haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

sockets: ensure we don't accept IPv4 clients when IPv4 is disabled

Browse source 
Currently if you disable listening on IPv4 addresses, via the
CLI flag ipv4=off, we still mistakenly accept IPv4 clients via
the IPv6 listener socket due to IPV6_V6ONLY flag being unset.

We must ensure IPV6_V6ONLY is always set if ipv4=off

This fixes the following scenarios

  -incoming tcp::9000,ipv6=on
  -incoming tcp:[::]:9000,ipv6=on
  -chardev socket,id=cdev0,host=,port=9000,server,nowait,ipv4=off
  -chardev socket,id=cdev0,host=,port=9000,server,nowait,ipv6=on
  -chardev socket,id=cdev0,host=::,port=9000,server,nowait,ipv4=off
  -chardev socket,id=cdev0,host=::,port=9000,server,nowait,ipv6=on

which all mistakenly accepted IPv4 clients

Acked-by: Gerd Hoffmann <kraxel@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2017-05-17 14:17:55 +01:00
parent 4dc5d815c4
commit 94bc0d1978
1 changed files with 31 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
util/qemu-sockets.c
View file

@ -104,17 +104,16 @@ NetworkAddressFamily inet_netfamily(int family)
* f t PF_INET6
* t - PF_INET
* t f PF_INET
* t t PF_INET6
* t t PF_INET6/PF_UNSPEC
*
* NB, this matrix is only about getting the necessary results
* from getaddrinfo(). Some of the cases require further work
* after reading results from getaddrinfo in order to fully
* apply the logic the end user wants. eg with the last case
* ipv4=t + ipv6=t + PF_INET6, getaddrinfo alone can only
* guarantee the ipv6=t part of the request - we need more
* checks to provide ipv4=t part of the guarantee. This is
* outside scope of this method and not currently handled by
* callers at all.
* apply the logic the end user wants.
*
* In the first and last cases, we must set IPV6_V6ONLY=0
* when binding, to allow a single listener to potentially
* accept both IPv4+6 addresses.
*/
int inet_ai_family_from_address(InetSocketAddress *addr,
Error **errp)
@ -124,6 +123,23 @@ int inet_ai_family_from_address(InetSocketAddress *addr,
error_setg(errp, "Cannot disable IPv4 and IPv6 at same time");
return PF_UNSPEC;
}
if ((addr->has_ipv6 && addr->ipv6) && (addr->has_ipv4 && addr->ipv4)) {
/*
* Some backends can only do a single listener. In that case
* we want empty hostname to resolve to "::" and then use the
* flag IPV6_V6ONLY==0 to get both protocols on 1 socket. This
* doesn't work for addresses other than "", so they're just
* inevitably broken until multiple listeners can be used,
* and thus we honour getaddrinfo automatic protocol detection
* Once all backends do multi-listener, remove the PF_INET6
* branch entirely.
*/
if (!addr->host || g_str_equal(addr->host, "")) {
return PF_INET6;
} else {
return PF_UNSPEC;
}
}
if ((addr->has_ipv6 && addr->ipv6) || (addr->has_ipv4 && !addr->ipv4)) {
return PF_INET6;
}
@ -213,8 +229,14 @@ static int inet_listen_saddr(InetSocketAddress *saddr,
port_max = saddr->has_to ? saddr->to + port_offset : port_min;
for (p = port_min; p <= port_max; p++) {
#ifdef IPV6_V6ONLY
/* listen on both ipv4 and ipv6 */
int v6only = 0;
/*
* Deals with first & last cases in matrix in comment
* for inet_ai_family_from_address().
*/
int v6only =
((!saddr->has_ipv4 && !saddr->has_ipv6) ||
(saddr->has_ipv4 && saddr->ipv4 &&
saddr->has_ipv6 && saddr->ipv6)) ? 0 : 1;
#endif
inet_setport(e, p);
#ifdef IPV6_V6ONLY