[PATCH] tap: Don't update ip6.addr_seen to ::

[PATCH] tap: Don't update ip6.addr_seen to ::

[David Gibson]

When we receive packets from the tap side, we update the addr_seen fields
to reflect the last known address of the guest or ns.  For ip4.addr_seen
we, sensibly, only update if the address we've just seen isn't 0 (0.0.0.0).
This case can occur during early DHCP transactions.

We have no equivalent case for IPv6.  We're less likely to hit this,
because DHCPv6 uses link-local addresses, however we can see an source
address of :: with certain multicast operations.  This can bite us if we
try to make an incoming connection very early after starting pasta with
--config-net: we may have only seen some of those multicast packets,
updated addr_seen to :: and not had any "real" packets to update it to a
global address.  I've seen this with some of the avocado test conversions.

In any case, it can never make sense to update addr_seen to ::, so
explicitly exclude that case.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 tap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tap.c b/tap.c
index faa4e26..c0b7f33 100644
--- a/tap.c
+++ b/tap.c
@@ -739,7 +739,7 @@ resume:
 			if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) {
 				c->ip6.addr_seen = *saddr;
 			}
-		} else {
+		} else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){
 			c->ip6.addr_seen = *saddr;
 		}
 
-- 
@@ -739,7 +739,7 @@ resume:
 			if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) {
 				c->ip6.addr_seen = *saddr;
 			}
-		} else {
+		} else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){
 			c->ip6.addr_seen = *saddr;
 		}
 
-- 
2.40.1

Re: [PATCH] tap: Don't update ip6.addr_seen to ::

[Stefano Brivio]

On Tue, 16 May 2023 10:36:11 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> When we receive packets from the tap side, we update the addr_seen fields
> to reflect the last known address of the guest or ns.  For ip4.addr_seen
> we, sensibly, only update if the address we've just seen isn't 0 (0.0.0.0).
> This case can occur during early DHCP transactions.
> 
> We have no equivalent case for IPv6.  We're less likely to hit this,
> because DHCPv6 uses link-local addresses, however we can see an source
> address of :: with certain multicast operations.  This can bite us if we
> try to make an incoming connection very early after starting pasta with
> --config-net: we may have only seen some of those multicast packets,
> updated addr_seen to :: and not had any "real" packets to update it to a
> global address.  I've seen this with some of the avocado test conversions.

It looks like I haven't stared at enough packet captures yet...

> In any case, it can never make sense to update addr_seen to ::, so
> explicitly exclude that case.
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>

Applied.

-- 
Stefano