- dev - passt

[PATCH] tcp: Update EPOLL_TYPE_TCP_TIMER fd
by Laurent Vivier 24 Dec '25

24 Dec '25

For consistency with other epoll events, set the fd field to the file descriptor actually added by epoll_ctl() (conn->timer), rather than conn->sock. This is a no-op change as ref.fd is not currently used in tcp_timer_handler(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index b179e3991236..fade42b0c4d9 100644 --- a/tcp.c +++ b/tcp.c @@ -554,7 +554,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer != -1) { union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev_t = { .data.u64 = ref_t.u64, .events = EPOLLIN | EPOLLET }; @@ -582,7 +582,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer == -1) { union epoll_ref ref = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev = { .data.u64 = ref.u64, .events = EPOLLIN | EPOLLET }; -- 2.51.1

2 1

[PATCH 0/2] Cleanups to listening socket init functions
by David Gibson 24 Dec '25

24 Dec '25

Another small preliminary for flexible forwarding. This makes some cleanups to the functions which create listening sockets for TCP and UDP. No functional changes. David Gibson (2): tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() udp: Rename udp_sock_init() to udp_listen() with small cleanups conf.c | 4 +-- tcp.c | 94 +++++++++++++++++++++------------------------------------- tcp.h | 6 ++-- udp.c | 32 +++++++++----------- udp.h | 6 ++-- 5 files changed, 56 insertions(+), 86 deletions(-) -- 2.52.0

2 3

[PATCH] pasta: Warn, disable matching IP version if not supported, in local mode
by Stefano Brivio 23 Dec '25

23 Dec '25

...instead of exiting, but only if local mode is enabled, that is, if we couldn't find a template interface or if the user didn't specify one. With IPv4, we always try to set or copy an address, so check if that fails. With IPv6, in local mode, we rely on the link-local address that's automatically generated inside the target namespace, and only fail later, as we try to set up routes. Check if that fails, instead. Otherwise, we'll fail to start if IPv6 support is not built in or disabled by the kernel ("ipv6.disable=1" on the command line), because, in that case, we'll try to enable local mode by default, and then fail to set any address or route. It would probably be more elegant to check for IP version support in conf_ip4_local() and conf_ip6_local(), and not even try to enable connectivity for unsupported versions, but it looks less robust than trying and failing, as there might be other ways to disable a given IP version. Note that there's currently no way to disable IPv4 support on the kernel command line, that is, there's no such thing as an ipv4.disable boot parameter. But I guess that's due to be eventually implemented, one day, so let's cover that case as well, also for consistency. Reported-by: Iyan <iyanmv(a)gmail.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2424192 Fixes: 4ddd59bc6085 ("conf: Separate local mode for each IP version, don't enable disabled IP version") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- pasta.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/pasta.c b/pasta.c index c307b8a..0ddd6b0 100644 --- a/pasta.c +++ b/pasta.c @@ -348,6 +348,12 @@ void pasta_ns_conf(struct ctx *c) AF_INET); } + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + goto ipv4_done; + } + if (rc < 0) { die("Couldn't set IPv4 address(es) in namespace: %s", strerror_(-rc)); @@ -367,6 +373,7 @@ void pasta_ns_conf(struct ctx *c) strerror_(-rc)); } } +ipv4_done: if (c->ifi6) { rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, @@ -413,12 +420,19 @@ void pasta_ns_conf(struct ctx *c) AF_INET6); } + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + goto ipv6_done; + } + if (rc < 0) { die("Couldn't set IPv6 route(s) in guest: %s", strerror_(-rc)); } } } +ipv6_done: proto_update_l2_buf(c->guest_mac); } -- 2.43.0

1 0

[PATCH v3 0/2] conf: Support CIDR notation for -a/--address option
by Jon Maloy 21 Dec '25

21 Dec '25

conf: Support CIDR notation for -a/--address option --- v3: Fixes after feedback from Laurent, David and Stefano Notably, updated man page for the -a option Jon Maloy (2): conf: Support CIDR notation for -a/--address option doc: Document CIDR notation support for -a/--address option conf.c | 94 ++++++++++++++++++++++++++++++++++++++++++++++++--------- passt.1 | 10 ++++-- 2 files changed, 87 insertions(+), 17 deletions(-) -- 2.52.0

2 2

[PATCH v3 1/2] conf: Support CIDR notation for -a/--address option
by Jon Maloy 21 Dec '25

21 Dec '25

Extend the -a/--address option to accept addresses in CIDR notation (e.g., 192.168.1.1/24 or 2001:db8::1/64) as an alternative to using separate -a and -n options. Add conf_addr_prefix_len() helper function that: - Parses address strings with optional /prefix_len suffix using inany_pton() - Validates prefix length based on address family (0-32 for IPv4, 0-128 for IPv6) - Returns address family via union inany_addr output parameter For IPv4, the prefix length is stored in ip4.prefix_len when provided. Mixing -n and CIDR notation results in an error to catch likely user mistakes. Also fix a bug in conf_ip4_prefix() that was incorrectly using the global 'optarg' instead of its 'arg' parameter. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- conf.c | 94 ++++++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 79 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index 2942c8c..81a6ca3 100644 --- a/conf.c +++ b/conf.c @@ -682,7 +682,7 @@ static int conf_ip4_prefix(const char *arg) return -1; } else { errno = 0; - len = strtoul(optarg, NULL, 0); + len = strtoul(arg, NULL, 0); if (len > 32 || errno) return -1; } @@ -690,6 +690,50 @@ static int conf_ip4_prefix(const char *arg) return len; } +/** + * conf_addr_prefix_len() - Parse address with optional prefix length + * @arg: Address string, optionally with /prefix_len suffix (modified) + * @addr: Output for parsed address + * @prefix_len: Output for prefix length (0 if not specified) + * + * Return: AF_INET for IPv4, AF_INET6 for IPv6, -1 on error + */ +static int conf_addr_prefix_len(char *arg, union inany_addr *addr, + int *prefix_len) +{ + char *slash; + + *prefix_len = 0; + + /* Check for /prefix_len suffix */ + slash = strchr(arg, '/'); + if (slash) { + unsigned long len; + char *end; + + *slash = '\0'; + errno = 0; + len = strtoul(slash + 1, &end, 10); + if (errno || *end) + return -1; + + *prefix_len = len; + } + + if (!inany_pton(arg, addr)) + return -1; + + if (inany_v4(addr)) { + if (*prefix_len > 32) + return -1; + return AF_INET; + } + + if (*prefix_len > 128) + return -1; + return AF_INET6; +} + /** * conf_ip4() - Verify or detect IPv4 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -896,7 +940,7 @@ static void usage(const char *name, FILE *f, int status) " a zero value disables assignment\n" " default: 65520: maximum 802.3 MTU minus 802.3 header\n" " length, rounded to 32 bits (IPv4 words)\n" - " -a, --address ADDR Assign IPv4 or IPv6 address ADDR\n" + " -a, --address ADDR Assign IPv4 or IPv6 address ADDR[/PREFIXLEN]\n" " can be specified zero to two times (for IPv4 and IPv6)\n" " default: use addresses from interface with default route\n" " -n, --netmask MASK Assign IPv4 MASK, dot-decimal or bits\n" @@ -1499,6 +1543,7 @@ void conf(struct ctx *c, int argc, char **argv) const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; char userns[PATH_MAX] = { 0 }, netns[PATH_MAX] = { 0 }; bool copy_addrs_opt = false, copy_routes_opt = false; + bool prefix_from_cidr = false, prefix_from_opt = false; enum fwd_ports_mode fwd_default = FWD_NONE; bool v4_only = false, v6_only = false; unsigned dns4_idx = 0, dns6_idx = 0; @@ -1808,23 +1853,39 @@ void conf(struct ctx *c, int argc, char **argv) c->mtu = mtu; break; } - case 'a': - if (inet_pton(AF_INET6, optarg, &c->ip6.addr) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr) && - !IN6_IS_ADDR_LOOPBACK(&c->ip6.addr) && - !IN6_IS_ADDR_V4MAPPED(&c->ip6.addr) && - !IN6_IS_ADDR_V4COMPAT(&c->ip6.addr) && - !IN6_IS_ADDR_MULTICAST(&c->ip6.addr)) { + case 'a': { + union inany_addr addr; + const struct in_addr *a4; + int prefix_len = 0; + int af; + + af = conf_addr_prefix_len(optarg, &addr, &prefix_len); + + if (af == AF_INET6 && + !IN6_IS_ADDR_UNSPECIFIED(&addr.a6) && + !IN6_IS_ADDR_LOOPBACK(&addr.a6) && + !IN6_IS_ADDR_V4MAPPED(&addr.a6) && + !IN6_IS_ADDR_V4COMPAT(&addr.a6) && + !IN6_IS_ADDR_MULTICAST(&addr.a6)) { + c->ip6.addr = addr.a6; if (c->mode == MODE_PASTA) c->ip6.no_copy_addrs = true; break; } - if (inet_pton(AF_INET, optarg, &c->ip4.addr) && - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr) && - !IN4_IS_ADDR_BROADCAST(&c->ip4.addr) && - !IN4_IS_ADDR_LOOPBACK(&c->ip4.addr) && - !IN4_IS_ADDR_MULTICAST(&c->ip4.addr)) { + a4 = inany_v4(&addr); + if (af == AF_INET && a4 && + !IN4_IS_ADDR_UNSPECIFIED(a4) && + !IN4_IS_ADDR_BROADCAST(a4) && + !IN4_IS_ADDR_LOOPBACK(a4) && + !IN4_IS_ADDR_MULTICAST(a4)) { + c->ip4.addr = *a4; + if (prefix_len) { + if (prefix_from_opt) + die("Can't use both -n and CIDR prefix length"); + c->ip4.prefix_len = prefix_len; + prefix_from_cidr = true; + } if (c->mode == MODE_PASTA) c->ip4.no_copy_addrs = true; break; @@ -1832,11 +1893,14 @@ void conf(struct ctx *c, int argc, char **argv) die("Invalid address: %s", optarg); break; + } case 'n': + if (prefix_from_cidr) + die("Can't use both -n and CIDR prefix length"); c->ip4.prefix_len = conf_ip4_prefix(optarg); if (c->ip4.prefix_len < 0) die("Invalid netmask: %s", optarg); - + prefix_from_opt = true; break; case 'M': parse_mac(c->our_tap_mac, optarg); -- 2.52.0

2 1

[PATCH v2] tcp: Update EPOLL_TYPE_TCP_TIMER fd
by Laurent Vivier 20 Dec '25

20 Dec '25

For consistency with other epoll events, set the fd field to the file descriptor actually added by epoll_ctl() (conn->timer), rather than conn->sock. This is a no-op change as ref.fd is not currently used in tcp_timer_handler(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index b179e3991236..6e6156098c12 100644 --- a/tcp.c +++ b/tcp.c @@ -554,7 +554,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer != -1) { union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev_t = { .data.u64 = ref_t.u64, .events = EPOLLIN | EPOLLET }; @@ -582,7 +582,6 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer == -1) { union epoll_ref ref = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, .flow = FLOW_IDX(conn) }; struct epoll_event ev = { .data.u64 = ref.u64, .events = EPOLLIN | EPOLLET }; @@ -598,6 +597,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) return; } conn->timer = fd; + ref.fd = conn->timer; if (epoll_ctl(epollfd, EPOLL_CTL_ADD, conn->timer, &ev)) { flow_dbg_perror(conn, "failed to add timer"); -- 2.51.1

2 1

[PATCH v2 00/12] RFC: Improve forwarding data structure
by David Gibson 19 Dec '25

19 Dec '25

This replaces the existing data structures storing forwarding information, with new ones that can store more detailed and flexible information, Eventually we plan to allow dynamically updating this as well. Patches 1, 2 & 8 could be merged (1 & 2 are the same as the the earlier series with cleanups to the listening socket init functions). The rest are just for early review. Since I'm going to be away for the next two weeks, no rush at all. v2: * Remove preliminary patches already merged * Add several patches actually using the new data structure David Gibson (12): tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() udp: Rename udp_sock_init() to udp_listen() with small cleanups conf, fwd: Keep a table of our port forwarding configuration conf: Accurately record ifname and address for outbound forwards conf, fwd: Record "auto" port forwards in forwarding table tcp, udp: Make {tcp,udp}_listen() return socket fds fwd: Make space to store listening sockets in forward table ip: Add ipproto_name() function fwd, tcp, udp: Set up listening sockets based on forward table tcp, udp: Remove old auto-forwarding socket arrays fwd: Generate auto-forward exclusions from socket fd tables tcp: Remove unused tcp_epoll_ref conf.c | 125 +++++++++++++++++--------- fwd.c | 273 +++++++++++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 49 ++++++++++- ip.c | 26 ++++++ ip.h | 2 + tcp.c | 190 +++------------------------------------ tcp.h | 17 +--- udp.c | 140 ++--------------------------- udp.h | 8 +- 9 files changed, 447 insertions(+), 383 deletions(-) -- 2.52.0

1 10

[PATCH v2 04/12] conf: Accurately record ifname and address for outbound forwards
by David Gibson 19 Dec '25

19 Dec '25

-T and -U options don't allow specifying a listening address. Usually this will listen on *%lo in the guest. However on kernels without unprivileged SO_BINDTODEVICE that's not possible so we instead listen separately on 127.0.0.1 and ::1. Currently that's handled at the point we actually set up the listens, we record both address and ifname as NULL in the forwarding table entry. That will cause trouble for future extensions we want, so update this to accurately create the forwarding table: either a single entry with ifname == "lo" or two entries with address of 127.0.0.1 and ::1. As a bonus, this gives the user a warning if they specify an explicit outbound forwarding on a kernel without SO_BINDTODEVICE. The existing warning for missing SO_BINDTODEVICE (incorrectly) only covers the case of -T auto or -U auto. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index ae2dc3e1..af9e82f5 100644 --- a/conf.c +++ b/conf.c @@ -157,12 +157,6 @@ static void conf_ports_range_except(const struct ctx *c, char optname, optname, optarg); } - if (ifname && c->no_bindtodevice) { - die( -"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", - optname, optarg); - } - for (base = first; base <= last; base++) { if (bitmap_isset(exclude, base)) continue; @@ -202,8 +196,27 @@ static void conf_ports_range_except(const struct ctx *c, char optname, } } - fwd_table_add(fwd, flags, addr, ifname, - base, i - 1, base + delta); + if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { + /* FIXME: Once the fwd bitmaps are removed, move this + * workaround to the caller + */ + ASSERT(!addr && ifname && !strcmp(ifname, "lo")); + warn( +"SO_BINDTODEVICE unavailable, forwarding only 127.0.0.1 and ::1 for '-%c %s'", + optname, optarg); + + if (c->ifi4) { + fwd_table_add(fwd, flags, &inany_loopback4, NULL, + base, i - 1, base + delta); + } + if (c->ifi6) { + fwd_table_add(fwd, flags, &inany_loopback6, NULL, + base, i - 1, base + delta); + } + } else { + fwd_table_add(fwd, flags, addr, ifname, + base, i - 1, base + delta); + } base = i - 1; } @@ -350,6 +363,15 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, } } while ((p = next_chunk(p, ','))); + if (ifname && c->no_bindtodevice) { + die( +"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", + optname, optarg); + } + /* Outbound forwards come from guest loopback */ + if ((optname == 'T' || optname == 'U') && !ifname) + ifname = "lo"; + if (exclude_only) { /* Exclude ephemeral ports */ for (i = 0; i < NUM_PORTS; i++) -- 2.52.0

1 0

[PATCH v2 03/12] conf, fwd: Keep a table of our port forwarding configuration
by David Gibson 19 Dec '25

19 Dec '25

At present, we set up forwarding as we parse the -t, and -u options, not keeping a persistent data structure with all the details. We do have some information in struct fwd_ports, but it doesn't capture all the nuance that the options do. As a first step to generalising our forwarding model, add a table of all the forwarding configured to struct fwd_ports. For now it covers only explicit forwards, not automatic, and we don't do anything with it other than print some additional debug information. We'll do more with it in future patches. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 83 +++++++++++++++++++++++++++++++++++++--------------------- fwd.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++++ fwd.h | 33 ++++++++++++++++++++++- 3 files changed, 161 insertions(+), 31 deletions(-) diff --git a/conf.c b/conf.c index 84ae12b2..ae2dc3e1 100644 --- a/conf.c +++ b/conf.c @@ -137,7 +137,7 @@ static int parse_port_range(const char *s, char **endptr, * @last: Last port to forward * @exclude: Bitmap of ports to exclude * @to: Port to translate @first to when forwarding - * @weak: Ignore errors, as long as at least one port is mapped + * @flags: Flags for forwarding entries */ static void conf_ports_range_except(const struct ctx *c, char optname, const char *optarg, struct fwd_ports *fwd, @@ -145,10 +145,11 @@ static void conf_ports_range_except(const struct ctx *c, char optname, const char *ifname, uint16_t first, uint16_t last, const uint8_t *exclude, uint16_t to, - bool weak) + uint8_t flags) { + unsigned delta = to - first; bool bound_one = false; - unsigned i; + unsigned base, i; int ret; if (first == 0) { @@ -162,37 +163,48 @@ static void conf_ports_range_except(const struct ctx *c, char optname, optname, optarg); } - for (i = first; i <= last; i++) { - if (bitmap_isset(exclude, i)) + for (base = first; base <= last; base++) { + if (bitmap_isset(exclude, base)) continue; - if (bitmap_isset(fwd->map, i)) { - warn( -"Altering mapping of already mapped port number: %s", optarg); - } + for (i = base; i <= last; i++) { + if (bitmap_isset(exclude, i)) + break; - bitmap_set(fwd->map, i); - fwd->delta[i] = to - first; + if (bitmap_isset(fwd->map, i)) { + warn( +"Altering mapping of already mapped port number: %s", optarg); + } - if (optname == 't') - ret = tcp_listen(c, PIF_HOST, addr, ifname, i); - else if (optname == 'u') - ret = udp_listen(c, PIF_HOST, addr, ifname, i); - else - /* No way to check in advance for -T and -U */ - ret = 0; + bitmap_set(fwd->map, i); + fwd->delta[i] = delta; + + if (optname == 't') + ret = tcp_listen(c, PIF_HOST, addr, ifname, i); + else if (optname == 'u') + ret = udp_listen(c, PIF_HOST, addr, ifname, i); + else + /* No way to check in advance for -T and -U */ + ret = 0; + + if (ret == -ENFILE || ret == -EMFILE) { + die( +"Can't open enough sockets for port specifier: %s", + optarg); + } - if (ret == -ENFILE || ret == -EMFILE) { - die("Can't open enough sockets for port specifier: %s", - optarg); + if (!ret) { + bound_one = true; + } else if (!(flags & FWD_WEAK)) { + die( +"Failed to bind port %u (%s) for option '-%c %s'", + i, strerror_(-ret), optname, optarg); + } } - if (!ret) { - bound_one = true; - } else if (!weak) { - die("Failed to bind port %u (%s) for option '-%c %s'", - i, strerror_(-ret), optname, optarg); - } + fwd_table_add(fwd, flags, addr, ifname, + base, i - 1, base + delta); + base = i - 1; } if (!bound_one) @@ -262,7 +274,7 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, conf_ports_range_except(c, optname, optarg, fwd, NULL, NULL, 1, NUM_PORTS - 1, exclude, - 1, true); + 1, FWD_WEAK); return; } @@ -347,7 +359,7 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, conf_ports_range_except(c, optname, optarg, fwd, addr, ifname, 1, NUM_PORTS - 1, exclude, - 1, true); + 1, FWD_WEAK); return; } @@ -380,7 +392,7 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, addr, ifname, orig_range.first, orig_range.last, exclude, - mapped_range.first, false); + mapped_range.first, 0); } while ((p = next_chunk(p, ','))); return; @@ -1210,6 +1222,17 @@ dns6: info(" %s", c->dns_search[i].n); } } + + info("Inbound TCP forwarding:"); + fwd_table_print(&c->tcp.fwd_in); + info("Inbound UDP forwarding:"); + fwd_table_print(&c->udp.fwd_in); + if (c->mode == MODE_PASTA) { + info("Outbound TCP forwarding:"); + fwd_table_print(&c->tcp.fwd_out); + info("Outbound UDP forwarding:"); + fwd_table_print(&c->udp.fwd_out); + } } /** diff --git a/fwd.c b/fwd.c index 44a0e109..a8477607 100644 --- a/fwd.c +++ b/fwd.c @@ -13,6 +13,7 @@ * Author: David Gibson <david(a)gibson.dropbear.id.au> */ +#include <assert.h> #include <stdint.h> #include <errno.h> #include <fcntl.h> @@ -22,6 +23,8 @@ #include "util.h" #include "ip.h" +#include "siphash.h" +#include "inany.h" #include "fwd.h" #include "passt.h" #include "lineread.h" @@ -313,6 +316,79 @@ bool fwd_port_is_ephemeral(in_port_t port) return (port >= fwd_ephemeral_min) && (port <= fwd_ephemeral_max); } +/** + * fwd_table_add() - Add an entry to a forwarding table + * @fwd: Table to add to + * @flags: Flags for this entry + * @addr: Our address to forward (NULL for both 0.0.0.0 and ::) + * @ifname: Only forward from this interface name, if non-empty + * @first: First port number to forward + * @last: Last port number to forward + * @to: First port of target port range to map to + */ +void fwd_table_add(struct fwd_ports *fwd, uint8_t flags, + const union inany_addr *addr, const char *ifname, + in_port_t first, in_port_t last, in_port_t to) +{ + /* Flags which can be set from the caller */ + const uint8_t allowed_flags = FWD_WEAK; + struct fwd_entry *new; + + ASSERT(!(flags & ~allowed_flags)); + + if (fwd->count >= ARRAY_SIZE(fwd->tab)) + die("Too many port forwarding ranges"); + + new = &fwd->tab[fwd->count++]; + new->flags = flags; + + if (addr) { + new->addr = *addr; + } else { + new->addr = inany_any6; + new->flags |= FWD_DUAL_STACK; + } + + memset(new->ifname, 0, sizeof(new->ifname)); + if (ifname) + strncpy(new->ifname, ifname, sizeof(new->ifname)); + + ASSERT(first <= last); + new->first = first; + new->last = last; + + new->to = to; +} + +/** + * fwd_table_print() - Print forwarding table for debugging + * @fwd: Table to print + */ +void fwd_table_print(const struct fwd_ports *fwd) +{ + unsigned i; + + for (i = 0; i < fwd->count; i++) { + const struct fwd_entry *fe = &fwd->tab[i]; + const char *weak = fe->flags & FWD_WEAK ? " WEAK" : ""; + const char *percent = *fe->ifname ? "%" : ""; + char addr[INANY_ADDRSTRLEN] = "*"; + + if (!(fe->flags & FWD_DUAL_STACK)) + inany_ntop(&fe->addr, addr, sizeof(addr)); + + if (fe->first == fe->last) { + info(" [%s]%s%s:%hu => %hu %s", + addr, percent, fe->ifname, + fe->first, fe->to, weak); + } else { + info(" [%s]%s%s:%hu-%hu => %hu-%hu %s", + addr, percent, fe->ifname, fe->first, fe->last, + fe->to, fe->last - fe->first + fe->to, weak); + } + } +} + /* See enum in kernel's include/net/tcp_states.h */ #define UDP_LISTEN 0x07 #define TCP_LISTEN 0x0a diff --git a/fwd.h b/fwd.h index 77925822..21f00cf8 100644 --- a/fwd.h +++ b/fwd.h @@ -16,6 +16,30 @@ struct flowside; void fwd_probe_ephemeral(void); bool fwd_port_is_ephemeral(in_port_t port); +/** + * struct fwd_entry - One range of ports to forward + * @addr: Address to forward from + * @ifname: Interface to forward from + * @first: First port number to forward + * @last: Last port number to forward + * @to: Port number to forward port @first to. + * @flags: Flag mask + * FWD_DUAL_STACK - forward both IPv4 and IPv6 (requires @addr be ::) + * FWD_WEAK - Don't give an error if binds fail for some forwards + * + * FIXME: @addr and @ifname currently ignored for outbound tables + */ +struct fwd_entry { + union inany_addr addr; + char ifname[IFNAMSIZ]; + in_port_t first, last, to; +#define FWD_DUAL_STACK BIT(0) +#define FWD_WEAK BIT(1) + uint8_t flags; +}; + +#define MAX_FWDS 128 + enum fwd_ports_mode { FWD_UNSET = 0, FWD_SPEC = 1, @@ -38,14 +62,21 @@ struct fwd_ports { enum fwd_ports_mode mode; int scan4; int scan6; + unsigned count; + struct fwd_entry tab[MAX_FWDS]; uint8_t map[PORT_BITMAP_SIZE]; in_port_t delta[NUM_PORTS]; }; #define FWD_PORT_SCAN_INTERVAL 1000 /* ms */ +void fwd_table_add(struct fwd_ports *fwd, uint8_t flags, + const union inany_addr *addr, const char *ifname, + in_port_t first, in_port_t last, in_port_t to); +void fwd_table_print(const struct fwd_ports *fwd); + void fwd_scan_ports_init(struct ctx *c); -void fwd_scan_ports_timer(struct ctx *c, const struct timespec *now); +void fwd_scan_ports_timer(struct ctx * c, const struct timespec *now); bool nat_inbound(const struct ctx *c, const union inany_addr *addr, union inany_addr *translated); -- 2.52.0

1 0

[RFC 00/12] Support for multiple address and late binding
by Jon Maloy 18 Dec '25

18 Dec '25

This series add functionality corresponding to three user stories in https://pad.passt.top/p/NetlinkMonitor: US-1: Dynamic Network Configuration Updates (PASTA) US-3: US-3: Multiple IPv6 Addresses (PASTA) US-4: Multiple IPv4 Addresses (PASTA) Jon Maloy (12): ip: Introduce multi-address data structures for IPv4 and IPv6 ip: Add ip4_default_prefix_len() helper function for class-based prefix conf: Allow multiple -a/--address options per address family conf: Apply -n/--netmask to most recently added address fwd: Check all configured addresses in guest accessibility functions arp: Check all configured addresses in ARP filtering netlink: Subscribe to link/address changes in namespace netlink: Subscribe to route changes in namespace netlink: Add host-side monitoring for late template interface binding netlink: Add host-side route monitoring and propagation netlink: Prevent host route events from overwriting guest-configured gateway netlink: Rename tap interface when late binding discovers template name arp.c | 11 +- conf.c | 135 +++++--- dhcp.c | 8 +- dhcpv6.c | 6 +- epoll_type.h | 4 + fwd.c | 30 +- ip.c | 21 ++ ip.h | 28 ++ isolation.c | 4 + ndp.c | 6 +- netlink.c | 869 +++++++++++++++++++++++++++++++++++++++++++++++++++ netlink.h | 6 + passt.c | 9 + passt.h | 21 +- pasta.c | 28 +- tap.c | 37 ++- tap.h | 1 + util.h | 1 + 18 files changed, 1137 insertions(+), 88 deletions(-) -- 2.51.1

2 31