Re: [PATCH 1/5] fwd: Clarify semantics of --host-lo-to-ns-lo

[Stefano Brivio <sbrivio@redhat.com>]

Nits only (pretty much for the whole series, even though I have
slightly more substantial remarks for 3/5 and 5/5, so I thought I'd
point all of them out):

On Fri, 10 Jul 2026 16:56:07 +1000
David Gibson <david@gibson.dropbear.id.au> wrote:

> The semantics of --host-lo-to-ns-lo as described in the man page don't
> quite make sense: It says without the option forwarded packets will appear
> to come _from_ the guest's public address, which is not usually true.
> Instead the packets will arrive *to* the guest's public address.  The exact
> semantics are also a bit confusing in general.
> 
> Rewrite both the man page and code to clarify this.  The new rule is that
> it redirects connections addressed to a host loopback address to the same
> loopback address in the guest.  This is notionally different from what we
> had in two ways:
>   * We can now deliver to nonstandard loopback addresses within the guest,
>     not just the default one.  This is technically a behavioural change,
>     but I think will be less surprising behaviour.
>   * The decision is now made on the original _destination_ address, rather
>     than source address.  That's different theoreically, but not in

theoretically

>     practice, since loopback packets must have loopback addresses for both
>     source and destination.
> 
> We make it explicitly incompatible with --no-splice - previously it
> was allowed, but would have no effect in that case.
> 
> As well as being more precise right now, these semantics will intersect
> better with upcoming remapping of target address by forwarding rules.
> 
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
> ---
>  conf.c  |  2 ++
>  fwd.c   | 22 ++++++++++------------
>  passt.1 |  9 +++++----
>  3 files changed, 17 insertions(+), 16 deletions(-)
> 
> diff --git a/conf.c b/conf.c
> index 6d83daef..5b6cc2be 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -1796,6 +1796,8 @@ void conf(struct ctx *c, int argc, char **argv)
>  		if (c->splice_only)
>  			die("--splice-only is for pasta mode only");
>  	}
> +	if (c->no_splice && c->host_lo_to_ns_lo)
> +		die("--host-lo-to-ns-lo is incompatible with --no-splice");
>  
>  	if (c->mode == MODE_PASTA && !c->pasta_conf_ns) {
>  		if (copy_routes_opt)
> diff --git a/fwd.c b/fwd.c
> index 3ae25fde..84400948 100644
> --- a/fwd.c
> +++ b/fwd.c
> @@ -1038,21 +1038,19 @@ uint8_t fwd_nat_from_host(const struct ctx *c,
>  		 * In either case, let the kernel pick the source address to
>  		 * match.
>  		 */
> -		if (inany_v4(&ini->eaddr)) {
> -			if (c->host_lo_to_ns_lo)
> -				tgt->eaddr = inany_loopback4;
> -			else
> -				tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
> +		if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))
> +			tgt->eaddr = ini->oaddr;
> +		else if (inany_v4(&ini->eaddr))
> +			tgt->eaddr = inany_from_v4(c->ip4.addr_seen);
> +		else
> +			tgt->eaddr.a6 = c->ip6.addr_seen;
> +
> +		/* Let the kernel pick source address and port */
> +		if (inany_v4(&tgt->eaddr))
>  			tgt->oaddr = inany_any4;
> -		} else {
> -			if (c->host_lo_to_ns_lo)
> -				tgt->eaddr = inany_loopback6;
> -			else
> -				tgt->eaddr.a6 = c->ip6.addr_seen;
> +		else
>  			tgt->oaddr = inany_any6;
> -		}
>  
> -		/* Let the kernel pick source port */
>  		tgt->oport = 0;
>  		if (proto == IPPROTO_UDP)
>  			/* But for UDP preserve the source port */
> diff --git a/passt.1 b/passt.1
> index a8a06311..4f2a8e41 100644
> --- a/passt.1
> +++ b/passt.1
> @@ -672,10 +672,11 @@ Default is \fBauto\fR.
>  
>  .TP
>  .BR \-\-host-lo-to-ns-lo
> -If specified, connections forwarded with \fB\-t\fR and \fB\-u\fR from
> -the host's loopback address will appear on the loopback address in the
> -guest as well.  Without this option such forwarded packets will appear
> -to come from the guest's public address.
> +If specified, connections to a host loopback address forwarded with
> +\fB\-t\fR or \fB\-u\fR will be delivered to the same loopback address
> +on the guest.  Without this option such connections are forwarded to
> +the guest's public address.  This option is incompatible with
> +\fB--no-splice\fR.

Pre-existing, but still somewhat confusing: this is one part of the man
page where we don't specify "guest or namespace", we just use "guest",
and yet it's never a guest, it's always a namespace.

Should we just change all the occurrences of "guest" to "namespace" in
this paragraph?

>  
>  .TP
>  .BR \-\-userns " " \fIspec

-- 
Stefano