From: Stefano Brivio
Add a 'taddr' field to forwarding rules, which controls the destination
address on the target side. Since changing the structure alters the pesto
update protocol, bump the protocol version number
Signed-off-by: Stefano Brivio
[dwg: Split from option parsing code, added protocol version bump,
explicitly exclude splicing with target address for now]
Signed-off-by: David Gibson
---
fwd.c | 8 ++++++--
fwd_rule.c | 53 +++++++++++++++++++++++++++++++++++++++++------------
fwd_rule.h | 7 +++++--
pesto.h | 6 +++++-
4 files changed, 57 insertions(+), 17 deletions(-)
diff --git a/fwd.c b/fwd.c
index 042158cf..3ae25fde 100644
--- a/fwd.c
+++ b/fwd.c
@@ -1023,7 +1023,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
/* Common for spliced and non-spliced cases */
tgt->eport = rule->to + (ini->oport - rule->first);
- if (!c->no_splice && inany_is_loopback(&ini->eaddr) &&
+ /* TODO: Allow splicing with specified target address */
+ if (!c->no_splice && inany_is_unspecified(&rule->taddr) &&
+ inany_is_loopback(&ini->eaddr) &&
(proto == IPPROTO_TCP || proto == IPPROTO_UDP)) {
/* spliceable */
@@ -1074,7 +1076,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
}
tgt->oport = ini->eport;
- if (inany_v4(&tgt->oaddr)) {
+ if (!inany_is_unspecified(&rule->taddr)) {
+ tgt->eaddr = rule->taddr;
+ } else if (inany_v4(&tgt->oaddr)) {
tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
} else {
if (inany_is_linklocal6(&tgt->oaddr))
diff --git a/fwd_rule.c b/fwd_rule.c
index 42ec68e3..312bc607 100644
--- a/fwd_rule.c
+++ b/fwd_rule.c
@@ -115,10 +115,15 @@ __attribute__((noinline))
const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size)
{
const char *percent = *rule->ifname ? "%" : "";
+ char taddr[INANY_ADDRSTRLEN] = { 0 };
const char *weak = "", *scan = "";
char addr[INANY_ADDRSTRLEN];
int len;
+ if (!inany_is_unspecified(&rule->taddr)) {
+ (void)snprintf(taddr, sizeof(taddr), "%s:",
+ inany_ntop(&rule->taddr, addr, sizeof(addr)));
+ }
inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr));
if (rule->flags & FWD_WEAK)
weak = " (best effort)";
@@ -127,16 +132,17 @@ const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size)
if (rule->first == rule->last) {
len = snprintf(dst, size,
- "%s [%s]%s%s:%hu => %hu %s%s",
+ "%s [%s]%s%s:%hu => %s%hu %s%s",
ipproto_name(rule->proto), addr, percent,
- rule->ifname, rule->first, rule->to, weak, scan);
+ rule->ifname, rule->first,
+ taddr, rule->to, weak, scan);
} else {
in_port_t tolast = rule->last - rule->first + rule->to;
len = snprintf(dst, size,
- "%s [%s]%s%s:%hu-%hu => %hu-%hu %s%s",
+ "%s [%s]%s%s:%hu-%hu => %s%hu-%hu %s%s",
ipproto_name(rule->proto), addr, percent,
rule->ifname, rule->first, rule->last,
- rule->to, tolast, weak, scan);
+ taddr, rule->to, tolast, weak, scan);
}
if (len < 0 || (size_t)len >= size)
@@ -325,6 +331,36 @@ int fwd_rule_add(struct fwd_table *fwd, const struct fwd_rule *new)
return -EINVAL;
}
+ if (!inany_is_unspecified(&new->taddr)) {
+ char tastr[INANY_ADDRSTRLEN];
+
+ if (inany_is_multicast(&new->taddr)) {
+ warn("Multicast target address %s for forwarding rule",
+ inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+ return -EINVAL;
+ }
+
+ if (new->flags & FWD_DUAL_STACK_ANY) {
+ warn("Dual stack forward to %s address %s unsupported",
+ inany_v4(&new->taddr) ? "IPv4" : "IPv6",
+ inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+ warn("Did you mean %s/... instead?",
+ inany_v4(&new->taddr) ? "0.0.0.0" : "[::]");
+ return -EINVAL;
+ }
+
+ if (!!inany_v4(&new->addr) != !!inany_v4(&new->taddr)) {
+ char lastr[INANY_ADDRSTRLEN];
+
+ warn("Forward from %s (%s) to %s (%s) unsupported",
+ inany_v4(&new->addr) ? "IPv4" : "IPv6",
+ inany_ntop(&new->addr, lastr, sizeof(lastr)),
+ inany_v4(&new->taddr) ? "IPv4" : "IPv6",
+ inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+ return -EINVAL;
+ }
+ }
+
for (i = 0; i < fwd->count; i++) {
char newstr[FWD_RULE_STRLEN], rulestr[FWD_RULE_STRLEN];
@@ -393,6 +429,7 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del,
{
struct fwd_rule rule = {
.addr = addr ? *addr : inany_any6,
+ .taddr = tgt_addr ? *tgt_addr : inany_any6,
.ifname = { 0 },
.proto = proto,
.flags = flags,
@@ -401,14 +438,6 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del,
char rulestr[FWD_RULE_STRLEN];
unsigned base, i;
- if (tgt_addr && !inany_is_unspecified(tgt_addr)) {
- char astr[INANY_ADDRSTRLEN];
-
- info("Target address: %s",
- inany_ntop(tgt_addr, astr, sizeof(astr)));
- die("Target address remapping not yet implemented");
- }
-
if (!addr)
rule.flags |= FWD_DUAL_STACK_ANY;
if (ifname) {
diff --git a/fwd_rule.h b/fwd_rule.h
index 435be5bd..a8788318 100644
--- a/fwd_rule.h
+++ b/fwd_rule.h
@@ -33,6 +33,7 @@
/**
* struct fwd_rule - Forwarding rule governing a range of ports
* @addr: Address to forward from
+ * @taddr: Target side destination address
* @ifname: Interface to forward from
* @first: First port number to forward
* @last: Last port number to forward
@@ -45,6 +46,7 @@
*/
struct fwd_rule {
union inany_addr addr;
+ union inany_addr taddr;
char ifname[IFNAMSIZ];
in_port_t first;
in_port_t last;
@@ -91,10 +93,11 @@ void fwd_probe_ephemeral(void);
#define FWD_RULE_STRLEN \
(IPPROTO_STRLEN - 1 \
- + INANY_ADDRSTRLEN - 1 \
+ + INANY_ADDRSTRLEN - 1 /* listen addr */ \
+ + INANY_ADDRSTRLEN - 1 /* target addr */ \
+ IFNAMSIZ - 1 \
+ 4 * (UINT16_STRLEN - 1) \
- + sizeof(" []%:- => - (best effort) (auto-scan)"))
+ + sizeof(" []%:- => :- (best effort) (auto-scan)"))
const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule);
const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size);
diff --git a/pesto.h b/pesto.h
index 980cc17d..8db701b4 100644
--- a/pesto.h
+++ b/pesto.h
@@ -15,7 +15,11 @@
#define PESTO_SERVER_MAGIC "basil:s"
/* Version 0 is reserved for unreleased / unsupported experimental versions */
-#define PESTO_PROTOCOL_VERSION 1
+/* Version 1 had no target address field in struct fwd_rule. It was released,
+ * but was little enough used that we decided not to implement backwards
+ * compatiblity code (i.e. a v2 pesto will not work with a v1 pasta)
+ */
+#define PESTO_PROTOCOL_VERSION 2
/* Maximum size of a pif name, including \0 */
#define PIF_NAME_SIZE (128)
--
2.55.0