From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202602 header.b=E89I33bj; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 4B35B5A0262 for ; Wed, 27 May 2026 06:52:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202602; t=1779857540; bh=ZsmYPp8zHEgYr1gTHvS3Qfr9VSYYwwvU/edDa/f8yR0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=E89I33bjHlFQ4iuYyyMM0mu6C92pk37vDyLzm/tN4flLUjnyM4Z0AV9avXwDAoB2b iZhThjjGeh+JG+/eyX3cq3S7BI+cr+oUvOynFkZXru83h0VtiyNpgADadPKf1ElGvs 5bfvDU4oAiEtTW8+MzO3H3SukfK2fUU0NxjA8wxMrJ6b7EXsZw0A5+VGRN+QgNEYk8 Zwv9MBBiEMFnqfCP+GcWdFdivVz1vSpyhFIBhKbBeFudP8DPV2b95up40+ZP9xaCSW mHfWl5WubNw6g5Ula/Mse6eTYW7FedTnSYF89ul++Dm2LJf4FVmxPzI2hrlvwHYexQ CxHRjkSoLkUxw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gQHKc5myPz4wCH; Wed, 27 May 2026 14:52:20 +1000 (AEST) Date: Wed, 27 May 2026 14:52:15 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v7 13/13] ndp: Support advertising multiple prefixes in Router Advertisements Message-ID: References: <20260413005319.3295910-1-jmaloy@redhat.com> <20260413005319.3295910-14-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="N1T3ZroB/FJCqdS/" Content-Disposition: inline In-Reply-To: <20260413005319.3295910-14-jmaloy@redhat.com> Message-ID-Hash: ESTNV3WWQOG2TRBPAZHDNNTMNKIKJSTC X-Message-ID-Hash: ESTNV3WWQOG2TRBPAZHDNNTMNKIKJSTC X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --N1T3ZroB/FJCqdS/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Apr 12, 2026 at 08:53:19PM -0400, Jon Maloy wrote: > We extend NDP to advertise all suitable IPv6 prefixes in Router > Advertisements, per RFC 4861. Observed and link-local addresses, > plus addresses with a prefix length !=3D 64, are excluded. >=20 > Signed-off-by: Jon Maloy >=20 > --- > v6: -Adapted to previous changes in series >=20 > v7: -Adapted to previous changes in series > -Use struct initializer for source link-layer address option > -Other minor fixes based on feedback from Stefano > --- > conf.c | 19 ++++++--- > fwd.c | 4 ++ > migrate.c | 5 +++ > ndp.c | 123 +++++++++++++++++++++++++++++++++++++----------------- > passt.h | 3 +- > 5 files changed, 108 insertions(+), 46 deletions(-) >=20 > diff --git a/conf.c b/conf.c > index 7c705de..97c66c9 100644 > --- a/conf.c > +++ b/conf.c > @@ -1216,7 +1216,7 @@ static void conf_print(const struct ctx *c) > } > =20 > if (c->ifi6) { > - bool has_dhcpv6 =3D false; > + bool has_ndp =3D false, has_dhcpv6 =3D false; Nit: has_slaac might be a better name, since NDP has a number of functions. > const char *head; > =20 > if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) > @@ -1225,18 +1225,25 @@ static void conf_print(const struct ctx *c) > buf, sizeof(buf))); > =20 > for_each_addr(a, c->addrs, c->addr_count, AF_INET6) { > + if (a->flags & CONF_ADDR_SLAAC) > + has_ndp =3D true; > if (a->flags & CONF_ADDR_DHCPV6) > has_dhcpv6 =3D true; > } > =20 > - if (c->no_ndp && !has_dhcpv6) > + if (!has_ndp && !has_dhcpv6) > goto dns6; > =20 > - a =3D fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); > - if (!c->no_ndp && a) { > + if (has_ndp) { > info("NDP:"); > - info(" assign: %s", > - inany_ntop(&a->addr, buf, sizeof(buf))); > + head =3D "assign: "; > + for_each_addr(a, c->addrs, c->addr_count, AF_INET6) { Nit: AF_INET6 is redundant with the CONF_ADDR_SLAAC check. > + if (!(a->flags & CONF_ADDR_SLAAC)) > + continue; > + inany_ntop(&a->addr, buf, sizeof(buf)); > + info(" %s: %s/%d", head, buf, a->prefix_len); > + head =3D " "; > + } > } > =20 > if (has_dhcpv6) { > diff --git a/fwd.c b/fwd.c > index 2b444fb..2bc8e33 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -302,6 +302,10 @@ void fwd_set_addr(struct ctx *c, const union inany_a= ddr *addr, > } else if (!(flags & CONF_ADDR_LINKLOCAL)) { > if (!c->no_dhcpv6) > flags |=3D CONF_ADDR_DHCPV6; > + > + /* NDP/RA only if prefix is /64 */ > + if (!c->no_ndp && prefix_len =3D=3D 64) > + flags |=3D CONF_ADDR_SLAAC; > } > =20 > /* Add to head or tail, depending on flag */ > diff --git a/migrate.c b/migrate.c > index adcbc63..f019924 100644 > --- a/migrate.c > +++ b/migrate.c > @@ -54,6 +54,7 @@ struct migrate_seen_addrs_v2 { > #define MIGRATE_ADDR_OBSERVED BIT(3) > #define MIGRATE_ADDR_DHCP BIT(4) > #define MIGRATE_ADDR_DHCPV6 BIT(5) > +#define MIGRATE_ADDR_SLAAC BIT(6) Same comments again about migration protocol. > =20 > /** > * struct migrate_addr_v3 - Migration format for a single address entry > @@ -89,6 +90,8 @@ static uint8_t flags_to_migration(uint8_t flags) > migration |=3D MIGRATE_ADDR_DHCP; > if (flags & CONF_ADDR_DHCPV6) > migration |=3D MIGRATE_ADDR_DHCPV6; > + if (flags & CONF_ADDR_SLAAC) > + migration |=3D MIGRATE_ADDR_SLAAC; > =20 > return migration; > } > @@ -115,6 +118,8 @@ static uint8_t flags_from_migration(uint8_t migration) > flags |=3D CONF_ADDR_DHCP; > if (migration & MIGRATE_ADDR_DHCPV6) > flags |=3D CONF_ADDR_DHCPV6; > + if (migration & MIGRATE_ADDR_SLAAC) > + flags |=3D CONF_ADDR_SLAAC; > =20 > return flags; > } > diff --git a/ndp.c b/ndp.c > index 3750fc5..bb8374a 100644 > --- a/ndp.c > +++ b/ndp.c > @@ -32,6 +32,8 @@ > #include "passt.h" > #include "tap.h" > #include "log.h" > +#include "fwd.h" > +#include "conf.h" > =20 > #define RT_LIFETIME 65535 > =20 > @@ -99,6 +101,16 @@ struct opt_prefix_info { > uint32_t reserved; > } __attribute__((packed)); > =20 > +/** > + * struct ndp_prefix - Prefix Information option with prefix > + * @info: Prefix Information option header > + * @prefix: IPv6 prefix > + */ > +struct ndp_prefix { > + struct opt_prefix_info info; > + struct in6_addr prefix; > +} __attribute__((__packed__)); > + > /** > * struct opt_mtu - Maximum transmission unit (MTU) option > * @header: Option header > @@ -140,27 +152,23 @@ struct opt_dnssl { > } __attribute__((packed)); > =20 > /** > - * struct ndp_ra - NDP Router Advertisement (RA) message > + * struct ndp_ra_hdr - NDP Router Advertisement fixed header > * @ih: ICMPv6 header > * @reachable: Reachability time, after confirmation (ms) > * @retrans: Time between retransmitted NS messages (ms) > - * @prefix_info: Prefix Information option > - * @prefix: IPv6 prefix > - * @mtu: MTU option > - * @source_ll: Target link-layer address > - * @var: Variable fields > */ > -struct ndp_ra { > +struct ndp_ra_hdr { > struct icmp6hdr ih; > uint32_t reachable; > uint32_t retrans; > - struct opt_prefix_info prefix_info; > - struct in6_addr prefix; > - struct opt_l2_addr source_ll; > +} __attribute__((__packed__)); > =20 > - unsigned char var[sizeof(struct opt_mtu) + sizeof(struct opt_rdnss) + > - sizeof(struct opt_dnssl)]; > -} __attribute__((packed, aligned(__alignof__(struct in6_addr)))); > +/* Maximum RA message size: hdr + prefixes + source_ll + mtu + rdnss + d= nssl */ > +#define NDP_RA_MAX_SIZE (sizeof(struct ndp_ra_hdr) + \ > + MAX_GUEST_ADDRS * sizeof(struct ndp_prefix) + \ > + sizeof(struct opt_l2_addr) + \ > + sizeof(struct opt_mtu) + sizeof(struct opt_rdnss) + \ > + sizeof(struct opt_dnssl)) > =20 > /** > * struct ndp_ns - NDP Neighbor Solicitation (NS) message > @@ -231,6 +239,42 @@ void ndp_unsolicited_na(const struct ctx *c, const s= truct in6_addr *addr) > ndp_na(c, &in6addr_ll_all_nodes, addr); > } > =20 > +/** > + * ndp_prefix_fill() - Fill prefix options for all suitable addresses > + * @c: Execution context > + * @buf: Buffer to write prefix options into > + * > + * Fills buffer with Prefix Information options for all non-linklocal, > + * non-observed addresses with prefix_len =3D=3D 64 > + * > + * Return: number of bytes written > + */ > +static size_t ndp_prefix_fill(const struct ctx *c, unsigned char *buf) > +{ > + const struct guest_addr *a; > + struct ndp_prefix *p; > + size_t offset =3D 0; > + > + for_each_addr(a, c->addrs, c->addr_count, AF_INET6) { > + if (!(a->flags & CONF_ADDR_SLAAC)) > + continue; > + > + p =3D (struct ndp_prefix *)(buf + offset); > + p->info.header.type =3D OPT_PREFIX_INFO; > + p->info.header.len =3D 4; /* 4 * 8 =3D 32 bytes */ > + p->info.prefix_len =3D 64; > + p->info.prefix_flags =3D 0xc0; /* L, A flags */ > + p->info.valid_lifetime =3D ~0U; > + p->info.pref_lifetime =3D ~0U; > + p->info.reserved =3D 0; > + p->prefix =3D a->addr.a6; > + > + offset +=3D sizeof(struct ndp_prefix); > + } > + > + return offset; > +} > + > /** > * ndp_ra() - Send an NDP Router Advertisement (RA) message > * @c: Execution context > @@ -238,7 +282,15 @@ void ndp_unsolicited_na(const struct ctx *c, const s= truct in6_addr *addr) > */ > static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) > { > - struct ndp_ra ra =3D { > + unsigned char buf[NDP_RA_MAX_SIZE] > + __attribute__((__aligned__(__alignof__(struct in6_addr)))); > + struct ndp_ra_hdr *hdr =3D (struct ndp_ra_hdr *)buf; > + struct opt_l2_addr *source_ll; > + unsigned char *ptr; > + size_t prefix_len; > + > + /* Build RA header */ > + *hdr =3D (struct ndp_ra_hdr){ > .ih =3D { > .icmp6_type =3D RA, > .icmp6_code =3D 0, > @@ -247,31 +299,26 @@ static void ndp_ra(const struct ctx *c, const struc= t in6_addr *dst) > .icmp6_rt_lifetime =3D htons_constant(RT_LIFETIME), > .icmp6_addrconf_managed =3D 1, > }, > - .prefix_info =3D { > - .header =3D { > - .type =3D OPT_PREFIX_INFO, > - .len =3D 4, > - }, > - .prefix_len =3D 64, > - .prefix_flags =3D 0xc0, /* prefix flags: L, A */ > - .valid_lifetime =3D ~0U, > - .pref_lifetime =3D ~0U, > - }, > - .source_ll =3D { > - .header =3D { > - .type =3D OPT_SRC_L2_ADDR, > - .len =3D 1, > - }, > - }, > }; > - const struct guest_addr *a =3D fwd_get_addr(c, AF_INET6, 0, 0); > - unsigned char *ptr =3D NULL; > =20 > - ASSERT(a); > - > - ra.prefix =3D a->addr.a6; > + /* Fill prefix options */ > + prefix_len =3D ndp_prefix_fill(c, (unsigned char *)(hdr + 1)); > + if (prefix_len =3D=3D 0) { > + /* No suitable prefixes to advertise */ > + return; Do we want this? I think it's still valid to present other options via NDP, even if we have no prefixes to advertise. And, I think we want to do so for at least the MTU. > + } > =20 > - ptr =3D &ra.var[0]; > + /* Add source link-layer address option */ > + ptr =3D (unsigned char *)(hdr + 1) + prefix_len; > + source_ll =3D (struct opt_l2_addr *)ptr; > + *source_ll =3D (struct opt_l2_addr) { > + .header =3D { > + .type =3D OPT_SRC_L2_ADDR, > + .len =3D 1, > + }, > + }; > + memcpy(source_ll->mac, c->our_tap_mac, ETH_ALEN); > + ptr +=3D sizeof(struct opt_l2_addr); > =20 > if (c->mtu) { > struct opt_mtu *mtu =3D (struct opt_mtu *)ptr; > @@ -345,10 +392,8 @@ static void ndp_ra(const struct ctx *c, const struct= in6_addr *dst) > } > } > =20 > - memcpy(&ra.source_ll.mac, c->our_tap_mac, ETH_ALEN); > - > /* NOLINTNEXTLINE(clang-analyzer-security.PointerSub) */ > - ndp_send(c, dst, &ra, ptr - (unsigned char *)&ra); > + ndp_send(c, dst, buf, ptr - buf); > } > =20 > /** > diff --git a/passt.h b/passt.h > index 028eb7c..2c633e4 100644 > --- a/passt.h > +++ b/passt.h > @@ -84,7 +84,8 @@ struct guest_addr { > #define CONF_ADDR_LINKLOCAL BIT(3) /* Link-local address */ > #define CONF_ADDR_OBSERVED BIT(4) /* Seen in guest traffic */ > #define CONF_ADDR_DHCP BIT(5) /* Advertise via DHCP (IPv4) */ > -#define CONF_ADDR_DHCPV6 BIT(6) /* Advertise via DHCPv6 (IPv6) */ > +#define CONF_ADDR_DHCPV6 BIT(6) /* Advertise via DHCPv6 */ This change belongs in the previous patch. > +#define CONF_ADDR_SLAAC BIT(7) /* Advertise via NDP/RA (/64) */ > }; > =20 > /** > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --N1T3ZroB/FJCqdS/ Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmoWeH4ACgkQzQJF27ox 2GccSg/8C1NY3vvg4jJfMXidlFPo1qIDsJoYgT/oCF9EopNFlLJFTDTMruWmqwt3 URLqTrqiBibVAzNzLKSHQFKaf/tYH95FwKYZOPlWErEZaLLdthip57YnufMRxp0A vZosSzPG3JVZu2gKzuQ994nb/tMk/uCDi/IDxKfFKmUPkLFGXbK+rZIkkEkZTPlL jViZJdlhMTO2Lr+aCCTYSPOSEsNKWTgNKlqTJMZtxOX/tELFeuDGcAaUo020w0NR 9sKt+ubp4UIvaxg0o2AC6bGQhDH8DC35qI59y9H+NjkH/Qtb5Jt9LGfsnPVriRFX 6B4X9L9PiF/mANn9EoZSfBKX5Bjx4fjrvoPCA80y+NwGImv17sph0VBw1HQ6YCmM 5qnucrXyawmhk0AqFvsFnqPj28ZxYrQ2ZCJ/oNzIbTzHx5yZeEywwLf4d3yGqZ4+ ueNGVfKqJsp/UjlA3FNCz178fc+df65utAZvGDjxLN1/R6l9pzweR99y9S8WeLOd wlbI8zLisqqlSulo/mmMOszIL4MLLcxHzaa03rcQg4JvZYm2abgqaNz2qEVMTFCC 1oirL0VVMQq75nIUBS0ayJ7k0sQZmIQzxUVg7pYYsmf+EJcuh/CPROvNj8VNmzxL cTG3F3EJFusyIaAefNq5Js5wN7W+cnnFBmaQWTLcB0/nUlo1L/0= =jAOd -----END PGP SIGNATURE----- --N1T3ZroB/FJCqdS/--