[PATCH 0/5] RFC: Fix bug 209
Here are a handful of changes to forwarding ant multicast handling, that fix bug 209. It also gets us closer to correct multicast handling, though we're certainly not there yet - multicast things currently only really work at all because IP_MULTICAST_ALL defaults to on, and for the common protocols the host is likely to be already a group member. RFC, because a tmux change has broken the tests for me, and I wanted to send this out before I sort out how to fix that. I have run the subset of tests covered by "make bats", which includes the podman tests. David Gibson (5): fwd: Clarify semantics of --host-lo-to-ns-lo udp: Validate that we have a unicast source address fwd: Rework default address logic for inbound flows fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() fwd: Don't rewrite inbound multicast destinations conf.c | 2 ++ fwd.c | 61 ++++++++++++++++++++++++++++++++++-------------------- passt.1 | 9 ++++---- udp_flow.c | 2 +- 4 files changed, 46 insertions(+), 28 deletions(-) -- 2.55.0
fwd_nat_from_host() (nearly) always rewrites the destination address for
inbound flows to the observed guest address. Usually, that makes sense:
regardless of the host address to which the new flow arrived, we want to
direct it to the guest. However, that clearly does not make sense for
multicast - it should still appear as a multicast transmission to the
guest.
In particular this can work very badly for multicast protocols which use
the same source and destination ports by convention (e.g. mDNS). In this
case, we will attempt to forword multicast packets to our own socket,
causing a forwarding loop (see bug 209 for more details).
While it's certainly not enough to make us handle multicast correctly in
all circumstances, not translating multicast destinations is closer to
correct, and prevents bug 209 at least.
Link: https://bugs.passt.top/show_bug.cgi?id=209
Signed-off-by: David Gibson
participants (1)
-
David Gibson