From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=S71wkYEw; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 838BE5A026D for ; Mon, 13 Jul 2026 02:39:47 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783903186; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oBSzLARldOhnAa7UmtkWst8ORObPJTYZVb2Cxhm7T08=; b=S71wkYEwOei03Tayk0MrtdAwTFDRjebX0YZkLwnFWuyPj9rjq3woKGe4hy4l5pwVvPSPQQ gZMZSRmW6vZktlXdY/OJgCwsWuRY7b4FYDh/u3dL27kIbXgKFK/jRg2/6bEXXIrjmebh3C HhEWpCjYAv/zc4SXmB4p/+gUmJoJA6A= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-101-4gVQRRyON1K7meaS79GNPw-1; Sun, 12 Jul 2026 20:39:45 -0400 X-MC-Unique: 4gVQRRyON1K7meaS79GNPw-1 X-Mimecast-MFC-AGG-ID: 4gVQRRyON1K7meaS79GNPw_1783903184 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-49402f0af24so538915e9.0 for ; Sun, 12 Jul 2026 17:39:44 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783903184; x=1784507984; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=oBSzLARldOhnAa7UmtkWst8ORObPJTYZVb2Cxhm7T08=; b=o5M9+c/w4UWH6VuRhMt1GxVrCqt0Xj9p9PHZiqvkRKygsj9fIQPdC20ix56spFGqNX 0edFl5pjmJIGhsJmDr8p5fMCz6DdBuG3Q3d4eHV3LhLAsyLf8EmNRrXMOLXpxv86VbAF 0GwbQdnj2CVH86dO/iLbUrEpZyOioICMZWqnCBL/kb4GCEeTm3P3u8eSo6SWu5cqAs0I u/zlg2rpa6cqr27kT5j2cFee0Paux3KD/VwFYG2mcniymyMV6P37F1T1nhNVIWB5YeGt hq0vcKRsIUJx0FDT2slg0rWeJN63+8CxXGiUW2xaCG1QB+cl64NthnbnDSPu5af/25jG YFYw== X-Gm-Message-State: AOJu0Yz3LtxTb2JIj3YZnDNWLNKlA6XiMeuG8JR60atW1tInxTPDpru7 1X05cf0pIyDCrUfpk1SUhy+WOwT2bcGiQVxkoNpT9JKr4CGTn/mrQwpTw23O4YwNkOBpXV7Vz6l 8a+LJHSgI3xr0qDjGYC9hb4XZbc2IjvkCA4GT/Bhib6K5YpIGLyY7dA== X-Gm-Gg: AfdE7ckvuasSxmt736x7CSa01tkoUilaFddLukbfbC8u9P/MS/ce4mQ0PbggywHgM0D yqq8x+6MOqpaogLC98TfiilIM8omwSHgzs1VttTcpnjVgAdbd+oRiwtzUpksFR7sz0MR6K2NIOn AUNsTxe5ozZwOfdvdpUu+qO5jGGOzcrlnWWuqWWqc24ZTZ39B5NPNiChYv49pA+rPGm2SEvoxyo 8nDIuCksequss02vZ+MQH25OQM8PL+cTXaywQEmV3k8w4wQp4WwhZGW0K1mzrz3NalJfHTjkU0v NbhtpgW+s47TWCh5yWcn6cpxnpcPtDM5m9muoIOgT1vHzLFFvxs6d+t8mBeP784rc4OtGKVgpXD 7husrelhSf0W7B3R1NW00dah/gabfv//RbhdFqJg= X-Received: by 2002:a05:600c:8b17:b0:493:f750:f7fc with SMTP id 5b1f17b1804b1-493f8837c34mr69510105e9.35.1783903183676; Sun, 12 Jul 2026 17:39:43 -0700 (PDT) X-Received: by 2002:a05:600c:8b17:b0:493:f750:f7fc with SMTP id 5b1f17b1804b1-493f8837c34mr69509945e9.35.1783903183198; Sun, 12 Jul 2026 17:39:43 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-493f2c8de2asm231587985e9.1.2026.07.12.17.39.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 17:39:42 -0700 (PDT) From: Stefano Brivio To: David Gibson Subject: Re: [PATCH 3/5] fwd: Rework default address logic for inbound flows Message-ID: <20260713023941.38f0ab5b@elisabeth> In-Reply-To: <20260710065611.530947-4-david@gibson.dropbear.id.au> References: <20260710065611.530947-1-david@gibson.dropbear.id.au> <20260710065611.530947-4-david@gibson.dropbear.id.au> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Mon, 13 Jul 2026 02:39:42 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: r1dfG6_eMwMcXhdUyprQYnTbVEOhsoa3GWcRbCTZb_w_1783903184 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: HAHSQZCF5MRNKHKOVVKBAKHAB3EBZ7ZX X-Message-ID-Hash: HAHSQZCF5MRNKHKOVVKBAKHAB3EBZ7ZX X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Fri, 10 Jul 2026 16:56:09 +1000 David Gibson wrote: > fwd_nat_from_host() needs to determine the guest side destination address > for the new flow. In some cases that's controlled by the forwarding rule > or -host-lo-to-ns-lo logic, but by default we use the observed guest --host-lo-to-ns-lo (I kid you not, I sometimes grep for option names in commit logs). > address. We need to pick the right one to match the source address, > though. > > Currently this is done with similar, but not quite identical logic in the > spliced and non-spliced paths. Introduce a new fwd_default_guest_addr() > helper to make explicit: > * We have the same logic for splice and tap paths > * This is a fallback path if nothing else determined the address (we > use this default nearly all the time now, but it might change in future) > * We're matching IP family and scope with the guest side source address > > Signed-off-by: David Gibson > --- > fwd.c | 44 ++++++++++++++++++++++++++++++-------------- > 1 file changed, 30 insertions(+), 14 deletions(-) > > diff --git a/fwd.c b/fwd.c > index 84400948..90297ef7 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -1005,6 +1005,27 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, > return true; > } > > +/** > + * fwd_default_geuest_addr() - Get appropriate guest address to send to fwd_default_guest_addr() > + * @c: Execution context > + * @guest_addr: Updated with chosen guest address > + * @template: Address to match IP version and scope of > + * > + * Sets @guest_addr to have the address of the guest, matching the IP version > + * and scope of @template where possible. Could we return the right @guest_addr instead? Or you want to avoid that because we can't use a pointer to inany_addr in that case? It would make: > + */ > +static void fwd_default_guest_addr(const struct ctx *c, > + union inany_addr *guest_addr, > + const union inany_addr *template) > +{ > + if (inany_v4(template)) > + *guest_addr = inany_from_v4(c->ip4.addr_seen); > + else if (inany_is_linklocal6(template)) > + guest_addr->a6 = c->ip6.addr_ll_seen; > + else > + guest_addr->a6 = c->ip6.addr_seen; > +} > + > /** > * fwd_nat_from_host() - Determine to forward a flow from the host interface > * @c: Execution context > @@ -1040,13 +1061,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > */ > if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) > tgt->eaddr = ini->oaddr; > - else if (inany_v4(&ini->eaddr)) > - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); > - else > - tgt->eaddr.a6 = c->ip6.addr_seen; > > /* Let the kernel pick source address and port */ > - if (inany_v4(&tgt->eaddr)) > + if (inany_v4(&ini->eaddr)) > tgt->oaddr = inany_any4; > else > tgt->oaddr = inany_any6; > @@ -1056,6 +1073,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > /* But for UDP preserve the source port */ > tgt->oport = ini->eport; > > + /* Use guest address as destination, if otherwise unspecified */ > + if (inany_is_unspecified(&tgt->eaddr)) > + fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); > return PIF_SPLICE; > } > > @@ -1074,16 +1094,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > } > tgt->oport = ini->eport; > > - if (!inany_is_unspecified(&rule->taddr)) { > + if (!inany_is_unspecified(&rule->taddr)) > tgt->eaddr = rule->taddr; > - } else if (inany_v4(&tgt->oaddr)) { > - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); > - } else { > - if (inany_is_linklocal6(&tgt->oaddr)) > - tgt->eaddr.a6 = c->ip6.addr_ll_seen; > - else > - tgt->eaddr.a6 = c->ip6.addr_seen; > - } > + > + /* Use guest address as destination, if otherwise unspecified */ > + if (inany_is_unspecified(&tgt->eaddr)) > + fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); this usage more intuitive, I think. > > return PIF_TAP; > } -- Stefano