September 2025 - dev

[PATCH v11 0/4] Reconstruct incoming ICMP headers for failed UDP connect and forward back
by Jon Maloy 13 Oct '25

13 Oct '25

v2: - Added patch breaking out udp header creation from function tap_udp4_send(). - Updated the ICMP creation by using the new function. - Added logics to find correct flow, depending on origin. - All done after feedback from David Gibson. v3: - More changes after feedback from David Gibson. v4: - Even more changes after feedback from D. Gibson v5: - Added corresponding patches for IPv6 v6: - Fixed some small nits after comments from D. Gibson. v7: - Added handling of all rejected ICMP messages - Returning correct user data amount if IPv6 as per RFC 4884. v8: - Added MTU to ICMPv4 ICMP_FRAG_NEEDED messages. - Added ASSERT() validation to message creation functions. v9: - Using real source address of ICMP to complement destination address for originial UDP message when needed. v10: -Fixed wrong l4len value given to tap_push_ip4h() in function udp_send_conn_fail_icmp4(), patch #2. v11: -Eliminated coverity warnings. -Fixed a couple of tab issues (My emacs settings weren't able to handle my combination of whitespace and tab settings correctly.) Jon Maloy (4): tap: break out building of udp header from tap_udp4_send function udp: create and send ICMPv4 to local peer when applicable tap: break out building of udp header from tap_udp6_send function udp: create and send ICMPv6 to local peer when applicable tap.c | 86 +++++++++++++++++++++++--------- tap.h | 15 ++++++ udp.c | 132 ++++++++++++++++++++++++++++++++++++++++++++----- udp_internal.h | 2 +- udp_vu.c | 4 +- 5 files changed, 200 insertions(+), 39 deletions(-) -- 2.48.1

3 8

[PATCH v2 00/14] Clean up checksum and header generation for inbound packets
by David Gibson 10 Oct '25

10 Oct '25

The main packet "fast paths" for UDP and TCP mostly just forward packets rather than generating them from scratch. However the control paths for ICMP and DHCP sometimes generate packets more or less from scratch. Because these are relatively rare, it's not performance critical. The paths for sending these packets have some duplication of the header generation. There's also some layering violation in tap_ip_send() which both generates IP headers and updates the L4 (UDP or UCMP) checksum. Finally that checksum generation is a little awkward: it temporarily generates the IP pseudo header (or something close enough to serve) in the place of the actual header, generates the checksum, then replaces it with the real IP header. This approach seems to be causing miscompiles with some LTO optimization, because the stores to the pseudo header are being moved or elided across the code calculating the checksum. This series addresses all of these. We consolidate and clarify the packet sending helpers, and use them in some places there was previously duplicated code. In the process we use new checksum generation helpers which take a different approach which should avoid the LTO problems (this aspect I haven't tested yet though). Changes since v1: * Numerous minor style changes * Rename header generation helpers to make their behaviour clearer * Added several missing function doc comments * Corrected some erroneous statements and terms in comments David Gibson (14): Add csum_icmp6() helper for calculating ICMPv6 checksums Add csum_icmp4() helper for calculating ICMP checksums Add csum_udp6() helper for calculating UDP over IPv6 checksums Add csum_udp4() helper for calculating UDP over IPv4 checksums Add csum_ip4_header() helper to calculate IPv4 header checksums Add helpers for normal inbound packet destination addresses Remove support for TCP packets from tap_ip_send() tap: Remove unhelpeful vnet_pre optimization from tap_send() Split tap_ip_send() into IPv4 and IPv6 specific functions tap: Split tap_ip6_send() into UDP and ICMP variants ndp: Remove unneeded eh_source parameter ndp: Use tap_icmp6_send() helper tap: Split tap_ip4_send() into UDP and ICMP variants dhcp: Use tap_udp4_send() helper in dhcp() arp.c | 2 +- checksum.c | 120 ++++++++++++++++----- checksum.h | 15 ++- dhcp.c | 19 +--- dhcpv6.c | 21 +--- icmp.c | 12 +-- ndp.c | 28 +---- ndp.h | 3 +- tap.c | 312 ++++++++++++++++++++++++++++++++++------------------- tap.h | 19 +++- 10 files changed, 345 insertions(+), 206 deletions(-) -- 2.37.3

2 17

[PATCH] test: Update passt.mbuto and passt.mem.mbuto
by Yumei Huang 09 Oct '25

09 Oct '25

If /bin is in the PATH of host, /usr/bin may not exist in mbuto guest, which causes some binaries failing to move to /usr/bin. As a result, tests fail as binaries not found. Fix it by adding /usr/bin to DIRS. Also create the same symlink for mbuto.mem.img. Link: https://bugs.passt.top/show_bug.cgi?id=158 Fixes: f4729be7a56b("test: Update mbuto profile to fix the symlink of /bin") Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/passt.mbuto | 2 +- test/passt.mem.mbuto | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 231b9c9..598c254 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -33,7 +33,7 @@ LINKS="${LINKS:- dhclient /usr/sbin/dhclient sysctl /usr/sbin/sysctl}" -DIRS="${DIRS} /tmp /usr/sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" +DIRS="${DIRS} /tmp /usr/sbin /usr/bin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/.ssh" COPIES="${COPIES} small.bin,/root/small.bin medium.bin,/root/medium.bin big.bin,/root/big.bin rampstream,/bin/rampstream rampstream-check.sh,/bin/rampstream-check.sh" diff --git a/test/passt.mem.mbuto b/test/passt.mem.mbuto index 532eae0..7554a43 100755 --- a/test/passt.mem.mbuto +++ b/test/passt.mem.mbuto @@ -12,7 +12,7 @@ PROGS="${PROGS:-ash,dash,bash chmod ip mount insmod mkdir ln cat chmod modprobe grep mknod sed chown sleep bc ls ps mount unshare chroot cp kill diff - head tail sort tr tee cut nm which switch_root}" + head tail sort tr tee cut nm which switch_root mv rm}" KMODS="${KMODS:- dummy}" @@ -22,12 +22,14 @@ LINKS="${LINKS:- ash,dash,bash /init ash,dash,bash /bin/sh}" -DIRS="${DIRS} /tmp /sbin" +DIRS="${DIRS} /tmp /sbin /usr/bin" COPIES="${COPIES} ../passt.avx2,/bin/passt.avx2" FIXUP="${FIXUP}"' -ln -s /bin /usr/bin +mv /bin/* /usr/bin || : +rm -rf /bin +ln -s /usr/bin /bin chmod 777 /tmp sh +m ' -- 2.47.0

3 6

[PATCH] netlink: Don't require address to be global, just not link local
by David Gibson 01 Oct '25

01 Oct '25

nl_addr_get() will only pick up global IPv6 addresses (RT_SCOPE_UNIVERSE). This is because link-local addresses aren't suitable. However site-local addresses (in the rare occassions they're used) would be fine for our purposes. In fact, anything wider than link scope is fine, so update the check to reflect that. Change the logic in the test scripts to match as well. Reported-by: Xun Gu <xugu(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=122 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 2 +- test/demo/podman | 4 ++-- test/migrate/basic | 2 +- test/migrate/basic_fin | 2 +- test/migrate/iperf3_bidir6 | 2 +- test/migrate/iperf3_in6 | 2 +- test/migrate/iperf3_many_out6 | 2 +- test/migrate/iperf3_out6 | 2 +- test/migrate/rampstream_in | 2 +- test/migrate/rampstream_out | 2 +- test/passt/dhcp | 2 +- test/passt/ndp | 2 +- test/passt_in_ns/dhcp | 2 +- test/pasta/dhcp | 2 +- test/pasta/ndp | 2 +- test/perf/pasta_tcp | 2 +- test/perf/pasta_udp | 2 +- test/two_guests/basic | 2 +- 18 files changed, 19 insertions(+), 19 deletions(-) diff --git a/netlink.c b/netlink.c index c4367807..9fe70f2c 100644 --- a/netlink.c +++ b/netlink.c @@ -786,7 +786,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, prefix_max = *prefix_len = ifa->ifa_prefixlen; } else if (af == AF_INET6 && addr && - ifa->ifa_scope == RT_SCOPE_UNIVERSE && + ifa->ifa_scope < RT_SCOPE_LINK && ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); diff --git a/test/demo/podman b/test/demo/podman index edd403a1..393691ca 100644 --- a/test/demo/podman +++ b/test/demo/podman @@ -310,8 +310,8 @@ nl say Everything is set now, let's start sleep 2 hout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -hout ADDR4 ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' -hout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' +hout ADDR4 ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local' +hout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local' hout GW4 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' hout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/migrate/basic b/test/migrate/basic index 3f11f7d8..c22fee80 100644 --- a/test/migrate/basic +++ b/test/migrate/basic @@ -39,7 +39,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: guest1/guest2 > host diff --git a/test/migrate/basic_fin b/test/migrate/basic_fin index aa61ec5a..c35c2690 100644 --- a/test/migrate/basic_fin +++ b/test/migrate/basic_fin @@ -39,7 +39,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: guest1, half-close, guest2 > host diff --git a/test/migrate/iperf3_bidir6 b/test/migrate/iperf3_bidir6 index 4bfefb58..60b2a9b2 100644 --- a/test/migrate/iperf3_bidir6 +++ b/test/migrate/iperf3_bidir6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 host <-> guest flood, many flows, during migration diff --git a/test/migrate/iperf3_in6 b/test/migrate/iperf3_in6 index 16cf504f..9b7f2c60 100644 --- a/test/migrate/iperf3_in6 +++ b/test/migrate/iperf3_in6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 host to guest throughput during migration diff --git a/test/migrate/iperf3_many_out6 b/test/migrate/iperf3_many_out6 index 88133f26..9b3095f6 100644 --- a/test/migrate/iperf3_many_out6 +++ b/test/migrate/iperf3_many_out6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 guest to host flood, many flows, during migration diff --git a/test/migrate/iperf3_out6 b/test/migrate/iperf3_out6 index 21fbfcd6..b94a70c2 100644 --- a/test/migrate/iperf3_out6 +++ b/test/migrate/iperf3_out6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 guest to host throughput during migration diff --git a/test/migrate/rampstream_in b/test/migrate/rampstream_in index df333ba5..3c7fd200 100644 --- a/test/migrate/rampstream_in +++ b/test/migrate/rampstream_in @@ -40,7 +40,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: sequence check, ramps, inbound diff --git a/test/migrate/rampstream_out b/test/migrate/rampstream_out index 8ed3229b..8cff6d9c 100644 --- a/test/migrate/rampstream_out +++ b/test/migrate/rampstream_out @@ -40,7 +40,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: sequence check, ramps, outbound diff --git a/test/passt/dhcp b/test/passt/dhcp index 145f1baa..dc6b880f 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -61,7 +61,7 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/passt/ndp b/test/passt/ndp index 516cd6b8..df77cdcc 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -25,7 +25,7 @@ check [ -n "__IFNAME__" ] test SLAAC: prefix gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' gout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/passt_in_ns/dhcp b/test/passt_in_ns/dhcp index a38a6908..0ccb4800 100644 --- a/test/passt_in_ns/dhcp +++ b/test/passt_in_ns/dhcp @@ -55,7 +55,7 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/pasta/dhcp b/test/pasta/dhcp index d4f3ad58..e1c66be6 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -39,7 +39,7 @@ ns /sbin/dhclient -6 --no-pid __IFNAME__ ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ __ADDR6__ = __HOST_ADDR6__ ] test DHCPv6: route diff --git a/test/pasta/ndp b/test/pasta/ndp index 952c1eab..e4828765 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -24,7 +24,7 @@ ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select( test SLAAC: prefix nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/perf/pasta_tcp b/test/perf/pasta_tcp index bc0de3c4..496d0fec 100644 --- a/test/perf/pasta_tcp +++ b/test/perf/pasta_tcp @@ -211,7 +211,7 @@ tr TCP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local] | .[0]' bw - bw - bw - diff --git a/test/perf/pasta_udp b/test/perf/pasta_udp index ab2f3e89..3a7054c9 100644 --- a/test/perf/pasta_udp +++ b/test/perf/pasta_udp @@ -196,7 +196,7 @@ tr UDP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local] | .[0]' iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 8G -l 1472 bw __BW__ 0.3 0.5 iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 12G -l 3972 diff --git a/test/two_guests/basic b/test/two_guests/basic index e2338ffd..a9625f3e 100644 --- a/test/two_guests/basic +++ b/test/two_guests/basic @@ -45,7 +45,7 @@ guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; guest2 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' g2out ADDR2_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] check [ "__ADDR2_6__" = "__HOST_ADDR6__" ] -- 2.51.0

2 2

[PATCH v11 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 01 Oct '25

01 Oct '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. v10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) v11: - Corrected the gratuitous ARP implementation to use the "ARP Announcement" model instead of the "Gratuitous ARP reply" model. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 26

[PATCH RFT] tcp: Fix ACK sequence on FIN to tap, handle retransmission in half-closed state
by Stefano Brivio 30 Sep '25

30 Sep '25

If we reach end-of-file on a socket (or get EPOLLRDHUP / EPOLLHUP) and send a FIN segment to the guest / container acknowledging a sequence number that's behind what we received so far, we won't have any further trigger to send an updated ACK segment, as we are now switching the epoll socket monitoring to edge-triggered mode. To avoid this situation, in tcp_update_seqack_wnd(), we set the next acknowledgement sequence to the current observed sequence, regardless of what was acknowledged socket-side. However, we don't necessarily call tcp_update_seqack_wnd() before sending the FIN segment, which might lead to this exchange, where 192.168.10.102 is a HTTP server in a Podman container, and 192.168.10.44 is a client fetching approximately 160 KB of data from it: 82 2.026811 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [FIN, ACK] Seq=121441 Ack=143 Win=65536 Len=0 the server is done sending 83 2.026898 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [ACK] Seq=143 Ack=114394 Win=216192 Len=0 pasta (client) acknowledges a previous sequence 84 2.027324 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [FIN, ACK] Seq=143 Ack=114394 Win=216192 Len=0 pasta (client) sends FIN, ACK as the client has no more data to send (a single GET request), while still acknowledging a previous sequence (because that's what the client acknowledged so far) 85 2.027349 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [ACK] Seq=121442 Ack=144 Win=65536 Len=0 the server acknowledges the FIN, ACK 86 2.224125 192.168.10.102 → 192.168.10.44 4150 TCP [TCP Retransmission] 55414 → 44992 [ACK] Seq=114394 Ack=144 Win=65536 Len=4096 [TCP segment of a reassembled PDU] ...and nothing happens for a while, until, approximately 200ms later, the server concludes that it needs to retransmit some data as it wasn't acknowledged. This is totally unnecessary, so avoid that by setting the ACK sequence to whatever we received from the container / guest, before sending a FIN segment and switching to EPOLLET. Further on: 87 2.224202 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [RST] Seq=144 Win=0 Len=0 as we see the retransmission, we conclude that this was the final ACK and close the connection. But the retransmission should instead tell us that the server is waiting for an ACK segment we never sent. To fix this, revert the TAP_FIN_RCVD event if we get a retransmission, because the peer is rewinding the sequence, which implies that the FIN will be retransmitted as well, eventually. And, until then, we shouldn't handle that side of the connection as closed. We need to process (silently discard) this data, instead. Link: https://github.com/containers/podman/issues/27179 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I couldn't reproduce the original issue, and the excerpts from the capture in the commit message are from the original report. I'm fairly sure that this is correct, but some testing in the problematic case is definitely needed. tcp.c | 4 ++++ tcp_buf.c | 14 +++++++++++++- tcp_vu.c | 7 ++++++- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index 48b1ef2..bfee56b 100644 --- a/tcp.c +++ b/tcp.c @@ -2128,6 +2128,10 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, return 1; } + /* Retransmissions revert any FIN segment (last data segment) */ + if (SEQ_LT(ntohl(th->seq), conn->seq_from_tap)) + conn_event(c, conn, ~TAP_FIN_RCVD); + /* Established connections not accepting data from tap */ if (conn->events & TAP_FIN_RCVD) { bool retr; diff --git a/tcp_buf.c b/tcp_buf.c index a493b5a..cc106bc 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -368,7 +368,19 @@ int tcp_buf_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) conn_flag(c, conn, STALLED); } else if ((conn->events & (SOCK_FIN_RCVD | TAP_FIN_SENT)) == SOCK_FIN_RCVD) { - int ret = tcp_buf_send_flag(c, conn, FIN | ACK); + int ret; + + /* On TAP_FIN_SENT, we won't get further data events + * from the socket, and this might be the last ACK + * segment we send to the tap, so update its sequence to + * include everything we received until now. + * + * See also the special handling on CONN_IS_CLOSING() in + * tcp_update_seqack_wnd(). + */ + conn->seq_ack_to_tap = conn->seq_from_tap; + + ret = tcp_buf_send_flag(c, conn, FIN | ACK); if (ret) { tcp_rst(c, conn); return ret; diff --git a/tcp_vu.c b/tcp_vu.c index ebd3a1e..3ec3538 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -410,7 +410,12 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) conn_flag(c, conn, STALLED); } else if ((conn->events & (SOCK_FIN_RCVD | TAP_FIN_SENT)) == SOCK_FIN_RCVD) { - int ret = tcp_vu_send_flag(c, conn, FIN | ACK); + int ret; + + /* See tcp_buf_data_from_sock() */ + conn->seq_ack_to_tap = conn->seq_from_tap; + + ret = tcp_vu_send_flag(c, conn, FIN | ACK); if (ret) { tcp_rst(c, conn); return ret; -- 2.43.0

1 2

[PATCH v2] test: Fix printf error when debug is enabled
by Yumei Huang 30 Sep '25

30 Sep '25

Running test pasta/tcp with debug enabled would get stuck with below error: + printf 'DEBUG: ns socat -u OPEN:__BASEPATH__/big.bin TCP6:[__GW6__%__IFNAME__]:10003\n' lib/term: line 38: printf: `_': invalid format character The error occurs because printf interprets the % character as the start of a format specifier, and the following '_' isn't one of them. Fix it by replacing 'printf "${*}"' with 'printf "%b" "${*}"'. Also update the docstring. Link: https://bugs.passt.top/show_bug.cgi?id=154 Fixes: de28c20d8051 ("test: Update lib/term for clearer output when DEBUG is enabled") Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/lib/term | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/test/lib/term b/test/lib/term index 6400746..79aa2b7 100755 --- a/test/lib/term +++ b/test/lib/term @@ -29,32 +29,32 @@ PR_NC='\033[0m' PR_DELAY_INIT=100 # ms # info() - Highlight test log pane, print message to it and to log file -# $@: Message to print +# $*: Message to print info() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe - printf "${*}\n" >> "${LOGFILE}" + printf "%b\n" "${*}" >> $STATEBASE/log_pipe + printf "%b\n" "${*}" >> "${LOGFILE}" } # info_n() - Highlight, print message to pane and to log file without newline -# $@: Message to print +# $*: Message to print info_n() { tmux select-pane -t ${PANE_INFO} - printf "${*}" >> $STATEBASE/log_pipe - printf "${*}" >> "${LOGFILE}" + printf "%b" "${*}" >> $STATEBASE/log_pipe + printf "%b" "${*}" >> "${LOGFILE}" } # info_nolog() - Highlight test log pane, print message to it -# $@: Message to print +# $*: Message to print info_nolog() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe + printf "%b\n" "${*}" >> $STATEBASE/log_pipe } # info_nolog() - Print message to log file -# $@: Message to print +# $*: Message to print log() { - printf "${*}\n" >> "${LOGFILE}" + printf "%b\n" "${*}" >> "${LOGFILE}" } # info_nolog_n() - Send message to pane without highlighting it, without newline @@ -363,8 +363,8 @@ status_test_start() { info_check() { switch_pane ${PANE_INFO} - printf "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe - printf "? ${*}" >> "${LOGFILE}" + printf "%b" "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe + printf "? %b" "${*}" >> "${LOGFILE}" } # info_check_passed() - Display and log a new line when a check passes -- 2.47.0

3 2

[PATCH] test: Fix printf error when debug is enabled
by Yumei Huang 30 Sep '25

30 Sep '25

Running test pasta/tcp with debug enabled would get stuck with below error: + printf 'DEBUG: ns socat -u OPEN:__BASEPATH__/big.bin TCP6:[__GW6__%__IFNAME__]:10003\n' lib/term: line 38: printf: `_': invalid format character The error occurs because printf interprets the % character as the start of a format specifier, and the following '_' isn't one of them. Fix it by replacing 'printf "${*}\n"' with 'printf "%s\n" "$*"'. Also update the docstring. Link: https://bugs.passt.top/show_bug.cgi?id=154 Fixes: de28c20d8051 ("test: Update lib/term for clearer output when DEBUG is enabled") Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/lib/term | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/test/lib/term b/test/lib/term index 6400746..2293474 100755 --- a/test/lib/term +++ b/test/lib/term @@ -29,32 +29,32 @@ PR_NC='\033[0m' PR_DELAY_INIT=100 # ms # info() - Highlight test log pane, print message to it and to log file -# $@: Message to print +# $*: Message to print info() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe - printf "${*}\n" >> "${LOGFILE}" + printf "%s\n" "$*" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> "${LOGFILE}" } # info_n() - Highlight, print message to pane and to log file without newline -# $@: Message to print +# $*: Message to print info_n() { tmux select-pane -t ${PANE_INFO} - printf "${*}" >> $STATEBASE/log_pipe - printf "${*}" >> "${LOGFILE}" + printf "%s\n" "$*" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> "${LOGFILE}" } # info_nolog() - Highlight test log pane, print message to it -# $@: Message to print +# $*: Message to print info_nolog() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe + printf "%s\n" "$*" >> $STATEBASE/log_pipe } # info_nolog() - Print message to log file -# $@: Message to print +# $*: Message to print log() { - printf "${*}\n" >> "${LOGFILE}" + printf "%s\n" "$*" >> "${LOGFILE}" } # info_nolog_n() - Send message to pane without highlighting it, without newline @@ -363,8 +363,8 @@ status_test_start() { info_check() { switch_pane ${PANE_INFO} - printf "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe - printf "? ${*}" >> "${LOGFILE}" + printf "%s" "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe + printf "? %s" "${*}" >> "${LOGFILE}" } # info_check_passed() - Display and log a new line when a check passes -- 2.47.0

3 5

[PATCH 0/2] Retry SYNs for inbound connections
by Yumei Huang 30 Sep '25

30 Sep '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism similar to retransmits. Tested two scenarios: 1) A guest is connected in a few seconds, the client connects to the guest successfully. 2) No guest connects at all, the client gets "Connection reset" in 80s. Also ran the testsuits, no regression issue introduced. Yumei Huang (2): tcp: Rename "retrans" of struct tcp_tap_conn and tcp_tap_transfer tcp: Resend SYN for inbound connections tcp.c | 21 ++++++++++++++------- tcp_conn.h | 8 ++++---- 2 files changed, 18 insertions(+), 11 deletions(-) -- 2.47.0

3 8

[PATCH v9 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 30 Sep '25

30 Sep '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 33