From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=pjfCjlK1; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 6827D5A065B for ; Thu, 18 Dec 2025 06:02:35 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1766034152; bh=OvkDADOkqB0cdbAd1TunyDlRvGz9b+43Yx/7rhCBnGc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=pjfCjlK1ZZ+pi1R2OzOu5EUPY0Tq4gJDx0uUuwsfYgS0OZonU8in07PDKFQDmhKW5 v93MyoLtD20N/1hHseTNtNbk5zqNQ1sSfCLurpQfeORx3N1+asXqILCeNWW1dJT+u+ S+Vf4/iJkFziG3fAKpo4MuPCm5k3WKO8DSJQq47A0Q1OYVSaizmkIDwS03DLQ/XtG0 P0IaPHmanU8BCHdmwZvnO+D+fouMLuoMX2zx+69N0eD+iI9D8ovjYCEr5cOMFLP3sk 0oG7ND3QsXywUlEajf72Q3hyJxpqFO8GMpeesJ/bIjM+PyoGBsUsldVjdJcTgGLn1d ZhnQ6PfXa5SiQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dWz7D6W1Dz4wGr; Thu, 18 Dec 2025 16:02:32 +1100 (AEDT) Date: Thu, 18 Dec 2025 15:53:56 +1100 From: David Gibson To: Jon Maloy Subject: Re: [RFC 10/12] netlink: Add host-side route monitoring and propagation Message-ID: References: <20251215015441.887736-1-jmaloy@redhat.com> <20251215015441.887736-11-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="TwORsntXjPIIk6KP" Content-Disposition: inline In-Reply-To: <20251215015441.887736-11-jmaloy@redhat.com> Message-ID-Hash: KUE6E5RTGTFDN52ZV6FCQTNURHAPTG4J X-Message-ID-Hash: KUE6E5RTGTFDN52ZV6FCQTNURHAPTG4J X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --TwORsntXjPIIk6KP Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Dec 14, 2025 at 08:54:39PM -0500, Jon Maloy wrote: > We extend host-side netlink monitoring to also track default route > changes on the template interface and propagate them to the namespace. >=20 > - Subscribe to RTMGRP_IPV4_ROUTE and RTMGRP_IPV6_ROUTE groups on the > host-side netlink socket > - Handle RTM_NEWROUTE/RTM_DELROUTE events for default routes. > - Support late binding via routes: if no template interface is bound > yet, adopt the interface in question when a default route appears > on it. > - When a default route is added, set guest_gw/our_tap_addr and > propagate the route to the namespace via nl_route_set_def() > - When a default route is removed, clear guest_gw/our_tap_addr >=20 > Signed-off-by: Jon Maloy > --- > netlink.c | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- > 1 file changed, 97 insertions(+), 3 deletions(-) >=20 > diff --git a/netlink.c b/netlink.c > index 583ada8..d049239 100644 > --- a/netlink.c > +++ b/netlink.c > @@ -199,7 +199,7 @@ static bool nl_addr6_add(struct ctx *c, const struct = in6_addr *addr, > idx =3D c->ip6.addr_count++; > c->ip6.addrs[idx].addr =3D *addr; > c->ip6.addrs[idx].prefix_len =3D prefix_len; > - c->ip6.addrs[idxyes].permanent =3D 0; > + c->ip6.addrs[idx].permanent =3D 0; > return true; > } > =20 > @@ -254,7 +254,7 @@ static bool nl_addr6_del(struct ctx *c, const struct = in6_addr *addr) > } > =20 > /** > - * nl_linkaddr_host_msg_read() - Handle host-side link/addr changes > + * nl_linkaddr_host_msg_read() - Handle host-side link/addr/route changes > * @c: Execution context > * @nh: Netlink message header > * > @@ -420,6 +420,99 @@ static void nl_linkaddr_host_msg_read(struct ctx *c,= const struct nlmsghdr *nh) > } > return; > } > + > + if (nh->nlmsg_type =3D=3D RTM_NEWROUTE || nh->nlmsg_type =3D=3D RTM_DEL= ROUTE) { There's enough in ths block it's probably worth splitting out into a functi= on. > + bool is_new =3D (nh->nlmsg_type =3D=3D RTM_NEWROUTE); > + const struct rtmsg *rtm =3D NLMSG_DATA(nh); > + struct rtattr *rta =3D RTM_RTA(rtm); > + size_t na =3D RTM_PAYLOAD(nh); > + unsigned int template_ifi; > + char ifname[IFNAMSIZ]; > + unsigned int oif =3D 0; > + void *gw =3D NULL; > + bool is_default; > + bool is_match; > + bool unbound; > + > + /* Only interested in default routes */ I'm not convinced this is enough. Just as we have to copy non-default routes in nl_route_dup(), I think we're going to need to keep them updated here. Speaking of which, it's ugly to have nl_route_dup() for the initial route copy, then an entirely different path for subsequent updates. Similar to the neighbour table, I think it should be possible to unify these by setting up the handler, then forcing an enumeration of the existing routes. > + if (rtm->rtm_dst_len !=3D 0) > + return; > + > + for (; RTA_OK(rta, na); rta =3D RTA_NEXT(rta, na)) { > + if (rta->rta_type =3D=3D RTA_GATEWAY) > + gw =3D RTA_DATA(rta); > + else if (rta->rta_type =3D=3D RTA_OIF) > + oif =3D *(unsigned int *)RTA_DATA(rta); > + } > + > + if (!gw || !oif) > + return; > + > + /* Get interface name for late binding check */ > + if (!if_indextoname(oif, ifname)) > + return; > + > + /* Check for late binding conditions */ > + is_default =3D !strcmp(c->pasta_ifn, pasta_default_ifn); > + is_match =3D !strcmp(ifname, c->pasta_ifn); Again, checking by interface name doesn't seem right. > + if (rtm->rtm_family =3D=3D AF_INET) > + template_ifi =3D c->ifi4; > + else if (rtm->rtm_family =3D=3D AF_INET6) > + template_ifi =3D c->ifi6; > + else > + return; > + > + unbound =3D (rtm->rtm_family =3D=3D AF_INET) ? > + (int)c->ifi4 <=3D 0 : (int)c->ifi6 <=3D 0; Can some of this filtering logic be shared with the address handling path? > + > + if (unbound && (is_default || is_match)) { > + debug("Late binding (route): using %s as %s template", > + ifname, > + rtm->rtm_family =3D=3D AF_INET ? "IPv4" : "IPv6"); > + > + if (rtm->rtm_family =3D=3D AF_INET) { > + c->ifi4 =3D oif; > + template_ifi =3D c->ifi4; > + } else { > + c->ifi6 =3D oif; > + template_ifi =3D c->ifi6; > + } > + > + if (is_default) > + snprintf(c->pasta_ifn, sizeof(c->pasta_ifn), > + "%s", ifname); > + } > + > + if (oif !=3D template_ifi) > + return; > + > + if (rtm->rtm_family =3D=3D AF_INET) { > + char buf[INET_ADDRSTRLEN]; > + > + if (!is_new) { > + c->ip4.guest_gw =3D (struct in_addr){ 0 }; > + c->ip4.our_tap_addr =3D (struct in_addr){ 0 }; > + return; This doesn't seem right. It will delete our gw information when *any* default route is removed, even if another one still exists. > + } > + c->ip4.guest_gw =3D *(struct in_addr *)gw; > + c->ip4.our_tap_addr =3D c->ip4.guest_gw; > + nl_route_set_def(nl_sock_ns, c->pasta_ifi, AF_INET, gw); We should only touch the guest if c->pasta_conf_ns. > + inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf)); > + debug("Set IPv4 default route via %s", buf); > + } else if (rtm->rtm_family =3D=3D AF_INET6) { > + char buf[INET6_ADDRSTRLEN]; > + > + if (!is_new) { > + c->ip6.guest_gw =3D (struct in6_addr){ 0 }; > + return; > + } > + c->ip6.guest_gw =3D *(struct in6_addr *)gw; > + nl_route_set_def(nl_sock_ns, c->pasta_ifi, AF_INET6, gw); > + inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf)); > + debug("Set IPv6 default route via %s", buf); > + } > + } > } > =20 > /** > @@ -676,7 +769,8 @@ static int nl_linkaddr_init_do(void *arg) > static int nl_linkaddr_host_init_do(void *arg) > { > struct sockaddr_nl addr =3D { .nl_family =3D AF_NETLINK, > - .nl_groups =3D RTMGRP_LINK | RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR }; > + .nl_groups =3D RTMGRP_LINK | RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR | > + RTMGRP_IPV4_ROUTE | RTMGRP_IPV6_ROUTE }; > =20 > (void)arg; > =20 > --=20 > 2.51.1 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --TwORsntXjPIIk6KP Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmlDiOMACgkQzQJF27ox 2GclDhAAgX29DLz7gAEftfB1pZ9TEZUSyE+q0Kk8L1VBrwBV+nFNI1U+VaVw9xf1 YXAcKR6p494/G4JbF39rPXh2OLvmfa7uTOh4tiICwWtUyw6mbCB4zNgYo0DW3fQY S3Ze+X+SVlvSONoQIQQZ5YTB6orZzn6xWd+eNdEClx731E/eB1P8QhHUgQB+Mtat iIW7rgD/KttHYaFWD/LVY7xuwTTILznXTVVlZHPPt+aTR/WingX8ZfvlOIFIOQOs XAeVvTgob9LrQDrJyivktqxGVv7MN4rhrFXkXqVFpEpzT0uVdb7modJlWjHJihMF kzrRUheFWlDtFfc53Umnc0zS6PiXVG4l/KBzBJ2pJLRlWIneJeG0uKltrls6coRo 6g2m3CF/Z2bTz5lAY/JXGsy/9e/SVPfKc2JxVq0VB2el01Xc005LOSp0dUf5bgDX ZIvKBYyKhrpZvI8V1UdrKNaLwKHmn6WiRXCdaZ891kt5fshMPJFyzsVD0HQ8bwL4 DQ+CVZFcehJ5NLozS6h70Bd9jmGIneAAu4Hiy4N/AdM5pJ527krT7ORZh4GaAf1G 6h4Uu1EcAEWq1sjt99hdMMf2sR69tRHNeixF78x+o99JFIhgOSr2qIwlp5OyGFGk No7abA3jObH8zsHs43PzYxuLqNFuEWqhLXTVIaMtB//sR7mr3dM= =haqJ -----END PGP SIGNATURE----- --TwORsntXjPIIk6KP--