From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id BBF345A0287 for ; Wed, 28 Feb 2024 12:25:32 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1709119522; bh=ojTazAz3p7EC67pdkF93uyzFXaibOVqAgXQwctHoI9o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UQFobPDwKARKO5ciTA8mrwFMJxi683h5cPRS+kO1mcZBT4rAneNprYhkgvOZm9+Oj oS7RvZSwE8W8n1LA+acoXzOpM9+wGOchCysnKmLU5WxAtuzjxK7QDvgcb6NSatNxW1 Y8Uabm5BaRmxnMunBqGZlu5LXqpjh90Y7jmTIJ4ockBkLk12U7fVyptkZuKGgysjVs CdGeO2ctd06/is++5mBvLvm+TQrMPzOyYvyyRYavojXQ6ciKydlXloLx0xtLGOqY4D EGNQrMcZuibBn7HCRGjU6HBaoVy2Z0Vpb61QUcGkNc8FWP4bgMsta65JPWPHDmCyyg 7pLnsUnkCkSHg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4TlBq66K28z4wyr; Wed, 28 Feb 2024 22:25:22 +1100 (AEDT) From: David Gibson To: passt-dev@passt.top, Stefano Brivio Subject: [PATCH v3 15/20] tcp_splice: Improve logic deciding when to splice Date: Wed, 28 Feb 2024 22:25:15 +1100 Message-ID: <20240228112520.2078220-16-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.43.2 In-Reply-To: <20240228112520.2078220-1-david@gibson.dropbear.id.au> References: <20240228112520.2078220-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: AS72HIGE657EYPSILBPLRK2NUXTNTJGO X-Message-ID-Hash: AS72HIGE657EYPSILBPLRK2NUXTNTJGO X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This makes several tweaks to improve the logic which decides whether we're able to use the splice method for a new connection. * Rather than only calling tcp_splice_conn_from_sock() in pasta mode, we check for pasta mode within it, better localising the checks. * Previously if we got a connection from a non-loopback address we'd always fall back to the "tap" path, even if the connection was on a socket in the namespace. If we did get a non-loopback address on a namespace socket, something has gone wrong and the "tap" path certainly won't be able to handle it. Report the error and close, rather than passing it along to tap. Signed-off-by: David Gibson --- inany.c | 1 - tcp.c | 3 +-- tcp_splice.c | 48 ++++++++++++++++++++++++++++++++++-------------- 3 files changed, 35 insertions(+), 17 deletions(-) diff --git a/inany.c b/inany.c index c11e2aa9..1c165b14 100644 --- a/inany.c +++ b/inany.c @@ -39,7 +39,6 @@ const union inany_addr inany_any4 = { * * Return: On success, a non-null pointer to @dst, NULL on failure */ -/* cppcheck-suppress unusedFunction */ const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size) { const struct in_addr *v4 = inany_v4(src); diff --git a/tcp.c b/tcp.c index 91163b83..be62a319 100644 --- a/tcp.c +++ b/tcp.c @@ -2737,8 +2737,7 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref, if (s < 0) goto cancel; - if (c->mode == MODE_PASTA && - tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa)) + if (tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa)) return; tcp_tap_conn_from_sock(c, ref.tcp_listen, flow, s, &sa, now); diff --git a/tcp_splice.c b/tcp_splice.c index a202715c..45b9b299 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -431,14 +431,44 @@ bool tcp_splice_conn_from_sock(const struct ctx *c, sa_family_t af; uint8_t pif1; - ASSERT(c->mode == MODE_PASTA); - - inany_from_sockaddr(&src, &srcport, sa); - if (!inany_is_loopback(&src)) + if (c->mode != MODE_PASTA) return false; + inany_from_sockaddr(&src, &srcport, sa); af = inany_v4(&src) ? AF_INET : AF_INET6; + switch (ref.pif) { + case PIF_SPLICE: + if (!inany_is_loopback(&src)) { + char str[INANY_ADDRSTRLEN]; + + /* We can't use flow_err() etc. because we haven't set + * the flow type yet + */ + warn("Bad source address %s for splice, closing", + inany_ntop(&src, str, sizeof(str))); + + /* We *don't* want to fall back to tap */ + flow_alloc_cancel(flow); + return true; + } + + pif1 = PIF_HOST; + dstport += c->tcp.fwd_out.delta[dstport]; + break; + + case PIF_HOST: + if (!inany_is_loopback(&src)) + return false; + + pif1 = PIF_SPLICE; + dstport += c->tcp.fwd_in.delta[dstport]; + break; + + default: + return false; + } + conn = FLOW_START(flow, FLOW_TCP_SPLICE, tcp_splice, 0); conn->flags = af == AF_INET ? 0 : SPLICE_V6; @@ -450,16 +480,6 @@ bool tcp_splice_conn_from_sock(const struct ctx *c, if (setsockopt(s0, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int))) flow_trace(conn, "failed to set TCP_QUICKACK on %i", s0); - if (ref.pif == PIF_SPLICE) { - pif1 = PIF_HOST; - dstport += c->tcp.fwd_out.delta[dstport]; - } else { - ASSERT(ref.pif == PIF_HOST); - - pif1 = PIF_SPLICE; - dstport += c->tcp.fwd_in.delta[dstport]; - } - if (tcp_splice_connect(c, conn, af, pif1, dstport)) conn_flag(c, conn, CLOSING); -- 2.43.2