June 2026 - dev

[PATCH] test/pasta/ndp: Fix NDP test for --config-net pasta setup
by Jon Maloy 21 Jun '26

21 Jun '26

--config-net sets IPv6 addresses directly via netlink rather than relying on kernel SLAAC, so addresses won't have the "kernel_ra" protocol tag. Match global-scope addresses instead, which works for both --config-net and SLAAC configurations. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/pasta/ndp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/pasta/ndp b/test/pasta/ndp index 1d385c73..7169f57a 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -18,11 +18,11 @@ test Interface name nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' check [ -n "__IFNAME__" ] ns ip link set dev __IFNAME__ up -# Wait for SLAAC & DAD to complete -ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select(.protocol == "kernel_ra")'; do sleep 0.1; done +# Wait for global IPv6 address to appear (via --config-net or SLAAC) +ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info[] | select(.scope == "global")'; do sleep 0.1; done test SLAAC: prefix -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local]| join("/64 ")' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 | tr '\n' ' ' -- 2.52.0

2 1

[PATCH] test/pasta/dhcp: Fix DHCP tests for --config-net pasta setup
by Jon Maloy 21 Jun '26

21 Jun '26

setup_pasta() now passes --config-net, which pre-configures the namespace interface via NDP/SLAAC before dhclient runs. This caused several issues: - dhclient -6 using the host's dhclient-script failed inside user namespaces (NetworkManager hooks, resolv.conf writes), causing infinite SOLICIT/REPLY loops. Add a minimal dhclient-script that applies leases with 'ip addr replace' and exits cleanly. - The DHCPv6 address check filtered for prefixlen == 128, but --config-net already configures the address with /64 via SLAAC, and 'ip -6 addr replace' cannot change the prefix length of an existing address. Match by scope == "global" instead. - Copy dhclient to STATEDIR and use explicit lease files to avoid conflicts with the host's dhclient state. - Quote variable expansions in test comparisons to prevent failures on empty values. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/dhclient-script | 17 +++++++++++++++++ test/pasta/dhcp | 14 ++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) create mode 100755 test/lib/dhclient-script diff --git a/test/lib/dhclient-script b/test/lib/dhclient-script new file mode 100755 index 00000000..c6f4c0fc --- /dev/null +++ b/test/lib/dhclient-script @@ -0,0 +1,17 @@ +#!/bin/sh +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Minimal dhclient-script for pasta tests. The host's dhclient-script +# fails inside user namespaces (NetworkManager hooks, resolv.conf +# writes, etc.), so we use this stripped-down version instead. +# Based on the guest script in test/passt.mbuto. + +[ -n "${new_interface_mtu}" ] && ip link set dev ${interface} mtu ${new_interface_mtu} + +[ -n "${new_ip_address}" ] && ip addr replace ${new_ip_address}/${new_subnet_mask} dev ${interface} +[ -n "${new_routers}" ] && for r in ${new_routers}; do ip route replace default via ${r} dev ${interface}; done + +[ -n "${new_ip6_address}" ] && ip -6 addr replace ${new_ip6_address}/${new_ip6_prefixlen:-128} dev ${interface} nodad + +exit 0 diff --git a/test/pasta/dhcp b/test/pasta/dhcp index 366935ff..5d7e78b6 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -19,30 +19,32 @@ nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifnam check [ -n "__IFNAME__" ] test DHCP: address -ns /sbin/dhclient -4 --no-pid __IFNAME__ +ns cp /sbin/dhclient __STATEDIR__/dhclient +ns __STATEDIR__/dhclient -4 --no-pid -lf __STATEDIR__/dhclient4.leases __IFNAME__ +sleep 1 nsout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' -check [ __ADDR__ = __HOST_ADDR__ ] +check [ "__ADDR__" = "__HOST_ADDR__" ] test DHCP: route nsout GW ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' hout HOST_GW ip -j -4 route show|jq -rM '[.[] | select(.dst == "default").gateway] | .[0]' -check [ __GW__ = __HOST_GW__ ] +check [ "__GW__" = "__HOST_GW__" ] test DHCP: MTU nsout MTU ip -j link show | jq -rM '.[] | select(.ifname == "__IFNAME__").mtu' check [ __MTU__ = 65520 ] test DHCPv6: address -ns /sbin/dhclient -6 --no-pid __IFNAME__ +ns __STATEDIR__/dhclient -6 -sf __BASEPATH__/lib/dhclient-script --no-pid -lf __STATEDIR__/dhclient6.leases __IFNAME__ # Wait for DAD to complete ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' check echo "__HOST_ADDR6__" | grep -wq "__ADDR6__" test DHCPv6: route nsout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' hout HOST_GW6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").gateway] | .[0]' -check [ __GW6__ = __HOST_GW6__ ] +check [ "__GW6__" = "__HOST_GW6__" ] -- 2.52.0

1 0

[PATCH] test/lib: Add --config-net to setup_pasta()
by Jon Maloy 21 Jun '26

21 Jun '26

Since commit b4dace8 ("fwd: Direct inbound spliced forwards to the guest's external address"), inbound splice connections target the guest's external address (addr_seen) rather than loopback. This requires the namespace tap interface to be configured with that address. setup_pasta() starts pasta without --config-net, so the tap interface in the namespace is never brought up and has no addresses or routes. Splice connections to addr_seen fail because the address is unreachable in the namespace, breaking all pasta TCP and UDP tests. Add --config-net to the pasta command line in setup_pasta(), matching what setup_passt_in_ns() and setup_two_guests() already do. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/lib/setup b/test/lib/setup index 59945987..dbf8079d 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -107,7 +107,7 @@ setup_pasta() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 -P ${STATESETUP}/passt.pid $(${NSTOOL} info -pw ${STATESETUP}/ns.hold)" + context_run_bg passt "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 --config-net -P ${STATESETUP}/passt.pid $(${NSTOOL} info -pw ${STATESETUP}/ns.hold)" # pidfile isn't created until pasta is ready wait_for [ -f "${STATESETUP}/passt.pid" ] -- 2.52.0

2 1

[PATCH] test/lib: Pre-create context log files before starting tail
by Jon Maloy 21 Jun '26

21 Jun '26

pane_watch_contexts() starts tail -f --retry on context log files, but those files may not exist yet when tail starts, resulting in error messages in the tmux pane. Pre-create them with touch so tail can open them immediately. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/term | 1 + 1 file changed, 1 insertion(+) diff --git a/test/lib/term b/test/lib/term index 2d2d2182..23639e34 100755 --- a/test/lib/term +++ b/test/lib/term @@ -252,6 +252,7 @@ pane_watch_contexts() { tmux select-pane -t ${__pane_number} -T "${__desc}" __cmd="tail -f --retry" for c; do + touch "${LOGDIR}/context_${c}.log" __cmd="${__cmd} ${LOGDIR}/context_${c}.log" done cmd_write ${__pane_number} "${__cmd}" -- 2.52.0

2 1

[PATCH v7 00/13] Introduce multiple addresses and late binding
by Jon Maloy 20 Jun '26

20 Jun '26

This series adds handling of multiple addresses into a unified address array, so that a guest can see the same addresses on his own interface. o All addresses are stored as union inany_addr o User configured addresses are marked with a USER flag. o Host provided addresses are marked with a HOST flag. o Link local addresses are also marked with a LINKLOCAL flag. o Addresses the guest is actually using are marked with an OBSERVED flag. o Addresses eligible for DHCP assignments are marked with an DHCP flag. o Addresses eligible for DHCPv6 advertisement are marked with an DHCPV6 flag. o Addresses eligible for NDP advertisement are marked with an NDP flag. v2: - Added the earlier standalone CIDR commit to the head of the series. - Replaced the guest namespace interface subscriptions with just an address observation feature, so that it works with both PASTA and PASST. - Unified 'no_copy_addrs' and 'copy_addrs' code paths, as suggested by David G. - Multiple other changes, also based on feedback from David. - Removed the host interface subscription patches, -for now. I intend to re-add them once this series is applied. - Outstanding question: When do we add an IPv4 link local address to the guest? Only in local/opaque mode? Only when explicitly requested? Always? v3: - Unified the IPv4 and IPv6 arrays into one array - Changed prefix_len to always be in IPv6/IpV4 mapped format - Updated migration protocol to v3, handling multiple addresses - Many other smaller changes, based on feedback from the PASST team v4: - Numerous changes based on feedback - Added several new commits, mostly broken out of the pre-existing ones. v5: - Re-introduced multiple OBSERVED addresses. This actually turned out to be cleaner and with more predictable behaviour than allowing only one. - Included the DHCP and NDP patches from previous versions, improved and updated according to feedback from the team. - Likewise re-included the host-side netlink commit to support late binding. v6: - Skipped late binding commit for now. - Added commit for using a single print buffer in conf_print - Added commit for reading and adding all addresses from template interface. - Added commit for refactoring pasta_ns_conf(). - Added separate address flags for DHCP, DHCPv6, and NDP, so that those are easy to recognize for their respective functions. - Split DHCP and DHCPv6 address selection into separate commits. - Updated migration protocol to v3 for multi-address support. - Numerous other smaller changes, both after feedback from David G. and issues I have identified myself. v7: - Replaced commit #1 with one that fixes a return address issue with DHCPv6 - Modified for_each_addr() macro to take 4 arguments - Many more fixes and changes based on feedback and own findings. Jon Maloy (13): dhcpv6: Fix reply destination to match client's source address passt, pasta: Introduce unified multi-address data structures fwd: Unify guest accessibility checks with unified address array arp: Check all configured addresses in ARP filtering conf: Allow multiple -a/--address options per address family netlink, conf: Read all addresses from template interface at startup netlink, pasta: refactor function pasta_ns_conf() conf, pasta: Track observed guest IPv4 addresses in unified address array conf, pasta: Track observed guest IPv6 addresses in unified address array migrate: Update protocol to v3 for multi-address support dhcp: Select address for DHCP distribution dhcpv6: Select addresses for DHCPv6 distribution ndp: Support advertising multiple prefixes in Router Advertisements arp.c | 20 +++- conf.c | 200 ++++++++++++++++++++--------------- dhcp.c | 22 ++-- dhcpv6.c | 115 +++++++++++--------- dhcpv6.h | 2 +- fwd.c | 305 ++++++++++++++++++++++++++++++++++++++++-------------- fwd.h | 8 ++ inany.h | 44 ++++++++ ip.h | 2 + migrate.c | 240 ++++++++++++++++++++++++++++++++++++++++-- ndp.c | 131 ++++++++++++++++------- netlink.c | 70 +++++++------ netlink.h | 7 +- passt.1 | 7 +- passt.h | 78 +++++++++++--- pasta.c | 224 ++++++++++++++++++++------------------- tap.c | 37 ++----- tap.h | 2 - 18 files changed, 1054 insertions(+), 460 deletions(-) -- 2.52.0

3 33

[PATCH v7 02/13] passt, pasta: Introduce unified multi-address data structures
by Jon Maloy 20 Jun '26

20 Jun '26

As preparation for supporting multiple addresses per interface, we replace the single addr/prefix_len fields with an array. The array consists of a new struct inany_addr_entry containing an address and prefix length, both in inany_addr format. Despite a lot of code refactoring, there are only two real functional changes: - The indicated IPv6 prefix length is now properly stored, instead of being ignored and overridden with the hardcoded value 64, as has been the case until now. - Since even IPv4 addresses now are stored in IPv6 format, we also store the corresponding prefix length in that format, i.e. using the range [96,128] instead of [0,32]. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: -Using inany_addr instead of protocol specific addresses as entry address field. v3: -Merging into one array, directly in struct ctx -Changed prefix_len and flags fields in struct inany_addr_entry to uint8_t, since that makes the struct directly migratable v4: -Updated according to changes in previous commits -Updated according to feedback from David G. -Squashed IP4_MASK macro commit into this one v6: -Renamed and moved some definitions -Introduced fwd_set_addr() and fwd_get_addr() already in this commit -Eliminated first_v4/v6() functions, replaced with fwd_get_addr() -Some other changes as suggested by David G. -I kept the flag CONF_ADDR_LINKLOCAL, since it will be needed later in an address selection function. v7: -Introduced CONF_ADDR_GENERATED flag -Other fixes based on feedback from David and Stefano. -I changed signature of inany_prefix_len(), but I did not change its semantics, since the premise of David's comment is wrong: the caller does *not* explicitly know he is dealing with an IPv4 address. In fact, there are examples later in this series where it may be an IPv6 address, and the caller just trusts he gets the return value in the appropriate format. -Introduced the inverse of inany_prefix_len(), called inany_prefix_len6() which always returns the prefix in IPv6 or mapped IPv4 format. The name of the function isn't great, but any alternative I came up with became too long to be practical. --- arp.c | 12 ++++- conf.c | 143 ++++++++++++++++++++++++++++++------------------------- dhcp.c | 14 ++++-- dhcpv6.c | 15 ++++-- fwd.c | 109 ++++++++++++++++++++++++++++++++++-------- fwd.h | 4 ++ inany.h | 41 ++++++++++++++++ ip.h | 2 + ndp.c | 16 +++++-- passt.h | 67 ++++++++++++++++++++++---- pasta.c | 25 ++++++---- tap.c | 7 ++- 12 files changed, 340 insertions(+), 115 deletions(-) diff --git a/arp.c b/arp.c index bb042e9..a7fd82f 100644 --- a/arp.c +++ b/arp.c @@ -41,6 +41,8 @@ static bool ignore_arp(const struct ctx *c, const struct arphdr *ah, const struct arpmsg *am) { + const struct guest_addr *a; + if (ah->ar_hrd != htons(ARPHRD_ETHER) || ah->ar_pro != htons(ETH_P_IP) || ah->ar_hln != ETH_ALEN || @@ -54,7 +56,8 @@ static bool ignore_arp(const struct ctx *c, return true; /* Don't resolve the guest's assigned address, either. */ - if (!memcmp(am->tip, &c->ip4.addr, sizeof(am->tip))) + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a && !memcmp(am->tip, inany_v4(&a->addr), sizeof(am->tip))) return true; return false; @@ -123,12 +126,17 @@ int arp(const struct ctx *c, struct iov_tail *data) */ void arp_send_init_req(const struct ctx *c) { + const struct guest_addr *a; struct { struct ethhdr eh; struct arphdr ah; struct arpmsg am; } __attribute__((__packed__)) req; + a = fwd_get_addr(c, AF_INET, 0, 0); + if (!a) + return; + /* Ethernet header */ req.eh.h_proto = htons(ETH_P_ARP); memcpy(req.eh.h_dest, MAC_BROADCAST, sizeof(req.eh.h_dest)); @@ -145,7 +153,7 @@ void arp_send_init_req(const struct ctx *c) memcpy(req.am.sha, c->our_tap_mac, sizeof(req.am.sha)); memcpy(req.am.sip, &c->ip4.our_tap_addr, sizeof(req.am.sip)); memcpy(req.am.tha, MAC_BROADCAST, sizeof(req.am.tha)); - memcpy(req.am.tip, &c->ip4.addr, sizeof(req.am.tip)); + memcpy(req.am.tip, inany_v4(&a->addr), sizeof(req.am.tip)); debug("Sending initial ARP request for guest MAC address"); tap_send_single(c, &req, sizeof(req)); diff --git a/conf.c b/conf.c index f13fef6..591f561 100644 --- a/conf.c +++ b/conf.c @@ -728,13 +728,15 @@ static int conf_ip4_prefix(const char *arg) /** * conf_ip4() - Verify or detect IPv4 support, get relevant addresses + * @c: Execution context * @ifi: Host interface to attempt (0 to determine one) - * @ip4: IPv4 context (will be written) * * Return: interface index for IPv4, or 0 on failure. */ -static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) +static unsigned int conf_ip4(struct ctx *c, unsigned int ifi) { + struct ip4_ctx *ip4 = &c->ip4; + if (!ifi) ifi = nl_get_ext_if(nl_sock, AF_INET); @@ -753,60 +755,57 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) } } - if (IN4_IS_ADDR_UNSPECIFIED(&ip4->addr)) { + if (!fwd_get_addr(c, AF_INET, 0, 0)) { + struct in_addr addr; + int prefix_len; int rc = nl_addr_get(nl_sock, ifi, AF_INET, - &ip4->addr, &ip4->prefix_len, NULL); + &addr, &prefix_len, NULL); if (rc < 0) { debug("Couldn't discover IPv4 address: %s", strerror_(-rc)); return 0; } - } + if (IN4_IS_ADDR_UNSPECIFIED(&addr)) + return 0; - if (!ip4->prefix_len) { - in_addr_t addr = ntohl(ip4->addr.s_addr); - if (IN_CLASSA(addr)) - ip4->prefix_len = (32 - IN_CLASSA_NSHIFT); - else if (IN_CLASSB(addr)) - ip4->prefix_len = (32 - IN_CLASSB_NSHIFT); - else if (IN_CLASSC(addr)) - ip4->prefix_len = (32 - IN_CLASSC_NSHIFT); - else - ip4->prefix_len = 32; + fwd_set_addr(c, &inany_from_v4(addr), CONF_ADDR_HOST, + prefix_len); + ip4->addr_seen = addr; } - ip4->addr_seen = ip4->addr; - ip4->our_tap_addr = ip4->guest_gw; - if (IN4_IS_ADDR_UNSPECIFIED(&ip4->addr)) - return 0; - return ifi; } /** * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode - * @ip4: IPv4 context (will be written) + * @c: Execution context (will be written) */ -static void conf_ip4_local(struct ip4_ctx *ip4) +static void conf_ip4_local(struct ctx *c) { - ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; - ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; - ip4->prefix_len = IP4_LL_PREFIX_LEN; + struct ip4_ctx *ip4 = &c->ip4; + ip4->addr_seen = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; ip4->no_copy_addrs = ip4->no_copy_routes = true; + fwd_set_addr(c, &inany_from_v4(IP4_LL_GUEST_ADDR), + CONF_ADDR_GENERATED | CONF_ADDR_LINKLOCAL, + IP4_LL_PREFIX_LEN); } /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses + * @c: Execution context * @ifi: Host interface to attempt (0 to determine one) - * @ip6: IPv6 context (will be written) * * Return: interface index for IPv6, or 0 on failure. */ -static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) +static unsigned int conf_ip6(struct ctx *c, unsigned int ifi) { + struct ip6_ctx *ip6 = &c->ip6; + const struct guest_addr *a; + union inany_addr addr; int prefix_len = 0; int rc; @@ -827,21 +826,28 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) } } - rc = nl_addr_get(nl_sock, ifi, AF_INET6, - IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, + rc = nl_addr_get(nl_sock, ifi, AF_INET6, &addr.a6, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { debug("Couldn't discover IPv6 address: %s", strerror_(-rc)); return 0; } - ip6->addr_seen = ip6->addr; + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (!a) { + if (IN6_IS_ADDR_UNSPECIFIED(&addr)) + return 0; + + fwd_set_addr(c, &addr, CONF_ADDR_HOST, prefix_len); + ip6->addr_seen = addr.a6; + } else { + ip6->addr_seen = a->addr.a6; + } if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw)) ip6->our_tap_ll = ip6->guest_gw; - if (IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->our_tap_ll)) + if (IN6_IS_ADDR_UNSPECIFIED(&ip6->our_tap_ll)) return 0; return ifi; @@ -849,13 +855,13 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) /** * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode - * @ip6: IPv6 context (will be written) + * @c: Execution context (will be written) */ -static void conf_ip6_local(struct ip6_ctx *ip6) +static void conf_ip6_local(struct ctx *c) { - ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + c->ip6.our_tap_ll = c->ip6.guest_gw = IP6_LL_GUEST_GW; - ip6->no_copy_addrs = ip6->no_copy_routes = true; + c->ip6.no_copy_addrs = c->ip6.no_copy_routes = true; } /** @@ -1137,6 +1143,7 @@ enum passt_modes conf_mode(int argc, char *argv[]) static void conf_print(const struct ctx *c) { char buf[INANY_ADDRSTRLEN]; + const struct guest_addr *a; int i; if (c->ifi4 > 0 || c->ifi6 > 0) { @@ -1181,16 +1188,18 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET, &c->ip4.map_host_loopback, buf, sizeof(buf))); - if (!c->no_dhcp) { + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a && !c->no_dhcp) { uint32_t mask; - mask = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + mask = IN4_MASK(inany_prefix_len(&a->addr, + a->prefix_len)); info("DHCP:"); info(" assign: %s", - inet_ntop(AF_INET, &c->ip4.addr, buf, sizeof(buf))); + inany_ntop(&a->addr, buf, sizeof(buf))); info(" mask: %s", - inet_ntop(AF_INET, &mask, buf, sizeof(buf))); + inet_ntop(AF_INET, &mask, buf, sizeof(buf))); info(" router: %s", inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf))); @@ -1201,8 +1210,8 @@ static void conf_print(const struct ctx *c) break; if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns[i], buf, sizeof(buf)); - info(" %s", buf); + info(" %s", inet_ntop(AF_INET, &c->ip4.dns[i], + buf, sizeof(buf))); } for (i = 0; *c->dns_search[i].n; i++) { @@ -1227,13 +1236,14 @@ static void conf_print(const struct ctx *c) else goto dns6; - info(" assign: %s", - inet_ntop(AF_INET6, &c->ip6.addr, buf, sizeof(buf))); + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + if (a) + info(" assign: %s", + inany_ntop(&a->addr, buf, sizeof(buf))); info(" router: %s", inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf))); info(" our link-local: %s", - inet_ntop(AF_INET6, &c->ip6.our_tap_ll, - buf, sizeof(buf))); + inet_ntop(AF_INET6, &c->ip6.our_tap_ll, buf, sizeof(buf))); dns6: for (i = 0; i < ARRAY_SIZE(c->ip6.dns); i++) { @@ -1241,8 +1251,10 @@ dns6: break; if (!i) info("DNS:"); - inet_ntop(AF_INET6, &c->ip6.dns[i], buf, sizeof(buf)); - info(" %s", buf); + info(" %s", + inet_ntop(AF_INET6, &c->ip6.dns[i], + buf, sizeof(buf))); + } for (i = 0; *c->dns_search[i].n; i++) { @@ -1886,19 +1898,16 @@ void conf(struct ctx *c, int argc, char **argv) IN6_IS_ADDR_V4COMPAT(&addr.a6)) die("Invalid address: %s", optarg); - if (inany_v4(&addr)) { - c->ip4.addr = *inany_v4(&addr); - c->ip4.prefix_len = prefix_len - 96; - if (c->mode == MODE_PASTA) - c->ip4.no_copy_addrs = true; - } else { - c->ip6.addr = addr.a6; - if (c->mode == MODE_PASTA) - c->ip6.no_copy_addrs = true; - } + /* Legacy behaviour: replace existing address if any */ + fwd_set_addr(c, &addr, CONF_ADDR_USER, prefix_len); + if (inany_v4(&addr)) + c->ip4.no_copy_addrs = true; + else + c->ip6.no_copy_addrs = true; break; } case 'n': { + struct guest_addr *a; int plen; if (addr_has_prefix_len) @@ -1908,8 +1917,12 @@ void conf(struct ctx *c, int argc, char **argv) if (plen < 0) die("Invalid prefix length: %s", optarg); - prefix_len_from_opt = plen + 96; - c->ip4.prefix_len = plen; + prefix_len_from_opt = plen; + + for_each_addr(a, c->addrs, c->addr_count, AF_INET) { + a->prefix_len = inany_prefix_len(&a->addr, plen); + break; + } break; } case 'M': @@ -2103,9 +2116,9 @@ void conf(struct ctx *c, int argc, char **argv) nl_sock_init(c, false); if (!v6_only && !c->splice_only) - c->ifi4 = conf_ip4(ifi4, &c->ip4); + c->ifi4 = conf_ip4(c, ifi4); if (!v4_only && !c->splice_only) - c->ifi6 = conf_ip6(ifi6, &c->ip6); + c->ifi6 = conf_ip6(c, ifi6); if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { warn("MTU %"PRIu16" is too small for IPv4 (minimum %u)", @@ -2128,7 +2141,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi4 && !v6_only) { if (!c->splice_only) { info("IPv4: no external interface as template, use local mode"); - conf_ip4_local(&c->ip4); + conf_ip4_local(c); } c->ifi4 = -1; } @@ -2136,7 +2149,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6 && !v4_only) { if (!c->splice_only) { info("IPv6: no external interface as template, use local mode"); - conf_ip6_local(&c->ip6); + conf_ip6_local(c); } c->ifi6 = -1; } @@ -2201,7 +2214,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; - } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + } else if (!fwd_get_addr(c, AF_INET6, 0, 0)) { c->no_dhcpv6 = 1; } diff --git a/dhcp.c b/dhcp.c index 1ff8cba..f0fa212 100644 --- a/dhcp.c +++ b/dhcp.c @@ -303,6 +303,7 @@ static void opt_set_dns_search(const struct ctx *c, size_t max_len) int dhcp(const struct ctx *c, struct iov_tail *data) { char macstr[ETH_ADDRSTRLEN]; + const struct guest_addr *a; size_t mlen, dlen, opt_len; struct in_addr mask, dst; struct ethhdr eh_storage; @@ -313,6 +314,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) const struct udphdr *uh; struct msg m_storage; struct msg const *m; + struct in_addr addr; struct msg reply; unsigned int i; @@ -344,6 +346,10 @@ int dhcp(const struct ctx *c, struct iov_tail *data) m->op != BOOTREQUEST) return -1; + a = fwd_get_addr(c, AF_INET, 0, 0); + assert(a); + addr = *inany_v4(&a->addr); + reply.op = BOOTREPLY; reply.htype = m->htype; reply.hlen = m->hlen; @@ -352,7 +358,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) reply.secs = 0; reply.flags = m->flags; reply.ciaddr = m->ciaddr; - reply.yiaddr = c->ip4.addr; + reply.yiaddr = addr; reply.siaddr = 0; reply.giaddr = m->giaddr; memcpy(&reply.chaddr, m->chaddr, sizeof(reply.chaddr)); @@ -404,7 +410,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) info(" from %s", eth_ntop(m->chaddr, macstr, sizeof(macstr))); - mask.s_addr = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + mask.s_addr = IN4_MASK(inany_prefix_len(&a->addr, a->prefix_len)); memcpy(opts[1].s, &mask, sizeof(mask)); memcpy(opts[3].s, &c->ip4.guest_gw, sizeof(c->ip4.guest_gw)); memcpy(opts[54].s, &c->ip4.our_tap_addr, sizeof(c->ip4.our_tap_addr)); @@ -412,7 +418,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) /* If the gateway is not on the assigned subnet, send an option 121 * (Classless Static Routing) adding a dummy route to it. */ - if ((c->ip4.addr.s_addr & mask.s_addr) + if ((addr.s_addr & mask.s_addr) != (c->ip4.guest_gw.s_addr & mask.s_addr)) { /* a.b.c.d/32:0.0.0.0, 0:a.b.c.d */ opts[121].slen = 14; @@ -471,7 +477,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) if (m->flags & FLAG_BROADCAST) dst = in4addr_broadcast; else - dst = c->ip4.addr; + dst = addr; tap_udp4_send(c, c->ip4.our_tap_addr, 67, dst, 68, &reply, dlen); diff --git a/dhcpv6.c b/dhcpv6.c index 2db0944..0a064a9 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -318,7 +318,7 @@ static bool dhcpv6_opt(struct iov_tail *data, uint16_t type) * false otherwise and @data is unmodified */ static bool dhcpv6_ia_notonlink(struct iov_tail *data, - struct in6_addr *la) + const struct in6_addr *la) { int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }; struct opt_ia_addr opt_addr_storage; @@ -567,6 +567,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, struct opt_hdr client_id_storage; /* cppcheck-suppress [variableScope,unmatchedSuppression] */ struct opt_ia_na ia_storage; + const struct guest_addr *a; const struct in6_addr *src; struct msg_hdr mh_storage; const struct msg_hdr *mh; @@ -574,6 +575,8 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, const struct udphdr *uh; size_t mlen, n; + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + uh = IOV_REMOVE_HEADER(data, uh_storage); if (!uh) return -1; @@ -627,7 +630,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mh->type == TYPE_CONFIRM && server_id) return -1; - if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { + if (a && dhcpv6_ia_notonlink(data, &a->addr.a6)) { dhcpv6_send_ia_notonlink(c, saddr, data, &client_id_base, ntohs(client_id->l), mh->xid); @@ -680,7 +683,8 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); - c->ip6.addr_seen = c->ip6.addr; + if (a) + c->ip6.addr_seen = a->addr.a6; return 1; } @@ -691,6 +695,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, */ void dhcpv6_init(const struct ctx *c) { + const struct guest_addr *a; time_t y2k = 946684800; /* Epoch to 2000-01-01T00:00:00Z, no mktime() */ uint32_t duid_time; @@ -704,5 +709,7 @@ void dhcpv6_init(const struct ctx *c) memcpy(resp_not_on_link.server_id.duid_lladdr, c->our_tap_mac, sizeof(c->our_tap_mac)); - resp.ia_addr.addr = c->ip6.addr; + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + if (a) + resp.ia_addr.addr = a->addr.a6; } diff --git a/fwd.c b/fwd.c index bedbf98..14ce0a7 100644 --- a/fwd.c +++ b/fwd.c @@ -249,6 +249,61 @@ void fwd_neigh_table_init(const struct ctx *c) fwd_neigh_table_update(c, &mga, c->our_tap_mac, true); } +/** + * fwd_set_addr() - Add or update an address in the unified address array + * @c: Execution context + * @addr: Address to add (IPv4-mapped or IPv6) + * @flags: CONF_ADDR_* flags for this address + * @prefix_len: Prefix length in IPv6 or IPv4 format + * + * Find the first existing entry of the same address family and + * overwrite it, or create a new one if none exists + */ +void fwd_set_addr(struct ctx *c, const union inany_addr *addr, + uint8_t flags, int prefix_len) +{ + struct guest_addr *a; + + for_each_addr(a, c->addrs, c->addr_count, inany_af(addr)) { + goto found; + } + + if (c->addr_count >= MAX_GUEST_ADDRS) + return; + + a = &c->addrs[c->addr_count++]; + +found: + a->addr = *addr; + a->prefix_len = inany_prefix_len6(addr, prefix_len); + a->flags = flags; +} + +/** + * fwd_get_addr() - Get guest address entry matching criteria + * @c: Execution context + * @af: Address family (AF_INET, AF_INET6, or 0 for any) + * @incl: Flags that must be present (any-match) + * @excl: Flags that must not be present + * + * Return: first address entry matching criteria, or NULL + */ +const struct guest_addr *fwd_get_addr(const struct ctx *c, sa_family_t af, + uint8_t incl, uint8_t excl) +{ + const struct guest_addr *a; + + for_each_addr(a, c->addrs, c->addr_count, af) { + if (incl && !(a->flags & incl)) + continue; + if (a->flags & excl) + continue; + return a; + } + + return NULL; +} + /** fwd_probe_ephemeral() - Determine what ports this host considers ephemeral * * Work out what ports the host thinks are emphemeral and record it for later @@ -941,8 +996,10 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini) * translation, false otherwise */ static bool fwd_guest_accessible4(const struct ctx *c, - const struct in_addr *addr) + const struct in_addr *addr) { + const struct guest_addr *a; + if (IN4_IS_ADDR_LOOPBACK(addr)) return false; @@ -957,7 +1014,8 @@ static bool fwd_guest_accessible4(const struct ctx *c, /* For IPv4, addr_seen is initialised to addr, so is always a valid * address */ - if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr) || + a = fwd_get_addr(c, AF_INET, 0, 0); + if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) || IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) return false; @@ -975,10 +1033,13 @@ static bool fwd_guest_accessible4(const struct ctx *c, static bool fwd_guest_accessible6(const struct ctx *c, const struct in6_addr *addr) { + const struct guest_addr *a; + if (IN6_IS_ADDR_LOOPBACK(addr)) return false; - if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr)) + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6)) return false; /* For IPv6, addr_seen starts unspecified, because we don't know what LL @@ -1023,16 +1084,21 @@ static bool fwd_guest_accessible(const struct ctx *c, static void nat_outbound(const struct ctx *c, const union inany_addr *addr, union inany_addr *translated) { - if (inany_equals4(addr, &c->ip4.map_host_loopback)) + const struct guest_addr *ga; + + if (inany_equals4(addr, &c->ip4.map_host_loopback)) { *translated = inany_loopback4; - else if (inany_equals6(addr, &c->ip6.map_host_loopback)) + } else if (inany_equals6(addr, &c->ip6.map_host_loopback)) { *translated = inany_loopback6; - else if (inany_equals4(addr, &c->ip4.map_guest_addr)) - *translated = inany_from_v4(c->ip4.addr); - else if (inany_equals6(addr, &c->ip6.map_guest_addr)) - translated->a6 = c->ip6.addr; - else + } else if (inany_equals4(addr, &c->ip4.map_guest_addr)) { + ga = fwd_get_addr(c, AF_INET, 0, 0); + *translated = ga ? ga->addr : inany_any4; + } else if (inany_equals6(addr, &c->ip6.map_guest_addr)) { + ga = fwd_get_addr(c, AF_INET6, 0, 0); + translated->a6 = ga ? ga->addr.a6 : in6addr_any; + } else { *translated = *addr; + } } /** @@ -1137,16 +1203,21 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback) && inany_equals6(addr, &in6addr_loopback)) { translated->a6 = c->ip6.map_host_loopback; - } else if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_guest_addr) && - inany_equals4(addr, &c->ip4.addr)) { - *translated = inany_from_v4(c->ip4.map_guest_addr); - } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && - inany_equals6(addr, &c->ip6.addr)) { - translated->a6 = c->ip6.map_guest_addr; - } else if (fwd_guest_accessible(c, addr)) { - *translated = *addr; } else { - return false; + const struct guest_addr *ga4 = fwd_get_addr(c, AF_INET, 0, 0); + const struct guest_addr *ga6 = fwd_get_addr(c, AF_INET6, 0, 0); + + if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_guest_addr) && + ga4 && inany_equals(addr, &ga4->addr)) { + *translated = inany_from_v4(c->ip4.map_guest_addr); + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && + ga6 && inany_equals(addr, &ga6->addr)) { + translated->a6 = c->ip6.map_guest_addr; + } else if (fwd_guest_accessible(c, addr)) { + *translated = *addr; + } else { + return false; + } } return true; diff --git a/fwd.h b/fwd.h index 958eee2..c5a1068 100644 --- a/fwd.h +++ b/fwd.h @@ -23,6 +23,8 @@ struct flowside; void fwd_probe_ephemeral(void); bool fwd_port_is_ephemeral(in_port_t port); +const struct guest_addr *fwd_get_addr(const struct ctx *c, sa_family_t af, + uint8_t incl, uint8_t excl); /** * struct fwd_rule - Forwarding rule governing a range of ports @@ -141,5 +143,7 @@ void fwd_neigh_table_free(const struct ctx *c, void fwd_neigh_mac_get(const struct ctx *c, const union inany_addr *addr, uint8_t *mac); void fwd_neigh_table_init(const struct ctx *c); +void fwd_set_addr(struct ctx *c, const union inany_addr *addr, + uint8_t flags, int prefix_len); #endif /* FWD_H */ diff --git a/inany.h b/inany.h index 9891ed6..0450c45 100644 --- a/inany.h +++ b/inany.h @@ -102,6 +102,16 @@ static inline struct in_addr *inany_v4(const union inany_addr *addr) return (struct in_addr *)&addr->v4mapped.a4; } +/** inany_af - Get address family of IPv[46] address + * @addr: IPv4 or IPv6 address + * + * Return: AF_INET for IPv4, AF_INET6 for IPv6 + */ +static inline sa_family_t inany_af(const union inany_addr *addr) +{ + return inany_v4(addr) ? AF_INET : AF_INET6; +} + /** inany_default_prefix_len() - Get default prefix length for address * @addr: IPv4 or iPv6 address * @@ -115,6 +125,37 @@ static inline int inany_default_prefix_len(const union inany_addr *addr) return v4 ? ip4_class_prefix_len(v4) + 96 : 64; } + +/** inany_prefix_len() - Convert prefix length to native format + * @addr: IPv4 or IPv6 address + * @prefix_len: prefix length (any format, auto-detected) + * + * Return: prefix length in native format (0-32 for IPv4, 0-128 for IPv6) + */ +static inline int inany_prefix_len(const union inany_addr *addr, + int prefix_len) +{ + if (inany_v4(addr) && prefix_len >= 96) + return prefix_len - 96; + + return prefix_len; +} + +/** inany_prefix_len6() - Convert prefix length to generic format + * @addr: IPv4 or IPv6 address + * @prefix_len: prefix length (any format, auto-detected) + * + * Return: prefix length in generic format (96-128 for IPv4, 0-128 for IPv6) + */ +static inline int inany_prefix_len6(const union inany_addr *addr, + int prefix_len) +{ + if (inany_v4(addr) && prefix_len && prefix_len <= 32) + return prefix_len + 96; + + return prefix_len; +} + /** inany_equals - Compare two IPv[46] addresses * @a, @b: IPv[46] addresses * diff --git a/ip.h b/ip.h index d0de6c8..933d98c 100644 --- a/ip.h +++ b/ip.h @@ -19,6 +19,8 @@ (ntohl(((struct in_addr *)(a))->s_addr) >> IN_CLASSA_NSHIFT == IN_LOOPBACKNET) #define IN4_IS_ADDR_MULTICAST(a) \ (IN_MULTICAST(ntohl(((struct in_addr *)(a))->s_addr))) +#define IN4_MASK(prefix) \ + ((prefix) <= 0 ? 0 : htonl(0xffffffff << (32 - (prefix)))) #define IN4_ARE_ADDR_EQUAL(a, b) \ (((struct in_addr *)(a))->s_addr == ((struct in_addr *)b)->s_addr) #define IN4ADDR_LOOPBACK_INIT \ diff --git a/ndp.c b/ndp.c index 1f2bcb0..3750fc5 100644 --- a/ndp.c +++ b/ndp.c @@ -257,7 +257,6 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) .valid_lifetime = ~0U, .pref_lifetime = ~0U, }, - .prefix = c->ip6.addr, .source_ll = { .header = { .type = OPT_SRC_L2_ADDR, @@ -265,8 +264,13 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) }, }, }; + const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0); unsigned char *ptr = NULL; + ASSERT(a); + + ra.prefix = a->addr.a6; + ptr = &ra.var[0]; if (c->mtu) { @@ -460,6 +464,7 @@ first: */ void ndp_send_init_req(const struct ctx *c) { + const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0); struct ndp_ns ns = { .ih = { .icmp6_type = NS, @@ -468,8 +473,13 @@ void ndp_send_init_req(const struct ctx *c) .icmp6_solicited = 0, /* Reserved */ .icmp6_override = 0, /* Reserved */ }, - .target_addr = c->ip6.addr + .target_addr = IN6ADDR_ANY_INIT }; + + if (!a) + return; + + ns.target_addr = a->addr.a6; debug("Sending initial NDP NS request for guest MAC address"); - ndp_send(c, &c->ip6.addr, &ns, sizeof(ns)); + ndp_send(c, &a->addr.a6, &ns, sizeof(ns)); } diff --git a/passt.h b/passt.h index b614bdf..f75656d 100644 --- a/passt.h +++ b/passt.h @@ -64,11 +64,28 @@ enum passt_modes { MODE_VU, }; +/* Maximum number of addresses in context address array */ +#define MAX_GUEST_ADDRS 32 + +/** + * struct guest_addr - Unified IPv4/IPv6 address entry + * @addr: IPv4 (as mapped) or IPv6 address + * @prefix_len: Prefix length in IPv6/IPv4-mapped [0,128]/[96,128] format + * @flags: CONF_ADDR_* flags + */ +struct guest_addr { + union inany_addr addr; + uint8_t prefix_len; + uint8_t flags; +#define CONF_ADDR_USER BIT(0) /* User set via -a */ +#define CONF_ADDR_HOST BIT(1) /* From host interface */ +#define CONF_ADDR_GENERATED BIT(2) /* Generated by PASST/PASTA */ +#define CONF_ADDR_LINKLOCAL BIT(3) /* Link-local address */ +}; + /** * struct ip4_ctx - IPv4 execution context - * @addr: IPv4 address assigned to guest * @addr_seen: Latest IPv4 address seen as source from tap - * @prefixlen: IPv4 prefix length (netmask) * @guest_gw: IPv4 gateway as seen by the guest * @map_host_loopback: Outbound connections to this address are NATted to the * host's 127.0.0.1 @@ -84,10 +101,7 @@ enum passt_modes { * @no_copy_addrs: Don't copy all addresses when configuring namespace */ struct ip4_ctx { - /* PIF_TAP addresses */ - struct in_addr addr; struct in_addr addr_seen; - int prefix_len; struct in_addr guest_gw; struct in_addr map_host_loopback; struct in_addr map_guest_addr; @@ -107,7 +121,6 @@ struct ip4_ctx { /** * struct ip6_ctx - IPv6 execution context - * @addr: IPv6 address assigned to guest * @addr_seen: Latest IPv6 global/site address seen as source from tap * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap * @guest_gw: IPv6 gateway as seen by the guest @@ -125,8 +138,6 @@ struct ip4_ctx { * @no_copy_addrs: Don't copy all addresses when configuring namespace */ struct ip6_ctx { - /* PIF_TAP addresses */ - struct in6_addr addr; struct in6_addr addr_seen; struct in6_addr addr_ll_seen; struct in6_addr guest_gw; @@ -181,6 +192,8 @@ struct ip6_ctx { * @fqdn: Guest FQDN * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration + * @addrs: Unified address array for both IPv4 (mapped) and IPv6 + * @addr_count: Number of active entries in @addrs array * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it @@ -260,6 +273,9 @@ struct ctx { int ifi6; struct ip6_ctx ip6; + struct guest_addr addrs[MAX_GUEST_ADDRS]; + int addr_count; + char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; @@ -301,6 +317,41 @@ struct ctx { bool migrate_exit; }; +/** + * next_addr_idx_() - Find next address index matching family filter + * @addrs: Array of guest addresses + * @count: Number of addresses in array + * @i: Starting index + * @af: Address family filter: AF_INET, AF_INET6, or 0 for all + * + * Return: next matching index, or count if none found + */ +static inline int next_addr_idx_(const struct guest_addr *addrs, int count, + int i, sa_family_t af) +{ + for (; i < count; i++) { + sa_family_t entry_af; + + entry_af = inany_v4(&addrs[i].addr) ? AF_INET : AF_INET6; + + if (af == AF_UNSPEC || af == entry_af) + return i; + } + return i; +} + +/** + * for_each_addr() - Iterate over addresses in array + * @a: Pointer variable for current entry (struct guest_addr *) + * @addrs: Array of guest addresses (e.g., c->addrs) + * @count: Number of addresses (e.g., c->addr_count) + * @af: Address family filter: AF_INET, AF_INET6, or 0 for all + */ +#define for_each_addr(a, addrs, count, af) \ + for (int i_ = next_addr_idx_((addrs), (count), 0, (af)); \ + i_ < (count) && ((a) = &(addrs)[i_], true); \ + i_ = next_addr_idx_((addrs), (count), i_ + 1, (af))) + void proto_update_l2_buf(const unsigned char *eth_d); #endif /* PASST_H */ diff --git a/pasta.c b/pasta.c index bab945f..c51e4cd 100644 --- a/pasta.c +++ b/pasta.c @@ -330,6 +330,8 @@ void pasta_ns_conf(struct ctx *c) if (c->pasta_conf_ns) { unsigned int flags = IFF_UP; + const struct guest_addr *a; + int plen; if (c->mtu) nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); @@ -341,10 +343,15 @@ void pasta_ns_conf(struct ctx *c) if (c->ifi4) { if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a) { + plen = inany_prefix_len(&a->addr, + a->prefix_len); + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET, + inany_v4(&a->addr), + plen); + } } else { rc = nl_addr_dup(nl_sock, c->ifi4, nl_sock_ns, c->pasta_ifi, @@ -397,11 +404,13 @@ ipv4_done: 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (a) rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } + c->pasta_ifi, + AF_INET6, + &a->addr.a6, + a->prefix_len); } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 59c45a3..eb93f74 100644 --- a/tap.c +++ b/tap.c @@ -936,8 +936,11 @@ resume: c->ip6.addr_seen = *saddr; } - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) - c->ip6.addr = *saddr; + if (!fwd_get_addr(c, AF_INET6, 0, 0)) { + union inany_addr addr = { .a6 = *saddr }; + + fwd_set_addr(c, &addr, CONF_ADDR_LINKLOCAL, 64); + } } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.52.0

3 4

[PATCH v3 0/6] Improvements to flow specific logging
by David Gibson 19 Jun '26

19 Jun '26

While working on podman bug 23739, I found some deficiences in how and when we report various socket errors related to specific flows. Here are some preliminary patches to improve that. v3: * Added a attribute((printf)) for the base flow log function * And fixed a couple of bad calls that caught * Removed one change from a plain log to a flow-specific log in UDP, where it turned out we didn't necessarily have a well defined flow * Fixing a cppcheck warning in the process * Put an explanatory comment and clang-tidy suppression for the (very limited) recursion in flow_log__() v2: * Added patch 2/6 At Stefano's suggestion * Simplified the errno Handling fix at Stefano's suggestion * Added patch 6/6 which I noticed while revising 5/6. * Made a handful of minor corrections based on feedback. David Gibson (6): flow: Regularise flow specific logging helpers flow: Indent flow details messages flow: Include flow details with higher priority log messages flow, udp: Fix errno handling in udp_flow_sock() flow, treewide: Promote priority of selected flow-linked messages udp: Improve messages for errors getting errors flow.c | 108 +++++++------- flow.h | 79 +++++----- icmp.c | 27 ++-- icmp.h | 3 +- migrate.c | 27 ++-- migrate.h | 8 +- passt.c | 8 +- tcp.c | 387 ++++++++++++++++++++++++++++--------------------- tcp.h | 5 +- tcp_buf.c | 67 +++++---- tcp_buf.h | 7 +- tcp_conn.h | 8 +- tcp_internal.h | 27 ++-- tcp_splice.c | 59 +++++--- tcp_splice.h | 3 +- tcp_vu.c | 31 ++-- tcp_vu.h | 5 +- udp.c | 57 +++++--- udp_flow.c | 18 ++- 19 files changed, 534 insertions(+), 400 deletions(-) -- 2.54.0

2 4

[PATCH v5 00/12] vhost-user: Add multiqueue support
by Laurent Vivier 19 Jun '26

19 Jun '26

This series implements multiqueue support for vhost-user mode, allowing passt to utilize multiple queue pairs for improved network throughput when used with multi-CPU guest VMs. While this version uses a single thread for packet processing, it enables the guest kernel to distribute network traffic across multiple queues and vCPUs. The implementation advertises support for up to 16 queue pairs (32 virtqueues) by setting VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ feature flags. Packets are routed to the appropriate RX queue based on which TX queue they originated from, following the virtio specification's automatic receive steering requirements. This series adds: - Multiqueue capability advertisement (VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ features) - Queue pair parameter throughout the network stack, propagated through all protocol handlers (TCP, UDP, ICMP, ARP, DHCP, DHCPv6, NDP) - Flow-aware queue routing that tracks the originating TX queue for each flow and routes return packets to the corresponding RX queue - Epoll fd derived directly from queue pair, removing the separate epollid field and adding flow_migrate() for moving flows between queue pairs - Test coverage with VHOST_USER_MQ environment variable to validate multiqueue functionality across all protocols (TCP, UDP, ICMP) and services (DHCP, NDP) Current behavior: - TX queue selection is controlled by the guest kernel's networking stack - RX packets are routed to queues based on their associated flows, with the queue assignment updated on each packet from TX to maintain affinity - Host-initiated flows (e.g., from socket-side connections) currently default to queue pair 0 The changes are transparent to single-queue operation - passt/pasta modes and single-queue vhost-user configurations continue to work unchanged, always using queue pair 0. v5: - Rebase - Dropped "tap: Convert packet pools to per-queue-pair arrays for multiqueue" - Split "vhost-user: Add queue pair parameter throughout the network stack" into separate per-protocol patches (tap, arp, tcp, udp, dhcp/dhcpv6, icmp, ndp) for easier review - New patch: "flow: Derive epoll fd from queue pair, removing epollid field" derives epoll fd directly from queue pair, removing the redundant epollid field and adding flow_migrate()/FLOW_MIGRATE() for existing flows - tcp_keepalive() and tcp_inactivity() now filter flows by queue pair - Renamed "vhost-user: Enable multiqueue" to "vhost-user: Advertise multiqueue support" v4: - Rebase - Added QPAIR_DEFAULT, QPAIR_FROMGUEST_QUEUE(), QPAIR_TOGUEST_QUEUE(), and QPAIR_FROM_QUEUE() macros to centralize queue pair calculations - Replaced hardcoded 0 with QPAIR_DEFAULT throughout for clarity - Set queue pair at flow creation time in icmp_ping_new() and udp_flow_new() rather than after creation - Removed vhost-user-specific queue macros (VHOST_USER_TX_QUEUE, VHOST_USER_IS_QUEUE_TX, VHOST_USER_IS_QUEUE_RX) in favor of generic QPAIR_* macros for better consistency v3: - Removed --max-qpairs configuration option - multiqueue support is now always enabled up to 16 queue pairs without requiring explicit configuration - Replaced "tap: Add queue pair parameter throughout the packet processing path" with "tap: Convert packet pools to per-queue-pair arrays for multiqueue" - simplified implementation by converting global pools to arrays rather than passing pool parameters throughout - Changed qpair parameter type from int to unsigned int throughout the codebase - Simplified test infrastructure - queues parameter is always set on netdev, mq=true added to virtio-net only when VHOST_USER_MQ > 1 - Updated QEMU usage hints to always show multiqueue-capable command line v2: - New patch: "tap: Remove pool parameter from tap4_handler() and tap6_handler()" to clean up unused parameters before adding queue pair parameter - Changed to one packet pool per queue pair instead of shared pools across all queue pairs - Split "multiqueue: Add queue-aware flow management..." into two patches: - "tap: Add queue pair parameter throughout the packet processing path" - "flow: Add queue pair tracking to flow management" - Updated test infrastructure patch with refined implementation Laurent Vivier (12): tap: Remove pool parameter from tap4_handler() and tap6_handler() vhost-user: Advertise multiqueue support test: Add multiqueue support to vhost-user test infrastructure tap: Thread queue pair through all remaining tap paths arp: Pass queue pair explicitly through ARP send path tcp: Pass queue pair explicitly through TCP send path udp: Pass queue pair explicitly through UDP send path dhcp/dhcpv6: Pass queue pair explicitly through DHCP send path icmp: Pass queue pair explicitly through ICMP send path ndp: Pass queue pair explicitly through NDP send path flow: Add queue pair tracking to flow management flow: Derive epoll fd from queue pair, removing epollid field arp.c | 15 +-- arp.h | 6 +- dhcp.c | 5 +- dhcp.h | 2 +- dhcpv6.c | 12 ++- dhcpv6.h | 2 +- flow.c | 66 ++++++++----- flow.h | 28 ++++-- fwd.c | 4 +- icmp.c | 29 ++++-- icmp.h | 7 +- ndp.c | 40 ++++---- ndp.h | 7 +- passt.c | 27 +++--- passt.h | 8 ++ tap.c | 134 ++++++++++++++------------ tap.h | 21 +++-- tcp.c | 249 ++++++++++++++++++++++++++++++------------------- tcp.h | 15 +-- tcp_buf.c | 10 +- tcp_internal.h | 7 +- tcp_splice.c | 2 +- tcp_vu.c | 22 +++-- tcp_vu.h | 6 +- test/lib/setup | 21 +++-- test/run | 23 +++++ udp.c | 45 +++++---- udp.h | 9 +- udp_flow.c | 27 +++--- udp_flow.h | 4 +- udp_internal.h | 3 +- udp_vu.c | 6 +- udp_vu.h | 3 +- vhost_user.c | 14 ++- vhost_user.h | 9 -- virtio.h | 2 +- vu_common.c | 22 +++-- vu_common.h | 3 +- 38 files changed, 557 insertions(+), 358 deletions(-) -- 2.54.0

2 24

[PATCH] inany: Fix doc comment to match u32 field, not u64
by Laurent Vivier 19 Jun '26

19 Jun '26

The original siphash incremental patch added a u64[2] member to union inany_addr for hashing. During review, this was changed to u32[4] to preserve 4-byte alignment: a u64 member would have forced 8-byte alignment on the union, mismatching struct in6_addr. The doc comment was not updated, fix @u64 references to @u32. Fixes: fc8f0f8c48ef ("siphash: Use incremental rather than all-at-once siphash functions") Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- inany.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inany.h b/inany.h index 73385b916240..6bf3ecaa0e7d 100644 --- a/inany.h +++ b/inany.h @@ -22,9 +22,9 @@ * @v4mapped.zero: All zero-bits for an IPv4 address * @v4mapped.one: All one-bits for an IPv4 address * @v4mapped.a4: If @a6 is an IPv4 mapped address, the IPv4 address - * @u64: As an array of u64s (solely for hashing) + * @u32: As an array of u32s (solely for hashing) * - * @v4mapped and @u64 shouldn't be accessed except via helpers. + * @v4mapped and @u32 shouldn't be accessed except via helpers. */ union inany_addr { struct in6_addr a6; -- 2.54.0

3 2

[PATCH v2] tap: Trim Ethernet padding from short IPv4 frames instead of dropping them
by David du Colombier 19 Jun '26

19 Jun '26

tap4_handler() requires the L2 payload after the IP header to match the IP datagram length exactly. Guests whose drivers pad transmitted frames to the 60 byte Ethernet minimum, as real hardware requires and as drivers modelled on hardware do (Plan 9's virtio-net, for one), send pure ACK and FIN segments as 60 byte frames: 14 byte Ethernet header, 40 byte IPv4 datagram, 6 padding octets. Those frames fail the exact length check and are dropped without trace. passt then never sees such a guest's acknowledgements: it retransmits from the lowest unacknowledged sequence with exponential backoff while the guest, which received and acknowledged everything, waits. Every fresh connection stalls for minutes (a 1 MiB HTTP fetch over --map-host-loopback measured 248 s before this change, 0.27 s after; bulk transfer over established connections, whose ACKs ride data segments above the padding threshold, is unaffected). FIN segments are padded too, so teardown hangs as well. Note that tap_send_single() pads passt's own outbound frames to ETH_ZLEN, so the receive path was already stricter than the send path. Trim the trailing padding to the IP datagram length instead, using a new iov_tail_trim() helper, and keep dropping frames genuinely shorter than the datagram they claim to carry. IPv6 is unaffected: its minimal TCP frame is 74 bytes, above the padding threshold. Signed-off-by: David du Colombier <0intro(a)gmail.com> --- v2: - store the iov_tail_size() result in a local variable instead of computing it twice - pass ARRAY_SIZE(trim_iov) instead of UIO_MAXIOV iov.c | 35 +++++++++++++++++++++++++++++++++++ iov.h | 2 ++ tap.c | 15 +++++++++++++-- 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/iov.c b/iov.c index 6fd684a..968a365 100644 --- a/iov.c +++ b/iov.c @@ -450,3 +450,38 @@ ssize_t iov_tail_clone(struct iovec *dst_iov, size_t dst_iov_cnt, return j; } + +/** + * iov_tail_trim() - Limit a tail to @len bytes via a scratch iovec array + * @tail: Pointer to the iov_tail to trim; rebuilt on success to + * reference @scratch + * @len: Number of bytes to keep + * @scratch: Scratch iovec array backing the trimmed tail; must stay + * valid as long as the trimmed tail is in use + * @scratch_cnt: Number of elements in @scratch + * + * Return: true on success, false if @tail is shorter than @len or does + * not fit in @scratch (@tail is unchanged on failure) + */ +bool iov_tail_trim(struct iov_tail *tail, size_t len, + struct iovec *scratch, size_t scratch_cnt) +{ + ssize_t cnt = iov_tail_clone(scratch, scratch_cnt, tail); + size_t left = len; + unsigned int i; + + if (cnt < 0) + return false; + + for (i = 0; i < (size_t)cnt && left; i++) { + if (scratch[i].iov_len > left) + scratch[i].iov_len = left; + left -= scratch[i].iov_len; + } + + if (left) + return false; + + *tail = IOV_TAIL(scratch, i, 0); + return true; +} diff --git a/iov.h b/iov.h index 4fdf14a..3af467e 100644 --- a/iov.h +++ b/iov.h @@ -97,6 +97,8 @@ size_t iov_push_header_(struct iov_tail *tail, const void *v, size_t len); void *iov_remove_header_(struct iov_tail *tail, void *v, size_t len, size_t align); ssize_t iov_tail_clone(struct iovec *dst_iov, size_t dst_iov_cnt, struct iov_tail *tail); +bool iov_tail_trim(struct iov_tail *tail, size_t len, + struct iovec *scratch, size_t scratch_cnt); /** * IOV_PEEK_HEADER() - Get typed pointer to a header from an IOV tail diff --git a/tap.c b/tap.c index 4cba4c7..6ed7f8d 100644 --- a/tap.c +++ b/tap.c @@ -716,7 +716,8 @@ static int tap4_handler(struct ctx *c, const struct pool *in, i = 0; resume: for (seq_count = 0, seq = NULL; i < in->count; i++) { - size_t l3len, hlen, l4len; + struct iovec trim_iov[UIO_MAXIOV]; + size_t l3len, hlen, l4len, check; struct ethhdr eh_storage; struct iphdr iph_storage; struct udphdr uh_storage; @@ -775,7 +776,17 @@ resume: if (!iov_drop_header(&data, hlen)) continue; - if (iov_tail_size(&data) != l4len) + + check = iov_tail_size(&data); + if (check < l4len) + continue; + + /* Drivers modelled on real hardware (Plan 9's virtio, for + * one) pad short frames to the 60 byte Ethernet minimum: + * trim trailing padding instead of dropping the packet. + */ + if (check > l4len && + !iov_tail_trim(&data, l4len, trim_iov, ARRAY_SIZE(trim_iov))) continue; if (iph->protocol == IPPROTO_ICMP) { -- 2.54.0

2 1