July 2026 - dev

[PATCH v2] feat: Pass open files to child in pasta mode
by Richard Lawrence 06 Aug '26

06 Aug '26

When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. The strategy used here is to delay the closing of inherited file descriptors until after pasta has forked to execute the COMMAND, which happens during the call to `conf()`. A nice side-effect is that the `--fd` argument no longer needs to be parsed early, and can rejoin the other args parsed normally in `conf()`. Highlighted changes: - `conf_tap_fd()` is now called directly by `conf()`. - The tap fd is relocated to a number at least 3, rather than exactly 3. - `snapshot_initial_fds()` memorizes inherited fds early in startup. - Inherited fds are discovered by reading from `/proc` if available. - `isolate_fds()` is now called after `conf()` in `main()`. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 39 ++++++++------- conf.h | 1 - isolation.c | 135 ++++++++++++++++++++++++++++++++++++---------------- isolation.h | 9 +++- passt.c | 7 ++- 5 files changed, 129 insertions(+), 62 deletions(-) diff --git a/conf.c b/conf.c index faf2681..6bfdfb6 100644 --- a/conf.c +++ b/conf.c @@ -1169,26 +1169,20 @@ static void conf_sock_listen(const struct ctx *c) } /** - * conf_tap_fd() - Read tap fd as supplied by -F command line option - * @argc: Argument count - * @argv: Command line options + * conf_tap_fd() - Read and relocate tap fd as supplied by -F command line option + * @fdarg: String containing fd + * + * Should: + * - move the --fd descriptor out of the range 0-2 * * Return: fd number from --fd option, or -1 if not supplied */ -int conf_tap_fd(int argc, char **argv) +int conf_tap_fd(const char *fdarg) { - const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, - { 0 }, }; - const char *fdarg = NULL, *p; unsigned long val; - int name; - - optind = 0; - do { - name = getopt_long(argc, argv, "-:F:", optfd, NULL); - if (name == 'F') - fdarg = optarg; - } while (name != -1); + const char *p; + int new_fd; + int fd; if (!fdarg) return -1; @@ -1197,7 +1191,18 @@ int conf_tap_fd(int argc, char **argv) if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || val > INT_MAX) die("Invalid --fd: %s", fdarg); - return val; + fd = (int)val; + if (fd >= 0 && fd < 3) { + new_fd = fcntl(fd, F_DUPFD, 3); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); + + close(fd); + fd = new_fd; + } + + return fd; } /** @@ -1625,7 +1630,7 @@ void conf(struct ctx *c, int argc, char **argv) c->fd_control_listen = c->fd_control = -1; break; case 'F': - /* --fd was parsed early and c->fd_tap set in main() */ + c->fd_tap = conf_tap_fd(optarg); c->one_off = true; *c->sock_path = 0; break; diff --git a/conf.h b/conf.h index 19bf9bc..16f9718 100644 --- a/conf.h +++ b/conf.h @@ -7,7 +7,6 @@ #define CONF_H enum passt_modes conf_mode(int argc, char *argv[]); -int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); void conf_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..2434748 100644 --- a/isolation.c +++ b/isolation.c @@ -24,19 +24,13 @@ * done anything we need to do with those resources, so we have * multiple stages of self-isolation. In order these are: * - * 1a. isolate_initial() + * 1. isolate_initial() * ==================== * * Executed immediately after startup, drops capabilities we don't * need at any point during execution (or which we gain back when we * need by joining other namespaces). * - * 1b. isolate_fds() - * ================ - * - * Executed immediately after isolate_initial(). Closes any leaked - * files we might have inherited from the parent process. - * * 2. isolate_user() * ================= * @@ -44,14 +38,20 @@ * operate in. Sets our final UID & GID, and enters the correct user * namespace. * - * 3. isolate_prefork() + * 3. isolate_fds() + * ================ + * + * Executed after conf(). Closes any leaked + * files we might have inherited from the parent process. + * + * 4. isolate_prefork() * ==================== * * Executed after all setup, but before daemonising (fork()ing into * the background). Uses mount namespace and pivot_root() to remove * our access to the filesystem. * - * 4. isolate_postfork() + * 5. isolate_postfork() * ===================== * * Executed immediately after daemonizing, but before entering the @@ -61,6 +61,7 @@ * runtime operation. */ +#include <dirent.h> #include <errno.h> #include <fcntl.h> #include <grp.h> @@ -77,6 +78,7 @@ #include <unistd.h> #include <sys/mount.h> #include <sys/prctl.h> +#include <sys/resource.h> #include <sys/socket.h> #include <sys/syscall.h> #include <sys/types.h> @@ -248,47 +250,96 @@ void isolate_initial(void) drop_caps_ep_except(keep); } -/* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr - * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd - * - * Should: - * - close all open files except for standard streams and the one from --fd - * - move the --fd descriptor out of the range 0-2 - * - * Return: new fd number for descriptor from --fd, or -1 if not specified +/** + * snapshot_initial_fds() - Snapshot initial file descriptors inherited from parent + * other than standard streams (stdin, stdout, stderr) + * @ifds: Snapshot struct of initial file descriptors to populate */ -int isolate_fds(int argc, char **argv) +void snapshot_initial_fds(struct initial_fd_snapshot *ifds) { - int fd, close_from = STDERR_FILENO + 1; + struct dirent *entry; + size_t capacity = 16; + int max_fd = 1024; + struct rlimit rl; + long parsed_fd; + char *endptr; + int dir_fd; + DIR *dir; + int fd; + + ifds->arr = NULL; + ifds->count = 0; + + dir = opendir("/proc/self/fd"); + if (dir) { + dir_fd = dirfd(dir); + ifds->arr = malloc(sizeof(int) * capacity); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds"); + + while ((entry = readdir(dir)) != NULL) { + if (entry->d_name[0] < '0' || entry->d_name[0] > '9') + continue; + parsed_fd = strtol(entry->d_name, &endptr, 10); + if (*endptr != '\0' || parsed_fd < 0 || parsed_fd > INT_MAX) + continue; + fd = (int)parsed_fd; + /* Ignore stdin/stdout/stderr and the opendir handle itself */ + if (fd > STDERR_FILENO && fd != dir_fd) { + if (ifds->count >= capacity) { + size_t new_cap = capacity * 2; + int *new_arr = realloc(ifds->arr, sizeof(int) * new_cap); + + if (!new_arr) + die_perror("Failed to reallocate memory for inherited fds"); + + ifds->arr = new_arr; + capacity = new_cap; + } + ifds->arr[ifds->count++] = fd; + } + } + closedir(dir); + return; + } + + /* Fallback for environments without /proc (e.g. minimal chroots) */ + if (getrlimit(RLIMIT_NOFILE, &rl) == 0 && rl.rlim_cur != RLIM_INFINITY) + max_fd = (int)rl.rlim_cur; - fd = conf_tap_fd(argc, argv); + ifds->arr = malloc(sizeof(int) * max_fd); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds fallback"); - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + for (fd = STDERR_FILENO + 1; fd < max_fd; fd++) { + if (fcntl(fd, F_GETFD) >= 0) + ifds->arr[ifds->count++] = fd; } +} - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { - if (errno == ENOSYS || errno == EINVAL) { - /* This probably means close_range() or the - * CLOSE_RANGE_UNSHARE flag is not supported by the - * kernel. Not much we can do here except carry on and - * hope for the best. - */ - warn( -"Can't use close_range() to ensure no files leaked by parent"); - } else { - die_perror("Failed to close files leaked by parent"); - } +/** + * isolate_fds() - Close leaked files from the parent process + * @ifds: Snapshot of initial file descriptors + * @keep_fd: File descriptor to keep open, if any + * + * Should: + * - close all file descriptors that were open at startup, except for keep_fd + */ +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd) +{ + size_t i; + + if (!ifds || !ifds->arr) + return; + + for (i = 0; i < ifds->count; i++) { + if (ifds->arr[i] != keep_fd) + close(ifds->arr[i]); } - return fd; + free(ifds->arr); + ifds->arr = NULL; + ifds->count = 0; } /** diff --git a/isolation.h b/isolation.h index ec47038..8ada988 100644 --- a/isolation.h +++ b/isolation.h @@ -8,10 +8,17 @@ #define ISOLATION_H #include <stdbool.h> +#include <stddef.h> #include <unistd.h> +struct initial_fd_snapshot { + int *arr; + size_t count; +}; + void isolate_initial(void); -int isolate_fds(int argc, char **argv); +void snapshot_initial_fds(struct initial_fd_snapshot *ifds); +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd); void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, const char *userns); int isolate_prefork(const struct ctx *c); diff --git a/passt.c b/passt.c index 5054551..c4335bf 100644 --- a/passt.c +++ b/passt.c @@ -335,6 +335,7 @@ int main(int argc, char **argv) struct epoll_event events[NUM_EPOLL_EVENTS]; int nfds, devnull_fd = -1, fd; struct ctx *c = &passt_ctx; + struct initial_fd_snapshot ifds; struct rlimit limit; struct timespec now; struct sigaction sa; @@ -344,8 +345,9 @@ int main(int argc, char **argv) arch_avx2_exec(argv); + snapshot_initial_fds(&ifds); + isolate_initial(); - c->fd_tap = isolate_fds(argc, argv); if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0) die_perror("Failed to open /dev/null"); @@ -390,6 +392,9 @@ int main(int argc, char **argv) sock_probe_features(c); conf(c, argc, argv); + + isolate_fds(&ifds, c->fd_tap); + trace_init(c->trace); pasta_netns_quit_init(c); -- 2.52.0

4 4

[PATCH v2 00/10] multithreading: Prepare data structures for concurrent queue pair workers
by Laurent Vivier 05 Aug '26

05 Aug '26

This series makes the passt data structures safe for concurrent access by multiple worker threads, each handling a different queue pair. It builds on the multiqueue series which threads the queue pair parameter through the network stack. The changes fall into four categories: 1. Per-queue-pair data isolation: - Convert packet pools (pool_tap4, pool_tap6) to per-queue-pair arrays - Convert L4 sequence batching arrays (tap4_l4, tap6_l4) similarly - Move flow and TCP timer state out of global/context structures into per-caller parameters 2. Stack-local buffers: - Move static iovec and virtqueue buffers onto the stack in tcp.c, tcp_vu.c, and udp_vu.c so each thread operates on its own copy 3. Locking for remaining shared state: - pthread_mutex on pre-opened socket pools (init_sock_pool4/6) - pthread_rwlock on the flow table, hash table, and free list, with read locks for lookups and write locks for mutations - _Thread_local for flow_new_entry so each thread independently tracks its in-progress allocation - Per-qpair filtering in flow_defer_handler() so each worker only processes its own flows 4. Lock-free flow migration between queue pairs: - When guest steers traffic to a different TX queue, flows migrate lazily using a to_migrate[] array - flow_migrate_mark() records target qpair from tap path (write-once, no lock needed) - flow_migrate_epollfd() completes migration on next socket/timer event by moving fd and updating qpair on the old thread - TCP timers migrate the same way using new tcp_timer_epoll_add() helper Global operations that don't need per-queue-pair handling (tcp_payload_flush, socket pool refills) are guarded to run only on queue pair 0. v2: - Rebase on latest master and multiqueue v6 - Split v1's "flow: Add mutex and per-qpair filtering..." into two patches: - "flow: Add locking, per-qpair filtering, and intermediate state handling" (locking only) - "flow: Add lazy, lock-free flow migration between queue pairs" (migration logic separated) - Changed from simple mutex to pthread_rwlock for flow table (read locks for lookups, write locks for mutations and free-list rebuild) - Updated flow_foreach() and flow_defer_handler() to handle intermediate flow states (NEW, INI, TGT, TYPED) that can be observed between flow_alloc() and FLOW_ACTIVATE() when lock is released - New patch: "tcp: Extract tcp_timer_epoll_add() helper" - factors out epoll registration for timer migration support - flow_migrate_epollfd() now uses tcp_timer_epoll_add() for timer migration v1: - Initial submission Based-on: 20260616125130.1324274-1-lvivier(a)redhat.com Laurent Vivier (10): tap: Convert packet pools to per-queue-pair arrays for multiqueue tap: Make L4 sequence pools per-qpair for thread safety tcp: Make static buffers stack-local for thread safety udp_vu: Make virtqueue buffers stack-local for thread safety flow: Make flow timer per-caller for thread safety tcp: Make TCP timer state per-caller and guard global tasks tcp: Protect init socket pools with mutex for thread safety tcp: Extract tcp_timer_epoll_add() helper flow: Add locking, per-qpair filtering, and intermediate state handling flow: Add lazy, lock-free flow migration between queue pairs flow.c | 222 ++++++++++++++++++++++++++++++++++++++++++++++----- flow.h | 5 +- flow_table.h | 2 +- icmp.c | 10 ++- passt.c | 37 +++++---- tap.c | 109 ++++++++++++++----------- tap.h | 2 +- tcp.c | 108 ++++++++++++++++++------- tcp.h | 9 +-- tcp_vu.c | 33 +++++--- udp.c | 3 + udp_flow.c | 4 + udp_vu.c | 4 +- vu_common.c | 2 +- 14 files changed, 409 insertions(+), 141 deletions(-) -- 2.54.0

2 22

[PATCH v6 00/12] vhost-user: Add multiqueue support
by Laurent Vivier 03 Aug '26

03 Aug '26

This series implements multiqueue support for vhost-user mode, allowing passt to utilize multiple queue pairs for improved network throughput when used with multi-CPU guest VMs. While this version uses a single thread for packet processing, it enables the guest kernel to distribute network traffic across multiple queues and vCPUs. The implementation advertises support for up to 16 queue pairs (32 virtqueues) by setting VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ feature flags. Packets are routed to the appropriate RX queue based on which TX queue they originated from, following the virtio specification's automatic receive steering requirements. This series adds: - Multiqueue capability advertisement (VIRTIO_NET_F_MQ and VHOST_USER_PROTOCOL_F_MQ features) - Queue pair parameter throughout the network stack, propagated through all protocol handlers (TCP, UDP, ICMP, ARP, DHCP, DHCPv6, NDP) - Flow-aware queue routing that tracks the originating TX queue for each flow and routes return packets to the corresponding RX queue - Epoll fd derived directly from queue pair, removing the separate epollid field and simplifying flow-to-queue association - Test coverage with VHOST_USER_MQ environment variable to validate multiqueue functionality across all protocols (TCP, UDP, ICMP) and services (DHCP, NDP) Current behavior: - TX queue selection is controlled by the guest kernel's networking stack - RX packets are routed to queues based on their associated flows, with the queue assignment updated on each packet from TX to maintain affinity - Host-initiated flows (e.g., from socket-side connections) currently default to queue pair 0 The changes are transparent to single-queue operation - passt/pasta modes and single-queue vhost-user configurations continue to work unchanged, always using queue pair 0. v6: - Rebase on latest master - Moved flow_migrate()/FLOW_MIGRATE() to a following series - this series now focuses solely on basic multiqueue support without dynamic flow migration between queue pairs. - qpair is now a parameter of flow_alloc(). - Made flow_setqp() static (only called during flow allocation) - Updated for upstream changes to flow logging infrastructure (flow_log__(), new logging macros with improved perror and details handling) - Updated for upstream migration handler signature changes (added 'now' parameter to flow_migrate_source_pre(), flow_migrate_source(), and flow_migrate_target()) v5: - Rebase - Dropped "tap: Convert packet pools to per-queue-pair arrays for multiqueue" - Split "vhost-user: Add queue pair parameter throughout the network stack" into separate per-protocol patches (tap, arp, tcp, udp, dhcp/dhcpv6, icmp, ndp) for easier review - New patch: "flow: Derive epoll fd from queue pair, removing epollid field" derives epoll fd directly from queue pair, removing the redundant epollid field and adding flow_migrate()/FLOW_MIGRATE() for existing flows - tcp_keepalive() and tcp_inactivity() now filter flows by queue pair - Renamed "vhost-user: Enable multiqueue" to "vhost-user: Advertise multiqueue support" v4: - Rebase - Added QPAIR_DEFAULT, QPAIR_FROMGUEST_QUEUE(), QPAIR_TOGUEST_QUEUE(), and QPAIR_FROM_QUEUE() macros to centralize queue pair calculations - Replaced hardcoded 0 with QPAIR_DEFAULT throughout for clarity - Set queue pair at flow creation time in icmp_ping_new() and udp_flow_new() rather than after creation - Removed vhost-user-specific queue macros (VHOST_USER_TX_QUEUE, VHOST_USER_IS_QUEUE_TX, VHOST_USER_IS_QUEUE_RX) in favor of generic QPAIR_* macros for better consistency v3: - Removed --max-qpairs configuration option - multiqueue support is now always enabled up to 16 queue pairs without requiring explicit configuration - Replaced "tap: Add queue pair parameter throughout the packet processing path" with "tap: Convert packet pools to per-queue-pair arrays for multiqueue" - simplified implementation by converting global pools to arrays rather than passing pool parameters throughout - Changed qpair parameter type from int to unsigned int throughout the codebase - Simplified test infrastructure - queues parameter is always set on netdev, mq=true added to virtio-net only when VHOST_USER_MQ > 1 - Updated QEMU usage hints to always show multiqueue-capable command line v2: - New patch: "tap: Remove pool parameter from tap4_handler() and tap6_handler()" to clean up unused parameters before adding queue pair parameter - Changed to one packet pool per queue pair instead of shared pools across all queue pairs - Split "multiqueue: Add queue-aware flow management..." into two patches: - "tap: Add queue pair parameter throughout the packet processing path" - "flow: Add queue pair tracking to flow management" - Updated test infrastructure patch with refined implementation Laurent Vivier (12): tap: Remove pool parameter from tap4_handler() and tap6_handler() vhost-user: Advertise multiqueue support test: Add multiqueue support to vhost-user test infrastructure tap: Thread queue pair through all remaining tap paths arp: Pass queue pair explicitly through ARP send path tcp: Pass queue pair explicitly through TCP send path udp: Pass queue pair explicitly through UDP send path dhcp/dhcpv6: Pass queue pair explicitly through DHCP send path icmp: Pass queue pair explicitly through ICMP send path ndp: Pass queue pair explicitly through NDP send path flow: Add queue pair tracking to flow management flow: Derive epoll fd from queue pair, removing epollid field arp.c | 9 ++- arp.h | 2 +- dhcp.c | 5 +- dhcp.h | 2 +- dhcpv6.c | 13 +-- dhcpv6.h | 2 +- flow.c | 45 +++++------ flow.h | 20 ++--- flow_table.h | 2 +- icmp.c | 24 +++--- icmp.h | 7 +- ndp.c | 33 ++++---- ndp.h | 2 +- passt.c | 25 +++--- passt.h | 10 +++ tap.c | 118 ++++++++++++++------------- tap.h | 19 ++--- tcp.c | 211 ++++++++++++++++++++++++++++--------------------- tcp.h | 15 ++-- tcp_buf.c | 8 +- tcp_internal.h | 6 +- tcp_splice.c | 1 - tcp_vu.c | 19 +++-- tcp_vu.h | 5 +- test/lib/setup | 21 +++-- test/run | 23 ++++++ udp.c | 48 ++++++----- udp.h | 9 ++- udp_flow.c | 27 ++++--- udp_flow.h | 13 +-- udp_internal.h | 3 +- udp_vu.c | 7 +- udp_vu.h | 3 +- vhost_user.c | 12 +-- vhost_user.h | 9 --- virtio.h | 2 +- vu_common.c | 22 +++--- vu_common.h | 3 +- 38 files changed, 462 insertions(+), 343 deletions(-) -- 2.54.0

2 22

[PATCH 0/7] multithreading: Add worker threads for queue pair processing
by Laurent Vivier 31 Jul '26

31 Jul '26

NOTE: This series has known stability issues (hangs and crashes under load) and is submitted for reference and testing purposes. This series adds pthread-based worker threads to enable parallel processing of queue pairs in vhost-user mode. Each queue pair gets its own worker thread with a dedicated epollfd. Thread 0 handles control events (listen sockets, vhost-user commands, repair, netlink) plus queue pair 0. Threads 1-15 handle only their assigned queue pair events. Threads start/stop dynamically via SET_VRING_ENABLE. Known issues include system hangs under load and crashes when virtqueues are exhausted. A temporary workaround in virtio.c masks underlying coordination problems between worker threads that need proper fixes. Based-on: 20260731162329.3552800-1-lvivier(a)redhat.com Laurent Vivier (7): vhost_user: Reset vq enable flag in vu_cleanup() threading: Add basic threading infrastructure passt: Integrate main event loop with threading infrastructure flow: Delegate epoll file descriptor management to threading subsystem ctx: Remove epollfd from context structure vhost-user: Add per-qpair worker threads virtio: Prevent crash on virtqueue exhaustion with temporary workaround Makefile | 8 +- conf.c | 10 ++- flow.c | 12 +-- flow.h | 4 +- fwd.c | 4 +- isolation.c | 6 +- netlink.c | 4 +- passt.c | 151 ++++++++++++++++++++++++-------------- passt.h | 7 +- pasta.c | 3 +- pif.c | 3 +- repair.c | 12 ++- tap.c | 9 ++- tcp.c | 3 +- tcp_splice.c | 1 + threading.c | 202 +++++++++++++++++++++++++++++++++++++++++++++++++++ threading.h | 22 ++++++ vhost_user.c | 34 +++++++-- vhost_user.h | 1 + virtio.c | 8 +- vu_common.c | 13 ++-- 21 files changed, 417 insertions(+), 100 deletions(-) create mode 100644 threading.c create mode 100644 threading.h -- 2.54.0

1 7

[PATCH] feat: Pass open files to child in pasta mode
by Richard Lawrence 31 Jul '26

31 Jul '26

When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. Changes: - `conf_tap_fd()` is now called directly by `conf()`. - The tap fd is relocated to a number at least 3, rather than exactly 3. - `snapshot_initial_fds()` memorizes inherited fds early in startup. - Inherited fds are discovered by reading from `/proc` if available. - `isolate_fds()` is now called after `conf()` in `main()`. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 39 +++++++++------- conf.h | 1 - isolation.c | 128 +++++++++++++++++++++++++++++++++++----------------- isolation.h | 9 +++- passt.c | 7 ++- 5 files changed, 122 insertions(+), 62 deletions(-) diff --git a/conf.c b/conf.c index faf2681..6bfdfb6 100644 --- a/conf.c +++ b/conf.c @@ -1169,26 +1169,20 @@ static void conf_sock_listen(const struct ctx *c) } /** - * conf_tap_fd() - Read tap fd as supplied by -F command line option - * @argc: Argument count - * @argv: Command line options + * conf_tap_fd() - Read and relocate tap fd as supplied by -F command line option + * @fdarg: String containing fd + * + * Should: + * - move the --fd descriptor out of the range 0-2 * * Return: fd number from --fd option, or -1 if not supplied */ -int conf_tap_fd(int argc, char **argv) +int conf_tap_fd(const char *fdarg) { - const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, - { 0 }, }; - const char *fdarg = NULL, *p; unsigned long val; - int name; - - optind = 0; - do { - name = getopt_long(argc, argv, "-:F:", optfd, NULL); - if (name == 'F') - fdarg = optarg; - } while (name != -1); + const char *p; + int new_fd; + int fd; if (!fdarg) return -1; @@ -1197,7 +1191,18 @@ int conf_tap_fd(int argc, char **argv) if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || val > INT_MAX) die("Invalid --fd: %s", fdarg); - return val; + fd = (int)val; + if (fd >= 0 && fd < 3) { + new_fd = fcntl(fd, F_DUPFD, 3); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); + + close(fd); + fd = new_fd; + } + + return fd; } /** @@ -1625,7 +1630,7 @@ void conf(struct ctx *c, int argc, char **argv) c->fd_control_listen = c->fd_control = -1; break; case 'F': - /* --fd was parsed early and c->fd_tap set in main() */ + c->fd_tap = conf_tap_fd(optarg); c->one_off = true; *c->sock_path = 0; break; diff --git a/conf.h b/conf.h index 19bf9bc..16f9718 100644 --- a/conf.h +++ b/conf.h @@ -7,7 +7,6 @@ #define CONF_H enum passt_modes conf_mode(int argc, char *argv[]); -int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); void conf_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..bedc4ce 100644 --- a/isolation.c +++ b/isolation.c @@ -24,19 +24,13 @@ * done anything we need to do with those resources, so we have * multiple stages of self-isolation. In order these are: * - * 1a. isolate_initial() + * 1. isolate_initial() * ==================== * * Executed immediately after startup, drops capabilities we don't * need at any point during execution (or which we gain back when we * need by joining other namespaces). * - * 1b. isolate_fds() - * ================ - * - * Executed immediately after isolate_initial(). Closes any leaked - * files we might have inherited from the parent process. - * * 2. isolate_user() * ================= * @@ -44,14 +38,20 @@ * operate in. Sets our final UID & GID, and enters the correct user * namespace. * - * 3. isolate_prefork() + * 3. isolate_fds() + * ================ + * + * Executed after conf(). Closes any leaked + * files we might have inherited from the parent process. + * + * 4. isolate_prefork() * ==================== * * Executed after all setup, but before daemonising (fork()ing into * the background). Uses mount namespace and pivot_root() to remove * our access to the filesystem. * - * 4. isolate_postfork() + * 5. isolate_postfork() * ===================== * * Executed immediately after daemonizing, but before entering the @@ -61,6 +61,7 @@ * runtime operation. */ +#include <dirent.h> #include <errno.h> #include <fcntl.h> #include <grp.h> @@ -77,6 +78,7 @@ #include <unistd.h> #include <sys/mount.h> #include <sys/prctl.h> +#include <sys/resource.h> #include <sys/socket.h> #include <sys/syscall.h> #include <sys/types.h> @@ -248,47 +250,89 @@ void isolate_initial(void) drop_caps_ep_except(keep); } -/* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr - * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd - * - * Should: - * - close all open files except for standard streams and the one from --fd - * - move the --fd descriptor out of the range 0-2 - * - * Return: new fd number for descriptor from --fd, or -1 if not specified +/** + * snapshot_initial_fds() - Snapshot initial file descriptors inherited from parent + * other than standard streams (stdin, stdout, stderr) + * @ifds: Snapshot struct of initial file descriptors to populate */ -int isolate_fds(int argc, char **argv) +void snapshot_initial_fds(struct initial_fd_snapshot *ifds) { - int fd, close_from = STDERR_FILENO + 1; + struct dirent *entry; + size_t capacity = 16; + int max_fd = 1024; + struct rlimit rl; + int dir_fd; + DIR *dir; + int fd; + + ifds->arr = NULL; + ifds->count = 0; + + dir = opendir("/proc/self/fd"); + if (dir) { + dir_fd = dirfd(dir); + ifds->arr = malloc(sizeof(int) * capacity); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds"); + + while ((entry = readdir(dir)) != NULL) { + if (entry->d_name[0] < '0' || entry->d_name[0] > '9') + continue; + + fd = atoi(entry->d_name); + /* Ignore stdin/stdout/stderr and the opendir handle itself */ + if (fd > STDERR_FILENO && fd != dir_fd) { + if (ifds->count >= capacity) { + capacity *= 2; + ifds->arr = realloc(ifds->arr, + sizeof(int) * capacity); + if (!ifds->arr) + die_perror("Failed to reallocate memory for inherited fds"); + } + ifds->arr[ifds->count++] = fd; + } + } + closedir(dir); + return; + } + + /* Fallback for environments without /proc (e.g. minimal chroots) */ + if (getrlimit(RLIMIT_NOFILE, &rl) == 0 && rl.rlim_cur != RLIM_INFINITY) + max_fd = (int)rl.rlim_cur; - fd = conf_tap_fd(argc, argv); + ifds->arr = malloc(sizeof(int) * max_fd); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds fallback"); - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + for (fd = STDERR_FILENO + 1; fd < max_fd; fd++) { + if (fcntl(fd, F_GETFD) >= 0) + ifds->arr[ifds->count++] = fd; } +} - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { - if (errno == ENOSYS || errno == EINVAL) { - /* This probably means close_range() or the - * CLOSE_RANGE_UNSHARE flag is not supported by the - * kernel. Not much we can do here except carry on and - * hope for the best. - */ - warn( -"Can't use close_range() to ensure no files leaked by parent"); - } else { - die_perror("Failed to close files leaked by parent"); - } +/** + * isolate_fds() - Close leaked files from the parent process + * @ifds: Snapshot of initial file descriptors + * @keep_fd: File descriptor to keep open, if any + * + * Should: + * - close all file descriptors that were open at startup, except for keep_fd + */ +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd) +{ + size_t i; + + if (!ifds || !ifds->arr) + return; + + for (i = 0; i < ifds->count; i++) { + if (ifds->arr[i] != keep_fd) + close(ifds->arr[i]); } - return fd; + free(ifds->arr); + ifds->arr = NULL; + ifds->count = 0; } /** diff --git a/isolation.h b/isolation.h index ec47038..8ada988 100644 --- a/isolation.h +++ b/isolation.h @@ -8,10 +8,17 @@ #define ISOLATION_H #include <stdbool.h> +#include <stddef.h> #include <unistd.h> +struct initial_fd_snapshot { + int *arr; + size_t count; +}; + void isolate_initial(void); -int isolate_fds(int argc, char **argv); +void snapshot_initial_fds(struct initial_fd_snapshot *ifds); +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd); void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, const char *userns); int isolate_prefork(const struct ctx *c); diff --git a/passt.c b/passt.c index 5054551..c4335bf 100644 --- a/passt.c +++ b/passt.c @@ -335,6 +335,7 @@ int main(int argc, char **argv) struct epoll_event events[NUM_EPOLL_EVENTS]; int nfds, devnull_fd = -1, fd; struct ctx *c = &passt_ctx; + struct initial_fd_snapshot ifds; struct rlimit limit; struct timespec now; struct sigaction sa; @@ -344,8 +345,9 @@ int main(int argc, char **argv) arch_avx2_exec(argv); + snapshot_initial_fds(&ifds); + isolate_initial(); - c->fd_tap = isolate_fds(argc, argv); if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0) die_perror("Failed to open /dev/null"); @@ -390,6 +392,9 @@ int main(int argc, char **argv) sock_probe_features(c); conf(c, argc, argv); + + isolate_fds(&ifds, c->fd_tap); + trace_init(c->trace); pasta_netns_quit_init(c); -- 2.52.0

2 1

passt: new version 2026_07_28.f8df3f1 available
by Stefano Brivio 29 Jul '26

29 Jul '26

The new version with tag 2026_07_28.f8df3f1 includes the following changes: f8df3f1 fwd: Don't log warnings when failing to bind "weak" ports, just debug messages 12b02aa treewide: Sandbox qrap 4c9ec30 conf, fwd: Prefer same-scope address as inbound source address from host 4e8aa70 conf: Honour --address, --gateway, --netmask in local mode as well 37a73a2 pasta: Regression test for bug 216 ffa5cee pasta: Do not configure ID mappings when invoked with --netns-only 316cb2e pif: Add message to static_assert for C11 compliance, fix build with gcc 8 81a99ce udp, icmp: Remove unused timer_run fields from protocol contexts c80d9db main: Ensure fds 0-2 are populated fd5b080 isolation: Move --fd descriptor to a number of our choosing ab82595 conf: Make conf_tap_fd() operate more like conf_mode() 33e0fbc isolation, conf: Set c->fd_tap from early parse of --fd 0a51006 isolation: Move close_open_files() to isolate_fds() b0ca29e passt: Always close pidfile_fd, not just when daemonizing 5418bd9 tap: Fix EAGAIN/EWOULDBLOCK check in tap_pasta_input() https://passt.top/passt/log/?qt=range&q=2026_07_16.090d739..2026_07_28.f8df… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10784038/ permanent mirror: https://passt.top/builds/copr/0^20260728.gf8df3f1/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gf8df3f1-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0f8df3f1-1_all.deb -- Stefano

1 0

[PATCH v2] passt.1: Clearer and more detailed description of --map-guest-addr
by David Gibson 28 Jul '26

28 Jul '26

It's been pointed out in bug 132 and elsewhere that the man page's description of the --map-guest-addr isn't very clear. It's technically correct, but hard to follow. In my defense as its author, this is largely because the problem the option is addressing is itself quite subtle and hard to explain. In particular while it's usually about host <-> guest communication, it may not be if -a is also used, and the semantics need to accomodate that. Anyway, here's an attempt to make clearer what it does - and why it more or less has to work that way. Reviews on clarity most welcome - I've had my head in the forwarding and address translation for the better part of a year, so it's natural that I've somewhat lost sight of what is and isn't obvious to someone coming fresh. Cc: Paul Holzinger <pholzing(a)redhat.com> Cc: Jan Rodak <jrodak(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=132 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.1 | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-) diff --git a/passt.1 b/passt.1 index 995590a6..f326f82c 100644 --- a/passt.1 +++ b/passt.1 @@ -405,18 +405,33 @@ sandboxing process fails. .TP .BR \-\-map-guest-addr " " \fIaddr -Translate \fIaddr\fR in the guest to be equal to the guest's assigned -address on the host. That is, packets from the guest to \fIaddr\fR -will be redirected to the address assigned to the guest with \fB-a\fR, -or by default the host's global address. This allows the guest to -access services available on the host's global address, even though its -own address shadows that of the host. - -If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one -IPv6 address can be translated, and if the option is specified -multiple times, the last one for each address type takes effect. - -By default, mapping happens as described for the \-\-map-host-loopback option. +Redirect outbound traffic to \fIaddr\fR to whatever node on the host +network has the same address as the guest. Rewrite inbound traffic +from that node so it appears to the guest to have come from \fIaddr\fR +instead. + +By default, the guest or namespace is given one of the host's public +addresses. While this avoids NAT in most cases, it means the guest +cannot communicate with the host using that address. +\fB--map-guest-addr\fR allows the guest to communicate with the host +via \fIaddr\fR instead. + +Note, however, that if \fB-a ADDR\fR is used, where \fBADDR\fR is not +one of the host's addresses, then \fB--map-guest-addr\fR will redirect +traffic to \fIaddr\fR to the host visible node with address +\fBADDR\fR, instead of the host itself. + +Only one IPv4 and one IPv6 address can be translated, and if the +option is specified multiple times, the last one for each address +family takes effect. \fB--map-guest-addr none\fR means no such +translation is performed for IPv4 or IPv6; this will usually make it +impossible for the guest to communicate with the host (at least using +direct IP). + +By default \fB--map-guest-addr GATEWAY\fR is implied, where +\fBGATEWAY\fR is the guest's default gateway address, unless +\fB--no-map-gw\fR is also specified, in which case \fB--map-guest-addr +none\fR is implied. .TP .BR \-4 ", " \-\-ipv4-only -- 2.55.0

2 2

[PATCH] passt.1: Clearer and more detailed description of --map-guest-addr
by David Gibson 28 Jul '26

28 Jul '26

It's been pointed out in bug 132 and elsewhere that the man page's description of the --map-guest-addr isn't very clear. It's technically correct, but hard to follow. In my defense as its author, this is largely because the problem the option is addressing is itself quite subtle and hard to explain. In particular while it's usually about host <-> guest communication, it may not be if -a is also used, and the semantics need to accomodate that. Anyway, here's an attempt to make clearer what it does - and why it more or less has to work that way. Reviews on clarity most welcome - I've had my head in the forwarding and address translation for the better part of a year, so it's natural that I've somewhat lost sight of what is and isn't obvious to someone coming fresh. Cc: Paul Holzinger <pholzing(a)redhat.com> Cc: Jan Rodak <jrodak(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=132 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.1 | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/passt.1 b/passt.1 index 995590a6..19901c1e 100644 --- a/passt.1 +++ b/passt.1 @@ -405,18 +405,34 @@ sandboxing process fails. .TP .BR \-\-map-guest-addr " " \fIaddr -Translate \fIaddr\fR in the guest to be equal to the guest's assigned -address on the host. That is, packets from the guest to \fIaddr\fR -will be redirected to the address assigned to the guest with \fB-a\fR, -or by default the host's global address. This allows the guest to -access services available on the host's global address, even though its -own address shadows that of the host. - -If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one -IPv6 address can be translated, and if the option is specified -multiple times, the last one for each address type takes effect. - -By default, mapping happens as described for the \-\-map-host-loopback option. +Because passt cannot allocate addresses in the host's network +environment, the guest or namespace will typically share an address +with some other "shadowed" interface in the host's network or the +wider internet. By default, the shadowed interface will be the host's +own primary interface, because that's the address given to the guest. +If the guest address is assigned with \fB-a\fR, however, the shadowed +interface will be whatever host-visible interface has the same +address, which could belong to any node on the host's network or the +internet. + +The guest or namespace cannot communicate with the shadowed interface +using its host-visible address: because that's the same as the guest's +address, sending packets there would loop back to the guest before +they're seen by passt to forward. + +\fB--map-guest-addr\fR allows the guest to communicate with the +shadowed interface via the address \fIaddr\fR instead. Packets from +the guest to \fIaddr\fR are translated into packets from the host to +the shadowed interface. Similarly, packets from the shadowed +interface to the host which are forwarded by passt's \fB-t\fR or +\fB-u\fR options will be translated to appear as if from \fIaddr\fR to +the guest's address. + +\fB--map-guest-addr none\fR or omitting \fB--map-guest-addr\fR +entirely means no address is mapped, and the guest will be unable to +communicate with the shadowed interface. Only one IPv4 and one IPv6 +address can be translated, and if the option is specified multiple +times, the last one for each address family takes effect. .TP .BR \-4 ", " \-\-ipv4-only -- 2.55.0

3 6

[BUG] --map-guest-addr target resolved once at startup; host network change kills the mapping silently and permanently
by Yuxi Liu 27 Jul '26

27 Jul '26

Hello, Bug report against pasta, as used by rootless podman for host.containers.internal. What happens ------------ Rootless container, default pasta networking (podman passes --no-map-gw --map-guest-addr 169.254.1.2), on a laptop. The laptop moves to a different network (hotel wifi, home, office). From that moment, every connection from the container to 169.254.1.2 times out. Forever. General outbound from the container keeps working, so the failure looks like the host service died. The host service is fine and answers on the host the whole time. Only recreating the container fixes the route. Why it happens -------------- --map-guest-addr forwards mapped traffic to the host's external address (commit 57b7bd2). pasta resolves that address once, at startup, and never again. After the host moves networks, pasta still connect()s to the launch-time address. Nobody owns that address anymore, the SYNs vanish, and no error is logged anywhere. pasta already runs a live netlink monitor in its event loop (RTMGRP_NEIGH, neighbour events). Host address changes are the one thing it reads once at startup and never watches afterward. Re-reading the current address needs no privilege: getifaddrs() works for any process. Reproduce --------- 1. Laptop on wifi network A. Run a rootless podman container with the default pasta network. Have any service listening on the host, say port 8191. 2. In the container: curl https://www.google.com/url?q=http://host.containers.internal:8191&source=gm… -> answers. 3. Move the laptop to wifi network B. 4. Same curl -> timeout. Stays dead until the container is recreated. Versions: passt 0.0~git20250503.587980c-2 (Ubuntu 25.10), podman 5.4.2. Expected -------- One of: 1. pasta re-resolves the mapping target when the host's addresses change, or 2. the mapped route fails loudly (RST) instead of silently, or 3. the man page warns that the mapping dies permanently on host network change. Laptops are a mainstream platform for rootless podman. A silent, permanent route death on every wifi change is a serious defect for them. Workaround ---------- --map-guest-addr none --map-host-loopback 169.254.1.2 (via podman: --network=pasta:--map-guest-addr,none,--map-host-loopback,169.254.1.2). Mapped traffic then arrives on the host as 127.0.0.1, which the host owns on every network. This changes source semantics (connections appear to come from loopback), which is acceptable when you control both sides. Best regards, Yuxi Liu

4 3

[PATCH] fwd: Don't log warnings when failing to bind "weak" ports, just debug messages
by Stefano Brivio 27 Jul '26

27 Jul '26

When ports are forwarded by exclusion, we might fail to bind all privileged ports (typically lower than 1024), but that's actually expected, and we shouldn't log warnings just because of that. Now, if those ports are automatically forwarded, and we have a container binding some low ports, we'll log those warnings messages every second, which is just unnecessary noise in the system log or in log files. Use LOG_DEBUG as severity for those messages, instead of LOG_WARNING, so that they are only printed when --debug is given: that should be convenient enough to investigate things, while avoiding excess noise during regular operations. There might be more sophisticated ways to limit this noise, but this might be a significant regression in some setups, introduced by recent changes in port forwarding handling, so I'm going for a somewhat minimal fix for the moment, which can be improved later on if needed. Reported-by: frajo <frajo(a)frajo.fi> Link: https://bugs.passt.top/show_bug.cgi?id=213 Fixes: b223bec48213 ("fwd, tcp, udp: Set up listening sockets based on forward table") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- fwd.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/fwd.c b/fwd.c index 4ba0af3..5679a3d 100644 --- a/fwd.c +++ b/fwd.c @@ -392,17 +392,22 @@ static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx, fd = pif_listen(c, rule->proto, pif, addr, ifname, port, idx); if (fd < 0) { char astr[INANY_ADDRSTRLEN]; + int pri = LOG_WARNING; - warn("Listen failed for %s %s port %s%s%s/%u: %s", - pif_name(pif), ipproto_name(rule->proto), - inany_ntop(addr, astr, sizeof(astr)), - ifname ? "%" : "", ifname ? ifname : "", - port, strerror_(-fd)); + if (rule->flags & FWD_WEAK) + pri = LOG_DEBUG; - if (!(rule->flags & FWD_WEAK)) - return -1; + logmsg(true, false, pri, + "Listen failed for %s %s port %s%s%s/%u: %s", + pif_name(pif), ipproto_name(rule->proto), + inany_ntop(addr, astr, sizeof(astr)), + ifname ? "%" : "", ifname ? ifname : "", + port, strerror_(-fd)); - continue; + if (rule->flags & FWD_WEAK) + continue; + + return -1; } socks[port - rule->first] = fd; -- 2.43.0

2 1