July 2026 - dev

[PATCH v8 01/14] dhcpv6: Fix reply destination to match client's source address
by Jon Maloy 09 Jul '26

09 Jul '26

tap_ip6_daddr() selects the reply destination based on our source address type (link-local), so it always returns addr_ll_seen. But if the client sent from a global address, we would reply to an address different from what the client is expecting. Since RFC 9915 (section 18.3.10) allows clients to use global addresses for DHCPv6, we now correct this, and always respond to the address the client was using. We also remove a redundant addr_ll_seen assignment, since this is already done by tap.c when processing IPv6 packets. Note: if the client uses a global source address, our reply will still have a link-local source, creating a scope mismatch. Fixing this properly would require a mechanism to allocate a global address for the DHCPv6 server, which we currently don't have. Responding to the client's actual source address is still a net improvement over the previous behavior of replying to an unrelated cached address. Note 2: This commit isn't actually a fix to an observed problem, but rather an answer to a theoretical issue, adding completeness to the mechanism and simplifying subsequent changes in this series. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v8: -Updated commit log, acknowledging concerns expressed by David and Stefano. -Some minor changes also addressing feedback from the same persons. --- dhcpv6.c | 16 ++++++++-------- dhcpv6.h | 2 +- tap.c | 15 --------------- tap.h | 2 -- 4 files changed, 9 insertions(+), 26 deletions(-) diff --git a/dhcpv6.c b/dhcpv6.c index 97c04e2c..29c7e320 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -370,12 +370,14 @@ notonlink: /** * dhcpv6_send_ia_notonlink() - Send NotOnLink status * @c: Execution context + * @caddr: Source address of client message (reply destination) * @ia_base: Non-appropriate IA_NA or IA_TA base * @client_id_base: Client ID message option base * @len: Client ID length * @xid: Transaction ID for message exchange */ static void dhcpv6_send_ia_notonlink(struct ctx *c, + const struct in6_addr *caddr, const struct iov_tail *ia_base, const struct iov_tail *client_id_base, int len, uint32_t xid) @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, resp_not_on_link.hdr.xid = xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - xid, &resp_not_on_link, n); + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); } /** @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh)) return -1; - c->ip6.addr_ll_seen = *saddr; - src = &c->ip6.our_tap_ll; mh = IOV_REMOVE_HEADER(data, mh_storage); @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { - dhcpv6_send_ia_notonlink(c, data, &client_id_base, - ntohs(client_id->l), mh->xid); + dhcpv6_send_ia_notonlink(c, saddr, data, + &client_id_base, + ntohs(client_id->l), + mh->xid); return 1; } @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - mh->xid, &resp, n); + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); c->ip6.addr_seen = c->ip6.addr; return 1; diff --git a/dhcpv6.h b/dhcpv6.h index c706dfdb..1015a1a7 100644 --- a/dhcpv6.h +++ b/dhcpv6.h @@ -7,7 +7,7 @@ #define DHCPV6_H int dhcpv6(struct ctx *c, struct iov_tail *data, - struct in6_addr *saddr, struct in6_addr *daddr); + const struct in6_addr *saddr, const struct in6_addr *daddr); void dhcpv6_init(const struct ctx *c); #endif /* DHCPV6_H */ diff --git a/tap.c b/tap.c index 6d93c7ce..d4189617 100644 --- a/tap.c +++ b/tap.c @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len) } } -/** - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets - * @c: Execution context - * @src: Source address - * - * Return: pointer to IPv6 address - */ -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src) -{ - if (IN6_IS_ADDR_LINKLOCAL(src)) - return &c->ip6.addr_ll_seen; - return &c->ip6.addr_seen; -} - /** * tap_push_l2h() - Build an L2 header for an inbound packet * @c: Execution context diff --git a/tap.h b/tap.h index 07ca0965..b335933f 100644 --- a/tap.h +++ b/tap.h @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr src, in_port_t sport, const void *in, size_t dlen); void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_addr dst, const void *in, const void *src_mac, size_t l4len); -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src); void *tap_push_ip6h(struct ipv6hdr *ip6h, const struct in6_addr *src, const struct in6_addr *dst, size_t l4len, uint8_t proto, uint32_t flow); -- 2.52.0

2 1

[PATCH v2] isolation: Add --chroot-fallback option
by Mateusz Andrzejewski 08 Jul '26

08 Jul '26

For integrations, which use rootfs on tmpfs or initramfs, it is not allowed to use pivot_root(). It results with invalid argument (EINVAL) error. Introduce --chroot-fallback option as a workaround with MS_MOVE + chroot(). Due to weaker isolation of chroot() method (we don't unmount old root), user has tu explicitly enable fallback with the new option. First, always try to sandbox with pivot_root(). In both cases the new root is placed into an empty tmpfs. For the solution to work we keep CAP_SYS_CHROOT capability, which is dropped at the end of the isolate_prefork() function. Link: https://bugs.passt.top/show_bug.cgi?id=104 Signed-off-by: Mateusz Andrzejewski <mateusz.andrzejewski(a)mikronika.com.pl> --- Changes since v1: - added a description of the new option to the man page - renamed option to --chroot-fallback - removed auxiliary variable in conf() - passed execution context to isolate_user() - fixed indentation and other coding style issues - fixed cppcheck issue with variableScope in isolate_prefork() Direct write to &c->chroot_fallback is not valid, because it's a bool variable and compilation results with an incompatible-pointer-types warning (int* expected). To fix this, the assignment was moved to the '32' label in the switch statement and the temporary helper variable could be removed. This follows the same pattern of other boolean options. conf.c | 8 +++++- isolation.c | 71 ++++++++++++++++++++++++++++++++++++++++++----------- isolation.h | 4 +-- passt.1 | 9 +++++++ passt.h | 2 ++ 5 files changed, 77 insertions(+), 17 deletions(-) diff --git a/conf.c b/conf.c index 4755a9f..6755bf6 100644 --- a/conf.c +++ b/conf.c @@ -654,6 +654,8 @@ static void usage(const char *name, FILE *f, int status) " --no-ra Disable router advertisements\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" + " --chroot-fallback Use chroot() if pivot_root() fails\n" + " can be useful for rootfs on tmpfs or initramfs\n" " -4, --ipv4-only Enable IPv4 operation only\n" " -6, --ipv6-only Enable IPv6 operation only\n" " -t, --tcp-ports SPEC TCP port forwarding to %s\n" @@ -1233,6 +1235,7 @@ void conf(struct ctx *c, int argc, char **argv) {"migrate-no-linger", no_argument, NULL, 30 }, {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, + {"chroot-fallback", no_argument, NULL, 32 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1467,6 +1470,9 @@ void conf(struct ctx *c, int argc, char **argv) die("Can't display statistics if not running in foreground"); c->stats = strtol(optarg, NULL, 0); break; + case 32: + c->chroot_fallback = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1879,7 +1885,7 @@ void conf(struct ctx *c, int argc, char **argv) conf_open_files(c); /* Before any possible setuid() / setgid() */ - isolate_user(uid, gid, !netns_only, userns, c->mode); + isolate_user(c, uid, gid, !netns_only, userns); if (c->no_icmp) c->no_ndp = 1; diff --git a/isolation.c b/isolation.c index 7e6225d..08e4008 100644 --- a/isolation.c +++ b/isolation.c @@ -166,6 +166,31 @@ static void clamp_caps(void) die_perror("Couldn't drop inheritable capabilities"); } +/** + * move_root() - Use chroot() instead of pivot_root() for sandboxing + * + * Return: negative error code on failure, zero on success + */ +static int move_root(void) +{ + if (mount(TMPDIR, "/", "", MS_MOVE, "")) { + err_perror("Failed to move root into empty tmpfs"); + return -errno; + } + + if (chroot(".")) { + err_perror("Failed to chroot() into empty tmpfs"); + return -errno; + } + + if (chdir("/")) { + err_perror("Failed to change directory into new root"); + return -errno; + } + + return 0; +} + /** * isolate_initial() - Early, mostly config independent self isolation * @argc: Argument count @@ -195,14 +220,18 @@ void isolate_initial(int argc, char **argv) * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces * + * We have to keep CAP_SYS_CHROOT in case of --chroot-fallback option + * being enabled, so we can fallback from pivot_root() to chroot() in + * isolate_prefork(). + * * It's debatable whether it's useful to drop caps when we * retain SETUID and SYS_ADMIN, but we might as well. We drop * further capabilities in isolate_user() and * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); - + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE) | + BIT(CAP_SYS_CHROOT); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child * from a non-init user namespace (pasta can't run as root), we need to @@ -220,11 +249,11 @@ void isolate_initial(int argc, char **argv) /** * isolate_user() - Switch to final UID/GID and move into userns + * @c: Execution context * @uid: User ID to run as (in original userns) * @gid: Group ID to run as (in original userns) * @use_userns: Whether to join or create a userns * @userns: userns path to enter, may be empty - * @mode: Mode (passt or pasta) * * Should: * - set our final UID and GID @@ -232,8 +261,8 @@ void isolate_initial(int argc, char **argv) * Mustn't: * - remove filesystem access (we need that for further setup) */ -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode) +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns) { uint64_t ns_caps = 0; @@ -277,7 +306,14 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, * netns */ ns_caps |= BIT(CAP_SYS_ADMIN); - if (mode == MODE_PASTA) { + + /* Only keep CAP_SYS_CHROOT for the --chroot-fallback case. Otherwise + * it can be dropped + */ + if (c->chroot_fallback) + ns_caps |= BIT(CAP_SYS_CHROOT); + + if (c->mode == MODE_PASTA) { /* Keep CAP_NET_ADMIN, so we can configure the if */ ns_caps |= BIT(CAP_NET_ADMIN); /* Keep CAP_NET_BIND_SERVICE, so we can splice @@ -331,7 +367,7 @@ int isolate_prefork(const struct ctx *c) if (mount("", TMPDIR, "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, "nr_inodes=2,nr_blocks=0")) { - err_perror("Failed to mount empty tmpfs for pivot_root()"); + err_perror("Failed to mount empty tmpfs for sandboxing"); return -errno; } @@ -341,13 +377,20 @@ int isolate_prefork(const struct ctx *c) } if (syscall(SYS_pivot_root, ".", ".")) { - err_perror("Failed to pivot_root() into empty tmpfs"); - return -errno; - } - - if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { - err_perror("Failed to unmount original root filesystem"); - return -errno; + if (c->chroot_fallback) { + int rc; + info("Failed to pivot_root(), fallback to chroot()..."); + if ((rc = move_root())) + return rc; + } else { + err_perror("Failed to pivot_root() into empty tmpfs"); + return -errno; + } + } else { + if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { + err_perror("Failed to unmount original root filesystem"); + return -errno; + } } /* Now that initialization is more-or-less complete, we can diff --git a/isolation.h b/isolation.h index 0576168..66b6968 100644 --- a/isolation.h +++ b/isolation.h @@ -11,8 +11,8 @@ #include <unistd.h> void isolate_initial(int argc, char **argv); -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode); +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns); int isolate_prefork(const struct ctx *c); void isolate_postfork(const struct ctx *c); diff --git a/passt.1 b/passt.1 index 908fd4a..8a33c2e 100644 --- a/passt.1 +++ b/passt.1 @@ -393,6 +393,15 @@ as destination, to the host. Implied if there is no gateway on the selected default route, or if there is no default route, for any of the enabled address families. +.TP +.BR \-\-chroot-fallback +Enable a fallback to chroot() in case pivot_root() returns an error. Useful for +integrations, which use rootfs on tmpfs or initramfs, where it is not allowed to +use pivot_root(), because it results with an invalid argument error (EINVAL). + +By default, fallback is disabled. If pivot_root() fails, then the entire +sandboxing process fails. + .TP .BR \-\-map-guest-addr " " \fIaddr Translate \fIaddr\fR in the guest to be equal to the guest's assigned diff --git a/passt.h b/passt.h index 16506dc..a20148e 100644 --- a/passt.h +++ b/passt.h @@ -214,6 +214,7 @@ struct ip6_ctx { * @splice_only: Only enable loopback forwarding * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding + * @chroot_fallback: Use chroot() in case pivot_root() fails * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max * @no_bindtodevice: Unprivileged SO_BINDTODEVICE not available @@ -299,6 +300,7 @@ struct ctx { int splice_only; int host_lo_to_ns_lo; int freebind; + bool chroot_fallback; int low_wmem; int low_rmem; -- 2.43.7

2 3

[PATCH v4 0/2] Target address mapping
by David Gibson 08 Jul '26

08 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. v4: * Add suggested command line fix if attempting a forward from dual stack address to a specific address v3: * Moved target address validation to fwd_rule_add() and tidied up a bit * Some readability tweaks to man page v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++- fwd_rule.c | 114 ++++++++++++++++++++++++++++++++++++++++++++--------- fwd_rule.h | 7 +++- passt.1 | 31 ++++++++++----- pesto.h | 6 ++- 5 files changed, 134 insertions(+), 32 deletions(-) -- 2.55.0

2 3

[PATCH v2 0/2] Target address mapping
by David Gibson 07 Jul '26

07 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. Based on v4 of my parsing rework series. v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++-- fwd_rule.c | 101 +++++++++++++++++++++++++++++++++++++++++++---------- fwd_rule.h | 7 ++-- passt.1 | 31 +++++++++++----- pesto.h | 6 +++- 5 files changed, 121 insertions(+), 32 deletions(-) -- 2.55.0

2 6

[PATCH v3 2/2] fwd, fwd_rule: Implement configurable target address mapping
by David Gibson 06 Jul '26

06 Jul '26

From: Stefano Brivio <sbrivio(a)redhat.com> Add a 'taddr' field to forwarding rules, which controls the destination address on the target side. Since changing the structure alters the pesto update protocol, bump the protocol version number Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> [dwg: Split from option parsing code, added protocol version bump, explicitly exclude splicing with target address for now] Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 8 ++++++-- fwd_rule.c | 51 +++++++++++++++++++++++++++++++++++++++------------ fwd_rule.h | 7 +++++-- pesto.h | 6 +++++- 4 files changed, 55 insertions(+), 17 deletions(-) diff --git a/fwd.c b/fwd.c index 042158cf..3ae25fde 100644 --- a/fwd.c +++ b/fwd.c @@ -1023,7 +1023,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, /* Common for spliced and non-spliced cases */ tgt->eport = rule->to + (ini->oport - rule->first); - if (!c->no_splice && inany_is_loopback(&ini->eaddr) && + /* TODO: Allow splicing with specified target address */ + if (!c->no_splice && inany_is_unspecified(&rule->taddr) && + inany_is_loopback(&ini->eaddr) && (proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { /* spliceable */ @@ -1074,7 +1076,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (inany_v4(&tgt->oaddr)) { + if (!inany_is_unspecified(&rule->taddr)) { + tgt->eaddr = rule->taddr; + } else if (inany_v4(&tgt->oaddr)) { tgt->eaddr = inany_from_v4(c->ip4.addr_seen); } else { if (inany_is_linklocal6(&tgt->oaddr)) diff --git a/fwd_rule.c b/fwd_rule.c index 42ec68e3..0857253d 100644 --- a/fwd_rule.c +++ b/fwd_rule.c @@ -115,10 +115,15 @@ __attribute__((noinline)) const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size) { const char *percent = *rule->ifname ? "%" : ""; + char taddr[INANY_ADDRSTRLEN] = { 0 }; const char *weak = "", *scan = ""; char addr[INANY_ADDRSTRLEN]; int len; + if (!inany_is_unspecified(&rule->taddr)) { + (void)snprintf(taddr, sizeof(taddr), "%s:", + inany_ntop(&rule->taddr, addr, sizeof(addr))); + } inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr)); if (rule->flags & FWD_WEAK) weak = " (best effort)"; @@ -127,16 +132,17 @@ const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size) if (rule->first == rule->last) { len = snprintf(dst, size, - "%s [%s]%s%s:%hu => %hu %s%s", + "%s [%s]%s%s:%hu => %s%hu %s%s", ipproto_name(rule->proto), addr, percent, - rule->ifname, rule->first, rule->to, weak, scan); + rule->ifname, rule->first, + taddr, rule->to, weak, scan); } else { in_port_t tolast = rule->last - rule->first + rule->to; len = snprintf(dst, size, - "%s [%s]%s%s:%hu-%hu => %hu-%hu %s%s", + "%s [%s]%s%s:%hu-%hu => %s%hu-%hu %s%s", ipproto_name(rule->proto), addr, percent, rule->ifname, rule->first, rule->last, - rule->to, tolast, weak, scan); + taddr, rule->to, tolast, weak, scan); } if (len < 0 || (size_t)len >= size) @@ -325,6 +331,34 @@ int fwd_rule_add(struct fwd_table *fwd, const struct fwd_rule *new) return -EINVAL; } + if (!inany_is_unspecified(&new->taddr)) { + char tastr[INANY_ADDRSTRLEN]; + + if (inany_is_multicast(&new->taddr)) { + warn("Multicast target address %s for forwarding rule", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + + if (new->flags & FWD_DUAL_STACK_ANY) { + warn("Dual stack forward to %s address %s unsupported", + inany_v4(&new->taddr) ? "IPv4" : "IPv6", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + + if (!!inany_v4(&new->addr) != !!inany_v4(&new->taddr)) { + char lastr[INANY_ADDRSTRLEN]; + + warn("Forward from %s (%s) to %s (%s) unsupported", + inany_v4(&new->addr) ? "IPv4" : "IPv6", + inany_ntop(&new->addr, lastr, sizeof(lastr)), + inany_v4(&new->taddr) ? "IPv4" : "IPv6", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + } + for (i = 0; i < fwd->count; i++) { char newstr[FWD_RULE_STRLEN], rulestr[FWD_RULE_STRLEN]; @@ -393,6 +427,7 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, { struct fwd_rule rule = { .addr = addr ? *addr : inany_any6, + .taddr = tgt_addr ? *tgt_addr : inany_any6, .ifname = { 0 }, .proto = proto, .flags = flags, @@ -401,14 +436,6 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, char rulestr[FWD_RULE_STRLEN]; unsigned base, i; - if (tgt_addr && !inany_is_unspecified(tgt_addr)) { - char astr[INANY_ADDRSTRLEN]; - - info("Target address: %s", - inany_ntop(tgt_addr, astr, sizeof(astr))); - die("Target address remapping not yet implemented"); - } - if (!addr) rule.flags |= FWD_DUAL_STACK_ANY; if (ifname) { diff --git a/fwd_rule.h b/fwd_rule.h index 435be5bd..a8788318 100644 --- a/fwd_rule.h +++ b/fwd_rule.h @@ -33,6 +33,7 @@ /** * struct fwd_rule - Forwarding rule governing a range of ports * @addr: Address to forward from + * @taddr: Target side destination address * @ifname: Interface to forward from * @first: First port number to forward * @last: Last port number to forward @@ -45,6 +46,7 @@ */ struct fwd_rule { union inany_addr addr; + union inany_addr taddr; char ifname[IFNAMSIZ]; in_port_t first; in_port_t last; @@ -91,10 +93,11 @@ void fwd_probe_ephemeral(void); #define FWD_RULE_STRLEN \ (IPPROTO_STRLEN - 1 \ - + INANY_ADDRSTRLEN - 1 \ + + INANY_ADDRSTRLEN - 1 /* listen addr */ \ + + INANY_ADDRSTRLEN - 1 /* target addr */ \ + IFNAMSIZ - 1 \ + 4 * (UINT16_STRLEN - 1) \ - + sizeof(" []%:- => - (best effort) (auto-scan)")) + + sizeof(" []%:- => :- (best effort) (auto-scan)")) const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule); const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size); diff --git a/pesto.h b/pesto.h index 980cc17d..8db701b4 100644 --- a/pesto.h +++ b/pesto.h @@ -15,7 +15,11 @@ #define PESTO_SERVER_MAGIC "basil:s" /* Version 0 is reserved for unreleased / unsupported experimental versions */ -#define PESTO_PROTOCOL_VERSION 1 +/* Version 1 had no target address field in struct fwd_rule. It was released, + * but was little enough used that we decided not to implement backwards + * compatiblity code (i.e. a v2 pesto will not work with a v1 pasta) + */ +#define PESTO_PROTOCOL_VERSION 2 /* Maximum size of a pif name, including \0 */ #define PIF_NAME_SIZE (128) -- 2.55.0

1 0

[PATCH v3 0/2] Target address mapping
by David Gibson 06 Jul '26

06 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. v3: * Moved target address validation to fwd_rule_add() and tidied up a bit * Some readability tweaks to man page v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++- fwd_rule.c | 112 ++++++++++++++++++++++++++++++++++++++++++++--------- fwd_rule.h | 7 +++- passt.1 | 31 ++++++++++----- pesto.h | 6 ++- 5 files changed, 132 insertions(+), 32 deletions(-) -- 2.55.0

1 1

[PATCH v5 00/13] Rework option parsing in preparation for destination remapping
by David Gibson 04 Jul '26

04 Jul '26

This was... a bit of a nightmare. It took way too long and went down a bunch of blind alleys. I'm not sure how much I like the final result: it's pleasingly terse in some cases, but in others it feels dangerously subtle, requiring a pretty careful understanding of the sequencing rules of C's &&, || and , operators. That said, while I was at many points ready to pack it in and hack my around the problems limiting the parsing for destination remapping, I couldn't really think of feasible way to do that either. So, here we are. v5: * Improvements to manpages and usage in 12/13 * No other changes v4: * Update manpages and --help to reflect changes in 12/13 * No other changes v3: * Fixed validation of ifnames in 13/13. * No other changes. v2: * Numerous minor tweaks based on Stefano's feedback. * The "minor issues" aren't actually minor - they're hard to solve in C, remain. David Gibson (13): Makefile: Add missing PESTO_HEADERS variable conf: Use parameter instead of global in conf_nat() parse: Start splitting out parsing helpers conf: Remove duplicate parsing of -F option conf: Clean up conf_ip4_prefix() parse: Add helper to parse unsigned integer values parse: Move parse_port_range() to new parsing framework parse: Add helpers for parsing IP addresses conf: Move address configuration into helper function conf: Remove unnecessary mode checks from conf_addr() conf: Use new parsing tools to handle -a option fwd_rule: Allow "all" port specs to be combined with other options fwd_rule: Rewrite forward rule parsing using parse.c helpers Makefile | 22 +-- common.h | 3 + conf.c | 218 ++++++++++++++++------------- conf.h | 1 + fwd_rule.c | 400 ++++++++++++++++++++++++----------------------------- fwd_rule.h | 2 - inany.c | 70 +--------- inany.h | 3 - parse.c | 244 ++++++++++++++++++++++++++++++++ parse.h | 37 +++++ passt.1 | 35 +++-- util.c | 12 +- 12 files changed, 621 insertions(+), 426 deletions(-) create mode 100644 parse.c create mode 100644 parse.h -- 2.55.0

2 14

[PATCH 0/3] Fix broken build with -DNDEBUG
by David Gibson 04 Jul '26

04 Jul '26

Fix the trivial but nasty with -DNDEBUG builds recently reported by Jan Palus. While we're there, add a couple of extra build tests. These wouldn't actually catch this problem, but they're better than nothing and do catch the #include problem I also spotted. David Gibson (3): test: Extend exeter build tests to cover more recent binaries Fix build with -DNDEBUG test: Add test for builds with -DNDEBUG test/build/build.py | 25 +++++++++++++++++++++---- util.h | 3 ++- 2 files changed, 23 insertions(+), 5 deletions(-) -- 2.54.0

3 6

[PATCH v4 00/13] Rework option parsing in preparation for destination remapping
by David Gibson 03 Jul '26

03 Jul '26

This was... a bit of a nightmare. It took way too long and went down a bunch of blind alleys. I'm not sure how much I like the final result: it's pleasingly terse in some cases, but in others it feels dangerously subtle, requiring a pretty careful understanding of the sequencing rules of C's &&, || and , operators. That said, while I was at many points ready to pack it in and hack my around the problems limiting the parsing for destination remapping, I couldn't really think of feasible way to do that either. So, here we are. v4: * Update manpages and --help to reflect changes in 12/13 * No other changes v3: * Fixed validation of ifnames in 13/13. * No other changes. v2: * Numerous minor tweaks based on Stefano's feedback. * The "minor issues" aren't actually minor - they're hard to solve in C, remain. David Gibson (13): Makefile: Add missing PESTO_HEADERS variable conf: Use parameter instead of global in conf_nat() parse: Start splitting out parsing helpers conf: Remove duplicate parsing of -F option conf: Clean up conf_ip4_prefix() parse: Add helper to parse unsigned integer values parse: Move parse_port_range() to new parsing framework parse: Add helpers for parsing IP addresses conf: Move address configuration into helper function conf: Remove unnecessary mode checks from conf_addr() conf: Use new parsing tools to handle -a option fwd_rule: Allow "all" port specs to be combined with other options fwd_rule: Rewrite forward rule parsing using parse.c helpers Makefile | 22 +-- common.h | 3 + conf.c | 220 ++++++++++++++++------------- conf.h | 1 + fwd_rule.c | 400 ++++++++++++++++++++++++----------------------------- fwd_rule.h | 2 - inany.c | 70 +--------- inany.h | 3 - parse.c | 244 ++++++++++++++++++++++++++++++++ parse.h | 37 +++++ passt.1 | 33 +++-- util.c | 12 +- 12 files changed, 621 insertions(+), 426 deletions(-) create mode 100644 parse.c create mode 100644 parse.h -- 2.55.0

2 13

[PATCH v3 00/13] Rework option parsing in preparation for destination remapping
by David Gibson 02 Jul '26

02 Jul '26

This was... a bit of a nightmare. It took way too long and went down a bunch of blind alleys. I'm not sure how much I like the final result: it's pleasingly terse in some cases, but in others it feels dangerously subtle, requiring a pretty careful understanding of the sequencing rules of C's &&, || and , operators. That said, while I was at many points ready to pack it in and hack my around the problems limiting the parsing for destination remapping, I couldn't really think of feasible way to do that either. So, here we are. v3: * Fixed validation of ifnames in 13/13. * No other changes. v2: * Numerous minor tweaks based on Stefano's feedback. * The "minor issues" aren't actually minor - they're hard to solve in C, remain. David Gibson (13): Makefile: Add missing PESTO_HEADERS variable conf: Use parameter instead of global in conf_nat() parse: Start splitting out parsing helpers conf: Remove duplicate parsing of -F option conf: Clean up conf_ip4_prefix() parse: Add helper to parse unsigned integer values parse: Move parse_port_range() to new parsing framework parse: Add helpers for parsing IP addresses conf: Move address configuration into helper function conf: Remove unnecessary mode checks from conf_addr() conf: Use new parsing tools to handle -a option fwd_rule: Allow "all" port specs to be combined with other options fwd_rule: Rewrite forward rule parsing using parse.c helpers Makefile | 22 +-- common.h | 3 + conf.c | 209 ++++++++++++++++------------ conf.h | 1 + fwd_rule.c | 400 ++++++++++++++++++++++++----------------------------- fwd_rule.h | 2 - inany.c | 70 +--------- inany.h | 3 - parse.c | 244 ++++++++++++++++++++++++++++++++ parse.h | 37 +++++ util.c | 12 +- 11 files changed, 600 insertions(+), 403 deletions(-) create mode 100644 parse.c create mode 100644 parse.h -- 2.54.0

1 13