Features/HelperNetworking: Difference between revisions

From QEMU
No edit summary
No edit summary
Line 7: Line 7:
* Name: [[User:AnthonyLiguori|Anthony Liguori]]
* Name: [[User:AnthonyLiguori|Anthony Liguori]]
* Email: anthony@codemonkey.ws
* Email: anthony@codemonkey.ws
* Name: [[User:Corey Bryant | Corey Bryant]]
* Email: coreyb@linux.vnet.ibm.com
* Name: [[User:Richa Marwaha | Richa Marwaha]]
* Email: rmarwah@linux.vnet.ibm.com


== Detailed Summary ==
== Detailed Summary ==
Line 12: Line 16:


==Network Helper==
==Network Helper==
With the help of qemu_network_helper,  an unprivileged user can configure the TAP interface which connects to a bridge. The helper can be invoked by using the br{bridge name} and helper{executable to configure the bridge} options in -net tap. Helper implements the most common qemu-ifup script that can be safely given cap_net_admin. Helper options in -net tap are the only options that doesnot need root privileges.
With the help of qemu_network_helper,  an unprivileged user can configure the TAP interface which connects to a bridge. The helper can be invoked by using the br{bridge name} and helper{executable to configure the bridge} options in -net tap. Helper implements the most common qemu-ifup script that can be safely given cap_net_admin.


Currently helper uses it's own ACL mechanism for access control as default,but future network helpers could be developed, for example, to support PolicyKit for access control.
Currently helper uses it's own ACL mechanism for access control as default,but future network helpers could be developed, for example, to support PolicyKit for access control.
Line 21: Line 25:
                   qemu-hda linux.img -net tap,br=br0,helper=/usr/local/libexec/qemu-bridge-helper
                   qemu-hda linux.img -net tap,br=br0,helper=/usr/local/libexec/qemu-bridge-helper
                                       -net nic,model=virtio
                                       -net nic,model=virtio
                 
                  qemu-hda linux.img -net bridge,br=br0 -net nic,model=virtio


== Status ==
== Status ==


* http://www.mail-archive.com/qemu-devel@nongnu.org/msg17772.html
* http://www.mail-archive.com/qemu-devel@nongnu.org/msg17772.html

Revision as of 14:47, 19 October 2011


Summary

Introduce infrastructure to allowed QEMU network backends to be implemented outside of QEMU in a generic way.

Owner

Detailed Summary

Replace ad-hoc network backends with a single -net fd option that allows for precise control of how QEMU interacts with a given file descriptor. Then introduce external helpers that can be invoked to create appropriate file descriptors and pass them back to QEMU. These helpers can run as a higher privileged user allowing QEMU to use complex network setups while being invoked as a non-privileged user. This also allows third parties to implement user-visible network backends without having to introduce them into QEMU itself.

Network Helper

With the help of qemu_network_helper, an unprivileged user can configure the TAP interface which connects to a bridge. The helper can be invoked by using the br{bridge name} and helper{executable to configure the bridge} options in -net tap. Helper implements the most common qemu-ifup script that can be safely given cap_net_admin.

Currently helper uses it's own ACL mechanism for access control as default,but future network helpers could be developed, for example, to support PolicyKit for access control.

Example

The following example shows how to launch Qemu instance with default as network helper to a TAP device to the bridge br0

                  qemu-hda linux.img -net tap,br=br0,helper=/usr/local/libexec/qemu-bridge-helper
                                     -net nic,model=virtio
                  
                  qemu-hda linux.img -net bridge,br=br0 -net nic,model=virtio


Status