From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=KyWlF/ug; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 353305A026E for ; Sat, 20 Jun 2026 00:10:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1781907003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pPvt3BpdThaRzPAG2nAAlOSX2PC0tAxtUzII1k/FMc0=; b=KyWlF/ugEBgeJHUAdnySrL3hedkENpih+/W9eYRc1DlpYRYD9tnJF9f99TiNOuuZhmMJNX VIgRjhu9rjN+6/fye7XO8ESDmngPfksBweyQ5j+jftO+WmGOZJBLBbezAuVUMo+KXEkOBt FtkzAxeeLhIxkFW7vSiK9NOjyh8HWMM= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-141-cooKFMyANneWrYZa56m4Lg-1; Fri, 19 Jun 2026 18:10:02 -0400 X-MC-Unique: cooKFMyANneWrYZa56m4Lg-1 X-Mimecast-MFC-AGG-ID: cooKFMyANneWrYZa56m4Lg_1781907001 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-49246459bc4so4154965e9.2 for ; Fri, 19 Jun 2026 15:10:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781907001; x=1782511801; h=date:content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=pPvt3BpdThaRzPAG2nAAlOSX2PC0tAxtUzII1k/FMc0=; b=aR9yvwQzlZuC80D+X6MlxT/Y9YHpOSAKt0LVJITHQ/FIwNjGv0Mt/k+zPJoQs0ph4o VgwcHncT8SW71gXD16XKdzN54Uq8gcdLjqhxDv7XBgS+dpP425HyUdBoOZLzftGs47aS yVhl5qwaXovgRVSwyeKKAMR4bUMfipN6RLp7wQ6Czgq+TOw+XPdU6iVmwxEk0PECIRQ5 FAug0796aHVslJ/GIRds15sRSreHoHCjVs4w3DjaBbkVwxbSgTpTAyTPjOTEwO1eeeY/ 4+5sHkb9sRv+U1xsTFJcgO2dBcW/Q+3cDC6noPsKZBep4nz5pO1hgLFBDWSG1zPf3rfa Xgxg== X-Forwarded-Encrypted: i=1; AFNElJ9Di8o3lvCRP7Rjj9eU1giDiYRzfmA+othebp+WvFM1eigPJ5HIyfo2dDswJ8JIwSgP2Yy1CU0GbsY=@passt.top X-Gm-Message-State: AOJu0Yz6qeYpBF7Gz8OGNdpULijYqRCab4UFcRa9CRr3iD/JzhHNdt2H 4YQAlG5y0dl3PeWkfwodIgDrso+J5zKklY2XHwQs2Ax9TlKlRKZXaAsf2WjEagq0gFAYH1ieDHf wbB84pVszTrd6pbfRXLG8uQvAyL7SFnbMDUFG8ynoF15V/Ik9ht2QbAgQGavISw== X-Gm-Gg: AfdE7cm13ero5+U0eJCK37fsIsht4KOUatQWtsy5lJU7rRX4XGVUpn7cEuSd40LcjS6 YDmOGVFG6MeNQFecgCOEzBOwIYqOEsC4hfPkPD3oOE+EwCZUt4rKvr9LW/yEJFwpCI2BMHy/DPN w+CH4/1d0E7s+XVKZulYTUonjs731F9jjk2J5Ztws0w5irspXpjGicXPNBuEd9jLe4+tXNpQ+1f OSdOL5jMaqlrWn6B3GgpwSV25Ub546euvEfSaUtEfXO3eK0SprA7cM6PP/aWkdVlgDDCng7sNrt 6edU/a+qwjhT784p+VwZRC4noRIAJkpcWG3XcJwm854f3Ezg3JMt4Q1qVZPfogCnCYTRh2OGCd8 VW+R6062nb3vlQG4RRhN+Doiy70XSWi6EkVuod78= X-Received: by 2002:a05:600d:17:b0:492:4410:ec5a with SMTP id 5b1f17b1804b1-4924410eec0mr55996495e9.33.1781907001179; Fri, 19 Jun 2026 15:10:01 -0700 (PDT) X-Received: by 2002:a05:600d:17:b0:492:4410:ec5a with SMTP id 5b1f17b1804b1-4924410eec0mr55996175e9.33.1781907000681; Fri, 19 Jun 2026 15:10:00 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49249238bfbsm16817555e9.5.2026.06.19.15.10.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Jun 2026 15:10:00 -0700 (PDT) From: Stefano Brivio To: Jon Maloy Subject: Re: [PATCH v7 03/13] fwd: Unify guest accessibility checks with unified address array Message-ID: <20260620000959.3a873a75@elisabeth> In-Reply-To: <20260413005319.3295910-4-jmaloy@redhat.com> References: <20260413005319.3295910-1-jmaloy@redhat.com> <20260413005319.3295910-4-jmaloy@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Sat, 20 Jun 2026 00:09:59 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: tA_kTg35MAUZEJmWze-mLfNKzYRL7i4bdy9iCh-TlFw_1781907001 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: ZVKIGIA6LVWX6AP2E2QYL4367RXL4TJL X-Message-ID-Hash: ZVKIGIA6LVWX6AP2E2QYL4367RXL4TJL X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: david@gibson.dropbear.id.au, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Sun, 12 Apr 2026 20:53:09 -0400 Jon Maloy wrote: > We replace the fwd_guest_accessible4() and fwd_guest_accessible6() > functions with a unified fwd_guest_accessible() function that handles > both address families. With the unified address array, we can check > all configured addresses in a single pass using for_each_addr() with > family filter AF_UNSPEC. > > Signed-off-by: Jon Maloy > > --- > v6: -Some fixes based on feedback from David Gibson > v7: -Added curly brackets to for_each_addr() in fwd_guest_accessible(), > as suggested by Stefano Brivio. > --- > fwd.c | 69 +++++++++++++---------------------------------------------- > 1 file changed, 15 insertions(+), 54 deletions(-) > > diff --git a/fwd.c b/fwd.c > index 14ce0a7..e676c18 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -988,19 +988,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini) > } > > /** > - * fwd_guest_accessible4() - Is IPv4 address guest-accessible > + * fwd_guest_accessible() - Is address guest-accessible > * @c: Execution context > - * @addr: Host visible IPv4 address > + * @addr: Host visible address (IPv4 or IPv6) > * > * Return: true if @addr on the host is accessible to the guest without > * translation, false otherwise > */ > -static bool fwd_guest_accessible4(const struct ctx *c, > - const struct in_addr *addr) > +static bool fwd_guest_accessible(const struct ctx *c, > + const union inany_addr *addr) > { > const struct guest_addr *a; > > - if (IN4_IS_ADDR_LOOPBACK(addr)) > + if (inany_is_loopback(addr)) > return false; > > /* In socket interfaces 0.0.0.0 generally means "any" or unspecified, > @@ -1008,38 +1008,18 @@ static bool fwd_guest_accessible4(const struct ctx *c, > * that has a different meaning for host and guest, we can't let it > * through untranslated. > */ > - if (IN4_IS_ADDR_UNSPECIFIED(addr)) > + if (inany_is_unspecified(addr)) > return false; > > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > - * address > + /* Check against all configured guest addresses */ > + for_each_addr(a, c->addrs, c->addr_count, AF_UNSPEC) { > + if (inany_equals(addr, &a->addr)) > + return false; > + } A lookup function as I was suggesting in the review of 2/13 would also be convenient here. > + /* Also check addr_seen: it tracks the address the guest is actually > + * using, which may differ from configured addresses. > */ > - a = fwd_get_addr(c, AF_INET, 0, 0); > - if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) || > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > - return false; > - > - return true; > -} > - > -/** > - * fwd_guest_accessible6() - Is IPv6 address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv6 address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible6(const struct ctx *c, > - const struct in6_addr *addr) > -{ > - const struct guest_addr *a; > - > - if (IN6_IS_ADDR_LOOPBACK(addr)) > - return false; > - > - a = fwd_get_addr(c, AF_INET6, 0, 0); > - if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6)) > + if (inany_equals4(addr, &c->ip4.addr_seen)) > return false; > > /* For IPv6, addr_seen starts unspecified, because we don't know what LL > @@ -1047,31 +1027,12 @@ static bool fwd_guest_accessible6(const struct ctx *c, > * if it has been set to a real address. > */ > if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) && > - IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen)) > + inany_equals6(addr, &c->ip6.addr_seen)) > return false; > > return true; > } > > -/** > - * fwd_guest_accessible() - Is IPv[46] address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv[46] address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible(const struct ctx *c, > - const union inany_addr *addr) > -{ > - const struct in_addr *a4 = inany_v4(addr); > - > - if (a4) > - return fwd_guest_accessible4(c, a4); > - > - return fwd_guest_accessible6(c, &addr->a6); > -} > - > /** > * nat_outbound() - Apply address translation for outbound (TAP to HOST) > * @c: Execution context -- Stefano