From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id A05625A0275 for ; Mon, 29 Jan 2024 05:36:08 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1706502959; bh=SHaJxcoOwF39aO5sXIMKVxFLz1D6iqMCQ4X8hX65KlI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hy6fTuvuItdQ+ibB2azyvpaSKs4bc0Ga0Fq41BYQLSgcjyA1IMbmwHORIHGXkbcEe 1v92mCSlBsoDQVsOr4bRXTyBd6sGslXbfHxTHawR9pRcupbkrxfw4h/rvjtHNDyG3p I3ZjsJWafzJuhqwFLN8cLxsgvNyWFccUBtmGOUuRYku4aHu/2ckbJ+QCvEp8JJ4Qda jZY46a7sxexyX2GeK38OFrvN6etBMFPPHnLBOtvkiBGotD8zjKSh4MSEfR8virex0S EHwvDfdnxUA7DjIo5Bz9uBQXl8wRcrXE0gw8n/JEp1zGYYBzQVs/+r9XfQjZZaqvjj lsWG05tPE6FMw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4TNb8b6X1Wz4x5l; Mon, 29 Jan 2024 15:35:59 +1100 (AEDT) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 12/16] tcp_splice: Improve logic deciding when to splice Date: Mon, 29 Jan 2024 15:35:53 +1100 Message-ID: <20240129043557.823451-13-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240129043557.823451-1-david@gibson.dropbear.id.au> References: <20240129043557.823451-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: 3XYCOLRIH2VY4I4VZBYJAWSJGMUODYOO X-Message-ID-Hash: 3XYCOLRIH2VY4I4VZBYJAWSJGMUODYOO X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This makes several tweaks to improve the logic which decides whether we're able to use the splice method for a new connection. * Rather than only calling tcp_splice_conn_from_sock() in pasta mode, we check for pasta mode within it, better localising the checks. * Previously if we got a connection from a non-loopback address we'd always fall back to the "tap" path, even if the connection was on a socket in the namespace. If we did get a non-loopback address on a namespace socket, something has gone wrong and the "tap" path certainly won't be able to handle it. Report the error and close, rather than passing it along to tap. Signed-off-by: David Gibson --- inany.c | 1 - tcp.c | 3 +-- tcp_splice.c | 49 ++++++++++++++++++++++++++++++++----------------- 3 files changed, 33 insertions(+), 20 deletions(-) diff --git a/inany.c b/inany.c index edf0b055..eaf2755d 100644 --- a/inany.c +++ b/inany.c @@ -23,7 +23,6 @@ * * Return: On success, a non-null pointer to @dst, NULL on failure */ -/* cppcheck-suppress unusedFunction */ const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size) { const struct in_addr *v4 = inany_v4(src); diff --git a/tcp.c b/tcp.c index 8daefe99..052bf7cb 100644 --- a/tcp.c +++ b/tcp.c @@ -2733,8 +2733,7 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref, if (s < 0) goto cancel; - if (c->mode == MODE_PASTA && - tcp_splice_conn_from_sock(c, ref.tcp_listen, &flow->tcp_splice, + if (tcp_splice_conn_from_sock(c, ref.tcp_listen, &flow->tcp_splice, s, (struct sockaddr *)&sa)) return; diff --git a/tcp_splice.c b/tcp_splice.c index abd698d4..3b438313 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -389,36 +389,51 @@ bool tcp_splice_conn_from_sock(const struct ctx *c, sa_family_t af; int s1, rc; - ASSERT(c->mode == MODE_PASTA); + if (c->mode != MODE_PASTA) + return false; inany_from_sockaddr(&src, &srcport, sa); - if (!inany_is_loopback(&src)) - return false; + af = inany_v4(&src) ? AF_INET : AF_INET6; - conn->flags = inany_v4(&src) ? 0 : SPLICE_V6; - af = CONN_V6(conn) ? AF_INET6 : AF_INET; + switch (ref.pif) { + case PIF_SPLICE: + if (!inany_is_loopback(&src)) { + char str[INANY_ADDRSTRLEN]; - if (setsockopt(s0, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int))) - flow_trace(conn, "failed to set TCP_QUICKACK on %i", s0); + flow_err(conn, "Bad source address %s for splice, closing", + inany_ntop(&src, str, sizeof(str))); - conn->f.type = FLOW_TCP_SPLICE; - conn->s[0] = s0; - conn->s[1] = -1; - conn->pipe[0][0] = conn->pipe[0][1] = -1; - conn->pipe[1][0] = conn->pipe[1][1] = -1; + /* We *don't* want to fall back to tap */ + flow_alloc_cancel((union flow *)conn); + return true; + } - if (ref.pif == PIF_SPLICE) { dstport += c->tcp.fwd_out.delta[dstport]; - s1 = tcp_conn_sock(c, af); - } else { - ASSERT(ref.pif == PIF_HOST); + break; - dstport += c->tcp.fwd_in.delta[dstport]; + case PIF_HOST: + if (!inany_is_loopback(&src)) + return false; + dstport += c->tcp.fwd_in.delta[dstport]; s1 = tcp_conn_sock_ns(c, af); + break; + + default: + return false; } + conn->f.type = FLOW_TCP_SPLICE; + conn->s[0] = s0; + conn->s[1] = -1; + conn->pipe[0][0] = conn->pipe[0][1] = -1; + conn->pipe[1][0] = conn->pipe[1][1] = -1; + conn->flags = af == AF_INET ? 0 : SPLICE_V6; + + if (setsockopt(s0, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int))) + flow_trace(conn, "failed to set TCP_QUICKACK on %i", s0); + if (s1 < 0) { flow_err(conn, "Couldn't open connectable socket for splice: %s", -- 2.43.0