12  * the COPYING file in the top-level directory.
17  * - There is no manual page
18  * - The syntax of the ACL file is not documented anywhere
19  * - parse_acl_file() doesn't report fopen() failure properly, fails
45 #include "net/tap-linux.h"
48 #include <cap-ng.h>
71             "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n");  in usage()
82         return -1;  in parse_acl_file()
116         while (arg != argend && g_ascii_isspace(*(argend - 1))) {  in parse_acl_file()
117             argend--;  in parse_acl_file()
129                 acl_rule->type = ACL_DENY_ALL;  in parse_acl_file()
131                 acl_rule->type = ACL_DENY;  in parse_acl_file()
132                 snprintf(acl_rule->iface, IFNAMSIZ, "%s", arg);  in parse_acl_file()
138                 acl_rule->type = ACL_ALLOW_ALL;  in parse_acl_file()
140                 acl_rule->type = ACL_ALLOW;  in parse_acl_file()
141                 snprintf(acl_rule->iface, IFNAMSIZ, "%s", arg);  in parse_acl_file()
159     return -1;  in parse_acl_file()
167     if (ioctl(fd, TUNGETFEATURES, &features) == -1) {  in has_vnet_hdr()
181     snprintf(ifr->ifr_name, IFNAMSIZ, "%s", ifname);  in prep_ifreq()
196     cmsg->cmsg_level = SOL_SOCKET;  in send_fd()
197     cmsg->cmsg_type = SCM_RIGHTS;  in send_fd()
198     cmsg->cmsg_len = CMSG_LEN(sizeof(fd));  in send_fd()
199     msg.msg_controllen = cmsg->cmsg_len;  in send_fd()
219         return -1;  in drop_privileges()
225         return -1;  in drop_privileges()
239     int fd = -1, ctlfd = -1, unixfd = -1;  in main()
255         if (drop_privileges() == -1) {  in main()
266         if (strcmp(argv[index], "--use-vnet") == 0) {  in main()
268         } else if (strncmp(argv[index], "--br=", 5) == 0) {  in main()
270         } else if (strncmp(argv[index], "--fd=", 5) == 0) {  in main()
278     if (bridge == NULL || unixfd == -1) {  in main()
290     if (parse_acl_file(acl_file, &acl_list) == -1) {  in main()
297     /* validate bridge against acl -- default policy is to deny  in main()
304         switch (acl_rule->type) {  in main()
309             if (strcmp(bridge, acl_rule->iface) == 0) {  in main()
317             if (strcmp(bridge, acl_rule->iface) == 0) {  in main()
332     if (ctlfd == -1) {  in main()
340     if (fd == -1) {  in main()
354     if (ioctl(fd, TUNSETIFF, &ifr) == -1) {  in main()
360     /* save tap device name */  in main()
365     if (ioctl(ctlfd, SIOCGIFMTU, &ifr) == -1) {  in main()
372     /* save mtu */  in main()
378     if (ioctl(ctlfd, SIOCSIFMTU, &ifr) == -1) {  in main()
385     /* Linux uses the lowest enslaved MAC address as the MAC address of  in main()
386      * the bridge.  Set MAC address to a high value so that it doesn't  in main()
387      * affect the MAC address of the bridge.  in main()
390         fprintf(stderr, "failed to get MAC address of device `%s': %s\n",  in main()
397         fprintf(stderr, "failed to set MAC address of device `%s': %s\n",  in main()
417     if (ret == -1) {  in main()
426     if (ioctl(ctlfd, SIOCGIFFLAGS, &ifr) == -1) {  in main()
434     if (ioctl(ctlfd, SIOCSIFFLAGS, &ifr) == -1) {  in main()
442     if (send_fd(unixfd, fd) == -1) {  in main()