[PATCH v4 2/9] arp/ndp: respond with true MAC address of LAN local remote hosts

[Jon Maloy <jmaloy@redhat.com>]

When we receive an ARP request or NDP neigbor solicitation over
the tap interface for a host on the local network segment attached
to the template interface, we respond with that host's real MAC
address.

The local host, which is acting as a proxy for the default gateway,
is still exempted from this rule.

Signed-off-by: Jon Maloy <jmaloy@redhat.com>
---
 arp.c   |  9 +++++++++
 fwd.c   | 38 ++++++++++++++++++++++++++++++--------
 fwd.h   |  1 +
 inany.c |  1 +
 ndp.c   |  9 +++++++++
 5 files changed, 50 insertions(+), 8 deletions(-)

diff --git a/arp.c b/arp.c
index fc482bb..c37867a 100644
--- a/arp.c
+++ b/arp.c
@@ -29,6 +29,7 @@
 #include "dhcp.h"
 #include "passt.h"
 #include "tap.h"
+#include "netlink.h"
 
 /**
  * arp() - Check if this is a supported ARP message, reply as needed
@@ -39,6 +40,7 @@
  */
 int arp(const struct ctx *c, const struct pool *p)
 {
+	union inany_addr tgt;
 	unsigned char swap[4];
 	struct ethhdr *eh;
 	struct arphdr *ah;
@@ -72,6 +74,13 @@ int arp(const struct ctx *c, const struct pool *p)
 	memcpy(am->tha,		am->sha,	sizeof(am->tha));
 	memcpy(am->sha,		c->our_tap_mac,	sizeof(am->sha));
 
+	/* Respond with true MAC address if remote host is on
+	 * the template interface's network segment
+	 */
+	inany_from_af(&tgt, AF_INET, am->tip);
+	if (!fwd_inany_nat(c, &tgt))
+		nl_neigh_mac_get(nl_sock, &tgt, c->ifi4, am->sha);
+
 	memcpy(swap,		am->tip,	sizeof(am->tip));
 	memcpy(am->tip,		am->sip,	sizeof(am->tip));
 	memcpy(am->sip,		swap,		sizeof(am->sip));
diff --git a/fwd.c b/fwd.c
index 250cf56..55bf5f2 100644
--- a/fwd.c
+++ b/fwd.c
@@ -331,20 +331,29 @@ static bool fwd_guest_accessible(const struct ctx *c,
  *
  * Only handles translations that depend *only* on the address.  Anything
  * related to specific ports or flows is handled elsewhere.
+ *
+ * Return: true if there was a translation, otherwise false
  */
-static void nat_outbound(const struct ctx *c, const union inany_addr *addr,
-			 union inany_addr *translated)
+static bool nat_outbound(const struct ctx *c, const union inany_addr *addr,
+				union inany_addr *translated)
 {
-	if (inany_equals4(addr, &c->ip4.map_host_loopback))
+	if (inany_equals4(addr, &c->ip4.map_host_loopback)) {
 		*translated = inany_loopback4;
-	else if (inany_equals6(addr, &c->ip6.map_host_loopback))
+		return true;
+	} else if (inany_equals6(addr, &c->ip6.map_host_loopback)) {
 		*translated = inany_loopback6;
-	else if (inany_equals4(addr, &c->ip4.map_guest_addr))
+		return true;
+	} else if (inany_equals4(addr, &c->ip4.map_guest_addr)) {
 		*translated = inany_from_v4(c->ip4.addr);
-	else if (inany_equals6(addr, &c->ip6.map_guest_addr))
+		return true;
+	} else if (inany_equals6(addr, &c->ip6.map_guest_addr)) {
 		translated->a6 = c->ip6.addr;
-	else
-		*translated = *addr;
+		return true;
+	}
+
+	*translated = *addr;
+	return false;
+
 }
 
 /**
@@ -554,3 +563,16 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
 
 	return PIF_TAP;
 }
+
+/** fwd_inany_nat - Find if a remote IPv[46] address is subject to NAT
+ * @c:          Execution context
+ * @addr:       IPv[46] address
+ *
+ * Return: true if translated, false otherwise
+ */
+bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr)
+{
+	union inany_addr addr_nat;
+
+	return nat_outbound(c, addr, &addr_nat);
+}
diff --git a/fwd.h b/fwd.h
index 65c7c96..c8d485d 100644
--- a/fwd.h
+++ b/fwd.h
@@ -56,5 +56,6 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto,
 			    const struct flowside *ini, struct flowside *tgt);
 uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
 			  const struct flowside *ini, struct flowside *tgt);
+bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr);
 
 #endif /* FWD_H */
diff --git a/inany.c b/inany.c
index 65a39f9..7680439 100644
--- a/inany.c
+++ b/inany.c
@@ -16,6 +16,7 @@
 #include "ip.h"
 #include "siphash.h"
 #include "inany.h"
+#include "fwd.h"
 
 const union inany_addr inany_loopback4 = INANY_INIT4(IN4ADDR_LOOPBACK_INIT);
 const union inany_addr inany_any4 = INANY_INIT4(IN4ADDR_ANY_INIT);
diff --git a/ndp.c b/ndp.c
index 3e15494..9912f80 100644
--- a/ndp.c
+++ b/ndp.c
@@ -32,6 +32,7 @@
 #include "passt.h"
 #include "tap.h"
 #include "log.h"
+#include "netlink.h"
 
 #define	RT_LIFETIME	65535
 
@@ -196,6 +197,7 @@ static void ndp_send(const struct ctx *c, const struct in6_addr *dst,
 static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
 	    const struct in6_addr *addr)
 {
+	union inany_addr tgt;
 	struct ndp_na na = {
 		.ih = {
 			.icmp6_type		= NA,
@@ -215,6 +217,13 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
 
 	memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN);
 
+	/* Respond with true link-layer address if remote host is on
+	 * the template interface's network segment
+	 */
+	inany_from_af(&tgt, AF_INET6, addr);
+	if (!fwd_inany_nat(c, &tgt))
+		nl_neigh_mac_get(nl_sock, &tgt, c->ifi6, na.target_l2_addr.mac);
+
 	ndp_send(c, dst, &na, sizeof(na));
 }
 
-- 
@@ -32,6 +32,7 @@
 #include "passt.h"
 #include "tap.h"
 #include "log.h"
+#include "netlink.h"
 
 #define	RT_LIFETIME	65535
 
@@ -196,6 +197,7 @@ static void ndp_send(const struct ctx *c, const struct in6_addr *dst,
 static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
 	    const struct in6_addr *addr)
 {
+	union inany_addr tgt;
 	struct ndp_na na = {
 		.ih = {
 			.icmp6_type		= NA,
@@ -215,6 +217,13 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
 
 	memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN);
 
+	/* Respond with true link-layer address if remote host is on
+	 * the template interface's network segment
+	 */
+	inany_from_af(&tgt, AF_INET6, addr);
+	if (!fwd_inany_nat(c, &tgt))
+		nl_neigh_mac_get(nl_sock, &tgt, c->ifi6, na.target_l2_addr.mac);
+
 	ndp_send(c, dst, &na, sizeof(na));
 }
 
-- 
2.50.1