- dev - passt

[PATCH v2] pasta: propagate exit code from child command
by Paul Holzinger 13 Feb '23

13 Feb '23

Exits codes are very useful for scripts, when the pasta child execvp() call fails with ENOENT that parent should also exit with > 0. In short the parent should always exit with the code from the child to make it useful in scripts. It is easy to test with: `pasta -- bash -c "exit 3"; echo $?` Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- Changes from v1: - Fixed comments from Stefano. pasta.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/pasta.c b/pasta.c index 3f6477c..fe21c5b 100644 --- a/pasta.c +++ b/pasta.c @@ -64,9 +64,17 @@ void pasta_child_handler(int signal) if (pasta_child_pid && !waitid(P_PID, pasta_child_pid, &infop, WEXITED | WNOHANG)) { - if (infop.si_pid == pasta_child_pid) - exit(EXIT_SUCCESS); + if (infop.si_pid == pasta_child_pid) { + if (infop.si_code == CLD_EXITED) + exit(infop.si_status); + + /* If killed by a signal, si_status is the number. + * Follow common shell convention of returning it + 128. + */ + exit(infop.si_status + 128); + /* Nothing to do, detached PID namespace going away */ + } } waitid(P_ALL, 0, NULL, WEXITED | WNOHANG); -- 2.39.1

3 2

[PATCH] pasta: Wait for tap to be set up before spawning command
by Stefano Brivio 13 Feb '23

13 Feb '23

Adapted from a patch by Paul Holzinger: when pasta spawns a command, operating without a pre-existing user and network namespace, it needs to wait for the tap device to be configured and its handler ready, before the command is actually executed. Otherwise, something like: pasta --config-net nslookup passt.top usually fails as the nslookup command is issued before the network interface is ready. We can't adopt a simpler approach based on SIGSTOP and SIGCONT here: the child runs in a separate PID namespace, so it can't send SIGSTOP to itself as the kernel sees the child as init process and blocks the delivery of the signal. We could send SIGSTOP from the parent, but this wouldn't avoid the possible condition where the child isn't ready to wait for it when the parent sends it, also raised by Paul -- and SIGSTOP can't be blocked, so it can never be pending. Use SIGUSR1 instead: mask it before clone(), so that the child starts with it blocked, and can safely wait for it. Once the parent is ready, it sends SIGUSR1 to the child. If SIGUSR1 is sent before the child is waiting for it, the kernel will queue it for us, because it's blocked. Reported-by: Paul Holzinger <pholzing(a)redhat.com> Fixes: 1392bc5ca002 ("Allow pasta to take a command to execute") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I just applied this, to keep things simpler for myself and for tests, given that Paul already had a look. I'm posting it anyway for reviews. passt.c | 3 +++ pasta.c | 14 +++++++++++++- pasta.h | 2 ++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/passt.c b/passt.c index 8b2c50d..d957e14 100644 --- a/passt.c +++ b/passt.c @@ -301,6 +301,9 @@ int main(int argc, char **argv) else write_pidfile(pidfile_fd, getpid()); + if (pasta_child_pid) + kill(pasta_child_pid, SIGUSR1); + isolate_postfork(&c); timer_init(&c, &now); diff --git a/pasta.c b/pasta.c index 528f02a..9169913 100644 --- a/pasta.c +++ b/pasta.c @@ -47,7 +47,7 @@ #include "log.h" /* PID of child, in case we created a namespace */ -static int pasta_child_pid; +int pasta_child_pid; /** * pasta_child_handler() - Exit once shell exits (if we started it), reap clones @@ -166,10 +166,16 @@ struct pasta_spawn_cmd_arg { static int pasta_spawn_cmd(void *arg) { const struct pasta_spawn_cmd_arg *a; + sigset_t set; if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail"); + /* Wait for the parent to be ready: see main() */ + sigemptyset(&set); + sigaddset(&set, SIGUSR1); + sigwaitinfo(&set, NULL); + a = (const struct pasta_spawn_cmd_arg *)arg; execvp(a->exe, a->argv); @@ -196,6 +202,7 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, char ns_fn_stack[NS_FN_STACK_SIZE]; char *sh_argv[] = { NULL, NULL }; char sh_arg0[PATH_MAX + 1]; + sigset_t set; c->foreground = 1; if (!c->debug) @@ -226,6 +233,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, arg.argv = sh_argv; } + /* Block SIGUSR1 in child, we queue it in main() when we're ready */ + sigemptyset(&set); + sigaddset(&set, SIGUSR1); + sigprocmask(SIG_BLOCK, &set, NULL); + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, sizeof(ns_fn_stack), CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | diff --git a/pasta.h b/pasta.h index a8b9893..0ccb7e9 100644 --- a/pasta.h +++ b/pasta.h @@ -6,6 +6,8 @@ #ifndef PASTA_H #define PASTA_H +extern int pasta_child_pid; + void pasta_open_ns(struct ctx *c, const char *netns); void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, int argc, char *argv[]); -- 2.35.1

2 1

[PATCH] test/pasta_options: Ignore failures on shell 'exit'
by Stefano Brivio 13 Feb '23

13 Feb '23

On shell 'exit' commands, running shells from pasta, we might get: Cannot set tty process group (No such process) as some TTY devices might be unaccessible. This is harmless, but after commit "pasta: propagate exit code from child command", we'll get test failures there, at least with dash. Ignore those explicitly with a ugly workaround: we can't simply do something like: exit || : because the failure is reported by the shell itself once it exits, regardless of the command evaluation. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This is already applied, I needed to unblock tests. Posting anyway for reviews. test/pasta_options/log_to_file | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/test/pasta_options/log_to_file b/test/pasta_options/log_to_file index 587bf8e..29fb2c8 100644 --- a/test/pasta_options/log_to_file +++ b/test/pasta_options/log_to_file @@ -34,12 +34,14 @@ set PORTS -t 10001,10002 -u 10001,10002 set LOG_FILE __STATEDIR__/pasta.log passt ./pasta -l __LOG_FILE__ -passt exit +passtb exit +sleep 1 check [ -s __LOG_FILE__ ] test Log truncated on creation passt ./pasta -l __LOG_FILE__ -passt exit +passtb exit +sleep 1 check [ $(cat __LOG_FILE__ | wc -l) -eq 1 ] test Maximum log size @@ -85,6 +87,7 @@ check_log_size_mountns test Timestamp consistency after rotations (no FALLOC_FL_COLLAPSE_RANGE) check tail -n +2 __LOG_FILE__ | cut -f1 -d' ' | tr -d [.:] | sort -c -passt exit +passtb exit +sleep 1 passt umount __STATEDIR__/t passt exit -- 2.35.1

2 1

[PATCH 1/2] pasta: correctly exit when execvp() fails
by Paul Holzinger 13 Feb '23

13 Feb '23

By default clone() will create a child that does not send SIGCHLD when the child exits. The caller has to specifiy the SIGNAL it should get in the flag bitmask. see clone(2) under "The child termination signal" This fixes the problem where pasta would not exit when the execvp() call failed, i.e. when the command does not exists. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- pasta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pasta.c b/pasta.c index 528f02a..3f6477c 100644 --- a/pasta.c +++ b/pasta.c @@ -229,7 +229,7 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, sizeof(ns_fn_stack), CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS, + CLONE_NEWUTS | SIGCHLD, (void *)&arg); if (pasta_child_pid == -1) { -- 2.39.1

2 5

[PATCH] pasta: do not leak netlink sock into child
by Paul Holzinger 13 Feb '23

13 Feb '23

When spawning a child command with pasta command... pasta should not leak fds that it opened. Only the fds that were already open should be given to the child. Run `pasta --config-net -- ls -l /proc/self/fd` from a terminal where only stdin/out/err are open. The fd 3 was opend by ls to read the /proc/self/fd dir. But fd 5 is the netlink socket that was opend in pasta. To prevent such a leak we will open the socket with SOCK_CLOEXEC. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/netlink.c b/netlink.c index 0850cbe..b8fa2a0 100644 --- a/netlink.c +++ b/netlink.c @@ -56,8 +56,8 @@ static int nl_sock_init_do(void *arg) if (arg) ns_enter((struct ctx *)arg); - if (((*s) = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE)) < 0 || - bind(*s, (struct sockaddr *)&addr, sizeof(addr))) { + *s = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE); + if (*s < 0 || bind(*s, (struct sockaddr *)&addr, sizeof(addr))) { *s = -1; return 0; } -- 2.39.1

2 2

[PATCH] Make assertions actually useful
by David Gibson 13 Feb '23

13 Feb '23

There are some places in passt/pasta which #include <assert.h> and make various assertions. If we hit these something has already gone wrong, but they're there so that we a useful message instead of cryptic misbehaviour if assumptions we thought were correct turn out not to be. Except.. the glibc implementation of assert() uses syscalls that aren't in our seccomp filter, so we'll get a SIGSYS before it actually prints the message. Work around this by adding our own ASSERT() implementation using our existing err() function to log the message, and an abort(). The abort() probably also won't work exactly right with seccomp, but once we've printed the message, dying with a SIGSYS works just as well as dying with a SIGABRT. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- inany.h | 6 ++---- lineread.c | 10 +++++----- tcp.c | 9 ++++----- tcp_splice.c | 3 +-- udp.c | 3 +-- util.c | 1 - util.h | 20 +++++++++++++++++++- 7 files changed, 32 insertions(+), 20 deletions(-) diff --git a/inany.h b/inany.h index 52d43f2..7ff32f0 100644 --- a/inany.h +++ b/inany.h @@ -6,8 +6,6 @@ * IPv6 or IPv4 (encoded as IPv4-mapped IPv6 addresses) */ -#include <assert.h> - /** union inany_addr - Represents either an IPv4 or IPv6 address * @a6: Address as an IPv6 address, may be IPv4-mapped * @v4mapped.zero: All zero-bits for an IPv4 address @@ -63,7 +61,7 @@ static inline void inany_from_af(union inany_addr *aa, int af, const void *addr) aa->v4mapped.a4 = *((struct in_addr *)addr); } else { /* Not valid to call with other address families */ - assert(0); + ASSERT(0); } } @@ -89,6 +87,6 @@ static inline void inany_from_sockaddr(union inany_addr *aa, in_port_t *port, *port = ntohs(sa4->sin_port); } else { /* Not valid to call with other address families */ - assert(0); + ASSERT(0); } } diff --git a/lineread.c b/lineread.c index 59021e6..6ffb14e 100644 --- a/lineread.c +++ b/lineread.c @@ -16,10 +16,10 @@ #include <fcntl.h> #include <string.h> #include <stdbool.h> -#include <assert.h> #include <unistd.h> #include "lineread.h" +#include "util.h" /** * lineread_init() - Prepare for line by line file reading without allocation @@ -44,10 +44,10 @@ static int peek_line(struct lineread *lr, bool eof) char *nl; /* Sanity checks (which also document invariants) */ - assert(lr->count >= 0); - assert(lr->next_line >= 0); - assert(lr->next_line + lr->count >= lr->next_line); - assert(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); + ASSERT(lr->count >= 0); + ASSERT(lr->next_line >= 0); + ASSERT(lr->next_line + lr->count >= lr->next_line); + ASSERT(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); nl = memchr(lr->buf + lr->next_line, '\n', lr->count); diff --git a/tcp.c b/tcp.c index 4744ac5..475c23f 100644 --- a/tcp.c +++ b/tcp.c @@ -288,7 +288,6 @@ #include <sys/uio.h> #include <unistd.h> #include <time.h> -#include <assert.h> #include <linux/tcp.h> /* For struct tcp_info */ @@ -602,7 +601,7 @@ static inline struct tcp_tap_conn *conn_at_idx(int index) { if ((index < 0) || (index >= TCP_MAX_CONNS)) return NULL; - assert(!(CONN(index)->c.spliced)); + ASSERT(!(CONN(index)->c.spliced)); return CONN(index); } @@ -2809,7 +2808,7 @@ static void tcp_conn_from_sock(struct ctx *c, union epoll_ref ref, socklen_t sl; int s; - assert(ref.r.p.tcp.tcp.listen); + ASSERT(ref.r.p.tcp.tcp.listen); if (c->tcp.conn_count >= TCP_MAX_CONNS) return; @@ -3051,7 +3050,7 @@ static void tcp_ns_sock_init4(const struct ctx *c, in_port_t port) struct in_addr loopback = { htonl(INADDR_LOOPBACK) }; int s; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); s = sock_l4(c, AF_INET, IPPROTO_TCP, &loopback, NULL, port, tref.u32); if (s >= 0) @@ -3075,7 +3074,7 @@ static void tcp_ns_sock_init6(const struct ctx *c, in_port_t port) .tcp.index = idx }; int s; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); s = sock_l4(c, AF_INET6, IPPROTO_TCP, &in6addr_loopback, NULL, port, tref.u32); diff --git a/tcp_splice.c b/tcp_splice.c index 72b1672..1d624f1 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -46,7 +46,6 @@ #include <sys/epoll.h> #include <sys/types.h> #include <sys/socket.h> -#include <assert.h> #include "util.h" #include "passt.h" @@ -519,7 +518,7 @@ bool tcp_splice_conn_from_sock(struct ctx *c, union epoll_ref ref, union inany_addr aany; in_port_t port; - assert(c->mode == MODE_PASTA); + ASSERT(c->mode == MODE_PASTA); inany_from_sockaddr(&aany, &port, sa); a4 = inany_v4(&aany); diff --git a/udp.c b/udp.c index dbfdb61..9c63a8c 100644 --- a/udp.c +++ b/udp.c @@ -108,7 +108,6 @@ #include <sys/uio.h> #include <unistd.h> #include <time.h> -#include <assert.h> #include "checksum.h" #include "util.h" @@ -255,7 +254,7 @@ static void udp_invert_portmap(struct udp_port_fwd *fwd) { int i; - assert(ARRAY_SIZE(fwd->f.delta) == ARRAY_SIZE(fwd->rdelta)); + ASSERT(ARRAY_SIZE(fwd->f.delta) == ARRAY_SIZE(fwd->rdelta)); for (i = 0; i < ARRAY_SIZE(fwd->f.delta); i++) { in_port_t delta = fwd->f.delta[i]; diff --git a/util.c b/util.c index d9858f2..c5ee1c0 100644 --- a/util.c +++ b/util.c @@ -23,7 +23,6 @@ #include <time.h> #include <errno.h> #include <stdbool.h> -#include <assert.h> #include "util.h" #include "passt.h" diff --git a/util.h b/util.h index 3baec91..a367f96 100644 --- a/util.h +++ b/util.h @@ -6,6 +6,11 @@ #ifndef UTIL_H #define UTIL_H +#include <stdlib.h> +#include <stdarg.h> + +#include "log.h" + #define VERSION_BLOB \ VERSION "\n" \ "Copyright Red Hat\n" \ @@ -47,6 +52,18 @@ #define STRINGIFY(x) #x #define STR(x) STRINGIFY(x) +#define ASSERT(expr) \ + do { \ + if (!(expr)) { \ + err("ASSERTION FAILED in %s (%s:%d): %s", \ + __func__, __FILE__, __LINE__, STRINGIFY(expr)); \ + /* This may actually SIGSYS, due to seccomp, \ + * but that will still get the job done \ + */ \ + abort(); \ + } \ + } while (0) + #ifdef P_tmpdir #define TMPDIR P_tmpdir #else @@ -163,7 +180,8 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, #include <net/if.h> #include <limits.h> -#include <stdarg.h> +#include <stdint.h> +#include <netinet/ip6.h> #include "packet.h" -- 2.39.0

2 1

[PATCH v3 00/18] RFC: Unify and simplify tap send path
by David Gibson 13 Feb '23

13 Feb '23

Although we have an abstraction for the "slow path" (DHCP, NDP) guest bound packets, the TCP and UDP forwarding paths write directly to the tap fd. However, it turns out how they send frames to the tap device is more similar than it originally appears. This series unifies the low-level tap send functions for TCP and UDP, and makes some clean ups along the way. This is based on my earlier outstanding series. Changes since v2: * Rebase on the latest version of the UDP tap/splice socket unification * Rework pcap_frame() to return an error rather than printing itself, restoring less verbose behaviour for one error in a group of frames. * Assorted typo fixes in comments and commit messages Changes since v1: * Abstract tap header construction as well as frame send (a number of new patches) * Remove unneeded flags buf_bytes globals as well * Fix bug where we weren't correctly setting iov_len after the move to giving variable sized iovecs to send_frames(). David Gibson (18): pcap: Introduce pcap_frame() helper pcap: Replace pcapm() with pcap_multiple() tcp: Combine two parts of passt tap send path together tcp: Don't compute total bytes in a message until we need it tcp: Improve interface to tcp_l2_buf_flush() tcp: Combine two parts of pasta tap send path together tap, tcp: Move tap send path to tap.c util: Introduce hton*_constant() in place of #ifdefs tcp, udp: Use named field initializers in iov_init functions util: Parameterize ethernet header initializer macro tcp: Remove redundant and incorrect initialization from *_iov_init() tcp: Consolidate calculation of total frame size tap: Add "tap headers" abstraction tcp: Use abstracted tap header tap: Use different io vector bases depending on tap type udp: Use abstracted tap header tap: Improve handling of partial frame sends udp: Use tap_send_frames() dhcpv6.c | 50 +++-------- pcap.c | 86 ++++++------------- pcap.h | 3 +- tap.c | 121 ++++++++++++++++++++++++++ tap.h | 54 ++++++++++++ tcp.c | 254 +++++++++++++------------------------------------------ udp.c | 213 ++++++---------------------------------------- udp.h | 2 +- util.h | 47 ++-------- 9 files changed, 310 insertions(+), 520 deletions(-) -- 2.39.0

2 23

[PATCH] tcp: Reset ACK_FROM_TAP_DUE flag only as needed, update timer
by Stefano Brivio 13 Feb '23

13 Feb '23

David reports that TCP transfers might stall, especially with smaller socket buffer sizes, because we reset the ACK_FROM_TAP_DUE flag, in tcp_tap_handler(), whenever we receive an ACK segment, regardless of its sequence number and the fact that we might still be waiting for one. This way, we might fail to re-transmit frames on ACK timeouts. We need, instead, to: - indicate with the @retrans field only re-transmissions for the same data sequences. If we make progress, it should be reset, given that it's used to abort a connection when we exceed a given number of re-transmissions for the same data - unset the ACK_FROM_TAP_DUE flag if and only if the acknowledged sequence is the same as the last one we sent, as suggested by David - keep it set otherwise, if progress was done but not all the data we sent was acknowledged, and update the expiration of the ACK timeout Add a new helper for these purposes, tcp_update_seqack_from_tap(). To extend the ACK timeout, the new helper sets the ACK_FROM_TAP_DUE flag, even if it was already set, and conn_flag_do() triggers a timer update. This part should be revisited at a later time, because, strictly speaking, ACK_FROM_TAP_DUE isn't a flag anymore. One possibility might be to introduce another connection attribute for events affecting timer deadlines. Reported-by: David Gibson <david(a)gibson.dropbear.id.au> Link: https://bugs.passt.top/show_bug.cgi?id=41 Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Fixes: be5bbb9b0681 ("tcp: Rework timers to use timerfd instead of periodic bitmap scan") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This is already applied, I needed to unblock tests. Posting anyway for reviews. tcp.c | 52 ++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 38 insertions(+), 14 deletions(-) diff --git a/tcp.c b/tcp.c index 1e0a338..dfa8b6d 100644 --- a/tcp.c +++ b/tcp.c @@ -757,8 +757,18 @@ static void conn_flag_do(const struct ctx *c, struct tcp_tap_conn *conn, tcp_flag_str[fls(~flag)]); } } else { - if (conn->flags & flag) + if (conn->flags & flag) { + /* Special case: setting ACK_FROM_TAP_DUE on a + * connection where it's already set is used to + * re-schedule the existing timer. + * TODO: define clearer semantics for timer-related + * flags and factor this into the logic below. + */ + if (flag == ACK_FROM_TAP_DUE) + tcp_timer_ctl(c, conn); + return; + } conn->flags |= flag; if (fls(flag) >= 0) { @@ -1591,6 +1601,26 @@ out: conn->seq_ack_to_tap != prev_ack_to_tap; } +/** + * tcp_update_seqack_from_tap() - ACK number from tap and related flags/counters + * @c: Execution context + * @conn: Connection pointer + * @seq Current ACK sequence, host order + */ +static void tcp_update_seqack_from_tap(const struct ctx *c, + struct tcp_tap_conn *conn, uint32_t seq) +{ + if (SEQ_GT(seq, conn->seq_ack_from_tap)) { + if (seq == conn->seq_to_tap) + conn_flag(c, conn, ~ACK_FROM_TAP_DUE); + else + conn_flag(c, conn, ACK_FROM_TAP_DUE); + + conn->retrans = 0; + conn->seq_ack_from_tap = seq; + } +} + /** * tcp_send_flag() - Send segment with flags to tap (no payload) * @c: Execution context @@ -2041,7 +2071,6 @@ static int tcp_sock_consume(struct tcp_tap_conn *conn, uint32_t ack_seq) MSG_DONTWAIT | MSG_TRUNC) < 0) return -errno; - conn->seq_ack_from_tap = ack_seq; return 0; } @@ -2333,14 +2362,9 @@ static void tcp_data_from_tap(struct ctx *c, struct tcp_tap_conn *conn, tcp_clamp_window(c, conn, max_ack_seq_wnd); - if (ack) { - if (max_ack_seq == conn->seq_to_tap) { - conn_flag(c, conn, ~ACK_FROM_TAP_DUE); - conn->retrans = 0; - } - - tcp_sock_consume(conn, max_ack_seq); - } + /* On socket flush failure, pretend there was no ACK, try again later */ + if (ack && !tcp_sock_consume(conn, max_ack_seq)) + tcp_update_seqack_from_tap(c, conn, max_ack_seq); if (retr) { trace("TCP: fast re-transmit, ACK: %u, previous sequence: %u", @@ -2492,10 +2516,8 @@ int tcp_tap_handler(struct ctx *c, int af, const void *addr, return p->count; } - if (th->ack) { - conn_flag(c, conn, ~ACK_FROM_TAP_DUE); - conn->retrans = 0; - } + if (th->ack && !(conn->events & ESTABLISHED)) + tcp_update_seqack_from_tap(c, conn, ntohl(th->ack_seq)); conn_flag(c, conn, ~STALLED); @@ -2543,6 +2565,8 @@ int tcp_tap_handler(struct ctx *c, int af, const void *addr, /* Established connections not accepting data from tap */ if (conn->events & TAP_FIN_RCVD) { + tcp_update_seqack_from_tap(c, conn, ntohl(th->ack_seq)); + if (conn->events & SOCK_FIN_RCVD && conn->seq_ack_from_tap == conn->seq_to_tap) conn_event(c, conn, CLOSED); -- 2.35.1

1 0

[PATCH] pasta: wait for netns setup before calling exec
by Paul Holzinger 08 Feb '23

08 Feb '23

When a user spawns a command with pasta they expect the network to be ready. Currently this does not work because pasta will fork/exec before it will setup the network config. This patch fixes it by using a pipe to sync parent and child. The child will now block reading from this pipe before the exec call. The parent will then unblock the child only after the netns was configured. A command like `pasta --config-net -- ping -c1 1.1.1.1` can now actually work as expected. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- passt.c | 9 ++++++++- passt.h | 3 +++ pasta.c | 31 ++++++++++++++++++++++++++++--- 3 files changed, 39 insertions(+), 4 deletions(-) diff --git a/passt.c b/passt.c index 8b2c50d..4ef5797 100644 --- a/passt.c +++ b/passt.c @@ -187,7 +187,8 @@ int main(int argc, char **argv) isolate_initial(); - c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = -1; + c.pasta_netns_fd = c.pasta_command_ready_fd = + c.fd_tap = c.fd_tap_listen = -1; sigemptyset(&sa.sa_mask); sa.sa_flags = 0; @@ -296,6 +297,12 @@ int main(int argc, char **argv) exit(EXIT_FAILURE); } + /* start pasta child process now after the netns is setup */ + if (c.pasta_command_ready_fd > -1) { + /* close causes EOF for the read in the child so no need to write() */ + close(c.pasta_command_ready_fd); + } + if (!c.foreground) __daemon(pidfile_fd, devnull_fd); else diff --git a/passt.h b/passt.h index 3d7e567..a78cd81 100644 --- a/passt.h +++ b/passt.h @@ -154,6 +154,8 @@ struct ip6_ctx { * @pcap: Path for packet capture file * @pid_file: Path to PID file, empty string if not configured * @pasta_netns_fd: File descriptor for network namespace in pasta mode + * @pasta_command_ready_fd: File descriptor for the ready pipe to + * start child cmd, -1 if not used * @no_netns_quit: In pasta mode, don't exit if fs-bound namespace is gone * @netns_base: Base name for fs-bound namespace, if any, in pasta mode * @netns_dir: Directory of fs-bound namespace, if any, in pasta mode @@ -205,6 +207,7 @@ struct ctx { int one_off; int pasta_netns_fd; + int pasta_command_ready_fd; int no_netns_quit; char netns_base[PATH_MAX]; diff --git a/pasta.c b/pasta.c index 528f02a..56ac326 100644 --- a/pasta.c +++ b/pasta.c @@ -149,16 +149,19 @@ void pasta_open_ns(struct ctx *c, const char *netns) /** * struct pasta_spawn_cmd_arg - Argument for pasta_spawn_cmd() - * @exe: Executable to run - * @argv: Command and arguments to run + * @exe: Executable to run + * @argv: Command and arguments to run + * @ready_pipe: Ready pipe pair from parent. */ struct pasta_spawn_cmd_arg { const char *exe; char *const *argv; + int ready_pipe[2]; }; /** - * pasta_spawn_cmd() - Prepare new netns, start command or shell + * pasta_spawn_cmd() - Prepare new netns, spawn child, wait for parent, + * then exec command or shell * @arg: See @pasta_spawn_cmd_arg * * Return: this function never returns @@ -166,11 +169,24 @@ struct pasta_spawn_cmd_arg { static int pasta_spawn_cmd(void *arg) { const struct pasta_spawn_cmd_arg *a; + char buf[1]; if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail"); a = (const struct pasta_spawn_cmd_arg *)arg; + + /* close write side, we want read to return EOF when parent closes the fd */ + close(a->ready_pipe[1]); + + /* wait here for parent setup to finish before we exec */ + if (TEMP_FAILURE_RETRY(read(a->ready_pipe[0], buf, sizeof(buf))) < 0) { + err("Failed to read ready pipe from parent: %s", + strerror(errno)); + exit(EXIT_FAILURE); + } + close(a->ready_pipe[0]); + execvp(a->exe, a->argv); perror("execvp"); @@ -226,6 +242,13 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, arg.argv = sh_argv; } + if (pipe(arg.ready_pipe) < 0) { + err("Create ready pipe: %s", strerror(errno)); + exit(EXIT_FAILURE); + } + + c->pasta_command_ready_fd = arg.ready_pipe[1]; + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, sizeof(ns_fn_stack), CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | @@ -237,6 +260,8 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, exit(EXIT_FAILURE); } + close(arg.ready_pipe[0]); + NS_CALL(pasta_wait_for_ns, c); } -- 2.39.1

2 10

Race condition with pasta COMMAND...
by Paul Holzinger 31 Jan '23

31 Jan '23

Hi all, while debugging some things I used `./pasta --config-net -- nslookup google.com 1.1.1.1` to test dns. The problem is that does not work because the nslookup process will be executed before pasta is ready with the netns setup, i.e. compare `./pasta --config-net -- ip a`. So a workaround is to spawn a shell and sleep: `sh -c "sleep 1; nslookup google.com 1.1.1.1"` However this is ugly and does not ensure that the netns is ready after one second. As a user I would expect pasta to wait until the setup is finished before it calls exec(). I can send a patch if you agree and I find some time. --- Paul

2 3