From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=fail reason="key not found in DNS" header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202312 header.b=XScr2JlQ; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 8254D5A0282 for ; Fri, 16 Aug 2024 07:40:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1723786807; bh=3H7Gv25TQaXCzpd1jSwafsbNNkZTuNwFo4buCTyMTnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XScr2JlQvOwp6R6aCVT1YcgxpN4Fotx7AdULZpA0Iqv5ELyBduA45KcGS7qj/62WE wSh9X75n8lLyNz/BiVvrmknTDuOzLI2L0lEnjbXTaIowT3a/y4wGvdo2ElrGg+0m7v XtlTzg6rhPHku+NaQsOxOHdOdj6hgBvh/i0BlOh5uz2psGjRFCcHm1KXQRu/4yQeGq q60KDrwSHOXOjl5zSuNHIktAX56BdYcaMVQ2fnLj7Uar26r7WBp6T+TXbiC6lLz6B5 pmTUXVz579llH5PU9wvZpE0XXhuMi8cucF4pGV2W/qgrjjS/PKxx/afDy2/ti9qcEl hyFZvNrxigL0A== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4WlW6H159Mz4x5M; Fri, 16 Aug 2024 15:40:07 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 17/22] fwd: Split notion of "our tap address" from gateway for IPv4 Date: Fri, 16 Aug 2024 15:39:58 +1000 Message-ID: <20240816054004.1335006-18-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240816054004.1335006-1-david@gibson.dropbear.id.au> References: <20240816054004.1335006-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: SLDPYC7T6N2LFLWTRCYMISQVXSBDBTLF X-Message-ID-Hash: SLDPYC7T6N2LFLWTRCYMISQVXSBDBTLF X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Paul Holzinger , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: ip4.gw conflates 3 conceptually different things, which (for now) have the same value: 1. The router/gateway address as seen by the guest 2. An address to NAT to the host with --no-map-gw isn't specified 3. An address to use as source when nothing else makes sense Case 3 occurs in two situations: a) for our DHCP responses - since they come from passt internally there's no naturally meaningful address for them to come from b) for forwarded connections coming from an address that isn't guest accessible (localhost or the guest's own address). (b) occurs even with --no-map-gw, and the expected behaviour of forwarding local connections requires it. For IPv6 role (3) is now taken by ip6.our_tap_ll (which usually has the same value as ip6.gw). For future flexibility we may want to make this "address of last resort" different from the gateway address, so split them logically for IPv4 as well. Specifically, add a new ip4.our_tap_addr field for the address with this role, and initialise it to ip4.gw for now. Unlike IPv6 where we can always get a link-local address, we might not be able to get a (non 0.0.0.0) address here. In that case we have to disable DHCP and forwarding of inbound connections with guest-inaccessible source addresses. Signed-off-by: David Gibson --- conf.c | 7 ++++++- dhcp.c | 4 ++-- fwd.c | 10 +++++++--- passt.h | 2 ++ 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/conf.c b/conf.c index 954f20ea..9f962fc8 100644 --- a/conf.c +++ b/conf.c @@ -660,6 +660,8 @@ static unsigned int conf_ip4(unsigned int ifi, ip4->addr_seen = ip4->addr; + ip4->our_tap_addr = ip4->gw; + if (MAC_IS_ZERO(mac)) { int rc = nl_link_get_mac(nl_sock, ifi, mac); if (rc < 0) { @@ -1666,7 +1668,10 @@ void conf(struct ctx *c, int argc, char **argv) die("External interface not usable"); if (c->ifi4 && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.gw)) - c->no_map_gw = c->no_dhcp = 1; + c->no_map_gw = 1; + + if (c->ifi4 && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) + c->no_dhcp = 1; if (c->ifi6 && IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw)) c->no_map_gw = 1; diff --git a/dhcp.c b/dhcp.c index acc5b03e..a935dc94 100644 --- a/dhcp.c +++ b/dhcp.c @@ -347,7 +347,7 @@ int dhcp(const struct ctx *c, const struct pool *p) mask.s_addr = htonl(0xffffffff << (32 - c->ip4.prefix_len)); memcpy(opts[1].s, &mask, sizeof(mask)); memcpy(opts[3].s, &c->ip4.gw, sizeof(c->ip4.gw)); - memcpy(opts[54].s, &c->ip4.gw, sizeof(c->ip4.gw)); + memcpy(opts[54].s, &c->ip4.our_tap_addr, sizeof(c->ip4.our_tap_addr)); /* If the gateway is not on the assigned subnet, send an option 121 * (Classless Static Routing) adding a dummy route to it. @@ -377,7 +377,7 @@ int dhcp(const struct ctx *c, const struct pool *p) opt_set_dns_search(c, sizeof(m->o)); dlen = offsetof(struct msg, o) + fill(m); - tap_udp4_send(c, c->ip4.gw, 67, c->ip4.addr, 68, m, dlen); + tap_udp4_send(c, c->ip4.our_tap_addr, 67, c->ip4.addr, 68, m, dlen); return 1; } diff --git a/fwd.c b/fwd.c index 1baae338..fe618742 100644 --- a/fwd.c +++ b/fwd.c @@ -387,10 +387,14 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, } if (!fwd_guest_accessible(c, &ini->eaddr)) { - if (inany_v4(&ini->eaddr)) - tgt->oaddr = inany_from_v4(c->ip4.gw); - else + if (inany_v4(&ini->eaddr)) { + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) + /* No source address we can use */ + return PIF_NONE; + tgt->oaddr = inany_from_v4(c->ip4.our_tap_addr); + } else { tgt->oaddr.a6 = c->ip6.our_tap_ll; + } } else { tgt->oaddr = ini->eaddr; } diff --git a/passt.h b/passt.h index 3b8a6283..ecfed1e7 100644 --- a/passt.h +++ b/passt.h @@ -97,6 +97,7 @@ enum passt_modes { * @gw: Default IPv4 gateway * @dns: DNS addresses for DHCP, zero-terminated * @dns_match: Forward DNS query if sent to this address + * @our_tap_addr: IPv4 address for passt's use on tap * @dns_host: Use this DNS on the host for forwarding * @addr_out: Optional source address for outbound traffic * @ifname_out: Optional interface name to bind outbound sockets to @@ -111,6 +112,7 @@ struct ip4_ctx { struct in_addr gw; struct in_addr dns[MAXNS + 1]; struct in_addr dns_match; + struct in_addr our_tap_addr; /* PIF_HOST addresses */ struct in_addr dns_host; -- 2.46.0