From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=ceDY8qbX; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 261385A004E for ; Fri, 06 Feb 2026 04:29:39 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1770348576; bh=VPyWNghmqSxUal/ZpGvOFWARS593zGr13f7qdnNfCdU=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=ceDY8qbXGuFyUY4p5rzXCdvFynVYThMaym2Ay4qXi5vju8y+/ApFkrhxpuW7Blkxi mKGkC5XYVo++R/uqdfs5sPBGxnvfc9pzbRiT9j25YpCV7HeLduc96Ha3g9qM88n7nK QNiUNBErt3pqfuRWpJKju0MN/sA/7KyDkgDUcaod+9PvgEY2wwga3Aze9cttTFUV3z 2pM+1nYvOyZJBpZ7WPhCv54RNM3tWiKKW+7ALqJn1AtVfSvDnohtTIT60DAxDnddRb TUkdd+6Htp7qBZCUMFbn3/jWsF+oiei6Qxf78y3PCBXXww68SPJZpffRuv3iNrvmXh zF6o1jAP8ENpw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4f6fhw0RVBz4w9T; Fri, 06 Feb 2026 14:29:36 +1100 (AEDT) Date: Fri, 6 Feb 2026 13:29:30 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v3 04/11] fwd: Check all configured addresses in guest accessibility functions Message-ID: References: <20260130214447.2540791-1-jmaloy@redhat.com> <20260130214447.2540791-5-jmaloy@redhat.com> <2b453804-9ba9-4ec6-9ad3-2dda13ef3df7@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="eJewukDZkZnbUp2Q" Content-Disposition: inline In-Reply-To: <2b453804-9ba9-4ec6-9ad3-2dda13ef3df7@redhat.com> Message-ID-Hash: UQNFC3QZGBNKG7J3GU4YR235SKWSJZN4 X-Message-ID-Hash: UQNFC3QZGBNKG7J3GU4YR235SKWSJZN4 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, dgibson@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --eJewukDZkZnbUp2Q Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Feb 04, 2026 at 08:01:45PM -0500, Jon Maloy wrote: >=20 >=20 > On 2026-02-04 08:16, David Gibson wrote: > > On Fri, Jan 30, 2026 at 04:44:40PM -0500, Jon Maloy wrote: > > > As a preparation for handling multiple addresses, we update > > > fwd_guest_accessible4() and fwd_guest_accessible6() to check > > > against all addresses in the unified addrs[] array using the > > > for_each_addr() macro. > > >=20 > > > This ensures that when multiple addresses are configured via -a optio= ns, > > > inbound traffic for any of them is correctly detected as having no va= lid > > > forwarding path, and subsequently dropped. This occurs when a peer > > > address collides with an address the guest is using, and we have no > > > translation for it. > > >=20 > > > Signed-off-by: Jon Maloy > > >=20 > > > --- > > > v2: Updated commit log to make it clearer > > > v3: Adapted to changes earlier in the series > > > --- > > > fwd.c | 25 +++++++++++++++++-------- > > > 1 file changed, 17 insertions(+), 8 deletions(-) > > >=20 > > > diff --git a/fwd.c b/fwd.c > > > index 54248a3..20d581d 100644 > > > --- a/fwd.c > > > +++ b/fwd.c > > > @@ -502,6 +502,8 @@ static bool is_dns_flow(uint8_t proto, const stru= ct flowside *ini) > > > static bool fwd_guest_accessible4(const struct ctx *c, > > > const struct in_addr *addr) > >=20 > > With the changes to this point, there's no longer a point to having > > separate fwd_guest_accessible4() and fwd_guest_accessible6() > > functions. fwd_guest_accessible() can check against the combined list > > in a single pass. >=20 > Absolutely. I have already identified several functions which can be > unified in a similar way, and have already implemented some. > But I still want to wait with such changes until this series has been > applied. That doesn't make a lot of sense to me. I mean, I understand doing things one step at a time. But in this case keeping the old structure means a bunch of extra churn, and the intermediate steps are more confusing to read and review than they need to be. > > This is an example of the simplfications that I think will outweigh > > the complications introduced by using merged list for v4 and v6 > > addresses. > >=20 > > > { > > > + const struct inany_addr_entry *e; > > > + > > > if (IN4_IS_ADDR_LOOPBACK(addr)) > > > return false; > > > @@ -513,12 +515,15 @@ static bool fwd_guest_accessible4(const struct = ctx *c, > > > if (IN4_IS_ADDR_UNSPECIFIED(addr)) > > > return false; > > > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > > > - * address > > > + /* Check against all configured guest addresses */ > > > + for_each_addr(c, e, AF_INET) > > > + if (IN4_ARE_ADDR_EQUAL(addr, inany_v4(&e->addr))) > > > + return false; > > > + > > > + /* Also check addr_seen: it tracks the address the guest is actually > > > + * using, which may differ from configured addresses. > > > */ > > > - if ((first_v4(c) && > > > - IN4_ARE_ADDR_EQUAL(addr, inany_v4(&first_v4(c)->addr))) || > > > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > > > + if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > > > return false; > > > return true; > > > @@ -535,11 +540,15 @@ static bool fwd_guest_accessible4(const struct = ctx *c, > > > static bool fwd_guest_accessible6(const struct ctx *c, > > > const struct in6_addr *addr) > > > { > > > + const struct inany_addr_entry *e; > > > + > > > if (IN6_IS_ADDR_LOOPBACK(addr)) > > > return false; > > > - if (first_v6(c) && IN6_ARE_ADDR_EQUAL(addr, &first_v6(c)->addr.a6)) > > > - return false; > > > + /* Check against all configured guest addresses */ > > > + for_each_addr(c, e, AF_INET6) > > > + if (IN6_ARE_ADDR_EQUAL(addr, &e->addr.a6)) > > > + return false; > > > /* For IPv6, addr_seen starts unspecified, because we don't know w= hat LL > > > * address the guest will take until we see it. Only check agains= t it > > > @@ -714,7 +723,7 @@ bool nat_inbound(const struct ctx *c, const union= inany_addr *addr, > > > first_v4(c) && inany_equals(addr, &first_v4(c)->addr)) { > > > *translated =3D inany_from_v4(c->ip4.map_guest_addr); > > > } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && > > > - first_v6(c) && inany_equals6(addr, &first_v6(c)->addr.a6)) { > > > + first_v6(c) && inany_equals(addr, &first_v6(c)->addr)) { > > > translated->a6 =3D c->ip6.map_guest_addr; > > > } else if (fwd_guest_accessible(c, addr)) { > > > *translated =3D *addr; > > > --=20 > > > 2.52.0 > > >=20 > >=20 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --eJewukDZkZnbUp2Q Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmmFYBkACgkQzQJF27ox 2GexSRAApEBv3rRqovNT+E8YjuQA75AVFFMXMluri+rpHwHDpiYNDgDPj9pnNqqy yhaW6eSqIbG5h1qtM+527PSVLX0pnqtfrt6iCttm9IBst7+VQ6BBMh04VHh4P8W2 fknLS/1RNRI1O0vnH60jg48NJTOzt5zxRptcVrQNfvhud50+lCk2YVSRY1itf0AX LloArVPPNxCO2mofim3F7SToJmgfoubGaDHBiWyZo3mEv9aITIRkZ6wIDwhlRGo2 08qZo9rhq+HCr0r8NwSZg6RpXNPNjfE3dP7t1PR0SUJuK5N4ffmYdJRnFUv8OmZv MzqGTfLLXRZjgM+2QCZLBjrmGFUG8OcGzJinoX9JC+aa9BXN8F62M/6XdEWf4OwH tazSItFSzwj3q6fca83oNE7j7RmKD613g4kC3T/bvj3TGkwVMLoCGRLtW83TbOx7 j9xvjnYlBENtGOqRNq03a/tf0v9cqK65I3MZ5haN7ITyuby/J6MVtVl8yQp4GQcc mJqJXW0Q+ELqhnC7PnmSQEKCHhMgXYawafeak+YJ2KBUoQn0xI8s4rj3Kiv1GsbL rVRX4AxFKpfZAdtkDaqOzv0db0vPLIKuD4jifkNfW/flI8hwNpmhsbPqQUdBcWyH gDJCLC6SFGwNX4Y4LkPGtA+qSdG0nxsG7YgVrd4PmDb0PLjAqZw= =w+0c -----END PGP SIGNATURE----- --eJewukDZkZnbUp2Q--