diff options
| -rw-r--r-- | conf.c | 16 | ||||
| -rw-r--r-- | passt.1 | 14 |
2 files changed, 20 insertions, 10 deletions
@@ -426,10 +426,12 @@ static void add_dns_resolv(struct ctx *c, const char *nameserver, if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_host)) c->ip4.dns_host = ns4; - /* Guest or container can only access local addresses via - * redirect + /* Special handling if guest or container can only access local + * addresses via redirect, or if the host gateway is also a + * resolver and we shadow its address */ - if (IN4_IS_ADDR_LOOPBACK(&ns4)) { + if (IN4_IS_ADDR_LOOPBACK(&ns4) || + IN4_ARE_ADDR_EQUAL(&ns4, &c->ip4.map_host_loopback)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) return; @@ -445,10 +447,12 @@ static void add_dns_resolv(struct ctx *c, const char *nameserver, if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_host)) c->ip6.dns_host = ns6; - /* Guest or container can only access local addresses via - * redirect + /* Special handling if guest or container can only access local + * addresses via redirect, or if the host gateway is also a + * resolver and we shadow its address */ - if (IN6_IS_ADDR_LOOPBACK(&ns6)) { + if (IN6_IS_ADDR_LOOPBACK(&ns6) || + IN6_ARE_ADDR_EQUAL(&ns6, &c->ip6.map_host_loopback)) { if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) return; @@ -941,10 +941,16 @@ with destination 127.0.0.10, and the default IPv4 gateway is 192.0.2.1, while the last observed source address from guest or namespace is 192.0.2.2, this will be translated to a connection from 192.0.2.1 to 192.0.2.2. -Similarly, for traffic coming from guest or namespace, packets with -destination address corresponding to the \fB\-\-map-host-loopback\fR -address will have their destination address translated to a loopback -address. +Similarly, for traffic coming from guest or namespace, packets with destination +address corresponding to the \fB\-\-map-host-loopback\fR address will have their +destination address translated to a loopback address. + +As an exception, traffic identified as DNS, originally directed to the +\fB\-\-map-host-loopback\fR address, if this address matches a resolver address +on the host, is \fBnot\fR translated to loopback, but rather handled in the same +way as if specified as \-\-dns-forward address, if no such option was given. +In the common case where the host gateway also acts a resolver, this avoids that +the host mapping shadows the gateway/resolver itself. .SS Handling of local traffic in pasta |