On Fri, Sep 05, 2025 at 10:11:48PM -0400, Jon Maloy wrote:
> When we receive an ARP request or NDP neigbor solicitation over
> the tap interface for a host on the local network segment attached
> to the template interface, we respond with that host's real MAC
> address.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

LGTM, apart from small nits.

> 
> ---
> v3: - Added helper function to find out if a remote ip address is subject
>       to NAT. This filters out local host addresses which should be
>       presented with the passt/pasta local MAC address 9a:55:9a:55:9a:55 even
>       though it is on the local segment.
>     - Adapted to the change in nl_mac_get() function, so that we now consider
>       only the template interface when checking the ARP/NDP table.
> v4: - Moved NAT check into the function nat_outbound() to obtain more
>       precise criteria for when NAT is used. We may in theory
>       have NAT even if original and translated addresses are equal, and
>       we want to catch this case.
>     - I chose to keep the wrapper funtion inany_nat(), but moved it to
>       fwd.h/fwd.c and renamed it to fwd_inany_nat().
> v5: - Simplified criteria for when we do ARP/NDP lookup. Now, we
>       just try with the potentially translated address after an
>       attempted NAT check.
>     - Using the new ARP/NDP cache table instead of using netlink
>       directly.
> ---
>  arp.c   | 9 ++++++++-
>  fwd.c   | 5 +++--
>  fwd.h   | 2 ++
>  inany.c | 1 +
>  ndp.c   | 8 ++++++++
>  5 files changed, 22 insertions(+), 3 deletions(-)
> 
> diff --git a/arp.c b/arp.c
> index 44677ad..8bff505 100644
> --- a/arp.c
> +++ b/arp.c
> @@ -69,6 +69,7 @@ static bool ignore_arp(const struct ctx *c,
>   */
>  int arp(const struct ctx *c, struct iov_tail *data)
>  {
> +	union inany_addr tgt, tgt_nat;
>  	struct {
>  		struct ethhdr eh;
>  		struct arphdr ah;
> @@ -80,6 +81,7 @@ int arp(const struct ctx *c, struct iov_tail *data)
>  	const struct ethhdr *eh;
>  	const struct arphdr *ah;
>  	const struct arpmsg *am;
> +	uint8_t omac[ETH_ALEN];

Maybe tap_omac to disambiguate.  Or else put it straight into
resp.am.sha, similar to how you do for IPv6.

>  	eh = IOV_REMOVE_HEADER(data, eh_storage);
>  	ah = IOV_REMOVE_HEADER(data, ah_storage);
> @@ -102,8 +104,13 @@ int arp(const struct ctx *c, struct iov_tail *data)
>  	resp.ah.ar_hln = ah->ar_hln;
>  	resp.ah.ar_pln = ah->ar_pln;
>  
> +	/* MAC address to return */
> +	inany_from_af(&tgt, AF_INET, am->tip);
> +	nat_outbound(c, &tgt, &tgt_nat);
> +	fwd_neigh_mac_get(c, &tgt_nat, omac);
> +
>  	/* ARP message */
> -	memcpy(resp.am.sha,		c->our_tap_mac,	sizeof(resp.am.sha));
> +	memcpy(resp.am.sha,		omac,		sizeof(resp.am.sha));
>  	memcpy(resp.am.sip,		am->tip,	sizeof(resp.am.sip));
>  	memcpy(resp.am.tha,		am->sha,	sizeof(resp.am.tha));
>  	memcpy(resp.am.tip,		am->sip,	sizeof(resp.am.tip));
> diff --git a/fwd.c b/fwd.c
> index ab49dba..664e167 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -630,8 +630,8 @@ static bool fwd_guest_accessible(const struct ctx *c,
>   * Only handles translations that depend *only* on the address.  Anything
>   * related to specific ports or flows is handled elsewhere.
>   */
> -static void nat_outbound(const struct ctx *c, const union inany_addr *addr,
> -			 union inany_addr *translated)
> +void nat_outbound(const struct ctx *c, const union inany_addr *addr,
> +		  union inany_addr *translated)

Since this is now exported, it should become fwd_nat_outbound() to
namespace it properly.

>  {
>  	if (inany_equals4(addr, &c->ip4.map_host_loopback))
>  		*translated = inany_loopback4;
> @@ -643,6 +643,7 @@ static void nat_outbound(const struct ctx *c, const union inany_addr *addr,
>  		translated->a6 = c->ip6.addr;
>  	else
>  		*translated = *addr;
> +

Spurious whitespace.

>  }
>  
>  /**
> diff --git a/fwd.h b/fwd.h
> index 80da4b1..bf1705b 100644
> --- a/fwd.h
> +++ b/fwd.h
> @@ -57,6 +57,8 @@ void fwd_scan_ports_init(struct ctx *c);
>  
>  bool nat_inbound(const struct ctx *c, const union inany_addr *addr,
>  		 union inany_addr *translated);
> +void nat_outbound(const struct ctx *c, const union inany_addr *addr,
> +		  union inany_addr *translated);
>  uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto,
>  			 const struct flowside *ini, struct flowside *tgt);
>  uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto,
> diff --git a/inany.c b/inany.c
> index 65a39f9..7680439 100644
> --- a/inany.c
> +++ b/inany.c
> @@ -16,6 +16,7 @@
>  #include "ip.h"
>  #include "siphash.h"
>  #include "inany.h"
> +#include "fwd.h"
>  
>  const union inany_addr inany_loopback4 = INANY_INIT4(IN4ADDR_LOOPBACK_INIT);
>  const union inany_addr inany_any4 = INANY_INIT4(IN4ADDR_ANY_INIT);
> diff --git a/ndp.c b/ndp.c
> index eb090cd..820c556 100644
> --- a/ndp.c
> +++ b/ndp.c
> @@ -196,6 +196,7 @@ static void ndp_send(const struct ctx *c, const struct in6_addr *dst,
>  static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
>  	    const struct in6_addr *addr)
>  {
> +	union inany_addr tgt, tgt_nat;
>  	struct ndp_na na = {
>  		.ih = {
>  			.icmp6_type		= NA,
> @@ -215,6 +216,13 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
>  
>  	memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN);
>  
> +	/* Respond with true MAC address if remote host's address or
> +	 * NAT translated address can be found in NDP table.
> +	 */
> +	inany_from_af(&tgt, AF_INET6, addr);
> +	nat_outbound(c, &tgt, &tgt_nat);
> +	fwd_neigh_mac_get(c, &tgt_nat, na.target_l2_addr.mac);
> +
>  	ndp_send(c, dst, &na, sizeof(na));
>  }
>  
> -- 
> 2.50.1
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson