From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202410 header.b=fx3NHIjH; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 9F0F35A026E for ; Fri, 18 Oct 2024 03:36:07 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202410; t=1729215357; bh=/KhTbbJ8KSbYA/704Zyu3VmML1mkzjpt2b3LniqzkSo=; h=From:To:Cc:Subject:Date:From; b=fx3NHIjHktmKakCW50a/I1cAuZAd8+nIiImtBVpbwlc1xu2txCygb79DfrQq6vIaI S+bqjM/OeDvONczgp8jEPOpfvJ0CyUqk3QKWjO8lJ0qoAnEHzNywkEl8BIJRD6CfzH UsQ4rZjvIvGDMxqA5ngnu1yJYskuGCqaoSR8gHwadF8SOvf6hqIRL4+Nhn7gbhcv+l xZ/HgIbDLh4VGFh6uiMfly4QQ7uz2yas1K4R2ZzN/hHg34/PZooig6zqTvzB3tBPdu 7wKGfdp/jwtD5yq56nTNFuOyMFbSiOFqsWWXi3zlmC8JhOGIKY7cSv9e+FpmEQpxBO xBt0yV/hGdAYA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4XV6jT1XzXz4wnp; Fri, 18 Oct 2024 12:35:57 +1100 (AEDT) From: David Gibson To: passt-dev@passt.top, Stefano Brivio Subject: [PATCH v5 0/7] Don't expose container loopback services to the host Date: Fri, 18 Oct 2024 12:35:49 +1100 Message-ID: <20241018013556.1266295-1-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.47.0 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: 4OXPVAPMVF5EJWYS74ATS2AQ6XQIUSYQ X-Message-ID-Hash: 4OXPVAPMVF5EJWYS74ATS2AQ6XQIUSYQ X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: podman issue #24045 pointed out that pasta's spliced forwarding logic can expose services within the namespace bound only to 127.0.0.1 or ::1 to the host. However, the namespace probably expects those to only be accessible to itself, so that's probably not what we want. This changes our forwarding logic so as not to do this. Note that the podman tests will currently fail with this series, I've submitted podman PR https://github.com/containers/podman/pull/24064 to fix that. Link: https://github.com/containers/podman/issues/24045 Changes since v4: * Handled a few cases where we need to wait for DAD which were missed in v4. * Fix a grammar error in comment Changes since v3: * Added several extra patches working around failures on Debian, because its dhclient-script doesn't wait for DAD to complete Changes since v2: * Add new field do structure comment Changes since v1: * Add --host-lo-to-ns-lo option to preserve the old behaviour * Clarify the new behaviour in the man page * Add some extra patches making some other corrections to the man page David Gibson (7): arp: Fix a handful of small warts test: Explicitly wait for DAD to complete on SLAAC addresses test: Wait for DAD on DHCPv6 addresses passt.1: Mark --stderr as deprecated more prominently passt.1: Clarify and update "Handling of local addresses" section test: Clarify test for spliced inbound transfers fwd: Direct inbound spliced forwards to the guest's external address arp.c | 8 ++--- conf.c | 9 ++++++ fwd.c | 31 +++++++++++++----- passt.1 | 75 ++++++++++++++++++++++++++----------------- passt.h | 2 ++ test/passt/dhcp | 2 ++ test/passt/ndp | 4 ++- test/passt_in_ns/dhcp | 2 ++ test/passt_in_ns/tcp | 8 ++--- test/passt_in_ns/udp | 4 +-- test/pasta/dhcp | 2 ++ test/pasta/ndp | 3 +- test/pasta/tcp | 16 ++++----- test/pasta/udp | 8 ++--- test/perf/passt_tcp | 2 ++ test/two_guests/basic | 6 +++- 16 files changed, 119 insertions(+), 63 deletions(-) -- 2.47.0