When pasta starts without an active template interface (e.g., WiFi
not yet connected), it falls back to local mode. This change adds
support for late binding: when the template interface gets an address
or a default route later, pasta detects this via a host-side netlink
socket and propagates the configuration to the namespace.
Late binding occurs when:
- A specific interface is given via -I and later gets an address/route.
- No interface is specified, and any interface gets an address/route.
In the latter case the first discovered interface is adopted as
template.
In this commit we add a host-side netlink socket to monitor link,
address, and route changes on the template interface. We add a
corresponding nl_linkaddr_host_handler() function to process such
events and propagate the changes to the namespace.
Signed-off-by: Jon Maloy
---
epoll_type.h | 2 +
isolation.c | 5 +
netlink.c | 397 ++++++++++++++++++++++++++++++++++++++++++++++++++-
netlink.h | 3 +
passt.c | 5 +
5 files changed, 407 insertions(+), 5 deletions(-)
diff --git a/epoll_type.h b/epoll_type.h
index a90ffb6..cd17a64 100644
--- a/epoll_type.h
+++ b/epoll_type.h
@@ -46,6 +46,8 @@ enum epoll_type {
EPOLL_TYPE_REPAIR,
/* Netlink neighbour subscription socket */
EPOLL_TYPE_NL_NEIGH,
+ /* Netlink link/address subscription socket for late binding */
+ EPOLL_TYPE_NL_LINKADDR_HOST,
EPOLL_NUM_TYPES,
};
diff --git a/isolation.c b/isolation.c
index b25f349..8087563 100644
--- a/isolation.c
+++ b/isolation.c
@@ -356,6 +356,11 @@ int isolate_prefork(const struct ctx *c)
if (c->mode == MODE_PASTA) {
/* Keep CAP_SYS_ADMIN, so we can enter the netns */
ns_caps |= BIT(CAP_SYS_ADMIN);
+ /* Keep CAP_NET_ADMIN for dynamic interface configuration,
+ * so we can propagate addresses and routes when template
+ * interface comes up after start
+ */
+ ns_caps |= BIT(CAP_NET_ADMIN);
/* Keep CAP_NET_BIND_SERVICE, so we can splice
* outbound connections to low port numbers
*/
diff --git a/netlink.c b/netlink.c
index 769cb23..a1790a4 100644
--- a/netlink.c
+++ b/netlink.c
@@ -37,6 +37,14 @@
#include "ip.h"
#include "netlink.h"
#include "epoll_ctl.h"
+#include "conf.h"
+#include "arp.h"
+#include "ndp.h"
+#include "tap.h"
+#include "fwd.h"
+
+/* Default namespace interface name */
+extern const char *pasta_default_ifn;
/* Same as RTA_NEXT() but for nexthops: RTNH_NEXT() doesn't take 'attrlen' */
#define RTNH_NEXT_AND_DEC(rtnh, attrlen) \
@@ -56,10 +64,14 @@
#define NLBUFSIZ 65536
/* Socket in init, in target namespace, sequence (just needs to be monotonic) */
-int nl_sock = -1;
-int nl_sock_ns = -1;
-static int nl_sock_neigh = -1;
-static int nl_seq = 1;
+int nl_sock = -1;
+int nl_sock_ns = -1;
+static int nl_sock_neigh = -1;
+static int nl_sock_linkaddr_host = -1;
+static int nl_seq = 1;
+
+static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
+ const void *addr, int prefix_len);
/**
* nl_sock_init_do() - Set up netlink sockets in init or target namespace
@@ -91,6 +103,329 @@ static int nl_sock_init_do(void *arg)
return 0;
}
+/**
+ * nl_linkaddr_host_msg_read() - Handle host-side link/addr/route changes
+ * @c: Execution context
+ * @nh: Netlink message header
+ *
+ * Monitor template interface changes and propagate to namespace.
+ * Supports late binding: if no template was detected at startup,
+ * adopt the interface specified by -I when it gets an address.
+ */
+static void nl_linkaddr_host_msg_read(struct ctx *c, const struct nlmsghdr *nh)
+{
+ if (nh->nlmsg_type == NLMSG_DONE || nh->nlmsg_type == NLMSG_ERROR)
+ return;
+
+ if (nh->nlmsg_type == RTM_NEWADDR || nh->nlmsg_type == RTM_DELADDR) {
+ bool is_new = (nh->nlmsg_type == RTM_NEWADDR);
+ const struct ifaddrmsg *ifa = NLMSG_DATA(nh);
+ char buf[INET6_ADDRSTRLEN];
+ unsigned int template_ifi;
+ union inany_addr inany;
+ char ifname[IFNAMSIZ];
+ struct rtattr *rta;
+ void *addr = NULL;
+ bool is_default;
+ sa_family_t af;
+ int prefix_len;
+ bool is_match;
+ bool unbound;
+ size_t na;
+ int rc;
+
+ if (!if_indextoname(ifa->ifa_index, ifname))
+ snprintf(ifname, sizeof(ifname), "?");
+
+ /* Get template interface index */
+ if (ifa->ifa_family == AF_INET)
+ template_ifi = c->ifi4;
+ else if (ifa->ifa_family == AF_INET6)
+ template_ifi = c->ifi6;
+ else
+ return;
+
+ /* Check for late binding conditions */
+ is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
+ is_match = !strcmp(ifname, c->pasta_ifn);
+ unbound = (ifa->ifa_family == AF_INET) ?
+ c->ifi4 <= 0 : c->ifi6 <= 0;
+
+ if (unbound && (is_default || is_match)) {
+ debug("Late binding: using %s as %s template", ifname,
+ ifa->ifa_family == AF_INET ? "IPv4" : "IPv6");
+
+ if (ifa->ifa_family == AF_INET) {
+ c->ifi4 = ifa->ifa_index;
+ template_ifi = c->ifi4;
+ } else {
+ c->ifi6 = ifa->ifa_index;
+ template_ifi = c->ifi6;
+ }
+
+ if (is_default)
+ snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
+ "%s", ifname);
+ }
+
+ if (ifa->ifa_index != template_ifi)
+ return;
+
+ rta = IFA_RTA(ifa);
+ na = IFA_PAYLOAD(nh);
+
+ for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
+ if (ifa->ifa_family == AF_INET &&
+ rta->rta_type == IFA_LOCAL) {
+ addr = RTA_DATA(rta);
+ break;
+ } else if (ifa->ifa_family == AF_INET6 &&
+ rta->rta_type == IFA_ADDRESS) {
+ addr = RTA_DATA(rta);
+ break;
+ }
+ }
+
+ if (!addr) {
+ info("No addr found in netlink linkaddr message");
+ return;
+ }
+
+ af = ifa->ifa_family;
+ inany_from_af(&inany, af, addr);
+ inet_ntop(af, addr, buf, sizeof(buf));
+
+ /* IPv4 prefix stored as IPv4-mapped, so add 96 bits */
+ prefix_len = ifa->ifa_prefixlen + (af == AF_INET ? 96 : 0);
+
+ if (!is_new) {
+ fwd_remove_addr(c, &inany);
+ nl_addr_del(nl_sock_ns, c->pasta_ifi,
+ af, addr, ifa->ifa_prefixlen);
+ return;
+ }
+
+ rc = nl_addr_set(nl_sock_ns, c->pasta_ifi,
+ af, addr, ifa->ifa_prefixlen);
+ if (rc < 0) {
+ debug("Failed to add %s/%u to ns: %s",
+ buf, ifa->ifa_prefixlen, strerror_(-rc));
+ } else {
+ fwd_set_addr(c, &inany,
+ CONF_ADDR_HOST | CONF_ADDR_OBSERVED,
+ prefix_len);
+ debug("Added %s/%u to namespace",
+ buf, ifa->ifa_prefixlen);
+ }
+ return;
+ }
+
+ if (nh->nlmsg_type == RTM_NEWROUTE || nh->nlmsg_type == RTM_DELROUTE) {
+ bool is_new = (nh->nlmsg_type == RTM_NEWROUTE);
+ const struct rtmsg *rtm = NLMSG_DATA(nh);
+ struct rtattr *rta = RTM_RTA(rtm);
+ size_t na = RTM_PAYLOAD(nh);
+ unsigned int template_ifi;
+ char ifname[IFNAMSIZ];
+ unsigned int oif = 0;
+ void *gw = NULL;
+ bool is_default;
+ bool is_match;
+ bool unbound;
+
+ /* We are only interested in default routes */
+ if (rtm->rtm_dst_len != 0)
+ return;
+
+ for (; RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) {
+ if (rta->rta_type == RTA_GATEWAY)
+ gw = RTA_DATA(rta);
+ else if (rta->rta_type == RTA_OIF)
+ oif = *(unsigned int *)RTA_DATA(rta);
+ }
+
+ if (!gw || !oif)
+ return;
+
+ /* Get interface name for late binding check */
+ if (!if_indextoname(oif, ifname))
+ return;
+
+ /* Check for late binding conditions */
+ is_default = !strcmp(c->pasta_ifn, pasta_default_ifn);
+ is_match = !strcmp(ifname, c->pasta_ifn);
+
+ if (rtm->rtm_family == AF_INET)
+ template_ifi = c->ifi4;
+ else if (rtm->rtm_family == AF_INET6)
+ template_ifi = c->ifi6;
+ else
+ return;
+
+ unbound = (rtm->rtm_family == AF_INET) ?
+ c->ifi4 <= 0 : c->ifi6 <= 0;
+
+ if (unbound && (is_default || is_match)) {
+ debug("Late binding (route): using %s as %s template",
+ ifname,
+ rtm->rtm_family == AF_INET ? "IPv4" : "IPv6");
+
+ if (rtm->rtm_family == AF_INET) {
+ c->ifi4 = oif;
+ template_ifi = c->ifi4;
+ } else {
+ c->ifi6 = oif;
+ template_ifi = c->ifi6;
+ }
+
+ if (is_default)
+ snprintf(c->pasta_ifn, sizeof(c->pasta_ifn),
+ "%s", ifname);
+ }
+
+ if (oif != template_ifi)
+ return;
+
+ if (rtm->rtm_family == AF_INET) {
+ char buf[INET_ADDRSTRLEN];
+
+ if (!is_new) {
+ c->ip4.guest_gw = (struct in_addr){ 0 };
+ c->ip4.our_tap_addr = (struct in_addr){ 0 };
+ return;
+ }
+ c->ip4.guest_gw = *(struct in_addr *)gw;
+ c->ip4.our_tap_addr = c->ip4.guest_gw;
+ nl_route_set_def(nl_sock_ns, c->pasta_ifi, AF_INET, gw);
+ inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf));
+ debug("Set IPv4 default route via %s", buf);
+ } else if (rtm->rtm_family == AF_INET6) {
+ char buf[INET6_ADDRSTRLEN];
+
+ if (!is_new) {
+ c->ip6.guest_gw = (struct in6_addr){ 0 };
+ return;
+ }
+ c->ip6.guest_gw = *(struct in6_addr *)gw;
+ nl_route_set_def(nl_sock_ns, c->pasta_ifi,
+ AF_INET6, gw);
+ inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf));
+ debug("Set IPv6 default route via %s", buf);
+ }
+ }
+}
+
+/**
+ * nl_linkaddr_host_handler() - Handle events from host link/addr notifier
+ * @c: Execution context
+ *
+ * Monitor template interface changes and propagate to namespace
+ */
+void nl_linkaddr_host_handler(struct ctx *c)
+{
+ char buf[NLBUFSIZ];
+
+ for (;;) {
+ ssize_t n = recv(nl_sock_linkaddr_host, buf, sizeof(buf),
+ MSG_DONTWAIT);
+ struct nlmsghdr *nh = (struct nlmsghdr *)buf;
+
+ if (n < 0) {
+ if (errno == EINTR)
+ continue;
+ if (errno != EAGAIN)
+ info("Host recv() error: %s", strerror_(errno));
+ break;
+ }
+
+ info("Host netlink: received %zd bytes", n);
+
+ for (; NLMSG_OK(nh, n); nh = NLMSG_NEXT(nh, n))
+ nl_linkaddr_host_msg_read(c, nh);
+ }
+}
+
+/**
+ * nl_linkaddr_host_init_do() - Create host-side link/addr notifier socket
+ * @arg: Unused
+ *
+ * Return: 0 on success, -1 on failure
+ */
+static int nl_linkaddr_host_init_do(void *arg)
+{
+ struct sockaddr_nl addr = {
+ .nl_family = AF_NETLINK,
+ .nl_groups = RTMGRP_LINK |
+ RTMGRP_IPV4_IFADDR | RTMGRP_IPV6_IFADDR |
+ RTMGRP_IPV4_ROUTE | RTMGRP_IPV6_ROUTE,
+ };
+
+ (void)arg;
+
+ nl_sock_linkaddr_host = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC,
+ NETLINK_ROUTE);
+ if (nl_sock_linkaddr_host < 0) {
+ debug("socket() failed for host: %s", strerror_(errno));
+ return -1;
+ }
+
+ if (bind(nl_sock_linkaddr_host, (struct sockaddr *)&addr,
+ sizeof(addr)) < 0) {
+ debug("bind() failed for host: %s", strerror_(errno));
+ close(nl_sock_linkaddr_host);
+ nl_sock_linkaddr_host = -1;
+ return -1;
+ }
+
+ debug("host socket fd=%d", nl_sock_linkaddr_host);
+ return 0;
+}
+
+/**
+ * nl_linkaddr_notify_init() - Initialize host link/address change notifier
+ * @c: Execution context
+ *
+ * In PASTA mode, create a host-side netlink socket to monitor template
+ * interface changes and propagate them to the namespace (late binding).
+ *
+ * Return: 0 on success, -1 on failure
+ */
+int nl_linkaddr_notify_init(const struct ctx *c)
+{
+ union epoll_ref ref = { .type = EPOLL_TYPE_NL_LINKADDR_HOST };
+ struct epoll_event ev = { .events = EPOLLIN };
+
+ if (c->mode != MODE_PASTA)
+ return 0;
+
+ if (nl_sock_linkaddr_host >= 0) {
+ debug("host notifier already initialized (fd=%d)",
+ nl_sock_linkaddr_host);
+ return 0;
+ }
+
+ nl_linkaddr_host_init_do(NULL);
+
+ if (nl_sock_linkaddr_host < 0) {
+ warn("Failed to create host link/addr notifier socket");
+ return -1;
+ }
+
+ ev.data.u64 = ref.u64;
+ if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD,
+ nl_sock_linkaddr_host, &ev) == -1) {
+ warn("epoll_ctl() failed on host notifier: %s",
+ strerror_(errno));
+ close(nl_sock_linkaddr_host);
+ nl_sock_linkaddr_host = -1;
+ return -1;
+ }
+
+ info("Host netlink socket fd=%d, pasta_ifn=%s",
+ nl_sock_linkaddr_host, c->pasta_ifn);
+
+ return 0;
+}
/**
* nl_sock_init() - Call nl_sock_init_do(), won't return on failure
* @c: Execution context
@@ -516,7 +851,7 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw)
req.set.r4.rta_gw.rta_len = rta_len;
}
- return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len);
+ return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_REPLACE, len);
}
/**
@@ -927,6 +1262,58 @@ int nl_addr_set(int s, unsigned int ifi, sa_family_t af,
return nl_do(s, &req, RTM_NEWADDR, NLM_F_CREATE | NLM_F_EXCL, len);
}
+/**
+ * nl_addr_del() - Delete IP address from given interface
+ * @s: Netlink socket
+ * @ifi: Interface index
+ * @af: Address family
+ * @addr: Address to delete
+ * @prefix_len: Prefix length
+ *
+ * Return: 0 on success, negative error code on failure
+ */
+static int nl_addr_del(int s, unsigned int ifi, sa_family_t af,
+ const void *addr, int prefix_len)
+{
+ struct req_t {
+ struct nlmsghdr nlh;
+ struct ifaddrmsg ifa;
+ union {
+ struct {
+ struct rtattr rta_l;
+ struct in_addr l;
+ } a4;
+ struct {
+ struct rtattr rta_l;
+ struct in6_addr l;
+ } a6;
+ } del;
+ } req = {
+ .ifa.ifa_family = af,
+ .ifa.ifa_index = ifi,
+ .ifa.ifa_prefixlen = prefix_len,
+ };
+ ssize_t len;
+
+ if (af == AF_INET6) {
+ size_t rta_len = RTA_LENGTH(sizeof(req.del.a6.l));
+
+ len = offsetof(struct req_t, del.a6) + sizeof(req.del.a6);
+ memcpy(&req.del.a6.l, addr, sizeof(req.del.a6.l));
+ req.del.a6.rta_l.rta_len = rta_len;
+ req.del.a6.rta_l.rta_type = IFA_LOCAL;
+ } else {
+ size_t rta_len = RTA_LENGTH(sizeof(req.del.a4.l));
+
+ len = offsetof(struct req_t, del.a4) + sizeof(req.del.a4);
+ memcpy(&req.del.a4.l, addr, sizeof(req.del.a4.l));
+ req.del.a4.rta_l.rta_len = rta_len;
+ req.del.a4.rta_l.rta_type = IFA_LOCAL;
+ }
+
+ return nl_do(s, &req, RTM_DELADDR, 0, len);
+}
+
/**
* nl_addr_dup() - Copy IP addresses for given interface and address family
* @s_src: Netlink socket in source network namespace
diff --git a/netlink.h b/netlink.h
index 8f1e9b9..c19d3a3 100644
--- a/netlink.h
+++ b/netlink.h
@@ -33,4 +33,7 @@ int nl_link_set_flags(int s, unsigned int ifi,
int nl_neigh_notify_init(const struct ctx *c);
void nl_neigh_notify_handler(const struct ctx *c);
+int nl_linkaddr_notify_init(const struct ctx *c);
+void nl_linkaddr_host_handler(struct ctx *c);
+
#endif /* NETLINK_H */
diff --git a/passt.c b/passt.c
index 7488a84..64163df 100644
--- a/passt.c
+++ b/passt.c
@@ -80,6 +80,7 @@ char *epoll_type_str[] = {
[EPOLL_TYPE_REPAIR_LISTEN] = "TCP_REPAIR helper listening socket",
[EPOLL_TYPE_REPAIR] = "TCP_REPAIR helper socket",
[EPOLL_TYPE_NL_NEIGH] = "netlink neighbour notifier socket",
+ [EPOLL_TYPE_NL_LINKADDR_HOST] = "host link/address notifier socket",
};
static_assert(ARRAY_SIZE(epoll_type_str) == EPOLL_NUM_TYPES,
"epoll_type_str[] doesn't match enum epoll_type");
@@ -303,6 +304,9 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events)
case EPOLL_TYPE_NL_NEIGH:
nl_neigh_notify_handler(c);
break;
+ case EPOLL_TYPE_NL_LINKADDR_HOST:
+ nl_linkaddr_host_handler(c);
+ break;
default:
/* Can't happen */
ASSERT(0);
@@ -413,6 +417,7 @@ int main(int argc, char **argv)
fwd_neigh_table_init(&c);
nl_neigh_notify_init(&c);
+ nl_linkaddr_notify_init(&c);
if (!c.foreground) {
if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0)
--
2.52.0