October 2025 - dev

[PATCH 3/3] test: Re-implement pasta NDP tests using tunbridge & exeter
by David Gibson 10 Oct '25

10 Oct '25

Convert the pasta NDP tests from shell and our own DSL to Python using the exeter test protocol and tunbridge network simulation library. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/Makefile | 2 +- test/pasta/dhcp | 5 ++++ test/pasta/ndp.py | 59 ++++++++++++++++++++++++++++++++++++++++++ test/run | 6 +++-- test/tasst/__init__.py | 4 +++ test/tasst/pasta.py | 40 ++++++++++++++++++++++++++++ 6 files changed, 113 insertions(+), 3 deletions(-) create mode 100755 test/pasta/ndp.py create mode 100644 test/tasst/pasta.py diff --git a/test/Makefile b/test/Makefile index f66c7e7e..95e3d75e 100644 --- a/test/Makefile +++ b/test/Makefile @@ -67,7 +67,7 @@ ASSETS = $(DOWNLOAD_ASSETS) $(LOCAL_ASSETS) EXETER_SH = smoke/smoke.sh build/static_checkers.sh EXETER_PYPATH = exeter/py3:tunbridge/:. -EXETER_PYTHON = smoke/smoke.py build/build.py +EXETER_PYTHON = smoke/smoke.py build/build.py pasta/ndp.py EXETER_BATS = $(EXETER_SH:%=%.bats) $(EXETER_PYTHON:%=%.bats) BATS_FILES = $(EXETER_BATS) \ podman/test/system/505-networking-pasta.bats diff --git a/test/pasta/dhcp b/test/pasta/dhcp index e1c66be6..61279fbf 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -18,6 +18,11 @@ test Interface name nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' check [ -n "__IFNAME__" ] +# Bring up the interface +ns ip link set dev __IFNAME__ up +# Wait for SLAAC & DAD to complete +ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select(.protocol == "kernel_ra")'; do sleep 0.1; done + test DHCP: address ns /sbin/dhclient -4 --no-pid __IFNAME__ nsout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' diff --git a/test/pasta/ndp.py b/test/pasta/ndp.py new file mode 100755 index 00000000..8c7ce31e --- /dev/null +++ b/test/pasta/ndp.py @@ -0,0 +1,59 @@ +#! /usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# test/pasta/ndp.py - pasta NDP functionality +# +# Copyright Red Hat +# Author: David Gibson <david(a)gibson.dropbear.id.au> + +import contextlib +import dataclasses +from typing import Iterator + +import exeter +import tunbridge +import tasst + + +(a)dataclasses.dataclass +class UnconfiguredScenario(exeter.Scenario): + """Tests for a pasta instance without --config-net""" + + host: tunbridge.Site + guest: tunbridge.Site + ifname: str + addr6: tunbridge.ip.AddrMask6 + gw6: tunbridge.ip.Addr6 + + @exeter.scenariotest + def test_ifname(self) -> None: + ifs = tunbridge.ip.ifs(self.guest) + exeter.assert_eq(set(ifs), {'lo', self.ifname}) + + @tunbridge.ndp.NdpScenario.subscenario + def test_ndp(self) -> tunbridge.ndp.NdpScenario: + tunbridge.ip.ifup(self.guest, self.ifname) + return tunbridge.ndp.NdpScenario(client=self.guest, + ifname=self.ifname, + network=self.addr6.network, + gateway=self.gw6) + + +(a)UnconfiguredScenario.test +(a)contextlib.contextmanager +def simh_pasta_setup() -> Iterator[UnconfiguredScenario]: + with (tunbridge.sample.simple_host('host') as simh, + tunbridge.sample.isolated('guest', simh.site) as guest): + assert simh.ip6 is not None + assert simh.gw6_ll is not None + with tasst.pasta.pasta(simh.site, guest): + yield UnconfiguredScenario(host=simh.site, + guest=guest, + ifname=simh.ifname, + addr6=simh.ip6, + gw6=simh.gw6_ll) + + +if __name__ == '__main__': + exeter.main() diff --git a/test/run b/test/run index 3872a56e..4f09d767 100755 --- a/test/run +++ b/test/run @@ -43,8 +43,10 @@ KERNEL=${KERNEL:-"/boot/vmlinuz-$(uname -r)"} COMMIT="$(git log --oneline --no-decorate -1)" -# Let exeter tests written in Python find their modules +# Let exeter tests written in Python find their modules and binaries to run export PYTHONPATH=${BASEPATH}/exeter/py3:${BASEPATH}/tunbridge:${BASEPATH} +export PASTA=${PASTA:-${BASEPATH}/../pasta} + . lib/util . lib/context @@ -75,8 +77,8 @@ run() { exeter build/build.py exeter build/static_checkers.sh + exeter pasta/ndp.py setup pasta - test pasta/ndp test pasta/dhcp test pasta/tcp test pasta/udp diff --git a/test/tasst/__init__.py b/test/tasst/__init__.py index fd4fe9a8..f5386b3a 100644 --- a/test/tasst/__init__.py +++ b/test/tasst/__init__.py @@ -8,3 +8,7 @@ # # Copyright Red Hat # Author: David Gibson <david(a)gibson.dropbear.id.au> + +from . import pasta + +__all__ = ['pasta'] diff --git a/test/tasst/pasta.py b/test/tasst/pasta.py new file mode 100644 index 00000000..91f59036 --- /dev/null +++ b/test/tasst/pasta.py @@ -0,0 +1,40 @@ +#! /usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# TASST - Test A Simple Socket Transport +# +# test/tasst/pasta.py - Helpers for seeting up pasta instances +# +# Copyright Red Hat +# Author: David Gibson <david(a)gibson.dropbear.id.au> + +import contextlib +import os +from typing import Iterator + +import tunbridge + + +(a)contextlib.contextmanager +def pasta(host: tunbridge.Site, guest: tunbridge.Site, *opts: str) \ + -> Iterator[tunbridge.site.SiteProcess]: + if tunbridge.unshare.parent(guest) is not host: + raise ValueError("pasta guest must be a namespace under host site") + + # This implies guest is a namespace site + assert isinstance(guest, tunbridge.unshare.NsenterSite) + + exe = os.environ['PASTA'] + + with host.tempdir() as piddir: + pidfile = os.path.join(piddir, 'pasta.pid') + cmd = [exe, '-f', '-P', pidfile] + list(opts) + [f'{guest.pid}'] + with host.bg(*cmd, stop=True) as pasta: + # Wait for the PID file to be written + pidstr = None + while not pidstr: + pidstr = host.readfile(pidfile, check=False) + pid = int(pidstr) + print(f'pasta started, host: {host}, guest: {guest}, pid: {pid}') + yield pasta -- 2.51.0

2 6

[PATCH v12 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 10 Oct '25

10 Oct '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. v10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) v11: - Corrected the gratuitous ARP implementation to use the "ARP Announcement" model instead of the "Gratuitous ARP reply" model. v12: - Updated based on feedback from David and Stefano - Added special handling of default GW and loopback addresses. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 32

[PATCH 0/4] tcp: Fix bad switch to CLOSE-WAIT state and surrounding issues
by Stefano Brivio 09 Oct '25

09 Oct '25

The most important fix here is 3/4, the other ones are either fixes for issues that weren't actually observed in practice, but I mistook them as the case fixed by 3/4, or for minor details. Stefano Brivio (4): tcp: Fix ACK sequence on FIN to tap tcp: Completely ignore data segment in CLOSE-WAIT state, log a message tcp: Don't consider FIN flags with mismatching sequence tcp: On partial send (incomplete sendmsg()), request a retransmission right away tcp.c | 12 +++++++++--- tcp_buf.c | 14 +++++++++++++- tcp_vu.c | 7 ++++++- 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.43.0

2 24

[PATCH v2] isolation: keep CAP_DAC_OVERRIDE initially
by Cole Robinson 09 Oct '25

09 Oct '25

Reproducer that I'd expect to work: $ cd $HOME $ sudo passt --runas $UID --socket foo.sock Failed to bind UNIX domain socket: Permission denied A more practical example is for libguestfs apps when run as user=root: + libguestfs connects to libvirt qemu:///system + libvirt qemu:///system defaults to user=qemu + libvirt chowns /run/libvirt/qemu/passt dir to user=qemu + libguestfs instead requests the VM run as user=root + patches in progress but we are blocked by this issue + passt is launched as root, but because CAP_DAC_OVERRIDE has been dropped, passt fails to create socket in qemu owned /run/libvirt/qemu/passt Fix it by not dropping CAP_DAC_OVERRIDE in isolate_initial. This might look sketchy, but isolate_initial already keeps CAP_SYS_ADMIN and CAP_NET_ADMIN, so we are probably no worse off. Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- v2: improve commit message isolation.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/isolation.c b/isolation.c index bbcd23b..b25f349 100644 --- a/isolation.c +++ b/isolation.c @@ -188,6 +188,9 @@ void isolate_initial(int argc, char **argv) * We have to keep CAP_SETUID and CAP_SETGID at this stage, so * that we can switch user away from root. * + * CAP_DAC_OVERRIDE may be required for socket setup when combined + * with --runas. + * * We have to keep some capabilities for the --netns-only case: * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces @@ -198,7 +201,7 @@ void isolate_initial(int argc, char **argv) * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN); + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child -- 2.51.0

2 1

[PATCH 0/5] Refactor epoll handling in preparation for multithreading
by Laurent Vivier 09 Oct '25

09 Oct '25

This series refactors how epoll file descriptors are managed throughout the codebase in preparation for introducing multithreading support. Currently, passt uses a single global epollfd accessed through the context structure. With multithreading, each thread will have its own epollfd managing its subset of flows. The key changes are: 1. Simplify epoll_del() to take the epollfd directly rather than extracting it from the context structure, reducing tight coupling. 2. Move epoll registration out of the socket creation function (sock_l4_sa()) into protocol-specific code, giving callers explicit control over which epoll instance manages each socket. 3. Replace the boolean in_epoll flag in TCP connection structures with an epollfd field in flow_common. This serves dual purposes: tracking whether a flow is registered (zero = not registered) and which epoll instance owns it (non-zero = specific epollfd). 4. Apply this pattern consistently across all protocol handlers (TCP, ICMP, UDP), storing the managing epollfd in each flow's common structure. These changes make the epoll ownership model explicit in the flow tracking system, allowing flows to be managed by different epoll instances - a prerequisite for the per-thread epollfd design in the upcoming multithreading work. Laurent Vivier (5): util: Simplify epoll_del() interface to take epollfd directly util: Move epoll registration out of sock_l4_sa() tcp, flow: Replace per-connection in_epoll flag with epollfd in flow_common icmp: Use epollfd from flow_common structure udp: Use epollfd from flow_common structure flow.c | 12 +++++------- flow.h | 4 +++- icmp.c | 23 ++++++++++++++++++----- pif.c | 34 ++++++++++++++++++++++++++++------ tap.c | 2 +- tcp.c | 36 ++++++++++++++++++------------------ tcp_conn.h | 8 +------- tcp_splice.c | 23 +++++++++++------------ udp_flow.c | 23 ++++++++++++++++++++--- util.c | 21 ++++----------------- util.h | 4 ++-- vhost_user.c | 6 +++--- 12 files changed, 114 insertions(+), 82 deletions(-) -- 2.50.1

3 15

[PATCH] test: Update passt.mbuto and passt.mem.mbuto
by Yumei Huang 09 Oct '25

09 Oct '25

If /bin is in the PATH of host, /usr/bin may not exist in mbuto guest, which causes some binaries failing to move to /usr/bin. As a result, tests fail as binaries not found. Fix it by adding /usr/bin to DIRS. Also create the same symlink for mbuto.mem.img. Link: https://bugs.passt.top/show_bug.cgi?id=158 Fixes: f4729be7a56b("test: Update mbuto profile to fix the symlink of /bin") Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/passt.mbuto | 2 +- test/passt.mem.mbuto | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 231b9c9..598c254 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -33,7 +33,7 @@ LINKS="${LINKS:- dhclient /usr/sbin/dhclient sysctl /usr/sbin/sysctl}" -DIRS="${DIRS} /tmp /usr/sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" +DIRS="${DIRS} /tmp /usr/sbin /usr/bin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" COPIES="${COPIES} small.bin,/root/small.bin medium.bin,/root/medium.bin big.bin,/root/big.bin rampstream,/bin/rampstream rampstream-check.sh,/bin/rampstream-check.sh" diff --git a/test/passt.mem.mbuto b/test/passt.mem.mbuto index 532eae0..7554a43 100755 --- a/test/passt.mem.mbuto +++ b/test/passt.mem.mbuto @@ -12,7 +12,7 @@ PROGS="${PROGS:-ash,dash,bash chmod ip mount insmod mkdir ln cat chmod modprobe grep mknod sed chown sleep bc ls ps mount unshare chroot cp kill diff - head tail sort tr tee cut nm which switch_root}" + head tail sort tr tee cut nm which switch_root mv rm}" KMODS="${KMODS:- dummy}" @@ -22,12 +22,14 @@ LINKS="${LINKS:- ash,dash,bash /init ash,dash,bash /bin/sh}" -DIRS="${DIRS} /tmp /sbin" +DIRS="${DIRS} /tmp /sbin /usr/bin" COPIES="${COPIES} ../passt.avx2,/bin/passt.avx2" FIXUP="${FIXUP}"' -ln -s /bin /usr/bin +mv /bin/* /usr/bin || : +rm -rf /bin +ln -s /usr/bin /bin chmod 777 /tmp sh +m ' -- 2.47.0

3 6

[PATCH v2] tcp: Clarify logic calculating how much guest data to ack
by David Gibson 08 Oct '25

08 Oct '25

This is fairly complex, because we have a method we prefer but we need to fall back to a simpler one in a bunch of cases. Slightly reorganise the code to make the flow clearer, and add a large comment giving the rationale. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 72 ++++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 46 insertions(+), 26 deletions(-) diff --git a/tcp.c b/tcp.c index 91aa3301..0f9e9b3f 100644 --- a/tcp.c +++ b/tcp.c @@ -1014,35 +1014,55 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn, uint32_t new_wnd_to_tap = prev_wnd_to_tap; int s = conn->sock; - if (!bytes_acked_cap) { - conn->seq_ack_to_tap = conn->seq_from_tap; - if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) - conn->seq_ack_to_tap = prev_ack_to_tap; - } else { - if ((unsigned)SNDBUF_GET(conn) < SNDBUF_SMALL || - tcp_rtt_dst_low(conn) || CONN_IS_CLOSING(conn) || - (conn->flags & LOCAL) || force_seq) { - conn->seq_ack_to_tap = conn->seq_from_tap; - } else if (conn->seq_ack_to_tap != conn->seq_from_tap) { - if (!tinfo) { - tinfo = &tinfo_new; - if (getsockopt(s, SOL_TCP, TCP_INFO, tinfo, &sl)) - return 0; - } - - /* This trips a cppcheck bug in some versions, including - * cppcheck 2.18.3. - * https://sourceforge.net/p/cppcheck/discussion/general/thread/fecde59085/ - */ - /* cppcheck-suppress [uninitvar,unmatchedSuppression] */ - conn->seq_ack_to_tap = tinfo->tcpi_bytes_acked + - conn->seq_init_from_tap; - - if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) - conn->seq_ack_to_tap = prev_ack_to_tap; + /* At this point we could ack all the data we've accepted for forwarding + * (seq_from_tap). When possible, however, we want to only acknowledge + * what the peer has acknowledged. This makes it appear to the guest + * more like a direct connection to the peer, and may improve flow + * control behaviour. + * + * For it to be possible and worth it we need: + * - The TCP_INFO Linux extension which gives us the peer acked bytes + * - Not to be told not to (force_seq) + * - Not half-closed in the peer->guest direction + * With no data coming from the peer, we might not get events which + * would prompt us to recheck bytes_acked. We could poll on a + * timer, but that's more trouble than it's worth. + * - Not a host local connection + * Data goes from socket to socket, with nothing meaningfully "in + * flight". + * - Not a pseudo-local connection (e.g. to a VM on the same host) + * - Large enough send buffer + * In these cases, there's not enough in flight to bother. + */ + if (bytes_acked_cap && !force_seq && + !CONN_IS_CLOSING(conn) && + !(conn->flags & LOCAL) && !tcp_rtt_dst_low(conn) && + (unsigned)SNDBUF_GET(conn) >= SNDBUF_SMALL) { + if (!tinfo) { + tinfo = &tinfo_new; + if (getsockopt(s, SOL_TCP, TCP_INFO, tinfo, &sl)) + return 0; } + + /* This trips a cppcheck bug in some versions, including + * cppcheck 2.18.3. + * https://sourceforge.net/p/cppcheck/discussion/general/thread/fecde59085/ + */ + /* cppcheck-suppress [uninitvar,unmatchedSuppression] */ + conn->seq_ack_to_tap = tinfo->tcpi_bytes_acked + + conn->seq_init_from_tap; + } else { + /* Fall back to acknowledging everything we got */ + conn->seq_ack_to_tap = conn->seq_from_tap; } + /* It's occasionally possible for us to go from using the fallback above + * to the tcpi_bytes_acked method. In that case, we must be careful not + * to let our ACKed sequence go backwards. + */ + if (SEQ_LT(conn->seq_ack_to_tap, prev_ack_to_tap)) + conn->seq_ack_to_tap = prev_ack_to_tap; + if (!snd_wnd_cap) { tcp_get_sndbuf(conn); new_wnd_to_tap = MIN(SNDBUF_GET(conn), MAX_WINDOW); -- 2.51.0

2 1

Re: [PATCH] isolation: keep CAP_DAC_OVERRIDE initially
by Stefano Brivio 08 Oct '25

08 Oct '25

On Tue, 7 Oct 2025 12:43:30 -0400 Cole Robinson <crobinso(a)redhat.com> wrote: > On 10/7/25 12:02 PM, Stefano Brivio wrote: > > [Cc: Yumei as this is somewhat related to > > https://archives.passt.top/passt-dev/20250926011714.5978-1-yuhuang@redhat.c…, > > and David as he wrote most of this part] > > > > On Tue, 7 Oct 2025 08:16:39 -0400 > > Cole Robinson <crobinso(a)redhat.com> wrote: > > > >> Reproducer that I'd expect to work > >> > >> $ cd $HOME > >> $ sudo passt --runas $UID --socket foo.sock > >> Failed to bind UNIX domain socket: Permission denied > >> > >> A more practical example is for libguestfs apps when run as user=root. > >> > >> + libguestfs connects to libvirt qemu:///system > >> + libvirt qemu:///system defaults to user=qemu. > >> + chowns passt runtime dir to user=qemu > >> + libguestfs instead requests the VM run as user=root > >> + patches in progress but we are blocked by this issue > >> + passt is launched as root, but can't open socket in passt dir. > >> > >> Obviously libvirt needs improvements too. > >> But it seems like this is a defect as well. > > > > Thanks for the patch! I think it's absolutely unproblematic to keep > > CAP_DAC_OVERRIDE for a moment at the beginning. Did you figure out > > exactly why it's needed by the way? > > > > Last line in the list above should read: > > + passt is launched as root, but can't open socket in passt dir > because it's owned by qemu.qemu ...at this point, can you perhaps come up with a complete commit message also including the details Rich explained / reported? No need to repost. On the other hand it's a single patch so if you have a moment you might as well... > > >> Signed-off-by: Cole Robinson <crobinso(a)redhat.com> > > > > Should we add: > > > > Link: https://github.com/libguestfs/libguestfs/pull/218 > > > > ? Or it's misleading, or you omitted it for any other reason? > > > > Works for me! I did not intentionally omit it > > Thanks, > Cole > -- Stefano

2 2

[PATCH 1/3] test: Prepare for tunbridge based tests
by David Gibson 08 Oct '25

08 Oct '25

I plan to start converting many of our tests to the tunbridge[0] network simulator framework. This is the first step: downloading and setting up tunbridge to work within our test scripts. It also introduces a 'tasst' Python library for code that we might want to reuse across various tunbridge based tests. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/.gitignore | 2 ++ test/Makefile | 19 +++++++++++-------- test/run | 2 +- test/smoke/smoke.py | 26 ++++++++++++++++++++++++++ test/tasst/__init__.py | 10 ++++++++++ 5 files changed, 50 insertions(+), 9 deletions(-) create mode 100755 test/smoke/smoke.py create mode 100644 test/tasst/__init__.py diff --git a/test/.gitignore b/test/.gitignore index 9412f0d3..71409c51 100644 --- a/test/.gitignore +++ b/test/.gitignore @@ -12,4 +12,6 @@ rampstream guest-key guest-key.pub /exeter/ +/tunbridge/ *.bats +__pycache__/ diff --git a/test/Makefile b/test/Makefile index 5b5f0fc1..f66c7e7e 100644 --- a/test/Makefile +++ b/test/Makefile @@ -54,7 +54,7 @@ UBUNTU_NEW_IMGS = xenial-server-cloudimg-powerpc-disk1.img \ jammy-server-cloudimg-s390x.img UBUNTU_IMGS = $(UBUNTU_OLD_IMGS) $(UBUNTU_NEW_IMGS) -DOWNLOAD_ASSETS = $(EXETOOL) mbuto podman \ +DOWNLOAD_ASSETS = $(EXETOOL) tunbridge mbuto podman \ $(DEBIAN_IMGS) $(FEDORA_IMGS) $(OPENSUSE_IMGS) $(UBUNTU_IMGS) TESTDATA_ASSETS = small.bin big.bin medium.bin \ rampstream @@ -65,15 +65,15 @@ LOCAL_ASSETS = mbuto.img mbuto.mem.img podman/bin/podman QEMU_EFI.fd \ ASSETS = $(DOWNLOAD_ASSETS) $(LOCAL_ASSETS) -EXETER_PYPATH = exeter/py3 -EXETER_PYTHON = build/build.py -EXETER_BATS = smoke/smoke.sh.bats \ - $(EXETER_PYTHON:%=%.bats) build/static_checkers.sh.bats +EXETER_SH = smoke/smoke.sh build/static_checkers.sh +EXETER_PYPATH = exeter/py3:tunbridge/:. +EXETER_PYTHON = smoke/smoke.py build/build.py +EXETER_BATS = $(EXETER_SH:%=%.bats) $(EXETER_PYTHON:%=%.bats) BATS_FILES = $(EXETER_BATS) \ podman/test/system/505-networking-pasta.bats # Python test code (for linters) -PYPKGS = $(EXETER_PYTHON) +PYPKGS = $(EXETER_PYTHON) tasst CFLAGS = -Wall -Werror -Wextra -pedantic -std=c99 @@ -88,6 +88,9 @@ exeter: exeter/exetool/exetool: pull-exeter +tunbridge: + git clone https://gitlab.com/dgibson/tunbridge.git + mbuto: git clone git://mbuto.sh/mbuto @@ -139,7 +142,7 @@ flake8: pull-exeter mypy: pull-exeter PYTHONPATH=$(EXETER_PYPATH) $(MYPY) $(PYPKGS) -$(EXETER_BATS): %.bats: % $(EXETOOL) +$(EXETER_BATS): %.bats: % $(EXETOOL) pull-tunbridge PYTHONPATH=$(EXETER_PYPATH) $(EXETOOL) bats -- $< > $@ bats: $(BATS_FILES) pull-podman @@ -153,7 +156,7 @@ debug: assets clean: rm -f perf.js *~ - rm -rf .mypy_cache + rm -rf .mypy_cache __pycache__ rm -f $(LOCAL_ASSETS) rm -f $(EXETER_BATS) rm -rf test_logs diff --git a/test/run b/test/run index f858e558..3872a56e 100755 --- a/test/run +++ b/test/run @@ -44,7 +44,7 @@ KERNEL=${KERNEL:-"/boot/vmlinuz-$(uname -r)"} COMMIT="$(git log --oneline --no-decorate -1)" # Let exeter tests written in Python find their modules -export PYTHONPATH=${BASEPATH}/exeter/py3 +export PYTHONPATH=${BASEPATH}/exeter/py3:${BASEPATH}/tunbridge:${BASEPATH} . lib/util . lib/context diff --git a/test/smoke/smoke.py b/test/smoke/smoke.py new file mode 100755 index 00000000..cbf77ad9 --- /dev/null +++ b/test/smoke/smoke.py @@ -0,0 +1,26 @@ +#! /usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# test/smoke/smoke.py - Python smoke tests +# +# Copyright Red Hat +# Author: David Gibson <david(a)gibson.dropbear.id.au> + +import exeter + + +(a)exeter.test +def py_test_libraries() -> None: + """Check test in Python have access to the libraries we need""" + + import tunbridge + import tasst + + print(f"Imported exeter: {exeter}") + print(f"Imported tunbridge: {tunbridge}") + print(f"Imported tasst: {tasst}") + + +if __name__ == '__main__': + exeter.main() diff --git a/test/tasst/__init__.py b/test/tasst/__init__.py new file mode 100644 index 00000000..fd4fe9a8 --- /dev/null +++ b/test/tasst/__init__.py @@ -0,0 +1,10 @@ +#! /usr/bin/env python3 +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# TASST - Test A Simple Socket Transport +# +# test/tasst/__init.py__ - Python library code useful for test cases +# +# Copyright Red Hat +# Author: David Gibson <david(a)gibson.dropbear.id.au> -- 2.51.0

2 2

[PATCH 0/1] RFC: Clarifying seq_ack_to_tap logic
by David Gibson 08 Oct '25

08 Oct '25

Prompted by the discussion on Stefano's recent TCP fixes, here's change I think clarifies our logic. This goes on top of my linter fixes (specifically the cppcheck suppression in the vicinity) but before Stefano's TCP fixes. Happy to have it folded into those TCP fixes, or reorganised around them. Stefano, please review my large comment. I'm confident on some of the points in there, but not all of them. David Gibson (1): tcp: Clarify logic calculating how much guest data to ack tcp.c | 68 ++++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 42 insertions(+), 26 deletions(-) -- 2.51.0

2 3