From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from gandalf.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id B6CE75A0291 for ; Tue, 23 May 2023 05:05:49 +0200 (CEST) Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4QQK2J0tPsz4x3q; Tue, 23 May 2023 13:05:44 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=201602; t=1684811144; bh=WCx5kwdAo3lfEOlc3wloov2z7mUvOd/q/RCXuMLZMIg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=e/fbINdqIFrymXnBtNTvaiB97R5GFWROaGFvasQ90oRGlMzlYQWR1+jpfEA9O4UnU 0ZdiZc9OwkzH1AoS3s11JGcRF48FUMJEwukCW/+JcXmXpbeGi+zTHXBjM03ZhgP3Hy yC3hiXcetSbV09YzPeSrN0Br5cKQ6yXNjOEx85+g= Date: Tue, 23 May 2023 13:04:44 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v3 05/10] conf, pasta: With --config-net, copy all routes by default Message-ID: References: <20230522174607.2824220-1-sbrivio@redhat.com> <20230522174607.2824220-6-sbrivio@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="W7QzEAi5mkUq2fsk" Content-Disposition: inline In-Reply-To: <20230522174607.2824220-6-sbrivio@redhat.com> Message-ID-Hash: ZHMLUV3LUHOMZVHH6BDBOLW5MZ2V6O7Z X-Message-ID-Hash: ZHMLUV3LUHOMZVHH6BDBOLW5MZ2V6O7Z X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, Callum Parsey , me@yawnt.com, lemmi@nerd2nerd.org, Andrea Arcangeli X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --W7QzEAi5mkUq2fsk Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, May 22, 2023 at 07:46:02PM +0200, Stefano Brivio wrote: > Use the newly-introduced NL_DUP mode for nl_route() to copy all the > routes associated to the template interface in the outer namespace, > unless --no-copy-routes (also implied by -g) is given. >=20 > This option is introduced as deprecated right away: it's not expected > to be of any use, but it's helpful to keep it around for a while to > debug any suspected issue with this change. >=20 > Otherwise, we can't use default gateways which are not, address-wise, > on the same subnet as the container, as reported by Callum. >=20 > Reported-by: Callum Parsey > Link: https://github.com/containers/podman/issues/18539 > Signed-off-by: Stefano Brivio Reviewed-by: David Gibson > --- > conf.c | 16 ++++++++++++++++ > passt.1 | 15 +++++++++++++++ > passt.h | 4 +++- > pasta.c | 6 ++++-- > 4 files changed, 38 insertions(+), 3 deletions(-) >=20 > diff --git a/conf.c b/conf.c > index 3ee6ae0..0a01983 100644 > --- a/conf.c > +++ b/conf.c > @@ -923,6 +923,8 @@ pasta_opts: > info( " --no-netns-quit Don't quit if filesystem-bound target"); > info( " network namespace is deleted"); > info( " --config-net Configure tap interface in namespace"); > + info( " --no-copy-routes DEPRECATED:"); > + info( " Don't copy all routes to namespace"); > info( " --ns-mac-addr ADDR Set MAC address on tap interface"); > =20 > exit(EXIT_FAILURE); > @@ -1198,6 +1200,7 @@ void conf(struct ctx *c, int argc, char **argv) > {"outbound-if4", required_argument, NULL, 15 }, > {"outbound-if6", required_argument, NULL, 16 }, > {"config-net", no_argument, NULL, 17 }, > + {"no-copy-routes", no_argument, NULL, 18 }, > { 0 }, > }; > struct get_bound_ports_ns_arg ns_ports_arg =3D { .c =3D c }; > @@ -1362,6 +1365,13 @@ void conf(struct ctx *c, int argc, char **argv) > =20 > c->pasta_conf_ns =3D 1; > break; > + case 18: > + if (c->mode !=3D MODE_PASTA) > + die("--no-copy-routes is for pasta mode only"); > + > + warn("--no-copy-routes will be dropped soon"); > + c->no_copy_routes =3D 1; > + break; > case 'd': > if (c->debug) > die("Multiple --debug options given"); > @@ -1510,6 +1520,9 @@ void conf(struct ctx *c, int argc, char **argv) > } > break; > case 'g': > + if (c->mode =3D=3D MODE_PASTA) > + c->no_copy_routes =3D 1; > + > if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && > inet_pton(AF_INET6, optarg, &c->ip6.gw) && > !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && > @@ -1644,6 +1657,9 @@ void conf(struct ctx *c, int argc, char **argv) > if (*c->sock_path && c->fd_tap >=3D 0) > die("Options --socket and --fd are mutually exclusive"); > =20 > + if (c->mode =3D=3D MODE_PASTA && c->no_copy_routes && !c->pasta_conf_ns) > + die("Option --no-copy-routes needs --config-net"); > + > if (!ifi4 && *c->ip4.ifname_out) > ifi4 =3D if_nametoindex(c->ip4.ifname_out); > =20 > diff --git a/passt.1 b/passt.1 > index 19e01d5..ee2803a 100644 > --- a/passt.1 > +++ b/passt.1 > @@ -546,6 +546,21 @@ NAME are given as target), do not exit once the netw= ork namespace is deleted. > Configure networking in the namespace: set up addresses and routes as co= nfigured > or sourced from the host, and bring up the tap interface. > =20 > +.TP > +.BR \-\-no-copy-routes " " (DEPRECATED) > +With \-\-config-net, do not copy all the routes associated to the interf= ace we > +derive addresses and routes from: set up only the default gateway. Impli= ed by > +-g, \-\-gateway. > + > +Default is to copy all the routing entries from the interface in the out= er > +namespace to the target namespace, translating the output interface attr= ibute to > +the outbound interface in the namespace. > + > +Note that this configuration option is \fBdeprecated\fR and will be remo= ved in a > +future version. It is not expected to be of any use, and it simply refle= cts a > +legacy behaviour. If you have any use for this, refer to \fBREPORTING BU= GS\fR > +below. > + > .TP > .BR \-\-ns-mac-addr " " \fIaddr > Configure MAC address \fIaddr\fR on the tap interface in the namespace. > diff --git a/passt.h b/passt.h > index 73fe808..d314596 100644 > --- a/passt.h > +++ b/passt.h > @@ -181,7 +181,8 @@ struct ip6_ctx { > * @ip6: IPv6 configuration > * @pasta_ifn: Name of namespace interface for pasta > * @pasta_ifn: Index of namespace interface for pasta > - * @pasta_conf_ns: Configure namespace interface after creating it > + * @pasta_conf_ns: Configure namespace after creating it > + * @no_copy_routes: Don't copy all routes when configuring target namesp= ace > * @no_tcp: Disable TCP operation > * @tcp: Context for TCP protocol handler > * @no_tcp: Disable UDP operation > @@ -240,6 +241,7 @@ struct ctx { > char pasta_ifn[IF_NAMESIZE]; > unsigned int pasta_ifi; > int pasta_conf_ns; > + int no_copy_routes; > =20 > int no_tcp; > struct tcp_ctx tcp; > diff --git a/pasta.c b/pasta.c > index 01109f5..b546c93 100644 > --- a/pasta.c > +++ b/pasta.c > @@ -273,12 +273,14 @@ void pasta_ns_conf(struct ctx *c) > nl_link(1, 1 /* lo */, MAC_ZERO, 1, 0); > =20 > if (c->pasta_conf_ns) { > + enum nl_op op_routes =3D c->no_copy_routes ? NL_SET : NL_DUP; > + > nl_link(1, c->pasta_ifi, c->mac_guest, 1, c->mtu); > =20 > if (c->ifi4) { > nl_addr(1, c->pasta_ifi, AF_INET, &c->ip4.addr, > &c->ip4.prefix_len, NULL); > - nl_route(NL_SET, c->ifi4, c->pasta_ifi, AF_INET, > + nl_route(op_routes, c->ifi4, c->pasta_ifi, AF_INET, > &c->ip4.gw); > } > =20 > @@ -286,7 +288,7 @@ void pasta_ns_conf(struct ctx *c) > int prefix_len =3D 64; > nl_addr(1, c->pasta_ifi, AF_INET6, &c->ip6.addr, > &prefix_len, NULL); > - nl_route(NL_SET, c->ifi6, c->pasta_ifi, AF_INET6, > + nl_route(op_routes, c->ifi6, c->pasta_ifi, AF_INET6, > &c->ip6.gw); > } > } else { --=20 David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson --W7QzEAi5mkUq2fsk Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmRsLS4ACgkQzQJF27ox 2GfeqA//eZEgoeHE0RVawQV22VSKjXHJHyvHuhgj3abNGEzTYNafV1ObagqNs/YP SeTLd0jmF5n7SascT0RNxDG83B+igLPx03i7doUKq+iW+Wg5r0l25J9P+Z1R0+wc 2Pr4XBnQx0Cu2h9sCZ2HrUznH7+vwOs4UW+vFMHkuMdUjzD6lqd90U+rZNqN2etH hev7bxwfDcjMzGjDgmRuIJ24ii2/eMiltsupINeZYLTKhQ6dGTtpeuvkOA2YAKtv vEv0nvqOn+sujjnfbQb1hKm1IELPc4Tawu/RTefbWlEXnwNEoyiCmPw7WxmNLzcB htqYvieLT/MEZ/UtU2aO+/NFX0xkGOSnBjJhXINF1vUxIcG+p5m7D4nGYh0kTz1n QSEFOD2jqDP3UcV/IizgrPI+aSAVjPxn7nNhTMm1NnJjKUZp45d5vPFY53dPO+gO Qwf5/aSYWx9ipZagjBDPGN4ZG8P3vgrXrF88XQMbohI/vH1KqKaLPSoBGw+oqkHC MkEcr10Nc43rv1mA7as2XZ3+gmiLr/mwrBCA/pLV89bHccdQrqYHQtxbHYyzluZ/ igDr5MOWMDbVhbXWlBhTzPc+sfbbgUlvCtDAksbPhStJYNsg3XJI4AcREcoY5v33 TyT3HRHKpLg4qo6KwhuFwe7uXRwSdAusIQFnRGqiTKXLoSlqSR8= =IADL -----END PGP SIGNATURE----- --W7QzEAi5mkUq2fsk--