June 2026 - dev

[PATCH] tap: don't let overheard traffic move addr_seen when serving a fixed address
by EJ Campbell 19 Jun '26

19 Jun '26

The latest source address seen on the tap interface (ip4.addr_seen) is taken to be the guest's and is used as the target for inbound port forwarding. The update accepts any source address. On a point-to-point tap that is always correct. But when the tap sits on a shared L2 segment -- for example when it is bridged together with other hosts -- pasta also sees frames from those other hosts. With a static configuration (-a / address set, DHCP disabled), an overheard frame from another host silently moves addr_seen to that host, and every subsequent inbound forwarded connection is sent there instead of to the guest, so connections are reset or hang. I hit this running pasta with its tap enslaved to a Linux bridge that also carries other traffic: inbound port forwarding to the guest broke as soon as another address was seen on the segment. Restrict the update so that, when DHCP is disabled (no_dhcp), only frames sourced from the configured guest address may move addr_seen. With DHCP enabled -- the default -- behaviour is unchanged, since the guest's address is whatever pasta leases and tracking it is still correct. The same reasoning applies to ip6.addr_seen on a shared segment; I left IPv6 alone for now since I only exercise IPv4 in this setup, and would be glad to extend it the same way if you prefer. Signed-off-by: EJ Campbell <ej.campbell(a)gmail.com> --- tap.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tap.c b/tap.c index 4cba4c7..514379e 100644 --- a/tap.c +++ b/tap.c @@ -770,7 +770,19 @@ resume: continue; } - if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr) + /* The latest source address seen on the tap is taken to be the + * guest's, and becomes the target for inbound forwarding. On a + * point-to-point tap that's always correct. But if the tap sits + * on a shared L2 segment (for example bridged together with + * other hosts) and we serve a fixed address (DHCP disabled), a + * frame overheard from another host on that segment must not + * move addr_seen and silently retarget forwarded connections + * away from the guest. When DHCP is disabled, only the + * configured guest address may update addr_seen; with DHCP + * enabled (the default) behaviour is unchanged. + */ + if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr && + (!c->no_dhcp || iph->saddr == c->ip4.addr.s_addr)) c->ip4.addr_seen.s_addr = iph->saddr; if (!iov_drop_header(&data, hlen)) base-commit: 4b2823784aab04a70dfc295b16fd6f0592955790 -- 2.53.0

3 6

[PATCH v2 0/6] Improvements to flow specific logging
by David Gibson 19 Jun '26

19 Jun '26

While working on podman bug 23739, I found some deficiences in how and when we report various socket errors related to specific flows. Here are some preliminary patches to improve that. I think patches 1..3 are pretty straightforward and safe. 4/4 I think is a good idea in principle - promoting the priority of a number of messages now that we have ratelimiting. However, plumbing 'now' all the places we need it resuls in a *lot* of churn, so we might want to postpone or split it up. Still, current drafted posted for consideration. v2: * Added patch 2/6 At Stefano's suggestion * Simplified the errno Handling fix at Stefano's suggestion * Added patch 6/6 which I noticed while revising 5/6. * Made a handful of minor corrections based on feedback. David Gibson (6): flow: Regularise flow specific logging helpers flow: Indent flow details messages flow: Include flow details with higher priority log messages flow, udp: Fix errno handling in udp_flow_sock() flow, treewide: Promote priority of selected flow-linked messages udp: Improve messages for errors getting errors flow.c | 103 ++++++------- flow.h | 72 ++++----- icmp.c | 27 ++-- icmp.h | 3 +- migrate.c | 27 ++-- migrate.h | 8 +- passt.c | 8 +- tcp.c | 387 ++++++++++++++++++++++++++++--------------------- tcp.h | 5 +- tcp_buf.c | 67 +++++---- tcp_buf.h | 7 +- tcp_conn.h | 8 +- tcp_internal.h | 27 ++-- tcp_splice.c | 59 +++++--- tcp_splice.h | 3 +- tcp_vu.c | 31 ++-- tcp_vu.h | 5 +- udp.c | 61 +++++--- udp_flow.c | 18 ++- 19 files changed, 528 insertions(+), 398 deletions(-) -- 2.54.0

2 7

[PATCH v3 3/6] flow: Include flow details with higher priority log messages
by David Gibson 19 Jun '26

19 Jun '26

Currently flow_log() and related functions / macros have a 'details' parameter which indicates whether to add extra messages with details of the flow's addresses. This is still a bit awkward to invoke, and only used in a few places. Change the logic, to automatically include the details if and only if the log priority is greater than LOG_DEBUG. Rationale: If at debug log level, there are already a bunch of debug messages tracking the flow life cycle, which include those details (we make sure to retain those). It's usually pretty easy to cross reference a specific flow debug message with the flow's history including the details. If at higher log level, and we generate a flow-connected error or warning we don't have those life cycle messages. So, just giving the flow index doesn't really tell you anything about which flow tripped the error. Adding the address details make the error message significantly more useful. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 2 +- flow.h | 22 +++++++++++----------- tcp.c | 2 +- udp.c | 5 ++--- 4 files changed, 15 insertions(+), 16 deletions(-) diff --git a/flow.c b/flow.c index 8f8435e6..b2963396 100644 --- a/flow.c +++ b/flow.c @@ -554,7 +554,7 @@ norule: /* This shouldn't happen, because if there's no rule for it we should * have no listening socket that would let us get here */ - flow_log(flow, LOG_DEBUG, false, true, "Missing forward rule"); + flow_dbg(flow, "Missing forward rule"); nofwd: flow_err(flow, "No rules to forward %s %s [%s]:%hu -> [%s]:%hu", diff --git a/flow.h b/flow.h index 2b78067a..61dde6d9 100644 --- a/flow.h +++ b/flow.h @@ -284,19 +284,19 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, enum flow_state state, const char *fmt, ...) __attribute__((format(printf, 6, 7))); -#define flow_log_(f_, pri_, perror_, details_, ...) \ - flow_log__((f_), (pri_), (perror_), (details_), (f_)->state, \ - __VA_ARGS__) +#define flow_log_(f_, pri_, perror_, ...) \ + flow_log__((f_), (pri_), (perror_), (pri_) > LOG_DEBUG, \ + (f_)->state, __VA_ARGS__) -#define flow_log(flow_, pri_, perror_, details_, ...) \ - flow_log_(&(flow_)->f, (pri_), (perror_), (details_), __VA_ARGS__) +#define flow_log(flow_, pri_, perror_, ...) \ + flow_log_(&(flow_)->f, (pri_), (perror_), __VA_ARGS__) #define flow_dbg(flow_, ...) \ - flow_log((flow_), LOG_DEBUG, false, false, __VA_ARGS__) + flow_log((flow_), LOG_DEBUG, false, __VA_ARGS__) #define flow_warn(flow_, ...) \ - flow_log((flow_), LOG_WARNING, false, false, __VA_ARGS__) + flow_log((flow_), LOG_WARNING, false, __VA_ARGS__) #define flow_err(flow_, ...) \ - flow_log((flow_), LOG_ERR, false, false, __VA_ARGS__) + flow_log((flow_), LOG_ERR, false, __VA_ARGS__) #define flow_trace(flow_, ...) \ do { \ if (log_trace) \ @@ -304,11 +304,11 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, } while (0) #define flow_dbg_perror(flow_, ...) \ - flow_log((flow_), LOG_DEBUG, true, false, __VA_ARGS__) + flow_log((flow_), LOG_DEBUG, true, __VA_ARGS__) #define flow_warn_perror(flow_, ...) \ - flow_log((flow_), LOG_WARNING, true, false, __VA_ARGS__) + flow_log((flow_), LOG_WARNING, true, __VA_ARGS__) #define flow_perror(flow_, ...) \ - flow_log((flow_), LOG_ERR, true, false, __VA_ARGS__) + flow_log((flow_), LOG_ERR, true, __VA_ARGS__) #define flow_dbg_ratelimit(flow_, now_, ...) \ logmsg_ratelimit(flow_dbg, debug, (now_), (flow_), __VA_ARGS__) diff --git a/tcp.c b/tcp.c index 3538eec2..1c902ac2 100644 --- a/tcp.c +++ b/tcp.c @@ -1404,7 +1404,7 @@ void tcp_linger0_(const struct flow_common *f, int s) */ if (setsockopt(s, SOL_SOCKET, SO_LINGER, &linger0, sizeof(linger0)) < 0) { - flow_log_(f, LOG_DEBUG, true, false, + flow_log_(f, LOG_DEBUG, true, "SO_LINGER failed, may not send RST to peer"); } } diff --git a/udp.c b/udp.c index c95bb200..2d9e2f04 100644 --- a/udp.c +++ b/udp.c @@ -943,8 +943,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, if (events & EPOLLERR) { if (udp_sock_errs(c, ref.fd, ref.flowside, PIF_NONE, 0) < 0) { - flow_log(uflow, LOG_ERR, false, true, - "Unrecoverable error on flow socket"); + flow_err(uflow, "Unrecoverable error on flow socket"); goto fail; } } @@ -975,7 +974,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, udp_buf_sock_to_tap(c, s, n, tosidx); } } else { - flow_log(uflow, LOG_ERR, false, true, + flow_err(uflow, "No support for forwarding UDP from %s to %s", pif_name(pif_at_sidx(ref.flowside)), pif_name(topif)); -- 2.54.0

1 0

[PATCH v3 2/6] flow: Indent flow details messages
by David Gibson 19 Jun '26

19 Jun '26

flow_log__() has the option to append an extra log message with address details of the flow, to give more context to errors or warnings. Add an indent to this part of the message, to emphasise that it's additional information related to a nearby message, rather than a message in its own right. Suggested-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/flow.c b/flow.c index c6741251..8f8435e6 100644 --- a/flow.c +++ b/flow.c @@ -315,7 +315,7 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, if (state >= FLOW_STATE_TGT) { flow_log__(f, pri, false, false, state, -"%s [%s]:%hu -> [%s]:%hu => %s [%s]:%hu -> [%s]:%hu", +" %s [%s]:%hu -> [%s]:%hu => %s [%s]:%hu -> [%s]:%hu", pif_name(f->pif[INISIDE]), inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), ini->eport, @@ -328,7 +328,7 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, tgt->eport); } else if (state >= FLOW_STATE_INI) { flow_log__(f, pri, false, false, state, - "%s [%s]:%hu -> [%s]:%hu => ?", + " %s [%s]:%hu -> [%s]:%hu => ?", pif_name(f->pif[INISIDE]), inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), ini->eport, -- 2.54.0

1 0

[PATCH v3 1/6] flow: Regularise flow specific logging helpers
by David Gibson 19 Jun '26

19 Jun '26

flow.h has a collection of logging helpers that automatically include information about a specific flow. Which variants are present are a bit ad-hoc, based on what we happened to want use (e.g. there are no LOG_WARNING level versions, at present). There's also a rather awkward and only occasionally used flow_log_details_() helper to print additional log messages with more details of the flow (basically its addresses). It's particularly awkward to try to combine that with ratelimiting. Re-organise this to be based around a flow_log__() internal helper, which has bool parameters to include strerror() / perror information and/or the extra details. Add wrapper macros for all combinations of perror, ratelimiting and DEBUG/WARNING/ERR priorities. Be a little more consistent about parameter order between the various functions / macros / wrappers while we're at it. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 94 ++++++++++++++++++++++++++++++---------------------------- flow.h | 71 +++++++++++++++++++++++--------------------- tcp.c | 4 +-- udp.c | 6 ++-- 4 files changed, 91 insertions(+), 84 deletions(-) diff --git a/flow.c b/flow.c index 7a5c81c2..c6741251 100644 --- a/flow.c +++ b/flow.c @@ -269,17 +269,25 @@ int flowside_connect(const struct ctx *c, int s, return connect(s, &sa.sa, socklen_inany(&sa)); } -/** flow_log_ - Log flow-related message +/** flow_log__ - Log flow-related message, internal helper * @f: flow the message is related to - * @newline: Append newline at the end of the message, if missing * @pri: Log priority + * @perror: Append strerror(errno) output + * @details: Add lines with flow addresses + * @state: State to display details for (used during state changes) * @fmt: Format string * @...: printf-arguments + * + * NOTE: This function is, technically speaking, recursive. However it recurses + * at most one layer, and as a tail call. clang-tidy doesn't like it, hence the + * suppression below. */ -void flow_log_(const struct flow_common *f, bool newline, int pri, - const char *fmt, ...) +/* NOLINTNEXTLINE(misc-no-recursion) */ +void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, + enum flow_state state, const char *fmt, ...) { const char *type_or_state; + int errno_ = errno; char msg[BUFSIZ]; va_list args; @@ -293,45 +301,41 @@ void flow_log_(const struct flow_common *f, bool newline, int pri, else type_or_state = FLOW_TYPE(f); - logmsg(newline, false, pri, + logmsg(!perror, false, pri, "Flow %u (%s): %s", flow_idx(f), type_or_state, msg); -} -/** flow_log_details_() - Log the details of a flow - * @f: flow to log - * @pri: Log priority - * @state: State to log details according to - * - * Logs the details of the flow: endpoints, interfaces, type etc. - */ -void flow_log_details_(const struct flow_common *f, int pri, - enum flow_state state) -{ - char estr0[INANY_ADDRSTRLEN], fstr0[INANY_ADDRSTRLEN]; - char estr1[INANY_ADDRSTRLEN], fstr1[INANY_ADDRSTRLEN]; - const struct flowside *ini = &f->side[INISIDE]; - const struct flowside *tgt = &f->side[TGTSIDE]; - - if (state >= FLOW_STATE_TGT) - flow_log_(f, true, pri, - "%s [%s]:%hu -> [%s]:%hu => %s [%s]:%hu -> [%s]:%hu", - pif_name(f->pif[INISIDE]), - inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), - ini->eport, - inany_ntop(&ini->oaddr, fstr0, sizeof(fstr0)), - ini->oport, - pif_name(f->pif[TGTSIDE]), - inany_ntop(&tgt->oaddr, fstr1, sizeof(fstr1)), - tgt->oport, - inany_ntop(&tgt->eaddr, estr1, sizeof(estr1)), - tgt->eport); - else if (state >= FLOW_STATE_INI) - flow_log_(f, true, pri, "%s [%s]:%hu -> [%s]:%hu => ?", - pif_name(f->pif[INISIDE]), - inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), - ini->eport, - inany_ntop(&ini->oaddr, fstr0, sizeof(fstr0)), - ini->oport); + if (perror) + logmsg(true, true, pri, ": %s", strerror_(errno_)); + + if (details) { + char estr0[INANY_ADDRSTRLEN], fstr0[INANY_ADDRSTRLEN]; + char estr1[INANY_ADDRSTRLEN], fstr1[INANY_ADDRSTRLEN]; + const struct flowside *ini = &f->side[INISIDE]; + const struct flowside *tgt = &f->side[TGTSIDE]; + + if (state >= FLOW_STATE_TGT) { + flow_log__(f, pri, false, false, state, +"%s [%s]:%hu -> [%s]:%hu => %s [%s]:%hu -> [%s]:%hu", + pif_name(f->pif[INISIDE]), + inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), + ini->eport, + inany_ntop(&ini->oaddr, fstr0, sizeof(fstr0)), + ini->oport, + pif_name(f->pif[TGTSIDE]), + inany_ntop(&tgt->oaddr, fstr1, sizeof(fstr1)), + tgt->oport, + inany_ntop(&tgt->eaddr, estr1, sizeof(estr1)), + tgt->eport); + } else if (state >= FLOW_STATE_INI) { + flow_log__(f, pri, false, false, state, + "%s [%s]:%hu -> [%s]:%hu => ?", + pif_name(f->pif[INISIDE]), + inany_ntop(&ini->eaddr, estr0, sizeof(estr0)), + ini->eport, + inany_ntop(&ini->oaddr, fstr0, sizeof(fstr0)), + ini->oport); + } + } } /** @@ -347,10 +351,9 @@ static void flow_set_state(struct flow_common *f, enum flow_state state) assert(oldstate < FLOW_NUM_STATES); f->state = state; - flow_log_(f, true, LOG_DEBUG, "%s -> %s", flow_state_str[oldstate], + flow_log__(f, LOG_DEBUG, false, true, MAX(state, oldstate), + "%s -> %s", flow_state_str[oldstate], FLOW_STATE(f)); - - flow_log_details_(f, LOG_DEBUG, MAX(state, oldstate)); } /** @@ -551,8 +554,7 @@ norule: /* This shouldn't happen, because if there's no rule for it we should * have no listening socket that would let us get here */ - flow_dbg(flow, "Missing forward rule"); - flow_log_details_(f, LOG_DEBUG, f->state); + flow_log(flow, LOG_DEBUG, false, true, "Missing forward rule"); nofwd: flow_err(flow, "No rules to forward %s %s [%s]:%hu -> [%s]:%hu", diff --git a/flow.h b/flow.h index 2623b3db..2b78067a 100644 --- a/flow.h +++ b/flow.h @@ -280,42 +280,47 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, int flow_migrate_target(struct ctx *c, const struct migrate_stage *stage, int fd); -void flow_log_(const struct flow_common *f, bool newline, int pri, - const char *fmt, ...) - __attribute__((format(printf, 4, 5))); - -#define flow_log(f_, pri, ...) flow_log_(&(f_)->f, true, (pri), __VA_ARGS__) -#define flow_dbg(f, ...) flow_log((f), LOG_DEBUG, __VA_ARGS__) -#define flow_err(f, ...) flow_log((f), LOG_ERR, __VA_ARGS__) - -#define flow_trace(f, ...) \ +void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, + enum flow_state state, const char *fmt, ...) + __attribute__((format(printf, 6, 7))); + +#define flow_log_(f_, pri_, perror_, details_, ...) \ + flow_log__((f_), (pri_), (perror_), (details_), (f_)->state, \ + __VA_ARGS__) + +#define flow_log(flow_, pri_, perror_, details_, ...) \ + flow_log_(&(flow_)->f, (pri_), (perror_), (details_), __VA_ARGS__) + +#define flow_dbg(flow_, ...) \ + flow_log((flow_), LOG_DEBUG, false, false, __VA_ARGS__) +#define flow_warn(flow_, ...) \ + flow_log((flow_), LOG_WARNING, false, false, __VA_ARGS__) +#define flow_err(flow_, ...) \ + flow_log((flow_), LOG_ERR, false, false, __VA_ARGS__) +#define flow_trace(flow_, ...) \ do { \ if (log_trace) \ - flow_dbg((f), __VA_ARGS__); \ - } while (0) - -#define flow_log_perror_(f, pri, ...) \ - do { \ - int errno_ = errno; \ - flow_log_((f), false, (pri), __VA_ARGS__); \ - logmsg(true, true, (pri), ": %s", strerror_(errno_)); \ + flow_dbg((flow_), __VA_ARGS__); \ } while (0) -#define flow_dbg_perror(f_, ...) flow_log_perror_(&(f_)->f, LOG_DEBUG, __VA_ARGS__) -#define flow_perror(f_, ...) flow_log_perror_(&(f_)->f, LOG_ERR, __VA_ARGS__) - -void flow_log_details_(const struct flow_common *f, int pri, - enum flow_state state); -#define flow_log_details(f_, pri) \ - flow_log_details_(&((f_)->f), (pri), (f_)->f.state) -#define flow_dbg_details(f_) flow_log_details((f_), LOG_DEBUG) -#define flow_err_details(f_) flow_log_details((f_), LOG_ERR) - -#define flow_dbg_ratelimit(f, now, ...) \ - logmsg_ratelimit(flow_dbg, debug, now, f, __VA_ARGS__) -#define flow_err_ratelimit(f, now, ...) \ - logmsg_ratelimit(flow_err, err, now, f, __VA_ARGS__) -#define flow_perror_ratelimit(f, now, ...) \ - logmsg_ratelimit(flow_perror, err, now, f, __VA_ARGS__) +#define flow_dbg_perror(flow_, ...) \ + flow_log((flow_), LOG_DEBUG, true, false, __VA_ARGS__) +#define flow_warn_perror(flow_, ...) \ + flow_log((flow_), LOG_WARNING, true, false, __VA_ARGS__) +#define flow_perror(flow_, ...) \ + flow_log((flow_), LOG_ERR, true, false, __VA_ARGS__) + +#define flow_dbg_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_dbg, debug, (now_), (flow_), __VA_ARGS__) +#define flow_dbg_perror_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_dbg_perror, debug, (now_), (flow_), __VA_ARGS__) +#define flow_warn_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_warn, warn, (now_), (flow_), __VA_ARGS__) +#define flow_warn_perror_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_warn_perror, warn, (now_), (flow_), __VA_ARGS__) +#define flow_err_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_err, err, (now_), (flow_), __VA_ARGS__) +#define flow_perror_ratelimit(flow_, now_, ...) \ + logmsg_ratelimit(flow_perror, err, (now_), (flow_), __VA_ARGS__) #endif /* FLOW_H */ diff --git a/tcp.c b/tcp.c index 097ab72e..3538eec2 100644 --- a/tcp.c +++ b/tcp.c @@ -1404,8 +1404,8 @@ void tcp_linger0_(const struct flow_common *f, int s) */ if (setsockopt(s, SOL_SOCKET, SO_LINGER, &linger0, sizeof(linger0)) < 0) { - flow_log_perror_(f, LOG_DEBUG, - "SO_LINGER failed, may not send RST to peer"); + flow_log_(f, LOG_DEBUG, true, false, + "SO_LINGER failed, may not send RST to peer"); } } diff --git a/udp.c b/udp.c index 375befa7..c95bb200 100644 --- a/udp.c +++ b/udp.c @@ -943,7 +943,8 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, if (events & EPOLLERR) { if (udp_sock_errs(c, ref.fd, ref.flowside, PIF_NONE, 0) < 0) { - flow_err(uflow, "Unrecoverable error on flow socket"); + flow_log(uflow, LOG_ERR, false, true, + "Unrecoverable error on flow socket"); goto fail; } } @@ -974,7 +975,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, udp_buf_sock_to_tap(c, s, n, tosidx); } } else { - flow_err(uflow, + flow_log(uflow, LOG_ERR, false, true, "No support for forwarding UDP from %s to %s", pif_name(pif_at_sidx(ref.flowside)), pif_name(topif)); @@ -984,7 +985,6 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, return; fail: - flow_err_details(uflow); udp_flow_close(c, uflow); } -- 2.54.0

1 0

[PATCH] udp, icmp: Remove unused timer_run fields from protocol contexts
by Laurent Vivier 19 Jun '26

19 Jun '26

Since 260075bde769 ("tcp, udp, fwd: Run all port scanning from a single timer"), CALL_PROTO_HANDLER() is only used for TCP. UDP and ICMP timers now run from flow_defer_handler(), making the timer_run fields in struct udp_ctx and struct icmp_ctx dead stores. Remove the unused fields, drop struct icmp_ctx entirely (it has no remaining members), and stop initialising them in timer_init(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- icmp.h | 7 ------- passt.c | 2 +- passt.h | 2 -- udp.h | 2 -- 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/icmp.h b/icmp.h index e8b928b61370..556260461995 100644 --- a/icmp.h +++ b/icmp.h @@ -19,12 +19,5 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, struct iov_tail *data, const struct timespec *now); void icmp_init(void); -/** - * struct icmp_ctx - Execution context for ICMP routines - * @timer_run: Timestamp of most recent timer run - */ -struct icmp_ctx { - struct timespec timer_run; -}; #endif /* ICMP_H */ diff --git a/passt.c b/passt.c index b1d35d5bf988..677c8471a105 100644 --- a/passt.c +++ b/passt.c @@ -141,7 +141,7 @@ static void random_init(struct ctx *c) */ static void timer_init(struct ctx *c, const struct timespec *now) { - c->tcp.timer_run = c->udp.timer_run = c->icmp.timer_run = *now; + c->tcp.timer_run = *now; } /** diff --git a/passt.h b/passt.h index 3a072945c382..205d7eecede7 100644 --- a/passt.h +++ b/passt.h @@ -194,7 +194,6 @@ struct ip6_ctx { * @no_udp: Disable UDP operation * @udp: Context for UDP protocol handler * @no_icmp: Disable ICMP operation - * @icmp: Context for ICMP protocol handler * @mtu: MTU passed via DHCP/NDP * @no_dns: Do not source/use DNS servers for any purpose * @no_dns_search: Do not source/use domain search lists for any purpose @@ -279,7 +278,6 @@ struct ctx { int no_udp; struct udp_ctx udp; int no_icmp; - struct icmp_ctx icmp; int no_dns; int no_dns_search; diff --git a/udp.h b/udp.h index 9ea7de682caf..b50283eab198 100644 --- a/udp.h +++ b/udp.h @@ -26,14 +26,12 @@ void udp_update_l2_buf(const unsigned char *eth_d); * struct udp_ctx - Execution context for UDP * @scan_in: Port scanning state for inbound packets * @scan_out: Port scanning state for outbound packets - * @timer_run: Timestamp of most recent timer run * @timeout: Timeout for unidirectional flows (in s) * @stream_timeout: Timeout for stream-like flows (in s) */ struct udp_ctx { struct fwd_scan scan_in; struct fwd_scan scan_out; - struct timespec timer_run; int timeout; int stream_timeout; }; -- 2.54.0

1 0

[PATCH v4 0/4] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 19 Jun '26

19 Jun '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. v4: Restructured series from 6 patches to 4: - 1/4 refactor fill_one() - 2/4 option overload - 3/4 --dhcp-opt with parser and man page - 4/4 --dhcp-boot with man page Anshu Kumari (4): dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option overload dhcp: Add --dhcp-opt with option table and value parser conf: Add --dhcp-boot command-line option conf.c | 50 ++++++++- dhcp.c | 321 ++++++++++++++++++++++++++++++++++++++++++++++++++++---- dhcp.h | 2 + passt.1 | 49 +++++++++ passt.h | 6 ++ 5 files changed, 407 insertions(+), 21 deletions(-) -- 2.54.0

2 10

[PATCH v2 0/2] dhcpv6: Add --dhcpv6-opt for custom DHCPv6 options
by Anshu Kumari 19 Jun '26

19 Jun '26

This series adds a --dhcpv6-opt CODE,VALUE command-line option to inject custom options into DHCPv6 replies, complementing the existing --dhcp-opt support for DHCPv4. The primary use case is UEFI HTTP Boot, which requires Vendor Class (option 16) with the correct enterprise-number + length-prefixed wire encoding per RFC 8415 Section 21.16, and Boot File URL (option 59). Value formats are determined automatically from the option code via a type table. Supported types include plain strings, IPv6 addresses (single and list), 8/16/32-bit integers, vendor class (ENTERPRISE:DATA), and length-prefixed string lists. Anshu Kumari (2): dhcpv6: Add --dhcpv6-opt with option type table and value parser dhcpv6: Inject custom options into DHCPv6 replies conf.c | 60 ++++++++++++- dhcpv6.c | 253 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ dhcpv6.h | 2 + passt.1 | 31 +++++++ passt.h | 12 +++ 5 files changed, 357 insertions(+), 1 deletion(-) -- 2.54.0

2 4

[PATCH 0/4] RFC: Improvements to flow specific logging
by David Gibson 17 Jun '26

17 Jun '26

While working on podman bug 23739, I found some deficiences in how and when we report various socket errors related to specific flows. Here are some preliminary patches to improve that. I think patches 1..3 are pretty straightforward and safe. 4/4 I think is a good idea in principle - promoting the priority of a number of messages now that we have ratelimiting. However, plumbing 'now' all the places we need it resuls in a *lot* of churn, so we might want to postpone or split it up. Still, current drafted posted for consideration. David Gibson (4): flow: Regularise flow specific logging helpers flow: Include flow details with higher priority log messages flow: Safer errno handling in flowside_connect() callers flow, treewide: Promote priority of selected flow-linked messages flow.c | 107 +++++++------- flow.h | 72 +++++----- icmp.c | 27 ++-- icmp.h | 3 +- migrate.c | 27 ++-- migrate.h | 8 +- passt.c | 8 +- tcp.c | 381 ++++++++++++++++++++++++++++--------------------- tcp.h | 5 +- tcp_buf.c | 78 +++++----- tcp_buf.h | 8 +- tcp_conn.h | 8 +- tcp_internal.h | 27 ++-- tcp_splice.c | 59 +++++--- tcp_splice.h | 3 +- tcp_vu.c | 42 +++--- tcp_vu.h | 6 +- udp.c | 48 ++++--- udp_flow.c | 22 +-- 19 files changed, 535 insertions(+), 404 deletions(-) -- 2.54.0

2 11

[PATCH v2 4/6] flow, udp: Fix errno handling in udp_flow_sock()
by David Gibson 17 Jun '26

17 Jun '26

flowside_connect() behaves much like connect(2) itself, returning -1 on error with errno set to the error code. One of the callers, in udp_flow_sock(), uses the errno code with flow_dbg_perror() *after* it's called epoll_del() and close() either of which could clobber errno. Fix that by moving the debug message earlier: there's no reason it has to wait until the epoll_del() and close(). While we're at it, adjust the comment on flowside_connect() to clarify that it sets errno (rather than, say, returning an error code). Suggested-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 2 +- udp_flow.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/flow.c b/flow.c index 596a4722..20938034 100644 --- a/flow.c +++ b/flow.c @@ -258,7 +258,7 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, * * Connect @s to the endpoint address and port from @tgt. * - * Return: 0 on success, negative on error + * Return: 0 on success, negative on error (setting errno) */ int flowside_connect(const struct ctx *c, int s, uint8_t pif, const struct flowside *tgt) diff --git a/udp_flow.c b/udp_flow.c index 35417bc4..31e2f8a7 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -90,11 +90,11 @@ static int udp_flow_sock(const struct ctx *c, if (flowside_connect(c, s, pif, side) < 0) { rc = -errno; + flow_dbg_perror(uflow, "Couldn't connect flow socket"); epoll_del(flow_epollfd(&uflow->f), s); close(s); - flow_dbg_perror(uflow, "Couldn't connect flow socket"); return rc; } uflow->s[sidei] = s; -- 2.54.0

1 0