From: David Gibson <david@gibson.dropbear.id.au>
To: Stefano Brivio <sbrivio@redhat.com>
Cc: passt-dev@passt.top, Paul Holzinger <pholzing@redhat.com>
Subject: Re: [PATCH v3 4/7] netlink, pasta: Disable DAD for link-local addresses on namespace interface
Date: Sat, 17 Aug 2024 17:59:45 +1000 [thread overview]
Message-ID: <ZsBYcSZn74j07g8q@zatzit.fritz.box> (raw)
In-Reply-To: <20240816073918.1483136-5-sbrivio@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 4602 bytes --]
On Fri, Aug 16, 2024 at 09:39:15AM +0200, Stefano Brivio wrote:
> It makes no sense for a container or a guest to try and perform
> duplicate address detection for their link-local address, as we'll
> anyway not relay neighbour solicitations with an unspecified source
> address.
>
> While they perform duplicate address detection, the link-local address
> is not usable, which prevents us from bringing up especially
> containers and communicate with them right away via IPv6.
>
> This is not enough to prevent DAD and reach the container right away:
> we'll need a couple more patches.
>
> As we send NLM_F_REPLACE requests right away, while we still have to
> read out other addresses on the same socket, we can't use nl_do():
> keep track of the last sequence we sent (last address we changed), and
> deal with the answers to those NLM_F_REPLACE requests in a separate
> loop, later.
>
> Link: https://github.com/containers/podman/pull/23561#discussion_r1711639663
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> ---
> netlink.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
> netlink.h | 1 +
> pasta.c | 6 ++++++
> 3 files changed, 62 insertions(+)
>
> diff --git a/netlink.c b/netlink.c
> index 873e6c7..59f2fd9 100644
> --- a/netlink.c
> +++ b/netlink.c
> @@ -673,6 +673,61 @@ int nl_route_dup(int s_src, unsigned int ifi_src,
> return 0;
> }
>
> +/**
> + * nl_addr_set_ll_nodad() - Set IFA_F_NODAD on IPv6 link-local addresses
> + * @s: Netlink socket
> + * @ifi: Interface index in target namespace
> + *
> + * Return: 0 on success, negative error code on failure
> + */
> +int nl_addr_set_ll_nodad(int s, unsigned int ifi)
> +{
> + struct req_t {
> + struct nlmsghdr nlh;
> + struct ifaddrmsg ifa;
> + } req = {
> + .ifa.ifa_family = AF_INET6,
> + .ifa.ifa_index = ifi,
> + };
> + unsigned ll_addrs = 0;
> + struct nlmsghdr *nh;
> + char buf[NLBUFSIZ];
> + ssize_t status;
> + uint32_t seq;
> +
> + seq = nl_send(s, &req, RTM_GETADDR, NLM_F_DUMP, sizeof(req));
> + nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWADDR) {
> + struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nh);
> + struct rtattr *rta;
> + size_t na;
> +
> + if (ifa->ifa_index != ifi || ifa->ifa_scope != RT_SCOPE_LINK)
> + continue;
> +
> + ifa->ifa_flags |= IFA_F_NODAD;
> +
> + for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na);
> + rta = RTA_NEXT(rta, na)) {
> + /* If 32-bit flags are used, add IFA_F_NODAD there */
> + if (rta->rta_type == IFA_FLAGS)
> + *(uint32_t *)RTA_DATA(rta) |= IFA_F_NODAD;
> + }
> +
> + nl_send(s, nh, RTM_NEWADDR, NLM_F_REPLACE, nh->nlmsg_len);
> + ll_addrs++;
> + }
Uh.. did you forget to push an update. This looks like the last
version.
> + if (status < 0)
> + return status;
You still have this early return.
> +
> + seq += ll_addrs;
> +
> + nl_foreach(nh, status, s, buf, seq)
> + warn("netlink: Unexpected response message");
And you need an outer loop over this nl_foreach() for each value of
seq from the one from the RTM_GETADDR to the last one from
NLM_F_REPLACE.
> +
> + return status;
> +}
> +
> /**
> * nl_addr_get() - Get most specific global address, given interface and family
> * @s: Netlink socket
> diff --git a/netlink.h b/netlink.h
> index 178f8ae..66a44ad 100644
> --- a/netlink.h
> +++ b/netlink.h
> @@ -19,6 +19,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af,
> void *addr, int *prefix_len, void *addr_l);
> int nl_addr_set(int s, unsigned int ifi, sa_family_t af,
> const void *addr, int prefix_len);
> +int nl_addr_set_ll_nodad(int s, unsigned int ifi);
> int nl_addr_dup(int s_src, unsigned int ifi_src,
> int s_dst, unsigned int ifi_dst, sa_family_t af);
> int nl_link_get_mac(int s, unsigned int ifi, void *mac);
> diff --git a/pasta.c b/pasta.c
> index 96545b1..17eed15 100644
> --- a/pasta.c
> +++ b/pasta.c
> @@ -340,6 +340,12 @@ void pasta_ns_conf(struct ctx *c)
> }
>
> if (c->ifi6) {
> + rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi);
> + if (rc < 0) {
> + warn("Can't set nodad for LL in namespace: %s",
> + strerror(-rc));
> + }
> +
> if (c->ip6.no_copy_addrs) {
> rc = nl_addr_set(nl_sock_ns, c->pasta_ifi,
> AF_INET6, &c->ip6.addr, 64);
--
David Gibson (he or they) | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you, not the other way
| around.
http://www.ozlabs.org/~dgibson
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2024-08-17 7:59 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-16 7:39 [PATCH v3 0/7] Prevent DAD for link-local addresses in containers Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 1/7] netlink: Fix typo in function comment for nl_addr_get() Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 2/7] netlink, pasta: Split MTU setting functionality out of nl_link_up() Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 3/7] netlink, pasta: Turn nl_link_up() into a generic function to set link flags Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 4/7] netlink, pasta: Disable DAD for link-local addresses on namespace interface Stefano Brivio
2024-08-17 7:59 ` David Gibson [this message]
2024-08-17 8:37 ` Stefano Brivio
2024-08-17 8:41 ` Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 5/7] netlink, pasta: Fetch link-local address from namespace interface once it's up Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 6/7] pasta: Disable neighbour solicitations on device up to prevent DAD Stefano Brivio
2024-08-16 7:39 ` [PATCH v3 7/7] netlink: Fix typo in function comment for nl_addr_set() Stefano Brivio
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZsBYcSZn74j07g8q@zatzit.fritz.box \
--to=david@gibson.dropbear.id.au \
--cc=passt-dev@passt.top \
--cc=pholzing@redhat.com \
--cc=sbrivio@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).