From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202510 header.b=iSJxOvmW; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id BE8A05A0276 for ; Wed, 03 Dec 2025 07:30:07 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202510; t=1764743403; bh=7EMYBXeXYqdCgNt346iqOCA/fCqSPq1/m+Ojtz1x+yM=; h=Date:From:To:Subject:References:In-Reply-To:From; b=iSJxOvmWFQjwkc5B4j+KSyflkoaDMiQlcX7haJ/WRZHq8oAAQcxDwxKKV/r5blQ4G 13ZgSBXf4h8RWeMEv0zlkkrApetSviuiV//gRHuH+Ni9FwPPecoyd4AQkFrhYsU6sI pw33nRZN4r1oK0vtvddHYGuK/liOESN/Rixpavvx2drRG4Z2EeyUZobYgTEdj9CRqG FiRvFg7YpP0ueUVr7fv9OUPMsE6MzIJIt9b7syvrgPkOd5Bt4rvHktAxjIzML+7Rpy qt+IH6dbNuI1LaRZw3UPYAAYFAyKMvZJZyAFrlwKStYuDUt7GsFgHFBlZMDTzH5ACY D/Ffgm7DdAU2w== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dLnn75WDGz4wGs; Wed, 03 Dec 2025 17:30:03 +1100 (AEDT) Date: Wed, 3 Dec 2025 15:41:36 +1100 From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: Re: [PATCH v5 12/15] tcp, udp: Bind outbound listening sockets by interface instead of address Message-ID: References: <20251202040215.2351792-1-david@gibson.dropbear.id.au> <20251202040215.2351792-13-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="9rMsmpdCY4rXSGX7" Content-Disposition: inline In-Reply-To: <20251202040215.2351792-13-david@gibson.dropbear.id.au> Message-ID-Hash: BOVEN3ZDIW2CLZIWDKBQGJNC6ONOI7EH X-Message-ID-Hash: BOVEN3ZDIW2CLZIWDKBQGJNC6ONOI7EH X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --9rMsmpdCY4rXSGX7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Sorry, I realised the warning I add here isn't correct in a couple of ways. I'll respin shortly, but patches 1..11 should still be fine to review. On Tue, Dec 02, 2025 at 03:02:12PM +1100, David Gibson wrote: > Currently, outbound forwards (-T, -U) are handled by sockets bound to the > loopback address. Typically we create two sockets, one for 127.0.0.1 and > one for ::1. >=20 > This has some disadvantages: > * The guest can't connect via 127.0.0.0/8 addresses other than 127.0.0.1 > * We can't use dual-stack sockets, we have to have separate sockets for > IPv4 and IPv6. >=20 > The restriction exists for a reason though. If the guest has any > interfaces other than pasta (e.g. a VPN tunnel) external hosts could reach > the host via the forwards. Especially combined with -T auto / -U auto th= is > would make it very easy to make a mistake with nasty security implication= s. >=20 > We can achieve this a different way, however. Don't bind to a specific > address, but _do_ use SO_BINDTODEVICE to restrict the sockets to the "lo" > interface. We fall back to the old behaviour for older kernels where > SO_BINDTODEVICE is not available unprivileged. >=20 > Note that although traffic to a local but non-loopback address is passed > over the 'lo' interface (as seen by netfilter and dumpcap), it doesn't > count as attached to that interface for the purposes of SO_BINDTODEVICE > (information from the routing table overrides the "physical" interface). > So, this change doesn't help for bug 100. >=20 > It's also not a complete fix for bug 113, it does however: > * Get us a step closer to fixing bug 113 > * Slightly simplify the code > * Make things a bit easier to allow more flexible binding on the guest in > in future >=20 > Link: https://bugs.passt.top/show_bug.cgi?id=3D113 >=20 > Signed-off-by: David Gibson > --- > conf.c | 6 ++++++ > pif.c | 6 ------ > tcp.c | 5 +++++ > udp.c | 30 +++++++++++++++++++++++------- > 4 files changed, 34 insertions(+), 13 deletions(-) >=20 > diff --git a/conf.c b/conf.c > index 6bd9717b..02a4b65a 100644 > --- a/conf.c > +++ b/conf.c > @@ -235,6 +235,12 @@ static void conf_ports(const struct ctx *c, char opt= name, const char *optarg, > if (c->mode !=3D MODE_PASTA) > die("'auto' port forwarding is only allowed for pasta"); > =20 > + if ((optname =3D=3D 'T' || optname =3D=3D 'U') && c->no_bindtodevice) { > + warn( > +"'-%c auto' enabled without unprivileged SO_BINDTODEVICE", optname); > + warn( > +"Forwarding from addresses other than 127.0.0.1 will not work"); > + } > fwd->mode =3D FWD_AUTO; > return; > } > diff --git a/pif.c b/pif.c > index 85904f35..db447b4f 100644 > --- a/pif.c > +++ b/pif.c > @@ -81,12 +81,6 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type t= ype, uint8_t pif, > =20 > ASSERT(pif_is_socket(pif)); > =20 > - if (pif =3D=3D PIF_SPLICE) { > - /* Sanity checks */ > - ASSERT(!ifname); > - ASSERT(addr && inany_is_loopback(addr)); > - } > - > if (!addr) { > ref.fd =3D sock_l4_dualstack(c, type, port, ifname); > } else { > diff --git a/tcp.c b/tcp.c > index 2abb8be4..aacc5b20 100644 > --- a/tcp.c > +++ b/tcp.c > @@ -2627,6 +2627,11 @@ static void tcp_ns_sock_init(const struct ctx *c, = in_port_t port) > { > ASSERT(!c->no_tcp); > =20 > + if (!c->no_bindtodevice) { > + tcp_sock_init(c, PIF_SPLICE, NULL, "lo", port); > + return; > + } > + > if (c->ifi4) > tcp_sock_init_one(c, PIF_SPLICE, &inany_loopback4, NULL, port); > if (c->ifi6) > diff --git a/udp.c b/udp.c > index 3d097fbb..4b625b78 100644 > --- a/udp.c > +++ b/udp.c > @@ -1182,6 +1182,26 @@ static void udp_splice_iov_init(void) > } > } > =20 > +/** > + * udp_ns_sock_init() - Init socket to listen for spliced outbound conne= ctions > + * @c: Execution context > + * @port: Port, host order > + */ > +static void udp_ns_sock_init(const struct ctx *c, in_port_t port) > +{ > + ASSERT(!c->no_udp); > + > + if (!c->no_bindtodevice) { > + udp_sock_init(c, PIF_SPLICE, NULL, "lo", port); > + return; > + } > + > + if (c->ifi4) > + udp_sock_init(c, PIF_SPLICE, &inany_loopback4, NULL, port); > + if (c->ifi6) > + udp_sock_init(c, PIF_SPLICE, &inany_loopback6, NULL, port); > +} > + > /** > * udp_port_rebind() - Rebind ports to match forward maps > * @c: Execution context > @@ -1213,14 +1233,10 @@ static void udp_port_rebind(struct ctx *c, bool o= utbound) > =20 > if ((c->ifi4 && socks[V4][port] =3D=3D -1) || > (c->ifi6 && socks[V6][port] =3D=3D -1)) { > - if (outbound) { > - udp_sock_init(c, PIF_SPLICE, > - &inany_loopback4, NULL, port); > - udp_sock_init(c, PIF_SPLICE, > - &inany_loopback6, NULL, port); > - } else { > + if (outbound) > + udp_ns_sock_init(c, port); > + else > udp_sock_init(c, PIF_HOST, NULL, NULL, port); > - } > } > } > } > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --9rMsmpdCY4rXSGX7 Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmkvv3EACgkQzQJF27ox 2GfW/A/9GTsz9znLHu0uga7Cw0W4QQqdfE4iAhu4/v5amvPWMzZK+Xd+WyYAZGV1 +auE9+kiEkbem4oU8FZqpgIZRyhRJRDFMouSpS2yIqMsYmBr+N1R9ffzVUhs0i5J Z2TteaIeUnc801DBFUTkEgfzSaVO6/9RBNGhclXb1SFUBcpsJf4hGttLIbDEH7Cy JcmGkmy7yIYY5xd6fPYcger7aC1N/TRuUe8ldfKFxsvAF0CFaKM9j3KvH0uyb2Lg Y8BAwTObAy8PZrxIcU28C1ZfQCjCqmwvie0jN7UqVEjm5gVovOy1i6UAVTttL3y5 NysfIeFSTO242H9h47i8xp//wTg3QBDxWvXCKDwbiIiTb1bSX9AnQ+sBv+cnGbDd +c87l4tJo2xXzvELcaokPMwD5FGjTmDP9pZFWufVH6J+q5rysvdEpBOiIsFkLNkN 7/5oyeeGzr63H6gh+y4sNH2OKZziVLe2mcTSpH1bUdioa+9jtoO1eKxSv+w/HMYv OTRCV5Hzbvw5+M+Vj4IBeCY+r5PTYg4So/LGw+F6QdA2iGAoSypRQCjcVMVc6m8T IGRsfmWUkFqPFV+mLHJFM6gk8a1jR7Z4stQ/N1pDdePutu9Mx1BErflzWM1KS9uM ddz3kxEmwz4aXDU9nqC4TRBNnFbnBDfDrM6S/+6R3kIaI6Nk87s= =Ubfz -----END PGP SIGNATURE----- --9rMsmpdCY4rXSGX7--