From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=NBstHCyu; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 9FE465A0652 for ; Wed, 04 Feb 2026 15:47:54 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1770216470; bh=dJzr6Lh4JX53/cLiwNHUWbBa9TPv+LYrrmzbHpyLU8c=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=NBstHCyu6PRWQsQz2UF+gDuA+/es5b4lE6yaEjhIuBb328hY5vmwry3b0lvSV9DcE 6j6odZTQEhgQ2v4Jm7xTpK9QKVYV2/9aj90hVB57TRG2IKulAEKUEJFGixsnycdMn2 hf0o/i0pU63soC4nS65fu8Zj2H0rRmlqWwu5yO7vKzlUwLuDdcXW1VDTSo5IMmTx8m +oyE2PoHpX4Gt5uwKVV5NLOEbQrOkFbBjssCcUNRQbzOiZZToVLcNbGb9HHohPD92D ZtDcJy7NxuRGO00DhZcCtSR1O0dRN2q368WSfcXwCMdc1RkTPtkG8c5AH0uknZVlGv JaR1sVm9fQnIA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4f5jrQ6XcJz4wpb; Thu, 05 Feb 2026 01:47:50 +1100 (AEDT) Date: Wed, 4 Feb 2026 23:16:00 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v3 04/11] fwd: Check all configured addresses in guest accessibility functions Message-ID: References: <20260130214447.2540791-1-jmaloy@redhat.com> <20260130214447.2540791-5-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="v/Y2m69DMZ9jBOwj" Content-Disposition: inline In-Reply-To: <20260130214447.2540791-5-jmaloy@redhat.com> Message-ID-Hash: QJM5ATDG6YRVSJW6Z6WSF26UJ3BM2Z54 X-Message-ID-Hash: QJM5ATDG6YRVSJW6Z6WSF26UJ3BM2Z54 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --v/Y2m69DMZ9jBOwj Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jan 30, 2026 at 04:44:40PM -0500, Jon Maloy wrote: > As a preparation for handling multiple addresses, we update > fwd_guest_accessible4() and fwd_guest_accessible6() to check > against all addresses in the unified addrs[] array using the > for_each_addr() macro. >=20 > This ensures that when multiple addresses are configured via -a options, > inbound traffic for any of them is correctly detected as having no valid > forwarding path, and subsequently dropped. This occurs when a peer > address collides with an address the guest is using, and we have no > translation for it. >=20 > Signed-off-by: Jon Maloy >=20 > --- > v2: Updated commit log to make it clearer > v3: Adapted to changes earlier in the series > --- > fwd.c | 25 +++++++++++++++++-------- > 1 file changed, 17 insertions(+), 8 deletions(-) >=20 > diff --git a/fwd.c b/fwd.c > index 54248a3..20d581d 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -502,6 +502,8 @@ static bool is_dns_flow(uint8_t proto, const struct f= lowside *ini) > static bool fwd_guest_accessible4(const struct ctx *c, > const struct in_addr *addr) With the changes to this point, there's no longer a point to having separate fwd_guest_accessible4() and fwd_guest_accessible6() functions. fwd_guest_accessible() can check against the combined list in a single pass. This is an example of the simplfications that I think will outweigh the complications introduced by using merged list for v4 and v6 addresses. > { > + const struct inany_addr_entry *e; > + > if (IN4_IS_ADDR_LOOPBACK(addr)) > return false; > =20 > @@ -513,12 +515,15 @@ static bool fwd_guest_accessible4(const struct ctx = *c, > if (IN4_IS_ADDR_UNSPECIFIED(addr)) > return false; > =20 > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > - * address > + /* Check against all configured guest addresses */ > + for_each_addr(c, e, AF_INET) > + if (IN4_ARE_ADDR_EQUAL(addr, inany_v4(&e->addr))) > + return false; > + > + /* Also check addr_seen: it tracks the address the guest is actually > + * using, which may differ from configured addresses. > */ > - if ((first_v4(c) && > - IN4_ARE_ADDR_EQUAL(addr, inany_v4(&first_v4(c)->addr))) || > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > + if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > return false; > =20 > return true; > @@ -535,11 +540,15 @@ static bool fwd_guest_accessible4(const struct ctx = *c, > static bool fwd_guest_accessible6(const struct ctx *c, > const struct in6_addr *addr) > { > + const struct inany_addr_entry *e; > + > if (IN6_IS_ADDR_LOOPBACK(addr)) > return false; > =20 > - if (first_v6(c) && IN6_ARE_ADDR_EQUAL(addr, &first_v6(c)->addr.a6)) > - return false; > + /* Check against all configured guest addresses */ > + for_each_addr(c, e, AF_INET6) > + if (IN6_ARE_ADDR_EQUAL(addr, &e->addr.a6)) > + return false; > =20 > /* For IPv6, addr_seen starts unspecified, because we don't know what LL > * address the guest will take until we see it. Only check against it > @@ -714,7 +723,7 @@ bool nat_inbound(const struct ctx *c, const union ina= ny_addr *addr, > first_v4(c) && inany_equals(addr, &first_v4(c)->addr)) { > *translated =3D inany_from_v4(c->ip4.map_guest_addr); > } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && > - first_v6(c) && inany_equals6(addr, &first_v6(c)->addr.a6)) { > + first_v6(c) && inany_equals(addr, &first_v6(c)->addr)) { > translated->a6 =3D c->ip6.map_guest_addr; > } else if (fwd_guest_accessible(c, addr)) { > *translated =3D *addr; > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --v/Y2m69DMZ9jBOwj Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmmDRoAACgkQzQJF27ox 2GdH7g//eVD2nmpU5o/kCaTcIuyuPqZLvYy6rzN7xF+oixXKMC7xIwSGLGySDrIH cgYm4/AtzQDO4Xm/2vzYSJHrYtLwPwzxsuiOPfOO9+Uqn7OdDuFwLZxF1vBB4L3Q 3POjP47G4fH/V4hT4DpKMoYavQ0h1jhszHwgd20oyn2l5XXaglGqut0pQVin49Zj ew3qovIJoBjDX6zEeT3x+4Shtf1z5mcyKkNdmhWIW3X3l19ZbqwSNMdvPcIWtVrK Ju+C3gXAxpgbitu1vCexbfHLWVUC1VR4KXx8d0USCOAjTe7dhlE57gb/9+WJlfHg jbw277aYY96yATC3mXSxlQUrVdlDk5qKoElODnVFIvf7Tvf3rEqD+XIhRUSOU37r BRV3qBbQW5iJATMTY+yxawyTx8W7PDW2kPtTGdwhJIvgh17byorSTrKq0EwTaWM2 EHlbJlKfsNU35+eOH615S6wAjk6uzEYAZ2WIOWTp9L77+ib1m82tgHmeB/psfzmc ys88C4j+kVe5olPLgYQ4S658BnB0JhVwivUwA2yX7XTYscdtw9Jc7DgAgvXAE3iV Y8dLVrmcdQDG4Ko4UombkKksifQOmpJa7eq3lvdOGBZ4b0tbcv5P+/FioWeDFTqK 1m497ECkG4pkfLWa7nhrU56/kk++mrYaetwro1BSQ7DJrIVeMWQ= =N/l5 -----END PGP SIGNATURE----- --v/Y2m69DMZ9jBOwj--