It was reported that SSDP notifications sent from a container (with e.g. minidlna) stopped appearing on the network starting from commit 1db4f773e87f ("udp: Improve detail of UDP endpoint sanity checking"). As a minimal reproducer using minidlnad(8): $ mkdir /tmp/minidlna $ cat conf media_dir=/tmp/minidlna db_dir=/tmp/minidlna $ ./pasta -d --config-net -- sh -c '/usr/sbin/minidlnad -p 31337 -S -f conf -P /dev/null & (sleep 1; killall minidlnad)' [...] 1.0327: Flow 0 (NEW): FREE -> NEW 1.0327: Flow 0 (INI): NEW -> INI 1.0327: Flow 0 (INI): TAP [88.198.0.164]:54185 -> [239.255.255.250]:1900 => ? 1.0327: Flow 0 (INI): Invalid endpoint on UDP packet 1.0327: Flow 0 (FREE): INI -> FREE 1.0328: Flow 0 (FREE): TAP [88.198.0.164]:54185 -> [239.255.255.250]:1900 => ? 1.0328: Dropping datagram with no flow TAP 88.198.0.164:54185 -> 239.255.255.250:1900 This is an actual regression as there's no particular reason to block outbound multicast UDP packets. And even if we don't handle multicast groups in any particular way (https://bugs.passt.top/show_bug.cgi?id=2, "Add IGMP/MLD proxy"), there's no reason to block inbound multicast or broadcast packets either, should they ever be somehow delivered to passt or pasta. Let multicast and broadcast packets through, refusing only to establish flows with unspecified endpoint, as those would actually cause havoc in the flow table. IP-wise, SSDP notifications look like this (after this patch), inside and outside: $ pasta -p /tmp/minidlna.pcap --config-net -- sh -c '/usr/sbin/minidlnad -p 31337 -S -f minidlna.conf -P /dev/null & (sleep 1; killall minidlnad)' [...] $ tshark -a packets:1 -r /tmp/minidlna.pcap ssdp 2 0.074808 88.198.0.164 ? 239.255.255.250 SSDP 200 NOTIFY * HTTP/1.1 # tshark -i ens3 -a packets:1 multicast 2>/dev/null 1 0.000000000 88.198.0.164 ? 239.255.255.250 SSDP 200 NOTIFY * HTTP/1.1 Link: https://github.com/containers/podman/issues/24871 Fixes: 1db4f773e87f ("udp: Improve detail of UDP endpoint sanity checking") Signed-off-by: Stefano Brivio --- udp_flow.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/udp_flow.c b/udp_flow.c index 343caae..9fd7d06 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -209,7 +209,7 @@ flow_sidx_t udp_flow_from_sock(const struct ctx *c, union epoll_ref ref, if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0 || ini->oport == 0) { - /* In principle ini->oddr also must be unicast, but when we've + /* In principle ini->oddr also must be specified, but when we've * been initiated from a socket bound to 0.0.0.0 or ::, we don't * know our address, so we have to leave it unpopulated. */ @@ -267,8 +267,8 @@ flow_sidx_t udp_flow_from_tap(const struct ctx *c, ini = flow_initiate_af(flow, PIF_TAP, af, saddr, srcport, daddr, dstport); - if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0 || - !inany_is_unicast(&ini->oaddr) || ini->oport == 0) { + if (inany_is_unspecified(&ini->eaddr) || ini->eport == 0 || + inany_is_unspecified(&ini->oaddr) || ini->oport == 0) { flow_dbg(flow, "Invalid endpoint on UDP packet"); flow_alloc_cancel(flow); return FLOW_SIDX_NONE; -- 2.43.0