passt: Relicense to GPL 2.0, or any later version
In practical terms, passt doesn't benefit from the additional
protection offered by the AGPL over the GPL, because it's not
suitable to be executed over a computer network.
Further, restricting the distribution under the version 3 of the GPL
wouldn't provide any practical advantage either, as long as the passt
codebase is concerned, and might cause unnecessary compatibility
dilemmas.
Change licensing terms to the GNU General Public License Version 2,
or any later version, with written permission from all current and
past contributors, namely: myself, David Gibson, Laine Stump, Andrea
Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian
Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov.
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-04-05 20:11:44 +02:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
/* PASST - Plug A Simple Socket Transport
|
|
|
|
|
* for qemu/UNIX domain socket mode
|
|
|
|
|
*
|
|
|
|
|
* PASTA - Pack A Subtle Tap Abstraction
|
|
|
|
|
* for network namespace/tap device mode
|
|
|
|
|
*
|
|
|
|
|
* netlink.c - rtnetlink routines: interfaces, addresses, routes
|
|
|
|
|
*
|
|
|
|
|
* Copyright (c) 2020-2021 Red Hat GmbH
|
|
|
|
|
* Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <sched.h>
|
|
|
|
|
#include <string.h>
|
|
|
|
|
#include <stddef.h>
|
|
|
|
|
#include <errno.h>
|
|
|
|
|
#include <sys/types.h>
|
|
|
|
|
#include <limits.h>
|
2023-03-21 04:54:59 +01:00
|
|
|
#include <unistd.h>
|
2023-03-08 04:00:22 +01:00
|
|
|
#include <signal.h>
|
2021-10-11 12:01:31 +02:00
|
|
|
#include <stdlib.h>
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
#include <stdbool.h>
|
2021-10-11 12:01:31 +02:00
|
|
|
#include <stdint.h>
|
|
|
|
|
#include <arpa/inet.h>
|
|
|
|
|
#include <netinet/in.h>
|
2021-10-21 04:26:08 +02:00
|
|
|
#include <netinet/if_ether.h>
|
|
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
#include <linux/netlink.h>
|
|
|
|
|
#include <linux/rtnetlink.h>
|
|
|
|
|
|
|
|
|
|
#include "util.h"
|
|
|
|
|
#include "passt.h"
|
2022-09-24 09:53:15 +02:00
|
|
|
#include "log.h"
|
2021-10-11 12:01:31 +02:00
|
|
|
#include "netlink.h"
|
|
|
|
|
|
2023-08-03 09:19:50 +02:00
|
|
|
/* Netlink expects a buffer of at least 8kiB or the system page size,
|
|
|
|
|
* whichever is larger. 32kiB is recommended for more efficient.
|
|
|
|
|
* Since the largest page size on any remotely common Linux setup is
|
|
|
|
|
* 64kiB (ppc64), that should cover it.
|
|
|
|
|
*
|
|
|
|
|
* https://www.kernel.org/doc/html/next/userspace-api/netlink/intro.html#buffer-sizing
|
|
|
|
|
*/
|
|
|
|
|
#define NLBUFSIZ 65536
|
2023-03-08 03:43:25 +01:00
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
/* Socket in init, in target namespace, sequence (just needs to be monotonic) */
|
2023-08-03 09:19:44 +02:00
|
|
|
int nl_sock = -1;
|
|
|
|
|
int nl_sock_ns = -1;
|
2023-08-03 09:19:46 +02:00
|
|
|
static int nl_seq = 1;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
/**
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* nl_sock_init_do() - Set up netlink sockets in init or target namespace
|
|
|
|
|
* @arg: Execution context, if running from namespace, NULL otherwise
|
2021-10-11 12:01:31 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0
|
|
|
|
|
*/
|
2021-10-21 04:26:08 +02:00
|
|
|
static int nl_sock_init_do(void *arg)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct sockaddr_nl addr = { .nl_family = AF_NETLINK, };
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
int *s = arg ? &nl_sock_ns : &nl_sock;
|
2022-01-25 19:55:54 +01:00
|
|
|
#ifdef NETLINK_GET_STRICT_CHK
|
|
|
|
|
int y = 1;
|
|
|
|
|
#endif
|
2021-10-11 12:01:31 +02:00
|
|
|
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
if (arg)
|
|
|
|
|
ns_enter((struct ctx *)arg);
|
|
|
|
|
|
2023-02-07 16:10:46 +01:00
|
|
|
*s = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE);
|
|
|
|
|
if (*s < 0 || bind(*s, (struct sockaddr *)&addr, sizeof(addr))) {
|
2021-10-11 12:01:31 +02:00
|
|
|
*s = -1;
|
|
|
|
|
return 0;
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
}
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2022-01-25 19:55:54 +01:00
|
|
|
#ifdef NETLINK_GET_STRICT_CHK
|
2022-04-05 07:10:30 +02:00
|
|
|
if (setsockopt(*s, SOL_NETLINK, NETLINK_GET_STRICT_CHK, &y, sizeof(y)))
|
|
|
|
|
debug("netlink: cannot set NETLINK_GET_STRICT_CHK on %i", *s);
|
2022-01-25 19:55:54 +01:00
|
|
|
#endif
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
return 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* nl_sock_init() - Call nl_sock_init_do(), won't return on failure
|
2021-10-11 12:01:31 +02:00
|
|
|
* @c: Execution context
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
* @ns: Get socket in namespace, not in init
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
void nl_sock_init(const struct ctx *c, bool ns)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
if (ns) {
|
2021-10-21 04:26:08 +02:00
|
|
|
NS_CALL(nl_sock_init_do, c);
|
2021-10-11 12:01:31 +02:00
|
|
|
if (nl_sock_ns == -1)
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
goto fail;
|
2021-10-11 12:01:31 +02:00
|
|
|
} else {
|
2021-10-21 04:26:08 +02:00
|
|
|
nl_sock_init_do(NULL);
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (nl_sock == -1)
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
goto fail;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
conf: Bind inbound ports with CAP_NET_BIND_SERVICE before isolate_user()
Even if CAP_NET_BIND_SERVICE is granted, we'll lose the capability in
the target user namespace as we isolate the process, which means
we're unable to bind to low ports at that point.
Bind inbound ports, and only those, before isolate_user(). Keep the
handling of outbound ports (for pasta mode only) after the setup of
the namespace, because that's where we'll bind them.
To this end, initialise the netlink socket for the init namespace
before isolate_user() as well, as we actually need to know the
addresses of the upstream interface before binding ports, in case
they're not explicitly passed by the user.
As we now call nl_sock_init() twice, checking its return code from
conf() twice looks a bit heavy: make it exit(), instead, as we
can't do much if we don't have netlink sockets.
While at it:
- move the v4_only && v6_only options check just after the first
option processing loop, as this is more strictly related to
option parsing proper
- update the man page, explaining that CAP_NET_BIND_SERVICE is
*not* the preferred way to bind ports, because passt and pasta
can be abused to allow other processes to make effective usage
of it. Add a note about the recommended sysctl instead
- simplify nl_sock_init_do() now that it's called once for each
case
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2022-10-13 18:21:27 +02:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
fail:
|
2023-02-15 09:24:37 +01:00
|
|
|
die("Failed to get netlink socket");
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2023-08-03 09:19:51 +02:00
|
|
|
* nl_send() - Prepare and send netlink request
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2023-08-03 09:19:48 +02:00
|
|
|
* @req: Request (will fill netlink header)
|
|
|
|
|
* @type: Request type
|
|
|
|
|
* @flags: Extra request flags (NLM_F_REQUEST and NLM_F_ACK assumed)
|
2021-10-11 12:01:31 +02:00
|
|
|
* @len: Request length
|
|
|
|
|
*
|
2023-08-03 09:19:51 +02:00
|
|
|
* Return: sequence number of request on success, terminates on error
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
2023-08-03 09:19:51 +02:00
|
|
|
static uint16_t nl_send(int s, void *req, uint16_t type,
|
|
|
|
|
uint16_t flags, ssize_t len)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
2023-08-03 09:19:48 +02:00
|
|
|
struct nlmsghdr *nh;
|
2021-10-20 00:05:11 +02:00
|
|
|
ssize_t n;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:48 +02:00
|
|
|
nh = (struct nlmsghdr *)req;
|
|
|
|
|
nh->nlmsg_type = type;
|
|
|
|
|
nh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
|
|
|
|
|
nh->nlmsg_len = len;
|
|
|
|
|
nh->nlmsg_seq = nl_seq++;
|
|
|
|
|
nh->nlmsg_pid = 0;
|
|
|
|
|
|
2023-08-03 09:19:47 +02:00
|
|
|
n = send(s, req, len, 0);
|
|
|
|
|
if (n < 0)
|
|
|
|
|
die("netlink: Failed to send(): %s", strerror(errno));
|
|
|
|
|
else if (n < len)
|
|
|
|
|
die("netlink: Short send (%lu of %lu bytes)", n, len);
|
|
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
return nh->nlmsg_seq;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_status() - Check status given by a netlink response
|
|
|
|
|
* @nh: Netlink response header
|
|
|
|
|
* @n: Remaining space in response buffer from @nh
|
|
|
|
|
* @seq: Request sequence number we expect a response to
|
|
|
|
|
*
|
|
|
|
|
* Return: 0 if @nh indicated successful completion,
|
|
|
|
|
* < 0, negative error code if @nh indicated failure
|
|
|
|
|
* > 0 @n if there are more responses to request @seq
|
|
|
|
|
* terminates if sequence numbers are out of sync
|
|
|
|
|
*/
|
|
|
|
|
static int nl_status(const struct nlmsghdr *nh, ssize_t n, uint16_t seq)
|
|
|
|
|
{
|
|
|
|
|
ASSERT(NLMSG_OK(nh, n));
|
|
|
|
|
|
|
|
|
|
if (nh->nlmsg_seq != seq)
|
|
|
|
|
die("netlink: Unexpected sequence number (%hu != %hu)",
|
|
|
|
|
nh->nlmsg_seq, seq);
|
|
|
|
|
|
|
|
|
|
if (nh->nlmsg_type == NLMSG_DONE) {
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
if (nh->nlmsg_type == NLMSG_ERROR) {
|
|
|
|
|
struct nlmsgerr *errmsg = (struct nlmsgerr *)NLMSG_DATA(nh);
|
|
|
|
|
return errmsg->error;
|
|
|
|
|
}
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:47 +02:00
|
|
|
return n;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
/**
|
|
|
|
|
* nl_next() - Get next netlink response message, recv()ing if necessary
|
|
|
|
|
* @s: Netlink socket
|
|
|
|
|
* @buf: Buffer for responses (at least NLBUFSIZ long)
|
|
|
|
|
* @nh: Previous message, or NULL if there are none
|
|
|
|
|
* @n: Variable with remaining unread bytes in buffer (updated)
|
|
|
|
|
*
|
|
|
|
|
* Return: pointer to next unread netlink response message (may block)
|
|
|
|
|
*/
|
|
|
|
|
static struct nlmsghdr *nl_next(int s, char *buf, struct nlmsghdr *nh, ssize_t *n)
|
|
|
|
|
{
|
|
|
|
|
if (nh) {
|
|
|
|
|
nh = NLMSG_NEXT(nh, *n);
|
|
|
|
|
if (NLMSG_OK(nh, *n))
|
|
|
|
|
return nh;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
*n = recv(s, buf, NLBUFSIZ, 0);
|
|
|
|
|
if (*n < 0)
|
|
|
|
|
die("netlink: Failed to recv(): %s", strerror(errno));
|
|
|
|
|
|
|
|
|
|
nh = (struct nlmsghdr *)buf;
|
|
|
|
|
if (!NLMSG_OK(nh, *n))
|
|
|
|
|
die("netlink: Response datagram with no message");
|
|
|
|
|
|
|
|
|
|
return nh;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_foreach - 'for' type macro to step through netlink response messages
|
2023-08-03 09:19:52 +02:00
|
|
|
* nl_foreach_oftype - as above, but only messages of expected type
|
2023-08-03 09:19:51 +02:00
|
|
|
* @nh: Steps through each response header (struct nlmsghdr *)
|
|
|
|
|
* @status: When loop exits indicates if there was an error (ssize_t)
|
|
|
|
|
* @s: Netlink socket
|
|
|
|
|
* @buf: Buffer for responses (at least NLBUFSIZ long)
|
|
|
|
|
* @seq: Sequence number of request we're getting responses for
|
2023-08-03 09:19:52 +02:00
|
|
|
* @type: Type of netlink message to process
|
|
|
|
|
*/
|
2023-08-03 09:19:51 +02:00
|
|
|
#define nl_foreach(nh, status, s, buf, seq) \
|
|
|
|
|
for ((nh) = nl_next((s), (buf), NULL, &(status)); \
|
|
|
|
|
((status) = nl_status((nh), (status), (seq))) > 0; \
|
|
|
|
|
(nh) = nl_next((s), (buf), (nh), &(status)))
|
|
|
|
|
|
2023-08-03 09:19:52 +02:00
|
|
|
#define nl_foreach_oftype(nh, status, s, buf, seq, type) \
|
|
|
|
|
nl_foreach((nh), (status), (s), (buf), (seq)) \
|
|
|
|
|
if ((nh)->nlmsg_type != (type)) { \
|
|
|
|
|
warn("netlink: Unexpected message type"); \
|
|
|
|
|
} else
|
|
|
|
|
|
2023-08-03 09:19:49 +02:00
|
|
|
/**
|
|
|
|
|
* nl_do() - Send netlink "do" request, and wait for acknowledgement
|
|
|
|
|
* @s: Netlink socket
|
|
|
|
|
* @req: Request (will fill netlink header)
|
|
|
|
|
* @type: Request type
|
|
|
|
|
* @flags: Extra request flags (NLM_F_REQUEST and NLM_F_ACK assumed)
|
|
|
|
|
* @len: Request length
|
|
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on error
|
|
|
|
|
*/
|
|
|
|
|
static int nl_do(int s, void *req, uint16_t type, uint16_t flags, ssize_t len)
|
|
|
|
|
{
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
2023-08-03 09:19:49 +02:00
|
|
|
uint16_t seq;
|
|
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s, req, type, flags, len);
|
|
|
|
|
nl_foreach(nh, status, s, buf, seq)
|
|
|
|
|
warn("netlink: Unexpected response message");
|
2023-08-03 09:19:49 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
return status;
|
2023-08-03 09:19:49 +02:00
|
|
|
}
|
|
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
/**
|
2022-07-22 07:31:13 +02:00
|
|
|
* nl_get_ext_if() - Get interface index supporting IP version being probed
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2022-07-22 07:31:13 +02:00
|
|
|
* @af: Address family (AF_INET or AF_INET6) to look for connectivity
|
|
|
|
|
* for.
|
2021-10-11 12:01:31 +02:00
|
|
|
*
|
|
|
|
|
* Return: interface index, 0 if not found
|
|
|
|
|
*/
|
2023-08-03 09:19:44 +02:00
|
|
|
unsigned int nl_get_ext_if(int s, sa_family_t af)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct { struct nlmsghdr nlh; struct rtmsg rtm; } req = {
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
2022-07-22 07:31:13 +02:00
|
|
|
.rtm.rtm_family = af,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
2023-08-03 09:19:54 +02:00
|
|
|
unsigned int ifi = 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
struct rtattr *rta;
|
2023-03-08 03:43:25 +01:00
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
|
|
|
|
uint16_t seq;
|
2022-04-05 07:10:30 +02:00
|
|
|
size_t na;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req));
|
2023-08-03 09:19:52 +02:00
|
|
|
nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWROUTE) {
|
2022-09-28 06:33:19 +02:00
|
|
|
struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:54 +02:00
|
|
|
if (ifi || rtm->rtm_dst_len || rtm->rtm_family != af)
|
2021-10-11 12:01:31 +02:00
|
|
|
continue;
|
|
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (rta->rta_type != RTA_OIF)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
ifi = *(unsigned int *)RTA_DATA(rta);
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:55 +02:00
|
|
|
if (status < 0)
|
|
|
|
|
warn("netlink: RTM_GETROUTE failed: %s", strerror(-status));
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:54 +02:00
|
|
|
return ifi;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2023-08-03 09:19:42 +02:00
|
|
|
* nl_route_get_def() - Get default route for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2023-08-03 09:19:42 +02:00
|
|
|
* @ifi: Interface index
|
2021-10-11 12:01:31 +02:00
|
|
|
* @af: Address family
|
2023-08-03 09:19:42 +02:00
|
|
|
* @gw: Default gateway to fill on NL_GET
|
2023-08-03 09:19:55 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
2023-08-03 09:19:55 +02:00
|
|
|
int nl_route_get_def(int s, unsigned int ifi, sa_family_t af, void *gw)
|
2023-08-03 09:19:42 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct rtmsg rtm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned int ifi;
|
|
|
|
|
} req = {
|
|
|
|
|
.rtm.rtm_family = af,
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
|
|
|
|
|
|
|
|
|
.rta.rta_type = RTA_OIF,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(sizeof(unsigned int)),
|
|
|
|
|
.ifi = ifi,
|
|
|
|
|
};
|
|
|
|
|
struct nlmsghdr *nh;
|
2023-08-03 09:19:54 +02:00
|
|
|
bool found = false;
|
2023-08-03 09:19:42 +02:00
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
|
|
|
|
uint16_t seq;
|
2023-08-03 09:19:42 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req));
|
2023-08-03 09:19:52 +02:00
|
|
|
nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWROUTE) {
|
2023-08-03 09:19:42 +02:00
|
|
|
struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh);
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
size_t na;
|
|
|
|
|
|
2023-08-03 09:19:54 +02:00
|
|
|
if (found || rtm->rtm_dst_len)
|
2023-08-03 09:19:42 +02:00
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
|
|
|
|
if (rta->rta_type != RTA_GATEWAY)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
memcpy(gw, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
2023-08-03 09:19:54 +02:00
|
|
|
found = true;
|
2023-08-03 09:19:42 +02:00
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:55 +02:00
|
|
|
return status;
|
2023-08-03 09:19:42 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_route_set_def() - Set default route for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2023-08-03 09:19:42 +02:00
|
|
|
* @ifi: Interface index in target namespace
|
|
|
|
|
* @af: Address family
|
|
|
|
|
* @gw: Default gateway to set
|
2023-08-03 09:19:53 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2023-08-03 09:19:42 +02:00
|
|
|
*/
|
2023-08-03 09:19:53 +02:00
|
|
|
int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, void *gw)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct rtmsg rtm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned int ifi;
|
|
|
|
|
union {
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_dst;
|
|
|
|
|
struct in6_addr d;
|
|
|
|
|
struct rtattr rta_gw;
|
|
|
|
|
struct in6_addr a;
|
|
|
|
|
} r6;
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_dst;
|
2023-08-03 09:19:43 +02:00
|
|
|
struct in_addr d;
|
2021-10-11 12:01:31 +02:00
|
|
|
struct rtattr rta_gw;
|
2023-08-03 09:19:43 +02:00
|
|
|
struct in_addr a;
|
2021-10-11 12:01:31 +02:00
|
|
|
} r4;
|
2021-10-21 04:26:08 +02:00
|
|
|
} set;
|
2021-10-11 12:01:31 +02:00
|
|
|
} req = {
|
|
|
|
|
.rtm.rtm_family = af,
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
2023-08-03 09:19:42 +02:00
|
|
|
.rtm.rtm_protocol = RTPROT_BOOT,
|
2021-10-11 12:01:31 +02:00
|
|
|
|
|
|
|
|
.rta.rta_type = RTA_OIF,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(sizeof(unsigned int)),
|
2023-08-03 09:19:42 +02:00
|
|
|
.ifi = ifi,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
2023-08-03 09:19:48 +02:00
|
|
|
ssize_t len;
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
if (af == AF_INET6) {
|
|
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.r6.d));
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:48 +02:00
|
|
|
len = offsetof(struct req_t, set.r6) + sizeof(req.set.r6);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
req.set.r6.rta_dst.rta_type = RTA_DST;
|
|
|
|
|
req.set.r6.rta_dst.rta_len = rta_len;
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
memcpy(&req.set.r6.a, gw, sizeof(req.set.r6.a));
|
|
|
|
|
req.set.r6.rta_gw.rta_type = RTA_GATEWAY;
|
|
|
|
|
req.set.r6.rta_gw.rta_len = rta_len;
|
|
|
|
|
} else {
|
|
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.r4.d));
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:48 +02:00
|
|
|
len = offsetof(struct req_t, set.r4) + sizeof(req.set.r4);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
req.set.r4.rta_dst.rta_type = RTA_DST;
|
|
|
|
|
req.set.r4.rta_dst.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:43 +02:00
|
|
|
memcpy(&req.set.r4.a, gw, sizeof(req.set.r4.a));
|
2023-08-03 09:19:42 +02:00
|
|
|
req.set.r4.rta_gw.rta_type = RTA_GATEWAY;
|
|
|
|
|
req.set.r4.rta_gw.rta_len = rta_len;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
2023-08-03 09:19:53 +02:00
|
|
|
return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len);
|
2023-08-03 09:19:42 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_route_dup() - Copy routes for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s_src: Netlink socket in source namespace
|
|
|
|
|
* @ifi_src: Source interface index
|
|
|
|
|
* @s_dst: Netlink socket in destination namespace
|
|
|
|
|
* @ifi_dst: Interface index in destination namespace
|
2023-08-03 09:19:42 +02:00
|
|
|
* @af: Address family
|
2023-08-03 09:19:56 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2023-08-03 09:19:42 +02:00
|
|
|
*/
|
2023-08-03 09:19:56 +02:00
|
|
|
int nl_route_dup(int s_src, unsigned int ifi_src,
|
|
|
|
|
int s_dst, unsigned int ifi_dst, sa_family_t af)
|
2023-08-03 09:19:42 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct rtmsg rtm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned int ifi;
|
|
|
|
|
} req = {
|
|
|
|
|
.rtm.rtm_family = af,
|
|
|
|
|
.rtm.rtm_table = RT_TABLE_MAIN,
|
|
|
|
|
.rtm.rtm_scope = RT_SCOPE_UNIVERSE,
|
|
|
|
|
.rtm.rtm_type = RTN_UNICAST,
|
|
|
|
|
|
|
|
|
|
.rta.rta_type = RTA_OIF,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(sizeof(unsigned int)),
|
2023-08-03 09:19:44 +02:00
|
|
|
.ifi = ifi_src,
|
2023-08-03 09:19:42 +02:00
|
|
|
};
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t nlmsgs_size, status;
|
2023-08-03 09:19:42 +02:00
|
|
|
unsigned dup_routes = 0;
|
|
|
|
|
struct nlmsghdr *nh;
|
2023-08-03 09:19:45 +02:00
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
uint16_t seq;
|
2023-08-03 09:19:42 +02:00
|
|
|
unsigned i;
|
netlink: Add functionality to copy routes from outer namespace
Instead of just fetching the default gateway and configuring a single
equivalent route in the target namespace, on 'pasta --config-net', it
might be desirable in some cases to copy the whole set of routes
corresponding to a given output interface.
For instance, in:
https://github.com/containers/podman/issues/18539
IPv4 Default Route Does Not Propagate to Pasta Containers on Hetzner VPSes
configuring the default gateway won't work without a gateway-less
route (specifying the output interface only), because the default
gateway is, somewhat dubiously, not on the same subnet as the
container.
This is a similar case to the one covered by commit 7656a6f88882
("conf: Adjust netmask on mismatch between IPv4 address/netmask and
gateway"), and I'm not exactly proud of that workaround.
We also have:
https://bugs.passt.top/show_bug.cgi?id=49
pasta does not work with tap-style interface
for which, eventually, we should be able to configure a gateway-less
route in the target namespace.
Introduce different operation modes for nl_route(), including a new
NL_DUP one, not exposed yet, which simply parrots back to the kernel
the route dump for a given interface from the outer namespace, fixing
up flags and interface indices on the way, and requesting to add the
same routes in the target namespace, on the interface we manage.
For n routes we want to duplicate, send n identical netlink requests
including the full dump: routes might depend on each other and the
kernel processes RTM_NEWROUTE messages sequentially, not atomically,
and repeating the full dump naturally resolves dependencies without
the need to actually calculate them.
I'm not kidding, it actually works pretty well.
Link: https://github.com/containers/podman/issues/18539
Link: https://bugs.passt.top/show_bug.cgi?id=49
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2023-05-14 13:49:43 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req));
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
/* nl_foreach() will step through multiple response datagrams,
|
|
|
|
|
* which we don't want here because we need to have all the
|
|
|
|
|
* routes in the buffer at once.
|
|
|
|
|
*/
|
|
|
|
|
nh = nl_next(s_src, buf, NULL, &nlmsgs_size);
|
|
|
|
|
for (status = nlmsgs_size;
|
|
|
|
|
NLMSG_OK(nh, status) && (status = nl_status(nh, status, seq)) > 0;
|
|
|
|
|
nh = NLMSG_NEXT(nh, status)) {
|
2023-08-03 09:19:42 +02:00
|
|
|
struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh);
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
size_t na;
|
netlink: Add functionality to copy routes from outer namespace
Instead of just fetching the default gateway and configuring a single
equivalent route in the target namespace, on 'pasta --config-net', it
might be desirable in some cases to copy the whole set of routes
corresponding to a given output interface.
For instance, in:
https://github.com/containers/podman/issues/18539
IPv4 Default Route Does Not Propagate to Pasta Containers on Hetzner VPSes
configuring the default gateway won't work without a gateway-less
route (specifying the output interface only), because the default
gateway is, somewhat dubiously, not on the same subnet as the
container.
This is a similar case to the one covered by commit 7656a6f88882
("conf: Adjust netmask on mismatch between IPv4 address/netmask and
gateway"), and I'm not exactly proud of that workaround.
We also have:
https://bugs.passt.top/show_bug.cgi?id=49
pasta does not work with tap-style interface
for which, eventually, we should be able to configure a gateway-less
route in the target namespace.
Introduce different operation modes for nl_route(), including a new
NL_DUP one, not exposed yet, which simply parrots back to the kernel
the route dump for a given interface from the outer namespace, fixing
up flags and interface indices on the way, and requesting to add the
same routes in the target namespace, on the interface we manage.
For n routes we want to duplicate, send n identical netlink requests
including the full dump: routes might depend on each other and the
kernel processes RTM_NEWROUTE messages sequentially, not atomically,
and repeating the full dump naturally resolves dependencies without
the need to actually calculate them.
I'm not kidding, it actually works pretty well.
Link: https://github.com/containers/podman/issues/18539
Link: https://bugs.passt.top/show_bug.cgi?id=49
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2023-05-14 13:49:43 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
if (nh->nlmsg_type != RTM_NEWROUTE)
|
2021-10-11 12:01:31 +02:00
|
|
|
continue;
|
|
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
dup_routes++;
|
|
|
|
|
|
2021-10-20 00:05:11 +02:00
|
|
|
for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na);
|
|
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2023-08-03 09:19:42 +02:00
|
|
|
if (rta->rta_type == RTA_OIF)
|
2023-08-03 09:19:44 +02:00
|
|
|
*(unsigned int *)RTA_DATA(rta) = ifi_dst;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
}
|
netlink: Add functionality to copy routes from outer namespace
Instead of just fetching the default gateway and configuring a single
equivalent route in the target namespace, on 'pasta --config-net', it
might be desirable in some cases to copy the whole set of routes
corresponding to a given output interface.
For instance, in:
https://github.com/containers/podman/issues/18539
IPv4 Default Route Does Not Propagate to Pasta Containers on Hetzner VPSes
configuring the default gateway won't work without a gateway-less
route (specifying the output interface only), because the default
gateway is, somewhat dubiously, not on the same subnet as the
container.
This is a similar case to the one covered by commit 7656a6f88882
("conf: Adjust netmask on mismatch between IPv4 address/netmask and
gateway"), and I'm not exactly proud of that workaround.
We also have:
https://bugs.passt.top/show_bug.cgi?id=49
pasta does not work with tap-style interface
for which, eventually, we should be able to configure a gateway-less
route in the target namespace.
Introduce different operation modes for nl_route(), including a new
NL_DUP one, not exposed yet, which simply parrots back to the kernel
the route dump for a given interface from the outer namespace, fixing
up flags and interface indices on the way, and requesting to add the
same routes in the target namespace, on the interface we manage.
For n routes we want to duplicate, send n identical netlink requests
including the full dump: routes might depend on each other and the
kernel processes RTM_NEWROUTE messages sequentially, not atomically,
and repeating the full dump naturally resolves dependencies without
the need to actually calculate them.
I'm not kidding, it actually works pretty well.
Link: https://github.com/containers/podman/issues/18539
Link: https://bugs.passt.top/show_bug.cgi?id=49
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
2023-05-14 13:49:43 +02:00
|
|
|
|
2023-08-03 09:19:54 +02:00
|
|
|
if (!NLMSG_OK(nh, status) || status > 0) {
|
|
|
|
|
/* Process any remaining datagrams in a different
|
|
|
|
|
* buffer so we don't overwrite the first one.
|
|
|
|
|
*/
|
|
|
|
|
char tail[NLBUFSIZ];
|
|
|
|
|
unsigned extra = 0;
|
|
|
|
|
|
|
|
|
|
nl_foreach_oftype(nh, status, s_src, tail, seq, RTM_NEWROUTE)
|
|
|
|
|
extra++;
|
|
|
|
|
|
|
|
|
|
if (extra) {
|
|
|
|
|
err("netlink: Too many routes to duplicate");
|
2023-08-03 09:19:56 +02:00
|
|
|
return -E2BIG;
|
2023-08-03 09:19:54 +02:00
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:56 +02:00
|
|
|
if (status < 0)
|
|
|
|
|
return status;
|
2023-08-03 09:19:54 +02:00
|
|
|
|
2023-08-03 09:19:42 +02:00
|
|
|
/* Routes might have dependencies between each other, and the kernel
|
2023-08-03 09:19:45 +02:00
|
|
|
* processes RTM_NEWROUTE messages sequentially. For n routes, we might
|
|
|
|
|
* need to send the requests up to n times to get all of them inserted.
|
|
|
|
|
* Routes that have been already inserted will return -EEXIST, but we
|
|
|
|
|
* can safely ignore that and repeat the requests. This avoids the need
|
|
|
|
|
* to calculate dependencies: let the kernel do that.
|
2023-08-03 09:19:42 +02:00
|
|
|
*/
|
2023-08-03 09:19:45 +02:00
|
|
|
for (i = 0; i < dup_routes; i++) {
|
2023-08-03 09:19:51 +02:00
|
|
|
for (nh = (struct nlmsghdr *)buf, status = nlmsgs_size;
|
|
|
|
|
NLMSG_OK(nh, status);
|
|
|
|
|
nh = NLMSG_NEXT(nh, status)) {
|
2023-08-03 09:19:48 +02:00
|
|
|
uint16_t flags = nh->nlmsg_flags;
|
2023-08-03 09:19:56 +02:00
|
|
|
int rc;
|
2023-08-03 09:19:45 +02:00
|
|
|
|
|
|
|
|
if (nh->nlmsg_type != RTM_NEWROUTE)
|
|
|
|
|
continue;
|
|
|
|
|
|
2023-08-03 09:19:56 +02:00
|
|
|
rc = nl_do(s_dst, nh, RTM_NEWROUTE,
|
|
|
|
|
(flags & ~NLM_F_DUMP_FILTERED) | NLM_F_CREATE,
|
|
|
|
|
nh->nlmsg_len);
|
|
|
|
|
if (rc < 0 && rc != -ENETUNREACH && rc != -EEXIST)
|
|
|
|
|
return rc;
|
2023-08-03 09:19:45 +02:00
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:56 +02:00
|
|
|
|
|
|
|
|
return 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2023-08-03 09:19:41 +02:00
|
|
|
* nl_addr_get() - Get IP address for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2023-05-14 18:44:53 +02:00
|
|
|
* @ifi: Interface index in outer network namespace
|
2021-10-11 12:01:31 +02:00
|
|
|
* @af: Address family
|
2023-08-03 09:19:41 +02:00
|
|
|
* @addr: Global address to fill
|
|
|
|
|
* @prefix_len: Mask or prefix length, to fill (for IPv4)
|
|
|
|
|
* @addr_l: Link-scoped address to fill (for IPv6)
|
2023-08-03 09:19:55 +02:00
|
|
|
*
|
|
|
|
|
* Return: 9 on success, negative error code on failure
|
2023-08-03 09:19:41 +02:00
|
|
|
*/
|
2023-08-03 09:19:55 +02:00
|
|
|
int nl_addr_get(int s, unsigned int ifi, sa_family_t af,
|
|
|
|
|
void *addr, int *prefix_len, void *addr_l)
|
2023-08-03 09:19:41 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifaddrmsg ifa;
|
|
|
|
|
} req = {
|
|
|
|
|
.ifa.ifa_family = af,
|
|
|
|
|
.ifa.ifa_index = ifi,
|
|
|
|
|
};
|
|
|
|
|
struct nlmsghdr *nh;
|
|
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
|
|
|
|
uint16_t seq;
|
2023-08-03 09:19:41 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s, &req, RTM_GETADDR, NLM_F_DUMP, sizeof(req));
|
2023-08-03 09:19:52 +02:00
|
|
|
nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWADDR) {
|
2023-08-03 09:19:41 +02:00
|
|
|
struct ifaddrmsg *ifa = (struct ifaddrmsg *)NLMSG_DATA(nh);
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
size_t na;
|
|
|
|
|
|
|
|
|
|
if (ifa->ifa_index != ifi)
|
|
|
|
|
continue;
|
|
|
|
|
|
2023-08-15 05:51:28 +02:00
|
|
|
for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na);
|
2023-08-03 09:19:41 +02:00
|
|
|
rta = RTA_NEXT(rta, na)) {
|
|
|
|
|
if (rta->rta_type != IFA_ADDRESS)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (af == AF_INET) {
|
|
|
|
|
memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
|
|
|
|
*prefix_len = ifa->ifa_prefixlen;
|
|
|
|
|
} else if (af == AF_INET6 && addr &&
|
|
|
|
|
ifa->ifa_scope == RT_SCOPE_UNIVERSE) {
|
|
|
|
|
memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (addr_l &&
|
|
|
|
|
af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK)
|
|
|
|
|
memcpy(addr_l, RTA_DATA(rta), RTA_PAYLOAD(rta));
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:55 +02:00
|
|
|
return status;
|
2023-08-03 09:19:41 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_add_set() - Set IP addresses for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2023-08-03 09:19:41 +02:00
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @af: Address family
|
|
|
|
|
* @addr: Global address to set
|
|
|
|
|
* @prefix_len: Mask or prefix length to set
|
2023-08-03 09:19:53 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
2023-08-03 09:19:53 +02:00
|
|
|
int nl_addr_set(int s, unsigned int ifi, sa_family_t af,
|
|
|
|
|
void *addr, int prefix_len)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifaddrmsg ifa;
|
|
|
|
|
union {
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_l;
|
2023-08-03 09:19:43 +02:00
|
|
|
struct in_addr l;
|
2021-10-11 12:01:31 +02:00
|
|
|
struct rtattr rta_a;
|
2023-08-03 09:19:43 +02:00
|
|
|
struct in_addr a;
|
2021-10-11 12:01:31 +02:00
|
|
|
} a4;
|
|
|
|
|
struct {
|
|
|
|
|
struct rtattr rta_l;
|
|
|
|
|
struct in6_addr l;
|
|
|
|
|
struct rtattr rta_a;
|
|
|
|
|
struct in6_addr a;
|
|
|
|
|
} a6;
|
2021-10-21 04:26:08 +02:00
|
|
|
} set;
|
2021-10-11 12:01:31 +02:00
|
|
|
} req = {
|
|
|
|
|
.ifa.ifa_family = af,
|
2023-08-03 09:19:41 +02:00
|
|
|
.ifa.ifa_index = ifi,
|
|
|
|
|
.ifa.ifa_prefixlen = prefix_len,
|
|
|
|
|
.ifa.ifa_scope = RT_SCOPE_UNIVERSE,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
2023-08-03 09:19:48 +02:00
|
|
|
ssize_t len;
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2023-08-03 09:19:41 +02:00
|
|
|
if (af == AF_INET6) {
|
|
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.a6.l));
|
2022-10-11 00:36:30 +02:00
|
|
|
|
2023-08-03 09:19:41 +02:00
|
|
|
/* By default, strictly speaking, it's duplicated */
|
|
|
|
|
req.ifa.ifa_flags = IFA_F_NODAD;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:48 +02:00
|
|
|
len = offsetof(struct req_t, set.a6) + sizeof(req.set.a6);
|
2021-10-21 04:26:08 +02:00
|
|
|
|
2023-08-03 09:19:41 +02:00
|
|
|
memcpy(&req.set.a6.l, addr, sizeof(req.set.a6.l));
|
|
|
|
|
req.set.a6.rta_l.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_l.rta_type = IFA_LOCAL;
|
|
|
|
|
memcpy(&req.set.a6.a, addr, sizeof(req.set.a6.a));
|
|
|
|
|
req.set.a6.rta_a.rta_len = rta_len;
|
|
|
|
|
req.set.a6.rta_a.rta_type = IFA_ADDRESS;
|
|
|
|
|
} else {
|
|
|
|
|
size_t rta_len = RTA_LENGTH(sizeof(req.set.a4.l));
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:48 +02:00
|
|
|
len = offsetof(struct req_t, set.a4) + sizeof(req.set.a4);
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:43 +02:00
|
|
|
memcpy(&req.set.a4.l, addr, sizeof(req.set.a4.l));
|
2023-08-03 09:19:41 +02:00
|
|
|
req.set.a4.rta_l.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_l.rta_type = IFA_LOCAL;
|
|
|
|
|
req.set.a4.rta_a.rta_len = rta_len;
|
|
|
|
|
req.set.a4.rta_a.rta_type = IFA_ADDRESS;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
2023-08-03 09:19:53 +02:00
|
|
|
return nl_do(s, &req, RTM_NEWADDR, NLM_F_CREATE | NLM_F_EXCL, len);
|
2023-08-03 09:19:41 +02:00
|
|
|
}
|
2023-05-14 18:44:53 +02:00
|
|
|
|
2023-08-03 09:19:41 +02:00
|
|
|
/**
|
|
|
|
|
* nl_addr_dup() - Copy IP addresses for given interface and address family
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s_src: Netlink socket in source network namespace
|
|
|
|
|
* @ifi_src: Interface index in source network namespace
|
|
|
|
|
* @s_dst: Netlink socket in destination network namespace
|
|
|
|
|
* @ifi_dst: Interface index in destination namespace
|
2023-08-03 09:19:41 +02:00
|
|
|
* @af: Address family
|
2023-08-03 09:19:56 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2023-08-03 09:19:41 +02:00
|
|
|
*/
|
2023-08-03 09:19:56 +02:00
|
|
|
int nl_addr_dup(int s_src, unsigned int ifi_src,
|
|
|
|
|
int s_dst, unsigned int ifi_dst, sa_family_t af)
|
2023-08-03 09:19:41 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifaddrmsg ifa;
|
|
|
|
|
} req = {
|
|
|
|
|
.ifa.ifa_family = af,
|
2023-08-03 09:19:44 +02:00
|
|
|
.ifa.ifa_index = ifi_src,
|
2023-08-03 09:19:41 +02:00
|
|
|
.ifa.ifa_prefixlen = 0,
|
|
|
|
|
};
|
2023-08-03 09:19:45 +02:00
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:41 +02:00
|
|
|
struct nlmsghdr *nh;
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
|
|
|
|
uint16_t seq;
|
2023-08-03 09:19:56 +02:00
|
|
|
int rc = 0;
|
2021-10-11 12:01:31 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s_src, &req, RTM_GETADDR, NLM_F_DUMP, sizeof(req));
|
2023-08-03 09:19:52 +02:00
|
|
|
nl_foreach_oftype(nh, status, s_src, buf, seq, RTM_NEWADDR) {
|
2023-08-03 09:19:41 +02:00
|
|
|
struct ifaddrmsg *ifa;
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
size_t na;
|
|
|
|
|
|
2021-10-11 12:01:31 +02:00
|
|
|
ifa = (struct ifaddrmsg *)NLMSG_DATA(nh);
|
2023-05-14 18:44:53 +02:00
|
|
|
|
2023-08-03 09:19:56 +02:00
|
|
|
if (rc < 0 || ifa->ifa_scope == RT_SCOPE_LINK ||
|
2023-08-03 09:19:45 +02:00
|
|
|
ifa->ifa_index != ifi_src)
|
2023-08-03 09:19:41 +02:00
|
|
|
continue;
|
2023-05-14 18:44:53 +02:00
|
|
|
|
2023-08-03 09:19:44 +02:00
|
|
|
ifa->ifa_index = ifi_dst;
|
2023-05-14 18:44:53 +02:00
|
|
|
|
2023-08-15 05:51:28 +02:00
|
|
|
for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na);
|
2021-10-20 00:05:11 +02:00
|
|
|
rta = RTA_NEXT(rta, na)) {
|
netlink: Don't propagate host address expiry to the container
When we copy addresses from the host to the container in nl_addr_dup(), we
copy all the address's attributes, including IFA_CACHEINFO, which controls
the address's lifetime. If the host address is managed by, for example,
DHCP, it will typically have a finite lifetime.
When we copy that lifetime to the pasta container, that lifetime will
remain, meaning the kernel will eventually remove the address, typically
some hours later. The container, however, won't have the DHCP client or
whatever was managing and maintaining the address in the host, so it will
just lose connectivity.
Long term, we may want to monitor host address changes and reflect them to
the guest. But for now, we just want to take a snapshot of the host's
address and set those in the container permanently. We can accomplish that
by stripping off the IFA_CACHEINFO attribute as we copy addresses.
Link: https://github.com/containers/podman/issues/19405
Link: https://bugs.passt.top/show_bug.cgi?id=70
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-15 05:51:29 +02:00
|
|
|
/* Strip label and expiry (cacheinfo) information */
|
|
|
|
|
if (rta->rta_type == IFA_LABEL ||
|
|
|
|
|
rta->rta_type == IFA_CACHEINFO)
|
2023-05-14 18:44:53 +02:00
|
|
|
rta->rta_type = IFA_UNSPEC;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
2023-05-14 18:44:53 +02:00
|
|
|
|
2023-08-03 09:19:56 +02:00
|
|
|
rc = nl_do(s_dst, nh, RTM_NEWADDR,
|
|
|
|
|
(nh->nlmsg_flags & ~NLM_F_DUMP_FILTERED) | NLM_F_CREATE,
|
|
|
|
|
nh->nlmsg_len);
|
2023-08-03 09:19:45 +02:00
|
|
|
}
|
2023-08-03 09:19:56 +02:00
|
|
|
if (status < 0)
|
|
|
|
|
return status;
|
|
|
|
|
|
|
|
|
|
return rc;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
* nl_link_get_mac() - Get link MAC address
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
2021-10-11 12:01:31 +02:00
|
|
|
* @ifi: Interface index
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
* @mac: Fill with current MAC address
|
2023-08-03 09:19:55 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
2021-10-11 12:01:31 +02:00
|
|
|
*/
|
2023-08-03 09:19:55 +02:00
|
|
|
int nl_link_get_mac(int s, unsigned int ifi, void *mac)
|
2021-10-11 12:01:31 +02:00
|
|
|
{
|
2022-02-23 10:50:09 +01:00
|
|
|
struct req_t {
|
2021-10-11 12:01:31 +02:00
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifinfomsg ifm;
|
|
|
|
|
} req = {
|
2021-10-14 13:05:56 +02:00
|
|
|
.ifm.ifi_family = AF_UNSPEC,
|
|
|
|
|
.ifm.ifi_index = ifi,
|
2021-10-11 12:01:31 +02:00
|
|
|
};
|
|
|
|
|
struct nlmsghdr *nh;
|
2023-03-08 03:43:25 +01:00
|
|
|
char buf[NLBUFSIZ];
|
2023-08-03 09:19:51 +02:00
|
|
|
ssize_t status;
|
|
|
|
|
uint16_t seq;
|
2022-04-05 07:10:30 +02:00
|
|
|
|
2023-08-03 09:19:51 +02:00
|
|
|
seq = nl_send(s, &req, RTM_GETLINK, 0, sizeof(req));
|
2023-08-03 09:19:52 +02:00
|
|
|
nl_foreach_oftype(nh, status, s, buf, seq, RTM_NEWLINK) {
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
struct ifinfomsg *ifm = (struct ifinfomsg *)NLMSG_DATA(nh);
|
|
|
|
|
struct rtattr *rta;
|
|
|
|
|
size_t na;
|
2021-10-14 13:05:56 +02:00
|
|
|
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
for (rta = IFLA_RTA(ifm), na = RTM_PAYLOAD(nh);
|
|
|
|
|
RTA_OK(rta, na);
|
2021-10-20 00:05:11 +02:00
|
|
|
rta = RTA_NEXT(rta, na)) {
|
2021-10-11 12:01:31 +02:00
|
|
|
if (rta->rta_type != IFLA_ADDRESS)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
memcpy(mac, RTA_DATA(rta), ETH_ALEN);
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-08-03 09:19:55 +02:00
|
|
|
return status;
|
2021-10-11 12:01:31 +02:00
|
|
|
}
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_link_set_mac() - Set link MAC address
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
* @ns: Use netlink socket in namespace
|
|
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @mac: MAC address to set
|
2023-08-03 09:19:53 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
*/
|
2023-08-03 09:19:53 +02:00
|
|
|
int nl_link_set_mac(int s, unsigned int ifi, void *mac)
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifinfomsg ifm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned char mac[ETH_ALEN];
|
|
|
|
|
} req = {
|
|
|
|
|
.ifm.ifi_family = AF_UNSPEC,
|
|
|
|
|
.ifm.ifi_index = ifi,
|
|
|
|
|
.rta.rta_type = IFLA_ADDRESS,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(ETH_ALEN),
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
memcpy(req.mac, mac, ETH_ALEN);
|
|
|
|
|
|
2023-08-03 09:19:53 +02:00
|
|
|
return nl_do(s, &req, RTM_NEWLINK, 0, sizeof(req));
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* nl_link_up() - Bring link up
|
2023-08-03 09:19:44 +02:00
|
|
|
* @s: Netlink socket
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
* @ifi: Interface index
|
|
|
|
|
* @mtu: If non-zero, set interface MTU
|
2023-08-03 09:19:53 +02:00
|
|
|
*
|
|
|
|
|
* Return: 0 on success, negative error code on failure
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
*/
|
2023-08-03 09:19:53 +02:00
|
|
|
int nl_link_up(int s, unsigned int ifi, int mtu)
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
{
|
|
|
|
|
struct req_t {
|
|
|
|
|
struct nlmsghdr nlh;
|
|
|
|
|
struct ifinfomsg ifm;
|
|
|
|
|
struct rtattr rta;
|
|
|
|
|
unsigned int mtu;
|
|
|
|
|
} req = {
|
|
|
|
|
.ifm.ifi_family = AF_UNSPEC,
|
|
|
|
|
.ifm.ifi_index = ifi,
|
|
|
|
|
.ifm.ifi_flags = IFF_UP,
|
|
|
|
|
.ifm.ifi_change = IFF_UP,
|
|
|
|
|
.rta.rta_type = IFLA_MTU,
|
|
|
|
|
.rta.rta_len = RTA_LENGTH(sizeof(unsigned int)),
|
|
|
|
|
.mtu = mtu,
|
|
|
|
|
};
|
2023-08-03 09:19:48 +02:00
|
|
|
ssize_t len = sizeof(req);
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
|
|
|
|
|
if (!mtu)
|
|
|
|
|
/* Shorten request to drop MTU attribute */
|
2023-08-03 09:19:48 +02:00
|
|
|
len = offsetof(struct req_t, rta);
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
|
2023-08-03 09:19:53 +02:00
|
|
|
return nl_do(s, &req, RTM_NEWLINK, 0, len);
|
netlink: Split up functionality of nl_link()
nl_link() performs a number of functions: it can bring links up, set MAC
address and MTU and also retrieve the existing MAC. This makes for a small
number of lines of code, but high conceptual complexity: it's quite hard
to follow what's going on both in nl_link() itself and it's also not very
obvious which function its callers are intending to use.
Clarify this, by splitting nl_link() into nl_link_up(), nl_link_set_mac(),
and nl_link_get_mac(). The first brings up a link, optionally setting the
MTU, the others get or set the MAC address.
This fixes an arguable bug in pasta_ns_conf(): it looks as though that was
intended to retrieve the guest MAC whether or not c->pasta_conf_ns is set.
However, it only actually does so in the !c->pasta_conf_ns case: the fact
that we set up==1 means we would only ever set, never get, the MAC in the
nl_link() call in the other path. We get away with this because the MAC
will quickly be discovered once we receive packets on the tap interface.
Still, it's neater to always get the MAC address here.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2023-08-03 09:19:40 +02:00
|
|
|
}
|