Re: [PATCH v5 13/13] netlink: Add host-side monitoring for late template interface binding

[David Gibson <david@gibson.dropbear.id.au>]

[-- Attachment #1: Type: text/plain, Size: 17215 bytes --]

On Sun, Feb 22, 2026 at 12:44:45PM -0500, Jon Maloy wrote:
> When pasta starts without an active template interface (e.g., WiFi
> not yet connected), it falls back to local mode. This change adds
> support for late binding: when the template interface gets an address
> or a default route later, pasta detects this via a host-side netlink
> socket and propagates the configuration to the namespace.
> 
> Late binding occurs when:
> - A specific interface is given via -I and later gets an address/route.
> - No interface is specified, and any interface gets an address/route.
>   In the latter case the first discovered interface is adopted as
>   template.
> 
> In this commit we add a host-side netlink socket to monitor link,
> address, and route changes on the template interface. We add a
> corresponding nl_linkaddr_host_handler() function to process such
> events and propagate the changes to the namespace.
> 
> Signed-off-by: Jon Maloy <jmaloy@redhat.com>

This is a big one, since you're already respinning based on my earlier
comments, I'm going to defer review until the next spin.

> ---
>  epoll_type.h |   2 +
>  isolation.c  |   5 +
>  netlink.c    | 397 ++++++++++++++++++++++++++++++++++++++++++++++++++-
>  netlink.h    |   3 +
>  passt.c      |   5 +
>  5 files changed, 407 insertions(+), 5 deletions(-)
> 
> diff --git a/epoll_type.h b/epoll_type.h
> index a90ffb6..cd17a64 100644
> --- a/epoll_type.h
> +++ b/epoll_type.h
> @@ -46,6 +46,8 @@ enum epoll_type {
>  	EPOLL_TYPE_REPAIR,
>  	/* Netlink neighbour subscription socket */
>  	EPOLL_TYPE_NL_NEIGH,
> +	/* Netlink link/address subscription socket for late binding */
> +	EPOLL_TYPE_NL_LINKADDR_HOST,
>  
>  	EPOLL_NUM_TYPES,
>  };
> diff --git a/isolation.c b/isolation.c
> index b25f349..8087563 100644
> --- a/isolation.c
> +++ b/isolation.c
> @@ -356,6 +356,11 @@ int isolate_prefork(const struct ctx *c)
>  	if (c->mode == MODE_PASTA) {
>  		/* Keep CAP_SYS_ADMIN, so we can enter the netns */
>  		ns_caps |= BIT(CAP_SYS_ADMIN);
> +		/* Keep CAP_NET_ADMIN for dynamic interface configuration,
> +		 * so we can propagate addresses and routes when template
> +		 * interface comes up after start
> +		 */
> +		ns_caps |= BIT(CAP_NET_ADMIN);
>  		/* Keep CAP_NET_BIND_SERVICE, so we can splice
>  		 * outbound connections to low port numbers
>  		 */
> diff --git a/netlink.c b/netlink.c
> index 769cb23..a1790a4 100644
> --- a/netlink.c
> +++ b/netlink.c
> @@ -37,6 +37,14 @@
>  #include "ip.h"
>  #include "netlink.h"
>  #include "epoll_ctl.h"
> +#include "conf.h"
> +#include "arp.h"
> +#include "ndp.h"
> +#include "tap.h"
> +#include "fwd.h"
> +
> +/* Default namespace interface name */
> +extern const char *pasta_default_ifn;
>  
>  /* Same as RTA_NEXT() but for nexthops: RTNH_NEXT() doesn't take 'attrlen' */
>  #define RTNH_NEXT_AND_DEC(rtnh, attrlen)				\
> @@ -56,10 +64,14 @@
>  #define NLBUFSIZ 65536
>  
>  /* Socket in init, in target namespace, sequence (just needs to be monotonic) */
> -int nl_sock		 = -1;
> -int nl_sock_ns		 = -1;
> -static int nl_sock_neigh = -1;
> -static int nl_seq	 = 1;
> +int nl_sock			 = -1;
> +int nl_sock_ns			 = -1;
> +static int nl_sock_neigh	 = -1;
> +static int nl_sock_linkaddr_host = -1;
> +static int nl_seq		 = 1;
> +
> +static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
> +		       const void *addr, int prefix_len);
>  
>  /**
>   * nl_sock_init_do() - Set up netlink sockets in init or target namespace
> @@ -91,6 +103,329 @@ static int nl_sock_init_do(void *arg)
>  	return 0;
>  }
>  
> +/**
> + * nl_linkaddr_host_msg_read() - Handle host-side link/addr/route changes
> + * @c:		Execution context
> + * @nh:	Netlink message header
> + *
> + * Monitor template interface changes and propagate to namespace.
> + * Supports late binding: if no template was detected at startup,
> + * adopt the interface specified by -I when it gets an address.
> + */
> +static void nl_linkaddr_host_msg_read(struct ctx *c, const struct nlmsghdr *nh)
> +{
> +	if (nh->nlmsg_type == NLMSG_DONE || nh->nlmsg_type == NLMSG_ERROR)
> +		return;
> +
> +	if (nh->nlmsg_type == RTM_NEWADDR || nh->nlmsg_type == RTM_DELADDR) {
> +		bool is_new = (nh->nlmsg_type == RTM_NEWADDR);
> +		const struct ifaddrmsg *ifa = NLMSG_DATA(nh);
> +		char buf[INET6_ADDRSTRLEN];
> +		unsigned int template_ifi;
> +		union inany_addr inany;
> +		char ifname[IFNAMSIZ];
> +		struct rtattr *rta;
> +		void *addr = NULL;
> +		bool is_default;
> +		sa_family_t af;
> +		int prefix_len;
> +		bool is_match;
> +		bool unbound;
> +		size_t na;
> +		int rc;
> +
> +		if (!if_indextoname(ifa->ifa_index, ifname))
> +			snprintf(ifname, sizeof(ifname), "?");
> +
> +		/* Get template interface index */
> +		if (ifa->ifa_family == AF_INET)
> +			template_ifi = c->ifi4;
> +		else if (ifa->ifa_family == AF_INET6)
> +			template_ifi = c->ifi6;
> +		else
> +			return;
> +
> +		/* Check for late binding conditions */
> +		is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
> +		is_match = !strcmp(ifname, c->pasta_ifn);
> +		unbound = (ifa->ifa_family == AF_INET) ?
> +			  c->ifi4 <= 0 : c->ifi6 <= 0;
> +
> +		if (unbound && (is_default || is_match)) {
> +			debug("Late binding: using %s as %s template", ifname,
> +			      ifa->ifa_family == AF_INET ? "IPv4" : "IPv6");
> +
> +			if (ifa->ifa_family == AF_INET) {
> +				c->ifi4 = ifa->ifa_index;
> +				template_ifi = c->ifi4;
> +			} else {
> +				c->ifi6 = ifa->ifa_index;
> +				template_ifi = c->ifi6;
> +			}
> +
> +			if (is_default)
> +				snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
> +					 "%s", ifname);
> +		}
> +
> +		if (ifa->ifa_index != template_ifi)
> +			return;
> +
> +		rta = IFA_RTA(ifa);
> +		na = IFA_PAYLOAD(nh);
> +
> +		for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
> +			if (ifa->ifa_family == AF_INET &&
> +			    rta->rta_type == IFA_LOCAL) {
> +				addr = RTA_DATA(rta);
> +				break;
> +			} else if (ifa->ifa_family == AF_INET6 &&
> +				   rta->rta_type == IFA_ADDRESS) {
> +				addr = RTA_DATA(rta);
> +				break;
> +			}
> +		}
> +
> +		if (!addr) {
> +			info("No addr found in netlink linkaddr message");
> +			return;
> +		}
> +
> +		af = ifa->ifa_family;
> +		inany_from_af(&inany, af, addr);
> +		inet_ntop(af, addr, buf, sizeof(buf));
> +
> +		/* IPv4 prefix stored as IPv4-mapped, so add 96 bits */
> +		prefix_len = ifa->ifa_prefixlen + (af == AF_INET ? 96 : 0);
> +
> +		if (!is_new) {
> +			fwd_remove_addr(c, &inany);
> +			nl_addr_del(nl_sock_ns, c->pasta_ifi,
> +				    af, addr, ifa->ifa_prefixlen);
> +			return;
> +		}
> +
> +		rc = nl_addr_set(nl_sock_ns, c->pasta_ifi,
> +				 af, addr, ifa->ifa_prefixlen);
> +		if (rc < 0) {
> +			debug("Failed to add %s/%u to ns: %s",
> +			      buf, ifa->ifa_prefixlen, strerror_(-rc));
> +		} else {
> +			fwd_set_addr(c, &inany,
> +				     CONF_ADDR_HOST | CONF_ADDR_OBSERVED,
> +				     prefix_len);
> +			debug("Added %s/%u to namespace",
> +			      buf, ifa->ifa_prefixlen);
> +		}
> +		return;
> +	}
> +
> +	if (nh->nlmsg_type == RTM_NEWROUTE || nh->nlmsg_type == RTM_DELROUTE) {
> +		bool is_new = (nh->nlmsg_type == RTM_NEWROUTE);
> +		const struct rtmsg *rtm = NLMSG_DATA(nh);
> +		struct rtattr *rta = RTM_RTA(rtm);
> +		size_t na = RTM_PAYLOAD(nh);
> +		unsigned int template_ifi;
> +		char ifname[IFNAMSIZ];
> +		unsigned int oif = 0;
> +		void *gw = NULL;
> +		bool is_default;
> +		bool is_match;
> +		bool unbound;
> +
> +		/* We are only interested in default routes */
> +		if (rtm->rtm_dst_len != 0)
> +			return;
> +
> +		for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
> +			if (rta->rta_type == RTA_GATEWAY)
> +				gw = RTA_DATA(rta);
> +			else if (rta->rta_type == RTA_OIF)
> +				oif = *(unsigned int *)RTA_DATA(rta);
> +		}
> +
> +		if (!gw || !oif)
> +			return;
> +
> +		/* Get interface name for late binding check */
> +		if (!if_indextoname(oif, ifname))
> +			return;
> +
> +		/* Check for late binding conditions */
> +		is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
> +		is_match = !strcmp(ifname, c->pasta_ifn);
> +
> +		if (rtm->rtm_family == AF_INET)
> +			template_ifi = c->ifi4;
> +		else if (rtm->rtm_family == AF_INET6)
> +			template_ifi = c->ifi6;
> +		else
> +			return;
> +
> +		unbound = (rtm->rtm_family == AF_INET) ?
> +			  c->ifi4 <= 0 : c->ifi6 <= 0;
> +
> +		if (unbound && (is_default || is_match)) {
> +			debug("Late binding (route): using %s as %s template",
> +			      ifname,
> +			      rtm->rtm_family == AF_INET ? "IPv4" : "IPv6");
> +
> +			if (rtm->rtm_family == AF_INET) {
> +				c->ifi4 = oif;
> +				template_ifi = c->ifi4;
> +			} else {
> +				c->ifi6 = oif;
> +				template_ifi = c->ifi6;
> +			}
> +
> +			if (is_default)
> +				snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
> +					 "%s", ifname);
> +		}
> +
> +		if (oif != template_ifi)
> +			return;
> +
> +		if (rtm->rtm_family == AF_INET) {
> +			char buf[INET_ADDRSTRLEN];
> +
> +			if (!is_new) {
> +				c->ip4.guest_gw = (struct in_addr){ 0 };
> +				c->ip4.our_tap_addr = (struct in_addr){ 0 };
> +				return;
> +			}
> +			c->ip4.guest_gw = *(struct in_addr *)gw;
> +			c->ip4.our_tap_addr = c->ip4.guest_gw;
> +			nl_route_set_def(nl_sock_ns, c->pasta_ifi, AF_INET, gw);
> +			inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf));
> +			debug("Set IPv4 default route via %s", buf);
> +		} else if (rtm->rtm_family == AF_INET6) {
> +			char buf[INET6_ADDRSTRLEN];
> +
> +			if (!is_new) {
> +				c->ip6.guest_gw = (struct in6_addr){ 0 };
> +				return;
> +			}
> +			c->ip6.guest_gw = *(struct in6_addr *)gw;
> +			nl_route_set_def(nl_sock_ns, c->pasta_ifi,
> +					 AF_INET6, gw);
> +			inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf));
> +			debug("Set IPv6 default route via %s", buf);
> +		}
> +	}
> +}
> +
> +/**
> + * nl_linkaddr_host_handler() - Handle events from host link/addr notifier
> + * @c:		Execution context
> + *
> + * Monitor template interface changes and propagate to namespace
> + */
> +void nl_linkaddr_host_handler(struct ctx *c)
> +{
> +	char buf[NLBUFSIZ];
> +
> +	for (;;) {
> +		ssize_t n = recv(nl_sock_linkaddr_host, buf, sizeof(buf),
> +				 MSG_DONTWAIT);
> +		struct nlmsghdr *nh = (struct nlmsghdr *)buf;
> +
> +		if (n < 0) {
> +			if (errno == EINTR)
> +				continue;
> +			if (errno != EAGAIN)
> +				info("Host recv() error: %s", strerror_(errno));
> +			break;
> +		}
> +
> +		info("Host netlink: received %zd bytes", n);
> +
> +		for (; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n))
> +			nl_linkaddr_host_msg_read(c, nh);
> +	}
> +}
> +
> +/**
> + * nl_linkaddr_host_init_do() - Create host-side link/addr notifier socket
> + * @arg:	Unused
> + *
> + * Return: 0 on success, -1 on failure
> + */
> +static int nl_linkaddr_host_init_do(void *arg)
> +{
> +	struct sockaddr_nl addr = {
> +		.nl_family = AF_NETLINK,
> +		.nl_groups = RTMGRP_LINK |
> +			     RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR |
> +			     RTMGRP_IPV4_ROUTE | RTMGRP_IPV6_ROUTE,
> +	};
> +
> +	(void)arg;
> +
> +	nl_sock_linkaddr_host = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC,
> +				       NETLINK_ROUTE);
> +	if (nl_sock_linkaddr_host < 0) {
> +		debug("socket() failed for host: %s", strerror_(errno));
> +		return -1;
> +	}
> +
> +	if (bind(nl_sock_linkaddr_host, (struct sockaddr *)&addr,
> +		 sizeof(addr)) < 0) {
> +		debug("bind() failed for host: %s", strerror_(errno));
> +		close(nl_sock_linkaddr_host);
> +		nl_sock_linkaddr_host = -1;
> +		return -1;
> +	}
> +
> +	debug("host socket fd=%d", nl_sock_linkaddr_host);
> +	return 0;
> +}
> +
> +/**
> + * nl_linkaddr_notify_init() - Initialize host link/address change notifier
> + * @c:		Execution context
> + *
> + * In PASTA mode, create a host-side netlink socket to monitor template
> + * interface changes and propagate them to the namespace (late binding).
> + *
> + * Return: 0 on success, -1 on failure
> + */
> +int nl_linkaddr_notify_init(const struct ctx *c)
> +{
> +	union epoll_ref ref = { .type = EPOLL_TYPE_NL_LINKADDR_HOST };
> +	struct epoll_event ev = { .events = EPOLLIN };
> +
> +	if (c->mode != MODE_PASTA)
> +		return 0;
> +
> +	if (nl_sock_linkaddr_host >= 0) {
> +		debug("host notifier already initialized (fd=%d)",
> +		      nl_sock_linkaddr_host);
> +		return 0;
> +	}
> +
> +	nl_linkaddr_host_init_do(NULL);
> +
> +	if (nl_sock_linkaddr_host < 0) {
> +		warn("Failed to create host link/addr notifier socket");
> +		return -1;
> +	}
> +
> +	ev.data.u64 = ref.u64;
> +	if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD,
> +		      nl_sock_linkaddr_host, &ev) == -1) {
> +		warn("epoll_ctl() failed on host notifier: %s",
> +		     strerror_(errno));
> +		close(nl_sock_linkaddr_host);
> +		nl_sock_linkaddr_host = -1;
> +		return -1;
> +	}
> +
> +	info("Host netlink socket fd=%d, pasta_ifn=%s",
> +	     nl_sock_linkaddr_host, c->pasta_ifn);
> +
> +	return 0;
> +}
>  /**
>   * nl_sock_init() - Call nl_sock_init_do(), won't return on failure
>   * @c:		Execution context
> @@ -516,7 +851,7 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw)
>  		req.set.r4.rta_gw.rta_len = rta_len;
>  	}
>  
> -	return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len);
> +	return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_REPLACE, len);
>  }
>  
>  /**
> @@ -927,6 +1262,58 @@ int nl_addr_set(int s, unsigned int ifi, sa_family_t af,
>  	return nl_do(s, &req, RTM_NEWADDR, NLM_F_CREATE | NLM_F_EXCL, len);
>  }
>  
> +/**
> + * nl_addr_del() - Delete IP address from given interface
> + * @s:		Netlink socket
> + * @ifi:	Interface index
> + * @af:		Address family
> + * @addr:	Address to delete
> + * @prefix_len:	Prefix length
> + *
> + * Return: 0 on success, negative error code on failure
> + */
> +static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
> +		       const void *addr, int prefix_len)
> +{
> +	struct req_t {
> +		struct nlmsghdr nlh;
> +		struct ifaddrmsg ifa;
> +		union {
> +			struct {
> +				struct rtattr rta_l;
> +				struct in_addr l;
> +			} a4;
> +			struct {
> +				struct rtattr rta_l;
> +				struct in6_addr l;
> +			} a6;
> +		} del;
> +	} req = {
> +		.ifa.ifa_family    = af,
> +		.ifa.ifa_index     = ifi,
> +		.ifa.ifa_prefixlen = prefix_len,
> +	};
> +	ssize_t len;
> +
> +	if (af == AF_INET6) {
> +		size_t rta_len = RTA_LENGTH(sizeof(req.del.a6.l));
> +
> +		len = offsetof(struct req_t, del.a6) + sizeof(req.del.a6);
> +		memcpy(&req.del.a6.l, addr, sizeof(req.del.a6.l));
> +		req.del.a6.rta_l.rta_len = rta_len;
> +		req.del.a6.rta_l.rta_type = IFA_LOCAL;
> +	} else {
> +		size_t rta_len = RTA_LENGTH(sizeof(req.del.a4.l));
> +
> +		len = offsetof(struct req_t, del.a4) + sizeof(req.del.a4);
> +		memcpy(&req.del.a4.l, addr, sizeof(req.del.a4.l));
> +		req.del.a4.rta_l.rta_len = rta_len;
> +		req.del.a4.rta_l.rta_type = IFA_LOCAL;
> +	}
> +
> +	return nl_do(s, &req, RTM_DELADDR, 0, len);
> +}
> +
>  /**
>   * nl_addr_dup() - Copy IP addresses for given interface and address family
>   * @s_src:	Netlink socket in source network namespace
> diff --git a/netlink.h b/netlink.h
> index 8f1e9b9..c19d3a3 100644
> --- a/netlink.h
> +++ b/netlink.h
> @@ -33,4 +33,7 @@ int nl_link_set_flags(int s, unsigned int ifi,
>  int nl_neigh_notify_init(const struct ctx *c);
>  void nl_neigh_notify_handler(const struct ctx *c);
>  
> +int nl_linkaddr_notify_init(const struct ctx *c);
> +void nl_linkaddr_host_handler(struct ctx *c);
> +
>  #endif /* NETLINK_H */
> diff --git a/passt.c b/passt.c
> index 7488a84..64163df 100644
> --- a/passt.c
> +++ b/passt.c
> @@ -80,6 +80,7 @@ char *epoll_type_str[] = {
>  	[EPOLL_TYPE_REPAIR_LISTEN]	= "TCP_REPAIR helper listening socket",
>  	[EPOLL_TYPE_REPAIR]		= "TCP_REPAIR helper socket",
>  	[EPOLL_TYPE_NL_NEIGH]		= "netlink neighbour notifier socket",
> +	[EPOLL_TYPE_NL_LINKADDR_HOST]	= "host link/address notifier socket",
>  };
>  static_assert(ARRAY_SIZE(epoll_type_str) == EPOLL_NUM_TYPES,
>  	      "epoll_type_str[] doesn't match enum epoll_type");
> @@ -303,6 +304,9 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events)
>  		case EPOLL_TYPE_NL_NEIGH:
>  			nl_neigh_notify_handler(c);
>  			break;
> +		case EPOLL_TYPE_NL_LINKADDR_HOST:
> +			nl_linkaddr_host_handler(c);
> +			break;
>  		default:
>  			/* Can't happen */
>  			ASSERT(0);
> @@ -413,6 +417,7 @@ int main(int argc, char **argv)
>  
>  	fwd_neigh_table_init(&c);
>  	nl_neigh_notify_init(&c);
> +	nl_linkaddr_notify_init(&c);
>  
>  	if (!c.foreground) {
>  		if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0)
> -- 
> 2.52.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]