fwd_rule: Allow "all" port specs to be combined with other options

Currently we handle -t all and the like as a special case, it can't be
combined with other port specifier options.  Remove that restriction,
allowing combined options like:
     -t all,~9999          # Forward everything non-ephemeral except 9999
     -t all,auto           # Equivalent to -t auto
     -t all,33000          # Forward non-ephemeral plus port 33,000

This isn't particularly useful immediately, but will become important for
destination address specification - it provides a place to attach the
target address for "all" or exclude only mappings.  It will also work
better with some parsing reworks we want to make.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

3 files changed, 41 insertions, 42 deletions

diff --git a/conf.c b/conf.c
index c4a36de..043fcf1 100644
--- a/conf.c
+++ b/conf.c
@@ -660,11 +660,10 @@ static void usage(const char *name, FILE *f, int status)
 		"    SPEC can be:\n"
 		"      'none': don't forward any ports\n"
 		"      [ADDR[%%IFACE]/]PORTS: forward specific ports\n"
-		"        PORTS is either 'all' (forward all unbound, non-ephemeral\n"
-		"        ports), or a comma-separated list of ports, optionally\n"
-		"        ranged with '-' and optional target ports after ':'.\n"
-		"        Ranges can be reduced by excluding ports or ranges\n"
-		"        prefixed by '~'.\n"
+		"        PORTS is a comma-separated list of ports or port\n"
+		"         ranges.  'all' indicates all unbound non-ephemeral\n"
+		"         ports.  Ranges can be reduced by excluding ports or\n"
+		"         ranges prefixed by '~'.\n"
 		"%s"
 		"        Examples:\n"
 		"        -t all		Forward all ports\n"
diff --git a/fwd_rule.c b/fwd_rule.c
index 6d7ec2c..b14df34 100644
--- a/fwd_rule.c
+++ b/fwd_rule.c
@@ -471,20 +471,13 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto,
 	uint8_t flags = 0;
 	unsigned i;
 
-	if (!strcmp(spec, "all")) {
-		/* Treat "all" as equivalent to "": all non-ephemeral ports */
-		spec = "";
-	}
-
 	/* Parse excluded ranges and "auto" in the first pass */
 	for_each_chunk(p, ep, spec, ",") {
 		struct port_range xrange;
 
-		if (isdigit(*p)) {
-			/* Include range, parse later */
-			exclude_only = false;
+		/* Include range, parse later */
+		if (parse_literal(&p, "all") || isdigit(*p))
 			continue;
-		}
 
 		if (parse_literal(&p, "auto")) {
 			if (p != ep) /* Garbage after the keyword */
@@ -512,20 +505,18 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto,
 			bitmap_set(exclude, i);
 	}
 
-	if (exclude_only) {
-		/* Exclude ephemeral ports */
-		fwd_port_map_ephemeral(exclude);
-
-		fwd_rule_range_except(fwd, del, proto, addr, ifname,
-				      1, NUM_PORTS - 1, exclude,
-				      1, flags | FWD_WEAK);
-		return;
-	}
-
 	/* Now process base ranges, skipping exclusions */
 	for_each_chunk(p, ep, spec, ",") {
 		struct port_range orig_range, mapped_range;
 
+		/* Handle "all" like exclude only */
+		if (parse_literal(&p, "all")) {
+			if (p != ep) /* Garbage after the keyword */
+				goto bad;
+
+			continue;
+		}
+
 		if (!isdigit(*p))
 			/* Already parsed */
 			continue;
@@ -533,6 +524,8 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto,
 		if (!parse_port_range(&p, &orig_range))
 			goto bad;
 
+		exclude_only = false;
+
 		if (parse_literal(&p, ":")) {
 			/* There's a range to map to as well */
 			if (!parse_port_range(&p, &mapped_range))
@@ -553,6 +546,14 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto,
 				      mapped_range.first, flags);
 	}
 
+	/* Finally handle "all" and exclude only specs */
+	if (exclude_only) {
+		fwd_port_map_ephemeral(exclude);
+
+		fwd_rule_range_except(fwd, del, proto, addr, ifname,
+				      1, NUM_PORTS - 1, exclude,
+				      1, flags | FWD_WEAK);
+	}
 	return;
 bad:
 	die("Invalid port specifier '%s'", spec);
diff --git a/passt.1 b/passt.1
index 908fd4a..183f888 100644
--- a/passt.1
+++ b/passt.1
@@ -432,29 +432,22 @@ Send \fIname\fR as Client FQDN: DHCP option 81 and DHCPv6 option 39.
 
 .TP
 .BR \-t ", " \-\-tcp-ports " " \fIspec
-Configure TCP port forwarding to guest or namespace. \fIspec\fR can be one of:
+Configure TCP port forwarding to guest or namespace. \fIspec\fR can be either:
 .RS
 
 .TP
 .BR none
 Don't forward any ports
 
+or
 .TP
 [\fIaddress\fR[\fB%\fR\fIinterface\fR]\fB/\fR]\fIports\fR ...
-Specific ports to forward.  Optionally, a specific listening address
-and interface name (since Linux 5.7) can be specified.  \fIports\fR
-may be either:
-.RS
-.TP
-\fBall\fR
-Forward all unbound, non-ephemeral ports, as permitted by current
-capabilities.  For low (< 1024) ports, see \fBNOTES\fR. No failures
-are reported for unavailable ports, unless no ports could be forwarded
-at all.
+
+Ports to forward.  Optionally, a specific listening address and
+interface name (since Linux 5.7) can be specified.
 .RE
 
-.RS
-or a comma-separated list of entries which may be any of:
+\fIports\fR is a comma-separated list of entries which may be any of:
 .TP
 \fIfirst\fR[\fB-\fR\fIlast\fR][\fB:\fR\fItofirst\fR[\fB-\fR\fItolast\fR]]
 Include range. Forward port numbers between \fIfirst\fR and \fIlast\fR
@@ -469,6 +462,13 @@ Exclude range.  Don't forward port numbers between \fIfirst\fR and
 \fIlast\fR.  This takes precedences over include ranges.
 
 .TP
+.BR all
+Forward all unbound, non-ephemeral ports, not covered by exclude
+ranges above, as permitted by current capabilities.  For low (< 1024)
+ports, see \fBNOTES\fR. No failures are reported for unavailable
+ports, unless no ports could be forwarded at all.
+
+.TP
 .BR auto
 \fBpasta\fR only.  Only forward ports in the specified set if the
 target ports are bound in the namespace. The list of ports is
@@ -476,11 +476,10 @@ periodically derived (every second) from listening sockets reported by
 \fI/proc/net/tcp\fR and \fI/proc/net/tcp6\fR, see \fBproc\fR(5).
 .RE
 
-Specifying excluded ranges only implies that all other non-ephemeral
-ports are forwarded. Specifying no ranges at all implies forwarding
-all non-ephemeral ports permitted by current capabilities.  In this
-case, no failures are reported for unavailable ports, unless no ports
-could be forwarded at all.
+Specifying excluded ranges only implies that all other non-ephemeral ports
+are forwarded. Specifying no ranges is equivalent to '\fBall\fR'.  In this
+case, no failures are reported for unavailable ports, unless no ports could
+be forwarded at all.
 
 Examples:
 .RS