- dev - passt

[PATCH 1/1] selinx: Add getattr to class udp_socket
by Janne Grunau 02 May '25

02 May '25

Commit 59cc89f ("udp, udp_flow: Track our specific address on socket interfaces") added a getsockname() call in udp_flow_new(). This requires getattr. Fixes "Flow 0 (UDP flow): Unable to determine local address: Permission denied" errors in muvm/passt on Fedora Linux 42 with SELinux. The SELinux audit message is | type=AVC msg=audit(1746083799.606:235): avc: denied { getattr } for | pid=2961 comm="passt" laddr=127.0.0.1 lport=49221 | faddr=127.0.0.53 fport=53 | scontext=unconfined_u:unconfined_r:passt_t:s0-s0:c0.c1023 | tcontext=unconfined_u:unconfined_r:passt_t:s0-s0:c0.c1023 | tclass=udp_socket permissive=0 Fixes: 59cc89f ("udp, udp_flow: Track our specific address on socket interfaces") Signed-off-by: Janne Grunau <janne-psst(a)jannau.net> --- contrib/selinux/passt.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index f8ea672..eb9ce72 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -49,7 +49,7 @@ require { type proc_net_t; type node_t; class tcp_socket { create accept listen name_bind name_connect getattr ioctl }; - class udp_socket { create accept listen }; + class udp_socket { create accept listen getattr }; class icmp_socket { bind create name_bind node_bind setopt read write }; class sock_file { create unlink write }; @@ -133,7 +133,7 @@ allow passt_t node_t:icmp_socket { name_bind node_bind }; allow passt_t port_t:icmp_socket name_bind; allow passt_t self:tcp_socket { create getopt setopt connect bind listen accept shutdown read write getattr ioctl }; -allow passt_t self:udp_socket { create getopt setopt connect bind read write }; +allow passt_t self:udp_socket { create getopt setopt connect bind read write getattr }; allow passt_t self:icmp_socket { bind create setopt read write }; allow passt_t user_tmp_t:dir { add_name write }; -- 2.49.0

2 1

[PATCH] util: Fix typo, ASSSERTION -> ASSERTION
by Stefano Brivio 30 Apr '25

30 Apr '25

Fixes: 9153aca15bc1 ("util: Add abort_with_msg() and ASSERT_WITH_MSG() helpers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.h b/util.h index cc7d084..5947337 100644 --- a/util.h +++ b/util.h @@ -75,7 +75,7 @@ void abort_with_msg(const char *fmt, ...) #define ASSERT_WITH_MSG(expr, ...) \ ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) #define ASSERT(expr) \ - ASSERT_WITH_MSG((expr), "ASSSERTION FAILED in %s (%s:%d): %s", \ + ASSERT_WITH_MSG((expr), "ASSERTION FAILED in %s (%s:%d): %s", \ __func__, __FILE__, __LINE__, STRINGIFY(expr)) #ifdef P_tmpdir -- 2.43.0

2 1

[PATCH] passt-repair: Hide bogus gcc warning from -Og
by Stefano Brivio 30 Apr '25

30 Apr '25

When building with gcc 13 and -Og, we get: passt-repair.c: In function ‘main’: passt-repair.c:161:23: warning: ‘ev’ may be used uninitialized [-Wmaybe-uninitialized] 161 | if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') { | ~~^~~~~ but that can't actually happen, because we only exit the preceding while loop if 'found' is true, and that only happens, in turn, as we assign 'ev'. Get rid of the warning by (redundantly) initialising ev to NULL. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt-repair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passt-repair.c b/passt-repair.c index 256a8c9..ff1c44f 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -113,7 +113,7 @@ int main(int argc, char **argv) if ((sb.st_mode & S_IFMT) == S_IFDIR) { char buf[sizeof(struct inotify_event) + NAME_MAX + 1] __attribute__ ((aligned(__alignof__(struct inotify_event)))); - const struct inotify_event *ev; + const struct inotify_event *ev = NULL; char path[PATH_MAX + 1]; bool found = false; ssize_t n; -- 2.43.0

1 0

[PATCH] conf: allow --fd 0
by Alyssa Ross 28 Apr '25

28 Apr '25

inetd-style socket passing traditionally starts a service with a connected socket on file descriptors 0 and 1. passt disallowing obtaining its socket from either of these descriptors made it difficult to use with super-servers providing this interface — in my case I wanted to use passt with s6-ipcserver[1]. Since (as far as I can tell) passt does not use standard input for anything else (unlike standard output), it should be safe to relax the restrictions on --fd to allow setting it to 0, enabling this use case. Link: https://skarnet.org/software/s6/s6-ipcserver.html [1] Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- conf.c | 3 ++- util.c | 4 +++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index f942851..a6d7e22 100644 --- a/conf.c +++ b/conf.c @@ -1717,7 +1717,8 @@ void conf(struct ctx *c, int argc, char **argv) fd_tap_opt = strtol(optarg, NULL, 0); if (errno || - fd_tap_opt <= STDERR_FILENO || fd_tap_opt > INT_MAX) + (fd_tap_opt != STDIN_FILENO && fd_tap_opt <= STDERR_FILENO) || + fd_tap_opt > INT_MAX) die("Invalid --fd: %s", optarg); c->fd_tap = fd_tap_opt; diff --git a/util.c b/util.c index 62a6003..f5497d4 100644 --- a/util.c +++ b/util.c @@ -875,7 +875,9 @@ void close_open_files(int argc, char **argv) errno = 0; fd = strtol(optarg, NULL, 0); - if (errno || fd <= STDERR_FILENO || fd > INT_MAX) + if (errno || + (fd != STDIN_FILENO && fd <= STDERR_FILENO) || + fd > INT_MAX) die("Invalid --fd: %s", optarg); } } while (name != -1); base-commit: 436afc30447c6f0ce516f2b38c769833114bb5f8 -- 2.47.2

2 2

[PATCH 0/2] udp: copy ttl or hop limit from socket to tap
by Jon Maloy 24 Apr '25

24 Apr '25

The following patches were meant as a preparation for supporting traceroute from remote to internal peers. Unfortunately we ran into two showstoppers during this work. 1: We cannot read IPv4 ttl from the dual-stack socket we are using as listener. setsockopt(IP_RECVTTL) is simply not supported by the kernel for IPv6 socket, even in dual-stack mode. It is not acceptable from a memory consumption viewpoint to create two listener sockets, one for IPv4 and one for IPv6, for each bound port. 2: There is no way we can create and send ICMP response messages to be sent out from the outgoing socket unless we can access it with privileges, which we cannot in PASST. Because of this, these patches are posted mostly as a documentation of the work done, maybe to be applied some time in the future if new conditions permit. Jon Maloy (2): make ttl parametrized udp: copy incoming packet TTL from socket to tap checksum.c | 7 +++-- checksum.h | 2 +- ip.h | 11 ++++--- tap.c | 16 +++++----- tap.h | 6 ++-- tcp.c | 5 ++-- udp.c | 79 +++++++++++++++++++++++++++++++++++++------------- udp_flow.c | 18 ++++++++++++ udp_internal.h | 4 +-- udp_vu.c | 5 ++-- util.c | 5 ++++ 11 files changed, 112 insertions(+), 46 deletions(-) -- 2.48.1

1 2

[0/2] udp: copy ttl or hop limit from socket to tap
by Jon Maloy 24 Apr '25

24 Apr '25

The following patches were meant as a preparation for supporting traceroute from remote to internal peers. Unfortunately we ran into two showstoppers during this work. 1: We cannot read IPv4 ttl from the dual-stack socket we are using as listener. setsockopt(IP_RECVTTL) is simply not supported by the kernel for IPv6 socket, even in dual-stack mode. It is not acceptable from a memory consumption viewpoint to create two listener sockets, one for IPv4 and one for IPv6, for each bound port. 2: There is no way we can create and send ICMP response messages to be sent out from the outgoing socket unless we can access it with privileges, which we cannot in PASST. Because of this, these patches are posted mostly as a documentation of the work done, maybe to be applied some time in the future if new conditions permit. Jon Maloy (2): make ttl parametrized udp: copy incoming packet TTL from socket to tap checksum.c | 7 +++-- checksum.h | 2 +- ip.h | 11 ++++--- tap.c | 16 +++++----- tap.h | 6 ++-- tcp.c | 5 ++-- udp.c | 79 +++++++++++++++++++++++++++++++++++++------------- udp_flow.c | 18 ++++++++++++ udp_internal.h | 4 +-- udp_vu.c | 5 ++-- util.c | 5 ++++ 11 files changed, 112 insertions(+), 46 deletions(-) -- 2.48.1

1 0

[PATCH v2 0/4] Translate source addresses for ICMP errors
by David Gibson 22 Apr '25

22 Apr '25

We now propagate ICMP errors on UDP flows back into ICMP packets on the tap interface. However, we don't always get the source address right for the synthesized message. Because ICMPs can be generated by intermediate routers, that source address might not be one of the endpoints, so the address translation we already have isn't sufficient. Implement properly translating ICMP addresses when we need to. This ended up a bit messier than I hoped, but it seems to work. A simple case to test this is: pasta --config-net --map-host-loopback=172.16.1.1 -- \ sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001" where 10001 is a port where nothing is listening on the host. Without this series, this will just time out. pasta sends an ICMP Port Unreachable message, but it's sent with source address 127.0.0.1 and so discarded by the guest. With this series, the address is properly translated and we correctly get the error from socat: 2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused v2: * Fix a (bogus) coverity warning * Minor cosmetic changes based on Stefano's review David Gibson (4): fwd: Split out helpers for port-independent NAT treewide: Improve robustness against sockaddrs of unexpected family udp: Rework offender address handling in udp_sock_recverr() udp: Translate offender addresses for ICMP messages flow.c | 16 ++++++++-- fwd.c | 87 ++++++++++++++++++++++++++++++++++++++---------------- fwd.h | 3 ++ inany.h | 28 +++++++++++------- tcp.c | 10 +++---- udp.c | 81 ++++++++++++++++++++++++++++++++++++-------------- udp_flow.c | 6 ++-- 7 files changed, 162 insertions(+), 69 deletions(-) -- 2.49.0

2 5

[PATCH 0/4] Translate source addresses for ICMP errors
by David Gibson 17 Apr '25

17 Apr '25

We now propagate ICMP errors on UDP flows back into ICMP packets on the tap interface. However, we don't always get the source address right for the synthesized message. Because ICMPs can be generated by intermediate routers, that source address might not be one of the endpoints, so the address translation we already have isn't sufficient. Implement properly translating ICMP addresses when we need to. This ended up a bit messier than I hoped, but it seems to work. A simple case to test this is: pasta --config-net --map-host-loopback=172.16.1.1 -- \ sh -c "echo hello | socat STDIO UDP4:172.16.1.1:10001" where 10001 is a port where nothing is listening on the host. Without this series, this will just time out. pasta sends an ICMP Port Unreachable message, but it's sent with source address 127.0.0.1 and so discarded by the guest. With this series, the address is properly translated and we correctly get the error from socat: 2025/04/16 19:02:37 socat[3] E read(5, 0x555c3dbf2000, 8192): Connection refused David Gibson (4): fwd: Split out helpers for port-independent NAT treewide: Improve robustness against sockaddrs of unexpected family udp: Rework offender address handling in udp_sock_recverr() udp: Translate offender addresses for ICMP messages flow.c | 16 ++++++++-- fwd.c | 87 ++++++++++++++++++++++++++++++++++++++---------------- fwd.h | 3 ++ inany.h | 22 +++++++++----- tcp.c | 10 +++---- udp.c | 79 +++++++++++++++++++++++++++++++++++-------------- udp_flow.c | 6 ++-- 7 files changed, 157 insertions(+), 66 deletions(-) -- 2.49.0

2 9

[PATCH v4 00/28] Introduce discontiguous frames management
by Laurent Vivier 16 Apr '25

16 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (28): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 47 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 142 +++++++++++++++++++++++++++++--- iov.h | 59 ++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 13 ++- ndp.h | 4 +- packet.c | 88 ++++++++------------ packet.h | 52 ++++++------ pcap.c | 1 + tap.c | 132 +++++++++++++++++------------- tap.h | 5 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 8 +- vu_common.c | 46 ++++------- 26 files changed, 690 insertions(+), 424 deletions(-) -- 2.49.0

1 28

[PATCH v3 00/20] Introduce discontiguous frames management
by Laurent Vivier 16 Apr '25

16 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. Laurent Vivier (20): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_slice(), iov_tail_slice() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail arp.c | 90 ++++++++++++++------- dhcp.c | 45 ++++++----- dhcpv6.c | 222 ++++++++++++++++++++++++++++++++-------------------- icmp.c | 25 +++--- iov.c | 165 +++++++++++++++++++++++++++++++++++--- iov.h | 61 +++++++++++---- ip.c | 27 +++---- ip.h | 3 +- ndp.c | 7 +- packet.c | 84 ++++++++------------ packet.h | 21 ++--- pcap.c | 1 + tap.c | 88 ++++++++++++++------- tap.h | 3 +- tcp.c | 61 ++++++++++----- tcp_buf.c | 2 +- udp.c | 34 +++++--- vu_common.c | 26 ++---- 18 files changed, 634 insertions(+), 331 deletions(-) -- 2.49.0

2 23