From 9d66df9a9a45b9305a2daff8a3c09a28f2c78d83 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Thu, 3 Oct 2024 14:48:32 +1000 Subject: conf: Add command line switch to enable IP_FREEBIND socket option In a couple of recent reports, we've seen that it can be useful for pasta to forward ports from addresses which are not currently configured on the host, but might be in future. That can be done with the sysctl net.ipv4.ip_nonlocal_bind, but that does require CAP_NET_ADMIN to set in the first place. We can allow the same thing on a per-socket basis with the IP_FREEBIND (or IPV6_FREEBIND) socket option. Add a --freebind command line argument to enable this socket option on all listening sockets. Link: https://bugs.passt.top/show_bug.cgi?id=101 Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- passt.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'passt.h') diff --git a/passt.h b/passt.h index 031c9b6..4908ed9 100644 --- a/passt.h +++ b/passt.h @@ -225,6 +225,7 @@ struct ip6_ctx { * @no_dhcpv6: Disable DHCPv6 server * @no_ndp: Disable NDP handler altogether * @no_ra: Disable router advertisements + * @freebind: Allow binding of non-local addresses for forwarding * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max */ @@ -284,6 +285,7 @@ struct ctx { int no_dhcpv6; int no_ndp; int no_ra; + int freebind; int low_wmem; int low_rmem; -- cgit v1.2.3