From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=C5j8iltr; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 8D37A5A0274 for ; Mon, 13 Jul 2026 07:39:08 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1783921140; bh=Fdc0L7BSnD6mI9MAwi4GO+Z215PWGiYVaQe+ARpQtcA=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=C5j8iltrxWngXAzdbMFbhgzeqJpQjQyPWF1iQ222wr6qbaQdIKJHPInEqpaO/+UwX 5PPb/WilQZsOzvToNMhH8BgpW/416fHrkCGl/qnG9YAzM1REO7vqFnTMuiQfntmpRp 3/jMombtkPGpnI0MoeSFgkEAPMKzUXLgd0WonFJycss8OoiWvk0AAvkIeXuNf1ikyz wcdFM8TC1+esY9UGvahE4Wis3GRM82OhG6GszleSp9FsQl1gmBhSZalInXq8deFP11 v01NvzsC3cAY+jZzZc6w/XLi/cbbr0hcWbWaF0PWx35JZLj5cQHQDIsFqERUeBtcKj c03kYkf0dtAVw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4gzB7m1SXWz4wFN; Mon, 13 Jul 2026 15:39:00 +1000 (AEST) Date: Mon, 13 Jul 2026 14:06:18 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH 5/5] fwd: Don't rewrite inbound multicast destinations Message-ID: References: <20260710065611.530947-1-david@gibson.dropbear.id.au> <20260710065611.530947-6-david@gibson.dropbear.id.au> <20260713023954.6b7a931b@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="WsmRgqIX+UOENTJU" Content-Disposition: inline In-Reply-To: <20260713023954.6b7a931b@elisabeth> Message-ID-Hash: 65MT6B2CMGAQGVLGKIW6GUCEYYRBYUB2 X-Message-ID-Hash: 65MT6B2CMGAQGVLGKIW6GUCEYYRBYUB2 X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --WsmRgqIX+UOENTJU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Jul 13, 2026 at 02:39:54AM +0200, Stefano Brivio wrote: > On Fri, 10 Jul 2026 16:56:11 +1000 > David Gibson wrote: >=20 > > fwd_nat_from_host() (nearly) always rewrites the destination address for > > inbound flows to the observed guest address. Usually, that makes sense: > > regardless of the host address to which the new flow arrived, we want to > > direct it to the guest. However, that clearly does not make sense for > > multicast - it should still appear as a multicast transmission to the > > guest. > >=20 > > In particular this can work very badly for multicast protocols which use > > the same source and destination ports by convention (e.g. mDNS). In th= is > > case, we will attempt to forword multicast packets to our own socket, > > causing a forwarding loop (see bug 209 for more details). > >=20 > > While it's certainly not enough to make us handle multicast correctly in > > all circumstances, not translating multicast destinations is closer to > > correct, and prevents bug 209 at least. > >=20 > > Link: https://bugs.passt.top/show_bug.cgi?id=3D209 > > Signed-off-by: David Gibson > > --- > > fwd.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > >=20 > > diff --git a/fwd.c b/fwd.c > > index 7d39898e..e59413b6 100644 > > --- a/fwd.c > > +++ b/fwd.c > > @@ -1045,7 +1045,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > > tgt->eport =3D rule->to + (ini->oport - rule->first); > > if (!inany_is_unspecified(&rule->taddr)) > > tgt->eaddr =3D rule->taddr; > > - else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) > > + else if (inany_is_multicast(&ini->oaddr) || >=20 > This is a bit convoluted: if one reads this commit message it makes > sense, but if one reads just the code later it's absolutely unclear > that this is needed to avoid the inany_is_unspecified(&tgt->eaddr) > clause at the end of the function (mostly). >=20 > Should we add a comment? Right now I can't come up with any reasonable > suggestion of where to place it or what to write in it, though. Uh.. agreed on both points. It *is* a bit convoluted, but I'm not sure how to clarify it either. I'm hoping it will mostly go away if we can switch to selecting the target pif based on the rule rather than the bespoke logic we have here. >=20 > > + (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))) > > tgt->eaddr =3D ini->oaddr; > > =20 > > /* TODO: Allow splicing with specified target address */ >=20 > --=20 > Stefano >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --WsmRgqIX+UOENTJU Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpUZCUACgkQzQJF27ox 2Gf19w/+O8WUX2LmjFP87uRXMzZgHFtTE/P6bUup7DJAxtnEEidrqdfmQgClvqBs FDSsfUibmvipq8W+0hI6m7xc3V9eUOhoLMUNNkYIgmF3mD5CbeoCXa17yHcBa8CC WoMjrrerQErgxr4U7LdvfJKDfgYfWHhHaWKkvG9EnONYvNmJLIL8Mv8LjOv2/EsP tC8BcoixJbUPS8/OJqoHZaZlzD2Zi6UVt7UB+LeONX8eaqcyv6H/MVaqIWaYiX9P SYdicF9yg6rm+8daM28BfUCxCCm397bV9fb3r+FT3YfNhkJy6aAYEz/p+rDnK7uX y0Ma+SIVaMMvaNkpuNLgrD3Lx99ipUtHVBM0dXAoZjC/asr20LU7arEDWzUwrUj5 4rrAeMi6IxokVGRuWO8mIzurp4Hvbsu5COL3cPw6Oeh2VPAQPtYcAjrdpdTg9iZX b28faTrqlePlbLALeIZAmgyd7y7CxhqgdAzIpXIc5W8BRB9bCk7/lIqukti9uBtl 9gwOgoh6U+DWcRKWUjrqR0x3AgQYAoLt1i3ZhCBFqf0LMxKzWuEe4SGhKXlEivvc frVO09DgIo4hI0E40jCfdBJlUrUHABlQgY3X5Oaqu+4TATrwGFdp1klxHDbbUpjp 8o4RiRmqq4/1jBBluCb3nY7wxo9CyzLn2r5/QkrLeGU/AahLtfw= =fasO -----END PGP SIGNATURE----- --WsmRgqIX+UOENTJU--