[PATCH v4 04/14] conf, fwd: Record "auto" port forwards in forwarding table

[David Gibson <david@gibson.dropbear.id.au>]

Currently the forwarding table records details of explicit port forwards,
but nothing for -[tTuU] auto.  That looks a little odd on the debug output,
and will be a problem for future changes.

Extend the forward table to have rules for auto-scanned forwards,
using a new FWD_SCAN flag.  For now the mechanism of auto port
forwarding isn't updated, and we will only create a single FWD_SCAN
rule per protocol and direction.  We'll better integrate auto scanning
with other forward table mechanics in future.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
 conf.c | 31 ++++++++++++++++++++++++++-----
 fwd.c  | 21 +++++++++++++--------
 fwd.h  |  2 ++
 3 files changed, 41 insertions(+), 13 deletions(-)

diff --git a/conf.c b/conf.c
index 475dbe04..fb6a8118 100644
--- a/conf.c
+++ b/conf.c
@@ -135,7 +135,7 @@ static int parse_port_range(const char *s, char **endptr,
  * @ifname:	Listening interface
  * @first:	First port to forward
  * @last:	Last port to forward
- * @exclude:	Bitmap of ports to exclude
+ * @exclude:	Bitmap of ports to exclude (may be NULL)
  * @to:		Port to translate @first to when forwarding
  * @flags:	Flags for forwarding entries
  */
@@ -168,11 +168,11 @@ static void conf_ports_range_except(const struct ctx *c, char optname,
 	}
 
 	for (base = first; base <= last; base++) {
-		if (bitmap_isset(exclude, base))
+		if (exclude && bitmap_isset(exclude, base))
 			continue;
 
 		for (i = base; i <= last; i++) {
-			if (bitmap_isset(exclude, i))
+			if (exclude && bitmap_isset(exclude, i))
 				break;
 
 			if (bitmap_isset(fwd->map, i)) {
@@ -180,9 +180,9 @@ static void conf_ports_range_except(const struct ctx *c, char optname,
 "Altering mapping of already mapped port number: %s", optarg);
 			}
 
-			if (optname == 't')
+			if (!(flags & FWD_SCAN) && optname == 't')
 				fd = tcp_listen(c, PIF_HOST, addr, ifname, i);
-			else if (optname == 'u')
+			else if (!(flags & FWD_SCAN) && optname == 'u')
 				fd = udp_listen(c, PIF_HOST, addr, ifname, i);
 			else
 				/* No way to check in advance for -T and -U */
@@ -2200,6 +2200,27 @@ void conf(struct ctx *c, int argc, char **argv)
 	if (!c->udp.fwd_out.mode)
 		c->udp.fwd_out.mode = fwd_default;
 
+	if (c->tcp.fwd_in.mode == FWD_AUTO) {
+		conf_ports_range_except(c, 't', "auto", &c->tcp.fwd_in,
+					NULL, NULL, 1, NUM_PORTS - 1,
+					NULL, 1, FWD_SCAN);
+	}
+	if (c->tcp.fwd_out.mode == FWD_AUTO) {
+		conf_ports_range_except(c, 'T', "auto", &c->tcp.fwd_out,
+					NULL, "lo", 1, NUM_PORTS - 1,
+					NULL, 1, FWD_SCAN);
+	}
+	if (c->udp.fwd_in.mode == FWD_AUTO) {
+		conf_ports_range_except(c, 'u', "auto", &c->udp.fwd_in,
+					NULL, NULL, 1, NUM_PORTS - 1,
+					NULL, 1, FWD_SCAN);
+	}
+	if (c->udp.fwd_out.mode == FWD_AUTO) {
+		conf_ports_range_except(c, 'U', "auto", &c->udp.fwd_out,
+					NULL, "lo", 1, NUM_PORTS - 1,
+					NULL, 1, FWD_SCAN);
+	}
+
 	if (!c->quiet)
 		conf_print(c);
 }
diff --git a/fwd.c b/fwd.c
index e80312fb..588bf24a 100644
--- a/fwd.c
+++ b/fwd.c
@@ -345,7 +345,7 @@ void fwd_rule_add(struct fwd_ports *fwd, uint8_t flags,
 		  in_port_t first, in_port_t last, in_port_t to)
 {
 	/* Flags which can be set from the caller */
-	const uint8_t allowed_flags = FWD_WEAK;
+	const uint8_t allowed_flags = FWD_WEAK | FWD_SCAN;
 	struct fwd_rule *new;
 	unsigned port;
 
@@ -379,7 +379,8 @@ void fwd_rule_add(struct fwd_ports *fwd, uint8_t flags,
 
 	for (port = new->first; port <= new->last; port++) {
 		/* Fill in the legacy data structures to match the table */
-		bitmap_set(fwd->map, port);
+		if (!(new->flags & FWD_SCAN))
+			bitmap_set(fwd->map, port);
 		fwd->delta[port] = new->to - new->first;
 	}
 }
@@ -395,21 +396,25 @@ void fwd_rules_print(const struct fwd_ports *fwd)
 	for (i = 0; i < fwd->count; i++) {
 		const struct fwd_rule *rule = &fwd->rules[i];
 		const char *percent = *rule->ifname ? "%" : "";
+		const char *weak = "", *scan = "";
 		char addr[INANY_ADDRSTRLEN];
-		const char *weak = "";
 
 		inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr));
 		if (rule->flags & FWD_WEAK)
 			weak = " (best effort)";
+		if (rule->flags & FWD_SCAN)
+			scan = " (auto-scan)";
 
 		if (rule->first == rule->last) {
-			info("    [%s]%s%s:%hu  =>  %hu %s",
+			info("    [%s]%s%s:%hu  =>  %hu %s%s",
 			     addr, percent, rule->ifname,
-			     rule->first, rule->to, weak);
+			     rule->first, rule->to, weak, scan);
 		} else {
-			info("    [%s]%s%s:%hu-%hu  =>  %hu-%hu %s",
-			     addr, percent, rule->ifname, rule->first, rule->last,
-			     rule->to, rule->last - rule->first + rule->to, weak);
+			info("    [%s]%s%s:%hu-%hu  =>  %hu-%hu %s%s",
+			     addr, percent, rule->ifname,
+			     rule->first, rule->last,
+			     rule->to, rule->last - rule->first + rule->to,
+			     weak, scan);
 		}
 	}
 }
diff --git a/fwd.h b/fwd.h
index d2a59c15..cc7e0aca 100644
--- a/fwd.h
+++ b/fwd.h
@@ -26,6 +26,7 @@ bool fwd_port_is_ephemeral(in_port_t port);
  * @flags:	Flag mask
  * 	FWD_DUAL_STACK_ANY - match any IPv4 or IPv6 address (@addr should be ::)
  *	FWD_WEAK - Don't give an error if binds fail for some forwards
+ *	FWD_SCAN - Only forward if the matching port in the target is listening
  *
  * FIXME: @addr and @ifname currently ignored for outbound tables
  */
@@ -37,6 +38,7 @@ struct fwd_rule {
 	in_port_t to;
 #define FWD_DUAL_STACK_ANY	BIT(0)
 #define FWD_WEAK		BIT(1)
+#define FWD_SCAN		BIT(2)
 	uint8_t flags;
 };
 
-- 
2.52.0