June 2026 - dev

Startup fd to avoid busywaits
by Lisanna Dettwyler 03 Jun '26

03 Jun '26

Hello! I would like to propose a patch that allows the invoker to pass a "ready fd" on startup that gets written to once the setup has been completed, similar to slirp4netns's `--ready-fd` flag. Currently we have to poll the interface in a loop to wait for setup to be completed, and it would be much better if we could instead block on fd activity. Just wanted to check if such a contribution would be welcome before putting in the work of authoring it, or if there's already a better way to wait for the interface to come up. This is our current implementation: https://github.com/NixOS/nix/pull/15919/changes#diff-2a9176262efad1ef345d88… Thanks, Lisanna

4 7

[PATCH] udp: Provide dummy iov in udp_peek_addr() to avoid Coverity warning
by Jon Maloy 02 Jun '26

02 Jun '26

udp_peek_addr() initialises struct msghdr without setting msg_iov, leaving it implicitly NULL. Coverity flags this as FORWARD_NULL, believing recvmsg() will dereference the NULL pointer. In practice, msg_iovlen being zero means the kernel never touches msg_iov, so the warning is a false positive. We now provide a one-byte dummy iov to make msg_iov non-NULL, hence suppressing this warning without changing the function's behaviour. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- udp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/udp.c b/udp.c index c28d6ee2..f648cb8b 100644 --- a/udp.c +++ b/udp.c @@ -734,9 +734,16 @@ static int udp_peek_addr(int s, union sockaddr_inany *src, { char sastr[SOCKADDR_STRLEN], dstr[INANY_ADDRSTRLEN]; char cmsg[PKTINFO_SPACE]; + char dummy; + struct iovec iov = { + .iov_base = &dummy, + .iov_len = sizeof(dummy), + }; struct msghdr msg = { .msg_name = src, .msg_namelen = sizeof(*src), + .msg_iov = &iov, + .msg_iovlen = 1, .msg_control = cmsg, .msg_controllen = sizeof(cmsg), }; -- 2.52.0

2 1

[PATCH] util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning
by Jon Maloy 02 Jun '26

02 Jun '26

conf_open_files() opens four file descriptors (fd_tap_listen, fd_repair_listen, pidfile_fd, fd_control_listen) that are held for the entire daemon lifetime. Because no close() call exists for them anywhere, Coverity flags each as INCOMPLETE_DEALLOCATOR. This is clearly a false positive, but we still want to get rid of this warning. We now register the execution context so that passt_exit() can use to close these descriptors before calling _exit(). All exit paths (signal handler, die(), die_perror()) funnel through passt_exit(), so this covers all cases. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- log.h | 2 ++ passt.c | 1 + util.c | 22 ++++++++++++++++++++++ 3 files changed, 25 insertions(+) diff --git a/log.h b/log.h index 69cfb507..079f429c 100644 --- a/log.h +++ b/log.h @@ -63,7 +63,9 @@ extern bool debug_flag; /* This would make more sense in util.h, but because we use it in die(), that * would cause awkward circular reference problems. */ +struct ctx; void passt_exit(int status) __attribute__((noreturn)); +void passt_exit_set_ctx(struct ctx *c); #define LOGFILE_SIZE_DEFAULT (1024 * 1024UL) #define LOGFILE_CUT_RATIO 30 /* When full, cut ~30% size */ diff --git a/passt.c b/passt.c index b6fc12d4..ec6aa57a 100644 --- a/passt.c +++ b/passt.c @@ -392,6 +392,7 @@ int main(int argc, char **argv) sock_probe_features(&c); conf(&c, argc, argv); + passt_exit_set_ctx(&c); trace_init(c.trace); pasta_netns_quit_init(&c); diff --git a/util.c b/util.c index b64c29ed..f15b1f9a 100644 --- a/util.c +++ b/util.c @@ -1097,6 +1097,17 @@ void abort_with_msg(const char *fmt, ...) abort(); } +static struct ctx *exit_cleanup_ctx; + +/** + * passt_exit_set_ctx() - Register context for cleanup on exit + * @c: Execution context + */ +void passt_exit_set_ctx(struct ctx *c) +{ + exit_cleanup_ctx = c; +} + /** * passt_exit() - Perform vital cleanup and exit * @@ -1108,6 +1119,17 @@ void abort_with_msg(const char *fmt, ...) */ void passt_exit(int status) { + if (exit_cleanup_ctx) { + if (exit_cleanup_ctx->fd_tap_listen >= 0) + close(exit_cleanup_ctx->fd_tap_listen); + if (exit_cleanup_ctx->fd_repair_listen >= 0) + close(exit_cleanup_ctx->fd_repair_listen); + if (exit_cleanup_ctx->pidfile_fd >= 0) + close(exit_cleanup_ctx->pidfile_fd); + if (exit_cleanup_ctx->fd_control_listen >= 0) + close(exit_cleanup_ctx->fd_control_listen); + } + /* Make sure we don't leave the pcap file truncated */ if (pcap_fd != -1 && fsync(pcap_fd)) warn_perror("Failed to flush pcap file, it might be truncated"); -- 2.52.0

2 1

[PATCH v2 0/6] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 02 Jun '26

02 Jun '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. Anshu Kumari (6): conf: Add --dhcp-opt command-line option conf: Add --dhcp-boot command-line option dhcp: Add option type table and value parser dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option overload doc: Add --dhcp-boot and --dhcp-opt to man page conf.c | 64 +++++++++++++- dhcp.c | 253 +++++++++++++++++++++++++++++++++++++++++++++++++++----- dhcp.h | 17 ++++ passt.1 | 41 +++++++++ passt.h | 16 ++++ 5 files changed, 370 insertions(+), 21 deletions(-) -- 2.54.0

4 20

[PATCH] apparmor: Fix signaling issues from podman
by Bittner, Jan 01 Jun '26

01 Jun '26

This fixes a bug that causes a crash in podman. Podman uses signal to communicate with pasta. Without this patch apparmor does not allow podman to signal pasta and kills pasta instead. Killing pasta causes podman to crash. You can reproduce this by starting a rootless podman socket and starting a container via the socket using podman remote or docker. Links: https://bugs.launchpad.net/ubuntu/+source/passt/+bug/2154379 Signed-off-by: Jan Philipp Bittner <jan.bittner(a)kdo.de> --- contrib/apparmor/usr.bin.pasta | 3 +++ 1 file changed, 3 insertions(+) diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..b0838de 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,6 +18,9 @@ include <tunables/global> profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> + # Allow podman to signal pasta + signal (receive) peer=podman, + # Alternatively: include <abstractions/user-tmp> /tmp/** rw, # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), -- 2.43.0

2 1