April 2025 - dev

[PATCH v2 0/4] Translate source addresses for ICMP errors
by David Gibson 22 Apr '25

22 Apr '25

We now propagate ICMP errors on UDP flows back into ICMP packets on the tap interface. However, we don't always get the source address right for the synthesized message. Because ICMPs can be generated by intermediate routers, that source address might not be one of the endpoints, so the address translation we already have isn't sufficient. Implement properly translating ICMP addresses when we need to. This ended up a bit messier than I hoped, but it seems to work. A simple case to test this is: pasta --config-net --map-host-loopback=172.16.1.1 -- \ sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001" where 10001 is a port where nothing is listening on the host. Without this series, this will just time out. pasta sends an ICMP Port Unreachable message, but it's sent with source address 127.0.0.1 and so discarded by the guest. With this series, the address is properly translated and we correctly get the error from socat: 2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused v2: * Fix a (bogus) coverity warning * Minor cosmetic changes based on Stefano's review David Gibson (4): fwd: Split out helpers for port-independent NAT treewide: Improve robustness against sockaddrs of unexpected family udp: Rework offender address handling in udp_sock_recverr() udp: Translate offender addresses for ICMP messages flow.c | 16 ++++++++-- fwd.c | 87 ++++++++++++++++++++++++++++++++++++++---------------- fwd.h | 3 ++ inany.h | 28 +++++++++++------- tcp.c | 10 +++---- udp.c | 81 ++++++++++++++++++++++++++++++++++++-------------- udp_flow.c | 6 ++-- 7 files changed, 162 insertions(+), 69 deletions(-) -- 2.49.0

2 5

[PATCH v5 00/29] Introduce discontiguous frames management
by Laurent Vivier 17 Apr '25

17 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (29): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool packet: use buf to store iovec array arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 47 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 142 +++++++++++++++++++++++++++++--- iov.h | 59 ++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 13 ++- ndp.h | 4 +- packet.c | 223 ++++++++++++++++++++++++++++++++++++++------------- packet.h | 56 ++++++------- pcap.c | 1 + tap.c | 132 +++++++++++++++++------------- tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 8 +- vu_common.c | 46 ++++------- 26 files changed, 823 insertions(+), 429 deletions(-) -- 2.49.0

1 29

[PATCH 0/4] Translate source addresses for ICMP errors
by David Gibson 17 Apr '25

17 Apr '25

We now propagate ICMP errors on UDP flows back into ICMP packets on the tap interface. However, we don't always get the source address right for the synthesized message. Because ICMPs can be generated by intermediate routers, that source address might not be one of the endpoints, so the address translation we already have isn't sufficient. Implement properly translating ICMP addresses when we need to. This ended up a bit messier than I hoped, but it seems to work. A simple case to test this is: pasta --config-net --map-host-loopback=172.16.1.1 -- \ sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001" where 10001 is a port where nothing is listening on the host. Without this series, this will just time out. pasta sends an ICMP Port Unreachable message, but it's sent with source address 127.0.0.1 and so discarded by the guest. With this series, the address is properly translated and we correctly get the error from socat: 2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused David Gibson (4): fwd: Split out helpers for port-independent NAT treewide: Improve robustness against sockaddrs of unexpected family udp: Rework offender address handling in udp_sock_recverr() udp: Translate offender addresses for ICMP messages flow.c | 16 ++++++++-- fwd.c | 87 ++++++++++++++++++++++++++++++++++++++---------------- fwd.h | 3 ++ inany.h | 22 +++++++++----- tcp.c | 10 +++---- udp.c | 79 +++++++++++++++++++++++++++++++++++-------------- udp_flow.c | 6 ++-- 7 files changed, 157 insertions(+), 66 deletions(-) -- 2.49.0

2 9

[PATCH v4 00/28] Introduce discontiguous frames management
by Laurent Vivier 16 Apr '25

16 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (28): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 47 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 142 +++++++++++++++++++++++++++++--- iov.h | 59 ++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 13 ++- ndp.h | 4 +- packet.c | 88 ++++++++------------ packet.h | 52 ++++++------ pcap.c | 1 + tap.c | 132 +++++++++++++++++------------- tap.h | 5 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 8 +- vu_common.c | 46 ++++------- 26 files changed, 690 insertions(+), 424 deletions(-) -- 2.49.0

1 28

[PATCH v3 00/20] Introduce discontiguous frames management
by Laurent Vivier 16 Apr '25

16 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. Laurent Vivier (20): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp.c | 90 ++++++++++++++------- dhcp.c | 45 ++++++----- dhcpv6.c | 222 ++++++++++++++++++++++++++++++++-------------------- icmp.c | 25 +++--- iov.c | 165 +++++++++++++++++++++++++++++++++++--- iov.h | 61 +++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 7 +- packet.c | 84 ++++++++------------ packet.h | 21 ++--- pcap.c | 1 + tap.c | 88 ++++++++++++++------- tap.h | 3 +- tcp.c | 61 ++++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vu_common.c | 26 ++---- 18 files changed, 634 insertions(+), 331 deletions(-) -- 2.49.0

2 23

[PATCH 0/7] Assorted fixes for UDP socket and error handling problems
by David Gibson 16 Apr '25

16 Apr '25

My recent changes to UDP socket management caused some unfortunate side effects. In particular, it has some bad interactions with UDP error handling. Fix several bugs here, along with some reworks to allow that. David Gibson (7): udp: Fix breakage of UDP error handling by PKTINFO support udp: Be quieter about errors on UDP receive udp: Pass socket & flow information direction to error handling functions udp: Deal with errors as we go in udp_sock_fwd() udp: Add udp_pktinfo() helper udp: Minor re-organisation of udp_sock_recverr() udp: Propagate errors on listening and brand new sockets udp.c | 215 +++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 138 insertions(+), 77 deletions(-) -- 2.49.0

2 12

passt: new version 2025_04_15.2340bbf available
by Stefano Brivio 15 Apr '25

15 Apr '25

The new version with tag 2025_04_15.2340bbf includes the following changes: 2340bbf udp: Propagate errors on listening and brand new sockets cfc0ee1 udp: Minor re-organisation of udp_sock_recverr() f107a86 udp: Add udp_pktinfo() helper 0498457 udp: Deal with errors as we go in udp_sock_fwd() 3f99558 udp: Pass socket & flow information direction to error handling functions 1bb8145 udp: Be quieter about errors on UDP receive baf049f udp: Fix breakage of UDP error handling by PKTINFO support 5024908 conf: Honour --dns-forward for local resolver even with --no-map-gw bbff365 conf: Split add_dns_resolv() into separate IPv4 and IPv6 versions 59cc89f udp, udp_flow: Track our specific address on socket interfaces 695c623 inany: Improve ASSERT message for bad socket family f4b0dd8 udp: Use PKTINFO cmsgs to get destination address for received datagrams 6693fa1 tcp_splice: Don't clobber errno before checking for EAGAIN d3f33f3 tcp_splice: Don't double count bytes read on EINTR ffbef85 conf: Add missing return in conf_nat(), fix --map-guest-addr none 06ef64c udp_flow: Save 8 bytes in struct udp_flow on 64-bit architectures 9725e79 udp_flow: Don't discard packets that arrive between bind() and connect() 9eb5406 udp: Fold udp_splice_prepare and udp_splice_send into udp_sock_to_sock bd6a41e udp: Rework udp_listen_sock_data() into udp_sock_fwd() 159beef udp_flow: Take pif and port as explicit parameters to udp_flow_from_sock() fd844a9 udp: Move UDP_MAX_FRAMES to udp.c fc6ee68 udp: Merge vhost-user and "buf" listening socket paths 0304dd9 udp: Split spliced forwarding path from udp_buf_reply_sock_data() 5221e17 udp: Parameterize number of datagrams handled by udp_*_reply_sock_data() 3a0881d udp: Don't bother to batch datagrams from "listening" socket 84ab130 udp: Polish udp_vu_sock_info() and remove from vu specific code 1d7bbb1 udp: Make udp_sock_recv() take max number of frames as a parameter d74b5a7 udp: Use connect()ed sockets for initiating side a7775e9 udp: support traceroute in direction tap-socket 06784d7 passt-repair: Ensure that read buffer is NULL-terminated 684870a udp: Correct some seccomp filter annotations 76e554d udp: Simplify updates to UDP flow timestamp 8aa2d90 udp: Remove redundant udp_at_sidx() call in udp_tap_handler() 3d41e4d passt-repair: Correct off-by-one error verifying name dec3d73 migrate, tcp: bind() migrated sockets in repair mode 6bfc60b platform requirements: Add test for address conflicts with TCP_REPAIR 8e32881 platform requirements: Add attributes to die() function 2ed2d59 platform requirements: Fix clang-tidy warning 3de5af6 udp: Improve name of UDP related ICMP sending functions 025a3c2 udp: Don't attempt to forward ICMP socket errors to other sockets 42a854a pasta, passt-repair: Support multiple events per read() in inotify handlers 65cca54 udp: correct source address for ICMP messages 664c588 build: normalize arm targets 77883fb udp: Add helper function for creating connected UDP socket 37d78c9 udp: Always hash socket facing flowsides f67c488 udp: Better handling of failure to forward from reply socket 269cf6a udp: Share more logic between vu and non-vu reply socket paths d924b7d udp_vu: Factor things out of udp_vu_reply_sock_data() loop 5a977c2 udp: Simplify checking of epoll event bits 89b203b udp: Common invocation of udp_sock_errs() for vhost-user and "buf" paths cf4d3f0 packet: Upgrade severity of most packet errors 0857515 packet: ASSERT on signs of pool corruption 9153aca util: Add abort_with_msg() and ASSERT_WITH_MSG() helpers 38bcce9 packet: Rework packet_get() versus packet_get_try() 961aa6a packet: Move checks against PACKET_MAX_LEN to packet_check_range() 37d9f37 packet: Avoid integer overflows in packet_get_do() c48331c packet: Correct type of PACKET_MAX_LEN 9866d14 tap: Clarify calculation of TAP_MSGS a41d6d1 tap: Make size of pool_tap[46] purely a tuning parameter e43e007 packet: More cautious checks to avoid pointer arithmetic UB 4592719 vu_common: Tighten vu_packet_check_range() https://passt.top/passt/log/?qt=range&q=2025_03_20.32f6212..2025_04_15.2340… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8907839/ permanent mirror: https://passt.top/builds/copr/0^20250415.g2340bbf/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g2340bbf-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_2340bbf-1_all.deb -- Stefano

1 0

[PATCH] udp: Fix breakage of UDP error handling by PKTINFO support
by David Gibson 15 Apr '25

15 Apr '25

We recently enabled the IP_PKTINFO / IPV6_RECVPKTINFO socket options on our UDP sockets. This lets us obtain and properly handle the specific local address used when we're "listening" with a socket on 0.0.0.0 or ::. However, the PKTINFO cmsgs this option generates appear on error queue messages as well as regular datagrams. udp_sock_recverr() doesn't expect this and so flags an unrecoverable error when it can't parse the control message. Correct this by adding space in udp_sock_recverr()s control buffer for the additional PKTINFO data, and scan through all cmsgs for the RECVERR, rather than only looking at the first one. Link: https://bugs.passt.top/show_bug.cgi?id=99 Fixes: f4b0dd8b06 ("udp: Use PKTINFO cmsgs to get destination address..") Reported-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/udp.c b/udp.c index 40af7dfc..f5fb98c2 100644 --- a/udp.c +++ b/udp.c @@ -155,6 +155,10 @@ __attribute__ ((aligned(32))) #endif udp_meta[UDP_MAX_FRAMES]; +#define PKTINFO_SPACE \ + MAX(CMSG_SPACE(sizeof(struct in_pktinfo)), \ + CMSG_SPACE(sizeof(struct in6_pktinfo))) + /** * enum udp_iov_idx - Indices for the buffers making up a single UDP frame * @UDP_IOV_TAP tap specific header @@ -476,10 +480,10 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) struct sock_extended_err ee; union sockaddr_inany saddr; }; - const struct errhdr *eh; - const struct cmsghdr *hdr; - char buf[CMSG_SPACE(sizeof(struct errhdr))]; + char buf[PKTINFO_SPACE + CMSG_SPACE(sizeof(struct errhdr))]; char data[ICMP6_MAX_DLEN]; + const struct errhdr *eh; + struct cmsghdr *hdr; int s = ref.fd; struct iovec iov = { .iov_base = data, @@ -507,12 +511,16 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) return -1; } - hdr = CMSG_FIRSTHDR(&mh); - if (!((hdr->cmsg_level == IPPROTO_IP && - hdr->cmsg_type == IP_RECVERR) || - (hdr->cmsg_level == IPPROTO_IPV6 && - hdr->cmsg_type == IPV6_RECVERR))) { - err("Unexpected cmsg reading error queue"); + for (hdr = CMSG_FIRSTHDR(&mh); hdr; hdr = CMSG_NXTHDR(&mh, hdr)) { + if ((hdr->cmsg_level == IPPROTO_IP && + hdr->cmsg_type == IP_RECVERR) || + (hdr->cmsg_level == IPPROTO_IPV6 && + hdr->cmsg_type == IPV6_RECVERR)) + break; + } + + if (!hdr) { + err("Missing RECVERR cmsg in error queue"); return -1; } @@ -587,10 +595,6 @@ static int udp_sock_errs(const struct ctx *c, union epoll_ref ref) return n_err; } -#define PKTINFO_SPACE \ - MAX(CMSG_SPACE(sizeof(struct in_pktinfo)), \ - CMSG_SPACE(sizeof(struct in6_pktinfo))) - /** * udp_peek_addr() - Get source address for next packet * @s: Socket to get information from -- 2.49.0

2 3

[PATCH 0/2] Fix --dns-forward with --no-map-gw
by Stefano Brivio 14 Apr '25

14 Apr '25

Patch 2/2 is the actual fix, patch 1/2 makes it less awkward. Stefano Brivio (2): conf: Split add_dns_resolv() into separate IPv4 and IPv6 versions conf: Honour --dns-forward for local resolver even with --no-map-gw conf.c | 115 +++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 74 insertions(+), 41 deletions(-) -- 2.43.0

3 6

[PATCH v2 00/20] Introduce discontiguous frames management
by Laurent Vivier 14 Apr '25

14 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. Laurent Vivier (20): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_drop() and iov_slice() iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_base() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp.c | 90 ++++++++++++++------- dhcp.c | 45 ++++++----- dhcpv6.c | 222 ++++++++++++++++++++++++++++++++-------------------- icmp.c | 32 ++++---- iov.c | 139 +++++++++++++++++++++++++++++--- iov.h | 59 ++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 7 +- packet.c | 84 ++++++++------------ packet.h | 21 ++--- pcap.c | 1 + tap.c | 88 ++++++++++++++------- tap.h | 3 +- tcp.c | 61 ++++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vu_common.c | 26 ++---- 18 files changed, 609 insertions(+), 335 deletions(-) -- 2.49.0

2 31

2025

2024

2023

2022

2021

dev April 2025