From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=D17k/iBa; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 7AA3D5A0262 for ; Mon, 30 Mar 2026 23:57:31 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774907850; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FPCm0U6w4KEmw5FbQajX7GyF1r1N+WhYTKGwLssSWp0=; b=D17k/iBa6lcuy4RHLttImY855pVk9eD8fMfYbq/IIitvgEO93eMMglwFVl89/wa1anitzM 0nJTbQwbYHmqRWiquHf81kbC19lphGfbNkGZZV5hqomRQCcGD7MH1vuZBbfxt5wuXocbIC CC60+y9B5msP2lY128MvfBtVon+YvUc= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-591-0YTNloetOTCktblejs-Z8Q-1; Mon, 30 Mar 2026 17:57:29 -0400 X-MC-Unique: 0YTNloetOTCktblejs-Z8Q-1 X-Mimecast-MFC-AGG-ID: 0YTNloetOTCktblejs-Z8Q_1774907848 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4839fc4cef6so58135415e9.0 for ; Mon, 30 Mar 2026 14:57:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774907848; x=1775512648; h=date:content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=FPCm0U6w4KEmw5FbQajX7GyF1r1N+WhYTKGwLssSWp0=; b=cJDnXYv/g/WUZhPcRKg65QwQUOGOGgvRwRu3bH+RLtr3PJKULu9DoB0l8xtc9ATaOi rfztMUOe0A5SJJ7j4K03SCLGCLkcmevtOji43VVgKT2nXehFcJtJXnU7WmqPtE8A4/VF SJZmw+AIdw1CxANW+yVZvdxVTpYWrvmrZtA7wqKKgp7g6hpK0VjZ5l2mDuoSSNO5JaeQ Qlhf5ydr2Bbtq/6ynj57j0NIKQ4EelpkFxfyHnV6v/ZqBLgwxzCLMzqBfQL+h12HZ96B YG3sHYvfLEkRU3AIYkRK/Wt5eOeZsjbRNAd/C1b5CeDpkgfvLtoHgiyezVIielkskRda ws0Q== X-Forwarded-Encrypted: i=1; AJvYcCWTgxmsdpoyCmvcToufnm/GXMO0LTxjnCwhLYhKTqQFeS9JO5o8A41jY4l3ajpp1HqyJ9Adjl9kJKI=@passt.top X-Gm-Message-State: AOJu0YxdLtSqx6LzdH/vqrVuzGCFALDtd9PXXFRhMqGc6SnQpA/7c9Wx 5zSnFn2JnFgYH1yce/Xrm8rrQvCPpzjEYYGdW9uiMNf4Jkg5B5TKBb3xhMTtSvd0ea2FkqzzxcN NtMtLwT2AR0y5v0tmmDKbJ5PLs8CCeSnWs4q4U7/dq+q25pXeneNVMC/OvKLCgg== X-Gm-Gg: ATEYQzwDr5jgDzuxHsli/DtJIjrlLW5/aPKdIFoI1HX0ROjGWFzArN5vuxjX4sllm2N 83Pw9qrUvr8g04A1Qi8YtuWy9GJpxmDABFqHCbgjVDBuPggwQeht1sE4avmvC8fE8jzIIapSKw0 G71NNo1oiUpYCjMDZqncZpaA1XGVtaLaDnJSMCBtpH3j7wDmNSqkpvERGhTM/cPoBwD90JrBUD+ XYOVsmO9f/NdlaGiLXKjUcrtxLQANbJOiuLk8Nd6w+9uPxTgZQcFWZYXIU3YTc47onqnqtnJlTd wtIe5rAKPLFLvx/Dj6E8mbwzwbiOFRk+0tAYes4gHqIH4//qIWeK/CnXJpOFZxLru6lMQHxlEHz o/ty6EfOyV9rQXqzF6PQewAAbzICDTepY X-Received: by 2002:a05:600c:1986:b0:486:faa8:9e4 with SMTP id 5b1f17b1804b1-488783a6913mr18579345e9.12.1774907847734; Mon, 30 Mar 2026 14:57:27 -0700 (PDT) X-Received: by 2002:a05:600c:1986:b0:486:faa8:9e4 with SMTP id 5b1f17b1804b1-488783a6913mr18579095e9.12.1774907847277; Mon, 30 Mar 2026 14:57:27 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-487351fb38csm228421055e9.4.2026.03.30.14.57.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 30 Mar 2026 14:57:26 -0700 (PDT) From: Stefano Brivio To: Jon Maloy Subject: Re: [PATCH v6 03/13] fwd: Unify guest accessibility checks with unified address array Message-ID: <20260330235725.6cdea034@elisabeth> In-Reply-To: <20260322004333.365713-4-jmaloy@redhat.com> References: <20260322004333.365713-1-jmaloy@redhat.com> <20260322004333.365713-4-jmaloy@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Mon, 30 Mar 2026 23:57:26 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: PpLg4Mdw_opHIaDRBYYUmqSjNhfHv581FviwZZQ7mPQ_1774907848 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: OJF5RPQUROHYUD6PHTKNBWKLNYSRUTD7 X-Message-ID-Hash: OJF5RPQUROHYUD6PHTKNBWKLNYSRUTD7 X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: david@gibson.dropbear.id.au, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Sat, 21 Mar 2026 20:43:23 -0400 Jon Maloy wrote: > We replace the fwd_guest_accessible4() and fwd_guest_accessible6() > functions with a unified fwd_guest_accessible() function that handles > both address families. With the unified address array, we can check > all configured addresses in a single pass using for_each_addr() with > family filter AF_UNSPEC. > > Signed-off-by: Jon Maloy > > --- > v6: -Some fixes based on feedback from David Gibson > --- > fwd.c | 69 ++++++++++++++--------------------------------------------- > 1 file changed, 16 insertions(+), 53 deletions(-) > > diff --git a/fwd.c b/fwd.c > index 9101d6d..695b5a5 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -991,19 +991,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini) > } > > /** > - * fwd_guest_accessible4() - Is IPv4 address guest-accessible > + * fwd_guest_accessible() - Is address guest-accessible > * @c: Execution context > - * @addr: Host visible IPv4 address > + * @addr: Host visible address (IPv4 or IPv6) > * > * Return: true if @addr on the host is accessible to the guest without > * translation, false otherwise > */ > -static bool fwd_guest_accessible4(const struct ctx *c, > - const struct in_addr *addr) > +static bool fwd_guest_accessible(const struct ctx *c, > + const union inany_addr *addr) > { > - const struct guest_addr *a = fwd_get_addr(c, AF_INET, 0, 0); > + const struct guest_addr *a; > > - if (IN4_IS_ADDR_LOOPBACK(addr)) > + if (inany_is_loopback(addr)) > return false; > > /* In socket interfaces 0.0.0.0 generally means "any" or unspecified, > @@ -1011,36 +1011,18 @@ static bool fwd_guest_accessible4(const struct ctx *c, > * that has a different meaning for host and guest, we can't let it > * through untranslated. > */ > - if (IN4_IS_ADDR_UNSPECIFIED(addr)) > + if (inany_is_unspecified(addr)) > return false; > > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > - * address > - */ > - if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) || > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > - return false; > - > - return true; > -} > - > -/** > - * fwd_guest_accessible6() - Is IPv6 address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv6 address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible6(const struct ctx *c, > - const struct in6_addr *addr) > -{ > - const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0); > - > - if (IN6_IS_ADDR_LOOPBACK(addr)) > - return false; > + /* Check against all configured guest addresses */ > + for_each_addr(a, c, AF_UNSPEC) Nit: by convention (inspired by the "net" Linux kernel coding style), blocks with more than one line are surrounded by curly brackets even if otherwise unnecessary. > + if (inany_equals(addr, &a->addr)) > + return false; > > - if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6)) > + /* Also check addr_seen: it tracks the address the guest is actually > + * using, which may differ from configured addresses. > + */ > + if (inany_equals4(addr, &c->ip4.addr_seen)) > return false; > > /* For IPv6, addr_seen starts unspecified, because we don't know what LL > @@ -1048,31 +1030,12 @@ static bool fwd_guest_accessible6(const struct ctx *c, > * if it has been set to a real address. > */ > if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) && > - IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen)) > + inany_equals6(addr, &c->ip6.addr_seen)) > return false; > > return true; > } > > -/** > - * fwd_guest_accessible() - Is IPv[46] address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv[46] address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible(const struct ctx *c, > - const union inany_addr *addr) > -{ > - const struct in_addr *a4 = inany_v4(addr); > - > - if (a4) > - return fwd_guest_accessible4(c, a4); > - > - return fwd_guest_accessible6(c, &addr->a6); > -} > - > /** > * nat_outbound() - Apply address translation for outbound (TAP to HOST) > * @c: Execution context -- Stefano