From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id 0BF765A0287; Mon, 22 May 2023 19:46:08 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH v3 05/10] conf, pasta: With --config-net, copy all routes by default Date: Mon, 22 May 2023 19:46:02 +0200 Message-Id: <20230522174607.2824220-6-sbrivio@redhat.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230522174607.2824220-1-sbrivio@redhat.com> References: <20230522174607.2824220-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: O6CSQXT4WNEAC5XUUFVFYOASVSQ7PBKY X-Message-ID-Hash: O6CSQXT4WNEAC5XUUFVFYOASVSQ7PBKY X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Callum Parsey , me@yawnt.com, David Gibson , lemmi@nerd2nerd.org, Andrea Arcangeli X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Use the newly-introduced NL_DUP mode for nl_route() to copy all the routes associated to the template interface in the outer namespace, unless --no-copy-routes (also implied by -g) is given. This option is introduced as deprecated right away: it's not expected to be of any use, but it's helpful to keep it around for a while to debug any suspected issue with this change. Otherwise, we can't use default gateways which are not, address-wise, on the same subnet as the container, as reported by Callum. Reported-by: Callum Parsey Link: https://github.com/containers/podman/issues/18539 Signed-off-by: Stefano Brivio --- conf.c | 16 ++++++++++++++++ passt.1 | 15 +++++++++++++++ passt.h | 4 +++- pasta.c | 6 ++++-- 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/conf.c b/conf.c index 3ee6ae0..0a01983 100644 --- a/conf.c +++ b/conf.c @@ -923,6 +923,8 @@ pasta_opts: info( " --no-netns-quit Don't quit if filesystem-bound target"); info( " network namespace is deleted"); info( " --config-net Configure tap interface in namespace"); + info( " --no-copy-routes DEPRECATED:"); + info( " Don't copy all routes to namespace"); info( " --ns-mac-addr ADDR Set MAC address on tap interface"); exit(EXIT_FAILURE); @@ -1198,6 +1200,7 @@ void conf(struct ctx *c, int argc, char **argv) {"outbound-if4", required_argument, NULL, 15 }, {"outbound-if6", required_argument, NULL, 16 }, {"config-net", no_argument, NULL, 17 }, + {"no-copy-routes", no_argument, NULL, 18 }, { 0 }, }; struct get_bound_ports_ns_arg ns_ports_arg = { .c = c }; @@ -1362,6 +1365,13 @@ void conf(struct ctx *c, int argc, char **argv) c->pasta_conf_ns = 1; break; + case 18: + if (c->mode != MODE_PASTA) + die("--no-copy-routes is for pasta mode only"); + + warn("--no-copy-routes will be dropped soon"); + c->no_copy_routes = 1; + break; case 'd': if (c->debug) die("Multiple --debug options given"); @@ -1510,6 +1520,9 @@ void conf(struct ctx *c, int argc, char **argv) } break; case 'g': + if (c->mode == MODE_PASTA) + c->no_copy_routes = 1; + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && inet_pton(AF_INET6, optarg, &c->ip6.gw) && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && @@ -1644,6 +1657,9 @@ void conf(struct ctx *c, int argc, char **argv) if (*c->sock_path && c->fd_tap >= 0) die("Options --socket and --fd are mutually exclusive"); + if (c->mode == MODE_PASTA && c->no_copy_routes && !c->pasta_conf_ns) + die("Option --no-copy-routes needs --config-net"); + if (!ifi4 && *c->ip4.ifname_out) ifi4 = if_nametoindex(c->ip4.ifname_out); diff --git a/passt.1 b/passt.1 index 19e01d5..ee2803a 100644 --- a/passt.1 +++ b/passt.1 @@ -546,6 +546,21 @@ NAME are given as target), do not exit once the network namespace is deleted. Configure networking in the namespace: set up addresses and routes as configured or sourced from the host, and bring up the tap interface. +.TP +.BR \-\-no-copy-routes " " (DEPRECATED) +With \-\-config-net, do not copy all the routes associated to the interface we +derive addresses and routes from: set up only the default gateway. Implied by +-g, \-\-gateway. + +Default is to copy all the routing entries from the interface in the outer +namespace to the target namespace, translating the output interface attribute to +the outbound interface in the namespace. + +Note that this configuration option is \fBdeprecated\fR and will be removed in a +future version. It is not expected to be of any use, and it simply reflects a +legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR +below. + .TP .BR \-\-ns-mac-addr " " \fIaddr Configure MAC address \fIaddr\fR on the tap interface in the namespace. diff --git a/passt.h b/passt.h index 73fe808..d314596 100644 --- a/passt.h +++ b/passt.h @@ -181,7 +181,8 @@ struct ip6_ctx { * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifn: Index of namespace interface for pasta - * @pasta_conf_ns: Configure namespace interface after creating it + * @pasta_conf_ns: Configure namespace after creating it + * @no_copy_routes: Don't copy all routes when configuring target namespace * @no_tcp: Disable TCP operation * @tcp: Context for TCP protocol handler * @no_tcp: Disable UDP operation @@ -240,6 +241,7 @@ struct ctx { char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; + int no_copy_routes; int no_tcp; struct tcp_ctx tcp; diff --git a/pasta.c b/pasta.c index 01109f5..b546c93 100644 --- a/pasta.c +++ b/pasta.c @@ -273,12 +273,14 @@ void pasta_ns_conf(struct ctx *c) nl_link(1, 1 /* lo */, MAC_ZERO, 1, 0); if (c->pasta_conf_ns) { + enum nl_op op_routes = c->no_copy_routes ? NL_SET : NL_DUP; + nl_link(1, c->pasta_ifi, c->mac_guest, 1, c->mtu); if (c->ifi4) { nl_addr(1, c->pasta_ifi, AF_INET, &c->ip4.addr, &c->ip4.prefix_len, NULL); - nl_route(NL_SET, c->ifi4, c->pasta_ifi, AF_INET, + nl_route(op_routes, c->ifi4, c->pasta_ifi, AF_INET, &c->ip4.gw); } @@ -286,7 +288,7 @@ void pasta_ns_conf(struct ctx *c) int prefix_len = 64; nl_addr(1, c->pasta_ifi, AF_INET6, &c->ip6.addr, &prefix_len, NULL); - nl_route(NL_SET, c->ifi6, c->pasta_ifi, AF_INET6, + nl_route(op_routes, c->ifi6, c->pasta_ifi, AF_INET6, &c->ip6.gw); } } else { -- 2.39.2