January 2023 - dev

[PATCH v2 00/14] Clean up checksum and header generation for inbound packets
by David Gibson 10 Oct '25

10 Oct '25

The main packet "fast paths" for UDP and TCP mostly just forward packets rather than generating them from scratch. However the control paths for ICMP and DHCP sometimes generate packets more or less from scratch. Because these are relatively rare, it's not performance critical. The paths for sending these packets have some duplication of the header generation. There's also some layering violation in tap_ip_send() which both generates IP headers and updates the L4 (UDP or UCMP) checksum. Finally that checksum generation is a little awkward: it temporarily generates the IP pseudo header (or something close enough to serve) in the place of the actual header, generates the checksum, then replaces it with the real IP header. This approach seems to be causing miscompiles with some LTO optimization, because the stores to the pseudo header are being moved or elided across the code calculating the checksum. This series addresses all of these. We consolidate and clarify the packet sending helpers, and use them in some places there was previously duplicated code. In the process we use new checksum generation helpers which take a different approach which should avoid the LTO problems (this aspect I haven't tested yet though). Changes since v1: * Numerous minor style changes * Rename header generation helpers to make their behaviour clearer * Added several missing function doc comments * Corrected some erroneous statements and terms in comments David Gibson (14): Add csum_icmp6() helper for calculating ICMPv6 checksums Add csum_icmp4() helper for calculating ICMP checksums Add csum_udp6() helper for calculating UDP over IPv6 checksums Add csum_udp4() helper for calculating UDP over IPv4 checksums Add csum_ip4_header() helper to calculate IPv4 header checksums Add helpers for normal inbound packet destination addresses Remove support for TCP packets from tap_ip_send() tap: Remove unhelpeful vnet_pre optimization from tap_send() Split tap_ip_send() into IPv4 and IPv6 specific functions tap: Split tap_ip6_send() into UDP and ICMP variants ndp: Remove unneeded eh_source parameter ndp: Use tap_icmp6_send() helper tap: Split tap_ip4_send() into UDP and ICMP variants dhcp: Use tap_udp4_send() helper in dhcp() arp.c | 2 +- checksum.c | 120 ++++++++++++++++----- checksum.h | 15 ++- dhcp.c | 19 +--- dhcpv6.c | 21 +--- icmp.c | 12 +-- ndp.c | 28 +---- ndp.h | 3 +- tap.c | 312 ++++++++++++++++++++++++++++++++++------------------- tap.h | 19 +++- 10 files changed, 345 insertions(+), 206 deletions(-) -- 2.37.3

2 17

[PATCH 0/4] RFC: Some cleanups to tap and tcp
by David Gibson 16 Feb '23

16 Feb '23

This is a handful of simple cleanups which I made while investigating https://bugs.passt.top/show_bug.cgi?id=41. Note that these don't themselves actually address that bug, they're just unrelated cleanups that happen to be in adjacent code. These are barely tested at all. I've had some crises right before going away that mean I haven't had a chance to plish these. I'm posting them so they're out there rather than waiting until I'm back in two weeks. These are based on my tap send unification series and the TCP socket pool cleanup series. David Gibson (4): tap: Don't pcap frames that didn't get sent tap: Eliminate goto from tap_handler() tcp: Remove 'recvmsg' goto from tcp_data_from_sock tcp: Remove 'zero_len' goto from tcp_data_from_sock tap.c | 49 +++++++++++++++++++++++++++---------------------- tcp.c | 37 +++++++++++++++++-------------------- 2 files changed, 44 insertions(+), 42 deletions(-) -- 2.39.1

2 9

Improved handling of changing DNS resolvers
by Noah Gold 14 Feb '23

14 Feb '23

Hi folks, libslirp and Passt have different approaches to sharing DNS resolvers with the guest system, each with their own benefits & drawbacks. On the libslirp project, we're discussing [1] how to support DNS failover. Passt already has support for this, but there is a drawback to its solution which prevents us from taking a similar approach: the resolvers are read exactly once, so if the host changes networks at runtime, the guest will not receive the updated resolvers and thus its connectivity will break. libslirp's current approach is to DNAT a single address exposed to the guest to one of the resolvers configured on the host. The problem here is that if that one resolver goes down, the guest can't resolve DNS names. We're considering changing so that instead of a single address, we expose a set of MAXNS addresses, and DNAT those 1:1 to the DNS resolvers registered with the host. Because the DNAT table lives on the host side, we can refresh the guest's resolvers whenever the host's resolvers change, but without the need to expire a DHCP lease (even with short leases, the guest will still lose connectivity for a time). Does this sound like an approach Passt would be open to adopting as well? Thanks. - Noah [1] https://gitlab.freedesktop.org/slirp/libslirp/-/issues/26

3 7

[PATCH] Make assertions actually useful
by David Gibson 13 Feb '23

13 Feb '23

There are some places in passt/pasta which #include <assert.h> and make various assertions. If we hit these something has already gone wrong, but they're there so that we a useful message instead of cryptic misbehaviour if assumptions we thought were correct turn out not to be. Except.. the glibc implementation of assert() uses syscalls that aren't in our seccomp filter, so we'll get a SIGSYS before it actually prints the message. Work around this by adding our own ASSERT() implementation using our existing err() function to log the message, and an abort(). The abort() probably also won't work exactly right with seccomp, but once we've printed the message, dying with a SIGSYS works just as well as dying with a SIGABRT. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- inany.h | 6 ++---- lineread.c | 10 +++++----- tcp.c | 9 ++++----- tcp_splice.c | 3 +-- udp.c | 3 +-- util.c | 1 - util.h | 20 +++++++++++++++++++- 7 files changed, 32 insertions(+), 20 deletions(-) diff --git a/inany.h b/inany.h index 52d43f2..7ff32f0 100644 --- a/inany.h +++ b/inany.h @@ -6,8 +6,6 @@ * IPv6 or IPv4 (encoded as IPv4-mapped IPv6 addresses) */ -#include <assert.h> - /** union inany_addr - Represents either an IPv4 or IPv6 address * @a6: Address as an IPv6 address, may be IPv4-mapped * @v4mapped.zero: All zero-bits for an IPv4 address @@ -63,7 +61,7 @@ static inline void inany_from_af(union inany_addr *aa, int af, const void *addr) aa->v4mapped.a4 = *((struct in_addr *)addr); } else { /* Not valid to call with other address families */ - assert(0); + ASSERT(0); } } @@ -89,6 +87,6 @@ static inline void inany_from_sockaddr(union inany_addr *aa, in_port_t *port, *port = ntohs(sa4->sin_port); } else { /* Not valid to call with other address families */ - assert(0); + ASSERT(0); } } diff --git a/lineread.c b/lineread.c index 59021e6..6ffb14e 100644 --- a/lineread.c +++ b/lineread.c @@ -16,10 +16,10 @@ #include <fcntl.h> #include <string.h> #include <stdbool.h> -#include <assert.h> #include <unistd.h> #include "lineread.h" +#include "util.h" /** * lineread_init() - Prepare for line by line file reading without allocation @@ -44,10 +44,10 @@ static int peek_line(struct lineread *lr, bool eof) char *nl; /* Sanity checks (which also document invariants) */ - assert(lr->count >= 0); - assert(lr->next_line >= 0); - assert(lr->next_line + lr->count >= lr->next_line); - assert(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); + ASSERT(lr->count >= 0); + ASSERT(lr->next_line >= 0); + ASSERT(lr->next_line + lr->count >= lr->next_line); + ASSERT(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); nl = memchr(lr->buf + lr->next_line, '\n', lr->count); diff --git a/tcp.c b/tcp.c index 4744ac5..475c23f 100644 --- a/tcp.c +++ b/tcp.c @@ -288,7 +288,6 @@ #include <sys/uio.h> #include <unistd.h> #include <time.h> -#include <assert.h> #include <linux/tcp.h> /* For struct tcp_info */ @@ -602,7 +601,7 @@ static inline struct tcp_tap_conn *conn_at_idx(int index) { if ((index < 0) || (index >= TCP_MAX_CONNS)) return NULL; - assert(!(CONN(index)->c.spliced)); + ASSERT(!(CONN(index)->c.spliced)); return CONN(index); } @@ -2809,7 +2808,7 @@ static void tcp_conn_from_sock(struct ctx *c, union epoll_ref ref, socklen_t sl; int s; - assert(ref.r.p.tcp.tcp.listen); + ASSERT(ref.r.p.tcp.tcp.listen); if (c->tcp.conn_count >= TCP_MAX_CONNS) return; @@ -3051,7 +3050,7 @@ static void tcp_ns_sock_init4(const struct ctx *c, in_port_t port) struct in_addr loopback = { htonl(INADDR_LOOPBACK) }; int s; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); s = sock_l4(c, AF_INET, IPPROTO_TCP, &loopback, NULL, port, tref.u32); if (s >= 0) @@ -3075,7 +3074,7 @@ static void tcp_ns_sock_init6(const struct ctx *c, in_port_t port) .tcp.index = idx }; int s; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); s = sock_l4(c, AF_INET6, IPPROTO_TCP, &in6addr_loopback, NULL, port, tref.u32); diff --git a/tcp_splice.c b/tcp_splice.c index 72b1672..1d624f1 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -46,7 +46,6 @@ #include <sys/epoll.h> #include <sys/types.h> #include <sys/socket.h> -#include <assert.h> #include "util.h" #include "passt.h" @@ -519,7 +518,7 @@ bool tcp_splice_conn_from_sock(struct ctx *c, union epoll_ref ref, union inany_addr aany; in_port_t port; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); inany_from_sockaddr(&aany, &port, sa); a4 = inany_v4(&aany); diff --git a/udp.c b/udp.c index dbfdb61..9c63a8c 100644 --- a/udp.c +++ b/udp.c @@ -108,7 +108,6 @@ #include <sys/uio.h> #include <unistd.h> #include <time.h> -#include <assert.h> #include "checksum.h" #include "util.h" @@ -255,7 +254,7 @@ static void udp_invert_portmap(struct udp_port_fwd *fwd) { int i; - assert(ARRAY_SIZE(fwd->f.delta) == ARRAY_SIZE(fwd->rdelta)); + ASSERT(ARRAY_SIZE(fwd->f.delta) == ARRAY_SIZE(fwd->rdelta)); for (i = 0; i < ARRAY_SIZE(fwd->f.delta); i++) { in_port_t delta = fwd->f.delta[i]; diff --git a/util.c b/util.c index d9858f2..c5ee1c0 100644 --- a/util.c +++ b/util.c @@ -23,7 +23,6 @@ #include <time.h> #include <errno.h> #include <stdbool.h> -#include <assert.h> #include "util.h" #include "passt.h" diff --git a/util.h b/util.h index 3baec91..a367f96 100644 --- a/util.h +++ b/util.h @@ -6,6 +6,11 @@ #ifndef UTIL_H #define UTIL_H +#include <stdlib.h> +#include <stdarg.h> + +#include "log.h" + #define VERSION_BLOB \ VERSION "\n" \ "Copyright Red Hat\n" \ @@ -47,6 +52,18 @@ #define STRINGIFY(x) #x #define STR(x) STRINGIFY(x) +#define ASSERT(expr) \ + do { \ + if (!(expr)) { \ + err("ASSERTION FAILED in %s (%s:%d): %s", \ + __func__, __FILE__, __LINE__, STRINGIFY(expr)); \ + /* This may actually SIGSYS, due to seccomp, \ + * but that will still get the job done \ + */ \ + abort(); \ + } \ + } while (0) + #ifdef P_tmpdir #define TMPDIR P_tmpdir #else @@ -163,7 +180,8 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, #include <net/if.h> #include <limits.h> -#include <stdarg.h> +#include <stdint.h> +#include <netinet/ip6.h> #include "packet.h" -- 2.39.0

2 1

[PATCH v3 00/18] RFC: Unify and simplify tap send path
by David Gibson 13 Feb '23

13 Feb '23

Although we have an abstraction for the "slow path" (DHCP, NDP) guest bound packets, the TCP and UDP forwarding paths write directly to the tap fd. However, it turns out how they send frames to the tap device is more similar than it originally appears. This series unifies the low-level tap send functions for TCP and UDP, and makes some clean ups along the way. This is based on my earlier outstanding series. Changes since v2: * Rebase on the latest version of the UDP tap/splice socket unification * Rework pcap_frame() to return an error rather than printing itself, restoring less verbose behaviour for one error in a group of frames. * Assorted typo fixes in comments and commit messages Changes since v1: * Abstract tap header construction as well as frame send (a number of new patches) * Remove unneeded flags buf_bytes globals as well * Fix bug where we weren't correctly setting iov_len after the move to giving variable sized iovecs to send_frames(). David Gibson (18): pcap: Introduce pcap_frame() helper pcap: Replace pcapm() with pcap_multiple() tcp: Combine two parts of passt tap send path together tcp: Don't compute total bytes in a message until we need it tcp: Improve interface to tcp_l2_buf_flush() tcp: Combine two parts of pasta tap send path together tap, tcp: Move tap send path to tap.c util: Introduce hton*_constant() in place of #ifdefs tcp, udp: Use named field initializers in iov_init functions util: Parameterize ethernet header initializer macro tcp: Remove redundant and incorrect initialization from *_iov_init() tcp: Consolidate calculation of total frame size tap: Add "tap headers" abstraction tcp: Use abstracted tap header tap: Use different io vector bases depending on tap type udp: Use abstracted tap header tap: Improve handling of partial frame sends udp: Use tap_send_frames() dhcpv6.c | 50 +++-------- pcap.c | 86 ++++++------------- pcap.h | 3 +- tap.c | 121 ++++++++++++++++++++++++++ tap.h | 54 ++++++++++++ tcp.c | 254 +++++++++++++------------------------------------------ udp.c | 213 ++++++---------------------------------------- udp.h | 2 +- util.h | 47 ++-------- 9 files changed, 310 insertions(+), 520 deletions(-) -- 2.39.0

2 23

Race condition with pasta COMMAND...
by Paul Holzinger 31 Jan '23

31 Jan '23

Hi all, while debugging some things I used `./pasta --config-net -- nslookup google.com 1.1.1.1` to test dns. The problem is that does not work because the nslookup process will be executed before pasta is ready with the netns setup, i.e. compare `./pasta --config-net -- ip a`. So a workaround is to spawn a shell and sleep: `sh -c "sleep 1; nslookup google.com 1.1.1.1"` However this is ugly and does not ensure that the netns is ready after one second. As a user I would expect pasta to wait until the setup is finished before it calls exec(). I can send a patch if you agree and I find some time. --- Paul

2 3

[PATCH 0/5] Cleanups to tcp socket pool handling
by David Gibson 23 Jan '23

23 Jan '23

This is a bit of a diversion from what I'm notionally working on at the moment. While thinking about what we'd need to use the IP_TRANSPARENT socket option to broaden the cases where we can "splice", I noticed some inelegancies in how we handle the pool of pre-opened sockets in the TCP code, and well, here we are. This makes a number of cleanups to the handling of these pools. Most notably, tcp_splice_connect() now has simpler semantics: it now always runs in the init namespace, and is always given a pre-opened socket (which could be in the guest ns). David Gibson (5): tcp: Make a helper to refill each socket pool tcp: Split init and ns cases for tcp_sock_refill() tcp: Move socket pool declarations around tcp: Split pool lookup from creating new sockets in tcp_conn_new_sock() tcp: Improve handling of fallback if socket pool is empty on new splice tcp.c | 138 ++++++++++++++++++------------------------------- tcp.h | 2 - tcp_conn.h | 12 ++++- tcp_splice.c | 141 ++++++++++++++++++++++++++------------------------- 4 files changed, 132 insertions(+), 161 deletions(-) -- 2.39.0

2 12

[PATCH v4 0/8] Don't use additional sockets for receiving "spliced" UDP communications
by David Gibson 13 Jan '23

13 Jan '23

At present, the UDP "splice" and "tap" paths are quite separate. We have separate sockets to receive packets bound for the tap and splice paths. This leads to some code duplication, and extra open sockets. This series partially unifies the two paths, allowing us to use a single (host side) socket, bound to 0.0.0.0 or :: to receive packets for both cases. Changes since v3: * Fixed really dumb compile error, and actually ran through the tests. Oops. Changes since v2: * Don't receive multiple packets at once for pasta mode - seems to hurt throughput on balance. * Add some comments clarifying reasoning here. Changes since v1: * Renamed udp_localname[46] to udp[46]_localname * Allow handling of UDP port 0 * Fix a bug which could misidentify certain v6 packets as v4-spliceable * Some minor cosmetic fixes to code and commit messages David Gibson (8): udp: Move sending pasta tap frames to the end of udp_sock_handler() udp: Split sending to passt tap interface into separate function udp: Split receive from preparation and send in udp_sock_handler() udp: Don't handle tap receive batch size calculation within a #define udp: Pre-populate msg_names with local address udp: Unify udp_sock_handler_splice() with udp_sock_handler() udp: Decide whether to "splice" per datagram rather than per socket udp: Don't use separate sockets to listen for spliced packets udp.c | 388 ++++++++++++++++++++++++++++++--------------------------- udp.h | 2 +- util.h | 7 ++ 3 files changed, 213 insertions(+), 184 deletions(-) -- 2.39.0

2 11

[libvirt PATCH 0/9] Support libvirt-managed QEMU domain <interface> backed by a passt process
by Laine Stump 12 Jan '23

12 Jan '23

passt (https://passt.top) provides a method for connecting a guest to the larger network without requiring any elevated privileges. This set of patches allows libvirt/QEMU users to easily configure a QEMU domain to use passt for the backend of any emulated network interface. More details are in the individual patches, but the short explanation is that you will use: <interface type='user'> <backend type='passt'> ... to select the passt backend. (We decided to do it this way since the concept is so similar to slirp, which was the original "type='user'") The following caveats currently apply: 1) passt support requires "-netdev stream" in QEMU, which is only available starting with qemu-7.2.0. So if you want to test these patches out, you need the latest upstream release of QEMU. 2) SELinux must be set to "permissive". This is of course temporary. As I understand it, the remedy to this is a new SELinux profile for the passt binary, which is outside the control of libvirt and so not something that can be addressed in this patchset (or any other patch to libvirt). 3) Although there is a a new option for QEMU's -netdev that will tell QEMU to attempt to reconnect to a new incarnation of the same socket if passt unexpectedly exits, and a new QEMU event that will be put into QEMU to inform libvirt that the passt process has exited (so that it can start a new, identical passt process), I think this hasn't been pushed upstream yet (??), and I haven't implemented any support for it here. So, if the passt process unexpectedly exits, the guest will be without networking. However, Stefano (passt author) is emphatic that passt will never unexpectedly exit :-) passt has *many* other options that libvirt could support, but the small subset here are the things that seem most useful (and/or were specifically requested by prospective users of passt). It is always easier to add more stuff in the future than to remove "mistakes", so I tried to no go overboard. Laine Stump (9): conf: rename virDomainNetBackend* to virDomainNetDriver* conf: move anonymous backend struct from virDomainNetDef into its own struct conf: put interface <backend> parsing/formatting separate functions conf: add passt XML additions to schema conf: parse/format passt-related XML additions qemu: new capability QEMU_CAPS_NETDEV_STREAM qemu: add passtStateDir to qemu driver config qemu: hook up passt config to qemu domains specfile: require passt for the build if fedora >= 36 or rhel >= 9 docs/formatdomain.rst | 95 +++++- libvirt.spec.in | 7 + meson.build | 1 + po/POTFILES | 1 + src/conf/domain_conf.c | 303 ++++++++++++++++-- src/conf/domain_conf.h | 64 +++- src/conf/domain_validate.c | 32 +- src/conf/schemas/domaincommon.rng | 65 ++++ src/conf/virconftypes.h | 6 + src/libvirt_private.syms | 1 + src/qemu/meson.build | 2 + src/qemu/qemu_capabilities.c | 4 + src/qemu/qemu_capabilities.h | 3 + src/qemu/qemu_command.c | 11 +- src/qemu/qemu_command.h | 3 +- src/qemu/qemu_conf.c | 2 + src/qemu/qemu_conf.h | 1 + src/qemu/qemu_domain.c | 5 +- src/qemu/qemu_domain.h | 3 +- src/qemu/qemu_driver.c | 12 + src/qemu/qemu_extdevice.c | 25 +- src/qemu/qemu_hotplug.c | 26 +- src/qemu/qemu_interface.c | 8 +- src/qemu/qemu_passt.c | 284 ++++++++++++++++ src/qemu/qemu_passt.h | 38 +++ src/qemu/qemu_process.c | 1 + src/qemu/qemu_validate.c | 9 +- src/security/virt-aa-helper.c | 2 +- .../caps_7.2.0.x86_64.xml | 1 + tests/qemuxml2argvdata/net-user-passt.args | 34 ++ .../net-user-passt.x86_64-latest.args | 37 +++ tests/qemuxml2argvdata/net-user-passt.xml | 57 ++++ tests/qemuxml2argvtest.c | 2 + tests/qemuxml2xmloutdata/net-user-passt.xml | 1 + tests/qemuxml2xmltest.c | 1 + 35 files changed, 1087 insertions(+), 60 deletions(-) create mode 100644 src/qemu/qemu_passt.c create mode 100644 src/qemu/qemu_passt.h create mode 100644 tests/qemuxml2argvdata/net-user-passt.args create mode 100644 tests/qemuxml2argvdata/net-user-passt.x86_64-latest.args create mode 100644 tests/qemuxml2argvdata/net-user-passt.xml create mode 120000 tests/qemuxml2xmloutdata/net-user-passt.xml -- 2.38.1

5 27

[PATCH] Correct port ranges in --tcp-ports examples
by Laine Stump 09 Jan '23

09 Jan '23

The proper syntax is: ${start}-${end}:${dststart}-${dstend} not ${start}-${end}-${dststart}:${dstend} Signed-off-by: Laine Stump <laine(a)redhat.com> --- passt.1 | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/passt.1 b/passt.1 index 528763b..0dad878 100644 --- a/passt.1 +++ b/passt.1 @@ -349,7 +349,7 @@ Forward local ports 22 and 25 to ports 22 and 25 on the guest -t 22-80 Forward local ports 22 to 80 to corresponding ports on the guest .TP --t 22-80-32:90 +-t 22-80:32-90 Forward local ports 22 to 80 to corresponding ports on the guest plus 10 .TP -t 192.0.2.1/22 @@ -361,7 +361,7 @@ Forward local port 22, bound to 192.0.2.1 and interface eth0, to port 22 -t 2000-5000,~3000-3010 Forward local ports 2000 to 5000, but not 3000 to 3010 .TP --t 192.0.2.1/20-30,~25 +-t 192.0.2.1/20-26:24-30,~25-29 Forward local ports 20 to 24, and 26 to 30, bound to 192.0.2.1 .TP -t ~20000-20010 @@ -427,7 +427,7 @@ Forward local ports 22 and 25 to ports 22 and 25 in the target namespace -t 22-80 Forward local ports 22 to 80 to corresponding ports in the target namespace .TP --t 22-80-32:90 +-t 22-80:32-90 Forward local ports 22 to 80 to corresponding ports plus 10 in the target namespace .TP @@ -440,7 +440,7 @@ Forward local port 22, bound to 192.0.2.1 and interface eth0, to port 22 -t 2000-5000,~3000-3010 Forward local ports 2000 to 5000, but not 3000 to 3010 .TP --t 192.0.2.1/20-30,~25 +-t 192.0.2.1/20-26:24-30,~25-29 Forward local ports 20 to 24, and 26 to 30, bound to 192.0.2.1 .TP -t ~20000-20010 -- 2.38.1

2 1