diff options
author | David Gibson <david@gibson.dropbear.id.au> | 2024-10-03 14:48:32 +1000 |
---|---|---|
committer | Stefano Brivio <sbrivio@redhat.com> | 2024-10-04 19:04:29 +0200 |
commit | 9d66df9a9a45b9305a2daff8a3c09a28f2c78d83 (patch) | |
tree | f627f8309045423bf05257549b8061dadc10b532 /passt.1 | |
parent | 151dbe0d3d3690978a0a5cf3b8fa9808bd708668 (diff) | |
download | passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar.gz passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar.bz2 passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar.lz passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar.xz passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.tar.zst passt-9d66df9a9a45b9305a2daff8a3c09a28f2c78d83.zip |
conf: Add command line switch to enable IP_FREEBIND socket option
In a couple of recent reports, we've seen that it can be useful for pasta
to forward ports from addresses which are not currently configured on the
host, but might be in future. That can be done with the sysctl
net.ipv4.ip_nonlocal_bind, but that does require CAP_NET_ADMIN to set in
the first place. We can allow the same thing on a per-socket basis with
the IP_FREEBIND (or IPV6_FREEBIND) socket option.
Add a --freebind command line argument to enable this socket option on
all listening sockets.
Link: https://bugs.passt.top/show_bug.cgi?id=101
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'passt.1')
-rw-r--r-- | passt.1 | 10 |
1 files changed, 10 insertions, 0 deletions
@@ -328,6 +328,16 @@ Disable Router Advertisements. Router Solicitations coming from guest or target namespace will be ignored. .TP +.BR \-\-freebind +Allow any binding address to be specified for \fB-t\fR and \fB-u\fR +options. Usually binding addresses must be addresses currently +configured on the host. With \fB\-\-freebind\fR, the +\fBIP_FREEBIND\fR or \fBIPV6_FREEBIND\fR socket option is enabled +allowing any address to be used. This is typically used to bind +addresses which might be configured on the host in future, at which +point the forwarding will immediately start operating. + +.TP .BR \-\-map-host-loopback " " \fIaddr Translate \fIaddr\fR to refer to the host. Packets from the guest to \fIaddr\fR will be redirected to the host. On the host such packets |