Re: [PATCH v12 3/9] arp/ndp: send ARP announcement / unsolicited NA when neigbour entry added

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 6405 bytes --]

On Thu, Oct 02, 2025 at 08:34:06PM -0400, Jon Maloy wrote:
> ARP announcements and unsolicited NAs should be handled with caution
> because of the risk of malignant users emitting them to disturb
> network communication.
> 
> There is however one case we where we know it is legitimate
> and safe for us to send out such messages: The one time we switch
> from using ctx->own_tap_mac to a MAC address received via the
> recently added neigbour subscription function. Later changes to
> the MAC address of a host in an existing entry cannot be fully
> trusted, so we abstain from doing it in such cases.
> 
> When sending this type of messages, we notice that the guest accepts
> the update, but shortly later asks for a confirmation in the form of
> a regular ARP/NS request. This is responded to with the new value,
> and we have exactly the effect we wanted.
> 
> This commit adds this functionality.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>
> 
> ---
> v10: -Made small changes based of feedback from David G.
> v11: -Moved from 'Gratuitous ARP reply' model to 'ARP Announcement'
>       model.
> v12: -Excluding loopback and default GW addresses from the ARP/NA
>       announcement to be sent to the guest
> ---
>  arp.c | 42 ++++++++++++++++++++++++++++++++++++++++++
>  arp.h |  2 ++
>  fwd.c | 16 ++++++++++++++++
>  ndp.c | 10 ++++++++++
>  ndp.h |  1 +
>  5 files changed, 71 insertions(+)
> 
> diff --git a/arp.c b/arp.c
> index ad088b1..b08780f 100644
> --- a/arp.c
> +++ b/arp.c
> @@ -146,3 +146,45 @@ void arp_send_init_req(const struct ctx *c)
>  	debug("Sending initial ARP request for guest MAC address");
>  	tap_send_single(c, &req, sizeof(req));
>  }
> +
> +/**
> + * arp_announce() - Send an ARP announcement for an IPv4 host
> + * @c:		Execution context
> + * @ip:	IPv4 address we announce as owned by @mac
> + * @mac:	MAC address to advertise for @ip
> + */
> +void arp_announce(const struct ctx *c, struct in_addr *ip,
> +		  const unsigned char *mac)
> +{
> +	char ip_str[INET_ADDRSTRLEN];
> +	char mac_str[ETH_ADDRSTRLEN];
> +	struct {
> +		struct ethhdr eh;
> +		struct arphdr ah;
> +		struct arpmsg am;
> +	} __attribute__((__packed__)) annc;
> +
> +	/* Ethernet header */
> +	annc.eh.h_proto = htons(ETH_P_ARP);
> +	memcpy(annc.eh.h_dest, MAC_BROADCAST, sizeof(annc.eh.h_dest));
> +	memcpy(annc.eh.h_source, mac, sizeof(annc.eh.h_source));
> +
> +	/* ARP header */
> +	annc.ah.ar_op = htons(ARPOP_REQUEST);
> +	annc.ah.ar_hrd = htons(ARPHRD_ETHER);
> +	annc.ah.ar_pro = htons(ETH_P_IP);
> +	annc.ah.ar_hln = ETH_ALEN;
> +	annc.ah.ar_pln = 4;
> +
> +	/* ARP message */
> +	memcpy(annc.am.sha, mac, sizeof(annc.am.sha));
> +	memcpy(annc.am.sip, ip, sizeof(annc.am.sip));
> +	memcpy(annc.am.tha, MAC_BROADCAST, sizeof(annc.am.tha));
> +	memcpy(annc.am.tip, ip, sizeof(annc.am.tip));

As noted in several earlier revisions, having sip == tip (but with
different mac addresses) looks odd.  Is that what the RFCs say to do
for ARP announcements?

> +	inet_ntop(AF_INET, ip, ip_str, sizeof(ip_str));
> +	eth_ntop(mac, mac_str, sizeof(mac_str));
> +	debug("Announcing ARP for %s / %s", ip_str, mac_str);
> +
> +	tap_send_single(c, &annc, sizeof(annc));
> +}
> diff --git a/arp.h b/arp.h
> index d5ad0e1..4862e90 100644
> --- a/arp.h
> +++ b/arp.h
> @@ -22,5 +22,7 @@ struct arpmsg {
>  
>  int arp(const struct ctx *c, struct iov_tail *data);
>  void arp_send_init_req(const struct ctx *c);
> +void arp_announce(const struct ctx *c, struct in_addr *ip,
> +		  const unsigned char *mac);
>  
>  #endif /* ARP_H */
> diff --git a/fwd.c b/fwd.c
> index c34bb1c..ade97c8 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -26,6 +26,8 @@
>  #include "passt.h"
>  #include "lineread.h"
>  #include "flow_table.h"
> +#include "arp.h"
> +#include "ndp.h"
>  
>  /* Empheral port range: values from RFC 6335 */
>  static in_port_t fwd_ephemeral_min = (1 << 15) + (1 << 14);
> @@ -140,6 +142,20 @@ void fwd_neigh_table_update(const struct ctx *c, const union inany_addr *addr,
>  
>  	memcpy(&e->addr, addr, sizeof(*addr));
>  	memcpy(e->mac, mac, ETH_ALEN);
> +
> +	if (inany_equals(addr, &inany_loopback4))
> +		return;
> +	if (inany_equals(addr, &inany_loopback6))
> +		return;

Since you need these explicit checks anyway, there's not much point to
the dummy entries you created - you could exit on these addresses
before even looking up the table.

> +	if (inany_equals(addr, &inany_from_v4(c->ip4.guest_gw)))
> +		return;
> +	if (inany_equals(addr, (union inany_addr *)&c->ip6.guest_gw))
> +		return;

Again, guest addresses, so they don't make sense here.

> +
> +	if (inany_v4(addr))
> +		arp_announce(c, inany_v4(addr), e->mac);
> +	else
> +		ndp_send_unsolicited_na(c, &addr->a6);

Oh...  this is a guest side operation but we have host side addresses.
So we need to apply a nat_inbound() first.  So we might need to filter
on that retranslated address instead.

>  }
>  
>  /**
> diff --git a/ndp.c b/ndp.c
> index 588b48f..d7f64a3 100644
> --- a/ndp.c
> +++ b/ndp.c
> @@ -218,6 +218,16 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst,
>  	ndp_send(c, dst, &na, sizeof(na));
>  }
>  
> +/**
> + * ndp_send_unsolicited_na() - Send unsolicited NA
> + * @c:         Execution context
> + * @addr:      IPv6 address to advertise
> + */
> +void ndp_send_unsolicited_na(const struct ctx *c, const struct in6_addr *addr)


Maybe just 'ndp_unsolicited_na', by analogy with ndp_na() itself.

> +{
> +	ndp_na(c, &in6addr_ll_all_nodes, addr);
> +}
> +
>  /**
>   * ndp_ra() - Send an NDP Router Advertisement (RA) message
>   * @c:		Execution context
> diff --git a/ndp.h b/ndp.h
> index 781ea86..320009c 100644
> --- a/ndp.h
> +++ b/ndp.h
> @@ -12,5 +12,6 @@ int ndp(const struct ctx *c, const struct in6_addr *saddr,
>  	struct iov_tail *data);
>  void ndp_timer(const struct ctx *c, const struct timespec *now);
>  void ndp_send_init_req(const struct ctx *c);
> +void ndp_send_unsolicited_na(const struct ctx *c, const struct in6_addr *addr);
>  
>  #endif /* NDP_H */
> -- 
> 2.50.1
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]