From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=Mrvzd+DQ; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 78CCF5A0624 for ; Thu, 15 Jan 2026 09:50:53 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1768467049; bh=lpbM5sG/bvMsoeWmbhUPRgjrV47YxfbnCVFDsR8o8Fo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mrvzd+DQUqRnHR/r9/IU99IS+EclrcNxRYhnJXQYXzfBaCp1bDNaGIuThRKCj9HCq qiWrfzOS+t+c9v94QwR67keH/niSv8N7uuqmQfNrVR71HYTZ4UPwF13Qp8x6LmDV6U sVwKA2KqDDo8imr8ewiT8lAl9yz2tA9EaUmMiOELA3/Ah3K3ZGY8o28071ojGrt7I6 Mcq2YdLM2WOidbNBi+QGiR37BsdSRpUMJWNmYZfTjxeIPdTtXtdcD5lNx4WDW9TOD7 Om/JsBkAOfCCPA/gDzu0KMbF9eykB2K60numo9DtShyVsFa5oy/xZ+nPBCvx9rkhq4 UED0NVsLjYddA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dsGsj35RLz4wMF; Thu, 15 Jan 2026 19:50:49 +1100 (AEDT) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH v4 03/14] conf: Accurately record ifname and address for outbound forwards Date: Thu, 15 Jan 2026 19:50:34 +1100 Message-ID: <20260115085045.3309818-4-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115085045.3309818-1-david@gibson.dropbear.id.au> References: <20260115085045.3309818-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: VMHZQKDW6GTTQJ6BFLYF4LDPG7EYFDOU X-Message-ID-Hash: VMHZQKDW6GTTQJ6BFLYF4LDPG7EYFDOU X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: -T and -U options don't allow specifying a listening address. Usually this will listen on *%lo in the guest. However on kernels without unprivileged SO_BINDTODEVICE that's not possible so we instead listen separately on 127.0.0.1 and ::1. Currently that's handled at the point we actually set up the listens, we record both address and ifname as NULL in the forwarding table entry. That will cause trouble for future extensions we want, so update this to accurately create the forwarding table: either a single rule with ifname == "lo" or two rules with addresses of 127.0.0.1 and ::1. As a bonus, this gives the user a warning if they specify an explicit outbound forwarding on a kernel without SO_BINDTODEVICE. The existing warning for missing SO_BINDTODEVICE incorrectly covered only the case of -T auto or -U auto. Signed-off-by: David Gibson --- conf.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 7ad09469..475dbe04 100644 --- a/conf.c +++ b/conf.c @@ -157,12 +157,6 @@ static void conf_ports_range_except(const struct ctx *c, char optname, optname, optarg); } - if (ifname && c->no_bindtodevice) { - die( -"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", - optname, optarg); - } - if (addr) { if (!c->ifi4 && inany_v4(addr)) { die("IPv4 is disabled, can't use -%c %s", @@ -209,8 +203,27 @@ static void conf_ports_range_except(const struct ctx *c, char optname, } } - fwd_rule_add(fwd, flags, addr, ifname, base, i - 1, - base + delta); + if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { + /* FIXME: Once the fwd bitmaps are removed, move this + * workaround to the caller + */ + ASSERT(!addr && ifname && !strcmp(ifname, "lo")); + warn( +"SO_BINDTODEVICE unavailable, forwarding only 127.0.0.1 and ::1 for '-%c %s'", + optname, optarg); + + if (c->ifi4) { + fwd_rule_add(fwd, flags, &inany_loopback4, NULL, + base, i - 1, base + delta); + } + if (c->ifi6) { + fwd_rule_add(fwd, flags, &inany_loopback6, NULL, + base, i - 1, base + delta); + } + } else { + fwd_rule_add(fwd, flags, addr, ifname, + base, i - 1, base + delta); + } base = i - 1; } @@ -357,6 +370,15 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, } } while ((p = next_chunk(p, ','))); + if (ifname && c->no_bindtodevice) { + die( +"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", + optname, optarg); + } + /* Outbound forwards come from guest loopback */ + if ((optname == 'T' || optname == 'U') && !ifname) + ifname = "lo"; + if (exclude_only) { /* Exclude ephemeral ports */ for (i = 0; i < NUM_PORTS; i++) -- 2.52.0