Re: [PATCH v2 05/10] conf, pasta: With --config-net, copy all routes by default

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 5949 bytes --]

On Mon, May 22, 2023 at 01:42:19AM +0200, Stefano Brivio wrote:
> Use the newly-introduced NL_DUP mode for nl_route() to copy all the
> routes associated to the template interface in the outer namespace,
> unless --no-copy-routes (also implied by -g) is given.
> 
> Otherwise, we can't use default gateways which are not, address-wise,
> on the same subnet as the container, as reported by Callum.
> 
> Reported-by: Callum Parsey <callum@neoninteger.au>
> Link: https://github.com/containers/podman/issues/18539
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear>

The logic looks sound, although I do have one concern noted below.

> ---
>  conf.c  | 14 ++++++++++++++
>  passt.1 | 10 ++++++++++
>  passt.h |  4 +++-
>  pasta.c |  6 ++++--
>  4 files changed, 31 insertions(+), 3 deletions(-)
> 
> diff --git a/conf.c b/conf.c
> index 3ee6ae0..7541261 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -923,6 +923,7 @@ pasta_opts:
>  	info(   "  --no-netns-quit	Don't quit if filesystem-bound target");
>  	info(   "  			network namespace is deleted");
>  	info(   "  --config-net		Configure tap interface in namespace");
> +	info(   "  --no-copy-routes	Don't copy all routes to namespace");

I'm always a bit nervous about adding new options, since it's
something we then have to maintain compatibility for.  Do we have a
confirmed use case where the copy routes behaviour will cause trouble?

>  	info(   "  --ns-mac-addr ADDR	Set MAC address on tap interface");
>  
>  	exit(EXIT_FAILURE);
> @@ -1198,6 +1199,7 @@ void conf(struct ctx *c, int argc, char **argv)
>  		{"outbound-if4", required_argument,	NULL,		15 },
>  		{"outbound-if6", required_argument,	NULL,		16 },
>  		{"config-net",	no_argument,		NULL,		17 },
> +		{"no-copy-routes", no_argument,		NULL,		18 },
>  		{ 0 },
>  	};
>  	struct get_bound_ports_ns_arg ns_ports_arg = { .c = c };
> @@ -1362,6 +1364,12 @@ void conf(struct ctx *c, int argc, char **argv)
>  
>  			c->pasta_conf_ns = 1;
>  			break;
> +		case 18:
> +			if (c->mode != MODE_PASTA)
> +				die("--no-copy-routes is for pasta mode only");
> +
> +			c->no_copy_routes = 1;
> +			break;
>  		case 'd':
>  			if (c->debug)
>  				die("Multiple --debug options given");
> @@ -1510,6 +1518,9 @@ void conf(struct ctx *c, int argc, char **argv)
>  			}
>  			break;
>  		case 'g':
> +			if (c->mode == MODE_PASTA)
> +				c->no_copy_routes = 1;
> +
>  			if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw)		&&
>  			    inet_pton(AF_INET6, optarg, &c->ip6.gw)	&&
>  			    !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw)	&&
> @@ -1644,6 +1655,9 @@ void conf(struct ctx *c, int argc, char **argv)
>  	if (*c->sock_path && c->fd_tap >= 0)
>  		die("Options --socket and --fd are mutually exclusive");
>  
> +	if (c->mode == MODE_PASTA && c->no_copy_routes && !c->pasta_conf_ns)
> +		die("Option --no-copy-routes needs --config-net");
> +
>  	if (!ifi4 && *c->ip4.ifname_out)
>  		ifi4 = if_nametoindex(c->ip4.ifname_out);
>  
> diff --git a/passt.1 b/passt.1
> index 19e01d5..10c96ae 100644
> --- a/passt.1
> +++ b/passt.1
> @@ -546,6 +546,16 @@ NAME are given as target), do not exit once the network namespace is deleted.
>  Configure networking in the namespace: set up addresses and routes as configured
>  or sourced from the host, and bring up the tap interface.
>  
> +.TP
> +.BR \-\-no-copy-routes
> +With \-\-config-net, do not copy all the routes associated to the interface we
> +derive addresses and routes from: set up only the default gateway. Implied by
> +-g, \-\-gateway.
> +
> +Default is to copy all the routing entries from the interface in the outer
> +namespace to the target namespace, translating the output interface attribute to
> +the outbound interface in the namespace.
> +
>  .TP
>  .BR \-\-ns-mac-addr " " \fIaddr
>  Configure MAC address \fIaddr\fR on the tap interface in the namespace.
> diff --git a/passt.h b/passt.h
> index 73fe808..d314596 100644
> --- a/passt.h
> +++ b/passt.h
> @@ -181,7 +181,8 @@ struct ip6_ctx {
>   * @ip6:		IPv6 configuration
>   * @pasta_ifn:		Name of namespace interface for pasta
>   * @pasta_ifn:		Index of namespace interface for pasta
> - * @pasta_conf_ns:	Configure namespace interface after creating it
> + * @pasta_conf_ns:	Configure namespace after creating it
> + * @no_copy_routes:	Don't copy all routes when configuring target namespace
>   * @no_tcp:		Disable TCP operation
>   * @tcp:		Context for TCP protocol handler
>   * @no_tcp:		Disable UDP operation
> @@ -240,6 +241,7 @@ struct ctx {
>  	char pasta_ifn[IF_NAMESIZE];
>  	unsigned int pasta_ifi;
>  	int pasta_conf_ns;
> +	int no_copy_routes;
>  
>  	int no_tcp;
>  	struct tcp_ctx tcp;
> diff --git a/pasta.c b/pasta.c
> index 01109f5..b546c93 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -273,12 +273,14 @@ void pasta_ns_conf(struct ctx *c)
>  	nl_link(1, 1 /* lo */, MAC_ZERO, 1, 0);
>  
>  	if (c->pasta_conf_ns) {
> +		enum nl_op op_routes = c->no_copy_routes ? NL_SET : NL_DUP;
> +
>  		nl_link(1, c->pasta_ifi, c->mac_guest, 1, c->mtu);
>  
>  		if (c->ifi4) {
>  			nl_addr(1, c->pasta_ifi, AF_INET, &c->ip4.addr,
>  				&c->ip4.prefix_len, NULL);
> -			nl_route(NL_SET, c->ifi4, c->pasta_ifi, AF_INET,
> +			nl_route(op_routes, c->ifi4, c->pasta_ifi, AF_INET,
>  				 &c->ip4.gw);
>  		}
>  
> @@ -286,7 +288,7 @@ void pasta_ns_conf(struct ctx *c)
>  			int prefix_len = 64;
>  			nl_addr(1, c->pasta_ifi, AF_INET6, &c->ip6.addr,
>  				&prefix_len, NULL);
> -			nl_route(NL_SET, c->ifi6, c->pasta_ifi, AF_INET6,
> +			nl_route(op_routes, c->ifi6, c->pasta_ifi, AF_INET6,
>  				 &c->ip6.gw);
>  		}
>  	} else {

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]