slirp: Fix restricted mode

This aligns the code to what the documentation claims: Allow everything
but requests that would have to be routed outside of the virtual LAN.

So we need to drop the unneeded IP-level filter, allow TFTP requests,
and add the missing protocol-level filter to ICMP.

CC: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

3 files changed, 6 insertions, 25 deletions

diff --git a/ip_icmp.c b/ip_icmp.c
index f29d2b5..a678fc1 100644
--- a/ip_icmp.c
+++ b/ip_icmp.c
@@ -102,6 +102,8 @@ void icmp_input(struct mbuf *m, int hlen)
         ip->ip_len += hlen; /* since ip_input subtracts this */
         if (ip->ip_dst.s_addr == slirp->vhost_addr.s_addr) {
             icmp_reflect(m);
+        } else if (slirp->restricted) {
+            goto freeit;
         } else {
             struct socket *so;
             struct sockaddr_in addr;
diff --git a/ip_input.c b/ip_input.c
index dc7dd4d..dc5fd1e 100644
--- a/ip_input.c
+++ b/ip_input.c
@@ -115,27 +115,6 @@ void ip_input(struct mbuf *m)
         goto bad;
     }
 
-    if (slirp->restricted) {
-        if ((ip->ip_dst.s_addr & slirp->vnetwork_mask.s_addr) ==
-            slirp->vnetwork_addr.s_addr) {
-            if (ip->ip_dst.s_addr == 0xffffffff && ip->ip_p != IPPROTO_UDP)
-                goto bad;
-        } else {
-            uint32_t inv_mask = ~slirp->vnetwork_mask.s_addr;
-            struct ex_list *ex_ptr;
-
-            if ((ip->ip_dst.s_addr & inv_mask) == inv_mask) {
-                goto bad;
-            }
-            for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
-                if (ex_ptr->ex_addr.s_addr == ip->ip_dst.s_addr)
-                    break;
-
-            if (!ex_ptr)
-                goto bad;
-        }
-    }
-
     /* Should drop packet if mbuf too long? hmmm... */
     if (m->m_len > ip->ip_len)
         m_adj(m, ip->ip_len - m->m_len);
diff --git a/udp.c b/udp.c
index 8f053c6..3ba311d 100644
--- a/udp.c
+++ b/udp.c
@@ -123,10 +123,6 @@ void udp_input(register struct mbuf *m, int iphlen)
         goto bad;
     }
 
-    if (slirp->restricted) {
-        goto bad;
-    }
-
     /*
      *  handle TFTP
      */
@@ -135,6 +131,10 @@ void udp_input(register struct mbuf *m, int iphlen)
         goto bad;
     }
 
+    if (slirp->restricted) {
+        goto bad;
+    }
+
     /*
      * Locate pcb for datagram.
      */