From nobody Wed Nov 5 17:18:44 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1496858573521914.7042045089574; Wed, 7 Jun 2017 11:02:53 -0700 (PDT) Received: from localhost ([::1]:45565 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dIfIA-0004pG-3T for importer@patchew.org; Wed, 07 Jun 2017 14:02:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55180) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dIfAB-0005Me-LZ for qemu-devel@nongnu.org; Wed, 07 Jun 2017 13:54:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dIfAA-0007u1-NP for qemu-devel@nongnu.org; Wed, 07 Jun 2017 13:54:35 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59504) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dIfAA-0007tf-Fg for qemu-devel@nongnu.org; Wed, 07 Jun 2017 13:54:34 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6D7E8C057FA7; Wed, 7 Jun 2017 17:54:33 +0000 (UTC) Received: from t460.redhat.com (ovpn-117-221.ams2.redhat.com [10.36.117.221]) by smtp.corp.redhat.com (Postfix) with ESMTP id 68363189B1; Wed, 7 Jun 2017 17:54:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 6D7E8C057FA7 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=berrange@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 6D7E8C057FA7 From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Wed, 7 Jun 2017 18:54:17 +0100 Message-Id: <20170607175419.13558-4-berrange@redhat.com> In-Reply-To: <20170607175419.13558-1-berrange@redhat.com> References: <20170607175419.13558-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 07 Jun 2017 17:54:33 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL v1 3/5] sockets: ensure we don't accept IPv4 clients when IPv4 is disabled X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Currently if you disable listening on IPv4 addresses, via the CLI flag ipv4=3Doff, we still mistakenly accept IPv4 clients via the IPv6 listener socket due to IPV6_V6ONLY flag being unset. We must ensure IPV6_V6ONLY is always set if ipv4=3Doff This fixes the following scenarios -incoming tcp::9000,ipv6=3Don -incoming tcp:[::]:9000,ipv6=3Don -chardev socket,id=3Dcdev0,host=3D,port=3D9000,server,nowait,ipv4=3Doff -chardev socket,id=3Dcdev0,host=3D,port=3D9000,server,nowait,ipv6=3Don -chardev socket,id=3Dcdev0,host=3D::,port=3D9000,server,nowait,ipv4=3Doff -chardev socket,id=3Dcdev0,host=3D::,port=3D9000,server,nowait,ipv6=3Don which all mistakenly accepted IPv4 clients Acked-by: Gerd Hoffmann Reviewed-by: Philippe Mathieu-Daud=C3=A9 Reviewed-by: Eric Blake Signed-off-by: Daniel P. Berrange --- util/qemu-sockets.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c index 81bc8de..852773d 100644 --- a/util/qemu-sockets.c +++ b/util/qemu-sockets.c @@ -104,17 +104,16 @@ NetworkAddressFamily inet_netfamily(int family) * f t PF_INET6 * t - PF_INET * t f PF_INET - * t t PF_INET6 + * t t PF_INET6/PF_UNSPEC * * NB, this matrix is only about getting the necessary results * from getaddrinfo(). Some of the cases require further work * after reading results from getaddrinfo in order to fully - * apply the logic the end user wants. eg with the last case - * ipv4=3Dt + ipv6=3Dt + PF_INET6, getaddrinfo alone can only - * guarantee the ipv6=3Dt part of the request - we need more - * checks to provide ipv4=3Dt part of the guarantee. This is - * outside scope of this method and not currently handled by - * callers at all. + * apply the logic the end user wants. + * + * In the first and last cases, we must set IPV6_V6ONLY=3D0 + * when binding, to allow a single listener to potentially + * accept both IPv4+6 addresses. */ int inet_ai_family_from_address(InetSocketAddress *addr, Error **errp) @@ -124,6 +123,23 @@ int inet_ai_family_from_address(InetSocketAddress *add= r, error_setg(errp, "Cannot disable IPv4 and IPv6 at same time"); return PF_UNSPEC; } + if ((addr->has_ipv6 && addr->ipv6) && (addr->has_ipv4 && addr->ipv4)) { + /* + * Some backends can only do a single listener. In that case + * we want empty hostname to resolve to "::" and then use the + * flag IPV6_V6ONLY=3D=3D0 to get both protocols on 1 socket. This + * doesn't work for addresses other than "", so they're just + * inevitably broken until multiple listeners can be used, + * and thus we honour getaddrinfo automatic protocol detection + * Once all backends do multi-listener, remove the PF_INET6 + * branch entirely. + */ + if (!addr->host || g_str_equal(addr->host, "")) { + return PF_INET6; + } else { + return PF_UNSPEC; + } + } if ((addr->has_ipv6 && addr->ipv6) || (addr->has_ipv4 && !addr->ipv4))= { return PF_INET6; } @@ -213,8 +229,14 @@ static int inet_listen_saddr(InetSocketAddress *saddr, port_max =3D saddr->has_to ? saddr->to + port_offset : port_min; for (p =3D port_min; p <=3D port_max; p++) { #ifdef IPV6_V6ONLY - /* listen on both ipv4 and ipv6 */ - int v6only =3D 0; + /* + * Deals with first & last cases in matrix in comment + * for inet_ai_family_from_address(). + */ + int v6only =3D + ((!saddr->has_ipv4 && !saddr->has_ipv6) || + (saddr->has_ipv4 && saddr->ipv4 && + saddr->has_ipv6 && saddr->ipv6)) ? 0 : 1; #endif inet_setport(e, p); #ifdef IPV6_V6ONLY --=20 2.9.3