Re: [PATCH 16/18] conf: Allow user-specified auto-scanned port forwarding ranges

[Stefano Brivio <sbrivio@redhat.com>]

On Tue,  7 Apr 2026 13:16:28 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> The forwarding table now allows for arbitrary port ranges to be marked as
> FWD_SCAN, meaning we don't open sockets for every port, but only those we
> scan as listening on the target side.  However, there's currently no way
> to create such rules, except -[tTuU] auto which always scans every port
> with an unspecified listening address and interface.
> 
> Allow user-specified "auto" ranges by moving the parsing of the "auto"
> keyword from conf_ports(), to conf_ports_spec() as part of the port
> specified.  "auto" can be combined freely with other port ranges, e.g.
>     -t 127.0.0.1/auto
>     -u %lo/5000-7000,auto
>     -T auto,12345
>     -U auto,~1-9000
> 
> Note that any address and interface given only affects where the automatic
> forwards listen, not what addresses we consider when scanning.  That is,
> if the target side is listening on *any* address, we will create a forward
> on the specified address.
> 
> Link: https://bugs.passt.top/show_bug.cgi?id=180
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>  conf.c | 66 ++++++++++++++++++++++++++++++++++++++++++----------------
>  1 file changed, 48 insertions(+), 18 deletions(-)
> 
> diff --git a/conf.c b/conf.c
> index fcc75d25..86c30c7f 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -13,6 +13,7 @@
>   */
>  
>  #include <arpa/inet.h>
> +#include <ctype.h>
>  #include <errno.h>
>  #include <fcntl.h>
>  #include <getopt.h>
> @@ -112,6 +113,28 @@ static int parse_port_range(const char *s, const char **endptr,
>  	return 0;
>  }
>  
> +/**
> + * parse_keyword() - Parse a literal keyword

Here, "parse" sounds overly generic. If I understand this correctly,
it's a strstr() / memmem() implementation with the added 'endptr'
functionality, so maybe... "Find the end of a substring"?

> + * @s:		String to parse
> + * @endptr:	Update to the character after the keyword
> + * @kw:		Keyword to accept
> + *
> + * Return: 0, if @s starts with @kw, -EINVAL if it does not
> + */
> +static int parse_keyword(const char *s, const char **endptr, const char *kw)
> +{
> +	size_t len = strlen(kw);
> +
> +	if (strlen(s) < len)
> +		return -EINVAL;
> +
> +	if (memcmp(s, kw, len))
> +		return -EINVAL;
> +
> +	*endptr = s + len;
> +	return 0;
> +}
> +
>  /**
>   * conf_ports_range_except() - Set up forwarding for a range of ports minus a
>   *                             bitmap of exclusions
> @@ -249,6 +272,7 @@ static void conf_ports_spec(const struct ctx *c,
>  	uint8_t exclude[PORT_BITMAP_SIZE] = { 0 };
>  	bool exclude_only = true;
>  	const char *p, *ep;
> +	uint8_t flags = 0;
>  	unsigned i;
>  
>  	if (!strcmp(spec, "all")) {
> @@ -256,15 +280,32 @@ static void conf_ports_spec(const struct ctx *c,
>  		spec = "";
>  	}
>  
> -	/* Mark all exclusions first, they might be given after base ranges */
> +	/* Parse excluded ranges and "auto" in the first pass */
>  	for_each_chunk(p, ep, spec, ",") {
>  		struct port_range xrange;
>  
> -		if (*p != '~') {
> -			/* Not an exclude range, parse later */
> +		if (isdigit(*p))  {
> +			/* Include range, parse later */
>  			exclude_only = false;
>  			continue;
>  		}
> +
> +		if (parse_keyword(p, &p, "auto") == 0) {
> +			if (p != ep) /* Garbage after the keyword */
> +				goto bad;
> +
> +			if (c->mode != MODE_PASTA) {
> +				die(
> +"'auto' port forwarding is only allowed for pasta");
> +			}
> +
> +			flags |= FWD_SCAN;
> +			continue;
> +		}
> +
> +		/* Should be an exclude range */
> +		if (*p != '~')
> +			goto bad;
>  		p++;
>  
>  		if (parse_port_range(p, &p, &xrange))
> @@ -283,7 +324,7 @@ static void conf_ports_spec(const struct ctx *c,
>  		conf_ports_range_except(c, optname, optarg, fwd,
>  					proto, addr, ifname,
>  					1, NUM_PORTS - 1, exclude,
> -					1, FWD_WEAK);
> +					1, flags | FWD_WEAK);
>  		return;
>  	}
>  
> @@ -291,8 +332,8 @@ static void conf_ports_spec(const struct ctx *c,
>  	for_each_chunk(p, ep, spec, ",") {
>  		struct port_range orig_range, mapped_range;
>  
> -		if (*p == '~')
> -			/* Exclude range, already parsed */
> +		if (!isdigit(*p))
> +			/* Already parsed */
>  			continue;
>  
>  		if (parse_port_range(p, &p, &orig_range))
> @@ -320,7 +361,7 @@ static void conf_ports_spec(const struct ctx *c,
>  					proto, addr, ifname,
>  					orig_range.first, orig_range.last,
>  					exclude,
> -					mapped_range.first, 0);
> +					mapped_range.first, flags);
>  	}
>  
>  	return;
> @@ -366,17 +407,6 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg,
>  	if (proto == IPPROTO_UDP && c->no_udp)
>  		die("UDP port forwarding requested but UDP is disabled");
>  
> -	if (!strcmp(optarg, "auto")) {
> -		if (c->mode != MODE_PASTA)
> -			die("'auto' port forwarding is only allowed for pasta");
> -
> -		conf_ports_range_except(c, optname, optarg, fwd,
> -					proto, NULL, NULL,
> -					1, NUM_PORTS - 1, NULL, 1, FWD_SCAN);
> -
> -		return;
> -	}
> -
>  	strncpy(buf, optarg, sizeof(buf) - 1);
>  
>  	if ((spec = strchr(buf, '/'))) {

The rest of the series looks good to me!

-- 
Stefano