diff options
author | aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162> | 2009-01-08 19:24:00 +0000 |
---|---|---|
committer | aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162> | 2009-01-08 19:24:00 +0000 |
commit | 27798c4bad6c56ce7faeefdc082fd501824c00bf (patch) | |
tree | 41fedaaa3c71d33e1435c878521c37563eaef404 | |
parent | 8a83e031bcc60c0fbfee518a265ee8b7c12c1e36 (diff) | |
download | slirp-27798c4bad6c56ce7faeefdc082fd501824c00bf.zip slirp-27798c4bad6c56ce7faeefdc082fd501824c00bf.tar.gz slirp-27798c4bad6c56ce7faeefdc082fd501824c00bf.tar.bz2 |
Add slirp_restrict option (Gleb Natapov)
Add "slirp firewall" to permit connection only to vmchannel addresses.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6241 c046a42c-6fe2-441c-8c8c-71466251a162
-rw-r--r-- | bootp.c | 22 | ||||
-rw-r--r-- | ip_input.c | 21 | ||||
-rw-r--r-- | libslirp.h | 2 | ||||
-rw-r--r-- | main.h | 2 | ||||
-rw-r--r-- | slirp.c | 10 | ||||
-rw-r--r-- | tcp_input.c | 11 | ||||
-rw-r--r-- | udp.c | 3 |
7 files changed, 57 insertions, 14 deletions
@@ -219,16 +219,18 @@ static void bootp_reply(struct bootp_t *bp) *q++ = 0xff; *q++ = 0x00; - *q++ = RFC1533_GATEWAY; - *q++ = 4; - memcpy(q, &saddr.sin_addr, 4); - q += 4; - - *q++ = RFC1533_DNS; - *q++ = 4; - dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS); - memcpy(q, &dns_addr, 4); - q += 4; + if (!slirp_restrict) { + *q++ = RFC1533_GATEWAY; + *q++ = 4; + memcpy(q, &saddr.sin_addr, 4); + q += 4; + + *q++ = RFC1533_DNS; + *q++ = 4; + dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS); + memcpy(q, &dns_addr, 4); + q += 4; + } *q++ = RFC2132_LEASE_TIME; *q++ = 4; @@ -132,6 +132,27 @@ void ip_input(m) struct mbuf *m; STAT(ipstat.ips_tooshort++); goto bad; } + + if (slirp_restrict) { + if (memcmp(&ip->ip_dst.s_addr, &special_addr, 3)) { + if (ip->ip_dst.s_addr == 0xffffffff && ip->ip_p != IPPROTO_UDP) + goto bad; + } else { + int host = ntohl(ip->ip_dst.s_addr) & 0xff; + struct ex_list *ex_ptr; + + if (host == 0xff) + goto bad; + + for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) + if (ex_ptr->ex_addr == host) + break; + + if (!ex_ptr) + goto bad; + } + } + /* Should drop packet if mbuf too long? hmmm... */ if (m->m_len > ip->ip_len) m_adj(m, ip->ip_len - m->m_len); @@ -5,7 +5,7 @@ extern "C" { #endif -void slirp_init(void); +void slirp_init(int restrict, char *special_ip); void slirp_select_fill(int *pnfds, fd_set *readfds, fd_set *writefds, fd_set *xfds); @@ -44,6 +44,8 @@ extern int towrite_max; extern int ppp_exit; extern int tcp_keepintvl; extern uint8_t client_ethaddr[6]; +extern char *slirp_special_ip; +extern int slirp_restrict; #define PROTO_SLIP 0x1 #ifdef USE_PPP @@ -46,6 +46,8 @@ static struct in_addr client_ipaddr; static const uint8_t zero_ethaddr[6] = { 0, 0, 0, 0, 0, 0 }; +char *slirp_special_ip = CTL_SPECIAL; +int slirp_restrict; int do_slowtimo; int link_up; struct timeval tt; @@ -164,7 +166,7 @@ static void slirp_cleanup(void) } #endif -void slirp_init(void) +void slirp_init(int restrict, char *special_ip) { // debug_init("/tmp/slirp.log", DEBUG_DEFAULT); @@ -177,6 +179,7 @@ void slirp_init(void) #endif link_up = 1; + slirp_restrict = restrict; if_init(); ip_init(); @@ -192,7 +195,10 @@ void slirp_init(void) fprintf(stderr, "Warning: No DNS servers found\n"); } - inet_aton(CTL_SPECIAL, &special_addr); + if (special_ip) + slirp_special_ip = special_ip; + + inet_aton(slirp_special_ip, &special_addr); alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS); getouraddr(); } diff --git a/tcp_input.c b/tcp_input.c index 41a3316..e22b460 100644 --- a/tcp_input.c +++ b/tcp_input.c @@ -255,6 +255,7 @@ struct socket *inso; u_long tiwin; int ret; /* int ts_present = 0; */ + struct ex_list *ex_ptr; DEBUG_CALL("tcp_input"); DEBUG_ARGS((dfd, " m = %8lx iphlen = %2d inso = %lx\n", (long)m, iphlen, @@ -365,6 +366,15 @@ struct socket *inso; m->m_data += sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr); + if (slirp_restrict) { + for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) + if (ex_ptr->ex_fport == ti->ti_dport && + (ntohl(ti->ti_dst.s_addr) & 0xff) == ex_ptr->ex_addr) + break; + + if (!ex_ptr) + goto drop; + } /* * Locate pcb for segment. */ @@ -645,7 +655,6 @@ findso: #endif { /* May be an add exec */ - struct ex_list *ex_ptr; for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { if (ex_ptr->ex_fport == so->so_fport && lastbyte == ex_ptr->ex_addr) { @@ -155,6 +155,9 @@ int iphlen; goto bad; } + if (slirp_restrict) + goto bad; + /* * handle TFTP */ |