tunneling support - tap interface in --net option

5 files changed, 44 insertions, 5 deletions

diff --git a/README.md b/README.md
index 616930e8a..b6e6fb89e 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,17 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
               $ firejail --net=eth0 --ip=192.168.1.80 --dns=8.8.8.8 firefox
               $ firejail --net=wlan0 firefox
 
+      --net=tap_interface
+              Enable a new network namespace and connect it to this  ethernet
+              tap  interface  using the standard Linux macvlan driver. If the
+              tap interface is not configured, the sandbox will  not  try  to
+              configure  the  interface inside the sandbox.  Please use --ip,
+              --netmask and --defaultgw to specify the configuration.
+
+              Example:
+              $ firejail --net=tap0 --ip=10.10.20.80  --netmask=255.255.255.0
+              --defaultgw=10.10.20.1 firefox
+
        --netmask=address
               Use this option when you want to assign an IP address in a  new
               namespace  and  the  parent interface specified by --net is not
@@ -131,7 +142,13 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
               $     firejail     --ip=10.10.20.67     --netmask=255.255.255.0
               --defaultgw=10.10.20.1
 
-      --nou2f
+       --keep-dev-shm
+              /dev/shm directory is untouched (even with --private-dev)
+
+              Example:
+              $ firejail --keep-dev-shm --private-dev
+
+     --nou2f
               Disable U2F devices.
 
               Example:
diff --git a/RELNOTES b/RELNOTES
index e5c9b0fc1..7eb075e4c 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -2,6 +2,7 @@ firejail (0.9.55) baseline; urgency=low
   * work in progress
   * modif: removed CFG_CHROOT_DESKTOP configuration option
   * support wireless devices in --net option
+  * support tap devices in --net option (tunneling support)
   * allow IP address configuration if the parent interface specified
      by --net is not configured (--netmask)
   * disable U2F devices (--nou2f)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c57e5910a..ef8d8172f 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -264,7 +264,7 @@ static void check_network(Bridge *br) {
         assert(br);
         if (br->macvlan == 0) // for bridge devices check network range or arp-scan and assign address
                 net_configure_sandbox_ip(br);
-        else if (br->ipsandbox) { // for macvlan check network range
+        else if (br->ipsandbox && br->ip && br->mask) { // for macvlan check network range
                 char *rv = in_netrange(br->ipsandbox, br->ip, br->mask);
                 if (rv) {
                         fprintf(stderr, "%s", rv);
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 767cf89f4..e29cf4f4b 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -589,16 +589,23 @@ configured as default gateway is the bridge device IP address. Up to four \-\-ne
 bridge devices can be defined. Mixing bridge and macvlan devices is allowed.
 
 .TP
-\fBnet ethernet_interface
+\fBnet ethernet_interface|wireless_interface
 Enable a new network namespace and connect it
-to this ethernet interface using the standard Linux macvlan
+to this ethernet interface using the standard Linux macvlan or ipvlan
 driver. Unless specified with option \-\-ip and \-\-defaultgw, an
 IP address and a default gateway will be assigned automatically
 to the sandbox. The IP address is verified using ARP before
 assignment. The address configured as default gateway is the
 default gateway of the host. Up to four \-\-net devices can
 be defined. Mixing bridge and macvlan devices is allowed.
-Note: wlan devices are not supported for this option.
+
+.TP
+\fBnet tap_interface
+Enable a new network namespace and connect it
+to this ethernet tap interface using the standard Linux macvlan
+driver.  If the tap interface is not configured, the sandbox
+will not try to configure the interface inside the sandbox.
+Please use ip, netmask and defaultgw to specify the configuration.
 
 .TP
 \fBnet none
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 74a9a9da9..f29d9cddf 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -816,6 +816,20 @@ $ firejail \-\-net=eth0 \-\-ip=192.168.1.80 \-\-dns=8.8.8.8 firefox
 $ firejail \-\-net=wlan0 firefox
 
 .TP
+\fB\-\-net=tap_interface
+Enable a new network namespace and connect it
+to this ethernet tap interface using the standard Linux macvlan
+driver. If the tap interface is not configured, the sandbox
+will not try to configure the interface inside the sandbox.
+Please use \-\-ip, \-\-netmask and \-\-defaultgw to specify the configuration.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox
+
+.TP
 \fB\-\-net=none
 Enable a new, unconnected network namespace. The only interface
 available in the new namespace is a new loopback interface (lo).