From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=VTtKXgFL; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id F08065A004E for ; Thu, 05 Feb 2026 02:01:50 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770253310; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FXttqi8mjVTGwf6O3DTcxV+BZX+Fpzr/7lP5teRq9dQ=; b=VTtKXgFLMtZbaffBWiQCBTDozMxCjJfuL65aEf3zYu0zEzpujzdW8OOHkQGzjbAtT1OQWD OrmqJgmDpYNjBOyLUbGIqx2KGSAbrX1fuGkhf7KNe8jHQkWZbrFUSr5JjbS5+vanvoJFz+ AQsyjZsAtV8+ti97eKk8leVPYvciu1A= Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-470-PrA-U3UtO2iFFikyF4VAzA-1; Wed, 04 Feb 2026 20:01:48 -0500 X-MC-Unique: PrA-U3UtO2iFFikyF4VAzA-1 X-Mimecast-MFC-AGG-ID: PrA-U3UtO2iFFikyF4VAzA_1770253308 Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-501473ee94fso24604181cf.3 for ; Wed, 04 Feb 2026 17:01:48 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770253308; x=1770858108; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FXttqi8mjVTGwf6O3DTcxV+BZX+Fpzr/7lP5teRq9dQ=; b=eZiqR+FIvGLWBLobQQ40hc07vSrQt8T15Xb/m13psXYxRrAt/x4cWSN8GT5mWu0sO+ 9ZTFJAqfuO151OJfCEK2NbuEW4YM7M0P+9+IjnPEgJpwVLlK1sdvtIAGRuYVshiIbAUI RiMaBGAOaRuFts/XTtBVG/bysYHumt59xtieKlQTMVXaGdu2yMueaBu6hUi0l31kr6+m Ki91EO/jQWE2kWX+chmvCUoBM/S0eS9FERc9DqsffJcghSN0nTWerVda5X5IBPfompGX Ddobxn1ScOEjXhMeJdkjxy26V4ntjIMYc+46/DtU7uhew5/Sh8s/q49CxclpXHFV3Fft KNkQ== X-Forwarded-Encrypted: i=1; AJvYcCVlJf1EyPoITnVSjD7xJOx9eSAJJa5/9OQtttxvaIIYDrkxUZ9iNfBK781IB60lu5WvMEEe4U0OT6U=@passt.top X-Gm-Message-State: AOJu0YxIo4AQJm1omsu8pEoQ1pAfaTS40jaM+YPSnqMDzOv4mOdkVzc+ bCl4qDEoEqkAXI11wza+y00yf8PwQpCAgsLocuSifE0m0YtEZQtqCyOrGMdmNhKNLx5Gotq+2yA Lxz62YD/EI4kp3AZARUBtgrfP9AGzpXV7GZTND/ClK9/DpK8WX23OYA== X-Gm-Gg: AZuq6aLTxDMfpHiM45GGYWgJlXZrKl5CKde4lBs2/v24y1RJwhB7vnrF4I4lmAeggst 3Ba0u0S9oeBZ80Rb7rtkU5wjV3peZbTAOTgkTgJYoy7VH495hMT5IlIm/cRugoyQ4Yl2IjaRSyn RXxsbokmA3bv9pOBnCl7t8yLSmezKJdfUe5eXTDhxFZTEQ0Wu8Z6CCK5j3kMcXITWzTAo+sYMt6 oyUUcZjooJfpaV5Cku6lI3LXRebH/VQQefj5X3epw2XPRnngkQtfPyfaiXdgosWAWWEsHwOsMoH 4iYoO3LRIMPR15GGAyb8fkE19ETMY07XxomM/CrIZ2mgBq8XIYB75BKqFL2W6So9zcmwO+z7EeW jGvz0h1UtBwzmtxluBeJNJQw4Xwaw3Xz1HZET5C3XPl58QpjoWng4KDlnA1tEwlgO/XFluKhIgp 3sjwCg X-Received: by 2002:ac8:5a41:0:b0:502:6ed5:7b0d with SMTP id d75a77b69052e-5061c196b3amr69337101cf.48.1770253307662; Wed, 04 Feb 2026 17:01:47 -0800 (PST) X-Received: by 2002:ac8:5a41:0:b0:502:6ed5:7b0d with SMTP id d75a77b69052e-5061c196b3amr69336501cf.48.1770253307030; Wed, 04 Feb 2026 17:01:47 -0800 (PST) Received: from [192.168.2.15] (lnsm3-montreal02-142-116-222-198.internet.virginmobile.ca. [142.116.222.198]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5061c147f42sm28252671cf.3.2026.02.04.17.01.46 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 04 Feb 2026 17:01:46 -0800 (PST) Message-ID: <2b453804-9ba9-4ec6-9ad3-2dda13ef3df7@redhat.com> Date: Wed, 4 Feb 2026 20:01:45 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 04/11] fwd: Check all configured addresses in guest accessibility functions To: David Gibson References: <20260130214447.2540791-1-jmaloy@redhat.com> <20260130214447.2540791-5-jmaloy@redhat.com> From: Jon Maloy In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: R07N0IYDksI-Lm-lzHhiDFQPNSN431cZRQ0KFYrLen4_1770253308 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Message-ID-Hash: LU4U5BQDZOOPMHYR5K2YDL2R2TEVMEPP X-Message-ID-Hash: LU4U5BQDZOOPMHYR5K2YDL2R2TEVMEPP X-MailFrom: jmaloy@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 2026-02-04 08:16, David Gibson wrote: > On Fri, Jan 30, 2026 at 04:44:40PM -0500, Jon Maloy wrote: >> As a preparation for handling multiple addresses, we update >> fwd_guest_accessible4() and fwd_guest_accessible6() to check >> against all addresses in the unified addrs[] array using the >> for_each_addr() macro. >> >> This ensures that when multiple addresses are configured via -a options, >> inbound traffic for any of them is correctly detected as having no valid >> forwarding path, and subsequently dropped. This occurs when a peer >> address collides with an address the guest is using, and we have no >> translation for it. >> >> Signed-off-by: Jon Maloy >> >> --- >> v2: Updated commit log to make it clearer >> v3: Adapted to changes earlier in the series >> --- >> fwd.c | 25 +++++++++++++++++-------- >> 1 file changed, 17 insertions(+), 8 deletions(-) >> >> diff --git a/fwd.c b/fwd.c >> index 54248a3..20d581d 100644 >> --- a/fwd.c >> +++ b/fwd.c >> @@ -502,6 +502,8 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini) >> static bool fwd_guest_accessible4(const struct ctx *c, >> const struct in_addr *addr) > > With the changes to this point, there's no longer a point to having > separate fwd_guest_accessible4() and fwd_guest_accessible6() > functions. fwd_guest_accessible() can check against the combined list > in a single pass. Absolutely. I have already identified several functions which can be unified in a similar way, and have already implemented some. But I still want to wait with such changes until this series has been applied. ///jon > > This is an example of the simplfications that I think will outweigh > the complications introduced by using merged list for v4 and v6 > addresses. > >> { >> + const struct inany_addr_entry *e; >> + >> if (IN4_IS_ADDR_LOOPBACK(addr)) >> return false; >> >> @@ -513,12 +515,15 @@ static bool fwd_guest_accessible4(const struct ctx *c, >> if (IN4_IS_ADDR_UNSPECIFIED(addr)) >> return false; >> >> - /* For IPv4, addr_seen is initialised to addr, so is always a valid >> - * address >> + /* Check against all configured guest addresses */ >> + for_each_addr(c, e, AF_INET) >> + if (IN4_ARE_ADDR_EQUAL(addr, inany_v4(&e->addr))) >> + return false; >> + >> + /* Also check addr_seen: it tracks the address the guest is actually >> + * using, which may differ from configured addresses. >> */ >> - if ((first_v4(c) && >> - IN4_ARE_ADDR_EQUAL(addr, inany_v4(&first_v4(c)->addr))) || >> - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) >> + if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) >> return false; >> >> return true; >> @@ -535,11 +540,15 @@ static bool fwd_guest_accessible4(const struct ctx *c, >> static bool fwd_guest_accessible6(const struct ctx *c, >> const struct in6_addr *addr) >> { >> + const struct inany_addr_entry *e; >> + >> if (IN6_IS_ADDR_LOOPBACK(addr)) >> return false; >> >> - if (first_v6(c) && IN6_ARE_ADDR_EQUAL(addr, &first_v6(c)->addr.a6)) >> - return false; >> + /* Check against all configured guest addresses */ >> + for_each_addr(c, e, AF_INET6) >> + if (IN6_ARE_ADDR_EQUAL(addr, &e->addr.a6)) >> + return false; >> >> /* For IPv6, addr_seen starts unspecified, because we don't know what LL >> * address the guest will take until we see it. Only check against it >> @@ -714,7 +723,7 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, >> first_v4(c) && inany_equals(addr, &first_v4(c)->addr)) { >> *translated = inany_from_v4(c->ip4.map_guest_addr); >> } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && >> - first_v6(c) && inany_equals6(addr, &first_v6(c)->addr.a6)) { >> + first_v6(c) && inany_equals(addr, &first_v6(c)->addr)) { >> translated->a6 = c->ip6.map_guest_addr; >> } else if (fwd_guest_accessible(c, addr)) { >> *translated = *addr; >> -- >> 2.52.0 >> >