Add rootless_port_forwarder option to select port forwarding backend

Fixes: https://redhat.atlassian.net/browse/RUN-2214
Fixes: podman-container-tools/podman#8193
Fixes: https://redhat.atlassian.net/browse/RUN-3587

Signed-off-by: Jan Rodák <hony.com@seznam.cz>

Author: Honny1

common/pkg/config/config.go

@@ -630,6 +630,12 @@ type NetworkConfig struct {
 	// If multiple IPs are specified, separate port mapping for each of the specified
 	// IP would be created.
 	DefaultHostIPs configfile.Slice `toml:"default_host_ips,omitempty"`
+
+	// RootlessPortForwarder selects the port forwarding mechanism for rootless
+	// bridge networks. "rootlessport" (default) uses a userspace TCP/UDP proxy.
+	// "pasta" (experimental) uses pasta's kernel splice for forwarding, which
+	// preserves the original source IP address inside the container.
+	RootlessPortForwarder string `toml:"rootless_port_forwarder,omitempty"`
 }
 
 type SubnetPool struct {
@@ -933,6 +939,12 @@ func (c *NetworkConfig) Validate() error {
 		}
 	}
 
+	switch c.RootlessPortForwarder {
+	case "", "rootlessport", "pasta":
+	default:
+		return fmt.Errorf("invalid rootless_port_forwarder value %q, must be \"rootlessport\" or \"pasta\"", c.RootlessPortForwarder)
+	}
+
 	return nil
 }
 

common/pkg/config/default.go

@@ -249,6 +249,7 @@ func defaultConfig() (*Config, error) {
 			DefaultRootlessNetworkCmd: "pasta",
 			DNSBindPort:               0,
 			NetavarkPluginDirs:        configfile.NewSlice(DefaultNetavarkPluginDirs),
+			RootlessPortForwarder:     "rootlessport",
 		},
 		Engine:   *defaultEngineConfig,
 		Secrets:  defaultSecretConfig(),