tunneling support - tap interface in --net option

3 files changed, 25 insertions, 4 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index c57e5910a..ef8d8172f 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -264,7 +264,7 @@ static void check_network(Bridge *br) {
         assert(br);
         if (br->macvlan == 0) // for bridge devices check network range or arp-scan and assign address
                 net_configure_sandbox_ip(br);
-        else if (br->ipsandbox) { // for macvlan check network range
+        else if (br->ipsandbox && br->ip && br->mask) { // for macvlan check network range
                 char *rv = in_netrange(br->ipsandbox, br->ip, br->mask);
                 if (rv) {
                         fprintf(stderr, "%s", rv);
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 767cf89f4..e29cf4f4b 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -589,16 +589,23 @@ configured as default gateway is the bridge device IP address. Up to four \-\-ne
 bridge devices can be defined. Mixing bridge and macvlan devices is allowed.
 
 .TP
-\fBnet ethernet_interface
+\fBnet ethernet_interface|wireless_interface
 Enable a new network namespace and connect it
-to this ethernet interface using the standard Linux macvlan
+to this ethernet interface using the standard Linux macvlan or ipvlan
 driver. Unless specified with option \-\-ip and \-\-defaultgw, an
 IP address and a default gateway will be assigned automatically
 to the sandbox. The IP address is verified using ARP before
 assignment. The address configured as default gateway is the
 default gateway of the host. Up to four \-\-net devices can
 be defined. Mixing bridge and macvlan devices is allowed.
-Note: wlan devices are not supported for this option.
+
+.TP
+\fBnet tap_interface
+Enable a new network namespace and connect it
+to this ethernet tap interface using the standard Linux macvlan
+driver.  If the tap interface is not configured, the sandbox
+will not try to configure the interface inside the sandbox.
+Please use ip, netmask and defaultgw to specify the configuration.
 
 .TP
 \fBnet none
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 74a9a9da9..f29d9cddf 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -816,6 +816,20 @@ $ firejail \-\-net=eth0 \-\-ip=192.168.1.80 \-\-dns=8.8.8.8 firefox
 $ firejail \-\-net=wlan0 firefox
 
 .TP
+\fB\-\-net=tap_interface
+Enable a new network namespace and connect it
+to this ethernet tap interface using the standard Linux macvlan
+driver. If the tap interface is not configured, the sandbox
+will not try to configure the interface inside the sandbox.
+Please use \-\-ip, \-\-netmask and \-\-defaultgw to specify the configuration.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox
+
+.TP
 \fB\-\-net=none
 Enable a new, unconnected network namespace. The only interface
 available in the new namespace is a new loopback interface (lo).