Re: [PATCH v2 0/4] Translate source addresses for ICMP errors

[Stefano Brivio <sbrivio@redhat.com>]

On Thu, 17 Apr 2025 11:55:39 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> We now propagate ICMP errors on UDP flows back into ICMP packets on
> the tap interface.  However, we don't always get the source address
> right for the synthesized message.  Because ICMPs can be generated by
> intermediate routers, that source address might not be one of the
> endpoints, so the address translation we already have isn't
> sufficient.
> 
> Implement properly translating ICMP addresses when we need to.  This
> ended up a bit messier than I hoped, but it seems to work.  A simple
> case to test this is:
> 
> 	pasta --config-net --map-host-loopback=172.16.1.1 -- \
> 		sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001"
> 
> where 10001 is a port where nothing is listening on the host.
> 
> Without this series, this will just time out.  pasta sends an ICMP
> Port Unreachable message, but it's sent with source address 127.0.0.1
> and so discarded by the guest.  With this series, the address is
> properly translated and we correctly get the error from socat:
> 
> 2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused
> 
> v2:
>  * Fix a (bogus) coverity warning
>  * Minor cosmetic changes based on Stefano's review

Applied.

-- 
Stefano