passt: Relicense to GPL 2.0, or any later version
In practical terms, passt doesn't benefit from the additional
protection offered by the AGPL over the GPL, because it's not
suitable to be executed over a computer network.
Further, restricting the distribution under the version 3 of the GPL
wouldn't provide any practical advantage either, as long as the passt
codebase is concerned, and might cause unnecessary compatibility
dilemmas.
Change licensing terms to the GNU General Public License Version 2,
or any later version, with written permission from all current and
past contributors, namely: myself, David Gibson, Laine Stump, Andrea
Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian
Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-04-05 20:11:44 +02:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-or-later
|
2021-10-19 12:43:28 +02:00
|
|
|
* Copyright (c) 2021 Red Hat GmbH
|
|
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
|
*/
|
|
|
|
|
|
2022-03-26 00:05:31 +01:00
|
|
|
#ifndef NETLINK_H
|
|
|
|
|
#define NETLINK_H
|
|
|
|
|
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
void nl_sock_init(const struct ctx *c, bool ns);
|
2022-07-22 07:31:13 +02:00
|
|
|
unsigned int nl_get_ext_if(sa_family_t af);
|
2023-08-03 09:19:42 +02:00
|
|
|
void nl_route_get_def(unsigned int ifi, sa_family_t af, void *gw);
|
|
|
|
|
void nl_route_set_def(unsigned int ifi, sa_family_t af, void *gw);
|
|
|
|
|
void nl_route_dup(unsigned int ifi, unsigned int ifi_ns, sa_family_t af);
|
2023-08-03 09:19:41 +02:00
|
|
|
void nl_addr_get(unsigned int ifi, sa_family_t af, void *addr,
|
|
|
|
|
int *prefix_len, void *addr_l);
|
|
|
|
|
void nl_addr_set(unsigned int ifi, sa_family_t af, void *addr, int prefix_len);
|
|
|
|
|
void nl_addr_dup(unsigned int ifi, unsigned int ifi_ns, sa_family_t af);
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
void nl_link_get_mac(int ns, unsigned int ifi, void *mac);
|
|
|
|
|
void nl_link_set_mac(int ns, unsigned int ifi, void *mac);
|
|
|
|
|
void nl_link_up(int ns, unsigned int ifi, int mtu);
|
2022-03-26 00:05:31 +01:00
|
|
|
|
|
|
|
|
#endif /* NETLINK_H */
|