- dev - passt

[PATCH 1/3] util: Rename sock_l4_dualstack() to sock_l4_dualstack_any()
by David Gibson 20 Nov '25

20 Nov '25

Stefano correctly noted that the fact a socket is dual-stack doesn't necessarily imply that it is bound to a wildcard address. While that's the only case we use for dual-stack sockets, there may be others. Therefore rename this function to make it clearer that it always uses a wildcard bind. Suggested-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- pif.c | 2 +- util.c | 6 +++--- util.h | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/pif.c b/pif.c index db447b4f..3d7a90e5 100644 --- a/pif.c +++ b/pif.c @@ -82,7 +82,7 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, ASSERT(pif_is_socket(pif)); if (!addr) { - ref.fd = sock_l4_dualstack(c, type, port, ifname); + ref.fd = sock_l4_dualstack_any(c, type, port, ifname); } else { union sockaddr_inany sa; diff --git a/util.c b/util.c index 82491326..b460dda2 100644 --- a/util.c +++ b/util.c @@ -197,7 +197,7 @@ int sock_l4(const struct ctx *c, enum epoll_type type, } /** - * sock_l4_dualstack() - Create a dual stack socket bound with wildcard address + * sock_l4_dualstack_any() - Create dualstack socket bound to :: and 0.0.0.0 * @c: Execution context * @type: epoll type * @port Port to bind to (:: and 0.0.0.0) @@ -207,8 +207,8 @@ int sock_l4(const struct ctx *c, enum epoll_type type, * * A dual stack socket is effectively bound to both :: and 0.0.0.0. */ -int sock_l4_dualstack(const struct ctx *c, enum epoll_type type, - in_port_t port, const char *ifname) +int sock_l4_dualstack_any(const struct ctx *c, enum epoll_type type, + in_port_t port, const char *ifname) { union sockaddr_inany sa = { .sa6.sin6_family = AF_INET6, diff --git a/util.h b/util.h index d9fbfe5d..963c0ec8 100644 --- a/util.h +++ b/util.h @@ -210,8 +210,8 @@ union sockaddr_inany; int sock_l4(const struct ctx *c, enum epoll_type type, const union sockaddr_inany *sa, const char *ifname); -int sock_l4_dualstack(const struct ctx *c, enum epoll_type type, - in_port_t port, const char *ifname); +int sock_l4_dualstack_any(const struct ctx *c, enum epoll_type type, + in_port_t port, const char *ifname); int sock_unix(char *sock_path); void sock_probe_mem(struct ctx *c); long timespec_diff_ms(const struct timespec *a, const struct timespec *b); -- 2.51.1

1 0

[PATCH 0/3] Fix bug 113
by David Gibson 20 Nov '25

20 Nov '25

My previous changes to socket binding didn't quite fix bug 113, but they get us close. Here are the last few pieces we need to fix it. This is based on my previous series improving consistency of listening socket binding. David Gibson (3): util: Rename sock_l4_dualstack() to sock_l4_dualstack_any() tcp: Always populate oaddr field for socket initiated flows fwd: Preserve non-standard loopback address when splice forwarding fwd.c | 4 +++- pif.c | 2 +- tcp.c | 8 +++----- util.c | 6 +++--- util.h | 4 ++-- 5 files changed, 12 insertions(+), 12 deletions(-) -- 2.51.1

1 0

[PATCH v3 2/8] util, flow, pif: Simplify sock_l4_sa() interface
by David Gibson 20 Nov '25

20 Nov '25

sock_l4_sa() has a somewhat confusing 'v6only' option controlling whether to set the IPV6_V6ONLY socket option. Usually it's set when the given address is IPv6, but not when we want to create a dual stack listening socket. The latter only makes sense when the address is :: however. Clarify this by only keeping the v6only option in an internal helper sock_l4_(). External users will call either sock_l4() which always creates a socket bound to a specific IP version, or sock_l4_dualstack() which creates a dual stack socket, but takes only a port not an address. We drop the '_sa' suffix while we're at it - it exists because this used to be an internal version with a sock_l4() wrapper. The wrapper no longer exists so the '_sa' is no longer useful. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 6 ++---- pif.c | 10 +++------- util.c | 27 +++++++++++++++++++++++---- util.h | 8 +++++--- 4 files changed, 33 insertions(+), 18 deletions(-) diff --git a/flow.c b/flow.c index 9926f408..fd530ddb 100644 --- a/flow.c +++ b/flow.c @@ -186,8 +186,7 @@ static int flowside_sock_splice(void *arg) ns_enter(a->c); - a->fd = sock_l4_sa(a->c, a->type, a->sa, NULL, - a->sa->sa_family == AF_INET6, a->data); + a->fd = sock_l4(a->c, a->type, a->sa, NULL, a->data); a->err = errno; return 0; @@ -222,8 +221,7 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, else if (sa.sa_family == AF_INET6) ifname = c->ip6.ifname_out; - return sock_l4_sa(c, type, &sa, ifname, - sa.sa_family == AF_INET6, data); + return sock_l4(c, type, &sa, ifname, data); case PIF_SPLICE: { struct flowside_sock_args args = { diff --git a/pif.c b/pif.c index 31723b29..5fb1f455 100644 --- a/pif.c +++ b/pif.c @@ -75,11 +75,7 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port, uint32_t data) { - union sockaddr_inany sa = { - .sa6.sin6_family = AF_INET6, - .sa6.sin6_addr = in6addr_any, - .sa6.sin6_port = htons(port), - }; + union sockaddr_inany sa; ASSERT(pif_is_socket(pif)); @@ -90,8 +86,8 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, } if (!addr) - return sock_l4_sa(c, type, &sa, ifname, false, data); + return sock_l4_dualstack(c, type, port, ifname, data); pif_sockaddr(c, &sa, pif, addr, port); - return sock_l4_sa(c, type, &sa, ifname, sa.sa_family == AF_INET6, data); + return sock_l4(c, type, &sa, ifname, data); } diff --git a/util.c b/util.c index 976fcabe..c94efae4 100644 --- a/util.c +++ b/util.c @@ -40,7 +40,7 @@ #endif /** - * sock_l4_sa() - Create and bind socket to socket address, add to epoll list + * sock_l4_() - Create and bind socket to socket address, add to epoll list * @c: Execution context * @type: epoll type * @sa: Socket address to bind to @@ -50,9 +50,9 @@ * * Return: newly created socket, negative error code on failure */ -int sock_l4_sa(const struct ctx *c, enum epoll_type type, - const union sockaddr_inany *sa, const char *ifname, - bool v6only, uint32_t data) +static int sock_l4_(const struct ctx *c, enum epoll_type type, + const union sockaddr_inany *sa, const char *ifname, + bool v6only, uint32_t data) { sa_family_t af = sa->sa_family; union epoll_ref ref = { .type = type, .data = data }; @@ -182,6 +182,25 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, return fd; } +int sock_l4(const struct ctx *c, enum epoll_type type, + const union sockaddr_inany *sa, const char *ifname, + uint32_t data) +{ + return sock_l4_(c, type, sa, ifname, sa->sa_family == AF_INET6, data); +} + +int sock_l4_dualstack(const struct ctx *c, enum epoll_type type, + in_port_t port, const char *ifname, uint32_t data) +{ + union sockaddr_inany sa = { + .sa6.sin6_family = AF_INET6, + .sa6.sin6_addr = in6addr_any, + .sa6.sin6_port = htons(port), + }; + + return sock_l4_(c, type, &sa, ifname, 0, data); +} + /** * sock_unix() - Create and bind AF_UNIX socket * @sock_path: Socket path. If empty, set on return (UNIX_SOCK_PATH as prefix) diff --git a/util.h b/util.h index e1a1ebc9..7f0cf686 100644 --- a/util.h +++ b/util.h @@ -203,9 +203,11 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, struct ctx; union sockaddr_inany; -int sock_l4_sa(const struct ctx *c, enum epoll_type type, - const union sockaddr_inany *sa, const char *ifname, - bool v6only, uint32_t data); +int sock_l4(const struct ctx *c, enum epoll_type type, + const union sockaddr_inany *sa, const char *ifname, + uint32_t data); +int sock_l4_dualstack(const struct ctx *c, enum epoll_type type, + in_port_t port, const char *ifname, uint32_t data); int sock_unix(char *sock_path); void sock_probe_mem(struct ctx *c); long timespec_diff_ms(const struct timespec *a, const struct timespec *b); -- 2.51.0

2 7

[PATCH v8 0/6] Retry SYNs for inbound connections
by Yumei Huang 19 Nov '25

19 Nov '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism using the similar backoff timeout as linux kernel. Also update the data retransmission timeout using the backoff timeout. v8: - Remove the TCP_/tcp_ suffix from certain macro and struct member names - Add parameter struct ctx *c to tcp_timer_ctl() - Modify rto_max type from size_t to int - Clamp syn_retries and syn_linear_timeouts with MAX_SYNCNT(127) - Some other minor fixes related to wording and formatting v7: - Update read_file() and read_file_integer() - Rename tcp_syn_params_init() to tcp_get_rto_params() - Modify the implementation of the timeout assignment - Add a patch to clamp the retry timeout Yumei Huang (6): tcp: Rename "retrans" to "retries" util: Introduce read_file() and read_file_integer() function tcp: Add parameter struct ctx *c to tcp_timer_ctl() tcp: Resend SYN for inbound connections tcp: Update data retransmission timeout tcp: Clamp the retry timeout tcp.c | 107 +++++++++++++++++++++++++++++++++++++++-------------- tcp.h | 6 +++ tcp_conn.h | 13 ++++--- util.c | 86 ++++++++++++++++++++++++++++++++++++++++++ util.h | 2 + 5 files changed, 181 insertions(+), 33 deletions(-) -- 2.51.0

3 31

[PATCH 3/3] fwd: Don't explicitly exclude reverse-direction TCP ports for UDP
by David Gibson 19 Nov '25

19 Nov '25

In auto-forwarding mode, we forward UDP ports for which there isn't (yet) a listening UDP port on the other side, but where there is a listening TCP socket for the same port number. This is useful for certain protocols such as iperf3. Correspondinly, when excluding ports from forwarding, we also exclude TCP ports from the other direction. That sounds like it makes sense, but is unnecessary: for the purposes of exclusion, we don't care why we have a listening UDP socket for that port, just whether we have one. That is already incorporated into the UDP bitmap alone. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 6 ++---- util.c | 1 + 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/fwd.c b/fwd.c index c7a880eb..c417e0f5 100644 --- a/fwd.c +++ b/fwd.c @@ -410,10 +410,8 @@ static void fwd_scan_ports(struct ctx *c) memcpy(excl_tcp_out, c->tcp.fwd_in.map, sizeof(excl_tcp_out)); memcpy(excl_tcp_in, c->tcp.fwd_out.map, sizeof(excl_tcp_in)); - bitmap_or(excl_udp_out, PORT_BITMAP_SIZE, - c->udp.fwd_in.map, c->tcp.fwd_in.map); - bitmap_or(excl_udp_in, PORT_BITMAP_SIZE, - c->udp.fwd_out.map, c->tcp.fwd_out.map); + memcpy(excl_udp_out, c->udp.fwd_in.map, sizeof(excl_udp_out)); + memcpy(excl_udp_in, c->udp.fwd_out.map, sizeof(excl_udp_in)); fwd_scan_ports_tcp(&c->tcp.fwd_out, excl_tcp_out); fwd_scan_ports_tcp(&c->tcp.fwd_in, excl_tcp_in); diff --git a/util.c b/util.c index 7944a495..ab23463b 100644 --- a/util.c +++ b/util.c @@ -338,6 +338,7 @@ bool bitmap_isset(const uint8_t *map, unsigned bit) * @a: First operand * @b: Second operand */ +/* cppcheck-suppress unusedFunction */ void bitmap_or(uint8_t *dst, size_t size, const uint8_t *a, const uint8_t *b) { unsigned long *dw = (unsigned long *)dst; -- 2.51.1

1 0

[PATCH 1/3] Revert "fwd: Update all port maps before applying exclusions"
by David Gibson 19 Nov '25

19 Nov '25

This reverts commit 81942a2417357ff10b02ccc8275cde2d4d6fbfbe. That commit was based on the premise of trying to make all the exclusions use the "latest" scan data. That was a fundamentally wrong approach: what we need to exclude is listening ports that pasta itself has created. That is, we need to exclude ports that we were _already_ listening on, not ones that we intend to listen once we rebind - we *want* the old data. Reverting this reduces the cases in which bug 176 occurs, but it's not a complete fix. Link: https://bugs.passt.top/show_bug.cgi?id=176 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 47 +++++++++++++++++++++++------------------------ 1 file changed, 23 insertions(+), 24 deletions(-) diff --git a/fwd.c b/fwd.c index 68bb1166..7b6c40fb 100644 --- a/fwd.c +++ b/fwd.c @@ -358,8 +358,10 @@ static void procfs_scan_listen(int fd, unsigned int lstate, uint8_t *map) /** * fwd_scan_ports_tcp() - Scan /proc to update TCP forwarding map * @fwd: Forwarding information to update + * @rev: Forwarding information for the reverse direction */ -static void fwd_scan_ports_tcp(struct fwd_ports *fwd) +static void fwd_scan_ports_tcp(struct fwd_ports *fwd, + const struct fwd_ports *rev) { if (fwd->mode != FWD_AUTO) return; @@ -367,15 +369,20 @@ static void fwd_scan_ports_tcp(struct fwd_ports *fwd) memset(fwd->map, 0, PORT_BITMAP_SIZE); procfs_scan_listen(fwd->scan4, TCP_LISTEN, fwd->map); procfs_scan_listen(fwd->scan6, TCP_LISTEN, fwd->map); + bitmap_and_not(fwd->map, PORT_BITMAP_SIZE, fwd->map, rev->map); } /** * fwd_scan_ports_udp() - Scan /proc to update UDP forwarding map * @fwd: Forwarding information to update + * @rev: Forwarding information for the reverse direction * @tcp_fwd: Corresponding TCP forwarding information + * @tcp_rev: TCP forwarding information for the reverse direction */ static void fwd_scan_ports_udp(struct fwd_ports *fwd, - const struct fwd_ports *tcp_fwd) + const struct fwd_ports *rev, + const struct fwd_ports *tcp_fwd, + const struct fwd_ports *tcp_rev) { if (fwd->mode != FWD_AUTO) return; @@ -391,6 +398,14 @@ static void fwd_scan_ports_udp(struct fwd_ports *fwd, */ procfs_scan_listen(tcp_fwd->scan4, TCP_LISTEN, fwd->map); procfs_scan_listen(tcp_fwd->scan6, TCP_LISTEN, fwd->map); + + /* This means we need to skip numbers of TCP ports bound on the other + * side, too. Otherwise, we would detect corresponding UDP ports as + * bound and try to forward them from the opposite side, but it's + * already us handling them. + */ + bitmap_and_not(fwd->map, PORT_BITMAP_SIZE, fwd->map, rev->map); + bitmap_and_not(fwd->map, PORT_BITMAP_SIZE, fwd->map, tcp_rev->map); } /** @@ -399,28 +414,12 @@ static void fwd_scan_ports_udp(struct fwd_ports *fwd, */ static void fwd_scan_ports(struct ctx *c) { - fwd_scan_ports_tcp(&c->tcp.fwd_out); - fwd_scan_ports_tcp(&c->tcp.fwd_in); - fwd_scan_ports_udp(&c->udp.fwd_out, &c->tcp.fwd_out); - fwd_scan_ports_udp(&c->udp.fwd_in, &c->tcp.fwd_in); - - if (c->tcp.fwd_out.mode == FWD_AUTO) { - bitmap_and_not(c->tcp.fwd_out.map, PORT_BITMAP_SIZE, - c->tcp.fwd_out.map, c->tcp.fwd_in.map); - } - if (c->tcp.fwd_in.mode == FWD_AUTO) { - bitmap_and_not(c->tcp.fwd_in.map, PORT_BITMAP_SIZE, - c->tcp.fwd_in.map, c->tcp.fwd_out.map); - } - - if (c->udp.fwd_out.mode == FWD_AUTO) { - bitmap_and_not(c->udp.fwd_out.map, PORT_BITMAP_SIZE, - c->udp.fwd_out.map, c->udp.fwd_in.map); - } - if (c->udp.fwd_in.mode == FWD_AUTO) { - bitmap_and_not(c->udp.fwd_in.map, PORT_BITMAP_SIZE, - c->udp.fwd_in.map, c->udp.fwd_out.map); - } + fwd_scan_ports_tcp(&c->tcp.fwd_out, &c->tcp.fwd_in); + fwd_scan_ports_tcp(&c->tcp.fwd_in, &c->tcp.fwd_out); + fwd_scan_ports_udp(&c->udp.fwd_out, &c->udp.fwd_in, + &c->tcp.fwd_out, &c->tcp.fwd_in); + fwd_scan_ports_udp(&c->udp.fwd_in, &c->udp.fwd_out, + &c->tcp.fwd_in, &c->tcp.fwd_out); } /** -- 2.51.1

1 0

[PATCH v3 0/8] Reduce differences between inbound and outbound socket binding
by David Gibson 18 Nov '25

18 Nov '25

The fact that outbound forwarding sockets are bound to the loopback address, whereas inbound forwarding sockets are (by default) bound to the unspecified address leads to some unexpected differences between the paths setting up each of them. An idea for tackling bug 100 suggested a different approach which will also reduce some of those differences and allow more code to be shared between the two paths. I've since discovered that this approach may not help for bug 100, but it might still be worthwhile for the clean up. Patches 1..6/8 are cleanups which shouldn't change behaviour, and I think are ready to merge. 7/8 is (arguably) a behavioural change, but I've made my case for it in the patch comment. 8/8 needs some further consideration, since I've discovered it does not fix bug 100 as is, I'm including it for advance review, though. v3: - A number of additional fixes covering the handling of IPV6_V6ONLY sockopt - Assorted trivial changes v2: - Some rearrangements and rewordings for clarity David Gibson (8): inany: Let length of sockaddr_inany be implicit from the family util, flow, pif: Simplify sock_l4_sa() interface tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one() udp: Unify some more inbound/outbound parts of udp_sock_init() udp: Move udp_sock_init() special case to its caller util: Fix setting of IPV6_V6ONLY socket option tcp, udp: Remove fallback if creating dual stack socket fails [RFC, DO NOT APPLY] tcp, udp: Bind outbound listening sockets by interface instead of address conf.c | 4 +- flow.c | 19 +++--- icmp.c | 3 +- inany.h | 18 ++++++ pif.c | 26 ++------ pif.h | 2 +- tcp.c | 164 +++++++++++++++++++-------------------------------- tcp.h | 5 +- tcp_splice.c | 5 +- udp.c | 102 +++++++++++++++----------------- udp.h | 5 +- util.c | 55 +++++++++++++---- util.h | 9 ++- 13 files changed, 201 insertions(+), 216 deletions(-) -- 2.51.0

2 11

[PATCH 0/4] vhost-user: Add multiqueue support
by Laurent Vivier 18 Nov '25

18 Nov '25

This series implements multiqueue support for vhost-user mode, allowing passt to utilize multiple queue pairs. There is no improved network performance because we keep using only one thread. The implementation introduces a --max-queues parameter to configure up to 16 queue pairs (32 virtqueues) in vhost-user mode. Packets are routed to the appropriate RX queue based on which TX queue they originated from, enabling the guest kernel to distribute network traffic across multiple queues and vCPUs. This series adds: - configuration support for multiqueue via --max-queues parameter - queue parameter threading throughout the network stack - a significant refactoring that propagates queue information through all protocol handlers (TCP, UDP, ICMP, ARP, DHCP, DHCPv6, NDP) - flow-aware queue routing that matches RX queue selection to the incoming TX queue, maintaining proper packet affinity - comprehensive test coverage with VHOST_USER_MQ environment variable to validate multiqueue functionality across all test scenarios Current behavior: TX queue selection is controlled by the guest kernel, while RX packets are routed to queues based on their associated flows. Host-initiated flows currently default to queue 0. The RX queue of a flow is updated on each new packet from the TX queue to maintain affinity. The changes maintain backward compatibility - without --max-queues, behavior remains unchanged with single-queue operation. Laurent Vivier (4): vhost-user: Enable multiqueue vhost-user: Add queue parameter throughout the network stack multiqueue: Add queue-aware flow management for multiqueue support test: Add multiqueue support to vhost-user test infrastructure arp.c | 12 ++--- arp.h | 4 +- conf.c | 31 ++++++++++++- dhcp.c | 5 ++- dhcp.h | 2 +- dhcpv6.c | 12 ++--- dhcpv6.h | 2 +- flow.c | 32 +++++++++++++ flow.h | 10 +++++ fwd.c | 4 +- icmp.c | 25 ++++++----- icmp.h | 2 +- ndp.c | 32 +++++++------ ndp.h | 5 ++- passt.h | 2 + tap.c | 120 +++++++++++++++++++++++++++++-------------------- tap.h | 18 ++++---- tcp.c | 82 ++++++++++++++++++--------------- tcp.h | 11 ++--- tcp_vu.c | 8 ++-- test/lib/setup | 60 +++++++++++++++++++------ test/run | 23 ++++++++++ udp.c | 40 ++++++++++------- udp.h | 12 ++--- udp_flow.c | 8 +++- udp_flow.h | 2 +- udp_vu.c | 4 +- vhost_user.c | 38 +++++++++------- virtio.h | 2 +- vu_common.c | 13 +++--- vu_common.h | 3 +- 31 files changed, 416 insertions(+), 208 deletions(-) -- 2.51.0

2 12

[PATCH] seccomp.sh: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 14 Nov '25

14 Nov '25

we use [a-z] and [A-Z] patterns with 'tr', but if there are files with names matching these patterns they will be replaced by the name of the file and seccomp.h will not be generated correctly: $ rm seccomp.h $ touch a b $ make tr: extra operand '[A-Z]' Try 'tr --help' for more information. seccomp profile passt allows: accept accept4 bind clock_gettime close connect epoll_ctl epoll_pwait epoll_wait exit_group fallocate fcntl fsync ftruncate getsockname getsockopt listen lseek read recvfrom recvmmsg recvmsg sendmmsg sendmsg sendto ... cc -Wall -Wextra -Wno-format-zero-length -Wformat-security -pedantic -std=c11 -D_XOPEN_SOURCE=700 -D_GNU_SOURCE -D_FORTIFY_SOURCE=2 -O2 -pie -fPIE -DPAGE_SIZE=4096 -DVERSION="2025_09_19.623dbf6-54-gf6b6118fcabd" -DDUAL_STACK_SOCKETS=1 -DHAS_GETRANDOM -fstack-protector-strong arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c flow.c fwd.c icmp.c igmp.c inany.c iov.c ip.c isolation.c lineread.c log.c mld.c ndp.c netlink.c migrate.c packet.c passt.c pasta.c pcap.c pif.c repair.c tap.c tcp.c tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c vhost_user.c virtio.c vu_common.c -o passt In file included from isolation.c:83: seccomp.h:11:45: error: 'AUDIT_ARCH_' undeclared here (not in a function); did you mean 'AUDIT_ARCH'? 11 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_, 0, 80), | ^~~~~~~~~~~ Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- seccomp.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seccomp.sh b/seccomp.sh index a7bc417b9f6b..ba92b29d9a29 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -22,7 +22,7 @@ IN="$@" [ -z "${ARCH}" ] && ARCH="$(uname -m)" [ -z "${CC}" ] && CC="cc" -AUDIT_ARCH="AUDIT_ARCH_$(echo ${ARCH} | tr [a-z] [A-Z] \ +AUDIT_ARCH="AUDIT_ARCH_$(echo ${ARCH} | tr '[a-z]' '[A-Z]' \ | sed 's/^ARM.*/ARM/' \ | sed 's/I[456]86/I386/' \ | sed 's/PPC64/PPC/' \ -- 2.51.0

3 7

[PATCH] udp: Use IP_FREEBIND for flow sockets as well as listening sockets
by David Gibson 14 Nov '25

14 Nov '25

The --freebind option allows pasta to listen on addresses that aren't registered on the host, which has a number of use cases. However, we omitted this option for UDP "flow sockets" which are created once a flow is started, connect()ed specifically to the peer. Flow sockets are also bound, and if the peer has contacted a freebind address, we need IP_FREEBIND to do so. Link: https://bugs.passt.top/show_bug.cgi?id=174 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) I'm still waiting on confirmation from the reporter that this actually fixes bug 174. However, I'm pretty sure this is _a_ correct fix, whether or not it's a complete fix for the issue seen by the reporter. diff --git a/util.c b/util.c index 44c21a3e..ab23463b 100644 --- a/util.c +++ b/util.c @@ -67,9 +67,8 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, freebind = c->freebind; break; case EPOLL_TYPE_UDP_LISTEN: - freebind = c->freebind; - /* fallthrough */ case EPOLL_TYPE_UDP: + freebind = c->freebind; proto = IPPROTO_UDP; socktype = SOCK_DGRAM | SOCK_NONBLOCK; break; -- 2.51.1

2 2