March 2024 - dev

[PATCH] netlink: Fix selection of template interface
by David Gibson 20 Mar '24

20 Mar '24

Since f919dc7a4b1c ("conf, netlink: Don't require a default route to start"), if there is only one host interface with routes, we will pick that as the template interface, even if there are no default routes for an IP version. Unfortunately this selection had a serious flaw: in some cases it would 'return' in the middle of an nl_foreach() loop, meaning we wouldn't consume all the netlink responses for our query. This could cause later netlink operations to fail as we read leftover responses from the aborted query. Rewrite the interface detection to avoid this problem. While we're there: * Perform detection of both default and non-default routes in a single pass, avoiding an ugly goto * Give more detail on error and working but unusual paths about the situation (no suitable interface, multiple possible candidates, etc.). Fixes: f919dc7a4b1c ("conf, netlink: Don't require a default route to start") Link: https://bugs.passt.top/show_bug.cgi?id=83 Link: https://github.com/containers/podman/issues/22052 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2270257 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 4 ++-- netlink.c | 62 ++++++++++++++++++++++++++++++++++--------------------- 2 files changed, 40 insertions(+), 26 deletions(-) diff --git a/conf.c b/conf.c index 644752cc..9e0318a5 100644 --- a/conf.c +++ b/conf.c @@ -584,7 +584,7 @@ static unsigned int conf_ip4(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("No interface with a route for IPv4: disabling IPv4"); + info("Couldn't pick external interface: disabling IPv4"); return 0; } @@ -656,7 +656,7 @@ static unsigned int conf_ip6(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("No interface with a route for IPv6: disabling IPv6"); + info("Couldn't pick external interface: disabling IPv6"); return 0; } diff --git a/netlink.c b/netlink.c index 632304c1..c0a5f158 100644 --- a/netlink.c +++ b/netlink.c @@ -254,8 +254,8 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) .rtm.rtm_type = RTN_UNICAST, .rtm.rtm_family = af, }; - bool default_only = true; - unsigned int ifi = 0; + unsigned defifi = 0, anyifi = 0; + unsigned ndef = 0, nany = 0; struct nlmsghdr *nh; struct rtattr *rta; char buf[NLBUFSIZ]; @@ -263,7 +263,6 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) uint32_t seq; size_t na; -again: /* Look for an interface with a default route first, failing that, look * for any interface with a route, and pick it only if it's the only * interface with a route. @@ -271,46 +270,61 @@ again: seq = nl_send(s, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWROUTE) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); + unsigned thisifi = 0; - if (default_only) { - if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af) - continue; - } else { - if (rtm->rtm_family != af) - continue; - } + if (rtm->rtm_family != af) + continue; for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { if (rta->rta_type == RTA_OIF) { - if (!default_only && ifi && - ifi != *(unsigned int *)RTA_DATA(rta)) - return 0; - - ifi = *(unsigned int *)RTA_DATA(rta); + thisifi = *(unsigned int *)RTA_DATA(rta); } else if (rta->rta_type == RTA_MULTIPATH) { const struct rtnexthop *rtnh; rtnh = (struct rtnexthop *)RTA_DATA(rta); + thisifi = rtnh->rtnh_ifindex; + } + } - if (!default_only && ifi && - (int)ifi != rtnh->rtnh_ifindex) - return 0; + if (!thisifi) + continue; /* No interface for this route */ - ifi = rtnh->rtnh_ifindex; - } + if (rtm->rtm_dst_len == 0) { + /* Default route */ + ndef++; + if (!defifi) + defifi = thisifi; + } else { + /* Non-default route */ + nany++; + if (!anyifi) + anyifi = thisifi; } } if (status < 0) warn("netlink: RTM_GETROUTE failed: %s", strerror(-status)); - if (!ifi && default_only) { - default_only = false; - goto again; + if (defifi) { + if (ndef > 1) + info("Multiple default %s routes, picked first", + af == AF_INET ? "IPv4" : "IPv6"); + return defifi; } - return ifi; + if (anyifi) { + if (nany == 1) + return anyifi; + + warn("Multiple interfaces with %s routes, use -i to select one", + af == AF_INET ? "IPv4" : "IPv6"); + } + + if (!nany) + warn("No interfaces with %s routes", af == AF_INET ? "IPv4" : "IPv6"); + + return 0; } /** -- 2.44.0

3 4

passt: new version 2024_03_20.71dd405 available
by Stefano Brivio 20 Mar '24

20 Mar '24

The new version with tag 2024_03_20.71dd405 includes the following changes: 71dd405 util: fix confusion between offset in the iovec array and in the entry 639fdf0 netlink: Fix selection of template interface https://passt.top/passt/log/?qt=range&q=2024_03_19.d35bcbe..2024_03_20.71dd… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7187051/ permanent mirror: https://passt.top/builds/copr/0^20240320.g71dd405/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g71dd405-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_71dd405-1_all.deb -- Stefano

1 0

[PATCH v2] util: fix confusion between offset in the iovec array and in the entry
by Laurent Vivier 20 Mar '24

20 Mar '24

In write_remainder() 'skip' is the offset to start the operation from in the iovec array. In iov_skip_bytes(), 'skip' is also the offset in the iovec array but 'offset' is the first unskipped byte in the iovec entry. As write_remainder() uses 'skip' for both, 'skip' is reset to the first unskipped byte in the iovec entry rather to staying the first unskipped byte in the iovec array. Fix the problem by introducing a new variable not to overwrite 'skip' on each loop. Fixes: 8bdb0883b441 ("util: Add write_remainder() helper") Cc: david(a)gibson.dropbear.id.au Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v2: - check offset != 0, not skip != 0 util.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/util.c b/util.c index 3b2393d6bfa8..849fa7f608c6 100644 --- a/util.c +++ b/util.c @@ -533,13 +533,14 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, int write_remainder(int fd, const struct iovec *iov, int iovcnt, size_t skip) { int i; + size_t offset; - while ((i = iov_skip_bytes(iov, iovcnt, skip, &skip)) < iovcnt) { + while ((i = iov_skip_bytes(iov, iovcnt, skip, &offset)) < iovcnt) { ssize_t rc; - if (skip) { - rc = write(fd, (char *)iov[i].iov_base + skip, - iov[i].iov_len - skip); + if (offset) { + rc = write(fd, (char *)iov[i].iov_base + offset, + iov[i].iov_len - offset); } else { rc = writev(fd, &iov[i], iovcnt - i); } -- 2.42.0

3 2

[PATCH] util: fix confusion between offset in the iovec array and in the entry
by Laurent Vivier 20 Mar '24

20 Mar '24

In write_remainder() 'skip' is the offset to start the operation from in the iovec array. In iov_skip_bytes(), 'skip' is also the offset in the iovec array but 'offset' is the first unskipped byte in the iovec entry. As write_remainder() uses 'skip' for both, 'skip' is reset to the first unskipped byte in the iovec entry rather to staying the first unskipped byte in the iovec array. Fix the problem by introducing a new variable not to overwrite 'skip' on each loop. Fixes: 8bdb0883b441 ("util: Add write_remainder() helper") Cc: david(a)gibson.dropbear.id.au Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- util.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/util.c b/util.c index 3b2393d6bfa8..eee53aed811b 100644 --- a/util.c +++ b/util.c @@ -533,13 +533,14 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, int write_remainder(int fd, const struct iovec *iov, int iovcnt, size_t skip) { int i; + size_t offset; - while ((i = iov_skip_bytes(iov, iovcnt, skip, &skip)) < iovcnt) { + while ((i = iov_skip_bytes(iov, iovcnt, skip, &offset)) < iovcnt) { ssize_t rc; if (skip) { - rc = write(fd, (char *)iov[i].iov_base + skip, - iov[i].iov_len - skip); + rc = write(fd, (char *)iov[i].iov_base + offset, + iov[i].iov_len - offset); } else { rc = writev(fd, &iov[i], iovcnt - i); } -- 2.42.0

2 2

passt: new version 2024_03_19.d35bcbe available
by Stefano Brivio 19 Mar '24

19 Mar '24

The new version with tag 2024_03_19.d35bcbe includes the following change: d35bcbe netlink: Fix handling of NLMSG_DONE in nl_route_dup() https://passt.top/passt/log/?qt=range&q=2024_03_18.615d370..2024_03_19.d35b… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7182507/ permanent mirror: https://passt.top/builds/copr/0^20240319.gd35bcbe/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gd35bcbe-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0d35bcbe-1_all.deb -- Stefano

1 0

[PATCH] netlink: Fix handling of NLMSG_DONE in nl_route_dup()
by David Gibson 19 Mar '24

19 Mar '24

A recent kernel change 87d381973e49 ("genetlink: fit NLMSG_DONE into same read() as families") changed netlink behaviour so that the NLMSG_DONE terminating a bunch of responses can go in the same datagram as those responses, rather than in a separate one. Our netlink code is supposed to handle that behaviour, and indeed does so for most cases, using the nl_foreach() macro. However, there was a subtle error in nl_route_dup() which doesn't work with this change. f00b1534 ("netlink: Don't try to get further datagrams in nl_route_dup() on NLMSG_DONE") attempted to fix this, but has its own subtle error. The problem arises because nl_route_dup(), unlike other cases doesn't just make a single pass through all the responses to a netlink request. It needs to get all the routes, then make multiple passes through them. We don't really have anywhere to buffer multiple datagrams, so we only support the case where all the routes fit in a single datagram - but we need to fail gracefully when that's not the case. After receiving the first datagram of responses (with nl_next()) we have a first loop scanning them. It needs to exit when either we run out of messages in the datagram (!NLMSG_OK()) or when we get a message indicating the last response (nl_status() <= 0). What we do after the loop depends on which exit case we had. If we saw the last response, we're done, but otherwise we need to receive more datagrams to discard the rest of the responses. We attempt to check for that second case by re-checking NLMSG_OK(nh, status). However in the got-last-response case, we've altered status from the number of remaining bytes to the error code (usually 0). That means NLMSG_OK() now returns false even if it didn't during the loop check. To fix this we need separate variables for the number of bytes left and the final status code. We also checked status after the loop, but this was redundant: we can only exit the loop with NLMSG_OK() == true if status <= 0. Reported-by: Martin Pitt <mpitt(a)redhat.com> Fixes: f00b153414b1 ("netlink: Don't try to get further datagrams in nl_route_dup() on NLMSG_DONE") Fixes: 4d6e9d0816e2 ("netlink: Always process all responses to a netlink request") Link: https://github.com/containers/podman/issues/22052 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/netlink.c b/netlink.c index f93f3770..632304c1 100644 --- a/netlink.c +++ b/netlink.c @@ -504,7 +504,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), .ifi = ifi_src, }; - ssize_t nlmsgs_size, status; + ssize_t nlmsgs_size, left, status; unsigned dup_routes = 0; struct nlmsghdr *nh; char buf[NLBUFSIZ]; @@ -518,9 +518,9 @@ int nl_route_dup(int s_src, unsigned int ifi_src, * routes in the buffer at once. */ nh = nl_next(s_src, buf, NULL, &nlmsgs_size); - for (status = nlmsgs_size; - NLMSG_OK(nh, status) && (status = nl_status(nh, status, seq)) > 0; - nh = NLMSG_NEXT(nh, status)) { + for (left = nlmsgs_size; + NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; + nh = NLMSG_NEXT(nh, left)) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); struct rtattr *rta; size_t na; @@ -550,8 +550,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, } } - if (nh->nlmsg_type != NLMSG_DONE && - (!NLMSG_OK(nh, status) || status > 0)) { + if (!NLMSG_OK(nh, left)) { /* Process any remaining datagrams in a different * buffer so we don't overwrite the first one. */ @@ -577,9 +576,9 @@ int nl_route_dup(int s_src, unsigned int ifi_src, * to calculate dependencies: let the kernel do that. */ for (i = 0; i < dup_routes; i++) { - for (nh = (struct nlmsghdr *)buf, status = nlmsgs_size; - NLMSG_OK(nh, status); - nh = NLMSG_NEXT(nh, status)) { + for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; + NLMSG_OK(nh, left); + nh = NLMSG_NEXT(nh, left)) { uint16_t flags = nh->nlmsg_flags; int rc; -- 2.44.0

2 1

[RFC v2] tcp: Replace TCP buffer structure by an iovec array
by Laurent Vivier 19 Mar '24

19 Mar '24

To be able to provide pointers to TCP headers and IP headers without worrying about alignment in the structure, split the structure into several arrays and point to each part of the frame using an iovec array. Using iovec also allows us to simply ignore the first entry when the vnet length header is not needed. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v2: - rebased on top of David's series "Some improvements to the tap send path" - no performance improvement anymore - remove the iovec functions of v1 introduced in tap.c to use new functions from David - don't use an array of array of iovec - fix comments - re-introduce MSS4 and MSS6 - address comments from David and Stefano I have tested only passt, not pasta tap.c | 3 +- tcp.c | 479 ++++++++++++++++++++++++++++------------------------------ 2 files changed, 233 insertions(+), 249 deletions(-) diff --git a/tap.c b/tap.c index 13e4da79d690..605b472b5ca2 100644 --- a/tap.c +++ b/tap.c @@ -424,8 +424,7 @@ size_t tap_send_frames(const struct ctx *c, const struct iovec *iov, debug("tap: failed to send %zu frames of %zu", nframes - m, nframes); - pcap_multiple(iov, bufs_per_frame, m, - c->mode == MODE_PASST ? sizeof(uint32_t) : 0); + pcap_multiple(iov, bufs_per_frame, m, 0); return m; } diff --git a/tcp.c b/tcp.c index a1860d10b15f..d5c09dbf53ab 100644 --- a/tcp.c +++ b/tcp.c @@ -318,39 +318,8 @@ /* MSS rounding: see SET_MSS() */ #define MSS_DEFAULT 536 - -struct tcp4_l2_head { /* For MSS4 macro: keep in sync with tcp4_l2_buf_t */ -#ifdef __AVX2__ - uint8_t pad[26]; -#else - uint8_t pad[2]; -#endif - struct tap_hdr taph; - struct iphdr iph; - struct tcphdr th; -#ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))); -#else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))); -#endif - -struct tcp6_l2_head { /* For MSS6 macro: keep in sync with tcp6_l2_buf_t */ -#ifdef __AVX2__ - uint8_t pad[14]; -#else - uint8_t pad[2]; -#endif - struct tap_hdr taph; - struct ipv6hdr ip6h; - struct tcphdr th; -#ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))); -#else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))); -#endif - -#define MSS4 ROUND_DOWN(USHRT_MAX - sizeof(struct tcp4_l2_head), 4) -#define MSS6 ROUND_DOWN(USHRT_MAX - sizeof(struct tcp6_l2_head), 4) +#define MSS4 ROUND_DOWN(ETH_MAX_MTU - ETH_HLEN - sizeof(struct tcphdr) - sizeof(struct iphdr), sizeof(uint32_t)) +#define MSS6 ROUND_DOWN(ETH_MAX_MTU - ETH_HLEN - sizeof(struct tcphdr) - sizeof(struct ipv6hdr), sizeof(uint32_t)) #define WINDOW_DEFAULT 14600 /* RFC 6928 */ #ifdef HAS_SND_WND @@ -445,133 +414,111 @@ struct tcp_buf_seq_update { }; /* Static buffers */ - /** - * tcp4_l2_buf_t - Pre-cooked IPv4 packet buffers for tap connections - * @pad: Align TCP header to 32 bytes, for AVX2 checksum calculation only - * @taph: Tap-level headers (partially pre-filled) - * @iph: Pre-filled IP header (except for tot_len and saddr) - * @uh: Headroom for TCP header - * @data: Storage for TCP payload + * struct tcp_l2_payload_t - TCP header and data to send data + * 32 bytes aligned to be able to use AVX2 checksum + * @th: TCP header + * @data: TCP data */ -static struct tcp4_l2_buf_t { -#ifdef __AVX2__ - uint8_t pad[26]; /* 0, align th to 32 bytes */ -#else - uint8_t pad[2]; /* align iph to 4 bytes 0 */ -#endif - struct tap_hdr taph; /* 26 2 */ - struct iphdr iph; /* 44 20 */ - struct tcphdr th; /* 64 40 */ - uint8_t data[MSS4]; /* 84 60 */ - /* 65536 65532 */ +struct tcp_l2_payload_t { + struct tcphdr th; + uint8_t data[65536 - sizeof(struct tcphdr)]; #ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))) +} __attribute__ ((packed, aligned(32))); #else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))) +} __attribute__ ((packed, aligned(__alignof__(unsigned int)))); #endif -tcp4_l2_buf[TCP_FRAMES_MEM]; -static struct tcp_buf_seq_update tcp4_l2_buf_seq_update[TCP_FRAMES_MEM]; - -static unsigned int tcp4_l2_buf_used; +static_assert(MSS4 <= sizeof(((struct tcp_l2_payload_t *)0)->data)); +static_assert(MSS6 <= sizeof(((struct tcp_l2_payload_t *)0)->data)); /** - * tcp6_l2_buf_t - Pre-cooked IPv6 packet buffers for tap connections - * @pad: Align IPv6 header for checksum calculation to 32B (AVX2) or 4B - * @taph: Tap-level headers (partially pre-filled) - * @ip6h: Pre-filled IP header (except for payload_len and addresses) - * @th: Headroom for TCP header - * @data: Storage for TCP payload + * struct tcp_l2_flags_t - TCP header and data to send option flags + * @th: TCP header + * @opts TCP option flags */ -struct tcp6_l2_buf_t { -#ifdef __AVX2__ - uint8_t pad[14]; /* 0 align ip6h to 32 bytes */ -#else - uint8_t pad[2]; /* align ip6h to 4 bytes 0 */ -#endif - struct tap_hdr taph; /* 14 2 */ - struct ipv6hdr ip6h; /* 32 20 */ - struct tcphdr th; /* 72 60 */ - uint8_t data[MSS6]; /* 92 80 */ - /* 65536 65532 */ +struct tcp_l2_flags_t { + struct tcphdr th; + char opts[OPT_MSS_LEN + OPT_WS_LEN + 1]; #ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))) +} __attribute__ ((packed, aligned(32))); #else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))) +} __attribute__ ((packed, aligned(__alignof__(unsigned int)))); #endif -tcp6_l2_buf[TCP_FRAMES_MEM]; -static struct tcp_buf_seq_update tcp6_l2_buf_seq_update[TCP_FRAMES_MEM]; +static uint32_t tcp4_vnet_len [TCP_FRAMES_MEM]; +/* Ethernet header for IPv4 frames */ +static struct ethhdr tcp4_eth_src; + +/* IPv4 headers */ +static struct iphdr tcp4_l2_ip[TCP_FRAMES_MEM]; +/* TCP headers and data for IPv4 frames */ +static struct tcp_l2_payload_t tcp4_l2_payload[TCP_FRAMES_MEM]; +static struct tcp_buf_seq_update tcp4_l2_buf_seq_update[TCP_FRAMES_MEM]; +static unsigned int tcp4_l2_buf_used; + +static uint32_t tcp4_flags_vnet_len [TCP_FRAMES_MEM]; +/* IPv4 headers for TCP option flags frames */ +static struct iphdr tcp4_l2_flags_ip[TCP_FRAMES_MEM]; +/* TCP headers and option flags for IPv4 frames */ +static struct tcp_l2_flags_t tcp4_l2_flags[TCP_FRAMES_MEM]; + +static unsigned int tcp4_l2_flags_buf_used; + +static uint32_t tcp6_vnet_len [TCP_FRAMES_MEM]; +/* Ethernet header for IPv6 frames */ +static struct ethhdr tcp6_eth_src; + +/* IPv6 headers */ +static struct ipv6hdr tcp6_l2_ip[TCP_FRAMES_MEM]; +/* TCP headers and data for IPv6 frames */ +static struct tcp_l2_payload_t tcp6_l2_payload[TCP_FRAMES_MEM]; + +static struct tcp_buf_seq_update tcp6_l2_buf_seq_update[TCP_FRAMES_MEM]; static unsigned int tcp6_l2_buf_used; +static uint32_t tcp6_flags_vnet_len [TCP_FRAMES_MEM]; +/* IPv6 headers for TCP option flags frames */ +static struct ipv6hdr tcp6_l2_flags_ip[TCP_FRAMES_MEM]; +/* TCP headers and option flags for IPv6 frames */ +static struct tcp_l2_flags_t tcp6_l2_flags[TCP_FRAMES_MEM]; + +static unsigned int tcp6_l2_flags_buf_used; + /* recvmsg()/sendmsg() data for tap */ static char tcp_buf_discard [MAX_WINDOW]; static struct iovec iov_sock [TCP_FRAMES_MEM + 1]; -static struct iovec tcp4_l2_iov [TCP_FRAMES_MEM]; -static struct iovec tcp6_l2_iov [TCP_FRAMES_MEM]; -static struct iovec tcp4_l2_flags_iov [TCP_FRAMES_MEM]; -static struct iovec tcp6_l2_flags_iov [TCP_FRAMES_MEM]; +/* + * enum tcp_iov_parts - I/O vector parts for one TCP frame + * TCP_IOV_TAP TAP header + * TCP_IOV_ETH ethernet header + * TCP_IOV_IP IP (v4/v6) header + * TCP_IOV_PAYLOAD IP payload (TCP header + data) + * TCP_IOV_NUM is the number of entries in the iovec array + */ +enum tcp_iov_parts { + /* TAP header */ + TCP_IOV_TAP = 0, + /* ethernet header */ + TCP_IOV_ETH = 1, + /* IP (v4/v6) header */ + TCP_IOV_IP = 2, + /* IP payload (TCP header + data) */ + TCP_IOV_PAYLOAD = 3, + /* number of entries in the iovec array */ + TCP_IOV_NUM +}; + +static struct iovec tcp4_l2_iov [TCP_FRAMES_MEM * TCP_IOV_NUM]; +static struct iovec tcp6_l2_iov [TCP_FRAMES_MEM * TCP_IOV_NUM]; +static struct iovec tcp4_l2_flags_iov [TCP_FRAMES_MEM * TCP_IOV_NUM]; +static struct iovec tcp6_l2_flags_iov [TCP_FRAMES_MEM * TCP_IOV_NUM]; /* sendmsg() to socket */ static struct iovec tcp_iov [UIO_MAXIOV]; -/** - * tcp4_l2_flags_buf_t - IPv4 packet buffers for segments without data (flags) - * @pad: Align TCP header to 32 bytes, for AVX2 checksum calculation only - * @taph: Tap-level headers (partially pre-filled) - * @iph: Pre-filled IP header (except for tot_len and saddr) - * @th: Headroom for TCP header - * @opts: Headroom for TCP options - */ -static struct tcp4_l2_flags_buf_t { -#ifdef __AVX2__ - uint8_t pad[26]; /* 0, align th to 32 bytes */ -#else - uint8_t pad[2]; /* align iph to 4 bytes 0 */ -#endif - struct tap_hdr taph; /* 26 2 */ - struct iphdr iph; /* 44 20 */ - struct tcphdr th; /* 64 40 */ - char opts[OPT_MSS_LEN + OPT_WS_LEN + 1]; -#ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))) -#else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))) -#endif -tcp4_l2_flags_buf[TCP_FRAMES_MEM]; - -static unsigned int tcp4_l2_flags_buf_used; - -/** - * tcp6_l2_flags_buf_t - IPv6 packet buffers for segments without data (flags) - * @pad: Align IPv6 header for checksum calculation to 32B (AVX2) or 4B - * @taph: Tap-level headers (partially pre-filled) - * @ip6h: Pre-filled IP header (except for payload_len and addresses) - * @th: Headroom for TCP header - * @opts: Headroom for TCP options - */ -static struct tcp6_l2_flags_buf_t { -#ifdef __AVX2__ - uint8_t pad[14]; /* 0 align ip6h to 32 bytes */ -#else - uint8_t pad[2]; /* align ip6h to 4 bytes 0 */ -#endif - struct tap_hdr taph; /* 14 2 */ - struct ipv6hdr ip6h; /* 32 20 */ - struct tcphdr th /* 72 */ __attribute__ ((aligned(4))); /* 60 */ - char opts[OPT_MSS_LEN + OPT_WS_LEN + 1]; -#ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))) -#else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))) -#endif -tcp6_l2_flags_buf[TCP_FRAMES_MEM]; - -static unsigned int tcp6_l2_flags_buf_used; - #define CONN(idx) (&(FLOW(idx)->tcp)) /* Table for lookup from remote address, local port, remote port */ @@ -967,25 +914,14 @@ static void tcp_update_check_tcp6(struct ipv6hdr *ip6h, struct tcphdr *th) } /** - * tcp_update_l2_buf() - Update L2 buffers with Ethernet and IPv4 addresses + * tcp_update_l2_buf() - Update ethernet header buffers with addresses * @eth_d: Ethernet destination address, NULL if unchanged * @eth_s: Ethernet source address, NULL if unchanged */ void tcp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s) { - int i; - - for (i = 0; i < TCP_FRAMES_MEM; i++) { - struct tcp4_l2_flags_buf_t *b4f = &tcp4_l2_flags_buf[i]; - struct tcp6_l2_flags_buf_t *b6f = &tcp6_l2_flags_buf[i]; - struct tcp4_l2_buf_t *b4 = &tcp4_l2_buf[i]; - struct tcp6_l2_buf_t *b6 = &tcp6_l2_buf[i]; - - eth_update_mac(&b4->taph.eh, eth_d, eth_s); - eth_update_mac(&b6->taph.eh, eth_d, eth_s); - eth_update_mac(&b4f->taph.eh, eth_d, eth_s); - eth_update_mac(&b6f->taph.eh, eth_d, eth_s); - } + eth_update_mac(&tcp4_eth_src, eth_d, eth_s); + eth_update_mac(&tcp6_eth_src, eth_d, eth_s); } /** @@ -995,29 +931,42 @@ void tcp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s) static void tcp_sock4_iov_init(const struct ctx *c) { struct iphdr iph = L2_BUF_IP4_INIT(IPPROTO_TCP); - struct iovec *iov; int i; - for (i = 0; i < ARRAY_SIZE(tcp4_l2_buf); i++) { - tcp4_l2_buf[i] = (struct tcp4_l2_buf_t) { - .taph = TAP_HDR_INIT(ETH_P_IP), - .iph = iph, - .th = { .doff = sizeof(struct tcphdr) / 4, .ack = 1 } - }; - } + tcp4_eth_src.h_proto = htons_constant(ETH_P_IP); + for (i = 0; i < TCP_FRAMES_MEM; i++) { + struct iovec *iov; - for (i = 0; i < ARRAY_SIZE(tcp4_l2_flags_buf); i++) { - tcp4_l2_flags_buf[i] = (struct tcp4_l2_flags_buf_t) { - .taph = TAP_HDR_INIT(ETH_P_IP), - .iph = L2_BUF_IP4_INIT(IPPROTO_TCP) - }; - } + /* headers */ + tcp4_l2_ip[i] = iph; + tcp4_l2_payload[i].th.doff = sizeof(struct tcphdr) / 4; + tcp4_l2_payload[i].th.ack = 1; - for (i = 0, iov = tcp4_l2_iov; i < TCP_FRAMES_MEM; i++, iov++) - iov->iov_base = tap_frame_base(c, &tcp4_l2_buf[i].taph); + tcp4_l2_flags_ip[i] = iph; + tcp4_l2_flags[i].th.doff = sizeof(struct tcphdr) / 4; + tcp4_l2_flags[i].th.ack = 1; - for (i = 0, iov = tcp4_l2_flags_iov; i < TCP_FRAMES_MEM; i++, iov++) - iov->iov_base = tap_frame_base(c, &tcp4_l2_flags_buf[i].taph); + /* iovecs */ + iov = &tcp4_l2_iov[i * TCP_IOV_NUM]; + iov[TCP_IOV_TAP].iov_base = &tcp4_vnet_len[i]; + iov[TCP_IOV_TAP].iov_len = c->mode == MODE_PASST ? + sizeof(uint32_t) : 0; + iov[TCP_IOV_ETH].iov_base = &tcp4_eth_src; + iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); + iov[TCP_IOV_IP].iov_base = &tcp4_l2_ip[i]; + iov[TCP_IOV_IP].iov_len = sizeof(struct iphdr); + iov[TCP_IOV_PAYLOAD].iov_base = &tcp4_l2_payload[i]; + + iov = &tcp4_l2_flags_iov[i * TCP_IOV_NUM]; + iov[TCP_IOV_TAP].iov_base = &tcp4_flags_vnet_len[i]; + iov[TCP_IOV_TAP].iov_len = c->mode == MODE_PASST ? + sizeof(uint32_t) : 0; + iov[TCP_IOV_ETH].iov_base = &tcp4_eth_src; + iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); + iov[TCP_IOV_IP].iov_base = &tcp4_l2_flags_ip[i]; + iov[TCP_IOV_IP].iov_len = sizeof(struct iphdr); + iov[TCP_IOV_PAYLOAD].iov_base = &tcp4_l2_flags[i]; + } } /** @@ -1026,29 +975,43 @@ static void tcp_sock4_iov_init(const struct ctx *c) */ static void tcp_sock6_iov_init(const struct ctx *c) { - struct iovec *iov; + struct ipv6hdr ip6 = L2_BUF_IP6_INIT(IPPROTO_TCP); int i; - for (i = 0; i < ARRAY_SIZE(tcp6_l2_buf); i++) { - tcp6_l2_buf[i] = (struct tcp6_l2_buf_t) { - .taph = TAP_HDR_INIT(ETH_P_IPV6), - .ip6h = L2_BUF_IP6_INIT(IPPROTO_TCP), - .th = { .doff = sizeof(struct tcphdr) / 4, .ack = 1 } - }; - } + tcp6_eth_src.h_proto = htons_constant(ETH_P_IPV6); + for (i = 0; i < TCP_FRAMES_MEM; i++) { + struct iovec *iov; - for (i = 0; i < ARRAY_SIZE(tcp6_l2_flags_buf); i++) { - tcp6_l2_flags_buf[i] = (struct tcp6_l2_flags_buf_t) { - .taph = TAP_HDR_INIT(ETH_P_IPV6), - .ip6h = L2_BUF_IP6_INIT(IPPROTO_TCP) - }; - } + /* headers */ + tcp6_l2_ip[i] = ip6; + tcp6_l2_payload[i].th.doff = sizeof(struct tcphdr) / 4; + tcp6_l2_payload[i].th.ack = 1; - for (i = 0, iov = tcp6_l2_iov; i < TCP_FRAMES_MEM; i++, iov++) - iov->iov_base = tap_frame_base(c, &tcp6_l2_buf[i].taph); + tcp6_l2_flags_ip[i] = ip6; + tcp6_l2_flags[i].th.doff = sizeof(struct tcphdr) / 4; + tcp6_l2_flags[i].th .ack = 1; - for (i = 0, iov = tcp6_l2_flags_iov; i < TCP_FRAMES_MEM; i++, iov++) - iov->iov_base = tap_frame_base(c, &tcp6_l2_flags_buf[i].taph); + /* iovecs */ + iov = &tcp6_l2_iov[i * TCP_IOV_NUM]; + iov[TCP_IOV_TAP].iov_base = &tcp6_vnet_len[i]; + iov[TCP_IOV_TAP].iov_len = c->mode == MODE_PASST ? + sizeof(uint32_t) : 0; + iov[TCP_IOV_ETH].iov_base = &tcp6_eth_src; + iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); + iov[TCP_IOV_IP].iov_base = &tcp6_l2_ip[i]; + iov[TCP_IOV_IP].iov_len = sizeof(struct ipv6hdr); + iov[TCP_IOV_PAYLOAD].iov_base = &tcp6_l2_payload[i]; + + iov = &tcp6_l2_flags_iov[i * TCP_IOV_NUM]; + iov[TCP_IOV_TAP].iov_base = &tcp6_flags_vnet_len[i]; + iov[TCP_IOV_TAP].iov_len = c->mode == MODE_PASST ? + sizeof(uint32_t) : 0; + iov[TCP_IOV_ETH].iov_base = &tcp6_eth_src; + iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); + iov[TCP_IOV_IP].iov_base = &tcp6_l2_flags_ip[i]; + iov[TCP_IOV_IP].iov_len = sizeof(struct ipv6hdr); + iov[TCP_IOV_PAYLOAD].iov_base = &tcp6_l2_flags[i]; + } } /** @@ -1289,10 +1252,12 @@ static void tcp_rst_do(struct ctx *c, struct tcp_tap_conn *conn); */ static void tcp_l2_flags_buf_flush(const struct ctx *c) { - tap_send_frames(c, tcp6_l2_flags_iov, 1, tcp6_l2_flags_buf_used); + tap_send_frames(c, tcp6_l2_flags_iov, TCP_IOV_NUM, + tcp6_l2_flags_buf_used); tcp6_l2_flags_buf_used = 0; - tap_send_frames(c, tcp4_l2_flags_iov, 1, tcp4_l2_flags_buf_used); + tap_send_frames(c, tcp4_l2_flags_iov, TCP_IOV_NUM, + tcp4_l2_flags_buf_used); tcp4_l2_flags_buf_used = 0; } @@ -1305,12 +1270,12 @@ static void tcp_l2_data_buf_flush(const struct ctx *c) unsigned i; size_t m; - m = tap_send_frames(c, tcp6_l2_iov, 1, tcp6_l2_buf_used); + m = tap_send_frames(c, tcp6_l2_iov, TCP_IOV_NUM, tcp6_l2_buf_used); for (i = 0; i < m; i++) *tcp6_l2_buf_seq_update[i].seq += tcp6_l2_buf_seq_update[i].len; tcp6_l2_buf_used = 0; - m = tap_send_frames(c, tcp4_l2_iov, 1, tcp4_l2_buf_used); + m = tap_send_frames(c, tcp4_l2_iov, TCP_IOV_NUM, tcp4_l2_buf_used); for (i = 0; i < m; i++) *tcp4_l2_buf_seq_update[i].seq += tcp4_l2_buf_seq_update[i].len; tcp4_l2_buf_used = 0; @@ -1433,7 +1398,7 @@ static size_t tcp_fill_headers6(const struct ctx *c, * tcp_l2_buf_fill_headers() - Fill 802.3, IP, TCP headers in pre-cooked buffers * @c: Execution context * @conn: Connection pointer - * @p: Pointer to any type of TCP pre-cooked buffer + * @iov: Pointer to an array of iovec of TCP pre-cooked buffer * @plen: Payload length (including TCP header options) * @check: Checksum, if already known * @seq: Sequence number for this segment @@ -1442,26 +1407,22 @@ static size_t tcp_fill_headers6(const struct ctx *c, */ static size_t tcp_l2_buf_fill_headers(const struct ctx *c, const struct tcp_tap_conn *conn, - void *p, size_t plen, + struct iovec *iov, size_t plen, const uint16_t *check, uint32_t seq) { const struct in_addr *a4 = inany_v4(&conn->faddr); size_t ip_len, tlen; if (a4) { - struct tcp4_l2_buf_t *b = (struct tcp4_l2_buf_t *)p; - - ip_len = tcp_fill_headers4(c, conn, &b->iph, &b->th, plen, + ip_len = tcp_fill_headers4(c, conn, iov[TCP_IOV_IP].iov_base, + iov[TCP_IOV_PAYLOAD].iov_base, plen, check, seq); - - tlen = tap_frame_len(c, &b->taph, ip_len); + tlen = ip_len - sizeof(struct iphdr); } else { - struct tcp6_l2_buf_t *b = (struct tcp6_l2_buf_t *)p; - - ip_len = tcp_fill_headers6(c, conn, &b->ip6h, &b->th, plen, + ip_len = tcp_fill_headers6(c, conn, iov[TCP_IOV_IP].iov_base, + iov[TCP_IOV_PAYLOAD].iov_base, plen, seq); - - tlen = tap_frame_len(c, &b->taph, ip_len); + tlen = ip_len - sizeof(struct ipv6hdr); } return tlen; @@ -1595,16 +1556,16 @@ static int tcp_send_flag(struct ctx *c, struct tcp_tap_conn *conn, int flags) { uint32_t prev_ack_to_tap = conn->seq_ack_to_tap; uint32_t prev_wnd_to_tap = conn->wnd_to_tap; - struct tcp4_l2_flags_buf_t *b4 = NULL; - struct tcp6_l2_flags_buf_t *b6 = NULL; + struct tcp_l2_flags_t *payload; struct tcp_info tinfo = { 0 }; socklen_t sl = sizeof(tinfo); int s = conn->sock; + uint32_t *vnet_len; size_t optlen = 0; - struct iovec *iov; struct tcphdr *th; + struct iovec *iov; + size_t ip_len; char *data; - void *p; if (SEQ_GE(conn->seq_ack_to_tap, conn->seq_from_tap) && !flags && conn->wnd_to_tap) @@ -1627,19 +1588,21 @@ static int tcp_send_flag(struct ctx *c, struct tcp_tap_conn *conn, int flags) return 0; if (CONN_V4(conn)) { - iov = tcp4_l2_flags_iov + tcp4_l2_flags_buf_used; - p = b4 = tcp4_l2_flags_buf + tcp4_l2_flags_buf_used++; - th = &b4->th; - - /* gcc 11.2 would complain on data = (char *)(th + 1); */ - data = b4->opts; + iov = &tcp4_l2_flags_iov[tcp4_l2_flags_buf_used++ * + TCP_IOV_NUM]; + vnet_len = iov[TCP_IOV_TAP].iov_base; + *vnet_len = sizeof(struct ethhdr) + sizeof(struct iphdr); } else { - iov = tcp6_l2_flags_iov + tcp6_l2_flags_buf_used; - p = b6 = tcp6_l2_flags_buf + tcp6_l2_flags_buf_used++; - th = &b6->th; - data = b6->opts; + iov = &tcp6_l2_flags_iov[tcp6_l2_flags_buf_used++ * + TCP_IOV_NUM]; + vnet_len = iov[TCP_IOV_TAP].iov_base; + *vnet_len = sizeof(struct ethhdr) + sizeof(struct ipv6hdr); } + payload = iov[TCP_IOV_PAYLOAD].iov_base; + th = &payload->th; + data = payload->opts; + if (flags & SYN) { int mss; @@ -1688,8 +1651,10 @@ static int tcp_send_flag(struct ctx *c, struct tcp_tap_conn *conn, int flags) th->syn = !!(flags & SYN); th->fin = !!(flags & FIN); - iov->iov_len = tcp_l2_buf_fill_headers(c, conn, p, optlen, - NULL, conn->seq_to_tap); + ip_len = tcp_l2_buf_fill_headers(c, conn, iov, optlen, NULL, + conn->seq_to_tap); + iov[TCP_IOV_PAYLOAD].iov_len = ip_len; + *vnet_len = htonl(*vnet_len + ip_len); if (th->ack) { if (SEQ_GE(conn->seq_ack_to_tap, conn->seq_from_tap)) @@ -1705,23 +1670,29 @@ static int tcp_send_flag(struct ctx *c, struct tcp_tap_conn *conn, int flags) if (th->fin || th->syn) conn->seq_to_tap++; - if (CONN_V4(conn)) { - if (flags & DUP_ACK) { - memcpy(b4 + 1, b4, sizeof(*b4)); - (iov + 1)->iov_len = iov->iov_len; - tcp4_l2_flags_buf_used++; + if (flags & DUP_ACK) { + struct iovec *dup_iov; + int i; + + if (CONN_V4(conn)) + dup_iov = &tcp4_l2_flags_iov[tcp4_l2_flags_buf_used++ * + TCP_IOV_NUM]; + else + dup_iov = &tcp6_l2_flags_iov[tcp6_l2_flags_buf_used++ * + TCP_IOV_NUM]; + + for (i = 0; i < TCP_IOV_NUM; i++) { + memcpy(dup_iov[i].iov_base, iov[i].iov_base, + iov[i].iov_len); + dup_iov[i].iov_len = iov[i].iov_len; } + } - if (tcp4_l2_flags_buf_used > ARRAY_SIZE(tcp4_l2_flags_buf) - 2) + if (CONN_V4(conn)) { + if (tcp4_l2_flags_buf_used > TCP_FRAMES_MEM - 2) tcp_l2_flags_buf_flush(c); } else { - if (flags & DUP_ACK) { - memcpy(b6 + 1, b6, sizeof(*b6)); - (iov + 1)->iov_len = iov->iov_len; - tcp6_l2_flags_buf_used++; - } - - if (tcp6_l2_flags_buf_used > ARRAY_SIZE(tcp6_l2_flags_buf) - 2) + if (tcp6_l2_flags_buf_used > TCP_FRAMES_MEM - 2) tcp_l2_flags_buf_flush(c); } @@ -2168,30 +2139,44 @@ static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, ssize_t plen, int no_csum, uint32_t seq) { uint32_t *seq_update = &conn->seq_to_tap; + uint32_t *vnet_len; struct iovec *iov; + size_t ip_len; if (CONN_V4(conn)) { - struct tcp4_l2_buf_t *b = &tcp4_l2_buf[tcp4_l2_buf_used]; - const uint16_t *check = no_csum ? &(b - 1)->iph.check : NULL; + struct iovec *iov_prev = &tcp4_l2_iov[(tcp4_l2_buf_used - 1) * TCP_IOV_NUM]; + const uint16_t *check = NULL; + + if (no_csum) { + struct iphdr *iph = iov_prev[TCP_IOV_IP].iov_base; + check = &iph->check; + } tcp4_l2_buf_seq_update[tcp4_l2_buf_used].seq = seq_update; tcp4_l2_buf_seq_update[tcp4_l2_buf_used].len = plen; - iov = tcp4_l2_iov + tcp4_l2_buf_used++; - iov->iov_len = tcp_l2_buf_fill_headers(c, conn, b, plen, - check, seq); - if (tcp4_l2_buf_used > ARRAY_SIZE(tcp4_l2_buf) - 1) + iov = &tcp4_l2_iov[tcp4_l2_buf_used++ * TCP_IOV_NUM]; + ip_len = tcp_l2_buf_fill_headers(c, conn, iov, plen, check, + seq); + iov[TCP_IOV_PAYLOAD].iov_len = ip_len; + vnet_len = iov[TCP_IOV_TAP].iov_base; + *vnet_len = htonl(sizeof(struct ethhdr) + + sizeof(struct iphdr) + + ip_len); + if (tcp4_l2_buf_used > TCP_FRAMES_MEM - 1) tcp_l2_data_buf_flush(c); } else if (CONN_V6(conn)) { - struct tcp6_l2_buf_t *b = &tcp6_l2_buf[tcp6_l2_buf_used]; - tcp6_l2_buf_seq_update[tcp6_l2_buf_used].seq = seq_update; tcp6_l2_buf_seq_update[tcp6_l2_buf_used].len = plen; - iov = tcp6_l2_iov + tcp6_l2_buf_used++; - iov->iov_len = tcp_l2_buf_fill_headers(c, conn, b, plen, - NULL, seq); - if (tcp6_l2_buf_used > ARRAY_SIZE(tcp6_l2_buf) - 1) + iov = &tcp6_l2_iov[tcp6_l2_buf_used++ * TCP_IOV_NUM]; + ip_len = tcp_l2_buf_fill_headers(c, conn, iov, plen, NULL, seq); + iov[TCP_IOV_PAYLOAD].iov_len = ip_len; + vnet_len = iov[TCP_IOV_TAP].iov_base; + *vnet_len = htonl(sizeof(struct ethhdr) + + sizeof(struct ipv6hdr) + + ip_len); + if (tcp6_l2_buf_used > TCP_FRAMES_MEM - 1) tcp_l2_data_buf_flush(c); } } @@ -2247,8 +2232,8 @@ static int tcp_data_from_sock(struct ctx *c, struct tcp_tap_conn *conn) iov_sock[0].iov_base = tcp_buf_discard; iov_sock[0].iov_len = already_sent; - if (( v4 && tcp4_l2_buf_used + fill_bufs > ARRAY_SIZE(tcp4_l2_buf)) || - (!v4 && tcp6_l2_buf_used + fill_bufs > ARRAY_SIZE(tcp6_l2_buf))) { + if (( v4 && tcp4_l2_buf_used + fill_bufs > TCP_FRAMES_MEM) || + (!v4 && tcp6_l2_buf_used + fill_bufs > TCP_FRAMES_MEM)) { tcp_l2_data_buf_flush(c); /* Silence Coverity CWE-125 false positive */ @@ -2257,9 +2242,9 @@ static int tcp_data_from_sock(struct ctx *c, struct tcp_tap_conn *conn) for (i = 0, iov = iov_sock + 1; i < fill_bufs; i++, iov++) { if (v4) - iov->iov_base = &tcp4_l2_buf[tcp4_l2_buf_used + i].data; + iov->iov_base = &tcp4_l2_payload[tcp4_l2_buf_used + i].data; else - iov->iov_base = &tcp6_l2_buf[tcp6_l2_buf_used + i].data; + iov->iov_base = &tcp6_l2_payload[tcp6_l2_buf_used + i].data; iov->iov_len = mss; } if (iov_rem) -- 2.42.0

3 3

passt: new version 2024_03_18.615d370 available
by Stefano Brivio 18 Mar '24

18 Mar '24

The new version with tag 2024_03_18.615d370 includes the following changes: 615d370 fedora: Switch license identifier to SPDX d989eae udp: Translate source address of resolver only for DNS remapped queries f919dc7 conf, netlink: Don't require a default route to start f00b153 netlink: Don't try to get further datagrams in nl_route_dup() on NLMSG_DONE d3eb0d7 tap: Rename tap_iov_{base,len} 4db947d tap: Implement tap_send() "slow path" in terms of fast path 1ebe787 tap: Simplify some casts in the tap "slow path" functions 2d0e008 tap: Extend tap_send_frames() to allow multi-buffer frames f67238a passt, log: Call __openlog() earlier, log to stderr until we detach 3fe9878 pcap: Use clock_gettime() instead of gettimeofday() 0761f29 passt.1: --{no-,}dhcp-dns and --{no-,}dhcp-search don't take addresses 4d05ba2 conf: Warn if we can't advertise any nameserver via DHCP, NDP, or DHCPv6 4388163 conf: Handle addresses passed via --dns just like the ones from resolv.conf b299942 tap: Capture only packets that are actually sent 413c159 udp: Use existing helper for UDP checksum on inbound IPv6 packets ae69838 udp: Avoid unnecessary pointer in udp_update_hdr4() b0419d1 udp: Re-order udp_update_hdr[46] for clarity and brevity 8a842e0 udp: Pass data length explicitly to to udp_update_hdr[46] 76571ae udp: Consistent port variable names in udp_update_hdr[46] 205b140 udp: Refactor udp_sock[46]_iov_init() 860d276 conf: Don't warn if nameservers were found, but won't be advertised 4779dfe icmp: Use 'flowside' epoll references for ping sockets 02cbdb0 icmp: Flow based error reporting 3af5e9f icmp: Store ping socket information in flow table 383a6f6 ip: Use regular htons() for non-constant protocol number in L2_BUF_IP4_PSUM 137ce01 iov: Improve documentation of iov_skip_bytes() bb11d15 tcp: Introduce tcp_fill_headers4()/tcp_fill_headers6() 6b22e10 tap: make tap_update_mac() generic 7df624e checksum: introduce functions to compute the header part checksum for TCP/UDP feb4900 checksum: use csum_ip4_header() in udp.c and tcp.c e82b4fe udp: little cleanup in udp_update_hdrX() to prepare future changes 324bd46 util: move IP stuff from util.[ch] to ip.[ch] e289d28 checksum: add csum_iov() 907621e checksum: align buffers 94502fa pcap: add pcap_iov() 3b9098a fwd: Rename port_fwd.[ch] and their contents 10376e7 port_fwd: Fix copypasta error in port_fwd_scan_udp() comments f15be71 tap: Disallow loopback addresses on tap interface 3b59b97 tcp: Validate TCP endpoint addresses dc9a5d7 tcp, tcp_splice: Parse listening socket epoll ref in tcp_listen_handler() ee677e0 tcp_splice: Improve logic deciding when to splice 4c2d923 tcp_splice: Improve error reporting on connect path f0e2a6b tcp_splice: Make tcp_splice_connect() create its own sockets f4e5d73 tcp_splice: Merge tcp_splice_new() into its caller 04d3d02 tcp_splice: More specific variable names in new splice path 0f938c3 flow: Clarify flow entry life cycle, introduce uniform logging d0550f9 tcp_splice: Don't use flow_trace() before setting flow type 80f9b61 tcp_splice: Simplify clean up logic 76c7e1d flow: Add helper to determine a flow's protocol bb9bf0b tcp, udp: Don't precompute port remappings in epoll references e196ead util: Allow IN4_IS_* macros to operate on untyped addresses f6e6e8a inany: Introduce union sockaddr_inany 0cf6b2d inany: Provide more conveniently typed constants for special addresses 330b5db inany: Add inany_ntop() helper d31277e inany: Helper to test for various address types 9a3fb5e tap: Use write_remainder() in tap_send_frames_passt() dda7945 pcap: Handle short writes in pcap_frame() 8bdb088 util: Add write_remainder() helper 24410b3 pcap: Update pcap_frame() to take an iovec and offset 64b63d9 iov: Add helper to find skip over first n bytes of an io vector 2a6f8bc iov: add some functions to manage iovec 90f1d3b udp: Remove unnecessary test for unspecified addr_out 745fa38 udp: Fix incorrect usage of IPv6 state in IPv4 path deea5a8 udp: Small streamline to udp_update_hdr4() bc2d0d3 udp: Set pif in epoll reference for ephemeral host sockets 720d777 udp: Don't attempt to translate a 0.0.0.0 source address bee61dd conf: If no interface with a default route was found, say it 925af4e Makefile: check for cppcheck's --check-level option in cppcheck target 15001b3 conf: set the log level much earlier b087165 passt: make --quiet set the log level to warning e5e6f29 tcp: Don't store errnos in socket pool fe27ebc tcp, tcp_splice: Helpers for getting sockets from the pools fbe81de tcp, tcp_splice: Issue warnings if unable to refill socket pool 554b3ae tcp: Stop on first error when refilling socket pools af303fd tcp: Don't stop refilling socket pool if we find a filled entry 4e08d9b treewide: Use sa_family_t for address family variables https://passt.top/passt/log/?qt=range&q=2024_02_20.1e6f92b..2024_03_18.615d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7176272/ permanent mirror: https://passt.top/builds/copr/0^20240318.g615d370/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g615d370-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_615d370-1_all.deb -- Stefano

1 0

[PATCH v2] conf, netlink: Don't require a default route to start
by Stefano Brivio 18 Mar '24

18 Mar '24

There might be isolated testing environments where default routes and global connectivity are not needed, a single interface has all non-loopback addresses and routes, and still passt and pasta are expected to work. In this case, it's pretty obvious what our upstream interface should be, so go ahead and select the only interface with at least one route, disabling DHCP and implying --no-map-gw as the documentation already states. If there are multiple interfaces with routes, though, refuse to start, because at that point it's really not clear what we should do. Reported-by: Martin Pitt <mpitt(a)redhat.com> Link: https://github.com/containers/podman/issues/21896 Signed-off-by: Stefano brivio <sbrivio(a)redhat.com> --- v2: Initialise rtnh in nl_get_ext_if() before using it... conf.c | 4 ++-- netlink.c | 31 ++++++++++++++++++++++++++++--- passt.1 | 45 +++++++++++++++++++++++++++++---------------- 3 files changed, 59 insertions(+), 21 deletions(-) diff --git a/conf.c b/conf.c index ac9fb34..644752c 100644 --- a/conf.c +++ b/conf.c @@ -584,7 +584,7 @@ static unsigned int conf_ip4(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("No interface with a default route for IPv4: disabling IPv4"); + info("No interface with a route for IPv4: disabling IPv4"); return 0; } @@ -656,7 +656,7 @@ static unsigned int conf_ip6(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("No interface with a default route for IPv6: disabling IPv6"); + info("No interface with a route for IPv6: disabling IPv6"); return 0; } diff --git a/netlink.c b/netlink.c index 20de9b3..f93f377 100644 --- a/netlink.c +++ b/netlink.c @@ -254,6 +254,7 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) .rtm.rtm_type = RTN_UNICAST, .rtm.rtm_family = af, }; + bool default_only = true; unsigned int ifi = 0; struct nlmsghdr *nh; struct rtattr *rta; @@ -262,21 +263,40 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) uint32_t seq; size_t na; +again: + /* Look for an interface with a default route first, failing that, look + * for any interface with a route, and pick it only if it's the only + * interface with a route. + */ seq = nl_send(s, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWROUTE) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); - if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af) - continue; + if (default_only) { + if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af) + continue; + } else { + if (rtm->rtm_family != af) + continue; + } for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { if (rta->rta_type == RTA_OIF) { + if (!default_only && ifi && + ifi != *(unsigned int *)RTA_DATA(rta)) + return 0; + ifi = *(unsigned int *)RTA_DATA(rta); } else if (rta->rta_type == RTA_MULTIPATH) { const struct rtnexthop *rtnh; rtnh = (struct rtnexthop *)RTA_DATA(rta); + + if (!default_only && ifi && + (int)ifi != rtnh->rtnh_ifindex) + return 0; + ifi = rtnh->rtnh_ifindex; } } @@ -285,6 +305,11 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) if (status < 0) warn("netlink: RTM_GETROUTE failed: %s", strerror(-status)); + if (!ifi && default_only) { + default_only = false; + goto again; + } + return ifi; } @@ -332,7 +357,7 @@ bool nl_route_get_def_multipath(struct rtattr *rta, void *gw) * @af: Address family * @gw: Default gateway to fill on NL_GET * - * Return: 0 on success, negative error code on failure + * Return: error on netlink failure, or 0 (gw unset if default route not found) */ int nl_route_get_def(int s, unsigned int ifi, sa_family_t af, void *gw) { diff --git a/passt.1 b/passt.1 index 9c492f5..3a23a43 100644 --- a/passt.1 +++ b/passt.1 @@ -148,7 +148,9 @@ for an IPv6 \fIaddr\fR. This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces -with the first default route for the corresponding IP version. +with the first default route, if any, for the corresponding IP version. If no +default routes are available and there is just one interface with any route, +that interface will be chosen instead. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -172,9 +174,11 @@ Assign IPv4 \fIaddr\fR as default gateway via DHCP (option 3), or IPv6 This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, IPv4 and IPv6 gateways are taken from the host interface with the -first default route for the corresponding IP version. If the default route is a -multipath one, the gateway is the first nexthop router returned by the kernel -which has the highest weight in the set of paths. +first default route, if any, for the corresponding IP version. If the default +route is a multipath one, the gateway is the first nexthop router returned by +the kernel which has the highest weight in the set of paths. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -185,9 +189,11 @@ to allow mapping of local traffic to guest and target namespace. See the .BR \-i ", " \-\-interface " " \fIname Use host interface \fIname\fR to derive addresses and routes. Default is to use the interfaces specified by \fB--outbound-if4\fR and -\fB--outbound-if6\fR, for IPv4 and IPv6 addresses and routes, respectively. If -no interfaces are given, the interface with the first default routes for each IP -version is selected. +\fB--outbound-if6\fR, for IPv4 and IPv6 addresses and routes, respectively. + +If no interfaces are given, the interface with the first default routes for each +IP version is selected. If no default routes are available and there is just one +interface with any route, that interface will be chosen instead. .TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -203,14 +209,20 @@ By default, the source address is selected by the routing tables. Bind IPv4 outbound sockets to host interface \fIname\fR, and, unless another interface is specified via \fB-i\fR, \fB--interface\fR, use this interface to derive IPv4 addresses and routes. -By default, the interface given by the default route is selected. + +By default, the interface given by the default route is selected. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead. .TP .BR \-\-outbound-if6 " " \fIname Bind IPv6 outbound sockets to host interface \fIname\fR, and, unless another interface is specified via \fB-i\fR, \fB--interface\fR, use this interface to derive IPv6 addresses and routes. -By default, the interface given by the default route is selected. + +By default, the interface given by the default route is selected. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead. .TP .BR \-D ", " \-\-dns " " \fIaddr @@ -305,19 +317,20 @@ namespace will be ignored. .BR \-\-no-map-gw Don't remap TCP connections and untracked UDP traffic, with the gateway address as destination, to the host. Implied if there is no gateway on the selected -default route for any of the enabled address families. +default route, or if there is no default route, for any of the enabled address +families. .TP .BR \-4 ", " \-\-ipv4-only Enable IPv4-only operation. IPv6 traffic will be ignored. -By default, IPv6 operation is enabled as long as at least an IPv6 default route -and an interface address are configured on a given host interface. +By default, IPv6 operation is enabled as long as at least an IPv6 route and an +interface address are configured on a given host interface. .TP .BR \-6 ", " \-\-ipv6-only Enable IPv6-only operation. IPv4 traffic will be ignored. -By default, IPv4 operation is enabled as long as at least an IPv4 default route -and an interface address are configured on a given host interface. +By default, IPv4 operation is enabled as long as at least an IPv4 route and an +interface address are configured on a given host interface. .SS \fBpasst\fR-only options @@ -817,8 +830,8 @@ local addresses, and it would also be impossible for guest or target namespace to route answers back. For convenience, and somewhat arbitrarily, the source address on these packets -is translated to the address of the default IPv4 or IPv6 gateway -- this is -known to be an existing, valid address on the same subnet. +is translated to the address of the default IPv4 or IPv6 gateway (if any) -- +this is known to be an existing, valid address on the same subnet. Loopback destination addresses are instead translated to the observed external address of the guest or target namespace. For IPv6 packets, if usage of a -- 2.39.2

2 1

[PATCH] udp: Translate source address of resolver only for DNS remapped queries
by Stefano Brivio 18 Mar '24

18 Mar '24

Paul reports that if pasta is configured with --dns-forward, and the container queries a resolver which is configured on the host directly, without using the address given for --dns-forward, we'll translate the source address of the response pretending it's coming from the address passed as --dns-forward, and the client will discard the reply. That is, $ cat /etc/resolv.conf 198.51.100.1 $ pasta --config-net --dns-forward 192.0.2.1 nslookup passt.top will not work, because we change the source address of the reply from 198.51.100.1 to 192.0.2.1. But the client contacted 198.51.100.1, and it's from that address that it expects an answer. Add a PORT_DNS_FWD flag for tap-facing ports, which is triggered by activity in the opposite direction as the other flags. If the tap-facing port was seen sending a DNS query that was remapped, we'll remap the source address of the response, otherwise we'll leave it unaffected. Reported-by: Paul Holzinger <pholzing(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- udp.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/udp.c b/udp.c index 0a7f3b7..694424a 100644 --- a/udp.c +++ b/udp.c @@ -127,15 +127,16 @@ /** * struct udp_tap_port - Port tracking based on tap-facing source port * @sock: Socket bound to source port used as index - * @flags: Flags for local bind, loopback address/unicast address as source + * @flags: Flags for recent activity type seen from/to port * @ts: Activity timestamp from tap, used for socket aging */ struct udp_tap_port { int sock; uint8_t flags; -#define PORT_LOCAL BIT(0) -#define PORT_LOOPBACK BIT(1) -#define PORT_GUA BIT(2) +#define PORT_LOCAL BIT(0) /* Port was contacted from local address */ +#define PORT_LOOPBACK BIT(1) /* Port was contacted from loopback address */ +#define PORT_GUA BIT(2) /* Port was contacted from global unicast */ +#define PORT_DNS_FWD BIT(3) /* Port used as source for DNS remapped query */ time_t ts; }; @@ -579,7 +580,8 @@ static size_t udp_update_hdr4(const struct ctx *c, struct udp4_l2_buf_t *b, struct in_addr src = b->s_in.sin_addr; if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && - IN4_ARE_ADDR_EQUAL(&src, &c->ip4.dns_host) && srcport == 53) { + IN4_ARE_ADDR_EQUAL(&src, &c->ip4.dns_host) && srcport == 53 && + (udp_tap_map[V4][dstport].flags & PORT_DNS_FWD)) { src = c->ip4.dns_match; } else if (IN4_IS_ADDR_LOOPBACK(&src) || IN4_ARE_ADDR_EQUAL(&src, &c->ip4.addr_seen)) { @@ -632,7 +634,8 @@ static size_t udp_update_hdr6(const struct ctx *c, struct udp6_l2_buf_t *b, dst = &c->ip6.addr_ll_seen; } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns_host) && - srcport == 53) { + srcport == 53 && + (udp_tap_map[V4][dstport].flags & PORT_DNS_FWD)) { src = &c->ip6.dns_match; } else if (IN6_IS_ADDR_LOOPBACK(src) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr_seen) || @@ -841,6 +844,9 @@ int udp_tap_handler(struct ctx *c, uint8_t pif, if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.dns_match) && ntohs(s_in.sin_port) == 53) { s_in.sin_addr = c->ip4.dns_host; + udp_tap_map[V4][src].ts = now->tv_sec; + udp_tap_map[V4][src].flags |= PORT_DNS_FWD; + bitmap_set(udp_act[V4][UDP_ACT_TAP], src); } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && !c->no_map_gw) { if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) || @@ -890,6 +896,9 @@ int udp_tap_handler(struct ctx *c, uint8_t pif, if (IN6_ARE_ADDR_EQUAL(daddr, &c->ip6.dns_match) && ntohs(s_in6.sin6_port) == 53) { s_in6.sin6_addr = c->ip6.dns_host; + udp_tap_map[V6][src].ts = now->tv_sec; + udp_tap_map[V6][src].flags |= PORT_DNS_FWD; + bitmap_set(udp_act[V6][UDP_ACT_TAP], src); } else if (IN6_ARE_ADDR_EQUAL(daddr, &c->ip6.gw) && !c->no_map_gw) { if (!(udp_tap_map[V6][dst].flags & PORT_LOCAL) || -- 2.39.2

2 1

2024

2023

2022

2021

dev March 2024