From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=dHQui9wQ; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 92F605A026D for ; Mon, 13 Jul 2026 07:39:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783921140; bh=PvKl+XDkST/FqxeqbboZtS4/VE9WSkM7/3YnvphGXZM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=dHQui9wQ+3CunfFjAQNTnt02kHRhkEWUE694SBLfKDV2txp+WE/O+DI37APy9cJjr dY/8n/j7X/luzHE8CKmzU8fXaNKAYRd7VazDX7a9SwZ1XWUcZnoDWuKL48Z+hWzAvB 9H7en8uWbeLRizCQGCIbSRK+JlAHfPRcDforoeS3Ck62H3kYXqQjGNuNbCxu/BoidB FGywDEdnbwtm+vN73xy2uZkhaX8mN8YDlfRDm36hkxXd+20gP2aKCfNlKFoyGklXHg hTr2311ROIO+QonbL4Suu/0oDAbc98Hqjd3oix9UJEN/EF8qTce7BxXfzB5O1TGmVc yqUiuwiDZFa8A== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzB7m16VFz4wHl; Mon, 13 Jul 2026 15:39:00 +1000 (AEST) Date: Mon, 13 Jul 2026 13:30:22 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH 1/5] fwd: Clarify semantics of --host-lo-to-ns-lo Message-ID: References: <20260710065611.530947-1-david@gibson.dropbear.id.au> <20260710065611.530947-2-david@gibson.dropbear.id.au> <20260713023935.48158b4f@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="4POg4yCAQYryBioY" Content-Disposition: inline In-Reply-To: <20260713023935.48158b4f@elisabeth> Message-ID-Hash: TAZSIOIF5BMPEQIXGIAMOD664VJHT6MG X-Message-ID-Hash: TAZSIOIF5BMPEQIXGIAMOD664VJHT6MG X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --4POg4yCAQYryBioY Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jul 13, 2026 at 02:39:35AM +0200, Stefano Brivio wrote: > Nits only (pretty much for the whole series, even though I have > slightly more substantial remarks for 3/5 and 5/5, so I thought I'd > point all of them out): >=20 > On Fri, 10 Jul 2026 16:56:07 +1000 > David Gibson wrote: >=20 > > The semantics of --host-lo-to-ns-lo as described in the man page don't > > quite make sense: It says without the option forwarded packets will app= ear > > to come _from_ the guest's public address, which is not usually true. > > Instead the packets will arrive *to* the guest's public address. The e= xact > > semantics are also a bit confusing in general. > >=20 > > Rewrite both the man page and code to clarify this. The new rule is th= at > > it redirects connections addressed to a host loopback address to the sa= me > > loopback address in the guest. This is notionally different from what = we > > had in two ways: > > * We can now deliver to nonstandard loopback addresses within the gue= st, > > not just the default one. This is technically a behavioural change, > > but I think will be less surprising behaviour. > > * The decision is now made on the original _destination_ address, rat= her > > than source address. That's different theoreically, but not in >=20 > theoretically Oops, fixed. [snip] > > .TP > > .BR \-\-host-lo-to-ns-lo > > -If specified, connections forwarded with \fB\-t\fR and \fB\-u\fR from > > -the host's loopback address will appear on the loopback address in the > > -guest as well. Without this option such forwarded packets will appear > > -to come from the guest's public address. > > +If specified, connections to a host loopback address forwarded with > > +\fB\-t\fR or \fB\-u\fR will be delivered to the same loopback address > > +on the guest. Without this option such connections are forwarded to > > +the guest's public address. This option is incompatible with > > +\fB--no-splice\fR. >=20 > Pre-existing, but still somewhat confusing: this is one part of the man > page where we don't specify "guest or namespace", we just use "guest", > and yet it's never a guest, it's always a namespace. >=20 > Should we just change all the occurrences of "guest" to "namespace" in > this paragraph? Good idea, done. For future reference, in cases where it's less obvious which namespace we're talking about, how do you feel about "guest namespace". --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --4POg4yCAQYryBioY Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpUW7cACgkQzQJF27ox 2GfVuw/9GGNl7FD46xWNgu57JnH4sad+TzXIR9BBhQnBG3A6rG2GCefOXte+lHAN YR4sjExBAsu+U3kdZxbNK6MoQzkXyHcF08CF4DD7UQ8MiXqp9D48BTdAzZYqVuXR qlDvB9bg1txoUyLbb0UVtPjwI1YUVlYstdYV8JAC8WoGGd0GPq+hWCbstEumddcl nCA2elNSujKKokzc/VPC4kPx2q64pk5dcEetJjZL983Vqlc9W4iZKHDgS3Ygrsgi gSwlFxoK5A7Z2QQb4vL/90qGr0lAEzmaCsAkMKN5B7IVdEvJlckVkTAOZX3d+X3l YpWiF7W2R6e52S/vLGWnHZqQCHQuOcyj/1hxd+Z0eNx9R3KWCV+icBVwqOtKnry5 Rwnov9ceQnGM7pZgxYrEkmq8iLmtl6KDlqQFnfUnm49vSA2wXSYThXtmR3meuGyn hoA38v+rznY4MX2cq1Q8MvYOUpPvUyrQNookYjo507tak2eIkMQ5YZqKImKd07d+ Yyq8YWyvG2+TeHBernSnrHvthAUCnRccYyEe4sBksItlCfNdwSwOzHzKB/OehEr4 oSWahFHOPXP98WpDT5HVjTLnWs8Zs1dp/EXcHaAn0UWopFTjDBolVCkJyqo7+Gsa aFXi4hHsBRvx72Gq94qNdsKDYLxm0ZuyLsPaHaHx3t5e+p1ndcU= =rRNK -----END PGP SIGNATURE----- --4POg4yCAQYryBioY--