- dev - passt

[PATCH 0/2] Support for SO_PEEK_OFF when a available
by Jon Maloy 29 Apr '24

29 Apr '24

First commit introduces support for SO_PEEK_OFF socket option. Second commit adds a workaround for a kernel TCP bug. Jon Maloy (2): tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 63 +++++++++++++++++++++++++++++++++++++++++++----------- tcp_conn.h | 2 ++ 2 files changed, 53 insertions(+), 12 deletions(-) -- 2.42.0

3 14

passt: new version 2024_04_26.d03c4e2 available
by Stefano Brivio 26 Apr '24

26 Apr '24

The new version with tag 2024_04_26.d03c4e2 includes the following changes: d03c4e2 netlink: Use IFA_F_NODAD also while duplicating addresses from the host bfc83b5 netlink: For IPv4, IFA_LOCAL is the interface address, not IFA_ADDRESS ff2ff2f test: Make log truncation test more robust 2681366 test: Slight simplification to pasta log tests 0804fdb udp: Correctly look up outbound socket with port remappings 9560123 tcp: Replace TCP buffer structure by an iovec array 27f1c76 conf: Don't fail if the template interface doesn't have a MAC address eca8baa conf: We're interested in the MAC address, not in the MAC itself ee338a2 pasta, util: Align stack area for clones to maximum natural alignment 5d5208b treewide: Compilers' name for armv6l and armv7l is "arm" https://passt.top/passt/log/?qt=range&q=2024_04_05.954589b..2024_04_26.d03c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7374013/ permanent mirror: https://passt.top/builds/copr/0^20240426.gd03c4e2/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://build.opensuse.org/package/requests/Virtualization:containers/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gd03c4e2-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0d03c4e2-1_all.deb -- Stefano

1 0

[PATCH v2 0/4] mbuto: Assorted fixes and simplifications
by David Gibson 26 Apr '24

26 Apr '24

While debugging a problem Laurent Vivier was having with the passt test suite, I discovered mbuto's archivemount support is entirely broken: if archivemount is on the system, mbuto won't work. While fixing that, I discovered some slightly related simplfications that can be made. Here they all are. Changes since v1: * Updated commit message in 2/4 to clarify why the desired advantages of using archivemount can't be used in practice * Improve accuracy of comment on compress_select in 3/4 * Clarify removal of update existing archive functionality. David Gibson (4): ${wd} is always set, no need to test for it Remove stale archivemount support Split "auto" compression mode into its own path Remove unnecessary cpio_init function mbuto | 128 +++++++++++++++------------------------------------------- 1 file changed, 33 insertions(+), 95 deletions(-) -- 2.44.0

2 5

[PATCH] netlink: For IPv4, IFA_LOCAL is the interface address, not IFA_ADDRESS
by Stefano Brivio 26 Apr '24

26 Apr '24

See the comment to the unnamed enum in linux/if_addr.h, which currently states: /* * Important comment: * IFA_ADDRESS is prefix address, rather than local interface address. * It makes no difference for normally configured broadcast interfaces, * but for point-to-point IFA_ADDRESS is DESTINATION address, * local address is supplied in IFA_LOCAL attribute. * * [...] */ if we fetch IFA_ADDRESS, and we have a point-to-point link with a peer address configured, we'll source the peer address as "our" address, and refuse to resolve it in arp(). This was reported with pasta and a tun upstream interface configured by OpenVPN in "p2p" topology: the target namespace will have similar addresses and routes as the host, which is fine, and will try to resolve the point-to-point peer address (because it's the default gateway). Given that we configure it as our address (only internally, not for visibly in the namespace), we'll fail to resolve that and traffic doesn't go anywhere. Note that this is not the case for IPv6: there, IFA_ADDRESS is the actual, local address of the interface, and IFA_LOCAL is not necessarily present, so the comment in linux/if_addr.h doesn't apply either. Link: https://github.com/containers/podman/issues/22320 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/netlink.c b/netlink.c index 89c0641..447fea2 100644 --- a/netlink.c +++ b/netlink.c @@ -668,7 +668,8 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { - if (rta->rta_type != IFA_ADDRESS) + if ((af == AF_INET && rta->rta_type != IFA_LOCAL) || + (af == AF_INET6 && rta->rta_type != IFA_ADDRESS)) continue; if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { -- 2.43.0

2 1

[PATCH 0/4] mbuto: Assorted fixes and simplifications
by David Gibson 26 Apr '24

26 Apr '24

While debugging a problem Laurent Vivier was having with the passt test suite, I discovered mbuto's archivemount support is entirely broken: if archivemount is on the system, mbuto won't work. While fixing that, I discovered some slightly related simplfications that can be made. Here they all are. David Gibson (4): ${wd} is always set, no need to test for it Remove stale archivemount support Split "auto" compression mode into its own path Remove unnecessary cpio_init function mbuto | 120 +++++++++++++++------------------------------------------- 1 file changed, 30 insertions(+), 90 deletions(-) -- 2.44.0

2 15

[PATCH] netlink: Use IFA_F_NODAD also while duplicating addresses from the host
by Stefano Brivio 26 Apr '24

26 Apr '24

...not just for a single set address (legacy operation with --no-copy-addrs). I forgot to add this to nl_addr_dup(). Note that we can have two version of flags: the 8-bit ifa_flags in ifaddrmsg, and the newer 32-bit version as IFA_FLAGS attribute, which is given priority if present. Make sure IFA_F_NODAD is set in both. Without this, a Podman user reports, something on the lines of: pasta --config-net -- ping -c1 -6 passt.top would fail as the kernel would start Duplicate Address Detection once we configure the address, which can't really work (and doesn't make sense) in this case. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/netlink.c b/netlink.c index 447fea2..b3897e6 100644 --- a/netlink.c +++ b/netlink.c @@ -804,6 +804,8 @@ int nl_addr_dup(int s_src, unsigned int ifi_src, continue; ifa->ifa_index = ifi_dst; + /* Same as nl_addr_set(), but here it's more than a default */ + ifa->ifa_flags |= IFA_F_NODAD; for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { @@ -811,6 +813,10 @@ int nl_addr_dup(int s_src, unsigned int ifi_src, if (rta->rta_type == IFA_LABEL || rta->rta_type == IFA_CACHEINFO) rta->rta_type = IFA_UNSPEC; + + /* If 32-bit flags are used, add IFA_F_NODAD there */ + if (rta->rta_type == IFA_FLAGS) + *(uint32_t *)RTA_DATA(rta) |= IFA_F_NODAD; } rc = nl_do(s_dst, nh, RTM_NEWADDR, -- 2.43.0

2 1

[PATCH 0/2] Fixes for logging tests
by David Gibson 25 Apr '24

25 Apr '24

Here's a fix for a spurious test failure in the logging tests, along with a trivial cleanup. David Gibson (2): test: Slight simplification to pasta log tests test: Make log truncation test more robust test/pasta_options/log_to_file | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) -- 2.44.0

2 4

[PATCH] udp: Correctly look up outbound socket with port remappings
by David Gibson 25 Apr '24

25 Apr '24

Commit bb9bf0bb ("tcp, udp: Don't precompute port remappings in epoll references") changed the epoll reference for UDP sockets to include the bound port as seen by the socket itself, rather than the bound port it would be translated to on the guest side. As a side effect, it also means that udp_tap_map[] is indexed by the bound port on the host side, rather than on the guest side. This is consistent and a good idea, however we forgot to account for it when finding the correct outgoing socket for packets originating in the guest. This means that if forwarding UDP inbound with a port number change, reply packets would be misdirected. Fix this by applying the reverse mapping before looking up the socket in udp_tap_handler(). While we're at it, use 'port' directly instead of 'uref.port' in udp_sock_init(). Those now always have the same value - failing to realise that is the same error as above. Link: https://bugs.passt.top/show_bug.cgi?id=87 Fixes: bb9bf0bb ("tcp, udp: Don't precompute port remappings in epoll references") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/udp.c b/udp.c index 694424a5..594ea191 100644 --- a/udp.c +++ b/udp.c @@ -829,6 +829,7 @@ int udp_tap_handler(struct ctx *c, uint8_t pif, * and destination, so we can just take those from the first message. */ src = ntohs(uh->source); + src += c->udp.fwd_in.rdelta[src]; dst = ntohs(uh->dest); if (af == AF_INET) { @@ -1005,7 +1006,7 @@ int udp_sock_init(const struct ctx *c, int ns, sa_family_t af, r4 = s = sock_l4(c, AF_INET, IPPROTO_UDP, addr, ifname, port, uref.u32); - udp_tap_map[V4][uref.port].sock = s < 0 ? -1 : s; + udp_tap_map[V4][port].sock = s < 0 ? -1 : s; udp_splice_init[V4][port].sock = s < 0 ? -1 : s; } else { r4 = s = sock_l4(c, AF_INET, IPPROTO_UDP, @@ -1022,7 +1023,7 @@ int udp_sock_init(const struct ctx *c, int ns, sa_family_t af, r6 = s = sock_l4(c, AF_INET6, IPPROTO_UDP, addr, ifname, port, uref.u32); - udp_tap_map[V6][uref.port].sock = s < 0 ? -1 : s; + udp_tap_map[V6][port].sock = s < 0 ? -1 : s; udp_splice_init[V6][port].sock = s < 0 ? -1 : s; } else { r6 = s = sock_l4(c, AF_INET6, IPPROTO_UDP, -- 2.44.0

2 1

[PATCH 0/2] netlink: Don't duplicate routes with mismatching interfaces
by Stefano Brivio 23 Apr '24

23 Apr '24

Stefano Brivio (2): netlink: Fix iterations over nexthop objects netlink: Don't duplicate routes referring to unrelated host interfaces netlink.c | 53 ++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 9 deletions(-) -- 2.43.0

1 2

[PATCH] netlink: Drop point-to-point peer information when we copy addresses
by Stefano Brivio 23 Apr '24

23 Apr '24

If the template host interface is of type tun, and it's configured with a point-to-point peer address (that's what happens for example with openvpn and '--topology net30'), pasta will copy the peer information onto the namespace interface. But the namespace interface is not actually a point-to-point tunnel, and we won't resolve the peer address via ARP either, so we have to drop this information to get the expected behaviour (traffic regularly sent over our tap interface). Link: https://github.com/containers/podman/issues/22320 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/netlink.c b/netlink.c index 89c0641..73aaa4b 100644 --- a/netlink.c +++ b/netlink.c @@ -792,8 +792,8 @@ int nl_addr_dup(int s_src, unsigned int ifi_src, seq = nl_send(s_src, &req, RTM_GETADDR, NLM_F_DUMP, sizeof(req)); nl_foreach_oftype(nh, status, s_src, buf, seq, RTM_NEWADDR) { + struct rtattr *rta, *rta_local = NULL; struct ifaddrmsg *ifa; - struct rtattr *rta; size_t na; ifa = (struct ifaddrmsg *)NLMSG_DATA(nh); @@ -804,12 +804,33 @@ int nl_addr_dup(int s_src, unsigned int ifi_src, ifa->ifa_index = ifi_dst; + for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na); + rta = RTA_NEXT(rta, na)) { + if (rta->rta_type == IFA_LOCAL) { + rta_local = rta; + break; + } + } + for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { /* Strip label and expiry (cacheinfo) information */ if (rta->rta_type == IFA_LABEL || rta->rta_type == IFA_CACHEINFO) rta->rta_type = IFA_UNSPEC; + + /* Different values for IFA_ADDRESS and IFA_LOCAL mean + * that IFA_LOCAL is the locally configured address, and + * IFA_ADDRESS is the peer address for a point-to-point + * interface. But our namespace interface isn't really a + * point-to-point tunnel, and we can't resolve that peer + * address via ARP: simply drop it, and keep the local + * address. + */ + if (rta->rta_type == IFA_ADDRESS && rta_local) { + memcpy(RTA_DATA(rta), RTA_DATA(rta_local), + RTA_PAYLOAD(rta)); + } } rc = nl_do(s_dst, nh, RTM_NEWADDR, -- 2.43.0

2 2

2024

2023

2022

2021

dev