How can I preserve the remote MAC address while using pasta networking on a rootless containter?

[Kenajcrap]

Currently, even though it correctly preserves hostname and ip address, it seems to always use the host's interface MAC address, leading to some minor interface bugs in Pi-hole, which I'm trying to run in a container, where it treats all devices as being a single one that have a bunch of different hostnames and IPs. There is probably an easy way to solve this that I'm not seeing after reading passt's man page.

my current run command:

/usr/bin/podman run \
        --cidfile=%t/%n.ctr-id \
        --cgroups=no-conmon \
        --rm \
        --sdnotify=conmon \
        --replace \
        -d \
        --name pihole \
        --hostname RPI \
        -p 443:443/tcp \
        -p 53:53/tcp \
        -p 53:53/udp \
        -p 8080:80/tcp \
        -p 853:853/tcp \
        -p 853:853/udp \
        -e WEBTHEME=default-darker \
        -e REV_SERVER=true \
        -e REV_SERVER_TARGET=10.170.15.1 \
        -e REV_SERVER_CIDR=10.170.15.0/24 \
        -e PIHOLE_DNS_=127.0.0.1#5335 \
        -e DNSSEC=true \
        -e DNSMASQ_LISTENING=single \
        -e INTERFACE=eth0 \
        -v etc_pihole-unbound:/etc/pihole:rw \
        -v etc_pihole_dnsmasq-unbound:/etc/dnsmasq.d:rw \
        -v etc_unbound:/etc/unbound:rw \
        --cap-add=NET_ADMIN \
        --net=pasta \
        docker.io/pihole/pihole:latest

Thank you for any help!

[Luap99]

@sbrivio-rh @dgibson ideas here?

[sbrivio-rh]

There's currently no way to do this with pasta. We can't really "preserve" the original source MAC address from packets because we don't get it from the kernel -- that would need a packet(7) socket, which needs the CAP_NET_RAW capability, but pasta is designed to run completely unprivileged.

There would be one possibility though:

https://passt.top/passt/tree/tap.c?id=5ec3634b07215337c2e69d88f9b1d74711897d7d#n130

query the ARP table (preferably via netlink, i.e. RTM_GETNEIGH) and use the MAC address associated to whatever IP address we're using as source. We should probably have a small (fixed size) cache to avoid a substantial impact on throughput and connection latency, and make this optional. Patches welcome!

[dgibson]

My first thought is that I'm not sure this is really in scope for passt/pasta. Pasta's model is based pretty strongly in an IP-level view of the network, so preserving L2 information like MAC addresses is not a natural fit.

That said, I think @sbrivio-rh 's idea of using ARP lookups to fake this should be pretty solid. If we did that one question is whether pasta should also then do a non-trivial ARP implementation on its simulated link, and essentially pass on ARP requests to the outside. There are some existing cases where we preserve some link-specific information, mostly in regard to IPv6 link local addresses. The way we do that is a bit muddled at the moment, but I do have plans to clean that up (essentially by having two different modes - one which makes the host look like a gateway router to the guest/container, and another which simulates the guest peeking out one specific interface on the host).

In any case, this seems like a fairly niche requirement, so I don't think it's something either I or @sbrivio-rh are likely to work on in the near future.