- dev - passt

[PATCH] apparmor: allow read access on /tmp for pasta
by Paul Holzinger 10 May '24

10 May '24

The podman CI on debian runs tests based on /tmp but pasta is failing there because it is unable to open the netns path as the open for read access is denied. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- contrib/apparmor/usr.bin.pasta | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index e5ee4df..2a4d28c 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -19,9 +19,10 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_init(), pcap(), + owner /tmp/** rw, # tap_sock_unix_init(), pcap(), # write_pidfile(), - # logfile_init() + # logfile_init(), + # pasta_open_ns() owner @{HOME}/** w, # pcap(), write_pidfile() } -- 2.44.0

2 1

[PATCH] tcp_splice: Set OUT_WAIT_ flag whenever pipe isn't emptied
by Stefano Brivio 09 May '24

09 May '24

In tcp_splice_sock_handler(), if we get EAGAIN on the second splice(), from pipe to receiving socket, that doesn't necessarily mean that the pipe is empty: the receiver buffer might be full instead. Hence, we can't use the 'never_read' flag to decide that there's nothing to wait for: even if we didn't read anything from the sending side in a given iteration, we might still have data to send in the pipe. Use read/written counters, instead. This fixes an issue where large bulk transfers would occasionally hang. From a corresponding strace: 0.000061 epoll_wait(4, [{events=EPOLLOUT, data={u32=29442, u64=12884931330}}], 8, 1000) = 1 0.005003 epoll_ctl(4, EPOLL_CTL_MOD, 211, {events=EPOLLIN|EPOLLRDHUP, data={u32=54018, u64=8589988610}}) = 0 0.000089 epoll_ctl(4, EPOLL_CTL_MOD, 115, {events=EPOLLIN|EPOLLRDHUP, data={u32=29442, u64=12884931330}}) = 0 0.000081 splice(211, NULL, 151, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) 0.000073 splice(150, NULL, 115, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = 1048576 0.000087 splice(211, NULL, 151, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) 0.000045 splice(150, NULL, 115, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = 520415 0.000060 splice(211, NULL, 151, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) 0.000044 splice(150, NULL, 115, NULL, 1048576, SPLICE_F_MOVE|SPLICE_F_NONBLOCK) = -1 EAGAIN (Resource temporarily unavailable) 0.000044 epoll_wait(4, [], 8, 1000) = 0 we're reading from socket 211 into to the pipe end numbered 151, which connects to pipe end 150, and from there we're writing into socket 115. We initially drop EPOLLOUT from the set of monitored flags for socket 115, because it already signaled it's ready for output. Then we read nothing from socket 211 (the sender had nothing to send), and we keep emptying the pipe into socket 115 (first 1048576 bytes, then 520415 bytes). This call of tcp_splice_sock_handler() ends with EAGAIN on the writing side, and we just exit this function without setting the OUT_WAIT_1 flag (and, in turn, EPOLLOUT for socket 115). However, it turns out, the pipe wasn't actually emptied, and while socket 211 had nothing more to send, we should have waited on socket 115 to be ready for output again. As a further step, we could consider not clearing EPOLLOUT at all, unless the read/written counters match, but I'm first trying to fix this ugly issue with a minimal patch. Link: https://github.com/containers/podman/issues/22575 Link: https://github.com/containers/podman/issues/22593 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp_splice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tcp_splice.c b/tcp_splice.c index 42b7be0..4c36b72 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -616,7 +616,7 @@ eintr: if (errno != EAGAIN) goto close; - if (never_read) + if (conn->read[fromside] == conn->written[fromside]) break; conn_event(c, conn, -- 2.43.0

2 1

[PATCH v2] netlink: Don't duplicate routes referring to unrelated host interfaces
by Stefano Brivio 06 May '24

06 May '24

We take care of this in nl_addr_dup(): if the interface index associated to an address doesn't match the selected host interface (ifa->ifa_index != ifi_src), we don't copy that address. But for routes, we just unconditionally update the interface index to match the index in the target namespace, even if the source interface didn't match. This might happen in two cases: with a pre-4.20 kernel without support for NETLINK_GET_STRICT_CHK, which won't filter routes based on the interface we pass in the request, as reported by runsisi, and any kernel with support for multipath routes where any of the nexthops refers to an unrelated host interface. In both cases, check the index of the source interface, and avoid copying unrelated routes. Reported-by: runsisi <runsisi(a)hust.edu.cn> Link: https://bugs.passt.top/show_bug.cgi?id=86 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Set NLMSG_NOOP on the message instead of AF_UNSPEC on the route to discard it, to keep the check on insertion simple. netlink.c | 39 +++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/netlink.c b/netlink.c index cdfe68c..b1c0cce 100644 --- a/netlink.c +++ b/netlink.c @@ -554,21 +554,32 @@ int nl_route_dup(int s_src, unsigned int ifi_src, NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; nh = NLMSG_NEXT(nh, left)) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); + bool discard = false; struct rtattr *rta; size_t na; if (nh->nlmsg_type != RTM_NEWROUTE) continue; - dup_routes++; - for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { /* RTA_OIF and RTA_MULTIPATH attributes carry the - * identifier of a host interface. Change them to match - * the corresponding identifier in the target namespace. - */ + * identifier of a host interface. If they match the + * host interface we're copying from, change them to + * match the corresponding identifier in the target + * namespace. + * + * If RTA_OIF doesn't match (NETLINK_GET_STRICT_CHK not + * available), or if any interface index in nexthop + * objects differ from the host interface, discard the + * route altogether. + */ if (rta->rta_type == RTA_OIF) { + if (*(unsigned int *)RTA_DATA(rta) != ifi_src) { + discard = true; + break; + } + *(unsigned int *)RTA_DATA(rta) = ifi_dst; } else if (rta->rta_type == RTA_MULTIPATH) { size_t nh_len = RTA_PAYLOAD(rta); @@ -576,8 +587,19 @@ int nl_route_dup(int s_src, unsigned int ifi_src, for (rtnh = (struct rtnexthop *)RTA_DATA(rta); RTNH_OK(rtnh, nh_len); - rtnh = RTNH_NEXT_AND_DEC(rtnh, nh_len)) + rtnh = RTNH_NEXT_AND_DEC(rtnh, nh_len)) { + int src = (int)ifi_src; + + if (rtnh->rtnh_ifindex != src) { + discard = true; + break; + } + rtnh->rtnh_ifindex = ifi_dst; + } + + if (discard) + break; } else if (rta->rta_type == RTA_PREFSRC) { /* Host routes might include a preferred source * address, which must be one of the host's @@ -588,6 +610,11 @@ int nl_route_dup(int s_src, unsigned int ifi_src, rta->rta_type = RTA_UNSPEC; } } + + if (discard) + nh->nlmsg_type = NLMSG_NOOP; + else + dup_routes++; } if (!NLMSG_OK(nh, left)) { -- 2.43.0

2 1

[PATCH v2 0/2] SO_PEEK_OFF support
by Jon Maloy 06 May '24

06 May '24

SO_PEEK_OFF support and a fix for the zero-window problem. Jon Maloy (2): tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 87 ++++++++++++++++++++++++++++++++++++++++++++++-------- tcp_conn.h | 2 ++ 2 files changed, 77 insertions(+), 12 deletions(-) -- 2.42.0

3 9

[PATCH v2 0/7] Rework UDP buffers
by David Gibson 02 May '24

02 May '24

Laurent recently reworked the TCP buffer handling to be split into various pieces tracked by iovecs. We'll want that for various future changes. This series makes a similar split for UDP buffers, which we'll want in order to allow dual-stack UDP sockets, amongst other things. This is based on my earlier series of cleanups for the TCP buffer handling. Changes since v1: * Rebase on v2 of the TCP iov and buffer handling cleanups * Rename udp_payload and udp_meta structures to _t for more consistency with tcp.c * Other minor changes based on Stefano's review David Gibson (7): test: Allow sftp via vsock-ssh in tests udp: Split tap-bound UDP packets into multiple buffers using io vector udp: Combine initialisation of IPv4 and IPv6 iovs udp: Explicitly set checksum in guest-bound UDP headers udp: Share payload buffers between IPv4 and IPv6 udp: Use the same buffer for the L2 header for all frames udp: Single buffer for IPv4, IPv6 headers and metadata tap.h | 38 ------ test/passt.mbuto | 6 +- udp.c | 299 +++++++++++++++++++++++------------------------ 3 files changed, 152 insertions(+), 191 deletions(-) -- 2.44.0

2 8

[PATCH v2 00/10] Small improvements to IOV handling
by David Gibson 02 May '24

02 May '24

Laurent's changes to split TCP buffers into various components with IOVs is now merged. This series has a batch of small cleanups to make the handling of this slightly nicer. These are preliminaries to doing something similar with the UDP buffers. Note that patch 10/10 might interfere with the experiments to work out what is going wrong with the odd batching / performance issues we've seen. We can leave it off for the time being if that's a problem. Changes since v1: * Added new patch removing some unused structures * Added two new patches cleaning up some endianness confusion * Added a bunch of missing cases to standardisation of length variable names * Assorted minor revisions based on Stefano's review David Gibson (10): checksum: Use proto_ipv6_header_psum() for ICMPv6 as well tap: Split tap specific and L2 (ethernet) headers tap: Remove unused structs tap_msg, tap_l4_msg treewide: Remove misleading and redundant endianness notes checksum: Make csum_ip4_header() take a host endian length treewide: Standardise variable names for various packet lengths tcp: Simplify packet length calculation when preparing headers tap, tcp: (Re-)abstract TAP specific header handling iov: Helper macro to construct iovs covering existing variables or fields tcp: Update tap specific header too in tcp_fill_headers[46]() arp.c | 6 +- checksum.c | 68 ++++++++++----------- checksum.h | 12 ++-- dhcp.c | 6 +- icmp.c | 12 ++-- iov.h | 3 + ndp.c | 6 +- passt.h | 28 ++------- pcap.c | 14 ++--- pcap.h | 2 +- tap.c | 146 ++++++++++++++++++++++---------------------- tap.h | 60 ++++++++++++------ tcp.c | 176 +++++++++++++++++++++++------------------------------ udp.c | 52 ++++++++-------- 14 files changed, 290 insertions(+), 301 deletions(-) -- 2.44.0

2 11

[PATCH 0/2] netlink: Don't duplicate routes with mismatching interfaces
by Stefano Brivio 01 May '24

01 May '24

Stefano Brivio (2): netlink: Fix iterations over nexthop objects netlink: Don't duplicate routes referring to unrelated host interfaces netlink.c | 53 ++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 9 deletions(-) -- 2.43.0

2 4

[PATCH 0/7] Rework UDP buffers
by David Gibson 01 May '24

01 May '24

Laurent recently reworked the TCP buffer handling to be split into various pieces tracked by iovecs. We'll want that for various future changes. This series makes a similar split for UDP buffers, which we'll want in order to allow dual-stack UDP sockets, amongst other things. This is based on my earlier series of cleanups for the TCP buffer handling. David Gibson (7): test: Allow sftp via vsock-ssh in tests udp: Split tap-bound UDP packets into multiple buffers using io vector udp: Combine initialisation of IPv4 and IPv6 iovs udp: Explicitly set checksum in guest-bound UDP headers udp: Share payload buffers between IPv4 and IPv6 udp: Use the same buffer for the L2 header for all frames udp: Single buffer for IPv4, IPv6 headers and metadata tap.h | 38 ------ test/passt.mbuto | 6 +- udp.c | 304 +++++++++++++++++++++++------------------------ 3 files changed, 153 insertions(+), 195 deletions(-) -- 2.44.0

2 13

[PATCH 0/7] Small improvements to IOV handling
by David Gibson 01 May '24

01 May '24

Laurent's changes to split TCP buffers into various components with IOVs is now merged. This series has a batch of small cleanups to make the handling of this slightly nicer. These are preliminaries to doing something similar with the UDP buffers. Note that patch 7/7 might interfere with the experiments to work out what is going wrong with the odd batching / performance issues we've seen. We can leave it off for the time being if that's a problem. David Gibson (7): checksum: Use proto_ipv6_header_psum() for ICMPv6 as well tap: Split tap specific and L2 (ethernet) headers treewide: Standardise variable names for various packet lengths tcp: Simplify packet length calculation when preparing headers tap, tcp: (Re-)abstract TAP specific header handling iov: Helper macro to construct iovs covering existing variables or fields tcp: Update tap specific header too in tcp_fill_headers[46]() checksum.c | 46 ++++++++--------- checksum.h | 10 ++-- icmp.c | 8 +-- iov.h | 3 ++ passt.h | 4 +- tap.c | 51 ++++++++++--------- tap.h | 46 +++++++++++++---- tcp.c | 144 +++++++++++++++++++++++------------------------------ udp.c | 50 ++++++++++--------- 9 files changed, 184 insertions(+), 178 deletions(-) -- 2.44.0

2 17

[PATCH 0/2] Support for SO_PEEK_OFF when a available
by Jon Maloy 29 Apr '24

29 Apr '24

First commit introduces support for SO_PEEK_OFF socket option. Second commit adds a workaround for a kernel TCP bug. Jon Maloy (2): tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 63 +++++++++++++++++++++++++++++++++++++++++++----------- tcp_conn.h | 2 ++ 2 files changed, 53 insertions(+), 12 deletions(-) -- 2.42.0

3 14

2024

2023

2022

2021

dev