- dev - passt

[PATCH v3 0/7] tcp: Fixes for issues uncovered by tests with 6.17-rc1 kernels
by Stefano Brivio 29 Aug '25

29 Aug '25

Starting from Linux kernel commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"), window limits are enforced more aggressively with a bigger amount of zero-window updates compared to what happened with e2142825c120 ("net: tcp: send zero-window ACK when no memory") alone, and occasional duplicate ACKs can now be seen also for local transfers with default (208 KiB) socket buffer sizes. Paul reports that, with 6.17-rc1-ish kernels, Podman tests for the pasta integration occasionally fail on the "TCP/IPv4 large transfer, tap" case. While playing with a reproducer that seems to be matching those failures: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done and a kernel including that commit, I hit a few different failures, that should be fixed by this series. Paul tested v1 of this series and found an additional failure (transfer timeout), which I could reproduce with a slightly different command: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 EXEC:./write.sh & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done where write.sh is simply: #!/bin/sh cat > /tmp/large.rcv so that the connection is not half-closed starting from the beginning, because socat can't make assumptions about the unidirectional nature of the traffic. This should now be fixed as well by the new version of patch 3/7. v3: - add patch 6/7 - in 7/7, check dlen <= 1 for keep-alive segments, instead of len <= 1 v2: in 3/6, rewind sequence also if the zero-window update comes in the middle of a batch with non-zero window updates Stefano Brivio (7): tcp: FIN flags have to be retransmitted as well tcp: Factor sequence rewind for retransmissions into a new function tcp: Rewind sequence when guest shrinks window to zero tcp: Fix closing logic for half-closed connections tcp: Don't try to transmit right after the peer shrank the window to zero tcp: Cast operands of sequence comparison macros to uint32_t before using them tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent tcp.c | 181 ++++++++++++++++++++++++++++++++++--------------- tcp_internal.h | 12 ++-- 2 files changed, 136 insertions(+), 57 deletions(-) -- 2.43.0

1 7

[PATCH v2 0/6] tcp: Fixes for issues uncovered by tests with 6.17-rc1 kernels
by Stefano Brivio 29 Aug '25

29 Aug '25

Starting from Linux kernel commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"), window limits are enforced more aggressively with a bigger amount of zero-window updates compared to what happened with e2142825c120 ("net: tcp: send zero-window ACK when no memory") alone, and occasional duplicate ACKs can now be seen also for local transfers with default (208 KiB) socket buffer sizes. Paul reports that, with 6.17-rc1-ish kernels, Podman tests for the pasta integration occasionally fail on the "TCP/IPv4 large transfer, tap" case. While playing with a reproducer that seems to be matching those failures: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done and a kernel including that commit, I hit a few different failures, that should be fixed by this series. Paul tested v1 of this series and found an additional failure (transfer timeout), which I could reproduce with a slightly different command: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 EXEC:./write.sh & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done where write.sh is simply: #!/bin/sh cat > /tmp/large.rcv so that the connection is not half-closed starting from the beginning, because socat can't make assumptions about the unidirectional nature of the traffic. This should now be fixed as well by the new version of patch 3/6. v2: in 3/6, rewind sequence also if the zero-window update comes in the middle of a batch with non-zero window updates Stefano Brivio (6): tcp: FIN flags have to be retransmitted as well tcp: Factor sequence rewind for retransmissions into a new function tcp: Rewind sequence when guest shrinks window to zero tcp: Fix closing logic for half-closed connections tcp: Don't try to transmit right after the peer shrank the window to zero tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent tcp.c | 179 +++++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 127 insertions(+), 52 deletions(-) -- 2.43.0

1 8

[PATCH v5 0/4] RFC: New proof-of-concept based exeter tests
by David Gibson 25 Aug '25

25 Aug '25

Here's a new approach to building passt tests with exeter. This new one no longer uses Avocado in the default case, although it would still be possible to manually run the exeter based tests with Avocado. Here's another draft of my work on testing passt with Avocado and the exeter library I recently created. It includes Cleber's patch adding some basic Avocado tests and builds on that. For now this only does simple tests, to show how the integration could work. It adds some new trivial "smoke tests" and converts the linter and build checks to exeter. More complex tests will require building the sinte/pesto library we've discussed. A lot of the work for that already exists in my earlier exeter test series, but it will need some rework to split it into a separate component. v5: * Updated according to Stefano's review - Fixed a number of whitespace errors - Improved many comments and variable names to make things clearer * New patch adding parallel test execution with BATS * Improved autodetection of exeter tests using "exetool probe" David Gibson (4): test: Extend test scripts to allow running exeter tests. test: Run static checkers as exeter tests test: Convert build tests to exeter test: Allow exeter & podman tests to be parallel executed with BATS test/.gitignore | 2 + test/Makefile | 22 ++++++- test/build/all | 61 ------------------- test/build/build.py | 109 ++++++++++++++++++++++++++++++++++ test/build/clang_tidy | 17 ------ test/build/cppcheck | 17 ------ test/build/static_checkers.sh | 30 ++++++++++ test/lib/exeter | 56 +++++++++++++++++ test/run | 18 ++++-- test/smoke/smoke.sh | 27 +++++++++ 10 files changed, 257 insertions(+), 102 deletions(-) delete mode 100644 test/build/all create mode 100755 test/build/build.py delete mode 100644 test/build/clang_tidy delete mode 100644 test/build/cppcheck create mode 100755 test/build/static_checkers.sh create mode 100644 test/lib/exeter create mode 100755 test/smoke/smoke.sh -- 2.50.1

2 8

[PATCH v4 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 25 Aug '25

25 Aug '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents Jon Maloy (9): netlink: add function to extract MAC addresses from NDP/ARP table arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() tcp: make tcp_rst_no_conn() respond with correct MAC address icmp: let icmp use mac address from flowside structure fwd: Added cache table for ARP/NDP contents arp.c | 8 ++ conf.c | 2 + flow.c | 20 +++- flow.h | 2 + fwd.c | 244 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 5 + icmp.c | 4 +- inany.c | 1 + ndp.c | 10 +- netlink.c | 79 ++++++++++++++++ netlink.h | 2 + passt.c | 9 +- passt.h | 3 +- pasta.c | 2 +- tap.c | 23 +++-- tap.h | 7 +- tcp.c | 21 ++++- tcp.h | 2 +- tcp_buf.c | 29 +++--- tcp_internal.h | 2 +- tcp_vu.c | 5 +- udp.c | 52 ++++++----- udp.h | 2 +- 23 files changed, 452 insertions(+), 82 deletions(-) -- 2.50.1

3 20

[PATCH] proc: Bring back lseek() operations for /proc/net entries
by Stefano Brivio 23 Aug '25

23 Aug '25

Commit ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") breaks lseek() for all /proc/net entries, as shown for instance by pasta(1), a user-mode network implementation using those entries to scan for bound ports: $ strace -e openat,lseek -e s=none pasta -- true [...] openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY|O_CLOEXEC) = 12 openat(AT_FDCWD, "/proc/net/tcp6", O_RDONLY|O_CLOEXEC) = 13 lseek(12, 0, SEEK_SET) = -1 ESPIPE (Illegal seek) lseek() failed on /proc/net file: Illegal seek lseek(13, 0, SEEK_SET) = -1 ESPIPE (Illegal seek) lseek() failed on /proc/net file: Illegal seek openat(AT_FDCWD, "/proc/net/udp", O_RDONLY|O_CLOEXEC) = 14 openat(AT_FDCWD, "/proc/net/udp6", O_RDONLY|O_CLOEXEC) = 15 lseek(14, 0, SEEK_SET) = -1 ESPIPE (Illegal seek) lseek() failed on /proc/net file: Illegal seek lseek(15, 0, SEEK_SET) = -1 ESPIPE (Illegal seek) lseek() failed on /proc/net file: Illegal seek [...] That's because PROC_ENTRY_proc_lseek isn't set for /proc/net entries, and it's now mandatory for lseek(). In fact, flags aren't set at all for those entries because pde_set_flags() isn't called for them. As commit d919b33dafb3 ("proc: faster open/read/close with "permanent" files") introduced flags for procfs directory entries, along with the pde_set_flags() helper, they weren't relevant for /proc/net entries, so the lack of pde_set_flags() calls in proc_create_net_*() functions was harmless. Now that the calls are strictly needed for lseek() functionality, add them. Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- fs/proc/generic.c | 2 +- fs/proc/internal.h | 1 + fs/proc/proc_net.c | 4 ++++ 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 76e800e38c8f..57ec5e385d1b 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -561,7 +561,7 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, return p; } -static void pde_set_flags(struct proc_dir_entry *pde) +void pde_set_flags(struct proc_dir_entry *pde) { if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) pde->flags |= PROC_ENTRY_PERMANENT; diff --git a/fs/proc/internal.h b/fs/proc/internal.h index e737401d7383..a358974f14d2 100644 --- a/fs/proc/internal.h +++ b/fs/proc/internal.h @@ -284,6 +284,7 @@ extern struct dentry *proc_lookup(struct inode *, struct dentry *, unsigned int) struct dentry *proc_lookup_de(struct inode *, struct dentry *, struct proc_dir_entry *); extern int proc_readdir(struct file *, struct dir_context *); int proc_readdir_de(struct file *, struct dir_context *, struct proc_dir_entry *); +void pde_set_flags(struct proc_dir_entry *pde); static inline void pde_get(struct proc_dir_entry *pde) { diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c index 52f0b75cbce2..20bc7481b02c 100644 --- a/fs/proc/proc_net.c +++ b/fs/proc/proc_net.c @@ -124,6 +124,7 @@ struct proc_dir_entry *proc_create_net_data(const char *name, umode_t mode, p->proc_ops = &proc_net_seq_ops; p->seq_ops = ops; p->state_size = state_size; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL_GPL(proc_create_net_data); @@ -170,6 +171,7 @@ struct proc_dir_entry *proc_create_net_data_write(const char *name, umode_t mode p->seq_ops = ops; p->state_size = state_size; p->write = write; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL_GPL(proc_create_net_data_write); @@ -217,6 +219,7 @@ struct proc_dir_entry *proc_create_net_single(const char *name, umode_t mode, pde_force_lookup(p); p->proc_ops = &proc_net_single_ops; p->single_show = show; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL_GPL(proc_create_net_single); @@ -261,6 +264,7 @@ struct proc_dir_entry *proc_create_net_single_write(const char *name, umode_t mo p->proc_ops = &proc_net_single_ops; p->single_show = show; p->write = write; + pde_set_flags(p); return proc_register(parent, p); } EXPORT_SYMBOL_GPL(proc_create_net_single_write); -- 2.43.0

3 4

[PATCH v4 0/3] RFC: New proof-of-concept based exeter tests
by David Gibson 22 Aug '25

22 Aug '25

Here's a new approach to building passt tests with exeter. This new one no longer uses Avocado in the default case, although it would still be possible to manually run the exeter based tests with Avocado. Here's another draft of my work on testing passt with Avocado and the exeter library I recently created. It includes Cleber's patch adding some basic Avocado tests and builds on that. For now this only does simple tests, to show how the integration could work. It adds some new trivial "smoke tests" and converts the linter and build checks to exeter. More complex tests will require building the sinte/pesto library we've discussed. A lot of the work for that already exists in my earlier exeter test series, but it will need some rework to split it into a separate component. Changes since v3: * Remove reliance on Avocado * Build integration between exeter and existing test scripts * Drop most of the complex tests for the time being. Changes since v2: * Added mypy type checking throughout * Use exeter "scenarios" to reduce boilerplate * Folded together a number of closely related patches (from 22 patches down to 15) * Entirely avoid open-coded Python context managers in favour of contextlib.contextmanager * No longer accidentally run a lot of the "meta" tests in the "real" testsuite * So, so many assorted cleanups David Gibson (3): test: Extend test scripts to allow running exeter tests. test: Run static checkers as exeter tests test: Convert build tests to exeter test/.gitignore | 1 + test/Makefile | 5 ++- test/build/all | 61 ------------------------- test/build/build.py | 84 +++++++++++++++++++++++++++++++++++ test/build/clang_tidy | 17 ------- test/build/cppcheck | 17 ------- test/build/static_checkers.sh | 30 +++++++++++++ test/lib/exeter | 46 +++++++++++++++++++ test/run | 18 +++++--- test/smoke/smoke.sh | 27 +++++++++++ 10 files changed, 204 insertions(+), 102 deletions(-) delete mode 100644 test/build/all create mode 100755 test/build/build.py delete mode 100644 test/build/clang_tidy delete mode 100644 test/build/cppcheck create mode 100755 test/build/static_checkers.sh create mode 100644 test/lib/exeter create mode 100755 test/smoke/smoke.sh -- 2.50.1

2 17

[PATCH v2] treewide: Flush pcap and log files, if used, before exiting
by Stefano Brivio 19 Aug '25

19 Aug '25

I didn't imagine that occasionally truncated pcap and log files, as a result of commit d0006fa784a7 ("treewide: use _exit() over exit()"), would be such a big deal, until I tried to debug TCP issues with this beauty: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done ...flush files and pcap if we're using them. Ignore fsync() errors for the log file as we obviously can't reliably log them. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Fix commit reference in commit message README.md | 2 +- log.c | 2 +- log.h | 1 + passt.c | 1 + pasta.c | 2 ++ pcap.c | 2 +- pcap.h | 2 ++ tap.c | 4 +++- util.c | 15 +++++++++++++++ util.h | 1 + 10 files changed, 28 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 54fed07..8f188f4 100644 --- a/README.md +++ b/README.md @@ -291,7 +291,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (30 syscalls allowed for _passt_, 41 for +* ✅ restrictive seccomp profiles (33 syscalls allowed for _passt_, 43 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available diff --git a/log.c b/log.c index 33b89fc..21e3673 100644 --- a/log.c +++ b/log.c @@ -35,7 +35,7 @@ static int log_sock = -1; /* Optional socket to system logger */ static char log_ident[BUFSIZ]; /* Identifier string for openlog() */ static int log_mask; /* Current log priority mask */ -static int log_file = -1; /* Optional log file descriptor */ +int log_file = -1; /* Optional log file descriptor */ static size_t log_size; /* Maximum log file size in bytes */ static size_t log_written; /* Currently used bytes in log file */ static size_t log_cut_size; /* Bytes to cut at start on rotation */ diff --git a/log.h b/log.h index 08aa88c..c8473c0 100644 --- a/log.h +++ b/log.h @@ -41,6 +41,7 @@ void logmsg_perror(int pri, const char *format, ...) _exit(EXIT_FAILURE); \ } while (0) +extern int log_file; extern int log_trace; extern bool log_conf_parsed; extern bool log_stderr; diff --git a/passt.c b/passt.c index 388d10f..a4ec115 100644 --- a/passt.c +++ b/passt.c @@ -170,6 +170,7 @@ static void exit_handler(int signal) { (void)signal; + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); } diff --git a/pasta.c b/pasta.c index c207692..687406b 100644 --- a/pasta.c +++ b/pasta.c @@ -70,6 +70,8 @@ void pasta_child_handler(int signal) if (pasta_child_pid && !waitid(P_PID, pasta_child_pid, &infop, WEXITED | WNOHANG)) { if (infop.si_pid == pasta_child_pid) { + fsync_pcap_and_log(); + if (infop.si_code == CLD_EXITED) _exit(infop.si_status); diff --git a/pcap.c b/pcap.c index 46d11a2..e9d8d80 100644 --- a/pcap.c +++ b/pcap.c @@ -37,7 +37,7 @@ #define PCAP_VERSION_MINOR 4 -static int pcap_fd = -1; +int pcap_fd = -1; struct pcap_pkthdr { uint32_t tv_sec; diff --git a/pcap.h b/pcap.h index 9795f2e..2aeb53e 100644 --- a/pcap.h +++ b/pcap.h @@ -6,6 +6,8 @@ #ifndef PCAP_H #define PCAP_H +extern int pcap_fd; + void pcap(const char *pkt, size_t l2len); void pcap_multiple(const struct iovec *iov, size_t frame_parts, unsigned int n, size_t offset); diff --git a/tap.c b/tap.c index 6db5d88..cddc164 100644 --- a/tap.c +++ b/tap.c @@ -1117,8 +1117,10 @@ void tap_sock_reset(struct ctx *c) { info("Client connection closed%s", c->one_off ? ", exiting" : ""); - if (c->one_off) + if (c->one_off) { + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); + } /* Close the connected socket, wait for a new connection */ epoll_del(c, c->fd_tap); diff --git a/util.c b/util.c index 3e93d47..c492f90 100644 --- a/util.c +++ b/util.c @@ -34,6 +34,7 @@ #include "passt.h" #include "packet.h" #include "log.h" +#include "pcap.h" #ifdef HAS_GETRANDOM #include <sys/random.h> #endif @@ -1045,3 +1046,17 @@ void abort_with_msg(const char *fmt, ...) */ abort(); } + +/** + * fsync_pcap_and_log() - Flush pcap and log files as needed + * + * #syscalls fsync + */ +void fsync_pcap_and_log(void) +{ + if (pcap_fd != -1 && fsync(pcap_fd)) + warn_perror("Failed to flush pcap file, it might be truncated"); + + if (log_file != -1) + (void)fsync(log_file); +} diff --git a/util.h b/util.h index b5b1b31..2a8c38f 100644 --- a/util.h +++ b/util.h @@ -226,6 +226,7 @@ int read_all_buf(int fd, void *buf, size_t len); int read_remainder(int fd, const struct iovec *iov, size_t cnt, size_t skip); void close_open_files(int argc, char **argv); bool snprintf_check(char *str, size_t size, const char *format, ...); +void fsync_pcap_and_log(void); /** * af_name() - Return name of an address family -- 2.43.0

2 1

[PATCH 0/6] tcp: Fixes for issues uncovered by tests with 6.17-rc1 kernels
by Stefano Brivio 19 Aug '25

19 Aug '25

Starting from Linux kernel commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"), window limits are enforced more aggressively with a bigger amount of zero-window updates compared to what happened with e2142825c120 ("net: tcp: send zero-window ACK when no memory") alone, and occasional duplicate ACKs can now be seen also for local transfers with default (208 KiB) socket buffer sizes. Paul reports that, with 6.17-rc1-ish kernels, Podman tests for the pasta integration occasionally fail on the "TCP/IPv4 large transfer, tap" case. While playing with a reproducer that seems to be matching those failures: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done and a kernel including that commit, I hit a few different failures, that should be fixed by this series. Stefano Brivio (6): tcp: FIN flags have to be retransmitted as well tcp: Factor sequence rewind for retransmissions into a new function tcp: Rewind sequence when guest shrinks window to zero tcp: Fix closing logic for half-closed connections tcp: Don't try to transmit right after the peer shrank the window to zero tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent tcp.c | 170 ++++++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 118 insertions(+), 52 deletions(-) -- 2.43.0

3 16

[PATCH] treewide: Flush pcap and log files, if used, before exiting
by Stefano Brivio 15 Aug '25

15 Aug '25

I didn't imagine that occasionally truncated pcap and log files, as a result of commit a9d63f91a59a ("passt-repair: use _exit() over return"), would be such a big deal, until I tried to debug TCP issues with this beauty: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done ...flush files and pcap if we're using them. Ignore fsync() errors for the log file as we obviously can't reliably log them. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 2 +- log.c | 2 +- log.h | 1 + passt.c | 1 + pasta.c | 2 ++ pcap.c | 2 +- pcap.h | 2 ++ tap.c | 4 +++- util.c | 15 +++++++++++++++ util.h | 1 + 10 files changed, 28 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 54fed07..8f188f4 100644 --- a/README.md +++ b/README.md @@ -291,7 +291,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (30 syscalls allowed for _passt_, 41 for +* ✅ restrictive seccomp profiles (33 syscalls allowed for _passt_, 43 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available diff --git a/log.c b/log.c index 33b89fc..21e3673 100644 --- a/log.c +++ b/log.c @@ -35,7 +35,7 @@ static int log_sock = -1; /* Optional socket to system logger */ static char log_ident[BUFSIZ]; /* Identifier string for openlog() */ static int log_mask; /* Current log priority mask */ -static int log_file = -1; /* Optional log file descriptor */ +int log_file = -1; /* Optional log file descriptor */ static size_t log_size; /* Maximum log file size in bytes */ static size_t log_written; /* Currently used bytes in log file */ static size_t log_cut_size; /* Bytes to cut at start on rotation */ diff --git a/log.h b/log.h index 08aa88c..c8473c0 100644 --- a/log.h +++ b/log.h @@ -41,6 +41,7 @@ void logmsg_perror(int pri, const char *format, ...) _exit(EXIT_FAILURE); \ } while (0) +extern int log_file; extern int log_trace; extern bool log_conf_parsed; extern bool log_stderr; diff --git a/passt.c b/passt.c index 388d10f..a4ec115 100644 --- a/passt.c +++ b/passt.c @@ -170,6 +170,7 @@ static void exit_handler(int signal) { (void)signal; + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); } diff --git a/pasta.c b/pasta.c index c207692..687406b 100644 --- a/pasta.c +++ b/pasta.c @@ -70,6 +70,8 @@ void pasta_child_handler(int signal) if (pasta_child_pid && !waitid(P_PID, pasta_child_pid, &infop, WEXITED | WNOHANG)) { if (infop.si_pid == pasta_child_pid) { + fsync_pcap_and_log(); + if (infop.si_code == CLD_EXITED) _exit(infop.si_status); diff --git a/pcap.c b/pcap.c index 46d11a2..e9d8d80 100644 --- a/pcap.c +++ b/pcap.c @@ -37,7 +37,7 @@ #define PCAP_VERSION_MINOR 4 -static int pcap_fd = -1; +int pcap_fd = -1; struct pcap_pkthdr { uint32_t tv_sec; diff --git a/pcap.h b/pcap.h index 9795f2e..2aeb53e 100644 --- a/pcap.h +++ b/pcap.h @@ -6,6 +6,8 @@ #ifndef PCAP_H #define PCAP_H +extern int pcap_fd; + void pcap(const char *pkt, size_t l2len); void pcap_multiple(const struct iovec *iov, size_t frame_parts, unsigned int n, size_t offset); diff --git a/tap.c b/tap.c index 6db5d88..cddc164 100644 --- a/tap.c +++ b/tap.c @@ -1117,8 +1117,10 @@ void tap_sock_reset(struct ctx *c) { info("Client connection closed%s", c->one_off ? ", exiting" : ""); - if (c->one_off) + if (c->one_off) { + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); + } /* Close the connected socket, wait for a new connection */ epoll_del(c, c->fd_tap); diff --git a/util.c b/util.c index 3e93d47..c492f90 100644 --- a/util.c +++ b/util.c @@ -34,6 +34,7 @@ #include "passt.h" #include "packet.h" #include "log.h" +#include "pcap.h" #ifdef HAS_GETRANDOM #include <sys/random.h> #endif @@ -1045,3 +1046,17 @@ void abort_with_msg(const char *fmt, ...) */ abort(); } + +/** + * fsync_pcap_and_log() - Flush pcap and log files as needed + * + * #syscalls fsync + */ +void fsync_pcap_and_log(void) +{ + if (pcap_fd != -1 && fsync(pcap_fd)) + warn_perror("Failed to flush pcap file, it might be truncated"); + + if (log_file != -1) + (void)fsync(log_file); +} diff --git a/util.h b/util.h index b5b1b31..2a8c38f 100644 --- a/util.h +++ b/util.h @@ -226,6 +226,7 @@ int read_all_buf(int fd, void *buf, size_t len); int read_remainder(int fd, const struct iovec *iov, size_t cnt, size_t skip); void close_open_files(int argc, char **argv); bool snprintf_check(char *str, size_t size, const char *format, ...); +void fsync_pcap_and_log(void); /** * af_name() - Return name of an address family -- 2.43.0

2 6

Exeter testing, next steps
by David Gibson 15 Aug '25

15 Aug '25

Today I finally had a good look at what the next steps need to be if we are to use exeter based test "for real" in the passt repo. I already have draft series which move a bunch of the simpler tests to exeter. But in order to actually use these we need some sort of runner. We're not tied to that runner, we can easily change - that's the whole point of exeter - but we need to have something. AIUI, Stefano is not happy with the idea of using either Avocado or Meson as the default which were the runners I initially focused on for exeter. I now suggest two more options: 1) Add a tool as part of exeter that will generate a BATS test script from an exeter test program. So you'd do something like: $ exetool --bats <exeter_test_program> > foo.bats $ bats foo.bats This should be pretty easy to do, it's basically what I already have for Avocado support, indeed a little easier. For reasons internal to exeter, Python is the obvious choice to implement exetool, but I could do it in shell if you really don't like that. 2) Hand-roll a minimal exeter runner as part of passt's existing test scripts. I'm thinking you could essentially point our test stuff at an exeter program as an alternative to pointing it at a file with the existing test DSL. This is more work, but still not too bad. It has the advantage of not adding another dependency, and means we could count exeter results along with our existing test results in the final summary. However, we'd lose parallel execution and filtering. Stefano, would you be willing to merge patches which add some basic exeter tests using one of these approaches? This would probably just be static checked and build tests at this point, as a proof-of-concept. If we can start introducing some exeter tests, the next step would be to work on the support library stuff for constructing more complex network environments from namespaces. I have draft series with this as well, but I was looking at splitting it into another mini-project (tentative name "sinte" - Simulated Inter Network Test Environment). -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 8