July 2026 - dev

[PATCH] pif: Add message to static_assert for C11 compliance, fix build with gcc 8
by Stefano Brivio 19 Jul '26

19 Jul '26

Seen with gcc 8.5: --- In file included from passt.h:18, from qrap.c:36: pif.h: In function 'pif_type': pif.h:48:44: error: expected ',' before ')' token static_assert(sizeof("?") <= PIF_NAME_SIZE); ^ make: *** [Makefile:105: qrap] Error 1 --- As noted in ba84a3b17af8 ("treewide: Add messages to static_assert() calls"), static_assert() calls need a message to comply with C11. The form without message is supported starting from C23 only. Fixes: cbcd4284111f ("pif: Limit pif names to 128 bytes") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- pif.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pif.h b/pif.h index 3a1e2e5..dedcaa5 100644 --- a/pif.h +++ b/pif.h @@ -45,7 +45,7 @@ static inline const char *pif_type(enum pif_type pt) return pif_type_str[pt]; else return "?"; - static_assert(sizeof("?") <= PIF_NAME_SIZE); + static_assert(sizeof("?") <= PIF_NAME_SIZE, "PIF_NAME_SIZE too small"); } static inline const char *pif_name(uint8_t pif) -- 2.43.0

2 2

[PATCH v2 0/6] Fix bug 215 and some related issues with fd handling
by David Gibson 19 Jul '26

19 Jul '26

Stefano, you called it correctly. While working on bug 215, as usual, I found a bunch of adjacent things to clean up. I did start by attempting the appoach you suggested for bug 215 - remembering which of the low fds were standard streams and avoiding closing them in __daemon(). It is indeed shorter, but only by 1-2 lines. Looking at possible interactions with other things, I became more and more convinced that leaving anything other than the standard streams in fds 0-2 was an accident waiting to happen. Much of the rest of the series is, for example, dealing with the possibility of --fd [012]. v2: * No longer fold fd closing into isolate_initial() * Some minor polish * Various improved comments and commit messages David Gibson (6): passt: Always close pidfile_fd, not just when daemonizing isolation: Move close_open_files() to isolate_fds() isolation, conf: Set c->fd_tap from early parse of --fd conf: Make conf_tap_fd() operate more like conf_mode() isolation: Move --fd descriptor to a number of our choosing main: Ensure fds 0-2 are populated conf.c | 31 ++++++++++++++++++++------- conf.h | 2 +- isolation.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++------- isolation.h | 3 ++- passt.c | 28 +++++++++++++++++-------- util.c | 52 +--------------------------------------------- util.h | 1 - 7 files changed, 98 insertions(+), 79 deletions(-) -- 2.55.0

2 6

[PATCH] treewide: Sandbox qrap
by Stefano Brivio 19 Jul '26

19 Jul '26

No sunsetting or rightsizing for you, qrap: dig, bury, and cover. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- .gitignore | 1 - Makefile | 11 +- README.md | 4 - contrib/fedora/passt.spec | 2 - doc/demo.sh | 12 +- doc/passt_overview.excalidraw | 29 --- hooks/pre-push | 2 +- passt.1 | 235 ++++++++++--------- qrap.1 | 77 ------ qrap.c | 429 ---------------------------------- tap.c | 2 - test/distro/opensuse | 2 +- 12 files changed, 127 insertions(+), 679 deletions(-) delete mode 100644 qrap.1 delete mode 100644 qrap.c diff --git a/.gitignore b/.gitignore index 3e40d9f..71420b6 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,6 @@ /pasta.avx2 /passt-repair /pesto -/qrap /pasta.1 /seccomp.h /seccomp_pesto.h diff --git a/Makefile b/Makefile index 5757aef..77474d6 100644 --- a/Makefile +++ b/Makefile @@ -39,13 +39,12 @@ PASST_SRCS = arch.c arp.c bitmap.c checksum.c conf.c dhcp.c dhcpv6.c \ parse.c passt.c pasta.c pcap.c pif.c repair.c serialise.c tap.c tcp.c \ tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c \ vhost_user.c virtio.c vu_common.c -QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c PESTO_SRCS = pesto.c bitmap.c fwd_rule.c inany.c ip.c lineread.c parse.c \ serialise.c -SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) +SRCS = $(PASST_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) -MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 +MANPAGES = passt.1 pasta.1 pesto.1 passt-repair.1 PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \ epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h icmp.h icmp_flow.h \ @@ -54,7 +53,6 @@ PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \ serialise.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h \ tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h udp_vu.h util.h \ vhost_user.h virtio.h vu_common.h -QRAP_HEADERS = arp.h ip.h passt.h util.h PASST_REPAIR_HEADERS = linux_dep.h PESTO_HEADERS = bitmap.h common.h fwd_rule.h inany.h ip.h log.h parse.h \ pesto.h serialise.h @@ -76,7 +74,7 @@ docdir ?= $(datarootdir)/doc/passt mandir ?= $(datarootdir)/man man1dir ?= $(mandir)/man1 -BASEBIN := passt qrap passt-repair pesto +BASEBIN := passt passt-repair pesto ifeq ($(TARGET_ARCH),x86_64) BASEBIN += passt.avx2 endif @@ -112,9 +110,6 @@ passt.avx2: $(PASST_SRCS) $(PASST_HEADERS) seccomp.h pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ -qrap: BASE_CPPFLAGS += -DARCH=\"$(TARGET_ARCH)\" -qrap: $(QRAP_SRCS) $(QRAP_HEADERS) - passt-repair: $(PASST_REPAIR_SRCS) $(PASST_REPAIR_HEADERS) seccomp_repair.h pesto: BASE_CPPFLAGS += -DPESTO diff --git a/README.md b/README.md index 8fdc0a3..43caf49 100644 --- a/README.md +++ b/README.md @@ -376,10 +376,6 @@ speeding up local connections, and usually requiring NAT. _pasta_: _passt_ exchanges packets with _qemu_ via UNIX domain socket, using the `socket` back-end in qemu. This is supported since qemu 7.2. -For older versions, the [qrap](/passt/tree/qrap.c) wrapper can be used to -connect to a UNIX domain socket and to start qemu, which can now use the file -descriptor that's already opened. - This approach, compared to using a _tap_ device, doesn't require any security capabilities, as we don't need to create any interface. diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 34838af..6c7530a 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -118,12 +118,10 @@ fi %doc %{_docdir}/%{name}/demo.sh %{_bindir}/passt %{_bindir}/pasta -%{_bindir}/qrap %{_bindir}/passt-repair %{_bindir}/pesto %{_mandir}/man1/passt.1* %{_mandir}/man1/pasta.1* -%{_mandir}/man1/qrap.1* %{_mandir}/man1/passt-repair.1* %{_mandir}/man1/pesto.1* %ifarch x86_64 diff --git a/doc/demo.sh b/doc/demo.sh index 6b0917c..b56669f 100755 --- a/doc/demo.sh +++ b/doc/demo.sh @@ -177,7 +177,7 @@ into_ns() { next [ "${KEY}" = "s" ] && ${SHELL} - cmd passt -P "${DEMO_DIR}/passt.pid" + cmd passt -P "${DEMO_DIR}/passt.pid" -s "${DEMO_DIR}/passt.socket" echo echo "...passt is running." next @@ -198,15 +198,12 @@ into_ns() { echo "can download and use mbuto (https://mbuto.sh/) to build a" echo "basic initramfs image. Otherwise, press 's' to skip this" echo "step, and start an existing virtual machine yourself." - echo "You'll need to use the qrap(1) wrapper, with qemu options" - echo "as reported above." next else echo "This script doesn't know, yet, how to run a virtual" echo "machine on your architecture (${__arch}). Please start an" - echo "existing virtual machine yourself, using the qrap(1)" - echo "wrapper, with qemu options as reported above." + echo "existing virtual machine yourself." echo fi @@ -225,12 +222,13 @@ into_ns() { next # shellcheck disable=SC2086 - cmd qrap 5 ${__qemu_arch} \ + cmd ${__qemu_arch} \ -smp "$(nproc)" -m 1024 \ -nographic -serial stdio -nodefaults -no-reboot -vga none \ -initrd "${DEMO_DIR}/demo.img" \ -kernel "/boot/vmlinuz-$(uname -r)" -append "console=ttyS0" \ - -net socket,fd=5 -net nic,model=virtio || : + -device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path="${DEMO_DIR}/passt.socket" || : } STTY_BACKUP="$(stty -g)" diff --git a/doc/passt_overview.excalidraw b/doc/passt_overview.excalidraw index 790728e..3217b3f 100644 --- a/doc/passt_overview.excalidraw +++ b/doc/passt_overview.excalidraw @@ -3595,35 +3595,6 @@ "baseline": 17, "textAlign": "left", "verticalAlign": "top" - }, - { - "type": "text", - "version": 1448, - "versionNonce": 1345391945, - "isDeleted": false, - "id": "c-esZiuHSm3wnTRlmIJZk", - "fillStyle": "hachure", - "strokeWidth": 1, - "strokeStyle": "dotted", - "roughness": 1, - "opacity": 100, - "angle": 4.969352159599495, - "x": 816.7081559166961, - "y": 215.74807066759342, - "strokeColor": "#2b8a3e", - "backgroundColor": "transparent", - "width": 211, - "height": 23, - "seed": 939668423, - "groupIds": [], - "strokeSharpness": "round", - "boundElementIds": [], - "fontSize": 20, - "fontFamily": 1, - "text": "(currently \"qrap\" wrapper)", - "baseline": 17, - "textAlign": "left", - "verticalAlign": "top" } ], "appState": { diff --git a/hooks/pre-push b/hooks/pre-push index 3e2d15f..8eebdbc 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -54,7 +54,7 @@ done cd .. make pkgs -scp passt passt.avx2 passt.1 qrap qrap.1 "${USER_HOST}:${BIN}" +scp passt passt.avx2 passt.1 "${USER_HOST}:${BIN}" scp pasta pasta.avx2 pasta.1 "${USER_HOST}:${BIN}" scp passt-repair passt-repair.1 "${USER_HOST}:${BIN}" scp pesto pesto.1 "${USER_HOST}:${BIN}" diff --git a/passt.1 b/passt.1 index 995590a..53e072a 100644 --- a/passt.1 +++ b/passt.1 @@ -580,8 +580,7 @@ Default is \fBnone\fR for \fBpasst\fR and \fBauto\fR for \fBpasta\fR. .TP .BR \-s ", " \-\-socket-path ", " \-\-socket " " \fIpath -Path for UNIX domain socket used by \fBqemu\fR(1) or \fBqrap\fR(1) to connect to -\fBpasst\fR. +Path for UNIX domain socket used by \fBqemu\fR(1) to connect to \fBpasst\fR. Default is to probe a free socket, not accepting connections, starting from \fI/tmp/passt_1.socket\fR to \fI/tmp/passt_64.socket\fR. @@ -762,129 +761,132 @@ forwards loopback traffic between namespaces. .RS .nf $ iperf3 -s -D -$ ./pasta -Outbound interface: eth0, namespace interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea -DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 -NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 -# -# dhclient -4 --no-pid -# dhclient -6 --no-pid + +$ pasta --config-net + # ip address show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever - inet6 ::1/128 scope host + inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever -2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UNKNOWN group default qlen 1000 - link/ether 5e:90:02:eb:b0:2a brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global eth0 +2: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether be:16:49:5a:65:dc brd ff:ff:ff:ff:ff:ff + inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global + inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:5c90:2ff:feeb:b02a/64 scope global dynamic mngtmpaddr - valid_lft 3591sec preferred_lft 3591sec - inet6 fe80::5c90:2ff:feeb:b02a/64 scope link + inet6 fe80::bc16:49ff:fe5a:65dc/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever + # ip route show -default via 192.168.1.1 dev eth0 -192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.118 +default via 88.198.0.161 dev enp9s0 proto dhcp metric 1002 +88.198.0.160/27 dev enp9s0 proto dhcp scope link metric 1002 + # ip -6 route show -2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 dev eth0 proto kernel metric 256 pref medium -2a02:6d40:3ca5:2001::/64 dev eth0 proto kernel metric 256 expires 3584sec pref medium -fe80::/64 dev eth0 proto kernel metric 256 pref medium -default via fe80::62e3:27ff:fe33:2b01 dev eth0 proto ra metric 1024 expires 3584sec pref medium +2a01:4f8:222:904::/64 dev enp9s0 proto kernel metric 256 pref medium +fe80::/64 dev enp9s0 proto kernel metric 256 pref medium +default via fe80::1 dev enp9s0 metric 1024 onlink pref medium + # iperf3 -c 127.0.0.1 -t1 Connecting to host 127.0.0.1, port 5201 -[ 5] local 127.0.0.1 port 51938 connected to 127.0.0.1 port 5201 +[ 5] local 127.0.0.1 port 59112 connected to 127.0.0.1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd -[ 5] 0.00-1.00 sec 4.46 GBytes 38.3 Gbits/sec 0 3.93 MBytes +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 2.62 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr -[ 5] 0.00-1.00 sec 4.46 GBytes 38.3 Gbits/sec 0 sender -[ 5] 0.00-1.41 sec 4.45 GBytes 27.1 Gbits/sec receiver +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 sender +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec receiver iperf Done. + # iperf3 -c ::1 -t1 Connecting to host ::1, port 5201 -[ 5] local ::1 port 50108 connected to ::1 port 5201 +[ 5] local ::1 port 49138 connected to ::1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd -[ 5] 0.00-1.00 sec 4.35 GBytes 37.4 Gbits/sec 0 4.99 MBytes +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 1.06 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr -[ 5] 0.00-1.00 sec 4.35 GBytes 37.4 Gbits/sec 0 sender -[ 5] 0.00-1.41 sec 4.35 GBytes 26.4 Gbits/sec receiver +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 sender +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec receiver iperf Done. -# ping -c1 -4 spaghetti.pizza -PING spaghetti.pizza (172.67.192.217) 56(84) bytes of data. -64 bytes from 172.67.192.217: icmp_seq=1 ttl=255 time=37.3 ms + +# ping -nc1 -4 spaghetti.pizza +PING spaghetti.pizza (5.161.47.86) 56(84) bytes of data. +64 bytes from 5.161.47.86: icmp_seq=1 ttl=255 time=99.4 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms -# ping -c1 -6 spaghetti.pizza -PING spaghetti.pizza(2606:4700:3034::6815:147a (2606:4700:3034::6815:147a)) 56 data bytes -64 bytes from 2606:4700:3034::6815:147a: icmp_seq=1 ttl=255 time=35.6 ms +rtt min/avg/max/mdev = 99.433/99.433/99.433/0.000 ms +# ping -nc1 -6 spaghetti.pizza +PING spaghetti.pizza (2a01:4f8:1c1e:d6f1::1) 56 data bytes +64 bytes from 2a01:4f8:1c1e:d6f1::1: icmp_seq=1 ttl=255 time=3.11 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms -rtt min/avg/max/mdev = 35.605/35.605/35.605/0.000 ms -# logout -$ - -.RE +rtt min/avg/max/mdev = 3.110/3.110/3.110/0.000 ms .fi +.RE .BR "Connect an existing user and network namespace" .RS .nf $ unshare -rUn -# echo $$ -2446678 +# echo $$ +1295969 .fi -.BR " [From another terminal]" + +.BR "[From another terminal]" .nf -$ ./pasta 2446678 -Outbound interface: eth0, namespace interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea +$ pasta --config-net 1295969 +Template interface: enp9s0 (IPv4), enp9s0 (IPv6) +Namespace interface: enp9s0 +MAC: + host: 9a:55:9a:55:9a:55 + NAT to host 127.0.0.1: 88.198.0.161 DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 + assign: 88.198.0.164 + mask: 255.255.255.224 + router: 88.198.0.161 +DNS: + 185.12.64.1 + 185.12.64.2 + NAT to host ::1: fe80::1 NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 - + assign: 2a01:4f8:222:904::2 + router: fe80::1 + our link-local: fe80::1 +Inbound forwarding rules (HOST): + TCP [*]:1-32767 => 1-32767 (best effort) (auto-scan) + TCP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) + UDP [*]:1-32767 => 1-32767 (best effort) (auto-scan) + UDP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) +Outbound forwarding rules (SPLICE): + TCP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) + TCP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) + UDP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) + UDP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) .fi -.BR " [Back to the original terminal]" + +.BR "[Back to the original terminal]" .nf -# dhclient -4 --no-pid -# dhclient -6 --no-pid # ip address show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever - inet6 ::1/128 scope host + inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever -2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UNKNOWN group default qlen 1000 - link/ether fa:c1:2a:27:92:a9 brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global eth0 +2: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether 9a:44:5e:54:d3:2c brd ff:ff:ff:ff:ff:ff + inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global + inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:f8c1:2aff:fe27:92a9/64 scope global dynamic mngtmpaddr - valid_lft 3594sec preferred_lft 3594sec - inet6 fe80::f8c1:2aff:fe27:92a9/64 scope link + inet6 fe80::9844:5eff:fe54:d32c/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever .fi .RE @@ -893,72 +895,69 @@ NDP/DHCPv6: .BR "Start and connect a guest with basic port forwarding" .RS .nf -$ ./passt -f -t 2222:22 -Outbound interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea +$ passt -f -t 2222:22 +UNIX domain socket bound at /tmp/passt_1.socket +No IPv6 nameserver available for NDP/DHCPv6 +Template interface: enp9s0 (IPv4), enp9s0 (IPv6) +MAC: + host: 9a:55:9a:55:9a:55 + NAT to host 127.0.0.1: 88.198.0.161 DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 - search: - redhat.com + assign: 88.198.0.164 + mask: 255.255.255.224 + router: 88.198.0.161 +DNS: + 185.12.64.1 + 185.12.64.2 + NAT to host ::1: fe80::1 NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 - search: - redhat.com -UNIX domain socket bound at /tmp/passt_1.socket - -You can now start qrap: - ./qrap 5 qemu-system-x86_64 ... -net socket,fd=5 -net nic,model=virtio -or directly qemu, patched with: - qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch -as follows: - qemu-system-x86_64 ... -net socket,connect=/tmp/passt_1.socket -net nic,model=virtio - + assign: 2a01:4f8:222:904::2 + router: fe80::1 + our link-local: fe80::1 +Inbound forwarding rules (HOST): + TCP [*]:2222 => 22 + +You can now start qemu (>= 7.2, with commit 13c6be96618c): + kvm ... -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket .fi -.BR " [From another terminal]" -.nf -$ ./qrap 5 qemu-system-x86_64 test.qcow2 -m 1024 -display none -nodefaults -nographic -net socket,fd=5 -net nic,model=virtio -Connected to /tmp/passt_1.socket -.fi -.BR " [Back to the original terminal]" +.BR "[From another terminal]" .nf -passt: DHCP: ack to request -passt: from 52:54:00:12:34:56 -passt: NDP: received NS, sending NA -passt: NDP: received RS, sending RA -passt: DHCPv6: received SOLICIT, sending ADVERTISE -passt: NDP: received NS, sending NA -passt: DHCPv6: received REQUEST/RENEW/CONFIRM, sending REPLY -passt: NDP: received NS, sending NA +$ qemu-system-x86_64 -m 128 test.qcow2 -display none -nodefaults -nographic -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket +.fi +.BR "[Back to the original terminal]" +.nf +accepted connection from PID 1301736 +New guest MAC address observed: 52:54:00:12:34:56 +DHCP: offer to discover + from 52:54:00:12:34:56 +DHCP: ack to request + from 52:54:00:12:34:56 +NDP: received RS, sending RA .fi -.BR " [From yet another terminal]" + +.BR "[From yet another terminal]" .nf $ ssh -p 2222 root@localhost root@localhost's password: .fi -.BR " [...]" +.BR "[...]" .nf # ip address show -1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 +1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever -2: ens2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UP group default qlen 1000 +2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global noprefixroute ens2 + inet 88.198.0.164/27 scope global eth0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global noprefixroute + inet6 2a01:4f8:222:904:5054:ff:fe12:3456/64 scope global dynamic flags 100 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b019:9ae2:a2fe:e6b4/64 scope global dynamic noprefixroute - valid_lft 3588sec preferred_lft 3588sec - inet6 fe80::1f98:d09f:9309:9e77/64 scope link noprefixroute + inet6 fe80::5054:ff:fe12:3456/64 scope link valid_lft forever preferred_lft forever .fi .RE diff --git a/qrap.1 b/qrap.1 deleted file mode 100644 index 98cc877..0000000 --- a/qrap.1 +++ /dev/null @@ -1,77 +0,0 @@ -.\" SPDX-License-Identifier: GPL-2.0-or-later -.\" Copyright (c) 2020-2021 Red Hat GmbH -.\" Author: Stefano Brivio <sbrivio(a)redhat.com> -.TH qrap 1 - -.SH NAME -.B qrap -\- temporary qemu wrapper connecting UNIX domain socket to file descriptor - -.SH SYNOPSIS -.B qrap -[\fIFDNUM\fR \fIQEMU_CMD\fR] [\fIQEMU_ARG\fR]... -.SH DESCRIPTION -\fBqrap\fR is a wrapper, designed specifically for usage with \fBqemu\fR(1) and -\fBpasst\fR(1), connecting a UNIX domain socket to a file descriptor, and -running \fBqemu\fR(1) with given arguments. - -A running instance of \fBpasst\fR(1) is probed checking for UNIX domain sockets, -answering a dummy ARP request, with names starting from -\fI/tmp/passt_1.socket\fR up to \fI/tmp/passt_64.socket\fR. - -If first and second arguments are not a socket number and a command, that is, -respectively, \fIFDNUM\fR and \fIQEMU_CMD\fR, \fBqrap\fR will try to locate a -qemu executable in \fBPATH\fR and patch the command line to specify a network -device and a \fInetdev\fR back-end for usage with \fBpasst\fR(1). - -If \fBqrap\fR patches the command line, it will remove any potentially -conflicting network device, that is, any \fI-netdev\fR or \fI-net\fR option, or -any \fI-device\fR option with argument starting with \fIvirtio-net-pci,\fR, -\fIvirtio-net-ccw,\fR, \fIe1000,\fR, \fIe1000e,\fR, or \fIrtl8139,\fR. - -.SH EXAMPLES - -.BR "Start qemu explicitly passing its command name and a socket number" -.RS -.nf -$ ./qrap 5 kvm test.qcow2 -m 1024 -display none -nodefaults -nographic -net socket,fd=5 -net nic,model=virtio -.fi -.RE - -.BR "Start qemu without command name and socket number, patching arguments" -.RS -.nf -$ ./qrap test.qcow2 -m 1024 -display none -nodefaults -nographic -.fi -.RE - -.SH NOTES - -This wrapper is temporary: qemu commit 13c6be96618c ("net: stream: add unix -socket") introduces native AF_UNIX socket support, and it should be included in -qemu starting from the 7.2 release. It will be around for a little bit longer to -give users enough time to switch. - -.SH AUTHOR - -Stefano Brivio <sbrivio(a)redhat.com> - -.SH REPORTING BUGS - -No public bug tracker is available at this time. For the moment being, report -issues to Stefano Brivio <sbrivio(a)redhat.com>. - -.SH COPYRIGHT - -Copyright (c) 2020-2021 Red Hat GmbH. - -\fBqrap\fR is free software: you can redistribute is and/or modify it under the -terms of the GNU General Public License as published by the Free Software -Foundation, either version 2 of the License, or (at your option) any later -version. - -.SH SEE ALSO - -\fBqemu\fR(1), \fBpasst\fR(1). - -High-level documentation is available at https://passt.top/passt/about/. diff --git a/qrap.c b/qrap.c deleted file mode 100644 index d596706..0000000 --- a/qrap.c +++ /dev/null @@ -1,429 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later - -/* PASST - Plug A Simple Socket Transport - * - * qrap.c - qemu wrapper connecting UNIX domain socket to file descriptor - * - * Copyright (c) 2020-2021 Red Hat GmbH - * Author: Stefano Brivio <sbrivio(a)redhat.com> - * - * TODO: Drop this implementation once qemu commit 13c6be96618c ("net: stream: - * add unix socket") is included in a release (7.2), and once we can reasonably - * assume existing users switched to it. - */ - -#include <stdio.h> -#include <stdint.h> -#include <stdlib.h> -#include <string.h> -#include <unistd.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <errno.h> -#include <linux/limits.h> -#include <limits.h> -#include <fcntl.h> -#include <net/if_arp.h> -#include <netinet/in.h> -#include <netinet/ip6.h> -#include <netinet/if_ether.h> -#include <time.h> - -#include <linux/icmpv6.h> - -#include "util.h" -#include "ip.h" -#include "passt.h" -#include "arp.h" - -static char *qemu_names[] = { - "kvm", - "qemu-kvm", -#ifdef ARCH - ( "qemu-system-" ARCH ), -#endif - "/usr/libexec/qemu-kvm", - NULL, -}; - -/** - * struct drop_arg - Drop matching arguments on command line - * @name: Option name - * @val: Substring in option value, NULL matches any value - */ -static const struct drop_arg { - char *name; - char *val; -} drop_args[] = { - { "-netdev", NULL }, - { "-net", NULL }, - { "-device", "virtio-net-pci," }, - { "-device", "{\"driver\":\"virtio-net-pci\"," }, - { "-device", "virtio-net-ccw," }, - { "-device", "{\"driver\":\"virtio-net-ccw\"," }, - { "-device", "e1000," }, - { "-device", "{\"driver\":\"e1000\"," }, - { "-device", "e1000e," }, - { "-device", "{\"driver\":\"e1000e\"," }, - { "-device", "rtl8139," }, - { "-device", "{\"driver\":\"rtl8139\"," }, - { 0 }, -}; - -/** - * struct pci_dev - PCI devices to add on command line depending on machine name - * @mach: Machine name - * @name: Device ("-device") name to insert - * @template: Prefix for device specification (first part of address) - * @template_post: Suffix for device specification (last part of address) - * @template_json: Device prefix for when JSON is used - * @template_json_post: Device suffix for when JSON is used - * @base: Base used for PCI addresses - * @first: First usable PCI address - * @last: Last usable PCI address - */ -static const struct pci_dev { - char *mach; - char *name; - char *template; - char *template_post; - char *template_json; - char *template_json_post; - int base; - int first; - int last; -} pci_devs[] = { - { - "pc-q35", "virtio-net-pci", - "bus=pci.", ",addr=0x0", - "\"bus\":\"pci.", ",\"addr\":\"0x0\"", - 10, 3, /* 2: hotplug bus */ 31 - }, - { - "pc-", "virtio-net-pci", - "bus=pci.0,addr=0x", "", - "\"bus\":\"pci.0\",\"addr\":\"0x", "", - 16, 2, /* 1: ISA bridge */ 31 - }, - { - "s390-ccw", "virtio-net-ccw", - "devno=fe.0.", "", - "\"devno\":\"fe.0.", "", - 16, 1, 16 - }, - { 0 }, -}; - -#define DEFAULT_FD 5 - -/** - * usage() - Print usage and exit - * @name: Executable name - */ -void usage(const char *name) -{ - fprintf(stderr, "Usage: %s [FDNUM QEMU_CMD] [QEMU_ARG]...\n", name); - fprintf(stderr, "\n"); - fprintf(stderr, "If first and second arguments aren't a socket number\n" - "and a path, %s will try to locate a qemu binary\n" - "and directly patch the command line\n", name); - - exit(EXIT_FAILURE); -} - -/** - * main() - Entry point and main loop - * @argc: Argument count - * @argv: File descriptor number, then qemu with arguments - * - * Return: 0 once interrupted, non-zero on failure - */ -int main(int argc, char **argv) -{ - int i, s, qemu_argc = 0, addr_map = 0, has_dev = 0, has_json = 0, retry_on_reset, rc; - struct timeval tv = { .tv_sec = 0, .tv_usec = (long)(500 * 1000) }; - char *qemu_argv[ARG_MAX], dev_str[ARG_MAX]; - struct sockaddr_un addr = { - .sun_family = AF_UNIX, - }; - const struct pci_dev *dev = NULL; - long fd; - struct { - uint32_t vnet_len4; - struct ethhdr eh4; - struct arphdr ah; - struct arpmsg am; - - uint32_t vnet_len6; - struct ethhdr eh6; - struct ipv6hdr ip6hr; - struct icmp6hdr ihr; - struct in6_addr target; - } __attribute__((__packed__)) probe = { - .vnet_len4 = htonl(42), - { - .h_dest = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_source = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_proto = htons(ETH_P_ARP), - }, - { .ar_hrd = htons(ARPHRD_ETHER), - .ar_pro = htons(ETH_P_IP), - .ar_hln = ETH_ALEN, - .ar_pln = 4, - .ar_op = htons(ARPOP_REQUEST), - }, - { - .sha = { 0 }, .sip = { 0 }, .tha = { 0 }, .tip = { 0 }, - }, - .vnet_len6 = htonl(78), - { - .h_dest = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_source = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_proto = htons(ETH_P_IPV6), - }, - { - .version = 6, - .payload_len = htons(24), - .nexthdr = IPPROTO_ICMPV6, - .hop_limit = 255, - .saddr = IN6ADDR_LOOPBACK_INIT, - .daddr = IN6ADDR_ANY_INIT, - }, - { - .icmp6_type = 135, - .icmp6_code = 0, - }, - IN6ADDR_ANY_INIT, - }; - char probe_r; - - if (argc >= 3) { - const char *path = getenv("PATH"); - errno = 0; - fd = strtol(argv[1], NULL, 0); - if (fd >= 3 && fd < INT_MAX && !errno && path) { - char env_path[ARG_MAX + 1], *p, command[ARG_MAX]; - - strncpy(env_path, path, ARG_MAX); - /* cppcheck-suppress strtokCalled */ - p = strtok(env_path, ":"); - while (p) { - snprintf(command, ARG_MAX, "%s/%s", p, argv[2]); - if (!access(command, X_OK)) - goto valid_args; - - /* cppcheck-suppress strtokCalled */ - p = strtok(NULL, ":"); - } - } - } - - fd = DEFAULT_FD; - - for (i = 1; i < argc - 1; i++) { - if (strcmp(argv[i], "-machine")) - continue; - - for (dev = pci_devs; dev->mach; dev++) { - if (strstr(argv[i + 1], dev->mach) == argv[i + 1]) - break; - } - } - - if (!dev || !dev->mach) - dev = pci_devs; - - for (qemu_argc = 1, i = 1; i < argc; i++) { - const struct drop_arg *a; - - for (a = drop_args; a->name; a++) { - if (!strcmp(argv[i], a->name)) { - if (!a->val) - break; - - if (i + 1 < argc && - strstr(argv[i + 1], a->val) == argv[i + 1]) - break; - } - } - if (a->name) { - i++; - continue; - } - - if (!strcmp(argv[i], "-device") && i + 1 < argc) { - const char *template = NULL; - const char *p; - - has_dev = 1; - - if ((p = strstr(argv[i + 1], dev->template))) { - template = dev->template; - } else if ((p = strstr(argv[i + 1], dev->template_json))) { - template = dev->template_json; - has_json = 1; - } - - if (template) { - long n; - - n = strtol(p + strlen(template), NULL, dev->base); - if (!errno) - addr_map |= (1 << n); - } - } - - qemu_argv[qemu_argc++] = argv[i]; - } - - for (i = dev->first; i < dev->last; i++) { - if (!(addr_map & (1 << i))) - break; - } - if (i == dev->last) { - fprintf(stderr, "Couldn't find free address for device\n"); - usage(argv[0]); - } - - if (has_dev) { - qemu_argv[qemu_argc++] = "-device"; - if (!has_json) { - if (dev->base == 16) { - snprintf(dev_str, ARG_MAX, - "%s,%s%x%s,netdev=hostnet0,x-txburst=4096", - dev->name, dev->template, i, dev->template_post); - } else if (dev->base == 10) { - snprintf(dev_str, ARG_MAX, - "%s,%s%d%s,netdev=hostnet0,x-txburst=4096", - dev->name, dev->template, i, dev->template_post); - } - } else { - if (dev->base == 16) { - snprintf(dev_str, ARG_MAX, - "{\"driver\":\"%s\",%s%x\"%s,\"netdev\":\"hostnet0\",\"x-txburst\":4096}", - dev->name, dev->template_json, i, dev->template_json_post); - } else if (dev->base == 10) { - snprintf(dev_str, ARG_MAX, - "{\"driver\":\"%s\",%s%d\"%s,\"netdev\":\"hostnet0\",\"x-txburst\":4096}", - dev->name, dev->template_json, i, dev->template_json_post); - } - } - qemu_argv[qemu_argc++] = dev_str; - } - - qemu_argv[qemu_argc++] = "-netdev"; - if (!has_json) { - qemu_argv[qemu_argc++] = "socket,fd=" STR(DEFAULT_FD) ",id=hostnet0"; - } else { - qemu_argv[qemu_argc++] = "{\"type\":\"socket\",\"fd\":\"" STR(DEFAULT_FD) "\",\"id\":\"hostnet0\"}"; - } - qemu_argv[qemu_argc] = NULL; - -valid_args: - for (i = 1; i < UNIX_SOCK_MAX; i++) { - retry_on_reset = 50; - -retry: - s = socket(AF_UNIX, SOCK_STREAM, 0); - if (s < 0) { - perror("socket"); - exit(EXIT_FAILURE); - } - - if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) - perror("setsockopt SO_RCVTIMEO"); - if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) - perror("setsockopt SO_SNDTIMEO"); - - snprintf(addr.sun_path, UNIX_PATH_MAX, UNIX_SOCK_PATH, i); - - errno = 0; - - if (connect(s, (const struct sockaddr *)&addr, sizeof(addr))) { - rc = errno; - perror("connect"); - } else if (send(s, &probe, sizeof(probe), 0) != sizeof(probe)) { - rc = errno; - perror("send"); - } else if (recv(s, &probe_r, 1, MSG_PEEK) <= 0) { - rc = errno; - perror("recv"); - } else { - break; - } - - /* FIXME: in a KubeVirt environment, libvirtd invokes qrap three - * times in a strict sequence when a virtual machine needs to - * be started, namely, when: - * - the domain XML is saved - * - the domain is started (for "probing") - * - the virtual machine is started for real - * and it often happens that the qemu process is still running - * when qrap is invoked again, so passt will refuse the new - * connection because the previous one is still active. This - * overlap seems to be anywhere between 0 and 3ms. - * - * If we get a connection reset, retry a few times, to allow for - * the previous qemu instance to terminate and, in turn, for the - * connection to passt to be closed. - * - * This should be fixed in libvirt instead. It probably makes - * sense to check this behaviour once native libvirt support is - * there, and this implies native qemu support too, so at that - * point qrap will have no reason to exist anymore -- that is, - * this FIXME will probably remain until the tool itself is - * obsoleted. - */ - if (retry_on_reset && rc == ECONNRESET) { - retry_on_reset--; - /* cppcheck-suppress usleepCalled */ - usleep(50 * 1000); - goto retry; - } - - fprintf(stderr, "Probe of %s failed\n", addr.sun_path); - - close(s); - } - - if (i == UNIX_SOCK_MAX) { - perror("connect"); - exit(EXIT_FAILURE); - } - - tv.tv_usec = 0; - if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) - perror("setsockopt, SO_RCVTIMEO reset"); - if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) - perror("setsockopt, SO_SNDTIMEO reset"); - - fprintf(stderr, "Connected to %s\n", addr.sun_path); - - if (dup2(s, (int)fd) < 0) { - perror("dup"); - exit(EXIT_FAILURE); - } - - close(s); - - if (qemu_argc) { - char **name; - - for (name = qemu_names; *name; name++) { - qemu_argv[0] = *name; - execvp(*name, qemu_argv); - if (errno != ENOENT) { - perror("execvp"); - usage(argv[0]); - } - } - if (errno == ENOENT) - fprintf(stderr, "Couldn't find qemu command\n"); - } else { - execvp(argv[2], argv + 2); - } - - perror("execvp"); - - return EXIT_FAILURE; -} diff --git a/tap.c b/tap.c index cf87591..dfa66c7 100644 --- a/tap.c +++ b/tap.c @@ -1377,8 +1377,6 @@ static void tap_backend_show_hints(const struct ctx *c) info("\nYou can now start qemu (>= 7.2, with commit 13c6be96618c):"); info(" kvm ... -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=%s", c->sock_path); - info("or qrap, for earlier qemu versions:"); - info(" ./qrap 5 kvm ... -net socket,fd=5 -net nic,model=virtio"); break; case MODE_VU: info("You can start qemu with:"); diff --git a/test/distro/opensuse b/test/distro/opensuse index eab722b..9ceb0bd 100644 --- a/test/distro/opensuse +++ b/test/distro/opensuse @@ -39,7 +39,7 @@ hostb ./passt -s __STATEDIR__/passt.socket -P __PIDFILE__ & sleep 1 host echo hout DNS6 sed -n 's/^nameserver $[^:]*:$$[^%]*$.*/\1\2/p' /etc/resolv.conf | head -1 -hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 qrap.1 Makefile README.md | tr '\n' ' '; echo +hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 Makefile README.md | tr '\n' ' '; echo test OpenSUSE Leap 15.1 -- 2.43.0

2 1

[PATCH] tap: Fix EAGAIN/EWOULDBLOCK check in tap_pasta_input()
by Hayato Kiwata 17 Jul '26

17 Jul '26

On Linux, EAGAIN and EWOULDBLOCK have the same value. Commit d2a1dc744b10 ("tap: Restructure in tap_pasta_input()") added a check for EWOULDBLOCK on purpose: > - Check for EWOULDBLOCK as well as EAGAIN for the benefit of any future > ports where those might not have the same value However, the condition uses && instead of ||, so it can never be true on a platform where EAGAIN and EWOULDBLOCK are different. Use || instead so that the check works as intended on such platforms. Fixes: d2a1dc744b10 ("tap: Restructure in tap_pasta_input()") Signed-off-by: Hayato Kiwata <dev(a)haytok.jp> --- tap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tap.c b/tap.c index d418961..cf87591 100644 --- a/tap.c +++ b/tap.c @@ -1329,7 +1329,7 @@ static void tap_pasta_input(struct ctx *c, const struct timespec *now) continue; } - if (errno == EAGAIN && errno == EWOULDBLOCK) + if (errno == EAGAIN || errno == EWOULDBLOCK) break; /* all done for now */ die("Error on tap device, exiting"); -- 2.39.5 (Apple Git-154)

3 2

[PATCH] pasta: Add --pass-fds option to preserve specific file descriptors
by Richard Lawrence 17 Jul '26

17 Jul '26

Introduce a new long-only command line option '--pass-fds' for pasta mode. This option accepts a comma-separated list of file descriptor numbers. It parses, validates, sorts, and deduplicates these file descriptors, and then skips closing them by calling close_range() on the gaps between them inside close_open_files(). The option is documented in the usage help and the passt.1 man page. Co-authored-by: rarensu <40872193+rarensu(a)users.noreply.github.com> Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot](a)users.noreply.github.com> Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 9 +++++- passt.1 | 5 ++++ util.c | 93 ++++++++++++++++++++++++++++++++++++++++++++++++++------- 3 files changed, 96 insertions(+), 11 deletions(-) diff --git a/conf.c b/conf.c index 5b6cc2b..0032d02 100644 --- a/conf.c +++ b/conf.c @@ -732,7 +732,9 @@ pasta_opts: " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" " --no-splice Disable inbound socket splicing\n" - " --splice-only Only enable loopback forwarding\n"); + " --splice-only Only enable loopback forwarding\n" + " --pass-fds FDS Comma-separated list of fds to pass to\n" + " the spawned command\n"); passt_exit(status); } @@ -1316,6 +1318,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"pass-fds", required_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1557,6 +1560,10 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--pass-fds is for pasta mode only"); + break; case 'd': c->debug = 1; c->quiet = 0; diff --git a/passt.1 b/passt.1 index 1570f6a..93c9b24 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ of local traffic in pasta\fR in the \fBNOTES\fR for more details. Do not create a tap device in the namespace. In this mode, \fIpasta\fR only forwards loopback traffic between namespaces. +.TP +.BR \-\-pass\-fds " " \fIfds\fR +Pass a comma-separated list of file descriptors to the spawned command. +These file descriptors will be kept open. + .SH EXAMPLES .SS \fBpasta diff --git a/util.c b/util.c index 4bc5d6f..c73fd74 100644 --- a/util.c +++ b/util.c @@ -932,29 +932,102 @@ const char *str_ee_origin(const struct sock_extended_err *ee) void close_open_files(int argc, char **argv) { const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, + { "pass-fds", required_argument, NULL, 33 }, { 0 }, }; long fd = -1; - int name, rc; + const char *pass_fds_arg = NULL; + int name, rc = 0; + int old_opterr = opterr; + opterr = 0; do { name = getopt_long(argc, argv, "-:F:", optfd, NULL); if (name == 'F') fd = conf_tap_fd(optarg); + else if (name == 33) + pass_fds_arg = optarg; } while (name != -1); + opterr = old_opterr; - if (fd == -1) { - rc = close_range(STDERR_FILENO + 1, ~0U, CLOSE_RANGE_UNSHARE); - } else if (fd == STDERR_FILENO + 1) { /* Still a single range */ - rc = close_range(STDERR_FILENO + 2, ~0U, CLOSE_RANGE_UNSHARE); - } else { - rc = close_range(STDERR_FILENO + 1, fd - 1, - CLOSE_RANGE_UNSHARE); - if (!rc) - rc = close_range(fd + 1, ~0U, CLOSE_RANGE_UNSHARE); + #define MAX_PASS_FDS 1024 + unsigned int keep_fds[MAX_PASS_FDS]; + int keep_fds_cnt = 0; + + if (fd != -1 && fd > STDERR_FILENO) { + keep_fds[keep_fds_cnt++] = (unsigned int)fd; + } + + if (pass_fds_arg) { + const char *p = pass_fds_arg; + while (*p) { + char *endptr; + unsigned long val = strtoul(p, &endptr, 10); + if (p == endptr) { + die("Invalid --pass-fds option: %s", pass_fds_arg); + } + if (val > INT_MAX || val <= STDERR_FILENO) { + die("Invalid file descriptor in --pass-fds: %lu", val); + } + if (keep_fds_cnt >= MAX_PASS_FDS) { + die("Too many file descriptors in --pass-fds"); + } + keep_fds[keep_fds_cnt++] = (unsigned int)val; + if (*endptr == ',') { + p = endptr + 1; + if (*p == '\0') { + die("Invalid --pass-fds option: trailing comma"); + } + } else if (*endptr == '\0') { + p = endptr; + } else { + die("Invalid character in --pass-fds option: %s", pass_fds_arg); + } + } } + /* Sort keep_fds in ascending order */ + for (int i = 1; i < keep_fds_cnt; i++) { + unsigned int key = keep_fds[i]; + int j = i - 1; + while (j >= 0 && keep_fds[j] > key) { + keep_fds[j + 1] = keep_fds[j]; + j--; + } + keep_fds[j + 1] = key; + } + + /* Remove duplicates */ + int write_idx = 0; + for (int i = 0; i < keep_fds_cnt; i++) { + if (i == 0 || keep_fds[i] != keep_fds[i - 1]) { + keep_fds[write_idx++] = keep_fds[i]; + } + } + keep_fds_cnt = write_idx; + + /* Close ranges */ + unsigned int current = STDERR_FILENO + 1; + for (int i = 0; i < keep_fds_cnt; i++) { + unsigned int f = keep_fds[i]; + if (current < f) { + int call_rc = close_range(current, f - 1, CLOSE_RANGE_UNSHARE); + if (call_rc != 0) + rc = call_rc; + } + current = f + 1; + } + if (keep_fds_cnt == 0 || keep_fds[keep_fds_cnt - 1] < ~0U) { + int call_rc = close_range(current, ~0U, CLOSE_RANGE_UNSHARE); + if (call_rc != 0) + rc = call_rc; + } + + /* Note: We assume that the parent process did not set FD_CLOEXEC on the + * passed file descriptors, so we do not explicitly clear it here. + */ + if (rc) { if (errno == ENOSYS || errno == EINVAL) { /* This probably means close_range() or the -- 2.52.0

3 2

[PATCH v2 1/6] passt: Always close pidfile_fd, not just when daemonizing
by David Gibson 17 Jul '26

17 Jul '26

In order to satisfy static checkers that we don't have an fd leak, a9c61ffaf153 added a close() of c->pidfile_fd, amongst others. However, it only close()s it in the case where we daemonize into the background. While less universally useful in the foreground / non-daemon case, it's perfectly reasonable to still have a pidfile. We'll still write it, and we should still close it. Cc: Jon Maloy <jmaloy(a)redhat.com> Fixes: a9c61ffaf153 ("util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/passt.c b/passt.c index 65a07d72..cc847ec2 100644 --- a/passt.c +++ b/passt.c @@ -420,11 +420,13 @@ int main(int argc, char **argv) if (!c->foreground) { __daemon(c->pidfile_fd, devnull_fd); - close(c->pidfile_fd); - c->pidfile_fd = -1; log_stderr = false; } else { pidfile_write(c->pidfile_fd, getpid()); + } + + if (c->pidfile_fd >= 0) { + close(c->pidfile_fd); c->pidfile_fd = -1; } -- 2.55.0

1 0

passt: new version 2026_07_16.090d739 available
by Stefano Brivio 17 Jul '26

17 Jul '26

The new version with tag 2026_07_16.090d739 includes the following changes: 090d739 passt.1, pesto.1: ::1 is an address, not a port 7d0c077 dhcp: Make option parsing more robust, explicitly handle options 0 and 255 10847ad CONTRIBUTING.md: The tag is "Link:", regardless of how many we have a3b9f86 udp_vu: Check iov_tail_clone() return before assigning to msg_iovlen 80cb5cf passt: Initialise listening socket fds to -1 fc6c774 fwd: Don't rewrite inbound multicast destinations 9013b59 fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() addd76d fwd: Rework default address logic for inbound flows 66fdabd udp: Validate that we have a unicast source address 26f2130 fwd: Clarify semantics of --host-lo-to-ns-lo fce9430 dhcpv6: Fix reply destination to match client's source address e74a7c2 selinux: Access to netns for podman-build, read access for netns in general 6ef3d1c isolation: Add --chroot-fallback option e67acde fwd, fwd_rule: Implement configurable target address mapping c8145c3 fwd_rule: Parse target addresses for forwarding rules bf21038 fwd_rule: Rewrite forward rule parsing using parse.c helpers 0581b0a fwd_rule: Allow "all" port specs to be combined with other options 289638b conf: Use new parsing tools to handle -a option b1d400f conf: Remove unnecessary mode checks from conf_addr() aaa0482 conf: Move address configuration into helper function 11f4fba parse: Add helpers for parsing IP addresses 4206913 parse: Move parse_port_range() to new parsing framework 8ffff9b parse: Add helper to parse unsigned integer values 9f8fcdc conf: Clean up conf_ip4_prefix() 2cdb27a conf: Remove duplicate parsing of -F option d29eb29 parse: Start splitting out parsing helpers cea54dd conf: Use parameter instead of global in conf_nat() e51a545 Makefile: Add missing PESTO_HEADERS variable edeb2a2 udp: Improve messages for errors getting errors 74863b0 flow, treewide: Promote priority of selected flow-linked messages 60cd39a flow, udp: Fix errno handling in udp_flow_sock() 780ba8a flow: Include flow details with higher priority log messages 2fbeb3b flow: Indent flow details messages d66a3f1 flow: Regularise flow specific logging helpers 3f57f03 tap: don't let overheard traffic move addr_seen when address is explicit f072bc0 tap: Trim Ethernet padding from short IPv4 frames instead of dropping them 41566e1 inany: Fix doc comment to match u32 field, not u64 ab2260a pif, util: Move listen(2) call from sock_l4_() to pif_listen() 50e3dcc fwd, pif: Remove duplicated logic between tcp_listen() and udp_listen() d5ef43d Makefile: Remove unused DUAL_STACK_SOCKETS define 6d1f38c flow: Correct misleading signature of flowside_sock_l4() 900ea8b tcp: MAX_WINDOW should be unsigned 19cd4ba tcp: Avoid SEQ_*() comparisons against 0 751a6f1 tcp: Merge common sequence logic from tcp_{buf,vu}_data_from_sock() 4604860 cppcheck: Add workaround for cppcheck bug 14847 96c4a9d cppcheck: Remove unused CPPCHECK_6936 https://passt.top/passt/log/?qt=range&q=2026_06_11.a9c61ff..2026_07_16.090d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10734380/ permanent mirror: https://passt.top/builds/copr/0^20260716.g090d739/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g090d739-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_090d739-1_all.deb -- Stefano

1 0

[PATCH v2 0/4] Assorted fixes, address a static checker warning
by Stefano Brivio 16 Jul '26

16 Jul '26

These are small assorted fixes and a change to address a static checker warning I had on my list for a while but never found the time to polish up for sending. So here they are. There's no particular relationship between patches, they are actually independent changes. v2: Changes suggested by David in 2/4 and 4/4, while 1/4 and 3/4 are unchanged Stefano Brivio (4): CONTRIBUTING.md: The tag is "Link:", regardless of how many we have dhcp: Make option parsing more robust, explicitly handle options 0 and 255 passt.1, pesto.1: ::1 is an address, not a port ndp: Use high quality entropy in NDP timer even if not needed CONTRIBUTING.md | 2 +- dhcp.c | 22 +++++++++++++--------- ndp.c | 12 ++++++++---- passt.1 | 2 +- pesto.1 | 2 +- 5 files changed, 24 insertions(+), 16 deletions(-) -- 2.43.0

2 7

[PATCH 0/6] Fix bug 215 and some related issues with fd handling
by David Gibson 16 Jul '26

16 Jul '26

Stefano, you called it correctly. While working on bug 215, as usual, I found a bunch of adjacent things to clean up. I did start by attempting the appoach you suggested for bug 215 - remembering which of the low fds were standard streams and avoiding closing them in __daemon(). It is indeed shorter, but only by 1-2 lines. Looking at possible interactions with other things, I became more and more convinced that leaving anything other than the standard streams in fds 0-2 was an accident waiting to happen. Much of the rest of the series is, for example, dealing with the possibility of --fd [012]. David Gibson (6): isolation, util: Fold close_open_files() into isolate_initial() isolation, conf: Set c->fd_tap from eary parse of --fd conf: Make conf_tap_fd() operate more like conf_mode() isolation: Move --fd descriptor to a number of our choosing main: Ensure fds 0-2 are populated passt: *Always* close pidfile_fd, not just when daemonizing conf.c | 31 +++++++++++++++++++++++-------- conf.h | 2 +- isolation.c | 32 ++++++++++++++++++++++++++++++-- isolation.h | 2 +- passt.c | 27 +++++++++++++++++---------- util.c | 52 +--------------------------------------------------- util.h | 1 - 7 files changed, 73 insertions(+), 74 deletions(-) -- 2.55.0

2 14

[PATCH 0/4] Assorted fixes, address a static checker warning
by Stefano Brivio 16 Jul '26

16 Jul '26

These are small assorted fixes and a change to address a static checker warning I had on my list for a while but never found the time to polish up for sending. So here they are. There's no particular relationship between patches, they are actually independent changes. Stefano Brivio (4): CONTRIBUTING.md: The tag is "Link:", regardless of how many we have dhcp: Make option parsing more robust, explicitly handle options 0 and 255 passt.1, pesto.1: ::1 is an address, not a port ndp: Use high quality entropy in NDP timer even if not needed CONTRIBUTING.md | 2 +- dhcp.c | 10 +++++++++- ndp.c | 11 +++++++---- passt.1 | 2 +- pesto.1 | 2 +- 5 files changed, 19 insertions(+), 8 deletions(-) -- 2.43.0

2 11