From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202606 header.b=mYlmtgsB; dkim-atps=neutral Received: from mail.ozlabs.org (gandalf.ozlabs.org [150.107.74.76]) by passt.top (Postfix) with ESMTPS id 01DDE5A0265 for ; Fri, 24 Jul 2026 02:44:19 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202606; t=1784853855; bh=6iqnVA5fP0Z/x+5i6hOzSEy2oaq3TmgldjwsMca+FBM=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=mYlmtgsBSlD1kBAcE4q7ffEjia1oKcN4YZqBNkUW1AHDuL+uG2WRY8VorrpWZo9Ky Twd2qxAutxEhHEF1MOCyCtxKPPVEZdz0+z0/hKiI4VL/W8zOeEIrL4HTmQf6Q5S2/4 Mm9PkA44XQkN5kWULv3AIENMHlBKVdJebblLA49egkh1j/hR0p2vhOvG4rQp+wupGK tTKrINCtBFBvGgdptDdZVKBE+1feJ9qTGOVcO4LtvKyd4R0M1LEhLCEv9x+3PvuUF8 Iax6mXk9HOA+F/7FTJ/9JIreVFnoPqLD//ghAgklwXhb6ApBDXATse9so0ORv6NXwp BoLvvDwrZ93Sw== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4h5q4b1nqPz4wGx; Fri, 24 Jul 2026 10:44:15 +1000 (AEST) Date: Fri, 24 Jul 2026 10:44:08 +1000 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH v2 2/2] conf, fwd: Prefer same-scope address as inbound source address from host Message-ID: References: <20260723151603.2967615-1-sbrivio@redhat.com> <20260723151603.2967615-3-sbrivio@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MK/b6HwObUzTrFYO" Content-Disposition: inline In-Reply-To: <20260723151603.2967615-3-sbrivio@redhat.com> Message-ID-Hash: H4WVJYRK7CG2OOVQCCM6XF5OW53WQDQQ X-Message-ID-Hash: H4WVJYRK7CG2OOVQCCM6XF5OW53WQDQQ X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, Jan =?iso-8859-1?Q?Rod=E1k?= , Paul Holzinger X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --MK/b6HwObUzTrFYO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jul 23, 2026 at 05:16:03PM +0200, Stefano Brivio wrote: > We might have situations, such as the one described in > https://bugs.passt.top/show_bug.cgi?id=3D217, where using a link-local > address as source in a given namespace doesn't guarantee that we can > reach the intended destination, because, for instance, the inbound > traffic we forward is in turn forwarded to a different interface, such > as a bridge. >=20 > In that case, the assumption from 9618d247006a ("ndp, dhcpv6, tcp, > udp: Always use link-local as source if gateway isn't") isn't a safe > one: the user might have specified a valid gateway address, matching > the scope of the destination address, but we won't use it as address > of last resort, and prefer a link-local address with a mismatch in > scope instead. >=20 > So, if the user specifies a given default gateway address for IPv6, > note that as 'our_tap_addr', like we would do with with IPv4, and > stick to Rule 2 of RFC 6724, Section 5, when selecting a source > address, by preferring an address with the same scope, if available. >=20 > Note that this preference will be applied only if, at the point of > the source address selection, the destination address is already > known, which, in general, only happens if there's an explicit mapping > rule specifying the target destination address. >=20 > Otherwise, if there's no explicit rule picking the destination > address, we select the destination address after selecting the source > address. This should probably be improved at some point, to select > matching address pairs (when a compatible one is available) instead of > sequentially picking source and destination addresses. That appears to > be beyond the scope of this patch, though. >=20 > Reported-by: Paul Holzinger > Link: https://bugs.passt.top/show_bug.cgi?id=3D217 > Signed-off-by: Stefano Brivio Reviewed-by: David Gibson > --- > v2: Use the address passed as --gateway as source for inbound NAT from > the host regardless of local mode, see: >=20 > https://bugs.passt.top/show_bug.cgi?id=3D217#c5 >=20 > conf.c | 8 ++++++-- > fwd.c | 6 +++++- > passt.h | 2 ++ > 3 files changed, 13 insertions(+), 3 deletions(-) >=20 > diff --git a/conf.c b/conf.c > index 8205dbf..faf2681 100644 > --- a/conf.c > +++ b/conf.c > @@ -490,6 +490,8 @@ static unsigned int conf_ip6(unsigned int ifi, struct= ip6_ctx *ip6) > =20 > if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw)) > ip6->our_tap_ll =3D ip6->guest_gw; > + else > + ip6->our_tap_addr =3D ip6->guest_gw; > =20 > if (IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) || > IN6_IS_ADDR_UNSPECIFIED(&ip6->our_tap_ll)) > @@ -507,10 +509,12 @@ static void conf_ip6_local(struct ip6_ctx *ip6) > if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) > ip6->guest_gw =3D IP6_LL_GUEST_GW; > =20 > - if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw)) > + if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw)) { > ip6->our_tap_ll =3D ip6->guest_gw; > - else > + } else { > + ip6->our_tap_addr =3D ip6->guest_gw; > ip6->our_tap_ll =3D IP6_LL_GUEST_GW; > + } > =20 > ip6->no_copy_addrs =3D ip6->no_copy_routes =3D true; > } > diff --git a/fwd.c b/fwd.c > index 7152169..4ba0af3 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -1090,7 +1090,11 @@ uint8_t fwd_nat_from_host(const struct ctx *c, > return PIF_NONE; > tgt->oaddr =3D inany_from_v4(c->ip4.our_tap_addr); > } else { > - tgt->oaddr.a6 =3D c->ip6.our_tap_ll; > + if (inany_is_linklocal6(&tgt->eaddr) || > + IN6_IS_ADDR_UNSPECIFIED(&c->ip6.our_tap_addr)) > + tgt->oaddr.a6 =3D c->ip6.our_tap_ll; > + else > + tgt->oaddr.a6 =3D c->ip6.our_tap_addr; > } > } > tgt->oport =3D ini->eport; > diff --git a/passt.h b/passt.h > index a61baca..51ccd4f 100644 > --- a/passt.h > +++ b/passt.h > @@ -121,6 +121,7 @@ struct ip4_ctx { > * @dns: DNS addresses for DHCPv6 and NDP > * @dns_match: Forward DNS query if sent to this address > * @our_tap_ll: Link-local IPv6 address for passt's use on tap > + * @our_tap_addr: Non-LL IPv6 address for passt's use on tap (if any) > * @dns_host: Use this DNS on the host for forwarding > * @addr_out: Optional source address for outbound traffic > * @ifname_out: Optional interface name to bind outbound sockets to > @@ -140,6 +141,7 @@ struct ip6_ctx { > struct in6_addr dns[MAXNS]; > struct in6_addr dns_match; > struct in6_addr our_tap_ll; > + struct in6_addr our_tap_addr; > =20 > /* PIF_HOST addresses */ > struct in6_addr dns_host; > --=20 > 2.43.0 >=20 --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --MK/b6HwObUzTrFYO Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmpitVEACgkQzQJF27ox 2GfUZw//fJC0XTOwhYCoPHK0MQTnYYEP3ouXblKe7RCVYTG7IyXyDKq7ZKuO9tia mPt6kg9sUV4Wfeb8DfD47ZIgaJb+N1Gcg+kGHsMGz7LVYHtUeKenXlCCrP3Wuzx9 M/U1xpA4Hx1JeDzkZK3axAo+5qiwyoYN6g6sgPiGFxG/Pbt+t0W/x9aWCr7A+TuC 8LOHnYirLovX4CzQP6ETS14D5/0B+UXMMKLTVaRgDelmXm3sCDsaSj/J07FFWBBS zeHan5pRgAgOUMmWSJnOUyVIG33+Hpy18vUZK3qPaKIO/nmFLVcov9M6/Jrs1FXB AG/FGW6p7hWa01uIYDJgY9fdEinx5bYkPdRxOeVZYrRkNi998Q/K7q2Y5IfjxdDE QZPE53T2qssx1SFi0hQYAaf8d/1UOL/eM2oBRNv3zpflrCXQ+tg4yHyVOOfFhTMb yXoTN6X+2wJz1qm83G/xYLmJlv5CF9SPnYic9ZFQ3WKaOckZX1p4wG90wxtcWBhU VxgF1xGA8SzeorVZFGkze0a1C9xBQOlX8+NoL9KoWwJCPaoA0gGtTTr+enpCBoXp Pzmrj0NOmze/KatGnvx8DnK+krmvHhMVfYJh03tIkxLo9mVSmNkHZvdC63qdph46 xmdM4NjT+V+jVrZJBIRffCJTmDxeuWS1YSoOTFb1KvNB/2hIDJ4= =vAL/ -----END PGP SIGNATURE----- --MK/b6HwObUzTrFYO--