This makes several tweaks to improve the logic which decides whether we're
able to use the splice method for a new connection.
* Rather than only calling tcp_splice_conn_from_sock() in pasta mode, we
check for pasta mode within it, better localising the checks.
* Previously if we got a connection from a non-loopback address we'd
always fall back to the "tap" path, even if the connection was on a
socket in the namespace. If we did get a non-loopback address on a
namespace socket, something has gone wrong and the "tap" path certainly
won't be able to handle it. Report the error and close, rather than
passing it along to tap.
Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
inany.c | 1 -
tcp.c | 3 +--
tcp_splice.c | 48 ++++++++++++++++++++++++++++++++++--------------
3 files changed, 35 insertions(+), 17 deletions(-)
diff --git a/inany.c b/inany.c
index c11e2aa9..1c165b14 100644
--- a/inany.c
+++ b/inany.c
@@ -39,7 +39,6 @@ const union inany_addr inany_any4 = {
*
* Return: On success, a non-null pointer to @dst, NULL on failure
*/
-/* cppcheck-suppress unusedFunction */
const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size)
{
const struct in_addr *v4 = inany_v4(src);
diff --git a/tcp.c b/tcp.c
index c06d1cc4..d61fb17b 100644
--- a/tcp.c
+++ b/tcp.c
@@ -2733,8 +2733,7 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref,
if (s < 0)
goto cancel;
- if (c->mode == MODE_PASTA &&
- tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa))
+ if (tcp_splice_conn_from_sock(c, ref.tcp_listen, flow, s, &sa))
return;
tcp_tap_conn_from_sock(c, ref.tcp_listen, flow, s, &sa, now);
diff --git a/tcp_splice.c b/tcp_splice.c
index 49075e5c..1937850f 100644
--- a/tcp_splice.c
+++ b/tcp_splice.c
@@ -405,14 +405,44 @@ bool tcp_splice_conn_from_sock(const struct ctx *c,
sa_family_t af;
uint8_t pif1;
- ASSERT(c->mode == MODE_PASTA);
-
- inany_from_sockaddr(&src, &srcport, sa);
- if (!inany_is_loopback(&src))
+ if (c->mode != MODE_PASTA)
return false;
+ inany_from_sockaddr(&src, &srcport, sa);
af = inany_v4(&src) ? AF_INET : AF_INET6;
+ switch (ref.pif) {
+ case PIF_SPLICE:
+ if (!inany_is_loopback(&src)) {
+ char str[INANY_ADDRSTRLEN];
+
+ /* We can't use flow_err() etc. because we haven't set
+ * the flow type yet
+ */
+ warn("Bad source address %s for splice, closing",
+ inany_ntop(&src, str, sizeof(str)));
+
+ /* We *don't* want to fall back to tap */
+ flow_alloc_cancel(flow);
+ return true;
+ }
+
+ pif1 = PIF_HOST;
+ dstport += c->tcp.fwd_out.delta[dstport];
+ break;
+
+ case PIF_HOST:
+ if (!inany_is_loopback(&src))
+ return false;
+
+ pif1 = PIF_SPLICE;
+ dstport += c->tcp.fwd_in.delta[dstport];
+ break;
+
+ default:
+ return false;
+ }
+
conn = FLOW_START(flow, FLOW_TCP_SPLICE, tcp_splice, 0);
conn->flags = af == AF_INET ? 0 : SPLICE_V6;
@@ -424,16 +454,6 @@ bool tcp_splice_conn_from_sock(const struct ctx *c,
if (setsockopt(s0, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int)))
flow_trace(conn, "failed to set TCP_QUICKACK on %i", s0);
- if (ref.pif == PIF_SPLICE) {
- pif1 = PIF_HOST;
- dstport += c->tcp.fwd_out.delta[dstport];
- } else {
- ASSERT(ref.pif == PIF_HOST);
-
- pif1 = PIF_SPLICE;
- dstport += c->tcp.fwd_in.delta[dstport];
- }
-
if (tcp_splice_connect(c, conn, af, pif1, dstport))
conn_flag(c, conn, CLOSING);
--
2.43.0