From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=FiHZQDRj; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 22EC65A004E for ; Tue, 13 Jan 2026 06:28:59 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1768282136; bh=hbA5kmJdTTfN1DRLGtR0l/7V/lN7XAo6myhp/sAJxZA=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=FiHZQDRj62djqLPrUk65hgCyBCrQ/CS0qBJMdD1UoOrg/XwHt/0XP+NBdLCFCfVeo bKIvpw5rqHqYuppWrJIJU+gA+WGWjV+mOIquJ9QP+SsRRlzIpRDJWczLjfOuLqJ+FC R8NFJ7jg8LA80P02QVXBE44Wpcm9V/5v6l5xi/d+Pg0YEJZA9cGsrpO27vGr+/dX/N eVpdqS4N4cQrgVkjygyv3hiXzNnWRK0zJuqLlM61Pgwjk4hZ9m6wDQ7liGKeK2dVkb LWbVs6q2x2JEqK5ngNLIveXhVkBq3OAUQTsQYDnGJ3KGZc7lNdNyEcCJtXJX4VpfaI Xp8SmzRjwqHKw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dqyTh0LL7z4wCk; Tue, 13 Jan 2026 16:28:56 +1100 (AEDT) Date: Tue, 13 Jan 2026 16:14:23 +1100 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v3 04/14] conf, fwd: Record "auto" port forwards in forwarding table Message-ID: References: <20260108022948.2657573-1-david@gibson.dropbear.id.au> <20260108022948.2657573-5-david@gibson.dropbear.id.au> <20260113002615.53c73c8b@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="DqC5bxtAqAprd0me" Content-Disposition: inline In-Reply-To: <20260113002615.53c73c8b@elisabeth> Message-ID-Hash: HFPYMZTGKYOPATKENAGNHI7GG3NHIMVP X-Message-ID-Hash: HFPYMZTGKYOPATKENAGNHI7GG3NHIMVP X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --DqC5bxtAqAprd0me Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jan 13, 2026 at 12:26:15AM +0100, Stefano Brivio wrote: > On Thu, 8 Jan 2026 13:29:38 +1100 > David Gibson wrote: >=20 > > Currently the forwarding table records details of explicit port forward= s, > > but nothing for -[tTuU] auto. That looks a little odd on the debug out= put, > > and will be a problem for future changes. > >=20 > > Extend the forward table to have rules for auto-scanned forwards, > > using a new FWD_SCAN flag. For now the mechanism of auto port > > forwarding isn't updated, and we will only create a single FWD_SCAN > > rule per protocol and direction. We'll better integrate auto scanning > > with other forward table mechanics in future. > >=20 > > Signed-off-by: David Gibson > > --- > > conf.c | 31 ++++++++++++++++++++++++++----- > > fwd.c | 18 +++++++++++------- > > fwd.h | 2 ++ > > 3 files changed, 39 insertions(+), 12 deletions(-) > >=20 > > diff --git a/conf.c b/conf.c > > index b486fefe..0bcf80d7 100644 > > --- a/conf.c > > +++ b/conf.c > > @@ -135,7 +135,7 @@ static int parse_port_range(const char *s, char **e= ndptr, > > * @ifname: Listening interface > > * @first: First port to forward > > * @last: Last port to forward > > - * @exclude: Bitmap of ports to exclude > > + * @exclude: Bitmap of ports to exclude (may be NULL) > > * @to: Port to translate @first to when forwarding > > * @flags: Flags for forwarding entries > > */ > > @@ -168,11 +168,11 @@ static void conf_ports_range_except(const struct = ctx *c, char optname, > > } > > =20 > > for (base =3D first; base <=3D last; base++) { > > - if (bitmap_isset(exclude, base)) > > + if (exclude && bitmap_isset(exclude, base)) > > continue; > > =20 > > for (i =3D base; i <=3D last; i++) { > > - if (bitmap_isset(exclude, i)) > > + if (exclude && bitmap_isset(exclude, i)) > > break; > > =20 > > if (bitmap_isset(fwd->map, i)) { > > @@ -180,9 +180,9 @@ static void conf_ports_range_except(const struct ct= x *c, char optname, > > "Altering mapping of already mapped port number: %s", optarg); > > } > > =20 > > - if (optname =3D=3D 't') > > + if (!(flags & FWD_SCAN) && optname =3D=3D 't') > > fd =3D tcp_listen(c, PIF_HOST, addr, ifname, i); > > - else if (optname =3D=3D 'u') > > + else if (!(flags & FWD_SCAN) && optname =3D=3D 'u') > > fd =3D udp_listen(c, PIF_HOST, addr, ifname, i); > > else > > /* No way to check in advance for -T and -U */ > > @@ -2202,6 +2202,27 @@ void conf(struct ctx *c, int argc, char **argv) > > if (!c->udp.fwd_out.mode) > > c->udp.fwd_out.mode =3D fwd_default; > > =20 > > + if (c->tcp.fwd_in.mode =3D=3D FWD_AUTO) { > > + conf_ports_range_except(c, 't', "auto", &c->tcp.fwd_in, > > + NULL, NULL, 1, NUM_PORTS - 1, > > + NULL, 1, FWD_SCAN); > > + } > > + if (c->tcp.fwd_out.mode =3D=3D FWD_AUTO) { > > + conf_ports_range_except(c, 'T', "auto", &c->tcp.fwd_out, > > + NULL, "lo", 1, NUM_PORTS - 1, > > + NULL, 1, FWD_SCAN); > > + } > > + if (c->udp.fwd_in.mode =3D=3D FWD_AUTO) { > > + conf_ports_range_except(c, 'u', "auto", &c->udp.fwd_in, > > + NULL, NULL, 1, NUM_PORTS - 1, > > + NULL, 1, FWD_SCAN); > > + } > > + if (c->udp.fwd_out.mode =3D=3D FWD_AUTO) { > > + conf_ports_range_except(c, 'U', "auto", &c->udp.fwd_out, > > + NULL, "lo", 1, NUM_PORTS - 1, > > + NULL, 1, FWD_SCAN); > > + } > > + > > if (!c->quiet) > > conf_print(c); > > } > > diff --git a/fwd.c b/fwd.c > > index ad398e54..69aca441 100644 > > --- a/fwd.c > > +++ b/fwd.c > > @@ -344,7 +344,7 @@ void fwd_rule_add(struct fwd_ports *fwd, uint8_t fl= ags, > > in_port_t first, in_port_t last, in_port_t to) > > { > > /* Flags which can be set from the caller */ > > - const uint8_t allowed_flags =3D FWD_WEAK; > > + const uint8_t allowed_flags =3D FWD_WEAK | FWD_SCAN; > > struct fwd_rule *new; > > unsigned port; > > =20 > > @@ -375,7 +375,8 @@ void fwd_rule_add(struct fwd_ports *fwd, uint8_t fl= ags, > > =20 > > for (port =3D new->first; port <=3D new->last; port++) { > > /* Fill in the legacy data structures to match the table */ > > - bitmap_set(fwd->map, port); > > + if (!(new->flags & FWD_SCAN)) > > + bitmap_set(fwd->map, port); > > fwd->delta[port] =3D new->to - new->first; > > } > > } > > @@ -391,19 +392,22 @@ void fwd_rules_print(const struct fwd_ports *fwd) > > for (i =3D 0; i < fwd->count; i++) { > > const struct fwd_rule *rule =3D &fwd->rules[i]; > > const char *weak =3D rule->flags & FWD_WEAK ? " WEAK" : ""; > > + const char *scan =3D rule->flags & FWD_SCAN ? " AUTO" : ""; > > const char *percent =3D *rule->ifname ? "%" : ""; > > char addr[INANY_ADDRSTRLEN]; > > =20 > > inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr)); > > =20 > > if (rule->first =3D=3D rule->last) { > > - info(" [%s]%s%s:%hu =3D> %hu %s", > > + info(" [%s]%s%s:%hu =3D> %hu %s%s", > > addr, percent, rule->ifname, > > - rule->first, rule->to, weak); > > + rule->first, rule->to, weak, scan); > > } else { > > - info(" [%s]%s%s:%hu-%hu =3D> %hu-%hu %s", > > - addr, percent, rule->ifname, rule->first, rule->last, > > - rule->to, rule->last - rule->first + rule->to, weak); > > + info(" [%s]%s%s:%hu-%hu =3D> %hu-%hu %s%s", > > + addr, percent, rule->ifname, > > + rule->first, rule->last, > > + rule->to, rule->last - rule->first + rule->to, > > + weak, scan); > > } > > } > > } > > diff --git a/fwd.h b/fwd.h > > index 3dfc7959..94869c2a 100644 > > --- a/fwd.h > > +++ b/fwd.h > > @@ -26,6 +26,7 @@ bool fwd_port_is_ephemeral(in_port_t port); > > * @flags: Flag mask > > * FWD_DUAL_STACK_ANY - match any IPv4 or IPv6 address (@addr should = be ::) > > * FWD_WEAK - Don't give an error if binds fail for some forwards > > + * FWD_SCAN - Only forward if we scan a listener on the target >=20 > Nit: I guess this could be slightly more descriptive than "scan a > listener", mentioning for example "if the corresponding port is bound > on the target". Done. >=20 > > * > > * FIXME: @addr and @ifname currently ignored for outbound tables > > */ > > @@ -35,6 +36,7 @@ struct fwd_rule { > > in_port_t first, last, to; > > #define FWD_DUAL_STACK_ANY BIT(0) > > #define FWD_WEAK BIT(1) > > +#define FWD_SCAN BIT(2) > > uint8_t flags; > > }; > > =20 >=20 > --=20 > Stefano >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --DqC5bxtAqAprd0me Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmll1K4ACgkQzQJF27ox 2Gc2XA/+Om+HZGZNi7khmiWlEY2LvjaOnlRur+J+dLb5/WMlmX41u8CG/73oNPIP ESY3fc+XbdwNYaaR8DZqDtWt+4hYlwWYwdYQdsLUlDIHid6J0MEdBWH9QX/PXqVp +pd9kIrUn43BaREjhrFIRw7Yllp19OZEUdr0ql3+/h8Wv9TcOZHu4ML/R9jEGWIV 3BbrpE4+lr+0QUx6qCjket0MzyR5bmRH43eACF/W2PrUjGllRgEOKOChllzFbhzT LjD7sRHXQgyw5aqD61Q6jxTUayhb4czGrxINq6nck5BbtRvo3VG8ZbyWeEI5Shp/ r6jQrP/liHii6Fx8GB3B+dD8oCLZTZSkWxLmayZTtYxXKpHgm6mIYuUJXdsOG2x/ OJmpxKglpuNmqLdsqf32vYdmDZ7mA80oeDsKgMqIkP/RpOpw+nbTPiWBbNq0GURl vlroqhuhmLtF6yjcSwTtvmPRFaob0lWkJd/A6VYfXRgeiHnND//wZMaqyv6JHGei hFKkT9/oRzGPsEHs3tup1QCrhXkMwt33nOYspJGNZWxQpDswUx95zGOrzR/fZPE9 Ve12xI03lrcdiyhIKIKfT1jGZBi4P8KdwH8US+nYCUB9nkWoNzGkMnU3j7lHnhQi RIQjNIdWPxsg5iN9qVvHZclwuX8BOBk0zl36IuAWtu3KnqYnpms= =jCFO -----END PGP SIGNATURE----- --DqC5bxtAqAprd0me--