- dev - passt

[PATCH] RFC: Remove unusable --netns-only option
by David Gibson 20 Jul '22

20 Jul '22

The intended semantics of --netns-only are pretty unclear to me. It's intended for pasta, but it's not clear whether its saying the spawned shell should only enter the target netns, or that the passt/pasta packet forwarding process should only sandbox itself in a network namespace, not a user namespace. In any case, as far as I can tell there's not actually any case in which the --netns-only option will work. If nothing else, we will always fail in sandbox(), because it attempts a number of operations which require CAP_SYS_ADMIN in our current user namespace. We drop all capabilities in our initial user namespace when we start, so the only way we can have CAP_SYS_ADMIN at this point is if we've joined a new user namespace, which we won't do with --netns-only. For pasta joining an existing namespace (the apparently intended use case), we'll actually fail before we'll fail before we get to that point: in conf_ns_check() we'll attempt to join the target network namespace. This also requires CAP_SYS_ADMIN in both our current user namespace and the user namespace which owns the target network namespace. Again, since we've dropped capabilities in our original namespace this will never be the case. For pasta creating its own network namespace we'll fail for a similar reason in yet another place. This time we'll fail in nl_sock_init() again because we attempt to enter the new network ns via NS_CALL without having regained CAP_SYS_ADMIN by joining a new user namespace. Because this happens after spawning the shell, it results in a weird failure mode, where the pasta spawned shell is running, but pasta isn't actually handling packets. Exiting the shell will lead to a hang until the process is explicitly killed. Since there's no way to invoke it, remove this feature. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 33 ++++++++++----------------------- passt.c | 10 ++++------ passt.h | 2 -- pasta.c | 28 ++++++++++------------------ util.c | 3 +-- 5 files changed, 25 insertions(+), 51 deletions(-) diff --git a/conf.c b/conf.c index cddc769..1dfbba1 100644 --- a/conf.c +++ b/conf.c @@ -498,7 +498,7 @@ static int conf_ns_check(void *arg) { struct ctx *c = (struct ctx *)arg; - if ((!c->netns_only && setns(c->pasta_userns_fd, CLONE_NEWUSER)) || + if (setns(c->pasta_userns_fd, CLONE_NEWUSER) || setns(c->pasta_netns_fd, CLONE_NEWNET)) c->pasta_userns_fd = c->pasta_netns_fd = -1; @@ -518,17 +518,12 @@ static int conf_ns_check(void *arg) static int conf_ns_opt(struct ctx *c, char *nsdir, const char *conf_userns, const char *optarg) { - int ufd = -1, nfd = -1, try, ret, netns_only_reset = c->netns_only; + int ufd = -1, nfd = -1, try, ret; char userns[PATH_MAX] = { 0 }, netns[PATH_MAX]; char *endptr; long pid_arg; pid_t pid; - if (c->netns_only && *conf_userns) { - err("Both --userns and --netns-only given"); - return -EINVAL; - } - /* It might be a PID, a netns path, or a netns name */ for (try = 0; try < 3; try++) { if (try == 0) { @@ -538,7 +533,7 @@ static int conf_ns_opt(struct ctx *c, pid = pid_arg; - if (!*conf_userns && !c->netns_only) { + if (!*conf_userns) { ret = snprintf(userns, PATH_MAX, "/proc/%i/ns/user", pid); if (ret <= 0 || ret > (int)sizeof(userns)) @@ -548,9 +543,6 @@ static int conf_ns_opt(struct ctx *c, if (ret <= 0 || ret > (int)sizeof(netns)) continue; } else if (try == 1) { - if (!*conf_userns) - c->netns_only = 1; - ret = snprintf(netns, PATH_MAX, "%s", optarg); if (ret <= 0 || ret > (int)sizeof(userns)) continue; @@ -562,19 +554,17 @@ static int conf_ns_opt(struct ctx *c, } /* Don't pass O_CLOEXEC here: ns_enter() needs those files */ - if (!c->netns_only) { - if (*conf_userns) - /* NOLINTNEXTLINE(android-cloexec-open) */ - ufd = open(conf_userns, O_RDONLY); - else if (*userns) - /* NOLINTNEXTLINE(android-cloexec-open) */ - ufd = open(userns, O_RDONLY); - } + if (*conf_userns) + /* NOLINTNEXTLINE(android-cloexec-open) */ + ufd = open(conf_userns, O_RDONLY); + else if (*userns) + /* NOLINTNEXTLINE(android-cloexec-open) */ + ufd = open(userns, O_RDONLY); /* NOLINTNEXTLINE(android-cloexec-open) */ nfd = open(netns, O_RDONLY); - if (nfd == -1 || (ufd == -1 && !c->netns_only)) { + if (nfd == -1 || ufd == -1) { if (nfd >= 0) close(nfd); @@ -604,8 +594,6 @@ static int conf_ns_opt(struct ctx *c, } } - c->netns_only = netns_only_reset; - return -ENOENT; } @@ -1046,7 +1034,6 @@ void conf(struct ctx *c, int argc, char **argv) {"tcp-ns", required_argument, NULL, 'T' }, {"udp-ns", required_argument, NULL, 'U' }, {"userns", required_argument, NULL, 2 }, - {"netns-only", no_argument, &c->netns_only, 1 }, {"nsrun-dir", required_argument, NULL, 3 }, {"config-net", no_argument, &c->pasta_conf_ns, 1 }, {"ns-mac-addr", required_argument, NULL, 4 }, diff --git a/passt.c b/passt.c index 58d9062..64edd39 100644 --- a/passt.c +++ b/passt.c @@ -199,12 +199,10 @@ static int sandbox(struct ctx *c) { int flags = CLONE_NEWIPC | CLONE_NEWNS | CLONE_NEWUTS; - if (!c->netns_only) { - if (c->pasta_userns_fd == -1) - flags |= CLONE_NEWUSER; - else - setns(c->pasta_userns_fd, CLONE_NEWUSER); - } + if (c->pasta_userns_fd == -1) + flags |= CLONE_NEWUSER; + else + setns(c->pasta_userns_fd, CLONE_NEWUSER); c->pasta_userns_fd = -1; diff --git a/passt.h b/passt.h index e541341..7f9d54b 100644 --- a/passt.h +++ b/passt.h @@ -110,7 +110,6 @@ enum passt_modes { * @gid: GID we should drop to, if started as root * @pasta_netns_fd: File descriptor for network namespace in pasta mode * @pasta_userns_fd: Descriptor for user namespace to join, -1 once joined - * @netns_only: In pasta mode, don't join or create a user namespace * @no_netns_quit: In pasta mode, don't exit if fs-bound namespace is gone * @netns_base: Base name for fs-bound namespace, if any, in pasta mode * @netns_dir: Directory of fs-bound namespace, if any, in pasta mode @@ -177,7 +176,6 @@ struct ctx { int pasta_netns_fd; int pasta_userns_fd; - int netns_only; int no_netns_quit; char netns_base[PATH_MAX]; diff --git a/pasta.c b/pasta.c index 5166082..dc35fef 100644 --- a/pasta.c +++ b/pasta.c @@ -82,16 +82,12 @@ static int pasta_wait_for_ns(void *arg) int flags = O_RDONLY | O_CLOEXEC; char ns[PATH_MAX]; - if (c->netns_only) - goto netns; - snprintf(ns, PATH_MAX, "/proc/%i/ns/user", pasta_child_pid); do while ((c->pasta_userns_fd = open(ns, flags)) < 0); while (setns(c->pasta_userns_fd, CLONE_NEWUSER) && !close(c->pasta_userns_fd)); -netns: snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid); do while ((c->pasta_netns_fd = open(ns, flags)) < 0); @@ -121,21 +117,18 @@ static int pasta_setup_ns(void *arg) { struct pasta_setup_ns_arg *a = (struct pasta_setup_ns_arg *)arg; char *shell; + char buf[BUFSIZ]; - if (!a->c->netns_only) { - char buf[BUFSIZ]; - - snprintf(buf, BUFSIZ, "%i %i %i", 0, a->euid, 1); + snprintf(buf, BUFSIZ, "%i %i %i", 0, a->euid, 1); - FWRITE("/proc/self/uid_map", buf, - "Cannot set uid_map in namespace"); + FWRITE("/proc/self/uid_map", buf, + "Cannot set uid_map in namespace"); - FWRITE("/proc/self/setgroups", "deny", - "Cannot write to setgroups in namespace"); + FWRITE("/proc/self/setgroups", "deny", + "Cannot write to setgroups in namespace"); - FWRITE("/proc/self/gid_map", buf, - "Cannot set gid_map in namespace"); - } + FWRITE("/proc/self/gid_map", buf, + "Cannot set gid_map in namespace"); FWRITE("/proc/sys/net/ipv4/ping_group_range", "0 0", "Cannot set ping_group_range, ICMP requests might fail"); @@ -165,9 +158,8 @@ void pasta_start_ns(struct ctx *c) pasta_child_pid = clone(pasta_setup_ns, ns_fn_stack + sizeof(ns_fn_stack) / 2, - (c->netns_only ? 0 : CLONE_NEWNET) | - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWUSER | - CLONE_NEWUTS, + CLONE_NEWNET | CLONE_NEWIPC | CLONE_NEWPID | + CLONE_NEWUSER | CLONE_NEWUTS, (void *)&arg); if (pasta_child_pid == -1) { diff --git a/util.c b/util.c index f45bc72..11cd3f4 100644 --- a/util.c +++ b/util.c @@ -524,8 +524,7 @@ void check_root(struct ctx *c) */ int ns_enter(const struct ctx *c) { - if (!c->netns_only && - c->pasta_userns_fd != -1 && + if (c->pasta_userns_fd != -1 && setns(c->pasta_userns_fd, CLONE_NEWUSER)) exit(EXIT_FAILURE); -- 2.36.1

2 3

[PATCH] passt: Allow exit_group() system call in seccomp profiles
by Stefano Brivio 14 Jul '22

14 Jul '22

We handle SIGQUIT and SIGTERM calling exit(), which is usually implemented with the exit_group() system call. If we don't allow exit_group(), we'll get a SIGSYS while handling SIGQUIT and SIGTERM, which means a misleading non-zero exit code. Reported-by: Wenli Quan <wquan(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2101990 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 2 +- README.md | 2 +- passt.c | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 0077fc9..6f7c971 100644 --- a/Makefile +++ b/Makefile @@ -115,7 +115,7 @@ qrap: $(QRAP_SRCS) passt.h valgrind: EXTRA_SYSCALLS="rt_sigprocmask rt_sigtimedwait rt_sigaction \ getpid gettid kill clock_gettime mmap munmap open \ - unlink exit_group gettimeofday" + unlink gettimeofday" valgrind: CFLAGS:=-g -O0 $(filter-out -O%,$(CFLAGS)) valgrind: all diff --git a/README.md b/README.md index 4fed6d5..628b9bb 100644 --- a/README.md +++ b/README.md @@ -286,7 +286,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (25 syscalls allowed for _passt_, 39 for +* ✅ restrictive seccomp profiles (26 syscalls allowed for _passt_, 40 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available diff --git a/passt.c b/passt.c index 56fcf5f..a8d94b4 100644 --- a/passt.c +++ b/passt.c @@ -257,6 +257,8 @@ static int sandbox(struct ctx *c) * * TODO: After unsharing the PID namespace and forking, SIG_DFL for SIGTERM and * SIGQUIT unexpectedly doesn't cause the process to terminate, figure out why. + * + * #syscalls exit_group */ void exit_handler(int signal) { -- 2.35.1

2 1

[PATCH] arch, passt: Use executable link to form AVX2 binary path
by Stefano Brivio 14 Jul '22

14 Jul '22

...instead of argv[0], which might or might not contain a valid path to the executable itself. Instead of mangling argv[0], use the same link to find out if we're already running the AVX2 build where supported. Alternatively, we could use execvpe(), but that might result in running a different installed version, in case e.g. the set of binaries is present in both /usr/bin and /usr/local/bin, with both being in $PATH. Reported-by: Wenli Quan <wquan(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2101310 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- arch.c | 25 +++++++++++++++---------- passt.c | 9 ++++++--- 2 files changed, 21 insertions(+), 13 deletions(-) diff --git a/arch.c b/arch.c index ae21d59..71feda3 100644 --- a/arch.c +++ b/arch.c @@ -14,26 +14,31 @@ #include <limits.h> #include <stdio.h> +#include <stdlib.h> #include <string.h> #include <unistd.h> /** - * arch_avx2_exec() - Run AVX2 build if supported, drop suffix from argv[0] + * arch_avx2_exec() - Switch to AVX2 build if supported * @argv: Arguments from command line */ #ifdef __x86_64__ -static char avx2_path[PATH_MAX]; - void arch_avx2_exec(char **argv) { - char *p = strstr(argv[0], ".avx2"); + char exe[PATH_MAX], new_path[PATH_MAX + sizeof(".avx2")], *p; + + if (readlink("/proc/self/exe", exe, PATH_MAX) < 0) { + perror("readlink /proc/self/exe"); + exit(EXIT_FAILURE); + } + + p = strstr(exe, ".avx2"); + if (p && strlen(p) == strlen(".avx2")) + return; - if (p) { - *p = 0; - } else if (__builtin_cpu_supports("avx2")) { - snprintf(avx2_path, PATH_MAX, "%s.avx2", argv[0]); - argv[0] = avx2_path; - execve(avx2_path, argv, environ); + if (__builtin_cpu_supports("avx2")) { + snprintf(new_path, PATH_MAX + sizeof(".avx2"), "%s.avx2", exe); + execve(new_path, argv, environ); perror("Can't run AVX2 build, using non-AVX2 version"); } } diff --git a/passt.c b/passt.c index dd0229a..56fcf5f 100644 --- a/passt.c +++ b/passt.c @@ -35,6 +35,7 @@ #include <sys/mount.h> #include <netinet/ip.h> #include <net/ethernet.h> +#include <libgen.h> #include <stdlib.h> #include <unistd.h> #include <net/if.h> @@ -283,11 +284,11 @@ int main(int argc, char **argv) { int nfds, i, devnull_fd = -1, pidfile_fd = -1, quit_fd; struct epoll_event events[EPOLL_EVENTS]; + char *log_name, argv0[PATH_MAX], *name; struct ctx c = { 0 }; struct rlimit limit; struct timespec now; struct sigaction sa; - char *log_name; arch_avx2_exec(argv); @@ -304,14 +305,16 @@ int main(int argc, char **argv) if (argc < 1) exit(EXIT_FAILURE); - if (strstr(argv[0], "pasta")) { + strncpy(argv0, argv[0], PATH_MAX - 1); + name = basename(argv0); + if (strstr(name, "pasta")) { sa.sa_handler = pasta_child_handler; sigaction(SIGCHLD, &sa, NULL); signal(SIGPIPE, SIG_IGN); c.mode = MODE_PASTA; log_name = "pasta"; - } else if (strstr(argv[0], "passt")) { + } else if (strstr(name, "passt")) { c.mode = MODE_PASST; log_name = "passt"; } else { -- 2.35.1

2 1

[PATCH 00/15] Test fixes, batch 4
by David Gibson 13 Jul '22

13 Jul '22

This set supersedes the previous "batch 3" which had some problems. This fixes a number of problems I've encountered trying to run the passt tests on a Fedora host. It also makes a number of small cleanups and improvements to the test running framework. David Gibson (14): Handle the case of a DNS server on localhost tests: qemu-system-ppc64le isn't a thing Invoke specific qemu-system-* binaries tests: Introduce makefile for building test assets tests: Move mbuto download and execution to asset build tests: Search multiple places for aarch64 EDK2 bios image Clean up passt.pid file tests: Remove unused set_mode() function tests: Remove not-very-useful "req" directive tests: Don't automatically traverse directories of test files tests: Explicitly list test files in test/run, remove "onlyfor" support tests: Move distro image download to asset build makefile tests: Prepare distro images during asset build phase tests: Remove unused DNS6 calculation from fedora tests Stefano Brivio (1): test: Add external mbuto profile, drop udhcpc, and switch to it .gitignore | 1 + Makefile | 3 +- conf.c | 16 +++ passt.1 | 6 +- test/.gitignore | 6 ++ test/Makefile | 177 +++++++++++++++++++++++++++++++ test/build/all | 22 +++- test/build/install | 34 ------ test/demo/passt | 5 +- test/demo/pasta | 1 - test/demo/podman | 2 - test/dhcp/passt | 1 - test/dhcp/pasta | 1 - test/distro/debian | 124 +++------------------- test/distro/fedora | 206 ++++-------------------------------- test/distro/opensuse | 24 ++--- test/distro/ubuntu | 39 ++----- test/find-arm64-firmware.sh | 13 +++ test/icmp/passt_in_ns | 1 - test/lib/setup | 50 ++++----- test/lib/test | 35 ++---- test/lib/util | 13 --- test/ndp/passt | 1 - test/ndp/pasta | 1 - test/passt.mbuto | 34 ++++++ test/perf/passt_tcp | 1 - test/perf/passt_udp | 1 - test/perf/pasta_tcp | 1 - test/perf/pasta_udp | 1 - test/prepare-distro-img.sh | 18 ++++ test/run | 58 +++++----- test/tcp/passt | 1 - test/tcp/passt_in_ns | 1 - test/tcp/pasta | 1 - test/udp/passt | 1 - test/udp/passt_in_ns | 1 - test/udp/pasta | 1 - test/valgrind/passt | 1 - test/valgrind/passt_in_ns | 1 - 39 files changed, 405 insertions(+), 499 deletions(-) create mode 100644 test/Makefile delete mode 100644 test/build/install create mode 100755 test/find-arm64-firmware.sh create mode 100755 test/passt.mbuto create mode 100755 test/prepare-distro-img.sh -- 2.36.1

2 23

[PATCH] conf: Allow to specify ranges and ports excluded from given ranges
by Stefano Brivio 13 Jul '22

13 Jul '22

This is useful in environments where we want to forward a large number of ports, or all non-ephemeral ones, and some other service running on the host needs a few selected ports. I'm using ~ as prefix for the specification of excluded ranges and ports to avoid the need for explicit command line quoting. Ranges and ports can be excluded from given ranges by adding them in the comma-separated list, prefixed by ~. Some quick examples: -t 5000-6000,~5555: forward ports 5000 to 6000, but not 5555 -t ~20000-20010: forward all non-ephemeral, allowed ports, except for ports 20000 to 20010 ...more details in usage message and man page. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 112 ++++++++++++++++++++++++++++++++++++++++++++++++++------ passt.1 | 28 +++++++++++++- 2 files changed, 127 insertions(+), 13 deletions(-) diff --git a/conf.c b/conf.c index cff71ff..14356b7 100644 --- a/conf.c +++ b/conf.c @@ -124,12 +124,12 @@ enum conf_port_type { static int conf_ports(struct ctx *c, char optname, const char *optarg, enum conf_port_type *set) { - int start_src = -1, end_src = -1, start_dst = -1, end_dst = -1; + int start_src, end_src, start_dst, end_dst, exclude_only = 1, i, port; + char addr_buf[sizeof(struct in6_addr)] = { 0 }, *addr = addr_buf; void (*remap)(in_port_t port, in_port_t delta); - char addr_buf[sizeof(struct in6_addr)] = { 0 }; + uint8_t *map, exclude[USHRT_MAX / 8] = { 0 }; + char buf[BUFSIZ], *sep, *spec, *p; sa_family_t af = AF_UNSPEC; - char buf[BUFSIZ], *sep, *p, *addr = addr_buf; - uint8_t *map; if (optname == 't') { map = c->tcp.port_to_tap; @@ -186,9 +186,9 @@ static int conf_ports(struct ctx *c, char optname, const char *optarg, strncpy(buf, optarg, sizeof(buf) - 1); - if ((p = strchr(buf, '/'))) { - *p = 0; - p++; + if ((spec = strchr(buf, '/'))) { + *spec = 0; + spec++; if (optname != 't' && optname != 'u') goto bad; @@ -200,16 +200,97 @@ static int conf_ports(struct ctx *c, char optname, const char *optarg, else goto bad; } else { - p = buf; + spec = buf; addr = NULL; } - if (strspn(p, "0123456789-,:") != strlen(p)) + if (strspn(spec, "0123456789-,:~") != strlen(spec)) goto bad; + /* Mark all exclusions first, they might be given after base ranges */ + p = spec; + start_src = end_src = -1; do { - int i, port; + while (*p != '~' && start_src == -1) { + exclude_only = 0; + + if (!(p = strchr(p, ','))) + break; + + p++; + } + if (!p || !*p) + break; + + if (*p == '~') + p++; + + errno = 0; + port = strtol(p, &sep, 10); + if (sep == p) + break; + + if (port < 0 || port > USHRT_MAX || errno) + goto bad; + + switch (*sep) { + case '-': + if (start_src == -1) /* ~22-... */ + start_src = port; + break; + case ',': + case 0: + if (start_src == -1) /* ~80 */ + start_src = end_src = port; + else if (end_src == -1) /* ~22-25 */ + end_src = port; + else + goto bad; + + if (start_src > end_src) /* ~80-22 */ + goto bad; + + for (i = start_src; i <= end_src; i++) { + if (bitmap_isset(exclude, i)) + goto overlap; + + bitmap_set(exclude, i); + } + break; + default: + goto bad; + } + p = sep + 1; + } while (*sep); + + if (exclude_only) { + for (i = 0; i < PORT_EPHEMERAL_MIN; i++) { + if (bitmap_isset(exclude, i)) + continue; + + bitmap_set(map, i); + + if (optname == 't') + tcp_sock_init(c, 0, af, addr, i); + else if (optname == 'u') + udp_sock_init(c, 0, af, addr, i); + } + + return 0; + } + + /* Now process base ranges, skipping exclusions */ + start_src = end_src = start_dst = end_dst = -1; + p = spec; + do { + while (*p == '~') { + if (!(p = strchr(p, ','))) + break; + p++; + } + if (!p || !*p) + break; errno = 0; port = strtol(p, &sep, 10); @@ -281,6 +362,9 @@ static int conf_ports(struct ctx *c, char optname, const char *optarg, if (bitmap_isset(map, i)) goto overlap; + if (bitmap_isset(exclude, i)) + continue; + bitmap_set(map, i); if (start_dst != -1) { @@ -726,7 +810,9 @@ static void usage(const char *name) info( " 'all': forward all unbound, non-ephemeral ports"); info( " a comma-separated list, optionally ranged with '-'"); info( " and optional target ports after ':', with optional"); - info( " address specification suffixed by '/'. Examples:"); + info( " address specification suffixed by '/'. Ranges can be"); + info( " reduced by excluding ports or ranges prefixed by '~'"); + info( " Examples:"); info( " -t 22 Forward local port 22 to 22 on guest"); info( " -t 22:23 Forward local port 22 to 23 on guest"); info( " -t 22,25 Forward ports 22, 25 to ports 22, 25"); @@ -734,6 +820,8 @@ static void usage(const char *name) info( " -t 22-80:32-90 Forward ports 22 to 80 to"); info( " corresponding port numbers plus 10"); info( " -t 192.0.2.1/5 Bind port 5 of 192.0.2.1 to guest"); + info( " -t 5-25,~10-20 Forward ports 5 to 9, and 21 to 25"); + info( " -t ~25 Forward all ports except for 25"); info( " default: none"); info( " -u, --udp-ports SPEC UDP port forwarding to guest"); info( " SPEC is as described for TCP above"); @@ -757,6 +845,8 @@ pasta_opts: info( " -t 22-80:32-90 Forward ports 22 to 80 to"); info( " corresponding port numbers plus 10"); info( " -t 192.0.2.1/5 Bind port 5 of 192.0.2.1 to namespace"); + info( " -t 5-25,~10-20 Forward ports 5 to 9, and 21 to 25"); + info( " -t ~25 Forward all bound ports except for 25"); info( " default: auto"); info( " IPv6 bound ports are also forwarded for IPv4"); info( " -u, --udp-ports SPEC UDP port forwarding to namespace"); diff --git a/passt.1 b/passt.1 index c7c43be..4e06c0c 100644 --- a/passt.1 +++ b/passt.1 @@ -306,7 +306,10 @@ For low (< 1024) ports, see \fBNOTES\fR. .BR ports A comma-separated list of ports, optionally ranged with \fI-\fR, and, optionally, with target ports after \fI:\fR, if they differ. Specific addresses -can be bound as well, separated by \fI/\fR. Examples: +can be bound as well, separated by \fI/\fR. Within given ranges, selected ports +and ranges can be excluded by an additional specification prefixed by \fI~\fR. +Specifying excluded ranges only implies that all other ports are forwarded. +Examples: .RS .TP -t 22 @@ -326,6 +329,15 @@ Forward local ports 22 to 80 to corresponding ports on the guest plus 10 .TP -t 192.0.2.1/22 Forward local port 22, bound to 192.0.2.1, to port 22 on the guest +.TP +-t 2000-5000,~3000-3010 +Forward local ports 2000 to 5000, but not 3000 to 3010 +.TP +-t 192.0.2.1/20-30,~25 +Forward local ports 20 to 24, and 26 to 30, bound to 192.0.2.1 +.TP +-t ~20000-20010 +Forward all ports to the guest, except for the range from 20000 to 20010 .RE Default is \fBnone\fR. @@ -368,7 +380,10 @@ periodically derived (every second) from listening sockets reported by .BR ports A comma-separated list of ports, optionally ranged with \fI-\fR, and, optionally, with target ports after \fI:\fR, if they differ. Specific addresses -can be bound as well, separated by \fI/\fR. Examples: +can be bound as well, separated by \fI/\fR. Within given ranges, selected ports +and ranges can be excluded by an additional specification prefixed by \fI~\fR. +Specifying excluded ranges only implies that all other ports are forwarded. +Examples: .RS .TP -t 22 @@ -389,6 +404,15 @@ namespace .TP -t 192.0.2.1/22 Forward local port 22, bound to 192.0.2.1, to port 22 in the target namespace +.TP +-t 2000-5000,~3000-3010 +Forward local ports 2000 to 5000, but not 3000 to 3010 +.TP +-t 192.0.2.1/20-30,~25 +Forward local ports 20 to 24, and 26 to 30, bound to 192.0.2.1 +.TP +-t ~20000-20010 +Forward all ports to the namespace, except for the range from 20000 to 20010 .RE IPv6 bound ports are also forwarded for IPv4. -- 2.35.1

1 0

[PATCH] conf: Fix initialisation of IPv6 unicast and link-local addresses
by Stefano Brivio 13 Jul '22

13 Jul '22

In commit 675174d4ba25 ("conf, tap: Split netlink and pasta functions, allow interface configuration"), I broke the initial setting of the observed IPv6 addresses in two ways: - the size copied from the configured addresses corresponds to an IPv4 address, not to an IPv6 address - the observed link-local address is initialised to the configured unicast address, not the link-local one If we haven't seen the guest using some type of addresses yet, we should default to the configured values, hence these initial settings: fix both. This resulted in UDP flows to the guest from a unique local address on the network not working before the guest shows passt a valid address itself, as reported by Alona. Reported-by: Alona Paz <alkaplan(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=16 Fixes: 675174d4ba25 ("conf, tap: Split netlink and pasta functions, allow interface configuration") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index 13cb5a1..cff71ff 100644 --- a/conf.c +++ b/conf.c @@ -589,8 +589,8 @@ static void conf_ip(struct ctx *c) IN6_IS_ADDR_UNSPECIFIED(&c->addr6) ? &c->addr6 : NULL, &prefix_len, &c->addr6_ll); - memcpy(&c->addr6_seen, &c->addr6, sizeof(c->addr4_seen)); - memcpy(&c->addr6_ll_seen, &c->addr6, sizeof(c->addr4_seen)); + memcpy(&c->addr6_seen, &c->addr6, sizeof(c->addr6)); + memcpy(&c->addr6_ll_seen, &c->addr6_ll, sizeof(c->addr6_ll)); } if (!c->gw4 || !c->addr4 || -- 2.35.1

1 0

[PATCH] util: Fix debug print on failed SO_REUSEADDR setting in sock_l4()
by Stefano Brivio 13 Jul '22

13 Jul '22

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 98946e4..2eea0ef 100644 --- a/util.c +++ b/util.c @@ -293,7 +293,7 @@ int sock_l4(const struct ctx *c, int af, uint8_t proto, } if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &y, sizeof(y))) - debug("Failed to set IPV6_V6ONLY on socket %i", fd); + debug("Failed to set SO_REUSEADDR on socket %i", fd); if (bind(fd, sa, sl) < 0) { /* We'll fail to bind to low ports if we don't have enough -- 2.35.1

1 0

[PATCH] test: Embed script for dhclient(8) in mbuto(1) profile
by Stefano Brivio 07 Jul '22

07 Jul '22

David reports that dhclient-script(8) on Fedora needs a number of binaries that are not included in PROGS of the current mbuto profile, and we would also need to include hostnamectl(1) there, which will fail without a systemd init. Embed a minimal script for dhclient(8) in the profile itself, written to /sbin/dhclient-script at boot, to just check what we need to check out of DHCP and DHCPv6 functionality. While at it, drop busybox and logger from PROGS, as we don't need them, and add hostname(1). While DHCP option 12 isn't supported yet by the DHCP implementation in passt, we should probably add it soon. Reported-by: David Gibson <david(a)gibson.dropbear.id.au> Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/passt.mbuto | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 150c062..968c1cd 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -11,7 +11,7 @@ # Author: Stefano Brivio <sbrivio(a)redhat.com> PROGS="${PROGS:-ash,dash,bash ip mount ls insmod mkdir ln cat chmod lsmod - modprobe find grep mknod mv rm umount jq iperf3 dhclient busybox logger + modprobe find grep mknod mv rm umount jq iperf3 dhclient hostname sed tr chown sipcalc cut md5sum nc dd strace ping tail killall sleep sysctl nproc tcp_rr tcp_crr udp_rr which tee seq bc}" @@ -22,15 +22,29 @@ LINKS="${LINKS:- ash,dash,bash /bin/sh ash,dash,bash /usr/bin/bash}" -COPIES="${COPIES} - /sbin/dhclient-script" +DIRS="${DIRS} /tmp /sbin" -DIRS="${DIRS} /tmp" +FIXUP="${FIXUP}"' + cat > /sbin/dhclient-script << EOF +#!/bin/sh +[ -n "\${new_interface_mtu}" ] && ip link set dev \${interface} mtu \${new_interface_mtu} + +[ -n "\${new_ip_address}" ] && ip addr add \${new_ip_address}/\${new_subnet_mask} dev \${interface} +[ -n "\${new_routers}" ] && for r in \${new_routers}; do ip route add default via \${r} dev \${interface}; done +[ -n "\${new_domain_name_servers}" ] && for d in \${new_domain_name_servers}; do echo "nameserver \${d}" >> /etc/resolv.conf; done +[ -n "\${new_domain_name}" ] && (printf "search"; for d in \${new_domain_name}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf -FIXUP="${FIXUP} +[ -n "\${new_ip6_address}" ] && ip addr add \${new_ip6_address}/\${new_ip6_prefixlen} dev \${interface} +[ -n "\${new_dhcp6_name_servers}" ] && for d in \${new_dhcp6_name_servers}; do echo "nameserver \${d}%\${interface}" >> /etc/resolv.conf; done +[ -n "\${new_dhcp6_domain_search}" ] && (printf "search"; for d in \${new_dhcp6_domain_search}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf + +[ -n "\${new_host_name}" ] && hostname "\${new_host_name}" +exit 0 +EOF + chmod 755 /sbin/dhclient-script :> /etc/fstab sh +m -" +' OUTPUT="KERNEL=__KERNEL__ INITRD=__INITRD__ -- 2.35.1

1 0

[PATCH] Fix parsing of LINKS
by David Gibson 06 Jul '22

06 Jul '22

Currently mbuto misparses the LINKS variable in the profile. It will correctly assign the first two tokens to the target and link name, but for subsequent tokens ${__target} will always be non-empty, and so we'll never change it for later links. AFAICT this has been missed because the existing sample profiles only have links all going to the same target. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- mbuto | 1 + 1 file changed, 1 insertion(+) diff --git a/mbuto b/mbuto index 4ffe549..7530c72 100755 --- a/mbuto +++ b/mbuto @@ -808,6 +808,7 @@ prog_add() { prog_link "${1}" \ "${__bindir##${wd}}/$("${BASENAME}" "${__bin}")" \ "${__target}" "${__l}" + __target= done libs_copy "${__bin}" -- 2.36.1

2 1

[PATCH v2 0/4] New line reading implementation
by David Gibson 06 Jul '22

06 Jul '22

As discussed on our call, the current line_read() implementation is pretty ugly and has some definite bugs. This series replaces it with a new implementation which should be more solid and more readable. The new implementation is larger than I'd really like, but it turns out its fiddlier to handle the various edge cases than you might think. David Gibson (4): Add cleaner line-by-line reading primitives Parse resolv.conf with new lineread implementation Use new lineread implementation for procfs_scan_listen() Remove unused line_read() Makefile | 8 ++-- conf.c | 22 ++++++---- lineread.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++++ lineread.h | 31 +++++++++++++++ util.c | 64 +++-------------------------- 5 files changed, 170 insertions(+), 70 deletions(-) create mode 100644 lineread.c create mode 100644 lineread.h -- 2.36.1

2 7