4 * Copyright IBM, Corp. 2011
7 * Anthony Liguori <aliguori@us.ibm.com>
8 * Richa Marwaha <rmarwah@linux.vnet.ibm.com>
9 * Corey Bryant <coreyb@linux.vnet.ibm.com>
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
17 * - There is no manual page
18 * - The syntax of the ACL file is not documented anywhere
19 * - parse_acl_file() doesn't report fopen() failure properly, fails
20 * to check ferror() after fgets() failure, arbitrarily truncates
21 * long lines, handles whitespace inconsistently, error messages
22 * don't point to the offending file and line, errors in included
23 * files are reported, but otherwise ignored, ...
26 #include "qemu/osdep.h"
29 #include <sys/ioctl.h>
30 #include <sys/socket.h>
32 #include <sys/prctl.h>
36 #include <linux/sockios.h>
39 #include <linux/if_bridge.h>
42 #include "qemu/queue.h"
44 #include "net/tap-linux.h"
50 #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
59 typedef struct ACLRule
{
62 QSIMPLEQ_ENTRY(ACLRule
) entry
;
65 typedef QSIMPLEQ_HEAD(ACLList
, ACLRule
) ACLList
;
67 static void usage(void)
70 "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n");
73 static int parse_acl_file(const char *filename
, ACLList
*acl_list
)
79 f
= fopen(filename
, "r");
84 while (fgets(line
, sizeof(line
), f
) != NULL
) {
86 char *cmd
, *arg
, *argend
;
88 while (g_ascii_isspace(*ptr
)) {
92 /* skip comments and empty lines */
93 if (*ptr
== '#' || *ptr
== 0) {
98 arg
= strchr(cmd
, ' ');
100 arg
= strchr(cmd
, '\t');
104 fprintf(stderr
, "Invalid config line:\n %s\n", line
);
110 while (g_ascii_isspace(*arg
)) {
114 argend
= arg
+ strlen(arg
);
115 while (arg
!= argend
&& g_ascii_isspace(*(argend
- 1))) {
120 if (!g_str_equal(cmd
, "include") && strlen(arg
) >= IFNAMSIZ
) {
121 fprintf(stderr
, "name `%s' too long: %zu\n", arg
, strlen(arg
));
125 if (strcmp(cmd
, "deny") == 0) {
126 acl_rule
= g_malloc(sizeof(*acl_rule
));
127 if (strcmp(arg
, "all") == 0) {
128 acl_rule
->type
= ACL_DENY_ALL
;
130 acl_rule
->type
= ACL_DENY
;
131 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
133 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
134 } else if (strcmp(cmd
, "allow") == 0) {
135 acl_rule
= g_malloc(sizeof(*acl_rule
));
136 if (strcmp(arg
, "all") == 0) {
137 acl_rule
->type
= ACL_ALLOW_ALL
;
139 acl_rule
->type
= ACL_ALLOW
;
140 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
142 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
143 } else if (strcmp(cmd
, "include") == 0) {
145 parse_acl_file(arg
, acl_list
);
147 fprintf(stderr
, "Unknown command `%s'\n", cmd
);
162 static bool has_vnet_hdr(int fd
)
164 unsigned int features
= 0;
166 if (ioctl(fd
, TUNGETFEATURES
, &features
) == -1) {
170 if (!(features
& IFF_VNET_HDR
)) {
177 static void prep_ifreq(struct ifreq
*ifr
, const char *ifname
)
179 memset(ifr
, 0, sizeof(*ifr
));
180 snprintf(ifr
->ifr_name
, IFNAMSIZ
, "%s", ifname
);
183 static int send_fd(int c
, int fd
)
185 char msgbuf
[CMSG_SPACE(sizeof(fd
))];
186 struct msghdr msg
= {
187 .msg_control
= msgbuf
,
188 .msg_controllen
= sizeof(msgbuf
),
190 struct cmsghdr
*cmsg
;
192 char req
[1] = { 0x00 };
194 cmsg
= CMSG_FIRSTHDR(&msg
);
195 cmsg
->cmsg_level
= SOL_SOCKET
;
196 cmsg
->cmsg_type
= SCM_RIGHTS
;
197 cmsg
->cmsg_len
= CMSG_LEN(sizeof(fd
));
198 msg
.msg_controllen
= cmsg
->cmsg_len
;
201 iov
.iov_len
= sizeof(req
);
205 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(fd
));
207 return sendmsg(c
, &msg
, 0);
211 static int drop_privileges(void)
213 /* clear all capabilities */
214 capng_clear(CAPNG_SELECT_BOTH
);
216 if (capng_update(CAPNG_ADD
, CAPNG_EFFECTIVE
| CAPNG_PERMITTED
,
217 CAP_NET_ADMIN
) < 0) {
221 /* change to calling user's real uid and gid, retaining supplemental
222 * groups and CAP_NET_ADMIN */
223 if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING
)) {
231 int main(int argc
, char **argv
)
235 unsigned long ifargs
[4];
238 int fd
= -1, ctlfd
= -1, unixfd
= -1;
241 const char *bridge
= NULL
;
242 char iface
[IFNAMSIZ
];
246 int access_allowed
, access_denied
;
247 int ret
= EXIT_SUCCESS
;
250 /* if we're run from an suid binary, immediately drop privileges preserving
252 if (geteuid() == 0 && getuid() != geteuid()) {
253 if (drop_privileges() == -1) {
254 fprintf(stderr
, "failed to drop privileges\n");
260 /* parse arguments */
261 for (index
= 1; index
< argc
; index
++) {
262 if (strcmp(argv
[index
], "--use-vnet") == 0) {
264 } else if (strncmp(argv
[index
], "--br=", 5) == 0) {
265 bridge
= &argv
[index
][5];
266 } else if (strncmp(argv
[index
], "--fd=", 5) == 0) {
267 unixfd
= atoi(&argv
[index
][5]);
274 if (bridge
== NULL
|| unixfd
== -1) {
278 if (strlen(bridge
) >= IFNAMSIZ
) {
279 fprintf(stderr
, "name `%s' too long: %zu\n", bridge
, strlen(bridge
));
283 /* parse default acl file */
284 QSIMPLEQ_INIT(&acl_list
);
285 if (parse_acl_file(DEFAULT_ACL_FILE
, &acl_list
) == -1) {
286 fprintf(stderr
, "failed to parse default acl file `%s'\n",
292 /* validate bridge against acl -- default policy is to deny
293 * according acl policy if we have a deny and allow both
294 * then deny should always win over allow
298 QSIMPLEQ_FOREACH(acl_rule
, &acl_list
, entry
) {
299 switch (acl_rule
->type
) {
304 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
312 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
319 if ((access_allowed
== 0) || (access_denied
== 1)) {
320 fprintf(stderr
, "access denied by acl file\n");
325 /* open a socket to use to control the network interfaces */
326 ctlfd
= socket(AF_INET
, SOCK_STREAM
, 0);
328 fprintf(stderr
, "failed to open control socket: %s\n", strerror(errno
));
333 /* open the tap device */
334 fd
= open("/dev/net/tun", O_RDWR
);
336 fprintf(stderr
, "failed to open /dev/net/tun: %s\n", strerror(errno
));
341 /* request a tap device, disable PI, and add vnet header support if
342 * requested and it's available. */
343 prep_ifreq(&ifr
, "tap%d");
344 ifr
.ifr_flags
= IFF_TAP
|IFF_NO_PI
;
345 if (use_vnet
&& has_vnet_hdr(fd
)) {
346 ifr
.ifr_flags
|= IFF_VNET_HDR
;
349 if (ioctl(fd
, TUNSETIFF
, &ifr
) == -1) {
350 fprintf(stderr
, "failed to create tun device: %s\n", strerror(errno
));
355 /* save tap device name */
356 snprintf(iface
, sizeof(iface
), "%s", ifr
.ifr_name
);
358 /* get the mtu of the bridge */
359 prep_ifreq(&ifr
, bridge
);
360 if (ioctl(ctlfd
, SIOCGIFMTU
, &ifr
) == -1) {
361 fprintf(stderr
, "failed to get mtu of bridge `%s': %s\n",
362 bridge
, strerror(errno
));
370 /* set the mtu of the interface based on the bridge */
371 prep_ifreq(&ifr
, iface
);
373 if (ioctl(ctlfd
, SIOCSIFMTU
, &ifr
) == -1) {
374 fprintf(stderr
, "failed to set mtu of device `%s' to %d: %s\n",
375 iface
, mtu
, strerror(errno
));
380 /* Linux uses the lowest enslaved MAC address as the MAC address of
381 * the bridge. Set MAC address to a high value so that it doesn't
382 * affect the MAC address of the bridge.
384 if (ioctl(ctlfd
, SIOCGIFHWADDR
, &ifr
) < 0) {
385 fprintf(stderr
, "failed to get MAC address of device `%s': %s\n",
386 iface
, strerror(errno
));
390 ifr
.ifr_hwaddr
.sa_data
[0] = 0xFE;
391 if (ioctl(ctlfd
, SIOCSIFHWADDR
, &ifr
) < 0) {
392 fprintf(stderr
, "failed to set MAC address of device `%s': %s\n",
393 iface
, strerror(errno
));
398 /* add the interface to the bridge */
399 prep_ifreq(&ifr
, bridge
);
400 ifindex
= if_nametoindex(iface
);
402 ifargs
[0] = BRCTL_ADD_IF
;
406 ifr
.ifr_data
= (void *)ifargs
;
407 ret
= ioctl(ctlfd
, SIOCDEVPRIVATE
, &ifr
);
409 ifr
.ifr_ifindex
= ifindex
;
410 ret
= ioctl(ctlfd
, SIOCBRADDIF
, &ifr
);
413 fprintf(stderr
, "failed to add interface `%s' to bridge `%s': %s\n",
414 iface
, bridge
, strerror(errno
));
419 /* bring the interface up */
420 prep_ifreq(&ifr
, iface
);
421 if (ioctl(ctlfd
, SIOCGIFFLAGS
, &ifr
) == -1) {
422 fprintf(stderr
, "failed to get interface flags for `%s': %s\n",
423 iface
, strerror(errno
));
428 ifr
.ifr_flags
|= IFF_UP
;
429 if (ioctl(ctlfd
, SIOCSIFFLAGS
, &ifr
) == -1) {
430 fprintf(stderr
, "failed to bring up interface `%s': %s\n",
431 iface
, strerror(errno
));
436 /* write fd to the domain socket */
437 if (send_fd(unixfd
, fd
) == -1) {
438 fprintf(stderr
, "failed to write fd to unix socket: %s\n",
455 while ((acl_rule
= QSIMPLEQ_FIRST(&acl_list
)) != NULL
) {
456 QSIMPLEQ_REMOVE_HEAD(&acl_list
, entry
);