From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202508 header.b=o5EHmWDK; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 259725A0279 for ; Thu, 21 Aug 2025 03:18:27 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202508; t=1755739104; bh=w3Up2as7CbeW11hFgmDJ/isaQb2Ca2ikXSHUPzt83rE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=o5EHmWDKt6foyNmdeUQHdMcFmpbx/kTmGoYgDpE3VS73J7CGEarQNEUqGaGxsE56N PRzg+zxOEsvnrtd4R6rkdz06tEpPl2+a4OSKhAb4aupS3sF6hhMV4edY9WOFh9WEF2 QePo9dd4lnjxFncEk9VKCd9h5iZS5+KIMfAIG1Lo4cy3/ZlXOoZocmibpydPOT9qWC q55zIDiFwnsCEhZkyfzvvuRRKylbKVsOLV7F0QJwjNFyi1vI5OpY1eoG3vo3K1WpUV cxkRBOgCF/F0og0eTyypQZoLdRdOEvB/k1ftpKBC6gdOx1mcjkPdTdk+NdURV1+Y1K iKskMEdjI1xvg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4c6lnX2mD5z4wbY; Thu, 21 Aug 2025 11:18:24 +1000 (AEST) Date: Thu, 21 Aug 2025 11:18:04 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v4 2/9] arp/ndp: respond with true MAC address of LAN local remote hosts Message-ID: References: <20250820031005.2725591-1-jmaloy@redhat.com> <20250820031005.2725591-3-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="DC04unWlbMUxdrsh" Content-Disposition: inline In-Reply-To: <20250820031005.2725591-3-jmaloy@redhat.com> Message-ID-Hash: QEW2KFZ23O6Y5VNS3KWCJHFKTUKDEFK7 X-Message-ID-Hash: QEW2KFZ23O6Y5VNS3KWCJHFKTUKDEFK7 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --DC04unWlbMUxdrsh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Aug 19, 2025 at 11:09:58PM -0400, Jon Maloy wrote: > When we receive an ARP request or NDP neigbor solicitation over > the tap interface for a host on the local network segment attached > to the template interface, we respond with that host's real MAC > address. >=20 > The local host, which is acting as a proxy for the default gateway, > is still exempted from this rule. >=20 > Signed-off-by: Jon Maloy > --- > arp.c | 9 +++++++++ > fwd.c | 38 ++++++++++++++++++++++++++++++-------- > fwd.h | 1 + > inany.c | 1 + > ndp.c | 9 +++++++++ > 5 files changed, 50 insertions(+), 8 deletions(-) >=20 > diff --git a/arp.c b/arp.c > index fc482bb..c37867a 100644 > --- a/arp.c > +++ b/arp.c > @@ -29,6 +29,7 @@ > #include "dhcp.h" > #include "passt.h" > #include "tap.h" > +#include "netlink.h" > =20 > /** > * arp() - Check if this is a supported ARP message, reply as needed > @@ -39,6 +40,7 @@ > */ > int arp(const struct ctx *c, const struct pool *p) > { > + union inany_addr tgt; > unsigned char swap[4]; > struct ethhdr *eh; > struct arphdr *ah; > @@ -72,6 +74,13 @@ int arp(const struct ctx *c, const struct pool *p) > memcpy(am->tha, am->sha, sizeof(am->tha)); > memcpy(am->sha, c->our_tap_mac, sizeof(am->sha)); > =20 > + /* Respond with true MAC address if remote host is on > + * the template interface's network segment > + */ > + inany_from_af(&tgt, AF_INET, am->tip); > + if (!fwd_inany_nat(c, &tgt)) > + nl_neigh_mac_get(nl_sock, &tgt, c->ifi4, am->sha); You're not checking for errors from nl_neigh_mac_get(). > memcpy(swap, am->tip, sizeof(am->tip)); > memcpy(am->tip, am->sip, sizeof(am->tip)); > memcpy(am->sip, swap, sizeof(am->sip)); > diff --git a/fwd.c b/fwd.c > index 250cf56..55bf5f2 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -331,20 +331,29 @@ static bool fwd_guest_accessible(const struct ctx *= c, > * > * Only handles translations that depend *only* on the address. Anything > * related to specific ports or flows is handled elsewhere. > + * > + * Return: true if there was a translation, otherwise false > */ > -static void nat_outbound(const struct ctx *c, const union inany_addr *ad= dr, > - union inany_addr *translated) > +static bool nat_outbound(const struct ctx *c, const union inany_addr *ad= dr, > + union inany_addr *translated) > { I'm having trouble convincing myself that explicitly excluding MAC preservation in NAT cases is strictly correct, as opposed to doing a MAC lookup on the translated address. I'm reasonably confident it will be good enough for most purposes. > - if (inany_equals4(addr, &c->ip4.map_host_loopback)) > + if (inany_equals4(addr, &c->ip4.map_host_loopback)) { For this case, we'll certainly want our_tap_mac. We should get that indirectly anyway, though, since 127.0.0.1 will never be in the host interface's neighbour table. > *translated =3D inany_loopback4; > - else if (inany_equals6(addr, &c->ip6.map_host_loopback)) > + return true; > + } else if (inany_equals6(addr, &c->ip6.map_host_loopback)) { > *translated =3D inany_loopback6; Ditto, but for ::. > - else if (inany_equals4(addr, &c->ip4.map_guest_addr)) > + return true; > + } else if (inany_equals4(addr, &c->ip4.map_guest_addr)) { > *translated =3D inany_from_v4(c->ip4.addr); > - else if (inany_equals6(addr, &c->ip6.map_guest_addr)) > + return true; > + } else if (inany_equals6(addr, &c->ip6.map_guest_addr)) { > translated->a6 =3D c->ip6.addr; Arguably for these cases, using the MAC of the translated address is what we want. There is a real peer on the host side (usually the host itself, but maybe something else), which might have a presence on the template interface. We have the NAT in place because it conflicts with the guest's IP, but the MAC should still be unique. > - else > - *translated =3D *addr; > + return true; > + } > + > + *translated =3D *addr; > + return false; > + > } > =20 > /** > @@ -554,3 +563,16 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8= _t proto, > =20 > return PIF_TAP; > } > + > +/** fwd_inany_nat - Find if a remote IPv[46] address is subject to NAT > + * @c: Execution context > + * @addr: IPv[46] address > + * > + * Return: true if translated, false otherwise > + */ > +bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr) > +{ > + union inany_addr addr_nat; > + > + return nat_outbound(c, addr, &addr_nat); > +} > diff --git a/fwd.h b/fwd.h > index 65c7c96..c8d485d 100644 > --- a/fwd.h > +++ b/fwd.h > @@ -56,5 +56,6 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_= t proto, > const struct flowside *ini, struct flowside *tgt); > uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, > const struct flowside *ini, struct flowside *tgt); > +bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr); > =20 > #endif /* FWD_H */ > diff --git a/inany.c b/inany.c > index 65a39f9..7680439 100644 > --- a/inany.c > +++ b/inany.c > @@ -16,6 +16,7 @@ > #include "ip.h" > #include "siphash.h" > #include "inany.h" > +#include "fwd.h" > =20 > const union inany_addr inany_loopback4 =3D INANY_INIT4(IN4ADDR_LOOPBACK_= INIT); > const union inany_addr inany_any4 =3D INANY_INIT4(IN4ADDR_ANY_INIT); > diff --git a/ndp.c b/ndp.c > index 3e15494..9912f80 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -32,6 +32,7 @@ > #include "passt.h" > #include "tap.h" > #include "log.h" > +#include "netlink.h" > =20 > #define RT_LIFETIME 65535 > =20 > @@ -196,6 +197,7 @@ static void ndp_send(const struct ctx *c, const struc= t in6_addr *dst, > static void ndp_na(const struct ctx *c, const struct in6_addr *dst, > const struct in6_addr *addr) > { > + union inany_addr tgt; > struct ndp_na na =3D { > .ih =3D { > .icmp6_type =3D NA, > @@ -215,6 +217,13 @@ static void ndp_na(const struct ctx *c, const struct= in6_addr *dst, > =20 > memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN); > =20 > + /* Respond with true link-layer address if remote host is on > + * the template interface's network segment > + */ > + inany_from_af(&tgt, AF_INET6, addr); > + if (!fwd_inany_nat(c, &tgt)) > + nl_neigh_mac_get(nl_sock, &tgt, c->ifi6, na.target_l2_addr.mac); > + > ndp_send(c, dst, &na, sizeof(na)); > } > =20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --DC04unWlbMUxdrsh Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmimc7wACgkQzQJF27ox 2GdPpA//c2rRvL4Wp23YTvNm2Gbu1kYq1uTBlQLC9CjvIDHkz2NQwjX53bDELpTf kHJbXo2khn+Doc+/MHe7pfvvOxz9HB9reoORrzkReuv3yYPkUeKgTWbAFP923pyo Qd+j5TdszfgHMmCAcy9MyunYe6UuavpG/aqbFS0HmEmufqkK7Bk9DOmIChD1RAkL UaKPJCzyMkgz1BAk0r/v7qGUkTRVEDG90Axfkk5UP470V4umr7b+piv6JJJE4Dki QVa9hg27iOdx0Y5vX1mEpoyRzCJ75Di0kbkxyTKnTeOX9DH+6JMZ6yoXWokyvehi WjTr1WI4ph7oC4k4Mh18R0XnZMiMgv3SrIBF9YnAYR1ybpMGI6Cc22hFahtxj9l2 rkRX3TF/3b1buAfIVTZtVK2I8JZQT+GQYVVpKsQYXE1Nmaj6KG7Nfs1qsnOs6IKH 0WyTtZrRrlupLi3DEdm7eusliKO82J9H8o2f/GDHOuJQX8VQToco0RLhDOkhUVf8 IKmngbEHMjDkM7DIifhENKpMt+Q7V6uhbKrFj1nchqyl+TjGvlGM6hyvLnjgJ11w WyJ4OWp045Pyn16zmEW9YBmaCdR1afEORz1qL5P5r5qwAR7ZOh6CHEObNNaVA7+l x3D5a6bkNCTccAN4HdJfaKBnQGf4XUdwQL28O6w49w2vI6yIdyU= =HJ05 -----END PGP SIGNATURE----- --DC04unWlbMUxdrsh--