From patchwork Wed Jun 19 10:47:29 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jan Kiszka X-Patchwork-Id: 252550 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id 6C1732C0182 for ; Wed, 19 Jun 2013 20:48:38 +1000 (EST) Received: from localhost ([::1]:33800 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UpFwK-0001Wh-Cf for incoming@patchwork.ozlabs.org; Wed, 19 Jun 2013 06:48:36 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48878) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UpFvU-0000ob-Kd for qemu-devel@nongnu.org; Wed, 19 Jun 2013 06:47:46 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UpFvS-0000Sq-Sr for qemu-devel@nongnu.org; Wed, 19 Jun 2013 06:47:44 -0400 Received: from thoth.sbs.de ([192.35.17.2]:24547) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UpFvS-0000Sb-It for qemu-devel@nongnu.org; Wed, 19 Jun 2013 06:47:42 -0400 Received: from mail1.siemens.de (localhost [127.0.0.1]) by thoth.sbs.de (8.13.6/8.13.6) with ESMTP id r5JAlWSg023287; Wed, 19 Jun 2013 12:47:32 +0200 Received: from mchn199C.mchp.siemens.de ([139.16.77.133]) by mail1.siemens.de (8.13.6/8.13.6) with ESMTP id r5JAlVmv013572; Wed, 19 Jun 2013 12:47:32 +0200 From: Jan Kiszka To: Anthony Liguori , qemu-devel Date: Wed, 19 Jun 2013 12:47:29 +0200 Message-Id: X-Mailer: git-send-email 1.7.3.4 In-Reply-To: References: In-Reply-To: References: X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x X-Received-From: 192.35.17.2 Cc: Gertjan Halkes Subject: [Qemu-devel] [PATCH 2/2] make user networking hostfwd work with restrict=y X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Gertjan Halkes This patch allows the hostfwd option to override the restrict=y setting in the user network stack, as explicitly stated in the documentation on the restrict option: restrict=on|off If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. Qemu bug tracker: https://bugs.launchpad.net/qemu/+bug/829455 Signed-off-by: Gertjan Halkes Signed-off-by: Jan Kiszka --- slirp/tcp_input.c | 26 ++++++++++++++++---------- 1 files changed, 16 insertions(+), 10 deletions(-) diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c index 6440eae..f946db8 100644 --- a/slirp/tcp_input.c +++ b/slirp/tcp_input.c @@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso) m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); - if (slirp->restricted) { - for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { - if (ex_ptr->ex_fport == ti->ti_dport && - ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { - break; - } - } - if (!ex_ptr) - goto drop; - } /* * Locate pcb for segment. */ @@ -355,6 +345,22 @@ findso: * as if it was LISTENING, and continue... */ if (so == NULL) { + if (slirp->restricted) { + /* Any hostfwds will have an existing socket, so we only get here + * for non-hostfwd connections. These should be dropped, unless it + * happens to be a guestfwd. + */ + for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { + if (ex_ptr->ex_fport == ti->ti_dport && + ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { + break; + } + } + if (!ex_ptr) { + goto dropwithreset; + } + } + if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN) goto dropwithreset;