From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202510 header.b=BwT6Zmr/; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 32E625A061C for ; Tue, 14 Oct 2025 07:04:51 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202510; t=1760418288; bh=2fh9N7uBOZ9+FA6ijewQzb9As3lEP3kyMI3LxxIXF5Q=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BwT6Zmr/GB6GK5rW/wg9iX6xu8XfgFglxO/0niYdIlKYIeSx3YazfFdWdL8nYQA40 XhHJyJe0Z/FL/t7AuWqfdQDj5B1EzOIkwScCBPFsFpHiKc75dalwufQ9WwAH/8yfzj 4Zpo8tsTEE4XIr61PMZiNoY1JTsm4qNHcMyYVbCfpd/yaW4ZI5jxUTaet1YhkH/7Sp Bg0CfRbPPs80/y+jRiJzVWJQF/v/eTjywA1nlDPiPWOUIBVj+n40gFBANkHn87Px/Q C+zC/OD5HXX6pcSX4LPpRS/ci4ksBRHxKIiUQlZLzp3SPuYtA5kyjxWd/DI6jMvF/H WNiFEnjlWp6Fg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4cm2Fr1FLzz4wCm; Tue, 14 Oct 2025 16:04:48 +1100 (AEDT) Date: Tue, 14 Oct 2025 15:57:48 +1100 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v13 04/10] arp/ndp: respond with true MAC address of LAN local remote hosts Message-ID: References: <20251012193337.616835-1-jmaloy@redhat.com> <20251012193337.616835-5-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hFIWm9DFETNXwhFx" Content-Disposition: inline In-Reply-To: <20251012193337.616835-5-jmaloy@redhat.com> Message-ID-Hash: Q3XS6WJXVGVUT55MLOE5EMSX2755AFIG X-Message-ID-Hash: Q3XS6WJXVGVUT55MLOE5EMSX2755AFIG X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --hFIWm9DFETNXwhFx Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Oct 12, 2025 at 03:33:31PM -0400, Jon Maloy wrote: > When we receive an ARP request or NDP neigbour solicitation over > the tap interface for a host on the local network segment attached > to the template interface, we respond with that host's real MAC > address, if available. >=20 > Signed-off-by: Jon Maloy >=20 > --- > v3: - Added helper function to find out if a remote ip address is subject > to NAT. This filters out local host addresses which should be > presented with the passt/pasta local MAC address 9a:55:9a:55:9a:55 = even > though it is on the local segment. > - Adapted to the change in nl_mac_get() function, so that we now cons= ider > only the template interface when checking the ARP/NDP table. > v4: - Moved NAT check into the function nat_outbound() to obtain more > precise criteria for when NAT is used. We may in theory > have NAT even if original and translated addresses are equal, and > we want to catch this case. > - I chose to keep the wrapper funtion inany_nat(), but moved it to > fwd.h/fwd.c and renamed it to fwd_inany_nat(). > v5: - Simplified criteria for when we do ARP/NDP lookup. Now, we > just try with the potentially translated address after an > attempted NAT check. > - Using the new ARP/NDP cache table instead of using netlink > directly. > v6: - Fixes after feedback from David: > - Renamed nat_outbound() to fwd_nat_outbound() > - Eliminated unnecessary temporary variable in arp.c::arp() > v12: - Some minor changes after feedback from Stefano > v13: - Removed call to nat_outbound() before MAC resolution, as > we are now handling guest-side visible addresses only. > --- > arp.c | 8 ++++++-- > inany.c | 1 + > ndp.c | 4 ++++ > 3 files changed, 11 insertions(+), 2 deletions(-) >=20 > diff --git a/arp.c b/arp.c > index ad088b1..b4a686f 100644 > --- a/arp.c > +++ b/arp.c > @@ -69,6 +69,7 @@ static bool ignore_arp(const struct ctx *c, > */ > int arp(const struct ctx *c, struct iov_tail *data) > { > + union inany_addr tgt; > struct { > struct ethhdr eh; > struct arphdr ah; > @@ -102,8 +103,11 @@ int arp(const struct ctx *c, struct iov_tail *data) > resp.ah.ar_hln =3D ah->ar_hln; > resp.ah.ar_pln =3D ah->ar_pln; > =20 > - /* ARP message */ > - memcpy(resp.am.sha, c->our_tap_mac, sizeof(resp.am.sha)); > + /* MAC address to return in ARP message */ > + inany_from_af(&tgt, AF_INET, am->tip); > + fwd_neigh_mac_get(c, &tgt, resp.am.sha); > + > + /* Rest of ARP message */ > memcpy(resp.am.sip, am->tip, sizeof(resp.am.sip)); > memcpy(resp.am.tha, am->sha, sizeof(resp.am.tha)); > memcpy(resp.am.tip, am->sip, sizeof(resp.am.tip)); > diff --git a/inany.c b/inany.c > index 65a39f9..7680439 100644 > --- a/inany.c > +++ b/inany.c > @@ -16,6 +16,7 @@ > #include "ip.h" > #include "siphash.h" > #include "inany.h" > +#include "fwd.h" > =20 > const union inany_addr inany_loopback4 =3D INANY_INIT4(IN4ADDR_LOOPBACK_= INIT); > const union inany_addr inany_any4 =3D INANY_INIT4(IN4ADDR_ANY_INIT); > diff --git a/ndp.c b/ndp.c > index 588b48f..7cc6e48 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -196,6 +196,7 @@ static void ndp_send(const struct ctx *c, const struc= t in6_addr *dst, > static void ndp_na(const struct ctx *c, const struct in6_addr *dst, > const struct in6_addr *addr) > { > + union inany_addr tgt; > struct ndp_na na =3D { > .ih =3D { > .icmp6_type =3D NA, > @@ -215,6 +216,9 @@ static void ndp_na(const struct ctx *c, const struct = in6_addr *dst, > =20 > memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN); The line above is obsoleted by the additions below isn't it? > + inany_from_af(&tgt, AF_INET6, addr); > + fwd_neigh_mac_get(c, &tgt, na.target_l2_addr.mac); > + > ndp_send(c, dst, &na, sizeof(na)); > } > =20 > --=20 > 2.50.1 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --hFIWm9DFETNXwhFx Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmjt2EwACgkQzQJF27ox 2GcTDBAAoTHTKRXwyB7R5t2BwYwNuIARD68Ia3aMz1+kLkGu59rX0/YuqVCt926M EH4Bqwz7tMqEN1+pkb2rqexiVz59uotfWiEB6IZF45VCs4gg3nJrerLBO79IlpCh R1rCXThY9U9RK6mVKWqh/JzThn8cLHGELGhhWEu1t2m1SDYxeFsbhz29fw/15L64 Bf2L8dB8UF3q3p0CTz1pyaZ1rR//RMUVPWUDg6FDc9iEajAFqa9jt8D5VioLViev k0HAoxZu5EZw2gDPwy6dC33JxuBtcQgmUuaA4iKnM18sQ4Y+BJgJV1VpW4/bHYRw Pp7BfYF5CToPrjciKE5SyTKvv6keVvquGr3hDHxVdnQwdjjzZlGjIhGPI8G6bJgL 9rK0Y39QZm5hud7wZWkG4Q8JRIjWGhCRxGoWUt4MoOv+cPEgE08uUB1dFICJCgh5 XMBrMEM7unEdBIYz/mlHiqw0xlCspo/WznbUYeVDk/wDAJtK9nfflKwcNI5At7ri Vtq1jBFglH6s5qGlLHnkpw6NZW9Pym2lMTaY/UJkJTR7z5PMhtN7Y4wxxQCOon5e izirpuklFPIYIqXGVtMw3Lxp+5VwzrNCAoeuazgq1tKgOkr/zJWUzPh4hh1dGj/8 lEWZAFtdO40mXI7iFF2XdPBGG6LXCjDQ+0LQKYCOBZeLll7H/Lo= =DTZ/ -----END PGP SIGNATURE----- --hFIWm9DFETNXwhFx--