- dev - passt

[PATCH v3] dhcp, dhcpv6: Add hostname and client fqdn ops
by Enrique Llorente 02 Dec '24

02 Dec '24

Both DHCPv4 and DHCPv6 has the capability to pass the hostname to clients, the DHCPv4 uses option 12 (hostname) while the DHCPv6 uses option 39 (client fqdn), for some virt deployments like kubevirt is expected to have the VirtualMachine name as the guest hostname. This change add the following arguments: - -H --hostname NAME to configure the hostname DHCPv4 option(12) - --fqdn NAME to configure client fqdn option for both DHCPv4(81) and DHCPv6(39) Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- conf.c | 23 ++++++++++++++++++++--- dhcp.c | 15 ++++++++++++++- dhcpv6.c | 44 +++++++++++++++++++++++++++++++++++++++++++- passt.h | 4 ++++ test/lib/setup | 10 +++++----- test/passt.mbuto | 6 ++++-- test/passt/dhcp | 17 ++++++++++++++++- util.c | 21 +++++++++++++++++++++ util.h | 2 ++ 9 files changed, 129 insertions(+), 13 deletions(-) diff --git a/conf.c b/conf.c index 86566db..e9cf491 100644 --- a/conf.c +++ b/conf.c @@ -849,7 +849,9 @@ static void usage(const char *name, FILE *f, int status) " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" - " -6, --ipv6-only Enable IPv6 operation only\n"); + " -6, --ipv6-only Enable IPv6 operation only\n" + " -H, --hostname NAME Hostname to configure client with\n" + " --fqdn NAME The FQDN to configure client with\n"); if (strstr(name, "pasta")) goto pasta_opts; @@ -1266,6 +1268,7 @@ void conf(struct ctx *c, int argc, char **argv) {"outbound", required_argument, NULL, 'o' }, {"dns", required_argument, NULL, 'D' }, {"search", required_argument, NULL, 'S' }, + {"hostname", required_argument, NULL, 'H' }, {"no-tcp", no_argument, &c->no_tcp, 1 }, {"no-udp", no_argument, &c->no_udp, 1 }, {"no-icmp", no_argument, &c->no_icmp, 1 }, @@ -1305,6 +1308,7 @@ void conf(struct ctx *c, int argc, char **argv) {"map-guest-addr", required_argument, NULL, 22 }, {"host-lo-to-ns-lo", no_argument, NULL, 23 }, {"dns-host", required_argument, NULL, 24 }, + {"fqdn", required_argument, NULL, 25 }, { 0 }, }; const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; @@ -1327,9 +1331,9 @@ void conf(struct ctx *c, int argc, char **argv) if (c->mode == MODE_PASTA) { c->no_dhcp_dns = c->no_dhcp_dns_search = 1; fwd_default = FWD_AUTO; - optstring = "+dqfel:hF:I:p:P:m:a:n:M:g:i:o:D:S:46t:u:T:U:"; + optstring = "+dqfel:hF:I:p:P:m:a:n:M:g:i:o:D:S:H:46t:u:T:U:"; } else { - optstring = "+dqfel:hs:F:p:P:m:a:n:M:g:i:o:D:S:461t:u:"; + optstring = "+dqfel:hs:F:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:"; } c->tcp.fwd_in.mode = c->tcp.fwd_out.mode = FWD_UNSET; @@ -1682,6 +1686,19 @@ void conf(struct ctx *c, int argc, char **argv) c->one_off = true; break; + case 'H': + ret = snprintf(c->hostname.n, sizeof(c->hostname.n), + "%s", optarg); + if (ret <= 0 || ret >= (int)sizeof(c->hostname.n)) + die("Invalid hostname: %s", optarg); + break; + case 25: + ret = snprintf(c->fqdn.n, sizeof(c->fqdn.n), + "%s", optarg); + if (ret <= 0 || ret >= (int)sizeof(c->fqdn.n)) + die("Invalid fqdn: %s", optarg); + break; + case 't': case 'u': case 'T': diff --git a/dhcp.c b/dhcp.c index a06f143..e05bfc6 100644 --- a/dhcp.c +++ b/dhcp.c @@ -275,7 +275,7 @@ static void opt_set_dns_search(const struct ctx *c, size_t max_len) */ int dhcp(const struct ctx *c, const struct pool *p) { - size_t mlen, dlen, offset = 0, opt_len, opt_off = 0; + size_t mlen, dlen, offset = 0, opt_len, opt_off = 0, hostname_len, fqdn_len = 0; char macstr[ETH_ADDRSTRLEN]; const struct ethhdr *eh; const struct iphdr *iph; @@ -375,6 +375,19 @@ int dhcp(const struct ctx *c, const struct pool *p) opts[6].slen += sizeof(uint32_t); } + hostname_len = strlen(c->hostname.n); + if ( hostname_len > 0 ) { + opts[12].slen = hostname_len; + memcpy(opts[12].s, &c->hostname.n, hostname_len); + } + + fqdn_len = strlen(c->fqdn.n); + if ( fqdn_len > 0 ) { + opts[81].slen = fqdn_len+3; + memcpy(opts[81].s+3, &c->fqdn.n, fqdn_len); + } + + if (!c->no_dhcp_dns_search) opt_set_dns_search(c, sizeof(m->o)); diff --git a/dhcpv6.c b/dhcpv6.c index 0523bba..88c0978 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -48,6 +48,7 @@ struct opt_hdr { # define STATUS_NOTONLINK htons_constant(4) # define OPT_DNS_SERVERS htons_constant(23) # define OPT_DNS_SEARCH htons_constant(24) +# define OPT_CLIENT_FQDN htons_constant(39) #define STR_NOTONLINK "Prefix not appropriate for link." uint16_t l; @@ -163,6 +164,18 @@ struct opt_dns_search { char list[MAXDNSRCH * NS_MAXDNAME]; } __attribute__((packed)); +/** + * struct opt_client_fqdn - Client FQDN option (RFC 4704) + * @hdr: Option header + * @flags: Flags as stated at RFC 4704 (always zero for us) + * @fqdn: Client fqdn + */ +struct opt_client_fqdn{ + struct opt_hdr hdr; + uint8_t flags; + char domain_name[253 /*RFC 1035*/ ]; +} __attribute__((packed)); + /** * struct msg_hdr - DHCPv6 client/server message header * @type: DHCP message type @@ -193,6 +206,7 @@ struct msg_hdr { * @client_id: Client Identifier, variable length * @dns_servers: DNS Recursive Name Server, here just for storage size * @dns_search: Domain Search List, here just for storage size + * @client_fqdn: Client FQDN, variable length */ static struct resp_t { struct msg_hdr hdr; @@ -203,10 +217,10 @@ static struct resp_t { struct opt_client_id client_id; struct opt_dns_servers dns_servers; struct opt_dns_search dns_search; + struct opt_client_fqdn client_fqdn; } __attribute__((__packed__)) resp = { { 0 }, SERVER_ID, - { { OPT_IA_NA, OPT_SIZE_CONV(sizeof(struct opt_ia_na) + sizeof(struct opt_ia_addr) - sizeof(struct opt_hdr)) }, @@ -228,6 +242,10 @@ static struct resp_t { { { OPT_DNS_SEARCH, 0, }, { 0 }, }, + + { { OPT_CLIENT_FQDN, 0, }, + 0, { 0 }, + }, }; static const struct opt_status_code sc_not_on_link = { @@ -411,6 +429,29 @@ search: return offset; } +/** + * dhcpv6_client_fqdn_fill() - Fill in client FQDN option + * @c: Execution context + * @buf: Response message buffer where options will be appended + * @offset: Offset in message buffer for new options + * + * Return: updated length of response message buffer. + */ +static size_t dhcpv6_client_fqdn_fill(const struct ctx *c, char *buf, int offset) +{ + uint16_t fqdn_len = strlen(c->fqdn.n); + if (fqdn_len > 0) { + struct opt_client_fqdn *o = (struct opt_client_fqdn *)(buf + offset); + size_t encoded_fqdn_len = encode_domain_name(c->fqdn.n, fqdn_len, o->domain_name); + size_t opt_len = encoded_fqdn_len + 1; + o->hdr.t = OPT_CLIENT_FQDN; + o->hdr.l = htons(opt_len); + o->flags = 0x00; + offset += sizeof(struct opt_hdr) + opt_len; + } + return offset; +} + /** * dhcpv6() - Check if this is a DHCPv6 message, reply as needed * @c: Execution context @@ -544,6 +585,7 @@ int dhcpv6(struct ctx *c, const struct pool *p, n = offsetof(struct resp_t, client_id) + sizeof(struct opt_hdr) + ntohs(client_id->l); n = dhcpv6_dns_fill(c, (char *)&resp, n); + n = dhcpv6_client_fqdn_fill(c, (char*)&resp, n); resp.hdr.xid = mh->xid; diff --git a/passt.h b/passt.h index 72c7f72..566d21d 100644 --- a/passt.h +++ b/passt.h @@ -205,6 +205,8 @@ struct ip6_ctx { * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list + * @hostname: Client hostname + * @fqdn: Client FQDN * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta @@ -262,6 +264,8 @@ struct ctx { struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; + struct fqdn hostname; + struct fqdn fqdn; unsigned int ifi6; struct ip6_ctx ip6; diff --git a/test/lib/setup b/test/lib/setup index 5338393..a3fe578 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -49,7 +49,7 @@ setup_passt() { context_run passt "make clean" context_run passt "make valgrind" - context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt ${__opts} -s ${STATESETUP}/passt.socket -f -t 10001 -u 10001 -P ${STATESETUP}/passt.pid" + context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt ${__opts} -s ${STATESETUP}/passt.socket -f -t 10001 -u 10001 -H hostname1 --fqdn fqdn1.passt.top -P ${STATESETUP}/passt.pid" # pidfile isn't created until passt is listening wait_for [ -f "${STATESETUP}/passt.pid" ] @@ -146,11 +146,11 @@ setup_passt_in_ns() { if [ ${VALGRIND} -eq 1 ]; then context_run passt "make clean" context_run passt "make valgrind" - context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt -f ${__opts} -s ${STATESETUP}/passt.socket -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" + context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt -f ${__opts} -s ${STATESETUP}/passt.socket -H hostname1 --fqdn fqdn1.passt.top -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" else context_run passt "make clean" context_run passt "make" - context_run_bg passt "./passt -f ${__opts} -s ${STATESETUP}/passt.socket -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" + context_run_bg passt "./passt -f ${__opts} -s ${STATESETUP}/passt.socket -H hostname1 --fqdn fqdn1.passt.top -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" fi wait_for [ -f "${STATESETUP}/passt.pid" ] @@ -215,7 +215,7 @@ setup_two_guests() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt_1 "./passt -s ${STATESETUP}/passt_1.socket -P ${STATESETUP}/passt_1.pid -f ${__opts} -t 10001 -u 10001" + context_run_bg passt_1 "./passt -s ${STATESETUP}/passt_1.socket -P ${STATESETUP}/passt_1.pid -f ${__opts} --fqdn fqdn1.passt.top -H hostname1 -t 10001 -u 10001" wait_for [ -f "${STATESETUP}/passt_1.pid" ] __opts= @@ -223,7 +223,7 @@ setup_two_guests() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt_2 "./passt -s ${STATESETUP}/passt_2.socket -P ${STATESETUP}/passt_2.pid -f ${__opts} -t 10004 -u 10004" + context_run_bg passt_2 "./passt -s ${STATESETUP}/passt_2.socket -P ${STATESETUP}/passt_2.pid -f ${__opts} --hostname hostname2 --fqdn fqdn2 -t 10004 -u 10004" wait_for [ -f "${STATESETUP}/passt_2.pid" ] GUEST_1_CID=94557 diff --git a/test/passt.mbuto b/test/passt.mbuto index 138d365..1e07693 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -13,7 +13,7 @@ PROGS="${PROGS:-ash,dash,bash ip mount ls insmod mkdir ln cat chmod lsmod modprobe find grep mknod mv rm umount jq iperf3 dhclient hostname sed tr chown sipcalc cut socat dd strace ping tail killall sleep sysctl - nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp}" + nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp env}" # OpenSSH 9.8 introduced split binaries, with sshd being the daemon, and # sshd-session the per-session program. We need the latter as well, and the path @@ -41,6 +41,7 @@ FIXUP="${FIXUP}"' #!/bin/sh LOG=/var/log/dhclient-script.log echo \${reason} \${interface} >> \$LOG +env >> \$LOG set >> \$LOG [ -n "\${new_interface_mtu}" ] && ip link set dev \${interface} mtu \${new_interface_mtu} @@ -54,7 +55,8 @@ set >> \$LOG [ -n "\${new_ip6_address}" ] && ip addr add \${new_ip6_address}/\${new_ip6_prefixlen} dev \${interface} [ -n "\${new_dhcp6_name_servers}" ] && for d in \${new_dhcp6_name_servers}; do echo "nameserver \${d}%\${interface}" >> /etc/resolv.conf; done [ -n "\${new_dhcp6_domain_search}" ] && (printf "search"; for d in \${new_dhcp6_domain_search}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf -[ -n "\${new_host_name}" ] && hostname "\${new_host_name}" +[ -n "\${new_host_name}" ] && echo "\${new_host_name}" > /tmp/new_host_name +[ -n "\${new_fqdn_fqdn}" ] && echo "\${new_fqdn_fqdn}" > /tmp/new_fqdn_fqdn exit 0 EOF chmod 755 /sbin/dhclient-script diff --git a/test/passt/dhcp b/test/passt/dhcp index 9925ab9..f947fd1 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -11,7 +11,7 @@ # Copyright (c) 2021 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -gtools ip jq dhclient sed tr +gtools ip jq dhclient sed tr hostname htools ip jq sed tr head test Interface name @@ -22,6 +22,7 @@ check [ -n "__IFNAME__" ] test DHCP: address guest /sbin/dhclient -4 __IFNAME__ +guest cat /var/log/dhclient-script.log gout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME__").addr_info[0].local' check [ "__ADDR__" = "__HOST_ADDR__" ] @@ -47,10 +48,20 @@ gout SEARCH sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^searc hout HOST_SEARCH sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' check [ "__SEARCH__" = "__HOST_SEARCH__" ] +test DHCP: Hostname +gout NEW_HOST_NAME cat /tmp/new_host_name +check [ "__NEW_HOST_NAME__" = "hostname1" ] + +test DHCP: Client FQDN +gout NEW_FQDN_FQDN cat /tmp/new_fqdn_fqdn +check [ "__NEW_FQDN_FQDN__" = "fqdn1.passt.top" ] + test DHCPv6: address +guest rm /tmp/new_fqdn_fqdn guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done +guest cat /var/log/dhclient-script.log gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] @@ -70,3 +81,7 @@ test DHCPv6: search list gout SEARCH6 sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' hout HOST_SEARCH6 sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' check [ "__SEARCH6__" = "__HOST_SEARCH6__" ] + +test DHCPv6: Hostname +gout NEW_FQDN_FQDN cat /tmp/new_fqdn_fqdn +check [ "__NEW_FQDN_FQDN__" = "fqdn1.passt.top" ] diff --git a/util.c b/util.c index 55cae3f..b38aec7 100644 --- a/util.c +++ b/util.c @@ -837,3 +837,24 @@ void raw_random(void *buf, size_t buflen) if (random_read < buflen) die("Unexpected EOF on random data source"); } +/** + * encode_domain_name() - Encoding domain names according to RFC 3315 sec 8 + * @domain_name: Input domain name to encode + * @len: Domain name length + * @buf: Buffer to fill in with encoded domain name + * + * Returns: encoded domain name length + */ + +size_t encode_domain_name(const char* domain_name, size_t len, char* buf){ + buf[0] = strcspn(domain_name, "."); + char* p = buf + 1; + for (size_t i = 0; i < len; i++) { + if (domain_name[i] == '.') { + p[i] = strcspn(domain_name + i + 1, "."); + } else { + p[i] = domain_name[i]; + } + } + return len + 2; +} diff --git a/util.h b/util.h index 90428c4..8001ebb 100644 --- a/util.h +++ b/util.h @@ -305,4 +305,6 @@ static inline int wrap_accept4(int sockfd, struct sockaddr *addr, #define accept4(s, addr, addrlen, flags) \ wrap_accept4((s), (addr), (addrlen), (flags)) +size_t encode_domain_name(const char* domain_name, size_t len, char* buf); + #endif /* UTIL_H */ -- 2.47.0

3 3

[PATCH] pasta: make it possible to disable socket splicing
by Jon Maloy 29 Nov '24

29 Nov '24

During testing it is sometimes useful to force traffic which would normally be forwarded by socket splicing through the tap interface. In this commit, we add a command switch making it possible to disable splicing for inbound local traffic. For outbound local traffic this seems to be much trickier, so I leave that for a possible later commit. Suggested-by: David Gibson <dgibson(a)redhat.com> Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- conf.c | 5 +++++ fwd.c | 2 +- passt.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index eaa7d99..8d58652 100644 --- a/conf.c +++ b/conf.c @@ -890,6 +890,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --no-splice Disable outbound socket splicing\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" @@ -1319,6 +1320,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"no-splice", no_argument, &c->no_splice, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, @@ -1756,6 +1758,9 @@ void conf(struct ctx *c, int argc, char **argv) } } while (name != -1); + if (c->mode == MODE_PASST) + c->no_splice = 1; + if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) die("--no-copy-routes needs --config-net"); diff --git a/fwd.c b/fwd.c index 0b7f8b1..2829cd2 100644 --- a/fwd.c +++ b/fwd.c @@ -443,7 +443,7 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, else if (proto == IPPROTO_UDP) tgt->eport += c->udp.fwd_in.delta[tgt->eport]; - if (c->mode == MODE_PASTA && inany_is_loopback(&ini->eaddr) && + if (!c->no_splice && inany_is_loopback(&ini->eaddr) && (proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { /* spliceable */ diff --git a/passt.h b/passt.h index c038630..0271e7c 100644 --- a/passt.h +++ b/passt.h @@ -291,6 +291,7 @@ struct ctx { int no_dhcpv6; int no_ndp; int no_ra; + int no_splice; int host_lo_to_ns_lo; int freebind; -- 2.45.2

3 5

[PATCH] perf/passt_vu_tcp: Make it shine
by Stefano Brivio 28 Nov '24

28 Nov '24

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/perf/passt_vu_tcp | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/test/perf/passt_vu_tcp b/test/perf/passt_vu_tcp index b434008..c4409b9 100644 --- a/test/perf/passt_vu_tcp +++ b/test/perf/passt_vu_tcp @@ -38,10 +38,10 @@ hout FREQ_PROCFS (echo "scale=1"; sed -n 's/cpu MHz.*: $[0-9]*$\..*$/(\1+10^2\ hout FREQ_CPUFREQ (echo "scale=1"; printf '( %i + 10^5 / 2 ) / 10^6\n' $(cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq) ) | bc -l hout FREQ [ -n "__FREQ_CPUFREQ__" ] && echo __FREQ_CPUFREQ__ || echo __FREQ_PROCFS__ -set THREADS 4 -set TIME 5 +set THREADS 6 +set TIME 2 set OMIT 0.1 -set OPTS -Z -P __THREADS__ -l 1M -O__OMIT__ -N +set OPTS -Z -P __THREADS__ -O__OMIT__ -N info Throughput in Gbps, latency in µs, __THREADS__ threads at __FREQ__ GHz report passt_vu tcp __THREADS__ __FREQ__ @@ -55,16 +55,16 @@ iperf3s ns 10002 bw - bw - guest ip link set dev __IFNAME__ mtu 1280 -iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 16M +iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 16M -l 1M bw __BW__ 1.2 1.5 guest ip link set dev __IFNAME__ mtu 1500 -iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 32M +iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 32M -l 1M bw __BW__ 1.6 1.8 guest ip link set dev __IFNAME__ mtu 9000 -iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 64M +iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 64M -l 1M bw __BW__ 4.0 5.0 guest ip link set dev __IFNAME__ mtu 65520 -iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 64M +iperf3 BW guest __MAP_NS6__ 10002 __TIME__ __OPTS__ -w 64M -l 1M bw __BW__ 7.0 8.0 iperf3k ns @@ -93,22 +93,22 @@ tr TCP throughput over IPv4: guest to host iperf3s ns 10002 guest ip link set dev __IFNAME__ mtu 256 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 2M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 2M -l 1M bw __BW__ 0.2 0.3 guest ip link set dev __IFNAME__ mtu 576 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 4M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 4M -l 1M bw __BW__ 0.5 0.8 guest ip link set dev __IFNAME__ mtu 1280 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 8M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 8M -l 1M bw __BW__ 1.2 1.5 guest ip link set dev __IFNAME__ mtu 1500 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 16M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 16M -l 1M bw __BW__ 1.6 1.8 guest ip link set dev __IFNAME__ mtu 9000 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 64M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 64M -l 1M bw __BW__ 4.0 5.0 guest ip link set dev __IFNAME__ mtu 65520 -iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 64M +iperf3 BW guest __MAP_NS4__ 10002 __TIME__ __OPTS__ -w 64M -l 1M bw __BW__ 7.0 8.0 iperf3k ns @@ -145,7 +145,7 @@ bw - bw - bw - bw - -iperf3 BW ns ::1 10001 __TIME__ __OPTS__ -w 32M +iperf3 BW ns ::1 10001 __TIME__ __OPTS__ -w 256M -l 16k bw __BW__ 6.0 6.8 iperf3k guest @@ -181,7 +181,7 @@ bw - bw - bw - bw - -iperf3 BW ns 127.0.0.1 10001 __TIME__ __OPTS__ -w 32M +iperf3 BW ns 127.0.0.1 10001 __TIME__ __OPTS__ -w 256M -l 16k bw __BW__ 6.0 6.8 iperf3k guest -- 2.43.0

1 0

[PATCH] tcp_vu: Compute IPv4 header checksum if dlen changes
by Laurent Vivier 28 Nov '24

28 Nov '24

In tcp_vu_data_from_sock() we compute IPv4 header checksum only for the first and the last packets, and re-use the first packet checksum for all the other packets as the content of the header doesn't change. It's more accurate to check the dlen value to know if the checksum should change as dlen is the only information that can change in the loop. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp_vu.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/tcp_vu.c b/tcp_vu.c index bbae918c3bb3..4e4e916ded78 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -381,12 +381,12 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) struct vu_dev *vdev = c->vdev; struct vu_virtq *vq = &vdev->vq[VHOST_USER_RX_QUEUE]; const struct flowside *tapside = TAPFLOW(conn); + ssize_t len, previous_dlen; size_t fillsize, hdrlen; int v6 = CONN_V6(conn); uint32_t already_sent; const uint16_t *check; int i, iov_cnt; - ssize_t len; if (!vu_queue_enabled(vq) || !vu_queue_started(vq)) { debug("Got packet, but RX virtqueue not usable yet"); @@ -460,19 +460,17 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) */ hdrlen = tcp_vu_hdrlen(v6); - for (i = 0, check = NULL; i < head_cnt; i++) { + for (i = 0, previous_dlen = -1, check = NULL; i < head_cnt; i++) { struct iovec *iov = &elem[head[i]].in_sg[0]; int buf_cnt = head[i + 1] - head[i]; ssize_t dlen = iov_size(iov, buf_cnt) - hdrlen; vu_set_vnethdr(vdev, iov->iov_base, buf_cnt); - /* we compute IPv4 header checksum only for the - * first and the last, all other checksums are the - * same as the first one - */ - if (i + 1 == head_cnt) + /* The IPv4 header checksum varies only with dlen */ + if (previous_dlen != dlen) check = NULL; + previous_dlen = dlen; tcp_vu_prepare(c, conn, iov->iov_base, dlen, &check); -- 2.47.0

2 1

[PATCH] Makefile: Use make internal string functions
by Laurent Vivier 28 Nov '24

28 Nov '24

TARGET_ARCH is computed from '$(CC) -dumpmachine' using external bash commands like echo, cut, tr and sed. This can be done using make internal string functions. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index cb7448079de5..1fce73707805 100644 --- a/Makefile +++ b/Makefile @@ -17,8 +17,9 @@ DUAL_STACK_SOCKETS := 1 TARGET ?= $(shell $(CC) -dumpmachine) # Get 'uname -m'-like architecture description for target -TARGET_ARCH := $(shell echo $(TARGET) | cut -f1 -d- | tr [A-Z] [a-z]) -TARGET_ARCH := $(shell echo $(TARGET_ARCH) | sed 's/powerpc/ppc/') +TARGET_ARCH := $(firstword $(subst -, ,$(TARGET))) +TARGET_ARCH := $(patsubst [:upper:],[:lower:],$(TARGET_ARCH)) +TARGET_ARCH := $(subst powerpc,ppc,$(TARGET_ARCH)) # On some systems enabling optimization also enables source fortification, # automagically. Do not override it. -- 2.47.0

3 2

[PATCH 0/7] TCP buffer handling cleanups (including vhost)
by David Gibson 28 Nov '24

28 Nov '24

Here's a current version of my IOV tail and some cleanups to TCP buffer handling based on it. Now rebased on top of v14 of the vhost-user patches. This was aimed at sharing more code between the "buffer" and vhost-user paths, but that turned out to be trickier than I anticipated, so it hasn't really been accomplished. Nonetheless I think these are reasonable cleanups on their own merits, and may yet make sharing some more code between the paths easier in future. David Gibson (7): iov: iov tail helpers iov, checksum: Replace csum_iov() with csum_iov_tail() tcp: Pass TCP header and payload separately to tcp_update_check_tcp[46]() tcp: Pass TCP header and payload separately to tcp_fill_headers[46]() tcp: Merge tcp_update_check_tcp[46]() tcp: Merge tcp_fill_headers[46]() with each other tcp_vu: Remove unnecessary tcp_vu_update_check() function checksum.c | 58 +++++-------- checksum.h | 8 +- iov.c | 91 ++++++++++++++++++++ iov.h | 76 ++++++++++++++++ tap.c | 6 +- tcp.c | 229 +++++++++++++------------------------------------ tcp_buf.c | 33 ++++--- tcp_internal.h | 21 ++--- tcp_vu.c | 120 ++++++++++---------------- udp.c | 7 +- udp_vu.c | 9 +- 11 files changed, 338 insertions(+), 320 deletions(-) -- 2.47.0

2 8

[PATCH] musl: fix conflict on ethhdr definition
by Laurent Vivier 27 Nov '24

27 Nov '24

there is a conflict between netinet/if_ether.h provided by musl and linux/if_ether.h provided by the linux headers: In file included from passt.h:185, from tcp_vu.c:21: /usr/include/netinet/if_ether.h:115:8: error: redefinition of 'struct ethhdr' 115 | struct ethhdr { | ^~~~~~ In file included from /usr/include/linux/virtio_net.h:32, from tcp_vu.c:17: /usr/include/linux/if_ether.h:173:8: note: originally defined here 173 | struct ethhdr { | ^~~~~~ The kernel headers provide a flag to disable the definition in this case, __UAPI_DEF_ETHHDR (see /usr/include/linux/if_ether.h comment). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Makefile b/Makefile index cb7448079de5..2aa56ada65fd 100644 --- a/Makefile +++ b/Makefile @@ -33,6 +33,9 @@ FLAGS += $(FORTIFY_FLAG) -O2 -pie -fPIE FLAGS += -DPAGE_SIZE=$(shell getconf PAGE_SIZE) FLAGS += -DVERSION=\"$(VERSION)\" FLAGS += -DDUAL_STACK_SOCKETS=$(DUAL_STACK_SOCKETS) +ifeq (musl, $(word 4,$(subst -, ,$(TARGET)))) +FLAGS += -D__UAPI_DEF_ETHHDR=0 +endif PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c flow.c fwd.c \ icmp.c igmp.c inany.c iov.c ip.c isolation.c lineread.c log.c mld.c \ -- 2.47.0

2 5

[PATCH] tcp_vu: Change 'dlen' to ssize_t in tcp_vu_data_from_sock()
by Stefano Brivio 27 Nov '24

27 Nov '24

...to quickly suppress a false positive from Coverity, which assumes that iov_size is 0 and 'dlen' might overflow as a result (with hdrlen being 66). An ASSERT() in tcp_vu_sock_recv() already guarantees that iov_size(iov, buf_cnt) here is anyway greater than 'hdrlen'. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This applies on top of "[PATCH] Fix build on 32bit target" tcp_vu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tcp_vu.c b/tcp_vu.c index 05e2d1d..a1510d9 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -462,7 +462,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) for (i = 0, check = NULL; i < head_cnt; i++) { struct iovec *iov = &elem[head[i]].in_sg[0]; int buf_cnt = head[i + 1] - head[i]; - int dlen = iov_size(iov, buf_cnt) - hdrlen; + ssize_t dlen = iov_size(iov, buf_cnt) - hdrlen; vu_set_vnethdr(vdev, iov->iov_base, buf_cnt); -- 2.43.0

2 1

passt: new version 2024_11_27.c0fbc7e available
by Stefano Brivio 27 Nov '24

27 Nov '24

The new version with tag 2024_11_27.c0fbc7e includes the following changes: c0fbc7e dhcp: Honour broadcast flag (RFC 2131, 4.1) 9da2038 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) d6e9e24 dhcp: Use -1 as "missing option" length instead of 0 14b84a7 treewide: Introduce 'local mode' for disconnected setups c6e6106 test: Improve logic for waiting for SLAAC & DAD to complete in NDP tests cda7f16 ndp: Don't send first periodic router advertisement right after guest connects 2bf8ffc test/perf: Select a single IPv6 namespace address in pasta tests 6819b2e conf, passt.1: Update --mac-addr default in usage() and man page b61be84 passt.1: Fix "default" note about --map-guest-addr https://passt.top/passt/log/?qt=range&q=2024_11_21.238c69f..2024_11_27.c0fb… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8318673/ permanent mirror: https://passt.top/builds/copr/0^20241127.gc0fbc7e/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc0fbc7e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c0fbc7e-1_all.deb -- Stefano

1 0

[PATCH v4] treewide: Introduce 'local mode' for disconnected setups
by Stefano Brivio 27 Nov '24

27 Nov '24

There are setups where no host interface is available or configured at all, intentionally or not, temporarily or not, but users expect (Podman) containers to run in any case as they did with slirp4netns, and we're now getting reports that we broke such setups at a rather alarming rate. To this end, if we don't find any usable host interface, instead of exiting: - for IPv4, use 169.254.2.1 as guest/container address and 169.254.2.2 as default gateway - for IPv6, don't assign any address (forcibly disable DHCPv6), and use the *first* link-local address we observe to represent the guest/container. Advertise fe80::1 as default gateway - use 'tap0' as default interface name for pasta Change ifi4 and ifi6 in struct ctx to int and accept a special -1 value meaning that no host interface was selected, but the IP family is enabled. The fact that the kernel uses unsigned int values for those is not an issue as 1. one can't create so many interfaces anyway and 2. we otherwise handle those values transparently. Fix a botched conditional in conf_print() to actually skip printing DHCPv6 information if DHCPv6 is disabled (and skip printing NDP information if NDP is disabled). Link: https://github.com/containers/podman/issues/24614 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v4: In conf(), leave the (*c->ip4.ifname_out && !c->ifi4) || (*c->ip6.ifname_out && !c->ifi6) case alone: there, the user gave outbound interfaces explicitly but we couldn't use them v3: Coverity reports that, in conf(), we might supply a negative c->ifi4 to if_indextoname() after checking that (!*c->pasta_ifn). That's a false positive, because if c->ifi4 is -1, we already set c->pasta_ifn to "tap0", so we won't call if_indextoname() at all, but, to make my life simpler, add a redundant check on c->ifi4 and c->ifi6 before calling if_indextoname() on them. v2: - drop fixed link-local address for IPv6 - change addresses to be reminiscent of libslirp's default choices - add man page changes and commit message - fix several things around, from testing (checked with several --map-guest-addr and --map-host-loopback combinations etc.) conf.c | 97 ++++++++++++++++++++++++++++++++++++++++++++------------- passt.1 | 33 +++++++++++++++++--- passt.h | 8 ++--- pasta.c | 7 +++-- tap.c | 3 ++ 5 files changed, 116 insertions(+), 32 deletions(-) diff --git a/conf.c b/conf.c index d342c8a..c6bffc4 100644 --- a/conf.c +++ b/conf.c @@ -48,6 +48,20 @@ #define NETNS_RUN_DIR "/run/netns" +#define IP4_LL_GUEST_ADDR (struct in_addr){ htonl_constant(0xa9fe0201) } + /* 169.254.2.1, libslirp default: 10.0.2.1 */ + +#define IP4_LL_GUEST_GW (struct in_addr){ htonl_constant(0xa9fe0202) } + /* 169.254.2.2, libslirp default: 10.0.2.2 */ + +#define IP4_LL_PREFIX_LEN 16 + +#define IP6_LL_GUEST_GW (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x01 }}} + +const char *pasta_default_ifn = "tap0"; + /** * next_chunk - Return the next piece of a string delimited by a character * @s: String to search @@ -631,7 +645,7 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("Couldn't pick external interface: disabling IPv4"); + debug("Failed to detect external interface for IPv4"); return 0; } @@ -639,8 +653,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_route_get_def(nl_sock, ifi, AF_INET, &ip4->guest_gw); if (rc < 0) { - err("Couldn't discover IPv4 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 gateway address: %s", + strerror(-rc)); return 0; } } @@ -649,8 +663,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_addr_get(nl_sock, ifi, AF_INET, &ip4->addr, &ip4->prefix_len, NULL); if (rc < 0) { - err("Couldn't discover IPv4 address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 address: %s", + strerror(-rc)); return 0; } } @@ -677,6 +691,19 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) return ifi; } +/** + * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode + * @ip4: IPv4 context (will be written) + */ +static void conf_ip4_local(struct ip4_ctx *ip4) +{ + ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; + ip4->prefix_len = IP4_LL_PREFIX_LEN; + + ip4->no_copy_addrs = ip4->no_copy_routes = true; +} + /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -693,15 +720,15 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("Couldn't pick external interface: disabling IPv6"); + debug("Failed to detect external interface for IPv6"); return 0; } if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) { rc = nl_route_get_def(nl_sock, ifi, AF_INET6, &ip6->guest_gw); if (rc < 0) { - err("Couldn't discover IPv6 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv6 gateway address: %s", + strerror(-rc)); return 0; } } @@ -710,7 +737,7 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { - err("Couldn't discover IPv6 address: %s", strerror(-rc)); + debug("Couldn't discover IPv6 address: %s", strerror(-rc)); return 0; } @@ -726,6 +753,17 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) return ifi; } +/** + * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode + * @ip6: IPv6 context (will be written) + */ +static void conf_ip6_local(struct ip6_ctx *ip6) +{ + ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + + ip6->no_copy_addrs = ip6->no_copy_routes = true; +} + /** * usage() - Print usage, exit with given status code * @name: Executable name @@ -948,12 +986,14 @@ static void conf_print(const struct ctx *c) char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; int i; - info("Template interface: %s%s%s%s%s", - c->ifi4 ? if_indextoname(c->ifi4, ifn) : "", - c->ifi4 ? " (IPv4)" : "", - (c->ifi4 && c->ifi6) ? ", " : "", - c->ifi6 ? if_indextoname(c->ifi6, ifn) : "", - c->ifi6 ? " (IPv6)" : ""); + if (c->ifi4 > 0 || c->ifi6 > 0) { + info("Template interface: %s%s%s%s%s", + c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", + c->ifi4 > 0 ? " (IPv4)" : "", + (c->ifi4 && c->ifi6) ? ", " : "", + c->ifi6 > 0 ? if_indextoname(c->ifi6, ifn) : "", + c->ifi6 > 0 ? " (IPv6)" : ""); + } if (*c->ip4.ifname_out || *c->ip6.ifname_out) { info("Outbound interface: %s%s%s%s%s", @@ -1024,9 +1064,9 @@ static void conf_print(const struct ctx *c) if (!c->no_ndp && !c->no_dhcpv6) info("NDP/DHCPv6:"); - else if (!c->no_ndp) - info("DHCPv6:"); else if (!c->no_dhcpv6) + info("DHCPv6:"); + else if (!c->no_ndp) info("NDP:"); else goto dns6; @@ -1733,10 +1773,23 @@ void conf(struct ctx *c, int argc, char **argv) c->ifi4 = conf_ip4(ifi4, &c->ip4); if (!v4_only) c->ifi6 = conf_ip6(ifi6, &c->ip6); - if ((!c->ifi4 && !c->ifi6) || - (*c->ip4.ifname_out && !c->ifi4) || + if ((*c->ip4.ifname_out && !c->ifi4) || (*c->ip6.ifname_out && !c->ifi6)) die("External interface not usable"); + if (!c->ifi4 && !c->ifi6) { + info("No external interface as template, switch to local mode"); + + conf_ip4_local(&c->ip4); + c->ifi4 = -1; + + conf_ip6_local(&c->ip6); + c->ifi6 = -1; + + if (!*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } + } if (c->ifi4 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) @@ -1840,6 +1893,8 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; + } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + c->no_dhcpv6 = 1; } if (!c->mtu) @@ -1848,9 +1903,9 @@ void conf(struct ctx *c, int argc, char **argv) get_dns(c); if (!*c->pasta_ifn) { - if (c->ifi4) + if (c->ifi4 > 0) if_indextoname(c->ifi4, c->pasta_ifn); - else + else if (c->ifi6 > 0) if_indextoname(c->ifi6, c->pasta_ifn); } diff --git a/passt.1 b/passt.1 index 059abd3..15c8338 100644 --- a/passt.1 +++ b/passt.1 @@ -160,7 +160,9 @@ once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces with the first default route, if any, for the corresponding IP version. If no default routes are available and there is any interface with any route for a -given IP version, the first of these interfaces will be chosen instead. +given IP version, the first of these interfaces will be chosen instead. If no +such interface exists, the link-local address 169.254.2.1 is assigned for IPv4, +and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -187,7 +189,9 @@ first default route, if any, for the corresponding IP version. If the default route is a multipath one, the gateway is the first nexthop router returned by the kernel which has the highest weight in the set of paths. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, the link-local +address 169.254.2.2 is used for IPv4, and the link-local address fe80::1 is used +for IPv6. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -202,7 +206,9 @@ Default is to use the interfaces specified by \fB--outbound-if4\fR and If no interfaces are given, the interface with the first default routes for each IP version is selected. If no default routes are available and there is just one -interface with any route, that interface will be chosen instead. +interface with any route, that interface will be chosen instead. If no such +interface exists, host interfaces will be ignored for the purposes of assigning +addresses and routes, and link-local addresses will be used instead. .TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -221,7 +227,8 @@ derive IPv4 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-\-outbound-if6 " " \fIname @@ -231,7 +238,8 @@ derive IPv6 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-D ", " \-\-dns " " \fIaddr @@ -503,6 +511,7 @@ Default is \fBnone\fR. .BR \-I ", " \-\-ns-ifname " " \fIname Name of tap interface to be created in target namespace. By default, the same interface name as the external, routable interface is used. +If no such interface exists, the name \fItap0\fR will be used instead. .TP .BR \-t ", " \-\-tcp-ports " " \fIspec @@ -1031,6 +1040,20 @@ If the sending window cannot be queried, it will always be announced as the current sending buffer size to guest or target namespace. This might affect throughput of TCP connections. +.SS Local mode for disconnected setups + +If \fBpasst\fR and \fBpasta\fR fail to find a host interface with a configured +address, other than loopback addresses, they will, obviously, not attempt to +source addresses or routes from the host. + +In this case, unless configured otherwise, they will assign the IPv4 link-local +address 169.254.2.1 to the guest or target namespace, and no IPv6 address. The +notion of the guest or target namespace IPv6 address is derived from the first +link-local address observed. + +Default gateways will be assigned as the link-local address 169.254.2.2 for +IPv4, and as the link-local address fe80::1 for IPv6. + .SH LIMITATIONS Currently, IGMP/MLD proxying (RFC 4605) and support for SCTP (RFC 4960) are not diff --git a/passt.h b/passt.h index 72c7f72..799ee50 100644 --- a/passt.h +++ b/passt.h @@ -202,10 +202,10 @@ struct ip6_ctx { * @our_tap_mac: Pasta/passt's MAC on the tap link * @guest_mac: MAC address of guest or namespace, seen or configured * @hash_secret: 128-bit secret for siphash functions - * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled + * @ifi4: Template interface for IPv4, -1: none, 0: IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list - * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled + * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta @@ -258,12 +258,12 @@ struct ctx { unsigned char guest_mac[ETH_ALEN]; uint64_t hash_secret[2]; - unsigned int ifi4; + int ifi4; struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; - unsigned int ifi6; + int ifi6; struct ip6_ctx ip6; char pasta_ifn[IF_NAMESIZE]; diff --git a/pasta.c b/pasta.c index a117704..96dacc3 100644 --- a/pasta.c +++ b/pasta.c @@ -369,8 +369,11 @@ void pasta_ns_conf(struct ctx *c) 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET6, &c->ip6.addr, 64); + if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 14d9b3d..5347df4 100644 --- a/tap.c +++ b/tap.c @@ -803,6 +803,9 @@ resume: if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) { c->ip6.addr_seen = *saddr; } + + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) + c->ip6.addr = *saddr; } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.43.0

2 2

2024

2023

2022

2021

dev