[PATCH 0/4] Translate source addresses for ICMP errors

[David Gibson <david@gibson.dropbear.id.au>]

We now propagate ICMP errors on UDP flows back into ICMP packets on
the tap interface.  However, we don't always get the source address
right for the synthesized message.  Because ICMPs can be generated by
intermediate routers, that source address might not be one of the
endpoints, so the address translation we already have isn't
sufficient.

Implement properly translating ICMP addresses when we need to.  This
ended up a bit messier than I hoped, but it seems to work.  A simple
case to test this is:

	pasta --config-net --map-host-loopback=172.16.1.1 -- \
		sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001"

where 10001 is a port where nothing is listening on the host.

Without this series, this will just time out.  pasta sends an ICMP
Port Unreachable message, but it's sent with source address 127.0.0.1
and so discarded by the guest.  With this series, the address is
properly translated and we correctly get the error from socat:

2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused

David Gibson (4):
  fwd: Split out helpers for port-independent NAT
  treewide: Improve robustness against sockaddrs of unexpected family
  udp: Rework offender address handling in udp_sock_recverr()
  udp: Translate offender addresses for ICMP messages

 flow.c     | 16 ++++++++--
 fwd.c      | 87 ++++++++++++++++++++++++++++++++++++++----------------
 fwd.h      |  3 ++
 inany.h    | 22 +++++++++-----
 tcp.c      | 10 +++----
 udp.c      | 79 +++++++++++++++++++++++++++++++++++--------------
 udp_flow.c |  6 ++--
 7 files changed, 157 insertions(+), 66 deletions(-)

-- 
2.49.0