Age | Commit message (Collapse) | Author | Files | Lines |
|
Recent security issues demonstrate the lack of safety care when casting
a mbuf to a particular structure type. At least, it should check that
the buffer is large enough. The following patches will make use of this
function.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
This allows pings provided that the process is running as root (or has some
capability to create raw sockets).
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
mbuf: Add debugging helpers for allocation
See merge request slirp/libslirp!90
|
|
This adds a few helpers for debugging mbuf allocations when running in
debugging mode (lsan, valgrind, etc.)
- We do not want to cache allocations, so always set M_DOFREE to prevent
us from putting any mbuf in it.
- We want to update the mbuf allocation owner on function call for more
precise leak reporting.
Based on Jeremy Marchand's fuzzing work.
Signed-off-by: jeremy marchand <jeremy.marchand@etu.u-bordeaux.fr>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
ncsi: make ncsi_calculate_checksum work with unaligned data
Closes #43
See merge request slirp/libslirp!89
|
|
Fixes #43
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Found with the "codespell" utility.
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
|
|
We cannot let the guest crash libslirp by making it answer a tftp
request such as shown in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33873
https://gitlab.com/qemu-project/qemu/-/issues/111
unspecified addresses may also be used for non-configured devices, so it
makes sense to use the broadcast ethernet address in that case, just
like we do with IPv4.
|
|
The ALLOCA(3) man-page mentions its "use is discouraged".
For now get_dns_addr_resolv_conf() is called with pointer to
a in_addr/in6_addr structure, and its size. Declare a union
of these structures on the stack, able to hold both of them.
This allows us to remove the alloca() call, keeping the buffer
on the stack.
Add an assertion in the unlikely case another inet address
is handled by this function.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210507133212.1952121-1-philmd@redhat.com>
|
|
Perform lazy guest address resolution for IPv6
See merge request slirp/libslirp!81
|
|
Previously QEMU rejected IPv6 host-forward attempts that had an
unspecified guest address. This is because for IPv6 the guest's
IP address isn't necessarily known ahead of time: Libslirp only
provides a "stateless" DHCPv6 server, which if the macaddr is
random then the IPv6 address is random too.
This patch changes this to do the address resolution lazily, in the
hopes that the guest's IPv6 address is known at the time the user
wants to connect to the guest. The request can still fail if the
guest doesn't have an IPv6 address yet (e.g., it's still early in
the boot). Such requests are immediately rejected.
Signed-off-by: Doug Evans <dje@google.com>
|
|
Listen v6only
See merge request slirp/libslirp!77
|
|
tcpx_listen: tcp_newtcpcb doesn't fail
See merge request slirp/libslirp!79
|
|
Debugging bind/listen failures without errno can get painful.
Signed-off-by: Doug Evans <dje@google.com>
|
|
Signed-off-by: Doug Evans <dje@google.com>
|
|
They are superseded by slirp_add/remove_hostxfwd
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Move DEBUG_CALL("if_start") to DEBUG_VERBOSE_CALL
See merge request slirp/libslirp!78
|
|
That allows to request binding on v6 addresses only.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
This debugging printf reduces the overall S/N ratio of debug output
in the normal case, so separate it out.
Signed-off-by: Doug Evans <dje@google.com>
|
|
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
This actually makes most of the code simpler.
|
|
Neighbor info
See merge request slirp/libslirp!71
|
|
This will be called from QEMU to dump the ARP/NDP tables.
ndpentry.eth_addr type changed from unsigned char to uint8_t
to be consistent with other macaddr objects.
Ditto for slirp_arphdr.{ar_sha,ar_tha}.
Signed-off-by: Doug Evans <dje@google.com>
|
|
Was causing compilation failures with -Werror=missing-prototypes.
|
|
... and call it everywhere a macaddr is pretty-printed.
Signed-off-by: Doug Evans <dje@google.com>
|
|
|
|
|
|
Expose udpx_listen and tcpx_listen as taking sockaddr
See merge request slirp/libslirp!74
|
|
Disable polling for PRI on MacOS
Closes #35
See merge request slirp/libslirp!73
|
|
Fixes #35.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
This generalizes adding hostfwd, and opens the path for cross ipv4/6
forward.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
to get struct sbuf
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
|
|
|
|
This should ensure the lists are considered empty after the cleanup
|
|
m_cleanup didn't cleanup the if_batchq and if_fastq queues, resulting in
a memory leak.
|
|
|
|
mbufs added to the freelist shouldn't keep the M_EXT flag as they can be
recycled and the new owner could try to access the freed extended buffer.
|
|
When emitting NDP Neighbour Sollicitations, ip6_output immediately calls
if_encap without going through any queue. if_encap however does not free
the mbuf, so ip6_output has to do it.
This was leaking one mbuf per NDP NS sent by slirp. Hopefully the guest was
not using more than NDP_TABLE_SIZE (16) IPv6 addresses, in which case it was
limited to a bound number, but more addresses would result to leaks.
|
|
Libslirp currently only provides a stateless DHCPv6 server,
and thus can't do the "addr-any -> guest IP address" translation
that is done for ipv4. Until a stateful DHCPv6 server is available,
reject addr-any.
Signed-off-by: Doug Evans <dje@google.com>
|
|
Signed-off-by: Doug Evans <dje@google.com>
|
|
|
|
|
|
Add ipv6 host forward support
See merge request slirp/libslirp!62
|