net.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include <unistd.h>
  25 #include <fcntl.h>
  26 #include <signal.h>
  27 #include <time.h>
  28 #include <errno.h>
  29 #include <sys/time.h>
  30 #include <zlib.h>
  31
  32 /* Needed early for CONFIG_BSD etc. */
  33 #include "config-host.h"
  34
  35 #ifndef _WIN32
  36 #include <sys/times.h>
  37 #include <sys/wait.h>
  38 #include <termios.h>
  39 #include <sys/mman.h>
  40 #include <sys/ioctl.h>
  41 #include <sys/resource.h>
  42 #include <sys/socket.h>
  43 #include <netinet/in.h>
  44 #include <net/if.h>
  45 #ifdef __NetBSD__
  46 #include <net/if_tap.h>
  47 #endif
  48 #ifdef __linux__
  49 #include <linux/if_tun.h>
  50 #endif
  51 #include <arpa/inet.h>
  52 #include <dirent.h>
  53 #include <netdb.h>
  54 #include <sys/select.h>
  55 #ifdef CONFIG_BSD
  56 #include <sys/stat.h>
  57 #if defined(__FreeBSD__) || defined(__DragonFly__)
  58 #include <libutil.h>
  59 #else
  60 #include <util.h>
  61 #endif
  62 #elif defined (__GLIBC__) && defined (__FreeBSD_kernel__)
  63 #include <freebsd/stdlib.h>
  64 #else
  65 #ifdef __linux__
  66 #include <pty.h>
  67 #include <malloc.h>
  68 #include <linux/rtc.h>
  69
  70 /* For the benefit of older linux systems which don't supply it,
  71    we use a local copy of hpet.h. */
  72 /* #include <linux/hpet.h> */
  73 #include "hpet.h"
  74
  75 #include <linux/ppdev.h>
  76 #include <linux/parport.h>
  77 #endif
  78 #ifdef __sun__
  79 #include <sys/stat.h>
  80 #include <sys/ethernet.h>
  81 #include <sys/sockio.h>
  82 #include <netinet/arp.h>
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/ip_icmp.h> // must come after ip.h
  87 #include <netinet/udp.h>
  88 #include <netinet/tcp.h>
  89 #include <net/if.h>
  90 #include <syslog.h>
  91 #include <stropts.h>
  92 #endif
  93 #endif
  94 #endif
  95
  96 #if defined(__OpenBSD__)
  97 #include <util.h>
  98 #endif
  99
 100 #if defined(CONFIG_VDE)
 101 #include <libvdeplug.h>
 102 #endif
 103
 104 #include "qemu-common.h"
 105 #include "net.h"
 106 #include "monitor.h"
 107 #include "sysemu.h"
 108 #include "qemu-timer.h"
 109 #include "qemu-char.h"
 110 #include "audio/audio.h"
 111 #include "qemu_socket.h"
 112 #include "qemu-log.h"
 113 #include "qemu-config.h"
 114
 115 #include "slirp/libslirp.h"
 116
 117 static QTAILQ_HEAD(, VLANState) vlans;
 118
 119 /***********************************************************/
 120 /* network device redirectors */
 121
 122 #if defined(DEBUG_NET) || defined(DEBUG_SLIRP)
 123 static void hex_dump(FILE *f, const uint8_t *buf, int size)
 124 {
 125     int len, i, j, c;
 126
 127     for(i=0;i<size;i+=16) {
 128         len = size - i;
 129         if (len > 16)
 130             len = 16;
 131         fprintf(f, "%08x ", i);
 132         for(j=0;j<16;j++) {
 133             if (j < len)
 134                 fprintf(f, " %02x", buf[i+j]);
 135             else
 136                 fprintf(f, "   ");
 137         }
 138         fprintf(f, " ");
 139         for(j=0;j<len;j++) {
 140             c = buf[i+j];
 141             if (c < ' ' || c > '~')
 142                 c = '.';
 143             fprintf(f, "%c", c);
 144         }
 145         fprintf(f, "\n");
 146     }
 147 }
 148 #endif
 149
 150 static int parse_macaddr(uint8_t *macaddr, const char *p)
 151 {
 152     int i;
 153     char *last_char;
 154     long int offset;
 155
 156     errno = 0;
 157     offset = strtol(p, &last_char, 0);
 158     if (0 == errno && '\0' == *last_char &&
 159             offset >= 0 && offset <= 0xFFFFFF) {
 160         macaddr[3] = (offset & 0xFF0000) >> 16;
 161         macaddr[4] = (offset & 0xFF00) >> 8;
 162         macaddr[5] = offset & 0xFF;
 163         return 0;
 164     } else {
 165         for(i = 0; i < 6; i++) {
 166             macaddr[i] = strtol(p, (char **)&p, 16);
 167             if (i == 5) {
 168                 if (*p != '\0')
 169                     return -1;
 170             } else {
 171                 if (*p != ':' && *p != '-')
 172                     return -1;
 173                 p++;
 174             }
 175         }
 176         return 0;
 177     }
 178
 179     return -1;
 180 }
 181
 182 static int get_str_sep(char *buf, int buf_size, const char **pp, int sep)
 183 {
 184     const char *p, *p1;
 185     int len;
 186     p = *pp;
 187     p1 = strchr(p, sep);
 188     if (!p1)
 189         return -1;
 190     len = p1 - p;
 191     p1++;
 192     if (buf_size > 0) {
 193         if (len > buf_size - 1)
 194             len = buf_size - 1;
 195         memcpy(buf, p, len);
 196         buf[len] = '\0';
 197     }
 198     *pp = p1;
 199     return 0;
 200 }
 201
 202 int parse_host_src_port(struct sockaddr_in *haddr,
 203                         struct sockaddr_in *saddr,
 204                         const char *input_str)
 205 {
 206     char *str = strdup(input_str);
 207     char *host_str = str;
 208     char *src_str;
 209     const char *src_str2;
 210     char *ptr;
 211
 212     /*
 213      * Chop off any extra arguments at the end of the string which
 214      * would start with a comma, then fill in the src port information
 215      * if it was provided else use the "any address" and "any port".
 216      */
 217     if ((ptr = strchr(str,',')))
 218         *ptr = '\0';
 219
 220     if ((src_str = strchr(input_str,'@'))) {
 221         *src_str = '\0';
 222         src_str++;
 223     }
 224
 225     if (parse_host_port(haddr, host_str) < 0)
 226         goto fail;
 227
 228     src_str2 = src_str;
 229     if (!src_str || *src_str == '\0')
 230         src_str2 = ":0";
 231
 232     if (parse_host_port(saddr, src_str2) < 0)
 233         goto fail;
 234
 235     free(str);
 236     return(0);
 237
 238 fail:
 239     free(str);
 240     return -1;
 241 }
 242
 243 int parse_host_port(struct sockaddr_in *saddr, const char *str)
 244 {
 245     char buf[512];
 246     struct hostent *he;
 247     const char *p, *r;
 248     int port;
 249
 250     p = str;
 251     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0)
 252         return -1;
 253     saddr->sin_family = AF_INET;
 254     if (buf[0] == '\0') {
 255         saddr->sin_addr.s_addr = 0;
 256     } else {
 257         if (qemu_isdigit(buf[0])) {
 258             if (!inet_aton(buf, &saddr->sin_addr))
 259                 return -1;
 260         } else {
 261             if ((he = gethostbyname(buf)) == NULL)
 262                 return - 1;
 263             saddr->sin_addr = *(struct in_addr *)he->h_addr;
 264         }
 265     }
 266     port = strtol(p, (char **)&r, 0);
 267     if (r == p)
 268         return -1;
 269     saddr->sin_port = htons(port);
 270     return 0;
 271 }
 272
 273 void qemu_format_nic_info_str(VLANClientState *vc, uint8_t macaddr[6])
 274 {
 275     snprintf(vc->info_str, sizeof(vc->info_str),
 276              "model=%s,macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
 277              vc->model,
 278              macaddr[0], macaddr[1], macaddr[2],
 279              macaddr[3], macaddr[4], macaddr[5]);
 280 }
 281
 282 static char *assign_name(VLANClientState *vc1, const char *model)
 283 {
 284     VLANState *vlan;
 285     char buf[256];
 286     int id = 0;
 287
 288     QTAILQ_FOREACH(vlan, &vlans, next) {
 289         VLANClientState *vc;
 290
 291         QTAILQ_FOREACH(vc, &vlan->clients, next) {
 292             if (vc != vc1 && strcmp(vc->model, model) == 0) {
 293                 id++;
 294             }
 295         }
 296     }
 297
 298     snprintf(buf, sizeof(buf), "%s.%d", model, id);
 299
 300     return qemu_strdup(buf);
 301 }
 302
 303 VLANClientState *qemu_new_vlan_client(VLANState *vlan,
 304                                       const char *model,
 305                                       const char *name,
 306                                       NetCanReceive *can_receive,
 307                                       NetReceive *receive,
 308                                       NetReceiveIOV *receive_iov,
 309                                       NetCleanup *cleanup,
 310                                       void *opaque)
 311 {
 312     VLANClientState *vc;
 313
 314     vc = qemu_mallocz(sizeof(VLANClientState));
 315
 316     vc->model = qemu_strdup(model);
 317     if (name)
 318         vc->name = qemu_strdup(name);
 319     else
 320         vc->name = assign_name(vc, model);
 321     vc->can_receive = can_receive;
 322     vc->receive = receive;
 323     vc->receive_iov = receive_iov;
 324     vc->cleanup = cleanup;
 325     vc->opaque = opaque;
 326
 327     if (vlan) {
 328         vc->vlan = vlan;
 329         QTAILQ_INSERT_TAIL(&vc->vlan->clients, vc, next);
 330     }
 331
 332     return vc;
 333 }
 334
 335 void qemu_del_vlan_client(VLANClientState *vc)
 336 {
 337     if (vc->vlan) {
 338         QTAILQ_REMOVE(&vc->vlan->clients, vc, next);
 339     }
 340
 341     if (vc->cleanup) {
 342         vc->cleanup(vc);
 343     }
 344
 345     qemu_free(vc->name);
 346     qemu_free(vc->model);
 347     qemu_free(vc);
 348 }
 349
 350 VLANClientState *qemu_find_vlan_client(VLANState *vlan, void *opaque)
 351 {
 352     VLANClientState *vc;
 353
 354     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 355         if (vc->opaque == opaque) {
 356             return vc;
 357         }
 358     }
 359
 360     return NULL;
 361 }
 362
 363 static VLANClientState *
 364 qemu_find_vlan_client_by_name(Monitor *mon, int vlan_id,
 365                               const char *client_str)
 366 {
 367     VLANState *vlan;
 368     VLANClientState *vc;
 369
 370     vlan = qemu_find_vlan(vlan_id, 0);
 371     if (!vlan) {
 372         monitor_printf(mon, "unknown VLAN %d\n", vlan_id);
 373         return NULL;
 374     }
 375
 376     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 377         if (!strcmp(vc->name, client_str)) {
 378             break;
 379         }
 380     }
 381     if (!vc) {
 382         monitor_printf(mon, "can't find device %s on VLAN %d\n",
 383                        client_str, vlan_id);
 384     }
 385
 386     return vc;
 387 }
 388
 389 int qemu_can_send_packet(VLANClientState *sender)
 390 {
 391     VLANState *vlan = sender->vlan;
 392     VLANClientState *vc;
 393
 394     if (!sender->vlan) {
 395         return 1;
 396     }
 397
 398     QTAILQ_FOREACH(vc, &vlan->clients, next) {
 399         if (vc == sender) {
 400             continue;
 401         }
 402
 403         /* no can_receive() handler, they can always receive */
 404         if (!vc->can_receive || vc->can_receive(vc)) {
 405             return 1;
 406         }
 407     }
 408     return 0;
 409 }
 410
 411 static int
 412 qemu_deliver_packet(VLANClientState *sender, const uint8_t *buf, int size)
 413 {
 414     VLANClientState *vc;
 415     int ret = -1;
 416
 417     sender->vlan->delivering = 1;
 418
 419     QTAILQ_FOREACH(vc, &sender->vlan->clients, next) {
 420         ssize_t len;
 421
 422         if (vc == sender) {
 423             continue;
 424         }
 425
 426         if (vc->link_down) {
 427             ret = size;
 428             continue;
 429         }
 430
 431         len = vc->receive(vc, buf, size);
 432
 433         ret = (ret >= 0) ? ret : len;
 434     }
 435
 436     sender->vlan->delivering = 0;
 437
 438     return ret;
 439 }
 440
 441 void qemu_purge_queued_packets(VLANClientState *vc)
 442 {
 443     VLANPacket *packet, *next;
 444
 445     if (!vc->vlan)
 446         return;
 447
 448     QTAILQ_FOREACH_SAFE(packet, &vc->vlan->send_queue, entry, next) {
 449         if (packet->sender == vc) {
 450             QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 451             qemu_free(packet);
 452         }
 453     }
 454 }
 455
 456 void qemu_flush_queued_packets(VLANClientState *vc)
 457 {
 458     if (!vc->vlan)
 459         return;
 460
 461     while (!QTAILQ_EMPTY(&vc->vlan->send_queue)) {
 462         VLANPacket *packet;
 463         int ret;
 464
 465         packet = QTAILQ_FIRST(&vc->vlan->send_queue);
 466         QTAILQ_REMOVE(&vc->vlan->send_queue, packet, entry);
 467
 468         ret = qemu_deliver_packet(packet->sender, packet->data, packet->size);
 469         if (ret == 0 && packet->sent_cb != NULL) {
 470             QTAILQ_INSERT_HEAD(&vc->vlan->send_queue, packet, entry);
 471             break;
 472         }
 473
 474         if (packet->sent_cb)
 475             packet->sent_cb(packet->sender, ret);
 476
 477         qemu_free(packet);
 478     }
 479 }
 480
 481 static void qemu_enqueue_packet(VLANClientState *sender,
 482                                 const uint8_t *buf, int size,
 483                                 NetPacketSent *sent_cb)
 484 {
 485     VLANPacket *packet;
 486
 487     packet = qemu_malloc(sizeof(VLANPacket) + size);
 488     packet->sender = sender;
 489     packet->size = size;
 490     packet->sent_cb = sent_cb;
 491     memcpy(packet->data, buf, size);
 492
 493     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 494 }
 495
 496 ssize_t qemu_send_packet_async(VLANClientState *sender,
 497                                const uint8_t *buf, int size,
 498                                NetPacketSent *sent_cb)
 499 {
 500     int ret;
 501
 502     if (sender->link_down || !sender->vlan) {
 503         return size;
 504     }
 505
 506 #ifdef DEBUG_NET
 507     printf("qemu_send_packet_async:\n");
 508     hex_dump(stdout, buf, size);
 509 #endif
 510
 511     if (sender->vlan->delivering) {
 512         qemu_enqueue_packet(sender, buf, size, NULL);
 513         return size;
 514     }
 515
 516     ret = qemu_deliver_packet(sender, buf, size);
 517     if (ret == 0 && sent_cb != NULL) {
 518         qemu_enqueue_packet(sender, buf, size, sent_cb);
 519         return 0;
 520     }
 521
 522     qemu_flush_queued_packets(sender);
 523
 524     return ret;
 525 }
 526
 527 void qemu_send_packet(VLANClientState *vc, const uint8_t *buf, int size)
 528 {
 529     qemu_send_packet_async(vc, buf, size, NULL);
 530 }
 531
 532 static ssize_t vc_sendv_compat(VLANClientState *vc, const struct iovec *iov,
 533                                int iovcnt)
 534 {
 535     uint8_t buffer[4096];
 536     size_t offset = 0;
 537     int i;
 538
 539     for (i = 0; i < iovcnt; i++) {
 540         size_t len;
 541
 542         len = MIN(sizeof(buffer) - offset, iov[i].iov_len);
 543         memcpy(buffer + offset, iov[i].iov_base, len);
 544         offset += len;
 545     }
 546
 547     return vc->receive(vc, buffer, offset);
 548 }
 549
 550 static ssize_t calc_iov_length(const struct iovec *iov, int iovcnt)
 551 {
 552     size_t offset = 0;
 553     int i;
 554
 555     for (i = 0; i < iovcnt; i++)
 556         offset += iov[i].iov_len;
 557     return offset;
 558 }
 559
 560 static int qemu_deliver_packet_iov(VLANClientState *sender,
 561                                    const struct iovec *iov, int iovcnt)
 562 {
 563     VLANClientState *vc;
 564     int ret = -1;
 565
 566     sender->vlan->delivering = 1;
 567
 568     QTAILQ_FOREACH(vc, &sender->vlan->clients, next) {
 569         ssize_t len;
 570
 571         if (vc == sender) {
 572             continue;
 573         }
 574
 575         if (vc->link_down) {
 576             ret = calc_iov_length(iov, iovcnt);
 577             continue;
 578         }
 579
 580         if (vc->receive_iov) {
 581             len = vc->receive_iov(vc, iov, iovcnt);
 582         } else {
 583             len = vc_sendv_compat(vc, iov, iovcnt);
 584         }
 585
 586         ret = (ret >= 0) ? ret : len;
 587     }
 588
 589     sender->vlan->delivering = 0;
 590
 591     return ret;
 592 }
 593
 594 static ssize_t qemu_enqueue_packet_iov(VLANClientState *sender,
 595                                        const struct iovec *iov, int iovcnt,
 596                                        NetPacketSent *sent_cb)
 597 {
 598     VLANPacket *packet;
 599     size_t max_len = 0;
 600     int i;
 601
 602     max_len = calc_iov_length(iov, iovcnt);
 603
 604     packet = qemu_malloc(sizeof(VLANPacket) + max_len);
 605     packet->sender = sender;
 606     packet->sent_cb = sent_cb;
 607     packet->size = 0;
 608
 609     for (i = 0; i < iovcnt; i++) {
 610         size_t len = iov[i].iov_len;
 611
 612         memcpy(packet->data + packet->size, iov[i].iov_base, len);
 613         packet->size += len;
 614     }
 615
 616     QTAILQ_INSERT_TAIL(&sender->vlan->send_queue, packet, entry);
 617
 618     return packet->size;
 619 }
 620
 621 ssize_t qemu_sendv_packet_async(VLANClientState *sender,
 622                                 const struct iovec *iov, int iovcnt,
 623                                 NetPacketSent *sent_cb)
 624 {
 625     int ret;
 626
 627     if (sender->link_down || !sender->vlan) {
 628         return calc_iov_length(iov, iovcnt);
 629     }
 630
 631     if (sender->vlan->delivering) {
 632         return qemu_enqueue_packet_iov(sender, iov, iovcnt, NULL);
 633     }
 634
 635     ret = qemu_deliver_packet_iov(sender, iov, iovcnt);
 636     if (ret == 0 && sent_cb != NULL) {
 637         qemu_enqueue_packet_iov(sender, iov, iovcnt, sent_cb);
 638         return 0;
 639     }
 640
 641     qemu_flush_queued_packets(sender);
 642
 643     return ret;
 644 }
 645
 646 ssize_t
 647 qemu_sendv_packet(VLANClientState *vc, const struct iovec *iov, int iovcnt)
 648 {
 649     return qemu_sendv_packet_async(vc, iov, iovcnt, NULL);
 650 }
 651
 652 #if defined(CONFIG_SLIRP)
 653
 654 /* slirp network adapter */
 655
 656 #define SLIRP_CFG_HOSTFWD 1
 657 #define SLIRP_CFG_LEGACY  2
 658
 659 struct slirp_config_str {
 660     struct slirp_config_str *next;
 661     int flags;
 662     char str[1024];
 663     int legacy_format;
 664 };
 665
 666 typedef struct SlirpState {
 667     QTAILQ_ENTRY(SlirpState) entry;
 668     VLANClientState *vc;
 669     Slirp *slirp;
 670 #ifndef _WIN32
 671     char smb_dir[128];
 672 #endif
 673 } SlirpState;
 674
 675 static struct slirp_config_str *slirp_configs;
 676 const char *legacy_tftp_prefix;
 677 const char *legacy_bootp_filename;
 678 static QTAILQ_HEAD(slirp_stacks, SlirpState) slirp_stacks =
 679     QTAILQ_HEAD_INITIALIZER(slirp_stacks);
 680
 681 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 682                          int legacy_format);
 683 static int slirp_guestfwd(SlirpState *s, const char *config_str,
 684                           int legacy_format);
 685
 686 #ifndef _WIN32
 687 static const char *legacy_smb_export;
 688
 689 static int slirp_smb(SlirpState *s, const char *exported_dir,
 690                      struct in_addr vserver_addr);
 691 static void slirp_smb_cleanup(SlirpState *s);
 692 #else
 693 static inline void slirp_smb_cleanup(SlirpState *s) { }
 694 #endif
 695
 696 int slirp_can_output(void *opaque)
 697 {
 698     SlirpState *s = opaque;
 699
 700     return qemu_can_send_packet(s->vc);
 701 }
 702
 703 void slirp_output(void *opaque, const uint8_t *pkt, int pkt_len)
 704 {
 705     SlirpState *s = opaque;
 706
 707 #ifdef DEBUG_SLIRP
 708     printf("slirp output:\n");
 709     hex_dump(stdout, pkt, pkt_len);
 710 #endif
 711     qemu_send_packet(s->vc, pkt, pkt_len);
 712 }
 713
 714 static ssize_t slirp_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
 715 {
 716     SlirpState *s = vc->opaque;
 717
 718 #ifdef DEBUG_SLIRP
 719     printf("slirp input:\n");
 720     hex_dump(stdout, buf, size);
 721 #endif
 722     slirp_input(s->slirp, buf, size);
 723     return size;
 724 }
 725
 726 static void net_slirp_cleanup(VLANClientState *vc)
 727 {
 728     SlirpState *s = vc->opaque;
 729
 730     slirp_cleanup(s->slirp);
 731     slirp_smb_cleanup(s);
 732     QTAILQ_REMOVE(&slirp_stacks, s, entry);
 733     qemu_free(s);
 734 }
 735
 736 static int net_slirp_init(VLANState *vlan, const char *model,
 737                           const char *name, int restricted,
 738                           const char *vnetwork, const char *vhost,
 739                           const char *vhostname, const char *tftp_export,
 740                           const char *bootfile, const char *vdhcp_start,
 741                           const char *vnameserver, const char *smb_export,
 742                           const char *vsmbserver)
 743 {
 744     /* default settings according to historic slirp */
 745     struct in_addr net  = { .s_addr = htonl(0x0a000200) }; /* 10.0.2.0 */
 746     struct in_addr mask = { .s_addr = htonl(0xffffff00) }; /* 255.255.255.0 */
 747     struct in_addr host = { .s_addr = htonl(0x0a000202) }; /* 10.0.2.2 */
 748     struct in_addr dhcp = { .s_addr = htonl(0x0a00020f) }; /* 10.0.2.15 */
 749     struct in_addr dns  = { .s_addr = htonl(0x0a000203) }; /* 10.0.2.3 */
 750 #ifndef _WIN32
 751     struct in_addr smbsrv = { .s_addr = 0 };
 752 #endif
 753     SlirpState *s;
 754     char buf[20];
 755     uint32_t addr;
 756     int shift;
 757     char *end;
 758     struct slirp_config_str *config;
 759
 760     if (!tftp_export) {
 761         tftp_export = legacy_tftp_prefix;
 762     }
 763     if (!bootfile) {
 764         bootfile = legacy_bootp_filename;
 765     }
 766
 767     if (vnetwork) {
 768         if (get_str_sep(buf, sizeof(buf), &vnetwork, '/') < 0) {
 769             if (!inet_aton(vnetwork, &net)) {
 770                 return -1;
 771             }
 772             addr = ntohl(net.s_addr);
 773             if (!(addr & 0x80000000)) {
 774                 mask.s_addr = htonl(0xff000000); /* class A */
 775             } else if ((addr & 0xfff00000) == 0xac100000) {
 776                 mask.s_addr = htonl(0xfff00000); /* priv. 172.16.0.0/12 */
 777             } else if ((addr & 0xc0000000) == 0x80000000) {
 778                 mask.s_addr = htonl(0xffff0000); /* class B */
 779             } else if ((addr & 0xffff0000) == 0xc0a80000) {
 780                 mask.s_addr = htonl(0xffff0000); /* priv. 192.168.0.0/16 */
 781             } else if ((addr & 0xffff0000) == 0xc6120000) {
 782                 mask.s_addr = htonl(0xfffe0000); /* tests 198.18.0.0/15 */
 783             } else if ((addr & 0xe0000000) == 0xe0000000) {
 784                 mask.s_addr = htonl(0xffffff00); /* class C */
 785             } else {
 786                 mask.s_addr = htonl(0xfffffff0); /* multicast/reserved */
 787             }
 788         } else {
 789             if (!inet_aton(buf, &net)) {
 790                 return -1;
 791             }
 792             shift = strtol(vnetwork, &end, 10);
 793             if (*end != '\0') {
 794                 if (!inet_aton(vnetwork, &mask)) {
 795                     return -1;
 796                 }
 797             } else if (shift < 4 || shift > 32) {
 798                 return -1;
 799             } else {
 800                 mask.s_addr = htonl(0xffffffff << (32 - shift));
 801             }
 802         }
 803         net.s_addr &= mask.s_addr;
 804         host.s_addr = net.s_addr | (htonl(0x0202) & ~mask.s_addr);
 805         dhcp.s_addr = net.s_addr | (htonl(0x020f) & ~mask.s_addr);
 806         dns.s_addr  = net.s_addr | (htonl(0x0203) & ~mask.s_addr);
 807     }
 808
 809     if (vhost && !inet_aton(vhost, &host)) {
 810         return -1;
 811     }
 812     if ((host.s_addr & mask.s_addr) != net.s_addr) {
 813         return -1;
 814     }
 815
 816     if (vdhcp_start && !inet_aton(vdhcp_start, &dhcp)) {
 817         return -1;
 818     }
 819     if ((dhcp.s_addr & mask.s_addr) != net.s_addr ||
 820         dhcp.s_addr == host.s_addr || dhcp.s_addr == dns.s_addr) {
 821         return -1;
 822     }
 823
 824     if (vnameserver && !inet_aton(vnameserver, &dns)) {
 825         return -1;
 826     }
 827     if ((dns.s_addr & mask.s_addr) != net.s_addr ||
 828         dns.s_addr == host.s_addr) {
 829         return -1;
 830     }
 831
 832 #ifndef _WIN32
 833     if (vsmbserver && !inet_aton(vsmbserver, &smbsrv)) {
 834         return -1;
 835     }
 836 #endif
 837
 838     s = qemu_mallocz(sizeof(SlirpState));
 839     s->slirp = slirp_init(restricted, net, mask, host, vhostname,
 840                           tftp_export, bootfile, dhcp, dns, s);
 841     QTAILQ_INSERT_TAIL(&slirp_stacks, s, entry);
 842
 843     for (config = slirp_configs; config; config = config->next) {
 844         if (config->flags & SLIRP_CFG_HOSTFWD) {
 845             if (slirp_hostfwd(s, config->str,
 846                               config->flags & SLIRP_CFG_LEGACY) < 0)
 847                 return -1;
 848         } else {
 849             if (slirp_guestfwd(s, config->str,
 850                                config->flags & SLIRP_CFG_LEGACY) < 0)
 851                 return -1;
 852         }
 853     }
 854 #ifndef _WIN32
 855     if (!smb_export) {
 856         smb_export = legacy_smb_export;
 857     }
 858     if (smb_export) {
 859         if (slirp_smb(s, smb_export, smbsrv) < 0)
 860             return -1;
 861     }
 862 #endif
 863
 864     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, slirp_receive, NULL,
 865                                  net_slirp_cleanup, s);
 866     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
 867              "net=%s, restricted=%c", inet_ntoa(net), restricted ? 'y' : 'n');
 868     return 0;
 869 }
 870
 871 static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
 872                                 const char *stack)
 873 {
 874     VLANClientState *vc;
 875
 876     if (vlan) {
 877         vc = qemu_find_vlan_client_by_name(mon, strtol(vlan, NULL, 0), stack);
 878         if (!vc) {
 879             return NULL;
 880         }
 881         if (strcmp(vc->model, "user")) {
 882             monitor_printf(mon, "invalid device specified\n");
 883             return NULL;
 884         }
 885         return vc->opaque;
 886     } else {
 887         if (QTAILQ_EMPTY(&slirp_stacks)) {
 888             monitor_printf(mon, "user mode network stack not in use\n");
 889             return NULL;
 890         }
 891         return QTAILQ_FIRST(&slirp_stacks);
 892     }
 893 }
 894
 895 void net_slirp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 896 {
 897     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 898     int host_port;
 899     char buf[256] = "";
 900     const char *src_str, *p;
 901     SlirpState *s;
 902     int is_udp = 0;
 903     int err;
 904     const char *arg1 = qdict_get_str(qdict, "arg1");
 905     const char *arg2 = qdict_get_try_str(qdict, "arg2");
 906     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 907
 908     if (arg2) {
 909         s = slirp_lookup(mon, arg1, arg2);
 910         src_str = arg3;
 911     } else {
 912         s = slirp_lookup(mon, NULL, NULL);
 913         src_str = arg1;
 914     }
 915     if (!s) {
 916         return;
 917     }
 918
 919     if (!src_str || !src_str[0])
 920         goto fail_syntax;
 921
 922     p = src_str;
 923     get_str_sep(buf, sizeof(buf), &p, ':');
 924
 925     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 926         is_udp = 0;
 927     } else if (!strcmp(buf, "udp")) {
 928         is_udp = 1;
 929     } else {
 930         goto fail_syntax;
 931     }
 932
 933     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 934         goto fail_syntax;
 935     }
 936     if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 937         goto fail_syntax;
 938     }
 939
 940     host_port = atoi(p);
 941
 942     err = slirp_remove_hostfwd(QTAILQ_FIRST(&slirp_stacks)->slirp, is_udp,
 943                                host_addr, host_port);
 944
 945     monitor_printf(mon, "host forwarding rule for %s %s\n", src_str,
 946                    err ? "removed" : "not found");
 947     return;
 948
 949  fail_syntax:
 950     monitor_printf(mon, "invalid format\n");
 951 }
 952
 953 static int slirp_hostfwd(SlirpState *s, const char *redir_str,
 954                          int legacy_format)
 955 {
 956     struct in_addr host_addr = { .s_addr = INADDR_ANY };
 957     struct in_addr guest_addr = { .s_addr = 0 };
 958     int host_port, guest_port;
 959     const char *p;
 960     char buf[256];
 961     int is_udp;
 962     char *end;
 963
 964     p = redir_str;
 965     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 966         goto fail_syntax;
 967     }
 968     if (!strcmp(buf, "tcp") || buf[0] == '\0') {
 969         is_udp = 0;
 970     } else if (!strcmp(buf, "udp")) {
 971         is_udp = 1;
 972     } else {
 973         goto fail_syntax;
 974     }
 975
 976     if (!legacy_format) {
 977         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 978             goto fail_syntax;
 979         }
 980         if (buf[0] != '\0' && !inet_aton(buf, &host_addr)) {
 981             goto fail_syntax;
 982         }
 983     }
 984
 985     if (get_str_sep(buf, sizeof(buf), &p, legacy_format ? ':' : '-') < 0) {
 986         goto fail_syntax;
 987     }
 988     host_port = strtol(buf, &end, 0);
 989     if (*end != '\0' || host_port < 1 || host_port > 65535) {
 990         goto fail_syntax;
 991     }
 992
 993     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
 994         goto fail_syntax;
 995     }
 996     if (buf[0] != '\0' && !inet_aton(buf, &guest_addr)) {
 997         goto fail_syntax;
 998     }
 999
1000     guest_port = strtol(p, &end, 0);
1001     if (*end != '\0' || guest_port < 1 || guest_port > 65535) {
1002         goto fail_syntax;
1003     }
1004
1005     if (slirp_add_hostfwd(s->slirp, is_udp, host_addr, host_port, guest_addr,
1006                           guest_port) < 0) {
1007         qemu_error("could not set up host forwarding rule '%s'\n",
1008                    redir_str);
1009         return -1;
1010     }
1011     return 0;
1012
1013  fail_syntax:
1014     qemu_error("invalid host forwarding rule '%s'\n", redir_str);
1015     return -1;
1016 }
1017
1018 void net_slirp_hostfwd_add(Monitor *mon, const QDict *qdict)
1019 {
1020     const char *redir_str;
1021     SlirpState *s;
1022     const char *arg1 = qdict_get_str(qdict, "arg1");
1023     const char *arg2 = qdict_get_try_str(qdict, "arg2");
1024     const char *arg3 = qdict_get_try_str(qdict, "arg3");
1025
1026     if (arg2) {
1027         s = slirp_lookup(mon, arg1, arg2);
1028         redir_str = arg3;
1029     } else {
1030         s = slirp_lookup(mon, NULL, NULL);
1031         redir_str = arg1;
1032     }
1033     if (s) {
1034         slirp_hostfwd(s, redir_str, 0);
1035     }
1036
1037 }
1038
1039 int net_slirp_redir(const char *redir_str)
1040 {
1041     struct slirp_config_str *config;
1042
1043     if (QTAILQ_EMPTY(&slirp_stacks)) {
1044         config = qemu_malloc(sizeof(*config));
1045         pstrcpy(config->str, sizeof(config->str), redir_str);
1046         config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY;
1047         config->next = slirp_configs;
1048         slirp_configs = config;
1049         return 0;
1050     }
1051
1052     return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1);
1053 }
1054
1055 #ifndef _WIN32
1056
1057 /* automatic user mode samba server configuration */
1058 static void slirp_smb_cleanup(SlirpState *s)
1059 {
1060     char cmd[128];
1061
1062     if (s->smb_dir[0] != '\0') {
1063         snprintf(cmd, sizeof(cmd), "rm -rf %s", s->smb_dir);
1064         system(cmd);
1065         s->smb_dir[0] = '\0';
1066     }
1067 }
1068
1069 static int slirp_smb(SlirpState* s, const char *exported_dir,
1070                      struct in_addr vserver_addr)
1071 {
1072     static int instance;
1073     char smb_conf[128];
1074     char smb_cmdline[128];
1075     FILE *f;
1076
1077     snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
1078              (long)getpid(), instance++);
1079     if (mkdir(s->smb_dir, 0700) < 0) {
1080         qemu_error("could not create samba server dir '%s'\n", s->smb_dir);
1081         return -1;
1082     }
1083     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
1084
1085     f = fopen(smb_conf, "w");
1086     if (!f) {
1087         slirp_smb_cleanup(s);
1088         qemu_error("could not create samba server configuration file '%s'\n",
1089                    smb_conf);
1090         return -1;
1091     }
1092     fprintf(f,
1093             "[global]\n"
1094             "private dir=%s\n"
1095             "smb ports=0\n"
1096             "socket address=127.0.0.1\n"
1097             "pid directory=%s\n"
1098             "lock directory=%s\n"
1099             "log file=%s/log.smbd\n"
1100             "smb passwd file=%s/smbpasswd\n"
1101             "security = share\n"
1102             "[qemu]\n"
1103             "path=%s\n"
1104             "read only=no\n"
1105             "guest ok=yes\n",
1106             s->smb_dir,
1107             s->smb_dir,
1108             s->smb_dir,
1109             s->smb_dir,
1110             s->smb_dir,
1111             exported_dir
1112             );
1113     fclose(f);
1114
1115     snprintf(smb_cmdline, sizeof(smb_cmdline), "%s -s %s",
1116              SMBD_COMMAND, smb_conf);
1117
1118     if (slirp_add_exec(s->slirp, 0, smb_cmdline, &vserver_addr, 139) < 0) {
1119         slirp_smb_cleanup(s);
1120         qemu_error("conflicting/invalid smbserver address\n");
1121         return -1;
1122     }
1123     return 0;
1124 }
1125
1126 /* automatic user mode samba server configuration (legacy interface) */
1127 int net_slirp_smb(const char *exported_dir)
1128 {
1129     struct in_addr vserver_addr = { .s_addr = 0 };
1130
1131     if (legacy_smb_export) {
1132         fprintf(stderr, "-smb given twice\n");
1133         return -1;
1134     }
1135     legacy_smb_export = exported_dir;
1136     if (!QTAILQ_EMPTY(&slirp_stacks)) {
1137         return slirp_smb(QTAILQ_FIRST(&slirp_stacks), exported_dir,
1138                          vserver_addr);
1139     }
1140     return 0;
1141 }
1142
1143 #endif /* !defined(_WIN32) */
1144
1145 struct GuestFwd {
1146     CharDriverState *hd;
1147     struct in_addr server;
1148     int port;
1149     Slirp *slirp;
1150 };
1151
1152 static int guestfwd_can_read(void *opaque)
1153 {
1154     struct GuestFwd *fwd = opaque;
1155     return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port);
1156 }
1157
1158 static void guestfwd_read(void *opaque, const uint8_t *buf, int size)
1159 {
1160     struct GuestFwd *fwd = opaque;
1161     slirp_socket_recv(fwd->slirp, fwd->server, fwd->port, buf, size);
1162 }
1163
1164 static int slirp_guestfwd(SlirpState *s, const char *config_str,
1165                           int legacy_format)
1166 {
1167     struct in_addr server = { .s_addr = 0 };
1168     struct GuestFwd *fwd;
1169     const char *p;
1170     char buf[128];
1171     char *end;
1172     int port;
1173
1174     p = config_str;
1175     if (legacy_format) {
1176         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1177             goto fail_syntax;
1178         }
1179     } else {
1180         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1181             goto fail_syntax;
1182         }
1183         if (strcmp(buf, "tcp") && buf[0] != '\0') {
1184             goto fail_syntax;
1185         }
1186         if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
1187             goto fail_syntax;
1188         }
1189         if (buf[0] != '\0' && !inet_aton(buf, &server)) {
1190             goto fail_syntax;
1191         }
1192         if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
1193             goto fail_syntax;
1194         }
1195     }
1196     port = strtol(buf, &end, 10);
1197     if (*end != '\0' || port < 1 || port > 65535) {
1198         goto fail_syntax;
1199     }
1200
1201     fwd = qemu_malloc(sizeof(struct GuestFwd));
1202     snprintf(buf, sizeof(buf), "guestfwd.tcp:%d", port);
1203     fwd->hd = qemu_chr_open(buf, p, NULL);
1204     if (!fwd->hd) {
1205         qemu_error("could not open guest forwarding device '%s'\n", buf);
1206         qemu_free(fwd);
1207         return -1;
1208     }
1209
1210     if (slirp_add_exec(s->slirp, 3, fwd->hd, &server, port) < 0) {
1211         qemu_error("conflicting/invalid host:port in guest forwarding "
1212                    "rule '%s'\n", config_str);
1213         qemu_free(fwd);
1214         return -1;
1215     }
1216     fwd->server = server;
1217     fwd->port = port;
1218     fwd->slirp = s->slirp;
1219
1220     qemu_chr_add_handlers(fwd->hd, guestfwd_can_read, guestfwd_read,
1221                           NULL, fwd);
1222     return 0;
1223
1224  fail_syntax:
1225     qemu_error("invalid guest forwarding rule '%s'\n", config_str);
1226     return -1;
1227 }
1228
1229 void do_info_usernet(Monitor *mon)
1230 {
1231     SlirpState *s;
1232
1233     QTAILQ_FOREACH(s, &slirp_stacks, entry) {
1234         monitor_printf(mon, "VLAN %d (%s):\n", s->vc->vlan->id, s->vc->name);
1235         slirp_connection_info(s->slirp, mon);
1236     }
1237 }
1238
1239 #endif /* CONFIG_SLIRP */
1240
1241 #if !defined(_WIN32)
1242
1243 typedef struct TAPState {
1244     VLANClientState *vc;
1245     int fd;
1246     char down_script[1024];
1247     char down_script_arg[128];
1248     uint8_t buf[4096];
1249     unsigned int read_poll : 1;
1250     unsigned int write_poll : 1;
1251 } TAPState;
1252
1253 static int launch_script(const char *setup_script, const char *ifname, int fd);
1254
1255 static int tap_can_send(void *opaque);
1256 static void tap_send(void *opaque);
1257 static void tap_writable(void *opaque);
1258
1259 static void tap_update_fd_handler(TAPState *s)
1260 {
1261     qemu_set_fd_handler2(s->fd,
1262                          s->read_poll  ? tap_can_send : NULL,
1263                          s->read_poll  ? tap_send     : NULL,
1264                          s->write_poll ? tap_writable : NULL,
1265                          s);
1266 }
1267
1268 static void tap_read_poll(TAPState *s, int enable)
1269 {
1270     s->read_poll = !!enable;
1271     tap_update_fd_handler(s);
1272 }
1273
1274 static void tap_write_poll(TAPState *s, int enable)
1275 {
1276     s->write_poll = !!enable;
1277     tap_update_fd_handler(s);
1278 }
1279
1280 static void tap_writable(void *opaque)
1281 {
1282     TAPState *s = opaque;
1283
1284     tap_write_poll(s, 0);
1285
1286     qemu_flush_queued_packets(s->vc);
1287 }
1288
1289 static ssize_t tap_receive_iov(VLANClientState *vc, const struct iovec *iov,
1290                                int iovcnt)
1291 {
1292     TAPState *s = vc->opaque;
1293     ssize_t len;
1294
1295     do {
1296         len = writev(s->fd, iov, iovcnt);
1297     } while (len == -1 && errno == EINTR);
1298
1299     if (len == -1 && errno == EAGAIN) {
1300         tap_write_poll(s, 1);
1301         return 0;
1302     }
1303
1304     return len;
1305 }
1306
1307 static ssize_t tap_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1308 {
1309     TAPState *s = vc->opaque;
1310     ssize_t len;
1311
1312     do {
1313         len = write(s->fd, buf, size);
1314     } while (len == -1 && (errno == EINTR || errno == EAGAIN));
1315
1316     return len;
1317 }
1318
1319 static int tap_can_send(void *opaque)
1320 {
1321     TAPState *s = opaque;
1322
1323     return qemu_can_send_packet(s->vc);
1324 }
1325
1326 #ifdef __sun__
1327 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1328 {
1329     struct strbuf sbuf;
1330     int f = 0;
1331
1332     sbuf.maxlen = maxlen;
1333     sbuf.buf = (char *)buf;
1334
1335     return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
1336 }
1337 #else
1338 static ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
1339 {
1340     return read(tapfd, buf, maxlen);
1341 }
1342 #endif
1343
1344 static void tap_send_completed(VLANClientState *vc, ssize_t len)
1345 {
1346     TAPState *s = vc->opaque;
1347     tap_read_poll(s, 1);
1348 }
1349
1350 static void tap_send(void *opaque)
1351 {
1352     TAPState *s = opaque;
1353     int size;
1354
1355     do {
1356         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
1357         if (size <= 0) {
1358             break;
1359         }
1360
1361         size = qemu_send_packet_async(s->vc, s->buf, size, tap_send_completed);
1362         if (size == 0) {
1363             tap_read_poll(s, 0);
1364         }
1365     } while (size > 0);
1366 }
1367
1368 #ifdef TUNSETSNDBUF
1369 /* sndbuf should be set to a value lower than the tx queue
1370  * capacity of any destination network interface.
1371  * Ethernet NICs generally have txqueuelen=1000, so 1Mb is
1372  * a good default, given a 1500 byte MTU.
1373  */
1374 #define TAP_DEFAULT_SNDBUF 1024*1024
1375
1376 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1377 {
1378     int sndbuf;
1379
1380     sndbuf = qemu_opt_get_size(opts, "sndbuf", TAP_DEFAULT_SNDBUF);
1381     if (!sndbuf) {
1382         sndbuf = INT_MAX;
1383     }
1384
1385     if (ioctl(s->fd, TUNSETSNDBUF, &sndbuf) == -1 && qemu_opt_get(opts, "sndbuf")) {
1386         qemu_error("TUNSETSNDBUF ioctl failed: %s\n", strerror(errno));
1387         return -1;
1388     }
1389     return 0;
1390 }
1391 #else
1392 static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
1393 {
1394     return 0;
1395 }
1396 #endif /* TUNSETSNDBUF */
1397
1398 static void tap_cleanup(VLANClientState *vc)
1399 {
1400     TAPState *s = vc->opaque;
1401
1402     qemu_purge_queued_packets(vc);
1403
1404     if (s->down_script[0])
1405         launch_script(s->down_script, s->down_script_arg, s->fd);
1406
1407     tap_read_poll(s, 0);
1408     tap_write_poll(s, 0);
1409     close(s->fd);
1410     qemu_free(s);
1411 }
1412
1413 /* fd support */
1414
1415 static TAPState *net_tap_fd_init(VLANState *vlan,
1416                                  const char *model,
1417                                  const char *name,
1418                                  int fd)
1419 {
1420     TAPState *s;
1421
1422     s = qemu_mallocz(sizeof(TAPState));
1423     s->fd = fd;
1424     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, tap_receive,
1425                                  tap_receive_iov, tap_cleanup, s);
1426     tap_read_poll(s, 1);
1427     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "fd=%d", fd);
1428     return s;
1429 }
1430
1431 #if defined (CONFIG_BSD) || defined (__FreeBSD_kernel__)
1432 static int tap_open(char *ifname, int ifname_size)
1433 {
1434     int fd;
1435     char *dev;
1436     struct stat s;
1437
1438     TFR(fd = open("/dev/tap", O_RDWR));
1439     if (fd < 0) {
1440         fprintf(stderr, "warning: could not open /dev/tap: no virtual network emulation\n");
1441         return -1;
1442     }
1443
1444     fstat(fd, &s);
1445     dev = devname(s.st_rdev, S_IFCHR);
1446     pstrcpy(ifname, ifname_size, dev);
1447
1448     fcntl(fd, F_SETFL, O_NONBLOCK);
1449     return fd;
1450 }
1451 #elif defined(__sun__)
1452 #define TUNNEWPPA       (('T'<<16) | 0x0001)
1453 /*
1454  * Allocate TAP device, returns opened fd.
1455  * Stores dev name in the first arg(must be large enough).
1456  */
1457 static int tap_alloc(char *dev, size_t dev_size)
1458 {
1459     int tap_fd, if_fd, ppa = -1;
1460     static int ip_fd = 0;
1461     char *ptr;
1462
1463     static int arp_fd = 0;
1464     int ip_muxid, arp_muxid;
1465     struct strioctl  strioc_if, strioc_ppa;
1466     int link_type = I_PLINK;;
1467     struct lifreq ifr;
1468     char actual_name[32] = "";
1469
1470     memset(&ifr, 0x0, sizeof(ifr));
1471
1472     if( *dev ){
1473        ptr = dev;
1474        while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
1475        ppa = atoi(ptr);
1476     }
1477
1478     /* Check if IP device was opened */
1479     if( ip_fd )
1480        close(ip_fd);
1481
1482     TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
1483     if (ip_fd < 0) {
1484        syslog(LOG_ERR, "Can't open /dev/ip (actually /dev/udp)");
1485        return -1;
1486     }
1487
1488     TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
1489     if (tap_fd < 0) {
1490        syslog(LOG_ERR, "Can't open /dev/tap");
1491        return -1;
1492     }
1493
1494     /* Assign a new PPA and get its unit number. */
1495     strioc_ppa.ic_cmd = TUNNEWPPA;
1496     strioc_ppa.ic_timout = 0;
1497     strioc_ppa.ic_len = sizeof(ppa);
1498     strioc_ppa.ic_dp = (char *)&ppa;
1499     if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
1500        syslog (LOG_ERR, "Can't assign new interface");
1501
1502     TFR(if_fd = open("/dev/tap", O_RDWR, 0));
1503     if (if_fd < 0) {
1504        syslog(LOG_ERR, "Can't open /dev/tap (2)");
1505        return -1;
1506     }
1507     if(ioctl(if_fd, I_PUSH, "ip") < 0){
1508        syslog(LOG_ERR, "Can't push IP module");
1509        return -1;
1510     }
1511
1512     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
1513         syslog(LOG_ERR, "Can't get flags\n");
1514
1515     snprintf (actual_name, 32, "tap%d", ppa);
1516     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1517
1518     ifr.lifr_ppa = ppa;
1519     /* Assign ppa according to the unit number returned by tun device */
1520
1521     if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
1522         syslog (LOG_ERR, "Can't set PPA %d", ppa);
1523     if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
1524         syslog (LOG_ERR, "Can't get flags\n");
1525     /* Push arp module to if_fd */
1526     if (ioctl (if_fd, I_PUSH, "arp") < 0)
1527         syslog (LOG_ERR, "Can't push ARP module (2)");
1528
1529     /* Push arp module to ip_fd */
1530     if (ioctl (ip_fd, I_POP, NULL) < 0)
1531         syslog (LOG_ERR, "I_POP failed\n");
1532     if (ioctl (ip_fd, I_PUSH, "arp") < 0)
1533         syslog (LOG_ERR, "Can't push ARP module (3)\n");
1534     /* Open arp_fd */
1535     TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
1536     if (arp_fd < 0)
1537        syslog (LOG_ERR, "Can't open %s\n", "/dev/tap");
1538
1539     /* Set ifname to arp */
1540     strioc_if.ic_cmd = SIOCSLIFNAME;
1541     strioc_if.ic_timout = 0;
1542     strioc_if.ic_len = sizeof(ifr);
1543     strioc_if.ic_dp = (char *)&ifr;
1544     if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
1545         syslog (LOG_ERR, "Can't set ifname to arp\n");
1546     }
1547
1548     if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
1549        syslog(LOG_ERR, "Can't link TAP device to IP");
1550        return -1;
1551     }
1552
1553     if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
1554         syslog (LOG_ERR, "Can't link TAP device to ARP");
1555
1556     close (if_fd);
1557
1558     memset(&ifr, 0x0, sizeof(ifr));
1559     pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
1560     ifr.lifr_ip_muxid  = ip_muxid;
1561     ifr.lifr_arp_muxid = arp_muxid;
1562
1563     if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
1564     {
1565       ioctl (ip_fd, I_PUNLINK , arp_muxid);
1566       ioctl (ip_fd, I_PUNLINK, ip_muxid);
1567       syslog (LOG_ERR, "Can't set multiplexor id");
1568     }
1569
1570     snprintf(dev, dev_size, "tap%d", ppa);
1571     return tap_fd;
1572 }
1573
1574 static int tap_open(char *ifname, int ifname_size)
1575 {
1576     char  dev[10]="";
1577     int fd;
1578     if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
1579        fprintf(stderr, "Cannot allocate TAP device\n");
1580        return -1;
1581     }
1582     pstrcpy(ifname, ifname_size, dev);
1583     fcntl(fd, F_SETFL, O_NONBLOCK);
1584     return fd;
1585 }
1586 #elif defined (_AIX)
1587 static int tap_open(char *ifname, int ifname_size)
1588 {
1589     fprintf (stderr, "no tap on AIX\n");
1590     return -1;
1591 }
1592 #else
1593 static int tap_open(char *ifname, int ifname_size)
1594 {
1595     struct ifreq ifr;
1596     int fd, ret;
1597
1598     TFR(fd = open("/dev/net/tun", O_RDWR));
1599     if (fd < 0) {
1600         fprintf(stderr, "warning: could not open /dev/net/tun: no virtual network emulation\n");
1601         return -1;
1602     }
1603     memset(&ifr, 0, sizeof(ifr));
1604     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
1605     if (ifname[0] != '\0')
1606         pstrcpy(ifr.ifr_name, IFNAMSIZ, ifname);
1607     else
1608         pstrcpy(ifr.ifr_name, IFNAMSIZ, "tap%d");
1609     ret = ioctl(fd, TUNSETIFF, (void *) &ifr);
1610     if (ret != 0) {
1611         fprintf(stderr, "warning: could not configure /dev/net/tun: no virtual network emulation\n");
1612         close(fd);
1613         return -1;
1614     }
1615     pstrcpy(ifname, ifname_size, ifr.ifr_name);
1616     fcntl(fd, F_SETFL, O_NONBLOCK);
1617     return fd;
1618 }
1619 #endif
1620
1621 static int launch_script(const char *setup_script, const char *ifname, int fd)
1622 {
1623     sigset_t oldmask, mask;
1624     int pid, status;
1625     char *args[3];
1626     char **parg;
1627
1628     sigemptyset(&mask);
1629     sigaddset(&mask, SIGCHLD);
1630     sigprocmask(SIG_BLOCK, &mask, &oldmask);
1631
1632     /* try to launch network script */
1633     pid = fork();
1634     if (pid == 0) {
1635         int open_max = sysconf(_SC_OPEN_MAX), i;
1636
1637         for (i = 0; i < open_max; i++) {
1638             if (i != STDIN_FILENO &&
1639                 i != STDOUT_FILENO &&
1640                 i != STDERR_FILENO &&
1641                 i != fd) {
1642                 close(i);
1643             }
1644         }
1645         parg = args;
1646         *parg++ = (char *)setup_script;
1647         *parg++ = (char *)ifname;
1648         *parg++ = NULL;
1649         execv(setup_script, args);
1650         _exit(1);
1651     } else if (pid > 0) {
1652         while (waitpid(pid, &status, 0) != pid) {
1653             /* loop */
1654         }
1655         sigprocmask(SIG_SETMASK, &oldmask, NULL);
1656
1657         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
1658             return 0;
1659         }
1660     }
1661     fprintf(stderr, "%s: could not launch network script\n", setup_script);
1662     return -1;
1663 }
1664
1665 static TAPState *net_tap_init(VLANState *vlan, const char *model,
1666                               const char *name, const char *ifname1,
1667                               const char *setup_script, const char *down_script)
1668 {
1669     TAPState *s;
1670     int fd;
1671     char ifname[128];
1672
1673     if (ifname1 != NULL)
1674         pstrcpy(ifname, sizeof(ifname), ifname1);
1675     else
1676         ifname[0] = '\0';
1677     TFR(fd = tap_open(ifname, sizeof(ifname)));
1678     if (fd < 0)
1679         return NULL;
1680
1681     if (!setup_script || !strcmp(setup_script, "no"))
1682         setup_script = "";
1683     if (setup_script[0] != '\0' &&
1684         launch_script(setup_script, ifname, fd)) {
1685         return NULL;
1686     }
1687     s = net_tap_fd_init(vlan, model, name, fd);
1688     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
1689              "ifname=%s,script=%s,downscript=%s",
1690              ifname, setup_script, down_script);
1691     if (down_script && strcmp(down_script, "no")) {
1692         snprintf(s->down_script, sizeof(s->down_script), "%s", down_script);
1693         snprintf(s->down_script_arg, sizeof(s->down_script_arg), "%s", ifname);
1694     }
1695     return s;
1696 }
1697
1698 #endif /* !_WIN32 */
1699
1700 #if defined(CONFIG_VDE)
1701 typedef struct VDEState {
1702     VLANClientState *vc;
1703     VDECONN *vde;
1704 } VDEState;
1705
1706 static void vde_to_qemu(void *opaque)
1707 {
1708     VDEState *s = opaque;
1709     uint8_t buf[4096];
1710     int size;
1711
1712     size = vde_recv(s->vde, (char *)buf, sizeof(buf), 0);
1713     if (size > 0) {
1714         qemu_send_packet(s->vc, buf, size);
1715     }
1716 }
1717
1718 static ssize_t vde_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1719 {
1720     VDEState *s = vc->opaque;
1721     ssize_t ret;
1722
1723     do {
1724       ret = vde_send(s->vde, (const char *)buf, size, 0);
1725     } while (ret < 0 && errno == EINTR);
1726
1727     return ret;
1728 }
1729
1730 static void vde_cleanup(VLANClientState *vc)
1731 {
1732     VDEState *s = vc->opaque;
1733     qemu_set_fd_handler(vde_datafd(s->vde), NULL, NULL, NULL);
1734     vde_close(s->vde);
1735     qemu_free(s);
1736 }
1737
1738 static int net_vde_init(VLANState *vlan, const char *model,
1739                         const char *name, const char *sock,
1740                         int port, const char *group, int mode)
1741 {
1742     VDEState *s;
1743     char *init_group = (char *)group;
1744     char *init_sock = (char *)sock;
1745
1746     struct vde_open_args args = {
1747         .port = port,
1748         .group = init_group,
1749         .mode = mode,
1750     };
1751
1752     s = qemu_mallocz(sizeof(VDEState));
1753     s->vde = vde_open(init_sock, (char *)"QEMU", &args);
1754     if (!s->vde){
1755         free(s);
1756         return -1;
1757     }
1758     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, vde_receive,
1759                                  NULL, vde_cleanup, s);
1760     qemu_set_fd_handler(vde_datafd(s->vde), vde_to_qemu, NULL, s);
1761     snprintf(s->vc->info_str, sizeof(s->vc->info_str), "sock=%s,fd=%d",
1762              sock, vde_datafd(s->vde));
1763     return 0;
1764 }
1765 #endif
1766
1767 /* network connection */
1768 typedef struct NetSocketState {
1769     VLANClientState *vc;
1770     int fd;
1771     int state; /* 0 = getting length, 1 = getting data */
1772     unsigned int index;
1773     unsigned int packet_len;
1774     uint8_t buf[4096];
1775     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
1776 } NetSocketState;
1777
1778 typedef struct NetSocketListenState {
1779     VLANState *vlan;
1780     char *model;
1781     char *name;
1782     int fd;
1783 } NetSocketListenState;
1784
1785 /* XXX: we consider we can send the whole packet without blocking */
1786 static ssize_t net_socket_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
1787 {
1788     NetSocketState *s = vc->opaque;
1789     uint32_t len;
1790     len = htonl(size);
1791
1792     send_all(s->fd, (const uint8_t *)&len, sizeof(len));
1793     return send_all(s->fd, buf, size);
1794 }
1795
1796 static ssize_t net_socket_receive_dgram(VLANClientState *vc, const uint8_t *buf, size_t size)
1797 {
1798     NetSocketState *s = vc->opaque;
1799
1800     return sendto(s->fd, (const void *)buf, size, 0,
1801                   (struct sockaddr *)&s->dgram_dst, sizeof(s->dgram_dst));
1802 }
1803
1804 static void net_socket_send(void *opaque)
1805 {
1806     NetSocketState *s = opaque;
1807     int size, err;
1808     unsigned l;
1809     uint8_t buf1[4096];
1810     const uint8_t *buf;
1811
1812     size = recv(s->fd, (void *)buf1, sizeof(buf1), 0);
1813     if (size < 0) {
1814         err = socket_error();
1815         if (err != EWOULDBLOCK)
1816             goto eoc;
1817     } else if (size == 0) {
1818         /* end of connection */
1819     eoc:
1820         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1821         closesocket(s->fd);
1822         return;
1823     }
1824     buf = buf1;
1825     while (size > 0) {
1826         /* reassemble a packet from the network */
1827         switch(s->state) {
1828         case 0:
1829             l = 4 - s->index;
1830             if (l > size)
1831                 l = size;
1832             memcpy(s->buf + s->index, buf, l);
1833             buf += l;
1834             size -= l;
1835             s->index += l;
1836             if (s->index == 4) {
1837                 /* got length */
1838                 s->packet_len = ntohl(*(uint32_t *)s->buf);
1839                 s->index = 0;
1840                 s->state = 1;
1841             }
1842             break;
1843         case 1:
1844             l = s->packet_len - s->index;
1845             if (l > size)
1846                 l = size;
1847             if (s->index + l <= sizeof(s->buf)) {
1848                 memcpy(s->buf + s->index, buf, l);
1849             } else {
1850                 fprintf(stderr, "serious error: oversized packet received,"
1851                     "connection terminated.\n");
1852                 s->state = 0;
1853                 goto eoc;
1854             }
1855
1856             s->index += l;
1857             buf += l;
1858             size -= l;
1859             if (s->index >= s->packet_len) {
1860                 qemu_send_packet(s->vc, s->buf, s->packet_len);
1861                 s->index = 0;
1862                 s->state = 0;
1863             }
1864             break;
1865         }
1866     }
1867 }
1868
1869 static void net_socket_send_dgram(void *opaque)
1870 {
1871     NetSocketState *s = opaque;
1872     int size;
1873
1874     size = recv(s->fd, (void *)s->buf, sizeof(s->buf), 0);
1875     if (size < 0)
1876         return;
1877     if (size == 0) {
1878         /* end of connection */
1879         qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1880         return;
1881     }
1882     qemu_send_packet(s->vc, s->buf, size);
1883 }
1884
1885 static int net_socket_mcast_create(struct sockaddr_in *mcastaddr)
1886 {
1887     struct ip_mreq imr;
1888     int fd;
1889     int val, ret;
1890     if (!IN_MULTICAST(ntohl(mcastaddr->sin_addr.s_addr))) {
1891         fprintf(stderr, "qemu: error: specified mcastaddr \"%s\" (0x%08x) does not contain a multicast address\n",
1892                 inet_ntoa(mcastaddr->sin_addr),
1893                 (int)ntohl(mcastaddr->sin_addr.s_addr));
1894         return -1;
1895
1896     }
1897     fd = socket(PF_INET, SOCK_DGRAM, 0);
1898     if (fd < 0) {
1899         perror("socket(PF_INET, SOCK_DGRAM)");
1900         return -1;
1901     }
1902
1903     val = 1;
1904     ret=setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
1905                    (const char *)&val, sizeof(val));
1906     if (ret < 0) {
1907         perror("setsockopt(SOL_SOCKET, SO_REUSEADDR)");
1908         goto fail;
1909     }
1910
1911     ret = bind(fd, (struct sockaddr *)mcastaddr, sizeof(*mcastaddr));
1912     if (ret < 0) {
1913         perror("bind");
1914         goto fail;
1915     }
1916
1917     /* Add host to multicast group */
1918     imr.imr_multiaddr = mcastaddr->sin_addr;
1919     imr.imr_interface.s_addr = htonl(INADDR_ANY);
1920
1921     ret = setsockopt(fd, IPPROTO_IP, IP_ADD_MEMBERSHIP,
1922                      (const char *)&imr, sizeof(struct ip_mreq));
1923     if (ret < 0) {
1924         perror("setsockopt(IP_ADD_MEMBERSHIP)");
1925         goto fail;
1926     }
1927
1928     /* Force mcast msgs to loopback (eg. several QEMUs in same host */
1929     val = 1;
1930     ret=setsockopt(fd, IPPROTO_IP, IP_MULTICAST_LOOP,
1931                    (const char *)&val, sizeof(val));
1932     if (ret < 0) {
1933         perror("setsockopt(SOL_IP, IP_MULTICAST_LOOP)");
1934         goto fail;
1935     }
1936
1937     socket_set_nonblock(fd);
1938     return fd;
1939 fail:
1940     if (fd >= 0)
1941         closesocket(fd);
1942     return -1;
1943 }
1944
1945 static void net_socket_cleanup(VLANClientState *vc)
1946 {
1947     NetSocketState *s = vc->opaque;
1948     qemu_set_fd_handler(s->fd, NULL, NULL, NULL);
1949     close(s->fd);
1950     qemu_free(s);
1951 }
1952
1953 static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan,
1954                                                 const char *model,
1955                                                 const char *name,
1956                                                 int fd, int is_connected)
1957 {
1958     struct sockaddr_in saddr;
1959     int newfd;
1960     socklen_t saddr_len;
1961     NetSocketState *s;
1962
1963     /* fd passed: multicast: "learn" dgram_dst address from bound address and save it
1964      * Because this may be "shared" socket from a "master" process, datagrams would be recv()
1965      * by ONLY ONE process: we must "clone" this dgram socket --jjo
1966      */
1967
1968     if (is_connected) {
1969         if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) {
1970             /* must be bound */
1971             if (saddr.sin_addr.s_addr==0) {
1972                 fprintf(stderr, "qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n",
1973                         fd);
1974                 return NULL;
1975             }
1976             /* clone dgram socket */
1977             newfd = net_socket_mcast_create(&saddr);
1978             if (newfd < 0) {
1979                 /* error already reported by net_socket_mcast_create() */
1980                 close(fd);
1981                 return NULL;
1982             }
1983             /* clone newfd to fd, close newfd */
1984             dup2(newfd, fd);
1985             close(newfd);
1986
1987         } else {
1988             fprintf(stderr, "qemu: error: init_dgram: fd=%d failed getsockname(): %s\n",
1989                     fd, strerror(errno));
1990             return NULL;
1991         }
1992     }
1993
1994     s = qemu_mallocz(sizeof(NetSocketState));
1995     s->fd = fd;
1996
1997     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive_dgram,
1998                                  NULL, net_socket_cleanup, s);
1999     qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s);
2000
2001     /* mcast: save bound address as dst */
2002     if (is_connected) s->dgram_dst=saddr;
2003
2004     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2005             "socket: fd=%d (%s mcast=%s:%d)",
2006             fd, is_connected? "cloned" : "",
2007             inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2008     return s;
2009 }
2010
2011 static void net_socket_connect(void *opaque)
2012 {
2013     NetSocketState *s = opaque;
2014     qemu_set_fd_handler(s->fd, net_socket_send, NULL, s);
2015 }
2016
2017 static NetSocketState *net_socket_fd_init_stream(VLANState *vlan,
2018                                                  const char *model,
2019                                                  const char *name,
2020                                                  int fd, int is_connected)
2021 {
2022     NetSocketState *s;
2023     s = qemu_mallocz(sizeof(NetSocketState));
2024     s->fd = fd;
2025     s->vc = qemu_new_vlan_client(vlan, model, name, NULL, net_socket_receive,
2026                                  NULL, net_socket_cleanup, s);
2027     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2028              "socket: fd=%d", fd);
2029     if (is_connected) {
2030         net_socket_connect(s);
2031     } else {
2032         qemu_set_fd_handler(s->fd, NULL, net_socket_connect, s);
2033     }
2034     return s;
2035 }
2036
2037 static NetSocketState *net_socket_fd_init(VLANState *vlan,
2038                                           const char *model, const char *name,
2039                                           int fd, int is_connected)
2040 {
2041     int so_type = -1, optlen=sizeof(so_type);
2042
2043     if(getsockopt(fd, SOL_SOCKET, SO_TYPE, (char *)&so_type,
2044         (socklen_t *)&optlen)< 0) {
2045         fprintf(stderr, "qemu: error: getsockopt(SO_TYPE) for fd=%d failed\n", fd);
2046         return NULL;
2047     }
2048     switch(so_type) {
2049     case SOCK_DGRAM:
2050         return net_socket_fd_init_dgram(vlan, model, name, fd, is_connected);
2051     case SOCK_STREAM:
2052         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2053     default:
2054         /* who knows ... this could be a eg. a pty, do warn and continue as stream */
2055         fprintf(stderr, "qemu: warning: socket type=%d for fd=%d is not SOCK_DGRAM or SOCK_STREAM\n", so_type, fd);
2056         return net_socket_fd_init_stream(vlan, model, name, fd, is_connected);
2057     }
2058     return NULL;
2059 }
2060
2061 static void net_socket_accept(void *opaque)
2062 {
2063     NetSocketListenState *s = opaque;
2064     NetSocketState *s1;
2065     struct sockaddr_in saddr;
2066     socklen_t len;
2067     int fd;
2068
2069     for(;;) {
2070         len = sizeof(saddr);
2071         fd = accept(s->fd, (struct sockaddr *)&saddr, &len);
2072         if (fd < 0 && errno != EINTR) {
2073             return;
2074         } else if (fd >= 0) {
2075             break;
2076         }
2077     }
2078     s1 = net_socket_fd_init(s->vlan, s->model, s->name, fd, 1);
2079     if (!s1) {
2080         closesocket(fd);
2081     } else {
2082         snprintf(s1->vc->info_str, sizeof(s1->vc->info_str),
2083                  "socket: connection from %s:%d",
2084                  inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2085     }
2086 }
2087
2088 static int net_socket_listen_init(VLANState *vlan,
2089                                   const char *model,
2090                                   const char *name,
2091                                   const char *host_str)
2092 {
2093     NetSocketListenState *s;
2094     int fd, val, ret;
2095     struct sockaddr_in saddr;
2096
2097     if (parse_host_port(&saddr, host_str) < 0)
2098         return -1;
2099
2100     s = qemu_mallocz(sizeof(NetSocketListenState));
2101
2102     fd = socket(PF_INET, SOCK_STREAM, 0);
2103     if (fd < 0) {
2104         perror("socket");
2105         return -1;
2106     }
2107     socket_set_nonblock(fd);
2108
2109     /* allow fast reuse */
2110     val = 1;
2111     setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, (const char *)&val, sizeof(val));
2112
2113     ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2114     if (ret < 0) {
2115         perror("bind");
2116         return -1;
2117     }
2118     ret = listen(fd, 0);
2119     if (ret < 0) {
2120         perror("listen");
2121         return -1;
2122     }
2123     s->vlan = vlan;
2124     s->model = qemu_strdup(model);
2125     s->name = name ? qemu_strdup(name) : NULL;
2126     s->fd = fd;
2127     qemu_set_fd_handler(fd, net_socket_accept, NULL, s);
2128     return 0;
2129 }
2130
2131 static int net_socket_connect_init(VLANState *vlan,
2132                                    const char *model,
2133                                    const char *name,
2134                                    const char *host_str)
2135 {
2136     NetSocketState *s;
2137     int fd, connected, ret, err;
2138     struct sockaddr_in saddr;
2139
2140     if (parse_host_port(&saddr, host_str) < 0)
2141         return -1;
2142
2143     fd = socket(PF_INET, SOCK_STREAM, 0);
2144     if (fd < 0) {
2145         perror("socket");
2146         return -1;
2147     }
2148     socket_set_nonblock(fd);
2149
2150     connected = 0;
2151     for(;;) {
2152         ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr));
2153         if (ret < 0) {
2154             err = socket_error();
2155             if (err == EINTR || err == EWOULDBLOCK) {
2156             } else if (err == EINPROGRESS) {
2157                 break;
2158 #ifdef _WIN32
2159             } else if (err == WSAEALREADY) {
2160                 break;
2161 #endif
2162             } else {
2163                 perror("connect");
2164                 closesocket(fd);
2165                 return -1;
2166             }
2167         } else {
2168             connected = 1;
2169             break;
2170         }
2171     }
2172     s = net_socket_fd_init(vlan, model, name, fd, connected);
2173     if (!s)
2174         return -1;
2175     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2176              "socket: connect to %s:%d",
2177              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2178     return 0;
2179 }
2180
2181 static int net_socket_mcast_init(VLANState *vlan,
2182                                  const char *model,
2183                                  const char *name,
2184                                  const char *host_str)
2185 {
2186     NetSocketState *s;
2187     int fd;
2188     struct sockaddr_in saddr;
2189
2190     if (parse_host_port(&saddr, host_str) < 0)
2191         return -1;
2192
2193
2194     fd = net_socket_mcast_create(&saddr);
2195     if (fd < 0)
2196         return -1;
2197
2198     s = net_socket_fd_init(vlan, model, name, fd, 0);
2199     if (!s)
2200         return -1;
2201
2202     s->dgram_dst = saddr;
2203
2204     snprintf(s->vc->info_str, sizeof(s->vc->info_str),
2205              "socket: mcast=%s:%d",
2206              inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port));
2207     return 0;
2208
2209 }
2210
2211 typedef struct DumpState {
2212     VLANClientState *pcap_vc;
2213     int fd;
2214     int pcap_caplen;
2215 } DumpState;
2216
2217 #define PCAP_MAGIC 0xa1b2c3d4
2218
2219 struct pcap_file_hdr {
2220     uint32_t magic;
2221     uint16_t version_major;
2222     uint16_t version_minor;
2223     int32_t thiszone;
2224     uint32_t sigfigs;
2225     uint32_t snaplen;
2226     uint32_t linktype;
2227 };
2228
2229 struct pcap_sf_pkthdr {
2230     struct {
2231         int32_t tv_sec;
2232         int32_t tv_usec;
2233     } ts;
2234     uint32_t caplen;
2235     uint32_t len;
2236 };
2237
2238 static ssize_t dump_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
2239 {
2240     DumpState *s = vc->opaque;
2241     struct pcap_sf_pkthdr hdr;
2242     int64_t ts;
2243     int caplen;
2244
2245     /* Early return in case of previous error. */
2246     if (s->fd < 0) {
2247         return size;
2248     }
2249
2250     ts = muldiv64(qemu_get_clock(vm_clock), 1000000, get_ticks_per_sec());
2251     caplen = size > s->pcap_caplen ? s->pcap_caplen : size;
2252
2253     hdr.ts.tv_sec = ts / 1000000;
2254     hdr.ts.tv_usec = ts % 1000000;
2255     hdr.caplen = caplen;
2256     hdr.len = size;
2257     if (write(s->fd, &hdr, sizeof(hdr)) != sizeof(hdr) ||
2258         write(s->fd, buf, caplen) != caplen) {
2259         qemu_log("-net dump write error - stop dump\n");
2260         close(s->fd);
2261         s->fd = -1;
2262     }
2263
2264     return size;
2265 }
2266
2267 static void net_dump_cleanup(VLANClientState *vc)
2268 {
2269     DumpState *s = vc->opaque;
2270
2271     close(s->fd);
2272     qemu_free(s);
2273 }
2274
2275 static int net_dump_init(VLANState *vlan, const char *device,
2276                          const char *name, const char *filename, int len)
2277 {
2278     struct pcap_file_hdr hdr;
2279     DumpState *s;
2280
2281     s = qemu_malloc(sizeof(DumpState));
2282
2283     s->fd = open(filename, O_CREAT | O_WRONLY | O_BINARY, 0644);
2284     if (s->fd < 0) {
2285         qemu_error("-net dump: can't open %s\n", filename);
2286         return -1;
2287     }
2288
2289     s->pcap_caplen = len;
2290
2291     hdr.magic = PCAP_MAGIC;
2292     hdr.version_major = 2;
2293     hdr.version_minor = 4;
2294     hdr.thiszone = 0;
2295     hdr.sigfigs = 0;
2296     hdr.snaplen = s->pcap_caplen;
2297     hdr.linktype = 1;
2298
2299     if (write(s->fd, &hdr, sizeof(hdr)) < sizeof(hdr)) {
2300         qemu_error("-net dump write error: %s\n", strerror(errno));
2301         close(s->fd);
2302         qemu_free(s);
2303         return -1;
2304     }
2305
2306     s->pcap_vc = qemu_new_vlan_client(vlan, device, name, NULL, dump_receive, NULL,
2307                                       net_dump_cleanup, s);
2308     snprintf(s->pcap_vc->info_str, sizeof(s->pcap_vc->info_str),
2309              "dump to %s (len=%d)", filename, len);
2310     return 0;
2311 }
2312
2313 /* find or alloc a new VLAN */
2314 VLANState *qemu_find_vlan(int id, int allocate)
2315 {
2316     VLANState *vlan;
2317
2318     QTAILQ_FOREACH(vlan, &vlans, next) {
2319         if (vlan->id == id) {
2320             return vlan;
2321         }
2322     }
2323
2324     if (!allocate) {
2325         return NULL;
2326     }
2327
2328     vlan = qemu_mallocz(sizeof(VLANState));
2329     vlan->id = id;
2330     QTAILQ_INIT(&vlan->clients);
2331     QTAILQ_INIT(&vlan->send_queue);
2332
2333     QTAILQ_INSERT_TAIL(&vlans, vlan, next);
2334
2335     return vlan;
2336 }
2337
2338 static int nic_get_free_idx(void)
2339 {
2340     int index;
2341
2342     for (index = 0; index < MAX_NICS; index++)
2343         if (!nd_table[index].used)
2344             return index;
2345     return -1;
2346 }
2347
2348 int qemu_show_nic_models(const char *arg, const char *const *models)
2349 {
2350     int i;
2351
2352     if (!arg || strcmp(arg, "?"))
2353         return 0;
2354
2355     fprintf(stderr, "qemu: Supported NIC models: ");
2356     for (i = 0 ; models[i]; i++)
2357         fprintf(stderr, "%s%c", models[i], models[i+1] ? ',' : '\n');
2358     return 1;
2359 }
2360
2361 void qemu_check_nic_model(NICInfo *nd, const char *model)
2362 {
2363     const char *models[2];
2364
2365     models[0] = model;
2366     models[1] = NULL;
2367
2368     if (qemu_show_nic_models(nd->model, models))
2369         exit(0);
2370     if (qemu_find_nic_model(nd, models, model) < 0)
2371         exit(1);
2372 }
2373
2374 int qemu_find_nic_model(NICInfo *nd, const char * const *models,
2375                         const char *default_model)
2376 {
2377     int i;
2378
2379     if (!nd->model)
2380         nd->model = qemu_strdup(default_model);
2381
2382     for (i = 0 ; models[i]; i++) {
2383         if (strcmp(nd->model, models[i]) == 0)
2384             return i;
2385     }
2386
2387     qemu_error("qemu: Unsupported NIC model: %s\n", nd->model);
2388     return -1;
2389 }
2390
2391 static int net_handle_fd_param(Monitor *mon, const char *param)
2392 {
2393     if (!qemu_isdigit(param[0])) {
2394         int fd;
2395
2396         fd = monitor_get_fd(mon, param);
2397         if (fd == -1) {
2398             qemu_error("No file descriptor named %s found", param);
2399             return -1;
2400         }
2401
2402         return fd;
2403     } else {
2404         return strtol(param, NULL, 0);
2405     }
2406 }
2407
2408 static int net_init_nic(QemuOpts *opts, Monitor *mon, const char *name)
2409 {
2410     int idx;
2411     NICInfo *nd;
2412
2413     idx = nic_get_free_idx();
2414     if (idx == -1 || nb_nics >= MAX_NICS) {
2415         qemu_error("Too Many NICs\n");
2416         return -1;
2417     }
2418
2419     nd = &nd_table[idx];
2420
2421     memset(nd, 0, sizeof(*nd));
2422
2423     nd->vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2424
2425     if (name) {
2426         nd->name = qemu_strdup(name);
2427     }
2428     if (qemu_opt_get(opts, "model")) {
2429         nd->model = qemu_strdup(qemu_opt_get(opts, "model"));
2430     }
2431     if (qemu_opt_get(opts, "addr")) {
2432         nd->devaddr = qemu_strdup(qemu_opt_get(opts, "addr"));
2433     }
2434
2435     nd->macaddr[0] = 0x52;
2436     nd->macaddr[1] = 0x54;
2437     nd->macaddr[2] = 0x00;
2438     nd->macaddr[3] = 0x12;
2439     nd->macaddr[4] = 0x34;
2440     nd->macaddr[5] = 0x56 + idx;
2441
2442     if (qemu_opt_get(opts, "macaddr") &&
2443         parse_macaddr(nd->macaddr, qemu_opt_get(opts, "macaddr")) < 0) {
2444         qemu_error("invalid syntax for ethernet address\n");
2445         return -1;
2446     }
2447
2448     nd->nvectors = qemu_opt_get_number(opts, "vectors", NIC_NVECTORS_UNSPECIFIED);
2449     if (nd->nvectors != NIC_NVECTORS_UNSPECIFIED &&
2450         (nd->nvectors < 0 || nd->nvectors > 0x7ffffff)) {
2451         qemu_error("invalid # of vectors: %d\n", nd->nvectors);
2452         return -1;
2453     }
2454
2455     nd->used = 1;
2456     nd->vlan->nb_guest_devs++;
2457     nb_nics++;
2458
2459     return idx;
2460 }
2461
2462 #if defined(CONFIG_SLIRP)
2463 static int net_init_slirp_configs(const char *name, const char *value, void *opaque)
2464 {
2465     struct slirp_config_str *config;
2466
2467     if (strcmp(name, "hostfwd") != 0 && strcmp(name, "guestfwd") != 0) {
2468         return 0;
2469     }
2470
2471     config = qemu_mallocz(sizeof(*config));
2472
2473     pstrcpy(config->str, sizeof(config->str), value);
2474
2475     if (!strcmp(name, "hostfwd")) {
2476         config->flags = SLIRP_CFG_HOSTFWD;
2477     }
2478
2479     config->next = slirp_configs;
2480     slirp_configs = config;
2481
2482     return 0;
2483 }
2484
2485 static int net_init_slirp(QemuOpts *opts, Monitor *mon, const char *name)
2486 {
2487     VLANState *vlan;
2488     struct slirp_config_str *config;
2489     const char *vhost;
2490     const char *vhostname;
2491     const char *vdhcp_start;
2492     const char *vnamesrv;
2493     const char *tftp_export;
2494     const char *bootfile;
2495     const char *smb_export;
2496     const char *vsmbsrv;
2497     char *vnet = NULL;
2498     int restricted = 0;
2499     int ret;
2500
2501     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2502
2503     vhost       = qemu_opt_get(opts, "host");
2504     vhostname   = qemu_opt_get(opts, "hostname");
2505     vdhcp_start = qemu_opt_get(opts, "dhcpstart");
2506     vnamesrv    = qemu_opt_get(opts, "dns");
2507     tftp_export = qemu_opt_get(opts, "tftp");
2508     bootfile    = qemu_opt_get(opts, "bootfile");
2509     smb_export  = qemu_opt_get(opts, "smb");
2510     vsmbsrv     = qemu_opt_get(opts, "smbserver");
2511
2512     if (qemu_opt_get(opts, "ip")) {
2513         const char *ip = qemu_opt_get(opts, "ip");
2514         int l = strlen(ip) + strlen("/24") + 1;
2515
2516         vnet = qemu_malloc(l);
2517
2518         /* emulate legacy ip= parameter */
2519         pstrcpy(vnet, l, ip);
2520         pstrcat(vnet, l, "/24");
2521     }
2522
2523     if (qemu_opt_get(opts, "net")) {
2524         if (vnet) {
2525             qemu_free(vnet);
2526         }
2527         vnet = qemu_strdup(qemu_opt_get(opts, "net"));
2528     }
2529
2530     if (qemu_opt_get(opts, "restrict") &&
2531         qemu_opt_get(opts, "restrict")[0] == 'y') {
2532         restricted = 1;
2533     }
2534
2535     qemu_opt_foreach(opts, net_init_slirp_configs, NULL, 0);
2536
2537     ret = net_slirp_init(vlan, "user", name, restricted, vnet, vhost,
2538                          vhostname, tftp_export, bootfile, vdhcp_start,
2539                          vnamesrv, smb_export, vsmbsrv);
2540
2541     while (slirp_configs) {
2542         config = slirp_configs;
2543         slirp_configs = config->next;
2544         qemu_free(config);
2545     }
2546
2547     if (ret != -1) {
2548         vlan->nb_host_devs++;
2549     }
2550
2551     qemu_free(vnet);
2552
2553     return ret;
2554 }
2555 #endif /* CONFIG_SLIRP */
2556
2557 #ifdef _WIN32
2558 static int net_init_tap_win32(QemuOpts *opts, Monitor *mon, const char *name)
2559 {
2560     VLANState *vlan;
2561     const char *ifname;
2562
2563     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2564
2565     ifname = qemu_opt_get(opts, "ifname");
2566
2567     if (!ifname) {
2568         qemu_error("tap: no interface name\n");
2569         return -1;
2570     }
2571
2572     if (tap_win32_init(vlan, "tap", name, ifname) == -1) {
2573         return -1;
2574     }
2575
2576     vlan->nb_host_devs++;
2577
2578     return 0;
2579 }
2580 #elif !defined(_AIX)
2581 static int net_init_tap(QemuOpts *opts, Monitor *mon, const char *name)
2582 {
2583     VLANState *vlan;
2584     TAPState *s;
2585
2586     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2587
2588     if (qemu_opt_get(opts, "fd")) {
2589         int fd;
2590
2591         if (qemu_opt_get(opts, "ifname") ||
2592             qemu_opt_get(opts, "script") ||
2593             qemu_opt_get(opts, "downscript")) {
2594             qemu_error("ifname=, script= and downscript= is invalid with fd=\n");
2595             return -1;
2596         }
2597
2598         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2599         if (fd == -1) {
2600             return -1;
2601         }
2602
2603         fcntl(fd, F_SETFL, O_NONBLOCK);
2604
2605         s = net_tap_fd_init(vlan, "tap", name, fd);
2606         if (!s) {
2607             close(fd);
2608         }
2609     } else {
2610         const char *ifname, *script, *downscript;
2611
2612         ifname     = qemu_opt_get(opts, "ifname");
2613         script     = qemu_opt_get(opts, "script");
2614         downscript = qemu_opt_get(opts, "downscript");
2615
2616         if (!script) {
2617             script = DEFAULT_NETWORK_SCRIPT;
2618         }
2619         if (!downscript) {
2620             downscript = DEFAULT_NETWORK_DOWN_SCRIPT;
2621         }
2622
2623         s = net_tap_init(vlan, "tap", name, ifname, script, downscript);
2624     }
2625
2626     if (!s) {
2627         return -1;
2628     }
2629
2630     if (tap_set_sndbuf(s, opts) < 0) {
2631         return -1;
2632     }
2633
2634     vlan->nb_host_devs++;
2635
2636     return 0;
2637 }
2638 #endif
2639
2640 static int net_init_socket(QemuOpts *opts, Monitor *mon, const char *name)
2641 {
2642     VLANState *vlan;
2643
2644     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2645
2646     if (qemu_opt_get(opts, "fd")) {
2647         int fd;
2648
2649         if (qemu_opt_get(opts, "listen") ||
2650             qemu_opt_get(opts, "connect") ||
2651             qemu_opt_get(opts, "mcast")) {
2652             qemu_error("listen=, connect= and mcast= is invalid with fd=\n");
2653             return -1;
2654         }
2655
2656         fd = net_handle_fd_param(mon, qemu_opt_get(opts, "fd"));
2657         if (fd == -1) {
2658             return -1;
2659         }
2660
2661         if (!net_socket_fd_init(vlan, "socket", name, fd, 1)) {
2662             close(fd);
2663             return -1;
2664         }
2665     } else if (qemu_opt_get(opts, "listen")) {
2666         const char *listen;
2667
2668         if (qemu_opt_get(opts, "fd") ||
2669             qemu_opt_get(opts, "connect") ||
2670             qemu_opt_get(opts, "mcast")) {
2671             qemu_error("fd=, connect= and mcast= is invalid with listen=\n");
2672             return -1;
2673         }
2674
2675         listen = qemu_opt_get(opts, "listen");
2676
2677         if (net_socket_listen_init(vlan, "socket", name, listen) == -1) {
2678             return -1;
2679         }
2680     } else if (qemu_opt_get(opts, "connect")) {
2681         const char *connect;
2682
2683         if (qemu_opt_get(opts, "fd") ||
2684             qemu_opt_get(opts, "listen") ||
2685             qemu_opt_get(opts, "mcast")) {
2686             qemu_error("fd=, listen= and mcast= is invalid with connect=\n");
2687             return -1;
2688         }
2689
2690         connect = qemu_opt_get(opts, "connect");
2691
2692         if (net_socket_connect_init(vlan, "socket", name, connect) == -1) {
2693             return -1;
2694         }
2695     } else if (qemu_opt_get(opts, "mcast")) {
2696         const char *mcast;
2697
2698         if (qemu_opt_get(opts, "fd") ||
2699             qemu_opt_get(opts, "connect") ||
2700             qemu_opt_get(opts, "listen")) {
2701             qemu_error("fd=, connect= and listen= is invalid with mcast=\n");
2702             return -1;
2703         }
2704
2705         mcast = qemu_opt_get(opts, "mcast");
2706
2707         if (net_socket_mcast_init(vlan, "socket", name, mcast) == -1) {
2708             return -1;
2709         }
2710     } else {
2711         qemu_error("-socket requires fd=, listen=, connect= or mcast=\n");
2712         return -1;
2713     }
2714
2715     vlan->nb_host_devs++;
2716
2717     return 0;
2718 }
2719
2720 #ifdef CONFIG_VDE
2721 static int net_init_vde(QemuOpts *opts, Monitor *mon, const char *name)
2722 {
2723     VLANState *vlan;
2724     const char *sock;
2725     const char *group;
2726     int port, mode;
2727
2728     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2729
2730     sock  = qemu_opt_get(opts, "sock");
2731     group = qemu_opt_get(opts, "group");
2732
2733     port = qemu_opt_get_number(opts, "port", 0);
2734     mode = qemu_opt_get_number(opts, "mode", 0700);
2735
2736     if (net_vde_init(vlan, "vde", name, sock, port, group, mode) == -1) {
2737         return -1;
2738     }
2739
2740     vlan->nb_host_devs++;
2741
2742     return 0;
2743 }
2744 #endif
2745
2746 static int net_init_dump(QemuOpts *opts, Monitor *mon, const char *name)
2747 {
2748     VLANState *vlan;
2749     int len;
2750     const char *file;
2751     char def_file[128];
2752
2753     vlan = qemu_find_vlan(qemu_opt_get_number(opts, "vlan", 0), 1);
2754
2755     file = qemu_opt_get(opts, "file");
2756     if (!file) {
2757         snprintf(def_file, sizeof(def_file), "qemu-vlan%d.pcap", vlan->id);
2758         file = def_file;
2759     }
2760
2761     len = qemu_opt_get_size(opts, "len", 65536);
2762
2763     return net_dump_init(vlan, "dump", name, file, len);
2764 }
2765
2766 #define NET_COMMON_PARAMS_DESC                     \
2767     {                                              \
2768         .name = "type",                            \
2769         .type = QEMU_OPT_STRING,                   \
2770         .help = "net client type (nic, tap etc.)", \
2771      }, {                                          \
2772         .name = "vlan",                            \
2773         .type = QEMU_OPT_NUMBER,                   \
2774         .help = "vlan number",                     \
2775      }, {                                          \
2776         .name = "name",                            \
2777         .type = QEMU_OPT_STRING,                   \
2778         .help = "identifier for monitor commands", \
2779      }
2780
2781 typedef int (*net_client_init_func)(QemuOpts *opts,
2782                                     Monitor *mon,
2783                                     const char *name);
2784
2785 /* magic number, but compiler will warn if too small */
2786 #define NET_MAX_DESC 20
2787
2788 static struct {
2789     const char *type;
2790     net_client_init_func init;
2791     QemuOptDesc desc[NET_MAX_DESC];
2792 } net_client_types[] = {
2793     {
2794         .type = "none",
2795         .desc = {
2796             NET_COMMON_PARAMS_DESC,
2797             { /* end of list */ }
2798         },
2799     }, {
2800         .type = "nic",
2801         .init = net_init_nic,
2802         .desc = {
2803             NET_COMMON_PARAMS_DESC,
2804             {
2805                 .name = "macaddr",
2806                 .type = QEMU_OPT_STRING,
2807                 .help = "MAC address",
2808             }, {
2809                 .name = "model",
2810                 .type = QEMU_OPT_STRING,
2811                 .help = "device model (e1000, rtl8139, virtio etc.)",
2812             }, {
2813                 .name = "addr",
2814                 .type = QEMU_OPT_STRING,
2815                 .help = "PCI device address",
2816             }, {
2817                 .name = "vectors",
2818                 .type = QEMU_OPT_NUMBER,
2819                 .help = "number of MSI-x vectors, 0 to disable MSI-X",
2820             },
2821             { /* end of list */ }
2822         },
2823 #ifdef CONFIG_SLIRP
2824     }, {
2825         .type = "user",
2826         .init = net_init_slirp,
2827         .desc = {
2828             NET_COMMON_PARAMS_DESC,
2829             {
2830                 .name = "hostname",
2831                 .type = QEMU_OPT_STRING,
2832                 .help = "client hostname reported by the builtin DHCP server",
2833             }, {
2834                 .name = "restrict",
2835                 .type = QEMU_OPT_STRING,
2836                 .help = "isolate the guest from the host (y|yes|n|no)",
2837             }, {
2838                 .name = "ip",
2839                 .type = QEMU_OPT_STRING,
2840                 .help = "legacy parameter, use net= instead",
2841             }, {
2842                 .name = "net",
2843                 .type = QEMU_OPT_STRING,
2844                 .help = "IP address and optional netmask",
2845             }, {
2846                 .name = "host",
2847                 .type = QEMU_OPT_STRING,
2848                 .help = "guest-visible address of the host",
2849             }, {
2850                 .name = "tftp",
2851                 .type = QEMU_OPT_STRING,
2852                 .help = "root directory of the built-in TFTP server",
2853             }, {
2854                 .name = "bootfile",
2855                 .type = QEMU_OPT_STRING,
2856                 .help = "BOOTP filename, for use with tftp=",
2857             }, {
2858                 .name = "dhcpstart",
2859                 .type = QEMU_OPT_STRING,
2860                 .help = "the first of the 16 IPs the built-in DHCP server can assign",
2861             }, {
2862                 .name = "dns",
2863                 .type = QEMU_OPT_STRING,
2864                 .help = "guest-visible address of the virtual nameserver",
2865             }, {
2866                 .name = "smb",
2867                 .type = QEMU_OPT_STRING,
2868                 .help = "root directory of the built-in SMB server",
2869             }, {
2870                 .name = "smbserver",
2871                 .type = QEMU_OPT_STRING,
2872                 .help = "IP address of the built-in SMB server",
2873             }, {
2874                 .name = "hostfwd",
2875                 .type = QEMU_OPT_STRING,
2876                 .help = "guest port number to forward incoming TCP or UDP connections",
2877             }, {
2878                 .name = "guestfwd",
2879                 .type = QEMU_OPT_STRING,
2880                 .help = "IP address and port to forward guest TCP connections",
2881             },
2882             { /* end of list */ }
2883         },
2884 #endif
2885 #ifdef _WIN32
2886     }, {
2887         .type = "tap",
2888         .init = net_init_tap_win32,
2889         .desc = {
2890             NET_COMMON_PARAMS_DESC,
2891             {
2892                 .name = "ifname",
2893                 .type = QEMU_OPT_STRING,
2894                 .help = "interface name",
2895             },
2896             { /* end of list */ }
2897         },
2898 #elif !defined(_AIX)
2899     }, {
2900         .type = "tap",
2901         .init = net_init_tap,
2902         .desc = {
2903             NET_COMMON_PARAMS_DESC,
2904             {
2905                 .name = "fd",
2906                 .type = QEMU_OPT_STRING,
2907                 .help = "file descriptor of an already opened tap",
2908             }, {
2909                 .name = "ifname",
2910                 .type = QEMU_OPT_STRING,
2911                 .help = "interface name",
2912             }, {
2913                 .name = "script",
2914                 .type = QEMU_OPT_STRING,
2915                 .help = "script to initialize the interface",
2916             }, {
2917                 .name = "downscript",
2918                 .type = QEMU_OPT_STRING,
2919                 .help = "script to shut down the interface",
2920 #ifdef TUNSETSNDBUF
2921             }, {
2922                 .name = "sndbuf",
2923                 .type = QEMU_OPT_SIZE,
2924                 .help = "send buffer limit"
2925 #endif
2926             },
2927             { /* end of list */ }
2928         },
2929 #endif
2930     }, {
2931         .type = "socket",
2932         .init = net_init_socket,
2933         .desc = {
2934             NET_COMMON_PARAMS_DESC,
2935             {
2936                 .name = "fd",
2937                 .type = QEMU_OPT_STRING,
2938                 .help = "file descriptor of an already opened socket",
2939             }, {
2940                 .name = "listen",
2941                 .type = QEMU_OPT_STRING,
2942                 .help = "port number, and optional hostname, to listen on",
2943             }, {
2944                 .name = "connect",
2945                 .type = QEMU_OPT_STRING,
2946                 .help = "port number, and optional hostname, to connect to",
2947             }, {
2948                 .name = "mcast",
2949                 .type = QEMU_OPT_STRING,
2950                 .help = "UDP multicast address and port number",
2951             },
2952             { /* end of list */ }
2953         },
2954 #ifdef CONFIG_VDE
2955     }, {
2956         .type = "vde",
2957         .init = net_init_vde,
2958         .desc = {
2959             NET_COMMON_PARAMS_DESC,
2960             {
2961                 .name = "sock",
2962                 .type = QEMU_OPT_STRING,
2963                 .help = "socket path",
2964             }, {
2965                 .name = "port",
2966                 .type = QEMU_OPT_NUMBER,
2967                 .help = "port number",
2968             }, {
2969                 .name = "group",
2970                 .type = QEMU_OPT_STRING,
2971                 .help = "group owner of socket",
2972             }, {
2973                 .name = "mode",
2974                 .type = QEMU_OPT_NUMBER,
2975                 .help = "permissions for socket",
2976             },
2977             { /* end of list */ }
2978         },
2979 #endif
2980     }, {
2981         .type = "dump",
2982         .init = net_init_dump,
2983         .desc = {
2984             NET_COMMON_PARAMS_DESC,
2985             {
2986                 .name = "len",
2987                 .type = QEMU_OPT_SIZE,
2988                 .help = "per-packet size limit (64k default)",
2989             }, {
2990                 .name = "file",
2991                 .type = QEMU_OPT_STRING,
2992                 .help = "dump file path (default is qemu-vlan0.pcap)",
2993             },
2994             { /* end of list */ }
2995         },
2996     },
2997     { /* end of list */ }
2998 };
2999
3000 int net_client_init(Monitor *mon, QemuOpts *opts)
3001 {
3002     const char *name;
3003     const char *type;
3004     int i;
3005
3006     type = qemu_opt_get(opts, "type");
3007     if (!type) {
3008         qemu_error("No type specified for -net\n");
3009         return -1;
3010     }
3011
3012     name = qemu_opts_id(opts);
3013     if (!name) {
3014         name = qemu_opt_get(opts, "name");
3015     }
3016
3017     for (i = 0; net_client_types[i].type != NULL; i++) {
3018         if (!strcmp(net_client_types[i].type, type)) {
3019             if (qemu_opts_validate(opts, &net_client_types[i].desc[0]) == -1) {
3020                 return -1;
3021             }
3022
3023             if (net_client_types[i].init) {
3024                 return net_client_types[i].init(opts, mon, name);
3025             } else {
3026                 return 0;
3027             }
3028         }
3029     }
3030
3031     qemu_error("Invalid -net type '%s'\n", type);
3032     return -1;
3033 }
3034
3035 void net_client_uninit(NICInfo *nd)
3036 {
3037     if (nd->vlan) {
3038         nd->vlan->nb_guest_devs--;
3039     }
3040     nb_nics--;
3041
3042     qemu_free(nd->model);
3043     qemu_free(nd->name);
3044     qemu_free(nd->devaddr);
3045
3046     nd->used = 0;
3047 }
3048
3049 static int net_host_check_device(const char *device)
3050 {
3051     int i;
3052     const char *valid_param_list[] = { "tap", "socket", "dump"
3053 #ifdef CONFIG_SLIRP
3054                                        ,"user"
3055 #endif
3056 #ifdef CONFIG_VDE
3057                                        ,"vde"
3058 #endif
3059     };
3060     for (i = 0; i < sizeof(valid_param_list) / sizeof(char *); i++) {
3061         if (!strncmp(valid_param_list[i], device,
3062                      strlen(valid_param_list[i])))
3063             return 1;
3064     }
3065
3066     return 0;
3067 }
3068
3069 void net_host_device_add(Monitor *mon, const QDict *qdict)
3070 {
3071     const char *device = qdict_get_str(qdict, "device");
3072     const char *opts_str = qdict_get_try_str(qdict, "opts");
3073     QemuOpts *opts;
3074
3075     if (!net_host_check_device(device)) {
3076         monitor_printf(mon, "invalid host network device %s\n", device);
3077         return;
3078     }
3079
3080     opts = qemu_opts_parse(&qemu_net_opts, opts_str ? opts_str : "", NULL);
3081     if (!opts) {
3082         monitor_printf(mon, "parsing network options '%s' failed\n",
3083                        opts_str ? opts_str : "");
3084         return;
3085     }
3086
3087     qemu_opt_set(opts, "type", device);
3088
3089     if (net_client_init(mon, opts) < 0) {
3090         monitor_printf(mon, "adding host network device %s failed\n", device);
3091     }
3092 }
3093
3094 void net_host_device_remove(Monitor *mon, const QDict *qdict)
3095 {
3096     VLANClientState *vc;
3097     int vlan_id = qdict_get_int(qdict, "vlan_id");
3098     const char *device = qdict_get_str(qdict, "device");
3099
3100     vc = qemu_find_vlan_client_by_name(mon, vlan_id, device);
3101     if (!vc) {
3102         return;
3103     }
3104     if (!net_host_check_device(vc->model)) {
3105         monitor_printf(mon, "invalid host network device %s\n", device);
3106         return;
3107     }
3108     qemu_del_vlan_client(vc);
3109 }
3110
3111 void net_set_boot_mask(int net_boot_mask)
3112 {
3113     int i;
3114
3115     /* Only the first four NICs may be bootable */
3116     net_boot_mask = net_boot_mask & 0xF;
3117
3118     for (i = 0; i < nb_nics; i++) {
3119         if (net_boot_mask & (1 << i)) {
3120             nd_table[i].bootable = 1;
3121             net_boot_mask &= ~(1 << i);
3122         }
3123     }
3124
3125     if (net_boot_mask) {
3126         fprintf(stderr, "Cannot boot from non-existent NIC\n");
3127         exit(1);
3128     }
3129 }
3130
3131 void do_info_network(Monitor *mon)
3132 {
3133     VLANState *vlan;
3134
3135     QTAILQ_FOREACH(vlan, &vlans, next) {
3136         VLANClientState *vc;
3137
3138         monitor_printf(mon, "VLAN %d devices:\n", vlan->id);
3139
3140         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3141             monitor_printf(mon, "  %s: %s\n", vc->name, vc->info_str);
3142         }
3143     }
3144 }
3145
3146 void do_set_link(Monitor *mon, const QDict *qdict)
3147 {
3148     VLANState *vlan;
3149     VLANClientState *vc = NULL;
3150     const char *name = qdict_get_str(qdict, "name");
3151     const char *up_or_down = qdict_get_str(qdict, "up_or_down");
3152
3153     QTAILQ_FOREACH(vlan, &vlans, next) {
3154         QTAILQ_FOREACH(vc, &vlan->clients, next) {
3155             if (strcmp(vc->name, name) == 0) {
3156                 goto done;
3157             }
3158         }
3159     }
3160 done:
3161
3162     if (!vc) {
3163         monitor_printf(mon, "could not find network device '%s'\n", name);
3164         return;
3165     }
3166
3167     if (strcmp(up_or_down, "up") == 0)
3168         vc->link_down = 0;
3169     else if (strcmp(up_or_down, "down") == 0)
3170         vc->link_down = 1;
3171     else
3172         monitor_printf(mon, "invalid link status '%s'; only 'up' or 'down' "
3173                        "valid\n", up_or_down);
3174
3175     if (vc->link_status_changed)
3176         vc->link_status_changed(vc);
3177 }
3178
3179 void net_cleanup(void)
3180 {
3181     VLANState *vlan;
3182
3183     QTAILQ_FOREACH(vlan, &vlans, next) {
3184         VLANClientState *vc, *next_vc;
3185
3186         QTAILQ_FOREACH_SAFE(vc, &vlan->clients, next, next_vc) {
3187             qemu_del_vlan_client(vc);
3188         }
3189     }
3190 }
3191
3192 static void net_check_clients(void)
3193 {
3194     VLANState *vlan;
3195
3196     QTAILQ_FOREACH(vlan, &vlans, next) {
3197         if (vlan->nb_guest_devs == 0 && vlan->nb_host_devs == 0)
3198             continue;
3199         if (vlan->nb_guest_devs == 0)
3200             fprintf(stderr, "Warning: vlan %d with no nics\n", vlan->id);
3201         if (vlan->nb_host_devs == 0)
3202             fprintf(stderr,
3203                     "Warning: vlan %d is not connected to host network\n",
3204                     vlan->id);
3205     }
3206 }
3207
3208 static int net_init_client(QemuOpts *opts, void *dummy)
3209 {
3210     return net_client_init(NULL, opts);
3211 }
3212
3213 int net_init_clients(void)
3214 {
3215     if (QTAILQ_EMPTY(&qemu_net_opts.head)) {
3216         /* if no clients, we use a default config */
3217         qemu_opts_set(&qemu_net_opts, NULL, "type", "nic");
3218 #ifdef CONFIG_SLIRP
3219         qemu_opts_set(&qemu_net_opts, NULL, "type", "user");
3220 #endif
3221     }
3222
3223     QTAILQ_INIT(&vlans);
3224
3225     if (qemu_opts_foreach(&qemu_net_opts, net_init_client, NULL, 1) == -1) {
3226         return -1;
3227     }
3228
3229     net_check_clients();
3230
3231     return 0;
3232 }
3233
3234 int net_client_parse(const char *optarg)
3235 {
3236 #if defined(CONFIG_SLIRP)
3237     /* handle legacy -net channel,port:chr */
3238     if (!strncmp(optarg, "channel,", strlen("channel,"))) {
3239         int ret;
3240
3241         optarg += strlen("channel,");
3242
3243         if (QTAILQ_EMPTY(&slirp_stacks)) {
3244             struct slirp_config_str *config;
3245
3246             config = qemu_malloc(sizeof(*config));
3247             pstrcpy(config->str, sizeof(config->str), optarg);
3248             config->flags = SLIRP_CFG_LEGACY;
3249             config->next = slirp_configs;
3250             slirp_configs = config;
3251             ret = 0;
3252         } else {
3253             ret = slirp_guestfwd(QTAILQ_FIRST(&slirp_stacks), optarg, 1);
3254         }
3255
3256         return ret;
3257     }
3258 #endif
3259     if (!qemu_opts_parse(&qemu_net_opts, optarg, "type")) {
3260         return -1;
3261     }
3262
3263     return 0;
3264 }