pesto: integrate port forwarding into netavark Setup/Teardown with state tracking

Fixes: podman-container-tools/podman#28769

Signed-off-by: Jan Rodák <hony.com@seznam.cz>

Author: Honny1

common/libnetwork/internal/rootlessnetns/netns_freebsd.go

@@ -35,3 +35,9 @@ func (n *Netns) Info() *types.RootlessNetnsInfo {
 func (n *Netns) PestoSocketPath() string {
 	return ""
 }
+
+func (n *Netns) PestoAddrStatePath(containerID string) string {
+	return ""
+}
+
+func (n *Netns) WipePestoAddrState() {}

common/libnetwork/internal/rootlessnetns/netns_linux.go

@@ -132,6 +132,9 @@ func (n *Netns) getOrCreateNetns() (netns.NetNS, bool, error) {
 			logrus.Warnf("failed to read rootless netns program pid: %v", err)
 		}
 		// In case of errors continue and setup the network cmd again.
+		// Wipe per-container pesto address state so that Setup() will
+		// re-publish port mappings after pasta is restarted.
+		n.WipePestoAddrState()
 	} else {
 		// Special case, the file might exist already but is not a valid netns.
 		// One reason could be that a previous setup was killed between creating
@@ -634,6 +637,28 @@ func (n *Netns) PestoSocketPath() string {
 	return n.getPath(pestoSocketFile)
 }
 
+// PestoAddrStatePath returns the path to the per-container pesto address
+// state file, used to track which container IPs are active for port forwarding.
+func (n *Netns) PestoAddrStatePath(containerID string) string {
+	return n.getPath("pesto-addrs-" + containerID + ".json")
+}
+
+// WipePestoAddrState removes all pesto address state files from the rootless
+// netns directory. Called after pasta is restarted so that stale state from
+// the previous pasta process doesn't prevent Setup from re-publishing ports.
+func (n *Netns) WipePestoAddrState() {
+	matches, err := filepath.Glob(n.getPath("pesto-addrs-*.json"))
+	if err != nil {
+		logrus.Warnf("pesto: failed to glob addr state files: %v", err)
+		return
+	}
+	for _, f := range matches {
+		if err := os.Remove(f); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			logrus.Warnf("pesto: failed to remove stale addr state %s: %v", f, err)
+		}
+	}
+}
+
 func refCount(dir string, inc int) (int, error) {
 	file := filepath.Join(dir, refCountFile)
 	content, err := os.ReadFile(file)

common/libnetwork/netavark/network.go

@@ -73,10 +73,13 @@ type netavarkNetwork struct {
 	rootlessNetns *rootlessnetns.Netns
 
 	// rootlessPortForwarder is the value of config.RootlessPortForwarder from
-	// containers.conf. When set to config.RootlessPortForwarderPasta, HostIP
-	// is stripped from port mappings before passing to netavark because pasta's
-	// splice changes the destination IP.
+	// containers.conf. When set to config.RootlessPortForwarderPasta, pesto
+	// handles port forwarding directly and netavark DNAT rules are skipped.
 	rootlessPortForwarder string
+
+	// config is the containers.conf config, needed for FindHelperBinary
+	// when invoking pesto for dynamic port forwarding.
+	config *config.Config
 }
 
 type InitConfig struct {
@@ -167,6 +170,7 @@ func NewNetworkInterface(conf *InitConfig) (types.ContainerNetwork, error) {
 		syslog:                conf.Syslog,
 		rootlessNetns:         netns,
 		rootlessPortForwarder: conf.Config.Network.RootlessPortForwarder,
+		config:                conf.Config,
 	}
 
 	return n, nil

common/libnetwork/netavark/pesto_state.go

@@ -0,0 +1,138 @@
+//go:build linux || freebsd
+
+package netavark
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"sort"
+
+	"go.podman.io/common/libnetwork/types"
+)
+
+// pestoAddrState tracks which container IPs are currently used for pesto
+// port forwarding. Stored as a per-container JSON file in the rootless
+// netns directory so connect/disconnect operations can detect whether
+// ports are already published and remap when necessary.
+type pestoAddrState struct {
+	ActiveIPv4        string                     `json:"active_ipv4,omitempty"`
+	ActiveIPv4Network string                     `json:"active_ipv4_network,omitempty"`
+	ActiveIPv6        string                     `json:"active_ipv6,omitempty"`
+	ActiveIPv6Network string                     `json:"active_ipv6_network,omitempty"`
+	NetworkIPs        map[string]pestoNetworkIPs `json:"network_ips"`
+}
+
+// pestoNetworkIPs holds the first IPv4 and IPv6 address assigned to a
+// container on a specific network.
+type pestoNetworkIPs struct {
+	IPv4 string `json:"ipv4,omitempty"`
+	IPv6 string `json:"ipv6,omitempty"`
+}
+
+func readPestoAddrState(path string) (*pestoAddrState, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	var state pestoAddrState
+	if err := json.Unmarshal(data, &state); err != nil {
+		return nil, err
+	}
+	return &state, nil
+}
+
+func writePestoAddrState(path string, state *pestoAddrState) error {
+	data, err := json.Marshal(state)
+	if err != nil {
+		return err
+	}
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, data, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, path)
+}
+
+func removePestoAddrState(path string) {
+	_ = os.Remove(path)
+}
+
+// containerIPsPerNetwork extracts the first IPv4 and IPv6 from each network
+// in the StatusBlock result. The map is keyed by network name.
+func containerIPsPerNetwork(result map[string]types.StatusBlock) map[string]pestoNetworkIPs {
+	out := make(map[string]pestoNetworkIPs, len(result))
+	for netName, status := range result {
+		var ips pestoNetworkIPs
+		for _, netInt := range status.Interfaces {
+			for _, netAddr := range netInt.Subnets {
+				if netAddr.IPNet.IP.To4() != nil {
+					if ips.IPv4 == "" {
+						ips.IPv4 = netAddr.IPNet.IP.String()
+					}
+				} else if ips.IPv6 == "" {
+					ips.IPv6 = netAddr.IPNet.IP.String()
+				}
+			}
+		}
+		out[netName] = ips
+	}
+	return out
+}
+
+// sortedNetworkNames returns the keys of a pestoNetworkIPs map in sorted
+// order so that IP selection is deterministic across runs.
+func sortedNetworkNames(m map[string]pestoNetworkIPs) []string {
+	names := make([]string, 0, len(m))
+	for name := range m {
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names
+}
+
+// firstIPsWithNetwork picks the first IPv4 and IPv6 from the network IPs
+// map (sorted by network name), returning the IP and the owning network.
+func firstIPsWithNetwork(netIPs map[string]pestoNetworkIPs) (ipv4, ipv4Net, ipv6, ipv6Net string) {
+	for _, name := range sortedNetworkNames(netIPs) {
+		ips := netIPs[name]
+		if ipv4 == "" && ips.IPv4 != "" {
+			ipv4 = ips.IPv4
+			ipv4Net = name
+		}
+		if ipv6 == "" && ips.IPv6 != "" {
+			ipv6 = ips.IPv6
+			ipv6Net = name
+		}
+		if ipv4 != "" && ipv6 != "" {
+			break
+		}
+	}
+	return
+}
+
+// firstIPv4FromState picks the first available IPv4 from the remaining
+// NetworkIPs in the state (sorted by network name for determinism).
+func firstIPv4FromState(state *pestoAddrState) (ip, network string) {
+	for _, name := range sortedNetworkNames(state.NetworkIPs) {
+		if v4 := state.NetworkIPs[name].IPv4; v4 != "" {
+			return v4, name
+		}
+	}
+	return "", ""
+}
+
+// firstIPv6FromState picks the first available IPv6 from the remaining
+// NetworkIPs in the state (sorted by network name for determinism).
+func firstIPv6FromState(state *pestoAddrState) (ip, network string) {
+	for _, name := range sortedNetworkNames(state.NetworkIPs) {
+		if v6 := state.NetworkIPs[name].IPv6; v6 != "" {
+			return v6, name
+		}
+	}
+	return "", ""
+}