Re: [PATCH v4 9/9] tcp, udp: Bind outbound listening sockets by interface instead of address

[Stefano Brivio <sbrivio@redhat.com>]

On Fri, 21 Nov 2025 16:24:20 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:

> On Fri, Nov 21, 2025 at 04:56:01AM +0100, Stefano Brivio wrote:
> > The series looks good to me in general, except that:
> > 
> > On Wed, 19 Nov 2025 16:22:57 +1100
> > David Gibson <david@gibson.dropbear.id.au> wrote:
> >   
> > > Currently, outbound forwards (-T, -U) are handled by sockets bound to the
> > > loopback address.  Typically we create two sockets, one for 127.0.0.1 and
> > > one for ::1.
> > > 
> > > This has some disadvantages:
> > >  * The guest can't connect via 127.0.0.0/8 addresses other than 127.0.0.1
> > >  * We can't use dual-stack sockets, we have to have separate sockets for
> > >    IPv4 and IPv6.
> > > 
> > > The restriction exists for a reason though.  If the guest has any
> > > interfaces other than pasta (e.g. a VPN tunnel) external hosts could reach
> > > the host via the forwards.  Especially combined with -T auto / -U auto this
> > > would make it very easy to make a mistake with nasty security implications.
> > > 
> > > We can achieve this a different way, however.  Don't bind to a specific
> > > address, but _do_ use SO_BINDTODEVICE to restrict the sockets to the "lo"
> > > interface.  
> > 
> > ...this means, as I pointed out on:
> > 
> >   https://archives.passt.top/passt-dev/20251022105916.53925523@elisabeth/
> > 
> > that we might break functionality for a number of pasta(1) users.
> > 
> > I don't have a complete version of the SO_BINDTODEVICE fallback I
> > sketched there, so I can't just add one on top of this series at the
> > moment, but we need something like that before I can merge this.  
> 
> Yes, I was intending to make that change, but just forgot.  I'll fix
> this patch and resend.  Are you intending to merge the rest of the
> series, or should I respin it?

I guess it's marginally easier if you respin so that we have a single
link to the series, eventually, and I would run tests on the series as
a whole, not just up to 8/9.

-- 
Stefano