From patchwork Thu Jan 26 14:42:24 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Corey Bryant X-Patchwork-Id: 138107 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 8A1C5B6F68 for ; Fri, 27 Jan 2012 13:02:48 +1100 (EST) Received: from localhost ([::1]:58082 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RqaHB-0007hC-Ka for incoming@patchwork.ozlabs.org; Thu, 26 Jan 2012 20:06:49 -0500 Received: from eggs.gnu.org ([140.186.70.92]:33389) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RqQYL-0004sH-5N for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:43:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RqQYE-0004T8-LJ for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:43:53 -0500 Received: from e36.co.us.ibm.com ([32.97.110.154]:43446) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RqQYE-0004RT-C2 for qemu-devel@nongnu.org; Thu, 26 Jan 2012 09:43:46 -0500 Received: from /spool/local by e36.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 26 Jan 2012 07:43:45 -0700 Received: from d03dlp02.boulder.ibm.com (9.17.202.178) by e36.co.us.ibm.com (192.168.1.136) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 26 Jan 2012 07:42:45 -0700 Received: from d03relay04.boulder.ibm.com (d03relay04.boulder.ibm.com [9.17.195.106]) by d03dlp02.boulder.ibm.com (Postfix) with ESMTP id 6587E3E40036 for ; Thu, 26 Jan 2012 07:42:44 -0700 (MST) Received: from d03av02.boulder.ibm.com (d03av02.boulder.ibm.com [9.17.195.168]) by d03relay04.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q0QEgVv3097724 for ; Thu, 26 Jan 2012 07:42:32 -0700 Received: from d03av02.boulder.ibm.com (loopback [127.0.0.1]) by d03av02.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q0QEgVOY022521 for ; Thu, 26 Jan 2012 07:42:31 -0700 Received: from localhost (sig-9-65-91-183.mts.ibm.com [9.65.91.183]) by d03av02.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q0QEgUGK022450; Thu, 26 Jan 2012 07:42:30 -0700 From: Corey Bryant To: qemu-devel@nongnu.org Date: Thu, 26 Jan 2012 09:42:24 -0500 Message-Id: <1327588947-4906-2-git-send-email-coreyb@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.3.4 In-Reply-To: <1327588947-4906-1-git-send-email-coreyb@linux.vnet.ibm.com> References: <1327588947-4906-1-git-send-email-coreyb@linux.vnet.ibm.com> X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12012614-3352-0000-0000-00000230973C X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 32.97.110.154 X-Mailman-Approved-At: Thu, 26 Jan 2012 20:06:11 -0500 Cc: aliguori@us.ibm.com, rmarwah@linux.vnet.ibm.com Subject: [Qemu-devel] [PATCH v8 1/4] Add basic version of bridge helper X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org This patch adds a helper that can be used to create a tap device attached to a bridge device. Since this helper is minimal in what it does, it can be given CAP_NET_ADMIN which allows qemu to avoid running as root while still satisfying the majority of what users tend to want to do with tap devices. The way this all works is that qemu launches this helper passing a bridge name and the name of an inherited file descriptor. The descriptor is one end of a socketpair() of domain sockets. This domain socket is used to transmit a file descriptor of the opened tap device from the helper to qemu. The helper can then exit and let qemu use the tap device. Signed-off-by: Anthony Liguori Signed-off-by: Richa Marwaha Signed-off-by: Corey Bryant --- Makefile | 12 +++- configure | 1 + qemu-bridge-helper.c | 221 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 232 insertions(+), 2 deletions(-) create mode 100644 qemu-bridge-helper.c diff --git a/Makefile b/Makefile index 917fb9b..aba3149 100644 --- a/Makefile +++ b/Makefile @@ -36,6 +36,8 @@ $(call set-vpath, $(SRC_PATH):$(SRC_PATH)/hw) LIBS+=-lz $(LIBS_TOOLS) +HELPERS-$(CONFIG_LINUX) = qemu-bridge-helper$(EXESUF) + ifdef BUILD_DOCS DOCS=qemu-doc.html qemu-tech.html qemu.1 qemu-img.1 qemu-nbd.8 QMP/qmp-commands.txt DOCS+=fsdev/virtfs-proxy-helper.1 @@ -77,7 +79,7 @@ defconfig: -include config-all-devices.mak -build-all: $(DOCS) $(TOOLS) recurse-all +build-all: $(DOCS) $(TOOLS) $(HELPERS-y) recurse-all config-host.h: config-host.h-timestamp config-host.h-timestamp: config-host.mak @@ -156,6 +158,8 @@ qemu-img$(EXESUF): qemu-img.o $(tools-obj-y) $(block-obj-y) qemu-nbd$(EXESUF): qemu-nbd.o $(tools-obj-y) $(block-obj-y) qemu-io$(EXESUF): qemu-io.o cmd.o $(tools-obj-y) $(block-obj-y) +qemu-bridge-helper$(EXESUF): qemu-bridge-helper.o + fsdev/virtfs-proxy-helper$(EXESUF): fsdev/virtfs-proxy-helper.o fsdev/virtio-9p-marshal.o oslib-posix.o $(trace-obj-y) fsdev/virtfs-proxy-helper$(EXESUF): LIBS += -lcap @@ -205,7 +209,7 @@ clean: # avoid old build problems by removing potentially incorrect old files rm -f config.mak op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h rm -f qemu-options.def - rm -f *.o *.d *.a *.lo $(TOOLS) qemu-ga TAGS cscope.* *.pod *~ */*~ + rm -f *.o *.d *.a *.lo $(TOOLS) $(HELPERS-y) qemu-ga TAGS cscope.* *.pod *~ */*~ rm -Rf .libs rm -f slirp/*.o slirp/*.d audio/*.o audio/*.d block/*.o block/*.d net/*.o net/*.d fsdev/*.o fsdev/*.d ui/*.o ui/*.d qapi/*.o qapi/*.d qga/*.o qga/*.d rm -f qemu-img-cmds.h @@ -278,6 +282,10 @@ install: all $(if $(BUILD_DOCS),install-doc) install-sysconfig ifneq ($(TOOLS),) $(INSTALL_PROG) $(STRIP_OPT) $(TOOLS) "$(DESTDIR)$(bindir)" endif +ifneq ($(HELPERS-y),) + $(INSTALL_DIR) "$(DESTDIR)$(libexecdir)" + $(INSTALL_PROG) $(STRIP_OPT) $(HELPERS-y) "$(DESTDIR)$(libexecdir)" +endif ifneq ($(BLOBS),) $(INSTALL_DIR) "$(DESTDIR)$(datadir)" set -e; for x in $(BLOBS); do \ diff --git a/configure b/configure index 9d5175b..66cc1b2 100755 --- a/configure +++ b/configure @@ -2896,6 +2896,7 @@ echo "datadir=$datadir" >> $config_host_mak echo "sysconfdir=$sysconfdir" >> $config_host_mak echo "docdir=$docdir" >> $config_host_mak echo "confdir=$confdir" >> $config_host_mak +echo "libexecdir=\${prefix}/libexec" >> $config_host_mak echo "ARCH=$ARCH" >> $config_host_mak if test "$debug_tcg" = "yes" ; then diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c new file mode 100644 index 0000000..48c5e22 --- /dev/null +++ b/qemu-bridge-helper.c @@ -0,0 +1,221 @@ +/* + * QEMU Bridge Helper + * + * Copyright IBM, Corp. 2011 + * + * Authors: + * Anthony Liguori + * Richa Marwaha + * Corey Bryant + * + * This work is licensed under the terms of the GNU GPL, version 2. See + * the COPYING file in the top-level directory. + * + */ + +#include "config-host.h" + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +#include + +#include + +#include "net/tap-linux.h" + +static void usage(void) +{ + fprintf(stderr, + "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n"); +} + +static bool has_vnet_hdr(int fd) +{ + unsigned int features = 0; + + if (ioctl(fd, TUNGETFEATURES, &features) == -1) { + return false; + } + + if (!(features & IFF_VNET_HDR)) { + return false; + } + + return true; +} + +static void prep_ifreq(struct ifreq *ifr, const char *ifname) +{ + memset(ifr, 0, sizeof(*ifr)); + snprintf(ifr->ifr_name, IFNAMSIZ, "%s", ifname); +} + +static int send_fd(int c, int fd) +{ + char msgbuf[CMSG_SPACE(sizeof(fd))]; + struct msghdr msg = { + .msg_control = msgbuf, + .msg_controllen = sizeof(msgbuf), + }; + struct cmsghdr *cmsg; + struct iovec iov; + char req[1] = { 0x00 }; + + cmsg = CMSG_FIRSTHDR(&msg); + cmsg->cmsg_level = SOL_SOCKET; + cmsg->cmsg_type = SCM_RIGHTS; + cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); + msg.msg_controllen = cmsg->cmsg_len; + + iov.iov_base = req; + iov.iov_len = sizeof(req); + + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); + + return sendmsg(c, &msg, 0); +} + +int main(int argc, char **argv) +{ + struct ifreq ifr; + int fd, ctlfd, unixfd = -1; + int use_vnet = 0; + int mtu; + const char *bridge = NULL; + char iface[IFNAMSIZ]; + int index; + int ret = EXIT_SUCCESS; + + /* parse arguments */ + for (index = 1; index < argc; index++) { + if (strcmp(argv[index], "--use-vnet") == 0) { + use_vnet = 1; + } else if (strncmp(argv[index], "--br=", 5) == 0) { + bridge = &argv[index][5]; + } else if (strncmp(argv[index], "--fd=", 5) == 0) { + unixfd = atoi(&argv[index][5]); + } else { + usage(); + return EXIT_FAILURE; + } + } + + if (bridge == NULL || unixfd == -1) { + usage(); + return EXIT_FAILURE; + } + + /* open a socket to use to control the network interfaces */ + ctlfd = socket(AF_INET, SOCK_STREAM, 0); + if (ctlfd == -1) { + fprintf(stderr, "failed to open control socket: %s\n", strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* open the tap device */ + fd = open("/dev/net/tun", O_RDWR); + if (fd == -1) { + fprintf(stderr, "failed to open /dev/net/tun: %s\n", strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* request a tap device, disable PI, and add vnet header support if + * requested and it's available. */ + prep_ifreq(&ifr, "tap%d"); + ifr.ifr_flags = IFF_TAP|IFF_NO_PI; + if (use_vnet && has_vnet_hdr(fd)) { + ifr.ifr_flags |= IFF_VNET_HDR; + } + + if (ioctl(fd, TUNSETIFF, &ifr) == -1) { + fprintf(stderr, "failed to create tun device: %s\n", strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* save tap device name */ + snprintf(iface, sizeof(iface), "%s", ifr.ifr_name); + + /* get the mtu of the bridge */ + prep_ifreq(&ifr, bridge); + if (ioctl(ctlfd, SIOCGIFMTU, &ifr) == -1) { + fprintf(stderr, "failed to get mtu of bridge `%s': %s\n", + bridge, strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* save mtu */ + mtu = ifr.ifr_mtu; + + /* set the mtu of the interface based on the bridge */ + prep_ifreq(&ifr, iface); + ifr.ifr_mtu = mtu; + if (ioctl(ctlfd, SIOCSIFMTU, &ifr) == -1) { + fprintf(stderr, "failed to set mtu of device `%s' to %d: %s\n", + iface, mtu, strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* add the interface to the bridge */ + prep_ifreq(&ifr, bridge); + ifr.ifr_ifindex = if_nametoindex(iface); + + if (ioctl(ctlfd, SIOCBRADDIF, &ifr) == -1) { + fprintf(stderr, "failed to add interface `%s' to bridge `%s': %s\n", + iface, bridge, strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* bring the interface up */ + prep_ifreq(&ifr, iface); + if (ioctl(ctlfd, SIOCGIFFLAGS, &ifr) == -1) { + fprintf(stderr, "failed to get interface flags for `%s': %s\n", + iface, strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + ifr.ifr_flags |= IFF_UP; + if (ioctl(ctlfd, SIOCSIFFLAGS, &ifr) == -1) { + fprintf(stderr, "failed to bring up interface `%s': %s\n", + iface, strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* write fd to the domain socket */ + if (send_fd(unixfd, fd) == -1) { + fprintf(stderr, "failed to write fd to unix socket: %s\n", + strerror(errno)); + ret = EXIT_FAILURE; + goto cleanup; + } + + /* ... */ + + /* profit! */ + +cleanup: + + return ret; +}