- dev - passt

[PATCH 1/5] cppcheck: Remove unused CPPCHECK_6936
by David Gibson 15 Jun '26

15 Jun '26

Our flags for cppcheck include -D CPPCHECK_6936. This used to enable a workaround for a cppcheck bug, but the code where we used it went away in commit 9153aca15bc1. Remove the now unused flag. Fixes: 9153aca15bc1 ("util: Add abort_with_msg() and ASSERT_WITH_MSG() helpers") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 0a0a60b0..c19383f3 100644 --- a/Makefile +++ b/Makefile @@ -208,8 +208,7 @@ CPPCHECK_FLAGS = --std=c11 --error-exitcode=1 --enable=all --force \ else \ echo ""; \ fi) \ - --suppress=missingIncludeSystem \ - -D CPPCHECK_6936 + --suppress=missingIncludeSystem cppcheck: passt.cppcheck passt-repair.cppcheck pesto.cppcheck -- 2.54.0

1 0

[PATCH v3 0/6] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 15 Jun '26

15 Jun '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. Anshu Kumari (6): conf: Add --dhcp-opt command-line option conf: Add --dhcp-boot command-line option dhcp: Add option type table and value parser dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option overload doc: Add --dhcp-boot and --dhcp-opt to man page conf.c | 29 ++++- dhcp.c | 322 ++++++++++++++++++++++++++++++++++++++++++++++++++++---- dhcp.h | 1 + passt.1 | 41 ++++++++ passt.h | 16 +++ 5 files changed, 389 insertions(+), 20 deletions(-) -- 2.54.0

3 22

[PATCH 0/4] Assorted minor socket creation cleanups
by David Gibson 15 Jun '26

15 Jun '26

As discussed on our recent call, I was looking again at bug 167. I discovered it's still fairly fiddly to address this, but while investigating spotted a number of cleanups to make in the vicinity. I think they make sense even without fixing bug 167 (yet), so here they are. David Gibson (4): flow: Correct misleading signature of flowside_sock_l4() Makefile: Remove unused DUAL_STACK_SOCKETS define fwd, pif: Remove duplicated logic between tcp_listen() and udp_listen() pif, util: Move listen(2) call from sock_l4_() to pif_listen() Makefile | 5 ----- flow.c | 11 +++++------ fwd.c | 8 +------- pif.c | 45 ++++++++++++++++++++++++++++++++++++--------- pif.h | 2 +- tcp.c | 38 -------------------------------------- tcp.h | 2 -- udp.c | 38 -------------------------------------- udp.h | 2 -- util.c | 7 ------- 10 files changed, 43 insertions(+), 115 deletions(-) -- 2.54.0

2 5

[PATCH v2] udp: Provide dummy iov in udp_peek_addr() to avoid Coverity warning
by Jon Maloy 15 Jun '26

15 Jun '26

udp_peek_addr() initialises struct msghdr without setting msg_iov, leaving it implicitly NULL. Coverity flags this as FORWARD_NULL, believing recvmsg() will dereference the NULL pointer. In practice, msg_iovlen being zero means the kernel never touches msg_iov, so the warning is a false positive. We now provide a one-byte dummy iov to make msg_iov non-NULL, hence suppressing this warning without changing the function's behaviour. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> ---- v2: - Make the dummy iov conditional on an ANALYZER macro, so it has zero runtime cost in production builds. - Add a new 'analyzer' Makefile target (similar to 'valgrind') that defines ANALYZER via CPPFLAGS for use with static analysis builds. --- Makefile | 3 +++ udp.c | 11 +++++++++++ 2 files changed, 14 insertions(+) diff --git a/Makefile b/Makefile index 0a0a60b0..4dcf4cd1 100644 --- a/Makefile +++ b/Makefile @@ -122,6 +122,9 @@ passt-repair: $(PASST_REPAIR_SRCS) $(PASST_REPAIR_HEADERS) seccomp_repair.h pesto: BASE_CPPFLAGS += -DPESTO pesto: $(PESTO_SRCS) $(PESTO_HEADERS) seccomp_pesto.h +analyzer: BASE_CPPFLAGS += -DANALYZER +analyzer: all + valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction \ rt_sigreturn getpid gettid kill clock_gettime \ mmap|mmap2 munmap open unlink gettimeofday futex \ diff --git a/udp.c b/udp.c index c28d6ee2..36c8c070 100644 --- a/udp.c +++ b/udp.c @@ -734,9 +734,20 @@ static int udp_peek_addr(int s, union sockaddr_inany *src, { char sastr[SOCKADDR_STRLEN], dstr[INANY_ADDRSTRLEN]; char cmsg[PKTINFO_SPACE]; +#ifdef ANALYZER + char dummy; + struct iovec iov = { + .iov_base = &dummy, + .iov_len = sizeof(dummy), + }; +#endif /* ANALYZER */ struct msghdr msg = { .msg_name = src, .msg_namelen = sizeof(*src), +#ifdef ANALYZER + .msg_iov = &iov, + .msg_iovlen = 1, +#endif /* ANALYZER */ .msg_control = cmsg, .msg_controllen = sizeof(cmsg), }; -- 2.52.0

3 3

[PATCH 3/6] tcp_splice: Clean up flow control path for splice forwarding
by David Gibson 15 Jun '26

15 Jun '26

Splice forwarding can be blocked either waiting for data from one side or waiting for space on the other. For that reason, tcp_splice_sock_handler() on either socket can forward data in either or both directions, depending on whether we have EPOLLIN, EPOLLOUT or both events. The flow control for this is quite hard to follow though, since we forward in one direction, then sometimes loop back with a goto to do it in the other direction. Simplify this by adding a tcp_splice_forward() function with the logic to forward in one direction and calling it either once or twice from tcp_splice_sock_handler(). Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp_splice.c | 137 ++++++++++++++++++++++++++------------------------- 1 file changed, 71 insertions(+), 66 deletions(-) diff --git a/tcp_splice.c b/tcp_splice.c index 34ffea73..18e8b303 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -474,67 +474,20 @@ void tcp_splice_conn_from_sock(const struct ctx *c, union flow *flow, int s0) } /** - * tcp_splice_sock_handler() - Handler for socket mapped to spliced connection + * tcp_splice_forward() - Forward data in one direction using splice() * @c: Execution context - * @ref: epoll reference - * @events: epoll events bitmap + * @conn: Connection to forward data for + * @fromsidei: Side to forward data from * * #syscalls:pasta splice */ -void tcp_splice_sock_handler(struct ctx *c, union epoll_ref ref, - uint32_t events) +static int tcp_splice_forward(struct ctx *c, struct + tcp_splice_conn *conn, unsigned fromsidei) { - struct tcp_splice_conn *conn = conn_at_sidx(ref.flowside); - unsigned evsidei = ref.flowside.sidei, fromsidei; - uint8_t lowat_set_flag, lowat_act_flag; - int eof, never_read; - - assert(conn->f.type == FLOW_TCP_SPLICE); - - if (conn->events == SPLICE_CLOSED) - return; - - if (events & EPOLLERR) { - int err, rc; - socklen_t sl = sizeof(err); - - rc = getsockopt(ref.fd, SOL_SOCKET, SO_ERROR, &err, &sl); - if (rc) - flow_perror(conn, "Error retrieving SO_ERROR"); - else - flow_dbg(conn, "Error event on %s socket: %s", - pif_name(conn->f.pif[evsidei]), - strerror_(err)); - goto reset; - } - - if (conn->events == SPLICE_CONNECT) { - if (!(events & EPOLLOUT)) { - flow_err(conn, "Unexpected events 0x%x during connect", - events); - goto reset; - } - if (tcp_splice_connect_finish(c, conn)) - goto reset; - } - - if (events & EPOLLOUT) { - fromsidei = !evsidei; - conn_event(conn, ~OUT_WAIT(evsidei)); - } else { - fromsidei = evsidei; - } - - if (events & EPOLLRDHUP) - /* For side 0 this is fake, but implied */ - conn_event(conn, FIN_RCVD(evsidei)); - -swap: - eof = 0; - never_read = 1; - - lowat_set_flag = RCVLOWAT_SET(fromsidei); - lowat_act_flag = RCVLOWAT_ACT(fromsidei); + uint8_t lowat_set_flag = RCVLOWAT_SET(fromsidei); + uint8_t lowat_act_flag = RCVLOWAT_ACT(fromsidei); + int never_read = 1; + int eof = 0; while (1) { ssize_t readlen, written, pending; @@ -551,7 +504,7 @@ retry: if (readlen < 0 && errno != EAGAIN) { flow_perror(conn, "Splicing from %s socket", pif_name(conn->f.pif[fromsidei])); - goto reset; + return -1; } flow_trace(conn, "%zi from read-side call", readlen); @@ -578,7 +531,7 @@ retry: if (written < 0 && errno != EAGAIN) { flow_perror(conn, "Splicing to %s socket", pif_name(conn->f.pif[!fromsidei])); - goto reset; + return -1; } flow_trace(conn, "%zi from write-side call (passed %zi)", @@ -639,24 +592,76 @@ retry: if (shutdown(conn->s[!sidei], SHUT_WR) < 0) { flow_perror(conn, "shutdown() on %s", pif_name(conn->f.pif[!sidei])); - goto reset; + return -1; } conn_event(conn, FIN_SENT(!sidei)); } } } - if (CONN_HAS(conn, FIN_SENT(0) | FIN_SENT(1))) { - /* Clean close, no reset */ - conn_flag(conn, CLOSING); + return 0; +} + +/** + * tcp_splice_sock_handler() - Handler for socket mapped to spliced connection + * @c: Execution context + * @ref: epoll reference + * @events: epoll events bitmap + */ +void tcp_splice_sock_handler(struct ctx *c, union epoll_ref ref, + uint32_t events) +{ + struct tcp_splice_conn *conn = conn_at_sidx(ref.flowside); + unsigned evsidei = ref.flowside.sidei; + + assert(conn->f.type == FLOW_TCP_SPLICE); + + if (conn->events == SPLICE_CLOSED) return; + + if (events & EPOLLERR) { + int err, rc; + socklen_t sl = sizeof(err); + + rc = getsockopt(ref.fd, SOL_SOCKET, SO_ERROR, &err, &sl); + if (rc) + flow_perror(conn, "Error retrieving SO_ERROR"); + else + flow_dbg(conn, "Error event on %s socket: %s", + pif_name(conn->f.pif[evsidei]), + strerror_(err)); + goto reset; + } + + if (conn->events == SPLICE_CONNECT) { + if (!(events & EPOLLOUT)) { + flow_err(conn, "Unexpected events 0x%x during connect", + events); + goto reset; + } + if (tcp_splice_connect_finish(c, conn)) + goto reset; + } + + if (events & EPOLLRDHUP) + /* For side 0 this is fake, but implied */ + conn_event(conn, FIN_RCVD(evsidei)); + + if (events & EPOLLOUT) { + if (tcp_splice_forward(c, conn, !evsidei)) + goto reset; + conn_event(conn, ~OUT_WAIT(evsidei)); } - if ((events & (EPOLLIN | EPOLLOUT)) == (EPOLLIN | EPOLLOUT)) { - events = EPOLLIN; + if (events & EPOLLIN) { + if (tcp_splice_forward(c, conn, evsidei)) + goto reset; + } - fromsidei = !fromsidei; - goto swap; + if (CONN_HAS(conn, FIN_SENT(0) | FIN_SENT(1))) { + /* Clean close, no reset */ + conn_flag(conn, CLOSING); + return; } if (events & EPOLLHUP) { -- 2.54.0

2 5

passt: new version 2026_06_11.a9c61ff available
by Stefano Brivio 13 Jun '26

13 Jun '26

The new version with tag 2026_06_11.a9c61ff includes the following changes: a9c61ff util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning e1a6d9e conf, util: Disable IPv6 if explicit IPv6 socket probe fails 21f4d13 tcp_splice: Improve EOF and read stall exit conditions 31d0893 passt, tcp: Inline CALL_PROTO_HANDLER() and merge tcp_timer() 2420ad2 tcp_splice: Remove questionable "optimisation" of pending bytes tracking 4ccb2ee tcp_splice: Simplify / correct OUT_WAIT flag handling cd61ad0 tcp_splice: Simplify shutdown(2) handling 987ac99 tcp_splice: Remove goto from forwarding loop 4a61870 tcp_splice: Improve EOF exit condition for the loop 1d475b1 tcp_splice: Simplify EPOLLRDHUP / eof / FIN handling 630e9bf tcp_splice: Remove never-invoked SO_RCVLOWAT logic 4b28237 tcp: Don't leak sockets on error paths 98e3c01 tcp, tcp_splice: Make helper for setting SO_LINGER socket option https://passt.top/passt/log/?qt=range&q=2026_05_26.038c51e..2026_06_11.a9c6… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10595057/ permanent mirror: https://passt.top/builds/copr/0^20260611.ga9c61ff/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-ga9c61ff-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0a9c61ff-1_all.deb -- Stefano

1 0

[PATCH v3] util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning
by Jon Maloy 12 Jun '26

12 Jun '26

conf_open_files() opens three file descriptors (fd_tap_listen, fd_repair_listen, fd_control_listen) that are held for the entire daemon lifetime. Because no close() call exists for them anywhere, Coverity flags each as INCOMPLETE_DEALLOCATOR. This is clearly a false positive, but we still want to get rid of this warning. We now register the execution context in global area so that passt_exit() can use it to close these descriptors before calling _exit(). All exit paths (signal handler, die(), die_perror()) funnel through passt_exit(), so this covers all cases. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- v2: - Made struct ctx global from the beginning, on suggestion from David Gibson. - Drop pidfile_fd from passt_exit() cleanup, since it can be closed directly after use. v3: - Moved stack declaration of struct *ctx in main() so it fits the reverse Christmas-tree order. --- passt.c | 77 +++++++++++++++++++++++++++++++-------------------------- passt.h | 2 ++ util.c | 7 ++++++ 3 files changed, 51 insertions(+), 35 deletions(-) diff --git a/passt.c b/passt.c index b3f806b9..b1d35d5b 100644 --- a/passt.c +++ b/passt.c @@ -62,6 +62,13 @@ char pkt_buf[PKT_BUF_BYTES] __attribute__ ((aligned(PAGE_SIZE))); +struct ctx passt_ctx = { + .pidfile_fd = -1, + .fd_tap = -1, + .pasta_netns_fd = -1, + .device_state_fd = -1, +}; + char *epoll_type_str[] = { [EPOLL_TYPE_TCP] = "connected TCP socket", [EPOLL_TYPE_TCP_SPLICE] = "connected spliced TCP socket", @@ -323,8 +330,8 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events) int main(int argc, char **argv) { struct epoll_event events[NUM_EPOLL_EVENTS]; + struct ctx *c = &passt_ctx; int nfds, devnull_fd = -1; - struct ctx c = { 0 }; struct rlimit limit; struct timespec now; struct sigaction sa; @@ -336,18 +343,15 @@ int main(int argc, char **argv) isolate_initial(argc, argv); - c.pasta_netns_fd = c.fd_tap = c.pidfile_fd = -1; - c.device_state_fd = -1; - sigemptyset(&sa.sa_mask); sa.sa_flags = 0; sa.sa_handler = exit_handler; sigaction(SIGTERM, &sa, NULL); sigaction(SIGQUIT, &sa, NULL); - c.mode = conf_mode(argc, argv); + c->mode = conf_mode(argc, argv); - if (c.mode == MODE_PASTA) { + if (c->mode == MODE_PASTA) { sa.sa_handler = pasta_child_handler; if (sigaction(SIGCHLD, &sa, NULL)) die_perror("Couldn't install signal handlers"); @@ -358,67 +362,70 @@ int main(int argc, char **argv) madvise(pkt_buf, sizeof(pkt_buf), MADV_HUGEPAGE); - c.epollfd = epoll_create1(EPOLL_CLOEXEC); - if (c.epollfd == -1) + c->epollfd = epoll_create1(EPOLL_CLOEXEC); + if (c->epollfd == -1) die_perror("Failed to create epoll file descriptor"); - flow_epollid_register(EPOLLFD_ID_DEFAULT, c.epollfd); + flow_epollid_register(EPOLLFD_ID_DEFAULT, c->epollfd); if (getrlimit(RLIMIT_NOFILE, &limit)) die_perror("Failed to get maximum value of open files limit"); - c.nofile = limit.rlim_cur = limit.rlim_max; + c->nofile = limit.rlim_cur = limit.rlim_max; if (setrlimit(RLIMIT_NOFILE, &limit)) die_perror("Failed to set current limit for open files"); - sock_probe_features(&c); + sock_probe_features(c); - conf(&c, argc, argv); - trace_init(c.trace); + conf(c, argc, argv); + trace_init(c->trace); - pasta_netns_quit_init(&c); + pasta_netns_quit_init(c); - tap_backend_init(&c); + tap_backend_init(c); - random_init(&c); + random_init(c); if (clock_gettime(CLOCK_MONOTONIC, &now)) die_perror("Failed to get CLOCK_MONOTONIC time"); flow_init(); - fwd_scan_ports_init(&c); + fwd_scan_ports_init(c); - if ((!c.no_udp && udp_init(&c)) || (!c.no_tcp && tcp_init(&c))) + if ((!c->no_udp && udp_init(c)) || (!c->no_tcp && tcp_init(c))) passt_exit(EXIT_FAILURE); - if (fwd_listen_init(&c)) + if (fwd_listen_init(c)) passt_exit(EXIT_FAILURE); - proto_update_l2_buf(c.guest_mac); + proto_update_l2_buf(c->guest_mac); - if (c.ifi4 && !c.no_dhcp) + if (c->ifi4 && !c->no_dhcp) dhcp_init(); - if (c.ifi6 && !c.no_dhcpv6) - dhcpv6_init(&c); + if (c->ifi6 && !c->no_dhcpv6) + dhcpv6_init(c); - pcap_init(&c); + pcap_init(c); - fwd_neigh_table_init(&c); - nl_neigh_notify_init(&c); + fwd_neigh_table_init(c); + nl_neigh_notify_init(c); - if (!c.foreground) { + if (!c->foreground) { if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0) die_perror("Failed to open /dev/null"); } - if (isolate_prefork(&c)) + if (isolate_prefork(c)) die("Failed to sandbox process, exiting"); - if (!c.foreground) { - __daemon(c.pidfile_fd, devnull_fd); + if (!c->foreground) { + __daemon(c->pidfile_fd, devnull_fd); + close(c->pidfile_fd); + c->pidfile_fd = -1; log_stderr = false; } else { - pidfile_write(c.pidfile_fd, getpid()); + pidfile_write(c->pidfile_fd, getpid()); + c->pidfile_fd = -1; } if (pasta_child_pid) { @@ -426,19 +433,19 @@ int main(int argc, char **argv) log_stderr = false; } - isolate_postfork(&c); + isolate_postfork(c); - timer_init(&c, &now); + timer_init(c, &now); loop: /* NOLINTBEGIN(bugprone-branch-clone): intervals can be the same */ /* cppcheck-suppress [duplicateValueTernary, unmatchedSuppression] */ - nfds = epoll_wait(c.epollfd, events, NUM_EPOLL_EVENTS, TIMER_INTERVAL); + nfds = epoll_wait(c->epollfd, events, NUM_EPOLL_EVENTS, TIMER_INTERVAL); /* NOLINTEND(bugprone-branch-clone) */ if (nfds == -1 && errno != EINTR) die_perror("epoll_wait() failed in main loop"); - passt_worker(&c, nfds, events); + passt_worker(c, nfds, events); goto loop; } diff --git a/passt.h b/passt.h index 1726965d..e1905f4c 100644 --- a/passt.h +++ b/passt.h @@ -307,6 +307,8 @@ struct ctx { bool migrate_exit; }; +extern struct ctx passt_ctx; + void proto_update_l2_buf(const unsigned char *eth_d); #endif /* PASST_H */ diff --git a/util.c b/util.c index b64c29ed..ef6ba80e 100644 --- a/util.c +++ b/util.c @@ -1108,6 +1108,13 @@ void abort_with_msg(const char *fmt, ...) */ void passt_exit(int status) { + if (passt_ctx.fd_tap_listen >= 0) + close(passt_ctx.fd_tap_listen); + if (passt_ctx.fd_repair_listen >= 0) + close(passt_ctx.fd_repair_listen); + if (passt_ctx.fd_control_listen >= 0) + close(passt_ctx.fd_control_listen); + /* Make sure we don't leave the pcap file truncated */ if (pcap_fd != -1 && fsync(pcap_fd)) warn_perror("Failed to flush pcap file, it might be truncated"); -- 2.52.0

2 1

[PATCH] conf, util: Disable IPv6 if explicit IPv6 socket probe fails
by Stefano Brivio 10 Jun '26

10 Jun '26

In https://bugs.passt.top/show_bug.cgi?id=188, I originally reported that if IPv6 is disabled in the kernel (for example via command line parameter ipv6.disable=1, or disabled in build configuration), and we attempt to forward any port, we'll exit right away after failing to set up dual-stack listening sockets. The original instance of that issue is now fixed for pasta by commit 75dcbc300bf0 ("pasta: Warn, disable matching IP version if not supported, in local mode") together with the new implementation of the rule forwarding table, starting from commit b223bec48213 ("fwd, tcp, udp: Set up listening sockets based on forward table"), because we first parse forwarding options, then probe for IPv6 support in the target namespace (and disable IPv6 as a result), and finally bind sockets once we already know that IPv6 support is disabled. But we don't do that when invoked as passt, because we have no target namespace and hence no probing for IPv6 support whatsoever. Add IPv6 to the socket features we test in sock_probe_features(), and, if we fail to create an IPv6 socket for whatever reason (which might include security policies as well), disable IPv6 support altogether, so that we won't attempt to use dual-stack sockets for port forwarding either. Note that the probe comes without any sort of debug message, because at this point we haven't parsed the configuration yet, and we would therefore print that regardless of the selected logging level and other options, including --ipv4-only, which would be rather confusing. I doubt we'll miss this kind of message though, IPv6 support being disabled is anyway obvious from the initial configuration dump. Reported-by: Chi Cuong HA <ChiCuong.HA(a)amadeus.com> Reported-by: Romain Geissler <romain.geissler(a)amadeus.com> Link: https://bugs.passt.top/show_bug.cgi?id=188 Fixes: 4ddd59bc6085 ("conf: Separate local mode for each IP version, don't enable disabled IP version") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 7 ++++++- passt.h | 2 ++ util.c | 8 ++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index 6f86940..cd05adf 100644 --- a/conf.c +++ b/conf.c @@ -1254,7 +1254,9 @@ void conf(struct ctx *c, int argc, char **argv) int name, ret; uid_t uid; gid_t gid; - + + if (c->no_ipv6) + v4_only = true; if (c->mode == MODE_PASTA) c->no_dhcp_dns = c->no_dhcp_dns_search = 1; @@ -1682,6 +1684,9 @@ void conf(struct ctx *c, int argc, char **argv) v6_only = false; break; case '6': + if (c->no_ipv6) + die("IPv6 not available but --ipv6-only given"); + v6_only = true; v4_only = false; break; diff --git a/passt.h b/passt.h index 1726965..c5f51d1 100644 --- a/passt.h +++ b/passt.h @@ -211,6 +211,7 @@ struct ip6_ctx { * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max * @no_bindtodevice: Unprivileged SO_BINDTODEVICE not available + * @no_ipv6: IPv6 sockets not available * @vdev: vhost-user device * @device_state_fd: Device state migration channel * @device_state_result: Device state migration result @@ -296,6 +297,7 @@ struct ctx { int low_wmem; int low_rmem; int no_bindtodevice; + bool no_ipv6; struct vu_dev *vdev; diff --git a/util.c b/util.c index b64c29e..fe0aab9 100644 --- a/util.c +++ b/util.c @@ -334,6 +334,14 @@ void sock_probe_features(struct ctx *c) c->no_bindtodevice = 1; } + /* Check if IPv6 sockets are usable */ + close(s); + s = socket(AF_INET6, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP); + if (s < 0) { + c->no_ipv6 = true; + return; + } + close(s); } -- 2.43.0

2 3

[PATCH 4/4] pif, util: Move listen(2) call from sock_l4_() to pif_listen()
by David Gibson 09 Jun '26

09 Jun '26

It's a bit odd to have the listen(2) call for TCP listening sockets, down deep in sock_l4_() conditional upon the epoll type passed in. Move it to pif_listen(), which is at least about listening, although it does still need to be conditional on TCP. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- pif.c | 14 ++++++++++---- util.c | 7 ------- 2 files changed, 10 insertions(+), 11 deletions(-) diff --git a/pif.c b/pif.c index ede2f903..f99f33e5 100644 --- a/pif.c +++ b/pif.c @@ -123,11 +123,17 @@ int pif_listen(const struct ctx *c, uint8_t proto, uint8_t pif, ref.listen.pif = pif; ref.listen.rule = rule; - ret = epoll_add(c->epollfd, EPOLLIN, ref); - if (ret < 0) { - close(ref.fd); - return ret; + if (proto == IPPROTO_TCP && listen(ref.fd, 128) < 0) { + ret = -errno; + goto fail; } + ret = epoll_add(c->epollfd, EPOLLIN, ref); + if (ret < 0) + goto fail; + return ref.fd; +fail: + close(ref.fd); + return ret; } diff --git a/util.c b/util.c index b64c29ed..e22696e3 100644 --- a/util.c +++ b/util.c @@ -169,13 +169,6 @@ static int sock_l4_(const struct ctx *c, enum epoll_type type, } } - if (type == EPOLL_TYPE_TCP_LISTEN && listen(fd, 128) < 0) { - ret = -errno; - warn("TCP socket listen: %s", strerror_(-ret)); - close(fd); - return ret; - } - return fd; } -- 2.54.0

1 0

[PATCH v2] util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning
by Jon Maloy 09 Jun '26

09 Jun '26

conf_open_files() opens three file descriptors (fd_tap_listen, fd_repair_listen, fd_control_listen) that are held for the entire daemon lifetime. Because no close() call exists for them anywhere, Coverity flags each as INCOMPLETE_DEALLOCATOR. This is clearly a false positive, but we still want to get rid of this warning. We now register the execution context in global area so that passt_exit() can use it to close these descriptors before calling _exit(). All exit paths (signal handler, die(), die_perror()) funnel through passt_exit(), so this covers all cases. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Made struct ctx global from the beginning, on suggestion from David Gibson. - Drop pidfile_fd from passt_exit() cleanup, since it can be closed directly after use. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- passt.c | 77 +++++++++++++++++++++++++++++++-------------------------- passt.h | 2 ++ util.c | 7 ++++++ 3 files changed, 51 insertions(+), 35 deletions(-) diff --git a/passt.c b/passt.c index b3f806b9..e75b80b1 100644 --- a/passt.c +++ b/passt.c @@ -62,6 +62,13 @@ char pkt_buf[PKT_BUF_BYTES] __attribute__ ((aligned(PAGE_SIZE))); +struct ctx passt_ctx = { + .pidfile_fd = -1, + .fd_tap = -1, + .pasta_netns_fd = -1, + .device_state_fd = -1, +}; + char *epoll_type_str[] = { [EPOLL_TYPE_TCP] = "connected TCP socket", [EPOLL_TYPE_TCP_SPLICE] = "connected spliced TCP socket", @@ -322,9 +329,9 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events) */ int main(int argc, char **argv) { + struct ctx *c = &passt_ctx; struct epoll_event events[NUM_EPOLL_EVENTS]; int nfds, devnull_fd = -1; - struct ctx c = { 0 }; struct rlimit limit; struct timespec now; struct sigaction sa; @@ -336,18 +343,15 @@ int main(int argc, char **argv) isolate_initial(argc, argv); - c.pasta_netns_fd = c.fd_tap = c.pidfile_fd = -1; - c.device_state_fd = -1; - sigemptyset(&sa.sa_mask); sa.sa_flags = 0; sa.sa_handler = exit_handler; sigaction(SIGTERM, &sa, NULL); sigaction(SIGQUIT, &sa, NULL); - c.mode = conf_mode(argc, argv); + c->mode = conf_mode(argc, argv); - if (c.mode == MODE_PASTA) { + if (c->mode == MODE_PASTA) { sa.sa_handler = pasta_child_handler; if (sigaction(SIGCHLD, &sa, NULL)) die_perror("Couldn't install signal handlers"); @@ -358,67 +362,70 @@ int main(int argc, char **argv) madvise(pkt_buf, sizeof(pkt_buf), MADV_HUGEPAGE); - c.epollfd = epoll_create1(EPOLL_CLOEXEC); - if (c.epollfd == -1) + c->epollfd = epoll_create1(EPOLL_CLOEXEC); + if (c->epollfd == -1) die_perror("Failed to create epoll file descriptor"); - flow_epollid_register(EPOLLFD_ID_DEFAULT, c.epollfd); + flow_epollid_register(EPOLLFD_ID_DEFAULT, c->epollfd); if (getrlimit(RLIMIT_NOFILE, &limit)) die_perror("Failed to get maximum value of open files limit"); - c.nofile = limit.rlim_cur = limit.rlim_max; + c->nofile = limit.rlim_cur = limit.rlim_max; if (setrlimit(RLIMIT_NOFILE, &limit)) die_perror("Failed to set current limit for open files"); - sock_probe_features(&c); + sock_probe_features(c); - conf(&c, argc, argv); - trace_init(c.trace); + conf(c, argc, argv); + trace_init(c->trace); - pasta_netns_quit_init(&c); + pasta_netns_quit_init(c); - tap_backend_init(&c); + tap_backend_init(c); - random_init(&c); + random_init(c); if (clock_gettime(CLOCK_MONOTONIC, &now)) die_perror("Failed to get CLOCK_MONOTONIC time"); flow_init(); - fwd_scan_ports_init(&c); + fwd_scan_ports_init(c); - if ((!c.no_udp && udp_init(&c)) || (!c.no_tcp && tcp_init(&c))) + if ((!c->no_udp && udp_init(c)) || (!c->no_tcp && tcp_init(c))) passt_exit(EXIT_FAILURE); - if (fwd_listen_init(&c)) + if (fwd_listen_init(c)) passt_exit(EXIT_FAILURE); - proto_update_l2_buf(c.guest_mac); + proto_update_l2_buf(c->guest_mac); - if (c.ifi4 && !c.no_dhcp) + if (c->ifi4 && !c->no_dhcp) dhcp_init(); - if (c.ifi6 && !c.no_dhcpv6) - dhcpv6_init(&c); + if (c->ifi6 && !c->no_dhcpv6) + dhcpv6_init(c); - pcap_init(&c); + pcap_init(c); - fwd_neigh_table_init(&c); - nl_neigh_notify_init(&c); + fwd_neigh_table_init(c); + nl_neigh_notify_init(c); - if (!c.foreground) { + if (!c->foreground) { if ((devnull_fd = open("/dev/null", O_RDWR | O_CLOEXEC)) < 0) die_perror("Failed to open /dev/null"); } - if (isolate_prefork(&c)) + if (isolate_prefork(c)) die("Failed to sandbox process, exiting"); - if (!c.foreground) { - __daemon(c.pidfile_fd, devnull_fd); + if (!c->foreground) { + __daemon(c->pidfile_fd, devnull_fd); + close(c->pidfile_fd); + c->pidfile_fd = -1; log_stderr = false; } else { - pidfile_write(c.pidfile_fd, getpid()); + pidfile_write(c->pidfile_fd, getpid()); + c->pidfile_fd = -1; } if (pasta_child_pid) { @@ -426,19 +433,19 @@ int main(int argc, char **argv) log_stderr = false; } - isolate_postfork(&c); + isolate_postfork(c); - timer_init(&c, &now); + timer_init(c, &now); loop: /* NOLINTBEGIN(bugprone-branch-clone): intervals can be the same */ /* cppcheck-suppress [duplicateValueTernary, unmatchedSuppression] */ - nfds = epoll_wait(c.epollfd, events, NUM_EPOLL_EVENTS, TIMER_INTERVAL); + nfds = epoll_wait(c->epollfd, events, NUM_EPOLL_EVENTS, TIMER_INTERVAL); /* NOLINTEND(bugprone-branch-clone) */ if (nfds == -1 && errno != EINTR) die_perror("epoll_wait() failed in main loop"); - passt_worker(&c, nfds, events); + passt_worker(c, nfds, events); goto loop; } diff --git a/passt.h b/passt.h index 1726965d..e1905f4c 100644 --- a/passt.h +++ b/passt.h @@ -307,6 +307,8 @@ struct ctx { bool migrate_exit; }; +extern struct ctx passt_ctx; + void proto_update_l2_buf(const unsigned char *eth_d); #endif /* PASST_H */ diff --git a/util.c b/util.c index b64c29ed..ef6ba80e 100644 --- a/util.c +++ b/util.c @@ -1108,6 +1108,13 @@ void abort_with_msg(const char *fmt, ...) */ void passt_exit(int status) { + if (passt_ctx.fd_tap_listen >= 0) + close(passt_ctx.fd_tap_listen); + if (passt_ctx.fd_repair_listen >= 0) + close(passt_ctx.fd_repair_listen); + if (passt_ctx.fd_control_listen >= 0) + close(passt_ctx.fd_control_listen); + /* Make sure we don't leave the pcap file truncated */ if (pcap_fd != -1 && fsync(pcap_fd)) warn_perror("Failed to flush pcap file, it might be truncated"); -- 2.52.0

2 1