Currently TCP connections use a 1-bit selector, 'spliced', to determine the
rest of the contents of the structure.  We want to generalise the TCP
connection table to other types of flows in other protocols.  Make a start
on this by replacing the tcp_conn_common structure with a new flow_common
structure with an enum rather than a simple boolean indicating the type of
flow.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 Makefile     |  8 +++----
 flow.c       | 14 ++++++++++++
 flow.h       | 29 ++++++++++++++++++++++++
 tcp.c        | 63 +++++++++++++++++++++++++++++++++++++---------------
 tcp_conn.h   | 24 ++++++--------------
 tcp_splice.c |  3 ++-
 6 files changed, 101 insertions(+), 40 deletions(-)
 create mode 100644 flow.c
 create mode 100644 flow.h

diff --git a/Makefile b/Makefile
index 4435bd6..c5a3ce7 100644
--- a/Makefile
+++ b/Makefile
@@ -43,15 +43,15 @@ FLAGS += -DARCH=\"$(TARGET_ARCH)\"
 FLAGS += -DVERSION=\"$(VERSION)\"
 FLAGS += -DDUAL_STACK_SOCKETS=$(DUAL_STACK_SOCKETS)
 
-PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c icmp.c igmp.c \
-	isolation.c lineread.c log.c mld.c ndp.c netlink.c packet.c passt.c \
-	pasta.c pcap.c siphash.c tap.c tcp.c tcp_splice.c udp.c util.c
+PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c flow.c icmp.c \
+	igmp.c isolation.c lineread.c log.c mld.c ndp.c netlink.c packet.c \
+	passt.c pasta.c pcap.c siphash.c tap.c tcp.c tcp_splice.c udp.c util.c
 QRAP_SRCS = qrap.c
 SRCS = $(PASST_SRCS) $(QRAP_SRCS)
 
 MANPAGES = passt.1 pasta.1 qrap.1
 
-PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h icmp.h \
+PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h flow.h icmp.h \
 	inany.h isolation.h lineread.h log.h ndp.h netlink.h packet.h passt.h \
 	pasta.h pcap.h port_fwd.h siphash.h tap.h tcp.h tcp_conn.h \
 	tcp_splice.h udp.h util.h
diff --git a/flow.c b/flow.c
new file mode 100644
index 0000000..c3802ce
--- /dev/null
+++ b/flow.c
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright Red Hat
+ * Author: David Gibson <david(a)gibson.dropbear.id.au>
+ *
+ * Tracking for logical "flows" of packets.
+ */
+
+#include "flow.h"
+
+const char *flow_type_str[] = {
+	[FLOW_NONE]		= "<none>",
+	[FLOW_TCP]		= "TCP connection",
+	[FLOW_TCP_SPLICE]	= "TCP connection (spliced)",
+};
diff --git a/flow.h b/flow.h
new file mode 100644
index 0000000..1afc1e5
--- /dev/null
+++ b/flow.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright Red Hat
+ * Author: David Gibson &lt;david(a)gibson.dropbear.id.au&gt;
+ *
+ * Tracking for logical "flows" of packets.
+ */
+#ifndef FLOW_H
+#define FLOW_H
+
+enum flow_type {
+	FLOW_NONE = 0,
+	FLOW_TCP,
+	FLOW_TCP_SPLICE,
+	FLOW_MAX = FLOW_TCP_SPLICE,
+};
+
+extern const char *flow_type_str[];
+#define FLOW_TYPE(f)							\
+        ((f)->type <= FLOW_MAX ? flow_type_str[(f)->type] : "?")
+
+/**
+ * struct flow_common - Common fields for packet flows
+ * @type:	Type of packet flow
+ */
+struct flow_common {
+	enum flow_type		type;
+};
+
+#endif /* FLOW_H */
diff --git a/tcp.c b/tcp.c
index c89e6e4..75930b1 100644
--- a/tcp.c
+++ b/tcp.c
@@ -302,6 +302,7 @@
 #include "tcp_splice.h"
 #include "log.h"
 #include "inany.h"
+#include "flow.h"
 
 #include "tcp_conn.h"
 
@@ -575,7 +576,7 @@ static inline struct tcp_tap_conn *conn_at_idx(int index)
 {
 	if ((index < 0) || (index >= TCP_MAX_CONNS))
 		return NULL;
-	ASSERT(!(CONN(index)->c.spliced));
+	ASSERT(CONN(index)->f.type == FLOW_TCP);
 	return CONN(index);
 }
 
@@ -1313,14 +1314,21 @@ void tcp_table_compact(struct ctx *c, union tcp_conn *hole)
 	from = tc + c->tcp.conn_count;
 	memcpy(hole, from, sizeof(*hole));
 
-	if (from->c.spliced)
-		tcp_splice_conn_update(c, &hole->splice);
-	else
+	switch (from->f.type) {
+	case FLOW_TCP:
 		tcp_tap_conn_update(c, &from->tap, &hole->tap);
+		break;
+	case FLOW_TCP_SPLICE:
+		tcp_splice_conn_update(c, &hole->splice);
+		break;
+	default:
+		die("Unexpected %s in tcp_table_compact()",
+		    FLOW_TYPE(&from->f));
+	}
 
-	debug("TCP: table compaction (spliced=%d): old index %li, new index %li, "
+	debug("TCP: table compaction (%s): old index %li, new index %li, "
 	      "from: %p, to: %p",
-	      from->c.spliced, CONN_IDX(from), CONN_IDX(hole), from, hole);
+	      FLOW_TYPE(&from->f), CONN_IDX(from), CONN_IDX(hole), from, hole);
 
 	memset(from, 0, sizeof(*from));
 }
@@ -1388,12 +1396,18 @@ void tcp_defer_handler(struct ctx *c)
 	tcp_l2_data_buf_flush(c);
 
 	for (conn = tc + c->tcp.conn_count - 1; conn >= tc; conn--) {
-		if (conn->c.spliced) {
-			if (conn->splice.flags & CLOSING)
-				tcp_splice_destroy(c, conn);
-		} else {
+		switch (conn->f.type) {
+		case FLOW_TCP:
 			if (conn->tap.events == CLOSED)
 				tcp_conn_destroy(c, conn);
+			break;
+		case FLOW_TCP_SPLICE:
+			if (conn->splice.flags & CLOSING)
+				tcp_splice_destroy(c, conn);
+			break;
+		default:
+			die("Unexpected %s in tcp_defer_handler()",
+			    FLOW_TYPE(&conn->f));
 		}
 	}
 }
@@ -2029,7 +2043,7 @@ static void tcp_conn_from_tap(struct ctx *c,
 	}
 
 	conn = CONN(c->tcp.conn_count++);
-	conn->c.spliced = false;
+	conn->f.type = FLOW_TCP;
 	conn->sock = s;
 	conn->timer = -1;
 	conn_event(c, conn, TAP_SYN_RCVD);
@@ -2714,7 +2728,7 @@ static void tcp_tap_conn_from_sock(struct ctx *c,
 				   struct sockaddr *sa,
 				   const struct timespec *now)
 {
-	conn->c.spliced = false;
+	conn->f.type = FLOW_TCP;
 	conn->sock = s;
 	conn->timer = -1;
 	conn->ws_to_tap = conn->ws_from_tap = 0;
@@ -2903,10 +2917,17 @@ void tcp_sock_handler(struct ctx *c, union epoll_ref ref, uint32_t
events)
 {
 	union tcp_conn *conn = tc + ref.tcp.index;
 
-	if (conn->c.spliced)
-		tcp_splice_sock_handler(c, &conn->splice, ref.fd, events);
-	else
+	switch (conn->f.type) {
+	case FLOW_TCP:
 		tcp_tap_sock_handler(c, &conn->tap, events);
+		break;
+	case FLOW_TCP_SPLICE:
+		tcp_splice_sock_handler(c, &conn->splice, ref.fd, events);
+		break;
+	default:
+		die("Unexpected %s in tcp_sock_handler_compact()",
+		    FLOW_TYPE(&conn->f));
+	}
 }
 
 /**
@@ -3294,11 +3315,17 @@ void tcp_timer(struct ctx *c, const struct timespec *ts)
 	}
 
 	for (conn = tc + c->tcp.conn_count - 1; conn >= tc; conn--) {
-		if (conn->c.spliced) {
-			tcp_splice_timer(c, conn);
-		} else {
+		switch (conn->f.type) {
+		case FLOW_TCP:
 			if (conn->tap.events == CLOSED)
 				tcp_conn_destroy(c, conn);
+			break;
+		case FLOW_TCP_SPLICE:
+			tcp_splice_timer(c, conn);
+			break;
+		default:
+			die("Unexpected %s in tcp_timer()",
+			    FLOW_TYPE(&conn->f));
 		}
 	}
 
diff --git a/tcp_conn.h b/tcp_conn.h
index d67ea62..0074a08 100644
--- a/tcp_conn.h
+++ b/tcp_conn.h
@@ -9,19 +9,9 @@
 #ifndef TCP_CONN_H
 #define TCP_CONN_H
 
-/**
- * struct tcp_conn_common - Common fields for spliced and non-spliced
- * @spliced:		Is this a spliced connection?
- */
-struct tcp_conn_common {
-	bool spliced	:1;
-};
-
-extern const char *tcp_common_flag_str[];
-
 /**
  * struct tcp_tap_conn - Descriptor for a TCP connection (not spliced)
- * @c:			Fields common with tcp_splice_conn
+ * @f:			Generic flow information
  * @in_epoll:		Is the connection in the epoll set?
  * @next_index:		Connection index of next item in hash chain, -1 for none
  * @tap_mss:		MSS advertised by tap/guest, rounded to 2 ^ TCP_MSS_BITS
@@ -46,8 +36,8 @@ extern const char *tcp_common_flag_str[];
  * @seq_init_from_tap:	Initial sequence number from tap
  */
 struct tcp_tap_conn {
-	/* Must be first element to match tcp_splice_conn */
-	struct tcp_conn_common c;
+	/* Must be first element */
+	struct flow_common f;
 
 	bool		in_epoll	:1;
 	int	 	next_index	:TCP_CONN_INDEX_BITS + 2;
@@ -121,7 +111,7 @@ struct tcp_tap_conn {
 
 /**
  * struct tcp_splice_conn - Descriptor for a spliced TCP connection
- * @c:			Fields common with tcp_tap_conn
+ * @f:			Generic flow information
  * @in_epoll:		Is the connection in the epoll set?
  * @a:			File descriptor number of socket for accepted connection
  * @pipe_a_b:		Pipe ends for splice() from @a to @b
@@ -135,8 +125,8 @@ struct tcp_tap_conn {
  * @b_written:		Bytes written to @b (not fully written from one @a read)
 */
 struct tcp_splice_conn {
-	/* Must be first element to match tcp_tap_conn */
-	struct tcp_conn_common c;
+	/* Must be first element */
+	struct flow_common f;
 
 	bool in_epoll	:1;
 	int a;
@@ -176,7 +166,7 @@ struct tcp_splice_conn {
  * @splice:		Fields specific to spliced connections
 */
 union tcp_conn {
-	struct tcp_conn_common c;
+	struct flow_common f;
 	struct tcp_tap_conn tap;
 	struct tcp_splice_conn splice;
 };
diff --git a/tcp_splice.c b/tcp_splice.c
index 5b36975..840d639 100644
--- a/tcp_splice.c
+++ b/tcp_splice.c
@@ -53,6 +53,7 @@
 #include "log.h"
 #include "tcp_splice.h"
 #include "inany.h"
+#include "flow.h"
 
 #include "tcp_conn.h"
 
@@ -511,7 +512,7 @@ bool tcp_splice_conn_from_sock(struct ctx *c, union
tcp_listen_epoll_ref ref,
 	if (setsockopt(s, SOL_TCP, TCP_QUICKACK, &((int){ 1 }), sizeof(int)))
 		trace("TCP (spliced): failed to set TCP_QUICKACK on %i", s);
 
-	conn->c.spliced = true;
+	conn->f.type = FLOW_TCP_SPLICE;
 	conn->a = s;
 
 	if (tcp_splice_new(c, conn, ref.port, ref.ns))
-- 
2.41.0

Both tcp.c and tcp_splice.c define CONN_IDX() variants to find the index
of their connection structures in the connection table, now become the
unified flow table.  We can easily combine these into a common helper.
While we're there, add some trickery for some additional type safety.

They also define their own CONN() versions, which aren't so easily combined
since they need to return different types, but we can have them use a
common helper.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 flow_table.h | 20 ++++++++++++++++++++
 tcp.c        | 49 ++++++++++++++++++++++++-------------------------
 tcp_conn.h   |  2 +-
 tcp_splice.c | 17 ++++++++---------
 4 files changed, 53 insertions(+), 35 deletions(-)

diff --git a/flow_table.h b/flow_table.h
index c4c646b..dd4875e 100644
--- a/flow_table.h
+++ b/flow_table.h
@@ -22,4 +22,24 @@ union flow {
 /* Global Flow Table */
 extern union flow flowtab[];
 
+
+/** flowk_idx - Index of flow from common structure
+ * @f:	Common flow fields pointer
+ *
+ * Return: index of @f in the flow table
+ */
+static inline unsigned flow_idx(const struct flow_common *f)
+{
+	return (union flow *)f - flowtab;
+}
+
+/** FLOW_IDX - Find the index of a flow
+ * @f_:	Flow pointer, either union flow * or protocol specific
+ *
+ * Return: index of @f in the flow table
+ */
+#define FLOW_IDX(f_)		(flow_idx(&(f_)->f))
+
+#define FLOW(index)		(&flowtab[(index)])
+
 #endif /* FLOW_TABLE_H */
diff --git a/tcp.c b/tcp.c
index 7994197..7d2e89d 100644
--- a/tcp.c
+++ b/tcp.c
@@ -561,8 +561,7 @@ tcp6_l2_flags_buf[TCP_FRAMES_MEM];
 
 static unsigned int tcp6_l2_flags_buf_used;
 
-#define CONN(index)		(&flowtab[(index)].tcp)
-#define CONN_IDX(conn)		((union flow *)(conn) - flowtab)
+#define CONN(index)		(&FLOW(index)->tcp)
 
 /** conn_at_idx() - Find a connection by index, if present
  * @index:	Index of connection to lookup
@@ -631,7 +630,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn
*conn)
 {
 	int m = conn->in_epoll ? EPOLL_CTL_MOD : EPOLL_CTL_ADD;
 	union epoll_ref ref = { .type = EPOLL_TYPE_TCP, .fd = conn->sock,
-				.tcp.index = CONN_IDX(conn) };
+				.tcp.index = FLOW_IDX(conn) };
 	struct epoll_event ev = { .data.u64 = ref.u64 };
 
 	if (conn->events == CLOSED) {
@@ -652,7 +651,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn
*conn)
 	if (conn->timer != -1) {
 		union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER,
 					  .fd = conn->sock,
-					  .tcp.index = CONN_IDX(conn) };
+					  .tcp.index = FLOW_IDX(conn) };
 		struct epoll_event ev_t = { .data.u64 = ref_t.u64,
 					    .events = EPOLLIN | EPOLLET };
 
@@ -680,7 +679,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn
*conn)
 	if (conn->timer == -1) {
 		union epoll_ref ref = { .type = EPOLL_TYPE_TCP_TIMER,
 					.fd = conn->sock,
-					.tcp.index = CONN_IDX(conn) };
+					.tcp.index = FLOW_IDX(conn) };
 		struct epoll_event ev = { .data.u64 = ref.u64,
 					  .events = EPOLLIN | EPOLLET };
 		int fd;
@@ -716,7 +715,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn
*conn)
 		it.it_value.tv_sec = ACT_TIMEOUT;
 	}
 
-	debug("TCP: index %li, timer expires in %lu.%03lus", CONN_IDX(conn),
+	debug("TCP: index %li, timer expires in %lu.%03lus", FLOW_IDX(conn),
 	      it.it_value.tv_sec, it.it_value.tv_nsec / 1000 / 1000);
 
 	timerfd_settime(conn->timer, 0, &it, NULL);
@@ -739,7 +738,7 @@ static void conn_flag_do(const struct ctx *c, struct tcp_tap_conn
*conn,
 
 		conn->flags &= flag;
 		if (flag_index >= 0) {
-			debug("TCP: index %li: %s dropped", CONN_IDX(conn),
+			debug("TCP: index %li: %s dropped", FLOW_IDX(conn),
 			      tcp_flag_str[flag_index]);
 		}
 	} else {
@@ -760,7 +759,7 @@ static void conn_flag_do(const struct ctx *c, struct tcp_tap_conn
*conn,
 
 		conn->flags |= flag;
 		if (flag_index >= 0) {
-			debug("TCP: index %li: %s", CONN_IDX(conn),
+			debug("TCP: index %li: %s", FLOW_IDX(conn),
 			      tcp_flag_str[flag_index]);
 		}
 	}
@@ -810,12 +809,12 @@ static void conn_event_do(const struct ctx *c, struct tcp_tap_conn
*conn,
 		new += 5;
 
 	if (prev != new) {
-		debug("TCP: index %li, %s: %s -> %s", CONN_IDX(conn),
+		debug("TCP: index %li, %s: %s -> %s", FLOW_IDX(conn),
 		      num == -1 	       ? "CLOSED" : tcp_event_str[num],
 		      prev == -1	       ? "CLOSED" : tcp_state_str[prev],
 		      (new == -1 || num == -1) ? "CLOSED" : tcp_state_str[new]);
 	} else {
-		debug("TCP: index %li, %s", CONN_IDX(conn),
+		debug("TCP: index %li, %s", FLOW_IDX(conn),
 		      num == -1 	       ? "CLOSED" : tcp_event_str[num]);
 	}
 
@@ -1200,11 +1199,11 @@ static void tcp_hash_insert(const struct ctx *c, struct
tcp_tap_conn *conn)
 	int b;
 
 	b = tcp_hash(c, &conn->faddr, conn->eport, conn->fport);
-	conn->next_index = tc_hash[b] ? CONN_IDX(tc_hash[b]) : -1;
+	conn->next_index = tc_hash[b] ? FLOW_IDX(tc_hash[b]) : -1U;
 	tc_hash[b] = conn;
 
 	debug("TCP: hash table insert: index %li, sock %i, bucket: %i, next: "
-	      "%p", CONN_IDX(conn), conn->sock, b,
conn_at_idx(conn->next_index));
+	      "%p", FLOW_IDX(conn), conn->sock, b,
conn_at_idx(conn->next_index));
 }
 
 /**
@@ -1230,7 +1229,7 @@ static void tcp_hash_remove(const struct ctx *c,
 	}
 
 	debug("TCP: hash table remove: index %li, sock %i, bucket: %i, new: %p",
-	      CONN_IDX(conn), conn->sock, b,
+	      FLOW_IDX(conn), conn->sock, b,
 	      prev ? conn_at_idx(prev->next_index) : tc_hash[b]);
 }
 
@@ -1250,7 +1249,7 @@ static void tcp_tap_conn_update(struct ctx *c, struct tcp_tap_conn
*old,
 	     prev = entry, entry = conn_at_idx(entry->next_index)) {
 		if (entry == old) {
 			if (prev)
-				prev->next_index = CONN_IDX(new);
+				prev->next_index = FLOW_IDX(new);
 			else
 				tc_hash[b] = new;
 			break;
@@ -1259,7 +1258,7 @@ static void tcp_tap_conn_update(struct ctx *c, struct tcp_tap_conn
*old,
 
 	debug("TCP: hash table update: old index %li, new index %li, sock %i, "
 	      "bucket: %i, old: %p, new: %p",
-	      CONN_IDX(old), CONN_IDX(new), new->sock, b, old, new);
+	      FLOW_IDX(old), FLOW_IDX(new), new->sock, b, old, new);
 
 	tcp_epoll_ctl(c, new);
 }
@@ -1301,9 +1300,9 @@ void tcp_table_compact(struct ctx *c, union flow *hole)
 {
 	union flow *from;
 
-	if (CONN_IDX(hole) == --c->flow_count) {
+	if (FLOW_IDX(hole) == --c->flow_count) {
 		debug("TCP: table compaction: maximum index was %li (%p)",
-		      CONN_IDX(hole), hole);
+		      FLOW_IDX(hole), hole);
 		memset(hole, 0, sizeof(*hole));
 		return;
 	}
@@ -1325,7 +1324,7 @@ void tcp_table_compact(struct ctx *c, union flow *hole)
 
 	debug("TCP: table compaction (%s): old index %li, new index %li, "
 	      "from: %p, to: %p",
-	      FLOW_TYPE(&from->f), CONN_IDX(from), CONN_IDX(hole), from, hole);
+	      FLOW_TYPE(&from->f), FLOW_IDX(from), FLOW_IDX(hole), from, hole);
 
 	memset(from, 0, sizeof(*from));
 }
@@ -1350,7 +1349,7 @@ static void tcp_conn_destroy(struct ctx *c, union flow *flow)
 static void tcp_rst_do(struct ctx *c, struct tcp_tap_conn *conn);
 #define tcp_rst(c, conn)						\
 	do {								\
-		debug("TCP: index %li, reset at %s:%i", CONN_IDX(conn), \
+		debug("TCP: index %li, reset at %s:%i", FLOW_IDX(conn), \
 		      __func__, __LINE__);				\
 		tcp_rst_do(c, conn);					\
 	} while (0)
@@ -2576,7 +2575,7 @@ int tcp_tap_handler(struct ctx *c, int af, const void *saddr, const
void *daddr,
 		return 1;
 	}
 
-	trace("TCP: packet length %lu from tap for index %lu", len, CONN_IDX(conn));
+	trace("TCP: packet length %lu from tap for index %lu", len, FLOW_IDX(conn));
 
 	if (th->rst) {
 		conn_event(c, conn, CLOSED);
@@ -2815,17 +2814,17 @@ void tcp_timer_handler(struct ctx *c, union epoll_ref ref)
 		tcp_timer_ctl(c, conn);
 	} else if (conn->flags & ACK_FROM_TAP_DUE) {
 		if (!(conn->events & ESTABLISHED)) {
-			debug("TCP: index %li, handshake timeout", CONN_IDX(conn));
+			debug("TCP: index %li, handshake timeout", FLOW_IDX(conn));
 			tcp_rst(c, conn);
 		} else if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) {
-			debug("TCP: index %li, FIN timeout", CONN_IDX(conn));
+			debug("TCP: index %li, FIN timeout", FLOW_IDX(conn));
 			tcp_rst(c, conn);
 		} else if (conn->retrans == TCP_MAX_RETRANS) {
 			debug("TCP: index %li, retransmissions count exceeded",
-			      CONN_IDX(conn));
+			      FLOW_IDX(conn));
 			tcp_rst(c, conn);
 		} else {
-			debug("TCP: index %li, ACK timeout, retry", CONN_IDX(conn));
+			debug("TCP: index %li, ACK timeout, retry", FLOW_IDX(conn));
 			conn->retrans++;
 			conn->seq_to_tap = conn->seq_ack_from_tap;
 			tcp_data_from_sock(c, conn);
@@ -2843,7 +2842,7 @@ void tcp_timer_handler(struct ctx *c, union epoll_ref ref)
 		 */
 		timerfd_settime(conn->timer, 0, &new, &old);
 		if (old.it_value.tv_sec == ACT_TIMEOUT) {
-			debug("TCP: index %li, activity timeout", CONN_IDX(conn));
+			debug("TCP: index %li, activity timeout", FLOW_IDX(conn));
 			tcp_rst(c, conn);
 		}
 	}
diff --git a/tcp_conn.h b/tcp_conn.h
index a7c7001..a8c0ae9 100644
--- a/tcp_conn.h
+++ b/tcp_conn.h
@@ -40,7 +40,7 @@ struct tcp_tap_conn {
 	struct flow_common f;
 
 	bool		in_epoll	:1;
-	int	 	next_index	:FLOW_INDEX_BITS + 2;
+	unsigned 	next_index	:FLOW_INDEX_BITS + 2;
 
 #define TCP_RETRANS_BITS		3
 	unsigned int	retrans		:TCP_RETRANS_BITS;
diff --git a/tcp_splice.c b/tcp_splice.c
index 72346b8..2794998 100644
--- a/tcp_splice.c
+++ b/tcp_splice.c
@@ -75,8 +75,7 @@ static int splice_pipe_pool		[TCP_SPLICE_PIPE_POOL_SIZE][2][2];
 #define CONN_V6(x)			(x->flags & SPLICE_V6)
 #define CONN_V4(x)			(!CONN_V6(x))
 #define CONN_HAS(conn, set)		((conn->events & (set)) == (set))
-#define CONN(index)			(&tc[(index)].splice)
-#define CONN_IDX(conn)			((union flow *)(conn) - flowtab)
+#define CONN(index)			(&FLOW(index)->tcp_splice)
 
 /* Display strings for connection events */
 static const char *tcp_splice_event_str[] __attribute((__unused__)) = {
@@ -137,7 +136,7 @@ static void conn_flag_do(const struct ctx *c, struct tcp_splice_conn
*conn,
 
 		conn->flags &= flag;
 		if (flag_index >= 0) {
-			debug("TCP (spliced): index %li: %s dropped", CONN_IDX(conn),
+			debug("TCP (spliced): index %li: %s dropped", FLOW_IDX(conn),
 			      tcp_splice_flag_str[flag_index]);
 		}
 	} else {
@@ -148,7 +147,7 @@ static void conn_flag_do(const struct ctx *c, struct tcp_splice_conn
*conn,
 
 		conn->flags |= flag;
 		if (flag_index >= 0) {
-			debug("TCP (spliced): index %li: %s", CONN_IDX(conn),
+			debug("TCP (spliced): index %li: %s", FLOW_IDX(conn),
 			      tcp_splice_flag_str[flag_index]);
 		}
 	}
@@ -176,9 +175,9 @@ static int tcp_splice_epoll_ctl(const struct ctx *c,
 {
 	int m = conn->in_epoll ? EPOLL_CTL_MOD : EPOLL_CTL_ADD;
 	union epoll_ref ref_a = { .type = EPOLL_TYPE_TCP, .fd = conn->a,
-				  .tcp.index = CONN_IDX(conn) };
+				  .tcp.index = FLOW_IDX(conn) };
 	union epoll_ref ref_b = { .type = EPOLL_TYPE_TCP, .fd = conn->b,
-				  .tcp.index = CONN_IDX(conn) };
+				  .tcp.index = FLOW_IDX(conn) };
 	struct epoll_event ev_a = { .data.u64 = ref_a.u64 };
 	struct epoll_event ev_b = { .data.u64 = ref_b.u64 };
 	uint32_t events_a, events_b;
@@ -221,7 +220,7 @@ static void conn_event_do(const struct ctx *c, struct tcp_splice_conn
*conn,
 
 		conn->events &= event;
 		if (flag_index >= 0) {
-			debug("TCP (spliced): index %li, ~%s", CONN_IDX(conn),
+			debug("TCP (spliced): index %li, ~%s", FLOW_IDX(conn),
 			      tcp_splice_event_str[flag_index]);
 		}
 	} else {
@@ -232,7 +231,7 @@ static void conn_event_do(const struct ctx *c, struct tcp_splice_conn
*conn,
 
 		conn->events |= event;
 		if (flag_index >= 0) {
-			debug("TCP (spliced): index %li, %s", CONN_IDX(conn),
+			debug("TCP (spliced): index %li, %s", FLOW_IDX(conn),
 			      tcp_splice_event_str[flag_index]);
 		}
 	}
@@ -295,7 +294,7 @@ void tcp_splice_destroy(struct ctx *c, union flow *flow)
 
 	conn->events = SPLICE_CLOSED;
 	conn->flags = 0;
-	debug("TCP (spliced): index %li, CLOSED", CONN_IDX(conn));
+	debug("TCP (spliced): index %li, CLOSED", FLOW_IDX(conn));
 
 	tcp_table_compact(c, flow);
 }
-- 
2.41.0

Handling of each protocol needs some degree of tracking of the addresses
and ports at the end of each connection or flow.  Sometimes that's explicit
(as in the guest visible addresses for TCP connections), sometimes implicit
(the bound and connected addresses of sockets).

To allow more general abd robust handling, and more consistency across
protocols we want to uniformly track the address and port at each end of
the connection.  Furthermore, because we allow port remapping, and we
sometimes need to apply NAT, the addresses and ports can be different as
seen by the guest/namespace and as by the host.

Introduce 'struct flowside' to keep track of the address and ports of a
flow from a single "side" (guest or host).  Store two of these in the
common fields of a flow to track that information for both sides.

For now we just introduce the structure and fields themselves, along with
some simple helpers.  Later patches will actually use these to store useful
information.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 flow.c | 22 ++++++++++++++++++++++
 flow.h | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+)

diff --git a/flow.c b/flow.c
index 12ca8db..a93cf8c 100644
--- a/flow.c
+++ b/flow.c
@@ -7,6 +7,7 @@
 
 #include <unistd.h>
 #include <string.h>
+#include <arpa/inet.h>
 
 #include "util.h"
 #include "passt.h"
@@ -24,6 +25,27 @@ const char *flow_type_str[] = {
 /* Global Flow Table */
 union flow flowtab[FLOW_MAX];
 
+/** flowside_fmt - Format a flowside as a string
+ * @fs:		flowside to format
+ * @buf:	Buffer into which to store the formatted version
+ * @size:	Size of @buf
+ *
+ * Return: pointer to formatted string describing @fs, or NULL on error
+ */
+/* cppcheck-suppress unusedFunction */
+const char *flowside_fmt(const struct flowside *fs, char *buf, size_t size)
+{
+	char ebuf[INET6_ADDRSTRLEN], fbuf[INET6_ADDRSTRLEN];
+
+	if (!inet_ntop(AF_INET6, &fs->eaddr, ebuf, sizeof(ebuf))
+	    || !inet_ntop(AF_INET6, &fs->faddr, fbuf, sizeof(fbuf)))
+		return NULL;
+
+	snprintf(buf, size, "[%s]:%hu <-> [%s]:%hu", fbuf, fs->fport,
+		 ebuf, fs->eport);
+	return (const char *)buf;
+}
+
 /**
  * flow_table_compact() - Perform compaction on flow table
  * @c:		Execution context
diff --git a/flow.h b/flow.h
index e212796..9891fcb 100644
--- a/flow.h
+++ b/flow.h
@@ -18,11 +18,59 @@ extern const char *flow_type_str[];
 #define FLOW_TYPE(f)							\
         ((f)->type <= FLOW_MAX ? flow_type_str[(f)->type] : "?")
 
+/**
+ * struct flowside - Describes a logical packet flow as seen from one "side"
+ * @eaddr:	Endpoint address (remote address from passt's PoV)
+ * @faddr:	Forwarding address (local address from passt's PoV)
+ * @eport:	Endpoint port
+ * @fport:	Forwarding port
+ */
+struct flowside {
+	union inany_addr faddr;
+	union inany_addr eaddr;
+	in_port_t fport, eport;
+};
+
+/** flowside_from_af - Initialize a flowside from addresses
+ * @fs:		flowside to initialize
+ * @af:		Address family (AF_INET or AF_INET6)
+ * @faddr:	Forwarding address (pointer to in_addr or in6_addr)
+ * @fport:	Forwarding port
+ * @eaddr:	Endpoint address (pointer to in_addr or in6_addr)
+ * @eport:	Endpoint port
+ */
+static inline void flowside_from_af(struct flowside *fs, int af,
+				    const void *faddr, in_port_t fport,
+				    const void *eaddr, in_port_t eport)
+{
+	inany_from_af(&fs->faddr, af, faddr);
+	inany_from_af(&fs->eaddr, af, eaddr);
+	fs->fport = fport;
+	fs->eport = eport;
+}
+
+/** flowside_complete - Check if flowside is fully initialized
+ * @fs:		flowside to check
+ */
+static inline bool flowside_complete(const struct flowside *fs)
+{
+	return !IN6_IS_ADDR_UNSPECIFIED(&fs->faddr) &&
+		!IN6_IS_ADDR_UNSPECIFIED(&fs->eaddr) &&
+		fs->fport != 0 && fs->eport != 0;
+}
+
+#define FLOWSIDE_STRLEN		(2*(INET6_ADDRSTRLEN+8) + 6)
+
+const char *flowside_fmt(const struct flowside *fs, char *buf, size_t size);
+
 /**
  * struct flow_common - Common fields for packet flows
+ * @side[]:	Information on the flow for each side.  Flow types can have
+ *		their own conventions about which side is which
  * @type:	Type of packet flow
  */
 struct flow_common {
+	struct flowside		side[2];
 	enum flow_type		type;
 };
 
-- 
2.41.0

tcp_tap_conn has several fields to track addresses and ports as seen by
the guest/namespace.  However we now have general fields for this in the
common flowside fields of struct flow.  Use those instead of protocol
specific fields.

So far we've only explicitly tracked the guest side forwarding address
in the TCP connection - the remote address from the guest's point of
view.  The tap side endpoint address - the local address from the
guest's point of view - was assumed to always be one of the handful of
guest addresses we track as addr_seen (one each for IPv4, IPv6 global
and IPv6 link-local).

struct flowside expects both addresses, and we will want to use the
endpoint address in future.  So, determine that address and store it as
part of the flowside.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 flow.c     |  1 -
 tcp.c      | 80 +++++++++++++++++++++++++++++-------------------------
 tcp_conn.h |  6 +---
 3 files changed, 44 insertions(+), 43 deletions(-)

diff --git a/flow.c b/flow.c
index a93cf8c..d7264f8 100644
--- a/flow.c
+++ b/flow.c
@@ -32,7 +32,6 @@ union flow flowtab[FLOW_MAX];
  *
  * Return: pointer to formatted string describing @fs, or NULL on error
  */
-/* cppcheck-suppress unusedFunction */
 const char *flowside_fmt(const struct flowside *fs, char *buf, size_t size)
 {
 	char ebuf[INET6_ADDRSTRLEN], fbuf[INET6_ADDRSTRLEN];
diff --git a/tcp.c b/tcp.c
index 722a613..16b930e 100644
--- a/tcp.c
+++ b/tcp.c
@@ -397,7 +397,9 @@ struct tcp6_l2_head {	/* For MSS6 macro: keep in sync with
tcp6_l2_buf_t */
 #define OPT_SACK	5
 #define OPT_TS		8
 
-#define CONN_V4(conn)		(!!inany_v4(&(conn)->faddr))
+#define TAPSIDE(conn)		(&(conn)->f.side[1])
+
+#define CONN_V4(conn)		(!!inany_v4(&TAPSIDE(conn)->faddr))
 #define CONN_V6(conn)		(!CONN_V4(conn))
 #define CONN_IS_CLOSING(conn)						\
 	((conn->events & ESTABLISHED) &&				\
@@ -844,7 +846,7 @@ static int tcp_rtt_dst_low(const struct tcp_tap_conn *conn)
 	int i;
 
 	for (i = 0; i < LOW_RTT_TABLE_SIZE; i++)
-		if (inany_equals(&conn->faddr, low_rtt_dst + i))
+		if (inany_equals(&TAPSIDE(conn)->faddr, low_rtt_dst + i))
 			return 1;
 
 	return 0;
@@ -866,7 +868,7 @@ static void tcp_rtt_dst_check(const struct tcp_tap_conn *conn,
 		return;
 
 	for (i = 0; i < LOW_RTT_TABLE_SIZE; i++) {
-		if (inany_equals(&conn->faddr, low_rtt_dst + i))
+		if (inany_equals(&TAPSIDE(conn)->faddr, low_rtt_dst + i))
 			return;
 		if (hole == -1 && IN6_IS_ADDR_UNSPECIFIED(low_rtt_dst + i))
 			hole = i;
@@ -878,7 +880,7 @@ static void tcp_rtt_dst_check(const struct tcp_tap_conn *conn,
 	if (hole == -1)
 		return;
 
-	low_rtt_dst[hole++] = conn->faddr;
+	low_rtt_dst[hole++] = TAPSIDE(conn)->faddr;
 	if (hole == LOW_RTT_TABLE_SIZE)
 		hole = 0;
 	inany_from_af(low_rtt_dst + hole, AF_INET6, &in6addr_any);
@@ -1143,8 +1145,8 @@ static int tcp_hash_match(const struct tcp_tap_conn *conn,
 			  const union inany_addr *faddr,
 			  in_port_t eport, in_port_t fport)
 {
-	if (inany_equals(&conn->faddr, faddr) &&
-	    conn->eport == eport && conn->fport == fport)
+	if (inany_equals(&TAPSIDE(conn)->faddr, faddr) &&
+	    TAPSIDE(conn)->eport == eport && TAPSIDE(conn)->fport == fport)
 		return 1;
 
 	return 0;
@@ -1186,7 +1188,8 @@ static unsigned int tcp_hash(const struct ctx *c, const union
inany_addr *faddr,
 static unsigned int tcp_conn_hash(const struct ctx *c,
 				  const struct tcp_tap_conn *conn)
 {
-	return tcp_hash(c, &conn->faddr, conn->eport, conn->fport);
+	return tcp_hash(c, &TAPSIDE(conn)->faddr,
+			TAPSIDE(conn)->eport, TAPSIDE(conn)->fport);
 }
 
 /**
@@ -1198,7 +1201,8 @@ static void tcp_hash_insert(const struct ctx *c, struct tcp_tap_conn
*conn)
 {
 	int b;
 
-	b = tcp_hash(c, &conn->faddr, conn->eport, conn->fport);
+	b = tcp_hash(c, &TAPSIDE(conn)->faddr,
+		     TAPSIDE(conn)->eport, TAPSIDE(conn)->fport);
 	conn->next_index = tc_hash[b] ? FLOW_IDX(tc_hash[b]) : -1U;
 	tc_hash[b] = conn;
 
@@ -1386,13 +1390,13 @@ static size_t tcp_l2_buf_fill_headers(const struct ctx *c,
 				      void *p, size_t plen,
 				      const uint16_t *check, uint32_t seq)
 {
-	const struct in_addr *a4 = inany_v4(&conn->faddr);
+	const struct in_addr *a4 = inany_v4(&TAPSIDE(conn)->faddr);
 	size_t ip_len, tlen;
 
 #define SET_TCP_HEADER_COMMON_V4_V6(b, conn, seq)			\
 do {									\
-	b->th.source = htons(conn->fport);				\
-	b->th.dest = htons(conn->eport);				\
+	b->th.source = htons(TAPSIDE(conn)->fport);			\
+	b->th.dest = htons(TAPSIDE(conn)->eport);			\
 	b->th.seq = htonl(seq);						\
 	b->th.ack_seq = htonl(conn->seq_ack_to_tap);			\
 	if (conn->events & ESTABLISHED)	{				\
@@ -1410,7 +1414,7 @@ do {									\
 		ip_len = plen + sizeof(struct iphdr) + sizeof(struct tcphdr);
 		b->iph.tot_len = htons(ip_len);
 		b->iph.saddr = a4->s_addr;
-		b->iph.daddr = c->ip4.addr_seen.s_addr;
+		b->iph.daddr = inany_v4(&TAPSIDE(conn)->eaddr)->s_addr;
 
 		if (check)
 			b->iph.check = *check;
@@ -1428,11 +1432,8 @@ do {									\
 		ip_len = plen + sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
 
 		b->ip6h.payload_len = htons(plen + sizeof(struct tcphdr));
-		b->ip6h.saddr = conn->faddr.a6;
-		if (IN6_IS_ADDR_LINKLOCAL(&b->ip6h.saddr))
-			b->ip6h.daddr = c->ip6.addr_ll_seen;
-		else
-			b->ip6h.daddr = c->ip6.addr_seen;
+		b->ip6h.saddr = TAPSIDE(conn)->faddr.a6;
+		b->ip6h.daddr = TAPSIDE(conn)->eaddr.a6;
 
 		memset(b->ip6h.flow_lbl, 0, 3);
 
@@ -1781,31 +1782,25 @@ static void tcp_clamp_window(const struct ctx *c, struct
tcp_tap_conn *conn,
 /**
  * tcp_seq_init() - Calculate initial sequence number according to RFC 6528
  * @c:		Execution context
- * @conn:	TCP connection, with faddr, fport and eport populated
+ * @conn:	TCP connection, with faddr, fport, eaddr, eport populated
  * @now:	Current timestamp
  */
 static void tcp_seq_init(const struct ctx *c, struct tcp_tap_conn *conn,
 			 const struct timespec *now)
 {
-	union inany_addr aany;
 	struct {
 		union inany_addr src;
 		in_port_t srcport;
 		union inany_addr dst;
 		in_port_t dstport;
 	} __attribute__((__packed__)) in = {
-		.src = conn->faddr,
-		.srcport = conn->fport,
-		.dstport = conn->eport,
+		.src = TAPSIDE(conn)->faddr,
+		.srcport = TAPSIDE(conn)->fport,
+		.dst = TAPSIDE(conn)->eaddr,
+		.dstport = TAPSIDE(conn)->eport,
 	};
 	uint32_t ns, seq = 0;
 
-	if (CONN_V4(conn))
-		inany_from_af(&aany, AF_INET, &c->ip4.addr);
-	else
-		inany_from_af(&aany, AF_INET6, &c->ip6.addr);
-	in.dst = aany;
-
 	seq = siphash_36b((uint8_t *)&in, c->tcp.hash_secret);
 
 	/* 32ns ticks, overflows 32 bits every 137s */
@@ -1967,13 +1962,12 @@ static void tcp_conn_from_tap(struct ctx *c,
 		.sin6_port = th->dest,
 		.sin6_addr = *(struct in6_addr *)daddr,
 	};
+	char fsstr[FLOWSIDE_STRLEN];
 	const struct sockaddr *sa;
 	struct tcp_tap_conn *conn;
 	socklen_t sl;
 	int s, mss;
 
-	(void)saddr;
-
 	if (c->flow_count >= FLOW_MAX)
 		return;
 
@@ -2021,7 +2015,12 @@ static void tcp_conn_from_tap(struct ctx *c,
 	if (!(conn->wnd_from_tap = (htons(th->window) >> conn->ws_from_tap)))
 		conn->wnd_from_tap = 1;
 
-	inany_from_af(&conn->faddr, af, daddr);
+	flowside_from_af(TAPSIDE(conn), af, daddr, ntohs(th->dest),
+			 saddr, ntohs(th->source));
+	ASSERT(flowside_complete(TAPSIDE(conn)));
+
+	debug("TCP: index %li, new connection from tap, %s", FLOW_IDX(conn),
+	      flowside_fmt(TAPSIDE(conn), fsstr, sizeof(fsstr)));
 
 	if (af == AF_INET) {
 		sa = (struct sockaddr *)&addr4;
@@ -2031,9 +2030,6 @@ static void tcp_conn_from_tap(struct ctx *c,
 		sl = sizeof(addr6);
 	}
 
-	conn->fport = ntohs(th->dest);
-	conn->eport = ntohs(th->source);
-
 	conn->seq_init_from_tap = ntohl(th->seq);
 	conn->seq_from_tap = conn->seq_init_from_tap + 1;
 	conn->seq_ack_to_tap = conn->seq_from_tap;
@@ -2692,10 +2688,20 @@ static void tcp_tap_conn_from_sock(struct ctx *c,
 	conn->ws_to_tap = conn->ws_from_tap = 0;
 	conn_event(c, conn, SOCK_ACCEPTED);
 
-	inany_from_sockaddr(&conn->faddr, &conn->fport, sa);
-	conn->eport = ref.port;
+	inany_from_sockaddr(&TAPSIDE(conn)->faddr, &TAPSIDE(conn)->fport, sa);
+	tcp_snat_inbound(c, &TAPSIDE(conn)->faddr);
+
+	if (CONN_V4(conn)) {
+		inany_from_af(&TAPSIDE(conn)->eaddr, AF_INET, &c->ip4.addr_seen);
+	} else {
+		if (IN6_IS_ADDR_LINKLOCAL(&TAPSIDE(conn)->faddr.a6))
+			TAPSIDE(conn)->eaddr.a6 = c->ip6.addr_ll_seen;
+		else
+			TAPSIDE(conn)->eaddr.a6 = c->ip6.addr_seen;
+	}
+	TAPSIDE(conn)->eport = ref.port;
 
-	tcp_snat_inbound(c, &conn->faddr);
+	ASSERT(flowside_complete(TAPSIDE(conn)));
 
 	tcp_seq_init(c, conn, now);
 	tcp_hash_insert(c, conn);
diff --git a/tcp_conn.h b/tcp_conn.h
index 4e7c7fc..3482759 100644
--- a/tcp_conn.h
+++ b/tcp_conn.h
@@ -24,6 +24,7 @@
  * @ws_to_tap:		Window scaling factor advertised to tap/guest
  * @sndbuf:		Sending buffer in kernel, rounded to 2 ^ SNDBUF_BITS
  * @seq_dup_ack_approx:	Last duplicate ACK number sent to tap
+ * @eaddr:		Guest side endpoint address (guest's local address)
  * @faddr:		Guest side forwarding address (guest's remote address)
  * @eport:		Guest side endpoint port (guest's local port)
  * @fport:		Guest side forwarding port (guest's remote port)
@@ -94,11 +95,6 @@ struct tcp_tap_conn {
 
 	uint8_t		seq_dup_ack_approx;
 
-
-	union inany_addr faddr;
-	in_port_t	eport;
-	in_port_t	fport;
-
 	uint16_t	wnd_from_tap;
 	uint16_t	wnd_to_tap;
 
-- 
2.41.0

We generate TCP initial sequence numbers, when we need them, from a hash
of the source and destination addresses and ports, plus a timestamp.
The contents of that hash are now exactly the same as the flowside_hash()
we use elsewhere.  The values won't be identical because we order the
fields in the hash differently, but that doesn't matter for our purposes.

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 tcp.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/tcp.c b/tcp.c
index 27cdd15..a9ddce6 100644
--- a/tcp.c
+++ b/tcp.c
@@ -1754,20 +1754,7 @@ static void tcp_clamp_window(const struct ctx *c, struct
tcp_tap_conn *conn,
 static void tcp_seq_init(const struct ctx *c, struct tcp_tap_conn *conn,
 			 const struct timespec *now)
 {
-	struct {
-		union inany_addr src;
-		in_port_t srcport;
-		union inany_addr dst;
-		in_port_t dstport;
-	} __attribute__((__packed__)) in = {
-		.src = TAPSIDE(conn)->faddr,
-		.srcport = TAPSIDE(conn)->fport,
-		.dst = TAPSIDE(conn)->eaddr,
-		.dstport = TAPSIDE(conn)->eport,
-	};
-	uint32_t ns, seq = 0;
-
-	seq = siphash_36b((uint8_t *)&in, c->tcp.hash_secret);
+	uint32_t ns, seq = flowside_hash(TAPSIDE(conn), c->tcp.hash_secret);
 
 	/* 32ns ticks, overflows 32 bits every 137s */
 	ns = (now->tv_sec * 1000000000 + now->tv_nsec) >> 5;
-- 
2.41.0

Every flow in the flow table now has space for the the addresses as seen by
both the host and guest side.  We fill that information in for regular
"tap" TCP connections, but not for spliced connections.

Fill in that information for spliced connections too, so it's now uniformly
available for all flow types (that we've implemented so far).

Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au>
---
 tcp.c        | 46 +++++++++++++++++++---------------------------
 tcp_splice.c | 40 ++++++++++++++++++++++++++--------------
 tcp_splice.h |  3 +--
 3 files changed, 46 insertions(+), 43 deletions(-)

diff --git a/tcp.c b/tcp.c
index 297134f..7459fc2 100644
--- a/tcp.c
+++ b/tcp.c
@@ -2639,37 +2639,25 @@ static void tcp_snat_inbound(const struct ctx *c, union inany_addr
*addr)
  * tcp_tap_conn_from_sock() - Initialize state for non-spliced connection
  * @c:		Execution context
  * @ref:	epoll reference of listening socket
- * @conn:	connection structure to initialize
+ * @conn:	connection structure (with TAPSIDE(@conn) completed)
  * @s:		Accepted socket
- * @sa:		Peer socket address (from accept())
  * @now:	Current timestamp
- *
- * Return: true if able to create a tap connection, false otherwise
  */
-static bool tcp_tap_conn_from_sock(struct ctx *c,
+static void tcp_tap_conn_from_sock(struct ctx *c,
 				   union tcp_listen_epoll_ref ref,
 				   struct tcp_tap_conn *conn, int s,
-				   struct sockaddr *sa,
 				   const struct timespec *now)
 {
 	char fsstr[FLOWSIDE_STRLEN];
 
+	ASSERT(flowside_complete(SOCKSIDE(conn)));
+
 	conn->f.type = FLOW_TCP;
 	conn->sock = s;
 	conn->timer = -1;
 	conn->ws_to_tap = conn->ws_from_tap = 0;
 	conn_event(c, conn, SOCK_ACCEPTED);
 
-	if (flowside_getsockname(SOCKSIDE(conn), s) < 0) {
-		err("tcp: Failed to get local name, connection dropped");
-		return false;
-	}
-	inany_from_sockaddr(&SOCKSIDE(conn)->eaddr, &SOCKSIDE(conn)->eport, sa);
-
-	ASSERT(flowside_complete(SOCKSIDE(conn)));
-	debug("TCP: index %li, new connection from socket, %s", FLOW_IDX(conn),
-	      flowside_fmt(SOCKSIDE(conn), fsstr, sizeof(fsstr)));
-
 	TAPSIDE(conn)->faddr = SOCKSIDE(conn)->eaddr;
 	TAPSIDE(conn)->fport = SOCKSIDE(conn)->eport;
 	tcp_snat_inbound(c, &TAPSIDE(conn)->faddr);
@@ -2699,8 +2687,6 @@ static bool tcp_tap_conn_from_sock(struct ctx *c,
 	conn_flag(c, conn, ACK_FROM_TAP_DUE);
 
 	tcp_get_sndbuf(conn);
-
-	return true;
 }
 
 /**
@@ -2712,6 +2698,7 @@ static bool tcp_tap_conn_from_sock(struct ctx *c,
 void tcp_listen_handler(struct ctx *c, union epoll_ref ref,
 			const struct timespec *now)
 {
+	char fsstr[FLOWSIDE_STRLEN];
 	struct sockaddr_storage sa;
 	union flow *flow;
 	socklen_t sl;
@@ -2730,20 +2717,25 @@ void tcp_listen_handler(struct ctx *c, union epoll_ref ref,
 	if (s < 0)
 		return;
 
-	flow = flowtab + c->flow_count++;
+	flow = flowtab + c->flow_count;
 
-	if (c->mode == MODE_PASTA &&
-	    tcp_splice_conn_from_sock(c, ref.tcp_listen, &flow->tcp_splice,
-				      s, (struct sockaddr *)&sa))
+	if (flowside_getsockname(&flow->f.side[0], s) < 0) {
+		err("tcp: Failed to get local name, connection dropped");
+		close(s);
 		return;
+	}
+	inany_from_sockaddr(&flow->f.side[0].eaddr, &flow->f.side[0].eport,
+			    &sa);
+	c->flow_count++;
 
-	if (tcp_tap_conn_from_sock(c, ref.tcp_listen, &flow->tcp, s,
-				   (struct sockaddr *)&sa, now))
+	debug("TCP: index %li, new connection from socket, %s", FLOW_IDX(flow),
+	      flowside_fmt(&flow->f.side[0], fsstr, sizeof(fsstr)));
+
+	if (c->mode == MODE_PASTA &&
+	    tcp_splice_conn_from_sock(c, ref.tcp_listen, &flow->tcp_splice, s))
 		return;
 
-	/* Failed to create the connection */
-	close(s);
-	c->flow_count--;
+	tcp_tap_conn_from_sock(c, ref.tcp_listen, &flow->tcp, s, now);
 }
 
 /**
diff --git a/tcp_splice.c b/tcp_splice.c
index 676e7e8..018d095 100644
--- a/tcp_splice.c
+++ b/tcp_splice.c
@@ -73,6 +73,9 @@ static int ns_sock_pool6	[TCP_SOCK_POOL_SIZE];
 /* Pool of pre-opened pipes */
 static int splice_pipe_pool		[TCP_SPLICE_PIPE_POOL_SIZE][2][2];
 
+#define ASIDE(conn)			(&(conn)->f.side[0])
+#define BSIDE(conn)			(&(conn)->f.side[1])
+
 #define CONN_V6(x)			(x->flags & SPLICE_V6)
 #define CONN_V4(x)			(!CONN_V6(x))
 #define CONN_HAS(conn, set)		((conn->events & (set)) == (set))
@@ -310,7 +313,16 @@ void tcp_splice_destroy(struct ctx *c, union flow *flow)
 static int tcp_splice_connect_finish(const struct ctx *c,
 				     struct tcp_splice_conn *conn)
 {
-	int i;
+	char fsstr[FLOWSIDE_STRLEN];
+	int i, rc;
+
+	rc = flowside_getsockname(BSIDE(conn), conn->b);
+	if (rc)
+		return rc;
+
+	ASSERT(flowside_complete(BSIDE(conn)));
+	debug("TCP (splice): index %li, connection forwarded, %s", FLOW_IDX(conn),
+	      flowside_fmt(BSIDE(conn), fsstr, sizeof(fsstr)));
 
 	conn->pipe_a_b[0] = conn->pipe_b_a[0] = -1;
 	conn->pipe_a_b[1] = conn->pipe_b_a[1] = -1;
@@ -386,10 +398,13 @@ static int tcp_splice_connect(const struct ctx *c, struct
tcp_splice_conn *conn,
 	if (CONN_V6(conn)) {
 		sa = (struct sockaddr *)&addr6;
 		sl = sizeof(addr6);
+		inany_from_af(&BSIDE(conn)->eaddr, AF_INET6, &addr6.sin6_addr);
 	} else {
 		sa = (struct sockaddr *)&addr4;
 		sl = sizeof(addr4);
+		inany_from_af(&BSIDE(conn)->eaddr, AF_INET, &addr4.sin_addr);
 	}
+	BSIDE(conn)->eport = port;
 
 	if (connect(conn->b, sa, sl)) {
 		if (errno != EINPROGRESS) {
@@ -480,33 +495,30 @@ static void tcp_splice_dir(struct tcp_splice_conn *conn, int
ref_sock,
  * tcp_splice_conn_from_sock() - Attempt to init state for a spliced connection
  * @c:		Execution context
  * @ref:	epoll reference of listening socket
- * @conn:	connection structure to initialize
+ * @conn:	connection structure (with ASIDE(@conn) completed)
  * @s:		Accepted socket
- * @sa:		Peer address of connection
  *
  * Return: true if able to create a spliced connection, false otherwise
  * #syscalls:pasta setsockopt
  */
 bool tcp_splice_conn_from_sock(struct ctx *c, union tcp_listen_epoll_ref ref,
-			       struct tcp_splice_conn *conn, int s,
-			       const struct sockaddr *sa)
+			       struct tcp_splice_conn *conn, int s)
 {
-	const struct in_addr *a4;
-	union inany_addr aany;
-	in_port_t port;
+	const struct in_addr *e4 = inany_v4(&ASIDE(conn)->eaddr);
+	const struct in_addr *f4 = inany_v4(&ASIDE(conn)->faddr);
 
 	ASSERT(c->mode == MODE_PASTA);
+	ASSERT(flowside_complete(ASIDE(conn)));
 
-	inany_from_sockaddr(&aany, &port, sa);
-	a4 = inany_v4(&aany);
-
-	if (a4) {
-		if (!IN4_IS_ADDR_LOOPBACK(a4))
+	if (e4) {
+		if (!IN4_IS_ADDR_LOOPBACK(e4))
 			return false;
+		ASSERT(f4 && IN4_IS_ADDR_LOOPBACK(f4));
 		conn->flags = 0;
 	} else {
-		if (!IN6_IS_ADDR_LOOPBACK(&aany.a6))
+		if (!IN6_IS_ADDR_LOOPBACK(&ASIDE(conn)->eaddr.a6))
 			return false;
+		ASSERT(IN6_IS_ADDR_LOOPBACK(&ASIDE(conn)->faddr.a6));
 		conn->flags = SPLICE_V6;
 	}
 
diff --git a/tcp_splice.h b/tcp_splice.h
index e7a583a..fb00318 100644
--- a/tcp_splice.h
+++ b/tcp_splice.h
@@ -11,8 +11,7 @@ struct tcp_splice_conn;
 void tcp_splice_sock_handler(struct ctx *c, struct tcp_splice_conn *conn,
 			     int s, uint32_t events);
 bool tcp_splice_conn_from_sock(struct ctx *c, union tcp_listen_epoll_ref ref,
-			       struct tcp_splice_conn *conn, int s,
-			       const struct sockaddr *sa);
+			       struct tcp_splice_conn *conn, int s);
 void tcp_splice_init(struct ctx *c);
 
 #endif /* TCP_SPLICE_H */
-- 
2.41.0