From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=b/X1Bm0R; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id B41005A0262 for ; Mon, 27 Jul 2026 03:47:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1785116830; bh=2DrcZLuRyfaS+8J+XQy9Etf7cVLevao8BeSsZ3vn0T0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=b/X1Bm0RBNoogrUPP55fq9cVQm9AVlMEaCuPWV2e4swAPBu6ZjzymlLjZJzl8MXxI C74F0RkmV8V92ZnToAdbHNEnRq3IQqPTpdK9zTITzyuNuoowpboLvB6BubRs9UrQur z/gPLsOWBFQvuBC3hnP3IaSXZvcTwPqzCqGTwJUJWu6LPXD+vxM4SL3QmqQyxRwNAO /yGnI1gth+X6dLePt1+Hb/QKeW/33Kyr7YR771jAcyS0boqmDXFLtbSlpgsOw+0erR YaswsqcxkyTLZDIEDUdtjxSFMXmmmq02qs70aHfS7nPhGdIkt7PuO6rv5vs9/84FLt ajPvds2gl0nPg== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4h7hKp4nSpz4w2D; Mon, 27 Jul 2026 11:47:10 +1000 (AEST) Date: Mon, 27 Jul 2026 11:47:05 +1000 From: David Gibson To: Yuxi Liu Subject: Re: [BUG] --map-guest-addr target resolved once at startup; host network change kills the mapping silently and permanently Message-ID: References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Vr7qMQHemUU1rcSe" Content-Disposition: inline In-Reply-To: Message-ID-Hash: Y2ZJBUIKWTTHJFHFVJV4NM6HTNTYQ7TM X-Message-ID-Hash: Y2ZJBUIKWTTHJFHFVJV4NM6HTNTYQ7TM X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --Vr7qMQHemUU1rcSe Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jul 25, 2026 at 09:28:14AM -0700, Yuxi Liu wrote: > Hello, >=20 > Bug report against pasta, as used by rootless podman for > host.containers.internal. >=20 > What happens > ------------ > Rootless container, default pasta networking (podman passes > --no-map-gw --map-guest-addr 169.254.1.2), on a laptop. The laptop > moves to a different network (hotel wifi, home, office). From that > moment, every connection from the container to 169.254.1.2 times out. > Forever. General outbound from the container keeps working, so the > failure looks like the host service died. The host service is fine and > answers on the host the whole time. Only recreating the container > fixes the route. >=20 > Why it happens > -------------- > --map-guest-addr forwards mapped traffic to the host's external > address (commit 57b7bd2). pasta resolves that address once, at > startup, and never again. After the host moves networks, pasta still > connect()s to the launch-time address. Nobody owns that address > anymore, the SYNs vanish, and no error is logged anywhere. >=20 > pasta already runs a live netlink monitor in its event loop > (RTMGRP_NEIGH, neighbour events). Host address changes are the one > thing it reads once at startup and never watches afterward. Re-reading > the current address needs no privilege: getifaddrs() works for any > process. Right. This is a known limitation. We're working on it, but it's fairly difficult to fix correctly, because it interacts with a bunch of other features. This is largely tracked by this bug: https://bugs.passt.top/show_bug.cgi?id=3D141 > Reproduce > --------- > 1. Laptop on wifi network A. Run a rootless podman container with the > default pasta network. Have any service listening on the host, > say port 8191. > 2. In the container: curl > https://www.google.com/url?q=3Dhttp://host.containers.internal:8191&sourc= e=3Dgmail&ust=3D1785083212577000&sa=3DE > -> answers. > 3. Move the laptop to wifi network B. > 4. Same curl -> timeout. Stays dead until the container is recreated. >=20 > Versions: passt 0.0~git20250503.587980c-2 (Ubuntu 25.10), > podman 5.4.2. >=20 > Expected > -------- > One of: > 1. pasta re-resolves the mapping target when the host's addresses > change, or > 2. the mapped route fails loudly (RST) instead of silently, or > 3. the man page warns that the mapping dies permanently on host > network change. >=20 > Laptops are a mainstream platform for rootless podman. A silent, > permanent route death on every wifi change is a serious defect for > them. >=20 > Workaround > ---------- > --map-guest-addr none --map-host-loopback 169.254.1.2 (via podman: > --network=3Dpasta:--map-guest-addr,none,--map-host-loopback,169.254.1.2). > Mapped traffic then arrives on the host as 127.0.0.1, which the host > owns on every network. This changes source semantics (connections > appear to come from loopback), which is acceptable when you control > both sides. Right, for your use case, --map-host-loopback seems like a good workaround. Even when we implement a netlink monitor, --map-guest-addr (or its future equivalent) can't really work when the laptop is not on any external network, because there is no external host address to direct traffic to. --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --Vr7qMQHemUU1rcSe Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpmuI8ACgkQzQJF27ox 2Ger8g//XwyXcK1Dz3hkiXlmJnU6Y07j2+c5/ysgcsVz1UG/WxfZ42exjgfGdDkm dlCja29Z8JM1h+iqChbgxoEKaaFzCMRdjQ9EDlY/gUXv1RzYgd0OQ6mLNVGKIX+v RiRCdNPOXzBOK7pXP/puR5+/T+jyCi/E5aoAl4xk1ZCW7GIfcykpqizA5Ot7pVeb pC8TLxtgBLmimO0mhO4Ke5r4gYcRUQESvMbGPraHLHw0Jk2wg6OqW0y2USDVSxbn YECYp8XWpD+6Kk3X3Z31GRrdPloRoWecaGBi0XQXDyyzG6brpI8rdVyuEmdn/N2M 1MQQA4RUXMFAUAwA8DeRnYBt/INhplN3C5ecdvfKVuh31F5gUCbMpICtE0dzm41v Q1GsYoI/FauzP7oGBR6JotYq8xjpdLt/cQ7+QIJbV00ROnCOxS86aIFx1VSCiw7y vNUI6nBVr1BzDSqSPfKXVju3EsqbMCGeHq3n2E2rrrCBoPHaFSghIvLYHOsQPwsp Mzn9Mb74bU+AFUE/GKAJ1mvhxSee7WiXm3BtvAIMIseZPIhdF5K50TFQvVidW4pe NNQmx6hgeFzU+ISQFwYOHOKIsb+2wOH+YBhS0QcFcT6kugZSZzRV003COEni4Iqc s/uoviM2oNROVq6xszvnXb73w48NBsVq3kg53j18fDnr9tCd87s= =1zD4 -----END PGP SIGNATURE----- --Vr7qMQHemUU1rcSe--