- dev - passt

[PATCH v2 1/6] passt: Always close pidfile_fd, not just when daemonizing
by David Gibson 17 Jul '26

17 Jul '26

In order to satisfy static checkers that we don't have an fd leak, a9c61ffaf153 added a close() of c->pidfile_fd, amongst others. However, it only close()s it in the case where we daemonize into the background. While less universally useful in the foreground / non-daemon case, it's perfectly reasonable to still have a pidfile. We'll still write it, and we should still close it. Cc: Jon Maloy <jmaloy(a)redhat.com> Fixes: a9c61ffaf153 ("util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/passt.c b/passt.c index 65a07d72..cc847ec2 100644 --- a/passt.c +++ b/passt.c @@ -420,11 +420,13 @@ int main(int argc, char **argv) if (!c->foreground) { __daemon(c->pidfile_fd, devnull_fd); - close(c->pidfile_fd); - c->pidfile_fd = -1; log_stderr = false; } else { pidfile_write(c->pidfile_fd, getpid()); + } + + if (c->pidfile_fd >= 0) { + close(c->pidfile_fd); c->pidfile_fd = -1; } -- 2.55.0

1 0

passt: new version 2026_07_16.090d739 available
by Stefano Brivio 17 Jul '26

17 Jul '26

The new version with tag 2026_07_16.090d739 includes the following changes: 090d739 passt.1, pesto.1: ::1 is an address, not a port 7d0c077 dhcp: Make option parsing more robust, explicitly handle options 0 and 255 10847ad CONTRIBUTING.md: The tag is "Link:", regardless of how many we have a3b9f86 udp_vu: Check iov_tail_clone() return before assigning to msg_iovlen 80cb5cf passt: Initialise listening socket fds to -1 fc6c774 fwd: Don't rewrite inbound multicast destinations 9013b59 fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() addd76d fwd: Rework default address logic for inbound flows 66fdabd udp: Validate that we have a unicast source address 26f2130 fwd: Clarify semantics of --host-lo-to-ns-lo fce9430 dhcpv6: Fix reply destination to match client's source address e74a7c2 selinux: Access to netns for podman-build, read access for netns in general 6ef3d1c isolation: Add --chroot-fallback option e67acde fwd, fwd_rule: Implement configurable target address mapping c8145c3 fwd_rule: Parse target addresses for forwarding rules bf21038 fwd_rule: Rewrite forward rule parsing using parse.c helpers 0581b0a fwd_rule: Allow "all" port specs to be combined with other options 289638b conf: Use new parsing tools to handle -a option b1d400f conf: Remove unnecessary mode checks from conf_addr() aaa0482 conf: Move address configuration into helper function 11f4fba parse: Add helpers for parsing IP addresses 4206913 parse: Move parse_port_range() to new parsing framework 8ffff9b parse: Add helper to parse unsigned integer values 9f8fcdc conf: Clean up conf_ip4_prefix() 2cdb27a conf: Remove duplicate parsing of -F option d29eb29 parse: Start splitting out parsing helpers cea54dd conf: Use parameter instead of global in conf_nat() e51a545 Makefile: Add missing PESTO_HEADERS variable edeb2a2 udp: Improve messages for errors getting errors 74863b0 flow, treewide: Promote priority of selected flow-linked messages 60cd39a flow, udp: Fix errno handling in udp_flow_sock() 780ba8a flow: Include flow details with higher priority log messages 2fbeb3b flow: Indent flow details messages d66a3f1 flow: Regularise flow specific logging helpers 3f57f03 tap: don't let overheard traffic move addr_seen when address is explicit f072bc0 tap: Trim Ethernet padding from short IPv4 frames instead of dropping them 41566e1 inany: Fix doc comment to match u32 field, not u64 ab2260a pif, util: Move listen(2) call from sock_l4_() to pif_listen() 50e3dcc fwd, pif: Remove duplicated logic between tcp_listen() and udp_listen() d5ef43d Makefile: Remove unused DUAL_STACK_SOCKETS define 6d1f38c flow: Correct misleading signature of flowside_sock_l4() 900ea8b tcp: MAX_WINDOW should be unsigned 19cd4ba tcp: Avoid SEQ_*() comparisons against 0 751a6f1 tcp: Merge common sequence logic from tcp_{buf,vu}_data_from_sock() 4604860 cppcheck: Add workaround for cppcheck bug 14847 96c4a9d cppcheck: Remove unused CPPCHECK_6936 https://passt.top/passt/log/?qt=range&q=2026_06_11.a9c61ff..2026_07_16.090d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10734380/ permanent mirror: https://passt.top/builds/copr/0^20260716.g090d739/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g090d739-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_090d739-1_all.deb -- Stefano

1 0

[PATCH v2 0/4] Assorted fixes, address a static checker warning
by Stefano Brivio 16 Jul '26

16 Jul '26

These are small assorted fixes and a change to address a static checker warning I had on my list for a while but never found the time to polish up for sending. So here they are. There's no particular relationship between patches, they are actually independent changes. v2: Changes suggested by David in 2/4 and 4/4, while 1/4 and 3/4 are unchanged Stefano Brivio (4): CONTRIBUTING.md: The tag is "Link:", regardless of how many we have dhcp: Make option parsing more robust, explicitly handle options 0 and 255 passt.1, pesto.1: ::1 is an address, not a port ndp: Use high quality entropy in NDP timer even if not needed CONTRIBUTING.md | 2 +- dhcp.c | 22 +++++++++++++--------- ndp.c | 12 ++++++++---- passt.1 | 2 +- pesto.1 | 2 +- 5 files changed, 24 insertions(+), 16 deletions(-) -- 2.43.0

2 7

[PATCH 0/6] Fix bug 215 and some related issues with fd handling
by David Gibson 16 Jul '26

16 Jul '26

Stefano, you called it correctly. While working on bug 215, as usual, I found a bunch of adjacent things to clean up. I did start by attempting the appoach you suggested for bug 215 - remembering which of the low fds were standard streams and avoiding closing them in __daemon(). It is indeed shorter, but only by 1-2 lines. Looking at possible interactions with other things, I became more and more convinced that leaving anything other than the standard streams in fds 0-2 was an accident waiting to happen. Much of the rest of the series is, for example, dealing with the possibility of --fd [012]. David Gibson (6): isolation, util: Fold close_open_files() into isolate_initial() isolation, conf: Set c->fd_tap from eary parse of --fd conf: Make conf_tap_fd() operate more like conf_mode() isolation: Move --fd descriptor to a number of our choosing main: Ensure fds 0-2 are populated passt: *Always* close pidfile_fd, not just when daemonizing conf.c | 31 +++++++++++++++++++++++-------- conf.h | 2 +- isolation.c | 32 ++++++++++++++++++++++++++++++-- isolation.h | 2 +- passt.c | 27 +++++++++++++++++---------- util.c | 52 +--------------------------------------------------- util.h | 1 - 7 files changed, 73 insertions(+), 74 deletions(-) -- 2.55.0

2 14

[PATCH 0/4] Assorted fixes, address a static checker warning
by Stefano Brivio 16 Jul '26

16 Jul '26

These are small assorted fixes and a change to address a static checker warning I had on my list for a while but never found the time to polish up for sending. So here they are. There's no particular relationship between patches, they are actually independent changes. Stefano Brivio (4): CONTRIBUTING.md: The tag is "Link:", regardless of how many we have dhcp: Make option parsing more robust, explicitly handle options 0 and 255 passt.1, pesto.1: ::1 is an address, not a port ndp: Use high quality entropy in NDP timer even if not needed CONTRIBUTING.md | 2 +- dhcp.c | 10 +++++++++- ndp.c | 11 +++++++---- passt.1 | 2 +- pesto.1 | 2 +- 5 files changed, 19 insertions(+), 8 deletions(-) -- 2.43.0

2 11

[PATCH v2 0/6] Fix issues and false positives from static analysis
by Jon Maloy 16 Jul '26

16 Jul '26

This series fixes minor issues found by static analysis tools in the main passt code and in documentation examples. The core code changes add missing fd initialisations and guard unsigned arithmetic against potential underflow. We also fix buffer handling, type mismatches, and resource leaks in the documentation example code. v2: - udp_vu, tap: Use if-guards instead of assert(), to handle the error paths properly and let the static checker follow the logic - doc/migration: Use snprintf() instead of strncpy() for clarity and guaranteed null-termination (David Gibson) - Drop va_list initialisation patch (Stefano Brivio, David Gibson) Jon Maloy (6): passt: Initialise listening socket fds to -1 udp_vu: Check iov_tail_clone() return before assigning to msg_iovlen tap: Guard IPv6 tail size subtraction against underflow doc/migration: Use snprintf() for socket path and fix argv access doc/migration: Fix buffer type mismatch in recv() call doc/platform-requirements: Close leaked sockets in test_close_dup() doc/migration/source.c | 2 +- doc/migration/target.c | 10 ++++------ doc/platform-requirements/udp-close-dup.c | 3 +++ passt.c | 3 +++ tap.c | 5 ++++- udp_vu.c | 8 ++++++-- 6 files changed, 21 insertions(+), 10 deletions(-) -- 2.52.0

3 14

[PATCH v2 0/5] Fix bug 209
by David Gibson 16 Jul '26

16 Jul '26

Here are a handful of changes to forwarding ant multicast handling, that fix bug 209. It also gets us closer to correct multicast handling, though we're certainly not there yet - multicast things currently only really work at all because IP_MULTICAST_ALL defaults to on, and for the common protocols the host is likely to be already a group member. v2: * Assorted minor polish based on feedback David Gibson (5): fwd: Clarify semantics of --host-lo-to-ns-lo udp: Validate that we have a unicast source address fwd: Rework default address logic for inbound flows fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() fwd: Don't rewrite inbound multicast destinations conf.c | 2 ++ fwd.c | 58 ++++++++++++++++++++++++++++++++---------------------- inany.h | 2 ++ passt.1 | 9 +++++---- udp_flow.c | 2 +- 5 files changed, 45 insertions(+), 28 deletions(-) -- 2.55.0

2 8

[PATCH v10] pasta: Refactor pasta_ns_conf() to reduce nesting
by Jon Maloy 15 Jul '26

15 Jul '26

Extract address and route configuration into two new helper functions pasta_conf_addrs() and pasta_conf_routes(), and replace the outer if (c->pasta_conf_ns) block with an early return. This reduces indentation and eliminates the goto labels. No functional change. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v7: -Removed redundant argument 'af' in nl_addr_set() -Removed redundant label and 'goto's in pasta_ns_conf() -Since I excluded addition of all LINKLOCAL addresses from host address array in a previous commit I can now omit this test in pasta_conf_addrs() as suggested by David. -Here is the example of agnostic usage of inany_prefix_len() I referred to in a previous commit. v8: -Do prefix_len conversion inside nl_addr_set() instead of in the calling function. -In nl_addr_set(), branch on inany_prefix_v4() return value instead of inany_af() to avoid redundant AF check and potential static checker false positives. (David) -Swap branch order in pasta_conf_routes() for consistency with pasta_conf_addrs(). (David) -Defer investigation of pre-existing IFF_NOARP / DAD interaction oddity noted by David. v9: - Broke out as standalone from multi-addr series. - Adapted to code conditions before the introduction of the unified address type. v10: - Applied all suggestions from David, more for symmetry reasons than for logical correctess. --- pasta.c | 220 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 115 insertions(+), 105 deletions(-) diff --git a/pasta.c b/pasta.c index 4e7ee542..3401fda2 100644 --- a/pasta.c +++ b/pasta.c @@ -303,13 +303,70 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, die_perror("Failed to join network namespace"); } +/** + * pasta_conf_addrs() - Configure addresses for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set configured address; if false, copy from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_addrs(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + if (!ifi) + return 0; + + if (!no_copy) + return nl_addr_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + if (af == AF_INET && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET, + &c->ip4.addr, c->ip4.prefix_len); + } else if (af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } + return 0; +} + +/** + * pasta_conf_routes() - Configure routes for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set default route; if false, copy routes from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_routes(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + const void *gw; + + if (af == AF_INET) + gw = &c->ip4.guest_gw; + else + gw = &c->ip6.guest_gw; + + if (!ifi) + return 0; + + if (!no_copy) + return nl_route_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + return nl_route_set_def(nl_sock_ns, c->pasta_ifi, af, gw); +} + /** * pasta_ns_conf() - Set up loopback and tap interfaces in namespace as needed * @c: Execution context */ void pasta_ns_conf(struct ctx *c) { - int rc = 0; + unsigned int flags = IFF_UP; + int rc; rc = nl_link_set_flags(nl_sock_ns, 1 /* lo */, IFF_UP, IFF_UP); if (rc < 0) @@ -328,116 +385,69 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't set MAC address in namespace: %s", strerror_(-rc)); - if (c->pasta_conf_ns) { - unsigned int flags = IFF_UP; - - if (c->mtu) - nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); - - if (c->ifi6) /* Avoid duplicate address detection on link up */ - flags |= IFF_NOARP; - - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); - - if (c->ifi4) { - if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); - } else { - rc = nl_addr_dup(nl_sock, c->ifi4, - nl_sock_ns, c->pasta_ifi, - AF_INET); - } - - if (c->ifi4 == -1 && rc == -ENOTSUP) { - warn("IPv4 not supported, disabling"); - c->ifi4 = 0; - goto ipv4_done; - } - - if (rc < 0) { - die("Couldn't set IPv4 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip4.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi4, nl_sock_ns, - c->pasta_ifi, AF_INET); - } - - if (rc < 0) { - die("Couldn't set IPv4 route(s) in guest: %s", - strerror_(-rc)); - } - } -ipv4_done: + proto_update_l2_buf(c->guest_mac); - if (c->ifi6) { - rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, - &c->ip6.addr_ll_seen); - if (rc < 0) { - warn("Can't get LL address from namespace: %s", - strerror_(-rc)); - } + if (!c->pasta_conf_ns) + return; - rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); - if (rc < 0) { - warn("Can't set nodad for LL in namespace: %s", - strerror_(-rc)); - } - - /* We dodged DAD: re-enable neighbour solicitations */ - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, - 0, IFF_NOARP); - - if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { - rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } - } else { - rc = nl_addr_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (rc < 0) { - die("Couldn't set IPv6 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip6.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET6, - &c->ip6.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (c->ifi6 == -1 && rc == -ENOTSUP) { - warn("IPv6 not supported, disabling"); - c->ifi6 = 0; - goto ipv6_done; - } - - if (rc < 0) { - die("Couldn't set IPv6 route(s) in guest: %s", + if (c->mtu) + nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); + + if (c->ifi6) /* Avoid duplicate address detection on link up */ + flags |= IFF_NOARP; + + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); + + if (c->ifi4) { + rc = pasta_conf_addrs(c, AF_INET, c->ifi4, + c->ip4.no_copy_addrs); + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + } else if (rc < 0) { + die("Couldn't set IPv4 address(es) in namespace: %s", + strerror_(-rc)); + } else { + rc = pasta_conf_routes(c, AF_INET, c->ifi4, + c->ip4.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv4 route(s) in guest: %s", strerror_(-rc)); - } } } -ipv6_done: - proto_update_l2_buf(c->guest_mac); + if (c->ifi6) { + rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, + &c->ip6.addr_ll_seen); + if (rc < 0) + warn("Can't get LL address from namespace: %s", + strerror_(-rc)); + + rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); + if (rc < 0) + warn("Can't set nodad for LL in namespace: %s", + strerror_(-rc)); + + /* We dodged DAD: re-enable neighbour solicitations */ + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, 0, IFF_NOARP); + + rc = pasta_conf_addrs(c, AF_INET6, c->ifi6, + c->ip6.no_copy_addrs); + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + return; + } else if (rc < 0) { + die("Couldn't set IPv6 address(es) in namespace: %s", + strerror_(-rc)); + } + + rc = pasta_conf_routes(c, AF_INET6, c->ifi6, + c->ip6.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv6 route(s) in guest: %s", + strerror_(-rc)); + } } /** -- 2.52.0

3 2

[PATCH v9] dhcpv6: Fix reply destination to match client's source address
by Jon Maloy 15 Jul '26

15 Jul '26

tap_ip6_daddr() selects the reply destination based on our source address type (link-local), so it always returns addr_ll_seen. But if the client sent from a global address, we would reply to an address different from what the client is expecting. Since RFC 9915 (section 18.3.10) allows clients to use global addresses for DHCPv6, we now correct this, and always respond to the address the client was using. We also remove a redundant addr_ll_seen assignment, since this is already done by tap.c when processing IPv6 packets. Note: if the client uses a global source address, our reply will still have a link-local source, creating a scope mismatch. Fixing this properly would require a mechanism to allocate a global address for the DHCPv6 server, which we currently don't have. Responding to the client's actual source address is still a net improvement over the previous behavior of replying to an unrelated cached address. Note 2: This commit isn't actually a fix to an observed problem, but rather an answer to a theoretical issue, adding completeness to the mechanism and simplifying subsequent changes in this series. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- v8: -Updated commit log, acknowledging concerns expressed by David and Stefano. -Some minor changes also addressing feedback from the same persons. v9: -Broken out of multi-addr series and posted as standalone patch. No code changes. --- dhcpv6.c | 16 ++++++++-------- dhcpv6.h | 2 +- tap.c | 15 --------------- tap.h | 2 -- 4 files changed, 9 insertions(+), 26 deletions(-) diff --git a/dhcpv6.c b/dhcpv6.c index 97c04e2c..29c7e320 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -370,12 +370,14 @@ notonlink: /** * dhcpv6_send_ia_notonlink() - Send NotOnLink status * @c: Execution context + * @caddr: Source address of client message (reply destination) * @ia_base: Non-appropriate IA_NA or IA_TA base * @client_id_base: Client ID message option base * @len: Client ID length * @xid: Transaction ID for message exchange */ static void dhcpv6_send_ia_notonlink(struct ctx *c, + const struct in6_addr *caddr, const struct iov_tail *ia_base, const struct iov_tail *client_id_base, int len, uint32_t xid) @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, resp_not_on_link.hdr.xid = xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - xid, &resp_not_on_link, n); + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); } /** @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh)) return -1; - c->ip6.addr_ll_seen = *saddr; - src = &c->ip6.our_tap_ll; mh = IOV_REMOVE_HEADER(data, mh_storage); @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { - dhcpv6_send_ia_notonlink(c, data, &client_id_base, - ntohs(client_id->l), mh->xid); + dhcpv6_send_ia_notonlink(c, saddr, data, + &client_id_base, + ntohs(client_id->l), + mh->xid); return 1; } @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - mh->xid, &resp, n); + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); c->ip6.addr_seen = c->ip6.addr; return 1; diff --git a/dhcpv6.h b/dhcpv6.h index c706dfdb..1015a1a7 100644 --- a/dhcpv6.h +++ b/dhcpv6.h @@ -7,7 +7,7 @@ #define DHCPV6_H int dhcpv6(struct ctx *c, struct iov_tail *data, - struct in6_addr *saddr, struct in6_addr *daddr); + const struct in6_addr *saddr, const struct in6_addr *daddr); void dhcpv6_init(const struct ctx *c); #endif /* DHCPV6_H */ diff --git a/tap.c b/tap.c index 6d93c7ce..d4189617 100644 --- a/tap.c +++ b/tap.c @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len) } } -/** - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets - * @c: Execution context - * @src: Source address - * - * Return: pointer to IPv6 address - */ -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src) -{ - if (IN6_IS_ADDR_LINKLOCAL(src)) - return &c->ip6.addr_ll_seen; - return &c->ip6.addr_seen; -} - /** * tap_push_l2h() - Build an L2 header for an inbound packet * @c: Execution context diff --git a/tap.h b/tap.h index 07ca0965..b335933f 100644 --- a/tap.h +++ b/tap.h @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr src, in_port_t sport, const void *in, size_t dlen); void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_addr dst, const void *in, const void *src_mac, size_t l4len); -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src); void *tap_push_ip6h(struct ipv6hdr *ip6h, const struct in6_addr *src, const struct in6_addr *dst, size_t l4len, uint8_t proto, uint32_t flow); -- 2.52.0

3 2

[PATCH 4/6] isolation: Move --fd descriptor to a number of our choosing
by David Gibson 14 Jul '26

14 Jul '26

Some users of passt pass an fd for the tap interface in, with the --fd parameter, rather than having passt open it itself. This requires some slightly fiddly logic in isolate_initial() so we don't close() it along with any other file descriptors leaked into us by hte parent. More importantly, however, this is broken if the passed fd is 0, 1 or 2, since in that case we will assume it's a standard stream and close it in __daemon(). We explicitly disallow 1 or 2 in conf_tap_fd(), but 0 has been permitted since aa1cc8922 ("conf: allow --fd 0"). It looks like the use case of the contributor of that patch didn't involve daemonizing passt. To fix this, use dup2() to move to the passed fd to 3. This removes the possibility of mixing it up with a standard stream, and as a bonus makes the close_range() logic much simpler. With isolate_initial() made safe for --fd 1 and --fd 2, we can remove the logic excluding those from conf_fd_tap(). Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 4 +--- isolation.c | 21 +++++++++------------ 2 files changed, 10 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index f0bce41b..67f0db6e 100644 --- a/conf.c +++ b/conf.c @@ -1177,9 +1177,7 @@ int conf_tap_fd(int argc, char **argv) return -1; p = fdarg; - if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || - val > INT_MAX || - (val != STDIN_FILENO && val <= STDERR_FILENO)) + if (!parse_unsigned(&p, 0, &val) || !parse_eoi(p) || val > INT_MAX) die("Invalid --fd: %s", fdarg); return val; diff --git a/isolation.c b/isolation.c index c4d476d6..1a7b8527 100644 --- a/isolation.c +++ b/isolation.c @@ -207,7 +207,7 @@ static int move_root(void) */ int isolate_initial(int argc, char **argv) { - int rc, fd_tap = -1; + int fd_tap = -1, close_from = STDERR_FILENO + 1; uint64_t keep; /* We want to keep CAP_NET_BIND_SERVICE in the initial @@ -249,19 +249,16 @@ int isolate_initial(int argc, char **argv) drop_caps_ep_except(keep); fd_tap = conf_tap_fd(argc, argv); - - if (fd_tap == -1) { - rc = close_range(STDERR_FILENO + 1, ~0U, CLOSE_RANGE_UNSHARE); - } else if (fd_tap == STDERR_FILENO + 1) { /* Still a single range */ - rc = close_range(STDERR_FILENO + 2, ~0U, CLOSE_RANGE_UNSHARE); - } else { - rc = close_range(STDERR_FILENO + 1, fd_tap - 1, - CLOSE_RANGE_UNSHARE); - if (!rc) - rc = close_range(fd_tap + 1, ~0U, CLOSE_RANGE_UNSHARE); + if (fd_tap >= 0) { + /* Move the passed fd to a more convenient location */ + if (fd_tap != close_from && + (dup2(fd_tap, close_from) != close_from || + close(fd_tap))) + die_perror("Could not move --fd descriptor"); + fd_tap = close_from++; } - if (rc) { + if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { if (errno == ENOSYS || errno == EINVAL) { /* This probably means close_range() or the * CLOSE_RANGE_UNSHARE flag is not supported by the -- 2.55.0

1 0