commit 12b513d837c9da5277390ddaf98ca0058339977a
author Jan Kiszka <jan.kiszka@siemens.com> Wed Jul 20 12:20:13 2011 +0200
committer Anthony Liguori <aliguori@us.ibm.com> Sat Jul 23 10:19:49 2011 -0500
tree 57d4e937818492effc1f31402dc830b1ca0b206c
parent 80f52a6694423da7a40e2ec39e14a5817184c7ef

slirp: Fix restricted mode

This aligns the code to what the documentation claims: Allow everything
but requests that would have to be routed outside of the virtual LAN.

So we need to drop the unneeded IP-level filter, allow TFTP requests,
and add the missing protocol-level filter to ICMP.

CC: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

slirp/ip_icmp.c

diff --git a/slirp/ip_icmp.c b/slirp/ip_icmp.c
index 751a8e2..0cd129c 100644
--- a/slirp/ip_icmp.c
+++ b/slirp/ip_icmp.c
@@ -101,6 +101,8 @@
     ip->ip_len += hlen;	             /* since ip_input subtracts this */
     if (ip->ip_dst.s_addr == slirp->vhost_addr.s_addr) {
       icmp_reflect(m);
+    } else if (slirp->restricted) {
+        goto freeit;
     } else {
       struct socket *so;
       struct sockaddr_in addr;