We remove the addr_seen and addr_ll_seen fields in struct ip6_ctx
and replace them by setting CONF_ADDR_OBSERVED and CONF_ADDR_LINKLOCAL
flags in the corresponding entry in the unified address array.
The observed IPv6 address is always kept at position 1 (position 0
is reserved for IPv4), allowing very fast lookup. Only one IPv6 address
can have the OBSERVED flag at a time.
A new fwd_set_observed_ip6() function handles observed IPv6 addresses,
mirroring the IPv4 fwd_set_observed_ip4() function. Both tap.c and
migrate.c now use this common function.
Signed-off-by: Jon Maloy
---
conf.c | 2 -
dhcpv6.c | 6 +--
dhcpv6.h | 2 +-
fwd.c | 108 ++++++++++++++++++++++++++++++++++++++++++++++--------
fwd.h | 1 +
migrate.c | 33 +++++++++++++----
passt.h | 4 --
pasta.c | 19 ++++++++--
tap.c | 62 ++++++++++++++++++++-----------
9 files changed, 175 insertions(+), 62 deletions(-)
diff --git a/conf.c b/conf.c
index 0172dcd..450a15e 100644
--- a/conf.c
+++ b/conf.c
@@ -807,8 +807,6 @@ static unsigned int conf_ip6(struct ctx *c, unsigned int ifi)
e->flags = CONF_ADDR_HOST;
}
- ip6->addr_seen = e->addr.a6;
-
if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw))
ip6->our_tap_ll = ip6->guest_gw;
diff --git a/dhcpv6.c b/dhcpv6.c
index 801b01b..33a1161 100644
--- a/dhcpv6.c
+++ b/dhcpv6.c
@@ -546,7 +546,7 @@ static size_t dhcpv6_client_fqdn_fill(const struct iov_tail *data,
* Return: 0 if it's not a DHCPv6 message, 1 if handled, -1 on failure
*/
int dhcpv6(struct ctx *c, struct iov_tail *data,
- const struct in6_addr *saddr, const struct in6_addr *daddr)
+ const struct in6_addr *daddr)
{
const struct opt_server_id *server_id = NULL;
struct inany_addr_entry *e = first_v6(c);
@@ -588,8 +588,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data,
if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh))
return -1;
- c->ip6.addr_ll_seen = *saddr;
-
src = &c->ip6.our_tap_ll;
mh = IOV_REMOVE_HEADER(data, mh_storage);
@@ -680,8 +678,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data,
tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546,
mh->xid, &resp, n);
- if (e)
- c->ip6.addr_seen = e->addr.a6;
return 1;
}
diff --git a/dhcpv6.h b/dhcpv6.h
index c706dfd..8cbc769 100644
--- a/dhcpv6.h
+++ b/dhcpv6.h
@@ -7,7 +7,7 @@
#define DHCPV6_H
int dhcpv6(struct ctx *c, struct iov_tail *data,
- struct in6_addr *saddr, struct in6_addr *daddr);
+ struct in6_addr *daddr);
void dhcpv6_init(const struct ctx *c);
#endif /* DHCPV6_H */
diff --git a/fwd.c b/fwd.c
index ca704c2..8598fff 100644
--- a/fwd.c
+++ b/fwd.c
@@ -571,6 +571,74 @@ void fwd_set_observed_ip4(struct ctx *c, const struct in_addr *addr)
}
}
+/**
+ * fwd_set_observed_ip6() - Set observed IPv6 guest address
+ * @c: Execution context
+ * @addr: IPv6 address observed in guest traffic
+ *
+ * Mark @addr as the observed guest address. The observed address is always
+ * kept at position 1 for O(1) lookup. Only one IPv6 address can have the
+ * OBSERVED flag at a time. Link-local addresses also get LINKLOCAL flag.
+ */
+void fwd_set_observed_ip6(struct ctx *c, const struct in6_addr *addr)
+{
+ struct inany_addr_entry *e;
+ uint8_t flags = CONF_ADDR_OBSERVED;
+ int i;
+
+ if (IN6_IS_ADDR_UNSPECIFIED(addr))
+ return;
+
+ if (IN6_IS_ADDR_LINKLOCAL(addr))
+ flags |= CONF_ADDR_LINKLOCAL;
+
+ /* Fast path: check if already observed at position 1 */
+ if (c->addr_count > 1) {
+ e = &c->addrs[1];
+ if ((e->flags & CONF_ADDR_OBSERVED) && !inany_v4(&e->addr) &&
+ IN6_ARE_ADDR_EQUAL(&e->addr.a6, addr))
+ return;
+ }
+
+ /* Slow path: new observed address - insert at position 1 */
+ if (c->addr_count >= INANY_MAX_ADDRS) {
+ debug("Address table full, can't add observed IPv6");
+ return;
+ }
+
+ /* Make room at position 1 */
+ if (c->addr_count > 1) {
+ e = &c->addrs[1];
+ memmove(&c->addrs[2], e, (c->addr_count - 1) * sizeof(*e));
+ }
+ c->addr_count++;
+
+ /* Insert new observed address at position 1 */
+ e = &c->addrs[1];
+ e->addr.a6 = *addr;
+ e->prefix_len = 64;
+ e->flags = flags;
+
+ /* Clean up: find and handle old observed IPv6 address */
+ for (i = 2; i < c->addr_count; i++) {
+ e = &c->addrs[i];
+
+ if (inany_v4(&e->addr) || !(e->flags & CONF_ADDR_OBSERVED))
+ continue;
+
+ /* Found old observed - clear flag */
+ e->flags &= ~CONF_ADDR_OBSERVED;
+
+ /* Remove if no other flags, or if addr is duplicate */
+ if (!e->flags || IN6_ARE_ADDR_EQUAL(&e->addr.a6, addr)) {
+ memmove(&c->addrs[i], &c->addrs[i + 1],
+ (c->addr_count - i - 1) * sizeof(*e));
+ c->addr_count--;
+ }
+ break;
+ }
+}
+
/**
* fwd_guest_accessible() - Is address guest-accessible
* @c: Execution context
@@ -600,15 +668,6 @@ static bool fwd_guest_accessible(const struct ctx *c,
if (inany_equals(addr, &e->addr))
return false;
- /* For IPv6, addr_seen starts unspecified, because we don't know what LL
- * address the guest will take until we see it. Only check against it
- * if it has been set to a real address.
- */
- if (!inany_v4(addr) &&
- !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&
- inany_equals6(addr, &c->ip6.addr_seen))
- return false;
-
return true;
}
@@ -819,10 +878,21 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
}
tgt->oaddr = inany_any4;
} else {
- if (c->host_lo_to_ns_lo)
+ if (c->host_lo_to_ns_lo) {
tgt->eaddr = inany_loopback6;
- else
- tgt->eaddr.a6 = c->ip6.addr_seen;
+ } else {
+ const union inany_addr *guest_addr;
+
+ guest_addr = fwd_guest_addr(c, AF_INET6,
+ CONF_ADDR_OBSERVED,
+ CONF_ADDR_LINKLOCAL);
+ if (!guest_addr)
+ guest_addr = fwd_guest_addr(c, AF_INET6,
+ 0, CONF_ADDR_LINKLOCAL);
+ if (!guest_addr)
+ return PIF_NONE;
+ tgt->eaddr = *guest_addr;
+ }
tgt->oaddr = inany_any6;
}
@@ -855,10 +925,16 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
return PIF_NONE;
tgt->eaddr = *guest_addr;
} else {
- if (inany_is_linklocal6(&tgt->oaddr))
- tgt->eaddr.a6 = c->ip6.addr_ll_seen;
- else
- tgt->eaddr.a6 = c->ip6.addr_seen;
+ bool linklocal = inany_is_linklocal6(&tgt->oaddr);
+ const union inany_addr *guest_addr;
+ uint8_t excl = linklocal ? 0 : CONF_ADDR_LINKLOCAL;
+
+ guest_addr = fwd_guest_addr(c, AF_INET6, CONF_ADDR_OBSERVED, excl);
+ if (!guest_addr)
+ guest_addr = fwd_guest_addr(c, AF_INET6, 0, excl);
+ if (!guest_addr)
+ return PIF_NONE;
+ tgt->eaddr = *guest_addr;
}
return PIF_TAP;
diff --git a/fwd.h b/fwd.h
index 38f4e60..4de3890 100644
--- a/fwd.h
+++ b/fwd.h
@@ -18,6 +18,7 @@ bool fwd_port_is_ephemeral(in_port_t port);
const union inany_addr *fwd_guest_addr(const struct ctx *c, sa_family_t af,
uint8_t incl, uint8_t excl);
void fwd_set_observed_ip4(struct ctx *c, const struct in_addr *addr);
+void fwd_set_observed_ip6(struct ctx *c, const struct in6_addr *addr);
enum fwd_ports_mode {
FWD_UNSET = 0,
diff --git a/migrate.c b/migrate.c
index d223857..6577334 100644
--- a/migrate.c
+++ b/migrate.c
@@ -56,18 +56,28 @@ struct migrate_seen_addrs_v1 {
static int seen_addrs_source_v1(struct ctx *c,
const struct migrate_stage *stage, int fd)
{
- struct migrate_seen_addrs_v1 addrs = {
- .addr6 = c->ip6.addr_seen,
- .addr6_ll = c->ip6.addr_ll_seen,
- };
+ struct migrate_seen_addrs_v1 addrs = { 0 };
+ const struct inany_addr_entry *e;
const union inany_addr *obs4;
(void)stage;
+ /* IPv4 observed address at position 0 */
obs4 = fwd_guest_addr(c, AF_INET, CONF_ADDR_OBSERVED, 0);
if (obs4)
addrs.addr4 = *inany_v4(obs4);
+ /* IPv6 observed address at position 1 */
+ if (c->addr_count > 1) {
+ e = &c->addrs[1];
+ if (!inany_v4(&e->addr) && (e->flags & CONF_ADDR_OBSERVED)) {
+ if (e->flags & CONF_ADDR_LINKLOCAL)
+ addrs.addr6_ll = e->addr.a6;
+ else
+ addrs.addr6 = e->addr.a6;
+ }
+ }
+
memcpy(addrs.mac, c->guest_mac, sizeof(addrs.mac));
if (write_all_buf(fd, &addrs, sizeof(addrs)))
@@ -88,6 +98,7 @@ static int seen_addrs_target_v1(struct ctx *c,
const struct migrate_stage *stage, int fd)
{
struct migrate_seen_addrs_v1 addrs;
+ struct in6_addr addr6, addr6_ll;
struct in_addr addr4;
(void)stage;
@@ -95,13 +106,19 @@ static int seen_addrs_target_v1(struct ctx *c,
if (read_all_buf(fd, &addrs, sizeof(addrs)))
return errno;
- c->ip6.addr_seen = addrs.addr6;
- c->ip6.addr_ll_seen = addrs.addr6_ll;
-
- /* Copy to avoid unaligned access from packed struct */
+ /* Copy from packed struct to avoid alignment issues */
addr4 = addrs.addr4;
+ addr6 = addrs.addr6;
+ addr6_ll = addrs.addr6_ll;
+
fwd_set_observed_ip4(c, &addr4);
+ /* Prefer global over link-local if both present (only one slot) */
+ if (!IN6_IS_ADDR_UNSPECIFIED(&addr6))
+ fwd_set_observed_ip6(c, &addr6);
+ else
+ fwd_set_observed_ip6(c, &addr6_ll);
+
memcpy(c->guest_mac, addrs.mac, sizeof(c->guest_mac));
return 0;
diff --git a/passt.h b/passt.h
index fa747c6..a9f63b5 100644
--- a/passt.h
+++ b/passt.h
@@ -112,8 +112,6 @@ struct ip4_ctx {
/**
* struct ip6_ctx - IPv6 execution context
- * @addr_seen: Latest IPv6 global/site address seen as source from tap
- * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap
* @guest_gw: IPv6 gateway as seen by the guest
* @map_host_loopback: Outbound connections to this address are NATted to the
* host's [::1]
@@ -129,8 +127,6 @@ struct ip4_ctx {
* @no_copy_addrs: Don't copy all addresses when configuring namespace
*/
struct ip6_ctx {
- struct in6_addr addr_seen;
- struct in6_addr addr_ll_seen;
struct in6_addr guest_gw;
struct in6_addr map_host_loopback;
struct in6_addr map_guest_addr;
diff --git a/pasta.c b/pasta.c
index dd23a14..f16d508 100644
--- a/pasta.c
+++ b/pasta.c
@@ -46,6 +46,8 @@
#include "util.h"
#include "passt.h"
+#include "conf.h"
+#include "fwd.h"
#include "isolation.h"
#include "netlink.h"
#include "log.h"
@@ -352,14 +354,15 @@ static void pasta_ns_conf_ip4(struct ctx *c)
*/
static void pasta_ns_conf_ip6(struct ctx *c)
{
+ struct in6_addr addr_ll;
int rc = 0;
- rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi,
- &c->ip6.addr_ll_seen);
- if (rc < 0) {
+ rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, &addr_ll);
+ if (rc < 0)
warn("Can't get LL address from namespace: %s",
strerror_(-rc));
- }
+ else
+ fwd_set_observed_ip6(c, &addr_ll);
rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi);
if (rc < 0) {
@@ -375,6 +378,13 @@ static void pasta_ns_conf_ip6(struct ctx *c)
const struct inany_addr_entry *e;
for_each_addr(e, c, AF_INET6) {
+ if (IN6_IS_ADDR_UNSPECIFIED(&e->addr.a6))
+ continue;
+
+ /* Skip link-local - kernel auto-configures */
+ if (e->flags & CONF_ADDR_LINKLOCAL)
+ continue;
+
rc = nl_addr_set(nl_sock_ns, c->pasta_ifi,
AF_INET6, &e->addr.a6, e->prefix_len);
if (rc < 0)
@@ -445,6 +455,7 @@ void pasta_ns_conf(struct ctx *c)
if (c->ifi6)
pasta_ns_conf_ip6(c);
+
}
proto_update_l2_buf(c->guest_mac);
diff --git a/tap.c b/tap.c
index 8c1ed35..be698eb 100644
--- a/tap.c
+++ b/tap.c
@@ -173,6 +173,16 @@ static void tap_check_src_addr4(struct ctx *c, const struct in_addr *addr)
fwd_set_observed_ip4(c, addr);
}
+/**
+ * tap_check_src_addr6() - Note an IPv6 address seen in guest traffic
+ * @c: Execution context
+ * @addr: IPv6 address seen as source from guest
+ */
+static void tap_check_src_addr6(struct ctx *c, const struct in6_addr *addr)
+{
+ fwd_set_observed_ip6(c, addr);
+}
+
/**
* tap_ip6_daddr() - Normal IPv6 destination address for inbound packets
* @c: Execution context
@@ -183,9 +193,33 @@ static void tap_check_src_addr4(struct ctx *c, const struct in_addr *addr)
const struct in6_addr *tap_ip6_daddr(const struct ctx *c,
const struct in6_addr *src)
{
- if (IN6_IS_ADDR_LINKLOCAL(src))
- return &c->ip6.addr_ll_seen;
- return &c->ip6.addr_seen;
+ bool want_ll = IN6_IS_ADDR_LINKLOCAL(src);
+ const struct inany_addr_entry *e;
+
+ /* Find first observed address of matching scope */
+ for_each_addr(e, c, AF_INET6) {
+ bool is_ll = !!(e->flags & CONF_ADDR_LINKLOCAL);
+
+ if (is_ll != want_ll)
+ continue;
+ if (e->flags & CONF_ADDR_OBSERVED)
+ return &e->addr.a6;
+ }
+
+ /* Fallback to first address of matching scope */
+ for_each_addr(e, c, AF_INET6) {
+ bool is_ll = !!(e->flags & CONF_ADDR_LINKLOCAL);
+
+ if (is_ll == want_ll)
+ return &e->addr.a6;
+ }
+
+ /* Last resort: return first IPv6 address */
+ e = first_v6(c);
+ if (e)
+ return &e->addr.a6;
+
+ return &in6addr_any;
}
/**
@@ -956,24 +990,8 @@ resume:
continue;
}
- if (IN6_IS_ADDR_LINKLOCAL(saddr)) {
- c->ip6.addr_ll_seen = *saddr;
-
- if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) {
- c->ip6.addr_seen = *saddr;
- }
-
- if (!first_v6(c) && c->addr_count < INANY_MAX_ADDRS) {
- struct inany_addr_entry *e;
-
- e = &c->addrs[c->addr_count++];
- e->addr.a6 = *saddr;
- e->prefix_len = 64;
- e->flags = CONF_ADDR_LINKLOCAL;
- }
- } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){
- c->ip6.addr_seen = *saddr;
- }
+ if (!IN6_IS_ADDR_UNSPECIFIED(saddr))
+ tap_check_src_addr6(c, saddr);
if (proto == IPPROTO_ICMPV6) {
struct iov_tail ndp_data;
@@ -1004,7 +1022,7 @@ resume:
if (proto == IPPROTO_UDP) {
struct iov_tail uh_data = data;
- if (dhcpv6(c, &uh_data, saddr, daddr))
+ if (dhcpv6(c, &uh_data, daddr))
continue;
}
--
2.52.0