From 68756ba8be2127b6ea30a466af9f78a5c97bc15f Mon Sep 17 00:00:00 2001 From: Bas van Sisseren Date: Mon, 3 Jun 2013 15:11:49 +0200 Subject: fix -net user checks by reordering checks reorder slirp config options. first check the dns-server-address, then check the first-dhcp-address. the original code was comparing the first-dhcp-address with the default dns-server-address, not the configured dns-server-address. Signed-off-by: Bas van Sisseren Signed-off-by: Jan Kiszka --- net/slirp.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/slirp.c b/net/slirp.c index b3f35d5861..124e953d9c 100644 --- a/net/slirp.c +++ b/net/slirp.c @@ -212,19 +212,19 @@ static int net_slirp_init(NetClientState *peer, const char *model, return -1; } - if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) { + if (vnameserver && !inet_aton(vnameserver, &dns)) { return -1; } - if ((dhcp.s_addr & mask.s_addr) != net.s_addr || - dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) { + if ((dns.s_addr & mask.s_addr) != net.s_addr || + dns.s_addr == host.s_addr) { return -1; } - if (vnameserver && !inet_aton(vnameserver, &dns)) { + if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) { return -1; } - if ((dns.s_addr & mask.s_addr) != net.s_addr || - dns.s_addr == host.s_addr) { + if ((dhcp.s_addr & mask.s_addr) != net.s_addr || + dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) { return -1; } -- cgit v1.2.1 From b5a87d26e848945eb891f4d7e4a7f2be514e08d5 Mon Sep 17 00:00:00 2001 From: Gertjan Halkes Date: Fri, 11 Nov 2011 16:04:20 +0100 Subject: make user networking hostfwd work with restrict=y This patch allows the hostfwd option to override the restrict=y setting in the user network stack, as explicitly stated in the documentation on the restrict option: restrict=on|off If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. Qemu bug tracker: https://bugs.launchpad.net/qemu/+bug/829455 Signed-off-by: Gertjan Halkes Signed-off-by: Jan Kiszka --- slirp/tcp_input.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c index 6440eae7fa..f946db8dc0 100644 --- a/slirp/tcp_input.c +++ b/slirp/tcp_input.c @@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso) m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); - if (slirp->restricted) { - for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { - if (ex_ptr->ex_fport == ti->ti_dport && - ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { - break; - } - } - if (!ex_ptr) - goto drop; - } /* * Locate pcb for segment. */ @@ -355,6 +345,22 @@ findso: * as if it was LISTENING, and continue... */ if (so == NULL) { + if (slirp->restricted) { + /* Any hostfwds will have an existing socket, so we only get here + * for non-hostfwd connections. These should be dropped, unless it + * happens to be a guestfwd. + */ + for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { + if (ex_ptr->ex_fport == ti->ti_dport && + ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { + break; + } + } + if (!ex_ptr) { + goto dropwithreset; + } + } + if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN) goto dropwithreset; -- cgit v1.2.1