Merge "Add user mode networking restrictions: a firewall"

8 files changed, 898 insertions, 34 deletions

diff --git a/qemu-options.hx b/qemu-options.hx
index 56800cd..80efaa6 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1440,6 +1440,95 @@ Set the initial date of the real time clock. Valid formats for
 @code{2006-06-17}. The default value is @code{now}.
 ETEXI
 
+/* Start user mode network stack restrictions */
+DEF("drop-udp", 0, QEMU_OPTION_drop_udp, \
+    "-drop-udp       starts filtering all UDP packets\n")
+STEXI
+
+@item -drop-udp
+Enable dropping of all UDP packets.
+ETEXI
+
+
+DEF("drop-tcp", 0, QEMU_OPTION_drop_tcp, \
+    "-drop-tcp       starts filtering all TCP packets\n")
+STEXI
+
+@item -drop-tcp
+Enable dropping of all TCP packets.
+ETEXI
+
+
+DEF("allow-tcp", HAS_ARG, QEMU_OPTION_allow_tcp, \
+    "-allow-tcp      Only allows TCP packets for host:port\n")
+STEXI
+
+@item -allow-tcp @var{host}:@var{port}
+Allows communication with the host named @code{host} and with
+the port @code{port}.
+ETEXI
+
+
+DEF("drop-log", 0, QEMU_OPTION_drop_log, \
+    "-drop-log       Creates a log for dropped connections\n")
+STEXI
+
+@item -drop-log @var{file}
+Creates a log for dropped connections in the file @code{file}.
+ETEXI
+
+/* Additional network restriction options */
+
+DEF("max-dns-conns", HAS_ARG, QEMU_OPTION_max_dns_conns, \
+    "-max-dns-conns limit \n"
+    "                Limits the maximum DNS connections\n")
+STEXI
+@item -max-dns-conns @var{limit}
+Limits the maximum DNS connections to @var{limit}.
+ETEXI
+
+DEF("allow-udp", HAS_ARG, QEMU_OPTION_allow_udp, \
+    "-allow-udp host:port \n"
+    "                Allows udp connections to go through to host:port\n")
+STEXI
+@item -allow-udp @var{host}:@var{port}
+Allows udp connections to go through to @var{host}:@var{port}.
+ETEXI
+
+DEF("dns-log", HAS_ARG, QEMU_OPTION_dns_log, \
+    "-dns-log file   Creates a log of DNS lookups\n")
+STEXI
+@item -dns-log @var{file}
+Creates a log of DNS lookups as @var{file}.
+ETEXI
+
+
+DEF("net-forward", HAS_ARG, QEMU_OPTION_net_forward, \
+"-net-forward dst_net:dst_mask:dst_port:redirect_ip:redirect_port:\n"
+"                Forwards guest network traffic sent to dst_net(dst_mask):dst_port\n"
+"                to redirect_ip:redirect_port\n")
+
+STEXI
+@item -net-forward @var{settings}
+Forwards network traffic using the settings @code{settings}.
+ETEXI
+
+
+DEF("net-forward-tcp2sink", HAS_ARG, QEMU_OPTION_net_forward_tcp2sink, \
+"-net-forward-tcp2sink sink_ip:sink_port\n"
+"                Forwards all dropped and non-forwarded guest network traffic\n"
+"                to specified ip:port. \n")
+
+STEXI
+@item -net-forward-tcp2sink @var{settings}
+Forwards all dropped and non-forwarded network traffic to sink ip:port.
+ETEXI
+
+
+
+/* End User mode network stack restrictions */
+
+
 DEF("icount", HAS_ARG, QEMU_OPTION_icount, \
     "-icount [N|auto]\n" \
     "                enable virtual instruction counter with 2^N clock ticks per\n" \
diff --git a/slirp-android/libslirp.h b/slirp-android/libslirp.h
index 6086384..120e3d3 100644
--- a/slirp-android/libslirp.h
+++ b/slirp-android/libslirp.h
@@ -2,7 +2,9 @@
 #define _LIBSLIRP_H
 
 #include <stdint.h>
+#include <stdio.h>
 #include "sockets.h"
+#include "slirp.h"
 #ifdef _WIN32
 #  define WIN32_LEAN_AND_MEAN
 #  define socket_close  winsock2_socket_close3
@@ -16,6 +18,8 @@
 extern "C" {
 #endif
 
+struct mbuf;
+
 int    inet_strtoip(const char*  str, uint32_t  *ip);
 char*  inet_iptostr(uint32_t  ip);
 
@@ -32,6 +36,59 @@ void slirp_input(const uint8_t *pkt, int pkt_len);
 int slirp_can_output(void);
 void slirp_output(const uint8_t *pkt, int pkt_len);
 
+/* ---------------------------------------------------*/
+/* User mode network stack restrictions */
+void slirp_drop_udp();
+void slirp_drop_tcp();
+void slirp_add_allow(unsigned long dst_addr, int dst_lport,
+                     int dst_hport, u_int8_t proto);
+void slirp_drop_log_fd(FILE* fd);
+int slirp_should_drop(unsigned long dst_addr,
+                      int dst_port,
+                      u_int8_t proto);
+int slirp_drop_log(const char* format, ...);
+
+/* for network forwards */
+void slirp_add_net_forward(unsigned long dest_ip, unsigned long dest_mask,
+                           int dest_lport, int dest_hport,
+                           unsigned long redirect_ip, int redirect_port);
+
+int slirp_should_net_forward(unsigned long remote_ip, int remote_port,
+                             unsigned long *redirect_ip, int *redirect_port);
+/* ---------------------------------------------------*/
+
+/**
+ * Additional network stack modifications, aiming to detect and log
+ * any network activity initiated by any binary outisde the context of
+ * the running browser.
+ */
+
+void slirp_dns_log_fd(FILE* fd);
+/** Logs the DNS name in DNS query issued by the VM. */
+int slirp_log_dns(struct mbuf* m, int dropped);
+/** IP packet dump of DNS queris and responses. */
+int slirp_dump_dns(struct mbuf* m);
+/** Sets an upper limit for the number of allowed DNS requests from
+ * the VM.
+ */
+void slirp_set_max_dns_conns(int max_dns_conns);
+/* Returns the max number of allowed DNS requests.*/
+int slirp_get_max_dns_conns();
+
+/**
+ * Modifications for implementing "-net-forward-tcp2sink' option.
+ */
+
+void slirp_forward_dropped_tcp2sink(unsigned long sink_ip,  int sink_port);
+int slirp_should_forward_dropped_tcp2sink();
+unsigned long slirp_get_tcp_sink_ip();
+int slirp_get_tcp_sink_port();
+
+
+
+
+/* ---------------------------------------------------*/
+
 void slirp_redir_loop(void (*func)(void *opaque, int is_udp,
                                    const SockAddress *laddr,
                                    const SockAddress *faddr),
diff --git a/slirp-android/slirp.c b/slirp-android/slirp.c
index e3c4c42..683bef5 100644
--- a/slirp-android/slirp.c
+++ b/slirp-android/slirp.c
@@ -32,6 +32,12 @@
 #include "android/android.h"
 #include "sockets.h"
 
+#include <sys/queue.h>
+
+/* proto types */
+static void slirp_net_forward_init(void);
+
+
 #define  D(...)   VERBOSE_PRINT(slirp,__VA_ARGS__)
 #define  DN(...)  do { if (VERBOSE_CHECK(slirp)) dprintn(__VA_ARGS__); } while (0)
 
@@ -259,6 +265,8 @@ void slirp_init(int restricted, const char *special_ip)
     alias_addr_ip = special_addr_ip | CTL_ALIAS;
     getouraddr();
     register_savevm("slirp", 0, 1, slirp_state_save, slirp_state_load, NULL);
+
+    slirp_net_forward_init();
 }
 
 #define CONN_CANFSEND(so) (((so)->so_state & (SS_FCANTSENDMORE|SS_ISFCONNECTED)) == SS_ISFCONNECTED)
@@ -819,6 +827,298 @@ void if_encap(const uint8_t *ip_data, int ip_data_len)
     }
 }
 
+
+/*---------------------------------------------------*/
+/* User mode network stack restrictions */
+struct fw_allow_entry {
+    struct fw_allow_entry* next;
+    unsigned long dst_addr;   /* host byte order */
+    /* Allowed port range. dst_lport should be the same as dst_hport for a
+     * single port. */
+    unsigned short dst_lport; /* host byte order */
+    unsigned short dst_hport; /* host byte order */
+};
+
+static int drop_udp = 0;
+static int drop_tcp = 0;
+static struct fw_allow_entry* allow_tcp_entries = NULL;
+static struct fw_allow_entry* allow_udp_entries = NULL;
+static FILE* drop_log_fd = NULL;
+static FILE* dns_log_fd = NULL;
+static int max_dns_conns = -1;   /* unlimited max DNS connections by default */
+static int slirp_net_forward_inited = 0;
+
+void slirp_drop_udp() {
+    drop_udp = 1;
+}
+
+void slirp_drop_tcp() {
+    drop_tcp = 1;
+}
+
+/* TCP traffic forwarding to a sink - If enabled, all TCP traffic to any
+ * ip/port that is not explicitly forwared using '-net-forward', and which would
+ * otherwise be dropped if '-drop-tcp' has been specified, is redirected to the
+ * specified ip:port
+ */
+int forward_dropped_tcp2sink = 0;
+static unsigned long tcp_sink_ip;
+int tcp_sink_port;
+
+void slirp_forward_dropped_tcp2sink(unsigned long sink_ip, int sink_port) {
+    tcp_sink_ip = sink_ip;
+    tcp_sink_port = sink_port;
+    forward_dropped_tcp2sink = 1;
+}
+
+int slirp_should_forward_dropped_tcp2sink() {
+    return forward_dropped_tcp2sink;
+}
+
+unsigned long slirp_get_tcp_sink_ip() {
+    return tcp_sink_ip;
+}
+int slirp_get_tcp_sink_port() {
+    return tcp_sink_port;
+}
+
+/* Fill in the firewall rules. dst_lport and dst_hport are in host byte order */
+void slirp_add_allow(unsigned long dst_addr,
+                     int dst_lport, int dst_hport,
+                     u_int8_t proto) {
+
+    struct fw_allow_entry** ate;
+    switch (proto) {
+      case IPPROTO_TCP:
+          ate = &allow_tcp_entries;
+          break;
+      case IPPROTO_UDP:
+          ate = &allow_udp_entries;
+          break;
+      default:
+          return; // unknown protocol for the FW
+    }
+
+    while(*ate != NULL)
+        ate = &(*ate)->next;
+
+    *ate = malloc(sizeof(**ate));
+    if (*ate == NULL) {
+        DEBUG_MISC((dfd,
+                    "Unable to create new firewall record, malloc failed\n"));
+        exit(-1);
+    }
+
+    (*ate)->next = NULL;
+    (*ate)->dst_addr = dst_addr;
+    (*ate)->dst_lport = dst_lport;
+    (*ate)->dst_hport = dst_hport;
+}
+
+void slirp_drop_log_fd(FILE* fd) {
+    drop_log_fd = fd;
+}
+
+void slirp_dns_log_fd(FILE* fd) {
+    dns_log_fd = fd;
+}
+
+/* Address and ports are in host byte order */
+int slirp_should_drop(unsigned long dst_addr,
+                      int dst_port,
+                      u_int8_t proto) {
+
+    struct fw_allow_entry* ate;
+
+    switch (proto) {
+        case IPPROTO_TCP:
+            if (drop_tcp != 0)
+                ate = allow_tcp_entries;
+            else
+                return 0;
+            break;
+        case IPPROTO_UDP:
+            if (drop_udp != 0)
+                ate = allow_udp_entries;
+            else
+                return 0;
+            break;
+        default:
+            return 1;  // unknown protocol for the FW
+    }
+
+    while(ate) {
+        if ((ate->dst_lport <= dst_port) && (dst_port <= ate->dst_hport)) {
+            // allow any destination if 0
+            if (ate->dst_addr == 0 || ate->dst_addr == dst_addr)
+                return 0;
+        }
+        ate = ate->next;
+    }
+
+    return 1;
+}
+
+/*
+ * log DNS requests in a separate log
+ */
+int
+slirp_log_dns(struct mbuf* m, int dropped) {
+    char dns_query[256];  // max allowable dns name size
+    int c = 0;
+    int i= 0;
+    int index = 0;
+    int offset = 40 + 1;  // udp/ip headers length + 1;
+    int trim_bytes = 4;
+
+    if (!dns_log_fd)
+        return -1;
+
+    /* We assume one DNS name per query: 300 = 255 (max dns name length)
+     * + 40 (udp/ip hdr) + 1 byte DNS peamble + 4 bytes DNS suffix
+     */
+    if (m->m_len < offset || m->m_len > 300) {
+        DEBUG_MISC((dfd,"Malformed DNS qeury, length %d \n", (int)m->m_len));
+        return -1;
+    }
+    for (i = offset; i < m->m_len - trim_bytes && index < sizeof(dns_query); i++, index++) {
+        c = m->m_data[i];
+        if (c < ' ' || c > '~')
+            c = '.';
+
+        dns_query[index] = (char)c;
+    }
+    dns_query[index] = '\0';
+    if (!dropped) {
+        fprintf(dns_log_fd, "Sent DNS query for, %s\n" , dns_query);
+    } else {
+        fprintf(dns_log_fd, "Dropped DNS query for, %s\n" , dns_query);
+    }
+    fflush(dns_log_fd);
+    return 1;
+}
+
+/*
+ * log DNS requests in a separate log
+ */
+int
+slirp_dump_dns(struct mbuf* m) {
+
+    if (!dns_log_fd)
+        return 0;
+    // first we write the length of the record then the record (IP packet)
+    if (!fwrite(&(m->m_len), sizeof(int), 1, dns_log_fd) ||
+        !fwrite(m->m_data, m->m_len, 1, dns_log_fd)) {
+        return 0;
+    }
+
+    fflush(dns_log_fd);
+    return 1;
+}
+
+/* Log dropped/accepted packet info */
+int slirp_drop_log(const char* format, ...) {
+    va_list args;
+
+    if (!drop_log_fd)
+        return 0;
+
+    va_start(args, format);
+    vfprintf(drop_log_fd, format, args);
+    va_end(args);
+
+    fflush(drop_log_fd);
+
+    return 1;
+}
+
+
+/* Set max DNS requests allowed to be issued from the VM */
+void slirp_set_max_dns_conns(int num_conns) {
+    max_dns_conns = num_conns;
+}
+
+int slirp_get_max_dns_conns() {
+    return max_dns_conns;
+}
+
+/* generic guest network redirection functionality for ipv4 */
+struct net_forward_entry {
+    QTAILQ_ENTRY(net_forward_entry) next;
+    /* ip addresses are also in host byte order */
+    unsigned long dest_ip;            /* the destination address they try to contact */
+    unsigned long dest_mask;          /* the mask to apply to the address for matching */
+    /* Range of ports they were trying to contact. In case of a single port,
+     * dest_lport should be the same as dest_hport */
+    int dest_lport; /* Host byte order */
+    int dest_hport; /* Host byte order */
+
+    unsigned long  redirect_ip;
+    int redirect_port; /* Host byte order */
+};
+
+static QTAILQ_HEAD(net_forwardq, net_forward_entry) net_forwards;
+
+static void slirp_net_forward_init(void)
+{
+    if (!slirp_net_forward_inited) {
+      QTAILQ_INIT(&net_forwards);
+      slirp_net_forward_inited = 1;
+    }
+}
+
+/* all addresses and ports ae in host byte order */
+void slirp_add_net_forward(unsigned long dest_ip, unsigned long dest_mask,
+                           int dest_lport, int dest_hport,
+                           unsigned long redirect_ip, int redirect_port)
+{
+    slirp_net_forward_init();
+
+    struct net_forward_entry *entry = malloc(sizeof(*entry));
+    if (entry == NULL) {
+        DEBUG_MISC((dfd, "Unable to create new forwarding entry, malloc failed\n"));
+        exit(-1);
+    }
+
+    entry->dest_ip = dest_ip;
+    entry->dest_mask = dest_mask;
+    entry->dest_lport = dest_lport;
+    entry->dest_hport = dest_hport;
+    entry->redirect_ip = redirect_ip;
+    entry->redirect_port = redirect_port;
+
+    QTAILQ_INSERT_TAIL(&net_forwards, entry, next);
+}
+
+/* remote_port and redir_port arguments
+ * are in network byte order (tcp_subr.c) */
+int slirp_should_net_forward(unsigned long remote_ip, int remote_port,
+                             unsigned long *redirect_ip, int *redirect_port)
+{
+    struct net_forward_entry *entry;
+
+    for (entry = net_forwards.tqh_first;
+         entry != NULL; entry = entry->next.tqe_next) {
+
+        if ((entry->dest_lport <= remote_port)
+            && (remote_port <= entry->dest_hport)) {
+            if ((entry->dest_ip & entry->dest_mask)
+                == (remote_ip & entry->dest_mask)) {
+              *redirect_ip = entry->redirect_ip;
+              *redirect_port = entry->redirect_port;
+              return 1;
+            }
+        }
+    }
+
+    return 0;
+}
+
+/*---------------------------------------------------*/
+
+
+
+
 static void _slirp_redir_loop(void (*func)(void *opaque, int is_udp,
                                            const SockAddress *laddr,
                                            const SockAddress *faddr),
diff --git a/slirp-android/socket.c b/slirp-android/socket.c
index 44640a8..285a8ef 100644
--- a/slirp-android/socket.c
+++ b/slirp-android/socket.c
@@ -570,6 +570,26 @@ sosendto(struct socket *so, struct mbuf *m)
 
 	addr_port = so->so_faddr_port;
 
+	/*
+	 * test for generic forwarding; this function replaces the arguments
+	 * only on success
+	 */
+	unsigned long faddr = addr_ip;
+        int fport = addr_port;
+
+	if (slirp_should_net_forward(faddr, fport, &faddr, &fport)) {
+	    slirp_drop_log(
+	       "Redirected UDP: src: 0x%08lx:0x%04x org dst: 0x%08lx:0x%04x "
+	       "new dst: 0x%08lx:0x%04x\n",
+	        so->so_laddr_ip, so->so_laddr_port,
+	        addr_ip, addr_port,
+	        faddr, fport
+	    );
+	}
+	addr_ip = faddr;
+	addr_port = fport;
+
+
         sock_address_init_inet(&addr, addr_ip, addr_port);
 
 	DEBUG_MISC((dfd, " sendto()ing, addr.sin_port=%d, addr.sin_addr.s_addr=%08x\n", addr_port, addr_ip));
@@ -779,4 +799,3 @@ sofwdrain(struct socket *so)
 	else
 		sofcantsendmore(so);
 }
-
diff --git a/slirp-android/tcp_subr.c b/slirp-android/tcp_subr.c
index b8b680c..0550d4b 100644
--- a/slirp-android/tcp_subr.c
+++ b/slirp-android/tcp_subr.c
@@ -377,6 +377,29 @@ tcp_proxy_event( struct socket*  so,
     tcp_input(NULL, sizeof(struct ip), so);
 }
 
+
+/* Tests if an IP address corresponds to a special Qemu service (eg, the DNS
+ * server or the gateway - see ctl.h) and if so, rewrites it with the real
+ * address of the service.
+ */
+int is_qemu_special_address(unsigned long dst_addr, unsigned long *redir_addr)
+{
+  if ((dst_addr & htonl(0xffffff00)) == special_addr_ip) {
+    /* It's an alias */
+
+    int  last_byte = dst_addr & 0xff;
+
+    if (CTL_IS_DNS(last_byte))
+      *redir_addr = dns_addr[last_byte - CTL_DNS];
+    else
+      *redir_addr = loopback_addr_ip;
+
+    return 1;
+  }
+  return 0;
+}
+
+
 /*
  * Connect to a host on the Internet
  * Called by tcp_input
@@ -390,41 +413,56 @@ tcp_proxy_event( struct socket*  so,
 int tcp_fconnect(struct socket *so)
 {
   int ret=0;
-    int try_proxy = 1;
     SockAddress    sockaddr;
-    uint32_t       sock_ip;
-    uint16_t       sock_port;
+    unsigned long       sock_ip;
+    int                 sock_port;
 
     DEBUG_CALL("tcp_fconnect");
     DEBUG_ARG("so = %lx", (long )so);
 
-    sock_ip   = so->so_faddr_ip;
-    sock_port = so->so_faddr_port;
-
-    if ((sock_ip & 0xffffff00) == special_addr_ip) {
-      /* It's an alias */
-      int  last_byte = sock_ip & 0xff;
-
-      if (CTL_IS_DNS(last_byte))
-        sock_ip = dns_addr[last_byte - CTL_DNS];
-      else
-        sock_ip = loopback_addr_ip;
-      try_proxy = 0;
-    }
-
-    sock_address_init_inet( &sockaddr, sock_ip, sock_port );
-
-    DEBUG_MISC((dfd, " connect()ing, addr=%s, proxy=%d\n",
-                sock_address_to_string(&sockaddr), try_proxy));
-
-    if (try_proxy) {
-        if (!proxy_manager_add(&sockaddr, SOCKET_STREAM, (ProxyEventFunc) tcp_proxy_event, so)) {
-            soisfconnecting(so);
-            so->s         = -1;
-            so->so_state |= SS_PROXIFIED;
-            return 0;
-        }
+    /* when true, a connection that otherwise would be dropped will instead be
+     * redirected to the sink ('-net-forward-tcp2sink') */
+    int forward_dropped_to_sink = 0;
+
+
+    /*-------------------------------------------------------------*/
+    /* User mode network stack restrictions */
+    if (slirp_should_drop(so->so_faddr_ip, so->so_faddr_port, IPPROTO_TCP)) {
+
+      /* If forwarding to sink is enabled, don't actually drop it */
+      if (slirp_should_forward_dropped_tcp2sink()) {
+        slirp_drop_log(
+            "About to be dropped TCP forwarded to sink: "
+            "src: 0x%08lx:0x%04x dst: 0x%08lx:0x%04x\n",
+              so->so_laddr_ip,
+              so->so_laddr_port,
+              so->so_faddr_ip,
+              so->so_faddr_port
+        );
+        forward_dropped_to_sink = 1;
+      }
+      else {
+        slirp_drop_log(
+            "Dropped TCP: src: 0x%08lx:0x%04x dst: 0x%08lx:0x%04x\n",
+            so->so_laddr_ip,
+            so->so_laddr_port,
+            so->so_faddr_ip,
+            so->so_faddr_port
+        );
+        //errno = ENETUNREACH;
+        errno = ECONNREFUSED;
+        return -1;
+      }
+    } else {
+      slirp_drop_log(
+          "Allowed TCP: src: 0x%08lx:0x%04x dst: 0x%08lx:0x%04x\n",
+          so->so_laddr_ip,
+          so->so_laddr_port,
+          so->so_faddr_ip,
+          so->so_faddr_port
+      );
     }
+    /*-------------------------------------------------------------*/
 
     if ((ret=so->s=socket_create_inet(SOCKET_STREAM)) >= 0) 
     {
@@ -434,6 +472,79 @@ int tcp_fconnect(struct socket *so)
         socket_set_xreuseaddr(s);
         socket_set_oobinline(s);
 
+
+        if (forward_dropped_to_sink) {
+
+          /* This connection would normally be dropped, but since forwarding of
+           * dropped connections is enabled, redirect it to the sink */
+          sock_ip = slirp_get_tcp_sink_ip();
+          sock_port= slirp_get_tcp_sink_port();
+          slirp_drop_log(
+              "Redirected would-be dropped TCP to sink: "
+                "src: 0x%08lx:0x%04x org dst: 0x%08lx:0x%04x "
+              "new dst: 0x%08lx:0x%04x\n",
+              so->so_laddr_ip, so->so_laddr_port,
+              so->so_faddr_ip, so->so_faddr_port,
+              sock_ip, sock_port
+            );
+        }
+        else {   /* An allowed connection */
+
+          unsigned long faddr;
+          int fport;
+
+          /* Determine if the connection should be redirected
+           * due to a -net-forward rule */
+          /* faddr and fport are modified only on success */
+          if (slirp_should_net_forward(so->so_faddr_ip, so->so_faddr_port,
+                                       &faddr, &fport)) {
+            slirp_drop_log(
+                "Redirected TCP: src: 0x%08lx:0x%04x org dst: 0x%08lx:0x%04x "
+                "new dst: 0x%08lx:0x%04x\n",
+                so->so_laddr_ip, so->so_laddr_port,
+                so->so_faddr_ip, so->so_faddr_port,
+                faddr, fport
+            );
+            sock_ip = faddr;              /* forced dst addr */
+            sock_port= fport;                 /* forced dst port */
+          }
+          /* Determine if this is a connection to a special qemu service,
+           * and change the destination address accordingly.
+           * 'faddr' is modified only onsuccess  */
+          else if (is_qemu_special_address(so->so_faddr_ip, &faddr)) {
+
+          /* We keep the original destination port. If a special service
+           * listens on a different port than the standard, then appropriate
+           * forwarding should be set up using -net-forward, e.g., as it is
+           * the case with Mawler's DNS traffic, which is redirected to the
+           * special DNS port:
+           * -net-forward 0.0.0.0:0.0.0.0:53:127.0.0.1:21737 */
+
+            sock_ip = faddr;         /* real DNS/gateway addr */
+            sock_port= so->so_faddr_port;/* original dst port */
+
+          }
+          /* A normal connection - keep the original destination addr/port */
+          else {
+
+            if (!proxy_manager_add(&sockaddr, SOCKET_STREAM,
+                                   (ProxyEventFunc) tcp_proxy_event, so)) {
+                soisfconnecting(so);
+                so->s         = -1;
+                so->so_state |= SS_PROXIFIED;
+                return 0;
+            }
+
+            sock_ip = so->so_faddr_ip;  /* original dst addr */
+            sock_port= so->so_faddr_port;   /* original dst port */
+          }
+        }
+
+        DEBUG_MISC((dfd, " connect()ing, addr=%s, proxy=%d\n",
+                    sock_address_to_string(&sockaddr), try_proxy));
+
+        sock_address_init_inet( &sockaddr, sock_ip, sock_port );
+
         /* We don't care what port we get */
         socket_connect(s, &sockaddr);
 
diff --git a/slirp-android/udp.c b/slirp-android/udp.c
index 9091505..a9c9a82 100644
--- a/slirp-android/udp.c
+++ b/slirp-android/udp.c
@@ -47,6 +47,10 @@
 struct udpstat udpstat;
 #endif
 
+/* Keeps track of the number of DNS requests.  Used to implement the firewall
+ * option that restricts the number of DNS requests (-max_dns_conns). */
+u_int dns_num_conns;
+
 struct socket udb;
 
 static u_int8_t udp_tos(struct socket *so);
@@ -68,6 +72,7 @@ void
 udp_init(void)
 {
 	udb.so_next = udb.so_prev = &udb;
+	dns_num_conns = 0;
 }
 /* m->m_data  points at ip packet header
  * m->m_len   length ip packet
@@ -121,6 +126,33 @@ udp_input(register struct mbuf *m, int iphlen)
 		ip->ip_len = len;
 	}
 
+	/* ------------------------------------------------------*/
+	/* User mode network stack restrictions */
+	/* slirp_should_drop requires host byte ordering in arguments */
+	if (slirp_should_drop(ntohl(ip->ip_dst.addr), ntohs(uh->uh_dport.port),
+	                      IPPROTO_UDP)) {
+	  slirp_drop_log(
+	    "Dropped UDP: src: 0x%08lx:0x%04x dst: 0x%08lx:0x%04x\n",
+	    ip->ip_src.addr,
+	    uh->uh_sport.port,
+	    ip->ip_dst.addr,
+	    uh->uh_dport.port
+	  );
+	  goto bad; /* drop the packet */
+	}
+	else {
+	  slirp_drop_log(
+	    "Allowed UDP: src: 0x%08lx:0x%04x dst: 0x%08lx:0x%04x\n",
+	    ip->ip_src.addr,
+	    uh->uh_sport.port,
+	    ip->ip_dst.addr,
+	    uh->uh_dport.port
+	  );
+	}
+  /* ------------------------------------------------------*/
+
+
+
 	/*
 	 * Save a copy of the IP header in case we want restore it
 	 * for sending an ICMP error message in response.
@@ -164,6 +196,18 @@ udp_input(register struct mbuf *m, int iphlen)
             goto bad;
         }
 
+        // DNS logging and FW rules
+        if (ntohs(uh->uh_dport.port) == 53) {
+            if (!slirp_dump_dns(m)) {
+                DEBUG_MISC((dfd,"Error logging DNS packet"));
+            }
+            dns_num_conns++;
+            if (slirp_get_max_dns_conns() != -1 &&
+                dns_num_conns > slirp_get_max_dns_conns())
+                goto bad;
+        }
+
+
 	/*
 	 * Locate pcb for datagram.
 	 */
@@ -309,6 +353,13 @@ int udp_output2_(struct socket *so, struct mbuf *m,
 
 	STAT(udpstat.udps_opackets++);
 
+	//  DNS logging
+	if (so != NULL && so->so_faddr_port == htons(53)) {
+	  if (!slirp_dump_dns(m)) {
+	    DEBUG_MISC((dfd,"Error logging DNS packet"));
+	  }
+	}
+
 	error = ip_output(so, m);
 
 	return (error);
diff --git a/slirp-android/udp.h b/slirp-android/udp.h
index 4350ec3..2224181 100644
--- a/slirp-android/udp.h
+++ b/slirp-android/udp.h
@@ -69,7 +69,6 @@ struct udpiphdr {
 #define ui_ulen         ui_u.uh_ulen
 #define ui_sum          ui_u.uh_sum
 
-#ifdef LOG_ENABLED
 struct udpstat {
 	                                /* input statistics: */
 	        u_long  udps_ipackets;          /* total input packets */
@@ -83,7 +82,6 @@ struct udpstat {
 	                                /* output statistics: */
 	        u_long  udps_opackets;          /* total output packets */
 };
-#endif
 
 /*
  * Names for UDP sysctl objects
@@ -91,9 +89,7 @@ struct udpstat {
 #define UDPCTL_CHECKSUM         1       /* checksum UDP packets */
 #define UDPCTL_MAXID            2
 
-#ifdef LOG_ENABLED
 extern struct udpstat udpstat;
-#endif
 
 extern struct socket udb;
 struct mbuf;
diff --git a/vl-android.c b/vl-android.c
index a35f351..1afc8d2 100644
--- a/vl-android.c
+++ b/vl-android.c
@@ -3620,6 +3620,164 @@ append_param(char* param_str, const char* arg, int size)
     }
 }
 
+/* Parses an integer
+ * Pararm:
+ *  str      String containing a number to be parsed.
+ *  result   Passes the parsed integer in this argument
+ *  returns  0 if ok, -1 if failed
+ */
+int
+parse_int(const char *str, int *result)
+{
+    char* r;
+    *result = strtol(str, &r, 0);
+    if (r == NULL || *r != '\0')
+      return -1;
+
+    return 0;
+}
+
+
+/* parses a null-terminated string specifying a network port (e.g., "80") or
+ * port range (e.g., "[6666-7000]"). In case of a single port, lport and hport
+ * are the same. Returns 0 on success, -1 on error. */
+
+int parse_port_range(const char *str, unsigned short *lport,
+                     unsigned short *hport) {
+
+  unsigned int low = 0, high = 0;
+  char *p, *arg = strdup(str);
+
+  if ((*arg == '[') && ((p = strrchr(arg, ']')) != NULL)) {
+    p = arg + 1;   /* skip '[' */
+    low  = atoi(strtok(p, "-"));
+    high = atoi(strtok(NULL, "-"));
+    if ((low > 0) && (high > 0) && (low < high) && (high < 65535)) {
+      *lport = low;
+      *hport = high;
+    }
+  }
+  else {
+    low = atoi(arg);
+    if ((0 < low) && (low < 65535)) {
+      *lport = low;
+      *hport = low;
+    }
+  }
+  free(arg);
+  if (low != 0)
+    return 0;
+  return -1;
+}
+
+/*
+ * Implements the generic port forwarding option
+ */
+void
+net_slirp_forward(const char *optarg)
+{
+    /*
+     * we expect the following format:
+     * dst_net:dst_mask:dst_port:redirect_ip:redirect_port OR
+     * dst_net:dst_mask:[dp_range_start-dp_range_end]:redirect_ip:redirect_port
+     */
+    char *argument = strdup(optarg), *p = argument;
+    char *dst_net, *dst_mask, *dst_port;
+    char *redirect_ip, *redirect_port;
+    uint32_t dnet, dmask, rip;
+    unsigned short dlport, dhport, rport;
+
+
+    dst_net = strtok(p, ":");
+    dst_mask = strtok(NULL, ":");
+    dst_port = strtok(NULL, ":");
+    redirect_ip = strtok(NULL, ":");
+    redirect_port = strtok(NULL, ":");
+
+    if (dst_net == NULL || dst_mask == NULL || dst_port == NULL ||
+        redirect_ip == NULL || redirect_port == NULL) {
+        fprintf(stderr,
+                "Invalid argument for -net-forward, we expect "
+                "dst_net:dst_mask:dst_port:redirect_ip:redirect_port or "
+                "dst_net:dst_mask:[dp_range_start-dp_range_end]"
+                ":redirect_ip:redirect_port: %s\n",
+                optarg);
+        exit(1);
+    }
+
+    /* inet_strtoip converts dotted address to host byte order */
+    if (inet_strtoip(dst_net, &dnet) == -1) {
+        fprintf(stderr, "Invalid destination IP net: %s\n", dst_net);
+        exit(1);
+    }
+    if (inet_strtoip(dst_mask, &dmask) == -1) {
+        fprintf(stderr, "Invalid destination IP mask: %s\n", dst_mask);
+        exit(1);
+    }
+    if (inet_strtoip(redirect_ip, &rip) == -1) {
+        fprintf(stderr, "Invalid redirect IP address: %s\n", redirect_ip);
+        exit(1);
+    }
+
+    if (parse_port_range(dst_port, &dlport, &dhport) == -1) {
+        fprintf(stderr, "Invalid destination port or port range\n");
+        exit(1);
+    }
+
+    rport = atoi(redirect_port);
+    if (!rport) {
+        fprintf(stderr, "Invalid redirect port: %s\n", redirect_port);
+        exit(1);
+    }
+
+    dnet &= dmask;
+
+    slirp_add_net_forward(dnet, dmask, dlport, dhport,
+                          rip, rport);
+
+    free(argument);
+}
+
+
+/* Parses an -allow-tcp or -allow-udp argument and inserts a corresponding
+ * entry in the allows list */
+void
+slirp_allow(const char *optarg, u_int8_t proto)
+{
+  /*
+   * we expect the following format:
+   * dst_ip:dst_port OR dst_ip:[dst_lport-dst_hport]
+   */
+  char *argument = strdup(optarg), *p = argument;
+  char *dst_ip_str, *dst_port_str;
+  uint32_t dst_ip;
+  unsigned short dst_lport, dst_hport;
+
+  dst_ip_str = strtok(p, ":");
+  dst_port_str = strtok(NULL, ":");
+
+  if (dst_ip_str == NULL || dst_port_str == NULL) {
+    fprintf(stderr,
+            "Invalid argument %s for -allow. We expect "
+            "dst_ip:dst_port or dst_ip:[dst_lport-dst_hport]\n",
+            optarg);
+    exit(1);
+  }
+
+  if (inet_strtoip(dst_ip_str, &dst_ip) == -1) {
+    fprintf(stderr, "Invalid destination IP address: %s\n", dst_ip_str);
+    exit(1);
+  }
+  if (parse_port_range(dst_port_str, &dst_lport, &dst_hport) == -1) {
+    fprintf(stderr, "Invalid destination port or port range\n");
+    exit(1);
+  }
+
+  slirp_add_allow(dst_ip, dst_lport, dst_hport, proto);
+
+  free(argument);
+}
+
 int main(int argc, char **argv, char **envp)
 {
     const char *gdbstub_dev = NULL;
@@ -4375,6 +4533,89 @@ int main(int argc, char **argv, char **envp)
                     }
                 }
                 break;
+
+            /* -------------------------------------------------------*/
+            /* User mode network stack restrictions */
+            case QEMU_OPTION_drop_udp:
+                slirp_drop_udp();
+                break;
+            case QEMU_OPTION_drop_tcp:
+                slirp_drop_tcp();
+                break;
+            case QEMU_OPTION_allow_tcp:
+                slirp_allow(optarg, IPPROTO_TCP);
+                break;
+            case QEMU_OPTION_allow_udp:
+                slirp_allow(optarg, IPPROTO_UDP);
+                break;
+             case QEMU_OPTION_drop_log:
+                {
+                    FILE* drop_log_fd;
+                    drop_log_fd = fopen(optarg, "w");
+
+                    if (!drop_log_fd) {
+                        fprintf(stderr, "Cannot open drop log: %s\n", optarg);
+                        exit(1);
+                    }
+
+                    slirp_drop_log_fd(drop_log_fd);
+                }
+                break;
+
+            case QEMU_OPTION_dns_log:
+                {
+                    FILE* dns_log_fd;
+                    dns_log_fd = fopen(optarg, "wb");
+
+                    if (dns_log_fd == NULL) {
+                        fprintf(stderr, "Cannot open dns log: %s\n", optarg);
+                        exit(1);
+                    }
+
+                    slirp_dns_log_fd(dns_log_fd);
+                }
+                break;
+
+
+            case QEMU_OPTION_max_dns_conns:
+                {
+                    int max_dns_conns = 0;
+                    if (parse_int(optarg, &max_dns_conns)) {
+                      fprintf(stderr,
+                              "qemu: syntax: -max-dns-conns max_connections\n");
+                      exit(1);
+                    }
+                    if (max_dns_conns <= 0 ||  max_dns_conns == LONG_MAX) {
+                      fprintf(stderr,
+                              "Invalid arg for max dns connections: %s\n",
+                              optarg);
+                      exit(1);
+                    }
+                    slirp_set_max_dns_conns(max_dns_conns);
+                }
+                break;
+
+            case QEMU_OPTION_net_forward:
+                net_slirp_forward(optarg);
+                break;
+            case QEMU_OPTION_net_forward_tcp2sink:
+                {
+                    SockAddress saddr;
+
+                    if (parse_host_port(&saddr, optarg)) {
+                        fprintf(stderr,
+                                "Invalid ip/port %s for "
+                                "-forward-dropped-tcp2sink. "
+                                "We expect 'sink_ip:sink_port'\n",
+                                optarg);
+                        exit(1);
+                    }
+                    slirp_forward_dropped_tcp2sink(saddr.u.inet.address,
+                                                   saddr.u.inet.port);
+                }
+                break;
+            /* -------------------------------------------------------*/
+
             case QEMU_OPTION_tb_size:
                 tb_size = strtol(optarg, NULL, 0);
                 if (tb_size < 0)