We replace the fwd_guest_accessible4() and fwd_guest_accessible6()
functions with a unified fwd_guest_accessible() function that handles
both address families. With the unified address array, we can check
all configured addresses in a single pass using for_each_addr() with
family filter AF_UNSPEC.
Signed-off-by: Jon Maloy
Reviewed-by: David Gibson
---
v6: -Some fixes based on feedback from David Gibson
v7: -Added curly brackets to for_each_loop() in fwd_guest_accessible(),
as suggested by Stefano Brivio.
---
fwd.c | 69 +++++++++++++----------------------------------------------
1 file changed, 15 insertions(+), 54 deletions(-)
diff --git a/fwd.c b/fwd.c
index f2ca34c2..9a88fa19 100644
--- a/fwd.c
+++ b/fwd.c
@@ -841,19 +841,19 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini)
}
/**
- * fwd_guest_accessible4() - Is IPv4 address guest-accessible
+ * fwd_guest_accessible() - Is address guest-accessible
* @c: Execution context
- * @addr: Host visible IPv4 address
+ * @addr: Host visible address (IPv4 or IPv6)
*
* Return: true if @addr on the host is accessible to the guest without
* translation, false otherwise
*/
-static bool fwd_guest_accessible4(const struct ctx *c,
- const struct in_addr *addr)
+static bool fwd_guest_accessible(const struct ctx *c,
+ const union inany_addr *addr)
{
const struct guest_addr *a;
- if (IN4_IS_ADDR_LOOPBACK(addr))
+ if (inany_is_loopback(addr))
return false;
/* In socket interfaces 0.0.0.0 generally means "any" or unspecified,
@@ -861,38 +861,18 @@ static bool fwd_guest_accessible4(const struct ctx *c,
* that has a different meaning for host and guest, we can't let it
* through untranslated.
*/
- if (IN4_IS_ADDR_UNSPECIFIED(addr))
+ if (inany_is_unspecified(addr))
return false;
- /* For IPv4, addr_seen is initialised to addr, so is always a valid
- * address
+ /* Check against all configured guest addresses */
+ for_each_addr(a, c->addrs, c->addr_count, AF_UNSPEC) {
+ if (inany_equals(addr, &a->addr))
+ return false;
+ }
+ /* Also check addr_seen: it tracks the address the guest is actually
+ * using, which may differ from configured addresses.
*/
- a = fwd_get_addr(c, AF_INET, CONF_ADDR_ANY, 0);
- if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) ||
- IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen))
- return false;
-
- return true;
-}
-
-/**
- * fwd_guest_accessible6() - Is IPv6 address guest-accessible
- * @c: Execution context
- * @addr: Host visible IPv6 address
- *
- * Return: true if @addr on the host is accessible to the guest without
- * translation, false otherwise
- */
-static bool fwd_guest_accessible6(const struct ctx *c,
- const struct in6_addr *addr)
-{
- const struct guest_addr *a;
-
- if (IN6_IS_ADDR_LOOPBACK(addr))
- return false;
-
- a = fwd_get_addr(c, AF_INET6, CONF_ADDR_ANY, 0);
- if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6))
+ if (inany_equals4(addr, &c->ip4.addr_seen))
return false;
/* For IPv6, addr_seen starts unspecified, because we don't know what LL
@@ -900,31 +880,12 @@ static bool fwd_guest_accessible6(const struct ctx *c,
* if it has been set to a real address.
*/
if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen) &&
- IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr_seen))
+ inany_equals6(addr, &c->ip6.addr_seen))
return false;
return true;
}
-/**
- * fwd_guest_accessible() - Is IPv[46] address guest-accessible
- * @c: Execution context
- * @addr: Host visible IPv[46] address
- *
- * Return: true if @addr on the host is accessible to the guest without
- * translation, false otherwise
- */
-static bool fwd_guest_accessible(const struct ctx *c,
- const union inany_addr *addr)
-{
- const struct in_addr *a4 = inany_v4(addr);
-
- if (a4)
- return fwd_guest_accessible4(c, a4);
-
- return fwd_guest_accessible6(c, &addr->a6);
-}
-
/**
* nat_outbound() - Apply address translation for outbound (TAP to HOST)
* @c: Execution context
--
2.52.0