[PATCH v5 13/13] netlink: Add host-side monitoring for late template interface binding

[Jon Maloy <jmaloy@redhat.com>]

When pasta starts without an active template interface (e.g., WiFi
not yet connected), it falls back to local mode. This change adds
support for late binding: when the template interface gets an address
or a default route later, pasta detects this via a host-side netlink
socket and propagates the configuration to the namespace.

Late binding occurs when:
- A specific interface is given via -I and later gets an address/route.
- No interface is specified, and any interface gets an address/route.
  In the latter case the first discovered interface is adopted as
  template.

In this commit we add a host-side netlink socket to monitor link,
address, and route changes on the template interface. We add a
corresponding nl_linkaddr_host_handler() function to process such
events and propagate the changes to the namespace.

Signed-off-by: Jon Maloy <jmaloy@redhat.com>
---
 epoll_type.h |   2 +
 isolation.c  |   5 +
 netlink.c    | 397 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 netlink.h    |   3 +
 passt.c      |   5 +
 5 files changed, 407 insertions(+), 5 deletions(-)

diff --git a/epoll_type.h b/epoll_type.h
index a90ffb6..cd17a64 100644
--- a/epoll_type.h
+++ b/epoll_type.h
@@ -46,6 +46,8 @@ enum epoll_type {
 	EPOLL_TYPE_REPAIR,
 	/* Netlink neighbour subscription socket */
 	EPOLL_TYPE_NL_NEIGH,
+	/* Netlink link/address subscription socket for late binding */
+	EPOLL_TYPE_NL_LINKADDR_HOST,
 
 	EPOLL_NUM_TYPES,
 };
diff --git a/isolation.c b/isolation.c
index b25f349..8087563 100644
--- a/isolation.c
+++ b/isolation.c
@@ -356,6 +356,11 @@ int isolate_prefork(const struct ctx *c)
 	if (c->mode == MODE_PASTA) {
 		/* Keep CAP_SYS_ADMIN, so we can enter the netns */
 		ns_caps |= BIT(CAP_SYS_ADMIN);
+		/* Keep CAP_NET_ADMIN for dynamic interface configuration,
+		 * so we can propagate addresses and routes when template
+		 * interface comes up after start
+		 */
+		ns_caps |= BIT(CAP_NET_ADMIN);
 		/* Keep CAP_NET_BIND_SERVICE, so we can splice
 		 * outbound connections to low port numbers
 		 */
diff --git a/netlink.c b/netlink.c
index 769cb23..a1790a4 100644
--- a/netlink.c
+++ b/netlink.c
@@ -37,6 +37,14 @@
 #include "ip.h"
 #include "netlink.h"
 #include "epoll_ctl.h"
+#include "conf.h"
+#include "arp.h"
+#include "ndp.h"
+#include "tap.h"
+#include "fwd.h"
+
+/* Default namespace interface name */
+extern const char *pasta_default_ifn;
 
 /* Same as RTA_NEXT() but for nexthops: RTNH_NEXT() doesn't take 'attrlen' */
 #define RTNH_NEXT_AND_DEC(rtnh, attrlen)				\
@@ -56,10 +64,14 @@
 #define NLBUFSIZ 65536
 
 /* Socket in init, in target namespace, sequence (just needs to be monotonic) */
-int nl_sock		 = -1;
-int nl_sock_ns		 = -1;
-static int nl_sock_neigh = -1;
-static int nl_seq	 = 1;
+int nl_sock			 = -1;
+int nl_sock_ns			 = -1;
+static int nl_sock_neigh	 = -1;
+static int nl_sock_linkaddr_host = -1;
+static int nl_seq		 = 1;
+
+static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
+		       const void *addr, int prefix_len);
 
 /**
  * nl_sock_init_do() - Set up netlink sockets in init or target namespace
@@ -91,6 +103,329 @@ static int nl_sock_init_do(void *arg)
 	return 0;
 }
 
+/**
+ * nl_linkaddr_host_msg_read() - Handle host-side link/addr/route changes
+ * @c:		Execution context
+ * @nh:	Netlink message header
+ *
+ * Monitor template interface changes and propagate to namespace.
+ * Supports late binding: if no template was detected at startup,
+ * adopt the interface specified by -I when it gets an address.
+ */
+static void nl_linkaddr_host_msg_read(struct ctx *c, const struct nlmsghdr *nh)
+{
+	if (nh->nlmsg_type == NLMSG_DONE || nh->nlmsg_type == NLMSG_ERROR)
+		return;
+
+	if (nh->nlmsg_type == RTM_NEWADDR || nh->nlmsg_type == RTM_DELADDR) {
+		bool is_new = (nh->nlmsg_type == RTM_NEWADDR);
+		const struct ifaddrmsg *ifa = NLMSG_DATA(nh);
+		char buf[INET6_ADDRSTRLEN];
+		unsigned int template_ifi;
+		union inany_addr inany;
+		char ifname[IFNAMSIZ];
+		struct rtattr *rta;
+		void *addr = NULL;
+		bool is_default;
+		sa_family_t af;
+		int prefix_len;
+		bool is_match;
+		bool unbound;
+		size_t na;
+		int rc;
+
+		if (!if_indextoname(ifa->ifa_index, ifname))
+			snprintf(ifname, sizeof(ifname), "?");
+
+		/* Get template interface index */
+		if (ifa->ifa_family == AF_INET)
+			template_ifi = c->ifi4;
+		else if (ifa->ifa_family == AF_INET6)
+			template_ifi = c->ifi6;
+		else
+			return;
+
+		/* Check for late binding conditions */
+		is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
+		is_match = !strcmp(ifname, c->pasta_ifn);
+		unbound = (ifa->ifa_family == AF_INET) ?
+			  c->ifi4 <= 0 : c->ifi6 <= 0;
+
+		if (unbound && (is_default || is_match)) {
+			debug("Late binding: using %s as %s template", ifname,
+			      ifa->ifa_family == AF_INET ? "IPv4" : "IPv6");
+
+			if (ifa->ifa_family == AF_INET) {
+				c->ifi4 = ifa->ifa_index;
+				template_ifi = c->ifi4;
+			} else {
+				c->ifi6 = ifa->ifa_index;
+				template_ifi = c->ifi6;
+			}
+
+			if (is_default)
+				snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
+					 "%s", ifname);
+		}
+
+		if (ifa->ifa_index != template_ifi)
+			return;
+
+		rta = IFA_RTA(ifa);
+		na = IFA_PAYLOAD(nh);
+
+		for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
+			if (ifa->ifa_family == AF_INET &&
+			    rta->rta_type == IFA_LOCAL) {
+				addr = RTA_DATA(rta);
+				break;
+			} else if (ifa->ifa_family == AF_INET6 &&
+				   rta->rta_type == IFA_ADDRESS) {
+				addr = RTA_DATA(rta);
+				break;
+			}
+		}
+
+		if (!addr) {
+			info("No addr found in netlink linkaddr message");
+			return;
+		}
+
+		af = ifa->ifa_family;
+		inany_from_af(&inany, af, addr);
+		inet_ntop(af, addr, buf, sizeof(buf));
+
+		/* IPv4 prefix stored as IPv4-mapped, so add 96 bits */
+		prefix_len = ifa->ifa_prefixlen + (af == AF_INET ? 96 : 0);
+
+		if (!is_new) {
+			fwd_remove_addr(c, &inany);
+			nl_addr_del(nl_sock_ns, c->pasta_ifi,
+				    af, addr, ifa->ifa_prefixlen);
+			return;
+		}
+
+		rc = nl_addr_set(nl_sock_ns, c->pasta_ifi,
+				 af, addr, ifa->ifa_prefixlen);
+		if (rc < 0) {
+			debug("Failed to add %s/%u to ns: %s",
+			      buf, ifa->ifa_prefixlen, strerror_(-rc));
+		} else {
+			fwd_set_addr(c, &inany,
+				     CONF_ADDR_HOST | CONF_ADDR_OBSERVED,
+				     prefix_len);
+			debug("Added %s/%u to namespace",
+			      buf, ifa->ifa_prefixlen);
+		}
+		return;
+	}
+
+	if (nh->nlmsg_type == RTM_NEWROUTE || nh->nlmsg_type == RTM_DELROUTE) {
+		bool is_new = (nh->nlmsg_type == RTM_NEWROUTE);
+		const struct rtmsg *rtm = NLMSG_DATA(nh);
+		struct rtattr *rta = RTM_RTA(rtm);
+		size_t na = RTM_PAYLOAD(nh);
+		unsigned int template_ifi;
+		char ifname[IFNAMSIZ];
+		unsigned int oif = 0;
+		void *gw = NULL;
+		bool is_default;
+		bool is_match;
+		bool unbound;
+
+		/* We are only interested in default routes */
+		if (rtm->rtm_dst_len != 0)
+			return;
+
+		for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
+			if (rta->rta_type == RTA_GATEWAY)
+				gw = RTA_DATA(rta);
+			else if (rta->rta_type == RTA_OIF)
+				oif = *(unsigned int *)RTA_DATA(rta);
+		}
+
+		if (!gw || !oif)
+			return;
+
+		/* Get interface name for late binding check */
+		if (!if_indextoname(oif, ifname))
+			return;
+
+		/* Check for late binding conditions */
+		is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
+		is_match = !strcmp(ifname, c->pasta_ifn);
+
+		if (rtm->rtm_family == AF_INET)
+			template_ifi = c->ifi4;
+		else if (rtm->rtm_family == AF_INET6)
+			template_ifi = c->ifi6;
+		else
+			return;
+
+		unbound = (rtm->rtm_family == AF_INET) ?
+			  c->ifi4 <= 0 : c->ifi6 <= 0;
+
+		if (unbound && (is_default || is_match)) {
+			debug("Late binding (route): using %s as %s template",
+			      ifname,
+			      rtm->rtm_family == AF_INET ? "IPv4" : "IPv6");
+
+			if (rtm->rtm_family == AF_INET) {
+				c->ifi4 = oif;
+				template_ifi = c->ifi4;
+			} else {
+				c->ifi6 = oif;
+				template_ifi = c->ifi6;
+			}
+
+			if (is_default)
+				snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
+					 "%s", ifname);
+		}
+
+		if (oif != template_ifi)
+			return;
+
+		if (rtm->rtm_family == AF_INET) {
+			char buf[INET_ADDRSTRLEN];
+
+			if (!is_new) {
+				c->ip4.guest_gw = (struct in_addr){ 0 };
+				c->ip4.our_tap_addr = (struct in_addr){ 0 };
+				return;
+			}
+			c->ip4.guest_gw = *(struct in_addr *)gw;
+			c->ip4.our_tap_addr = c->ip4.guest_gw;
+			nl_route_set_def(nl_sock_ns, c->pasta_ifi, AF_INET, gw);
+			inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf));
+			debug("Set IPv4 default route via %s", buf);
+		} else if (rtm->rtm_family == AF_INET6) {
+			char buf[INET6_ADDRSTRLEN];
+
+			if (!is_new) {
+				c->ip6.guest_gw = (struct in6_addr){ 0 };
+				return;
+			}
+			c->ip6.guest_gw = *(struct in6_addr *)gw;
+			nl_route_set_def(nl_sock_ns, c->pasta_ifi,
+					 AF_INET6, gw);
+			inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf));
+			debug("Set IPv6 default route via %s", buf);
+		}
+	}
+}
+
+/**
+ * nl_linkaddr_host_handler() - Handle events from host link/addr notifier
+ * @c:		Execution context
+ *
+ * Monitor template interface changes and propagate to namespace
+ */
+void nl_linkaddr_host_handler(struct ctx *c)
+{
+	char buf[NLBUFSIZ];
+
+	for (;;) {
+		ssize_t n = recv(nl_sock_linkaddr_host, buf, sizeof(buf),
+				 MSG_DONTWAIT);
+		struct nlmsghdr *nh = (struct nlmsghdr *)buf;
+
+		if (n < 0) {
+			if (errno == EINTR)
+				continue;
+			if (errno != EAGAIN)
+				info("Host recv() error: %s", strerror_(errno));
+			break;
+		}
+
+		info("Host netlink: received %zd bytes", n);
+
+		for (; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n))
+			nl_linkaddr_host_msg_read(c, nh);
+	}
+}
+
+/**
+ * nl_linkaddr_host_init_do() - Create host-side link/addr notifier socket
+ * @arg:	Unused
+ *
+ * Return: 0 on success, -1 on failure
+ */
+static int nl_linkaddr_host_init_do(void *arg)
+{
+	struct sockaddr_nl addr = {
+		.nl_family = AF_NETLINK,
+		.nl_groups = RTMGRP_LINK |
+			     RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR |
+			     RTMGRP_IPV4_ROUTE | RTMGRP_IPV6_ROUTE,
+	};
+
+	(void)arg;
+
+	nl_sock_linkaddr_host = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC,
+				       NETLINK_ROUTE);
+	if (nl_sock_linkaddr_host < 0) {
+		debug("socket() failed for host: %s", strerror_(errno));
+		return -1;
+	}
+
+	if (bind(nl_sock_linkaddr_host, (struct sockaddr *)&addr,
+		 sizeof(addr)) < 0) {
+		debug("bind() failed for host: %s", strerror_(errno));
+		close(nl_sock_linkaddr_host);
+		nl_sock_linkaddr_host = -1;
+		return -1;
+	}
+
+	debug("host socket fd=%d", nl_sock_linkaddr_host);
+	return 0;
+}
+
+/**
+ * nl_linkaddr_notify_init() - Initialize host link/address change notifier
+ * @c:		Execution context
+ *
+ * In PASTA mode, create a host-side netlink socket to monitor template
+ * interface changes and propagate them to the namespace (late binding).
+ *
+ * Return: 0 on success, -1 on failure
+ */
+int nl_linkaddr_notify_init(const struct ctx *c)
+{
+	union epoll_ref ref = { .type = EPOLL_TYPE_NL_LINKADDR_HOST };
+	struct epoll_event ev = { .events = EPOLLIN };
+
+	if (c->mode != MODE_PASTA)
+		return 0;
+
+	if (nl_sock_linkaddr_host >= 0) {
+		debug("host notifier already initialized (fd=%d)",
+		      nl_sock_linkaddr_host);
+		return 0;
+	}
+
+	nl_linkaddr_host_init_do(NULL);
+
+	if (nl_sock_linkaddr_host < 0) {
+		warn("Failed to create host link/addr notifier socket");
+		return -1;
+	}
+
+	ev.data.u64 = ref.u64;
+	if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD,
+		      nl_sock_linkaddr_host, &ev) == -1) {
+		warn("epoll_ctl() failed on host notifier: %s",
+		     strerror_(errno));
+		close(nl_sock_linkaddr_host);
+		nl_sock_linkaddr_host = -1;
+		return -1;
+	}
+
+	info("Host netlink socket fd=%d, pasta_ifn=%s",
+	     nl_sock_linkaddr_host, c->pasta_ifn);
+
+	return 0;
+}
 /**
  * nl_sock_init() - Call nl_sock_init_do(), won't return on failure
  * @c:		Execution context
@@ -516,7 +851,7 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw)
 		req.set.r4.rta_gw.rta_len = rta_len;
 	}
 
-	return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len);
+	return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_REPLACE, len);
 }
 
 /**
@@ -927,6 +1262,58 @@ int nl_addr_set(int s, unsigned int ifi, sa_family_t af,
 	return nl_do(s, &req, RTM_NEWADDR, NLM_F_CREATE | NLM_F_EXCL, len);
 }
 
+/**
+ * nl_addr_del() - Delete IP address from given interface
+ * @s:		Netlink socket
+ * @ifi:	Interface index
+ * @af:		Address family
+ * @addr:	Address to delete
+ * @prefix_len:	Prefix length
+ *
+ * Return: 0 on success, negative error code on failure
+ */
+static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
+		       const void *addr, int prefix_len)
+{
+	struct req_t {
+		struct nlmsghdr nlh;
+		struct ifaddrmsg ifa;
+		union {
+			struct {
+				struct rtattr rta_l;
+				struct in_addr l;
+			} a4;
+			struct {
+				struct rtattr rta_l;
+				struct in6_addr l;
+			} a6;
+		} del;
+	} req = {
+		.ifa.ifa_family    = af,
+		.ifa.ifa_index     = ifi,
+		.ifa.ifa_prefixlen = prefix_len,
+	};
+	ssize_t len;
+
+	if (af == AF_INET6) {
+		size_t rta_len = RTA_LENGTH(sizeof(req.del.a6.l));
+
+		len = offsetof(struct req_t, del.a6) + sizeof(req.del.a6);
+		memcpy(&req.del.a6.l, addr, sizeof(req.del.a6.l));
+		req.del.a6.rta_l.rta_len = rta_len;
+		req.del.a6.rta_l.rta_type = IFA_LOCAL;
+	} else {
+		size_t rta_len = RTA_LENGTH(sizeof(req.del.a4.l));
+
+		len = offsetof(struct req_t, del.a4) + sizeof(req.del.a4);
+		memcpy(&req.del.a4.l, addr, sizeof(req.del.a4.l));
+		req.del.a4.rta_l.rta_len = rta_len;
+		req.del.a4.rta_l.rta_type = IFA_LOCAL;
+	}
+
+	return nl_do(s, &req, RTM_DELADDR, 0, len);
+}
+
 /**
  * nl_addr_dup() - Copy IP addresses for given interface and address family
  * @s_src:	Netlink socket in source network namespace
diff --git a/netlink.h b/netlink.h
index 8f1e9b9..c19d3a3 100644
--- a/netlink.h
+++ b/netlink.h
@@ -33,4 +33,7 @@ int nl_link_set_flags(int s, unsigned int ifi,
 int nl_neigh_notify_init(const struct ctx *c);
 void nl_neigh_notify_handler(const struct ctx *c);
 
+int nl_linkaddr_notify_init(const struct ctx *c);
+void nl_linkaddr_host_handler(struct ctx *c);
+
 #endif /* NETLINK_H */
diff --git a/passt.c b/passt.c
index 7488a84..64163df 100644
--- a/passt.c
+++ b/passt.c
@@ -80,6 +80,7 @@ char *epoll_type_str[] = {
 	[EPOLL_TYPE_REPAIR_LISTEN]	= "TCP_REPAIR helper listening socket",
 	[EPOLL_TYPE_REPAIR]		= "TCP_REPAIR helper socket",
 	[EPOLL_TYPE_NL_NEIGH]		= "netlink neighbour notifier socket",
+	[EPOLL_TYPE_NL_LINKADDR_HOST]	= "host link/address notifier socket",
 };
 static_assert(ARRAY_SIZE(epoll_type_str) == EPOLL_NUM_TYPES,
 	      "epoll_type_str[] doesn't match enum epoll_type");
@@ -303,6 +304,9 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events)
 		case EPOLL_TYPE_NL_NEIGH:
 			nl_neigh_notify_handler(c);
 			break;
+		case EPOLL_TYPE_NL_LINKADDR_HOST:
+			nl_linkaddr_host_handler(c);
+			break;
 		default:
 			/* Can't happen */
 			ASSERT(0);
@@ -413,6 +417,7 @@ int main(int argc, char **argv)
 
 	fwd_neigh_table_init(&c);
 	nl_neigh_notify_init(&c);
+	nl_linkaddr_notify_init(&c);
 
 	if (!c.foreground) {
 		if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0)
-- 
2.52.0