From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 344FA5A027C for ; Tue, 6 Feb 2024 02:17:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1707182260; bh=NU2dIYxwUJmRB1CGWE4PU48dw/avoNWWhk4EG+NqK1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sNr0J01DTVIMjcsdAhCKcbCqcsh2s+9Gg73GAAxZuV4VVC8Tma6pKeuuQdDpf0GLD pOAMU1ESvJPn0EEbjSVYMHd2FOJi26iOBh1f8LVtcXqlVOhCek1UfQElVYIskbu9bR KcWtR4Ru5wsMpJwzRy79P9Und+kuiu1Tb6u6MRzI1PMTWefewJK8bFDuBVUvBjfjaT fHVmHUDElnJ+Qr0GIT3aL4uQ/Kql5KZfOtvwEdlmyneAmgp6seigqn3kEcjOGcaoRz fO6EimEGQBO9DGuRejVur/wBkganVFuW6Pz0XoDsiEw2Y2rAcLvMn7VBmk/tCzgEFn tQqyR7AX3rAAQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4TTQN41hCLz4x0n; Tue, 6 Feb 2024 12:17:40 +1100 (AEDT) From: David Gibson To: passt-dev@passt.top, Stefano Brivio Subject: [PATCH v2 17/22] tcp_splice: Improve logic deciding when to splice Date: Tue, 6 Feb 2024 12:17:29 +1100 Message-ID: <20240206011734.884138-18-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240206011734.884138-1-david@gibson.dropbear.id.au> References: <20240206011734.884138-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: UUIHUWAO3YIYLM2R4UUK5UDQWYQP5JTB X-Message-ID-Hash: UUIHUWAO3YIYLM2R4UUK5UDQWYQP5JTB X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This makes several tweaks to improve the logic which decides whether we're able to use the splice method for a new connection. * Rather than only calling tcp_splice_conn_from_sock() in pasta mode, we check for pasta mode within it, better localising the checks. * Previously if we got a connection from a non-loopback address we'd always fall back to the "tap" path, even if the connection was on a socket in the namespace. If we did get a non-loopback address on a namespace socket, something has gone wrong and the "tap" path certainly won't be able to handle it. Report the error and close, rather than passing it along to tap. Signed-off-by: David Gibson --- inany.c | 1 - tcp.c | 3 +-- tcp_splice.c | 48 ++++++++++++++++++++++++++++++++++-------------- 3 files changed, 35 insertions(+), 17 deletions(-) diff --git a/inany.c b/inany.c index c11e2aa9..1c165b14 100644 --- a/inany.c +++ b/inany.c @@ -39,7 +39,6 @@ const union inany_addr inany_any4 = { * * Return: On success, a non-null pointer to @dst, NULL on failure */ -/* cppcheck-suppress unusedFunction */ const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size) { const struct in_addr *v4 = inany_v4(src); diff --git a/tcp.c b/tcp.c index c06d1cc4..d61fb17b 100644 --- a/tcp.c +++ b/tcp.c @@ -2733,8 +2733,7 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref, if (s < 0) goto cancel; - if (c->mode == MODE_PASTA && - tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa)) + if (tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa)) return; tcp_tap_conn_from_sock(c, ref.tcp_listen, flow, s, &sa, now); diff --git a/tcp_splice.c b/tcp_splice.c index 49075e5c..1937850f 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -405,14 +405,44 @@ bool tcp_splice_conn_from_sock(const struct ctx *c, sa_family_t af; uint8_t pif1; - ASSERT(c->mode == MODE_PASTA); - - inany_from_sockaddr(&src, &srcport, sa); - if (!inany_is_loopback(&src)) + if (c->mode != MODE_PASTA) return false; + inany_from_sockaddr(&src, &srcport, sa); af = inany_v4(&src) ? AF_INET : AF_INET6; + switch (ref.pif) { + case PIF_SPLICE: + if (!inany_is_loopback(&src)) { + char str[INANY_ADDRSTRLEN]; + + /* We can't use flow_err() etc. because we haven't set + * the flow type yet + */ + warn("Bad source address %s for splice, closing", + inany_ntop(&src, str, sizeof(str))); + + /* We *don't* want to fall back to tap */ + flow_alloc_cancel(flow); + return true; + } + + pif1 = PIF_HOST; + dstport += c->tcp.fwd_out.delta[dstport]; + break; + + case PIF_HOST: + if (!inany_is_loopback(&src)) + return false; + + pif1 = PIF_SPLICE; + dstport += c->tcp.fwd_in.delta[dstport]; + break; + + default: + return false; + } + conn = FLOW_START(flow, FLOW_TCP_SPLICE, tcp_splice, 0); conn->flags = af == AF_INET ? 0 : SPLICE_V6; @@ -424,16 +454,6 @@ bool tcp_splice_conn_from_sock(const struct ctx *c, if (setsockopt(s0, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int))) flow_trace(conn, "failed to set TCP_QUICKACK on %i", s0); - if (ref.pif == PIF_SPLICE) { - pif1 = PIF_HOST; - dstport += c->tcp.fwd_out.delta[dstport]; - } else { - ASSERT(ref.pif == PIF_HOST); - - pif1 = PIF_SPLICE; - dstport += c->tcp.fwd_in.delta[dstport]; - } - if (tcp_splice_connect(c, conn, af, pif1, dstport)) conn_flag(c, conn, CLOSING); -- 2.43.0