Re: [PATCH v4 2/9] arp/ndp: respond with true MAC address of LAN local remote hosts

On Tue, Aug 19, 2025 at 11:09:58PM -0400, Jon Maloy wrote:

When we receive an ARP request or NDP neigbor solicitation over the tap interface for a host on the local network segment attached to the template interface, we respond with that host's real MAC address.

The local host, which is acting as a proxy for the default gateway, is still exempted from this rule.

Signed-off-by: Jon Maloy --- arp.c | 9 +++++++++ fwd.c | 38 ++++++++++++++++++++++++++++++-------- fwd.h | 1 + inany.c | 1 + ndp.c | 9 +++++++++ 5 files changed, 50 insertions(+), 8 deletions(-)

diff --git a/arp.c b/arp.c index fc482bb..c37867a 100644 --- a/arp.c +++ b/arp.c @@ -29,6 +29,7 @@ #include "dhcp.h" #include "passt.h" #include "tap.h" +#include "netlink.h"

/** * arp() - Check if this is a supported ARP message, reply as needed @@ -39,6 +40,7 @@ */ int arp(const struct ctx *c, const struct pool *p) { + union inany_addr tgt; unsigned char swap[4]; struct ethhdr *eh; struct arphdr *ah; @@ -72,6 +74,13 @@ int arp(const struct ctx *c, const struct pool *p) memcpy(am->tha, am->sha, sizeof(am->tha)); memcpy(am->sha, c->our_tap_mac, sizeof(am->sha));

+ /* Respond with true MAC address if remote host is on + * the template interface's network segment + */ + inany_from_af(&tgt, AF_INET, am->tip); + if (!fwd_inany_nat(c, &tgt)) + nl_neigh_mac_get(nl_sock, &tgt, c->ifi4, am->sha);

You're not checking for errors from nl_neigh_mac_get().

memcpy(swap, am->tip, sizeof(am->tip)); memcpy(am->tip, am->sip, sizeof(am->tip)); memcpy(am->sip, swap, sizeof(am->sip)); diff --git a/fwd.c b/fwd.c index 250cf56..55bf5f2 100644 --- a/fwd.c +++ b/fwd.c @@ -331,20 +331,29 @@ static bool fwd_guest_accessible(const struct ctx *c, * * Only handles translations that depend *only* on the address. Anything * related to specific ports or flows is handled elsewhere. + * + * Return: true if there was a translation, otherwise false */ -static void nat_outbound(const struct ctx *c, const union inany_addr *addr, - union inany_addr *translated) +static bool nat_outbound(const struct ctx *c, const union inany_addr *addr, + union inany_addr *translated) {

I'm having trouble convincing myself that explicitly excluding MAC preservation in NAT cases is strictly correct, as opposed to doing a MAC lookup on the translated address. I'm reasonably confident it will be good enough for most purposes.

- if (inany_equals4(addr, &c->ip4.map_host_loopback)) + if (inany_equals4(addr, &c->ip4.map_host_loopback)) {

For this case, we'll certainly want our_tap_mac. We should get that indirectly anyway, though, since 127.0.0.1 will never be in the host interface's neighbour table.

*translated = inany_loopback4; - else if (inany_equals6(addr, &c->ip6.map_host_loopback)) + return true; + } else if (inany_equals6(addr, &c->ip6.map_host_loopback)) { *translated = inany_loopback6;

Ditto, but for ::.

- else if (inany_equals4(addr, &c->ip4.map_guest_addr)) + return true; + } else if (inany_equals4(addr, &c->ip4.map_guest_addr)) { *translated = inany_from_v4(c->ip4.addr); - else if (inany_equals6(addr, &c->ip6.map_guest_addr)) + return true; + } else if (inany_equals6(addr, &c->ip6.map_guest_addr)) { translated->a6 = c->ip6.addr;

Arguably for these cases, using the MAC of the translated address is what we want. There is a real peer on the host side (usually the host itself, but maybe something else), which might have a presence on the template interface. We have the NAT in place because it conflicts with the guest's IP, but the MAC should still be unique.

- else - *translated = *addr; + return true; + } + + *translated = *addr; + return false; + }

/** @@ -554,3 +563,16 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,

return PIF_TAP; } + +/** fwd_inany_nat - Find if a remote IPv[46] address is subject to NAT + * @c: Execution context + * @addr: IPv[46] address + * + * Return: true if translated, false otherwise + */ +bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr) +{ + union inany_addr addr_nat; + + return nat_outbound(c, addr, &addr_nat); +} diff --git a/fwd.h b/fwd.h index 65c7c96..c8d485d 100644 --- a/fwd.h +++ b/fwd.h @@ -56,5 +56,6 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, const struct flowside *ini, struct flowside *tgt); uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, const struct flowside *ini, struct flowside *tgt); +bool fwd_inany_nat(const struct ctx *c, const union inany_addr *addr);

#endif /* FWD_H */ diff --git a/inany.c b/inany.c index 65a39f9..7680439 100644 --- a/inany.c +++ b/inany.c @@ -16,6 +16,7 @@ #include "ip.h" #include "siphash.h" #include "inany.h" +#include "fwd.h"

const union inany_addr inany_loopback4 = INANY_INIT4(IN4ADDR_LOOPBACK_INIT); const union inany_addr inany_any4 = INANY_INIT4(IN4ADDR_ANY_INIT); diff --git a/ndp.c b/ndp.c index 3e15494..9912f80 100644 --- a/ndp.c +++ b/ndp.c @@ -32,6 +32,7 @@ #include "passt.h" #include "tap.h" #include "log.h" +#include "netlink.h"

#define RT_LIFETIME 65535

@@ -196,6 +197,7 @@ static void ndp_send(const struct ctx *c, const struct in6_addr *dst, static void ndp_na(const struct ctx *c, const struct in6_addr *dst, const struct in6_addr *addr) { + union inany_addr tgt; struct ndp_na na = { .ih = { .icmp6_type = NA, @@ -215,6 +217,13 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst,

memcpy(na.target_l2_addr.mac, c->our_tap_mac, ETH_ALEN);

+ /* Respond with true link-layer address if remote host is on + * the template interface's network segment + */ + inany_from_af(&tgt, AF_INET6, addr); + if (!fwd_inany_nat(c, &tgt)) + nl_neigh_mac_get(nl_sock, &tgt, c->ifi6, na.target_l2_addr.mac); + ndp_send(c, dst, &na, sizeof(na)); }

-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson