From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202410 header.b=iPcwcOf0; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 42C405A004E for ; Thu, 17 Oct 2024 03:20:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202410; t=1729128004; bh=poiY2S6HrtLKZi+l7ZB9aRUD9dGDVU4G+Mkn1TTJnLk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=iPcwcOf0iXFpUvAMCKi9ooe7JG5XNJR/79Yt/c+5yVQ4jyChPU3AKdUw2ANJygrWl k1eohXjtu+cu1x4veP1wHDEIjvo1kkOrHfGC7uOLy34Kr6gukdGou4CBSEz1vc+WN5 c0kGJ4c1RZCk2o1mmKhNOw0o47I1x67RucHO0k+tqV1psMYuAyc6rthwzwKFZF16qy yEy3jg/poUMukw2s7fStIolzmkrhh2eWco5qZH7cq5wE9eyWG5ooBDYhcMSNm3RZVR 5Nz9f7BuBH4m8kypsZwqljj5XmEnos3851ybvfbJ7J6/QeNJ0w3Uk/P+YZ2tHCTcrO aaZ/+OOjdraig== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4XTVPc5ldRz4x11; Thu, 17 Oct 2024 12:20:04 +1100 (AEDT) Date: Thu, 17 Oct 2024 12:19:58 +1100 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v3 4/4] fwd: Direct inbound spliced forwards to the guest's external address Message-ID: References: <20241002054826.1812844-1-david@gibson.dropbear.id.au> <20241002054826.1812844-5-david@gibson.dropbear.id.au> <20241009150721.63af48f6@elisabeth> <20241009224433.7fc28fc7@elisabeth> <20241016172648.666b0f8c@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="FxrcH9WyMh8by3yR" Content-Disposition: inline In-Reply-To: <20241016172648.666b0f8c@elisabeth> Message-ID-Hash: K3ABBXISMSJXCTY64YOVAX6HAJU2OVDX X-Message-ID-Hash: K3ABBXISMSJXCTY64YOVAX6HAJU2OVDX X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --FxrcH9WyMh8by3yR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Oct 16, 2024 at 05:26:48PM +0200, Stefano Brivio wrote: > On Wed, 16 Oct 2024 19:39:40 +1100 > David Gibson wrote: >=20 > > On Wed, Oct 16, 2024 at 04:46:52PM +1100, David Gibson wrote: > > > On Wed, Oct 16, 2024 at 02:15:19PM +1100, David Gibson wrote: =20 > > > > On Thu, Oct 10, 2024 at 04:57:32PM +1100, David Gibson wrote: =20 > > > > > On Wed, Oct 09, 2024 at 10:44:33PM +0200, Stefano Brivio wrote: = =20 > > > > > > On Wed, 9 Oct 2024 15:07:21 +0200 > > > > > > Stefano Brivio wrote: =20 > > > > [snip] =20 > > > > > > > > @@ -447,20 +447,35 @@ uint8_t fwd_nat_from_host(const struc= t ctx *c, uint8_t proto, > > > > > > > > (proto =3D=3D IPPROTO_TCP || proto =3D=3D IPPROTO_UDP= )) { > > > > > > > > /* spliceable */ > > > > > > > > =20 > > > > > > > > - /* Preserve the specific loopback adddress used, but let= the > > > > > > > > - * kernel pick a source port on the target side > > > > > > > > + /* The traffic will go over the guest's 'lo' interface, = but by > > > > > > > > + * default use its external address, so we don't inadver= tently > > > > > > > > + * expose services that listen only on the guest's loopb= ack > > > > > > > > + * address. That can be overridden by --host-lo-to-ns-l= o which > > > > > > > > + * will instead forward to the loopback address in the g= uest. > > > > > > > > + * > > > > > > > > + * In either case, let the kernel pick the source addres= s to > > > > > > > > + * match. > > > > > > > > */ > > > > > > > > - tgt->oaddr =3D ini->eaddr; > > > > > > > > + if (inany_v4(&ini->eaddr)) { > > > > > > > > + if (c->host_lo_to_ns_lo) > > > > > > > > + tgt->eaddr =3D inany_loopback4; > > > > > > > > + else > > > > > > > > + tgt->eaddr =3D inany_from_v4(c->ip4.addr_seen); > > > > > > > > + tgt->oaddr =3D inany_any4; > > > > > > > > + } else { > > > > > > > > + if (c->host_lo_to_ns_lo) > > > > > > > > + tgt->eaddr =3D inany_loopback6; > > > > > > > > + else > > > > > > > > + tgt->eaddr.a6 =3D c->ip6.addr_seen; =20 > > > > > > >=20 > > > > > > > Either this... > > > > > > > =20 > > > > > > > > + tgt->oaddr =3D inany_any6; =20 > > > > > > >=20 > > > > > > > or this (and not something before this patch, up to 3/4) make= the > > > > > > > "TCP/IPv6: host to ns (spliced): big transfer" test in pasta/= tcp hang, > > > > > > > sometimes (about one in three/four runs), that's what I mista= kenly > > > > > > > reported as coming from Laurent's series at: =20 > > > > >=20 > > > > > Huh, interesting. Just got back from my leave and ran that group= of > > > > > tests in a loop this afternoon, but didn't manage to reproduce. I > > > > > have administrivia that will probably fill the rest of this week,= but > > > > > I'll look into this as soon as I can. =20 > > > >=20 > > > > I reproduced the problem on passt.top, and I have a partial idea > > > > what's going on. As you say it's seeming like the address (addr_se= en > > > > =3D=3D addr in this case) isn't properly ready. This is over splic= e, but > > > > on the tap interface, I see the container sending NS messages for i= ts > > > > own address - seems like it's doing DAD. But more importantly, we'= re > > > > answering those NS messages with NA messages, because we answer all > > > > NS. i.e. we're making the DAD fail. What I'm not sure of is how t= his > > > > ever worked at all. --config-net makes sense, since we disable DAD, > > > > but our test suite has always been using NDP+DHCP instead of > > > > --config-net. > > > >=20 > > > > So, AFACT, we'll always fail guest DAD attempts, both IPv6, which > > > > happens most of the time and for IPv4 via ARP, which is used much m= ore > > > > rarely. I think we need to be more selective in what NS or ARP > > > > lookups we resopnd to. The question is what approach to take: =20 > > >=20 > > > Hmm... no.. there's more to this. > > >=20 > > > Usually DAD requests have :: as the source address, and we *do* > > > exclude those from getting replies. In this case though, we're > > > getting NS requests for the assigned address from what looks like the > > > SLAAC address. So, I do think it would be wise to explicitly exclude > > > these: we shouldn't be giving NA responses for an address that ought > > > to belong to the guest, even if it doesn't look like a DAD. > > >=20 > > > But, I'm not sure what's triggering this. Is for some reason the DHCP > > > address not "taking", so the container is trying to locate it on the > > > network instead? Or _is_ this DAD, but under some circumstances > > > rather than using :: as the source address it uses another configured > > > address. =20 > >=20 > > Ok.. I've understood a bit more. While timing is a factor here, it > > looks like the main reason I wasn't seeing it on my machine is what > > I'd consider a bug in the Debian version of the dhclient-script: > > when adding an IPv6 address, it returns without waiting for DAD to > > complete (i.e. for the address to be non-tentative). >=20 > Oops. On one hand, I would feel inclined to propose a fix for the > Debian and Ubuntu packages. On the other hand, I wonder if it's > universally considered a bug: the DHCPv6 client did its job at that > point, and it's debatable whether dhclient should wait for the address > to be usable before forking to background. >=20 > That is, arguably, the job of dhclient's is to request and configure an > address. It's not a network configuration daemon. There might be many > other reasons why that address is unusable, and yet dhclient is not > responsible for them. Hrm... I guess. Counterpoints.. - Most other failures to get a usable address will result in a visible error - dhclient has a --dad-wait-time option which seems to imply that the script should wait for DAD - The upstream script version waits for DAD In any case I filed a report for it https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1085231 > By the way, I guess it's just an issue for test scripts like this one. Why do you guess that? > > There's also an additional bug, which doesn't cause this problem, I > > think, but caused some problems when I was investigating. DHCPv6 > > needs the link-local SLAAC address already configured and > > non-tentative. The Fedora dhclient-script waits for that too at the > > PREINIT6 stage, but the Debian one doesn't, meaning if you attempt > > dhclient -6 immediately after starting the namespace it will fail to > > bind the UDP address it needs. >=20 > Right, and that's fine for us because we have a 2-second delay after > SLAAC. This looks to me a bit more like a real bug, but again, there > might be many other reasons why dhclient can't use a link-local > address. One might argue that it's the responsibility of the > user/caller to invoke dhclient when appropriate. Here I think it's a much clearer argument that it's a real bug. We play fast and loose with it for mbuto, but dhclient can typically be called on an interface that isn't even up: the PREINIT/PREINIT6 script actions are specifically for this, they'll bring the interface up ready for the client to do its thing. I'd say the script is failing to do its job for PREINIT6 if there isn't a usable link-local address at the end. I filed a report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1085229 > In that sense, you might be wondering why there's a 2-second delay > after SLAAC, but no delay after invoking dhclient -6: the reason is > that I was convinced that one wouldn't need DAD once a DHCPv6 client > configures an address. The server is already checking that, I thought. >=20 > Well, no. RFC 8415 18.2.10.1: >=20 > https://datatracker.ietf.org/doc/html/rfc8415#section-18.2.10.1 >=20 > says: >=20 > If the client can operate with the addresses and/or prefixes obtained > from the server: >=20 > [...] >=20 > - The client MUST perform duplicate address detection as per > Section 5.4 of [RFC4862], which does list some exceptions, on each > of the received addresses in any IAs on which it has not performed > duplicate address detection during processing of any of the > previous Reply messages from the server. The client performs the > duplicate address detection before using the received addresses > for any traffic. If any of the addresses are found to be in use > on the link, the client sends a Decline message to the server for > those addresses as described in Section 18.2.8. Indeed. > > I still think it's a good idea not to give NA messages for the guest > > assigned address, but we'll need a different workaround for this > > issue. >=20 > I read the rest of your reasoning about it, but the nice thing of the > current behaviour (and that's why I added that single check on the > source address in ndp()) is that the guest can really use whatever > address it wants, regardless of what we tried to configure, and we'll > resolve any other address. Hrm. I suppose. Fwiw we already make the equivalent exclusion for ARP > If we receive a neighbour solicitation for the guest assigned address, > and the source address is not unspecified, it means that the guest is > _not_ using the assigned address, and it's actually trying to reach it. >=20 > > I guess we'll have to manually wait for DAD to complete in the > > DHCP tests, which will be kind of mucky :/ >=20 > Alternatively, we could use the same trick as added by commit > f4e9f26480ef ("pasta: Disable neighbour solicitations on device up > to prevent DAD"): disable neighbour solicitations, run dhclient -6, > set 'nodad' on the address, and re-enable neighbour solicitations. >=20 > This works for me: Ok. More complex, but faster, I guess. I'll try implementing this. --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --FxrcH9WyMh8by3yR Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmcQZjkACgkQzQJF27ox 2GeK8Q//TyKkC0j7cRPd7zHOuCAPypuul7WOCKLdkVcvHSnJvaa+50J6cu1dMbPN MP63WDvn4n9u8HpXUEVSVabGSlJwGXR0vJ4RJgrTAv+VGF16o58WMjbnJ3XIspoQ Bj/FwdgzzqgTdRibuRItZ1uDZSjyJQDOOjitukB9D/EpyEdGW5/Fd2QClDqrTFba NjCi6OTj/975/Cekr7ZXLvGGsM1ZM+ftSNB00gUNNbk8c8n/IzDo0CjH6mI8ljbB BHnsGaJAePoO4HEUw0Aekrqmo0rFl2+y9qbDroillZIzgK2X0g7Mnt7ZNW6c8pHF +U2k0Td7U2Q4G6WuqZF5BjKr6fK7kcv7+K+legKYJuKaCVu6e+lDPX0noQzaiF+/ 9CAPMG2eKCjQrnzGM8n75jb1bxADo8NrRpTsxQ62KZEoZFk9a5XghfpjsRyYkpv/ zztkGzpfebjxY0mNdrABWS3/pVljCIFU16bN2StrdOLl9szkntgZjoUH2clAUv+N uUilRJgtX/tpoOKtVUOZnqY64ER/zl3Rkv1yTALgTjc2qbARldAqKQadtfINRC7b DhxQKXmk+2bfUiPQvYPl2uSuEgEOlw4R0llnK/JhwqbUufSmWQf03yL0DEEQIyDF 04XDZDuir/SZcNicXZ3h4ASA/q9tZYCUyG3mBgOcyXckoK+WSjs= =Vsk7 -----END PGP SIGNATURE----- --FxrcH9WyMh8by3yR--