- dev - passt

[PATCH] tcp: make tcp_sock_set_bufsize() static (again)
by Laurent Vivier 27 Dec '23

27 Dec '23

e5eefe77435a ("tcp: Refactor to use events instead of states, split out spliced implementation") has exported tcp_sock_set_bufsize() to be able to use it in tcp_splice.c, but 6ccab72d9b40 has removed its use in tcp_splice.c, so we can set it static again. Fixes: 6ccab72d9b40 ("tcp: Improve handling of fallback if socket pool is empty on new splice") Cc: david(a)gibson.dropbear.id.au Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 2 +- tcp.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index f506cfdd3bc7..1680b516b5b9 100644 --- a/tcp.c +++ b/tcp.c @@ -929,7 +929,7 @@ static void tcp_get_sndbuf(struct tcp_tap_conn *conn) * tcp_sock_set_bufsize() - Set SO_RCVBUF and SO_SNDBUF to maximum values * @s: Socket, can be -1 to avoid check in the caller */ -void tcp_sock_set_bufsize(const struct ctx *c, int s) +static void tcp_sock_set_bufsize(const struct ctx *c, int s) { int v = INT_MAX / 2; /* Kernel clamps and rounds, no need to check */ diff --git a/tcp.h b/tcp.h index 27b11668f258..87a6bf9f0ee8 100644 --- a/tcp.h +++ b/tcp.h @@ -23,7 +23,6 @@ int tcp_init(struct ctx *c); void tcp_timer(struct ctx *c, const struct timespec *ts); void tcp_defer_handler(struct ctx *c); -void tcp_sock_set_bufsize(const struct ctx *c, int s); void tcp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s); /** -- 2.42.0

3 2

[PATCH] checksum: Don't use linux/icmp.h when netinet/ip_icmp.h will do
by David Gibson 27 Dec '23

27 Dec '23

In most places where we need to get ICMP definitions, we get them from <netinet/ip_icmp.h>. However in checksum.c we instead include <linux/icmp.h>. Change it to use <netinet/ip_icmp.h> for consistency. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- checksum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checksum.c b/checksum.c index 03b8a7c..f21c9b7 100644 --- a/checksum.c +++ b/checksum.c @@ -49,11 +49,11 @@ #include <arpa/inet.h> #include <netinet/ip.h> #include <netinet/tcp.h> +#include <netinet/ip_icmp.h> #include <stddef.h> #include <stdint.h> #include <linux/udp.h> -#include <linux/icmp.h> #include <linux/icmpv6.h> /* Checksums are optional for UDP over IPv4, so we usually just set -- 2.43.0

2 1

[PATCH v2 0/4] TCP hash table changes, in preparation for flow table
by David Gibson 27 Dec '23

27 Dec '23

I now have an in-progress draft of a unified hash table to go with the unified flow table. This turns out to be easier if we first make some preliminary changes to the structure of the TCP hash table. So, here are those. Changes since v1: * Use while loops instead of some equivalent, but hard to read for loops for the hash probing. * Switch from probing forwards through hash buckets to probing backwards. This makes the code closer to the version in Knuth its based on, and thus easier to see if we've made a mistake in adaptation. * Improve the helpers for modular arithmetic in use * Correct an error where we had things exactly the wrong way around when finding entries to move during removal. * Add a patch fixing a conceptual / documentation problem in some adjacent code David Gibson (4): tcp: Fix conceptually incorrect byte-order switch in tcp_tap_handler() tcp: Switch hash table to linear probing instead of chaining tcp: Implement hash table with indices rather than pointers tcp: Don't account for hash table size in tcp_hash() flow.h | 11 +++++ tcp.c | 143 ++++++++++++++++++++++++++++------------------------- tcp_conn.h | 2 - util.h | 28 +++++++++++ 4 files changed, 114 insertions(+), 70 deletions(-) -- 2.43.0

2 5

[PATCH v2] README: Default SLAAC prefix comes from address (not prefix) on host
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Fix botched paragraph README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index c360037..916260e 100644 --- a/README.md +++ b/README.md @@ -406,13 +406,13 @@ upstream interface of the host, and the same default gateway as the default gateway of the host. Addresses are translated in case the guest is seen using a different address from the assigned one. -For IPv6, the guest or namespace is assigned, via SLAAC, the same prefix as the -upstream interface of the host, the same default route as the default route of -the host, and, if a DHCPv6 client is running in the guest or namespace, also the -same address as the upstream address of the host. This means that, with a DHCPv6 -client in the guest or namespace, addresses don't need to be translated. Should -the client use a different address, the destination address is translated for -packets going to the guest or to the namespace. +For IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from +the address of the upstream interface of the host, the same default route as the +default route of the host, and, if a DHCPv6 client is running in the guest or +namespace, also the same address as the upstream address of the host. This means +that, with a DHCPv6 client in the guest or namespace, addresses don't need to be +translated. Should the client use a different address, the destination address +is translated for packets going to the guest or to the namespace. ### Local connections with _passt_ -- 2.39.2

1 0

[PATCH] README: Default SLAAC prefix comes from address (not prefix) on host
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index c360037..e73a51d 100644 --- a/README.md +++ b/README.md @@ -406,10 +406,11 @@ upstream interface of the host, and the same default gateway as the default gateway of the host. Addresses are translated in case the guest is seen using a different address from the assigned one. -For IPv6, the guest or namespace is assigned, via SLAAC, the same prefix as the -upstream interface of the host, the same default route as the default route of -the host, and, if a DHCPv6 client is running in the guest or namespace, also the -same address as the upstream address of the host. This means that, with a DHCPv6 +For IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from +the address of the upstream interface of the hostthe same prefix as the upstream +interface of the host, the same default route as the default route of the host, +and, if a DHCPv6 client is running in the guest or namespace, also the same +address as the upstream address of the host. This means that, with a DHCPv6 client in the guest or namespace, addresses don't need to be translated. Should the client use a different address, the destination address is translated for packets going to the guest or to the namespace. -- 2.39.2

1 0

[PATCH] netlink: Fetch most specific (longest prefix) address in nl_addr_get()
by Stefano Brivio 27 Dec '23

27 Dec '23

This happened in most cases implicitly before commit eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions"): while going through results from netlink, we would only copy an address into the provided return buffer if no address had been picked yet. Because of the insertion logic in the kernel (ipv6_link_dev_addr()), the first returned address would also be the one added last, and, in case of a Linux guest using a DHCPv6 client as well as SLAAC, that would be the address assigned via DHCPv6, because SLAAC happens before the DHCPv6 exchange. The effect of, instead, picking the last returned address (first assigned) is visible when passt or pasta runs nested, given that, by default, they advertise a prefix for SLAAC usage, plus an address via DHCPv6. The first level (L1 guest) would get a /64 address by means of SLAAC, and a /128 address via DHCPv6, the latter matching the address on the host. The second level (L2 guest) would also get two addresses: a /64 via SLAAC (same prefix as the host), and a /128 via DHCPv6, matching the the L1 SLAAC-assigned address, not the one obtained via DHCPv6. That is, none of the L2 addresses would match the address on the host. The whole point of having a DHCPv6 server is to avoid (implicit) NAT when possible, though. Fix this in a more explicit way than the behaviour we initially had: pick the first address among the set of most specific ones, by comparing prefix lengths. Do this for IPv4 and for link-local addresses, too, to match in any case the implementation of the default source address selection. Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Fixes: eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/netlink.c b/netlink.c index b221c79..6e40d28 100644 --- a/netlink.c +++ b/netlink.c @@ -527,7 +527,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, } /** - * nl_addr_get() - Get IP address for given interface and address family + * nl_addr_get() - Get most specific global address, given interface and family * @s: Netlink socket * @ifi: Interface index in outer network namespace * @af: Address family @@ -540,6 +540,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, int nl_addr_get(int s, unsigned int ifi, sa_family_t af, void *addr, int *prefix_len, void *addr_l) { + uint8_t prefix_max = 0, prefix_max_ll = 0; struct req_t { struct nlmsghdr nlh; struct ifaddrmsg ifa; @@ -566,17 +567,25 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, if (rta->rta_type != IFA_ADDRESS) continue; - if (af == AF_INET) { + if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - *prefix_len = ifa->ifa_prefixlen; + + prefix_max = *prefix_len = ifa->ifa_prefixlen; } else if (af == AF_INET6 && addr && - ifa->ifa_scope == RT_SCOPE_UNIVERSE) { + ifa->ifa_scope == RT_SCOPE_UNIVERSE && + ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max = ifa->ifa_prefixlen; } if (addr_l && - af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK) + af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK && + ifa->ifa_prefixlen > prefix_max_ll) { memcpy(addr_l, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max_ll = ifa->ifa_prefixlen; + } } } return status; -- 2.39.2

1 0

[PATCH] flow: Add missing include, stdio.h
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: lemmi <lemmi(a)nerd2nerd.org> Link: https://github.com/void-linux/void-packages/actions/runs/7097192513/job/193… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- flow.c | 1 + 1 file changed, 1 insertion(+) diff --git a/flow.c b/flow.c index d24726d..a8aeb15 100644 --- a/flow.c +++ b/flow.c @@ -6,6 +6,7 @@ */ #include <stdint.h> +#include <stdio.h> #include <unistd.h> #include <string.h> -- 2.39.2

2 1

[PATCH] tcp: Cast timeval fields to unsigned long long for printing
by Stefano Brivio 27 Dec '23

27 Dec '23

On x32, glibc defines time_t and suseconds_t (the latter, also known as __syscall_slong_t) as unsigned long long, whereas "everywhere else", including x86_64 and i686, those are unsigned long. See also https://sourceware.org/bugzilla/show_bug.cgi?id=16437 for all the gory details. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index f506cfd..1e4d2fa 100644 --- a/tcp.c +++ b/tcp.c @@ -727,8 +727,9 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) it.it_value.tv_sec = ACT_TIMEOUT; } - flow_dbg(conn, "timer expires in %lu.%03lus", it.it_value.tv_sec, - it.it_value.tv_nsec / 1000 / 1000); + flow_dbg(conn, "timer expires in %llu.%03llus", + (unsigned long long)it.it_value.tv_sec, + (unsigned long long)it.it_value.tv_nsec / 1000 / 1000); timerfd_settime(conn->timer, 0, &it, NULL); } -- 2.39.2

2 1

[PATCH] README: Update "Availability" section
by Stefano Brivio 27 Dec '23

27 Dec '23

It's been a while -- there are now official packages for Arch Linux, Gentoo, Void Linux. Suggested-by: Rahil Bhimjiani <me(a)rahil.website> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 6d00313..c360037 100644 --- a/README.md +++ b/README.md @@ -341,19 +341,17 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ⌚ drop-in replacement for VPNKit (rootless Docker) ### Availability -* ✅ official [packages](https://gitlab.com/redhat/centos-stream/rpms/passt) for - CentOS Stream -* ✅ official [packages](https://tracker.debian.org/pkg/passt) for Debian -* ✅ official [packages](https://src.fedoraproject.org/rpms/passt) for Fedora -* ✅ official [packages](https://packages.ubuntu.com/lunar/passt) for Ubuntu -* ✅ unofficial [packages](https://aur.archlinux.org/packages/passt-git) for - Arch Linux -* ✅ unofficial - [packages](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for EPEL, - Mageia -* 🛠 official - [packages](https://build.opensuse.org/package/show/Virtualization:containers… - for openSUSE +* official packages for: + * ✅ [Arch Linux](https://archlinux.org/packages/extra/x86_64/passt/) ([aarch64](https://archlinuxarm.org/packages/aarch64/passt), [i486](https://www.archlinux32.org/packages/?q=passt)) + * ✅ [CentOS Stream]((https://gitlab.com/redhat/centos-stream/rpms/passt) + * ✅ [Debian](https://tracker.debian.org/pkg/passt) + * ✅ [Fedora](https://src.fedoraproject.org/rpms/passt) + * ✅ [Gentoo](https://packages.gentoo.org/packages/net-misc/passt) + * ✅ [Ubuntu](https://launchpad.net/ubuntu/+source/passt) + * ✅ [Void Linux](https://voidlinux.org/packages/?q=passt) +* unofficial packages for: + * ✅ [EPEL, Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) + * 🛠 [openSUSE](https://build.opensuse.org/package/show/Virtualization:containers… * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 static builds for other RPM-based distributions * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 -- 2.39.2

2 1

[PATCH v2 00/13] Manage more flow related things from generic flow code
by David Gibson 20 Dec '23

20 Dec '23

There are a number of things that are more-or-less general to flows which are still explicitly handled in tcp.c and tcp_splice.c including allocation and freeing of flow entries, and dispatch of deferred and timer functions. Even without adding more fields to the common flow structure, we can handle a number of these in a more flow-centric way. Unlike v1 this version is based on the hash table rework series. Changes since v1: * Store the timestamp of last flow timers run in a global, rather than a ctx field * Rebased on the TCP hash table rework * Add patches 9..13/13 with changes to allocation and freeing of flow entries. David Gibson (13): flow: Make flow_table.h #include the protocol specific headers it needs treewide: Standardise on 'now' for current timestamp variables tcp, tcp_splice: Remove redundant handling from tcp_timer() tcp, tcp_splice: Move per-type cleanup logic into per-type helpers flow, tcp: Add flow-centric dispatch for deferred flow handling flow, tcp: Add handling for per-flow timers epoll: Better handling of number of epoll types tcp, tcp_splice: Avoid double layered dispatch for connected TCP sockets flow: Move flow_log_() to near top of flow.c flow: Move flow_count from context structure to a global flow: Abstract helpers for allocating new flows flow: Enforce that freeing of closed flows must happen in deferred handlers flow: Avoid moving flow entries to compact table flow.c | 201 +++++++++++++++++++++++++++++++++++++++++---------- flow.h | 5 +- flow_table.h | 34 +++++++++ icmp.c | 12 +-- icmp.h | 2 +- log.c | 34 ++++----- passt.c | 20 +++-- passt.h | 9 +-- tcp.c | 139 ++++++++--------------------------- tcp.h | 2 +- tcp_conn.h | 8 +- tcp_splice.c | 60 +++++++-------- tcp_splice.h | 6 +- udp.c | 16 ++-- udp.h | 2 +- 15 files changed, 317 insertions(+), 233 deletions(-) -- 2.43.0

1 13