- dev - passt

[PATCH v3 0/6] Improvements to flow specific logging
by David Gibson 22 Jun '26

22 Jun '26

While working on podman bug 23739, I found some deficiences in how and when we report various socket errors related to specific flows. Here are some preliminary patches to improve that. v3: * Added a attribute((printf)) for the base flow log function * And fixed a couple of bad calls that caught * Removed one change from a plain log to a flow-specific log in UDP, where it turned out we didn't necessarily have a well defined flow * Fixing a cppcheck warning in the process * Put an explanatory comment and clang-tidy suppression for the (very limited) recursion in flow_log__() v2: * Added patch 2/6 At Stefano's suggestion * Simplified the errno Handling fix at Stefano's suggestion * Added patch 6/6 which I noticed while revising 5/6. * Made a handful of minor corrections based on feedback. David Gibson (6): flow: Regularise flow specific logging helpers flow: Indent flow details messages flow: Include flow details with higher priority log messages flow, udp: Fix errno handling in udp_flow_sock() flow, treewide: Promote priority of selected flow-linked messages udp: Improve messages for errors getting errors flow.c | 108 +++++++------- flow.h | 79 +++++----- icmp.c | 27 ++-- icmp.h | 3 +- migrate.c | 27 ++-- migrate.h | 8 +- passt.c | 8 +- tcp.c | 387 ++++++++++++++++++++++++++++--------------------- tcp.h | 5 +- tcp_buf.c | 67 +++++---- tcp_buf.h | 7 +- tcp_conn.h | 8 +- tcp_internal.h | 27 ++-- tcp_splice.c | 59 +++++--- tcp_splice.h | 3 +- tcp_vu.c | 31 ++-- tcp_vu.h | 5 +- udp.c | 57 +++++--- udp_flow.c | 18 ++- 19 files changed, 534 insertions(+), 400 deletions(-) -- 2.54.0

2 6

[PATCH v2] tap: Trim Ethernet padding from short IPv4 frames instead of dropping them
by David du Colombier 22 Jun '26

22 Jun '26

tap4_handler() requires the L2 payload after the IP header to match the IP datagram length exactly. Guests whose drivers pad transmitted frames to the 60 byte Ethernet minimum, as real hardware requires and as drivers modelled on hardware do (Plan 9's virtio-net, for one), send pure ACK and FIN segments as 60 byte frames: 14 byte Ethernet header, 40 byte IPv4 datagram, 6 padding octets. Those frames fail the exact length check and are dropped without trace. passt then never sees such a guest's acknowledgements: it retransmits from the lowest unacknowledged sequence with exponential backoff while the guest, which received and acknowledged everything, waits. Every fresh connection stalls for minutes (a 1 MiB HTTP fetch over --map-host-loopback measured 248 s before this change, 0.27 s after; bulk transfer over established connections, whose ACKs ride data segments above the padding threshold, is unaffected). FIN segments are padded too, so teardown hangs as well. Note that tap_send_single() pads passt's own outbound frames to ETH_ZLEN, so the receive path was already stricter than the send path. Trim the trailing padding to the IP datagram length instead, using a new iov_tail_trim() helper, and keep dropping frames genuinely shorter than the datagram they claim to carry. IPv6 is unaffected: its minimal TCP frame is 74 bytes, above the padding threshold. Signed-off-by: David du Colombier <0intro(a)gmail.com> --- v2: - store the iov_tail_size() result in a local variable instead of computing it twice - pass ARRAY_SIZE(trim_iov) instead of UIO_MAXIOV iov.c | 35 +++++++++++++++++++++++++++++++++++ iov.h | 2 ++ tap.c | 15 +++++++++++++-- 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/iov.c b/iov.c index 6fd684a..968a365 100644 --- a/iov.c +++ b/iov.c @@ -450,3 +450,38 @@ ssize_t iov_tail_clone(struct iovec *dst_iov, size_t dst_iov_cnt, return j; } + +/** + * iov_tail_trim() - Limit a tail to @len bytes via a scratch iovec array + * @tail: Pointer to the iov_tail to trim; rebuilt on success to + * reference @scratch + * @len: Number of bytes to keep + * @scratch: Scratch iovec array backing the trimmed tail; must stay + * valid as long as the trimmed tail is in use + * @scratch_cnt: Number of elements in @scratch + * + * Return: true on success, false if @tail is shorter than @len or does + * not fit in @scratch (@tail is unchanged on failure) + */ +bool iov_tail_trim(struct iov_tail *tail, size_t len, + struct iovec *scratch, size_t scratch_cnt) +{ + ssize_t cnt = iov_tail_clone(scratch, scratch_cnt, tail); + size_t left = len; + unsigned int i; + + if (cnt < 0) + return false; + + for (i = 0; i < (size_t)cnt && left; i++) { + if (scratch[i].iov_len > left) + scratch[i].iov_len = left; + left -= scratch[i].iov_len; + } + + if (left) + return false; + + *tail = IOV_TAIL(scratch, i, 0); + return true; +} diff --git a/iov.h b/iov.h index 4fdf14a..3af467e 100644 --- a/iov.h +++ b/iov.h @@ -97,6 +97,8 @@ size_t iov_push_header_(struct iov_tail *tail, const void *v, size_t len); void *iov_remove_header_(struct iov_tail *tail, void *v, size_t len, size_t align); ssize_t iov_tail_clone(struct iovec *dst_iov, size_t dst_iov_cnt, struct iov_tail *tail); +bool iov_tail_trim(struct iov_tail *tail, size_t len, + struct iovec *scratch, size_t scratch_cnt); /** * IOV_PEEK_HEADER() - Get typed pointer to a header from an IOV tail diff --git a/tap.c b/tap.c index 4cba4c7..6ed7f8d 100644 --- a/tap.c +++ b/tap.c @@ -716,7 +716,8 @@ static int tap4_handler(struct ctx *c, const struct pool *in, i = 0; resume: for (seq_count = 0, seq = NULL; i < in->count; i++) { - size_t l3len, hlen, l4len; + struct iovec trim_iov[UIO_MAXIOV]; + size_t l3len, hlen, l4len, check; struct ethhdr eh_storage; struct iphdr iph_storage; struct udphdr uh_storage; @@ -775,7 +776,17 @@ resume: if (!iov_drop_header(&data, hlen)) continue; - if (iov_tail_size(&data) != l4len) + + check = iov_tail_size(&data); + if (check < l4len) + continue; + + /* Drivers modelled on real hardware (Plan 9's virtio, for + * one) pad short frames to the 60 byte Ethernet minimum: + * trim trailing padding instead of dropping the packet. + */ + if (check > l4len && + !iov_tail_trim(&data, l4len, trim_iov, ARRAY_SIZE(trim_iov))) continue; if (iph->protocol == IPPROTO_ICMP) { -- 2.54.0

3 2

[PATCH] test/pasta/ndp: Fix NDP test for --config-net pasta setup
by Jon Maloy 21 Jun '26

21 Jun '26

--config-net sets IPv6 addresses directly via netlink rather than relying on kernel SLAAC, so addresses won't have the "kernel_ra" protocol tag. Match global-scope addresses instead, which works for both --config-net and SLAAC configurations. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/pasta/ndp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/pasta/ndp b/test/pasta/ndp index 1d385c73..7169f57a 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -18,11 +18,11 @@ test Interface name nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' check [ -n "__IFNAME__" ] ns ip link set dev __IFNAME__ up -# Wait for SLAAC & DAD to complete -ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select(.protocol == "kernel_ra")'; do sleep 0.1; done +# Wait for global IPv6 address to appear (via --config-net or SLAAC) +ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info[] | select(.scope == "global")'; do sleep 0.1; done test SLAAC: prefix -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local]| join("/64 ")' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 | tr '\n' ' ' -- 2.52.0

2 1

[PATCH] test/pasta/dhcp: Fix DHCP tests for --config-net pasta setup
by Jon Maloy 21 Jun '26

21 Jun '26

setup_pasta() now passes --config-net, which pre-configures the namespace interface via NDP/SLAAC before dhclient runs. This caused several issues: - dhclient -6 using the host's dhclient-script failed inside user namespaces (NetworkManager hooks, resolv.conf writes), causing infinite SOLICIT/REPLY loops. Add a minimal dhclient-script that applies leases with 'ip addr replace' and exits cleanly. - The DHCPv6 address check filtered for prefixlen == 128, but --config-net already configures the address with /64 via SLAAC, and 'ip -6 addr replace' cannot change the prefix length of an existing address. Match by scope == "global" instead. - Copy dhclient to STATEDIR and use explicit lease files to avoid conflicts with the host's dhclient state. - Quote variable expansions in test comparisons to prevent failures on empty values. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/dhclient-script | 17 +++++++++++++++++ test/pasta/dhcp | 14 ++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) create mode 100755 test/lib/dhclient-script diff --git a/test/lib/dhclient-script b/test/lib/dhclient-script new file mode 100755 index 00000000..c6f4c0fc --- /dev/null +++ b/test/lib/dhclient-script @@ -0,0 +1,17 @@ +#!/bin/sh +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# Minimal dhclient-script for pasta tests. The host's dhclient-script +# fails inside user namespaces (NetworkManager hooks, resolv.conf +# writes, etc.), so we use this stripped-down version instead. +# Based on the guest script in test/passt.mbuto. + +[ -n "${new_interface_mtu}" ] && ip link set dev ${interface} mtu ${new_interface_mtu} + +[ -n "${new_ip_address}" ] && ip addr replace ${new_ip_address}/${new_subnet_mask} dev ${interface} +[ -n "${new_routers}" ] && for r in ${new_routers}; do ip route replace default via ${r} dev ${interface}; done + +[ -n "${new_ip6_address}" ] && ip -6 addr replace ${new_ip6_address}/${new_ip6_prefixlen:-128} dev ${interface} nodad + +exit 0 diff --git a/test/pasta/dhcp b/test/pasta/dhcp index 366935ff..5d7e78b6 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -19,30 +19,32 @@ nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifnam check [ -n "__IFNAME__" ] test DHCP: address -ns /sbin/dhclient -4 --no-pid __IFNAME__ +ns cp /sbin/dhclient __STATEDIR__/dhclient +ns __STATEDIR__/dhclient -4 --no-pid -lf __STATEDIR__/dhclient4.leases __IFNAME__ +sleep 1 nsout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' -check [ __ADDR__ = __HOST_ADDR__ ] +check [ "__ADDR__" = "__HOST_ADDR__" ] test DHCP: route nsout GW ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' hout HOST_GW ip -j -4 route show|jq -rM '[.[] | select(.dst == "default").gateway] | .[0]' -check [ __GW__ = __HOST_GW__ ] +check [ "__GW__" = "__HOST_GW__" ] test DHCP: MTU nsout MTU ip -j link show | jq -rM '.[] | select(.ifname == "__IFNAME__").mtu' check [ __MTU__ = 65520 ] test DHCPv6: address -ns /sbin/dhclient -6 --no-pid __IFNAME__ +ns __STATEDIR__/dhclient -6 -sf __BASEPATH__/lib/dhclient-script --no-pid -lf __STATEDIR__/dhclient6.leases __IFNAME__ # Wait for DAD to complete ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' check echo "__HOST_ADDR6__" | grep -wq "__ADDR6__" test DHCPv6: route nsout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' hout HOST_GW6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").gateway] | .[0]' -check [ __GW6__ = __HOST_GW6__ ] +check [ "__GW6__" = "__HOST_GW6__" ] -- 2.52.0

1 0

[PATCH] test/lib: Add --config-net to setup_pasta()
by Jon Maloy 21 Jun '26

21 Jun '26

Since commit b4dace8 ("fwd: Direct inbound spliced forwards to the guest's external address"), inbound splice connections target the guest's external address (addr_seen) rather than loopback. This requires the namespace tap interface to be configured with that address. setup_pasta() starts pasta without --config-net, so the tap interface in the namespace is never brought up and has no addresses or routes. Splice connections to addr_seen fail because the address is unreachable in the namespace, breaking all pasta TCP and UDP tests. Add --config-net to the pasta command line in setup_pasta(), matching what setup_passt_in_ns() and setup_two_guests() already do. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/setup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/lib/setup b/test/lib/setup index 59945987..dbf8079d 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -107,7 +107,7 @@ setup_pasta() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 -P ${STATESETUP}/passt.pid $(${NSTOOL} info -pw ${STATESETUP}/ns.hold)" + context_run_bg passt "./pasta ${__opts} -f -t 10002 -T 10003 -u 10002 -U 10003 --config-net -P ${STATESETUP}/passt.pid $(${NSTOOL} info -pw ${STATESETUP}/ns.hold)" # pidfile isn't created until pasta is ready wait_for [ -f "${STATESETUP}/passt.pid" ] -- 2.52.0

2 1

[PATCH] test/lib: Pre-create context log files before starting tail
by Jon Maloy 21 Jun '26

21 Jun '26

pane_watch_contexts() starts tail -f --retry on context log files, but those files may not exist yet when tail starts, resulting in error messages in the tmux pane. Pre-create them with touch so tail can open them immediately. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/lib/term | 1 + 1 file changed, 1 insertion(+) diff --git a/test/lib/term b/test/lib/term index 2d2d2182..23639e34 100755 --- a/test/lib/term +++ b/test/lib/term @@ -252,6 +252,7 @@ pane_watch_contexts() { tmux select-pane -t ${__pane_number} -T "${__desc}" __cmd="tail -f --retry" for c; do + touch "${LOGDIR}/context_${c}.log" __cmd="${__cmd} ${LOGDIR}/context_${c}.log" done cmd_write ${__pane_number} "${__cmd}" -- 2.52.0

2 1

[PATCH] inany: Fix doc comment to match u32 field, not u64
by Laurent Vivier 19 Jun '26

19 Jun '26

The original siphash incremental patch added a u64[2] member to union inany_addr for hashing. During review, this was changed to u32[4] to preserve 4-byte alignment: a u64 member would have forced 8-byte alignment on the union, mismatching struct in6_addr. The doc comment was not updated, fix @u64 references to @u32. Fixes: fc8f0f8c48ef ("siphash: Use incremental rather than all-at-once siphash functions") Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- inany.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/inany.h b/inany.h index 73385b916240..6bf3ecaa0e7d 100644 --- a/inany.h +++ b/inany.h @@ -22,9 +22,9 @@ * @v4mapped.zero: All zero-bits for an IPv4 address * @v4mapped.one: All one-bits for an IPv4 address * @v4mapped.a4: If @a6 is an IPv4 mapped address, the IPv4 address - * @u64: As an array of u64s (solely for hashing) + * @u32: As an array of u32s (solely for hashing) * - * @v4mapped and @u64 shouldn't be accessed except via helpers. + * @v4mapped and @u32 shouldn't be accessed except via helpers. */ union inany_addr { struct in6_addr a6; -- 2.54.0

3 2

[PATCH] tap: don't let overheard traffic move addr_seen when serving a fixed address
by EJ Campbell 19 Jun '26

19 Jun '26

The latest source address seen on the tap interface (ip4.addr_seen) is taken to be the guest's and is used as the target for inbound port forwarding. The update accepts any source address. On a point-to-point tap that is always correct. But when the tap sits on a shared L2 segment -- for example when it is bridged together with other hosts -- pasta also sees frames from those other hosts. With a static configuration (-a / address set, DHCP disabled), an overheard frame from another host silently moves addr_seen to that host, and every subsequent inbound forwarded connection is sent there instead of to the guest, so connections are reset or hang. I hit this running pasta with its tap enslaved to a Linux bridge that also carries other traffic: inbound port forwarding to the guest broke as soon as another address was seen on the segment. Restrict the update so that, when DHCP is disabled (no_dhcp), only frames sourced from the configured guest address may move addr_seen. With DHCP enabled -- the default -- behaviour is unchanged, since the guest's address is whatever pasta leases and tracking it is still correct. The same reasoning applies to ip6.addr_seen on a shared segment; I left IPv6 alone for now since I only exercise IPv4 in this setup, and would be glad to extend it the same way if you prefer. Signed-off-by: EJ Campbell <ej.campbell(a)gmail.com> --- tap.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tap.c b/tap.c index 4cba4c7..514379e 100644 --- a/tap.c +++ b/tap.c @@ -770,7 +770,19 @@ resume: continue; } - if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr) + /* The latest source address seen on the tap is taken to be the + * guest's, and becomes the target for inbound forwarding. On a + * point-to-point tap that's always correct. But if the tap sits + * on a shared L2 segment (for example bridged together with + * other hosts) and we serve a fixed address (DHCP disabled), a + * frame overheard from another host on that segment must not + * move addr_seen and silently retarget forwarded connections + * away from the guest. When DHCP is disabled, only the + * configured guest address may update addr_seen; with DHCP + * enabled (the default) behaviour is unchanged. + */ + if (iph->saddr && c->ip4.addr_seen.s_addr != iph->saddr && + (!c->no_dhcp || iph->saddr == c->ip4.addr.s_addr)) c->ip4.addr_seen.s_addr = iph->saddr; if (!iov_drop_header(&data, hlen)) base-commit: 4b2823784aab04a70dfc295b16fd6f0592955790 -- 2.53.0

3 6

[PATCH v2 0/6] Improvements to flow specific logging
by David Gibson 19 Jun '26

19 Jun '26

While working on podman bug 23739, I found some deficiences in how and when we report various socket errors related to specific flows. Here are some preliminary patches to improve that. I think patches 1..3 are pretty straightforward and safe. 4/4 I think is a good idea in principle - promoting the priority of a number of messages now that we have ratelimiting. However, plumbing 'now' all the places we need it resuls in a *lot* of churn, so we might want to postpone or split it up. Still, current drafted posted for consideration. v2: * Added patch 2/6 At Stefano's suggestion * Simplified the errno Handling fix at Stefano's suggestion * Added patch 6/6 which I noticed while revising 5/6. * Made a handful of minor corrections based on feedback. David Gibson (6): flow: Regularise flow specific logging helpers flow: Indent flow details messages flow: Include flow details with higher priority log messages flow, udp: Fix errno handling in udp_flow_sock() flow, treewide: Promote priority of selected flow-linked messages udp: Improve messages for errors getting errors flow.c | 103 ++++++------- flow.h | 72 ++++----- icmp.c | 27 ++-- icmp.h | 3 +- migrate.c | 27 ++-- migrate.h | 8 +- passt.c | 8 +- tcp.c | 387 ++++++++++++++++++++++++++++--------------------- tcp.h | 5 +- tcp_buf.c | 67 +++++---- tcp_buf.h | 7 +- tcp_conn.h | 8 +- tcp_internal.h | 27 ++-- tcp_splice.c | 59 +++++--- tcp_splice.h | 3 +- tcp_vu.c | 31 ++-- tcp_vu.h | 5 +- udp.c | 61 +++++--- udp_flow.c | 18 ++- 19 files changed, 528 insertions(+), 398 deletions(-) -- 2.54.0

2 7

[PATCH v3 3/6] flow: Include flow details with higher priority log messages
by David Gibson 19 Jun '26

19 Jun '26

Currently flow_log() and related functions / macros have a 'details' parameter which indicates whether to add extra messages with details of the flow's addresses. This is still a bit awkward to invoke, and only used in a few places. Change the logic, to automatically include the details if and only if the log priority is greater than LOG_DEBUG. Rationale: If at debug log level, there are already a bunch of debug messages tracking the flow life cycle, which include those details (we make sure to retain those). It's usually pretty easy to cross reference a specific flow debug message with the flow's history including the details. If at higher log level, and we generate a flow-connected error or warning we don't have those life cycle messages. So, just giving the flow index doesn't really tell you anything about which flow tripped the error. Adding the address details make the error message significantly more useful. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 2 +- flow.h | 22 +++++++++++----------- tcp.c | 2 +- udp.c | 5 ++--- 4 files changed, 15 insertions(+), 16 deletions(-) diff --git a/flow.c b/flow.c index 8f8435e6..b2963396 100644 --- a/flow.c +++ b/flow.c @@ -554,7 +554,7 @@ norule: /* This shouldn't happen, because if there's no rule for it we should * have no listening socket that would let us get here */ - flow_log(flow, LOG_DEBUG, false, true, "Missing forward rule"); + flow_dbg(flow, "Missing forward rule"); nofwd: flow_err(flow, "No rules to forward %s %s [%s]:%hu -> [%s]:%hu", diff --git a/flow.h b/flow.h index 2b78067a..61dde6d9 100644 --- a/flow.h +++ b/flow.h @@ -284,19 +284,19 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, enum flow_state state, const char *fmt, ...) __attribute__((format(printf, 6, 7))); -#define flow_log_(f_, pri_, perror_, details_, ...) \ - flow_log__((f_), (pri_), (perror_), (details_), (f_)->state, \ - __VA_ARGS__) +#define flow_log_(f_, pri_, perror_, ...) \ + flow_log__((f_), (pri_), (perror_), (pri_) > LOG_DEBUG, \ + (f_)->state, __VA_ARGS__) -#define flow_log(flow_, pri_, perror_, details_, ...) \ - flow_log_(&(flow_)->f, (pri_), (perror_), (details_), __VA_ARGS__) +#define flow_log(flow_, pri_, perror_, ...) \ + flow_log_(&(flow_)->f, (pri_), (perror_), __VA_ARGS__) #define flow_dbg(flow_, ...) \ - flow_log((flow_), LOG_DEBUG, false, false, __VA_ARGS__) + flow_log((flow_), LOG_DEBUG, false, __VA_ARGS__) #define flow_warn(flow_, ...) \ - flow_log((flow_), LOG_WARNING, false, false, __VA_ARGS__) + flow_log((flow_), LOG_WARNING, false, __VA_ARGS__) #define flow_err(flow_, ...) \ - flow_log((flow_), LOG_ERR, false, false, __VA_ARGS__) + flow_log((flow_), LOG_ERR, false, __VA_ARGS__) #define flow_trace(flow_, ...) \ do { \ if (log_trace) \ @@ -304,11 +304,11 @@ void flow_log__(const struct flow_common *f, int pri, bool perror, bool details, } while (0) #define flow_dbg_perror(flow_, ...) \ - flow_log((flow_), LOG_DEBUG, true, false, __VA_ARGS__) + flow_log((flow_), LOG_DEBUG, true, __VA_ARGS__) #define flow_warn_perror(flow_, ...) \ - flow_log((flow_), LOG_WARNING, true, false, __VA_ARGS__) + flow_log((flow_), LOG_WARNING, true, __VA_ARGS__) #define flow_perror(flow_, ...) \ - flow_log((flow_), LOG_ERR, true, false, __VA_ARGS__) + flow_log((flow_), LOG_ERR, true, __VA_ARGS__) #define flow_dbg_ratelimit(flow_, now_, ...) \ logmsg_ratelimit(flow_dbg, debug, (now_), (flow_), __VA_ARGS__) diff --git a/tcp.c b/tcp.c index 3538eec2..1c902ac2 100644 --- a/tcp.c +++ b/tcp.c @@ -1404,7 +1404,7 @@ void tcp_linger0_(const struct flow_common *f, int s) */ if (setsockopt(s, SOL_SOCKET, SO_LINGER, &linger0, sizeof(linger0)) < 0) { - flow_log_(f, LOG_DEBUG, true, false, + flow_log_(f, LOG_DEBUG, true, "SO_LINGER failed, may not send RST to peer"); } } diff --git a/udp.c b/udp.c index c95bb200..2d9e2f04 100644 --- a/udp.c +++ b/udp.c @@ -943,8 +943,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, if (events & EPOLLERR) { if (udp_sock_errs(c, ref.fd, ref.flowside, PIF_NONE, 0) < 0) { - flow_log(uflow, LOG_ERR, false, true, - "Unrecoverable error on flow socket"); + flow_err(uflow, "Unrecoverable error on flow socket"); goto fail; } } @@ -975,7 +974,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, udp_buf_sock_to_tap(c, s, n, tosidx); } } else { - flow_log(uflow, LOG_ERR, false, true, + flow_err(uflow, "No support for forwarding UDP from %s to %s", pif_name(pif_at_sidx(ref.flowside)), pif_name(topif)); -- 2.54.0

1 0