passt: Relicense to GPL 2.0, or any later version
In practical terms, passt doesn't benefit from the additional
protection offered by the AGPL over the GPL, because it's not
suitable to be executed over a computer network.
Further, restricting the distribution under the version 3 of the GPL
wouldn't provide any practical advantage either, as long as the passt
codebase is concerned, and might cause unnecessary compatibility
dilemmas.
Change licensing terms to the GNU General Public License Version 2,
or any later version, with written permission from all current and
past contributors, namely: myself, David Gibson, Laine Stump, Andrea
Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian
Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-04-05 20:11:44 +02:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-or-later
|
2022-09-24 11:08:16 +02:00
|
|
|
* Copyright Red Hat
|
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
* Author: David Gibson <david@gibson.dropbear.id.au>
|
|
|
|
*/
|
|
|
|
|
2024-02-28 12:25:20 +01:00
|
|
|
#ifndef FWD_H
|
|
|
|
#define FWD_H
|
2022-09-24 11:08:16 +02:00
|
|
|
|
2024-07-18 07:26:43 +02:00
|
|
|
struct flowside;
|
|
|
|
|
2022-09-24 11:08:22 +02:00
|
|
|
/* Number of ports for both TCP and UDP */
|
|
|
|
#define NUM_PORTS (1U << 16)
|
|
|
|
|
fwd, conf: Probe host's ephemeral ports
When we forward "all" ports (-t all or -u all), or use an exclude-only
range, we don't actually forward *all* ports - that wouln't leave local
ports to use for outgoing connections. Rather we forward all non-ephemeral
ports - those that won't be used for outgoing connections or datagrams.
Currently we assume the range of ephemeral ports is that recommended by
RFC 6335, 49152-65535. However, that's not the range used by default on
Linux, 32768-60999 but configurable with the net.ipv4.ip_local_port_range
sysctl.
We can't really know what range the guest will consider ephemeral, but if
it differs too much from the host it's likely to cause problems we can't
avoid anyway. So, using the host's ephemeral range is a better guess than
using the RFC 6335 range.
Therefore, add logic to probe the host's ephemeral range, falling back to
the RFC 6335 range if that fails. This has the bonus advantage of
reducing the number of ports bound by -t all -u all on most Linux machines
thereby reducing kernel memory usage. Specifically this reduces kernel
memory usage with -t all -u all from ~380MiB to ~289MiB.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2024-08-29 11:58:47 +02:00
|
|
|
void fwd_probe_ephemeral(void);
|
2024-08-29 11:58:45 +02:00
|
|
|
bool fwd_port_is_ephemeral(in_port_t port);
|
|
|
|
|
2024-02-28 12:25:20 +01:00
|
|
|
enum fwd_ports_mode {
|
2024-05-13 16:57:57 +02:00
|
|
|
FWD_UNSET = 0,
|
2022-09-24 11:08:16 +02:00
|
|
|
FWD_SPEC = 1,
|
|
|
|
FWD_NONE,
|
|
|
|
FWD_AUTO,
|
|
|
|
FWD_ALL,
|
|
|
|
};
|
|
|
|
|
2022-09-24 11:08:22 +02:00
|
|
|
#define PORT_BITMAP_SIZE DIV_ROUND_UP(NUM_PORTS, 8)
|
2022-09-24 11:08:16 +02:00
|
|
|
|
2022-09-24 11:08:17 +02:00
|
|
|
/**
|
2024-02-28 12:25:20 +01:00
|
|
|
* fwd_ports - Describes port forwarding for one protocol and direction
|
2022-09-24 11:08:17 +02:00
|
|
|
* @mode: Overall forwarding mode (all, none, auto, specific ports)
|
2023-11-03 03:23:02 +01:00
|
|
|
* @scan4: /proc/net fd to scan for IPv4 ports when in AUTO mode
|
|
|
|
* @scan6: /proc/net fd to scan for IPv6 ports when in AUTO mode
|
2022-09-24 11:08:17 +02:00
|
|
|
* @map: Bitmap describing which ports are forwarded
|
|
|
|
* @delta: Offset between the original destination and mapped port number
|
|
|
|
*/
|
2024-02-28 12:25:20 +01:00
|
|
|
struct fwd_ports {
|
|
|
|
enum fwd_ports_mode mode;
|
2023-11-03 03:23:02 +01:00
|
|
|
int scan4;
|
|
|
|
int scan6;
|
2022-09-24 11:08:17 +02:00
|
|
|
uint8_t map[PORT_BITMAP_SIZE];
|
2022-09-24 11:08:22 +02:00
|
|
|
in_port_t delta[NUM_PORTS];
|
2022-09-24 11:08:17 +02:00
|
|
|
};
|
|
|
|
|
2024-02-28 12:25:20 +01:00
|
|
|
void fwd_scan_ports_tcp(struct fwd_ports *fwd, const struct fwd_ports *rev);
|
|
|
|
void fwd_scan_ports_udp(struct fwd_ports *fwd, const struct fwd_ports *rev,
|
|
|
|
const struct fwd_ports *tcp_fwd,
|
|
|
|
const struct fwd_ports *tcp_rev);
|
|
|
|
void fwd_scan_ports_init(struct ctx *c);
|
2023-11-03 03:22:56 +01:00
|
|
|
|
2024-07-18 07:26:43 +02:00
|
|
|
uint8_t fwd_nat_from_tap(const struct ctx *c, uint8_t proto,
|
|
|
|
const struct flowside *ini, struct flowside *tgt);
|
|
|
|
uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto,
|
|
|
|
const struct flowside *ini, struct flowside *tgt);
|
|
|
|
uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
|
|
|
|
const struct flowside *ini, struct flowside *tgt);
|
|
|
|
|
2024-02-28 12:25:20 +01:00
|
|
|
#endif /* FWD_H */
|