1 /* $OpenBSD: priv.c,v 1.17 2021/03/29 23:37:01 dv Exp $ */ 2 3 /* 4 * Copyright (c) 2016 Reyk Floeter <reyk@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/param.h> /* nitems */ 20 #include <sys/queue.h> 21 #include <sys/stat.h> 22 #include <sys/socket.h> 23 #include <sys/un.h> 24 #include <sys/ioctl.h> 25 #include <sys/tree.h> 26 27 #include <net/if.h> 28 #include <netinet/in.h> 29 #include <netinet/if_ether.h> 30 #include <netinet6/in6_var.h> 31 #include <netinet6/nd6.h> 32 #include <net/if_bridge.h> 33 34 #include <arpa/inet.h> 35 36 #include <errno.h> 37 #include <event.h> 38 #include <fcntl.h> 39 #include <stdlib.h> 40 #include <stdio.h> 41 #include <string.h> 42 #include <unistd.h> 43 #include <signal.h> 44 #include <ctype.h> 45 46 #include "proc.h" 47 #include "vmd.h" 48 49 int priv_dispatch_parent(int, struct privsep_proc *, struct imsg *); 50 void priv_run(struct privsep *, struct privsep_proc *, void *); 51 52 static struct privsep_proc procs[] = { 53 { "parent", PROC_PARENT, priv_dispatch_parent } 54 }; 55 56 void 57 priv(struct privsep *ps, struct privsep_proc *p) 58 { 59 proc_run(ps, p, procs, nitems(procs), priv_run, NULL); 60 } 61 62 void 63 priv_run(struct privsep *ps, struct privsep_proc *p, void *arg) 64 { 65 struct vmd *env = ps->ps_env; 66 67 /* 68 * no pledge(2) in the "priv" process: 69 * write ioctls are not permitted by pledge. 70 */ 71 72 /* Open our own socket for generic interface ioctls */ 73 if ((env->vmd_fd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) 74 fatal("socket"); 75 76 /* But we need a different fd for IPv6 */ 77 if ((env->vmd_fd6 = socket(AF_INET6, SOCK_DGRAM, 0)) == -1) 78 fatal("socket6"); 79 } 80 81 int 82 priv_dispatch_parent(int fd, struct privsep_proc *p, struct imsg *imsg) 83 { 84 const char *desct[] = { "tap", "switch", "bridge", 85 "veb", NULL }; 86 struct privsep *ps = p->p_ps; 87 struct vmop_ifreq vfr; 88 struct vmd *env = ps->ps_env; 89 struct ifreq ifr; 90 struct ifbreq ifbr; 91 struct ifgroupreq ifgr; 92 struct ifaliasreq ifra; 93 struct in6_aliasreq in6_ifra; 94 struct if_afreq ifar; 95 struct vmop_addr_req vareq; 96 struct vmop_addr_result varesult; 97 char type[IF_NAMESIZE]; 98 99 switch (imsg->hdr.type) { 100 case IMSG_VMDOP_PRIV_IFDESCR: 101 case IMSG_VMDOP_PRIV_IFRDOMAIN: 102 case IMSG_VMDOP_PRIV_IFEXISTS: 103 case IMSG_VMDOP_PRIV_IFADD: 104 case IMSG_VMDOP_PRIV_IFUP: 105 case IMSG_VMDOP_PRIV_IFDOWN: 106 case IMSG_VMDOP_PRIV_IFGROUP: 107 case IMSG_VMDOP_PRIV_IFADDR: 108 case IMSG_VMDOP_PRIV_IFADDR6: 109 IMSG_SIZE_CHECK(imsg, &vfr); 110 memcpy(&vfr, imsg->data, sizeof(vfr)); 111 112 /* We should not get malicious requests from the parent */ 113 if (priv_getiftype(vfr.vfr_name, type, NULL) == -1 || 114 priv_findname(type, desct) == -1) 115 fatalx("%s: rejected priv operation on interface: %s", 116 __func__, vfr.vfr_name); 117 break; 118 case IMSG_VMDOP_CONFIG: 119 case IMSG_CTL_RESET: 120 case IMSG_VMDOP_PRIV_GET_ADDR: 121 break; 122 default: 123 return (-1); 124 } 125 126 switch (imsg->hdr.type) { 127 case IMSG_VMDOP_PRIV_IFDESCR: 128 /* Set the interface description */ 129 strlcpy(ifr.ifr_name, vfr.vfr_name, sizeof(ifr.ifr_name)); 130 ifr.ifr_data = (caddr_t)vfr.vfr_value; 131 if (ioctl(env->vmd_fd, SIOCSIFDESCR, &ifr) == -1) 132 log_warn("SIOCSIFDESCR"); 133 break; 134 case IMSG_VMDOP_PRIV_IFRDOMAIN: 135 strlcpy(ifr.ifr_name, vfr.vfr_name, sizeof(ifr.ifr_name)); 136 ifr.ifr_rdomainid = vfr.vfr_id; 137 if (ioctl(env->vmd_fd, SIOCSIFRDOMAIN, &ifr) == -1) 138 log_warn("SIOCSIFRDOMAIN"); 139 break; 140 case IMSG_VMDOP_PRIV_IFADD: 141 if (priv_getiftype(vfr.vfr_value, type, NULL) == -1) 142 fatalx("%s: rejected to add interface: %s", 143 __func__, vfr.vfr_value); 144 145 /* Attach the device to the bridge */ 146 strlcpy(ifbr.ifbr_name, vfr.vfr_name, 147 sizeof(ifbr.ifbr_name)); 148 strlcpy(ifbr.ifbr_ifsname, vfr.vfr_value, 149 sizeof(ifbr.ifbr_ifsname)); 150 if (ioctl(env->vmd_fd, SIOCBRDGADD, &ifbr) == -1 && 151 errno != EEXIST) 152 log_warn("SIOCBRDGADD"); 153 break; 154 case IMSG_VMDOP_PRIV_IFEXISTS: 155 /* Determine if bridge/switch exists */ 156 strlcpy(ifr.ifr_name, vfr.vfr_name, sizeof(ifr.ifr_name)); 157 if (ioctl(env->vmd_fd, SIOCGIFFLAGS, &ifr) == -1) 158 fatalx("%s: bridge \"%s\" does not exist", 159 __func__, vfr.vfr_name); 160 break; 161 case IMSG_VMDOP_PRIV_IFUP: 162 case IMSG_VMDOP_PRIV_IFDOWN: 163 /* Set the interface status */ 164 strlcpy(ifr.ifr_name, vfr.vfr_name, sizeof(ifr.ifr_name)); 165 if (ioctl(env->vmd_fd, SIOCGIFFLAGS, &ifr) == -1) { 166 log_warn("SIOCGIFFLAGS"); 167 break; 168 } 169 if (imsg->hdr.type == IMSG_VMDOP_PRIV_IFUP) 170 ifr.ifr_flags |= IFF_UP; 171 else 172 ifr.ifr_flags &= ~IFF_UP; 173 if (ioctl(env->vmd_fd, SIOCSIFFLAGS, &ifr) == -1) 174 log_warn("SIOCSIFFLAGS"); 175 break; 176 case IMSG_VMDOP_PRIV_IFGROUP: 177 if (priv_validgroup(vfr.vfr_value) == -1) 178 fatalx("%s: invalid group name", __func__); 179 180 if (strlcpy(ifgr.ifgr_name, vfr.vfr_name, 181 sizeof(ifgr.ifgr_name)) >= sizeof(ifgr.ifgr_name) || 182 strlcpy(ifgr.ifgr_group, vfr.vfr_value, 183 sizeof(ifgr.ifgr_group)) >= sizeof(ifgr.ifgr_group)) 184 fatalx("%s: group name too long", __func__); 185 186 if (ioctl(env->vmd_fd, SIOCAIFGROUP, &ifgr) == -1 && 187 errno != EEXIST) 188 log_warn("SIOCAIFGROUP"); 189 break; 190 case IMSG_VMDOP_PRIV_IFADDR: 191 memset(&ifra, 0, sizeof(ifra)); 192 193 if (vfr.vfr_addr.ss_family != AF_INET || 194 vfr.vfr_addr.ss_family != vfr.vfr_mask.ss_family) 195 fatalx("%s: invalid address family", __func__); 196 197 /* Set the interface address */ 198 strlcpy(ifra.ifra_name, vfr.vfr_name, sizeof(ifra.ifra_name)); 199 200 ifra.ifra_addr.sa_len = 201 ifra.ifra_mask.sa_len = 202 sizeof(struct sockaddr_in); 203 204 memcpy(&ifra.ifra_addr, &vfr.vfr_addr, 205 ifra.ifra_addr.sa_len); 206 memcpy(&ifra.ifra_mask, &vfr.vfr_mask, 207 ifra.ifra_mask.sa_len); 208 209 if (ioctl(env->vmd_fd, SIOCAIFADDR, &ifra) == -1) 210 log_warn("SIOCAIFADDR"); 211 break; 212 case IMSG_VMDOP_PRIV_IFADDR6: 213 memset(&ifar, 0, sizeof(ifar)); 214 memset(&in6_ifra, 0, sizeof(in6_ifra)); 215 216 if (vfr.vfr_addr.ss_family != AF_INET6 || 217 vfr.vfr_addr.ss_family != vfr.vfr_mask.ss_family) 218 fatalx("%s: invalid address family", __func__); 219 220 /* First enable IPv6 on this interface */ 221 strlcpy(ifar.ifar_name, vfr.vfr_name, 222 sizeof(ifar.ifar_name)); 223 ifar.ifar_af = AF_INET6; 224 if (ioctl(env->vmd_fd, SIOCIFAFATTACH, (caddr_t)&ifar) == -1) 225 log_warn("SIOCIFAFATTACH"); 226 227 /* Set the interface address */ 228 strlcpy(in6_ifra.ifra_name, vfr.vfr_name, 229 sizeof(in6_ifra.ifra_name)); 230 231 in6_ifra.ifra_addr.sin6_len = 232 in6_ifra.ifra_prefixmask.sin6_len = 233 sizeof(struct sockaddr_in6); 234 235 memcpy(&in6_ifra.ifra_addr, &vfr.vfr_addr, 236 in6_ifra.ifra_addr.sin6_len); 237 memcpy(&in6_ifra.ifra_prefixmask, &vfr.vfr_mask, 238 in6_ifra.ifra_prefixmask.sin6_len); 239 in6_ifra.ifra_prefixmask.sin6_scope_id = 0; 240 241 in6_ifra.ifra_lifetime.ia6t_vltime = ND6_INFINITE_LIFETIME; 242 in6_ifra.ifra_lifetime.ia6t_pltime = ND6_INFINITE_LIFETIME; 243 244 if (ioctl(env->vmd_fd6, SIOCDIFADDR_IN6, &in6_ifra) == -1 && 245 errno != EADDRNOTAVAIL) 246 log_warn("SIOCDIFADDR_IN6"); 247 248 if (ioctl(env->vmd_fd6, SIOCAIFADDR_IN6, &in6_ifra) == -1) 249 log_warn("SIOCAIFADDR_IN6"); 250 break; 251 case IMSG_VMDOP_PRIV_GET_ADDR: 252 IMSG_SIZE_CHECK(imsg, &vareq); 253 memcpy(&vareq, imsg->data, sizeof(vareq)); 254 255 varesult.var_vmid = vareq.var_vmid; 256 varesult.var_nic_idx = vareq.var_nic_idx; 257 258 /* resolve lladdr for the tap(4) and send back to parent */ 259 if (ioctl(imsg->fd, SIOCGIFADDR, &varesult.var_addr) != 0) 260 log_warn("SIOCGIFADDR"); 261 else 262 proc_compose_imsg(ps, PROC_PARENT, -1, 263 IMSG_VMDOP_PRIV_GET_ADDR_RESPONSE, imsg->hdr.peerid, 264 -1, &varesult, sizeof(varesult)); 265 close(imsg->fd); 266 break; 267 case IMSG_VMDOP_CONFIG: 268 config_getconfig(env, imsg); 269 break; 270 case IMSG_CTL_RESET: 271 config_getreset(env, imsg); 272 break; 273 default: 274 return (-1); 275 } 276 277 return (0); 278 } 279 280 int 281 priv_getiftype(char *ifname, char *type, unsigned int *unitptr) 282 { 283 const char *errstr; 284 size_t span; 285 unsigned int unit; 286 287 /* Extract the name part */ 288 span = strcspn(ifname, "0123456789"); 289 if (span == 0 || span >= strlen(ifname) || span >= (IF_NAMESIZE - 1)) 290 return (-1); 291 memcpy(type, ifname, span); 292 type[span] = 0; 293 294 /* Now parse the unit (we don't strictly validate the format here) */ 295 unit = strtonum(ifname + span, 0, UINT_MAX, &errstr); 296 if (errstr != NULL) 297 return (-1); 298 if (unitptr != NULL) 299 *unitptr = unit; 300 301 return (0); 302 } 303 304 int 305 priv_findname(const char *name, const char **names) 306 { 307 unsigned int i; 308 309 for (i = 0; names[i] != NULL; i++) { 310 if (strcmp(name, names[i]) == 0) 311 return (0); 312 } 313 314 return (-1); 315 } 316 317 int 318 priv_validgroup(const char *name) 319 { 320 if (strlen(name) >= IF_NAMESIZE) 321 return (-1); 322 /* Group can not end with a digit */ 323 if (name[0] && isdigit(name[strlen(name) - 1])) 324 return (-1); 325 return (0); 326 } 327 328 /* 329 * Called from the Parent process to setup vm interface(s) 330 * - ensure the interface has the description set (tracking purposes) 331 * - if interface is to be attached to a switch, attach it 332 * - check if rdomain is set on interface and switch 333 * - if interface only or both, use interface rdomain 334 * - if switch only, use switch rdomain 335 * - check if group is set on interface and switch 336 * - if interface, add it 337 * - if switch, add it 338 * - ensure the interface is up/down 339 * - if local interface, set address 340 */ 341 int 342 vm_priv_ifconfig(struct privsep *ps, struct vmd_vm *vm) 343 { 344 char name[64]; 345 struct vmd *env = ps->ps_env; 346 struct vm_create_params *vcp = &vm->vm_params.vmc_params; 347 struct vmd_if *vif; 348 struct vmd_switch *vsw; 349 unsigned int i; 350 struct vmop_ifreq vfr, vfbr; 351 struct sockaddr_in *sin4; 352 struct sockaddr_in6 *sin6; 353 354 for (i = 0; i < VMM_MAX_NICS_PER_VM; i++) { 355 vif = &vm->vm_ifs[i]; 356 357 if (vif->vif_name == NULL) 358 break; 359 360 memset(&vfr, 0, sizeof(vfr)); 361 if (strlcpy(vfr.vfr_name, vif->vif_name, 362 sizeof(vfr.vfr_name)) >= sizeof(vfr.vfr_name)) 363 return (-1); 364 365 /* Description can be truncated */ 366 (void)snprintf(vfr.vfr_value, sizeof(vfr.vfr_value), 367 "vm%u-if%u-%s", vm->vm_vmid, i, vcp->vcp_name); 368 369 log_debug("%s: interface %s description %s", __func__, 370 vfr.vfr_name, vfr.vfr_value); 371 372 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFDESCR, 373 &vfr, sizeof(vfr)); 374 375 /* set default rdomain */ 376 vfr.vfr_id = getrtable(); 377 378 vsw = switch_getbyname(vif->vif_switch); 379 380 /* Check if switch should exist */ 381 if (vsw == NULL && vif->vif_switch != NULL) 382 log_warnx("switch \"%s\" not found", vif->vif_switch); 383 384 /* Add interface to switch and set proper rdomain */ 385 if (vsw != NULL) { 386 memset(&vfbr, 0, sizeof(vfbr)); 387 388 if (strlcpy(vfbr.vfr_name, vsw->sw_ifname, 389 sizeof(vfbr.vfr_name)) >= sizeof(vfbr.vfr_name)) 390 return (-1); 391 if (strlcpy(vfbr.vfr_value, vif->vif_name, 392 sizeof(vfbr.vfr_value)) >= sizeof(vfbr.vfr_value)) 393 return (-1); 394 395 log_debug("%s: switch \"%s\" interface %s add %s", 396 __func__, vsw->sw_name, vfbr.vfr_name, 397 vfbr.vfr_value); 398 399 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFADD, 400 &vfbr, sizeof(vfbr)); 401 402 /* Check rdomain properties */ 403 if (vif->vif_flags & VMIFF_RDOMAIN) 404 vfr.vfr_id = vif->vif_rdomain; 405 else if (vsw->sw_flags & VMIFF_RDOMAIN) 406 vfr.vfr_id = vsw->sw_rdomain; 407 } else { 408 /* No switch to attach case */ 409 if (vif->vif_flags & VMIFF_RDOMAIN) 410 vfr.vfr_id = vif->vif_rdomain; 411 } 412 413 /* Set rdomain on interface */ 414 if (vfr.vfr_id != 0) 415 log_debug("%s: interface %s rdomain %u", __func__, 416 vfr.vfr_name, vfr.vfr_id); 417 418 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFRDOMAIN, 419 &vfr, sizeof(vfr)); 420 421 /* First group is defined per-interface */ 422 if (vif->vif_group) { 423 if (strlcpy(vfr.vfr_value, vif->vif_group, 424 sizeof(vfr.vfr_value)) >= sizeof(vfr.vfr_value)) 425 return (-1); 426 427 log_debug("%s: interface %s group %s", __func__, 428 vfr.vfr_name, vfr.vfr_value); 429 430 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFGROUP, 431 &vfr, sizeof(vfr)); 432 } 433 434 /* The second group is defined per-switch */ 435 if (vsw != NULL && vsw->sw_group != NULL) { 436 if (strlcpy(vfr.vfr_value, vsw->sw_group, 437 sizeof(vfr.vfr_value)) >= sizeof(vfr.vfr_value)) 438 return (-1); 439 440 log_debug("%s: interface %s group %s switch \"%s\"", 441 __func__, vfr.vfr_name, vfr.vfr_value, 442 vsw->sw_name); 443 444 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFGROUP, 445 &vfr, sizeof(vfr)); 446 } 447 448 /* Set the new interface status to up or down */ 449 proc_compose(ps, PROC_PRIV, (vif->vif_flags & VMIFF_UP) ? 450 IMSG_VMDOP_PRIV_IFUP : IMSG_VMDOP_PRIV_IFDOWN, 451 &vfr, sizeof(vfr)); 452 453 /* Set interface address if it is a local interface */ 454 if (vm->vm_params.vmc_ifflags[i] & VMIFF_LOCAL) { 455 memset(&vfr.vfr_mask, 0, sizeof(vfr.vfr_mask)); 456 memset(&vfr.vfr_addr, 0, sizeof(vfr.vfr_addr)); 457 458 /* local IPv4 address with a /31 mask */ 459 sin4 = (struct sockaddr_in *)&vfr.vfr_mask; 460 sin4->sin_family = AF_INET; 461 sin4->sin_len = sizeof(*sin4); 462 sin4->sin_addr.s_addr = htonl(0xfffffffe); 463 464 sin4 = (struct sockaddr_in *)&vfr.vfr_addr; 465 sin4->sin_family = AF_INET; 466 sin4->sin_len = sizeof(*sin4); 467 if ((sin4->sin_addr.s_addr = 468 vm_priv_addr(&env->vmd_cfg, 469 vm->vm_vmid, i, 0)) == 0) 470 return (-1); 471 472 inet_ntop(AF_INET, &sin4->sin_addr, 473 name, sizeof(name)); 474 log_debug("%s: interface %s address %s/31", 475 __func__, vfr.vfr_name, name); 476 477 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFADDR, 478 &vfr, sizeof(vfr)); 479 } 480 if ((vm->vm_params.vmc_ifflags[i] & VMIFF_LOCAL) && 481 (env->vmd_cfg.cfg_flags & VMD_CFG_INET6)) { 482 memset(&vfr.vfr_mask, 0, sizeof(vfr.vfr_mask)); 483 memset(&vfr.vfr_addr, 0, sizeof(vfr.vfr_addr)); 484 485 /* local IPv6 address with a /96 mask */ 486 sin6 = ss2sin6(&vfr.vfr_mask); 487 sin6->sin6_family = AF_INET6; 488 sin6->sin6_len = sizeof(*sin6); 489 memset(&sin6->sin6_addr.s6_addr[0], 0xff, 12); 490 memset(&sin6->sin6_addr.s6_addr[12], 0, 4); 491 492 sin6 = ss2sin6(&vfr.vfr_addr); 493 sin6->sin6_family = AF_INET6; 494 sin6->sin6_len = sizeof(*sin6); 495 if (vm_priv_addr6(&env->vmd_cfg, 496 vm->vm_vmid, i, 0, &sin6->sin6_addr) == -1) 497 return (-1); 498 499 inet_ntop(AF_INET6, &sin6->sin6_addr, 500 name, sizeof(name)); 501 log_debug("%s: interface %s address %s/96", 502 __func__, vfr.vfr_name, name); 503 504 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFADDR6, 505 &vfr, sizeof(vfr)); 506 } 507 } 508 509 return (0); 510 } 511 512 /* 513 * Called from the Parent process to setup underlying switch interface 514 * - ensure the interface exists 515 * - ensure the interface has the correct rdomain set 516 * - ensure the interface has the description set (tracking purposes) 517 * - ensure the interface is up/down 518 */ 519 int 520 vm_priv_brconfig(struct privsep *ps, struct vmd_switch *vsw) 521 { 522 struct vmop_ifreq vfr; 523 524 memset(&vfr, 0, sizeof(vfr)); 525 526 if (strlcpy(vfr.vfr_name, vsw->sw_ifname, 527 sizeof(vfr.vfr_name)) >= sizeof(vfr.vfr_name)) 528 return (-1); 529 530 /* ensure bridge/switch exists */ 531 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFEXISTS, 532 &vfr, sizeof(vfr)); 533 534 /* Use the configured rdomain or get it from the process */ 535 if (vsw->sw_flags & VMIFF_RDOMAIN) 536 vfr.vfr_id = vsw->sw_rdomain; 537 else 538 vfr.vfr_id = getrtable(); 539 if (vfr.vfr_id != 0) 540 log_debug("%s: interface %s rdomain %u", __func__, 541 vfr.vfr_name, vfr.vfr_id); 542 543 /* ensure switch has the correct rodmain */ 544 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFRDOMAIN, 545 &vfr, sizeof(vfr)); 546 547 /* Description can be truncated */ 548 (void)snprintf(vfr.vfr_value, sizeof(vfr.vfr_value), 549 "switch%u-%s", vsw->sw_id, vsw->sw_name); 550 551 log_debug("%s: interface %s description %s", __func__, 552 vfr.vfr_name, vfr.vfr_value); 553 554 proc_compose(ps, PROC_PRIV, IMSG_VMDOP_PRIV_IFDESCR, 555 &vfr, sizeof(vfr)); 556 557 /* Set the new interface status to up or down */ 558 proc_compose(ps, PROC_PRIV, (vsw->sw_flags & VMIFF_UP) ? 559 IMSG_VMDOP_PRIV_IFUP : IMSG_VMDOP_PRIV_IFDOWN, 560 &vfr, sizeof(vfr)); 561 562 vsw->sw_running = 1; 563 return (0); 564 } 565 566 uint32_t 567 vm_priv_addr(struct vmd_config *cfg, uint32_t vmid, int idx, int isvm) 568 { 569 struct address *h = &cfg->cfg_localprefix; 570 in_addr_t prefix, mask, addr; 571 572 /* 573 * 1. Set the address prefix and mask, 100.64.0.0/10 by default. 574 */ 575 if (h->ss.ss_family != AF_INET || 576 h->prefixlen < 0 || h->prefixlen > 32) 577 fatal("local prefix"); 578 prefix = ss2sin(&h->ss)->sin_addr.s_addr; 579 mask = prefixlen2mask(h->prefixlen); 580 581 /* 2. Encode the VM ID as a per-VM subnet range N, 100.64.N.0/24. */ 582 addr = vmid << 8; 583 584 /* 585 * 3. Assign a /31 subnet M per VM interface, 100.64.N.M/31. 586 * Each subnet contains exactly two IP addresses; skip the 587 * first subnet to avoid a gateway address ending with .0. 588 */ 589 addr |= (idx + 1) * 2; 590 591 /* 4. Use the first address for the gateway, the second for the VM. */ 592 if (isvm) 593 addr++; 594 595 /* 5. Convert to network byte order and add the prefix. */ 596 addr = htonl(addr) | prefix; 597 598 /* 599 * Validate the results: 600 * - the address should not exceed the prefix (eg. VM ID to high). 601 * - up to 126 interfaces can be encoded per VM. 602 */ 603 if (prefix != (addr & mask) || idx >= 0x7f) { 604 log_warnx("%s: dhcp address range exceeded," 605 " vm id %u interface %d", __func__, vmid, idx); 606 return (0); 607 } 608 609 return (addr); 610 } 611 612 int 613 vm_priv_addr6(struct vmd_config *cfg, uint32_t vmid, 614 int idx, int isvm, struct in6_addr *in6_addr) 615 { 616 struct address *h = &cfg->cfg_localprefix6; 617 struct in6_addr addr, mask; 618 uint32_t addr4; 619 620 /* 1. Set the address prefix and mask, fd00::/8 by default. */ 621 if (h->ss.ss_family != AF_INET6 || 622 h->prefixlen < 0 || h->prefixlen > 128) 623 fatal("local prefix6"); 624 addr = ss2sin6(&h->ss)->sin6_addr; 625 prefixlen2mask6(h->prefixlen, &mask); 626 627 /* 2. Encode the VM IPv4 address as subnet, fd00::NN:NN:0:0/96. */ 628 if ((addr4 = vm_priv_addr(cfg, vmid, idx, 1)) == 0) 629 return (0); 630 memcpy(&addr.s6_addr[8], &addr4, sizeof(addr4)); 631 632 /* 633 * 3. Set the last octet to 1 (host) or 2 (VM). 634 * The latter is currently not used inside vmd as we don't 635 * answer rtsol requests ourselves. 636 */ 637 if (!isvm) 638 addr.s6_addr[15] = 1; 639 else 640 addr.s6_addr[15] = 2; 641 642 memcpy(in6_addr, &addr, sizeof(*in6_addr)); 643 644 return (0); 645 } 646