- dev - passt

[PATCH v2 0/3] Probe host's ephemeral ports, rather than using RFC values
by David Gibson 29 Aug '24

29 Aug '24

As discussed on our recent call, this implements basing which ports we consider "ephemeral" on probing the host's settings, rather than just assuming the RFC 6335 recommended values, which are not what Linux uses by default. I think this is more correct, but additionally using the Linux values means we consider more ports ephemeral, reducing kernel memory consumption for -t all -u all. Changes in v2: * Add missing close() for the sysctl file David Gibson (3): conf, fwd: Make ephemeral port logic more flexible conf, fwd: Don't attempt to forward port 0 fwd, conf: Probe host's ephemeral ports conf.c | 19 +++++++++++---- fwd.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ fwd.h | 3 +++ util.h | 3 --- 4 files changed, 92 insertions(+), 7 deletions(-) -- 2.46.0

2 5

[PATCH 0/3] Probe host's ephemeral ports, rather than using RFC values
by David Gibson 29 Aug '24

29 Aug '24

As discussed on our recent call, this implements basing which ports we consider "ephemeral" on probing the host's settings, rather than just assuming the RFC 6335 recommended values, which are not what Linux uses by default. I think this is more correct, but additionally using the Linux values means we consider more ports ephemeral, reducing kernel memory consumption for -t all -u all. David Gibson (3): conf, fwd: Make ephemeral port logic more flexible conf, fwd: Don't attempt to forward port 0 fwd, conf: Probe host's ephemeral ports conf.c | 19 ++++++++++++---- fwd.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ fwd.h | 3 +++ util.h | 3 --- 4 files changed, 88 insertions(+), 7 deletions(-) -- 2.46.0

3 9

[net-next, v2 0/2] Adding SO_PEEK_OFF for TCPv6
by jmaloy＠redhat.com 28 Aug '24

28 Aug '24

From: Jon Maloy <jmaloy(a)redhat.com> Adding SO_PEEK_OFF for TCPv6 and selftest for it. Jon Maloy (2): tcp: add SO_PEEK_OFF socket option tor TCPv6 selftests: add selftest for tcp SO_PEEK_OFF support net/ipv6/af_inet6.c | 1 + tools/testing/selftests/net/Makefile | 1 + tools/testing/selftests/net/tcp_so_peek_off.c | 184 ++++++++++++++++++ 3 files changed, 186 insertions(+) create mode 100644 tools/testing/selftests/net/tcp_so_peek_off.c -- 2.45.2

4 7

[PATCH v2 0/3] Dual stack sockets for UDP
by David Gibson 27 Aug '24

27 Aug '24

Here, at last, is a change to use dual stack sockets for UDP port forwards as we have for TCP for some time. With the merging of many parallel IPv4/IPv6 structures being done for the flow table and other recent work, this actually turned out much easier than I anticipated. Changes since v1: * Removed a redundant assignment to msg_namelen David Gibson (3): udp: Merge udp[46]_mh_recv arrays udp: Remove unnnecessary local from udp_sock_init() udp: Use dual stack sockets for port forwarding when possible udp.c | 101 +++++++++++++++++++++++++++++----------------------------- udp.h | 2 -- 2 files changed, 50 insertions(+), 53 deletions(-) -- 2.46.0

2 4

[PATCH] seccomp.sh: Try to account for terminal width while formatting list of system calls
by Stefano Brivio 27 Aug '24

27 Aug '24

Avoid excess lines on wide terminals, but make sure we don't fail if we can't fetch the number of columns for any reason, as it's not a fundamental feature and we don't want to break anything with it. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- seccomp.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/seccomp.sh b/seccomp.sh index 052e1c8..38aa826 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -242,7 +242,10 @@ for __p in ${__profiles}; do __calls="$(sed -n 's/[\t ]*\*[\t ]*#syscalls$:'"${__p}"'\|$[\t ]\{1,\}$.*$/\2/p' ${IN})" __calls="${__calls} ${EXTRA_SYSCALLS:-}" __calls="$(filter ${__calls})" - echo "seccomp profile ${__p} allows: ${__calls}" | tr '\n' ' ' | fmt -t + + cols="$(stty -a | sed -n 's/.*columns $[0-9]*$.*/\1/p' || :)" 2>/dev/null + case $cols in [0-9]*) col_args="-w ${cols}";; *) col_args="";; esac + echo "seccomp profile ${__p} allows: ${__calls}" | tr '\n' ' ' | fmt -t ${col_args} # Pad here to keep gen_profile() "simple" __count=0 -- 2.43.0

1 0

[PATCH 0/3] Dual stack sockets for UDP
by David Gibson 27 Aug '24

27 Aug '24

Here, at last, is a change to use dual stack sockets for UDP port forwards as we have for TCP for some time. With the merging of many parallel IPv4/IPv6 structures being done for the flow table and other recent work, this actually turned out much easier than I anticipated. David Gibson (3): udp: Merge udp[46]_mh_recv arrays udp: Remove unnnecessary local from udp_sock_init() udp: Use dual stack sockets for port forwarding when possible udp.c | 104 ++++++++++++++++++++++++++++++---------------------------- udp.h | 2 -- 2 files changed, 53 insertions(+), 53 deletions(-) -- 2.46.0

2 8

[PATCH] mbuto: Fix handling of binaries in /usr/libexec
by Stefano Brivio 27 Aug '24

27 Aug '24

The FHS says that binaries under /usr/libexec are not intended to run directly on the host, and not, as I incorrectly assumed (probably from some outdated distribution guidelines), on other hosts only: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html If we move them to /usr/bin in the guest image, the helpers or programs that are supposed to run those binaries might not find them. We have, however, cases like /usr/libexec/qemu-kvm on some distributions where we might have programs, on the host, which are meant to run them, but we don't want to copy those to the guest image, and we want to run the binary we copied from /usr/libexec directly. This was the reason why I initially added this special handling. Instead of doing that, simply add /usr/libexec to the guest's $PATH, from the $FIXUP script. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- mbuto | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/mbuto b/mbuto index a2a8147..c2fffa0 100755 --- a/mbuto +++ b/mbuto @@ -48,10 +48,13 @@ COPIES="${COPIES:-}" # Workers for time-consuming tasks such as stripping modules, see workers() THREADS="$(nproc)" -# Fix-up script to run before /init, can be omitted +# Fix-up script to run before /init, can be omitted. Note that we're adding +# /usr/libexec to PATH because, while a given program might not be intended to +# directly run on the host (that's what /usr/libexec is for), we might need to +# run it directly on the guest instead. [ -z "${FIXUP}" ] && FIXUP='#!/bin/sh -export PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/sbin:/usr/sbin: +export PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/sbin:/usr/sbin:/usr/libexec: mount -t proc proc /proc mount -t sysfs sys /sys @@ -752,14 +755,7 @@ prog_add() { unset IFS [ -z "${__bin}" ] && err "Can't source ${1}" - # Binaries in /usr/libexec are meant to run on other hosts only, so they - # can't reside in /usr/libexec on the target image. Move to /usr/bin. - if [ "$("${DIRNAME}" "${__bin}")" = "/usr/libexec" ]; then - __bindir="${wd}/usr/bin" - else - __bindir="${wd}$("${DIRNAME}" "${__bin}")" - fi - + __bindir="${wd}$("${DIRNAME}" "${__bin}")" "${MKDIR}" -p "${__bindir}" "${CP}" --preserve=all "${__bin}" "${__bindir}" -- 2.43.0

2 1

[PATCH] test: Look for possible sshd-session paths (if it's there at all) in mbuto's profile
by Stefano Brivio 27 Aug '24

27 Aug '24

Some distributions already have OpenSSH 9.8, which introduces split sshd/sshd-session binaries, and there we need to copy the binary from the host, which can be /usr/libexec/openssh/sshd-session (Fedora Rawhide), /usr/lib/ssh/sshd-session (Arch Linux), /usr/lib/openssh/sshd-session (Debian), and possibly other paths. Add at least those three, and, if we don't find sshd-session, assume we don't need it: it could very well be an older version of OpenSSH, as reported by David for Fedora 40, or perhaps another daemon (would Dropbear even work? I'm not sure). Reported-by: David Gibson <david(a)gibson.dropbear.id.au> Fixes: d6817b3930be ("test/passt.mbuto: Install sshd-session OpenSSH's split process") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/passt.mbuto | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 61865e8..138d365 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -13,8 +13,15 @@ PROGS="${PROGS:-ash,dash,bash ip mount ls insmod mkdir ln cat chmod lsmod modprobe find grep mknod mv rm umount jq iperf3 dhclient hostname sed tr chown sipcalc cut socat dd strace ping tail killall sleep sysctl - nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp - /usr/lib/openssh/sshd-session}" + nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp}" + +# OpenSSH 9.8 introduced split binaries, with sshd being the daemon, and +# sshd-session the per-session program. We need the latter as well, and the path +# depends on the distribution. It doesn't exist on older versions. +for bin in /usr/lib/openssh/sshd-session /usr/lib/ssh/sshd-session \ + /usr/libexec/openssh/sshd-session; do + command -v "${bin}" >/dev/null && PROGS="${PROGS} ${bin}" +done KMODS="${KMODS:- virtio_net virtio_pci vmw_vsock_virtio_transport}" -- 2.43.0

2 1

[PATCH] Remove incorrect special handling of /usr/libexec
by David Gibson 26 Aug '24

26 Aug '24

The statement in the comment about /usr/libexec being only for running on other hosts simply isn't true, neither in practice nor according to the FHS spec[0]. Furthermore this logic didn't even handle it correctly, since it would only handle binaries _directly_ in /usr/libexec, not those in (explicitly FHS permitted) subdirectories under /usr/libexec. [0] https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- mbuto | 8 -------- 1 file changed, 8 deletions(-) diff --git a/mbuto b/mbuto index a2a8147..5e8ea9c 100755 --- a/mbuto +++ b/mbuto @@ -752,14 +752,6 @@ prog_add() { unset IFS [ -z "${__bin}" ] && err "Can't source ${1}" - # Binaries in /usr/libexec are meant to run on other hosts only, so they - # can't reside in /usr/libexec on the target image. Move to /usr/bin. - if [ "$("${DIRNAME}" "${__bin}")" = "/usr/libexec" ]; then - __bindir="${wd}/usr/bin" - else - __bindir="${wd}$("${DIRNAME}" "${__bin}")" - fi - "${MKDIR}" -p "${__bindir}" "${CP}" --preserve=all "${__bin}" "${__bindir}" -- 2.46.0

2 6

[PATCH 0/4] Assorted test fixes for i386/i686 and OpenSSH 9.8
by Stefano Brivio 26 Aug '24

26 Aug '24

Stefano Brivio (4): test/lib/setup: Transform i686 kernel architecture name into QEMU name (i386) test/passt.mbuto: Run sshd from vsock proxy with absolute path test/passt.mbuto: Install sshd-session OpenSSH's split process test: Duplicate existing recvfrom() valgrind suppression for recv() test/lib/setup | 10 ++++++---- test/passt.mbuto | 5 +++-- test/valgrind.supp | 9 +++++++++ 3 files changed, 18 insertions(+), 6 deletions(-) -- 2.43.0

2 11