mirror of
https://github.com/qemu/qemu.git
synced 2024-12-17 09:13:44 +08:00
e7b347d0bf
When QEMU sets up a tap based network device backend, it mostly ignores errors reported from various ioctl() calls it makes, assuming the TAP file descriptor is valid. This assumption can easily be violated when the user is passing in a pre-opened file descriptor. At best, the ioctls may fail with a -EBADF, but if the user passes in a bogus FD number that happens to clash with a FD number that QEMU has opened internally for another reason, a wide variety of errnos may result, as the TUNGETIFF ioctl number may map to a completely different command on a different type of file. By ignoring all these errors, QEMU sets up a zombie network backend that will never pass any data. Even worse, when QEMU shuts down, or that network backend is hot-removed, it will close this bogus file descriptor, which could belong to another QEMU device backend. There's no obvious guaranteed reliable way to detect that a FD genuinely is a TAP device, as opposed to a UNIX socket, or pipe, or something else. Checking the errno from probing vnet hdr flag though, does catch the big common cases. ie calling TUNGETIFF will return EBADF for an invalid FD, and ENOTTY when FD is a UNIX socket, or pipe which catches accidental collisions with FDs used for stdio, or monitor socket. Previously the example below where bogus fd 9 collides with the FD used for the chardev saw: $ ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,fd=9 \ -chardev socket,id=charchannel0,path=/tmp/qga,server,nowait \ -monitor stdio -vnc :0 qemu-system-x86_64: -netdev tap,id=hostnet0,fd=9: TUNGETIFF ioctl() failed: Inappropriate ioctl for device TUNSETOFFLOAD ioctl() failed: Bad address QEMU 2.9.1 monitor - type 'help' for more information (qemu) Warning: netdev hostnet0 has no peer which gives a running QEMU with a zombie network backend. With this change applied we get an error message and QEMU immediately exits before carrying on and making a bigger disaster: $ ./x86_64-softmmu/qemu-system-x86_64 -netdev tap,id=hostnet0,fd=9 \ -chardev socket,id=charchannel0,path=/tmp/qga,server,nowait \ -monitor stdio -vnc :0 qemu-system-x86_64: -netdev tap,id=hostnet0,vhost=on,fd=9: Unable to query TUNGETIFF on FD 9: Inappropriate ioctl for device Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com> Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-id: 20171027085548.3472-1-berrange@redhat.com [lv: to simplify, don't check on EINVAL with TUNGETIFF as it exists since v2.6.27] Signed-off-by: Laurent Vivier <lvivier@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
258 lines
6.7 KiB
C
258 lines
6.7 KiB
C
/*
|
|
* QEMU System Emulator
|
|
*
|
|
* Copyright (c) 2003-2008 Fabrice Bellard
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
|
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qapi/error.h"
|
|
#include "tap_int.h"
|
|
#include "qemu/ctype.h"
|
|
#include "qemu/cutils.h"
|
|
#include "qemu-common.h"
|
|
|
|
#include <sys/ethernet.h>
|
|
#include <sys/sockio.h>
|
|
#include <netinet/arp.h>
|
|
#include <netinet/in.h>
|
|
#include <netinet/in_systm.h>
|
|
#include <netinet/ip.h>
|
|
#include <netinet/ip_icmp.h> // must come after ip.h
|
|
#include <netinet/udp.h>
|
|
#include <netinet/tcp.h>
|
|
#include <net/if.h>
|
|
#include <stropts.h>
|
|
#include "qemu/error-report.h"
|
|
|
|
ssize_t tap_read_packet(int tapfd, uint8_t *buf, int maxlen)
|
|
{
|
|
struct strbuf sbuf;
|
|
int f = 0;
|
|
|
|
sbuf.maxlen = maxlen;
|
|
sbuf.buf = (char *)buf;
|
|
|
|
return getmsg(tapfd, NULL, &sbuf, &f) >= 0 ? sbuf.len : -1;
|
|
}
|
|
|
|
#define TUNNEWPPA (('T'<<16) | 0x0001)
|
|
/*
|
|
* Allocate TAP device, returns opened fd.
|
|
* Stores dev name in the first arg(must be large enough).
|
|
*/
|
|
static int tap_alloc(char *dev, size_t dev_size, Error **errp)
|
|
{
|
|
/* FIXME leaks like a sieve on error paths */
|
|
/* FIXME suspicious: many errors are reported, then ignored */
|
|
int tap_fd, if_fd, ppa = -1;
|
|
static int ip_fd = 0;
|
|
char *ptr;
|
|
|
|
static int arp_fd = 0;
|
|
int ip_muxid, arp_muxid;
|
|
struct strioctl strioc_if, strioc_ppa;
|
|
int link_type = I_PLINK;
|
|
struct lifreq ifr;
|
|
char actual_name[32] = "";
|
|
|
|
memset(&ifr, 0x0, sizeof(ifr));
|
|
|
|
if( *dev ){
|
|
ptr = dev;
|
|
while( *ptr && !qemu_isdigit((int)*ptr) ) ptr++;
|
|
ppa = atoi(ptr);
|
|
}
|
|
|
|
/* Check if IP device was opened */
|
|
if( ip_fd )
|
|
close(ip_fd);
|
|
|
|
TFR(ip_fd = open("/dev/udp", O_RDWR, 0));
|
|
if (ip_fd < 0) {
|
|
error_setg(errp, "Can't open /dev/ip (actually /dev/udp)");
|
|
return -1;
|
|
}
|
|
|
|
TFR(tap_fd = open("/dev/tap", O_RDWR, 0));
|
|
if (tap_fd < 0) {
|
|
error_setg(errp, "Can't open /dev/tap");
|
|
return -1;
|
|
}
|
|
|
|
/* Assign a new PPA and get its unit number. */
|
|
strioc_ppa.ic_cmd = TUNNEWPPA;
|
|
strioc_ppa.ic_timout = 0;
|
|
strioc_ppa.ic_len = sizeof(ppa);
|
|
strioc_ppa.ic_dp = (char *)&ppa;
|
|
if ((ppa = ioctl (tap_fd, I_STR, &strioc_ppa)) < 0)
|
|
error_report("Can't assign new interface");
|
|
|
|
TFR(if_fd = open("/dev/tap", O_RDWR, 0));
|
|
if (if_fd < 0) {
|
|
error_setg(errp, "Can't open /dev/tap (2)");
|
|
return -1;
|
|
}
|
|
if(ioctl(if_fd, I_PUSH, "ip") < 0){
|
|
error_setg(errp, "Can't push IP module");
|
|
return -1;
|
|
}
|
|
|
|
if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) < 0)
|
|
error_report("Can't get flags");
|
|
|
|
snprintf (actual_name, 32, "tap%d", ppa);
|
|
pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
|
|
|
|
ifr.lifr_ppa = ppa;
|
|
/* Assign ppa according to the unit number returned by tun device */
|
|
|
|
if (ioctl (if_fd, SIOCSLIFNAME, &ifr) < 0)
|
|
error_report("Can't set PPA %d", ppa);
|
|
if (ioctl(if_fd, SIOCGLIFFLAGS, &ifr) <0)
|
|
error_report("Can't get flags");
|
|
/* Push arp module to if_fd */
|
|
if (ioctl (if_fd, I_PUSH, "arp") < 0)
|
|
error_report("Can't push ARP module (2)");
|
|
|
|
/* Push arp module to ip_fd */
|
|
if (ioctl (ip_fd, I_POP, NULL) < 0)
|
|
error_report("I_POP failed");
|
|
if (ioctl (ip_fd, I_PUSH, "arp") < 0)
|
|
error_report("Can't push ARP module (3)");
|
|
/* Open arp_fd */
|
|
TFR(arp_fd = open ("/dev/tap", O_RDWR, 0));
|
|
if (arp_fd < 0)
|
|
error_report("Can't open %s", "/dev/tap");
|
|
|
|
/* Set ifname to arp */
|
|
strioc_if.ic_cmd = SIOCSLIFNAME;
|
|
strioc_if.ic_timout = 0;
|
|
strioc_if.ic_len = sizeof(ifr);
|
|
strioc_if.ic_dp = (char *)𝔦
|
|
if (ioctl(arp_fd, I_STR, &strioc_if) < 0){
|
|
error_report("Can't set ifname to arp");
|
|
}
|
|
|
|
if((ip_muxid = ioctl(ip_fd, I_LINK, if_fd)) < 0){
|
|
error_setg(errp, "Can't link TAP device to IP");
|
|
return -1;
|
|
}
|
|
|
|
if ((arp_muxid = ioctl (ip_fd, link_type, arp_fd)) < 0)
|
|
error_report("Can't link TAP device to ARP");
|
|
|
|
close (if_fd);
|
|
|
|
memset(&ifr, 0x0, sizeof(ifr));
|
|
pstrcpy(ifr.lifr_name, sizeof(ifr.lifr_name), actual_name);
|
|
ifr.lifr_ip_muxid = ip_muxid;
|
|
ifr.lifr_arp_muxid = arp_muxid;
|
|
|
|
if (ioctl (ip_fd, SIOCSLIFMUXID, &ifr) < 0)
|
|
{
|
|
ioctl (ip_fd, I_PUNLINK , arp_muxid);
|
|
ioctl (ip_fd, I_PUNLINK, ip_muxid);
|
|
error_report("Can't set multiplexor id");
|
|
}
|
|
|
|
snprintf(dev, dev_size, "tap%d", ppa);
|
|
return tap_fd;
|
|
}
|
|
|
|
int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
|
|
int vnet_hdr_required, int mq_required, Error **errp)
|
|
{
|
|
char dev[10]="";
|
|
int fd;
|
|
|
|
fd = tap_alloc(dev, sizeof(dev), errp);
|
|
if (fd < 0) {
|
|
return -1;
|
|
}
|
|
pstrcpy(ifname, ifname_size, dev);
|
|
if (*vnet_hdr) {
|
|
/* Solaris doesn't have IFF_VNET_HDR */
|
|
*vnet_hdr = 0;
|
|
|
|
if (vnet_hdr_required && !*vnet_hdr) {
|
|
error_setg(errp, "vnet_hdr=1 requested, but no kernel "
|
|
"support for IFF_VNET_HDR available");
|
|
close(fd);
|
|
return -1;
|
|
}
|
|
}
|
|
fcntl(fd, F_SETFL, O_NONBLOCK);
|
|
return fd;
|
|
}
|
|
|
|
void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
|
|
{
|
|
}
|
|
|
|
int tap_probe_vnet_hdr(int fd, Error **errp)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
int tap_probe_has_ufo(int fd)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
int tap_probe_vnet_hdr_len(int fd, int len)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
void tap_fd_set_vnet_hdr_len(int fd, int len)
|
|
{
|
|
}
|
|
|
|
int tap_fd_set_vnet_le(int fd, int is_le)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
int tap_fd_set_vnet_be(int fd, int is_be)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
void tap_fd_set_offload(int fd, int csum, int tso4,
|
|
int tso6, int ecn, int ufo)
|
|
{
|
|
}
|
|
|
|
int tap_fd_enable(int fd)
|
|
{
|
|
return -1;
|
|
}
|
|
|
|
int tap_fd_disable(int fd)
|
|
{
|
|
return -1;
|
|
}
|
|
|
|
int tap_fd_get_ifname(int fd, char *ifname)
|
|
{
|
|
return -1;
|
|
}
|