make user networking hostfwd work with restrict=y
This patch allows the hostfwd option to override the restrict=y setting in the user network stack, as explicitly stated in the documentation on the restrict option: restrict=on|off If this option is enabled, the guest will be isolated, i.e. it will not be able to contact the host and no guest IP packets will be routed over the host to the outside. This option does not affect any explicitly set forwarding rules. Qemu bug tracker: https://bugs.launchpad.net/qemu/+bug/829455 Signed-off-by: Gertjan Halkes <qemu@ghalkes.nl> Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This commit is contained in:
parent
68756ba8be
commit
b5a87d26e8
@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso)
|
|||||||
m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
|
m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
|
||||||
m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
|
m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
|
||||||
|
|
||||||
if (slirp->restricted) {
|
|
||||||
for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
|
|
||||||
if (ex_ptr->ex_fport == ti->ti_dport &&
|
|
||||||
ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (!ex_ptr)
|
|
||||||
goto drop;
|
|
||||||
}
|
|
||||||
/*
|
/*
|
||||||
* Locate pcb for segment.
|
* Locate pcb for segment.
|
||||||
*/
|
*/
|
||||||
@ -355,6 +345,22 @@ findso:
|
|||||||
* as if it was LISTENING, and continue...
|
* as if it was LISTENING, and continue...
|
||||||
*/
|
*/
|
||||||
if (so == NULL) {
|
if (so == NULL) {
|
||||||
|
if (slirp->restricted) {
|
||||||
|
/* Any hostfwds will have an existing socket, so we only get here
|
||||||
|
* for non-hostfwd connections. These should be dropped, unless it
|
||||||
|
* happens to be a guestfwd.
|
||||||
|
*/
|
||||||
|
for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
|
||||||
|
if (ex_ptr->ex_fport == ti->ti_dport &&
|
||||||
|
ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (!ex_ptr) {
|
||||||
|
goto dropwithreset;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
|
if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
|
||||||
goto dropwithreset;
|
goto dropwithreset;
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user