Re: [PATCH v3 4/7] netlink, pasta: Disable DAD for link-local addresses on namespace interface

[Stefano Brivio <sbrivio@redhat.com>]

On Sat, 17 Aug 2024 10:37:16 +0200
Stefano Brivio <sbrivio@redhat.com> wrote:

> On Sat, 17 Aug 2024 17:59:45 +1000
> David Gibson <david@gibson.dropbear.id.au> wrote:
> 
> > On Fri, Aug 16, 2024 at 09:39:15AM +0200, Stefano Brivio wrote:  
> > > It makes no sense for a container or a guest to try and perform
> > > duplicate address detection for their link-local address, as we'll
> > > anyway not relay neighbour solicitations with an unspecified source
> > > address.
> > > 
> > > While they perform duplicate address detection, the link-local address
> > > is not usable, which prevents us from bringing up especially
> > > containers and communicate with them right away via IPv6.
> > > 
> > > This is not enough to prevent DAD and reach the container right away:
> > > we'll need a couple more patches.
> > > 
> > > As we send NLM_F_REPLACE requests right away, while we still have to
> > > read out other addresses on the same socket, we can't use nl_do():
> > > keep track of the last sequence we sent (last address we changed), and
> > > deal with the answers to those NLM_F_REPLACE requests in a separate
> > > loop, later.
> > > 
> > > Link: https://github.com/containers/podman/pull/23561#discussion_r1711639663
> > > Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> > > ---
> > >  netlink.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
> > >  netlink.h |  1 +
> > >  pasta.c   |  6 ++++++
> > >  3 files changed, 62 insertions(+)
> > > 
> > > diff --git a/netlink.c b/netlink.c
> > > index 873e6c7..59f2fd9 100644
> > > --- a/netlink.c
> > > +++ b/netlink.c
> > > @@ -673,6 +673,61 @@ int nl_route_dup(int s_src, unsigned int ifi_src,
> > >  	return 0;
> > >  }
> > >  
> > > +/**
> > > + * nl_addr_set_ll_nodad() - Set IFA_F_NODAD on IPv6 link-local addresses
> > > + * @s:		Netlink socket
> > > + * @ifi:	Interface index in target namespace
> > > + *
> > > + * Return: 0 on success, negative error code on failure
> > > + */
> > > +int nl_addr_set_ll_nodad(int s, unsigned int ifi)
> > > +{
> > > +	struct req_t {
> > > +		struct nlmsghdr nlh;
> > > +		struct ifaddrmsg ifa;
> > > +	} req = {
> > > +		.ifa.ifa_family    = AF_INET6,
> > > +		.ifa.ifa_index     = ifi,
> > > +	};
> > > +	unsigned ll_addrs = 0;
> > > +	struct nlmsghdr *nh;
> > > +	char buf[NLBUFSIZ];
> > > +	ssize_t status;
> > > +	uint32_t seq;
> > > +
> > > +	seq = nl_send(s, &req, RTM_GETADDR, NLM_F_DUMP, sizeof(req));
> > > +	nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWADDR) {
> > > +		struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nh);
> > > +		struct rtattr *rta;
> > > +		size_t na;
> > > +
> > > +		if (ifa->ifa_index != ifi || ifa->ifa_scope != RT_SCOPE_LINK)
> > > +			continue;
> > > +
> > > +		ifa->ifa_flags |= IFA_F_NODAD;
> > > +
> > > +		for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na);
> > > +		     rta = RTA_NEXT(rta, na)) {
> > > +			/* If 32-bit flags are used, add IFA_F_NODAD there */
> > > +			if (rta->rta_type == IFA_FLAGS)
> > > +				*(uint32_t *)RTA_DATA(rta) |= IFA_F_NODAD;
> > > +		}
> > > +
> > > +		nl_send(s, nh, RTM_NEWADDR, NLM_F_REPLACE, nh->nlmsg_len);
> > > +		ll_addrs++;
> > > +	}    
> > 
> > Uh.. did you forget to push an update.  This looks like the last
> > version.  
> 
> Worse :( I accidentally squashed the new changes into 5/7.

6/7, actually.

-- 
Stefano