From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202508 header.b=DwMIUj9U; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 7DDA15A0279 for ; Wed, 10 Sep 2025 04:57:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202508; t=1757473034; bh=/hFm3+Oey6eRSag86lRMv9H2X+BmFAVkZM6YZSDBYgM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DwMIUj9UqdkkVuKp6b/nXIrFG2ztyHZ/9WaytfnuK40AxBC0n7rtkUNhShEDs3zib qC03IO2hvnp+LEODqo25y4JvGrIr4USnfkSo0iqvvteedtPza8Yoe0NxWYpZhUIzwM ikAJaYQsx4wC0pLaEZx/9yIq8vAuHv2EV5au4FSerqvVtc4m8quMuNWIeWhSfL8KH3 E1W2OTRuQUgNhuxy1EIe5BGwhEVsncH0byFXNzVFpN3jm9H8LYewle61yK5tbq+2RQ fE+KN/IHYLh1a/Mlq3pqqQmuwW7pCXzQwEykxKNAKbE0mhuXbf8vtp2XhLONYkcSt7 4B0gqdy9e3lLQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4cM52L2g6zz4w9Y; Wed, 10 Sep 2025 12:57:14 +1000 (AEST) Date: Wed, 10 Sep 2025 12:50:05 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v6 3/8] arp/ndp: respond with true MAC address of LAN local remote hosts Message-ID: References: <20250910015919.173414-1-jmaloy@redhat.com> <20250910015919.173414-4-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="oAIp83ler+gh+VGl" Content-Disposition: inline In-Reply-To: <20250910015919.173414-4-jmaloy@redhat.com> Message-ID-Hash: 3XEPQ3YPR6T6BRZ6QS4JKA6RFNK2QB3E X-Message-ID-Hash: 3XEPQ3YPR6T6BRZ6QS4JKA6RFNK2QB3E X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --oAIp83ler+gh+VGl Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 09, 2025 at 09:59:14PM -0400, Jon Maloy wrote: > When we receive an ARP request or NDP neigbor solicitation over > the tap interface for a host on the local network segment attached > to the template interface, we respond with that host's real MAC > address. >=20 > Signed-off-by: Jon Maloy Reviewed-by: David Gibson >=20 > --- > v3: - Added helper function to find out if a remote ip address is subject > to NAT. This filters out local host addresses which should be > presented with the passt/pasta local MAC address 9a:55:9a:55:9a:55 = even > though it is on the local segment. > - Adapted to the change in nl_mac_get() function, so that we now cons= ider > only the template interface when checking the ARP/NDP table. > v4: - Moved NAT check into the function nat_outbound() to obtain more > precise criteria for when NAT is used. We may in theory > have NAT even if original and translated addresses are equal, and > we want to catch this case. > - I chose to keep the wrapper funtion inany_nat(), but moved it to > fwd.h/fwd.c and renamed it to fwd_inany_nat(). > v5: - Simplified criteria for when we do ARP/NDP lookup. Now, we > just try with the potentially translated address after an > attempted NAT check. > - Using the new ARP/NDP cache table instead of using netlink > directly. > v6: - Fixes after feedback from David: > - Renamed nat_outbound() to fwd_nat_outbound() > - Eliminated unnecessary temporary variable in arp.c::arp() > --- > arp.c | 9 +++++++-- > fwd.c | 8 ++++---- > fwd.h | 2 ++ > inany.c | 1 + > ndp.c | 8 ++++++++ > 5 files changed, 22 insertions(+), 6 deletions(-) >=20 > diff --git a/arp.c b/arp.c > index 44677ad..90ed5dc 100644 > --- a/arp.c > +++ b/arp.c > @@ -69,6 +69,7 @@ static bool ignore_arp(const struct ctx *c, > */ > int arp(const struct ctx *c, struct iov_tail *data) > { > + union inany_addr tgt, tgt_nat; > struct { > struct ethhdr eh; > struct arphdr ah; > @@ -102,8 +103,12 @@ int arp(const struct ctx *c, struct iov_tail *data) > resp.ah.ar_hln =3D ah->ar_hln; > resp.ah.ar_pln =3D ah->ar_pln; > =20 > - /* ARP message */ > - memcpy(resp.am.sha, c->our_tap_mac, sizeof(resp.am.sha)); > + /* MAC address to return in ARP message */ > + inany_from_af(&tgt, AF_INET, am->tip); > + fwd_nat_outbound(c, &tgt, &tgt_nat); > + fwd_neigh_mac_get(c, &tgt_nat, resp.am.sha); > + > + /* Rest of ARP message */ > memcpy(resp.am.sip, am->tip, sizeof(resp.am.sip)); > memcpy(resp.am.tha, am->sha, sizeof(resp.am.tha)); > memcpy(resp.am.tip, am->sip, sizeof(resp.am.tip)); > diff --git a/fwd.c b/fwd.c > index c58ba9f..127bd31 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -500,7 +500,7 @@ static bool fwd_guest_accessible(const struct ctx *c, > } > =20 > /** > - * nat_outbound() - Apply address translation for outbound (TAP to HOST) > + * fwd_nat_outbound() - Apply address translation for outbound (TAP to H= OST) > * @c: Execution context > * @addr: Input address (as seen on TAP interface) > * @translated: Output address (as seen on HOST interface) > @@ -508,8 +508,8 @@ static bool fwd_guest_accessible(const struct ctx *c, > * Only handles translations that depend *only* on the address. Anything > * related to specific ports or flows is handled elsewhere. > */ > -static void nat_outbound(const struct ctx *c, const union inany_addr *ad= dr, > - union inany_addr *translated) > +void fwd_nat_outbound(const struct ctx *c, const union inany_addr *addr, > + union inany_addr *translated) > { > if (inany_equals4(addr, &c->ip4.map_host_loopback)) > *translated =3D inany_loopback4; > @@ -543,7 +543,7 @@ uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t= proto, > inany_equals6(&ini->oaddr, &c->ip6.dns_match)) > tgt->eaddr.a6 =3D c->ip6.dns_host; > else > - nat_outbound(c, &ini->oaddr, &tgt->eaddr); > + fwd_nat_outbound(c, &ini->oaddr, &tgt->eaddr); > =20 > tgt->eport =3D ini->oport; > =20 > diff --git a/fwd.h b/fwd.h > index 728601f..a4dd6bb 100644 > --- a/fwd.h > +++ b/fwd.h > @@ -50,6 +50,8 @@ void fwd_scan_ports_init(struct ctx *c); > =20 > bool nat_inbound(const struct ctx *c, const union inany_addr *addr, > union inany_addr *translated); > +void fwd_nat_outbound(const struct ctx *c, const union inany_addr *addr, > + union inany_addr *translated); > uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto, > const struct flowside *ini, struct flowside *tgt); > uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, > diff --git a/inany.c b/inany.c > index 65a39f9..7680439 100644 > --- a/inany.c > +++ b/inany.c > @@ -16,6 +16,7 @@ > #include "ip.h" > #include "siphash.h" > #include "inany.h" > +#include "fwd.h" > =20 > const union inany_addr inany_loopback4 =3D INANY_INIT4(IN4ADDR_LOOPBACK_= INIT); > const union inany_addr inany_any4 =3D INANY_INIT4(IN4ADDR_ANY_INIT); > diff --git a/ndp.c b/ndp.c > index eb090cd..944371c 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -196,6 +196,7 @@ static void ndp_send(const struct ctx *c, const struc= t in6_addr *dst, > static void ndp_na(const struct ctx *c, const struct in6_addr *dst, > const struct in6_addr *addr) > { > + union inany_addr tgt, tgt_nat; > struct ndp_na na =3D { > .ih =3D { > .icmp6_type =3D NA, > @@ -215,6 +216,13 @@ static void ndp_na(const struct ctx *c, const struct= in6_addr *dst, > =20 > memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN); > =20 > + /* Respond with true MAC address if remote host's address or > + * NAT translated address can be found in NDP table. > + */ > + inany_from_af(&tgt, AF_INET6, addr); > + fwd_nat_outbound(c, &tgt, &tgt_nat); > + fwd_neigh_mac_get(c, &tgt_nat, na.target_l2_addr.mac); > + > ndp_send(c, dst, &na, sizeof(na)); > } > =20 > --=20 > 2.50.1 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --oAIp83ler+gh+VGl Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIyBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmjA51wACgkQzQJF27ox 2GcxVQ/3dXSkI9tadhJgTaeqeDej85GHMvXqb7D36dYZp4wq7rDDexgEM6e3AlFn 1D7tumWWmsHhHsLghyMqLakLci/MXKTpGIE5TDTioQT01qESFXObFJ7mYCSgYNFD bGAxAHBT9/tKI/zHzXz5MtPkFkNJuGcgaZQrVv8r4IqplTurgE4DRXIGJvmxiyZ9 ZHjXW5jMyS6LaiZVCPCVe0tZgL+BlBpwjV1Ypzd5ObDfZh/flms/ZaErpRmGxz0o EozwZ61ellQhXNABdX80shncMcVaNT8yyKRu2W8/5z4LMkAtCMKpEpz5ZObp7SLb 8Jp/t1LoBostcOHeKacreG7d/E3OC8nLDeweRsrlUtNookgAlUqUFcq0JiAR/Z8l M0EZGB+AyglWmr7w/ypshkqjuIye3M5Vq1/k1+Hp/0x+2HSXUusxqvAoRMyzBywG RgvAKz6Vv/qbySxzUqWf75ZVUZRH69xMNdYHT0mofg4uzrfUseL583xDCdA8CrKy q0fqsaYrW/wg3PHIpiHDpldoUQvVDk7AoPdp+Jwr72hXsx9cmAYwQriMf66JmdPv +Z4eYDhFBHKqlBVu3LsVsqaWfHaGAgcXQuyGgDWYNR66AFCFTWsc8HVvm23woXhQ Ki96ibQQwvfPiNDfomHXRsg+b5lq6+EvThxe95xaku5dhoVLLQ== =zwot -----END PGP SIGNATURE----- --oAIp83ler+gh+VGl--