fwd, fwd_rule: Implement configurable target address mapping

Add a 'taddr' field to forwarding rules, which controls the destination
address on the target side.  Since changing the structure alters the pesto
update protocol, bump the protocol version number

[dwg: Split from option parsing code, added protocol version bump,
 explicitly exclude splicing with target address for now]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

4 files changed, 57 insertions, 17 deletions

diff --git a/fwd.c b/fwd.c
index 042158c..3ae25fd 100644
--- a/fwd.c
+++ b/fwd.c
@@ -1023,7 +1023,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
 	/* Common for spliced and non-spliced cases */
 	tgt->eport = rule->to + (ini->oport - rule->first);
 
-	if (!c->no_splice && inany_is_loopback(&ini->eaddr) &&
+	/* TODO: Allow splicing with specified target address */
+	if (!c->no_splice && inany_is_unspecified(&rule->taddr) &&
+	    inany_is_loopback(&ini->eaddr) &&
 	    (proto == IPPROTO_TCP || proto == IPPROTO_UDP)) {
 		/* spliceable */
 
@@ -1074,7 +1076,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
 	}
 	tgt->oport = ini->eport;
 
-	if (inany_v4(&tgt->oaddr)) {
+	if (!inany_is_unspecified(&rule->taddr)) {
+		tgt->eaddr = rule->taddr;
+	} else if (inany_v4(&tgt->oaddr)) {
 		tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
 	} else {
 		if (inany_is_linklocal6(&tgt->oaddr))
diff --git a/fwd_rule.c b/fwd_rule.c
index 42ec68e..312bc60 100644
--- a/fwd_rule.c
+++ b/fwd_rule.c
@@ -115,10 +115,15 @@ __attribute__((noinline))
 const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size)
 {
 	const char *percent = *rule->ifname ? "%" : "";
+	char taddr[INANY_ADDRSTRLEN] = { 0 };
 	const char *weak = "", *scan = "";
 	char addr[INANY_ADDRSTRLEN];
 	int len;
 
+	if (!inany_is_unspecified(&rule->taddr)) {
+		(void)snprintf(taddr, sizeof(taddr), "%s:",
+			       inany_ntop(&rule->taddr, addr, sizeof(addr)));
+	}
 	inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr));
 	if (rule->flags & FWD_WEAK)
 		weak = " (best effort)";
@@ -127,16 +132,17 @@ const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size)
 
 	if (rule->first == rule->last) {
 		len = snprintf(dst, size,
-			       "%s [%s]%s%s:%hu  =>  %hu %s%s",
+			       "%s [%s]%s%s:%hu  =>  %s%hu %s%s",
 			       ipproto_name(rule->proto), addr, percent,
-			       rule->ifname, rule->first, rule->to, weak, scan);
+			       rule->ifname, rule->first,
+			       taddr, rule->to, weak, scan);
 	} else {
 		in_port_t tolast = rule->last - rule->first + rule->to;
 		len = snprintf(dst, size,
-			       "%s [%s]%s%s:%hu-%hu  =>  %hu-%hu %s%s",
+			       "%s [%s]%s%s:%hu-%hu  =>  %s%hu-%hu %s%s",
 			       ipproto_name(rule->proto), addr, percent,
 			       rule->ifname, rule->first, rule->last,
-			       rule->to, tolast, weak, scan);
+			       taddr, rule->to, tolast, weak, scan);
 	}
 
 	if (len < 0 || (size_t)len >= size)
@@ -325,6 +331,36 @@ int fwd_rule_add(struct fwd_table *fwd, const struct fwd_rule *new)
 		return -EINVAL;
 	}
 
+	if (!inany_is_unspecified(&new->taddr)) {
+		char tastr[INANY_ADDRSTRLEN];
+
+		if (inany_is_multicast(&new->taddr)) {
+			warn("Multicast target address %s for forwarding rule",
+			     inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+			return -EINVAL;
+		}
+
+		if (new->flags & FWD_DUAL_STACK_ANY) {
+			warn("Dual stack forward to %s address %s unsupported",
+			     inany_v4(&new->taddr) ? "IPv4" : "IPv6",
+			     inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+			warn("Did you mean %s/... instead?",
+			     inany_v4(&new->taddr) ? "0.0.0.0" : "[::]");
+			return -EINVAL;
+		}
+
+		if (!!inany_v4(&new->addr) != !!inany_v4(&new->taddr)) {
+			char lastr[INANY_ADDRSTRLEN];
+
+			warn("Forward from %s (%s) to %s (%s) unsupported",
+			     inany_v4(&new->addr) ? "IPv4" : "IPv6",
+			     inany_ntop(&new->addr, lastr, sizeof(lastr)),
+			     inany_v4(&new->taddr) ? "IPv4" : "IPv6",
+			     inany_ntop(&new->taddr, tastr, sizeof(tastr)));
+			return -EINVAL;
+		}
+	}
+
 	for (i = 0; i < fwd->count; i++) {
 		char newstr[FWD_RULE_STRLEN], rulestr[FWD_RULE_STRLEN];
 
@@ -393,6 +429,7 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del,
 {
 	struct fwd_rule rule = {
 		.addr = addr ? *addr : inany_any6,
+		.taddr = tgt_addr ? *tgt_addr : inany_any6,
 		.ifname = { 0 },
 		.proto = proto,
 		.flags = flags,
@@ -401,14 +438,6 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del,
 	char rulestr[FWD_RULE_STRLEN];
 	unsigned base, i;
 
-	if (tgt_addr && !inany_is_unspecified(tgt_addr)) {
-		char astr[INANY_ADDRSTRLEN];
-
-		info("Target address: %s",
-		     inany_ntop(tgt_addr, astr, sizeof(astr)));
-		die("Target address remapping not yet implemented");
-	}
-
 	if (!addr)
 		rule.flags |= FWD_DUAL_STACK_ANY;
 	if (ifname) {
diff --git a/fwd_rule.h b/fwd_rule.h
index 435be5b..a878831 100644
--- a/fwd_rule.h
+++ b/fwd_rule.h
@@ -33,6 +33,7 @@
 /**
  * struct fwd_rule - Forwarding rule governing a range of ports
  * @addr:	Address to forward from
+ * @taddr:	Target side destination address
  * @ifname:	Interface to forward from
  * @first:	First port number to forward
  * @last:	Last port number to forward
@@ -45,6 +46,7 @@
  */
 struct fwd_rule {
 	union inany_addr addr;
+	union inany_addr taddr;
 	char ifname[IFNAMSIZ];
 	in_port_t first;
 	in_port_t last;
@@ -91,10 +93,11 @@ void fwd_probe_ephemeral(void);
 
 #define FWD_RULE_STRLEN					    \
 	(IPPROTO_STRLEN - 1				    \
-	 + INANY_ADDRSTRLEN - 1				    \
+	 + INANY_ADDRSTRLEN - 1 /* listen addr */	    \
+	 + INANY_ADDRSTRLEN - 1	/* target addr */	    \
 	 + IFNAMSIZ - 1					    \
 	 + 4 * (UINT16_STRLEN - 1)			    \
-	 + sizeof(" []%:-  =>  - (best effort) (auto-scan)"))
+	 + sizeof(" []%:-  =>  :- (best effort) (auto-scan)"))
 
 const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule);
 const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size);
diff --git a/pesto.h b/pesto.h
index 980cc17..8db701b 100644
--- a/pesto.h
+++ b/pesto.h
@@ -15,7 +15,11 @@
 #define PESTO_SERVER_MAGIC	"basil:s"
 
 /* Version 0 is reserved for unreleased / unsupported experimental versions */
-#define PESTO_PROTOCOL_VERSION	1
+/* Version 1 had no target address field in struct fwd_rule.  It was released,
+ * but was little enough used that we decided not to implement backwards
+ * compatiblity code (i.e. a v2 pesto will not work with a v1 pasta)
+ */
+#define PESTO_PROTOCOL_VERSION	2
 
 /* Maximum size of a pif name, including \0 */
 #define	PIF_NAME_SIZE	(128)