From da54641f140e2fa99f69acc436d49d792b303679 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Sun, 14 May 2023 15:04:38 +0200 Subject: conf, pasta: With --config-net, copy all routes by default Use the newly-introduced NL_DUP mode for nl_route() to copy all the routes associated to the template interface in the outer namespace, unless --no-copy-routes (also implied by -g) is given. This option is introduced as deprecated right away: it's not expected to be of any use, but it's helpful to keep it around for a while to debug any suspected issue with this change. Otherwise, we can't use default gateways which are not, address-wise, on the same subnet as the container, as reported by Callum. Reported-by: Callum Parsey Link: https://github.com/containers/podman/issues/18539 Signed-off-by: Stefano Brivio Reviewed-by: David Gibson --- conf.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'conf.c') diff --git a/conf.c b/conf.c index 3ee6ae0..0a01983 100644 --- a/conf.c +++ b/conf.c @@ -923,6 +923,8 @@ pasta_opts: info( " --no-netns-quit Don't quit if filesystem-bound target"); info( " network namespace is deleted"); info( " --config-net Configure tap interface in namespace"); + info( " --no-copy-routes DEPRECATED:"); + info( " Don't copy all routes to namespace"); info( " --ns-mac-addr ADDR Set MAC address on tap interface"); exit(EXIT_FAILURE); @@ -1198,6 +1200,7 @@ void conf(struct ctx *c, int argc, char **argv) {"outbound-if4", required_argument, NULL, 15 }, {"outbound-if6", required_argument, NULL, 16 }, {"config-net", no_argument, NULL, 17 }, + {"no-copy-routes", no_argument, NULL, 18 }, { 0 }, }; struct get_bound_ports_ns_arg ns_ports_arg = { .c = c }; @@ -1362,6 +1365,13 @@ void conf(struct ctx *c, int argc, char **argv) c->pasta_conf_ns = 1; break; + case 18: + if (c->mode != MODE_PASTA) + die("--no-copy-routes is for pasta mode only"); + + warn("--no-copy-routes will be dropped soon"); + c->no_copy_routes = 1; + break; case 'd': if (c->debug) die("Multiple --debug options given"); @@ -1510,6 +1520,9 @@ void conf(struct ctx *c, int argc, char **argv) } break; case 'g': + if (c->mode == MODE_PASTA) + c->no_copy_routes = 1; + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && inet_pton(AF_INET6, optarg, &c->ip6.gw) && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.gw) && @@ -1644,6 +1657,9 @@ void conf(struct ctx *c, int argc, char **argv) if (*c->sock_path && c->fd_tap >= 0) die("Options --socket and --fd are mutually exclusive"); + if (c->mode == MODE_PASTA && c->no_copy_routes && !c->pasta_conf_ns) + die("Option --no-copy-routes needs --config-net"); + if (!ifi4 && *c->ip4.ifname_out) ifi4 = if_nametoindex(c->ip4.ifname_out); -- cgit v1.2.3