[PATCH] tap: don't let overheard traffic move addr_seen when serving a fixed address

[PATCH] tap: don't let overheard traffic move addr_seen when serving a fixed address

[EJ Campbell]

The latest source address seen on the tap interface (ip4.addr_seen) is
taken to be the guest's and is used as the target for inbound port
forwarding. The update accepts any source address.

On a point-to-point tap that is always correct. But when the tap sits on
a shared L2 segment -- for example when it is bridged together with other
hosts -- pasta also sees frames from those other hosts. With a static
configuration (-a / address set, DHCP disabled), an overheard frame from
another host silently moves addr_seen to that host, and every subsequent
inbound forwarded connection is sent there instead of to the guest, so
connections are reset or hang.

I hit this running pasta with its tap enslaved to a Linux bridge that also
carries other traffic: inbound port forwarding to the guest broke as soon
as another address was seen on the segment.

Restrict the update so that, when DHCP is disabled (no_dhcp), only frames
sourced from the configured guest address may move addr_seen. With DHCP
enabled -- the default -- behaviour is unchanged, since the guest's
address is whatever pasta leases and tracking it is still correct.

The same reasoning applies to ip6.addr_seen on a shared segment; I left
IPv6 alone for now since I only exercise IPv4 in this setup, and would be
glad to extend it the same way if you prefer.

Signed-off-by: EJ Campbell <ej.campbell@gmail.com>
---
 tap.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tap.c b/tap.c
index 4cba4c7..514379e 100644
--- a/tap.c
+++ b/tap.c
@@ -770,7 +770,19 @@ resume:
                      continue;
              }

-             if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr)
+             /* The latest source address seen on the tap is taken to be the
+              * guest's, and becomes the target for inbound forwarding. On a
+              * point-to-point tap that's always correct. But if the tap sits
+              * on a shared L2 segment (for example bridged together with
+              * other hosts) and we serve a fixed address (DHCP disabled), a
+              * frame overheard from another host on that segment must not
+              * move addr_seen and silently retarget forwarded connections
+              * away from the guest. When DHCP is disabled, only the
+              * configured guest address may update addr_seen; with DHCP
+              * enabled (the default) behaviour is unchanged.
+              */
+             if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr &&
+                 (!c->no_dhcp || iph->saddr == c->ip4.addr.s_addr))
                      c->ip4.addr_seen.s_addr = iph->saddr;

              if (!iov_drop_header(&data, hlen))

base-commit: 4b2823784aab04a70dfc295b16fd6f0592955790
--
2.53.0