From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202508 header.b=DPANTseO; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id AB2C75A0279 for ; Mon, 08 Sep 2025 05:09:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202508; t=1757300974; bh=wj1kHVRTNSX1wDZC2O2k+A8/Y9PD2qmceGVhUj+zObM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DPANTseODQY9CJWWTuO9yHebjuJeFlIWgP+WiMjLbfpoyH3vtFEYPhrVsCGpMGQ/M A8j5Svxq+4JJSZ//SbUc96zBWnIyd2bZ4VRpZPQgLry4BsI+8mMuf0yy0NQDHk2VAv i14LdGnLXiw01ytBqI+EyGhfBaLAaPQvg1tNO+ymk0Y4Nq5NzjKgGT09ze5dmPsqbp v3C4XKL//RCN+g12FfG9Z8sOySxwPKcKAy4weqlww3vbn3IBkWVsp9EDoNmfjtH3+y bTzRJEFpwkbTHaupehG0zT7sZGGVg64yZ3T5uvosVbZbucRW1/QtndgTr3usmMwwJr JSzCoFdlAHMew== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4cKsPV5BfNz4wBH; Mon, 8 Sep 2025 13:09:34 +1000 (AEST) Date: Mon, 8 Sep 2025 13:04:18 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v5 04/10] arp/ndp: respond with true MAC address of LAN local remote hosts Message-ID: References: <20250906021154.2760611-1-jmaloy@redhat.com> <20250906021154.2760611-5-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="xYCS+UMPm3mD9L52" Content-Disposition: inline In-Reply-To: <20250906021154.2760611-5-jmaloy@redhat.com> Message-ID-Hash: PSCD7Y2MPBSORPKTX5EEHQZZRZYK3UP6 X-Message-ID-Hash: PSCD7Y2MPBSORPKTX5EEHQZZRZYK3UP6 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --xYCS+UMPm3mD9L52 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Sep 05, 2025 at 10:11:48PM -0400, Jon Maloy wrote: > When we receive an ARP request or NDP neigbor solicitation over > the tap interface for a host on the local network segment attached > to the template interface, we respond with that host's real MAC > address. >=20 > Signed-off-by: Jon Maloy LGTM, apart from small nits. >=20 > --- > v3: - Added helper function to find out if a remote ip address is subject > to NAT. This filters out local host addresses which should be > presented with the passt/pasta local MAC address 9a:55:9a:55:9a:55 = even > though it is on the local segment. > - Adapted to the change in nl_mac_get() function, so that we now cons= ider > only the template interface when checking the ARP/NDP table. > v4: - Moved NAT check into the function nat_outbound() to obtain more > precise criteria for when NAT is used. We may in theory > have NAT even if original and translated addresses are equal, and > we want to catch this case. > - I chose to keep the wrapper funtion inany_nat(), but moved it to > fwd.h/fwd.c and renamed it to fwd_inany_nat(). > v5: - Simplified criteria for when we do ARP/NDP lookup. Now, we > just try with the potentially translated address after an > attempted NAT check. > - Using the new ARP/NDP cache table instead of using netlink > directly. > --- > arp.c | 9 ++++++++- > fwd.c | 5 +++-- > fwd.h | 2 ++ > inany.c | 1 + > ndp.c | 8 ++++++++ > 5 files changed, 22 insertions(+), 3 deletions(-) >=20 > diff --git a/arp.c b/arp.c > index 44677ad..8bff505 100644 > --- a/arp.c > +++ b/arp.c > @@ -69,6 +69,7 @@ static bool ignore_arp(const struct ctx *c, > */ > int arp(const struct ctx *c, struct iov_tail *data) > { > + union inany_addr tgt, tgt_nat; > struct { > struct ethhdr eh; > struct arphdr ah; > @@ -80,6 +81,7 @@ int arp(const struct ctx *c, struct iov_tail *data) > const struct ethhdr *eh; > const struct arphdr *ah; > const struct arpmsg *am; > + uint8_t omac[ETH_ALEN]; Maybe tap_omac to disambiguate. Or else put it straight into resp.am.sha, similar to how you do for IPv6. > eh =3D IOV_REMOVE_HEADER(data, eh_storage); > ah =3D IOV_REMOVE_HEADER(data, ah_storage); > @@ -102,8 +104,13 @@ int arp(const struct ctx *c, struct iov_tail *data) > resp.ah.ar_hln =3D ah->ar_hln; > resp.ah.ar_pln =3D ah->ar_pln; > =20 > + /* MAC address to return */ > + inany_from_af(&tgt, AF_INET, am->tip); > + nat_outbound(c, &tgt, &tgt_nat); > + fwd_neigh_mac_get(c, &tgt_nat, omac); > + > /* ARP message */ > - memcpy(resp.am.sha, c->our_tap_mac, sizeof(resp.am.sha)); > + memcpy(resp.am.sha, omac, sizeof(resp.am.sha)); > memcpy(resp.am.sip, am->tip, sizeof(resp.am.sip)); > memcpy(resp.am.tha, am->sha, sizeof(resp.am.tha)); > memcpy(resp.am.tip, am->sip, sizeof(resp.am.tip)); > diff --git a/fwd.c b/fwd.c > index ab49dba..664e167 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -630,8 +630,8 @@ static bool fwd_guest_accessible(const struct ctx *c, > * Only handles translations that depend *only* on the address. Anything > * related to specific ports or flows is handled elsewhere. > */ > -static void nat_outbound(const struct ctx *c, const union inany_addr *ad= dr, > - union inany_addr *translated) > +void nat_outbound(const struct ctx *c, const union inany_addr *addr, > + union inany_addr *translated) Since this is now exported, it should become fwd_nat_outbound() to namespace it properly. > { > if (inany_equals4(addr, &c->ip4.map_host_loopback)) > *translated =3D inany_loopback4; > @@ -643,6 +643,7 @@ static void nat_outbound(const struct ctx *c, const u= nion inany_addr *addr, > translated->a6 =3D c->ip6.addr; > else > *translated =3D *addr; > + Spurious whitespace. > } > =20 > /** > diff --git a/fwd.h b/fwd.h > index 80da4b1..bf1705b 100644 > --- a/fwd.h > +++ b/fwd.h > @@ -57,6 +57,8 @@ void fwd_scan_ports_init(struct ctx *c); > =20 > bool nat_inbound(const struct ctx *c, const union inany_addr *addr, > union inany_addr *translated); > +void nat_outbound(const struct ctx *c, const union inany_addr *addr, > + union inany_addr *translated); > uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto, > const struct flowside *ini, struct flowside *tgt); > uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, > diff --git a/inany.c b/inany.c > index 65a39f9..7680439 100644 > --- a/inany.c > +++ b/inany.c > @@ -16,6 +16,7 @@ > #include "ip.h" > #include "siphash.h" > #include "inany.h" > +#include "fwd.h" > =20 > const union inany_addr inany_loopback4 =3D INANY_INIT4(IN4ADDR_LOOPBACK_= INIT); > const union inany_addr inany_any4 =3D INANY_INIT4(IN4ADDR_ANY_INIT); > diff --git a/ndp.c b/ndp.c > index eb090cd..820c556 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -196,6 +196,7 @@ static void ndp_send(const struct ctx *c, const struc= t in6_addr *dst, > static void ndp_na(const struct ctx *c, const struct in6_addr *dst, > const struct in6_addr *addr) > { > + union inany_addr tgt, tgt_nat; > struct ndp_na na =3D { > .ih =3D { > .icmp6_type =3D NA, > @@ -215,6 +216,13 @@ static void ndp_na(const struct ctx *c, const struct= in6_addr *dst, > =20 > memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN); > =20 > + /* Respond with true MAC address if remote host's address or > + * NAT translated address can be found in NDP table. > + */ > + inany_from_af(&tgt, AF_INET6, addr); > + nat_outbound(c, &tgt, &tgt_nat); > + fwd_neigh_mac_get(c, &tgt_nat, na.target_l2_addr.mac); > + > ndp_send(c, dst, &na, sizeof(na)); > } > =20 > --=20 > 2.50.1 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --xYCS+UMPm3mD9L52 Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmi+R7EACgkQzQJF27ox 2GeECQ/8DubAWyOn4x3/z5nAftSJWZ7KSi8JcXztJ/Wd2tJBRi5fOHUj9lC2FXtr Z4uSSqKPb08bUXnWtW0wmLz0I13Bx3YckrbmDpqxDX5g6JsSNbUmG88CosA7Ylv/ xJ3x/cdc7VCHcy0LvKtM0iWc2mpIsgmxTbt+oog92SDrIfIoVMKw4Cw7BgM4kRci HDNWh1SQVvFbsCYlaFyY360sHMndLWqKTQk0pTAcBhY34taZxoCA6gsY+Ijpxu1w ZUSQ0XWws7LP+Vsc/cmzHVzQHIoxHm4O9Qe+h9Zuvzy3G6aR4g2NIxNeIsQy7vl5 qw81BzLWhCvv8DW8z4o8bxdfERW4c3W0ifP18A2cK9QNhPae3xWH6tE+49p8zxG9 5AUYEqdi3MIVec1pPCxLSRa4j3Y3rFTK92Tt4WyCUAQmbcq1Xd+c9onNRhBIUnkH L2CRUBGGbH1zzi2NFjqaGA+xe53fFlZ/O0ChaOCF0RSPtdVuhWhgGthmGbejhTN2 XjoidPXE0JeJi0+gCtEggURzy0Bd94W9VRzEQR16rXv2zUIZ4hskc9xTZih7eNTH 09kYrGE88q0JDGwDBPafXjRGRktZ/koTyLVs14yFRjjj0dLyK7AObms9LabY8fGW PTWmxbq60jON6b54eX4MpoO07V8odzpizJNar8pcwN6BWbopGjY= =fIqh -----END PGP SIGNATURE----- --xYCS+UMPm3mD9L52--