[PATCH v4 0/7] Don't expose container loopback services to the host

[David Gibson <david@gibson.dropbear.id.au>]

podman issue #24045 pointed out that pasta's spliced forwarding logic
can expose services within the namespace bound only to 127.0.0.1 or
::1 to the host.  However, the namespace probably expects those to
only be accessible to itself, so that's probably not what we want.

This changes our forwarding logic so as not to do this.  Note that the
podman tests will currently fail with this series, I've submitted
podman PR https://github.com/containers/podman/pull/24064 to fix that.

Link: https://github.com/containers/podman/issues/24045

Changes since v3:
 * Added several extra patches working around failures on Debian,
   because its dhclient-script doesn't wait for DAD to complete
Changes since v2:
 * Add new field do structure comment
Changes since v1:
 * Add --host-lo-to-ns-lo option to preserve the old behaviour
 * Clarify the new behaviour in the man page
 * Add some extra patches making some other corrections to the man
   page

David Gibson (7):
  arp: Fix a handful of small warts
  test: Explicitly wait for DAD to complete on SLAAC addresses
  test: Wait for DAD on DHCPv6 addresses
  passt.1: Mark --stderr as deprecated more prominently
  passt.1: Clarify and update "Handling of local addresses" section
  test: Clarify test for spliced inbound transfers
  fwd: Direct inbound spliced forwards to the guest's external address

 arp.c                 |  8 ++---
 conf.c                |  9 ++++++
 fwd.c                 | 31 +++++++++++++-----
 passt.1               | 75 ++++++++++++++++++++++++++-----------------
 passt.h               |  2 ++
 test/passt/dhcp       |  2 ++
 test/passt/ndp        |  4 ++-
 test/passt_in_ns/tcp  |  8 ++---
 test/passt_in_ns/udp  |  4 +--
 test/pasta/dhcp       |  2 ++
 test/pasta/ndp        |  3 +-
 test/pasta/tcp        | 16 ++++-----
 test/pasta/udp        |  8 ++---
 test/two_guests/basic |  6 +++-
 14 files changed, 115 insertions(+), 63 deletions(-)

-- 
2.47.0