From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=dffBiQ7V; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 684105A0262 for ; Mon, 13 Jul 2026 02:40:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783903199; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+2oYhKULI6EdfVyUjFEl9IpwoBErHuf+lWycO5ewTso=; b=dffBiQ7VqF8icqqdsBPLj1xhDFIwzOgaIRI+Cf5UByWq+kNJXmcui3ZaoovTF0oZYxLGaq bTc9LniZJOo80+WxYrOmJbN1i8hV1qxQQub2lYFW+Et2cNPIX3S7Z+9WUahF7nABHuoNQR oCXj1kcjCO+fQnlU2bz6EaS4Hds99oM= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-558-qIdNRAMLNteXrdubEGVS6Q-1; Sun, 12 Jul 2026 20:39:57 -0400 X-MC-Unique: qIdNRAMLNteXrdubEGVS6Q-1 X-Mimecast-MFC-AGG-ID: qIdNRAMLNteXrdubEGVS6Q_1783903196 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-47f24a50f0cso2151746f8f.3 for ; Sun, 12 Jul 2026 17:39:57 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783903196; x=1784507996; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=+2oYhKULI6EdfVyUjFEl9IpwoBErHuf+lWycO5ewTso=; b=kq/0S5nsJ/4vFROlzveVarDUbsoyGJLfQOBsFUwPu9Sq9WQd5ro1c+SzNB7tIAnXE7 5NcY6ELIOONXTmxyQdcylyKoFM6qternbQ4qNVhN2cd5iebQGGnLTU+yLGK9Pxi/WkrF W/ovR+YstHSSAXCKB+CVPVqzu3zPD44v9uq3vFwIkCqQTEXGfMBk9PrxpYaOmvrsQvN/ mkcwm13zla2x65GsamiTHeZa67sFf2XrIyDsiQqXCl1toU+H8zuxcCICEiLH3PYQScbb KiDtaTRZtern+8jR3M0MbvCuaBilZUX7BuOA3sHTFuBshHcxgsWex32p9Q6YosY6QmDR qGXQ== X-Gm-Message-State: AOJu0YyGKn52bY8SG6qC9xbtk3l9CA04kahGFGHPTpOPMfi19StWm9DO HTbWAvrRbtC3xnnkxSPBCvE3g3ppf8TgqBFv0/89nG4SgMi8Thg9WT7M2kzxtYAQY9WGieQq3A5 ea9qPszOCbK58EDcwxXCCd8Wo0bmZPbzwoJm6ujb0RnxVzxckV9pzCfUiQdS1Tw== X-Gm-Gg: AfdE7ck6MFz6hEgncuyx2qnqX2tMclJ0eGcQ4EkBSRSEqY1mWzw1At0VJ1/3qSFddMr /k1q5CqEfVwLwbEjgjbRVKoMRf8e9cl+akiohw+uBu/uYU87gsVjD34kdJhUIRW8FttBsulvXU9 uM+7MI6PBJZNcRHNjWhPnROhDmtvdZ2VWmksPDkp4n6w222jb7OolRb5VMqVZLpvgO9BkL2yS4y 2WBmRlYhx9uRCeDvoNUebvYdKThVD5uso4PwA3wYfehYPiDir+68HVCheRgIhkjuGiE0F/BsFP9 AdK14qJt4DBY9oI2euoNG08As1Wer/xWUKjT7hmml00+vKLNtLUbAmmccXZgqvaOIbLooniv0Am QN7LVMS/eShtVZjL1zoXXH7tM8tJ29G/GtV3f5ag= X-Received: by 2002:a05:6000:1786:b0:475:f0c2:75a6 with SMTP id ffacd0b85a97d-47f2dd08a4emr7957671f8f.55.1783903196249; Sun, 12 Jul 2026 17:39:56 -0700 (PDT) X-Received: by 2002:a05:6000:1786:b0:475:f0c2:75a6 with SMTP id ffacd0b85a97d-47f2dd08a4emr7957656f8f.55.1783903195757; Sun, 12 Jul 2026 17:39:55 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47aa039ae44sm77066420f8f.23.2026.07.12.17.39.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Jul 2026 17:39:55 -0700 (PDT) From: Stefano Brivio To: David Gibson Subject: Re: [PATCH 5/5] fwd: Don't rewrite inbound multicast destinations Message-ID: <20260713023954.6b7a931b@elisabeth> In-Reply-To: <20260710065611.530947-6-david@gibson.dropbear.id.au> References: <20260710065611.530947-1-david@gibson.dropbear.id.au> <20260710065611.530947-6-david@gibson.dropbear.id.au> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Mon, 13 Jul 2026 02:39:54 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: UwWJs4pdkkpgQwYShbJhOQe_yvA2r7PpjGVgy-0cge0_1783903196 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: 4RQ4SENRO4PJZRVRREO6JGZY3H74BQWB X-Message-ID-Hash: 4RQ4SENRO4PJZRVRREO6JGZY3H74BQWB X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Fri, 10 Jul 2026 16:56:11 +1000 David Gibson wrote: > fwd_nat_from_host() (nearly) always rewrites the destination address for > inbound flows to the observed guest address. Usually, that makes sense: > regardless of the host address to which the new flow arrived, we want to > direct it to the guest. However, that clearly does not make sense for > multicast - it should still appear as a multicast transmission to the > guest. > > In particular this can work very badly for multicast protocols which use > the same source and destination ports by convention (e.g. mDNS). In this > case, we will attempt to forword multicast packets to our own socket, > causing a forwarding loop (see bug 209 for more details). > > While it's certainly not enough to make us handle multicast correctly in > all circumstances, not translating multicast destinations is closer to > correct, and prevents bug 209 at least. > > Link: https://bugs.passt.top/show_bug.cgi?id=209 > Signed-off-by: David Gibson > --- > fwd.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fwd.c b/fwd.c > index 7d39898e..e59413b6 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -1045,7 +1045,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > tgt->eport = rule->to + (ini->oport - rule->first); > if (!inany_is_unspecified(&rule->taddr)) > tgt->eaddr = rule->taddr; > - else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) > + else if (inany_is_multicast(&ini->oaddr) || This is a bit convoluted: if one reads this commit message it makes sense, but if one reads just the code later it's absolutely unclear that this is needed to avoid the inany_is_unspecified(&tgt->eaddr) clause at the end of the function (mostly). Should we add a comment? Right now I can't come up with any reasonable suggestion of where to place it or what to write in it, though. > + (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))) > tgt->eaddr = ini->oaddr; > > /* TODO: Allow splicing with specified target address */ -- Stefano