From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 72B495A0278 for ; Fri, 28 Jul 2023 11:48:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=201602; t=1690537715; bh=JNMl2m9HoMzmhqzzRtDVaiCuPhd3lhzSm60VqnLbhdQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CH8mSyd/7RaWsixVu3C/gURU417HyZNVccwoIFLFYI/RIC6e50WqTCAfnKu5D7D+T QjQJl3h/Gxo/+YWkl88aWHX6gpARrNj423z1o1TAVLe85Ht9sa6QBaNkdsTP3hpdQX o/pUV8BKKiWnL6eQ1XG1hMOgOD5LDrtYRFgRQxT8= Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4RC2rf74djz4wyn; Fri, 28 Jul 2023 19:48:34 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 6/8] tcp: Track guest-side correspondent address Date: Fri, 28 Jul 2023 19:48:29 +1000 Message-ID: <20230728094831.4097571-7-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230728094831.4097571-1-david@gibson.dropbear.id.au> References: <20230728094831.4097571-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: AOBSKN47R3SKPAEJLDBYWF4EEHG5SMUF X-Message-ID-Hash: AOBSKN47R3SKPAEJLDBYWF4EEHG5SMUF X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Currently the only address we explicitly track in the TCP connection structure is the tap side forwarding address - that is the remote address from the guest's point of view. The tap side correspondent address - the local address from the guest's point of view - is assumed to always be one of the handful of guest addresses we track as addr_seen (one each for IPv4, IPv6 global and IPv6 link-local). We want to generalize our forwarding model to allow the guest to have multiple addresses. As a start on this, track the tap-side correspondent address in the connection structure, only using one of the addr_seen variables when we start a new connection. Signed-off-by: David Gibson --- tcp.c | 37 +++++++++++++++++-------------------- tcp_conn.h | 2 ++ 2 files changed, 19 insertions(+), 20 deletions(-) diff --git a/tcp.c b/tcp.c index ac7ae60..6c4d71e 100644 --- a/tcp.c +++ b/tcp.c @@ -1449,7 +1449,7 @@ do { \ ip_len = plen + sizeof(struct iphdr) + sizeof(struct tcphdr); b->iph.tot_len = htons(ip_len); b->iph.saddr = a4->s_addr; - b->iph.daddr = c->ip4.addr_seen.s_addr; + b->iph.daddr = inany_v4(&conn->caddr)->s_addr; if (check) b->iph.check = *check; @@ -1468,10 +1468,7 @@ do { \ b->ip6h.payload_len = htons(plen + sizeof(struct tcphdr)); b->ip6h.saddr = conn->faddr.a6; - if (IN6_IS_ADDR_LINKLOCAL(&b->ip6h.saddr)) - b->ip6h.daddr = c->ip6.addr_ll_seen; - else - b->ip6h.daddr = c->ip6.addr_seen; + b->ip6h.daddr = conn->caddr.a6; memset(b->ip6h.flow_lbl, 0, 3); @@ -1820,13 +1817,12 @@ static void tcp_clamp_window(const struct ctx *c, struct tcp_tap_conn *conn, /** * tcp_seq_init() - Calculate initial sequence number according to RFC 6528 * @c: Execution context - * @conn: TCP connection, with faddr, fport and cport populated + * @conn: TCP connection, with faddr, fport, caddr, cport populated * @now: Current timestamp */ static void tcp_seq_init(const struct ctx *c, struct tcp_tap_conn *conn, const struct timespec *now) { - union inany_addr aany; struct { union inany_addr src; in_port_t srcport; @@ -1835,16 +1831,11 @@ static void tcp_seq_init(const struct ctx *c, struct tcp_tap_conn *conn, } __attribute__((__packed__)) in = { .src = conn->faddr, .srcport = conn->cport, + .dst = conn->caddr, .dstport = conn->fport, }; uint32_t ns, seq = 0; - if (CONN_V4(conn)) - inany_from_af(&aany, AF_INET, &c->ip4.addr); - else - inany_from_af(&aany, AF_INET6, &c->ip6.addr); - in.dst = aany; - seq = siphash_36b((uint8_t *)&in, c->tcp.hash_secret); /* 32ns ticks, overflows 32 bits every 137s */ @@ -2011,8 +2002,6 @@ static void tcp_conn_from_tap(struct ctx *c, socklen_t sl; int s, mss; - (void)saddr; - if (c->tcp.conn_count >= TCP_MAX_CONNS) return; @@ -2061,6 +2050,9 @@ static void tcp_conn_from_tap(struct ctx *c, conn->wnd_from_tap = 1; inany_from_af(&conn->faddr, af, daddr); + inany_from_af(&conn->caddr, af, saddr); + conn->fport = ntohs(th->dest); + conn->cport = ntohs(th->source); if (af == AF_INET) { sa = (struct sockaddr *)&addr4; @@ -2070,9 +2062,6 @@ static void tcp_conn_from_tap(struct ctx *c, sl = sizeof(addr6); } - conn->fport = ntohs(th->dest); - conn->cport = ntohs(th->source); - conn->seq_init_from_tap = ntohl(th->seq); conn->seq_from_tap = conn->seq_init_from_tap + 1; conn->seq_ack_to_tap = conn->seq_from_tap; @@ -2731,10 +2720,18 @@ static void tcp_tap_conn_from_sock(struct ctx *c, union epoll_ref ref, conn_event(c, conn, SOCK_ACCEPTED); inany_from_sockaddr(&conn->faddr, &conn->fport, sa); - conn->cport = ref.r.p.tcp.tcp.index; - tcp_snat_inbound(c, &conn->faddr); + if (CONN_V4(conn)) { + inany_from_af(&conn->caddr, AF_INET, &c->ip4.addr_seen); + } else { + if (IN6_IS_ADDR_LINKLOCAL(&conn->faddr.a6)) + conn->caddr.a6 = c->ip6.addr_ll_seen; + else + conn->caddr.a6 = c->ip6.addr_seen; + } + conn->cport = ref.r.p.tcp.tcp.index; + tcp_seq_init(c, conn, now); tcp_hash_insert(c, conn); diff --git a/tcp_conn.h b/tcp_conn.h index ba2a1ef..9151c18 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -35,6 +35,7 @@ extern const char *tcp_common_flag_str[]; * @ws_to_tap: Window scaling factor advertised to tap/guest * @sndbuf: Sending buffer in kernel, rounded to 2 ^ SNDBUF_BITS * @seq_dup_ack_approx: Last duplicate ACK number sent to tap + * @caddr: Guest side correspondent address (guest's local address) * @faddr: Guest side forwarding address (guest's remote address) * @cport: Guest side correspondent port (guest's local port) * @fport: Guest side forwarding port (guest's remote port) @@ -105,6 +106,7 @@ struct tcp_tap_conn { uint8_t seq_dup_ack_approx; + union inany_addr caddr; union inany_addr faddr; in_port_t cport; in_port_t fport; -- 2.41.0