From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=IJ0Q5uwK; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id D60875A0623 for ; Mon, 19 Jan 2026 09:24:56 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1768811092; bh=6rJlp2ZbrCMn2gLCDDMxMr2PzLQgsaOl/lKUOfbMe9A=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=IJ0Q5uwKJKRblpoUooRy/BINepaX7Yt3NzWN2R3iWDEak4IROCElL+3OX9iGOukGQ qgHGvT/8vSY7Pu1IofOjyo0QQyhUcme7J6Og5myy8vx5YO1bWarX2RhO7Up+hv2EWu DsgYJq0gAuiL2l/gWDgxqQxwyXQf/Dyiy2Rz+s3hrhUl3UFr0BhSNIKT74RXMYe8GK 29oRXP6QsXWFcPHj6T1Ob55AoKK2H5vZvK2RxnVFXrf+SyowC5+cadeuoB/SmeGeBZ /vAo/wm6MxJ4mOzGvVAsdt6rkz0faQkusxWOZ8/WKQZhXUCfwu7z1OKDrDbj11wlKO 410I/pnecvEGw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dvk5w5BHQz4wCp; Mon, 19 Jan 2026 19:24:52 +1100 (AEDT) Date: Mon, 19 Jan 2026 18:29:25 +1100 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v2 4/9] fwd: Check all configured addresses in guest accessibility functions Message-ID: References: <20260118221612.2115386-1-jmaloy@redhat.com> <20260118221612.2115386-5-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GONqqmXqdx5c82pe" Content-Disposition: inline In-Reply-To: <20260118221612.2115386-5-jmaloy@redhat.com> Message-ID-Hash: KVGZXOAX2FCID35R2LVRPJ77KKM5BH3N X-Message-ID-Hash: KVGZXOAX2FCID35R2LVRPJ77KKM5BH3N X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --GONqqmXqdx5c82pe Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jan 18, 2026 at 05:16:07PM -0500, Jon Maloy wrote: > As a preparation for handling multiple addresses, we update > fwd_guest_accessible4() and fwd_guest_accessible6() to check > against all addresses in the addrs[] array. >=20 > This ensures that when multiple addresses are configured via -a options, > inbound traffic for any of them is correctly detected as having no valid > forwarding path, and subsequently dropped. This occurs when a peer > address collides with an address the guest is using, and we have no > translation for it. >=20 > Signed-off-by: Jon Maloy >=20 > --- > v2: Updated commit log to make it clearer > --- > fwd.c | 22 ++++++++++++++++------ > 1 file changed, 16 insertions(+), 6 deletions(-) >=20 > diff --git a/fwd.c b/fwd.c > index 8d8151b..f1db34c 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -502,6 +502,8 @@ static bool is_dns_flow(uint8_t proto, const struct f= lowside *ini) > static bool fwd_guest_accessible4(const struct ctx *c, > const struct in_addr *addr) fwd_guest_accesible[46]() are only ever called via fwd_guest_accessible() which takes an inny_addr. Again, you can simplify this a bunch by actually exploiting the fact that the arrays are now also inany_addr, rather than having an inany_addr but still having separate v4 and v6 paths everywhere. > { > + int i; > + > if (IN4_IS_ADDR_LOOPBACK(addr)) > return false; > =20 > @@ -513,11 +515,15 @@ static bool fwd_guest_accessible4(const struct ctx = *c, > if (IN4_IS_ADDR_UNSPECIFIED(addr)) > return false; > =20 > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > - * address > + /* Check against all configured guest addresses */ > + for (i =3D 0; i < c->ip4.addr_count; i++) > + if (IN4_ARE_ADDR_EQUAL(addr, inany_v4(&c->ip4.addrs[i].addr))) > + return false; > + > + /* Also check addr_seen: it tracks the address the guest is actually > + * using, which may differ from configured addresses. > */ > - if (IN4_ARE_ADDR_EQUAL(addr, inany_v4(&c->ip4.addrs[0].addr)) || > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > + if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > return false; > =20 > return true; > @@ -534,11 +540,15 @@ static bool fwd_guest_accessible4(const struct ctx = *c, > static bool fwd_guest_accessible6(const struct ctx *c, > const struct in6_addr *addr) > { > + int i; > + > if (IN6_IS_ADDR_LOOPBACK(addr)) > return false; > =20 > - if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addrs[0].addr.a6)) > - return false; > + /* Check against all configured guest addresses */ > + for (i =3D 0; i < c->ip6.addr_count; i++) > + if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addrs[i].addr.a6)) > + return false; > =20 > /* For IPv6, addr_seen starts unspecified, because we don't know what LL > * address the guest will take until we see it. Only check against it > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --GONqqmXqdx5c82pe Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmlt3VUACgkQzQJF27ox 2GcY0RAAhN05xqpGDPFSACBRNdaFsow+DregMx3bS2xcdg4AdDAx5d6SPSoqtTgC z0oeGVKMX4BveWfQzaNgSq9Kaw9DLEztZrM3nEt4wrMIWX6T6cw8phMfhhFdeKkg xGTluzCWNekuPszn2tAFRTTCLfw/rV7m6bpNNaJA6nNXvv/qSkENpfLJtYqsYFbN msZg6gCJCx3TW/BtsKi0ER0a5vIMHSsspNiKARg1u6tUFNZM0Uj3SpoYekwg/OSF cX6cEtDwMrr3/uzDvaX47cedx9BPpZJa8AbcF/jZNhijFEIMLnCs3qHkCRHtM7aj 3OmuvgQNSnRh+l82t2+qZUcktva202BSmrVx9y0LlA28tZNrsvb6gPExSGcoUy2+ uLR+LuWLAFnkYnfRZ4P1Hg2+NPhTfmZTXCxwyh10+oZQCM8oFCm06XDAEdhYhudL mtM7sBPbm64UU2Z/wcQSKigDDBHI3ASrJB77cFIliJjmyE3roqfAvcO93/cebKxp iSHSOqMv17BURnV/XVqU+RjP2yiavcidqFfO65nhBlF74NEP/5o3F41/W1Ql57AJ GMimTUZsg7jB/gzHCfBlgUDnVwFxF/YSe+vTCtu4EvexuHYFbjqktT1zYjmIL6cD MVn4OyNNnX4nYlEvRuW6qYGBhog/8zZyabRpAopEakeGtdohDA0= =FmJ6 -----END PGP SIGNATURE----- --GONqqmXqdx5c82pe--