May 2024 - dev

[PATCH v4 0/2] Implement explicit outbound address and interface selection
by Stefano Brivio 14 Nov '26

14 Nov '26

v4: In 2/2, use --outbound-if4 and --outbound-if6, by default, to also assign "template" interface indices Stefano Brivio (2): conf, passt.h: Rename "outbound" interface to "template" interface conf, icmp, tcp, udp: Add options to bind to outbound address and interface conf.c | 112 ++++++++++++++++++++++++++++++++++++++++++++++++-------- icmp.c | 24 ++++++++++-- passt.1 | 29 ++++++++++++++- passt.h | 14 ++++++- tcp.c | 60 ++++++++++++++++++++++++++++++ udp.c | 54 ++++++++++++++++++--------- 6 files changed, 252 insertions(+), 41 deletions(-) -- 2.39.2

4 7

[PATCH v2 00/14] Clean up checksum and header generation for inbound packets
by David Gibson 10 Oct '25

10 Oct '25

The main packet "fast paths" for UDP and TCP mostly just forward packets rather than generating them from scratch. However the control paths for ICMP and DHCP sometimes generate packets more or less from scratch. Because these are relatively rare, it's not performance critical. The paths for sending these packets have some duplication of the header generation. There's also some layering violation in tap_ip_send() which both generates IP headers and updates the L4 (UDP or UCMP) checksum. Finally that checksum generation is a little awkward: it temporarily generates the IP pseudo header (or something close enough to serve) in the place of the actual header, generates the checksum, then replaces it with the real IP header. This approach seems to be causing miscompiles with some LTO optimization, because the stores to the pseudo header are being moved or elided across the code calculating the checksum. This series addresses all of these. We consolidate and clarify the packet sending helpers, and use them in some places there was previously duplicated code. In the process we use new checksum generation helpers which take a different approach which should avoid the LTO problems (this aspect I haven't tested yet though). Changes since v1: * Numerous minor style changes * Rename header generation helpers to make their behaviour clearer * Added several missing function doc comments * Corrected some erroneous statements and terms in comments David Gibson (14): Add csum_icmp6() helper for calculating ICMPv6 checksums Add csum_icmp4() helper for calculating ICMP checksums Add csum_udp6() helper for calculating UDP over IPv6 checksums Add csum_udp4() helper for calculating UDP over IPv4 checksums Add csum_ip4_header() helper to calculate IPv4 header checksums Add helpers for normal inbound packet destination addresses Remove support for TCP packets from tap_ip_send() tap: Remove unhelpeful vnet_pre optimization from tap_send() Split tap_ip_send() into IPv4 and IPv6 specific functions tap: Split tap_ip6_send() into UDP and ICMP variants ndp: Remove unneeded eh_source parameter ndp: Use tap_icmp6_send() helper tap: Split tap_ip4_send() into UDP and ICMP variants dhcp: Use tap_udp4_send() helper in dhcp() arp.c | 2 +- checksum.c | 120 ++++++++++++++++----- checksum.h | 15 ++- dhcp.c | 19 +--- dhcpv6.c | 21 +--- icmp.c | 12 +-- ndp.c | 28 +---- ndp.h | 3 +- tap.c | 312 ++++++++++++++++++++++++++++++++++------------------- tap.h | 19 +++- 10 files changed, 345 insertions(+), 206 deletions(-) -- 2.37.3

2 17

[PATCH] pasta.c: modify hostname when detaching new namespace
by Danish Prakash 29 Jul '24

29 Jul '24

When invoking pasta without any arguments, it's difficult to tell whether we are in the new namespace or not leaving users a bit confused. This change modifies the host namespace to add a prefix "pasta-" to make it a bit more obvious. Signed-off-by: Danish Prakash <contact(a)danishpraka.sh> --- pasta.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/pasta.c b/pasta.c index 31e1e00..840a2b1 100644 --- a/pasta.c +++ b/pasta.c @@ -180,6 +180,8 @@ static int pasta_spawn_cmd(void *arg) { const struct pasta_spawn_cmd_arg *a; sigset_t set; + char hostname[HOST_NAME_MAX+1], pasta_hostname[HOST_NAME_MAX+1]; + char *hostname_prefix = "pasta-"; /* We run in a detached PID and mount namespace: mount /proc over */ if (mount("", "/proc", "proc", 0, NULL)) @@ -188,6 +190,17 @@ static int pasta_spawn_cmd(void *arg) if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail"); + if (gethostname(hostname, HOST_NAME_MAX+1) == 0) { + if ((strlen(hostname) + strlen(hostname_prefix)) > HOST_NAME_MAX) { + hostname[strlen(hostname)-strlen(hostname_prefix)] = '\0'; + } + sprintf(pasta_hostname, "%s%s", hostname_prefix, hostname); + + if (sethostname(pasta_hostname, strlen(pasta_hostname)) != 0) { + warn("Unable to set pasta-prefixed hostname"); + } + } + /* Wait for the parent to be ready: see main() */ sigemptyset(&set); sigaddset(&set, SIGUSR1); -- 2.45.1

2 10

[PATCH 0/8] Open socket and PID files as root, before switching
by Stefano Brivio 21 Jun '24

21 Jun '24

If libguestfs tools run as root, with the 'direct' backend (without libvirt), we'll start as root as well. As guest images might be owned by root, there are valid reasons to use libguestfs tools as root, so be nice to them: open socket and PID files *before* switching to nobody, so that we can still access their paths. Stefano Brivio (8): conf: Don't lecture user about starting us as root tap: Move all-ones initialisation of mac_guest to tap_sock_init() passt, tap: Don't use -1 as uninitialised value for fd_tap_listen tap: Split tap_sock_unix_init() into opening and listening parts util: Rename write_pidfile() to pidfile_write() passt, util: Move opening of PID file to its own function conf, passt, tap: Open socket and PID files before switching UID/GID conf, passt.h: Rename pid_file in struct ctx to pidfile conf.c | 23 +++++++++++++++++++---- passt.c | 17 ++++------------- passt.h | 8 ++++++-- tap.c | 57 +++++++++++++++++++++++++++++++++++---------------------- tap.h | 1 + util.c | 28 +++++++++++++++++++++++++--- util.h | 3 ++- 7 files changed, 92 insertions(+), 45 deletions(-) -- 2.43.0

3 29

[PATCH] selinux: Allow access to user_devpts
by Derek Schrock 07 Jun '24

07 Jun '24

Allow access to user_devpts. $ pasta --version pasta 0^20240510.g7288448-1.fc40.x86_64 ... $ awk '' < /dev/null $ pasta --version $ While this might be a awk bug it appears pasta should still have access to devpts. --- contrib/selinux/pasta.te | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 0ceda06..4e36c3f 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -211,3 +211,4 @@ allow pasta_t ifconfig_t:process { noatsecure rlimitinh siginh }; allow pasta_t netutils_t:process { noatsecure rlimitinh siginh }; allow pasta_t ping_t:process { noatsecure rlimitinh siginh }; allow pasta_t user_tty_device_t:chr_file { append read write }; +allow pasta_t user_devpts_t:chr_file { append read write }; -- 2.45.0

3 7

[PATCH 0/3] conf, log: Fix regression in usage() printing
by David Gibson 05 Jun '24

05 Jun '24

Erik Sjölund pointed out a regression where we're no long printing the --help message to stdout, but to stderr instead. I'm not actually sure what caused the regression, but it was made possible by the fact that the original fix was pretty strange to begin with. It introduced some hacks to force the logging subsystem to go to stdout, which have presumably failed in some subtle way. But, there's really no reason to run usage() through the logging subsystem in the first place - it just adds complexity. Link: https://bugs.passt.top/show_bug.cgi?id=90 Link: https://bugs.passt.top/show_bug.cgi?id=52 David Gibson (3): conf: Remove unhelpful usage() wrapper conf: Don't print usage via the logging subsystem log: Remove log_to_stdout option conf.c | 329 ++++++++++++++++++++++++++++----------------------------- log.c | 8 +- log.h | 1 - 3 files changed, 163 insertions(+), 175 deletions(-) -- 2.45.1

2 5

[PATCH v4 0/3] Support for SO_PEEK_OFF socket option
by Jon Maloy 04 Jun '24

04 Jun '24

Latest changes based on feedback. Notably, removed fast retransmit when peer advertises zero-window. Jon Maloy (3): tcp: move seq_to_tap update to when frame is queued tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 149 ++++++++++++++++++++++++++++++++++++++++------------- tcp_conn.h | 2 + 2 files changed, 116 insertions(+), 35 deletions(-) -- 2.42.0

3 17

[PATCH v4 00/10] Add vhost-user support to passt (part 2)
by Laurent Vivier 03 Jun '24

03 Jun '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. v4: - remove "tcp: extract buffer management from tcp_conn_tap_mss()" as the MSS size can be the same between socket and vhost-user. - rename tcp_send_flag() and tcp_data_from_sock() to tcp_buf_send_flag() and tcp_buf_data_from_sock() v3: - add 3 new patches tap: use in->buf_size rather than sizeof(pkt_buf) tcp: remove tap_hdr parameter iov: remove iov_copy() v2: - compare to MODE_PASTA in conf_open_files() too - move taph out of udp_update_hdr4()/udp_update_hdr6() Laurent Vivier (10): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST iov: remove iov_copy() tcp: remove tap_hdr parameter tap: use in->buf_size rather than sizeof(pkt_buf) Makefile | 5 +- conf.c | 14 +- iov.c | 39 ---- iov.h | 3 - isolation.c | 10 +- passt.c | 4 +- tap.c | 119 +++++----- tap.h | 7 + tcp.c | 604 +++---------------------------------------------- tcp_buf.c | 536 +++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 16 ++ tcp_internal.h | 85 +++++++ udp.c | 68 +++--- udp.h | 2 +- 14 files changed, 792 insertions(+), 720 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

2 19

[PATCH v3 00/11] Add vhost-user support to passt (part 2)
by Laurent Vivier 31 May '24

31 May '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. v3: - add 3 new patches tap: use in->buf_size rather than sizeof(pkt_buf) tcp: remove tap_hdr parameter iov: remove iov_copy() v2: - compare to MODE_PASTA in conf_open_files() too - move taph out of udp_update_hdr4()/udp_update_hdr6() Laurent Vivier (11): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: extract buffer management from tcp_conn_tap_mss() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST iov: remove iov_copy() tcp: remove tap_hdr parameter tap: use in->buf_size rather than sizeof(pkt_buf) Makefile | 5 +- conf.c | 14 +- iov.c | 39 ---- iov.h | 3 - isolation.c | 10 +- passt.c | 4 +- tap.c | 119 +++++----- tap.h | 7 + tcp.c | 609 +++---------------------------------------------- tcp_buf.c | 553 ++++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 17 ++ tcp_internal.h | 77 +++++++ udp.c | 68 +++--- udp.h | 2 +- 14 files changed, 798 insertions(+), 729 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

2 12

[PATCH v7 0/3] Support for SO_PEEK_OFF
by Jon Maloy 31 May '24

31 May '24

v7: Only patch #3 updated. Jon Maloy (3): tcp: move seq_to_tap update to when frame is queued tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 164 +++++++++++++++++++++++++++++++++++++++-------------- tcp_conn.h | 2 + 2 files changed, 123 insertions(+), 43 deletions(-) -- 2.45.0

2 5