On Fri, Mar 15, 2024 at 05:13:26PM +0100, Stefano Brivio wrote:

There might be isolated testing environments where default routes and global connectivity are not needed, a single interface has all non-loopback addresses and routes, and still passt and pasta are expected to work.

In this case, it's pretty obvious what our upstream interface should be, so go ahead and select the only interface with at least one route, disabling DHCP and implying --no-map-gw as the documentation already states.

If there are multiple interfaces with routes, though, refuse to start, because at that point it's really not clear what we should do.

Reported-by: Martin Pitt Link: https://github.com/containers/podman/issues/21896 Signed-off-by: Stefano brivio

It's an ugly hack, but a useful one, so Reviewed-by: David Gibson

--- v2: Initialise rtnh in nl_get_ext_if() before using it...

conf.c | 4 ++-- netlink.c | 31 ++++++++++++++++++++++++++++--- passt.1 | 45 +++++++++++++++++++++++++++++---------------- 3 files changed, 59 insertions(+), 21 deletions(-)

diff --git a/conf.c b/conf.c index ac9fb34..644752c 100644 --- a/conf.c +++ b/conf.c @@ -584,7 +584,7 @@ static unsigned int conf_ip4(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET);

if (!ifi) { - info("No interface with a default route for IPv4: disabling IPv4"); + info("No interface with a route for IPv4: disabling IPv4"); return 0; }

@@ -656,7 +656,7 @@ static unsigned int conf_ip6(unsigned int ifi, ifi = nl_get_ext_if(nl_sock, AF_INET6);

if (!ifi) { - info("No interface with a default route for IPv6: disabling IPv6"); + info("No interface with a route for IPv6: disabling IPv6"); return 0; }

diff --git a/netlink.c b/netlink.c index 20de9b3..f93f377 100644 --- a/netlink.c +++ b/netlink.c @@ -254,6 +254,7 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) .rtm.rtm_type = RTN_UNICAST, .rtm.rtm_family = af, }; + bool default_only = true; unsigned int ifi = 0; struct nlmsghdr *nh; struct rtattr *rta; @@ -262,21 +263,40 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) uint32_t seq; size_t na;

+again: + /* Look for an interface with a default route first, failing that, look + * for any interface with a route, and pick it only if it's the only + * interface with a route. + */ seq = nl_send(s, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWROUTE) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh);

- if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af) - continue; + if (default_only) { + if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af) + continue; + } else { + if (rtm->rtm_family != af) + continue; + }

for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { if (rta->rta_type == RTA_OIF) { + if (!default_only && ifi && + ifi != *(unsigned int *)RTA_DATA(rta)) + return 0; + ifi = *(unsigned int *)RTA_DATA(rta); } else if (rta->rta_type == RTA_MULTIPATH) { const struct rtnexthop *rtnh;

rtnh = (struct rtnexthop *)RTA_DATA(rta); + + if (!default_only && ifi && + (int)ifi != rtnh->rtnh_ifindex) + return 0; + ifi = rtnh->rtnh_ifindex; } } @@ -285,6 +305,11 @@ unsigned int nl_get_ext_if(int s, sa_family_t af) if (status < 0) warn("netlink: RTM_GETROUTE failed: %s", strerror(-status));

+ if (!ifi && default_only) { + default_only = false; + goto again; + } + return ifi; }

@@ -332,7 +357,7 @@ bool nl_route_get_def_multipath(struct rtattr *rta, void *gw) * @af: Address family * @gw: Default gateway to fill on NL_GET * - * Return: 0 on success, negative error code on failure + * Return: error on netlink failure, or 0 (gw unset if default route not found) */ int nl_route_get_def(int s, unsigned int ifi, sa_family_t af, void *gw) { diff --git a/passt.1 b/passt.1 index 9c492f5..3a23a43 100644 --- a/passt.1 +++ b/passt.1 @@ -148,7 +148,9 @@ for an IPv6 \fIaddr\fR. This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces -with the first default route for the corresponding IP version. +with the first default route, if any, for the corresponding IP version. If no +default routes are available and there is just one interface with any route, +that interface will be chosen instead.

.TP .BR \-n ", " \-\-netmask " " \fImask @@ -172,9 +174,11 @@ Assign IPv4 \fIaddr\fR as default gateway via DHCP (option 3), or IPv6 This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, IPv4 and IPv6 gateways are taken from the host interface with the -first default route for the corresponding IP version. If the default route is a -multipath one, the gateway is the first nexthop router returned by the kernel -which has the highest weight in the set of paths. +first default route, if any, for the corresponding IP version. If the default +route is a multipath one, the gateway is the first nexthop router returned by +the kernel which has the highest weight in the set of paths. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead.

Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -185,9 +189,11 @@ to allow mapping of local traffic to guest and target namespace. See the .BR \-i ", " \-\-interface " " \fIname Use host interface \fIname\fR to derive addresses and routes. Default is to use the interfaces specified by \fB--outbound-if4\fR and -\fB--outbound-if6\fR, for IPv4 and IPv6 addresses and routes, respectively. If -no interfaces are given, the interface with the first default routes for each IP -version is selected. +\fB--outbound-if6\fR, for IPv4 and IPv6 addresses and routes, respectively. + +If no interfaces are given, the interface with the first default routes for each +IP version is selected. If no default routes are available and there is just one +interface with any route, that interface will be chosen instead.

.TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -203,14 +209,20 @@ By default, the source address is selected by the routing tables. Bind IPv4 outbound sockets to host interface \fIname\fR, and, unless another interface is specified via \fB-i\fR, \fB--interface\fR, use this interface to derive IPv4 addresses and routes. -By default, the interface given by the default route is selected. + +By default, the interface given by the default route is selected. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead.

.TP .BR \-\-outbound-if6 " " \fIname Bind IPv6 outbound sockets to host interface \fIname\fR, and, unless another interface is specified via \fB-i\fR, \fB--interface\fR, use this interface to derive IPv6 addresses and routes. -By default, the interface given by the default route is selected. + +By default, the interface given by the default route is selected. If no default +routes are available and there is just one interface with any route, that +interface will be chosen instead.

.TP .BR \-D ", " \-\-dns " " \fIaddr @@ -305,19 +317,20 @@ namespace will be ignored. .BR \-\-no-map-gw Don't remap TCP connections and untracked UDP traffic, with the gateway address as destination, to the host. Implied if there is no gateway on the selected -default route for any of the enabled address families. +default route, or if there is no default route, for any of the enabled address +families.

.TP .BR \-4 ", " \-\-ipv4-only Enable IPv4-only operation. IPv6 traffic will be ignored. -By default, IPv6 operation is enabled as long as at least an IPv6 default route -and an interface address are configured on a given host interface. +By default, IPv6 operation is enabled as long as at least an IPv6 route and an +interface address are configured on a given host interface.

.TP .BR \-6 ", " \-\-ipv6-only Enable IPv6-only operation. IPv4 traffic will be ignored. -By default, IPv4 operation is enabled as long as at least an IPv4 default route -and an interface address are configured on a given host interface. +By default, IPv4 operation is enabled as long as at least an IPv4 route and an +interface address are configured on a given host interface.

.SS \fBpasst\fR-only options

@@ -817,8 +830,8 @@ local addresses, and it would also be impossible for guest or target namespace to route answers back.

For convenience, and somewhat arbitrarily, the source address on these packets -is translated to the address of the default IPv4 or IPv6 gateway -- this is -known to be an existing, valid address on the same subnet. +is translated to the address of the default IPv4 or IPv6 gateway (if any) -- +this is known to be an existing, valid address on the same subnet.

Loopback destination addresses are instead translated to the observed external address of the guest or target namespace. For IPv6 packets, if usage of a

-- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson