4 * Copyright IBM, Corp. 2011
7 * Anthony Liguori <aliguori@us.ibm.com>
8 * Richa Marwaha <rmarwah@linux.vnet.ibm.com>
9 * Corey Bryant <coreyb@linux.vnet.ibm.com>
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
16 #include "qemu/osdep.h"
19 #include <sys/ioctl.h>
20 #include <sys/socket.h>
22 #include <sys/prctl.h>
26 #include <linux/sockios.h>
29 #include <linux/if_bridge.h>
32 #include "qemu/queue.h"
34 #include "net/tap-linux.h"
40 #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
49 typedef struct ACLRule
{
52 QSIMPLEQ_ENTRY(ACLRule
) entry
;
55 typedef QSIMPLEQ_HEAD(ACLList
, ACLRule
) ACLList
;
57 static void usage(void)
60 "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n");
63 static int parse_acl_file(const char *filename
, ACLList
*acl_list
)
69 f
= fopen(filename
, "r");
74 while (fgets(line
, sizeof(line
), f
) != NULL
) {
76 char *cmd
, *arg
, *argend
;
78 while (isspace(*ptr
)) {
82 /* skip comments and empty lines */
83 if (*ptr
== '#' || *ptr
== 0) {
88 arg
= strchr(cmd
, ' ');
90 arg
= strchr(cmd
, '\t');
94 fprintf(stderr
, "Invalid config line:\n %s\n", line
);
102 while (isspace(*arg
)) {
106 argend
= arg
+ strlen(arg
);
107 while (arg
!= argend
&& isspace(*(argend
- 1))) {
112 if (!g_str_equal(cmd
, "include") && strlen(arg
) >= IFNAMSIZ
) {
113 fprintf(stderr
, "name `%s' too long: %zu\n", arg
, strlen(arg
));
119 if (strcmp(cmd
, "deny") == 0) {
120 acl_rule
= g_malloc(sizeof(*acl_rule
));
121 if (strcmp(arg
, "all") == 0) {
122 acl_rule
->type
= ACL_DENY_ALL
;
124 acl_rule
->type
= ACL_DENY
;
125 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
127 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
128 } else if (strcmp(cmd
, "allow") == 0) {
129 acl_rule
= g_malloc(sizeof(*acl_rule
));
130 if (strcmp(arg
, "all") == 0) {
131 acl_rule
->type
= ACL_ALLOW_ALL
;
133 acl_rule
->type
= ACL_ALLOW
;
134 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
136 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
137 } else if (strcmp(cmd
, "include") == 0) {
139 parse_acl_file(arg
, acl_list
);
141 fprintf(stderr
, "Unknown command `%s'\n", cmd
);
153 static bool has_vnet_hdr(int fd
)
155 unsigned int features
= 0;
157 if (ioctl(fd
, TUNGETFEATURES
, &features
) == -1) {
161 if (!(features
& IFF_VNET_HDR
)) {
168 static void prep_ifreq(struct ifreq
*ifr
, const char *ifname
)
170 memset(ifr
, 0, sizeof(*ifr
));
171 snprintf(ifr
->ifr_name
, IFNAMSIZ
, "%s", ifname
);
174 static int send_fd(int c
, int fd
)
176 char msgbuf
[CMSG_SPACE(sizeof(fd
))];
177 struct msghdr msg
= {
178 .msg_control
= msgbuf
,
179 .msg_controllen
= sizeof(msgbuf
),
181 struct cmsghdr
*cmsg
;
183 char req
[1] = { 0x00 };
185 cmsg
= CMSG_FIRSTHDR(&msg
);
186 cmsg
->cmsg_level
= SOL_SOCKET
;
187 cmsg
->cmsg_type
= SCM_RIGHTS
;
188 cmsg
->cmsg_len
= CMSG_LEN(sizeof(fd
));
189 msg
.msg_controllen
= cmsg
->cmsg_len
;
192 iov
.iov_len
= sizeof(req
);
196 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(fd
));
198 return sendmsg(c
, &msg
, 0);
202 static int drop_privileges(void)
204 /* clear all capabilities */
205 capng_clear(CAPNG_SELECT_BOTH
);
207 if (capng_update(CAPNG_ADD
, CAPNG_EFFECTIVE
| CAPNG_PERMITTED
,
208 CAP_NET_ADMIN
) < 0) {
212 /* change to calling user's real uid and gid, retaining supplemental
213 * groups and CAP_NET_ADMIN */
214 if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING
)) {
222 int main(int argc
, char **argv
)
226 unsigned long ifargs
[4];
229 int fd
= -1, ctlfd
= -1, unixfd
= -1;
232 const char *bridge
= NULL
;
233 char iface
[IFNAMSIZ
];
237 int access_allowed
, access_denied
;
238 int ret
= EXIT_SUCCESS
;
241 /* if we're run from an suid binary, immediately drop privileges preserving
243 if (geteuid() == 0 && getuid() != geteuid()) {
244 if (drop_privileges() == -1) {
245 fprintf(stderr
, "failed to drop privileges\n");
251 /* parse arguments */
252 for (index
= 1; index
< argc
; index
++) {
253 if (strcmp(argv
[index
], "--use-vnet") == 0) {
255 } else if (strncmp(argv
[index
], "--br=", 5) == 0) {
256 bridge
= &argv
[index
][5];
257 } else if (strncmp(argv
[index
], "--fd=", 5) == 0) {
258 unixfd
= atoi(&argv
[index
][5]);
265 if (bridge
== NULL
|| unixfd
== -1) {
269 if (strlen(bridge
) >= IFNAMSIZ
) {
270 fprintf(stderr
, "name `%s' too long: %zu\n", bridge
, strlen(bridge
));
274 /* parse default acl file */
275 QSIMPLEQ_INIT(&acl_list
);
276 if (parse_acl_file(DEFAULT_ACL_FILE
, &acl_list
) == -1) {
277 fprintf(stderr
, "failed to parse default acl file `%s'\n",
283 /* validate bridge against acl -- default policy is to deny
284 * according acl policy if we have a deny and allow both
285 * then deny should always win over allow
289 QSIMPLEQ_FOREACH(acl_rule
, &acl_list
, entry
) {
290 switch (acl_rule
->type
) {
295 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
303 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
310 if ((access_allowed
== 0) || (access_denied
== 1)) {
311 fprintf(stderr
, "access denied by acl file\n");
316 /* open a socket to use to control the network interfaces */
317 ctlfd
= socket(AF_INET
, SOCK_STREAM
, 0);
319 fprintf(stderr
, "failed to open control socket: %s\n", strerror(errno
));
324 /* open the tap device */
325 fd
= open("/dev/net/tun", O_RDWR
);
327 fprintf(stderr
, "failed to open /dev/net/tun: %s\n", strerror(errno
));
332 /* request a tap device, disable PI, and add vnet header support if
333 * requested and it's available. */
334 prep_ifreq(&ifr
, "tap%d");
335 ifr
.ifr_flags
= IFF_TAP
|IFF_NO_PI
;
336 if (use_vnet
&& has_vnet_hdr(fd
)) {
337 ifr
.ifr_flags
|= IFF_VNET_HDR
;
340 if (ioctl(fd
, TUNSETIFF
, &ifr
) == -1) {
341 fprintf(stderr
, "failed to create tun device: %s\n", strerror(errno
));
346 /* save tap device name */
347 snprintf(iface
, sizeof(iface
), "%s", ifr
.ifr_name
);
349 /* get the mtu of the bridge */
350 prep_ifreq(&ifr
, bridge
);
351 if (ioctl(ctlfd
, SIOCGIFMTU
, &ifr
) == -1) {
352 fprintf(stderr
, "failed to get mtu of bridge `%s': %s\n",
353 bridge
, strerror(errno
));
361 /* set the mtu of the interface based on the bridge */
362 prep_ifreq(&ifr
, iface
);
364 if (ioctl(ctlfd
, SIOCSIFMTU
, &ifr
) == -1) {
365 fprintf(stderr
, "failed to set mtu of device `%s' to %d: %s\n",
366 iface
, mtu
, strerror(errno
));
371 /* Linux uses the lowest enslaved MAC address as the MAC address of
372 * the bridge. Set MAC address to a high value so that it doesn't
373 * affect the MAC address of the bridge.
375 if (ioctl(ctlfd
, SIOCGIFHWADDR
, &ifr
) < 0) {
376 fprintf(stderr
, "failed to get MAC address of device `%s': %s\n",
377 iface
, strerror(errno
));
381 ifr
.ifr_hwaddr
.sa_data
[0] = 0xFE;
382 if (ioctl(ctlfd
, SIOCSIFHWADDR
, &ifr
) < 0) {
383 fprintf(stderr
, "failed to set MAC address of device `%s': %s\n",
384 iface
, strerror(errno
));
389 /* add the interface to the bridge */
390 prep_ifreq(&ifr
, bridge
);
391 ifindex
= if_nametoindex(iface
);
393 ifargs
[0] = BRCTL_ADD_IF
;
397 ifr
.ifr_data
= (void *)ifargs
;
398 ret
= ioctl(ctlfd
, SIOCDEVPRIVATE
, &ifr
);
400 ifr
.ifr_ifindex
= ifindex
;
401 ret
= ioctl(ctlfd
, SIOCBRADDIF
, &ifr
);
404 fprintf(stderr
, "failed to add interface `%s' to bridge `%s': %s\n",
405 iface
, bridge
, strerror(errno
));
410 /* bring the interface up */
411 prep_ifreq(&ifr
, iface
);
412 if (ioctl(ctlfd
, SIOCGIFFLAGS
, &ifr
) == -1) {
413 fprintf(stderr
, "failed to get interface flags for `%s': %s\n",
414 iface
, strerror(errno
));
419 ifr
.ifr_flags
|= IFF_UP
;
420 if (ioctl(ctlfd
, SIOCSIFFLAGS
, &ifr
) == -1) {
421 fprintf(stderr
, "failed to bring up interface `%s': %s\n",
422 iface
, strerror(errno
));
427 /* write fd to the domain socket */
428 if (send_fd(unixfd
, fd
) == -1) {
429 fprintf(stderr
, "failed to write fd to unix socket: %s\n",
446 while ((acl_rule
= QSIMPLEQ_FIRST(&acl_list
)) != NULL
) {
447 QSIMPLEQ_REMOVE_HEAD(&acl_list
, entry
);