From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=MXxfQ+rs; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 445485A0624 for ; Mon, 13 Jul 2026 07:39:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783921140; bh=xIO0wF4Q1zyLJHk1OLTbLiAj93YqckLt1mHBdWN073w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MXxfQ+rsmgym4SRfzvX4jI1IESbCYEFH4BRlUx6ezUT+lR8RMo5mqW2tD5pZH7lBj jRc6WlpFUPq0I7j5X1XKCvSV7AzQsP+A22flKvH8Kwy/NgEJf6gHtweURefRGJX+9w afEw5KLC2k+vtr/AM33uCx8bXM8c6Xr/rxK5JyGty+2VlYWKdnkdmT7DVyvPmQp4al hICOpA1wOaZaYkYVZDhHTd/7i2VnPIiT9/eomYkJfqCgZR/ZNoc0htqUpgWKUX+Q8S Z2DbfCsxMhVCiGhQka17fSN0NrPKfFMF5LzdSaJMM+bIcD3TMbQpaa17th6zwr2GPq Vj769f3XRtxmA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzB7m2Kh3z4wJ2; Mon, 13 Jul 2026 15:39:00 +1000 (AEST) From: David Gibson To: passt-dev@passt.top, Stefano Brivio Subject: [PATCH v2 1/5] fwd: Clarify semantics of --host-lo-to-ns-lo Date: Mon, 13 Jul 2026 15:38:52 +1000 Message-ID: <20260713053856.1329271-2-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260713053856.1329271-1-david@gibson.dropbear.id.au> References: <20260713053856.1329271-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: J6GYI4GFOW36G3VEBWL6KMA2ASFLUCO3 X-Message-ID-Hash: J6GYI4GFOW36G3VEBWL6KMA2ASFLUCO3 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The semantics of --host-lo-to-ns-lo as described in the man page don't quite make sense: It says without the option forwarded packets will appear to come _from_ the guest's public address, which is not usually true. Instead the packets will arrive *to* the guest's public address. The exact semantics are also a bit confusing in general. Rewrite both the man page and code to clarify this. The new rule is that it redirects connections addressed to a host loopback address to the same loopback address in the guest. This is notionally different from what we had in two ways: * We can now deliver to nonstandard loopback addresses within the guest, not just the default one. This is technically a behavioural change, but I think will be less surprising behaviour. * The decision is now made on the original _destination_ address, rather than source address. That's different theoretically, but not in practice, since loopback packets must have loopback addresses for both source and destination. We make it explicitly incompatible with --no-splice - previously it was allowed, but would have no effect in that case. As well as being more precise right now, these semantics will intersect better with other upcoming changes to the forwarding logic. Signed-off-by: David Gibson --- conf.c | 2 ++ fwd.c | 22 ++++++++++------------ passt.1 | 9 +++++---- 3 files changed, 17 insertions(+), 16 deletions(-) diff --git a/conf.c b/conf.c index 6d83daef..5b6cc2be 100644 --- a/conf.c +++ b/conf.c @@ -1796,6 +1796,8 @@ void conf(struct ctx *c, int argc, char **argv) if (c->splice_only) die("--splice-only is for pasta mode only"); } + if (c->no_splice && c->host_lo_to_ns_lo) + die("--host-lo-to-ns-lo is incompatible with --no-splice"); if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) diff --git a/fwd.c b/fwd.c index 3ae25fde..84400948 100644 --- a/fwd.c +++ b/fwd.c @@ -1038,21 +1038,19 @@ uint8_t fwd_nat_from_host(const struct ctx *c, * In either case, let the kernel pick the source address to * match. */ - if (inany_v4(&ini->eaddr)) { - if (c->host_lo_to_ns_lo) - tgt->eaddr = inany_loopback4; - else - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); + if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + tgt->eaddr = ini->oaddr; + else if (inany_v4(&ini->eaddr)) + tgt->eaddr = inany_from_v4(c->ip4.addr_seen); + else + tgt->eaddr.a6 = c->ip6.addr_seen; + + /* Let the kernel pick source address and port */ + if (inany_v4(&tgt->eaddr)) tgt->oaddr = inany_any4; - } else { - if (c->host_lo_to_ns_lo) - tgt->eaddr = inany_loopback6; - else - tgt->eaddr.a6 = c->ip6.addr_seen; + else tgt->oaddr = inany_any6; - } - /* Let the kernel pick source port */ tgt->oport = 0; if (proto == IPPROTO_UDP) /* But for UDP preserve the source port */ diff --git a/passt.1 b/passt.1 index a8a06311..1570f6af 100644 --- a/passt.1 +++ b/passt.1 @@ -672,10 +672,11 @@ Default is \fBauto\fR. .TP .BR \-\-host-lo-to-ns-lo -If specified, connections forwarded with \fB\-t\fR and \fB\-u\fR from -the host's loopback address will appear on the loopback address in the -guest as well. Without this option such forwarded packets will appear -to come from the guest's public address. +If specified, connections to a host loopback address forwarded with +\fB\-t\fR or \fB\-u\fR will be delivered to the same loopback address +in the namespace. Without this option such connections are forwarded +to the namespace's public address. This option is incompatible with +\fB--no-splice\fR. .TP .BR \-\-userns " " \fIspec -- 2.55.0