- dev - passt

[PATCH] Correct various function comment headers
by Laurent Vivier 06 Jun '25

06 Jun '25

This commit refines function comment headers for improved accuracy and consistency. Key changes include: - Corrected parameter/return descriptions (e.g., `logtime`, `__daemon`). - Added missing and removed incorrect parameter documentation (e.g., `tcp_vu_sock_recv`, `ndp`). - Standardized comments to the `/** ... */` style for functions like `udp_flow_close` and `ns_enter`. - Ensured function names in comments consistently use `()`. - Addressed minor typos and updated comments for renamed functions. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- conf.c | 2 +- flow.c | 4 +++- log.c | 3 ++- ndp.c | 1 - netlink.c | 1 - pasta.c | 4 +--- pcap.c | 7 ++----- tcp.c | 10 ++++++---- tcp_buf.c | 4 ++-- tcp_vu.c | 4 +++- udp.c | 4 ++-- udp_flow.c | 5 +++-- util.c | 11 +++++++---- 13 files changed, 32 insertions(+), 28 deletions(-) diff --git a/conf.c b/conf.c index a6d7e22a860c..f4c8ca25c87e 100644 --- a/conf.c +++ b/conf.c @@ -1358,7 +1358,7 @@ static void conf_open_files(struct ctx *c) } /** - * parse_mac - Parse a MAC address from a string + * parse_mac() - Parse a MAC address from a string * @mac: Binary MAC address, initialised on success * @str: String to parse * diff --git a/flow.c b/flow.c index 6a5c8aa439c2..cc050339c9c4 100644 --- a/flow.c +++ b/flow.c @@ -480,7 +480,9 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, /** * flow_set_type() - Set type and move to TYPED * @flow: Flow to change state - * @pif: pif of the initiating side + * @type: New flow type to assign + * + * Return: pointer to the modified flow structure. */ union flow *flow_set_type(union flow *flow, enum flow_type type) { diff --git a/log.c b/log.c index 5d7d76f68b2e..33b89fc14574 100644 --- a/log.c +++ b/log.c @@ -54,7 +54,8 @@ bool log_stderr = true; /* Not daemonised, no shell spawned */ * logtime() - Get the current time for logging purposes * @ts: Buffer into which to store the timestamp * - * Return: pointer to @now, or NULL if there was an error retrieving the time + * Return: pointer to @ts on success, or NULL if there was + * an error retrieving the time */ static const struct timespec *logtime(struct timespec *ts) { diff --git a/ndp.c b/ndp.c index b664034b00b1..3e1549456839 100644 --- a/ndp.c +++ b/ndp.c @@ -335,7 +335,6 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) /** * ndp() - Check for NDP solicitations, reply as needed * @c: Execution context - * @ih: ICMPv6 header * @saddr: Source IPv6 address * @p: Packet pool * diff --git a/netlink.c b/netlink.c index a0525047e898..ee9325a054a2 100644 --- a/netlink.c +++ b/netlink.c @@ -1024,7 +1024,6 @@ int nl_link_get_mac(int s, unsigned int ifi, void *mac) /** * nl_link_set_mac() - Set link MAC address * @s: Netlink socket - * @ns: Use netlink socket in namespace * @ifi: Interface index * @mac: MAC address to set * diff --git a/pasta.c b/pasta.c index 017fa3224c65..c20769211d9e 100644 --- a/pasta.c +++ b/pasta.c @@ -57,15 +57,13 @@ int pasta_child_pid; /** * pasta_child_handler() - Exit once shell exits (if we started it), reap clones - * @signal: Unused, handler deals with SIGCHLD only + * @signal: Signal number; this handler deals with SIGCHLD only */ void pasta_child_handler(int signal) { int errno_save = errno; siginfo_t infop; - (void)signal; - if (signal != SIGCHLD) return; diff --git a/pcap.c b/pcap.c index e95aa6fe29a6..46d11a2a6daa 100644 --- a/pcap.c +++ b/pcap.c @@ -52,8 +52,6 @@ struct pcap_pkthdr { * @iovcnt: Number of buffers (@iov entries) in frame * @offset: Byte offset of the L2 headers within @iov * @now: Timestamp - * - * Returns: 0 on success, -errno on error writing to the file */ static void pcap_frame(const struct iovec *iov, size_t iovcnt, size_t offset, const struct timespec *now) @@ -113,10 +111,9 @@ void pcap_multiple(const struct iovec *iov, size_t frame_parts, unsigned int n, pcap_frame(iov + i * frame_parts, frame_parts, offset, &now); } -/* - * pcap_iov - Write packet data described by an I/O vector +/** + * pcap_iov() - Write packet data described by an I/O vector * to a pcap file descriptor. - * * @iov: Pointer to the array of struct iovec describing the I/O vector * containing packet data to write, including L2 header * @iovcnt: Number of buffers (@iov entries) diff --git a/tcp.c b/tcp.c index 0ac298a74125..f43c1e27c112 100644 --- a/tcp.c +++ b/tcp.c @@ -456,7 +456,7 @@ int tcp_set_peek_offset(const struct tcp_tap_conn *conn, int offset) /** * tcp_conn_epoll_events() - epoll events mask for given connection state * @events: Current connection events - * @conn_flags Connection flags + * @conn_flags: Connection flags * * Return: epoll events mask corresponding to implied connection state */ @@ -1079,7 +1079,7 @@ out: * tcp_update_seqack_from_tap() - ACK number from tap and related flags/counters * @c: Execution context * @conn: Connection pointer - * @seq Current ACK sequence, host order + * @seq: Current ACK sequence, host order */ static void tcp_update_seqack_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, uint32_t seq) @@ -1103,7 +1103,7 @@ static void tcp_update_seqack_from_tap(const struct ctx *c, * @conn: Connection pointer * @flags: TCP flags: if not set, send segment only if ACK is due * @th: TCP header to update - * @data: buffer to store TCP option + * @opts: TCP option buffer (output parameter) * @optlen: size of the TCP option buffer (output parameter) * * Return: < 0 error code on connection reset, @@ -1238,7 +1238,7 @@ static void tcp_get_tap_ws(struct tcp_tap_conn *conn, /** * tcp_tap_window_update() - Process an updated window from tap side * @conn: Connection pointer - * @window: Window value, host order, unscaled + * @wnd: Window value, host order, unscaled */ static void tcp_tap_window_update(struct tcp_tap_conn *conn, unsigned wnd) { @@ -1261,6 +1261,8 @@ static void tcp_tap_window_update(struct tcp_tap_conn *conn, unsigned wnd) * tcp_init_seq() - Calculate initial sequence number according to RFC 6528 * @hash: Hash of connection details * @now: Current timestamp + * + * Return: the calculated 32-bit initial sequence number. */ static uint32_t tcp_init_seq(uint64_t hash, const struct timespec *now) { diff --git a/tcp_buf.c b/tcp_buf.c index 05305636b503..d1fca676c9a7 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -104,7 +104,7 @@ void tcp_sock_iov_init(const struct ctx *c) /** * tcp_revert_seq() - Revert affected conn->seq_to_tap after failed transmission - * @ctx: Execution context + * @c: Execution context * @conns: Array of connection pointers corresponding to queued frames * @frames: Two-dimensional array containing queued frames with sub-iovs * @num_frames: Number of entries in the two arrays to be compared @@ -148,7 +148,7 @@ void tcp_payload_flush(const struct ctx *c) } /** - * tcp_buf_fill_headers() - Fill 802.3, IP, TCP headers in pre-cooked buffers + * tcp_l2_buf_fill_headers() - Fill 802.3, IP, TCP headers in pre-cooked buffers * @conn: Connection pointer * @iov: Pointer to an array of iovec of TCP pre-cooked buffers * @check: Checksum, if already known diff --git a/tcp_vu.c b/tcp_vu.c index 57587cc73a63..f3914c7c2195 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -176,8 +176,10 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) * @already_sent: Number of bytes already sent * @fillsize: Maximum bytes to fill in guest-side receiving window * @iov_cnt: number of iov (output) + * @head_cnt: Pointer to store the count of head iov entries (output) * - * Return: Number of iov entries used to store the data or negative error code + * Return: number of bytes received from the socket, or a negative error code + * on failure. */ static ssize_t tcp_vu_sock_recv(const struct ctx *c, const struct tcp_tap_conn *conn, bool v6, diff --git a/udp.c b/udp.c index ca28b37c142d..65a52e0755c0 100644 --- a/udp.c +++ b/udp.c @@ -473,7 +473,7 @@ static void udp_send_tap_icmp6(const struct ctx *c, /** * udp_pktinfo() - Retrieve packet destination address from cmsg * @msg: msghdr into which message has been received - * @dst: (Local) destination address of message in @mh (output) + * @dst: (Local) destination address of message in @msg (output) * * Return: 0 on success, -1 if the information was missing (@dst is set to * inany_any6). @@ -736,7 +736,7 @@ static int udp_peek_addr(int s, union sockaddr_inany *src, * udp_sock_recv() - Receive datagrams from a socket * @c: Execution context * @s: Socket to receive from - * @mmh mmsghdr array to receive into + * @mmh: mmsghdr array to receive into * @n: Maximum number of datagrams to receive * * Return: Number of datagrams received diff --git a/udp_flow.c b/udp_flow.c index 4c6b3c2ca8da..cef3fb588bbe 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -36,7 +36,7 @@ struct udp_flow *udp_at_sidx(flow_sidx_t sidx) return &flow->udp; } -/* +/** * udp_flow_close() - Close and clean up UDP flow * @c: Execution context * @uflow: UDP flow @@ -126,7 +126,8 @@ static int udp_flow_sock(const struct ctx *c, * @flow: Initiated flow * @now: Timestamp * - * Return: UDP specific flow, if successful, NULL on failure + * Return: sidx for the target side of the new UDP flow, or FLOW_SIDX_NONE + * on failure. * * #syscalls getsockname */ diff --git a/util.c b/util.c index f5497d4634dc..7b245ccc01f9 100644 --- a/util.c +++ b/util.c @@ -364,7 +364,7 @@ void bitmap_or(uint8_t *dst, size_t size, const uint8_t *a, const uint8_t *b) dst[i] = a[i] | b[i]; } -/* +/** * ns_enter() - Enter configured user (unless already joined) and network ns * @c: Execution context * @@ -499,7 +499,8 @@ int output_file_open(const char *path, int flags) * @pidfile_fd: Open PID file descriptor * @devnull_fd: Open file descriptor for /dev/null * - * Return: child PID on success, won't return on failure + * Return: 0 in the child process on success. The parent process exits. + * Does not return in either process on failure (calls _exit). */ int __daemon(int pidfile_fd, int devnull_fd) { @@ -607,7 +608,8 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, #endif } -/* write_all_buf() - write all of a buffer to an fd +/** + * write_all_buf() - write all of a buffer to an fd * @fd: File descriptor * @buf: Pointer to base of buffer * @len: Length of buffer @@ -637,7 +639,8 @@ int write_all_buf(int fd, const void *buf, size_t len) return 0; } -/* write_remainder() - write the tail of an IO vector to an fd +/** + * write_remainder() - write the tail of an IO vector to an fd * @fd: File descriptor * @iov: IO vector * @iovcnt: Number of entries in @iov -- 2.49.0

2 1

[PATCH] flow, repair: Proper error handling for missing passt-repair helper on target
by Stefano Brivio 04 Jun '25

04 Jun '25

If the target doesn't have a connected passt-repair helper, repair_wait() sets a timeout and forcibly calls accept4(), but if the timeout expires, we don't report any error and proceed as if we had a connected helper. Later, in repair_flush(), sendmsg() will fail for each flow we try to migrate with EBADF, and we'll handle that gracefully, but it makes no sense to even try, and it also leads to noise in the logs. Similarly to how we handle a missing repair helper in flow_migrate_repair_all(), propagate timeout and other errors through repair_wait(), and don't attempt to migrate flows if repair_wait() failed. Fixes: c8b520c0625b ("flow, repair: Wait for a short while for passt-repair to connect") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- flow.c | 3 ++- repair.c | 38 ++++++++++++++++++++++++++++---------- repair.h | 4 ++-- 3 files changed, 32 insertions(+), 13 deletions(-) diff --git a/flow.c b/flow.c index cc05033..da5c813 100644 --- a/flow.c +++ b/flow.c @@ -1130,7 +1130,8 @@ int flow_migrate_target(struct ctx *c, const struct migrate_stage *stage, if (!count) return 0; - repair_wait(c); + if ((rc = repair_wait(c))) + return -rc; if ((rc = flow_migrate_repair_all(c, true))) return -rc; diff --git a/repair.c b/repair.c index 149fe51..f6b1bf3 100644 --- a/repair.c +++ b/repair.c @@ -68,18 +68,21 @@ void repair_sock_init(const struct ctx *c) * repair_listen_handler() - Handle events on TCP_REPAIR helper listening socket * @c: Execution context * @events: epoll events + * + * Return: 0 on valid event with new connected socket, error code on failure */ -void repair_listen_handler(struct ctx *c, uint32_t events) +int repair_listen_handler(struct ctx *c, uint32_t events) { union epoll_ref ref = { .type = EPOLL_TYPE_REPAIR }; struct epoll_event ev = { 0 }; struct ucred ucred; socklen_t len; + int rc; if (events != EPOLLIN) { debug("Spurious event 0x%04x on TCP_REPAIR helper socket", events); - return; + return EINVAL; } len = sizeof(ucred); @@ -90,18 +93,19 @@ void repair_listen_handler(struct ctx *c, uint32_t events) SOCK_NONBLOCK); if (discard == -1) - return; + return errno; if (!getsockopt(discard, SOL_SOCKET, SO_PEERCRED, &ucred, &len)) info("Discarding TCP_REPAIR helper, PID %i", ucred.pid); close(discard); - return; + return EEXIST; } if ((c->fd_repair = accept4(c->fd_repair_listen, NULL, NULL, 0)) < 0) { + rc = errno; debug_perror("accept4() on TCP_REPAIR helper listening socket"); - return; + return rc; } if (!getsockopt(c->fd_repair, SOL_SOCKET, SO_PEERCRED, &ucred, &len)) @@ -111,10 +115,14 @@ void repair_listen_handler(struct ctx *c, uint32_t events) ev.events = EPOLLHUP | EPOLLET; ev.data.u64 = ref.u64; if (epoll_ctl(c->epollfd, EPOLL_CTL_ADD, c->fd_repair, &ev)) { + rc = errno; debug_perror("epoll_ctl() on TCP_REPAIR helper socket"); close(c->fd_repair); c->fd_repair = -1; + return rc; } + + return 0; } /** @@ -145,29 +153,39 @@ void repair_handler(struct ctx *c, uint32_t events) /** * repair_wait() - Wait (with timeout) for TCP_REPAIR helper to connect * @c: Execution context + * + * Return: 0 on success or if already connected, error code on failure */ -void repair_wait(struct ctx *c) +int repair_wait(struct ctx *c) { struct timeval tv = { .tv_sec = 0, .tv_usec = (long)(REPAIR_ACCEPT_TIMEOUT_US) }; + int rc; + static_assert(REPAIR_ACCEPT_TIMEOUT_US < 1000 * 1000, ".tv_usec is greater than 1000 * 1000"); - if (c->fd_repair >= 0 || c->fd_repair_listen == -1) - return; + if (c->fd_repair >= 0) + return 0; + + if (c->fd_repair_listen == -1) + return ENOENT; if (setsockopt(c->fd_repair_listen, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) { + rc = errno; err_perror("Set timeout on TCP_REPAIR listening socket"); - return; + return rc; } - repair_listen_handler(c, EPOLLIN); + rc = repair_listen_handler(c, EPOLLIN); tv.tv_usec = 0; if (setsockopt(c->fd_repair_listen, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) err_perror("Clear timeout on TCP_REPAIR listening socket"); + + return rc; } /** diff --git a/repair.h b/repair.h index 1d37922..ab27e67 100644 --- a/repair.h +++ b/repair.h @@ -7,10 +7,10 @@ #define REPAIR_H void repair_sock_init(const struct ctx *c); -void repair_listen_handler(struct ctx *c, uint32_t events); +int repair_listen_handler(struct ctx *c, uint32_t events); void repair_handler(struct ctx *c, uint32_t events); void repair_close(struct ctx *c); -void repair_wait(struct ctx *c); +int repair_wait(struct ctx *c); int repair_flush(struct ctx *c); int repair_set(struct ctx *c, int s, int cmd); -- 2.43.0

1 0

[PATCH] fedora: Depend on SELinux tools and policy version, drop circular dependency
by Stefano Brivio 04 Jun '25

04 Jun '25

From: Vit Mojzis <vmojzis(a)redhat.com> From an original patch by Vit Mojzis: add dependencies on SELinux userspace tools and recommend the latest available version of the policy as of now. Drop circular dependency between passt and passt-selinux: passt requires passt-selinux, so passt-selinux shouldn't require passt. Link: https://src.fedoraproject.org/rpms/passt/pull-request/3 Signed-off-by: Vit Mojzis <vmojzis(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 0abb2fa..e7feaf8 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -9,6 +9,7 @@ %global git_hash {{{ git_head }}} %global selinuxtype targeted +%global selinux_policy_version 41.41 Name: passt Version: {{{ git_version }}} @@ -33,15 +34,17 @@ for network namespaces: traffic is forwarded using a tap interface inside the namespace, without the need to create further interfaces on the host, hence not requiring any capabilities or privileges. -%package selinux -BuildArch: noarch -Summary: SELinux support for passt and pasta -Requires: %{name} = %{version}-%{release} -Requires: selinux-policy -Requires(post): %{name} -Requires(post): policycoreutils -Requires(preun): %{name} -Requires(preun): policycoreutils +%package selinux +BuildArch: noarch +Summary: SELinux support for passt and pasta +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +Requires(post): policycoreutils +Requires(post): libselinux-utils +Requires(preun): policycoreutils +BuildRequires: selinux-policy-devel +BuildRequires: pkgconfig(systemd) +Recommends: selinux-policy-%{selinuxtype} >= %{selinux_policy_version} %description selinux This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1). -- 2.43.0

1 0

[PATCH] fedora: Call %selinux_modules_* macros only once
by Stefano Brivio 04 Jun '25

04 Jun '25

From: Petr Lautrbach <lautrbach(a)redhat.com> %selinux_modules_* macros has `-i %*` so that it can be used for multiple modules at once. This will improve the performace of the package (un)installation. $ sudo time -p rpm --reinstall passt-selinux-0\^20250512.g8ec1341-1.fc42.noarch.rpm real 49.09 user 44.16 sys 4.37 $ sudo time -p rpm --reinstall results_passt/0\^20250512.g8ec1341/2.fc43/passt-selinux-0\^20250512.g8ec1341-2.fc43.noarch.rpm real 17.03 user 15.06 sys 1.83 Reported-by: Richard W.M. Jones <rjones(a)redhat.com> Link: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… Link: https://src.fedoraproject.org/rpms/passt/pull-request/2 Signed-off-by: Petr Lautrbach <lautrbach(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 5aaf7ac..0abb2fa 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -89,15 +89,11 @@ popd %selinux_relabel_pre -s %{selinuxtype} %post selinux -%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp -%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp -%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp %{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp %postun selinux if [ $1 -eq 0 ]; then - %selinux_modules_uninstall -s %{selinuxtype} passt - %selinux_modules_uninstall -s %{selinuxtype} pasta - %selinux_modules_uninstall -s %{selinuxtype} passt-repair + %selinux_modules_uninstall -s %{selinuxtype} passt pasta passt-repair fi %posttrans selinux -- 2.43.0

1 0

[PATCH] passt-repair: Fix missing newlines in error messages
by Stefano Brivio 04 Jun '25

04 Jun '25

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt-repair.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/passt-repair.c b/passt-repair.c index ff1c44f..8c59d7e 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -83,7 +83,7 @@ int main(int argc, char **argv) prog.filter = filter_repair; if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { - fprintf(stderr, "Failed to apply seccomp filter"); + fprintf(stderr, "Failed to apply seccomp filter\n"); _exit(1); } @@ -134,13 +134,13 @@ int main(int argc, char **argv) n = read(fd, buf, sizeof(buf)); if (n < 0) { - fprintf(stderr, "inotify read: %i", errno); + fprintf(stderr, "inotify read: %i\n", errno); _exit(1); } buf[n - 1] = '\0'; if (n < (ssize_t)sizeof(*ev)) { - fprintf(stderr, "Short inotify read: %zi", n); + fprintf(stderr, "Short inotify read: %zi\n", n); continue; } @@ -176,7 +176,7 @@ int main(int argc, char **argv) } if (ret <= 0 || ret >= (int)sizeof(a.sun_path)) { - fprintf(stderr, "Invalid socket path"); + fprintf(stderr, "Invalid socket path\n"); _exit(2); } @@ -245,8 +245,8 @@ loop: for (i = 0; i < n; i++) { if (setsockopt(fds[i], SOL_TCP, TCP_REPAIR, &op, sizeof(op))) { fprintf(stderr, - "Setting TCP_REPAIR to %i on socket %i: %s", op, - fds[i], strerror(errno)); + "Setting TCP_REPAIR to %i on socket %i: %s\n", + op, fds[i], strerror(errno)); _exit(1); } -- 2.43.0

2 1

[PATCH v5 00/29] Introduce discontiguous frames management
by Laurent Vivier 03 Jun '25

03 Jun '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (29): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool packet: use buf to store iovec array arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 47 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 142 +++++++++++++++++++++++++++++--- iov.h | 59 ++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 13 ++- ndp.h | 4 +- packet.c | 223 ++++++++++++++++++++++++++++++++++++++------------- packet.h | 56 ++++++------- pcap.c | 1 + tap.c | 132 +++++++++++++++++------------- tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 8 +- vu_common.c | 46 ++++------- 26 files changed, 823 insertions(+), 429 deletions(-) -- 2.49.0

2 54

[PATCH] fedora: Separately restore context for /run/user in %posttrans selinux
by Stefano Brivio 24 May '25

24 May '25

The previous change introduces specific file contexts for /run/user/%{USERID}/netns and /run/user/%{USERID}/containers/networks/rootless-netns, but %selinux_relabel_post can't handle that, see comments for more details. Add a separate restorecon(8) call for /run/user in the post-transaction scriptlet for the SELinux subpackage. Reported-by: Max Chernoff <git(a)maxchernoff.ca> Link: https://bugs.passt.top/show_bug.cgi?id=81 Link: https://github.com/containers/podman/discussions/26100#discussioncomment-13… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This should be applied on top of Max's: [PATCH v3 1/1] selinux: Transition to pasta_t in containers contrib/fedora/passt.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 745cf01..5aaf7ac 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -102,6 +102,12 @@ fi %posttrans selinux %selinux_relabel_post -s %{selinuxtype} +# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file +# (see selabel_file(5)) in order to restore only the file contexts which +# actually changed. However, as file_contexts doesn't support %{USERID} +# substitutions, this will not work for specific file contexts that pasta needs +# to have under /run/user. Restore those explicitly. +restorecon -R /run/user %files %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} -- 2.43.0

2 3

[PATCH] tap: Avoid bogus missingReturn cppcheck warning in tap_l2_max_len()
by Stefano Brivio 19 May '25

19 May '25

Cppcheck 2.14.2 on Alpine Linux (musl) says that: tap.c:111:19: error: Found an exit path from function with non-void return type that has missing return statement [missingReturn] switch (c->mode) { ^ This exit path is not reachable because we ASSERT(0) after the switch, but for some reason cppcheck doesn't see this with musl headers. Hide the warning with a redundant return statement. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tap.c b/tap.c index d630f6d..6db5d88 100644 --- a/tap.c +++ b/tap.c @@ -118,6 +118,8 @@ unsigned long tap_l2_max_len(const struct ctx *c) } /* NOLINTEND(bugprone-branch-clone) */ ASSERT(0); + + return 0; /* Unreachable, for cppcheck's sake */ } /** -- 2.43.0

2 4

[PATCH 0/3] Standardize and correct function comment headers
by Laurent Vivier 16 May '25

16 May '25

This series cleans up function comment headers in iov, virtio, and vhost_user modules for improved consistency and accuracy. The following changes are included: iov: Standardize function comment headers (Ensures /** and func_name() syntax for uniformity) virtio: Correct and align comment headers (Addresses format, typos, tags, param names in .c/.h) vhost_user: Correct and align function comment headers (Corrects params, func names in comments, & docs in .c) Full details can be found in the individual patch descriptions. Laurent Vivier (3): vhost_user: Correct and align function comment headers virtio: Correct and align comment headers iov: Standardize function comment headers iov.c | 15 ++-- vhost_user.c | 221 +++++++++++++++++++++++++-------------------------- vhost_user.h | 2 +- virtio.c | 29 ++++--- virtio.h | 4 +- 5 files changed, 137 insertions(+), 134 deletions(-) -- 2.49.0

2 4

[PATCH] codespell: Correct typos in comments and error message
by Laurent Vivier 16 May '25

16 May '25

This commit addresses several spelling errors identified by the `codespell` tool. The corrections apply to: - Code comments in `fwd.c`, `ip.h`, `isolation.c`, and `log.c`. - An error message string in `vhost_user.c`. Specifically, the following misspellings were corrected: - "adddress" to "address" - "capabilites" to "capabilities" - "Musn't" to "Mustn't" - "calculatd" to "calculated" - "Invalide" to "Invalid" Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- fwd.c | 2 +- ip.h | 2 +- isolation.c | 8 ++++---- log.c | 2 +- vhost_user.c | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/fwd.c b/fwd.c index 49aabc34aa18..250cf5640b85 100644 --- a/fwd.c +++ b/fwd.c @@ -418,7 +418,7 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, else tgt->eaddr = inany_loopback6; - /* Preserve the specific loopback adddress used, but let the kernel pick + /* Preserve the specific loopback address used, but let the kernel pick * a source port on the target side */ tgt->oaddr = ini->eaddr; diff --git a/ip.h b/ip.h index 471c57ee4c71..24509d9c11cd 100644 --- a/ip.h +++ b/ip.h @@ -118,7 +118,7 @@ static inline uint32_t ip6_get_flow_lbl(const struct ipv6hdr *ip6h) char *ipv6_l4hdr(const struct pool *p, int idx, size_t offset, uint8_t *proto, size_t *dlen); -/* IPv6 link-local all-nodes multicast adddress, ff02::1 */ +/* IPv6 link-local all-nodes multicast address, ff02::1 */ static const struct in6_addr in6addr_ll_all_nodes = { .s6_addr = { 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, diff --git a/isolation.c b/isolation.c index c944fb35c3a4..bbcd23b72271 100644 --- a/isolation.c +++ b/isolation.c @@ -129,7 +129,7 @@ static void drop_caps_ep_except(uint64_t keep) * additional layer of protection. Executing this requires * CAP_SETPCAP, which we will have within our userns. * - * Note that dropping capabilites from the bounding set limits + * Note that dropping capabilities from the bounding set limits * exec()ed processes, but does not remove them from the effective or * permitted sets, so it doesn't reduce our own capabilities. */ @@ -174,8 +174,8 @@ static void clamp_caps(void) * Should: * - drop unneeded capabilities * - close all open files except for standard streams and the one from --fd - * Musn't: - * - remove filesytem access (we need to access files during setup) + * Mustn't: + * - remove filesystem access (we need to access files during setup) */ void isolate_initial(int argc, char **argv) { @@ -194,7 +194,7 @@ void isolate_initial(int argc, char **argv) * * It's debatable whether it's useful to drop caps when we * retain SETUID and SYS_ADMIN, but we might as well. We drop - * further capabilites in isolate_user() and + * further capabilities in isolate_user() and * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | diff --git a/log.c b/log.c index d40d7ae2a92c..5d7d76f68b2e 100644 --- a/log.c +++ b/log.c @@ -402,7 +402,7 @@ void __setlogmask(int mask) * logfile_init() - Open log file and write header with PID, version, path * @name: Identifier for header: passt or pasta * @path: Path to log file - * @size: Maximum size of log file: log_cut_size is calculatd here + * @size: Maximum size of log file: log_cut_size is calculated here */ void logfile_init(const char *name, const char *path, size_t size) { diff --git a/vhost_user.c b/vhost_user.c index 105f77a5df2b..ca36763cabaf 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -1021,7 +1021,7 @@ static bool vu_set_device_state_fd_exec(struct vu_dev *vdev, if (direction != VHOST_USER_TRANSFER_STATE_DIRECTION_SAVE && direction != VHOST_USER_TRANSFER_STATE_DIRECTION_LOAD) - die("Invalide device_state_fd direction: %d", direction); + die("Invalid device_state_fd direction: %d", direction); migrate_request(vdev->context, msg->fds[0], direction == VHOST_USER_TRANSFER_STATE_DIRECTION_LOAD); -- 2.49.0

2 1