Use the newly-introduced NL_DUP mode for nl_route() to copy all the
routes associated to the template interface in the outer namespace,
unless --no-copy-routes (also implied by -g) is given.
Otherwise, we can't use default gateways which are not, address-wise,
on the same subnet as the container, as reported by Callum.
Reported-by: Callum Parsey
Link: https://github.com/containers/podman/issues/18539
Signed-off-by: Stefano Brivio
---
conf.c | 14 ++++++++++++++
passt.1 | 10 ++++++++++
passt.h | 4 +++-
pasta.c | 6 ++++--
4 files changed, 31 insertions(+), 3 deletions(-)
diff --git a/conf.c b/conf.c
index bc1ae99..c2a745e 100644
--- a/conf.c
+++ b/conf.c
@@ -923,6 +923,7 @@ pasta_opts:
info( " --no-netns-quit Don't quit if filesystem-bound target");
info( " network namespace is deleted");
info( " --config-net Configure tap interface in namespace");
+ info( " --no-copy-routes Don't copy all routes to namespace");
info( " --ns-mac-addr ADDR Set MAC address on tap interface");
exit(EXIT_FAILURE);
@@ -1212,6 +1213,7 @@ void conf(struct ctx *c, int argc, char **argv)
{"outbound-if4", required_argument, NULL, 15 },
{"outbound-if6", required_argument, NULL, 16 },
{"config-net", no_argument, NULL, 17 },
+ {"no-copy-routes", no_argument, NULL, 18 },
{ 0 },
};
struct get_bound_ports_ns_arg ns_ports_arg = { .c = c };
@@ -1376,6 +1378,12 @@ void conf(struct ctx *c, int argc, char **argv)
c->pasta_conf_ns = 1;
break;
+ case 18:
+ if (c->mode != MODE_PASTA)
+ die("--no-copy-routes is for pasta mode only");
+
+ c->no_copy_routes = 1;
+ break;
case 'd':
if (c->debug)
die("Multiple --debug options given");
@@ -1524,6 +1532,9 @@ void conf(struct ctx *c, int argc, char **argv)
}
break;
case 'g':
+ if (c->mode == MODE_PASTA)
+ c->no_copy_routes = 1;
+
if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) &&
inet_pton(AF_INET6, optarg, &c->ip6.gw) &&
!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) &&
@@ -1658,6 +1669,9 @@ void conf(struct ctx *c, int argc, char **argv)
if (*c->sock_path && c->fd_tap >= 0)
die("Options --socket and --fd are mutually exclusive");
+ if (c->mode == MODE_PASTA && c->no_copy_routes && !c->pasta_conf_ns)
+ die("Option --no-copy-routes needs --config-net");
+
if (!ifi4 && *c->ip4.ifname_out)
ifi4 = if_nametoindex(c->ip4.ifname_out);
diff --git a/passt.1 b/passt.1
index 19e01d5..10c96ae 100644
--- a/passt.1
+++ b/passt.1
@@ -546,6 +546,16 @@ NAME are given as target), do not exit once the network namespace is deleted.
Configure networking in the namespace: set up addresses and routes as configured
or sourced from the host, and bring up the tap interface.
+.TP
+.BR \-\-no-copy-routes
+With \-\-config-net, do not copy all the routes associated to the interface we
+derive addresses and routes from: set up only the default gateway. Implied by
+-g, \-\-gateway.
+
+Default is to copy all the routing entries from the interface in the outer
+namespace to the target namespace, translating the output interface attribute to
+the outbound interface in the namespace.
+
.TP
.BR \-\-ns-mac-addr " " \fIaddr
Configure MAC address \fIaddr\fR on the tap interface in the namespace.
diff --git a/passt.h b/passt.h
index 73fe808..d314596 100644
--- a/passt.h
+++ b/passt.h
@@ -181,7 +181,8 @@ struct ip6_ctx {
* @ip6: IPv6 configuration
* @pasta_ifn: Name of namespace interface for pasta
* @pasta_ifn: Index of namespace interface for pasta
- * @pasta_conf_ns: Configure namespace interface after creating it
+ * @pasta_conf_ns: Configure namespace after creating it
+ * @no_copy_routes: Don't copy all routes when configuring target namespace
* @no_tcp: Disable TCP operation
* @tcp: Context for TCP protocol handler
* @no_tcp: Disable UDP operation
@@ -240,6 +241,7 @@ struct ctx {
char pasta_ifn[IF_NAMESIZE];
unsigned int pasta_ifi;
int pasta_conf_ns;
+ int no_copy_routes;
int no_tcp;
struct tcp_ctx tcp;
diff --git a/pasta.c b/pasta.c
index 9161a1f..120cc1e 100644
--- a/pasta.c
+++ b/pasta.c
@@ -268,12 +268,14 @@ void pasta_ns_conf(struct ctx *c)
nl_link(1, 1 /* lo */, MAC_ZERO, 1, 0);
if (c->pasta_conf_ns) {
+ enum nl_op op_routes = c->no_copy_routes ? NL_SET : NL_DUP;
+
nl_link(1, c->pasta_ifi, c->mac_guest, 1, c->mtu);
if (c->ifi4) {
nl_addr(1, c->pasta_ifi, AF_INET, &c->ip4.addr,
&c->ip4.prefix_len, NULL);
- nl_route(NL_SET, c->ifi4, c->pasta_ifi, AF_INET,
+ nl_route(op_routes, c->ifi4, c->pasta_ifi, AF_INET,
&c->ip4.gw);
}
@@ -281,7 +283,7 @@ void pasta_ns_conf(struct ctx *c)
int prefix_len = 64;
nl_addr(1, c->pasta_ifi, AF_INET6, &c->ip6.addr,
&prefix_len, NULL);
- nl_route(NL_SET, c->ifi6, c->pasta_ifi, AF_INET6,
+ nl_route(op_routes, c->ifi6, c->pasta_ifi, AF_INET6,
&c->ip6.gw);
}
} else {
--
2.39.2