On Tue, Aug 20, 2024 at 09:56:40PM +0200, Stefano Brivio wrote: > On Fri, 16 Aug 2024 15:40:03 +1000 > David Gibson wrote: > > > The guest is usually assigned one of the host's IP addresses. That means > > it can't access the host itself via its usual address. The > > --nat-host-loopback option (enabled by default with the gateway address) > > allows the guest to contact the host. However, connections forwarded this > > way appear on the host to have originated from the loopback interface, > > which isn't always desirable. > > > > Add a new --nat-guest-addr option, which acts similarly but forwarded > > connections will go to the host's external address, instead of loopback. > > > > If '-a' is used, so the guest's address is not the same as the host's, this > > will instead forward to whatever host-visible site is shadowed by the > > guest's assigned address. > > > > Signed-off-by: David Gibson > > --- > > conf.c | 51 ++++++++++++++++++++++++++++++++++----------------- > > fwd.c | 10 ++++++++++ > > passt.1 | 15 +++++++++++++++ > > passt.h | 6 ++++++ > > 4 files changed, 65 insertions(+), 17 deletions(-) > > > > diff --git a/conf.c b/conf.c > > index c5831e82..d14abc63 100644 > > --- a/conf.c > > +++ b/conf.c > > @@ -825,6 +825,14 @@ static void usage(const char *name, FILE *f, int status) > > " Can be specified zero to two (for IPv4 and IPv6)\n" > > " default: gateway address, or none if --no-map-gw is also\n" > > " specified\n" > > + " --nat-guest-addr ADDR NAT ADDR to guest's address\n" > > + " Packets from the guest to ADDR will be redirected to the\n" > > + " adress on the host that's the same as the guest's\n" > > + " assigned address. Usually that means (one of) the host's\n" > > + " global address.\n" > > Same as 20/22, it's probably enough to have this in the man page. > > > + " ADDR can be 'none', in which case nothing is mapped\n" > > + " Can be specified zero to two (for IPv4 and IPv6)\n" > > "can", times Done. > > + " default: none\n" > > " --dns-forward ADDR Forward DNS queries sent to ADDR\n" > > " can be specified zero to two times (for IPv4 and IPv6)\n" > > " default: don't forward DNS queries\n" > > @@ -1141,29 +1149,32 @@ static void conf_ugid(char *runas, uid_t *uid, gid_t *gid) > > } > > > > /** > > - * conf_nat() - Parse --nat-host-loopback option > > - * @c: Execution context > > - * @arg: String argument to --nat-host-loopback > > - * @no_map_gw: --no-map-gw flag, updated for "none" argument > > + * conf_nat() - Parse --nat-host-loopback or --nat-guest-addr option > > + * @arg: String argument to option > > + * @addr4: IPv4 to update with parsed address > > + * @addr6: IPv6 to update with parsed address > > + * @no_map_gw: --no-map-gw flag, or NULL, updated for "none" argument > > */ > > -static void conf_nat(struct ctx *c, const char *arg, int *no_map_gw) > > +static void conf_nat(const char *arg, struct in_addr *addr4, > > + struct in6_addr *addr6, int *no_map_gw) > > { > > if (strcmp(arg, "none") == 0) { > > - c->ip4.nat_host_loopback = in4addr_any; > > - c->ip6.nat_host_loopback = in6addr_any; > > - *no_map_gw = 1; > > + *addr4 = in4addr_any; > > + *addr6 = in6addr_any; > > + if (no_map_gw) > > + *no_map_gw = 1; > > } > > > > - if (inet_pton(AF_INET6, arg, &c->ip6.nat_host_loopback) && > > - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_host_loopback) && > > - !IN6_IS_ADDR_LOOPBACK(&c->ip6.nat_host_loopback) && > > - !IN6_IS_ADDR_MULTICAST(&c->ip6.nat_host_loopback)) > > + if (inet_pton(AF_INET6, arg, addr6) && > > + !IN6_IS_ADDR_UNSPECIFIED(addr6) && > > + !IN6_IS_ADDR_LOOPBACK(addr6) && > > + !IN6_IS_ADDR_MULTICAST(addr6)) > > return; > > > > - if (inet_pton(AF_INET, arg, &c->ip4.nat_host_loopback) && > > - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.nat_host_loopback) && > > - !IN4_IS_ADDR_LOOPBACK(&c->ip4.nat_host_loopback) && > > - !IN4_IS_ADDR_MULTICAST(&c->ip4.nat_host_loopback)) > > + if (inet_pton(AF_INET, arg, addr4) && > > + !IN4_IS_ADDR_UNSPECIFIED(addr4) && > > + !IN4_IS_ADDR_LOOPBACK(addr4) && > > + !IN4_IS_ADDR_MULTICAST(addr4)) > > return; > > > > die("Invalid address to remap to host: %s", optarg); > > @@ -1279,6 +1290,7 @@ void conf(struct ctx *c, int argc, char **argv) > > {"no-copy-addrs", no_argument, NULL, 19 }, > > {"netns-only", no_argument, NULL, 20 }, > > {"nat-host-loopback", required_argument, NULL, 21 }, > > + {"nat-guest-addr", required_argument, NULL, 22 }, > > { 0 }, > > }; > > const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; > > @@ -1449,7 +1461,12 @@ void conf(struct ctx *c, int argc, char **argv) > > *userns = 0; > > break; > > case 21: > > - conf_nat(c, optarg, &no_map_gw); > > + conf_nat(optarg, &c->ip4.nat_host_loopback, > > + &c->ip6.nat_host_loopback, &no_map_gw); > > + break; > > + case 22: > > + conf_nat(optarg, &c->ip4.nat_guest_addr, > > + &c->ip6.nat_guest_addr, NULL); > > break; > > case 'd': > > c->debug = 1; > > diff --git a/fwd.c b/fwd.c > > index 7718f7e2..ff4789a2 100644 > > --- a/fwd.c > > +++ b/fwd.c > > @@ -272,6 +272,10 @@ uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto, > > tgt->eaddr = inany_loopback4; > > else if (inany_equals6(&ini->oaddr, &c->ip6.nat_host_loopback)) > > tgt->eaddr = inany_loopback6; > > + else if (inany_equals4(&ini->oaddr, &c->ip4.nat_guest_addr)) > > + tgt->eaddr = inany_from_v4(c->ip4.addr); > > + else if (inany_equals6(&ini->oaddr, &c->ip6.nat_guest_addr)) > > + tgt->eaddr.a6 = c->ip6.addr; > > else > > tgt->eaddr = ini->oaddr; > > > > @@ -393,6 +397,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, > > } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_host_loopback) && > > inany_equals6(&ini->eaddr, &in6addr_loopback)) { > > tgt->oaddr.a6 = c->ip6.nat_host_loopback; > > + } else if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.nat_guest_addr) && > > + inany_equals4(&ini->eaddr, &c->ip4.addr)) { > > + tgt->oaddr = inany_from_v4(c->ip4.nat_guest_addr); > > + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.nat_guest_addr) && > > + inany_equals6(&ini->eaddr, &c->ip6.addr)) { > > + tgt->oaddr.a6 = c->ip6.nat_guest_addr; > > } else if (!fwd_guest_accessible(c, &ini->eaddr)) { > > if (inany_v4(&ini->eaddr)) { > > if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) > > diff --git a/passt.1 b/passt.1 > > index 3680056a..7cf553cf 100644 > > --- a/passt.1 > > +++ b/passt.1 > > @@ -350,6 +350,21 @@ as destination, to the host. Implied if there is no gateway on the selected > > default route, or if there is no default route, for any of the enabled address > > families. > > > > +.TP > > +.BR \-\-nat-guest-loopback " " \fIaddr > > +Translate \fIaddr\fR in the guest to be equal to the guest's assigned > > +address on the host. That is, packets from the guest to \fIaddr\fR > > +will be redirected to the address assigned to the guest with \fB-a\fR, > > +or by default the host's global address. This allows the guest to > > +access services availble on the host's global address, even though its > > +own address shadows that of the host. > > + > > +If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one > > +IPv6 address can be translated, if the option is specified multiple > > , and if Done. Also fixed the fact I incorrectly called it --nat-guest-loopback instead of --map-guest-addr above. > > +times, the last one for each address type takes effect. > > + > > +Default is no mapping. > > + > > .TP > > .BR \-4 ", " \-\-ipv4-only > > Enable IPv4-only operation. IPv6 traffic will be ignored. > > diff --git a/passt.h b/passt.h > > index 20a5904a..586c1d05 100644 > > --- a/passt.h > > +++ b/passt.h > > @@ -104,6 +104,8 @@ enum passt_modes { > > * @guest_gw: IPv4 gateway as seen by the guest > > * @nat_host_loopback: Outbound connections to this address are NATted to the > > * host's 127.0.0.1 > > + * @nat_guest_addr: Outbound connections to this address are NATted to the > > + * guest's assigned address > > * @dns: DNS addresses for DHCP, zero-terminated > > * @dns_match: Forward DNS query if sent to this address > > * @our_tap_addr: IPv4 address for passt's use on tap > > @@ -120,6 +122,7 @@ struct ip4_ctx { > > int prefix_len; > > struct in_addr guest_gw; > > struct in_addr nat_host_loopback; > > + struct in_addr nat_guest_addr; > > struct in_addr dns[MAXNS + 1]; > > struct in_addr dns_match; > > struct in_addr our_tap_addr; > > @@ -142,6 +145,8 @@ struct ip4_ctx { > > * @guest_gw: IPv6 gateway as seen by the guest > > * @nat_host_loopback: Outbound connections to this address are NATted to the > > * host's [::1] > > + * @nat_guest_addr: Outbound connections to this address are NATted to the > > + * guest's assigned address > > * @dns: DNS addresses for DHCPv6 and NDP, zero-terminated > > * @dns_match: Forward DNS query if sent to this address > > * @our_tap_ll: Link-local IPv6 address for passt's use on tap > > @@ -158,6 +163,7 @@ struct ip6_ctx { > > struct in6_addr addr_ll_seen; > > struct in6_addr guest_gw; > > struct in6_addr nat_host_loopback; > > + struct in6_addr nat_guest_addr; > > struct in6_addr dns[MAXNS + 1]; > > struct in6_addr dns_match; > > struct in6_addr our_tap_ll; > -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson