September 2026 - dev

[PATCH v2] feat: Pass open files to child in pasta mode
by Richard Lawrence 21 Oct '26

21 Oct '26

When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. The strategy used here is to delay the closing of inherited file descriptors until after pasta has forked to execute the COMMAND, which happens during the call to `conf()`. A nice side-effect is that the `--fd` argument no longer needs to be parsed early, and can rejoin the other args parsed normally in `conf()`. Highlighted changes: - `conf_tap_fd()` is now called directly by `conf()`. - The tap fd is relocated to a number at least 3, rather than exactly 3. - `snapshot_initial_fds()` memorizes inherited fds early in startup. - Inherited fds are discovered by reading from `/proc` if available. - `isolate_fds()` is now called after `conf()` in `main()`. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 39 ++++++++------- conf.h | 1 - isolation.c | 135 ++++++++++++++++++++++++++++++++++++---------------- isolation.h | 9 +++- passt.c | 7 ++- 5 files changed, 129 insertions(+), 62 deletions(-) diff --git a/conf.c b/conf.c index faf2681..6bfdfb6 100644 --- a/conf.c +++ b/conf.c @@ -1169,26 +1169,20 @@ static void conf_sock_listen(const struct ctx *c) } /** - * conf_tap_fd() - Read tap fd as supplied by -F command line option - * @argc: Argument count - * @argv: Command line options + * conf_tap_fd() - Read and relocate tap fd as supplied by -F command line option + * @fdarg: String containing fd + * + * Should: + * - move the --fd descriptor out of the range 0-2 * * Return: fd number from --fd option, or -1 if not supplied */ -int conf_tap_fd(int argc, char **argv) +int conf_tap_fd(const char *fdarg) { - const struct option optfd[] = { { "fd", required_argument, NULL, 'F' }, - { 0 }, }; - const char *fdarg = NULL, *p; unsigned long val; - int name; - - optind = 0; - do { - name = getopt_long(argc, argv, "-:F:", optfd, NULL); - if (name == 'F') - fdarg = optarg; - } while (name != -1); + const char *p; + int new_fd; + int fd; if (!fdarg) return -1; @@ -1197,7 +1191,18 @@ int conf_tap_fd(int argc, char **argv) if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || val > INT_MAX) die("Invalid --fd: %s", fdarg); - return val; + fd = (int)val; + if (fd >= 0 && fd < 3) { + new_fd = fcntl(fd, F_DUPFD, 3); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); + + close(fd); + fd = new_fd; + } + + return fd; } /** @@ -1625,7 +1630,7 @@ void conf(struct ctx *c, int argc, char **argv) c->fd_control_listen = c->fd_control = -1; break; case 'F': - /* --fd was parsed early and c->fd_tap set in main() */ + c->fd_tap = conf_tap_fd(optarg); c->one_off = true; *c->sock_path = 0; break; diff --git a/conf.h b/conf.h index 19bf9bc..16f9718 100644 --- a/conf.h +++ b/conf.h @@ -7,7 +7,6 @@ #define CONF_H enum passt_modes conf_mode(int argc, char *argv[]); -int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); void conf_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..2434748 100644 --- a/isolation.c +++ b/isolation.c @@ -24,19 +24,13 @@ * done anything we need to do with those resources, so we have * multiple stages of self-isolation. In order these are: * - * 1a. isolate_initial() + * 1. isolate_initial() * ==================== * * Executed immediately after startup, drops capabilities we don't * need at any point during execution (or which we gain back when we * need by joining other namespaces). * - * 1b. isolate_fds() - * ================ - * - * Executed immediately after isolate_initial(). Closes any leaked - * files we might have inherited from the parent process. - * * 2. isolate_user() * ================= * @@ -44,14 +38,20 @@ * operate in. Sets our final UID & GID, and enters the correct user * namespace. * - * 3. isolate_prefork() + * 3. isolate_fds() + * ================ + * + * Executed after conf(). Closes any leaked + * files we might have inherited from the parent process. + * + * 4. isolate_prefork() * ==================== * * Executed after all setup, but before daemonising (fork()ing into * the background). Uses mount namespace and pivot_root() to remove * our access to the filesystem. * - * 4. isolate_postfork() + * 5. isolate_postfork() * ===================== * * Executed immediately after daemonizing, but before entering the @@ -61,6 +61,7 @@ * runtime operation. */ +#include <dirent.h> #include <errno.h> #include <fcntl.h> #include <grp.h> @@ -77,6 +78,7 @@ #include <unistd.h> #include <sys/mount.h> #include <sys/prctl.h> +#include <sys/resource.h> #include <sys/socket.h> #include <sys/syscall.h> #include <sys/types.h> @@ -248,47 +250,96 @@ void isolate_initial(void) drop_caps_ep_except(keep); } -/* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr - * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd - * - * Should: - * - close all open files except for standard streams and the one from --fd - * - move the --fd descriptor out of the range 0-2 - * - * Return: new fd number for descriptor from --fd, or -1 if not specified +/** + * snapshot_initial_fds() - Snapshot initial file descriptors inherited from parent + * other than standard streams (stdin, stdout, stderr) + * @ifds: Snapshot struct of initial file descriptors to populate */ -int isolate_fds(int argc, char **argv) +void snapshot_initial_fds(struct initial_fd_snapshot *ifds) { - int fd, close_from = STDERR_FILENO + 1; + struct dirent *entry; + size_t capacity = 16; + int max_fd = 1024; + struct rlimit rl; + long parsed_fd; + char *endptr; + int dir_fd; + DIR *dir; + int fd; + + ifds->arr = NULL; + ifds->count = 0; + + dir = opendir("/proc/self/fd"); + if (dir) { + dir_fd = dirfd(dir); + ifds->arr = malloc(sizeof(int) * capacity); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds"); + + while ((entry = readdir(dir)) != NULL) { + if (entry->d_name[0] < '0' || entry->d_name[0] > '9') + continue; + parsed_fd = strtol(entry->d_name, &endptr, 10); + if (*endptr != '\0' || parsed_fd < 0 || parsed_fd > INT_MAX) + continue; + fd = (int)parsed_fd; + /* Ignore stdin/stdout/stderr and the opendir handle itself */ + if (fd > STDERR_FILENO && fd != dir_fd) { + if (ifds->count >= capacity) { + size_t new_cap = capacity * 2; + int *new_arr = realloc(ifds->arr, sizeof(int) * new_cap); + + if (!new_arr) + die_perror("Failed to reallocate memory for inherited fds"); + + ifds->arr = new_arr; + capacity = new_cap; + } + ifds->arr[ifds->count++] = fd; + } + } + closedir(dir); + return; + } + + /* Fallback for environments without /proc (e.g. minimal chroots) */ + if (getrlimit(RLIMIT_NOFILE, &rl) == 0 && rl.rlim_cur != RLIM_INFINITY) + max_fd = (int)rl.rlim_cur; - fd = conf_tap_fd(argc, argv); + ifds->arr = malloc(sizeof(int) * max_fd); + if (!ifds->arr) + die_perror("Failed to allocate memory for inherited fds fallback"); - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + for (fd = STDERR_FILENO + 1; fd < max_fd; fd++) { + if (fcntl(fd, F_GETFD) >= 0) + ifds->arr[ifds->count++] = fd; } +} - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { - if (errno == ENOSYS || errno == EINVAL) { - /* This probably means close_range() or the - * CLOSE_RANGE_UNSHARE flag is not supported by the - * kernel. Not much we can do here except carry on and - * hope for the best. - */ - warn( -"Can't use close_range() to ensure no files leaked by parent"); - } else { - die_perror("Failed to close files leaked by parent"); - } +/** + * isolate_fds() - Close leaked files from the parent process + * @ifds: Snapshot of initial file descriptors + * @keep_fd: File descriptor to keep open, if any + * + * Should: + * - close all file descriptors that were open at startup, except for keep_fd + */ +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd) +{ + size_t i; + + if (!ifds || !ifds->arr) + return; + + for (i = 0; i < ifds->count; i++) { + if (ifds->arr[i] != keep_fd) + close(ifds->arr[i]); } - return fd; + free(ifds->arr); + ifds->arr = NULL; + ifds->count = 0; } /** diff --git a/isolation.h b/isolation.h index ec47038..8ada988 100644 --- a/isolation.h +++ b/isolation.h @@ -8,10 +8,17 @@ #define ISOLATION_H #include <stdbool.h> +#include <stddef.h> #include <unistd.h> +struct initial_fd_snapshot { + int *arr; + size_t count; +}; + void isolate_initial(void); -int isolate_fds(int argc, char **argv); +void snapshot_initial_fds(struct initial_fd_snapshot *ifds); +void isolate_fds(struct initial_fd_snapshot *ifds, int keep_fd); void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, const char *userns); int isolate_prefork(const struct ctx *c); diff --git a/passt.c b/passt.c index 5054551..c4335bf 100644 --- a/passt.c +++ b/passt.c @@ -335,6 +335,7 @@ int main(int argc, char **argv) struct epoll_event events[NUM_EPOLL_EVENTS]; int nfds, devnull_fd = -1, fd; struct ctx *c = &passt_ctx; + struct initial_fd_snapshot ifds; struct rlimit limit; struct timespec now; struct sigaction sa; @@ -344,8 +345,9 @@ int main(int argc, char **argv) arch_avx2_exec(argv); + snapshot_initial_fds(&ifds); + isolate_initial(); - c->fd_tap = isolate_fds(argc, argv); if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0) die_perror("Failed to open /dev/null"); @@ -390,6 +392,9 @@ int main(int argc, char **argv) sock_probe_features(c); conf(c, argc, argv); + + isolate_fds(&ifds, c->fd_tap); + trace_init(c->trace); pasta_netns_quit_init(c); -- 2.52.0

4 8

[PATCH v2 1/3] Fix handling of netlink multipart route dumps.
by Martin Schitter 21 Oct '26

21 Oct '26

This patch adds a `nl_collect` function to store all datagram chunks of a multipart route dump in one single interim buffer for further processing and dependency resolution. --- netlink.c | 79 +++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 56 insertions(+), 23 deletions(-) diff --git a/netlink.c b/netlink.c index 225b666..650a6fd 100644 --- a/netlink.c +++ b/netlink.c @@ -229,6 +229,51 @@ static struct nlmsghdr *nl_next(int s, char *buf, struct nlmsghdr *nh, ssize_t * /* NOLINTNEXTLINE(readability-inconsistent-ifelse-braces) */\ } else +/** + * nl_collect() - Collect all respose Datagrams of a netlink multi part dump + * @s: Netlink socket + * @buf: Buffer for responses (at least NLBUFSIZ long) + * @buflen: Buffer size. + * @seq: Sequence number of request we're getting responses for + * + * Return: Length of collected responses in bytes or error code < 0 + */ +int nl_collect(int s, char *buf, size_t buflen, uint32_t seq) +{ + size_t collected = 0; + struct nlmsghdr *nh; + ssize_t n; + int res; + const struct nlmsghdr* tail; + + #define NLMSG_DONE_SIZE NLMSG_LENGTH(4) + + while(collected + NLBUFSIZ < buflen){ + nh = nl_next(s, &buf[collected], NULL, &n); + debug("collect: add chunk of size n=%ld at offset=%ld, seq=%d nlmsg_len=%d", + n, collected, seq, ((const struct nlmsghdr *)&buf[collected])->nlmsg_len); + res = nl_status(nh, n, seq); + if (res < 0) /* error */ + return res; + collected += n; + + /* look for NLMSG_DONE -- it's ussualy transmitted in a seperate datagram, + * but in some rare cases also placed at the end of a multipart chunk.*/ + tail = (const struct nlmsghdr*)&buf[collected - NLMSG_DONE_SIZE]; + if (res == 0 || ( + collected >= NLMSG_DONE_SIZE + && (tail = (const struct nlmsghdr*)&buf[collected - NLMSG_DONE_SIZE]) + && NLMSG_OK(tail, NLMSG_DONE_SIZE) + && (nl_status(tail, NLMSG_DONE_SIZE, seq) == 0)) + ) { + debug("collected: %ld", collected); + return collected; + } + } + err("netlink: Too many routes to duplicate"); + return -E2BIG; +} + /** * nl_do() - Send netlink "do" request, and wait for acknowledgement * @s: Netlink socket @@ -553,21 +598,21 @@ int nl_route_dup(int s_src, unsigned int ifi_src, .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), .ifi = ifi_src, }; - ssize_t nlmsgs_size, left, status; + ssize_t nlmsgs_size, left, status = 0; unsigned dup_routes = 0; struct nlmsghdr *nh; - char buf[NLBUFSIZ]; + char buf[NLBUFSIZ * 8]; uint32_t seq; unsigned i; seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); - /* nl_foreach() will step through multiple response datagrams, - * which we don't want here because we need to have all the - * routes in the buffer at once. - */ - nh = nl_next(s_src, buf, NULL, &nlmsgs_size); - for (left = nlmsgs_size; + /* collect all the chunks of a multi part dump in one buffer.*/ + nlmsgs_size = nl_collect(s_src, buf, sizeof(buf), seq); + if (nlmsgs_size < 0) + return nlmsgs_size; + + for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; nh = NLMSG_NEXT(nh, left)) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); @@ -648,24 +693,12 @@ int nl_route_dup(int s_src, unsigned int ifi_src, dup_routes++; } - if (!NLMSG_OK(nh, left)) { - /* Process any remaining datagrams in a different - * buffer so we don't overwrite the first one. - */ - char tail[NLBUFSIZ]; - unsigned extra = 0; - - nl_foreach_oftype(nh, status, s_src, tail, seq, RTM_NEWROUTE) - extra++; - - if (extra) { - err("netlink: Too many routes to duplicate"); - return -E2BIG; - } - } + /* status should be 0 (=NLMSG_DONE) */ if (status < 0) return status; + debug("found %d routes in dump", dup_routes); + /* Routes might have dependencies between each other, and the kernel * processes RTM_NEWROUTE messages sequentially. For n routes, we might * need to send the requests up to n times to get all of them inserted. -- 2.53.0

2 3

[PATCH v4] netlink: Fix nl_route_dup by 3-step processing
by Martin Schitter 21 Oct '26

21 Oct '26

Fixes: #221 Eliminate the route entries capacity limitations of nl_route_dup by copping them to the destination namespace in three successive steps to bypass dependency issues. This approach is taken from the handling used in the restore subcommand of iproute2. Signed-off-by: Martin Schitter <ms+git(a)mur.at> --- netlink.c | 207 ++++++++++++++++++++++++++---------------------------- 1 file changed, 99 insertions(+), 108 deletions(-) diff --git a/netlink.c b/netlink.c index 225b666..803cb20 100644 --- a/netlink.c +++ b/netlink.c @@ -525,6 +525,20 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw) return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len); } +/** + * nl_rtattr_cmp() -- compare two routing attributes + * @rta1: Routing attribute + * @rta2: Routing attribute + * + * Return: 0 if equal + */ +static int nl_rtattr_cmp(const struct rtattr *rta1, const struct rtattr *rta2) +{ + if (!rta1 || !rta2 || rta1->rta_len != rta2->rta_len) + return 1; + return memcmp(RTA_DATA(rta1), RTA_DATA(rta2), RTA_PAYLOAD(rta1)); +} + /** * nl_route_dup() - Copy routes for given interface and address family * @s_src: Netlink socket in source namespace @@ -535,56 +549,73 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw) * * Return: 0 on success, negative error code on failure */ -int nl_route_dup(int s_src, unsigned int ifi_src, - int s_dst, unsigned int ifi_dst, sa_family_t af) +int nl_route_dup(int s_src, unsigned int ifi_src, int s_dst, + unsigned int ifi_dst, sa_family_t af) { - struct req_t { - struct nlmsghdr nlh; - struct rtmsg rtm; - struct rtattr rta; - unsigned int ifi; - } req = { - .rtm.rtm_family = af, - .rtm.rtm_table = RT_TABLE_MAIN, - .rtm.rtm_scope = RT_SCOPE_UNIVERSE, - .rtm.rtm_type = RTN_UNICAST, + /* Duplicate routes in correct order using 3 succesive stages: + * 0. ones for local addresses, + * 1. ones for local networks, + * 2. others (remote networks/hosts). + */ + for (int prio = 0; prio < 3; prio++) { + struct req_t { + struct nlmsghdr nlh; + struct rtmsg rtm; + struct rtattr rta; + unsigned int ifi; + } req = { + .rtm.rtm_family = af, + .rtm.rtm_table = RT_TABLE_MAIN, + .rtm.rtm_scope = RT_SCOPE_UNIVERSE, + .rtm.rtm_type = RTN_UNICAST, + + .rta.rta_type = RTA_OIF, + .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), + .ifi = ifi_src, + }; + ssize_t status; + struct nlmsghdr *nh; + char buf[NLBUFSIZ]; + uint32_t seq; + + seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, + sizeof(req)); + + nl_foreach(nh, status, s_src, buf, seq) { + struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); + struct rtattr *rta; + size_t na; + uint16_t flags = nh->nlmsg_flags; + int rc; - .rta.rta_type = RTA_OIF, - .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), - .ifi = ifi_src, - }; - ssize_t nlmsgs_size, left, status; - unsigned dup_routes = 0; - struct nlmsghdr *nh; - char buf[NLBUFSIZ]; - uint32_t seq; - unsigned i; - seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); + if (nh->nlmsg_type != RTM_NEWROUTE) + continue; - /* nl_foreach() will step through multiple response datagrams, - * which we don't want here because we need to have all the - * routes in the buffer at once. - */ - nh = nl_next(s_src, buf, NULL, &nlmsgs_size); - for (left = nlmsgs_size; - NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; - nh = NLMSG_NEXT(nh, left)) { - struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); - bool discard = false; - struct rtattr *rta; - size_t na; + struct rtattr *tb[RTA_MAX+1] = { 0 }; - if (nh->nlmsg_type != RTM_NEWROUTE) - continue; + for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); + RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { + tb[rta->rta_type] = rta; + } - /* nexthop state flags don't apply to freshly created routes, - * and the kernel will refuse our route if they are set. - */ - rtm->rtm_flags &= ~RTNH_COMPARE_MASK; + /* Process only matching routes of current priority + * (variant of an approach used in iproute2s restore_handler) + */ + if (!(prio == 2 && tb[RTA_GATEWAY]) && + !(prio == 1 && !tb[RTA_GATEWAY] && + tb[RTA_PREFSRC] && + nl_rtattr_cmp(tb[RTA_PREFSRC], tb[RTA_DST])) && + !(prio == 0 && !tb[RTA_GATEWAY] && + (!tb[RTA_PREFSRC] || + !nl_rtattr_cmp(tb[RTA_PREFSRC], tb[RTA_DST])))) + continue; + + /* nexthop state flags don't apply to freshly created routes, + * and the kernel will refuse our route if they are set. + */ + rtm->rtm_flags &= ~RTNH_COMPARE_MASK; - for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); - rta = RTA_NEXT(rta, na)) { /* RTA_OIF and RTA_MULTIPATH attributes carry the * identifier of a host interface. If they match the * host interface we're copying from, change them to @@ -595,103 +626,63 @@ int nl_route_dup(int s_src, unsigned int ifi_src, * available), or if any interface index in nexthop * objects differ from the host interface, discard the * route altogether. - */ - if (rta->rta_type == RTA_OIF) { - if (*(unsigned int *)RTA_DATA(rta) != ifi_src) { - discard = true; - break; + */ + if (tb[RTA_OIF]) { + if (*(unsigned int *)RTA_DATA(tb[RTA_OIF]) != + ifi_src) { + continue; } - - *(unsigned int *)RTA_DATA(rta) = ifi_dst; - } else if (rta->rta_type == RTA_MULTIPATH) { - int nh_len = RTA_PAYLOAD(rta); + *(unsigned int *)RTA_DATA(tb[RTA_OIF]) = + ifi_dst; + } else if (tb[RTA_MULTIPATH]) { + int nh_len = RTA_PAYLOAD(tb[RTA_MULTIPATH]); struct rtnexthop *rtnh; - - for (rtnh = (struct rtnexthop *)RTA_DATA(rta); + bool discard = false; + for (rtnh = (struct rtnexthop *) + RTA_DATA(tb[RTA_MULTIPATH]); RTNH_OK(rtnh, nh_len); - rtnh = RTNH_NEXT_AND_DEC(rtnh, nh_len)) { + rtnh = RTNH_NEXT_AND_DEC(rtnh, + nh_len)) { int src = (int)ifi_src; - if (rtnh->rtnh_ifindex != src) { discard = true; break; } - rtnh->rtnh_ifindex = ifi_dst; } - if (discard) - break; - } else if (rta->rta_type == RTA_PREFSRC || - rta->rta_type == RTA_NH_ID) { + continue; + } else if (tb[RTA_PREFSRC]) { /* Strip RTA_PREFSRC attributes: host routes * might include a preferred source address, * which must be one of the host's addresses. * However, with -a, pasta will use a different * namespace address, making such a route * invalid in the namespace. - * - * Strip RTA_NH_ID attributes: host routes set + */ + tb[RTA_PREFSRC]->rta_type = RTA_UNSPEC; + } else if (tb[RTA_NH_ID]) { + /* Strip RTA_NH_ID attributes: host routes set * up via routing protocols (e.g. OSPF) might * contain a nexthop ID (and not nexthop * objects, which are taken care of in the * RTA_MULTIPATH case above) that's not valid * in the target namespace. */ - rta->rta_type = RTA_UNSPEC; + tb[RTA_NH_ID]->rta_type = RTA_UNSPEC; } - } - - if (discard) - nh->nlmsg_type = NLMSG_NOOP; - else - dup_routes++; - } - - if (!NLMSG_OK(nh, left)) { - /* Process any remaining datagrams in a different - * buffer so we don't overwrite the first one. - */ - char tail[NLBUFSIZ]; - unsigned extra = 0; - - nl_foreach_oftype(nh, status, s_src, tail, seq, RTM_NEWROUTE) - extra++; - - if (extra) { - err("netlink: Too many routes to duplicate"); - return -E2BIG; - } - } - if (status < 0) - return status; - - /* Routes might have dependencies between each other, and the kernel - * processes RTM_NEWROUTE messages sequentially. For n routes, we might - * need to send the requests up to n times to get all of them inserted. - * Routes that have been already inserted will return -EEXIST, but we - * can safely ignore that and repeat the requests. This avoids the need - * to calculate dependencies: let the kernel do that. - */ - for (i = 0; i < dup_routes; i++) { - for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; - NLMSG_OK(nh, left); - nh = NLMSG_NEXT(nh, left)) { - uint16_t flags = nh->nlmsg_flags; - int rc; - - if (nh->nlmsg_type != RTM_NEWROUTE) - continue; rc = nl_do(s_dst, nh, RTM_NEWROUTE, - (flags & ~NLM_F_DUMP_FILTERED) | NLM_F_CREATE, + (flags & ~NLM_F_DUMP_FILTERED) | + NLM_F_CREATE, nh->nlmsg_len); if (rc < 0 && rc != -EEXIST && rc != -ENETUNREACH && rc != -EHOSTUNREACH) return rc; } + if (status < 0) + return status; } - return 0; } -- 2.53.0

2 1

[PATCH] tcp: Don't fast re-transmit if only our FIN is outstanding
by Aris Konstantoulas 03 Oct '26

03 Oct '26

From: Aris Konstantoulas <aris(a)ariscodes.com> In the TAP_FIN_RCVD path of tcp_tap_handler(), a bare segment from the guest acknowledging exactly seq_ack_from_tap, with an unchanged window, is taken as a duplicate ACK and triggers a fast re-transmit. If the only unacknowledged sequence number is our own FIN, that's harmful: tcp_rewind_seq() rewinds seq_to_tap and clears TAP_FIN_SENT, so tcp_data_from_sock() immediately sends the FIN again. If the guest answers that FIN with the same bare ACK, as a socket in TIME-WAIT will, we loop at packet rate: - conn->retries is never incremented on this path, so we never reach TCP_MAX_RETRIES and tcp_rst() - ACK_FROM_TAP_DUE is re-armed on every iteration, so the backed-off re-transmission in tcp_timer_handler() never fires - TAP_FIN_ACKED can't be set, as it requires TAP_FIN_SENT, which the rewind just cleared On an idle Podman host (rootless, pasta), this showed up as a single flow exchanging ~45,000 54-byte segments per second between pasta and a container whose socket was in TIME-WAIT, with pasta using ~75% of one core, until the socket was killed by hand. It recurred on the idle teardown of an HTTP/2 connection to an ACME server. With a raw-socket peer driving the same sequence against pasta at f8df3f1, pasta re-sent the FIN 727,509 times in 10 seconds. With this change it's re-transmitted by the timer at 1, 3, 7, 15, 31, 63 and 127 seconds, and the connection is reset once TCP_MAX_RETRIES is reached. Don't consider a duplicate ACK as a fast re-transmit trigger if the only outstanding sequence number is the FIN, and leave it to the timer. Fast re-transmit of data is unaffected, with or without a FIN queued after it. Fixes: bde1847960cf ("tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent") Link: https://bugs.passt.top/show_bug.cgi?id=125 Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Aris Konstantoulas <aris(a)ariscodes.com> --- Notes: Notes for reviewers, not for the commit message: - Reproducer: a raw AF_PACKET TCP peer in pasta's namespace completes a handshake, closes first, then answers each FIN from pasta with a bare ACK for seq_ack_from_tap, with an unchanged window. I can post it (Python, ~200 lines) if useful. - Open question: I haven't established how a real flow first reaches the state where the peer ACKs exactly up to, but not past, our FIN. The live capture showed the TIME-WAIT socket ACKing the sequence number of pasta's FIN itself. That would fit a FIN re-sent after the first one was already acknowledged, one sequence number further on, that is, tcp_rewind_seq() clearing TAP_FIN_SENT with nothing outstanding. Candidates are the zero-window rewind and the fast-retransmit check in tcp_data_from_tap(), neither of which checks that anything is outstanding. This patch breaks the loop in either case, but not that possible entry path. I'm happy to look into it further, possibly as part of bug 125. tcp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index 3b78d2e..e279f8a 100644 --- a/tcp.c +++ b/tcp.c @@ -2417,15 +2417,22 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, /* Established connections not accepting data from tap */ if (conn->events & TAP_FIN_RCVD) { + bool fin_only, retr; size_t dlen; - bool retr; if ((dlen = tcp_packet_data_len(th, l4len))) { flow_dbg(conn, "data segment in CLOSE-WAIT (%zu B)", dlen); } - retr = th->ack && !th->fin && + /* If only our FIN is outstanding, rewinding on a duplicate ACK + * would re-send it on every ACK, bypassing the backoff and + * retry limit of tcp_timer_handler(): let the timer do it. + */ + fin_only = (conn->events & TAP_FIN_SENT) && + conn->seq_to_tap == conn->seq_ack_from_tap + 1; + + retr = th->ack && !th->fin && !fin_only && ntohl(th->ack_seq) == conn->seq_ack_from_tap && ntohs(th->window) == conn->wnd_from_tap; -- 2.43.0

2 2

[PATCH v2 0/7] Add AFL++ fuzzing support for passt
by Anshu Kumari 28 Sep '26

28 Sep '26

This series adds integrated AFL++ fuzzing support for passt, extending the earlier work by AbdAlRahman Gad with persistent mode, bidirectional protocol fuzzing, and real TCP connection coverage via a companion test server. Each testcase is a flat buffer split into four regions: epoll events, raw L2 tap frames, test-server payloads, and getsockopt(TCP_INFO) overrides. AFL++ controls all four through mutation of a 10-byte header. Fuzz-injected epoll events are interleaved with real kernel events so protocol handshakes can complete. A standalone test server (fuzz-server) attaches to AFL++'s shared memory and sends fuzzer-controlled payload on every accepted TCP connection. AnyIP routing in a rootless user+network namespace makes every destination local, so the test server intercepts all outbound traffic from passt without mocking recv(). Deterministic wrappers replace clock_gettime(), getsockopt() and assert() to eliminate non-determinism from kernel state. Sandboxing (seccomp, namespaces, close_range, capabilities) is bypassed under FUZZING builds since AFL++ needs its own fds and syscalls. *** BLURB HERE *** Anshu Kumari (7): fuzz: Add AFL++ shared memory testcase buffer layout fuzz: Add deterministic wrappers for assert, clock and getsockopt fuzz: Guard protocol handlers against invalid fuzz-injected state fuzz: Bypass sandboxing for fuzzing builds fuzz: Add AFL++ persistent mode fuzz loop fuzz: Add host-side test server for bidirectional fuzzing fuzz: Add build targets, namespace setup and documentation Makefile | 35 +++- flow.c | 52 +++++ fuzz-server.c | 343 +++++++++++++++++++++++++++++++++ fuzz-testbuf.h | 135 +++++++++++++ fuzz.c | 102 ++++++++++ fuzz.h | 38 ++++ fuzzing/README.fuzzing.md | 129 +++++++++++++ fuzzing/fuzz-setup.sh | 24 +++ fuzzing/testcase_dir/empty.bin | Bin 0 -> 12 bytes icmp.c | 8 +- isolation.c | 23 +++ passt.c | 198 +++++++++++++++++++ tap.c | 13 ++ tcp.c | 18 +- tcp_buf.c | 1 + tcp_splice.c | 4 +- udp.c | 29 ++- udp_flow.c | 3 +- util.c | 1 + 19 files changed, 1131 insertions(+), 25 deletions(-) create mode 100644 fuzz-server.c create mode 100644 fuzz-testbuf.h create mode 100644 fuzz.c create mode 100644 fuzz.h create mode 100644 fuzzing/README.fuzzing.md create mode 100755 fuzzing/fuzz-setup.sh create mode 100644 fuzzing/testcase_dir/empty.bin -- 2.55.0

1 7

[PATCH v4] netlink: Fix nl_route_dup by 3-step processing
by Martin Schitter 26 Sep '26

26 Sep '26

This is a rewrite of my patches to fix issue #221.

1 0

passt: new version 2026_09_25.df90211 available
by Stefano Brivio 26 Sep '26

26 Sep '26

The new version with tag 2026_09_25.df90211 includes the following changes: df90211 udp: Add missing @now parameter doc to udp_flow_from_tap() f2683d1 apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only 588b545 pasta: Add --no-pidns to keep spawned command in caller's PID namespace 3a890a6 contrib/apparmor: add missing setfcap capability de8b085 vhost_user: Reset vq enable flag in vu_cleanup() d2fb3ba Add Zed editor settings cef6bce util, pasta: Remove some unneeded #includes cf3a11f util: Add missing O_CLOEXEC for !HAS_GETRANDOM path abdc94a util: Eliminate a stray trailing whitespace aa2c8f0 clangd: Add _GNU_SOURCE to default clangd options 67dfdbd udp_flow: Remove obsolete comment 553ed8b parse: Convert parse_mac() to conventions of parse.c 7bf1595 isolation: Don't create our userns as nobody a8aedb8 isolation: Create helper function to enter user namespace 9587a35 util, pasta: Generalise [ug]id_map creation 5b4bdc8 pasta: Include pasta.h in pasta.c 7e8d49b netlink: Don't warn about multiple interfaces when there's only one defc25b isolation: Include linux_dep.h for close_range() https://passt.top/passt/log/?qt=range&q=2026_07_28.f8df3f1..2026_09_25.df90… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/11037397/ permanent mirror: https://passt.top/builds/copr/0^20260925.gdf90211/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdf90211-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0df90211-1_all.deb -- Stefano

1 0

[PATCH] udp: Add missing @now parameter doc to udp_flow_from_tap()
by Laurent Vivier 26 Sep '26

26 Sep '26

udp_flow_from_tap() takes a @now parameter but its doc comment omits it. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- udp_flow.c | 1 + 1 file changed, 1 insertion(+) diff --git a/udp_flow.c b/udp_flow.c index a29f356252fe..865702ce6756 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -267,6 +267,7 @@ flow_sidx_t udp_flow_from_sock(const struct ctx *c, uint8_t pif, * @daddr: Destination address guest side * @srcport: Source port on guest side * @dstport: Destination port on guest side + * @now: Current timestamp * * Return: sidx for the destination side of the flow for this packet, or * FLOW_SIDX_NONE if we couldn't find or create a flow. -- 2.55.0

2 1

[PATCH] apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only
by Stefano Brivio 25 Sep '26

25 Sep '26

Podman overrides TMPDIR to /var/tmp, and an upcoming change in the requires pasta to write its PID file to TMPDIR. To support this in the AppArmor policy, we need to loosen the existing rule restricting file writes to /tmp/ and subpaths in order to include common alternative paths for TMPDIR: the user-tmp abstraction does exactly this. Reported-by: Giuseppe Scrivano <gscrivan(a)redhat.com> Link: https://github.com/podman-container-tools/container-libs/pull/1207 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/apparmor/usr.bin.passt | 3 +-- contrib/apparmor/usr.bin.pasta | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include <tunables/global> profile passt /usr/bin/passt{,.avx2} { include <abstractions/passt> - # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include <tunables/global> profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> - # Alternatively: include <abstractions/user-tmp> - /tmp/** rw, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), -- 2.43.0

1 0

[PATCH v10] pasta: Refactor pasta_ns_conf() to reduce nesting
by Jon Maloy 21 Sep '26

21 Sep '26

Extract address and route configuration into two new helper functions pasta_conf_addrs() and pasta_conf_routes(), and replace the outer if (c->pasta_conf_ns) block with an early return. This reduces indentation and eliminates the goto labels. No functional change. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- v7: -Removed redundant argument 'af' in nl_addr_set() -Removed redundant label and 'goto's in pasta_ns_conf() -Since I excluded addition of all LINKLOCAL addresses from host address array in a previous commit I can now omit this test in pasta_conf_addrs() as suggested by David. -Here is the example of agnostic usage of inany_prefix_len() I referred to in a previous commit. v8: -Do prefix_len conversion inside nl_addr_set() instead of in the calling function. -In nl_addr_set(), branch on inany_prefix_v4() return value instead of inany_af() to avoid redundant AF check and potential static checker false positives. (David) -Swap branch order in pasta_conf_routes() for consistency with pasta_conf_addrs(). (David) -Defer investigation of pre-existing IFF_NOARP / DAD interaction oddity noted by David. v9: - Broke out as standalone from multi-addr series. - Adapted to code conditions before the introduction of the unified address type. v10: - Applied all suggestions from David, more for symmetry reasons than for logical correctess. --- pasta.c | 220 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 115 insertions(+), 105 deletions(-) diff --git a/pasta.c b/pasta.c index 7ba5d75e..a9ee8348 100644 --- a/pasta.c +++ b/pasta.c @@ -290,13 +290,70 @@ void pasta_start_ns(struct ctx *c, int argc, char *argv[]) die_perror("Failed to join network namespace"); } +/** + * pasta_conf_addrs() - Configure addresses for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set configured address; if false, copy from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_addrs(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + if (!ifi) + return 0; + + if (!no_copy) + return nl_addr_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + if (af == AF_INET && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET, + &c->ip4.addr, c->ip4.prefix_len); + } else if (af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } + return 0; +} + +/** + * pasta_conf_routes() - Configure routes for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set default route; if false, copy routes from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_routes(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + const void *gw; + + if (af == AF_INET) + gw = &c->ip4.guest_gw; + else + gw = &c->ip6.guest_gw; + + if (!ifi) + return 0; + + if (!no_copy) + return nl_route_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + return nl_route_set_def(nl_sock_ns, c->pasta_ifi, af, gw); +} + /** * pasta_ns_conf() - Set up loopback and tap interfaces in namespace as needed * @c: Execution context */ void pasta_ns_conf(struct ctx *c) { - int rc = 0; + unsigned int flags = IFF_UP; + int rc; rc = nl_link_set_flags(nl_sock_ns, 1 /* lo */, IFF_UP, IFF_UP); if (rc < 0) @@ -315,116 +372,69 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't set MAC address in namespace: %s", strerror_(-rc)); - if (c->pasta_conf_ns) { - unsigned int flags = IFF_UP; - - if (c->mtu) - nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); - - if (c->ifi6) /* Avoid duplicate address detection on link up */ - flags |= IFF_NOARP; - - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); - - if (c->ifi4) { - if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); - } else { - rc = nl_addr_dup(nl_sock, c->ifi4, - nl_sock_ns, c->pasta_ifi, - AF_INET); - } - - if (c->ifi4 == -1 && rc == -ENOTSUP) { - warn("IPv4 not supported, disabling"); - c->ifi4 = 0; - goto ipv4_done; - } - - if (rc < 0) { - die("Couldn't set IPv4 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip4.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi4, nl_sock_ns, - c->pasta_ifi, AF_INET); - } - - if (rc < 0) { - die("Couldn't set IPv4 route(s) in guest: %s", - strerror_(-rc)); - } - } -ipv4_done: + proto_update_l2_buf(c->guest_mac); - if (c->ifi6) { - rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, - &c->ip6.addr_ll_seen); - if (rc < 0) { - warn("Can't get LL address from namespace: %s", - strerror_(-rc)); - } + if (!c->pasta_conf_ns) + return; - rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); - if (rc < 0) { - warn("Can't set nodad for LL in namespace: %s", - strerror_(-rc)); - } - - /* We dodged DAD: re-enable neighbour solicitations */ - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, - 0, IFF_NOARP); - - if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { - rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } - } else { - rc = nl_addr_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (rc < 0) { - die("Couldn't set IPv6 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip6.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET6, - &c->ip6.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (c->ifi6 == -1 && rc == -ENOTSUP) { - warn("IPv6 not supported, disabling"); - c->ifi6 = 0; - goto ipv6_done; - } - - if (rc < 0) { - die("Couldn't set IPv6 route(s) in guest: %s", + if (c->mtu) + nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); + + if (c->ifi6) /* Avoid duplicate address detection on link up */ + flags |= IFF_NOARP; + + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); + + if (c->ifi4) { + rc = pasta_conf_addrs(c, AF_INET, c->ifi4, + c->ip4.no_copy_addrs); + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + } else if (rc < 0) { + die("Couldn't set IPv4 address(es) in namespace: %s", + strerror_(-rc)); + } else { + rc = pasta_conf_routes(c, AF_INET, c->ifi4, + c->ip4.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv4 route(s) in guest: %s", strerror_(-rc)); - } } } -ipv6_done: - proto_update_l2_buf(c->guest_mac); + if (c->ifi6) { + rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, + &c->ip6.addr_ll_seen); + if (rc < 0) + warn("Can't get LL address from namespace: %s", + strerror_(-rc)); + + rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); + if (rc < 0) + warn("Can't set nodad for LL in namespace: %s", + strerror_(-rc)); + + /* We dodged DAD: re-enable neighbour solicitations */ + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, 0, IFF_NOARP); + + rc = pasta_conf_addrs(c, AF_INET6, c->ifi6, + c->ip6.no_copy_addrs); + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + return; + } else if (rc < 0) { + die("Couldn't set IPv6 address(es) in namespace: %s", + strerror_(-rc)); + } + + rc = pasta_conf_routes(c, AF_INET6, c->ifi6, + c->ip6.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv6 route(s) in guest: %s", + strerror_(-rc)); + } } /** -- 2.52.0

2 1