fix(pasta): assign a fixed IPv6 address, gateway, and DNS to the netns - #620
Merged
Merged
Conversation
Currently, `curl -fsSL http://[${parent_ipv6}]:8080` fails when running
`hack/integration-ipv6.sh` with `--net=pasta`.
This is because pasta copies the destination address `${parent_ipv6}` into
the isolated netns and the destination becomes a local address inside the
netns.
To begin with, the only interface on the host with an available IPv6 route
is the dummy interface (`dummy42`), so it is selected as the template, and
its address and route are duplicated into the netns by `nl_addr_dup()` and
`nl_route_dup()` [1].
As a result, the route to `${parent_ipv6}` becomes `local`, the packets
never leave the netns, and they do not reach the httpd running on the
host.
To resolve this error, pass `--address`, `--gateway`, and `--dns-forward`
when running pasta, so that a fixed IPv6 configuration is assigned to tap0
inside the netns.
child: fd00::100
gateway: fd00::2
DNS: fd00::3
With these options, pasta executes `nl_addr_set()` and
`nl_route_set_def()` [1] in `pasta.c` instead of `nl_addr_dup()` and
`nl_route_dup()`, and assigns the specified address and route to tap0
inside the netns.
As a result, `${parent_ipv6}` is no longer duplicated into the netns, and
when running `curl -fsSL http://[${parent_ipv6}]:8080` inside the netns,
packets leave the netns through tap0.
On the host side, pasta relays the connection to the httpd, so the curl
now succeeds.
[1] https://passt.top/passt/tree/pasta.c
Signed-off-by: Hayato Kiwata <dev@haytok.jp>
AkihiroSuda
reviewed
Sep 8, 2026
| return res, nil | ||
| } | ||
|
|
||
| func AddIPInt6(ip net.IP, i int) (net.IP, error) { |
Member
There was a problem hiding this comment.
Instead you could call https://pkg.go.dev/net/netip#Addr.Next multiple times ?
Contributor
Author
There was a problem hiding this comment.
Thanks, will fix on another PR.
Contributor
Author
|
Thanks for your review!! By the way, what would it take for |
Member
Let's wait for a couple of months to confirm that nobody is experiencing a serious issue |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently,
curl -fsSL http://[${parent_ipv6}]:8080fails when runninghack/integration-ipv6.shwith--net=pasta.This is because pasta copies the destination address
${parent_ipv6}into the isolated netns and the destination becomes a local address inside the netns.To begin with, the only interface on the host with an available IPv6 route is the dummy interface (
dummy42), so it is selected as the template, and its address and route are duplicated into the netns bynl_addr_dup()andnl_route_dup()[1].As a result, the route to
${parent_ipv6}becomeslocal, the packets never leave the netns, and they do not reach the httpd running on the host.To resolve this error, pass
--address,--gateway, and--dns-forwardwhen running pasta, so that a fixed IPv6 configuration is assigned to tap0 inside the netns.child: fd00::100
gateway: fd00::2
DNS: fd00::3
With these options, pasta executes
nl_addr_set()andnl_route_set_def()[1] inpasta.cinstead ofnl_addr_dup()andnl_route_dup(), and assigns the specified address and route to tap0 inside the netns.As a result,
${parent_ipv6}is no longer duplicated into the netns, and when runningcurl -fsSL http://[${parent_ipv6}]:8080inside the netns, packets leave the netns through tap0.On the host side, pasta relays the connection to the httpd, so the curl now succeeds.
[1] https://passt.top/passt/tree/pasta.c