slirp/slirp.c

   1 /*
   2  * libslirp glue
   3  *
   4  * Copyright (c) 2004-2008 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24 #include "qemu-common.h"
  25 #include "qemu/timer.h"
  26 #include "char/char.h"
  27 #include "slirp.h"
  28 #include "hw/hw.h"
  29
  30 /* host loopback address */
  31 struct in_addr loopback_addr;
  32 /* host loopback network mask */
  33 unsigned long loopback_mask;
  34
  35 /* emulated hosts use the MAC addr 52:55:IP:IP:IP:IP */
  36 static const uint8_t special_ethaddr[ETH_ALEN] = {
  37     0x52, 0x55, 0x00, 0x00, 0x00, 0x00
  38 };
  39
  40 static const uint8_t zero_ethaddr[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 };
  41
  42 u_int curtime;
  43 static u_int time_fasttimo, last_slowtimo;
  44 static int do_slowtimo;
  45
  46 static QTAILQ_HEAD(slirp_instances, Slirp) slirp_instances =
  47     QTAILQ_HEAD_INITIALIZER(slirp_instances);
  48
  49 static struct in_addr dns_addr;
  50 static u_int dns_addr_time;
  51
  52 #ifdef _WIN32
  53
  54 int get_dns_addr(struct in_addr *pdns_addr)
  55 {
  56     FIXED_INFO *FixedInfo=NULL;
  57     ULONG    BufLen;
  58     DWORD    ret;
  59     IP_ADDR_STRING *pIPAddr;
  60     struct in_addr tmp_addr;
  61
  62     if (dns_addr.s_addr != 0 && (curtime - dns_addr_time) < 1000) {
  63         *pdns_addr = dns_addr;
  64         return 0;
  65     }
  66
  67     FixedInfo = (FIXED_INFO *)GlobalAlloc(GPTR, sizeof(FIXED_INFO));
  68     BufLen = sizeof(FIXED_INFO);
  69
  70     if (ERROR_BUFFER_OVERFLOW == GetNetworkParams(FixedInfo, &BufLen)) {
  71         if (FixedInfo) {
  72             GlobalFree(FixedInfo);
  73             FixedInfo = NULL;
  74         }
  75         FixedInfo = GlobalAlloc(GPTR, BufLen);
  76     }
  77
  78     if ((ret = GetNetworkParams(FixedInfo, &BufLen)) != ERROR_SUCCESS) {
  79         printf("GetNetworkParams failed. ret = %08x\n", (u_int)ret );
  80         if (FixedInfo) {
  81             GlobalFree(FixedInfo);
  82             FixedInfo = NULL;
  83         }
  84         return -1;
  85     }
  86
  87     pIPAddr = &(FixedInfo->DnsServerList);
  88     inet_aton(pIPAddr->IpAddress.String, &tmp_addr);
  89     *pdns_addr = tmp_addr;
  90     dns_addr = tmp_addr;
  91     dns_addr_time = curtime;
  92     if (FixedInfo) {
  93         GlobalFree(FixedInfo);
  94         FixedInfo = NULL;
  95     }
  96     return 0;
  97 }
  98
  99 static void winsock_cleanup(void)
 100 {
 101     WSACleanup();
 102 }
 103
 104 #else
 105
 106 static struct stat dns_addr_stat;
 107
 108 int get_dns_addr(struct in_addr *pdns_addr)
 109 {
 110     char buff[512];
 111     char buff2[257];
 112     FILE *f;
 113     int found = 0;
 114     struct in_addr tmp_addr;
 115
 116     if (dns_addr.s_addr != 0) {
 117         struct stat old_stat;
 118         if ((curtime - dns_addr_time) < 1000) {
 119             *pdns_addr = dns_addr;
 120             return 0;
 121         }
 122         old_stat = dns_addr_stat;
 123         if (stat("/etc/resolv.conf", &dns_addr_stat) != 0)
 124             return -1;
 125         if ((dns_addr_stat.st_dev == old_stat.st_dev)
 126             && (dns_addr_stat.st_ino == old_stat.st_ino)
 127             && (dns_addr_stat.st_size == old_stat.st_size)
 128             && (dns_addr_stat.st_mtime == old_stat.st_mtime)) {
 129             *pdns_addr = dns_addr;
 130             return 0;
 131         }
 132     }
 133
 134     f = fopen("/etc/resolv.conf", "r");
 135     if (!f)
 136         return -1;
 137
 138 #ifdef DEBUG
 139     lprint("IP address of your DNS(s): ");
 140 #endif
 141     while (fgets(buff, 512, f) != NULL) {
 142         if (sscanf(buff, "nameserver%*[ \t]%256s", buff2) == 1) {
 143             if (!inet_aton(buff2, &tmp_addr))
 144                 continue;
 145             /* If it's the first one, set it to dns_addr */
 146             if (!found) {
 147                 *pdns_addr = tmp_addr;
 148                 dns_addr = tmp_addr;
 149                 dns_addr_time = curtime;
 150             }
 151 #ifdef DEBUG
 152             else
 153                 lprint(", ");
 154 #endif
 155             if (++found > 3) {
 156 #ifdef DEBUG
 157                 lprint("(more)");
 158 #endif
 159                 break;
 160             }
 161 #ifdef DEBUG
 162             else
 163                 lprint("%s", inet_ntoa(tmp_addr));
 164 #endif
 165         }
 166     }
 167     fclose(f);
 168     if (!found)
 169         return -1;
 170     return 0;
 171 }
 172
 173 #endif
 174
 175 static void slirp_init_once(void)
 176 {
 177     static int initialized;
 178 #ifdef _WIN32
 179     WSADATA Data;
 180 #endif
 181
 182     if (initialized) {
 183         return;
 184     }
 185     initialized = 1;
 186
 187 #ifdef _WIN32
 188     WSAStartup(MAKEWORD(2,0), &Data);
 189     atexit(winsock_cleanup);
 190 #endif
 191
 192     loopback_addr.s_addr = htonl(INADDR_LOOPBACK);
 193     loopback_mask = htonl(IN_CLASSA_NET);
 194 }
 195
 196 static void slirp_state_save(QEMUFile *f, void *opaque);
 197 static int slirp_state_load(QEMUFile *f, void *opaque, int version_id);
 198
 199 Slirp *slirp_init(int restricted, struct in_addr vnetwork,
 200                   struct in_addr vnetmask, struct in_addr vhost,
 201                   const char *vhostname, const char *tftp_path,
 202                   const char *bootfile, struct in_addr vdhcp_start,
 203                   struct in_addr vnameserver, const char **vdnssearch,
 204                   void *opaque)
 205 {
 206     Slirp *slirp = g_malloc0(sizeof(Slirp));
 207
 208     slirp_init_once();
 209
 210     slirp->restricted = restricted;
 211
 212     if_init(slirp);
 213     ip_init(slirp);
 214
 215     /* Initialise mbufs *after* setting the MTU */
 216     m_init(slirp);
 217
 218     slirp->vnetwork_addr = vnetwork;
 219     slirp->vnetwork_mask = vnetmask;
 220     slirp->vhost_addr = vhost;
 221     if (vhostname) {
 222         pstrcpy(slirp->client_hostname, sizeof(slirp->client_hostname),
 223                 vhostname);
 224     }
 225     slirp->tftp_prefix = g_strdup(tftp_path);
 226     slirp->bootp_filename = g_strdup(bootfile);
 227     slirp->vdhcp_startaddr = vdhcp_start;
 228     slirp->vnameserver_addr = vnameserver;
 229
 230     if (vdnssearch) {
 231         translate_dnssearch(slirp, vdnssearch);
 232     }
 233
 234     slirp->opaque = opaque;
 235
 236     register_savevm(NULL, "slirp", 0, 3,
 237                     slirp_state_save, slirp_state_load, slirp);
 238
 239     QTAILQ_INSERT_TAIL(&slirp_instances, slirp, entry);
 240
 241     return slirp;
 242 }
 243
 244 void slirp_cleanup(Slirp *slirp)
 245 {
 246     QTAILQ_REMOVE(&slirp_instances, slirp, entry);
 247
 248     unregister_savevm(NULL, "slirp", slirp);
 249
 250     ip_cleanup(slirp);
 251     m_cleanup(slirp);
 252
 253     g_free(slirp->vdnssearch);
 254     g_free(slirp->tftp_prefix);
 255     g_free(slirp->bootp_filename);
 256     g_free(slirp);
 257 }
 258
 259 #define CONN_CANFSEND(so) (((so)->so_state & (SS_FCANTSENDMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
 260 #define CONN_CANFRCV(so) (((so)->so_state & (SS_FCANTRCVMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
 261
 262 void slirp_update_timeout(uint32_t *timeout)
 263 {
 264     if (!QTAILQ_EMPTY(&slirp_instances)) {
 265         *timeout = MIN(1000, *timeout);
 266     }
 267 }
 268
 269 void slirp_pollfds_fill(GArray *pollfds)
 270 {
 271     Slirp *slirp;
 272     struct socket *so, *so_next;
 273
 274     if (QTAILQ_EMPTY(&slirp_instances)) {
 275         return;
 276     }
 277
 278     /*
 279      * First, TCP sockets
 280      */
 281     do_slowtimo = 0;
 282
 283     QTAILQ_FOREACH(slirp, &slirp_instances, entry) {
 284         /*
 285          * *_slowtimo needs calling if there are IP fragments
 286          * in the fragment queue, or there are TCP connections active
 287          */
 288         do_slowtimo |= ((slirp->tcb.so_next != &slirp->tcb) ||
 289                 (&slirp->ipq.ip_link != slirp->ipq.ip_link.next));
 290
 291         for (so = slirp->tcb.so_next; so != &slirp->tcb;
 292                 so = so_next) {
 293             int events = 0;
 294
 295             so_next = so->so_next;
 296
 297             so->pollfds_idx = -1;
 298
 299             /*
 300              * See if we need a tcp_fasttimo
 301              */
 302             if (time_fasttimo == 0 && so->so_tcpcb->t_flags & TF_DELACK) {
 303                 time_fasttimo = curtime; /* Flag when we want a fasttimo */
 304             }
 305
 306             /*
 307              * NOFDREF can include still connecting to local-host,
 308              * newly socreated() sockets etc. Don't want to select these.
 309              */
 310             if (so->so_state & SS_NOFDREF || so->s == -1) {
 311                 continue;
 312             }
 313
 314             /*
 315              * Set for reading sockets which are accepting
 316              */
 317             if (so->so_state & SS_FACCEPTCONN) {
 318                 GPollFD pfd = {
 319                     .fd = so->s,
 320                     .events = G_IO_IN | G_IO_HUP | G_IO_ERR,
 321                 };
 322                 so->pollfds_idx = pollfds->len;
 323                 g_array_append_val(pollfds, pfd);
 324                 continue;
 325             }
 326
 327             /*
 328              * Set for writing sockets which are connecting
 329              */
 330             if (so->so_state & SS_ISFCONNECTING) {
 331                 GPollFD pfd = {
 332                     .fd = so->s,
 333                     .events = G_IO_OUT | G_IO_ERR,
 334                 };
 335                 so->pollfds_idx = pollfds->len;
 336                 g_array_append_val(pollfds, pfd);
 337                 continue;
 338             }
 339
 340             /*
 341              * Set for writing if we are connected, can send more, and
 342              * we have something to send
 343              */
 344             if (CONN_CANFSEND(so) && so->so_rcv.sb_cc) {
 345                 events |= G_IO_OUT | G_IO_ERR;
 346             }
 347
 348             /*
 349              * Set for reading (and urgent data) if we are connected, can
 350              * receive more, and we have room for it XXX /2 ?
 351              */
 352             if (CONN_CANFRCV(so) &&
 353                 (so->so_snd.sb_cc < (so->so_snd.sb_datalen/2))) {
 354                 events |= G_IO_IN | G_IO_HUP | G_IO_ERR | G_IO_PRI;
 355             }
 356
 357             if (events) {
 358                 GPollFD pfd = {
 359                     .fd = so->s,
 360                     .events = events,
 361                 };
 362                 so->pollfds_idx = pollfds->len;
 363                 g_array_append_val(pollfds, pfd);
 364             }
 365         }
 366
 367         /*
 368          * UDP sockets
 369          */
 370         for (so = slirp->udb.so_next; so != &slirp->udb;
 371                 so = so_next) {
 372             so_next = so->so_next;
 373
 374             so->pollfds_idx = -1;
 375
 376             /*
 377              * See if it's timed out
 378              */
 379             if (so->so_expire) {
 380                 if (so->so_expire <= curtime) {
 381                     udp_detach(so);
 382                     continue;
 383                 } else {
 384                     do_slowtimo = 1; /* Let socket expire */
 385                 }
 386             }
 387
 388             /*
 389              * When UDP packets are received from over the
 390              * link, they're sendto()'d straight away, so
 391              * no need for setting for writing
 392              * Limit the number of packets queued by this session
 393              * to 4.  Note that even though we try and limit this
 394              * to 4 packets, the session could have more queued
 395              * if the packets needed to be fragmented
 396              * (XXX <= 4 ?)
 397              */
 398             if ((so->so_state & SS_ISFCONNECTED) && so->so_queued <= 4) {
 399                 GPollFD pfd = {
 400                     .fd = so->s,
 401                     .events = G_IO_IN | G_IO_HUP | G_IO_ERR,
 402                 };
 403                 so->pollfds_idx = pollfds->len;
 404                 g_array_append_val(pollfds, pfd);
 405             }
 406         }
 407
 408         /*
 409          * ICMP sockets
 410          */
 411         for (so = slirp->icmp.so_next; so != &slirp->icmp;
 412                 so = so_next) {
 413             so_next = so->so_next;
 414
 415             so->pollfds_idx = -1;
 416
 417             /*
 418              * See if it's timed out
 419              */
 420             if (so->so_expire) {
 421                 if (so->so_expire <= curtime) {
 422                     icmp_detach(so);
 423                     continue;
 424                 } else {
 425                     do_slowtimo = 1; /* Let socket expire */
 426                 }
 427             }
 428
 429             if (so->so_state & SS_ISFCONNECTED) {
 430                 GPollFD pfd = {
 431                     .fd = so->s,
 432                     .events = G_IO_IN | G_IO_HUP | G_IO_ERR,
 433                 };
 434                 so->pollfds_idx = pollfds->len;
 435                 g_array_append_val(pollfds, pfd);
 436             }
 437         }
 438     }
 439 }
 440
 441 void slirp_pollfds_poll(GArray *pollfds, int select_error)
 442 {
 443     Slirp *slirp;
 444     struct socket *so, *so_next;
 445     int ret;
 446
 447     if (QTAILQ_EMPTY(&slirp_instances)) {
 448         return;
 449     }
 450
 451     curtime = qemu_get_clock_ms(rt_clock);
 452
 453     QTAILQ_FOREACH(slirp, &slirp_instances, entry) {
 454         /*
 455          * See if anything has timed out
 456          */
 457         if (time_fasttimo && ((curtime - time_fasttimo) >= 2)) {
 458             tcp_fasttimo(slirp);
 459             time_fasttimo = 0;
 460         }
 461         if (do_slowtimo && ((curtime - last_slowtimo) >= 499)) {
 462             ip_slowtimo(slirp);
 463             tcp_slowtimo(slirp);
 464             last_slowtimo = curtime;
 465         }
 466
 467         /*
 468          * Check sockets
 469          */
 470         if (!select_error) {
 471             /*
 472              * Check TCP sockets
 473              */
 474             for (so = slirp->tcb.so_next; so != &slirp->tcb;
 475                     so = so_next) {
 476                 int revents;
 477
 478                 so_next = so->so_next;
 479
 480                 revents = 0;
 481                 if (so->pollfds_idx != -1) {
 482                     revents = g_array_index(pollfds, GPollFD,
 483                                             so->pollfds_idx).revents;
 484                 }
 485
 486                 if (so->so_state & SS_NOFDREF || so->s == -1) {
 487                     continue;
 488                 }
 489
 490                 /*
 491                  * Check for URG data
 492                  * This will soread as well, so no need to
 493                  * test for G_IO_IN below if this succeeds
 494                  */
 495                 if (revents & G_IO_PRI) {
 496                     sorecvoob(so);
 497                 }
 498                 /*
 499                  * Check sockets for reading
 500                  */
 501                 else if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR)) {
 502                     /*
 503                      * Check for incoming connections
 504                      */
 505                     if (so->so_state & SS_FACCEPTCONN) {
 506                         tcp_connect(so);
 507                         continue;
 508                     } /* else */
 509                     ret = soread(so);
 510
 511                     /* Output it if we read something */
 512                     if (ret > 0) {
 513                         tcp_output(sototcpcb(so));
 514                     }
 515                 }
 516
 517                 /*
 518                  * Check sockets for writing
 519                  */
 520                 if (!(so->so_state & SS_NOFDREF) &&
 521                         (revents & (G_IO_OUT | G_IO_ERR))) {
 522                     /*
 523                      * Check for non-blocking, still-connecting sockets
 524                      */
 525                     if (so->so_state & SS_ISFCONNECTING) {
 526                         /* Connected */
 527                         so->so_state &= ~SS_ISFCONNECTING;
 528
 529                         ret = send(so->s, (const void *) &ret, 0, 0);
 530                         if (ret < 0) {
 531                             /* XXXXX Must fix, zero bytes is a NOP */
 532                             if (errno == EAGAIN || errno == EWOULDBLOCK ||
 533                                 errno == EINPROGRESS || errno == ENOTCONN) {
 534                                 continue;
 535                             }
 536
 537                             /* else failed */
 538                             so->so_state &= SS_PERSISTENT_MASK;
 539                             so->so_state |= SS_NOFDREF;
 540                         }
 541                         /* else so->so_state &= ~SS_ISFCONNECTING; */
 542
 543                         /*
 544                          * Continue tcp_input
 545                          */
 546                         tcp_input((struct mbuf *)NULL, sizeof(struct ip), so);
 547                         /* continue; */
 548                     } else {
 549                         ret = sowrite(so);
 550                     }
 551                     /*
 552                      * XXXXX If we wrote something (a lot), there
 553                      * could be a need for a window update.
 554                      * In the worst case, the remote will send
 555                      * a window probe to get things going again
 556                      */
 557                 }
 558
 559                 /*
 560                  * Probe a still-connecting, non-blocking socket
 561                  * to check if it's still alive
 562                  */
 563 #ifdef PROBE_CONN
 564                 if (so->so_state & SS_ISFCONNECTING) {
 565                     ret = qemu_recv(so->s, &ret, 0, 0);
 566
 567                     if (ret < 0) {
 568                         /* XXX */
 569                         if (errno == EAGAIN || errno == EWOULDBLOCK ||
 570                             errno == EINPROGRESS || errno == ENOTCONN) {
 571                             continue; /* Still connecting, continue */
 572                         }
 573
 574                         /* else failed */
 575                         so->so_state &= SS_PERSISTENT_MASK;
 576                         so->so_state |= SS_NOFDREF;
 577
 578                         /* tcp_input will take care of it */
 579                     } else {
 580                         ret = send(so->s, &ret, 0, 0);
 581                         if (ret < 0) {
 582                             /* XXX */
 583                             if (errno == EAGAIN || errno == EWOULDBLOCK ||
 584                                 errno == EINPROGRESS || errno == ENOTCONN) {
 585                                 continue;
 586                             }
 587                             /* else failed */
 588                             so->so_state &= SS_PERSISTENT_MASK;
 589                             so->so_state |= SS_NOFDREF;
 590                         } else {
 591                             so->so_state &= ~SS_ISFCONNECTING;
 592                         }
 593
 594                     }
 595                     tcp_input((struct mbuf *)NULL, sizeof(struct ip), so);
 596                 } /* SS_ISFCONNECTING */
 597 #endif
 598             }
 599
 600             /*
 601              * Now UDP sockets.
 602              * Incoming packets are sent straight away, they're not buffered.
 603              * Incoming UDP data isn't buffered either.
 604              */
 605             for (so = slirp->udb.so_next; so != &slirp->udb;
 606                     so = so_next) {
 607                 int revents;
 608
 609                 so_next = so->so_next;
 610
 611                 revents = 0;
 612                 if (so->pollfds_idx != -1) {
 613                     revents = g_array_index(pollfds, GPollFD,
 614                             so->pollfds_idx).revents;
 615                 }
 616
 617                 if (so->s != -1 &&
 618                     (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR))) {
 619                     sorecvfrom(so);
 620                 }
 621             }
 622
 623             /*
 624              * Check incoming ICMP relies.
 625              */
 626             for (so = slirp->icmp.so_next; so != &slirp->icmp;
 627                     so = so_next) {
 628                     int revents;
 629
 630                     so_next = so->so_next;
 631
 632                     revents = 0;
 633                     if (so->pollfds_idx != -1) {
 634                         revents = g_array_index(pollfds, GPollFD,
 635                                                 so->pollfds_idx).revents;
 636                     }
 637
 638                     if (so->s != -1 &&
 639                         (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR))) {
 640                     icmp_receive(so);
 641                 }
 642             }
 643         }
 644
 645         if_start(slirp);
 646     }
 647 }
 648
 649 static void arp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
 650 {
 651     struct arphdr *ah = (struct arphdr *)(pkt + ETH_HLEN);
 652     uint8_t arp_reply[max(ETH_HLEN + sizeof(struct arphdr), 64)];
 653     struct ethhdr *reh = (struct ethhdr *)arp_reply;
 654     struct arphdr *rah = (struct arphdr *)(arp_reply + ETH_HLEN);
 655     int ar_op;
 656     struct ex_list *ex_ptr;
 657
 658     ar_op = ntohs(ah->ar_op);
 659     switch(ar_op) {
 660     case ARPOP_REQUEST:
 661         if (ah->ar_tip == ah->ar_sip) {
 662             /* Gratuitous ARP */
 663             arp_table_add(slirp, ah->ar_sip, ah->ar_sha);
 664             return;
 665         }
 666
 667         if ((ah->ar_tip & slirp->vnetwork_mask.s_addr) ==
 668             slirp->vnetwork_addr.s_addr) {
 669             if (ah->ar_tip == slirp->vnameserver_addr.s_addr ||
 670                 ah->ar_tip == slirp->vhost_addr.s_addr)
 671                 goto arp_ok;
 672             for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
 673                 if (ex_ptr->ex_addr.s_addr == ah->ar_tip)
 674                     goto arp_ok;
 675             }
 676             return;
 677         arp_ok:
 678             memset(arp_reply, 0, sizeof(arp_reply));
 679
 680             arp_table_add(slirp, ah->ar_sip, ah->ar_sha);
 681
 682             /* ARP request for alias/dns mac address */
 683             memcpy(reh->h_dest, pkt + ETH_ALEN, ETH_ALEN);
 684             memcpy(reh->h_source, special_ethaddr, ETH_ALEN - 4);
 685             memcpy(&reh->h_source[2], &ah->ar_tip, 4);
 686             reh->h_proto = htons(ETH_P_ARP);
 687
 688             rah->ar_hrd = htons(1);
 689             rah->ar_pro = htons(ETH_P_IP);
 690             rah->ar_hln = ETH_ALEN;
 691             rah->ar_pln = 4;
 692             rah->ar_op = htons(ARPOP_REPLY);
 693             memcpy(rah->ar_sha, reh->h_source, ETH_ALEN);
 694             rah->ar_sip = ah->ar_tip;
 695             memcpy(rah->ar_tha, ah->ar_sha, ETH_ALEN);
 696             rah->ar_tip = ah->ar_sip;
 697             slirp_output(slirp->opaque, arp_reply, sizeof(arp_reply));
 698         }
 699         break;
 700     case ARPOP_REPLY:
 701         arp_table_add(slirp, ah->ar_sip, ah->ar_sha);
 702         break;
 703     default:
 704         break;
 705     }
 706 }
 707
 708 void slirp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
 709 {
 710     struct mbuf *m;
 711     int proto;
 712
 713     if (pkt_len < ETH_HLEN)
 714         return;
 715
 716     proto = ntohs(*(uint16_t *)(pkt + 12));
 717     switch(proto) {
 718     case ETH_P_ARP:
 719         arp_input(slirp, pkt, pkt_len);
 720         break;
 721     case ETH_P_IP:
 722         m = m_get(slirp);
 723         if (!m)
 724             return;
 725         /* Note: we add to align the IP header */
 726         if (M_FREEROOM(m) < pkt_len + 2) {
 727             m_inc(m, pkt_len + 2);
 728         }
 729         m->m_len = pkt_len + 2;
 730         memcpy(m->m_data + 2, pkt, pkt_len);
 731
 732         m->m_data += 2 + ETH_HLEN;
 733         m->m_len -= 2 + ETH_HLEN;
 734
 735         ip_input(m);
 736         break;
 737     default:
 738         break;
 739     }
 740 }
 741
 742 /* Output the IP packet to the ethernet device. Returns 0 if the packet must be
 743  * re-queued.
 744  */
 745 int if_encap(Slirp *slirp, struct mbuf *ifm)
 746 {
 747     uint8_t buf[1600];
 748     struct ethhdr *eh = (struct ethhdr *)buf;
 749     uint8_t ethaddr[ETH_ALEN];
 750     const struct ip *iph = (const struct ip *)ifm->m_data;
 751
 752     if (ifm->m_len + ETH_HLEN > sizeof(buf)) {
 753         return 1;
 754     }
 755
 756     if (!arp_table_search(slirp, iph->ip_dst.s_addr, ethaddr)) {
 757         uint8_t arp_req[ETH_HLEN + sizeof(struct arphdr)];
 758         struct ethhdr *reh = (struct ethhdr *)arp_req;
 759         struct arphdr *rah = (struct arphdr *)(arp_req + ETH_HLEN);
 760
 761         if (!ifm->arp_requested) {
 762             /* If the client addr is not known, send an ARP request */
 763             memset(reh->h_dest, 0xff, ETH_ALEN);
 764             memcpy(reh->h_source, special_ethaddr, ETH_ALEN - 4);
 765             memcpy(&reh->h_source[2], &slirp->vhost_addr, 4);
 766             reh->h_proto = htons(ETH_P_ARP);
 767             rah->ar_hrd = htons(1);
 768             rah->ar_pro = htons(ETH_P_IP);
 769             rah->ar_hln = ETH_ALEN;
 770             rah->ar_pln = 4;
 771             rah->ar_op = htons(ARPOP_REQUEST);
 772
 773             /* source hw addr */
 774             memcpy(rah->ar_sha, special_ethaddr, ETH_ALEN - 4);
 775             memcpy(&rah->ar_sha[2], &slirp->vhost_addr, 4);
 776
 777             /* source IP */
 778             rah->ar_sip = slirp->vhost_addr.s_addr;
 779
 780             /* target hw addr (none) */
 781             memset(rah->ar_tha, 0, ETH_ALEN);
 782
 783             /* target IP */
 784             rah->ar_tip = iph->ip_dst.s_addr;
 785             slirp->client_ipaddr = iph->ip_dst;
 786             slirp_output(slirp->opaque, arp_req, sizeof(arp_req));
 787             ifm->arp_requested = true;
 788
 789             /* Expire request and drop outgoing packet after 1 second */
 790             ifm->expiration_date = qemu_get_clock_ns(rt_clock) + 1000000000ULL;
 791         }
 792         return 0;
 793     } else {
 794         memcpy(eh->h_dest, ethaddr, ETH_ALEN);
 795         memcpy(eh->h_source, special_ethaddr, ETH_ALEN - 4);
 796         /* XXX: not correct */
 797         memcpy(&eh->h_source[2], &slirp->vhost_addr, 4);
 798         eh->h_proto = htons(ETH_P_IP);
 799         memcpy(buf + sizeof(struct ethhdr), ifm->m_data, ifm->m_len);
 800         slirp_output(slirp->opaque, buf, ifm->m_len + ETH_HLEN);
 801         return 1;
 802     }
 803 }
 804
 805 /* Drop host forwarding rule, return 0 if found. */
 806 int slirp_remove_hostfwd(Slirp *slirp, int is_udp, struct in_addr host_addr,
 807                          int host_port)
 808 {
 809     struct socket *so;
 810     struct socket *head = (is_udp ? &slirp->udb : &slirp->tcb);
 811     struct sockaddr_in addr;
 812     int port = htons(host_port);
 813     socklen_t addr_len;
 814
 815     for (so = head->so_next; so != head; so = so->so_next) {
 816         addr_len = sizeof(addr);
 817         if ((so->so_state & SS_HOSTFWD) &&
 818             getsockname(so->s, (struct sockaddr *)&addr, &addr_len) == 0 &&
 819             addr.sin_addr.s_addr == host_addr.s_addr &&
 820             addr.sin_port == port) {
 821             close(so->s);
 822             sofree(so);
 823             return 0;
 824         }
 825     }
 826
 827     return -1;
 828 }
 829
 830 int slirp_add_hostfwd(Slirp *slirp, int is_udp, struct in_addr host_addr,
 831                       int host_port, struct in_addr guest_addr, int guest_port)
 832 {
 833     if (!guest_addr.s_addr) {
 834         guest_addr = slirp->vdhcp_startaddr;
 835     }
 836     if (is_udp) {
 837         if (!udp_listen(slirp, host_addr.s_addr, htons(host_port),
 838                         guest_addr.s_addr, htons(guest_port), SS_HOSTFWD))
 839             return -1;
 840     } else {
 841         if (!tcp_listen(slirp, host_addr.s_addr, htons(host_port),
 842                         guest_addr.s_addr, htons(guest_port), SS_HOSTFWD))
 843             return -1;
 844     }
 845     return 0;
 846 }
 847
 848 int slirp_add_exec(Slirp *slirp, int do_pty, const void *args,
 849                    struct in_addr *guest_addr, int guest_port)
 850 {
 851     if (!guest_addr->s_addr) {
 852         guest_addr->s_addr = slirp->vnetwork_addr.s_addr |
 853             (htonl(0x0204) & ~slirp->vnetwork_mask.s_addr);
 854     }
 855     if ((guest_addr->s_addr & slirp->vnetwork_mask.s_addr) !=
 856         slirp->vnetwork_addr.s_addr ||
 857         guest_addr->s_addr == slirp->vhost_addr.s_addr ||
 858         guest_addr->s_addr == slirp->vnameserver_addr.s_addr) {
 859         return -1;
 860     }
 861     return add_exec(&slirp->exec_list, do_pty, (char *)args, *guest_addr,
 862                     htons(guest_port));
 863 }
 864
 865 ssize_t slirp_send(struct socket *so, const void *buf, size_t len, int flags)
 866 {
 867     if (so->s == -1 && so->extra) {
 868         qemu_chr_fe_write(so->extra, buf, len);
 869         return len;
 870     }
 871
 872     return send(so->s, buf, len, flags);
 873 }
 874
 875 static struct socket *
 876 slirp_find_ctl_socket(Slirp *slirp, struct in_addr guest_addr, int guest_port)
 877 {
 878     struct socket *so;
 879
 880     for (so = slirp->tcb.so_next; so != &slirp->tcb; so = so->so_next) {
 881         if (so->so_faddr.s_addr == guest_addr.s_addr &&
 882             htons(so->so_fport) == guest_port) {
 883             return so;
 884         }
 885     }
 886     return NULL;
 887 }
 888
 889 size_t slirp_socket_can_recv(Slirp *slirp, struct in_addr guest_addr,
 890                              int guest_port)
 891 {
 892     struct iovec iov[2];
 893     struct socket *so;
 894
 895     so = slirp_find_ctl_socket(slirp, guest_addr, guest_port);
 896
 897     if (!so || so->so_state & SS_NOFDREF) {
 898         return 0;
 899     }
 900
 901     if (!CONN_CANFRCV(so) || so->so_snd.sb_cc >= (so->so_snd.sb_datalen/2)) {
 902         return 0;
 903     }
 904
 905     return sopreprbuf(so, iov, NULL);
 906 }
 907
 908 void slirp_socket_recv(Slirp *slirp, struct in_addr guest_addr, int guest_port,
 909                        const uint8_t *buf, int size)
 910 {
 911     int ret;
 912     struct socket *so = slirp_find_ctl_socket(slirp, guest_addr, guest_port);
 913
 914     if (!so)
 915         return;
 916
 917     ret = soreadbuf(so, (const char *)buf, size);
 918
 919     if (ret > 0)
 920         tcp_output(sototcpcb(so));
 921 }
 922
 923 static void slirp_tcp_save(QEMUFile *f, struct tcpcb *tp)
 924 {
 925     int i;
 926
 927     qemu_put_sbe16(f, tp->t_state);
 928     for (i = 0; i < TCPT_NTIMERS; i++)
 929         qemu_put_sbe16(f, tp->t_timer[i]);
 930     qemu_put_sbe16(f, tp->t_rxtshift);
 931     qemu_put_sbe16(f, tp->t_rxtcur);
 932     qemu_put_sbe16(f, tp->t_dupacks);
 933     qemu_put_be16(f, tp->t_maxseg);
 934     qemu_put_sbyte(f, tp->t_force);
 935     qemu_put_be16(f, tp->t_flags);
 936     qemu_put_be32(f, tp->snd_una);
 937     qemu_put_be32(f, tp->snd_nxt);
 938     qemu_put_be32(f, tp->snd_up);
 939     qemu_put_be32(f, tp->snd_wl1);
 940     qemu_put_be32(f, tp->snd_wl2);
 941     qemu_put_be32(f, tp->iss);
 942     qemu_put_be32(f, tp->snd_wnd);
 943     qemu_put_be32(f, tp->rcv_wnd);
 944     qemu_put_be32(f, tp->rcv_nxt);
 945     qemu_put_be32(f, tp->rcv_up);
 946     qemu_put_be32(f, tp->irs);
 947     qemu_put_be32(f, tp->rcv_adv);
 948     qemu_put_be32(f, tp->snd_max);
 949     qemu_put_be32(f, tp->snd_cwnd);
 950     qemu_put_be32(f, tp->snd_ssthresh);
 951     qemu_put_sbe16(f, tp->t_idle);
 952     qemu_put_sbe16(f, tp->t_rtt);
 953     qemu_put_be32(f, tp->t_rtseq);
 954     qemu_put_sbe16(f, tp->t_srtt);
 955     qemu_put_sbe16(f, tp->t_rttvar);
 956     qemu_put_be16(f, tp->t_rttmin);
 957     qemu_put_be32(f, tp->max_sndwnd);
 958     qemu_put_byte(f, tp->t_oobflags);
 959     qemu_put_byte(f, tp->t_iobc);
 960     qemu_put_sbe16(f, tp->t_softerror);
 961     qemu_put_byte(f, tp->snd_scale);
 962     qemu_put_byte(f, tp->rcv_scale);
 963     qemu_put_byte(f, tp->request_r_scale);
 964     qemu_put_byte(f, tp->requested_s_scale);
 965     qemu_put_be32(f, tp->ts_recent);
 966     qemu_put_be32(f, tp->ts_recent_age);
 967     qemu_put_be32(f, tp->last_ack_sent);
 968 }
 969
 970 static void slirp_sbuf_save(QEMUFile *f, struct sbuf *sbuf)
 971 {
 972     uint32_t off;
 973
 974     qemu_put_be32(f, sbuf->sb_cc);
 975     qemu_put_be32(f, sbuf->sb_datalen);
 976     off = (uint32_t)(sbuf->sb_wptr - sbuf->sb_data);
 977     qemu_put_sbe32(f, off);
 978     off = (uint32_t)(sbuf->sb_rptr - sbuf->sb_data);
 979     qemu_put_sbe32(f, off);
 980     qemu_put_buffer(f, (unsigned char*)sbuf->sb_data, sbuf->sb_datalen);
 981 }
 982
 983 static void slirp_socket_save(QEMUFile *f, struct socket *so)
 984 {
 985     qemu_put_be32(f, so->so_urgc);
 986     qemu_put_be32(f, so->so_faddr.s_addr);
 987     qemu_put_be32(f, so->so_laddr.s_addr);
 988     qemu_put_be16(f, so->so_fport);
 989     qemu_put_be16(f, so->so_lport);
 990     qemu_put_byte(f, so->so_iptos);
 991     qemu_put_byte(f, so->so_emu);
 992     qemu_put_byte(f, so->so_type);
 993     qemu_put_be32(f, so->so_state);
 994     slirp_sbuf_save(f, &so->so_rcv);
 995     slirp_sbuf_save(f, &so->so_snd);
 996     slirp_tcp_save(f, so->so_tcpcb);
 997 }
 998
 999 static void slirp_bootp_save(QEMUFile *f, Slirp *slirp)
1000 {
1001     int i;
1002
1003     for (i = 0; i < NB_BOOTP_CLIENTS; i++) {
1004         qemu_put_be16(f, slirp->bootp_clients[i].allocated);
1005         qemu_put_buffer(f, slirp->bootp_clients[i].macaddr, 6);
1006     }
1007 }
1008
1009 static void slirp_state_save(QEMUFile *f, void *opaque)
1010 {
1011     Slirp *slirp = opaque;
1012     struct ex_list *ex_ptr;
1013
1014     for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
1015         if (ex_ptr->ex_pty == 3) {
1016             struct socket *so;
1017             so = slirp_find_ctl_socket(slirp, ex_ptr->ex_addr,
1018                                        ntohs(ex_ptr->ex_fport));
1019             if (!so)
1020                 continue;
1021
1022             qemu_put_byte(f, 42);
1023             slirp_socket_save(f, so);
1024         }
1025     qemu_put_byte(f, 0);
1026
1027     qemu_put_be16(f, slirp->ip_id);
1028
1029     slirp_bootp_save(f, slirp);
1030 }
1031
1032 static void slirp_tcp_load(QEMUFile *f, struct tcpcb *tp)
1033 {
1034     int i;
1035
1036     tp->t_state = qemu_get_sbe16(f);
1037     for (i = 0; i < TCPT_NTIMERS; i++)
1038         tp->t_timer[i] = qemu_get_sbe16(f);
1039     tp->t_rxtshift = qemu_get_sbe16(f);
1040     tp->t_rxtcur = qemu_get_sbe16(f);
1041     tp->t_dupacks = qemu_get_sbe16(f);
1042     tp->t_maxseg = qemu_get_be16(f);
1043     tp->t_force = qemu_get_sbyte(f);
1044     tp->t_flags = qemu_get_be16(f);
1045     tp->snd_una = qemu_get_be32(f);
1046     tp->snd_nxt = qemu_get_be32(f);
1047     tp->snd_up = qemu_get_be32(f);
1048     tp->snd_wl1 = qemu_get_be32(f);
1049     tp->snd_wl2 = qemu_get_be32(f);
1050     tp->iss = qemu_get_be32(f);
1051     tp->snd_wnd = qemu_get_be32(f);
1052     tp->rcv_wnd = qemu_get_be32(f);
1053     tp->rcv_nxt = qemu_get_be32(f);
1054     tp->rcv_up = qemu_get_be32(f);
1055     tp->irs = qemu_get_be32(f);
1056     tp->rcv_adv = qemu_get_be32(f);
1057     tp->snd_max = qemu_get_be32(f);
1058     tp->snd_cwnd = qemu_get_be32(f);
1059     tp->snd_ssthresh = qemu_get_be32(f);
1060     tp->t_idle = qemu_get_sbe16(f);
1061     tp->t_rtt = qemu_get_sbe16(f);
1062     tp->t_rtseq = qemu_get_be32(f);
1063     tp->t_srtt = qemu_get_sbe16(f);
1064     tp->t_rttvar = qemu_get_sbe16(f);
1065     tp->t_rttmin = qemu_get_be16(f);
1066     tp->max_sndwnd = qemu_get_be32(f);
1067     tp->t_oobflags = qemu_get_byte(f);
1068     tp->t_iobc = qemu_get_byte(f);
1069     tp->t_softerror = qemu_get_sbe16(f);
1070     tp->snd_scale = qemu_get_byte(f);
1071     tp->rcv_scale = qemu_get_byte(f);
1072     tp->request_r_scale = qemu_get_byte(f);
1073     tp->requested_s_scale = qemu_get_byte(f);
1074     tp->ts_recent = qemu_get_be32(f);
1075     tp->ts_recent_age = qemu_get_be32(f);
1076     tp->last_ack_sent = qemu_get_be32(f);
1077     tcp_template(tp);
1078 }
1079
1080 static int slirp_sbuf_load(QEMUFile *f, struct sbuf *sbuf)
1081 {
1082     uint32_t off, sb_cc, sb_datalen;
1083
1084     sb_cc = qemu_get_be32(f);
1085     sb_datalen = qemu_get_be32(f);
1086
1087     sbreserve(sbuf, sb_datalen);
1088
1089     if (sbuf->sb_datalen != sb_datalen)
1090         return -ENOMEM;
1091
1092     sbuf->sb_cc = sb_cc;
1093
1094     off = qemu_get_sbe32(f);
1095     sbuf->sb_wptr = sbuf->sb_data + off;
1096     off = qemu_get_sbe32(f);
1097     sbuf->sb_rptr = sbuf->sb_data + off;
1098     qemu_get_buffer(f, (unsigned char*)sbuf->sb_data, sbuf->sb_datalen);
1099
1100     return 0;
1101 }
1102
1103 static int slirp_socket_load(QEMUFile *f, struct socket *so)
1104 {
1105     if (tcp_attach(so) < 0)
1106         return -ENOMEM;
1107
1108     so->so_urgc = qemu_get_be32(f);
1109     so->so_faddr.s_addr = qemu_get_be32(f);
1110     so->so_laddr.s_addr = qemu_get_be32(f);
1111     so->so_fport = qemu_get_be16(f);
1112     so->so_lport = qemu_get_be16(f);
1113     so->so_iptos = qemu_get_byte(f);
1114     so->so_emu = qemu_get_byte(f);
1115     so->so_type = qemu_get_byte(f);
1116     so->so_state = qemu_get_be32(f);
1117     if (slirp_sbuf_load(f, &so->so_rcv) < 0)
1118         return -ENOMEM;
1119     if (slirp_sbuf_load(f, &so->so_snd) < 0)
1120         return -ENOMEM;
1121     slirp_tcp_load(f, so->so_tcpcb);
1122
1123     return 0;
1124 }
1125
1126 static void slirp_bootp_load(QEMUFile *f, Slirp *slirp)
1127 {
1128     int i;
1129
1130     for (i = 0; i < NB_BOOTP_CLIENTS; i++) {
1131         slirp->bootp_clients[i].allocated = qemu_get_be16(f);
1132         qemu_get_buffer(f, slirp->bootp_clients[i].macaddr, 6);
1133     }
1134 }
1135
1136 static int slirp_state_load(QEMUFile *f, void *opaque, int version_id)
1137 {
1138     Slirp *slirp = opaque;
1139     struct ex_list *ex_ptr;
1140
1141     while (qemu_get_byte(f)) {
1142         int ret;
1143         struct socket *so = socreate(slirp);
1144
1145         if (!so)
1146             return -ENOMEM;
1147
1148         ret = slirp_socket_load(f, so);
1149
1150         if (ret < 0)
1151             return ret;
1152
1153         if ((so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) !=
1154             slirp->vnetwork_addr.s_addr) {
1155             return -EINVAL;
1156         }
1157         for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
1158             if (ex_ptr->ex_pty == 3 &&
1159                 so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr &&
1160                 so->so_fport == ex_ptr->ex_fport) {
1161                 break;
1162             }
1163         }
1164         if (!ex_ptr)
1165             return -EINVAL;
1166
1167         so->extra = (void *)ex_ptr->ex_exec;
1168     }
1169
1170     if (version_id >= 2) {
1171         slirp->ip_id = qemu_get_be16(f);
1172     }
1173
1174     if (version_id >= 3) {
1175         slirp_bootp_load(f, slirp);
1176     }
1177
1178     return 0;
1179 }