November 2024 - dev

[PATCH] ndp: Don't send first periodic router advertisement right after guest connects
by Stefano Brivio 26 Nov '24

26 Nov '24

This is very visible with muvm, but it also happens with QEMU: we're sending the first unsolicited router advertisement milliseconds after the guest connects. That's usually pointless because, when the hypervisor connects, the guest is typically not ready yet to process anything of that sort: it's still booting. And if we happen to send it late enough (still milliseconds), with muvm, while the message is discarded, it sometimes (slightly) delays the response to the first solicited router advertisement, which is the one we need to have coming fast. Skip sending the unsolicited advertisement on the first timer run, just calculate the next delay. Keep it simple by observing that we're probably not trying to reach the 1970s with IPv6. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- ndp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ndp.c b/ndp.c index 1752d64..37bf7a3 100644 --- a/ndp.c +++ b/ndp.c @@ -420,9 +420,13 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) interval = min_rtr_adv_interval + random() % (max_rtr_adv_interval - min_rtr_adv_interval); + if (!next_ra) + goto first; + info("NDP: sending unsolicited RA, next in %llds", (long long)interval); ndp_ra(c, &in6addr_ll_all_nodes); +first: next_ra = now->tv_sec + interval; } -- 2.43.0

2 3

[PATCH v2] treewide: Introduce 'local mode' for disconnected setups
by Stefano Brivio 26 Nov '24

26 Nov '24

There are setups where no host interface is available or configured at all, intentionally or not, temporarily or not, but users expect (Podman) containers to run in any case as they did with slirp4netns, and we're now getting reports that we broke such setups at a rather alarming rate. To this end, if we don't find any usable host interface, instead of exiting: - for IPv4, use 169.254.2.1 as guest/container address and 169.254.2.2 as default gateway - for IPv6, don't assign any address (forcibly disable DHCPv6), and use the *first* link-local address we observe to represent the guest/container. Advertise fe80::1 as default gateway - use 'tap0' as default interface name for pasta Change ifi4 and ifi6 in struct ctx to int and accept a special -1 value meaning that no host interface was selected, but the IP family is enabled. The fact that the kernel uses unsigned int values for those is not an issue as 1. one can't create so many interfaces anyway and 2. we otherwise handle those values transparently. Fix a botched conditional in conf_print() to actually skip printing DHCPv6 information if DHCPv6 is disabled (and skip printing NDP information if NDP is disabled). Link: https://github.com/containers/podman/issues/24614 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: - drop fixed link-local address for IPv6 - change addresses to be reminiscent of libslirp's default choices - add man page changes and commit message - fix several things around, from testing (checked with several --map-guest-addr and --map-host-loopback combinations etc.) conf.c | 92 +++++++++++++++++++++++++++++++++++++++++++++------------ passt.1 | 33 +++++++++++++++++---- passt.h | 8 ++--- pasta.c | 7 +++-- tap.c | 3 ++ 5 files changed, 113 insertions(+), 30 deletions(-) diff --git a/conf.c b/conf.c index 86566db..551c2b0 100644 --- a/conf.c +++ b/conf.c @@ -48,6 +48,20 @@ #define NETNS_RUN_DIR "/run/netns" +#define IP4_LL_GUEST_ADDR (struct in_addr){ htonl_constant(0xa9fe0201) } + /* 169.254.2.1, libslirp default: 10.0.2.1 */ + +#define IP4_LL_GUEST_GW (struct in_addr){ htonl_constant(0xa9fe0202) } + /* 169.254.2.2, libslirp default: 10.0.2.2 */ + +#define IP4_LL_PREFIX_LEN 16 + +#define IP6_LL_GUEST_GW (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x01 }}} + +const char *pasta_default_ifn = "tap0"; + /** * next_chunk - Return the next piece of a string delimited by a character * @s: String to search @@ -631,7 +645,7 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("Couldn't pick external interface: disabling IPv4"); + debug("Failed to detect external interface for IPv4"); return 0; } @@ -639,8 +653,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_route_get_def(nl_sock, ifi, AF_INET, &ip4->guest_gw); if (rc < 0) { - err("Couldn't discover IPv4 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 gateway address: %s", + strerror(-rc)); return 0; } } @@ -649,8 +663,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_addr_get(nl_sock, ifi, AF_INET, &ip4->addr, &ip4->prefix_len, NULL); if (rc < 0) { - err("Couldn't discover IPv4 address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 address: %s", + strerror(-rc)); return 0; } } @@ -677,6 +691,19 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) return ifi; } +/** + * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode + * @ip4: IPv4 context (will be written) + */ +static void conf_ip4_local(struct ip4_ctx *ip4) +{ + ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; + ip4->prefix_len = IP4_LL_PREFIX_LEN; + + ip4->no_copy_addrs = ip4->no_copy_routes = true; +} + /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -693,15 +720,15 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("Couldn't pick external interface: disabling IPv6"); + debug("Failed to detect external interface for IPv6"); return 0; } if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) { rc = nl_route_get_def(nl_sock, ifi, AF_INET6, &ip6->guest_gw); if (rc < 0) { - err("Couldn't discover IPv6 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv6 gateway address: %s", + strerror(-rc)); return 0; } } @@ -710,7 +737,7 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { - err("Couldn't discover IPv6 address: %s", strerror(-rc)); + debug("Couldn't discover IPv6 address: %s", strerror(-rc)); return 0; } @@ -726,6 +753,17 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) return ifi; } +/** + * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode + * @ip6: IPv6 context (will be written) + */ +static void conf_ip6_local(struct ip6_ctx *ip6) +{ + ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + + ip6->no_copy_addrs = ip6->no_copy_routes = true; +} + /** * usage() - Print usage, exit with given status code * @name: Executable name @@ -948,12 +986,14 @@ static void conf_print(const struct ctx *c) char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; int i; - info("Template interface: %s%s%s%s%s", - c->ifi4 ? if_indextoname(c->ifi4, ifn) : "", - c->ifi4 ? " (IPv4)" : "", - (c->ifi4 && c->ifi6) ? ", " : "", - c->ifi6 ? if_indextoname(c->ifi6, ifn) : "", - c->ifi6 ? " (IPv6)" : ""); + if (c->ifi4 > 0 || c->ifi6 > 0) { + info("Template interface: %s%s%s%s%s", + c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", + c->ifi4 > 0 ? " (IPv4)" : "", + (c->ifi4 && c->ifi6) ? ", " : "", + c->ifi6 > 0 ? if_indextoname(c->ifi6, ifn) : "", + c->ifi6 > 0 ? " (IPv6)" : ""); + } if (*c->ip4.ifname_out || *c->ip6.ifname_out) { info("Outbound interface: %s%s%s%s%s", @@ -1024,9 +1064,9 @@ static void conf_print(const struct ctx *c) if (!c->no_ndp && !c->no_dhcpv6) info("NDP/DHCPv6:"); - else if (!c->no_ndp) - info("DHCPv6:"); else if (!c->no_dhcpv6) + info("DHCPv6:"); + else if (!c->no_ndp) info("NDP:"); else goto dns6; @@ -1735,8 +1775,20 @@ void conf(struct ctx *c, int argc, char **argv) c->ifi6 = conf_ip6(ifi6, &c->ip6); if ((!c->ifi4 && !c->ifi6) || (*c->ip4.ifname_out && !c->ifi4) || - (*c->ip6.ifname_out && !c->ifi6)) - die("External interface not usable"); + (*c->ip6.ifname_out && !c->ifi6)) { + info("No external interface as template, switch to local mode"); + + conf_ip4_local(&c->ip4); + c->ifi4 = -1; + + conf_ip6_local(&c->ip6); + c->ifi6 = -1; + + if (!*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } + } if (c->ifi4 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) @@ -1840,6 +1892,8 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; + } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + c->no_dhcpv6 = 1; } if (!c->mtu) diff --git a/passt.1 b/passt.1 index f084978..f5cf8a4 100644 --- a/passt.1 +++ b/passt.1 @@ -160,7 +160,9 @@ once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces with the first default route, if any, for the corresponding IP version. If no default routes are available and there is any interface with any route for a -given IP version, the first of these interfaces will be chosen instead. +given IP version, the first of these interfaces will be chosen instead. If no +such interface exists, the link-local address 169.254.2.1 is assigned for IPv4, +and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -188,7 +190,9 @@ first default route, if any, for the corresponding IP version. If the default route is a multipath one, the gateway is the first nexthop router returned by the kernel which has the highest weight in the set of paths. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, the link-local +address 169.254.2.2 is used for IPv4, and the link-local address fe80::1 is used +for IPv6. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -203,7 +207,9 @@ Default is to use the interfaces specified by \fB--outbound-if4\fR and If no interfaces are given, the interface with the first default routes for each IP version is selected. If no default routes are available and there is just one -interface with any route, that interface will be chosen instead. +interface with any route, that interface will be chosen instead. If no such +interface exists, host interfaces will be ignored for the purposes of assigning +addresses and routes, and link-local addresses will be used instead. .TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -222,7 +228,8 @@ derive IPv4 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-\-outbound-if6 " " \fIname @@ -232,7 +239,8 @@ derive IPv6 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-D ", " \-\-dns " " \fIaddr @@ -504,6 +512,7 @@ Default is \fBnone\fR. .BR \-I ", " \-\-ns-ifname " " \fIname Name of tap interface to be created in target namespace. By default, the same interface name as the external, routable interface is used. +If no such interface exists, the name \fItap0\fR will be used instead. .TP .BR \-t ", " \-\-tcp-ports " " \fIspec @@ -1032,6 +1041,20 @@ If the sending window cannot be queried, it will always be announced as the current sending buffer size to guest or target namespace. This might affect throughput of TCP connections. +.SS Local mode for disconnected setups + +If \fBpasst\fR and \fBpasta\fR fail to find a host interface with a configured +address, other than loopback addresses, they will, obviously, not attempt to +source addresses or routes from the host. + +In this case, unless configured otherwise, they will assign the IPv4 link-local +address 169.254.2.1 to the guest or target namespace, and no IPv6 address. The +notion of the guest or target namespace IPv6 address is derived from the first +link-local address observed. + +Default gateways will be assigned as the link-local address 169.254.2.2 for +IPv4, and as the link-local address fe80::1 for IPv6. + .SH LIMITATIONS Currently, IGMP/MLD proxying (RFC 4605) and support for SCTP (RFC 4960) are not diff --git a/passt.h b/passt.h index 72c7f72..799ee50 100644 --- a/passt.h +++ b/passt.h @@ -202,10 +202,10 @@ struct ip6_ctx { * @our_tap_mac: Pasta/passt's MAC on the tap link * @guest_mac: MAC address of guest or namespace, seen or configured * @hash_secret: 128-bit secret for siphash functions - * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled + * @ifi4: Template interface for IPv4, -1: none, 0: IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list - * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled + * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta @@ -258,12 +258,12 @@ struct ctx { unsigned char guest_mac[ETH_ALEN]; uint64_t hash_secret[2]; - unsigned int ifi4; + int ifi4; struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; - unsigned int ifi6; + int ifi6; struct ip6_ctx ip6; char pasta_ifn[IF_NAMESIZE]; diff --git a/pasta.c b/pasta.c index a117704..96dacc3 100644 --- a/pasta.c +++ b/pasta.c @@ -369,8 +369,11 @@ void pasta_ns_conf(struct ctx *c) 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET6, &c->ip6.addr, 64); + if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 14d9b3d..5347df4 100644 --- a/tap.c +++ b/tap.c @@ -803,6 +803,9 @@ resume: if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) { c->ip6.addr_seen = *saddr; } + + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) + c->ip6.addr = *saddr; } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.43.0

2 3

[PATCH v3 0/3] dhcp: Add support for Rapid Commit, broadcast replies
by Stefano Brivio 26 Nov '24

26 Nov '24

These are all changes coming from pending muvm experiments where I'm trying to speed up and simplify the networking setup in the guest. v3: In 1/3, set 'slen' for options we won't send to -1 in dhcp_init(), and reset it for option 80 every time we handle a DHCP request. Add a comment about DHCP needing a valid message type (option 53) v2: In 3/3, add in4addr_broadcast to ip.h, instead of open-coding it in dhcp() Stefano Brivio (3): dhcp: Use -1 as "missing option" length instead of 0 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) dhcp: Honour broadcast flag (RFC 2131, 4.1) dhcp.c | 51 ++++++++++++++++++++++++++++++++++++++++----------- ip.h | 3 +++ 2 files changed, 43 insertions(+), 11 deletions(-) -- 2.43.0

2 6

[PATCH] test/perf: Select a single IPv6 namespace address in pasta tests
by Stefano Brivio 26 Nov '24

26 Nov '24

By dropping the filter on prefix length, commit 910f4f910301 ("test: Don't require 64-bit prefixes in perf tests") broke tests on setups where two global unicast IPv6 addresses are available, which is the typical case when the "host" is a VM running under passt with addresses from SLAAC and DHCPv6, because two addresses will be returned. Pick the first one instead. We don't really care about the prefix length, any of these addresses will work. Fixes: 910f4f910301 ("test: Don't require 64-bit prefixes in perf tests") Link: https://archives.passt.top/passt-dev/20241119214344.6b4a5b3a@elisabeth/ Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/perf/pasta_tcp | 2 +- test/perf/pasta_udp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/test/perf/pasta_tcp b/test/perf/pasta_tcp index 88284b2..bc0de3c 100644 --- a/test/perf/pasta_tcp +++ b/test/perf/pasta_tcp @@ -211,7 +211,7 @@ tr TCP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' bw - bw - bw - diff --git a/test/perf/pasta_udp b/test/perf/pasta_udp index 3d07091..ab2f3e8 100644 --- a/test/perf/pasta_udp +++ b/test/perf/pasta_udp @@ -196,7 +196,7 @@ tr UDP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 8G -l 1472 bw __BW__ 0.3 0.5 iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 12G -l 3972 -- 2.43.0

2 1

[PATCH] conf, passt.1: Update --mac-addr default in usage() and man page
by Stefano Brivio 26 Nov '24

26 Nov '24

Fixes: 90e83d50a9bd ("Don't take "our" MAC address from the host") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 2 +- passt.1 | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/conf.c b/conf.c index 551c2b0..3a84669 100644 --- a/conf.c +++ b/conf.c @@ -826,7 +826,7 @@ static void usage(const char *name, FILE *f, int status) " -n, --netmask MASK Assign IPv4 MASK, dot-decimal or bits\n" " default: netmask from matching address on the host\n" " -M, --mac-addr ADDR Use source MAC address ADDR\n" - " default: MAC address from interface with default route\n" + " default: 9a:55:9a:55:9a:55 (locally administered)\n" " -g, --gateway ADDR Pass IPv4 or IPv6 address as gateway\n" " default: gateway from interface with default route\n" " -i, --interface NAME Interface for addresses and routes\n" diff --git a/passt.1 b/passt.1 index 8d1d860..15c8338 100644 --- a/passt.1 +++ b/passt.1 @@ -176,8 +176,7 @@ according to the CIDR block of the assigned address (RFC 4632). .BR \-M ", " \-\-mac-addr " " \fIaddr Use source MAC address \fIaddr\fR when communicating to the guest or to the target namespace. -Default is to use the MAC address of the interface with the first IPv4 default -route on the host. +Default is the locally administered MAC addresses 9a:55:9a:55:9a:55. .TP .BR \-g ", " \-\-gateway " " \fIaddr -- 2.43.0

2 1

[PATCH] passt.1: Fix "default" note about --map-guest-addr
by Stefano Brivio 26 Nov '24

26 Nov '24

It's not true that there's no mapping by default: there's no mapping in the --map-guest-addr sense, by default, but in that case the default --map-host-loopback behaviour prevails. While at it, fix a typo. Fixes: 57b7bd2a48a1 ("fwd, conf: Allow NAT of the guest's assigned address") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/passt.1 b/passt.1 index f5cf8a4..8d1d860 100644 --- a/passt.1 +++ b/passt.1 @@ -381,14 +381,14 @@ Translate \fIaddr\fR in the guest to be equal to the guest's assigned address on the host. That is, packets from the guest to \fIaddr\fR will be redirected to the address assigned to the guest with \fB-a\fR, or by default the host's global address. This allows the guest to -access services availble on the host's global address, even though its +access services available on the host's global address, even though its own address shadows that of the host. If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one IPv6 address can be translated, and if the option is specified multiple times, the last one for each address type takes effect. -Default is no mapping. +By default, mapping happens as described for the \-\-map-host-loopback option. .TP .BR \-4 ", " \-\-ipv4-only -- 2.43.0

2 1

[PATCH 0/3] dhcp: Add support for Rapid Commit, broadcast replies
by Stefano Brivio 25 Nov '24

25 Nov '24

These are all changes coming from pending muvm experiments where I'm trying to speed up and simplify the networking setup in the guest. Stefano Brivio (3): dhcp: Use -1 as "missing option" length instead of 0 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) dhcp: Honour broadcast flag (RFC 2131, 4.1) dhcp.c | 49 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 38 insertions(+), 11 deletions(-) -- 2.43.0

2 9

[PATCH v2 0/3] dhcp: Add support for Rapid Commit, broadcast replies
by Stefano Brivio 25 Nov '24

25 Nov '24

These are all changes coming from pending muvm experiments where I'm trying to speed up and simplify the networking setup in the guest. v2: In 3/3, add in4addr_broadcast to ip.h, instead of open-coding it in dhcp() Stefano Brivio (3): dhcp: Use -1 as "missing option" length instead of 0 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) dhcp: Honour broadcast flag (RFC 2131, 4.1) dhcp.c | 49 ++++++++++++++++++++++++++++++++++++++----------- ip.h | 3 +++ 2 files changed, 41 insertions(+), 11 deletions(-) -- 2.43.0

1 3

[PATCH RFT] conf: Introduce default link-local addresses and routes when we can't use any interface as template
by Stefano Brivio 22 Nov '24

22 Nov '24

Link: https://github.com/containers/podman/issues/24614 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 66 insertions(+), 11 deletions(-) diff --git a/conf.c b/conf.c index 86566db..4c81aaf 100644 --- a/conf.c +++ b/conf.c @@ -48,6 +48,23 @@ #define NETNS_RUN_DIR "/run/netns" +#define IP4_LL_GUEST_ADDR (struct in_addr){ htonl_constant(0xa9fe0a02) } + /* 169.254.10.2 */ + +#define IP4_LL_GUEST_GW (struct in_addr){ htonl_constant(0xa9fe0a01) } + /* 169.254.10.1 */ + +#define IP4_LL_PREFIX_LEN 16 + +#define IP6_LL_GUEST_ADDR (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x02 }}} +#define IP6_LL_GUEST_GW (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x01 }}} + +const char *pasta_default_ifn = "tap0"; + /** * next_chunk - Return the next piece of a string delimited by a character * @s: String to search @@ -631,7 +648,7 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("Couldn't pick external interface: disabling IPv4"); + debug("Failed to detect external interface for IPv4"); return 0; } @@ -639,8 +656,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_route_get_def(nl_sock, ifi, AF_INET, &ip4->guest_gw); if (rc < 0) { - err("Couldn't discover IPv4 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 gateway address: %s", + strerror(-rc)); return 0; } } @@ -649,8 +666,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_addr_get(nl_sock, ifi, AF_INET, &ip4->addr, &ip4->prefix_len, NULL); if (rc < 0) { - err("Couldn't discover IPv4 address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 address: %s", + strerror(-rc)); return 0; } } @@ -677,6 +694,19 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) return ifi; } +/** + * conf_ip4_local() - Configure IPv4 link-local addresses for local mode + * @ip4: IPv4 context (will be written) + */ +static void conf_ip4_local(struct ip4_ctx *ip4) +{ + ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; + ip4->prefix_len = IP4_LL_PREFIX_LEN; + + ip4->no_copy_addrs = ip4->no_copy_routes = true; +} + /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -693,15 +723,15 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("Couldn't pick external interface: disabling IPv6"); + debug("Failed to detect external interface for IPv6"); return 0; } if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) { rc = nl_route_get_def(nl_sock, ifi, AF_INET6, &ip6->guest_gw); if (rc < 0) { - err("Couldn't discover IPv6 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv6 gateway address: %s", + strerror(-rc)); return 0; } } @@ -710,7 +740,7 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { - err("Couldn't discover IPv6 address: %s", strerror(-rc)); + debug("Couldn't discover IPv6 address: %s", strerror(-rc)); return 0; } @@ -726,6 +756,18 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) return ifi; } +/** + * conf_ip6_local() - Configure IPv6 link-local addresses for local mode + * @ip6: IPv6 context (will be written) + */ +static void conf_ip6_local(struct ip6_ctx *ip6) +{ + ip6->addr_seen = ip6->addr = IP6_LL_GUEST_ADDR; + ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + + ip6->no_copy_addrs = ip6->no_copy_routes = true; +} + /** * usage() - Print usage, exit with given status code * @name: Executable name @@ -1735,8 +1777,21 @@ void conf(struct ctx *c, int argc, char **argv) c->ifi6 = conf_ip6(ifi6, &c->ip6); if ((!c->ifi4 && !c->ifi6) || (*c->ip4.ifname_out && !c->ifi4) || - (*c->ip6.ifname_out && !c->ifi6)) - die("External interface not usable"); + (*c->ip6.ifname_out && !c->ifi6)) { + /* Switch to local mode */ + info("No external interface as template, switch to local mode"); + + conf_ip4_local(&c->ip4); + c->ifi4 = -1; + + conf_ip6_local(&c->ip6); + c->ifi6 = -1; + + if (!*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } + } if (c->ifi4 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) -- 2.43.0

1 0

passt: new version 2024_11_21.238c69f available
by Stefano Brivio 21 Nov '24

21 Nov '24

The new version with tag 2024_11_21.238c69f includes the following changes: 238c69f tcp: Acknowledge keep-alive segments, ignore them for the rest af464c4 tcp: Reset ACK_TO_TAP_DUE flag whenever an ACK isn't needed anymore 5ae2184 ndp: Don't send unsolicited RAs if NDP is disabled bf94927 ndp: Don't send unsolicited router advertisement if we can't, yet 5e24466 selinux: Use auth_read_passwd() interface for all our getpwnam() needs 6e1e442 ndp: Send unsolicited Router Advertisements b39760c passt: Seed libc's pseudo random number generator 71d5dee util: Add general low-level random bytes helper a60703e ndp: Make route lifetime a #define 36c070e ndp: Use struct assignment in preference to memcpy() for IPv6 addresses cbc83e1 ndp: Split out helpers for sending specific NDP message types 4e47167 ndp: Add ndp_send() helper 71f228d ndp: Remove redundant update to addr_seen 0588163 cppcheck: Don't check the system headers 14dd70e linux_dep: Fix CLOSE_RANGE_UNSHARE availability handling d64f257 linux_dep: Move close_range() conditional handling to linux_dep.h b84cd05 log: Only check for FALLOC_FL_COLLAPSE_RANGE availability at runtime 58fa550 tap, tcp, util: Add some missing SOCK_CLOEXEC flags 71869e2 passt: Use NOLINT clang-tidy block instead of NOLINTNEXTLINE d4f09c9 util: Define small and big thresholds for socket buffers as unsigned long long 87940f9 tap: Cast TAP_BUF_BYTES - ETH_MAX_MTU to ssize_t, not TAP_BUF_BYTES 1feb90f dhcpv6: Turn some option headers pointers to const 5f5e814 dhcpv6: Use for loop instead of goto to avoid false positive cppcheck warning 78da088 tcp: unify payload and flags l2 frames array 9a0e544 test: Improve test for NDP assigned prefix 910f4f9 test: Don't require 64-bit prefixes in perf tests 1699083 test: Make nstool hold robust against interruptions to control clients b456ee1 test: Rename propagating signal handler 867db07 util: Work around cppcheck bug 6936 6f913b3 udp: Don't dereference uflow before NULL check in udp_reply_sock_handler() d8e05a3 ndp: Use const pointer for ndp_ns packet 0d7b820 linux_dep: Generalise tcp_info.h to handling Linux extension compatibility c5f4e4d fwd: Squash different-signedness comparison warning 1e76a19 util: Remove unused ffsl() function 1d7cff3 clang: Add rudimentary clangd configuration c560e2f Makefile: Don't attempt to auto-detect stack size 13fc6d5 Makefile: Use -DARCH for qrap only 7917159 seccomp: Simplify handling of AUDIT_ARCH 93bce40 Makefile: Move NETNS_RUN_DIR definition to C code c938d8a netlink: RTA_PAYLOAD() returns int, not size_t f6b546c flow: Correct type of flowside_at_sidx() 30b4f88 arch: Avoid explicit access to 'environ' b78e72d clang: Move clang-tidy configuration from Makefile to .clang-tidy 8346216 Makefile: Simplify exclusion of qrap from static checks 8f1b6a0 clang: Add .clang-format file 5e93bcd test: Adjust misplaced sleeps in two_guests code 9afce0b tap: Explicitly cast TUNSETIFF to fix build warning with musl on ppc64le d165d36 tcp: Fix build against musl, __sum16 comes from linux/types.h https://passt.top/passt/log/?qt=range&q=2024_10_30.ee7d0b6..2024_11_21.238c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8293460/ permanent mirror: https://passt.top/builds/copr/0^20241121.g238c69f/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g238c69f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_238c69f-1_all.deb -- Stefano

1 0