The semantics of --host-lo-to-ns-lo as described in the man page don't
quite make sense: It says without the option forwarded packets will appear
to come _from_ the guest's public address, which is not usually true.
Instead the packets will arrive *to* the guest's public address. The exact
semantics are also a bit confusing in general.
Rewrite both the man page and code to clarify this. The new rule is that
it redirects connections addressed to a host loopback address to the same
loopback address in the guest. This is notionally different from what we
had in two ways:
* We can now deliver to nonstandard loopback addresses within the guest,
not just the default one. This is technically a behavioural change,
but I think will be less surprising behaviour.
* The decision is now made on the original _destination_ address, rather
than source address. That's different theoreically, but not in
practice, since loopback packets must have loopback addresses for both
source and destination.
We make it explicitly incompatible with --no-splice - previously it
was allowed, but would have no effect in that case.
As well as being more precise right now, these semantics will intersect
better with upcoming remapping of target address by forwarding rules.
Signed-off-by: David Gibson
---
conf.c | 2 ++
fwd.c | 22 ++++++++++------------
passt.1 | 9 +++++----
3 files changed, 17 insertions(+), 16 deletions(-)
diff --git a/conf.c b/conf.c
index c4a36dee..912543fa 100644
--- a/conf.c
+++ b/conf.c
@@ -1792,6 +1792,8 @@ void conf(struct ctx *c, int argc, char **argv)
if (c->splice_only)
die("--splice-only is for pasta mode only");
}
+ if (c->no_splice && c->host_lo_to_ns_lo)
+ die("--host-lo-to-ns-lo is incompatible with --no-splice");
if (c->mode == MODE_PASTA && !c->pasta_conf_ns) {
if (copy_routes_opt)
diff --git a/fwd.c b/fwd.c
index 042158cf..659f8d9f 100644
--- a/fwd.c
+++ b/fwd.c
@@ -1036,21 +1036,19 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
* In either case, let the kernel pick the source address to
* match.
*/
- if (inany_v4(&ini->eaddr)) {
- if (c->host_lo_to_ns_lo)
- tgt->eaddr = inany_loopback4;
- else
- tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
+ if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))
+ tgt->eaddr = ini->oaddr;
+ else if (inany_v4(&ini->eaddr))
+ tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
+ else
+ tgt->eaddr.a6 = c->ip6.addr_seen;
+
+ /* Let the kernel pick source address and port */
+ if (inany_v4(&tgt->eaddr))
tgt->oaddr = inany_any4;
- } else {
- if (c->host_lo_to_ns_lo)
- tgt->eaddr = inany_loopback6;
- else
- tgt->eaddr.a6 = c->ip6.addr_seen;
+ else
tgt->oaddr = inany_any6;
- }
- /* Let the kernel pick source port */
tgt->oport = 0;
if (proto == IPPROTO_UDP)
/* But for UDP preserve the source port */
diff --git a/passt.1 b/passt.1
index 908fd4a4..d057aebc 100644
--- a/passt.1
+++ b/passt.1
@@ -650,10 +650,11 @@ Default is \fBauto\fR.
.TP
.BR \-\-host-lo-to-ns-lo
-If specified, connections forwarded with \fB\-t\fR and \fB\-u\fR from
-the host's loopback address will appear on the loopback address in the
-guest as well. Without this option such forwarded packets will appear
-to come from the guest's public address.
+If specified, connections to a host loopback address forwarded with
+\fB\-t\fR or \fB\-u\fR will be delivered to the same loopback address
+on the guest. Without this option such connections are forwarded to
+the guest's public address. This option is incompatible with
+\fB--no-splice\fR.
.TP
.BR \-\-userns " " \fIspec
--
2.54.0