From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202408 header.b=j0c11Aiw; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 62B445A004C for ; Thu, 26 Sep 2024 05:42:09 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202408; t=1727322125; bh=opsgvYQuSdZXHb7KwD/PWzLrcLUmZ7H8ClIdtzMU4yw=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=j0c11AiwiGlSuRJtbjc43L+nPIvf7TPl7ch5+WILf6TGPSCNPkK5Q4Poooxop0oqz AMA4MbyqYNs54NIXBM5tclT2HVr75sKDPBXwXK+gpxrK71tZMLnlhH1ixdaZ2v7TkO fW14uftFPsIRU/yIgy0tgm05C24d2YlB3R+AIwnl4mi1ly7XVIvPV0/0VHTBaflg1H WPYlJnLNZKAM0xhX6vxaMrMgUiR2dxVqdFmHqYC2Td8Yv3+TsX9rAJA5sw+XHgn0kI fKMgjEIHlegoH4peGCdipPkQOoqPYu5D22C1+eByP6yrn1woLLoVuapf1T/9AvLoUe 91dcgCaDx5rOg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4XDfY90T9Dz4xR4; Thu, 26 Sep 2024 13:42:05 +1000 (AEST) Date: Thu, 26 Sep 2024 12:02:52 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH 2/2] fwd: Direct inbound spliced forwards to the guest's external address Message-ID: References: <20240925065436.2064995-1-david@gibson.dropbear.id.au> <20240925065436.2064995-3-david@gibson.dropbear.id.au> <20240925102944.7cd28dfb@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="zzkIr8fT/ROBXHYL" Content-Disposition: inline In-Reply-To: <20240925102944.7cd28dfb@elisabeth> Message-ID-Hash: Q5HE26HDBPRORSOL7TKKDF7CVVGWSOA6 X-Message-ID-Hash: Q5HE26HDBPRORSOL7TKKDF7CVVGWSOA6 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --zzkIr8fT/ROBXHYL Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Sep 25, 2024 at 10:29:44AM +0200, Stefano Brivio wrote: > On Wed, 25 Sep 2024 16:54:36 +1000 > David Gibson wrote: >=20 > > In pasta mode, where addressing permits we "splice" connections, forwar= ding > > directly from host socket to guest/container socket without any L2 or L3 > > processing. This gives us a very large performance improvement when it= 's > > possible. > >=20 > > Since the traffic is from a local socket within the guest, it will go o= ver > > the guest's 'lo' interface, and accordingly we set the guest side addre= ss > > to be the loopback address. However this has a surprising side effect: > > sometimes guests will run services that are only supposed to be used wi= thin > > the guest and are therefore bound to only 127.0.0.1 and/or ::1. pasta's > > forwarding exposes those services to the host, which isn't generally wh= at > > we want. > >=20 > > Correct this by instead forwarding inbound "splice" flows to the guest's > > external address. > >=20 > > Link: https://github.com/containers/podman/issues/24045 > >=20 > > Signed-off-by: David Gibson > > --- > > fwd.c | 24 +++++++++++++++--------- > > 1 file changed, 15 insertions(+), 9 deletions(-) > >=20 > > diff --git a/fwd.c b/fwd.c > > index a505098..d5149db 100644 > > --- a/fwd.c > > +++ b/fwd.c > > @@ -447,20 +447,26 @@ uint8_t fwd_nat_from_host(const struct ctx *c, ui= nt8_t proto, > > (proto =3D=3D IPPROTO_TCP || proto =3D=3D IPPROTO_UDP)) { > > /* spliceable */ > > =20 > > - /* Preserve the specific loopback adddress used, but let the > > - * kernel pick a source port on the target side > > + /* The traffic will go over the guest's 'lo' interface, but use > > + * its external address, so we don't inadvertendly expose >=20 > inadvertently Oops, fixed. > > + * services that listen only on the guest's loopback address. > > + * > > + * Let the kernel pick our address on PIF_SPLICE > > */ > > - tgt->oaddr =3D ini->eaddr; > > + if (inany_v4(&ini->eaddr)) { > > + tgt->eaddr =3D inany_from_v4(c->ip4.addr_seen); > > + tgt->oaddr =3D inany_any4; > > + } else { > > + tgt->eaddr.a6 =3D c->ip6.addr_seen; > > + tgt->oaddr =3D inany_any6; > > + } > > + > > + /* Let the kernel pick port */ > > tgt->oport =3D 0; > > if (proto =3D=3D IPPROTO_UDP) > > - /* But for UDP preserve the source port */ > > + /* Except for UDP, preserve the source port */ >=20 > It means the same thing, but it's less clear now: does it mean "Except > for UDP: in that case preserve the source port" or "Except for UDP: in > all other cases preserve the source port"? Good point. I was trying to make it a follow on from the earlier "Let the kernel pick port" comment, but you're right the old version was still clearer. Reverted. > I would keep the original version unless I'm missing something subtle > that this patch would change regarding ports. >=20 > > tgt->oport =3D ini->eport; > > =20 > > - if (inany_v4(&ini->eaddr)) > > - tgt->eaddr =3D inany_loopback4; > > - else > > - tgt->eaddr =3D inany_loopback6; > > - > > return PIF_SPLICE; > > } > > =20 >=20 > The series looks good to me (yes, I know I still have to review one > pending series from you), except for the concern I mentioned as a > comment to the cover letter. >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --zzkIr8fT/ROBXHYL Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmb0wMwACgkQzQJF27ox 2GelNA/9EcUte5lSPqUpWzHNCamF+UZmiGnWy31KHNrCOLqCTYv+FSHCThfOYg01 5od0aTC+4rQ7W0jbRGiNUfwWYc6KqTRIDwPl9p/fjknMaIwS38B7R+P2qqSGbGne EUaXDvFxo9FhGAJm9LNKmKdpORxP0GoLTwCIcElkufd3bq6Smo7goi7lCxkuj5Ty 9Fhxw2zm+34LMj+m2vtBZv9g5OU85MLMxHTcHOgTLFMR66ZOeMqiwnvumToLH0Bh et3YxyGhpqyUF+JWvDPjrHF3z4Cv53H0mBmsDINqj/W1qaGR6bUCVGVuVgwacJZk kWeDb0z6NTUdFfi5bSi/+3gPiBoYOSLQzUnoSPo+Yq6WE87ruxHka8K43Z1poenz 5sqVb2qi9yYx8d+vt0xdHgE3G63npTJjL/oHrpttlXjHhPNYWsXtIyqDOer5VQfq ylNThPqhKuqLEKPQ9WajQHLhG6BRbAfZvu81S1xkejMNO0W+KIRnOLyQNqMpr/XG 8BkT8cayRvEgmepZoW8P0mPQQQHtMk3ykQONoLy01ozmleOKRhtlXUPbhtxEUQZj CqTY2ixK37PvMupgr2orx0ij6SGiMP1lt42pK585j2Z/SW5eD7EszjdYs7ocjvbV ycJpSBbzolM5qQM3ZBUiVAvmqorF4416143kLJAWgQmeThSY20o= =Dfpy -----END PGP SIGNATURE----- --zzkIr8fT/ROBXHYL--