From patchwork Fri Nov 11 15:04:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gertjan Halkes X-Patchwork-Id: 125186 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id B4DC31007D8 for ; Sat, 12 Nov 2011 02:04:44 +1100 (EST) Received: from localhost ([::1]:50404 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ROsen-0001SG-VG for incoming@patchwork.ozlabs.org; Fri, 11 Nov 2011 10:04:41 -0500 Received: from eggs.gnu.org ([140.186.70.92]:32986) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ROsef-0001Rs-Rh for qemu-devel@nongnu.org; Fri, 11 Nov 2011 10:04:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ROsee-0006vQ-IE for qemu-devel@nongnu.org; Fri, 11 Nov 2011 10:04:33 -0500 Received: from mail.otvi.nl ([178.21.19.65]:40376) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ROsee-0006uB-Dg; Fri, 11 Nov 2011 10:04:32 -0500 Received: from s51476e0b.adsl.wanadoo.nl ([81.71.110.11] helo=revolver) by mail.otvi.nl with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1ROsec-0008Fd-1j; Fri, 11 Nov 2011 16:04:30 +0100 Date: Fri, 11 Nov 2011 16:04:20 +0100 From: Gertjan Halkes To: Anthony Liguori Message-ID: <20111111160420.787aee5c@revolver> In-Reply-To: <4EBD3004.3080301@codemonkey.ws> References: <20111111125818.444e400b@revolver> <4EBD3004.3080301@codemonkey.ws> X-Mailer: Claws Mail 3.7.6 (GTK+ 2.22.0; x86_64-pc-linux-gnu) Mime-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6 (newer, 3) X-Received-From: 178.21.19.65 Cc: qemu-trivial@nongnu.org, qemu-devel@nongnu.org Subject: Re: [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org On Fri, 11 Nov 2011 08:24:04 -0600, Anthony Liguori wrote: >Please submit against qemu.git master with a Signed-off-by. Ok, here goes: This patch allows the hostfwd option to override the restrict=y setting in the user network stack, as explicitly stated in the documentation on the restrict option: restrict=on|off If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. Qemu bug tracker: https://bugs.launchpad.net/qemu/+bug/829455 Signed-off-by: Gertjan Halkes --- slirp/tcp_input.c | 28 +++++++++++++++++----------- 1 files changed, 17 insertions(+), 11 deletions(-) diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c index 942aaf4..ed09c27 100644 --- a/slirp/tcp_input.c +++ b/slirp/tcp_input.c @@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso) m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); - if (slirp->restricted) { - for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { - if (ex_ptr->ex_fport == ti->ti_dport && - ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { - break; - } - } - if (!ex_ptr) - goto drop; - } /* * Locate pcb for segment. */ @@ -354,7 +344,23 @@ findso: * the only flag set, then create a session, mark it * as if it was LISTENING, and continue... */ - if (so == NULL) { + if (so == NULL) { + if (slirp->restricted) { + /* Any hostfwds will have an existing socket, so we only get here + * for non-hostfwd connections. These should be dropped, unless it + * happens to be a guestfwd. + */ + for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { + if (ex_ptr->ex_fport == ti->ti_dport && + ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { + break; + } + } + if (!ex_ptr) { + goto dropwithreset; + } + } + if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN) goto dropwithreset;