aboutgitcodebugslistschat
path: root/isolation.c
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-03-08 03:29:51 +0100
committerStefano Brivio <sbrivio@redhat.com>2023-03-09 03:43:59 +0100
commita9c59dd91baa6315259328fc0e36ac63a61ab24b (patch)
tree7521d3ff5f142ed9acf20e7b1cafc537a818031a /isolation.c
parent70148ce5be9844ba0e3c8112fb0117689c1bfca0 (diff)
downloadpasst-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar.gz
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar.bz2
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar.lz
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar.xz
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.tar.zst
passt-a9c59dd91baa6315259328fc0e36ac63a61ab24b.zip
conf, icmp, tcp, udp: Add options to bind to outbound address and interface
I didn't notice earlier: libslirp (and slirp4netns) supports binding outbound sockets to specific IPv4 and IPv6 addresses, to force the source addresse selection. If we want to claim feature parity, we should implement that as well. Further, Podman supports specifying outbound interfaces as well, but this is simply done by resolving the primary address for an interface when the network back-end is started. However, since kernel version 5.7, commit c427bfec18f2 ("net: core: enable SO_BINDTODEVICE for non-root users"), we can actually bind to a specific interface name, which doesn't need to be validated in advance. Implement -o / --outbound ADDR to bind to IPv4 and IPv6 addresses, and --outbound-if4 and --outbound-if6 to bind IPv4 and IPv6 sockets to given interfaces. Given that it probably makes little sense to select addresses and routes from interfaces different than the ones given for outbound sockets, also assign those as "template" interfaces, by default, unless explicitly overridden by '-i'. For ICMP and UDP, we call sock_l4() to open outbound sockets, as we already needed to bind to given ports or echo identifiers, and we can bind() a socket only once: there, pass address (if any) and interface (if any) for the existing bind() and setsockopt() calls. For TCP, in general, we wouldn't otherwise bind sockets. Add a specific helper to do that. For UDP outbound sockets, we need to know if the final destination of the socket is a loopback address, before we decide whether it makes sense to bind the socket at all: move the block mangling the address destination before the creation of the socket in the IPv4 path. This was already the case for the IPv6 path. Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Diffstat (limited to 'isolation.c')
0 files changed, 0 insertions, 0 deletions