From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=fail reason="key not found in DNS" header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202312 header.b=XI9m5gJx; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 68D655A0277 for ; Fri, 16 Aug 2024 07:40:21 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202312; t=1723786807; bh=b6Syy5Oamsw5qh2XwqqQ9B4SfP7vVpvN8y2NCpDSIrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XI9m5gJx7y2a1qv+XySUNuou2RU9r2DrltXFVi6ZXJMFSyGGAmZBqML8PNaon06ID G5kFjtdKBeoDZUTU/JMiX2Ls8I5PQMY2/BPYlLOYGa0Ua3mskDaSlQIUcXa0EB0UQN 33x9VmPB9zQe/pBOJJsQoZRXQ2pNyC6wXN2mJifLcDqGcGXCb5Ir3doR0Gk3XTEQKx vVk6wovQ2YkX/Rx0/guvC8oCy2n2929MyR3w2FSXhSw/3vBCPEqsQsRUEQqSp8G8co MeyTBYNbqDFFldnBQ1c3RB8ziRJICX3RucLIhTr+h9I3avXKLZm5xBKV0FPb37Nuc4 DkuGQLgu2KidA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4WlW6H1WzQz4x87; Fri, 16 Aug 2024 15:40:07 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 22/22] fwd, conf: Allow NAT of the guest's assigned address Date: Fri, 16 Aug 2024 15:40:03 +1000 Message-ID: <20240816054004.1335006-23-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.46.0 In-Reply-To: <20240816054004.1335006-1-david@gibson.dropbear.id.au> References: <20240816054004.1335006-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: IPM4AFPBWZ6JBKS7HTQNZT42SMIVOX3I X-Message-ID-Hash: IPM4AFPBWZ6JBKS7HTQNZT42SMIVOX3I X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Paul Holzinger , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The guest is usually assigned one of the host's IP addresses. That means it can't access the host itself via its usual address. The --nat-host-loopback option (enabled by default with the gateway address) allows the guest to contact the host. However, connections forwarded this way appear on the host to have originated from the loopback interface, which isn't always desirable. Add a new --nat-guest-addr option, which acts similarly but forwarded connections will go to the host's external address, instead of loopback. If '-a' is used, so the guest's address is not the same as the host's, this will instead forward to whatever host-visible site is shadowed by the guest's assigned address. Signed-off-by: David Gibson --- conf.c | 51 ++++++++++++++++++++++++++++++++++----------------- fwd.c | 10 ++++++++++ passt.1 | 15 +++++++++++++++ passt.h | 6 ++++++ 4 files changed, 65 insertions(+), 17 deletions(-) diff --git a/conf.c b/conf.c index c5831e82..d14abc63 100644 --- a/conf.c +++ b/conf.c @@ -825,6 +825,14 @@ static void usage(const char *name, FILE *f, int status) " Can be specified zero to two (for IPv4 and IPv6)\n" " default: gateway address, or none if --no-map-gw is also\n" " specified\n" + " --nat-guest-addr ADDR NAT ADDR to guest's address\n" + " Packets from the guest to ADDR will be redirected to the\n" + " adress on the host that's the same as the guest's\n" + " assigned address. Usually that means (one of) the host's\n" + " global address.\n" + " ADDR can be 'none', in which case nothing is mapped\n" + " Can be specified zero to two (for IPv4 and IPv6)\n" + " default: none\n" " --dns-forward ADDR Forward DNS queries sent to ADDR\n" " can be specified zero to two times (for IPv4 and IPv6)\n" " default: don't forward DNS queries\n" @@ -1141,29 +1149,32 @@ static void conf_ugid(char *runas, uid_t *uid, gid_t *gid) } /** - * conf_nat() - Parse --nat-host-loopback option - * @c: Execution context - * @arg: String argument to --nat-host-loopback - * @no_map_gw: --no-map-gw flag, updated for "none" argument + * conf_nat() - Parse --nat-host-loopback or --nat-guest-addr option + * @arg: String argument to option + * @addr4: IPv4 to update with parsed address + * @addr6: IPv6 to update with parsed address + * @no_map_gw: --no-map-gw flag, or NULL, updated for "none" argument */ -static void conf_nat(struct ctx *c, const char *arg, int *no_map_gw) +static void conf_nat(const char *arg, struct in_addr *addr4, + struct in6_addr *addr6, int *no_map_gw) { if (strcmp(arg, "none") == 0) { - c->ip4.nat_host_loopback = in4addr_any; - c->ip6.nat_host_loopback = in6addr_any; - *no_map_gw = 1; + *addr4 = in4addr_any; + *addr6 = in6addr_any; + if (no_map_gw) + *no_map_gw = 1; } - if (inet_pton(AF_INET6, arg, &c->ip6.nat_host_loopback) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_host_loopback) && - !IN6_IS_ADDR_LOOPBACK(&c->ip6.nat_host_loopback) && - !IN6_IS_ADDR_MULTICAST(&c->ip6.nat_host_loopback)) + if (inet_pton(AF_INET6, arg, addr6) && + !IN6_IS_ADDR_UNSPECIFIED(addr6) && + !IN6_IS_ADDR_LOOPBACK(addr6) && + !IN6_IS_ADDR_MULTICAST(addr6)) return; - if (inet_pton(AF_INET, arg, &c->ip4.nat_host_loopback) && - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.nat_host_loopback) && - !IN4_IS_ADDR_LOOPBACK(&c->ip4.nat_host_loopback) && - !IN4_IS_ADDR_MULTICAST(&c->ip4.nat_host_loopback)) + if (inet_pton(AF_INET, arg, addr4) && + !IN4_IS_ADDR_UNSPECIFIED(addr4) && + !IN4_IS_ADDR_LOOPBACK(addr4) && + !IN4_IS_ADDR_MULTICAST(addr4)) return; die("Invalid address to remap to host: %s", optarg); @@ -1279,6 +1290,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-copy-addrs", no_argument, NULL, 19 }, {"netns-only", no_argument, NULL, 20 }, {"nat-host-loopback", required_argument, NULL, 21 }, + {"nat-guest-addr", required_argument, NULL, 22 }, { 0 }, }; const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; @@ -1449,7 +1461,12 @@ void conf(struct ctx *c, int argc, char **argv) *userns = 0; break; case 21: - conf_nat(c, optarg, &no_map_gw); + conf_nat(optarg, &c->ip4.nat_host_loopback, + &c->ip6.nat_host_loopback, &no_map_gw); + break; + case 22: + conf_nat(optarg, &c->ip4.nat_guest_addr, + &c->ip6.nat_guest_addr, NULL); break; case 'd': c->debug = 1; diff --git a/fwd.c b/fwd.c index 7718f7e2..ff4789a2 100644 --- a/fwd.c +++ b/fwd.c @@ -272,6 +272,10 @@ uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto, tgt->eaddr = inany_loopback4; else if (inany_equals6(&ini->oaddr, &c->ip6.nat_host_loopback)) tgt->eaddr = inany_loopback6; + else if (inany_equals4(&ini->oaddr, &c->ip4.nat_guest_addr)) + tgt->eaddr = inany_from_v4(c->ip4.addr); + else if (inany_equals6(&ini->oaddr, &c->ip6.nat_guest_addr)) + tgt->eaddr.a6 = c->ip6.addr; else tgt->eaddr = ini->oaddr; @@ -393,6 +397,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_host_loopback) && inany_equals6(&ini->eaddr, &in6addr_loopback)) { tgt->oaddr.a6 = c->ip6.nat_host_loopback; + } else if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.nat_guest_addr) && + inany_equals4(&ini->eaddr, &c->ip4.addr)) { + tgt->oaddr = inany_from_v4(c->ip4.nat_guest_addr); + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_guest_addr) && + inany_equals6(&ini->eaddr, &c->ip6.addr)) { + tgt->oaddr.a6 = c->ip6.nat_guest_addr; } else if (!fwd_guest_accessible(c, &ini->eaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) diff --git a/passt.1 b/passt.1 index 3680056a..7cf553cf 100644 --- a/passt.1 +++ b/passt.1 @@ -350,6 +350,21 @@ as destination, to the host. Implied if there is no gateway on the selected default route, or if there is no default route, for any of the enabled address families. +.TP +.BR \-\-nat-guest-loopback " " \fIaddr +Translate \fIaddr\fR in the guest to be equal to the guest's assigned +address on the host. That is, packets from the guest to \fIaddr\fR +will be redirected to the address assigned to the guest with \fB-a\fR, +or by default the host's global address. This allows the guest to +access services availble on the host's global address, even though its +own address shadows that of the host. + +If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one +IPv6 address can be translated, if the option is specified multiple +times, the last one for each address type takes effect. + +Default is no mapping. + .TP .BR \-4 ", " \-\-ipv4-only Enable IPv4-only operation. IPv6 traffic will be ignored. diff --git a/passt.h b/passt.h index 20a5904a..586c1d05 100644 --- a/passt.h +++ b/passt.h @@ -104,6 +104,8 @@ enum passt_modes { * @guest_gw: IPv4 gateway as seen by the guest * @nat_host_loopback: Outbound connections to this address are NATted to the * host's 127.0.0.1 + * @nat_guest_addr: Outbound connections to this address are NATted to the + * guest's assigned address * @dns: DNS addresses for DHCP, zero-terminated * @dns_match: Forward DNS query if sent to this address * @our_tap_addr: IPv4 address for passt's use on tap @@ -120,6 +122,7 @@ struct ip4_ctx { int prefix_len; struct in_addr guest_gw; struct in_addr nat_host_loopback; + struct in_addr nat_guest_addr; struct in_addr dns[MAXNS + 1]; struct in_addr dns_match; struct in_addr our_tap_addr; @@ -142,6 +145,8 @@ struct ip4_ctx { * @guest_gw: IPv6 gateway as seen by the guest * @nat_host_loopback: Outbound connections to this address are NATted to the * host's [::1] + * @nat_guest_addr: Outbound connections to this address are NATted to the + * guest's assigned address * @dns: DNS addresses for DHCPv6 and NDP, zero-terminated * @dns_match: Forward DNS query if sent to this address * @our_tap_ll: Link-local IPv6 address for passt's use on tap @@ -158,6 +163,7 @@ struct ip6_ctx { struct in6_addr addr_ll_seen; struct in6_addr guest_gw; struct in6_addr nat_host_loopback; + struct in6_addr nat_guest_addr; struct in6_addr dns[MAXNS + 1]; struct in6_addr dns_match; struct in6_addr our_tap_ll; -- 2.46.0