On Thu, Nov 28, 2024 at 07:45:32PM -0500, Jon Maloy wrote:During testing it is sometimes useful to force traffic which would normally be forwarded by socket splicing through the tap interface. In this commit, we add a command switch making it possible to disable splicing for inbound local traffic. For outbound local traffic this seems to be much trickier, so I leave that for a possible later commit.See comments on your other mail.Suggested-by: David Gibson <dgibson(a)redhat.com> Signed-off-by: Jon Maloy <jmaloy(a)redhat.com>This LGTM, excepting minor details. Arguably it's even enough, since you can effectively disable outbound splicing by not using -T or -U.--- conf.c | 5 +++++ fwd.c | 2 +- passt.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index eaa7d99..8d58652 100644 --- a/conf.c +++ b/conf.c @@ -890,6 +890,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --no-splice Disable outbound socket splicing\n"This should be "inbound" not "outbound" yes? For a final version this would need to be added to the manpage as well. I guess unless we wanted to leave it undocumented as an option intended only for developer testing." --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" @@ -1319,6 +1320,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"no-splice", no_argument, &c->no_splice, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, @@ -1756,6 +1758,9 @@ void conf(struct ctx *c, int argc, char **argv) } } while (name != -1); + if (c->mode == MODE_PASST) + c->no_splice = 1; + if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) die("--no-copy-routes needs --config-net"); diff --git a/fwd.c b/fwd.c index 0b7f8b1..2829cd2 100644 --- a/fwd.c +++ b/fwd.c @@ -443,7 +443,7 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, else if (proto == IPPROTO_UDP) tgt->eport += c->udp.fwd_in.delta[tgt->eport]; - if (c->mode == MODE_PASTA && inany_is_loopback(&ini->eaddr) && + if (!c->no_splice && inany_is_loopback(&ini->eaddr) && (proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { /* spliceable */ diff --git a/passt.h b/passt.h index c038630..0271e7c 100644 --- a/passt.h +++ b/passt.h @@ -291,6 +291,7 @@ struct ctx { int no_dhcpv6; int no_ndp; int no_ra; + int no_splice; int host_lo_to_ns_lo; int freebind;-- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson