July 2023 - dev

[RFC v2] tcp: add support for read with offset when using MSG_PEEK
by Jon Maloy 05 Sep '23

05 Sep '23

When reading received messages with MSG_PEEK, we sometines have to read the leading bytes of the stream several times, only to reach the bytes we really want. This is clearly non-optimal. What we would want is something similar to pread/preadv(), but working even for tcp sockets. At the same time, we obviously don't want to add any new arguments to the recv/recvmsg() calls. In this commit, we allow the user to set iovec.iov_base in the first vector entry to NULL. This tells the socket to skip the first entry, hence making the iov_len field of that entry indicate the offset value. This way, there is no need to add any new arguments. This change is simple and non-intrusive, and should be safe addition to the socket API. We have measured it to give a throughput improvement of 8-10 % for the protocol splicer 'passst', which is used in KubeVirt containers. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> works with original msghdr Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- net/ipv4/tcp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 33f559f491c8..1d89337e89b6 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2428,6 +2428,7 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, struct tcp_sock *tp = tcp_sk(sk); int copied = 0; u32 peek_seq; + u32 peek_offset; u32 *seq; unsigned long used; int err; @@ -2435,7 +2436,6 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, long timeo; struct sk_buff *skb, *last; u32 urg_hole = 0; - err = -ENOTCONN; if (sk->sk_state == TCP_LISTEN) goto out; @@ -2469,6 +2469,14 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, if (flags & MSG_PEEK) { peek_seq = tp->copied_seq; seq = &peek_seq; + if (msg->msg_iter.iov[0].iov_base == NULL) { + peek_offset = msg->msg_iter.iov[0].iov_len; + msg->msg_iter.iov = &msg->msg_iter.iov[1]; + msg->msg_iter.nr_segs -= 1; + msg->msg_iter.count -= peek_offset; + len -= peek_offset; + *seq += peek_offset; + } } target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); -- 2.39.0

3 5

[PATCH 00/17] netlink fixes and cleanups
by David Gibson 03 Aug '23

03 Aug '23

We've had several bugs in the past that were quite tricky to debug, but would have been much easier if we'd known that a netlink operation had failed. So, it would be desirable to actually detect and report failures of netlink operations. While working on that, I discovered that there are a number of other issues ranging from very small to medium sized with the way we use netlink. This series addresses many of them. Link: https://bugs.passt.top/show_bug.cgi?id=60 Link: https://bugs.passt.top/show_bug.cgi?id=67 David Gibson (17): netlink: Split up functionality if nl_link() netlink: Split nl_addr() into separate operation functions netlink: Split nl_route() into separate operation functions netlink: Use struct in_addr for IPv4 addresses, not bare uint32_t netlink: Explicitly pass netlink sockets to operations netlink: Make nl_*_dup() use a separate datagram for each request netlink: Start sequence number from 1 instead of 0 netlink: Treat send() or recv() errors as fatal netlink: Fill in netlink header fields from nl_req() netlink: Add nl_do() helper for simple operations with error checking netlink: Clearer reasoning about the netlink response buffer size netlink: Split nl_req() to allow processing multiple response datagrams netlink: Add nl_foreach_oftype to filter response message types netlink: Propagate errors for "set" operations netlink: Always process all responses to a netlink request netlink: Propagate errors for "dump" operations netlink: Propagate errors for "dup" operations conf.c | 66 ++++- netlink.c | 844 ++++++++++++++++++++++++++++++++++-------------------- netlink.h | 27 +- pasta.c | 75 +++-- 4 files changed, 659 insertions(+), 353 deletions(-) -- 2.41.0

2 34

[PATCH 0/8] RFC: Generalize flow tracking, part 1
by David Gibson 28 Jul '23

28 Jul '23

This is a first draft of the first part of implementing a more general flow table (connection tracking) as described at: https://pad.passt.top/p/NewForwardingModel This is by no means complete. So far it doesn't really do anything new, it just reorganizes the TCP connection table to be closer to the more general flow table. Still it's ready for preliminary review. David Gibson (8): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers tcp: Track guest-side correspondent address tcp, flow: Introduce struct demiflow tcp, flow: Perform TCP hash calculations based on demiflow structure flow.h | 66 +++++++++++++++ icmp.c | 12 ++- icmp.h | 3 +- passt.c | 10 +-- passt.h | 4 +- pasta.c | 2 +- siphash.c | 1 + tap.c | 29 ++++--- tcp.c | 227 ++++++++++++++++++++------------------------------- tcp.h | 5 +- tcp_conn.h | 9 +- tcp_splice.c | 2 + udp.c | 37 +++------ udp.h | 5 +- util.h | 4 +- 15 files changed, 209 insertions(+), 207 deletions(-) create mode 100644 flow.h -- 2.41.0

1 8

ip_nonlocal_bind causes havoc with local connection detection
by Valtteri Vuorikoski 20 Jul '23

20 Jul '23

If net.ipv4.ip_nonlocal_bind is enabled, the following code in tcp_conn_from_tap gets very confused: if (!bind(s, sa, sl)) { tcp_rst(c, conn); /* Nobody is listening then */ return; } if (errno != EADDRNOTAVAIL && errno != EACCES) conn_flag(c, conn, LOCAL); This is especially visible if net.ipv4.ip_unprivileged_port_start is set to a value lower than the default. For example, if net.ipv4.ip_unprivileged_port_start=443 and net.ipv4.ip_nonlocal_bind=1, the bind()==0 branch will be hit for all outgoing connections going to port 443 because bind() succeeds even when "sa" contains the remote address, and pretty much nothing will work. It might the best to skip the check and marking connections as LOCAL if net.ipv4.ip_nonlocal_bind is enabled? If that doesn't seem reasonable, then maybe show a warning at start and/or just document that the ip_nonlocal_bind setting shouldn't be used with passt? -Valtteri

2 2

[PATCH 00/27] RFC: Start converting passt & pasta tests to Avocado using special plugin
by David Gibson 10 Jul '23

10 Jul '23

I've sent previous series converting some of the passt & pasta testsuite to use Avocado. However the jUnit-like structure of avocado tests wasn't a great fit for our needs (plus Stefano and I just dislike the style). Here's another attempt, where instead we use a new "avocado-classless" plugin to avoid jUnit-ism. This is definitely a work-in-progress. Some early observations: * It is noticeably less verbose than jUnit style * It does avoid some of the confusing stuff that arises from jUnit style * The present draft has some different pretty confusing stuff, involving nested and stacked function decorators, and some other non-entirely-obvious use of higher order functions * I hope I can improve this at least a bit, but it will need some thought * I was pleasantly surprised at how simple it was to write the plugin itself David Gibson (27): avocado: Make a duplicate copy of testsuite for comparison purposes avocado: Don't double download assets for test/ and oldtest/ avocado: Move static checkers to avocado avocado: Introduce "avocado-classless" plugin, runner and outline avocado, test: Add static checkers for Python code avocado: Resolver implementation for avocado-classless plugin avocado: Add basic assertion helpers to avocado-classless plugin tasst, avocado: Introduce library of common test helpers avocado-classless: Test matrices by composition tasst: Helper functions for executing commands in different places avocado-classless: Allow overriding default timeout avocado: Convert build tests to avocado tasst: Add helpers for running background commands on sites tasst: Add helper to get network interface names for a site tasst: Add helpers to run commands with nstool tasst: Add ifup and network address helpers to Site tasst: Helper for creating veth devices between namespaces tasst: Add helper for getting MTU of a network interface tasst: Add helper to wait for IP address to appear tasst: Add helpers for getting a site's routes tasst: Helpers to test transferring data between sites tasst: IP address allocation helpers tasst: Helpers for running daemons with a pidfile tasst: Helpers for testing NDP behaviour tasst: Helpers for testing DHCP & DHCPv6 behaviour tasst: Helpers to construct a simple network environment for tests avocado: Convert basic pasta tests Makefile | 9 + oldtest/.gitignore | 11 + oldtest/Makefile | 119 +++ oldtest/README.md | 137 +++ {test => oldtest}/build/all | 0 {test => oldtest}/build/clang_tidy | 0 {test => oldtest}/build/cppcheck | 0 oldtest/ci | 1 + oldtest/demo/passt | 245 ++++++ oldtest/demo/pasta | 274 ++++++ oldtest/demo/podman | 819 ++++++++++++++++++ oldtest/distro/debian | 252 ++++++ oldtest/distro/fedora | 396 +++++++++ oldtest/distro/opensuse | 208 +++++ oldtest/distro/ubuntu | 216 +++++ oldtest/env/mate-terminal.profile | 42 + oldtest/find-arm64-firmware.sh | 13 + oldtest/lib/context | 130 +++ oldtest/lib/layout | 259 ++++++ oldtest/lib/layout_ugly | 113 +++ oldtest/lib/perf_report | 272 ++++++ oldtest/lib/setup | 385 ++++++++ oldtest/lib/setup_ugly | 58 ++ oldtest/lib/term | 750 ++++++++++++++++ oldtest/lib/test | 398 +++++++++ oldtest/lib/util | 133 +++ oldtest/lib/video | 152 ++++ oldtest/memory/passt | 187 ++++ oldtest/nstool.c | 565 ++++++++++++ oldtest/passt.mbuto | 83 ++ oldtest/passt.mem.mbuto | 44 + oldtest/passt/dhcp | 70 ++ oldtest/passt/ndp | 33 + oldtest/passt/shutdown | 19 + oldtest/passt/tcp | 76 ++ oldtest/passt/udp | 46 + oldtest/passt_in_ns/icmp | 32 + oldtest/passt_in_ns/shutdown | 19 + oldtest/passt_in_ns/tcp | 256 ++++++ oldtest/passt_in_ns/udp | 138 +++ {test => oldtest}/pasta/dhcp | 0 {test => oldtest}/pasta/ndp | 0 {test => oldtest}/pasta/tcp | 0 {test => oldtest}/pasta/udp | 0 oldtest/pasta_options/log_to_file | 93 ++ oldtest/perf/passt_tcp | 215 +++++ oldtest/perf/passt_udp | 165 ++++ oldtest/perf/pasta_tcp | 300 +++++++ oldtest/perf/pasta_udp | 219 +++++ oldtest/prepare-distro-img.sh | 18 + oldtest/run | 238 +++++ oldtest/run_demo | 1 + oldtest/two_guests/basic | 80 ++ oldtest/valgrind.supp | 9 + test/.gitignore | 2 + test/Makefile | 69 +- test/avocado/build.py | 94 ++ test/avocado/pasta.py | 129 +++ test/avocado/static_checkers/clang-tidy.sh | 3 + test/avocado/static_checkers/cppcheck.sh | 3 + test/avocado/static_checkers/flake8.sh | 3 + test/avocado/static_checkers/pylint.sh | 3 + test/avocado_classless/.gitignore | 1 + .../avocado_classless/__init__.py | 11 + .../avocado_classless/manifest.py | 48 + .../avocado_classless/plugin.py | 231 +++++ .../avocado_classless/test.py | 80 ++ test/avocado_classless/examples.py | 57 ++ test/avocado_classless/selftests.py | 76 ++ test/avocado_classless/setup.py | 32 + test/lib/layout | 31 - test/lib/setup | 47 - test/run | 14 - test/tasst/__init__.py | 11 + test/tasst/address.py | 80 ++ test/tasst/dhcp.py | 114 +++ test/tasst/dhcpv6.py | 74 ++ test/tasst/exesite.py | 285 ++++++ test/tasst/meta/__init__.py | 16 + test/tasst/meta/static_ifup.py | 60 ++ test/tasst/meta/veth.py | 86 ++ test/tasst/ndp.py | 99 +++ test/tasst/nstool.py | 184 ++++ test/tasst/pasta.py | 42 + test/tasst/scenario/__init__.py | 12 + test/tasst/scenario/simple.py | 98 +++ test/tasst/transfer.py | 174 ++++ test/tasst/typecheck.py | 47 + 88 files changed, 10518 insertions(+), 96 deletions(-) create mode 100644 oldtest/.gitignore create mode 100644 oldtest/Makefile create mode 100644 oldtest/README.md rename {test => oldtest}/build/all (100%) rename {test => oldtest}/build/clang_tidy (100%) rename {test => oldtest}/build/cppcheck (100%) create mode 120000 oldtest/ci create mode 100644 oldtest/demo/passt create mode 100644 oldtest/demo/pasta create mode 100644 oldtest/demo/podman create mode 100644 oldtest/distro/debian create mode 100644 oldtest/distro/fedora create mode 100644 oldtest/distro/opensuse create mode 100644 oldtest/distro/ubuntu create mode 100644 oldtest/env/mate-terminal.profile create mode 100755 oldtest/find-arm64-firmware.sh create mode 100644 oldtest/lib/context create mode 100644 oldtest/lib/layout create mode 100644 oldtest/lib/layout_ugly create mode 100755 oldtest/lib/perf_report create mode 100755 oldtest/lib/setup create mode 100755 oldtest/lib/setup_ugly create mode 100755 oldtest/lib/term create mode 100755 oldtest/lib/test create mode 100755 oldtest/lib/util create mode 100755 oldtest/lib/video create mode 100644 oldtest/memory/passt create mode 100644 oldtest/nstool.c create mode 100755 oldtest/passt.mbuto create mode 100755 oldtest/passt.mem.mbuto create mode 100644 oldtest/passt/dhcp create mode 100644 oldtest/passt/ndp create mode 100644 oldtest/passt/shutdown create mode 100644 oldtest/passt/tcp create mode 100644 oldtest/passt/udp create mode 100644 oldtest/passt_in_ns/icmp create mode 100644 oldtest/passt_in_ns/shutdown create mode 100644 oldtest/passt_in_ns/tcp create mode 100644 oldtest/passt_in_ns/udp rename {test => oldtest}/pasta/dhcp (100%) rename {test => oldtest}/pasta/ndp (100%) rename {test => oldtest}/pasta/tcp (100%) rename {test => oldtest}/pasta/udp (100%) create mode 100644 oldtest/pasta_options/log_to_file create mode 100644 oldtest/perf/passt_tcp create mode 100644 oldtest/perf/passt_udp create mode 100644 oldtest/perf/pasta_tcp create mode 100644 oldtest/perf/pasta_udp create mode 100755 oldtest/prepare-distro-img.sh create mode 100755 oldtest/run create mode 120000 oldtest/run_demo create mode 100644 oldtest/two_guests/basic create mode 100644 oldtest/valgrind.supp create mode 100644 test/avocado/build.py create mode 100644 test/avocado/pasta.py create mode 100755 test/avocado/static_checkers/clang-tidy.sh create mode 100755 test/avocado/static_checkers/cppcheck.sh create mode 100755 test/avocado/static_checkers/flake8.sh create mode 100755 test/avocado/static_checkers/pylint.sh create mode 100644 test/avocado_classless/.gitignore create mode 100644 test/avocado_classless/avocado_classless/__init__.py create mode 100644 test/avocado_classless/avocado_classless/manifest.py create mode 100644 test/avocado_classless/avocado_classless/plugin.py create mode 100644 test/avocado_classless/avocado_classless/test.py create mode 100644 test/avocado_classless/examples.py create mode 100644 test/avocado_classless/selftests.py create mode 100644 test/avocado_classless/setup.py create mode 100644 test/tasst/__init__.py create mode 100644 test/tasst/address.py create mode 100644 test/tasst/dhcp.py create mode 100644 test/tasst/dhcpv6.py create mode 100644 test/tasst/exesite.py create mode 100644 test/tasst/meta/__init__.py create mode 100644 test/tasst/meta/static_ifup.py create mode 100644 test/tasst/meta/veth.py create mode 100644 test/tasst/ndp.py create mode 100644 test/tasst/nstool.py create mode 100644 test/tasst/pasta.py create mode 100644 test/tasst/scenario/__init__.py create mode 100644 test/tasst/scenario/simple.py create mode 100644 test/tasst/transfer.py create mode 100644 test/tasst/typecheck.py -- 2.41.0

2 31

[PATCH] Revert "MAKE: Fix parallel builds; .o files; .gitignore; new makedocs"
by Stefano Brivio 10 Jul '23

10 Jul '23

This reverts commit cc2a6bec3cf2ff6ed0c043ada93d352466614373: I applied that patch by mistake. Fixes: cc2a6bec3cf2 ("MAKE: Fix parallel builds; .o files; .gitignore; new makedocs") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- .gitignore | 1 - Makefile | 51 ++++++++++++++++++++++++++------------------------- makedocs.pl | 19 ------------------- 3 files changed, 26 insertions(+), 45 deletions(-) delete mode 100644 makedocs.pl diff --git a/.gitignore b/.gitignore index caeafa5..d3d0e2c 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,4 @@ *~ -*.o /passt /passt.avx2 /pasta diff --git a/Makefile b/Makefile index 4c99771..a5256f5 100644 --- a/Makefile +++ b/Makefile @@ -100,41 +100,29 @@ else BIN := passt pasta qrap endif -.NOTPARALLEL: seccomp.h -all: seccomp.h $(BIN) $(MANPAGES) docs - -PASST_OBJS = $(PASST_SRCS:.c=.o) -PASST_AVX2_OBJS = $(PASST_SRCS:.c=.avx2.o) -OBJS = $(SRCS:.c=.o) -QRAP_OBJS = $(QRAP_SRCS:.c=.o) -AVXFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops +all: $(BIN) $(MANPAGES) docs static: FLAGS += -static -DGLIBC_NO_STATIC_NSS -static: clean seccomp.h all +static: clean all seccomp.h: seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) @ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ARCH="$(TARGET_ARCH)" CC="$(CC)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) -.c.o: - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ - -$(PASST_AVX2_OBJS): seccomp.h - $(CC) $(AVXFLAGS) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $(@:.avx2.o=.c) -o $@ - -passt: $(PASST_OBJS) seccomp.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_OBJS) -o passt $(LDFLAGS) +passt: $(PASST_SRCS) $(HEADERS) + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS) -passt.avx2: $(PASST_AVX2_OBJS) $(HEADERS) seccomp.h - $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) $(AVXFLAGS) \ - $(PASST_AVX2_OBJS) -o passt.avx2 $(LDFLAGS) +passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops +passt.avx2: $(PASST_SRCS) $(HEADERS) + $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) \ + $(PASST_SRCS) -o passt.avx2 $(LDFLAGS) -passt.avx2: passt seccomp.h +passt.avx2: passt pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ -qrap: $(QRAP_OBJS) passt.h seccomp.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_OBJS) -o qrap $(LDFLAGS) +qrap: $(QRAP_SRCS) passt.h + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_SRCS) -o qrap $(LDFLAGS) valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ getpid gettid kill clock_gettime mmap \ @@ -182,8 +170,21 @@ pkgs: static # other way around: the web version should be obtained by adding HTML and # JavaScript portions to a plain Markdown, instead. However, cgit needs to use # a file in the git tree. Find a better way around this. -docs: - [ ! -e doc/ ]; mkdir docs; perl makedocs.pl > docs/README.plain.md +docs: README.md + @( \ + skip=0; \ + while read l; do \ + case $$l in \ + "## Demo") exit 0 ;; \ + "<!"*) ;; \ + "</"*) skip=1 ;; \ + "<"*) skip=2 ;; \ + esac; \ + \ + [ $$skip -eq 0 ] && echo "$$l"; \ + [ $$skip -eq 1 ] && skip=0; \ + done < README.md; \ + ) > README.plain.md # Checkers currently disabled for clang-tidy: # - llvmlibc-restrict-system-libc-headers diff --git a/makedocs.pl b/makedocs.pl deleted file mode 100644 index 295e1d9..0000000 --- a/makedocs.pl +++ /dev/null @@ -1,19 +0,0 @@ -use strict; - -my $str = ''; -my $regex = qr/(<[^\/].*?>.*?<\/.*?>\n?)|(<\/div>)|(<\/p>)/msp; -my $subst = ''; - - -local $/=undef; -open FILE, '<', 'README.md' or die "Can't open file $!"; -my $file_content = <FILE>; -close FILE; -#print "Source: $file_content\n"; -my $result = $file_content =~ s/$regex//rg; - -my $regex2 = qr/\n[ \n]{3,}\n/msp; -$result = $result =~ s/$regex2/\n\n/rg; - -#print "The result of the substitution is: $result\n"; -print "$result\n"; -- 2.39.2

1 0

[PATCH v2] tap: Explicitly drop IPv4 fragments, and give a warning
by David Gibson 07 Jul '23

07 Jul '23

We don't handle defragmentation of IP packets coming from the tap side, and we're unlikely to any time soon (with our large MTU, it's not useful for practical use cases). Currently, however, we simply ignore the fragmentation flags and treat fragments as though they were whole IP packets. This isn't ideal and can lead to rather cryptic behaviour if we do receive IP fragments. Change the code to explicitly drop fragmented packets, and print a rate limited warning if we do encounter them. Link: https://bugs.passt.top/show_bug.cgi?id=62 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) Changes since v1: * Added missing ntohs() diff --git a/tap.c b/tap.c index e3235299..a6a73d3b 100644 --- a/tap.c +++ b/tap.c @@ -62,6 +62,7 @@ static PACKET_POOL_NOINIT(pool_tap4, TAP_MSGS, pkt_buf); static PACKET_POOL_NOINIT(pool_tap6, TAP_MSGS, pkt_buf); #define TAP_SEQS 128 /* Different L4 tuples in one batch */ +#define FRAGMENT_MSG_RATE 10 /* # seconds between fragment warnings */ /** * tap_send() - Send frame, with qemu socket header if needed @@ -543,6 +544,32 @@ static void tap_packet_debug(const struct iphdr *iph, } } +/** + * tap4_is_fragment() - Determine if a packet is an IP fragment + * @iph: IPv4 header (length already validated) + * @now: Current timestamp + * + * Return: true if iph is an IP fragment, false otherwise + */ +static bool tap4_is_fragment(const struct iphdr *iph, + const struct timespec *now) +{ + if (ntohs(iph->frag_off) & ~IP_DF) { + /* Ratelimit messages */ + static time_t last_message; + static unsigned num_dropped; + + num_dropped++; + if (now->tv_sec - last_message > FRAGMENT_MSG_RATE) { + warn("Can't process IPv4 fragments (%lu dropped)", num_dropped); + last_message = now->tv_sec; + num_dropped = 0; + } + return true; + } + return false; +} + /** * tap4_handler() - IPv4 and ARP packet handler for tap file descriptor * @c: Execution context @@ -591,6 +618,10 @@ resume: hlen > l3_len) continue; + /* We don't handle IP fragments, drop them */ + if (tap4_is_fragment(iph, now)) + continue; + l4_len = l3_len - hlen; if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr) { -- 2.41.0

2 1

[PATCH] tap: Explicitly drop IPv4 fragments, and give a warning
by David Gibson 05 Jul '23

05 Jul '23

We don't handle defragmentation of IP packets coming from the tap side, and we're unlikely to any time soon (with our large MTU, it's not useful for practical use cases). Currently, however, we simply ignore the fragmentation flags and treat fragments as though they were whole IP packets. This isn't ideal and can lead to rather cryptic behaviour if we do receive IP fragments. Change the code to explicitly drop fragmented packets, and print a rate limited warning if we do encounter them. Bugzilla: https://bugs.passt.top/show_bug.cgi?id=62 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/tap.c b/tap.c index e3235299..2e6939fa 100644 --- a/tap.c +++ b/tap.c @@ -62,6 +62,7 @@ static PACKET_POOL_NOINIT(pool_tap4, TAP_MSGS, pkt_buf); static PACKET_POOL_NOINIT(pool_tap6, TAP_MSGS, pkt_buf); #define TAP_SEQS 128 /* Different L4 tuples in one batch */ +#define FRAGMENT_MSG_RATE 10 /* # seconds between fragment warnings */ /** * tap_send() - Send frame, with qemu socket header if needed @@ -543,6 +544,32 @@ static void tap_packet_debug(const struct iphdr *iph, } } +/** + * tap4_is_fragment() - Determine if a packet is an IP fragment + * @iph: IPv4 header (length already validated) + * @now: Current timestamp + * + * Return: true if iph is an IP fragment, false otherwise + */ +static bool tap4_is_fragment(const struct iphdr *iph, + const struct timespec *now) +{ + if (iph->frag_off & ~IP_DF) { + /* Ratelimit messages */ + static time_t last_message; + static unsigned num_dropped; + + num_dropped++; + if (now->tv_sec - last_message > FRAGMENT_MSG_RATE) { + warn("Can't process IPv4 fragments (%lu dropped)", num_dropped); + last_message = now->tv_sec; + num_dropped = 0; + } + return true; + } + return false; +} + /** * tap4_handler() - IPv4 and ARP packet handler for tap file descriptor * @c: Execution context @@ -591,6 +618,10 @@ resume: hlen > l3_len) continue; + /* We don't handle IP fragments, drop them */ + if (tap4_is_fragment(iph, now)) + continue; + l4_len = l3_len - hlen; if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr) { -- 2.41.0

2 3

[PATCH] MAKE: Fix parallel builds; .o files; .gitignore; new makedocs
by KuhnChris 02 Jul '23

02 Jul '23

From: KuhnChris <kuhnchris(a)kuhnchris.eu> --- .gitignore | 1 + Makefile | 51 +++++++++++++++++++++++++-------------------------- makedocs.pl | 19 +++++++++++++++++++ 3 files changed, 45 insertions(+), 26 deletions(-) create mode 100644 makedocs.pl diff --git a/.gitignore b/.gitignore index d3d0e2c..caeafa5 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ *~ +*.o /passt /passt.avx2 /pasta diff --git a/Makefile b/Makefile index a5256f5..4c99771 100644 --- a/Makefile +++ b/Makefile @@ -100,29 +100,41 @@ else BIN := passt pasta qrap endif -all: $(BIN) $(MANPAGES) docs +.NOTPARALLEL: seccomp.h +all: seccomp.h $(BIN) $(MANPAGES) docs + +PASST_OBJS = $(PASST_SRCS:.c=.o) +PASST_AVX2_OBJS = $(PASST_SRCS:.c=.avx2.o) +OBJS = $(SRCS:.c=.o) +QRAP_OBJS = $(QRAP_SRCS:.c=.o) +AVXFLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops static: FLAGS += -static -DGLIBC_NO_STATIC_NSS -static: clean all +static: clean seccomp.h all seccomp.h: seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) @ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ARCH="$(TARGET_ARCH)" CC="$(CC)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) -passt: $(PASST_SRCS) $(HEADERS) - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS) +.c.o: + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $< -o $@ + +$(PASST_AVX2_OBJS): seccomp.h + $(CC) $(AVXFLAGS) $(FLAGS) $(CFLAGS) $(CPPFLAGS) -c $(@:.avx2.o=.c) -o $@ + +passt: $(PASST_OBJS) seccomp.h + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_OBJS) -o passt $(LDFLAGS) -passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops -passt.avx2: $(PASST_SRCS) $(HEADERS) - $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) \ - $(PASST_SRCS) -o passt.avx2 $(LDFLAGS) +passt.avx2: $(PASST_AVX2_OBJS) $(HEADERS) seccomp.h + $(CC) $(filter-out -O2,$(FLAGS)) $(CFLAGS) $(CPPFLAGS) $(AVXFLAGS) \ + $(PASST_AVX2_OBJS) -o passt.avx2 $(LDFLAGS) -passt.avx2: passt +passt.avx2: passt seccomp.h pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ -qrap: $(QRAP_SRCS) passt.h - $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_SRCS) -o qrap $(LDFLAGS) +qrap: $(QRAP_OBJS) passt.h seccomp.h + $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_OBJS) -o qrap $(LDFLAGS) valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ getpid gettid kill clock_gettime mmap \ @@ -170,21 +182,8 @@ pkgs: static # other way around: the web version should be obtained by adding HTML and # JavaScript portions to a plain Markdown, instead. However, cgit needs to use # a file in the git tree. Find a better way around this. -docs: README.md - @( \ - skip=0; \ - while read l; do \ - case $$l in \ - "## Demo") exit 0 ;; \ - "<!"*) ;; \ - "</"*) skip=1 ;; \ - "<"*) skip=2 ;; \ - esac; \ - \ - [ $$skip -eq 0 ] && echo "$$l"; \ - [ $$skip -eq 1 ] && skip=0; \ - done < README.md; \ - ) > README.plain.md +docs: + [ ! -e doc/ ]; mkdir docs; perl makedocs.pl > docs/README.plain.md # Checkers currently disabled for clang-tidy: # - llvmlibc-restrict-system-libc-headers diff --git a/makedocs.pl b/makedocs.pl new file mode 100644 index 0000000..295e1d9 --- /dev/null +++ b/makedocs.pl @@ -0,0 +1,19 @@ +use strict; + +my $str = ''; +my $regex = qr/(<[^\/].*?>.*?<\/.*?>\n?)|(<\/div>)|(<\/p>)/msp; +my $subst = ''; + + +local $/=undef; +open FILE, '<', 'README.md' or die "Can't open file $!"; +my $file_content = <FILE>; +close FILE; +#print "Source: $file_content\n"; +my $result = $file_content =~ s/$regex//rg; + +my $regex2 = qr/\n[ \n]{3,}\n/msp; +$result = $result =~ s/$regex2/\n\n/rg; + +#print "The result of the substitution is: $result\n"; +print "$result\n"; -- 2.30.2

3 2