From fc6c774f6705800cc9409713e678001ca6c4a581 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Mon, 13 Jul 2026 15:38:56 +1000 Subject: fwd: Don't rewrite inbound multicast destinations fwd_nat_from_host() (nearly) always rewrites the destination address for inbound flows to the observed guest address. Usually, that makes sense: regardless of the host address to which the new flow arrived, we want to direct it to the guest. However, that clearly does not make sense for multicast - it should still appear as a multicast transmission to the guest. In particular this can work very badly for multicast protocols which use the same source and destination ports by convention (e.g. mDNS). In this case, we will attempt to forword multicast packets to our own socket, causing a forwarding loop (see bug 209 for more details). While it's certainly not enough to make us handle multicast correctly in all circumstances, not translating multicast destinations is closer to correct, and prevents bug 209 at least. Link: https://bugs.passt.top/show_bug.cgi?id=209 Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- fwd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fwd.c b/fwd.c index 1369bae..7152169 100644 --- a/fwd.c +++ b/fwd.c @@ -1042,7 +1042,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, tgt->eport = rule->to + (ini->oport - rule->first); if (!inany_is_unspecified(&rule->taddr)) tgt->eaddr = rule->taddr; - else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + else if (inany_is_multicast(&ini->oaddr) || + (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr))) tgt->eaddr = ini->oaddr; /* TODO: Allow splicing with specified target address */ -- cgit v1.2.3