From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202602 header.b=gRGk7EF7; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 1447F5A061E for ; Mon, 25 May 2026 11:38:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202602; t=1779701916; bh=LYgh4zz6SPLPl/9Ro8zmMRoBQ3u/4VeywrtaZKux9TM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=gRGk7EF7bNQ80McQVc7mwP3hjsD+FtYEVKozSctL/O14InqP0NJjbulEQsSofrMsG OciU2mTL+VbFqzFgGzQW++0Q4ppP5Ikkb5E7ujQABgGZT2/XEbqbV4+FZxQl/K9SoE 0DVA5U0cbqIUpvpaM87jZaQTNK450BNzBdBa9CpGPuHMiKuuzHhRYI7n1V22k7/EQU o/XwVdK/ZCzAIZQDDn2z17ZF9eYw60Q+i2Q0H12Wa1Sd+GVrQfq2gJ8S4WlgxXGe70 V2ZAc+ceQTUUVMAPgK2ejaLUa1MtAzc9If0INhUbw1jOMA8dE3GF3Jdg7x+q70PwzZ 3scyKqNz8xinA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gP9mr3DDmz4wKG; Mon, 25 May 2026 19:38:36 +1000 (AEST) Date: Mon, 25 May 2026 19:38:31 +1000 From: David Gibson To: Jon Maloy Subject: Re: [PATCH v7 03/13] fwd: Unify guest accessibility checks with unified address array Message-ID: References: <20260413005319.3295910-1-jmaloy@redhat.com> <20260413005319.3295910-4-jmaloy@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="80ZbALM6gp9w5Xyf" Content-Disposition: inline In-Reply-To: <20260413005319.3295910-4-jmaloy@redhat.com> Message-ID-Hash: HJIOH72HMFEUQRTG7ORDIF6AMMY76A4K X-Message-ID-Hash: HJIOH72HMFEUQRTG7ORDIF6AMMY76A4K X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: sbrivio@redhat.com, passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --80ZbALM6gp9w5Xyf Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Apr 12, 2026 at 08:53:09PM -0400, Jon Maloy wrote: > We replace the fwd_guest_accessible4() and fwd_guest_accessible6() > functions with a unified fwd_guest_accessible() function that handles > both address families. With the unified address array, we can check > all configured addresses in a single pass using for_each_addr() with > family filter AF_UNSPEC. >=20 > Signed-off-by: Jon Maloy Reviewed-by: David Gibson Small pre-existing nit noted below, but it probably goes away later in the series anyway. >=20 > --- > v6: -Some fixes based on feedback from David Gibson > v7: -Added curly brackets to for_each_addr() in fwd_guest_accessible(), > as suggested by Stefano Brivio. > --- > fwd.c | 69 +++++++++++++---------------------------------------------- > 1 file changed, 15 insertions(+), 54 deletions(-) >=20 > diff --git a/fwd.c b/fwd.c > index 14ce0a7..e676c18 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -988,19 +988,19 @@ static bool is_dns_flow(uint8_t proto, const struct= flowside *ini) > } > =20 > /** > - * fwd_guest_accessible4() - Is IPv4 address guest-accessible > + * fwd_guest_accessible() - Is address guest-accessible > * @c: Execution context > - * @addr: Host visible IPv4 address > + * @addr: Host visible address (IPv4 or IPv6) > * > * Return: true if @addr on the host is accessible to the guest without > * translation, false otherwise > */ > -static bool fwd_guest_accessible4(const struct ctx *c, > - const struct in_addr *addr) > +static bool fwd_guest_accessible(const struct ctx *c, > + const union inany_addr *addr) > { > const struct guest_addr *a; > =20 > - if (IN4_IS_ADDR_LOOPBACK(addr)) > + if (inany_is_loopback(addr)) > return false; > =20 > /* In socket interfaces 0.0.0.0 generally means "any" or unspecified, > @@ -1008,38 +1008,18 @@ static bool fwd_guest_accessible4(const struct ct= x *c, > * that has a different meaning for host and guest, we can't let it > * through untranslated. > */ > - if (IN4_IS_ADDR_UNSPECIFIED(addr)) > + if (inany_is_unspecified(addr)) > return false; > =20 > - /* For IPv4, addr_seen is initialised to addr, so is always a valid > - * address > + /* Check against all configured guest addresses */ > + for_each_addr(a, c->addrs, c->addr_count, AF_UNSPEC) { > + if (inany_equals(addr, &a->addr)) > + return false; > + } > + /* Also check addr_seen: it tracks the address the guest is actually > + * using, which may differ from configured addresses. > */ > - a =3D fwd_get_addr(c, AF_INET, 0, 0); > - if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) || > - IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) > - return false; > - > - return true; > -} > - > -/** > - * fwd_guest_accessible6() - Is IPv6 address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv6 address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible6(const struct ctx *c, > - const struct in6_addr *addr) > -{ > - const struct guest_addr *a; > - > - if (IN6_IS_ADDR_LOOPBACK(addr)) > - return false; > - > - a =3D fwd_get_addr(c, AF_INET6, 0, 0); > - if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6)) > + if (inany_equals4(addr, &c->ip4.addr_seen)) > return false; > =20 > /* For IPv6, addr_seen starts unspecified, because we don't know what LL > @@ -1047,31 +1027,12 @@ static bool fwd_guest_accessible6(const struct ct= x *c, > * if it has been set to a real address. > */ > if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) && Pre-existing nit: this test is unnecessary, we already checked that this address is not unspecified, so if addr_seen *is* unspecified, they can't be equal. > - IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen)) > + inany_equals6(addr, &c->ip6.addr_seen)) > return false; > =20 > return true; > } > =20 > -/** > - * fwd_guest_accessible() - Is IPv[46] address guest-accessible > - * @c: Execution context > - * @addr: Host visible IPv[46] address > - * > - * Return: true if @addr on the host is accessible to the guest without > - * translation, false otherwise > - */ > -static bool fwd_guest_accessible(const struct ctx *c, > - const union inany_addr *addr) > -{ > - const struct in_addr *a4 =3D inany_v4(addr); > - > - if (a4) > - return fwd_guest_accessible4(c, a4); > - > - return fwd_guest_accessible6(c, &addr->a6); > -} > - > /** > * nat_outbound() - Apply address translation for outbound (TAP to HOST) > * @c: Execution context > --=20 > 2.52.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --80ZbALM6gp9w5Xyf Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmoUGJYACgkQzQJF27ox 2GcmXRAAgzWVYeFl8X0LBydvrEDFlsnnolTAVmFxUjbTe6TxzgN/VXZNsdeP7S6o 6jYShTEntJo7XlGSSwyJA/3IPbdm9oKeTRBTE+lFNwjm9jV9ZJchfv/w40kQ8xYZ EyWs1524eni36dtb1RNIfFRo6hrWENk6t5GhhKXGNh/msluFepWVLvCQwykH/xS3 vN5bbGmcFIs4lNgPg13+i8yM55jYksE/uoxegOUZsy16Yv9Df5j+p4yuX1/xo4Ta 8joYIp/rlB8FB1TnLMHOGGW1+umaYzdPZhMXEf6cLY9q3TxtpLByEp3v5Pf2Fydd PENFISC0rb2xIdv6+8EXkwvj7+nh7caG5FEyGhZDN+TMtV6HrGPaEZNC79g21DSM 1gZrCloXPqKdXlimPSk8BeySxNhBQr3Rfic8uDuNAlHbzNIrCqbA9qJAa5c7neUf f0TIU7xe6K8d5c2KKzBrkj7v3/CvfBvCGNgu6Tr3zNtGfv0pP3R8oCTJiYJVEuGe 3Qqd41rWqcE6wWuR0oyIECifr65hesfIYQZ/JZMF4NIZMZP4TZYSwa+UoZXbmrwn YDu4tGeGnKKgBAk+G/mrJ3Qb9d6rpQ9DHAlBJigDNpXBGne/kVnlU5IVW4VCyOEK t34bveiwd6J66MQa4NJvjh+Dvg8g+0b1fx6mA/rPsD+U3ywCeGI= =AnaQ -----END PGP SIGNATURE----- --80ZbALM6gp9w5Xyf--