- dev - passt

[PATCH v3] util, pasta: Add do_clone() wrapper around __clone2() and clone()
by Stefano Brivio 17 Nov '22

17 Nov '22

Spotted in Debian's buildd logs: on ia64, clone(2) is not available: the glibc wrapper is named __clone2() and it takes, additionally, the size of the stack area passed by the caller. Add a do_clone() wrapper handling the different cases, and also taking care of pointing the child's stack in the middle of the allocated area: on PA-RISC (hppa), handled by clone(), the stack grows up, and on ia64 the stack grows down, but the register backing store grows up -- and I think it might be actually used here. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v3: Don't call it __clone(), it conflicts with glibc on static builds v2: Add a wrapper instead of two __ia64__ ifdefs pasta.c | 10 +++++----- util.c | 21 +++++++++++++++++++++ util.h | 8 +++++--- 3 files changed, 31 insertions(+), 8 deletions(-) diff --git a/pasta.c b/pasta.c index db86317..528f02a 100644 --- a/pasta.c +++ b/pasta.c @@ -226,11 +226,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, arg.argv = sh_argv; } - pasta_child_pid = clone(pasta_spawn_cmd, - ns_fn_stack + sizeof(ns_fn_stack) / 2, - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS, - (void *)&arg); + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, + sizeof(ns_fn_stack), + CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | + CLONE_NEWUTS, + (void *)&arg); if (pasta_child_pid == -1) { perror("clone"); diff --git a/util.c b/util.c index be102e3..2125a67 100644 --- a/util.c +++ b/util.c @@ -482,3 +482,24 @@ int write_file(const char *path, const char *buf) close(fd); return len == 0 ? 0 : -1; } + +/** + * do_clone() - Wrapper of __clone2() for ia64, clone() for other architectures + * @fn: Entry point for child + * @stack_area: Stack area for child: we'll point callees to the middle of it + * @stack_size: Total size of stack area, passed to callee divided by two + * @flags: clone() system call flags + * @arg: Argument to @fn + * + * Return: thread ID of child, -1 on failure + */ +int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, + void *arg) +{ +#ifdef __ia64__ + return __clone2(fn, stack_area + stack_size / 2, stack_size / 2, + flags, arg); +#else + return clone(fn, stack_area + stack_size / 2, flags, arg); +#endif +} diff --git a/util.h b/util.h index 2d4e1ff..02b55a9 100644 --- a/util.h +++ b/util.h @@ -81,13 +81,15 @@ (((struct in_addr *)(a))->s_addr == ((struct in_addr *)b)->s_addr) #define NS_FN_STACK_SIZE (RLIMIT_STACK_VAL * 1024 / 8) +int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, + void *arg); #define NS_CALL(fn, arg) \ do { \ char ns_fn_stack[NS_FN_STACK_SIZE]; \ \ - clone((fn), ns_fn_stack + sizeof(ns_fn_stack) / 2, \ - CLONE_VM | CLONE_VFORK | CLONE_FILES | SIGCHLD, \ - (void *)(arg)); \ + do_clone((fn), ns_fn_stack, sizeof(ns_fn_stack), \ + CLONE_VM | CLONE_VFORK | CLONE_FILES | SIGCHLD,\ + (void *)(arg)); \ } while (0) #if __BYTE_ORDER == __BIG_ENDIAN -- 2.35.1

2 2

vsock regression
by David Gibson 17 Nov '22

17 Nov '22

A word of warning, if you try to run the passt tests on a recent qemu git build. A change to default options causes vsock to break. You can work around it by adding a `queue_reset=false` option to the vsock device, or reverting to qemu commit 3c37f8b8d1e5 or earlier. I've written up the details here: https://gitlab.com/qemu-project/qemu/-/issues/1318 Possibly I should also ping some people on qemu-devel. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson

1 0

passt: new version 2022_11_16.ace074c available
by Stefano Brivio 17 Nov '22

17 Nov '22

The new version with tag 2022_11_16.ace074c includes the following changes: ace074c README: The upcoming version of Podman adds support for pasta ab6f825 util, pasta: Add do_clone() wrapper around __clone2() and clone() 7d8c2fb test/lib/test: Clean up iperf3 JSON files before starting the server 25dab96 tap: Revert recently added checks in tap_handler_passt() b27d6d1 arp, tap, util: Don't use perror() after seccomp filter is installed 5f74465 Remove contrib/debian, Debian package development now happens on Salsa fb7b71b contrib/apparmor: Merge pasta and passt profiles, update rules b6400db README: Add links to Debian package tracker 85d8ba3 Makefile: Change HPPA into PARISC while building PASST_AUDIT_ARCH fb8376f Makefile: It's AUDIT_ARCH_MIPSEL64, not AUDIT_ARCH_MIPS64EL b501a8f Makefile: Don't filter out -O2 from supplied flags for AVX2 builds b3c9e76 Makefile: Honour passed CPPFLAGS, not just CFLAGS 3a2afde conf, udp: Drop mostly duplicated dns_send arrays, rename related fields https://passt.top/passt/log/?qt=range&q=2022_11_10.4129764..2022_11_16.ace0… Packages: - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5043502/ permanent mirror: https://passt.top/builds/copr/0^20221116.gace074c/ - Debian: https://tracker.debian.org/pkg/passt https://salsa.debian.org/sbrivio/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Package for other RPM-based distributions, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt-gace074c-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ -- Stefano

1 0

[PATCH] README: The upcoming version of Podman adds support for pasta
by Stefano Brivio 16 Nov '22

16 Nov '22

Don't update the demo yet: we could just wait until Podman 4.3.2 is out and packaged. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 3d0a5b4..8947702 100644 --- a/README.md +++ b/README.md @@ -330,10 +330,9 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ qemu, libvirt support with [`qrap` wrapper](/passt/tree/qrap.c) * ✅ out-of-tree patches for [qemu](/passt/tree/contrib/qemu) and [libvirt](/passt/tree/contrib/libvirt) available +* ✅ Podman [support](https://github.com/containers/podman/pull/16141) * ✅ bug-to-bug compatible - [_slirp4netns_ replacement](/passt/tree/slirp4netns.sh) (rootless Podman, - RootlessKit) -* ✅ out-of-tree patch for [Podman](/passt/tree/contrib/podman) available + [_slirp4netns_ replacement](/passt/tree/slirp4netns.sh) * ✅ out-of-tree patch for [Kata Containers](/passt/tree/contrib/kata-containers) available * 🛠 native [qemu](https://bugs.passt.top/show_bug.cgi?id=11), @@ -610,6 +609,11 @@ See also the [test logs](/builds/latest/test/). ./pasta + * alternatively, use it directly with Podman (since Podman 4.3.2, or with + commit [`aa47e05ae4a0`](https://github.com/containers/podman/commit/aa47e05ae4a0d14a338cbe106b7eb9cdf098a529): + + podman run --net=pasta ... + * you're now inside a new user and network namespace. For IPv6, SLAAC happens right away as _pasta_ sets up the interface, but DHCPv6 support is available as well. For IPv4, configure the interface with a DHCP client: -- 2.35.1

1 0

[PATCH v2] util, pasta: Add __clone() wrapper around __clone2() and clone()
by Stefano Brivio 16 Nov '22

16 Nov '22

Spotted in Debian's buildd logs: on ia64, clone(2) is not available: the glibc wrapper is named __clone2() and it takes, additionally, the size of the stack area passed by the caller. Add a __clone() wrapper handling the different cases, and also taking care of pointing the child's stack in the middle of the allocated area: on PA-RISC (hppa), handled by clone(), the stack grows up, and on ia64 the stack grows down, but the register backing store grows up -- and I think it might be actually used here. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Add a wrapper instead of two __ia64__ ifdefs pasta.c | 10 +++++----- util.c | 21 +++++++++++++++++++++ util.h | 8 +++++--- 3 files changed, 31 insertions(+), 8 deletions(-) diff --git a/pasta.c b/pasta.c index db86317..e00c197 100644 --- a/pasta.c +++ b/pasta.c @@ -226,11 +226,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, arg.argv = sh_argv; } - pasta_child_pid = clone(pasta_spawn_cmd, - ns_fn_stack + sizeof(ns_fn_stack) / 2, - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS, - (void *)&arg); + pasta_child_pid = __clone(pasta_spawn_cmd, ns_fn_stack, + sizeof(ns_fn_stack), + CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | + CLONE_NEWUTS, + (void *)&arg); if (pasta_child_pid == -1) { perror("clone"); diff --git a/util.c b/util.c index be102e3..d068fe3 100644 --- a/util.c +++ b/util.c @@ -482,3 +482,24 @@ int write_file(const char *path, const char *buf) close(fd); return len == 0 ? 0 : -1; } + +/** + * __clone() - Wrapper of __clone2() for ia64, clone() for other architectures + * @fn: Entry point for child + * @stack_area: Stack area for child: we'll point callees to the middle of it + * @stack_size: Total size of stack area, passed to callee divided by two + * @flags: clone() system call flags + * @arg: Argument to @fn + * + * Return: thread ID of child, -1 on failure + */ +int __clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, + void *arg) +{ +#ifdef __ia64__ + return __clone2(fn, stack_area + stack_size / 2, stack_size / 2, + flags, arg); +#else + return clone(fn, stack_area + stack_size / 2, flags, arg); +#endif +} diff --git a/util.h b/util.h index 2d4e1ff..7591817 100644 --- a/util.h +++ b/util.h @@ -81,13 +81,15 @@ (((struct in_addr *)(a))->s_addr == ((struct in_addr *)b)->s_addr) #define NS_FN_STACK_SIZE (RLIMIT_STACK_VAL * 1024 / 8) +int __clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, + void *arg); #define NS_CALL(fn, arg) \ do { \ char ns_fn_stack[NS_FN_STACK_SIZE]; \ \ - clone((fn), ns_fn_stack + sizeof(ns_fn_stack) / 2, \ - CLONE_VM | CLONE_VFORK | CLONE_FILES | SIGCHLD, \ - (void *)(arg)); \ + __clone((fn), ns_fn_stack, sizeof(ns_fn_stack), \ + CLONE_VM | CLONE_VFORK | CLONE_FILES | SIGCHLD,\ + (void *)(arg)); \ } while (0) #if __BYTE_ORDER == __BIG_ENDIAN -- 2.35.1

1 0

[PATCH] tap: Revert recently added checks in tap_handler_passt()
by Stefano Brivio 16 Nov '22

16 Nov '22

This reverts commit 198f87835dc4 ("tap: Return -EIO from tap_handler_passt() on inconsistent packet stream") and commit 510dace86ccf ("tap: Keep stream consistent if qemu length descriptor spans two recv() calls"). I can hit occasional failures in perf/passt_tcp tests where we seem to be getting excess data at the end of a recv(), and for some reason I couldn't figure out yet, if we just ignore it, subsequent recv() calls from qemu return correct data. If we close the connection, qemu can't talk to us anymore, of course. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tap.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/tap.c b/tap.c index b7ac996..d26af58 100644 --- a/tap.c +++ b/tap.c @@ -747,31 +747,19 @@ redo: return -ECONNRESET; } - while (n > 0) { - ssize_t len; - - /* Force receiving at least a complete length descriptor to - * avoid an inconsistent stream. - */ - if (n < (ssize_t)sizeof(uint32_t)) { - rem = recv(c->fd_tap, p + n, - (ssize_t)sizeof(uint32_t) - n, 0); - if ((n += rem) != (ssize_t)sizeof(uint32_t)) - return -EIO; - } - - len = ntohl(*(uint32_t *)p); + while (n > (ssize_t)sizeof(uint32_t)) { + ssize_t len = ntohl(*(uint32_t *)p); p += sizeof(uint32_t); n -= sizeof(uint32_t); /* At most one packet might not fit in a single read, and this - * also needs to be blocking. + * needs to be blocking. */ if (len > n) { rem = recv(c->fd_tap, p + n, len - n, 0); if ((n += rem) != len) - return -EIO; + return 0; } /* Complete the partial read above before discarding a malformed -- 2.35.1

1 0

[PATCH 0/8] Fixes for Debian package functionality and build
by Stefano Brivio 16 Nov '22

16 Nov '22

Stefano Brivio (8): Makefile: Honour passed CPPFLAGS, not just CFLAGS Makefile: Don't filter out -O2 from supplied flags for AVX2 builds Makefile: It's AUDIT_ARCH_MIPSEL64, not AUDIT_ARCH_MIPS64EL Makefile: Change HPPA into PARISC while building PASST_AUDIT_ARCH util, pasta: Use __clone2() instead of clone() on ia64 README: Add links to Debian package tracker contrib/apparmor: Merge pasta and passt profiles, update rules Remove contrib/debian, Debian package development now happens on Salsa Makefile | 16 ++++---- README.md | 17 ++++---- contrib/apparmor/usr.bin.passt | 73 ++++++++++++++++++++++++---------- contrib/apparmor/usr.bin.pasta | 66 ------------------------------ contrib/debian/README.Debian | 8 ---- contrib/debian/changelog | 6 --- contrib/debian/control | 22 ---------- contrib/debian/copyright | 13 ------ contrib/debian/rules | 12 ------ contrib/debian/watch | 2 - pasta.c | 9 +++++ util.h | 12 ++++++ 12 files changed, 91 insertions(+), 165 deletions(-) delete mode 100644 contrib/apparmor/usr.bin.pasta delete mode 100644 contrib/debian/README.Debian delete mode 100644 contrib/debian/changelog delete mode 100644 contrib/debian/control delete mode 100644 contrib/debian/copyright delete mode 100755 contrib/debian/rules delete mode 100644 contrib/debian/watch -- 2.35.1

2 15

[PATCH] arp, tap, util: Don't use perror() after seccomp filter is installed
by Stefano Brivio 16 Nov '22

16 Nov '22

If stderr is closed, after we fork to background, glibc's implementation of perror() will try to re-open it by calling dup(), upon which the seccomp filter causes the process to terminate, because dup() is not included in the list of allowed syscalls. Replace perror() calls that might happen after isolation_postfork(). We could probably replace all of them, but early ones need a bit more attention as we have to check whether log.c functions work in early stages. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- arp.c | 6 ++++-- tap.c | 6 +++--- util.c | 6 +++--- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/arp.c b/arp.c index 141d43f..930b9ea 100644 --- a/arp.c +++ b/arp.c @@ -24,6 +24,7 @@ #include <string.h> #include "util.h" +#include "log.h" #include "arp.h" #include "dhcp.h" #include "passt.h" @@ -43,6 +44,7 @@ int arp(const struct ctx *c, const struct pool *p) struct arphdr *ah; struct arpmsg *am; size_t len; + int ret; eh = packet_get(p, 0, 0, sizeof(*eh), NULL); ah = packet_get(p, 0, sizeof(*eh), sizeof(*ah), NULL); @@ -81,8 +83,8 @@ int arp(const struct ctx *c, const struct pool *p) memcpy(eh->h_dest, eh->h_source, sizeof(eh->h_dest)); memcpy(eh->h_source, c->mac, sizeof(eh->h_source)); - if (tap_send(c, eh, len) < 0) - perror("ARP: send"); + if ((ret = tap_send(c, eh, len)) < 0) + warn("ARP: send: %s", strerror(ret)); return 1; } diff --git a/tap.c b/tap.c index abeff25..b7ac996 100644 --- a/tap.c +++ b/tap.c @@ -899,7 +899,7 @@ static void tap_sock_unix_init(struct ctx *c) int i; if (fd < 0) { - perror("UNIX socket"); + err("UNIX socket: %s", strerror(errno)); exit(EXIT_FAILURE); } @@ -920,7 +920,7 @@ static void tap_sock_unix_init(struct ctx *c) ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, 0); if (ex < 0) { - perror("UNIX domain socket check"); + err("UNIX domain socket check: %s", strerror(errno)); exit(EXIT_FAILURE); } @@ -944,7 +944,7 @@ static void tap_sock_unix_init(struct ctx *c) } if (i == UNIX_SOCK_MAX) { - perror("UNIX socket bind"); + err("UNIX socket bind: %s", strerror(errno)); exit(EXIT_FAILURE); } diff --git a/util.c b/util.c index 514bd44..be102e3 100644 --- a/util.c +++ b/util.c @@ -125,7 +125,7 @@ int sock_l4(const struct ctx *c, int af, uint8_t proto, fd = socket(af, SOCK_DGRAM | SOCK_NONBLOCK, proto); if (fd < 0) { - perror("L4 socket"); + warn("L4 socket: %s", strerror(errno)); return -1; } @@ -193,7 +193,7 @@ int sock_l4(const struct ctx *c, int af, uint8_t proto, } if (proto == IPPROTO_TCP && listen(fd, 128) < 0) { - perror("TCP socket listen"); + warn("TCP socket listen: %s", strerror(errno)); close(fd); return -1; } @@ -201,7 +201,7 @@ int sock_l4(const struct ctx *c, int af, uint8_t proto, ev.events = EPOLLIN; ev.data.u64 = ref.u64; if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD, fd, &ev) == -1) { - perror("L4 epoll_ctl"); + warn("L4 epoll_ctl: %s", strerror(errno)); return -1; } -- 2.35.1

2 1

[PATCH 00/14] RFC: tcp: Don't use separate listening sockets for spliced and non-spliced connections
by David Gibson 15 Nov '22

15 Nov '22

We can splice TCP connections in pasta mode if and only if they originate from localhost. Currently we separate the two cases by having separate listening sockets: one listens on the host address for non-spliceable connections, the other listens on the loopback address for spliceable connections. As well as requiring twice as many listening sockets, this has the drawback of meaning that passt and pasta behaviour differ subtley but surprisingly: by default passt inbound port forwards will listen on the unspecified address, but for pasta they will be changed to listen on the host's interface address. In fact we don't need to do this. We can defer the decision about whether to splice a connection until after we've accepted it, by testing the peer address to see if it is local. At least, in principle we can. This series deals with a number of complications on the way to accomplishing that. CAVEAT: The current draft increases the size of tcp_conn above its current 64 bytes, which is likely to push it into a second cache line on some machines. This is fixable, but doing so is fiddly, and I'm still working on it. David Gibson (14): style: Minor corrections to function comments tcp: Remove unused TCP_MAX_SOCKS constant tcp: Better helpers for converting between connection pointer and index tcp_splice: Helpers for converting from index to/from tcp_splice_conn tcp: Move connection state structures into a shared header tcp: Add connection union type tcp: Improved helpers to update connections after moving tcp: Unify spliced and non-spliced connection tables tcp: Unify tcp_defer_handler and tcp_splice_defer_handler() tcp: Partially unify tcp_timer() and tcp_splice_timer() tcp: Unify the IN_EPOLL flag tcp: Separate helpers to create ns listening sockets tcp: Unify part of spliced and non-spliced conn_from_sock path tcp: Use the same sockets to listen for spliced and non-spliced connections Makefile | 3 +- conf.c | 12 +- tap.c | 6 +- tcp.c | 661 +++++++++++++++++++++++---------------------------- tcp.h | 7 +- tcp_conn.h | 208 ++++++++++++++++ tcp_splice.c | 292 +++++++++-------------- tcp_splice.h | 4 +- 8 files changed, 625 insertions(+), 568 deletions(-) create mode 100644 tcp_conn.h -- 2.38.1

2 16

[PATCH] conf, udp: Drop mostly duplicated dns_send arrays, rename related fields
by Stefano Brivio 15 Nov '22

15 Nov '22

Given that we use just the first valid DNS resolver address configured, or read from resolv.conf(5) on the host, to forward DNS queries to, in case --dns-forward is used, we don't need to duplicate dns[] to dns_send[]: - rename dns_send[] back to dns[]: those are the resolvers we advertise to the guest/container - for forwarding purposes, instead of dns[], use a single field (for each protocol version): dns_host - and rename dns_fwd to dns_match, so that it's clear this is the address we are matching DNS queries against, to decide if they need to be forwarded Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 76 ++++++++++++++++++++++++-------------------------------- dhcp.c | 5 ++-- dhcpv6.c | 5 ++-- ndp.c | 6 ++--- passt.h | 20 +++++++-------- udp.c | 21 +++++++++------- 6 files changed, 62 insertions(+), 71 deletions(-) diff --git a/conf.c b/conf.c index 1adcf83..a995eb7 100644 --- a/conf.c +++ b/conf.c @@ -355,11 +355,9 @@ overlap: */ static void get_dns(struct ctx *c) { - struct in6_addr *dns6_send = &c->ip6.dns_send[0]; - struct in_addr *dns4_send = &c->ip4.dns_send[0]; + struct in6_addr *dns6 = &c->ip6.dns[0], dns6_tmp; + struct in_addr *dns4 = &c->ip4.dns[0], dns4_tmp; int dns4_set, dns6_set, dnss_set, dns_set, fd; - struct in6_addr *dns6 = &c->ip6.dns[0]; - struct in_addr *dns4 = &c->ip4.dns[0]; struct fqdn *s = c->dns_search; struct lineread resolvconf; int line_len; @@ -388,49 +386,44 @@ static void get_dns(struct ctx *c) *end = 0; if (!dns4_set && - dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 && - inet_pton(AF_INET, p + 1, dns4)) { + dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 + && inet_pton(AF_INET, p + 1, &dns4_tmp)) { /* Guest or container can only access local * addresses via local redirect */ - if (IN4_IS_ADDR_LOOPBACK(dns4)) { + if (IN4_IS_ADDR_LOOPBACK(&dns4_tmp)) { if (!c->no_map_gw) { - *dns4_send = c->ip4.gw; - dns4_send++; + *dns4 = c->ip4.gw; + dns4++; } } else { - *dns4_send = *dns4; - dns4_send++; + *dns4 = dns4_tmp; + dns4++; } - dns4++; - - dns4->s_addr = htonl(INADDR_ANY); - dns4_send->s_addr = htonl(INADDR_ANY); + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_host)) + c->ip4.dns_host = dns4_tmp; } if (!dns6_set && - dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 && - inet_pton(AF_INET6, p + 1, dns6)) { + dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 + && inet_pton(AF_INET6, p + 1, &dns6_tmp)) { /* Guest or container can only access local * addresses via local redirect */ - if (IN6_IS_ADDR_LOOPBACK(dns6)) { + if (IN6_IS_ADDR_LOOPBACK(&dns6_tmp)) { if (!c->no_map_gw) { - memcpy(dns6_send, &c->ip6.gw, - sizeof(*dns6_send)); - dns6_send++; + memcpy(dns6, &c->ip6.gw, + sizeof(*dns6)); + dns6++; } } else { - memcpy(dns6_send, dns6, - sizeof(*dns6_send)); - dns6_send++; + memcpy(dns6, &dns6_tmp, sizeof(*dns6)); + dns6++; } - dns6++; - - memset(dns6, 0, sizeof(*dns6)); - memset(dns6_send, 0, sizeof(*dns6_send)); + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_host)) + c->ip6.dns_host = dns6_tmp; } } else if (!dnss_set && strstr(line, "search ") == line && s == c->dns_search) { @@ -897,12 +890,10 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET, &c->ip4.gw, buf4, sizeof(buf4))); } - for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); - i++) { + for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) { if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns_send[i], buf4, - sizeof(buf4)); + inet_ntop(AF_INET, &c->ip4.dns[i], buf4, sizeof(buf4)); info(" %s", buf4); } @@ -933,8 +924,7 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET6, &c->ip6.addr_ll, buf6, sizeof(buf6))); dns6: - for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); - i++) { + for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) { if (!i) info("DNS:"); inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6)); @@ -1230,17 +1220,17 @@ void conf(struct ctx *c, int argc, char **argv) c->no_dhcp_dns_search = 1; break; case 9: - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - inet_pton(AF_INET6, optarg, &c->ip6.dns_fwd) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - !IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_fwd)) + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + inet_pton(AF_INET6, optarg, &c->ip6.dns_match) && + !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + !IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_match)) break; - if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - inet_pton(AF_INET, optarg, &c->ip4.dns_fwd) && - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - !IN4_IS_ADDR_BROADCAST(&c->ip4.dns_fwd) && - !IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_fwd)) + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + inet_pton(AF_INET, optarg, &c->ip4.dns_match) && + !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + !IN4_IS_ADDR_BROADCAST(&c->ip4.dns_match) && + !IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_match)) break; err("Invalid DNS forwarding address: %s", optarg); diff --git a/dhcp.c b/dhcp.c index 12da47a..6088886 100644 --- a/dhcp.c +++ b/dhcp.c @@ -359,9 +359,8 @@ int dhcp(const struct ctx *c, const struct pool *p) } for (i = 0, opts[6].slen = 0; - !c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); - i++) { - ((struct in_addr *)opts[6].s)[i] = c->ip4.dns_send[i]; + !c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) { + ((struct in_addr *)opts[6].s)[i] = c->ip4.dns[i]; opts[6].slen += sizeof(uint32_t); } diff --git a/dhcpv6.c b/dhcpv6.c index 67262e6..e763aed 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -379,7 +379,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset) if (c->no_dhcp_dns) goto search; - for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); i++) { + for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) { if (!i) { srv = (struct opt_dns_servers *)(buf + offset); offset += sizeof(struct opt_hdr); @@ -387,8 +387,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset) srv->hdr.l = 0; } - memcpy(&srv->addr[i], &c->ip6.dns_send[i], - sizeof(srv->addr[i])); + memcpy(&srv->addr[i], &c->ip6.dns[i], sizeof(srv->addr[i])); srv->hdr.l += sizeof(srv->addr[i]); offset += sizeof(srv->addr[i]); } diff --git a/ndp.c b/ndp.c index 6d79477..80e1f19 100644 --- a/ndp.c +++ b/ndp.c @@ -121,7 +121,7 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr) if (c->no_dhcp_dns) goto dns_done; - for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[n]); n++); + for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[n]); n++); if (n) { *p++ = 25; /* RDNSS */ *p++ = 1 + 2 * n; /* length */ @@ -130,8 +130,8 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr) p += 4; for (i = 0; i < n; i++) { - memcpy(p, &c->ip6.dns_send[i], 16); - p += 16; /* address */ + memcpy(p, &c->ip6.dns[i], 16); /* address */ + p += 16; } for (n = 0; *c->dns_search[n].n; n++) diff --git a/passt.h b/passt.h index e93eea8..6649c0a 100644 --- a/passt.h +++ b/passt.h @@ -101,9 +101,9 @@ enum passt_modes { * @addr_seen: Latest IPv4 address seen as source from tap * @prefixlen: IPv4 prefix length (netmask) * @gw: Default IPv4 gateway, network order - * @dns: Host IPv4 DNS addresses, zero-terminated, network order - * @dns_send: Offered IPv4 DNS, zero-terminated, network order - * @dns_fwd: Address forwarded (UDP) to first IPv4 DNS, network order + * @dns: DNS addresses for DHCP, zero-terminated, network order + * @dns_match: Forward DNS query if sent to this address, network order + * @dns_host: Use this DNS on the host for forwarding, network order */ struct ip4_ctx { struct in_addr addr; @@ -111,8 +111,8 @@ struct ip4_ctx { int prefix_len; struct in_addr gw; struct in_addr dns[MAXNS + 1]; - struct in_addr dns_send[MAXNS + 1]; - struct in_addr dns_fwd; + struct in_addr dns_match; + struct in_addr dns_host; }; /** @@ -122,9 +122,9 @@ struct ip4_ctx { * @addr_seen: Latest IPv6 global/site address seen as source from tap * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap * @gw: Default IPv6 gateway - * @dns: Host IPv6 DNS addresses, zero-terminated - * @dns_send: Offered IPv6 DNS addresses, zero-terminated - * @dns_fwd: Address forwarded (UDP) to first IPv6 DNS, network order + * @dns: DNS addresses for DHCPv6 and NDP, zero-terminated + * @dns_match: Forward DNS query if sent to this address + * @dns_host: Use this DNS on the host for forwarding */ struct ip6_ctx { struct in6_addr addr; @@ -133,8 +133,8 @@ struct ip6_ctx { struct in6_addr addr_ll_seen; struct in6_addr gw; struct in6_addr dns[MAXNS + 1]; - struct in6_addr dns_send[MAXNS + 1]; - struct in6_addr dns_fwd; + struct in6_addr dns_match; + struct in6_addr dns_host; }; #include <netinet/if_ether.h> diff --git a/udp.c b/udp.c index ff7f993..0aa6308 100644 --- a/udp.c +++ b/udp.c @@ -678,10 +678,10 @@ static void udp_sock_fill_data_v4(const struct ctx *c, int n, src_port = ntohs(b->s_in.sin_port); - if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns[0]) && + if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns_host) && src_port == 53) { - b->iph.saddr = c->ip4.dns_fwd.s_addr; + b->iph.saddr = c->ip4.dns_match.s_addr; } else if (IN4_IS_ADDR_LOOPBACK(&b->s_in.sin_addr) || IN4_IS_ADDR_UNSPECIFIED(&b->s_in.sin_addr)|| IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.addr_seen)) { @@ -770,10 +770,11 @@ static void udp_sock_fill_data_v6(const struct ctx *c, int n, if (IN6_IS_ADDR_LINKLOCAL(src)) { b->ip6h.daddr = c->ip6.addr_ll_seen; b->ip6h.saddr = b->s_in6.sin6_addr; - } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns[0]) && src_port == 53) { + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns_host) && + src_port == 53) { b->ip6h.daddr = c->ip6.addr_seen; - b->ip6h.saddr = c->ip6.dns_fwd; + b->ip6h.saddr = c->ip6.dns_match; } else if (IN6_IS_ADDR_LOOPBACK(src) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr_seen) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr)) { @@ -1016,13 +1017,15 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, udp_tap_map[V4][src].ts = now->tv_sec; - if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && !c->no_map_gw) { + if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && + !c->no_map_gw) { if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) || (udp_tap_map[V4][dst].flags & PORT_LOOPBACK)) s_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK); else s_in.sin_addr = c->ip4.addr_seen; - } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.dns_fwd) && + } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, + &c->ip4.dns_match) && ntohs(s_in.sin_port) == 53) { s_in.sin_addr = c->ip4.dns[0]; } @@ -1045,7 +1048,7 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, s_in6.sin6_addr = c->ip6.addr; else s_in6.sin6_addr = c->ip6.addr_seen; - } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_fwd) && + } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_match) && ntohs(s_in6.sin6_port) == 53) { s_in6.sin6_addr = c->ip6.dns[0]; } else if (IN6_IS_ADDR_LINKLOCAL(&s_in6.sin6_addr)) { -- 2.35.1

2 1