Re: [PATCH 16/18] conf: Allow user-specified auto-scanned port forwarding ranges

Stefano Brivio
2026-04-08T21:40:47Z

On Tue, 7 Apr 2026 13:16:28 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> The forwarding table now allows for arbitrary port ranges to be marked as
> FWD_SCAN, meaning we don't open sockets for every port, but only those we
> scan as listening on the target side. However, there's currently no way
> to create such rules, except -[tTuU] auto which always scans every port
> with an unspecified listening address and interface.
>
> Allow user-specified "auto" ranges by moving the parsing of the "auto"
> keyword from conf_ports(), to conf_ports_spec() as part of the port
> specified. "auto" can be combined freely with other port ranges, e.g.
> -t 127.0.0.1/auto
> -u %lo/5000-7000,auto
> -T auto,12345
> -U auto,~1-9000
>
> Note that any address and interface given only affects where the automatic
> forwards listen, not what addresses we consider when scanning. That is,
> if the target side is listening on *any* address, we will create a forward
> on the specified address.
>
> Link: https://bugs.passt.top/show_bug.cgi?id=180
>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
> conf.c | 66 ++++++++++++++++++++++++++++++++++++++++++----------------
> 1 file changed, 48 insertions(+), 18 deletions(-)
>
> diff --git a/conf.c b/conf.c
> index fcc75d25..86c30c7f 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -13,6 +13,7 @@
> */
>
> #include <arpa/inet.h>
> +#include <ctype.h>
> #include <errno.h>
> #include <fcntl.h>
> #include <getopt.h>
> @@ -112,6 +113,28 @@ static int parse_port_range(const char *s, const char **endptr,
> return 0;
> }
>
> +/**
> + * parse_keyword() - Parse a literal keyword

Here, "parse" sounds overly generic. If I understand this correctly,
it's a strstr() / memmem() implementation with the added 'endptr'
functionality, so maybe... "Find the end of a substring"?

> + * @s: String to parse
> + * @endptr: Update to the character after the keyword
> + * @kw: Keyword to accept
> + *
> + * Return: 0, if @s starts with @kw, -EINVAL if it does not
> + */
> +static int parse_keyword(const char *s, const char **endptr, const char *kw)
> +{
> + size_t len = strlen(kw);
> +
> + if (strlen(s) < len)
> + return -EINVAL;
> +
> + if (memcmp(s, kw, len))
> + return -EINVAL;
> +
> + *endptr = s + len;
> + return 0;
> +}
> +
> /**
> * conf_ports_range_except() - Set up forwarding for a range of ports minus a
> * bitmap of exclusions
> @@ -249,6 +272,7 @@ static void conf_ports_spec(const struct ctx *c,
> uint8_t exclude[PORT_BITMAP_SIZE] = { 0 };
> bool exclude_only = true;
> const char *p, *ep;
> + uint8_t flags = 0;
> unsigned i;
>
> if (!strcmp(spec, "all")) {
> @@ -256,15 +280,32 @@ static void conf_ports_spec(const struct ctx *c,
> spec = "";
> }
>
> - /* Mark all exclusions first, they might be given after base ranges */
> + /* Parse excluded ranges and "auto" in the first pass */
> for_each_chunk(p, ep, spec, ",") {
> struct port_range xrange;
>
> - if (*p != '~') {
> - /* Not an exclude range, parse later */
> + if (isdigit(*p)) {
> + /* Include range, parse later */
> exclude_only = false;
> continue;
> }
> +
> + if (parse_keyword(p, &p, "auto") == 0) {
> + if (p != ep) /* Garbage after the keyword */
> + goto bad;
> +
> + if (c->mode != MODE_PASTA) {
> + die(
> +"'auto' port forwarding is only allowed for pasta");
> + }
> +
> + flags |= FWD_SCAN;
> + continue;
> + }
> +
> + /* Should be an exclude range */
> + if (*p != '~')
> + goto bad;
> p++;
>
> if (parse_port_range(p, &p, &xrange))
> @@ -283,7 +324,7 @@ static void conf_ports_spec(const struct ctx *c,
> conf_ports_range_except(c, optname, optarg, fwd,
> proto, addr, ifname,
> 1, NUM_PORTS - 1, exclude,
> - 1, FWD_WEAK);
> + 1, flags | FWD_WEAK);
> return;
> }
>
> @@ -291,8 +332,8 @@ static void conf_ports_spec(const struct ctx *c,
> for_each_chunk(p, ep, spec, ",") {
> struct port_range orig_range, mapped_range;
>
> - if (*p == '~')
> - /* Exclude range, already parsed */
> + if (!isdigit(*p))
> + /* Already parsed */
> continue;
>
> if (parse_port_range(p, &p, &orig_range))
> @@ -320,7 +361,7 @@ static void conf_ports_spec(const struct ctx *c,
> proto, addr, ifname,
> orig_range.first, orig_range.last,
> exclude,
> - mapped_range.first, 0);
> + mapped_range.first, flags);
> }
>
> return;
> @@ -366,17 +407,6 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg,
> if (proto == IPPROTO_UDP && c->no_udp)
> die("UDP port forwarding requested but UDP is disabled");
>
> - if (!strcmp(optarg, "auto")) {
> - if (c->mode != MODE_PASTA)
> - die("'auto' port forwarding is only allowed for pasta");
> -
> - conf_ports_range_except(c, optname, optarg, fwd,
> - proto, NULL, NULL,
> - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN);
> -
> - return;
> - }
> -
> strncpy(buf, optarg, sizeof(buf) - 1);
>
> if ((spec = strchr(buf, '/'))) {

The rest of the series looks good to me!

--
Stefano