passt: New design and implementation with native Layer 4 sockets

This is a reimplementation, partially building on the earlier draft,
that uses L4 sockets (SOCK_DGRAM, SOCK_STREAM) instead of SOCK_RAW,
providing L4-L2 translation functionality without requiring any
security capability.

Conceptually, this follows the design presented at:
	https://gitlab.com/abologna/kubevirt-and-kvm/-/blob/master/Networking.md

The most significant novelty here comes from TCP and UDP translation
layers. In particular, the TCP state and translation logic follows
the intent of being minimalistic, without reimplementing a full TCP
stack in either direction, and synchronising as much as possible the
TCP dynamic and flows between guest and host kernel.

Another important introduction concerns addressing, port translation
and forwarding. The Layer 4 implementations now attempt to bind on
all unbound ports, in order to forward connections in a transparent
way.

While at it:
- the qemu 'tap' back-end can't be used as-is by qrap anymore,
  because of explicit checks now introduced in qemu to ensure that
  the corresponding file descriptor is actually a tap device. For
  this reason, qrap now operates on a 'socket' back-end type,
  accounting for and building the additional header reporting
  frame length

- provide a demo script that sets up namespaces, addresses and
  routes, and starts the daemon. A virtual machine started in the
  network namespace, wrapped by qrap, will now directly interface
  with passt and communicate using Layer 4 sockets provided by the
  host kernel.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

1 files changed, 4 insertions, 48 deletions

diff --git a/passt.h b/passt.h
index 904b42f..e2c9035 100644
--- a/passt.h
+++ b/passt.h
@@ -1,56 +1,12 @@
-#define CT_SIZE		4096
 #define UNIX_SOCK_PATH	"/tmp/passt.socket"
 
 /**
- * struct ct4 - IPv4 connection tracking entry
- * @p:		IANA protocol number
- * @sa:		Source address (as seen from tap interface)
- * @da:		Destination address
- * @sp:		Source port, network order
- * @dp:		Destination port, network order
- * @hd:		Destination MAC address
- * @hs:		Source MAC address
- * @fd:		File descriptor for corresponding AF_INET socket
- */
-struct ct4 {
-	uint8_t p;
-	uint32_t sa;
-	uint32_t da;
-	uint16_t sp;
-	uint16_t dp;
-	unsigned char hd[ETH_ALEN];
-	unsigned char hs[ETH_ALEN];
-	int fd;
-};
-
-/**
- * struct ct6 - IPv6 connection tracking entry
- * @p:		IANA protocol number
- * @sa:		Source address (as seen from tap interface)
- * @da:		Destination address
- * @sp:		Source port, network order
- * @dp:		Destination port, network order
- * @hd:		Destination MAC address
- * @hs:		Source MAC address
- * @fd:		File descriptor for corresponding AF_INET6 socket
- */
-struct ct6 {
-	uint8_t p;
-	struct in6_addr sa;
-	struct in6_addr da;
-	uint16_t sp;
-	uint16_t dp;
-	unsigned char hd[ETH_ALEN];
-	unsigned char hs[ETH_ALEN];
-	int fd;
-};
-
-/**
  * struct ctx - Execution context
  * @epollfd:	file descriptor for epoll instance
  * @fd_unix:	AF_UNIX socket for tap file descriptor
- * @map4:	Connection tracking table
  * @v4:		Enable IPv4 transport
+ * @mac:	Host MAC address
+ * @mac_guest:	Guest MAC address
  * @addr4:	IPv4 address for external, routable interface
  * @mask4:	IPv4 netmask, network order
  * @gw4:	Default IPv4 gateway, network order
@@ -64,9 +20,8 @@ struct ct6 {
 struct ctx {
 	int epollfd;
 	int fd_unix;
-	struct ct4 map4[CT_SIZE];
-	struct ct6 map6[CT_SIZE];
 	unsigned char mac[ETH_ALEN];
+	unsigned char mac_guest[ETH_ALEN];
 
 	int v4;
 	unsigned long addr4;
@@ -76,6 +31,7 @@ struct ctx {
 
 	int v6;
 	struct in6_addr addr6;
+	struct in6_addr addr6_guest;
 	struct in6_addr gw6;
 	struct in6_addr dns6;