scsi: esp: check buffer length before reading scsi command
[qemu.git] / net / filter-mirror.c
1 /*
2 * Copyright (c) 2016 HUAWEI TECHNOLOGIES CO., LTD.
3 * Copyright (c) 2016 FUJITSU LIMITED
4 * Copyright (c) 2016 Intel Corporation
5 *
6 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
7 *
8 * This work is licensed under the terms of the GNU GPL, version 2 or
9 * later. See the COPYING file in the top-level directory.
10 */
11
12 #include "qemu/osdep.h"
13 #include "net/filter.h"
14 #include "net/net.h"
15 #include "qemu-common.h"
16 #include "qapi/error.h"
17 #include "qapi/qmp/qerror.h"
18 #include "qapi-visit.h"
19 #include "qom/object.h"
20 #include "qemu/main-loop.h"
21 #include "qemu/error-report.h"
22 #include "trace.h"
23 #include "sysemu/char.h"
24 #include "qemu/iov.h"
25 #include "qemu/sockets.h"
26
27 #define FILTER_MIRROR(obj) \
28 OBJECT_CHECK(MirrorState, (obj), TYPE_FILTER_MIRROR)
29
30 #define FILTER_REDIRECTOR(obj) \
31 OBJECT_CHECK(MirrorState, (obj), TYPE_FILTER_REDIRECTOR)
32
33 #define TYPE_FILTER_MIRROR "filter-mirror"
34 #define TYPE_FILTER_REDIRECTOR "filter-redirector"
35 #define REDIRECTOR_MAX_LEN NET_BUFSIZE
36
37 typedef struct MirrorState {
38 NetFilterState parent_obj;
39 char *indev;
40 char *outdev;
41 CharDriverState *chr_in;
42 CharDriverState *chr_out;
43 SocketReadState rs;
44 } MirrorState;
45
46 static int filter_mirror_send(CharDriverState *chr_out,
47 const struct iovec *iov,
48 int iovcnt)
49 {
50 int ret = 0;
51 ssize_t size = 0;
52 uint32_t len = 0;
53 char *buf;
54
55 size = iov_size(iov, iovcnt);
56 if (!size) {
57 return 0;
58 }
59
60 len = htonl(size);
61 ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)&len, sizeof(len));
62 if (ret != sizeof(len)) {
63 goto err;
64 }
65
66 buf = g_malloc(size);
67 iov_to_buf(iov, iovcnt, 0, buf, size);
68 ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)buf, size);
69 g_free(buf);
70 if (ret != size) {
71 goto err;
72 }
73
74 return 0;
75
76 err:
77 return ret < 0 ? ret : -EIO;
78 }
79
80 static void
81 redirector_to_filter(NetFilterState *nf, const uint8_t *buf, int len)
82 {
83 struct iovec iov = {
84 .iov_base = (void *)buf,
85 .iov_len = len,
86 };
87
88 if (nf->direction == NET_FILTER_DIRECTION_ALL ||
89 nf->direction == NET_FILTER_DIRECTION_TX) {
90 qemu_netfilter_pass_to_next(nf->netdev, 0, &iov, 1, nf);
91 }
92
93 if (nf->direction == NET_FILTER_DIRECTION_ALL ||
94 nf->direction == NET_FILTER_DIRECTION_RX) {
95 qemu_netfilter_pass_to_next(nf->netdev->peer, 0, &iov, 1, nf);
96 }
97 }
98
99 static int redirector_chr_can_read(void *opaque)
100 {
101 return REDIRECTOR_MAX_LEN;
102 }
103
104 static void redirector_chr_read(void *opaque, const uint8_t *buf, int size)
105 {
106 NetFilterState *nf = opaque;
107 MirrorState *s = FILTER_REDIRECTOR(nf);
108 int ret;
109
110 ret = net_fill_rstate(&s->rs, buf, size);
111
112 if (ret == -1) {
113 qemu_chr_add_handlers(s->chr_in, NULL, NULL, NULL, NULL);
114 }
115 }
116
117 static void redirector_chr_event(void *opaque, int event)
118 {
119 NetFilterState *nf = opaque;
120 MirrorState *s = FILTER_REDIRECTOR(nf);
121
122 switch (event) {
123 case CHR_EVENT_CLOSED:
124 qemu_chr_add_handlers(s->chr_in, NULL, NULL, NULL, NULL);
125 break;
126 default:
127 break;
128 }
129 }
130
131 static ssize_t filter_mirror_receive_iov(NetFilterState *nf,
132 NetClientState *sender,
133 unsigned flags,
134 const struct iovec *iov,
135 int iovcnt,
136 NetPacketSent *sent_cb)
137 {
138 MirrorState *s = FILTER_MIRROR(nf);
139 int ret;
140
141 ret = filter_mirror_send(s->chr_out, iov, iovcnt);
142 if (ret) {
143 error_report("filter_mirror_send failed(%s)", strerror(-ret));
144 }
145
146 /*
147 * we don't hope this error interrupt the normal
148 * path of net packet, so we always return zero.
149 */
150 return 0;
151 }
152
153 static ssize_t filter_redirector_receive_iov(NetFilterState *nf,
154 NetClientState *sender,
155 unsigned flags,
156 const struct iovec *iov,
157 int iovcnt,
158 NetPacketSent *sent_cb)
159 {
160 MirrorState *s = FILTER_REDIRECTOR(nf);
161 int ret;
162
163 if (s->chr_out) {
164 ret = filter_mirror_send(s->chr_out, iov, iovcnt);
165 if (ret) {
166 error_report("filter_mirror_send failed(%s)", strerror(-ret));
167 }
168 return iov_size(iov, iovcnt);
169 } else {
170 return 0;
171 }
172 }
173
174 static void filter_mirror_cleanup(NetFilterState *nf)
175 {
176 MirrorState *s = FILTER_MIRROR(nf);
177
178 if (s->chr_out) {
179 qemu_chr_fe_release(s->chr_out);
180 }
181 }
182
183 static void filter_redirector_cleanup(NetFilterState *nf)
184 {
185 MirrorState *s = FILTER_REDIRECTOR(nf);
186
187 if (s->chr_in) {
188 qemu_chr_add_handlers(s->chr_in, NULL, NULL, NULL, NULL);
189 qemu_chr_fe_release(s->chr_in);
190 }
191 if (s->chr_out) {
192 qemu_chr_fe_release(s->chr_out);
193 }
194 }
195
196 static void filter_mirror_setup(NetFilterState *nf, Error **errp)
197 {
198 MirrorState *s = FILTER_MIRROR(nf);
199
200 if (!s->outdev) {
201 error_setg(errp, "filter filter mirror needs 'outdev' "
202 "property set");
203 return;
204 }
205
206 s->chr_out = qemu_chr_find(s->outdev);
207 if (s->chr_out == NULL) {
208 error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
209 "Device '%s' not found", s->outdev);
210 return;
211 }
212
213 if (qemu_chr_fe_claim(s->chr_out) != 0) {
214 error_setg(errp, QERR_DEVICE_IN_USE, s->outdev);
215 return;
216 }
217 }
218
219 static void redirector_rs_finalize(SocketReadState *rs)
220 {
221 MirrorState *s = container_of(rs, MirrorState, rs);
222 NetFilterState *nf = NETFILTER(s);
223
224 redirector_to_filter(nf, rs->buf, rs->packet_len);
225 }
226
227 static void filter_redirector_setup(NetFilterState *nf, Error **errp)
228 {
229 MirrorState *s = FILTER_REDIRECTOR(nf);
230
231 if (!s->indev && !s->outdev) {
232 error_setg(errp, "filter redirector needs 'indev' or "
233 "'outdev' at least one property set");
234 return;
235 } else if (s->indev && s->outdev) {
236 if (!strcmp(s->indev, s->outdev)) {
237 error_setg(errp, "'indev' and 'outdev' could not be same "
238 "for filter redirector");
239 return;
240 }
241 }
242
243 net_socket_rs_init(&s->rs, redirector_rs_finalize);
244
245 if (s->indev) {
246 s->chr_in = qemu_chr_find(s->indev);
247 if (s->chr_in == NULL) {
248 error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
249 "IN Device '%s' not found", s->indev);
250 return;
251 }
252
253 qemu_chr_fe_claim_no_fail(s->chr_in);
254 qemu_chr_add_handlers(s->chr_in, redirector_chr_can_read,
255 redirector_chr_read, redirector_chr_event, nf);
256 }
257
258 if (s->outdev) {
259 s->chr_out = qemu_chr_find(s->outdev);
260 if (s->chr_out == NULL) {
261 error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
262 "OUT Device '%s' not found", s->outdev);
263 return;
264 }
265 qemu_chr_fe_claim_no_fail(s->chr_out);
266 }
267 }
268
269 static void filter_mirror_class_init(ObjectClass *oc, void *data)
270 {
271 NetFilterClass *nfc = NETFILTER_CLASS(oc);
272
273 nfc->setup = filter_mirror_setup;
274 nfc->cleanup = filter_mirror_cleanup;
275 nfc->receive_iov = filter_mirror_receive_iov;
276 }
277
278 static void filter_redirector_class_init(ObjectClass *oc, void *data)
279 {
280 NetFilterClass *nfc = NETFILTER_CLASS(oc);
281
282 nfc->setup = filter_redirector_setup;
283 nfc->cleanup = filter_redirector_cleanup;
284 nfc->receive_iov = filter_redirector_receive_iov;
285 }
286
287 static char *filter_redirector_get_indev(Object *obj, Error **errp)
288 {
289 MirrorState *s = FILTER_REDIRECTOR(obj);
290
291 return g_strdup(s->indev);
292 }
293
294 static void
295 filter_redirector_set_indev(Object *obj, const char *value, Error **errp)
296 {
297 MirrorState *s = FILTER_REDIRECTOR(obj);
298
299 g_free(s->indev);
300 s->indev = g_strdup(value);
301 }
302
303 static char *filter_mirror_get_outdev(Object *obj, Error **errp)
304 {
305 MirrorState *s = FILTER_MIRROR(obj);
306
307 return g_strdup(s->outdev);
308 }
309
310 static void
311 filter_mirror_set_outdev(Object *obj, const char *value, Error **errp)
312 {
313 MirrorState *s = FILTER_MIRROR(obj);
314
315 g_free(s->outdev);
316 s->outdev = g_strdup(value);
317 if (!s->outdev) {
318 error_setg(errp, "filter filter mirror needs 'outdev' "
319 "property set");
320 return;
321 }
322 }
323
324 static char *filter_redirector_get_outdev(Object *obj, Error **errp)
325 {
326 MirrorState *s = FILTER_REDIRECTOR(obj);
327
328 return g_strdup(s->outdev);
329 }
330
331 static void
332 filter_redirector_set_outdev(Object *obj, const char *value, Error **errp)
333 {
334 MirrorState *s = FILTER_REDIRECTOR(obj);
335
336 g_free(s->outdev);
337 s->outdev = g_strdup(value);
338 }
339
340 static void filter_mirror_init(Object *obj)
341 {
342 object_property_add_str(obj, "outdev", filter_mirror_get_outdev,
343 filter_mirror_set_outdev, NULL);
344 }
345
346 static void filter_redirector_init(Object *obj)
347 {
348 object_property_add_str(obj, "indev", filter_redirector_get_indev,
349 filter_redirector_set_indev, NULL);
350 object_property_add_str(obj, "outdev", filter_redirector_get_outdev,
351 filter_redirector_set_outdev, NULL);
352 }
353
354 static void filter_mirror_fini(Object *obj)
355 {
356 MirrorState *s = FILTER_MIRROR(obj);
357
358 g_free(s->outdev);
359 }
360
361 static void filter_redirector_fini(Object *obj)
362 {
363 MirrorState *s = FILTER_REDIRECTOR(obj);
364
365 g_free(s->indev);
366 g_free(s->outdev);
367 }
368
369 static const TypeInfo filter_redirector_info = {
370 .name = TYPE_FILTER_REDIRECTOR,
371 .parent = TYPE_NETFILTER,
372 .class_init = filter_redirector_class_init,
373 .instance_init = filter_redirector_init,
374 .instance_finalize = filter_redirector_fini,
375 .instance_size = sizeof(MirrorState),
376 };
377
378 static const TypeInfo filter_mirror_info = {
379 .name = TYPE_FILTER_MIRROR,
380 .parent = TYPE_NETFILTER,
381 .class_init = filter_mirror_class_init,
382 .instance_init = filter_mirror_init,
383 .instance_finalize = filter_mirror_fini,
384 .instance_size = sizeof(MirrorState),
385 };
386
387 static void register_types(void)
388 {
389 type_register_static(&filter_mirror_info);
390 type_register_static(&filter_redirector_info);
391 }
392
393 type_init(register_types);