From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=N+frm/RA; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 4327F5A0624 for ; Fri, 10 Jul 2026 08:56:24 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783666574; bh=IfVkBOiLSCxdeyTAZXzBksTqVvoFPxt0jvOUYTCQJEs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N+frm/RA6yvHgXxNIkHZLjJHD8Su+0elx13AMt33pFEWvgS5OA4BtujNeKHguyezv KfTlDe/HdtRRE4t5e5wCy0aYOe3jqiLfbGZ4W9Hvv6ftc/DhgfI9EagLOxrzP1ctTo WciZuQsNPtFlBq89fsVrzR7eVK01uWRxH3Bb7wNP+mGaztJSsqU6BiS1rYelVRCnht wighJ/H64ONbB6cYOFZj6mek2LIxHzvsVbLbN/5W8x7CgYqzjMNUVxxqyAK4vSYlmx pzmAKA0tVuN7l6GD91QWRGvzgVb+vOLY/n1wxFfUG/jeAh887PSmLiiFvvXSVeXF6N H5FTZW5ggPDXQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gxN0G4y3Yz58dY; Fri, 10 Jul 2026 16:56:14 +1000 (AEST) From: David Gibson To: Stefano Brivio , passt-dev@passt.top Subject: [PATCH 5/5] fwd: Don't rewrite inbound multicast destinations Date: Fri, 10 Jul 2026 16:56:11 +1000 Message-ID: <20260710065611.530947-6-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260710065611.530947-1-david@gibson.dropbear.id.au> References: <20260710065611.530947-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: ZA4A347JABZKP4WUNWPXHWJHZSAB5VRK X-Message-ID-Hash: ZA4A347JABZKP4WUNWPXHWJHZSAB5VRK X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: fwd_nat_from_host() (nearly) always rewrites the destination address for inbound flows to the observed guest address. Usually, that makes sense: regardless of the host address to which the new flow arrived, we want to direct it to the guest. However, that clearly does not make sense for multicast - it should still appear as a multicast transmission to the guest. In particular this can work very badly for multicast protocols which use the same source and destination ports by convention (e.g. mDNS). In this case, we will attempt to forword multicast packets to our own socket, causing a forwarding loop (see bug 209 for more details). While it's certainly not enough to make us handle multicast correctly in all circumstances, not translating multicast destinations is closer to correct, and prevents bug 209 at least. Link: https://bugs.passt.top/show_bug.cgi?id=209 Signed-off-by: David Gibson --- fwd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fwd.c b/fwd.c index 7d39898e..e59413b6 100644 --- a/fwd.c +++ b/fwd.c @@ -1045,7 +1045,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, tgt->eport = rule->to + (ini->oport - rule->first); if (!inany_is_unspecified(&rule->taddr)) tgt->eaddr = rule->taddr; - else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + else if (inany_is_multicast(&ini->oaddr) || + (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))) tgt->eaddr = ini->oaddr; /* TODO: Allow splicing with specified target address */ -- 2.55.0