On Thu, Oct 02, 2025 at 08:34:06PM -0400, Jon Maloy wrote: > ARP announcements and unsolicited NAs should be handled with caution > because of the risk of malignant users emitting them to disturb > network communication. > > There is however one case we where we know it is legitimate > and safe for us to send out such messages: The one time we switch > from using ctx->own_tap_mac to a MAC address received via the > recently added neigbour subscription function. Later changes to > the MAC address of a host in an existing entry cannot be fully > trusted, so we abstain from doing it in such cases. > > When sending this type of messages, we notice that the guest accepts > the update, but shortly later asks for a confirmation in the form of > a regular ARP/NS request. This is responded to with the new value, > and we have exactly the effect we wanted. > > This commit adds this functionality. > > Signed-off-by: Jon Maloy > > --- > v10: -Made small changes based of feedback from David G. > v11: -Moved from 'Gratuitous ARP reply' model to 'ARP Announcement' > model. > v12: -Excluding loopback and default GW addresses from the ARP/NA > announcement to be sent to the guest > --- > arp.c | 42 ++++++++++++++++++++++++++++++++++++++++++ > arp.h | 2 ++ > fwd.c | 16 ++++++++++++++++ > ndp.c | 10 ++++++++++ > ndp.h | 1 + > 5 files changed, 71 insertions(+) > > diff --git a/arp.c b/arp.c > index ad088b1..b08780f 100644 > --- a/arp.c > +++ b/arp.c > @@ -146,3 +146,45 @@ void arp_send_init_req(const struct ctx *c) > debug("Sending initial ARP request for guest MAC address"); > tap_send_single(c, &req, sizeof(req)); > } > + > +/** > + * arp_announce() - Send an ARP announcement for an IPv4 host > + * @c: Execution context > + * @ip: IPv4 address we announce as owned by @mac > + * @mac: MAC address to advertise for @ip > + */ > +void arp_announce(const struct ctx *c, struct in_addr *ip, > + const unsigned char *mac) > +{ > + char ip_str[INET_ADDRSTRLEN]; > + char mac_str[ETH_ADDRSTRLEN]; > + struct { > + struct ethhdr eh; > + struct arphdr ah; > + struct arpmsg am; > + } __attribute__((__packed__)) annc; > + > + /* Ethernet header */ > + annc.eh.h_proto = htons(ETH_P_ARP); > + memcpy(annc.eh.h_dest, MAC_BROADCAST, sizeof(annc.eh.h_dest)); > + memcpy(annc.eh.h_source, mac, sizeof(annc.eh.h_source)); > + > + /* ARP header */ > + annc.ah.ar_op = htons(ARPOP_REQUEST); > + annc.ah.ar_hrd = htons(ARPHRD_ETHER); > + annc.ah.ar_pro = htons(ETH_P_IP); > + annc.ah.ar_hln = ETH_ALEN; > + annc.ah.ar_pln = 4; > + > + /* ARP message */ > + memcpy(annc.am.sha, mac, sizeof(annc.am.sha)); > + memcpy(annc.am.sip, ip, sizeof(annc.am.sip)); > + memcpy(annc.am.tha, MAC_BROADCAST, sizeof(annc.am.tha)); > + memcpy(annc.am.tip, ip, sizeof(annc.am.tip)); As noted in several earlier revisions, having sip == tip (but with different mac addresses) looks odd. Is that what the RFCs say to do for ARP announcements? > + inet_ntop(AF_INET, ip, ip_str, sizeof(ip_str)); > + eth_ntop(mac, mac_str, sizeof(mac_str)); > + debug("Announcing ARP for %s / %s", ip_str, mac_str); > + > + tap_send_single(c, &annc, sizeof(annc)); > +} > diff --git a/arp.h b/arp.h > index d5ad0e1..4862e90 100644 > --- a/arp.h > +++ b/arp.h > @@ -22,5 +22,7 @@ struct arpmsg { > > int arp(const struct ctx *c, struct iov_tail *data); > void arp_send_init_req(const struct ctx *c); > +void arp_announce(const struct ctx *c, struct in_addr *ip, > + const unsigned char *mac); > > #endif /* ARP_H */ > diff --git a/fwd.c b/fwd.c > index c34bb1c..ade97c8 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -26,6 +26,8 @@ > #include "passt.h" > #include "lineread.h" > #include "flow_table.h" > +#include "arp.h" > +#include "ndp.h" > > /* Empheral port range: values from RFC 6335 */ > static in_port_t fwd_ephemeral_min = (1 << 15) + (1 << 14); > @@ -140,6 +142,20 @@ void fwd_neigh_table_update(const struct ctx *c, const union inany_addr *addr, > > memcpy(&e->addr, addr, sizeof(*addr)); > memcpy(e->mac, mac, ETH_ALEN); > + > + if (inany_equals(addr, &inany_loopback4)) > + return; > + if (inany_equals(addr, &inany_loopback6)) > + return; Since you need these explicit checks anyway, there's not much point to the dummy entries you created - you could exit on these addresses before even looking up the table. > + if (inany_equals(addr, &inany_from_v4(c->ip4.guest_gw))) > + return; > + if (inany_equals(addr, (union inany_addr *)&c->ip6.guest_gw)) > + return; Again, guest addresses, so they don't make sense here. > + > + if (inany_v4(addr)) > + arp_announce(c, inany_v4(addr), e->mac); > + else > + ndp_send_unsolicited_na(c, &addr->a6); Oh... this is a guest side operation but we have host side addresses. So we need to apply a nat_inbound() first. So we might need to filter on that retranslated address instead. > } > > /** > diff --git a/ndp.c b/ndp.c > index 588b48f..d7f64a3 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -218,6 +218,16 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst, > ndp_send(c, dst, &na, sizeof(na)); > } > > +/** > + * ndp_send_unsolicited_na() - Send unsolicited NA > + * @c: Execution context > + * @addr: IPv6 address to advertise > + */ > +void ndp_send_unsolicited_na(const struct ctx *c, const struct in6_addr *addr) Maybe just 'ndp_unsolicited_na', by analogy with ndp_na() itself. > +{ > + ndp_na(c, &in6addr_ll_all_nodes, addr); > +} > + > /** > * ndp_ra() - Send an NDP Router Advertisement (RA) message > * @c: Execution context > diff --git a/ndp.h b/ndp.h > index 781ea86..320009c 100644 > --- a/ndp.h > +++ b/ndp.h > @@ -12,5 +12,6 @@ int ndp(const struct ctx *c, const struct in6_addr *saddr, > struct iov_tail *data); > void ndp_timer(const struct ctx *c, const struct timespec *now); > void ndp_send_init_req(const struct ctx *c); > +void ndp_send_unsolicited_na(const struct ctx *c, const struct in6_addr *addr); > > #endif /* NDP_H */ > -- > 2.50.1 > -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson