From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202602 header.b=cRiz3rzr; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id CD4C95A065B for ; Fri, 10 Apr 2026 03:03:24 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202602; t=1775782993; bh=1n1s+b/juEAYEPFh+uW9+T2XBcz2mKNRmsNUrKtzwf4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cRiz3rzrFwpg0/re/Vg3lTPqKgEHIB/+2X/zEMHrxjr5GYwN93YkondKWIYzMINpn u2trKC4Z6B2dNj/eExFYH7EiBCu8R2v+wikbasnN0RShvd+el/KFxkXNkC48A39m8O VVLBDFc6Ly08kyFl4m0dSHFrKm3GWzrjZjTz6LEL5x8ZnddYazE3zA0Rb6duZDc0I2 qFs1xTMxG5O3ZOpwHR/YuAgw3BAvTbXtpxWyz/PlPLlKN7eXwHFQBoaTuS4qjDBrBu SGx/aPCsEYCPBbLiECV3ufvS59rlnIXwjxrZQ30M/zFRr3mf6xZ53betg0NfnZg9f8 tTcH+rM83dhTQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4fsJSx15WLz4wsQ; Fri, 10 Apr 2026 11:03:13 +1000 (AEST) From: David Gibson To: passt-dev@passt.top, Stefano Brivio Subject: [PATCH v2 17/23] conf: Allow user-specified auto-scanned port forwarding ranges Date: Fri, 10 Apr 2026 11:03:03 +1000 Message-ID: <20260410010309.736855-18-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260410010309.736855-1-david@gibson.dropbear.id.au> References: <20260410010309.736855-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: YWE5XV7L3ND3FTEN5VNDDVCUYMDX4WWI X-Message-ID-Hash: YWE5XV7L3ND3FTEN5VNDDVCUYMDX4WWI X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The forwarding table now allows for arbitrary port ranges to be marked as FWD_SCAN, meaning we don't open sockets for every port, but only those we scan as listening on the target side. However, there's currently no way to create such rules, except -[tTuU] auto which always scans every port with an unspecified listening address and interface. Allow user-specified "auto" ranges by moving the parsing of the "auto" keyword from conf_ports(), to conf_ports_spec() as part of the port specified. "auto" can be combined freely with other port ranges, e.g. -t 127.0.0.1/auto -u %lo/5000-7000,auto -T auto,12345 -U auto,~1-9000 Note that any address and interface given only affects where the automatic forwards listen, not what addresses we consider when scanning. That is, if the target side is listening on *any* address, we will create a forward on the specified address. Link: https://bugs.passt.top/show_bug.cgi?id=180 Signed-off-by: David Gibson --- conf.c | 85 ++++++++++++++++++++++++++++++++++++++++++--------------- passt.1 | 30 ++++++++++++++------ 2 files changed, 85 insertions(+), 30 deletions(-) diff --git a/conf.c b/conf.c index f62109b5..8e3b4b20 100644 --- a/conf.c +++ b/conf.c @@ -13,6 +13,7 @@ */ #include +#include #include #include #include @@ -112,6 +113,28 @@ static int parse_port_range(const char *s, const char **endptr, return 0; } +/** + * parse_keyword() - Parse a literal keyword + * @s: String to parse + * @endptr: Update to the character after the keyword + * @kw: Keyword to accept + * + * Return: 0, if @s starts with @kw, -EINVAL if it does not + */ +static int parse_keyword(const char *s, const char **endptr, const char *kw) +{ + size_t len = strlen(kw); + + if (strlen(s) < len) + return -EINVAL; + + if (memcmp(s, kw, len)) + return -EINVAL; + + *endptr = s + len; + return 0; +} + /** * conf_ports_range_except() - Set up forwarding for a range of ports minus a * bitmap of exclusions @@ -249,6 +272,7 @@ static void conf_ports_spec(const struct ctx *c, uint8_t exclude[PORT_BITMAP_SIZE] = { 0 }; bool exclude_only = true; const char *p, *ep; + uint8_t flags = 0; unsigned i; if (!strcmp(spec, "all")) { @@ -256,15 +280,32 @@ static void conf_ports_spec(const struct ctx *c, spec = ""; } - /* Mark all exclusions first, they might be given after base ranges */ + /* Parse excluded ranges and "auto" in the first pass */ for_each_chunk(p, ep, spec, ",") { struct port_range xrange; - if (*p != '~') { - /* Not an exclude range, parse later */ + if (isdigit(*p)) { + /* Include range, parse later */ exclude_only = false; continue; } + + if (parse_keyword(p, &p, "auto") == 0) { + if (p != ep) /* Garbage after the keyword */ + goto bad; + + if (c->mode != MODE_PASTA) { + die( +"'auto' port forwarding is only allowed for pasta"); + } + + flags |= FWD_SCAN; + continue; + } + + /* Should be an exclude range */ + if (*p != '~') + goto bad; p++; if (parse_port_range(p, &p, &xrange)) @@ -283,7 +324,7 @@ static void conf_ports_spec(const struct ctx *c, conf_ports_range_except(c, optname, optarg, fwd, proto, addr, ifname, 1, NUM_PORTS - 1, exclude, - 1, FWD_WEAK); + 1, flags | FWD_WEAK); return; } @@ -291,8 +332,8 @@ static void conf_ports_spec(const struct ctx *c, for_each_chunk(p, ep, spec, ",") { struct port_range orig_range, mapped_range; - if (*p == '~') - /* Exclude range, already parsed */ + if (!isdigit(*p)) + /* Already parsed */ continue; if (parse_port_range(p, &p, &orig_range)) @@ -320,7 +361,7 @@ static void conf_ports_spec(const struct ctx *c, proto, addr, ifname, orig_range.first, orig_range.last, exclude, - mapped_range.first, 0); + mapped_range.first, flags); } return; @@ -366,17 +407,6 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, if (proto == IPPROTO_UDP && c->no_udp) die("UDP port forwarding requested but UDP is disabled"); - if (!strcmp(optarg, "auto")) { - if (c->mode != MODE_PASTA) - die("'auto' port forwarding is only allowed for pasta"); - - conf_ports_range_except(c, optname, optarg, fwd, - proto, NULL, NULL, - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); - - return; - } - strncpy(buf, optarg, sizeof(buf) - 1); if ((spec = strchr(buf, '/'))) { @@ -1031,13 +1061,13 @@ static void usage(const char *name, FILE *f, int status) " can be specified multiple times\n" " SPEC can be:\n" " 'none': don't forward any ports\n" - "%s" " [ADDR[%%IFACE]/]PORTS: forward specific ports\n" " PORTS is either 'all' (forward all unbound, non-ephemeral\n" " ports), or a comma-separated list of ports, optionally\n" " ranged with '-' and optional target ports after ':'.\n" " Ranges can be reduced by excluding ports or ranges\n" - " prefixed by '~'\n" + " prefixed by '~'.\n" + "%s" " Examples:\n" " -t all Forward all ports\n" " -t 127.0.0.1/all Forward all ports from local address\n" @@ -1051,15 +1081,26 @@ static void usage(const char *name, FILE *f, int status) " -t 192.0.2.1/5 Bind port 5 of 192.0.2.1 to %s\n" " -t 5-25,~10-20 Forward ports 5 to 9, and 21 to 25\n" " -t ~25 Forward all ports except for 25\n" + "%s" " default: %s\n" " -u, --udp-ports SPEC UDP port forwarding to %s\n" " SPEC is as described for TCP above\n" " default: %s\n", guest, strstr(name, "pasta") ? - " 'auto': forward all ports currently bound in namespace\n" + " The 'auto' keyword may be given to only forward\n" + " ports which are bound in the target namespace\n" + : "", + guest, guest, guest, + strstr(name, "pasta") ? + " -t auto Forward all ports bound in namespace\n" + " -t 192.0.2.2/auto Forward ports from 192.0.2.2 if\n" + " they are bound in the namespace\n" + " -t 8000-8010,auto Forward ports 8000-8010 if they\n" + " are bound in the namespace\n" : "", - guest, guest, guest, fwd_default, guest, fwd_default); + + fwd_default, guest, fwd_default); if (strstr(name, "pasta")) goto pasta_opts; diff --git a/passt.1 b/passt.1 index 3ba447d5..eeecc0fb 100644 --- a/passt.1 +++ b/passt.1 @@ -434,12 +434,6 @@ Configure TCP port forwarding to guest or namespace. \fIspec\fR can be one of: .BR none Don't forward any ports -.TP -.BR auto " " (\fBpasta\fR " " only) -Dynamically forward ports bound in the namespace. The list of ports is -periodically derived (every second) from listening sockets reported by -\fI/proc/net/tcp\fR and \fI/proc/net/tcp6\fR, see \fBproc\fR(5). - .TP [\fIaddress\fR[\fB%\fR\fIinterface\fR]\fB/\fR]\fIports\fR ... Specific ports to forward. Optionally, a specific listening address @@ -468,11 +462,20 @@ as \fIfirst\fR. \fB~\fR\fIfirst\fR[\fB-\fR\fIlast\fR] Exclude range. Exclude port numbers between \fIfirst\fR and \fIlast\fR from. This takes precedences over include ranges. + +.TP +.BR auto +(\fBpasta\fR " " only). Only forward ports in the specified set if +the target ports are bound in the namespace. The list of ports is +periodically derived (every second) from listening sockets reported by +\fI/proc/net/tcp\fR and \fI/proc/net/tcp6\fR, see \fBproc\fR(5). .RE Specifying excluded ranges only implies that all other non-ephemeral -ports are forwarded. In this case, no failures are reported for -unavailable ports, unless no ports could be forwarded at all. +ports are forwarded. Specifying no ranges at all implies forwarding +all non-ephemeral ports permitted by current capabilities. In this +case, no failures are reported for unavailable ports, unless no ports +could be forwarded at all. Examples: .RS @@ -519,6 +522,17 @@ and 30 .TP -t ~20000-20010 Forward all ports to the guest, except for the range from 20000 to 20010 +.TP +-t auto +Automatically forward any ports which are bound in the namespace. +.TP +-t 192.0.2.2/auto +Automatically forward any ports which are bound in the namespace, +listening only on local port 192.0.2.2. +.TP +-t 8000-8010,auto +Forward ports in the range 8000-8010 if and only if they are bound in +the namespace. .RE Default is \fBnone\fR for \fBpasst\fR and \fBauto\fR for \fBpasta\fR. -- 2.53.0