- dev - passt

[PATCH] contrib: Drop QEMU out-of-tree patches
by Stefano Brivio 08 Mar '23

08 Mar '23

Native support was introduced with commit 13c6be96618c, QEMU 7.2. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- ...NIX-domain-sockets-to-be-used-as-net.patch | 171 ------------------ ...e-EINVAL-on-netdev-socket-connection.patch | 37 ---- 2 files changed, 208 deletions(-) delete mode 100644 contrib/qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch delete mode 100644 contrib/qemu/0002-net-Don-t-ignore-EINVAL-on-netdev-socket-connection.patch diff --git a/contrib/qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch b/contrib/qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch deleted file mode 100644 index 9e71f88..0000000 --- a/contrib/qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch +++ /dev/null @@ -1,171 +0,0 @@ -From 83c3f76b8fe6b4a6bb45dcf5cfad65ec6f98a10e Mon Sep 17 00:00:00 2001 -From: Stefano Brivio <sbrivio(a)redhat.com> -Date: Wed, 26 Jan 2022 16:45:15 +0100 -Subject: [PATCH 1/2] net: Allow also UNIX domain sockets to be used as -netdev - socket - -It has lower overhead compared to TCP, doesn't need a free port -and the adaptation is trivial. - -Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> ---- -SPDX-FileCopyrightText: 2020-2022 Red Hat GmbH <sbrivio(a)redhat.com> -SPDX-License-Identifier: AGPL-3.0-or-later - - net/socket.c | 106 ++++++++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 87 insertions(+), 19 deletions(-) - -diff --git a/net/socket.c b/net/socket.c -index 2e5f3ac923..b901e22836 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -511,26 +511,59 @@ static int net_socket_listen_init(NetClientState *peer, - { - NetClientState *nc; - NetSocketState *s; -- struct sockaddr_in saddr; -- int fd, ret; -+ struct sockaddr_storage saddr; -+ struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr; -+ struct sockaddr_un *saddr_un = (struct sockaddr_un *)&saddr; -+ size_t saddr_size; -+ int fd, ret, pf; -+ -+#ifndef WIN32 -+ if (strchr(host_str, ':')) { -+#endif -+ if (parse_host_port(saddr_in, host_str, errp) < 0) -+ return -1; - -- if (parse_host_port(&saddr, host_str, errp) < 0) { -- return -1; -- } -+ pf = PF_INET; -+ saddr_size = sizeof(*saddr_in); -+#ifndef WIN32 -+ } else { -+ struct stat sb; -+ -+ if (stat(host_str, &sb) == -1) { -+ error_setg_errno(errp, errno, "can't stat socket path"); -+ return -1; -+ } -+ -+ if ((sb.st_mode & S_IFMT) != S_IFSOCK) { -+ error_setg_errno(errp, errno, "path provided is not a socket"); -+ return -1; -+ } - -- fd = qemu_socket(PF_INET, SOCK_STREAM, 0); -+ saddr_un->sun_family = PF_UNIX; -+ strncpy(saddr_un->sun_path, host_str, sizeof(saddr_un->sun_path)); -+ -+ pf = PF_UNIX; -+ saddr_size = sizeof(*saddr_un); -+ } -+#endif /* !WIN32 */ -+ fd = qemu_socket(pf, SOCK_STREAM, 0); - if (fd < 0) { - error_setg_errno(errp, errno, "can't create stream socket"); - return -1; - } - qemu_set_nonblock(fd); - -- socket_set_fast_reuse(fd); -+ if (pf == PF_INET) -+ socket_set_fast_reuse(fd); - -- ret = bind(fd, (struct sockaddr *)&saddr, sizeof(saddr)); -+ ret = bind(fd, (struct sockaddr *)&saddr, saddr_size); - if (ret < 0) { -- error_setg_errno(errp, errno, "can't bind ip=%s to socket", -- inet_ntoa(saddr.sin_addr)); -+ if (pf == PF_INET) -+ error_setg_errno(errp, errno, "can't bind ip=%s to socket", -+ inet_ntoa(saddr_in->sin_addr)); -+ else if (pf == PF_UNIX) -+ error_setg_errno(errp, errno, "can't create socket with path: %s", -+ host_str); - closesocket(fd); - return -1; - } -@@ -559,14 +592,43 @@ static int net_socket_connect_init(NetClientState *peer, - Error **errp) - { - NetSocketState *s; -- int fd, connected, ret; -- struct sockaddr_in saddr; -+ int fd, connected, ret, pf; -+ struct sockaddr_storage saddr; -+ size_t saddr_size; -+ struct sockaddr_in *saddr_in = (struct sockaddr_in *)&saddr; -+#ifndef WIN32 -+ struct sockaddr_un *saddr_un = (struct sockaddr_un *)&saddr; -+ -+ if (strchr(host_str, ':')) { -+#endif -+ if (parse_host_port(saddr_in, host_str, errp) < 0) -+ return -1; - -- if (parse_host_port(&saddr, host_str, errp) < 0) { -- return -1; -+ pf = PF_INET; -+ saddr_size = sizeof(*saddr_in); -+#ifndef WIN32 -+ } else { -+ struct stat sb; -+ -+ if (stat(host_str, &sb) == -1) { -+ error_setg_errno(errp, errno, "can't stat socket path"); -+ return -1; -+ } -+ -+ if ((sb.st_mode & S_IFMT) != S_IFSOCK) { -+ error_setg_errno(errp, errno, "provided path is not a socket"); -+ return -1; -+ } -+ -+ saddr_un->sun_family = PF_UNIX; -+ strncpy(saddr_un->sun_path, host_str, sizeof(saddr_un->sun_path)); -+ -+ pf = PF_UNIX; -+ saddr_size = sizeof(*saddr_un); - } -+#endif /* !WIN32 */ - -- fd = qemu_socket(PF_INET, SOCK_STREAM, 0); -+ fd = qemu_socket(pf, SOCK_STREAM, 0); - if (fd < 0) { - error_setg_errno(errp, errno, "can't create stream socket"); - return -1; -@@ -575,7 +637,7 @@ static int net_socket_connect_init(NetClientState *peer, - - connected = 0; - for(;;) { -- ret = connect(fd, (struct sockaddr *)&saddr, sizeof(saddr)); -+ ret = connect(fd, (struct sockaddr *)&saddr, saddr_size); - if (ret < 0) { - if (errno == EINTR || errno == EWOULDBLOCK) { - /* continue */ -@@ -597,9 +659,15 @@ static int net_socket_connect_init(NetClientState *peer, - return -1; - } - -- snprintf(s->nc.info_str, sizeof(s->nc.info_str), -- "socket: connect to %s:%d", -- inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port)); -+ if (pf == PF_INET) { -+ snprintf(s->nc.info_str, sizeof(s->nc.info_str), -+ "socket: connect to %s:%d", -+ inet_ntoa(saddr_in->sin_addr), ntohs(saddr_in->sin_port)); -+ } else if (pf == PF_UNIX) { -+ snprintf(s->nc.info_str, sizeof(s->nc.info_str), -+ "socket: connect to %s", saddr_un->sun_path); -+ } -+ - return 0; - } - --- -2.28.0 - diff --git a/contrib/qemu/0002-net-Don-t-ignore-EINVAL-on-netdev-socket-connection.patch b/contrib/qemu/0002-net-Don-t-ignore-EINVAL-on-netdev-socket-connection.patch deleted file mode 100644 index 0e31a1b..0000000 --- a/contrib/qemu/0002-net-Don-t-ignore-EINVAL-on-netdev-socket-connection.patch +++ /dev/null @@ -1,37 +0,0 @@ -From a6d475147682de1fe3b14eb325f4247e013e8440 Mon Sep 17 00:00:00 2001 -Message-Id: <a6d475147682de1fe3b14eb325f4247e013e8440.1619091389.git.sbrivio(a)redhat.com> -In-Reply-To: <ba51349d353f11e05c6341a7e065f2ade3874c68.1619091389.git.sbrivio(a)redhat.com> -References: <ba51349d353f11e05c6341a7e065f2ade3874c68.1619091389.git.sbrivio(a)redhat.com> -From: Stefano Brivio <sbrivio(a)redhat.com> -Date: Wed, 21 Apr 2021 18:52:16 +0200 -Subject: [PATCH 2/2] net: Don't ignore EINVAL on netdev socket connection - -Other errors are treated as failure by net_socket_connect_init(), -but if connect() returns EINVAL, we'll fail silently. Remove the -related exception. - -Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> ---- -SPDX-FileCopyrightText: 2020-2021 Red Hat GmbH <sbrivio(a)redhat.com> -SPDX-License-Identifier: AGPL-3.0-or-later - - net/socket.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/net/socket.c b/net/socket.c -index aadd11dae2b3..d3293ac12e82 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -644,8 +644,7 @@ static int net_socket_connect_init(NetClientState *peer, - if (errno == EINTR || errno == EWOULDBLOCK) { - /* continue */ - } else if (errno == EINPROGRESS || -- errno == EALREADY || -- errno == EINVAL) { -+ errno == EALREADY) { - break; - } else { - error_setg_errno(errp, errno, "can't connect socket"); --- -2.29.2 - -- 2.39.2

2 1

[PATCH] contrib: Drop Podman out-of-tree patch, integration is upstream now
by Stefano Brivio 08 Mar '23

08 Mar '23

See https://github.com/containers/podman/pull/16141, shipped in Podman 4.4. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- ...001-libpod-Add-pasta-networking-mode.patch | 605 ------------------ 1 file changed, 605 deletions(-) delete mode 100644 contrib/podman/0001-libpod-Add-pasta-networking-mode.patch diff --git a/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch b/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch deleted file mode 100644 index a6e832a..0000000 --- a/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch +++ /dev/null @@ -1,605 +0,0 @@ -From 7294b62e15bee68f1920ea04aaab3284ce43e7ea Mon Sep 17 00:00:00 2001 -From: Stefano Brivio <sbrivio(a)redhat.com> -Date: Mon, 2 May 2022 16:12:07 +0200 -Subject: [PATCH] libpod: Add pasta networking mode - -Conceptually equivalent to networking by means of slirp4netns(1), -with a few practical differences: - -- pasta(1) forks to background once networking is configured in the - namespace and quits on its own once the namespace is deleted: - file descriptor synchronisation and PID tracking are not needed - -- port forwarding is configured via command line options at start-up, - instead of an API socket: this is taken care of right away as we're - about to start pasta - -- there's no need for further selection of port forwarding modes: - pasta behaves similarly to containers-rootlessport for local binds - (splice() instead of read()/write() pairs, without L2-L4 - translation), and keeps the original source address for non-local - connections like slirp4netns does - -- IPv6 is not an experimental feature, and enabled by default. IPv6 - port forwarding is supported - -- by default, addresses and routes are copied from the host, that is, - container users will see the same IP address and routes as if they - were in the init namespace context. The interface name is also - sourced from the host upstream interface with the first default - route in the routing table. This is also configurable as documented - -- by default, the host is reachable using the gateway address from - the container, unless the --no-map-gw option is passed - -- sandboxing and seccomp(2) policies cannot be disabled - -See https://passt.top for more details about pasta. - -Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> ---- -SPDX-FileCopyrightText: 2021-2022 Red Hat GmbH <sbrivio(a)redhat.com> -SPDX-License-Identifier: Apache-2.0 - - docs/source/markdown/podman-create.1.md.in | 48 +++++++- - .../source/markdown/podman-pod-create.1.md.in | 44 +++++++ - docs/source/markdown/podman-run.1.md.in | 49 +++++++- - docs/source/markdown/podman.1.md | 6 +- - libpod/networking_common.go | 3 +- - libpod/networking_linux.go | 3 + - libpod/networking_pasta.go | 107 ++++++++++++++++++ - pkg/namespaces/namespaces.go | 6 + - pkg/specgen/generate/namespaces.go | 10 ++ - pkg/specgen/generate/pod_create.go | 6 + - pkg/specgen/namespaces.go | 16 ++- - pkg/specgen/podspecgen.go | 2 +- - 12 files changed, 286 insertions(+), 14 deletions(-) - create mode 100644 libpod/networking_pasta.go - -diff --git a/docs/source/markdown/podman-create.1.md.in b/docs/source/markdown/podman-create.1.md.in -index 742a32b5a..79fb3a3e1 100644 ---- a/docs/source/markdown/podman-create.1.md.in -+++ b/docs/source/markdown/podman-create.1.md.in -@@ -277,10 +277,15 @@ Valid _mode_ values are: - - **interface_name**: Specify a name for the created network interface inside the container. - - For example to set a static ipv4 address and a static mac address, use `--network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99`. -+ - - \<network name or ID\>[:OPTIONS,...]: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. Using the network name implies the bridge network mode. It is possible to specify the same options described under the bridge mode above. You can use the **--network** option multiple times to specify additional networks. -+ - - **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. -+ - - **container:**_id_: Reuse another container's network stack. -+ - - **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. -+ - - **ns:**_path_: Path to a network namespace to join. - - **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. - - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: -@@ -296,6 +301,40 @@ Valid _mode_ values are: - Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If your application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. - - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. - -+- **pasta[:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking -+stack. By default, IPv4 and IPv6 addresses and routes, as well as the pod -+interface name, are copied from the host. Port forwarding preserves the original -+source IP address. Options described in pasta(1) can be specified as -+comma-separated arguments. -+ -+In terms of pasta(1) options, **--config-net** is given by default, in order to -+configure networking when the container is started. Also, **-t none** and -+**-u none** are passed if, respectively, no TCP or UDP port forwarding from host -+to container is configured, to disable automatic port forwarding based on bound -+ports. Similarly, **-T none** and **-U none** are also given to disable the same -+functionality from container to host. -+ -+Some examples: -+ - **pasta:--no-map-gw**: Don't allow the container to directly reach the host -+ using the gateway address, which would normally be mapped to a loopback or -+ link-local address. -+ - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in -+ the container. -+ - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options: disable IPv6, assign -+ `10.0.2.0/24` to the `tap0` interface in the container, with gateway -+ `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 -+ bytes, disable NDP, DHCPv6 and DHCP support. -+ - **pasta:--no-map-gw,-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options with Podman overrides: same as -+ above, but leave the MTU to 65520 bytes, and don't map the gateway address -+ from the container to a local address. -+ - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding -+ based on observed bound ports from both host and container sides -+ - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to -+ host, using the loopback interface instead of the tap interface for improved -+ performance -+ - @@option network-alias - - @@option no-healthcheck -@@ -550,8 +589,9 @@ In order for users to run rootless, there must be an entry for their username in - - Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. - The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use --the vfs storage driver, which is diskspace expensive and does not perform well. slirp4netns is --required for VPN, without it containers need to be run with the --network=host flag. -+the vfs storage driver, which is diskspace expensive and does not perform well. -+slirp4netns or pasta are required for VPN, without it containers need to be run -+with the --network=host flag. - - ## ENVIRONMENT - -@@ -600,7 +640,9 @@ page. - NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. - - ## SEE ALSO --**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** -+**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, -+**[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, -+**[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** - - ## HISTORY - October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `<dwalsh(a)redhat.com>` -diff --git a/docs/source/markdown/podman-pod-create.1.md.in b/docs/source/markdown/podman-pod-create.1.md.in -index fdae1d249..104ad460b 100644 ---- a/docs/source/markdown/podman-pod-create.1.md.in -+++ b/docs/source/markdown/podman-pod-create.1.md.in -@@ -131,10 +131,15 @@ Valid _mode_ values are: - - **interface_name**: Specify a name for the created network interface inside the container. - - For example to set a static ipv4 address and a static mac address, use `--network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99`. -+ - - \<network name or ID\>[:OPTIONS,...]: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. Using the network name implies the bridge network mode. It is possible to specify the same options described under the bridge mode above. You can use the **--network** option multiple times to specify additional networks. -+ - - **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. -+ - - **container:**_id_: Reuse another container's network stack. -+ - - **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. -+ - - **ns:**_path_: Path to a network namespace to join. - - **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. - - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: -@@ -150,6 +155,43 @@ Valid _mode_ values are: - Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If your application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. - - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. - -+- **pasta[:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking -+stack. By default, IPv4 and IPv6 addresses and routes, as well as the pod -+interface name, are copied from the host. If port forwarding isn't configured, -+ports will be forwarded dynamically as services are bound on either side (init -+namespace or container namespace). Port forwarding preserves the original source -+IP address. Options described in pasta(1) can be specified as comma-separated -+arguments. -+ -+ -+In terms of pasta(1) options, **--config-net** is given by default, in order to -+configure networking when the container is started. Also, **-t none** and -+**-u none** are passed if, respectively, no TCP or UDP port forwarding from host -+to container is configured, to disable automatic port forwarding based on bound -+ports. Similarly, **-T none** and **-U none** are also given to disable the same -+functionality from container to host. -+ -+Some examples: -+ - **pasta:--no-map-gw**: Don't allow the container to directly reach the host -+ using the gateway address, which would normally be mapped to a loopback or -+ link-local address. -+ - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in -+ the container. -+ - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options: disable IPv6, assign -+ `10.0.2.0/24` to the `tap0` interface in the container, with gateway -+ `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 -+ bytes, disable NDP, DHCPv6 and DHCP support. -+ - **pasta:--no-map-gw,-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options with Podman overrides: same as -+ above, but leave the MTU to 65520 bytes, and don't map the gateway address -+ from the container to a local address. -+ - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding -+ based on observed bound ports from both host and container sides -+ - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to -+ host, using the loopback interface instead of the tap interface for improved -+ performance -+ - @@option network-alias - - @@option no-hosts -@@ -248,6 +290,8 @@ $ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loo - - $ podman pod create --network slirp4netns:cidr=192.168.0.0/24 - -+$ podman pod create --network pasta -+ - $ podman pod create --network net1:ip=10.89.1.5 --network net2:ip=10.89.10.10 - ``` - -diff --git a/docs/source/markdown/podman-run.1.md.in b/docs/source/markdown/podman-run.1.md.in -index 2109a0e33..a9b212e81 100644 ---- a/docs/source/markdown/podman-run.1.md.in -+++ b/docs/source/markdown/podman-run.1.md.in -@@ -298,10 +298,15 @@ Valid _mode_ values are: - - **interface_name**: Specify a name for the created network interface inside the container. - - For example to set a static ipv4 address and a static mac address, use `--network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99`. -+ - - \<network name or ID\>[:OPTIONS,...]: Connect to a user-defined network; this is the network name or ID from a network created by **[podman network create](podman-network-create.1.md)**. Using the network name implies the bridge network mode. It is possible to specify the same options described under the bridge mode above. You can use the **--network** option multiple times to specify additional networks. -+ - - **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity. -+ - - **container:**_id_: Reuse another container's network stack. -+ - - **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure. -+ - - **ns:**_path_: Path to a network namespace to join. - - **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. - - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: -@@ -317,6 +322,43 @@ Valid _mode_ values are: - Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If your application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. - - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. - -+- **pasta[:OPTIONS,...]**: use **pasta**(1) to create a user-mode networking -+stack. By default, IPv4 and IPv6 addresses and routes, as well as the pod -+interface name, are copied from the host. If port forwarding isn't configured, -+ports will be forwarded dynamically as services are bound on either side (init -+namespace or container namespace). Port forwarding preserves the original source -+IP address. Options described in pasta(1) can be specified as comma-separated -+arguments. -+ -+ -+In terms of pasta(1) options, **--config-net** is given by default, in order to -+configure networking when the container is started. Also, **-t none** and -+**-u none** are passed if, respectively, no TCP or UDP port forwarding from host -+to container is configured, to disable automatic port forwarding based on bound -+ports. Similarly, **-T none** and **-U none** are also given to disable the same -+functionality from container to host. -+ -+Some examples: -+ - **pasta:--no-map-gw**: Don't allow the container to directly reach the host -+ using the gateway address, which would normally be mapped to a loopback or -+ link-local address. -+ - **pasta:--mtu,1500**: Specify a 1500 bytes MTU for the _tap_ interface in -+ the container. -+ - **pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options: disable IPv6, assign -+ `10.0.2.0/24` to the `tap0` interface in the container, with gateway -+ `10.0.2.3`, enable DNS forwarder reachable at `10.0.2.3`, set MTU to 1500 -+ bytes, disable NDP, DHCPv6 and DHCP support. -+ - **pasta:--no-map-gw,-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp**, -+ equivalent to default slirp4netns(1) options with Podman overrides: same as -+ above, but leave the MTU to 65520 bytes, and don't map the gateway address -+ from the container to a local address. -+ - **pasta:-t,auto,-u,auto,-T,auto,-U,auto**: enable automatic port forwarding -+ based on observed bound ports from both host and container sides -+ - **pasta:-T,5201**: enable forwarding of TCP port 5201 from container to -+ host, using the loopback interface instead of the tap interface for improved -+ performance -+ - @@option network-alias - - @@option no-healthcheck -@@ -900,8 +942,9 @@ In order for users to run rootless, there must be an entry for their username in - - Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. - The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use --the **vfs** storage driver, which is diskspace expensive and does not perform well. slirp4netns is --required for VPN, without it containers need to be run with the **--network=host** flag. -+the **vfs** storage driver, which is diskspace expensive and does not perform -+well. slirp4netns or pasta are required for VPN, without it containers need to -+be run with the **--network=host** flag. - - ## ENVIRONMENT - -@@ -948,7 +991,7 @@ page. - NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. - - ## SEE ALSO --**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** -+**[podman(1)](podman.1.md)**, **[podman-save(1)](podman-save.1.md)**, **[podman-ps(1)](podman-ps.1.md)**, **[podman-attach(1)](podman-attach.1.md)**, **[podman-pod-create(1)](podman-pod-create.1.md)**, **[podman-port(1)](podman-port.1.md)**, **[podman-start(1)](podman-start.1.md)**, **[podman-kill(1)](podman-kill.1.md)**, **[podman-stop(1)](podman-stop.1.md)**, **[podman-generate-systemd(1)](podman-generate-systemd.1.md)**, **[podman-rm(1)](podman-rm.1.md)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[systemd.unit(5)](https://www.freedesktop.org/software/systemd/man/systemd.unit.html)**, **[setsebool(8)](https://man7.org/linux/man-pages/man8/setsebool.8.html)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[fuse-overlayfs(1)](https://github.com/containers/fuse-overlayfs/blob/main/fuse-overlayfs.1.md)**, **proc(5)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)**, **personality(2)** - - ## HISTORY - September 2018, updated by Kunal Kushwaha `<kushwaha_kunal_v7(a)lab.ntt.co.jp>` -diff --git a/docs/source/markdown/podman.1.md b/docs/source/markdown/podman.1.md -index 7a8dd7043..a54288bb0 100644 ---- a/docs/source/markdown/podman.1.md -+++ b/docs/source/markdown/podman.1.md -@@ -88,7 +88,7 @@ Set libpod namespace. Namespaces are used to separate groups of containers and p - When namespace is set, created containers and pods will join the given namespace, and only containers and pods in the given namespace will be visible to Podman. - - #### **--network-cmd-path**=*path* --Path to the command binary to use for setting up a network. It is currently only used for setting up a slirp4netns network. If "" is used then the binary is looked up using the $PATH environment variable. -+Path to the command binary to use for setting up a network. It is currently only used for setting up a slirp4netns(1) or pasta(1) network. If "" is used then the binary is looked up using the $PATH environment variable. - - #### **--network-config-dir**=*directory* - -@@ -422,7 +422,7 @@ See the `subuid(5)` and `subgid(5)` man pages for more information. - - Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. - --Currently the slirp4netns package is required to be installed to create a network device, otherwise rootless containers need to run in the network namespace of the host. -+Currently either slirp4netns or pasta are required to be installed to create a network device, otherwise rootless containers need to run in the network namespace of the host. - - In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the /etc/subuid and /etc/subgid systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the `ignore_chown_errors` option in the /etc/containers/storage.conf or in ~/.config/containers/storage.conf files. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this could cause issues when running the container. - -@@ -435,7 +435,7 @@ The Network File System (NFS) and other distributed file systems (for example: L - For more information, please refer to the [Podman Troubleshooting Page](https://github.com/containers/podman/blob/main/troubleshooting.md). - - ## SEE ALSO --**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **oci-hooks(5)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/master/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** -+**[containers-mounts.conf(5)](https://github.com/containers/common/blob/main/docs/containers-mounts.conf.5.md)**, **[containers.conf(5)](https://github.com/containers/common/blob/main/docs/containers.conf.5.md)**, **[containers-registries.conf(5)](https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md)**, **[containers-storage.conf(5)](https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md)**, **[buildah(1)](https://github.com/containers/buildah/blob/main/docs/buildah.1.md)**, **oci-hooks(5)**, **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[crun(1)](https://github.com/containers/crun/blob/main/crun.1.md)**, **[runc(8)](https://github.com/opencontainers/runc/blob/master/man/runc.8.md)**, **[subuid(5)](https://www.unix.com/man-page/linux/5/subuid)**, **[subgid(5)](https://www.unix.com/man-page/linux/5/subgid)**, **[slirp4netns(1)](https://github.com/rootless-containers/slirp4netns/blob/master/slirp4netns.1.md)**, **[pasta(1)](https://passt.top/builds/latest/web/passt.1.html)**, **[conmon(8)](https://github.com/containers/conmon/blob/main/docs/conmon.8.md)** - - ## HISTORY - Dec 2016, Originally compiled by Dan Walsh <dwalsh(a)redhat.com> -diff --git a/libpod/networking_common.go b/libpod/networking_common.go -index fa444e26a..2590a4477 100644 ---- a/libpod/networking_common.go -+++ b/libpod/networking_common.go -@@ -133,7 +133,8 @@ func (r *Runtime) teardownCNI(ctr *Container) error { - return err - } - -- if !ctr.config.NetMode.IsSlirp4netns() && len(networks) > 0 { -+ if !ctr.config.NetMode.IsSlirp4netns() && -+ !ctr.config.NetMode.IsPasta() && len(networks) > 0 { - netOpts := ctr.getNetworkOptions(networks) - return r.teardownNetwork(ctr.state.NetNS.Path(), netOpts) - } -diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go -index 6ea56ade5..822004a7c 100644 ---- a/libpod/networking_linux.go -+++ b/libpod/networking_linux.go -@@ -563,6 +563,9 @@ func (r *Runtime) configureNetNS(ctr *Container, ctrNS ns.NetNS) (status map[str - if ctr.config.NetMode.IsSlirp4netns() { - return nil, r.setupSlirp4netns(ctr, ctrNS) - } -+ if ctr.config.NetMode.IsPasta() { -+ return nil, r.setupPasta(ctr, ctrNS) -+ } - networks, err := ctr.networks() - if err != nil { - return nil, err -diff --git a/libpod/networking_pasta.go b/libpod/networking_pasta.go -new file mode 100644 -index 000000000..f179c803a ---- /dev/null -+++ b/libpod/networking_pasta.go -@@ -0,0 +1,107 @@ -+// SPDX-License-Identifier: Apache-2.0 -+// -+// networking_pasta.go - Start pasta(1) to provide connectivity to the container -+// -+// Copyright (c) 2022 Red Hat GmbH -+// Author: Stefano Brivio <sbrivio(a)redhat.com> -+// -+// +build linux -+ -+package libpod -+ -+import ( -+ "os/exec" -+ "fmt" -+ "strings" -+ -+ "github.com/containernetworking/plugins/pkg/ns" -+ "github.com/pkg/errors" -+ "github.com/sirupsen/logrus" -+) -+ -+func (r *Runtime) setupPasta(ctr *Container, netns ns.NetNS) error { -+ var NoTCPInitPorts = true -+ var NoUDPInitPorts = true -+ var NoTCPNamespacePorts = true -+ var NoUDPNamespacePorts = true -+ -+ path := r.config.Engine.NetworkCmdPath -+ if path == "" { -+ var err error -+ path, err = exec.LookPath("pasta") -+ if err != nil { -+ return fmt.Errorf("could not find pasta, the network namespace can't be configured: %w", err) -+ } -+ } -+ -+ cmdArgs := []string{} -+ cmdArgs = append(cmdArgs, "--config-net") -+ -+ for _, i := range ctr.convertPortMappings() { -+ protocols := strings.Split(i.Protocol, ",") -+ for _, protocol := range protocols { -+ var addr string -+ -+ if (i.HostIP != "") { -+ addr = fmt.Sprintf("%s/", i.HostIP) -+ } else { -+ addr = "" -+ } -+ -+ if protocol == "tcp" { -+ cmdArgs = append(cmdArgs, "-t") -+ } else if protocol == "udp" { -+ cmdArgs = append(cmdArgs, "-u") -+ } else { -+ return fmt.Errorf("can't forward protocol: %s", protocol) -+ } -+ -+ arg := fmt.Sprintf("%s%d-%d:%d-%d", addr, -+ i.HostPort, -+ i.HostPort + i.Range - 1, -+ i.ContainerPort, -+ i.ContainerPort + i.Range - 1) -+ cmdArgs = append(cmdArgs, arg) -+ } -+ } -+ -+ cmdArgs = append(cmdArgs, ctr.config.NetworkOptions["pasta"]...) -+ -+ for _, i := range cmdArgs { -+ if (i == "-t" || i == "--tcp-ports") { -+ NoTCPInitPorts = false -+ } else if (i == "-u" || i == "--udp-ports") { -+ NoUDPInitPorts = false -+ } else if (i == "-T" || i == "--tcp-ns") { -+ NoTCPNamespacePorts = false -+ } else if (i == "-U" || i == "--udp-ns") { -+ NoUDPNamespacePorts = false -+ } -+ } -+ -+ if (NoTCPInitPorts) { -+ cmdArgs = append(cmdArgs, "-t", "none") -+ } -+ if (NoUDPInitPorts) { -+ cmdArgs = append(cmdArgs, "-u", "none") -+ } -+ if (NoTCPNamespacePorts) { -+ cmdArgs = append(cmdArgs, "-T", "none") -+ } -+ if (NoUDPNamespacePorts) { -+ cmdArgs = append(cmdArgs, "-U", "none") -+ } -+ -+ cmdArgs = append(cmdArgs, "--netns", netns.Path()) -+ -+ logrus.Debugf("pasta arguments: %s", strings.Join(cmdArgs, " ")) -+ -+ // pasta forks once ready, and quits once we delete the target namespace -+ _, err := exec.Command(path, cmdArgs...).Output() -+ if err != nil { -+ return errors.Wrapf(err, "failed to start pasta: %s", -+ err.(*exec.ExitError).Stderr) -+ } -+ -+ return nil -+} -diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go -index 6dd576ea5..85903e7a9 100644 ---- a/pkg/namespaces/namespaces.go -+++ b/pkg/namespaces/namespaces.go -@@ -19,6 +19,7 @@ const ( - privateType = "private" - shareableType = "shareable" - slirpType = "slirp4netns" -+ pastaType = "pasta" - ) - - // KeepIDUserNsOptions defines how to keepIDmatically create a user namespace. -@@ -440,6 +441,11 @@ func (n NetworkMode) IsSlirp4netns() bool { - return n == slirpType || strings.HasPrefix(string(n), slirpType+":") - } - -+// IsPasta indicates if we are running a rootless network stack using pasta -+func (n NetworkMode) IsPasta() bool { -+ return n == pastaType || strings.HasPrefix(string(n), pastaType + ":") -+} -+ - // IsNS indicates a network namespace passed in by path (ns:<path>) - func (n NetworkMode) IsNS() bool { - return strings.HasPrefix(string(n), nsType) -diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go -index 9497894f3..11a30e545 100644 ---- a/pkg/specgen/generate/namespaces.go -+++ b/pkg/specgen/generate/namespaces.go -@@ -300,6 +300,16 @@ func namespaceOptions(s *specgen.SpecGenerator, rt *libpod.Runtime, pod *libpod. - val = fmt.Sprintf("slirp4netns:%s", s.NetNS.Value) - } - toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, val, nil)) -+ case specgen.Pasta: -+ portMappings, expose, err := createPortMappings(s, imageData) -+ if err != nil { -+ return nil, err -+ } -+ val := "pasta" -+ if s.NetNS.Value != "" { -+ val = fmt.Sprintf("pasta:%s", s.NetNS.Value) -+ } -+ toReturn = append(toReturn, libpod.WithNetNS(portMappings, expose, postConfigureNetNS, val, nil)) - case specgen.Bridge, specgen.Private, specgen.Default: - portMappings, expose, err := createPortMappings(s, imageData) - if err != nil { -diff --git a/pkg/specgen/generate/pod_create.go b/pkg/specgen/generate/pod_create.go -index 14d390e49..ad91353cb 100644 ---- a/pkg/specgen/generate/pod_create.go -+++ b/pkg/specgen/generate/pod_create.go -@@ -195,6 +195,12 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) { - p.InfraContainerSpec.NetworkOptions = p.NetworkOptions - p.InfraContainerSpec.NetNS.NSMode = specgen.Slirp - } -+ case specgen.Pasta: -+ logrus.Debugf("Pod will use pasta") -+ if p.InfraContainerSpec.NetNS.NSMode != "host" { -+ p.InfraContainerSpec.NetworkOptions = p.NetworkOptions -+ p.InfraContainerSpec.NetNS.NSMode = specgen.NamespaceMode("pasta") -+ } - case specgen.NoNetwork: - logrus.Debugf("Pod will not use networking") - if len(p.InfraContainerSpec.PortMappings) > 0 || -diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go -index b6bbee868..5c4cb97c2 100644 ---- a/pkg/specgen/namespaces.go -+++ b/pkg/specgen/namespaces.go -@@ -52,6 +52,9 @@ const ( - // be used. - // Only used with the network namespace, invalid otherwise. - Slirp NamespaceMode = "slirp4netns" -+ // Pasta indicates that a pasta network stack should be used. -+ // Only used with the network namespace, invalid otherwise. -+ Pasta NamespaceMode = "pasta" - // KeepId indicates a user namespace to keep the owner uid inside - // of the namespace itself. - // Only used with the user namespace, invalid otherwise. -@@ -154,7 +157,7 @@ func validateNetNS(n *Namespace) error { - return nil - } - switch n.NSMode { -- case Slirp: -+ case Slirp, Pasta: - break - case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge: - break -@@ -197,7 +200,7 @@ func (n *Namespace) validate() error { - switch n.NSMode { - case "", Default, Host, Path, FromContainer, FromPod, Private: - // Valid, do nothing -- case NoNetwork, Bridge, Slirp: -+ case NoNetwork, Bridge, Slirp, Pasta: - return errors.New("cannot use network modes with non-network namespace") - default: - return fmt.Errorf("invalid namespace type %s specified", n.NSMode) -@@ -349,6 +352,13 @@ func ParseNetworkFlag(networks []string) (Namespace, map[string]types.PerNetwork - networkOptions[parts[0]] = strings.Split(parts[1], ",") - } - toReturn.NSMode = Slirp -+ case ns == string(Pasta), strings.HasPrefix(ns, string(Pasta) + ":"): -+ parts := strings.SplitN(ns, ":", 2) -+ if len(parts) > 1 { -+ networkOptions = make(map[string][]string) -+ networkOptions[parts[0]] = strings.Split(parts[1], ",") -+ } -+ toReturn.NSMode = Pasta - case ns == string(FromPod): - toReturn.NSMode = FromPod - case ns == "" || ns == string(Default) || ns == string(Private): -@@ -419,7 +429,7 @@ func ParseNetworkFlag(networks []string) (Namespace, map[string]types.PerNetwork - if parts[0] == "" { - return toReturn, nil, nil, fmt.Errorf("network name cannot be empty: %w", define.ErrInvalidArg) - } -- if cutil.StringInSlice(parts[0], []string{string(Bridge), string(Slirp), string(FromPod), string(NoNetwork), -+ if cutil.StringInSlice(parts[0], []string{string(Bridge), string(Slirp), string(Pasta), string(FromPod), string(NoNetwork), - string(Default), string(Private), string(Path), string(FromContainer), string(Host)}) { - return toReturn, nil, nil, fmt.Errorf("can only set extra network names, selected mode %s conflicts with bridge: %w", parts[0], define.ErrInvalidArg) - } -diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go -index 64a79f4ee..faeeb2ed6 100644 ---- a/pkg/specgen/podspecgen.go -+++ b/pkg/specgen/podspecgen.go -@@ -98,7 +98,7 @@ type PodNetworkConfig struct { - // PortMappings is a set of ports to map into the infra container. - // As, by default, containers share their network with the infra - // container, this will forward the ports to the entire pod. -- // Only available if NetNS is set to Bridge or Slirp. -+ // Only available if NetNS is set to Bridge, Slirp, or Pasta. - // Optional. - PortMappings []types.PortMapping `json:"portmappings,omitempty"` - // Map of networks names to ids the container should join to. --- -2.35.1 - -- 2.39.2

2 1

[PATCH] tcp: Clamp MSS value when queueing data to tap, also for pasta
by Stefano Brivio 08 Mar '23

08 Mar '23

Tom reports that a pattern of repated ~1 MiB chunks downloads over NNTP over TLS, on Podman 4.4 using pasta as network back-end, results in pasta taking one full CPU thread after a while, and the download never succeeds. On that setup, we end up re-sending the same frame over and over, with a consistent 65 534 bytes size, and never get an acknowledgement from the tap-side client. This only happens for the default MTU value (65 520 bytes) or for values that are slightly smaller than that (down to 64 499 bytes). We hit this condition because the MSS value we use in tcp_data_from_sock(), only in pasta mode, is simply clamped to USHRT_MAX, and not to the actual size of the buffers we pre-cooked for sending, which is a bit less than that. It looks like we got away with it until commit 0fb7b2b9080a ("tap: Use different io vector bases depending on tap type") fixed the setting of iov_len. Luckily, since it's pasta, we're queueing up to two frames at a time, so the worst that can happen is a badly segmented TCP stream: we always have some space at the tail of the buffer. Clamp the MSS value to the appropriate maximum given by struct tcp{4,6}_buf_data_t, no matter if we're running in pasta or passt mode. While at it, fix the comments to those structs to reflect the current struct size. This is not really relevant for any further calculation or consideration, but it's convenient to know while debugging this kind of issues. Thanks to Tom for reporting the issue in a very detailed way and for providing a test setup. Reported-by: Tom Mombourquette <tom(a)devnode.com> Link: https://github.com/containers/podman/issues/17703 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/tcp.c b/tcp.c index a29e387..0214087 100644 --- a/tcp.c +++ b/tcp.c @@ -461,7 +461,7 @@ static struct tcp4_l2_buf_t { struct iphdr iph; /* 44 28 */ struct tcphdr th; /* 64 48 */ uint8_t data[MSS4]; /* 84 68 */ - /* 65541 65525 */ + /* 65536 65532 */ #ifdef __AVX2__ } __attribute__ ((packed, aligned(32))) #else @@ -489,7 +489,7 @@ struct tcp6_l2_buf_t { struct ipv6hdr ip6h; /* 32 20 */ struct tcphdr th; /* 72 60 */ uint8_t data[MSS6]; /* 92 80 */ - /* 65639 65627 */ + /* 65536 65532 */ #ifdef __AVX2__ } __attribute__ ((packed, aligned(32))) #else @@ -1917,15 +1917,13 @@ int tcp_conn_new_sock(const struct ctx *c, sa_family_t af) /** * tcp_conn_tap_mss() - Get MSS value advertised by tap/guest - * @c: Execution context * @conn: Connection pointer * @opts: Pointer to start of TCP options * @optlen: Bytes in options: caller MUST ensure available length * * Return: clamped MSS value */ -static uint16_t tcp_conn_tap_mss(const struct ctx *c, - const struct tcp_tap_conn *conn, +static uint16_t tcp_conn_tap_mss(const struct tcp_tap_conn *conn, const char *opts, size_t optlen) { unsigned int mss; @@ -1936,13 +1934,10 @@ static uint16_t tcp_conn_tap_mss(const struct ctx *c, else mss = ret; - /* Don't upset qemu */ - if (c->mode == MODE_PASST) { - if (CONN_V4(conn)) - mss = MIN(MSS4, mss); - else - mss = MIN(MSS6, mss); - } + if (CONN_V4(conn)) + mss = MIN(MSS4, mss); + else + mss = MIN(MSS6, mss); return MIN(mss, USHRT_MAX); } @@ -2066,7 +2061,7 @@ static void tcp_conn_from_tap(struct ctx *c, int af, const void *addr, conn->wnd_to_tap = WINDOW_DEFAULT; - mss = tcp_conn_tap_mss(c, conn, opts, optlen); + mss = tcp_conn_tap_mss(conn, opts, optlen); if (setsockopt(s, SOL_TCP, TCP_MAXSEG, &mss, sizeof(mss))) trace("TCP: failed to set TCP_MAXSEG on socket %i", s); MSS_SET(conn, mss); @@ -2533,7 +2528,7 @@ static void tcp_conn_from_sock_finish(struct ctx *c, struct tcp_tap_conn *conn, if (!(conn->wnd_from_tap >>= conn->ws_from_tap)) conn->wnd_from_tap = 1; - MSS_SET(conn, tcp_conn_tap_mss(c, conn, opts, optlen)); + MSS_SET(conn, tcp_conn_tap_mss(conn, opts, optlen)); conn->seq_init_from_tap = ntohl(th->seq) + 1; conn->seq_from_tap = conn->seq_init_from_tap; -- 2.39.2

2 1

[PATCH v3 0/2] Implement explicit outbound address and interface selection
by Stefano Brivio 08 Mar '23

08 Mar '23

v3: In 2/2, *really* pass the correct bind_addr reference to sock_l4() in udp_tap_handler() -- I just sent v2 from the wrong directory :/ Stefano Brivio (2): conf, passt.h: Rename "outbound" interface to "template" interface conf, icmp, tcp, udp: Add options to bind to outbound address and interface conf.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------ icmp.c | 24 +++++++++++++--- passt.1 | 19 ++++++++++++ passt.h | 14 +++++++-- tcp.c | 60 ++++++++++++++++++++++++++++++++++++++ udp.c | 54 +++++++++++++++++++++++----------- 6 files changed, 228 insertions(+), 32 deletions(-) -- 2.39.2

2 3

[PATCH 0/3] Fail gracefully on too many open files
by Stefano Brivio 08 Mar '23

08 Mar '23

If we can't bind a few ports out of a port specifier, fine, we don't want to bother the user with that. But running out of files on '-t all' or similar is something different: patch 3/3 fixes this, 1/3 and 2/3 are preparation steps. Stefano Brivio (3): tcp, udp, util: Pass socket creation errors all the way up tcp, udp: Fix partial success return codes in {tcp,udp}_sock_init() conf: Terminate on EMFILE or ENFILE on sockets for port mapping conf.c | 36 +++++++++++++++++++++++++++++------- tcp.c | 29 ++++++++++++++--------------- udp.c | 44 +++++++++++++++++++++----------------------- util.c | 31 ++++++++++++++++++------------- 4 files changed, 82 insertions(+), 58 deletions(-) -- 2.39.2

2 6

[PATCH v2 0/2] Implement explicit outbound address and interface selection
by Stefano Brivio 08 Mar '23

08 Mar '23

v2: In 2/2, pass the correct bind_addr reference to sock_l4() in udp_tap_handler() Stefano Brivio (2): conf, passt.h: Rename "outbound" interface to "template" interface conf, icmp, tcp, udp: Add options to bind to outbound address and interface conf.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------ icmp.c | 24 +++++++++++++--- passt.1 | 19 ++++++++++++ passt.h | 14 +++++++-- tcp.c | 60 ++++++++++++++++++++++++++++++++++++++ udp.c | 54 +++++++++++++++++++++++----------- 6 files changed, 228 insertions(+), 32 deletions(-) -- 2.39.2

1 2

[PATCH 0/4] Fix build against musl C library
by Stefano Brivio 08 Mar '23

08 Mar '23

This series, partially coming from Chris Kuhn, enables passt to be built against musl. Tested on Alpine (x86_64) 3.17.2, musl 1.2.3-r4. See also: https://bugs.passt.top/show_bug.cgi?id=4 https://github.com/void-linux/void-packages/pull/42517 Chris Kuhn (2): conf, passt: Rename stderr to force_stderr treewide: Fix header includes to build with musl Stefano Brivio (2): netlink: Use 8 KiB * netlink message header size as response buffer util: Carry own definition of __bswap_constant{16,32} conf.c | 8 +++++--- isolation.c | 1 + netlink.c | 16 ++++++++++------ passt.c | 4 +++- passt.h | 4 ++-- tap.c | 1 + tcp.c | 1 + tcp_splice.c | 1 + udp.c | 1 + util.c | 1 + util.h | 11 +++++++++++ 11 files changed, 37 insertions(+), 12 deletions(-) -- 2.39.2

2 8

[PATCH 0/4] Further adjustments for SELinux policy files
by Stefano Brivio 08 Mar '23

08 Mar '23

This series addresses a number of issues or inconveniences shown by further testing against libvirt, essentially a 9.1.0 version patched up to fix the current breakage by starting passt in the "passt_t" domain. Stefano Brivio (4): contrib/selinux: Drop duplicate init_daemon_domain() rule contrib/selinux: Let passt write to stdout and stderr when it starts contrib/selinux: Allow binding and connecting to all UDP and TCP ports contrib/selinux: Let interface users set paths for log, PID, socket files contrib/selinux/passt.if | 26 +++++++++++++++++++++++++- contrib/selinux/passt.te | 29 ++++++++++++++++------------- 2 files changed, 41 insertions(+), 14 deletions(-) -- 2.39.2

2 5

[PATCH 1/3] musl adaptations
by KuhnChris 04 Mar '23

04 Mar '23

--- conf.c | 6 +++--- passt.c | 2 +- passt.h | 4 ++-- util.h | 14 ++++++++++++++ 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/conf.c b/conf.c index 0e512f4..c1dd9ba 100644 --- a/conf.c +++ b/conf.c @@ -1305,13 +1305,13 @@ void conf(struct ctx *c, int argc, char **argv) if (logfile) die("Can't log to both file and stderr"); - if (c->stderr) + if (c->force_stderr) die("Multiple --stderr options given"); - c->stderr = 1; + c->force_stderr = 1; break; case 'l': - if (c->stderr) + if (c->force_stderr) die("Can't log to both stderr and file"); if (logfile) diff --git a/passt.c b/passt.c index 5b8146e..f67213a 100644 --- a/passt.c +++ b/passt.c @@ -241,7 +241,7 @@ int main(int argc, char **argv) conf(&c, argc, argv); trace_init(c.trace); - if (c.stderr || isatty(fileno(stdout))) + if (c.force_stderr || isatty(fileno(stdout))) __openlog(log_name, LOG_PERROR, LOG_DAEMON); quit_fd = pasta_netns_quit_init(&c); diff --git a/passt.h b/passt.h index e0383eb..71d3602 100644 --- a/passt.h +++ b/passt.h @@ -32,7 +32,7 @@ struct tap_l4_msg { union epoll_ref; #include <stdbool.h> - +#include <bits/limits.h> #include "packet.h" #include "icmp.h" #include "port_fwd.h" @@ -197,7 +197,7 @@ struct ctx { int trace; int quiet; int foreground; - int stderr; + int force_stderr; int nofile; char sock_path[UNIX_PATH_MAX]; char pcap[PATH_MAX]; diff --git a/util.h b/util.h index 570094c..7315ce2 100644 --- a/util.h +++ b/util.h @@ -7,7 +7,10 @@ #define UTIL_H #include <stdlib.h> +#include <stdio.h> #include <stdarg.h> +#include <signal.h> +#include <byteswap.h> #include "log.h" @@ -88,6 +91,8 @@ #define MAC_ZERO ((uint8_t [ETH_ALEN]){ 0 }) #define MAC_IS_ZERO(addr) (!memcmp((addr), MAC_ZERO, ETH_ALEN)) +#if defined(__GLIBC__) || defined(__UCLIBC__) + #if __BYTE_ORDER == __BIG_ENDIAN #define htons_constant(x) (x) #define htonl_constant(x) (x) @@ -96,6 +101,15 @@ #define htonl_constant(x) (__bswap_constant_32(x)) #endif +#else + +/* mainly musl fallback */ + +#define htons_constant(x) (x) +#define htonl_constant(x) (x) + +#endif + #define IN4_IS_ADDR_UNSPECIFIED(a) \ ((a)->s_addr == htonl(INADDR_ANY)) #define IN4_IS_ADDR_BROADCAST(a) \ -- 2.38.4

2 5

[PATCH] udp: Fix signedness warning on 32-bits architectures
by Stefano Brivio 01 Mar '23

01 Mar '23

When a ssize_t is an int: udp.c: In function ‘udp_sock_handler’: udp.c:774:23: warning: comparison of integer expressions of different signedness: ‘unsigned int’ and ‘ssize_t’ {aka ‘int’} [-Wsign-compare] 774 | for (i = 0; i < n; i += m) { | ^ udp.c:781:43: warning: comparison of integer expressions of different signedness: ‘unsigned int’ and ‘ssize_t’ {aka ‘int’} [-Wsign-compare] 781 | for (m = 1; i + m < n; m++) { | Change 'i' and 'm' counters in udp_sock_handler() to signed versions, to match ssize_t n. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/udp.c b/udp.c index 20a9ea0..b7cbfdc 100644 --- a/udp.c +++ b/udp.c @@ -754,7 +754,7 @@ void udp_sock_handler(struct ctx *c, union epoll_ref ref, uint32_t events, in_port_t dstport = ref.r.p.udp.udp.port; bool v6 = ref.r.p.udp.udp.v6; struct mmsghdr *mmh_recv; - unsigned int i, m; + int i, m; if (!(events & EPOLLIN)) return; -- 2.39.1

2 1