- dev - passt

[PATCH 0/7] Fixes for armv6l, armv7l, and warnings on some gcc flags
by Stefano Brivio 26 Feb '22

26 Feb '22

This series fixes issues and warnings I spotted in Martin's build logs for OpenSUSE on armv6l and armv7l (patches 1/7 to 3/7). I couldn't find (yet) a convenient way to add armv6l and armv7l OpenSUSE builds to the tests using qemu TCG (suggestions welcome!) so I tried things out on a Raspberry Pi Zero and a Raspberry Pi 4 for the moment being -- patches 4/7 to 7/7 fix the other issues I hit there. Stefano Brivio (7): passt: Explicitly check return value of chdir() udp: Explicitly initialise sin6_scope_id and sin_zero in sockaddr_in{,6} seccomp.sh: Handle syscall number defines in the (x + y) form tap: Cast ETH_MAX_MTU to signed in comparisons Makefile: Fix up AUDIT_ARCH for armv6l, armv7l passt: Don't warn on failed madvise() seccomp: Adjust list of allowed syscalls for armv6l, armv7l Makefile | 1 + passt.c | 15 +++++++++------ pasta.c | 3 ++- seccomp.sh | 3 +++ tap.c | 4 ++-- udp.c | 2 ++ util.c | 3 ++- 7 files changed, 21 insertions(+), 10 deletions(-) -- 2.34.1

1 7

[PATCH 1/2] passt.1: Drop duplicate --dns section
by Stefano Brivio 25 Feb '22

25 Feb '22

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.1 | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/passt.1 b/passt.1 index 1e7cf1a..57cf745 100644 --- a/passt.1 +++ b/passt.1 @@ -171,14 +171,6 @@ configured (see options \fB--no-dhcp-dns\fR, \fB--dhcp-dns\fR, This option can be specified multiple times, and a single, empty option disables usage of DNS addresses altogether. -.TP -.BR \-D ", " \-\-dns " " \fIaddr -Use \fIaddr\fR (IPv4 or IPv6) for DHCP, DHCPv6, NDP or DNS forwarding, as -configured (see options \fB--no-dhcp-dns\fR, \fB--dhcp-dns\fR, -\fB--dns-forward\fR) instead of reading addresses from \fI/etc/resolv.conf\fR. -This option can be specified multiple times, and a single, empty option disables -usage of DNS addresses altogether. - .TP .BR \-\-dns-forward " " \fIaddr Map \fIaddr\fR (IPv4 or IPv6) as seen from guest or namespace to the first @@ -440,9 +432,7 @@ The default path is shown with --help. .TP .BR \-\-config-net Configure networking in the namespace: set up addresses and routes as configured -or sourced from the host, and bring up the tap interface. This option implies -\fB--no-ra\fR: the static configuration of the IPv6 address will not allow the -kernel to set up the default route using SLAAC. +or sourced from the host, and bring up the tap interface. .TP .BR \-\-ns-mac-addr " " \fIaddr -- 2.34.1

1 1

[PATCH 1/3] test: Fix name of CI asciinema player in perf links handler
by Stefano Brivio 23 Feb '22

23 Feb '22

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/perf_report | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/test/lib/perf_report b/test/lib/perf_report index 9117046..f1d3ab9 100755 --- a/test/lib/perf_report +++ b/test/lib/perf_report @@ -114,11 +114,10 @@ for (var i = 0; i < perf_links.length; i++) { } event.preventDefault(); - ci_video_player.dispose(); - ci_video_player = AsciinemaPlayer.create( - "/builds/latest/web/ci.cast", - ci_video, - { startAt: seek, autoplay: true }); + ci_player.dispose(); + ci_player = AsciinemaPlayer.create("/builds/latest/web/ci.cast", + ci_video, + { startAt: seek, autoplay: true }); window.scrollTo({ top: top, behavior: "smooth" }) }, false); -- 2.34.1

1 2

[PATCH] passt: Drop PASST_LEGACY_NO_OPTIONS sections
by Stefano Brivio 22 Feb '22

22 Feb '22

...nobody uses those builds anymore. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 12 ------------ hooks/pre-push | 4 ---- passt.c | 2 -- tap.c | 7 ------- 4 files changed, 25 deletions(-) diff --git a/conf.c b/conf.c index 9851575..c8a3693 100644 --- a/conf.c +++ b/conf.c @@ -1281,18 +1281,6 @@ void conf(struct ctx *c, int argc, char **argv) if (!*c->pasta_ifn) if_indextoname(c->ifi, c->pasta_ifn); -#ifdef PASST_LEGACY_NO_OPTIONS - if (c->mode == MODE_PASST) { - c->foreground = 1; - c->stderr = 1; - - if (!tcp_tap) { - memset(c->tcp.port_to_tap, 0xff, - PORT_EPHEMERAL_MIN / 8); - } - } -#endif - c->tcp.ns_detect_ports = c->udp.ns_detect_ports = 0; c->tcp.init_detect_ports = c->udp.init_detect_ports = 0; diff --git a/hooks/pre-push b/hooks/pre-push index 3a46922..0246776 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -66,7 +66,3 @@ scp *.deb *.rpm "${USER_HOST}:${BIN}/avx2/" ssh "${USER_HOST}" "mv ${LATEST} ${AWAY}" ssh "${USER_HOST}" "mv ${TEMP} ${LATEST}" ssh "${USER_HOST}" "rm -rf ${AWAY}" - -# Legacy, for KubeVirt tests -# CFLAGS="-DPASST_LEGACY_NO_OPTIONS -static" make avx2 -# scp passt qrap "${USER_HOST}:${BUILDS}/static/" diff --git a/passt.c b/passt.c index 36f0161..3d18d1f 100644 --- a/passt.c +++ b/passt.c @@ -309,9 +309,7 @@ int main(int argc, char **argv) struct sigaction sa; char *log_name; -#ifndef PASST_LEGACY_NO_OPTIONS check_root(); -#endif drop_caps(); c.pasta_userns_fd = c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = -1; diff --git a/tap.c b/tap.c index 38004a5..9e6ece9 100644 --- a/tap.c +++ b/tap.c @@ -818,13 +818,6 @@ static void tap_sock_unix_init(struct ctx *c) } info("UNIX domain socket bound at %s\n", addr.sun_path); -#ifdef PASST_LEGACY_NO_OPTIONS - /* - * syscalls:passt chmod - */ - chmod(addr.sun_path, - S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH); -#endif listen(fd, 0); -- 2.34.1

1 0

[PATCH] demo, ci: Switch to asciinema(1) for terminal recordings
by Stefano Brivio 22 Feb '22

22 Feb '22

For demos, cool-retro-term(1) looked fancier, but several threads of that and ffmpeg(1) are just messing up with performance testing. The CI videos started getting really big as well, and they were difficult to read. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 52 +++++++++++++++------ test/README.md | 26 ++++------- test/lib/perf_report | 17 ++++--- test/lib/term | 27 ++++------- test/lib/video | 107 ++++++++++++++++++++++++++----------------- test/run | 16 +++---- 6 files changed, 139 insertions(+), 106 deletions(-) diff --git a/README.md b/README.md index 16e91b9..9c71c13 100644 --- a/README.md +++ b/README.md @@ -398,28 +398,52 @@ is fully configurable with command line options. ### pasta +<link rel="stylesheet" type="text/css" href="/static/asciinema-player.css" /> +<script src="/static/asciinema-player.min.js"></script> + +<div style="display: grid; grid-template-columns: 1fr 1fr;"> + <div> + <div id="demo_pasta" style="width: 100%; height: auto;"></div> + <div>use pasta to create and connect a namespace</div> + </div> +</div> <div style="display: grid; grid-template-columns: 1fr 1fr;"> - <div><video id="demo_pasta_video" style="width: 100%; height: auto;" controls> - <source src="/builds/latest/web/demo_pasta.webm" type="video/webm"> - </video>use pasta to create and connect a namespace</div> - <div><video id="demo_podman_video" style="width: 100%; height: auto;" controls> - <source src="/builds/latest/web/demo_podman.webm" type="video/webm"> - </video>use Podman with pasta</div> + <div> + <div id="demo_podman" style="width: 100%; height: auto;"></div> + <div>use Podman with pasta</div> </div> +<script> +demo_pasta_player = AsciinemaPlayer.create('/builds/latest/web/demo_pasta.cast', + document.getElementById('demo_pasta'), + { cols: 130, rows: 40, preload: true } + ); + +demo_podman_player = AsciinemaPlayer.create('/builds/latest/web/demo_podman.cast', + document.getElementById('demo_podman'), + { cols: 130, rows: 40, preload: true } + ); +</script> ### passt -<p><video id="demo_passt_video" style="width: 70%; height: auto; max-height: 90%" controls> - <source src="/builds/latest/web/demo_passt.webm" type="video/webm"> -</video></p> +<div id="demo_passt" style="width: 70%; height: auto; max-height: 90%"></div> +<script> +demo_passt_player = AsciinemaPlayer.create('/builds/latest/web/demo_passt.cast', + document.getElementById('demo_passt'), + { cols: 130, rows: 40, preload: true } + ); +</script> ## Continuous Integration -<p><video id="ci_video" style="width: 90%; height: auto; max-height: 90%" controls> - <source src="/builds/latest/web/ci.webm" type="video/webm"> -</video></p> - -<script src="/builds/latest/web/ci.js"></script> +<div id="ci" style="width: 90%; height: auto; max-height: 90%"></div> +<script> +ci_player = AsciinemaPlayer.create('/builds/latest/web/ci.cast', + document.getElementById('ci'), + { cols: 240, rows: 50, preload: true } + ); +</script> +<div><script src="/builds/latest/web/ci.js"></script></div> Test logs [here](/builds/latest/test/). diff --git a/test/README.md b/test/README.md index 647100f..88270e8 100644 --- a/test/README.md +++ b/test/README.md @@ -49,21 +49,13 @@ as needed, so there's no need to actually install it. ### Special requirements for continuous integration and demo modes -Running the test suite as continuous integration or demo modes will record a -video of the steps being executed, and create binary packages. The demo mode -uses _cool-retro-term_ as terminal, whereas the continuous integration mode uses -_MATE Terminal_ by default. +Running the test suite as continuous integration or demo modes will record the +terminal with the steps being executed, using asciinema(1), and create binary +packages. -The following additional packages are commonly needed as well: +The following additional packages are commonly needed: - dbus-x11 xdotool x11-utils xvfb ffmpeg mate-terminal cool-retro-term xauth - dconf-cli alien linux-perf tshark sqlite3` - -For convenience, suitable profiles for _MATE Terminal_ and _cool-retro-term_ are -provided under the `env` directory. To source them: - - dconf load /org/mate/terminal/profiles/ < env/mate-terminal.profile - cp env/cool_retro_term.sqlite ~/.local/share/cool-retro-term/QML/OfflineStorage/Databases/*.sqlite + alien linux-perf tshark ## Regular test @@ -79,9 +71,9 @@ Issuing: ./ci -will run the whole test suite while recording a video of the execution, and it -will also build JavaScript fragments used on http://passt.top/ for performance -data tables and links to specific video offsets. +will run the whole test suite while recording the execution, and it will also +build JavaScript fragments used on http://passt.top/ for performance data tables +and links to specific offsets in the captures. ## Demo mode @@ -89,7 +81,7 @@ Issuing: ./demo -will run the demo cases under `demo`, recording videos as well. +will run the demo cases under `demo`, with terminal captures as well. # Framework diff --git a/test/lib/perf_report b/test/lib/perf_report index baa084b..9117046 100755 --- a/test/lib/perf_report +++ b/test/lib/perf_report @@ -103,19 +103,24 @@ for (var i = 0; i < perf_links.length; i++) { var obj = document.getElementById(perf_links[i][0]); obj.addEventListener("click", function(event) { - var ci_video = document.getElementById("ci_video"); + var ci_video = document.getElementById("ci"); var top = ci_video.offsetTop - 5; + var seek; - event.preventDefault(); - ci_video.play(); - ci_video.pause(); for (var i = 0; i < perf_links.length; i++) { if (this.id == perf_links[i][0]) { - ci_video.currentTime = perf_links[i][1] - 10; + seek = perf_links[i][1]; } } + + event.preventDefault(); + ci_video_player.dispose(); + ci_video_player = AsciinemaPlayer.create( + "/builds/latest/web/ci.cast", + ci_video, + { startAt: seek, autoplay: true }); + window.scrollTo({ top: top, behavior: "smooth" }) - ci_video.play(); }, false); } ' diff --git a/test/lib/term b/test/lib/term index e8a1d38..205a6a9 100755 --- a/test/lib/term +++ b/test/lib/term @@ -539,33 +539,22 @@ pause_continue() { info_nolog "" } -# run_term() - Start tmux session, X terminal if requested, running entry point +# run_term() - Start tmux session, running entry point, with recording if needed run_term() { export SHELL="/bin/sh" tmux set-option -g default-shell "/bin/sh" tmux set-option -g update-environment "PCAP DEBUG" if [ ${CI} -eq 1 ]; then - __xterm_done="$(mktemp)" - if [ ${XVFB} -eq 1 ]; then - xvfb-run -s "-screen 0 4000x4000x24 -ac" ${CI_XTERM} "$(pwd)" -e "sh -c \"printf '\e[8;50;240t'; tmux new-session -s passt_test ./ci from_term; echo >${__xterm_done}\"" - else - ${CI_XTERM} "$(pwd)" -e "sh -c \"printf '\e[8;50;240t'; tmux new-session -s passt_test ./ci from_term; echo >${__xterm_done}\"" - fi - while ! [ -s "${__xterm_done}" ]; do sleep 1; done - rm "${__xterm_done}" + printf '\e[8;50;240t' + asciinema rec --overwrite ci.uncut -c 'tmux new-session -s passt_test ./ci from_term' + video_postprocess ci.uncut elif [ ${DEMO} -eq 1 ]; then - while true; do - if [ ${XVFB} -eq 1 ]; then - xvfb-run -s "-screen 0 4000x4000x24 -ac" ${DEMO_XTERM} "$(pwd)" -e sh -c 'tmux new-session -s passt_test ./run_demo from_term' - else - ${DEMO_XTERM} "$(pwd)" -e sh -c 'tmux new-session -s passt_test ./run_demo from_term' - fi - [ $? -ne 0 ] && { tmux kill-session -t passt_test; continue; } - break - done + printf '\e[8;40;130t' + asciinema rec --overwrite demo.uncut -c 'tmux new-session -s passt_test ./run_demo from_term' + video_postprocess demo.uncut else - tmux new-session -s passt_test ./run from_term + tmux new-session -s passt_test ./run_demo from_term fi } diff --git a/test/lib/video b/test/lib/video index 6db9c1d..ec79c85 100755 --- a/test/lib/video +++ b/test/lib/video @@ -8,9 +8,9 @@ # PASTA - Pack A Subtle Tap Abstraction # for network namespace/tap device mode # -# test/lib/video - Video grabbing, JavaScript fragments with links +# test/lib/video - Session recording, JavaScript fragments with links # -# Copyright (c) 2021 Red Hat GmbH +# Copyright (c) 2021-2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> FFMPEG_PID_FILE="$(mktemp)" @@ -33,19 +33,24 @@ for (var i = 0; i < video___VIDEO_NAME__links.length; i++) { var obj = document.getElementById(video___VIDEO_NAME__links[i][0]); obj.addEventListener("click", function(event) { - var __VIDEO_NAME___video = document.getElementById("__VIDEO_NAME___video"); - var top = __VIDEO_NAME___video.offsetTop - 5; + var __VIDEO_NAME___div = document.getElementById("__VIDEO_NAME__"); + var top = __VIDEO_NAME___div.offsetTop - 5; + var seek; - event.preventDefault(); - __VIDEO_NAME___video.play(); - __VIDEO_NAME___video.pause(); for (var i = 0; i < video___VIDEO_NAME__links.length; i++) { if (this.id == video___VIDEO_NAME__links[i][0]) { - __VIDEO_NAME___video.currentTime = video___VIDEO_NAME__links[i][1]; + seek = video___VIDEO_NAME__links[i][1]; } } + + event.preventDefault(); + __VIDEO_NAME___player.dispose(); + __VIDEO_NAME___player = AsciinemaPlayer.create( + "/builds/latest/web/__VIDEO_NAME__.cast", + __VIDEO_NAME___div, + { startAt: seek, autoplay: true }); + window.scrollTo({ top: top, behavior: "smooth" }) - __VIDEO_NAME___video.play(); }, false); } ' @@ -65,53 +70,71 @@ video_append_links_js() VIDEO_LINKS_BUF="${VIDEO_LINKS_BUF}${@}" } -# video_grab() - Fetch window geometry, start grabbing video -video_grab() { +# video_start() - Mark start of a test in capture, record start timestamp +video_start() { VIDEO_NAME="${1}" - rm -f "${BASEPATH}/${VIDEO_NAME}.mp4" "${BASEPATH}/${VIDEO_NAME}.webm" "${BASEPATH}/${VIDEO_NAME}.js" - echo "${VIDEO_LINKS_TEMPLATE}" > "${BASEPATH}/${VIDEO_NAME}.js" - - if [ ${XVFB} -eq 1 ]; then - # Grab the geometry of the first window that's at least 100px wide - eval $(xwininfo -d :99.0 -root -tree | sed -n 's/^[ ]*0x[0-f]*[^0-9]*$[0-9]\{3,\}$x$[0-9]*$+$[0-9]*$+$[0-9]*$.*/__width=\1; __height=\2; __x=\3; __y=\4;/p') - else - __x=$(xwininfo -id $(xdotool getactivewindow) | sed -n 's/[ ]*Absolute upper-left X:[ ]*$[0-9]*$$/\1/p') - __y=$(xwininfo -id $(xdotool getactivewindow) | sed -n 's/[ ]*Absolute upper-left Y:[ ]*$[0-9]*$$/\1/p') - __width=$(xwininfo -id $(xdotool getactivewindow) | sed -n 's/[ ]*Width:[ ]*$[0-9]*$$/\1/p') - __height=$(xwininfo -id $(xdotool getactivewindow) | sed -n 's/[ ]*Height:[ ]*$[0-9]*$$/\1/p') - fi - - [ $((__width % 2)) ] && __width=$((__width - 1)) - [ $((__height % 2)) ] && __height=$((__height - 1)) - - sleep 3 VIDEO_START_SECONDS=$(sed -n 's/$[0-9]*$.[0-9]* [0-9]*.[0-9]*/\1/p' /proc/uptime) - [ ${XVFB} -eq 1 ] && __disp=":99.0" || __disp= - ffmpeg -f x11grab -framerate 15 -video_size "${__width}x${__height}" -i "${__disp}+${__x},${__y}" -vcodec libx264 -qp 0 -draw_mouse 0 "${BASEPATH}/${VIDEO_NAME}.mp4" & echo $! > "${FFMPEG_PID_FILE}" -} -# video_time_now() - Print current video timestamp, in seconds -video_time_now() { - __now=$(sed -n 's/$[0-9]*$.[0-9]* [0-9]*.[0-9]*/\1/p' /proc/uptime) - echo $((__now - VIDEO_START_SECONDS)) + sync + [ ${DEMO} -eq 1 ] && tail -1 "${BASEPATH}/demo.uncut" > "${BASEPATH}/${VIDEO_NAME}.start" + [ ${CI} -eq 1 ] && tail -1 "${BASEPATH}/ci.uncut" > "${BASEPATH}/${VIDEO_NAME}.start" + sync + + tmux refresh-client } -# video_stop() - Stop grabbing, finalise JavaScript templates, convert to webm +# video_stop() - Mark stop of a test in capture, finalise JavaScript fragments video_stop() { + tmux refresh-client + + sync + [ ${DEMO} -eq 1 ] && tail -1 "${BASEPATH}/demo.uncut" > "${BASEPATH}/${VIDEO_NAME}.stop" + [ ${CI} -eq 1 ] && tail -1 "${BASEPATH}/ci.uncut" > "${BASEPATH}/${VIDEO_NAME}.stop" + sync + sed -i 's/^.*$/&\\/g' "${BASEPATH}/${VIDEO_NAME}.js" echo "${VIDEO_LINKS_TEMPLATE_JS}" | sed "s/__VIDEO_NAME__/${VIDEO_NAME}/g" >> "${BASEPATH}/${VIDEO_NAME}.js" echo "${VIDEO_LINKS_BUF}" >> "${BASEPATH}/${VIDEO_NAME}.js" echo "${VIDEO_LINKS_TEMPLATE_POST}" | sed "s/__VIDEO_NAME__/${VIDEO_NAME}/g" >> "${BASEPATH}/${VIDEO_NAME}.js" +} - kill -INT $(cat "${FFMPEG_PID_FILE}") - while ps -p $(cat "${FFMPEG_PID_FILE}") >/dev/null; do sleep 1; done - rm "${FFMPEG_PID_FILE}" - - [ ${1} -ne 0 ] && return +# video_postprocess() - Cut terminal recordings based on .start and .stop files +video_postprocess() { + IFS=' +' + __cast_name= + for __l in $(cat ${1}); do + [ -z "${__header}" ] && __header="${__l}" && continue + + if [ -z "${__cast_name}" ]; then + for __cast_cut in *.start; do + [ "${__l}" != "$(cat "${__cast_cut}")" ] && continue + __cast_name="${__cast_cut%.start}" + __cast_offset= + __stop_line="$(cat ${__cast_name}.stop)" + echo "${__header}" > "${__cast_name}.cast" + break + done + continue + fi + + [ "${__l}" = "${__stop_line}" ] && __cast_name= && continue + + __l_offset="$(echo ${__l%%.*}|tr -c -d '[:digit:]')" + __l_rest="${__l#*.}" + [ -z "${__cast_offset}" ] && __cast_offset=${__l_offset} + __l_offset=$((__l_offset - __cast_offset)) + printf '[%s.%s\n' "${__l_offset}" "${__l_rest}" >> "${__cast_name}".cast + done + unset IFS +} - ffmpeg -an -fflags +genpts -i "${BASEPATH}/${VIDEO_NAME}.mp4" -c:v libvpx-vp9 -row-mt 1 -minrate 10k -maxrate 200k -b:v 200k "${BASEPATH}/${VIDEO_NAME}.webm" +# video_time_now() - Print current video timestamp, in seconds +video_time_now() { + __now=$(sed -n 's/$[0-9]*$.[0-9]* [0-9]*.[0-9]*/\1/p' /proc/uptime) + echo $((__now - VIDEO_START_SECONDS)) } # video_link() - Append single link to given video chapter diff --git a/test/run b/test/run index c91122d..385267e 100755 --- a/test/run +++ b/test/run @@ -60,7 +60,7 @@ run() { term perf_init - [ ${CI} -eq 1 ] && video_grab ci + [ ${CI} -eq 1 ] && video_start ci setup build test build @@ -94,7 +94,7 @@ run() { teardown two_guests perf_finish - [ ${CI} -eq 1 ] && video_stop ${STATUS_FAIL} + [ ${CI} -eq 1 ] && video_stop log "PASS: ${STATUS_PASS}, FAIL: ${STATUS_FAIL}" @@ -117,24 +117,24 @@ demo() { term_demo layout_demo_passt - video_grab demo_passt + video_start demo_passt MODE=passt test demo - video_stop 0 + video_stop teardown demo_passt layout_demo_pasta - video_grab demo_pasta + video_start demo_pasta MODE=pasta test demo - video_stop 0 + video_stop teardown demo_pasta layout_demo_podman - video_grab demo_podman + video_start demo_podman MODE=podman test demo - video_stop 0 + video_stop teardown_demo_podman return 0 -- 2.34.1

1 0

[PATCH 00/18] slirp4netns, sandboxing, Podman integration, assorted fixes
by Stefano Brivio 22 Feb '22

22 Feb '22

This series: - completes slirp4netns(1) compatibility of slirp4netns.sh and introduces equivalent features in pasta (patches 1/18, 2/18, 6/18, 9/18) - enables namespace-based sandboxing that's _at least_ equivalent to the one implemented by slirp4netns (patches 3/18 and 4/18) - carries a number of fixes for minor ssues I found while doing this (patches 5/18, 7/18, 8/18, 10/18, 11/18) - introduce a self-quit mechanism for pasta for easier integration with container runtimes (patch 12/18) - fixes a few items in documentation and tests (patches 13/18 to 16/18) - adds Podman integration as out-of-tree patch (patch 17/18) - adds a demo for Podman operation with pasta and side-by-side comparison with slirp4netns (patch 18/18). I already ran a demo recording for the Podman demo: https://passt.top/builds/latest/web/demo_podman.webm Stefano Brivio (18): slirp4netns: Look up pasta command, exit if not found slirp4netns: Add EXIT as condition for trap passt, pasta: Namespace-based sandboxing, defer seccomp policy application passt: Make process not dumpable after sandboxing Makefile, conf, passt: Drop passt4netns references, explicit argc check slirp4netns.sh: Implement API socket option for port forwarding conf: Don't print configuration on --quiet conf: Given IPv4 address and no netmask, assign RFC 790-style classes conf, udp: Introduce basic DNS forwarding udp: Allow loopback connections from host using configured unicast address tcp, udp: Receive batching doesn't pay off when writing single frames to tap pasta: By default, quit if filesystem-bound net namespace goes away test/distro/ubuntu: Use DEBIAN_FRONTEND=noninteractive for apt on 22.04 test/perf/passt_udp: Drop threshold for 256B test man page: Update REPORTING BUGS section README, hooks: Build HTML man page on push, add a link contrib: Add patch for Podman integration test: Add demo for Podman with pasta Makefile | 10 +- README.md | 18 +- conf.c | 219 +++-- ...001-libpod-Add-pasta-networking-mode.patch | 542 +++++++++++ dhcp.c | 5 +- dhcpv6.c | 7 + hooks/pre-push | 3 + ndp.c | 6 +- passt.1 | 92 +- passt.c | 140 ++- passt.h | 28 +- pasta.c | 217 ++--- pasta.h | 2 + pcap.c | 5 +- pcap.h | 2 +- slirp4netns.sh | 198 +++- tap.c | 58 +- tcp.c | 49 +- test/demo/passt | 3 +- test/demo/pasta | 5 +- test/demo/podman | 843 ++++++++++++++++++ test/distro/ubuntu | 1 + test/lib/layout | 38 +- test/lib/setup | 49 +- test/lib/term | 10 + test/lib/test | 35 + test/perf/passt_udp | 4 +- test/run | 8 + udp.c | 76 +- util.c | 129 ++- util.h | 12 +- 31 files changed, 2430 insertions(+), 384 deletions(-) create mode 100644 contrib/podman/0001-libpod-Add-pasta-networking-mode.patch create mode 100644 test/demo/podman -- 2.34.1

1 19

[PATCH] test/perf/passt_tcp: Drop iperf3 window size for host-to-guest tests
by Stefano Brivio 01 Feb '22

01 Feb '22

With a recent 5.15 kernel, passing a huge window size to iperf3 with lower MTUs makes iperf3 stop sending packets after a few seconds -- I haven't investigated this in detail, but the window size will be adjusted dynamically anyway and not passing it doesn't actually affect throughput, so simply drop the option. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/perf/passt_tcp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/test/perf/passt_tcp b/test/perf/passt_tcp index 0db12ea..99d8fb1 100644 --- a/test/perf/passt_tcp +++ b/test/perf/passt_tcp @@ -141,19 +141,19 @@ tr TCP throughput over IPv6: host to guest bw - bw - ns ip link set dev lo mtu 1280 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 1.0 1.2 ns ip link set dev lo mtu 1500 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 9000 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 8M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 5.0 6.0 ns ip link set dev lo mtu 65520 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 16M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 6.0 6.8 ns ip link set dev lo mtu 65535 @@ -181,28 +181,28 @@ lat __LAT__ 500 350 tr TCP throughput over IPv4: host to guest ns ip link set dev lo mtu 256 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 1M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 0.3 0.5 ns ip link set dev lo mtu 576 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 1M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 0.5 1.0 ns ip link set dev lo mtu 1280 ns ip addr add ::1 dev lo -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 1500 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 9000 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 8M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 5.0 6.0 ns ip link set dev lo mtu 65520 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 16M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 6.0 6.8 ns ip link set dev lo mtu 65535 -- 2.34.1

1 0

[PATCH] util: Avoid return of possibly truncated unsigned long in bitmap_isset()
by Stefano Brivio 01 Feb '22

01 Feb '22

Oops. If *word & BITMAP_BIT(bit) is bigger than an int (which is the case for half of the possible bits of a bitmap on 64-bit archs), we'll return that as an int, that is, zero, even if the bit at hand is set. Just return zero or one there, no callers are interested in the actual bitmap as return value. Issue found as pasta wouldn't automatically detect some bound ports. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.c b/util.c index 57b987a..94d49a6 100644 --- a/util.c +++ b/util.c @@ -366,13 +366,13 @@ void bitmap_clear(uint8_t *map, int bit) * @map: Pointer to bitmap * @bit: Bit number to check * - * Return: non-zero if given bit is set, zero if it's not + * Return: one if given bit is set, zero if it's not */ int bitmap_isset(const uint8_t *map, int bit) { unsigned long *word = (unsigned long *)map + BITMAP_WORD(bit); - return *word & BITMAP_BIT(bit); + return !!(*word & BITMAP_BIT(bit)); } /** -- 2.34.1

1 0

pending series merged and pushed
by Stefano Brivio 01 Feb '22

01 Feb '22

Hi, I just merged and pushed these series: [PATCH 00/22] Fixes for non-x86_64, older kernels/glibc, and some more [PATCH 0/4] Tests for multiple architectures and distributions [PATCH 0/4] Proof-of-concept for Kata Containers integration [PATCH] passt: Address new clang-tidy warnings from LLVM 13.0.1 [PATCH] test/distro: Avoid race between display of ns_msg and netcat exiting [PATCH] test/distro/ubuntu: Skip apt-get update for 16.04 on powerpc Enjoy, and let me know if something broke. Thanks, -- Stefano

1 0

[PATCH] test/distro/ubuntu: Skip apt-get update for 16.04 on powerpc
by Stefano Brivio 31 Jan '22

31 Jan '22

Some recent change to xenial-updates broke dependencies for gcc, it can't be installed anymore. Skipping apt-get update leaves gcc dependencies in a consistent state, though. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/distro/ubuntu | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/distro/ubuntu b/test/distro/ubuntu index 6013122..b67c1f3 100644 --- a/test/distro/ubuntu +++ b/test/distro/ubuntu @@ -154,7 +154,9 @@ host guestfish --rw -a __IMG__ -i copy-in __GUEST_FILES__ /root/ host ./qrap 5 qemu-system-ppc64 -m 1024 -M pseries -nographic -nodefaults -serial stdio -no-reboot -nographic -vga none -hda __IMG__ -net socket,fd=5 -net nic,model=virtio host PS1='$ ' host dhclient -host apt-get update +# Skip apt-get update here: some updates to xenial-updates around 2022-01-30 +# broke dependencies for libc6 and gcc-5 -- note that powerpc is not officially +# supported on this version host apt-get -y install make gcc netcat-openbsd host make clean -- 2.34.1

1 0