- dev - passt

[PATCH 3/3] tcp, udp: Make {tcp,udp}_listen() return socket fds
by David Gibson 12 Jan '26

12 Jan '26

{tcp,udp}_listen() currently return 0 on success, rather than the socket fd they created. Historically, that was because these functions could sometimes create multiple sockets. We've now refactored things to avoid that, so it makes more sense for them to return the socket on success. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 14 +++++++------- tcp.c | 7 ++----- udp.c | 4 ++-- 3 files changed, 11 insertions(+), 14 deletions(-) diff --git a/conf.c b/conf.c index cc3c20a9..5db49653 100644 --- a/conf.c +++ b/conf.c @@ -149,7 +149,7 @@ static void conf_ports_range_except(const struct ctx *c, char optname, { bool bound_one = false; unsigned i; - int ret; + int fd; if (first == 0) { die("Can't forward port 0 for option '-%c %s'", @@ -185,23 +185,23 @@ static void conf_ports_range_except(const struct ctx *c, char optname, fwd->delta[i] = to - first; if (optname == 't') - ret = tcp_listen(c, PIF_HOST, addr, ifname, i); + fd = tcp_listen(c, PIF_HOST, addr, ifname, i); else if (optname == 'u') - ret = udp_listen(c, PIF_HOST, addr, ifname, i); + fd = udp_listen(c, PIF_HOST, addr, ifname, i); else /* No way to check in advance for -T and -U */ - ret = 0; + fd = 0; - if (ret == -ENFILE || ret == -EMFILE) { + if (fd == -ENFILE || fd == -EMFILE) { die("Can't open enough sockets for port specifier: %s", optarg); } - if (!ret) { + if (fd >= 0) { bound_one = true; } else if (!weak) { die("Failed to bind port %u (%s) for option '-%c %s'", - i, strerror_(-ret), optname, optarg); + i, strerror_(-fd), optname, optarg); } } diff --git a/tcp.c b/tcp.c index 67007c05..80b47f3c 100644 --- a/tcp.c +++ b/tcp.c @@ -2680,7 +2680,7 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, * @ifname: Name of interface to bind to, NULL for any * @port: Port, host order * - * Return: 0 on success, negative error code on failure + * Return: Socket fd on success, negative error code on failure */ int tcp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) @@ -2729,10 +2729,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, socks[port][V6] = s < 0 ? -1 : s; } - if (s < 0) - return s; - - return 0; + return s; } /** diff --git a/udp.c b/udp.c index 8cfa1e1f..63dc7c25 100644 --- a/udp.c +++ b/udp.c @@ -1136,7 +1136,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, * @ifname: Name of interface to bind to, NULL if not configured * @port: Port, host order * - * Return: 0 on success, negative error code on failure + * Return: Socket fd on success, negative error code on failure */ int udp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) @@ -1180,7 +1180,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, if (!addr || !inany_v4(addr)) socks[V6][port] = s < 0 ? -1 : s; - return s < 0 ? s : 0; + return s; } /** -- 2.52.0

2 2

[PATCH v4] conf: Support CIDR notation for -a/--address option
by Jon Maloy 12 Jan '26

12 Jan '26

Extend the -a/--address option to accept addresses in CIDR notation (e.g., 192.168.1.1/24 or 2001:db8::1/64) as an alternative to using separate -a and -n options. We add a new conf_addr_prefix_len() helper function that: - Parses address strings with optional /prefix_len suffix - Validates prefix length based on address family (0-32 for IPv4, 0-128 for IPv6), including handling of IPv4-to-IPv6 mapping case. - Returns address family via union inany_addr output parameter For IPv4, the prefix length is stored in ip4.prefix_len when provided. Mixing -n and CIDR notation results in an error to catch likely user mistakes. Also fix a bug in conf_ip4_prefix() that was incorrectly using the global 'optarg' instead of its 'arg' parameter. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v3: Fixes after feedback from Laurent, David and Stefano Notably, updated man page for the -a option v4: Fixes based on feedback from David G: - Handling prefix length adjustment when IPv4-to-IPv6 mapping - Removed redundant !IN6_IS_ADDR_V4MAPPED(&addr.a6) test - Simplified tests of acceptable address types - Merged documentation and code commits - Some documentation text clarifications --- conf.c | 91 +++++++++++++++++++++++++++++++++++++++++++++++---------- inany.c | 29 ++++++++++++++++++ inany.h | 1 + passt.1 | 17 +++++++---- 4 files changed, 118 insertions(+), 20 deletions(-) diff --git a/conf.c b/conf.c index 2942c8c..b36abf3 100644 --- a/conf.c +++ b/conf.c @@ -682,7 +682,7 @@ static int conf_ip4_prefix(const char *arg) return -1; } else { errno = 0; - len = strtoul(optarg, NULL, 0); + len = strtoul(arg, NULL, 0); if (len > 32 || errno) return -1; } @@ -690,6 +690,50 @@ static int conf_ip4_prefix(const char *arg) return len; } +/** + * conf_addr_prefix_len() - Parse address with optional prefix length + * @arg: Address string, optionally with /prefix_len suffix (modified) + * @addr: Output for parsed address + * @prefix_len: Output for prefix length (0 if not specified) + * + * Return: AF_INET for IPv4, AF_INET6 for IPv6, -1 on error + */ +static int conf_addr_prefix_len(char *arg, union inany_addr *addr, + int *prefix_len) +{ + char *slash; + + *prefix_len = 0; + + /* Check for /prefix_len suffix */ + slash = strchr(arg, '/'); + if (slash) { + unsigned long len; + char *end; + + *slash = '\0'; + errno = 0; + len = strtoul(slash + 1, &end, 10); + if (errno || *end) + return -1; + + *prefix_len = len; + } + + if (!inany_prefix_pton(arg, addr, prefix_len)) + return -1; + + if (inany_v4(addr)) { + if (*prefix_len > 32) + return -1; + return AF_INET; + } + + if (*prefix_len > 128) + return -1; + return AF_INET6; +} + /** * conf_ip4() - Verify or detect IPv4 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -896,7 +940,7 @@ static void usage(const char *name, FILE *f, int status) " a zero value disables assignment\n" " default: 65520: maximum 802.3 MTU minus 802.3 header\n" " length, rounded to 32 bits (IPv4 words)\n" - " -a, --address ADDR Assign IPv4 or IPv6 address ADDR\n" + " -a, --address ADDR Assign IPv4 or IPv6 address ADDR[/PREFIXLEN]\n" " can be specified zero to two times (for IPv4 and IPv6)\n" " default: use addresses from interface with default route\n" " -n, --netmask MASK Assign IPv4 MASK, dot-decimal or bits\n" @@ -1499,6 +1543,7 @@ void conf(struct ctx *c, int argc, char **argv) const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; char userns[PATH_MAX] = { 0 }, netns[PATH_MAX] = { 0 }; bool copy_addrs_opt = false, copy_routes_opt = false; + bool prefix_from_cidr = false, prefix_from_opt = false; enum fwd_ports_mode fwd_default = FWD_NONE; bool v4_only = false, v6_only = false; unsigned dns4_idx = 0, dns6_idx = 0; @@ -1808,23 +1853,36 @@ void conf(struct ctx *c, int argc, char **argv) c->mtu = mtu; break; } - case 'a': - if (inet_pton(AF_INET6, optarg, &c->ip6.addr) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr) && - !IN6_IS_ADDR_LOOPBACK(&c->ip6.addr) && - !IN6_IS_ADDR_V4MAPPED(&c->ip6.addr) && - !IN6_IS_ADDR_V4COMPAT(&c->ip6.addr) && - !IN6_IS_ADDR_MULTICAST(&c->ip6.addr)) { + case 'a': { + union inany_addr addr; + const struct in_addr *a4; + int prefix_len = 0; + int af; + + af = conf_addr_prefix_len(optarg, &addr, &prefix_len); + + if (inany_is_unspecified(&addr) || + inany_is_multicast(&addr) || + inany_is_loopback(&addr) || + IN6_IS_ADDR_V4COMPAT(&addr.a6)) + die("Invalid address: %s", optarg); + + if (af == AF_INET6) { + c->ip6.addr = addr.a6; if (c->mode == MODE_PASTA) c->ip6.no_copy_addrs = true; break; } - if (inet_pton(AF_INET, optarg, &c->ip4.addr) && - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr) && - !IN4_IS_ADDR_BROADCAST(&c->ip4.addr) && - !IN4_IS_ADDR_LOOPBACK(&c->ip4.addr) && - !IN4_IS_ADDR_MULTICAST(&c->ip4.addr)) { + a4 = inany_v4(&addr); + if (af == AF_INET && a4) { + c->ip4.addr = *a4; + if (prefix_len) { + if (prefix_from_opt) + die("Can't mix CIDR with -n"); + c->ip4.prefix_len = prefix_len; + prefix_from_cidr = true; + } if (c->mode == MODE_PASTA) c->ip4.no_copy_addrs = true; break; @@ -1832,11 +1890,14 @@ void conf(struct ctx *c, int argc, char **argv) die("Invalid address: %s", optarg); break; + } case 'n': + if (prefix_from_cidr) + die("Can't use both -n and CIDR prefix length"); c->ip4.prefix_len = conf_ip4_prefix(optarg); if (c->ip4.prefix_len < 0) die("Invalid netmask: %s", optarg); - + prefix_from_opt = true; break; case 'M': parse_mac(c->our_tap_mac, optarg); diff --git a/inany.c b/inany.c index 7680439..f142a76 100644 --- a/inany.c +++ b/inany.c @@ -57,3 +57,32 @@ int inany_pton(const char *src, union inany_addr *dst) return 0; } + +/** inany_prefix_pton - Parse an IPv[46] address with prefix length adjustment + * @src: IPv[46] address string + * @dst: output buffer, filled with parsed address + * @prefix_len: pointer to prefix length + * + * Return: on success, 1, if no parseable address is found, 0 + */ +int inany_prefix_pton(const char *src, union inany_addr *dst, int *prefix_len) +{ + /* First try parsing as plain IPv4 */ + if (inet_pton(AF_INET, src, &dst->v4mapped.a4)) { + memset(&dst->v4mapped.zero, 0, sizeof(dst->v4mapped.zero)); + memset(&dst->v4mapped.one, 0xff, sizeof(dst->v4mapped.one)); + return 1; + } + + /* Try parsing as IPv6, adjust prefix length if mapped IPv4 address */ + if (inet_pton(AF_INET6, src, &dst->a6)) { + if (inany_v4(dst) && prefix_len && *prefix_len > 0) { + if (*prefix_len < 96) + return 0; + *prefix_len -= 96; + } + return 1; + } + + return 0; +} diff --git a/inany.h b/inany.h index 61b36fb..36865f9 100644 --- a/inany.h +++ b/inany.h @@ -295,5 +295,6 @@ static inline void inany_siphash_feed(struct siphash_state *state, const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size); int inany_pton(const char *src, union inany_addr *dst); +int inany_prefix_pton(const char *src, union inany_addr *dst, int *prefix_len); #endif /* INANY_H */ diff --git a/passt.1 b/passt.1 index db0d662..7ca03be 100644 --- a/passt.1 +++ b/passt.1 @@ -156,10 +156,14 @@ By default, the advertised MTU is 65520 bytes, that is, the maximum 802.3 MTU minus the length of a 802.3 header, rounded to 32 bits (IPv4 words). .TP -.BR \-a ", " \-\-address " " \fIaddr +.BR \-a ", " \-\-address " " \fIaddr\fR[\fB/\fR\fIprefix_len\fR] Assign IPv4 \fIaddr\fR via DHCP (\fByiaddr\fR), or \fIaddr\fR via DHCPv6 (option 5) and an \fIaddr\fR-based prefix via NDP Router Advertisement (option type 3) for an IPv6 \fIaddr\fR. +An optional \fB/\fR\fIprefix_len\fR (0-32 for IPv4, 0-128 for IPv6) can be +appended in CIDR notation (e.g., 192.168.1.1/24). This is an alternative to +using the \fB-n\fR, \fB--netmask\fR option. Mixing CIDR notation with +\fB-n\fR results in an error. This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces @@ -172,10 +176,13 @@ is assigned for IPv4, and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask Assign IPv4 netmask \fImask\fR, expressed as dot-decimal or number of bits, via -DHCP (option 1). -By default, the netmask associated to the host address matching the assigned one -is used. If there's no matching address on the host, the netmask is determined -according to the CIDR block of the assigned address (RFC 4632). +DHCP (option 1). Alternatively, the prefix length can be specified using CIDR +notation with the \fB-a\fR, \fB--address\fR option (e.g., \fB-a\fR 192.168.1.1/24). +Mixing \fB-n\fR with CIDR notation results in an error. +If no address is indicated, the netmask associated with the adopted host address, +if any, is used. If an address is indicated, but without a prefix length, the +netmask is determined based on the corresponding network class. In all other +cases, the netmask is determined by using the indicated prefix length. .TP .BR \-M ", " \-\-mac-addr " " \fIaddr -- 2.52.0

2 1

[PATCH v3 0/5] Fixes for Fedora 43
by David Gibson 11 Jan '26

11 Jan '26

While away, I updated my laptop to Fedora 43. Naturally a bunch of things in the passt tests broke. First there were the usual breakages due to a new static checker version (also one real bug). Then several other problems. Changes in v3: * Fixed a really stupid mistake in applying the change to 2/5 Changes in v2: * Trivial whitespace fix from Laurent * Used more natural array iteration in 2/5 (suggested by Laurent) * Added Laurent's R-b tags David Gibson (5): util: Be more defensive about buffer overruns in read_file() migrate: Don't use terminator element for versions[] array treewide: Don't rely on terminator records in ip[46].dns arrays test: Handle Operating System Command escapes in terminal output test: Include sshd-auth in mbuto guest image conf.c | 8 ++++++-- dhcp.c | 4 +++- dhcpv6.c | 4 +++- migrate.c | 9 ++++----- ndp.c | 4 +++- passt.h | 4 ++-- test/lib/term | 4 ++-- test/passt.mbuto | 6 ++++++ util.c | 2 +- 9 files changed, 30 insertions(+), 15 deletions(-) -- 2.52.0

2 7

[PATCH v2] udp_vu: Discard datagrams when RX virtqueue is not usable
by Laurent Vivier 11 Jan '26

11 Jan '26

During vhost-user device initialization, UDP datagrams may arrive on listening sockets before the guest has enabled the RX virtqueue. When this happens, udp_vu_sock_recv() returns 0 without consuming the datagram from the socket. The caller, udp_sock_fwd(), uses a while loop with udp_peek_addr() to process pending datagrams. Since the datagram remains in the socket buffer, udp_peek_addr() keeps returning data available, causing a busy loop with 100% CPU usage. To avoid that, we need to discard the data when the virtqueue is not ready. udp_buf_sock_to_tap() actually does the same as it reads data with udp_sock_recv() and if fd_tap is not initialized tap_send_frames() drops them. Fixes: 28997fcb29b5 ("vhost-user: add vhost-user") Link: https://bugs.passt.top/show_bug.cgi?id=185 Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- Notes: v2: - move recvmsg() from udp_vu_sock_to_tap() to udp_vu_sock_recv() udp_vu.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/udp_vu.c b/udp_vu.c index c30dcf97698f..3774d538a2d0 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -65,7 +65,8 @@ static size_t udp_vu_hdrlen(bool v6) * @v6: Set for IPv6 connections * @dlen: Size of received data (output) * - * Return: number of iov entries used to store the datagram + * Return: number of iov entries used to store the datagram, 0 if the datagram + * was discarded because the virtqueue is not ready, -1 on error */ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, bool v6, ssize_t *dlen) @@ -77,6 +78,15 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, ASSERT(!c->no_udp); + if (!vu_queue_enabled(vq) || !vu_queue_started(vq)) { + debug("Got UDP packet, but RX virtqueue not usable yet"); + + if (recvmsg(s, &msg, MSG_DONTWAIT) < 0) + debug_perror("Failed to discard datagram"); + + return 0; + } + /* compute L2 header length */ hdrlen = udp_vu_hdrlen(v6); @@ -87,7 +97,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, sizeof(struct virtio_net_hdr_mrg_rxbuf), NULL); if (iov_cnt == 0) - return 0; + return -1; /* reserve space for the headers */ ASSERT(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN)); @@ -101,7 +111,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, *dlen = recvmsg(s, &msg, 0); if (*dlen < 0) { vu_queue_rewind(vq, iov_cnt); - return 0; + return -1; } /* restore the pointer to the headers address */ @@ -216,15 +226,17 @@ void udp_vu_sock_to_tap(const struct ctx *c, int s, int n, flow_sidx_t tosidx) int iov_used; iov_used = udp_vu_sock_recv(c, vq, s, v6, &dlen); - if (iov_used <= 0) + if (iov_used < 0) break; - udp_vu_prepare(c, toside, dlen); - if (*c->pcap) { - udp_vu_csum(toside, iov_used); - pcap_iov(iov_vu, iov_used, - sizeof(struct virtio_net_hdr_mrg_rxbuf)); + if (iov_used > 0) { + udp_vu_prepare(c, toside, dlen); + if (*c->pcap) { + udp_vu_csum(toside, iov_used); + pcap_iov(iov_vu, iov_used, + sizeof(struct virtio_net_hdr_mrg_rxbuf)); + } + vu_flush(vdev, vq, elem, iov_used); } - vu_flush(vdev, vq, elem, iov_used); } } -- 2.52.0

3 4

[PATCH v2 0/3] Clean ups to epoll references
by David Gibson 11 Jan '26

11 Jan '26

A handful of simple cleanups to epoll references. Changes in v2: * Removed bogus comment line left over from an early draft David Gibson (3): tcp: Remove unused tcp_epoll_ref epoll_ctl: Add missing description for flowside field of epoll_ref fwd, tcp, udp: Consolidate epoll refs for listening sockets epoll_ctl.h | 7 +++---- fwd.h | 13 +++++++++++++ tcp.c | 8 ++++---- tcp.h | 24 ------------------------ udp.c | 6 +++--- udp.h | 15 --------------- 6 files changed, 23 insertions(+), 50 deletions(-) -- 2.52.0

3 7

[PATCH v2 0/5] flow: Introduce flow_epoll_set() to centralize epoll operations
by Laurent Vivier 09 Jan '26

09 Jan '26

Currently, each protocol handler (TCP, TCP splice, ICMP/ping, UDP) has its own code to add or modify file descriptors in epoll. This leads to duplicated boilerplate across icmp.c, tcp.c, tcp_splice.c, and udp_flow.c, with each setting up epoll_ref unions and calling epoll_ctl() with flow-type-specific details. This series introduces flow_epoll_set() in flow.c to handle epoll operations for all flow types in a unified way. The function provides a simpler interface where the caller passes the command, type, events, and file descriptor, and flow_epoll_set() handles the epoll_ref setup and epoll_ctl() call. The API is: int flow_epoll_set(int command, enum epoll_type type, const struct flow_common *f, uint32_t events, int fd, unsigned int sidei); This centralized approach will be essential for queue pair migration in the upcoming multithreading work, where flows need to be moved between different epoll instances owned by different threads. Preparatory patches: - Patch 1 removes dead timer update code in tcp_epoll_ctl() - Patch 2 removes unneeded epoll_ref indirection in udp_flow - Patch 3 refactors udp_flow_sock() to assign the socket internally - Patch 4 refactors tcp_splice_conn_epoll_events() to per-side computation Core patch: - Patch 5 introduces flow_epoll_set() used by all protocol handlers Changes in v2: - Added patch 1: Remove dead timer update in tcp_epoll_ctl() since flow table compaction was eliminated - Added patch 2: Remove unnecessary epoll_ref indirection in udp_flow.c - Dropped v1 patch 6 (compute events inside flow_epoll_set()) - Dropped v1 patch 7 (retrieve fd from flow structure) - Added epoll_ctl() command parameter (EPOLL_CTL_ADD/EPOLL_CTL_MOD) - Callers must set epollfd via flow_epollid_set() before calling flow_epoll_set() - Removed FLOW_EPOLL_TIMER_ADD/FLOW_EPOLL_TIMER_MOD constants - Reduced series from 7 to 5 patches Laurent Vivier (5): tcp: remove timer update in tcp_epoll_ctl() udp_flow: remove unneeded epoll_ref indirection udp_flow: Assign socket to flow inside udp_flow_sock() tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation flow: Introduce flow_epoll_set() to centralize epoll operations flow.c | 33 +++++++++++++++ flow.h | 3 ++ icmp.c | 11 ++--- tcp.c | 72 ++++++++++++++------------------ tcp_splice.c | 115 ++++++++++++++++++++++++--------------------------- udp_flow.c | 19 +++------ 6 files changed, 131 insertions(+), 122 deletions(-) -- 2.52.0

2 9

[PATCH] tcp: remove timer update in tcp_epoll_ctl()
by Laurent Vivier 09 Jan '26

09 Jan '26

Timer update in tcp_epoll_ctl() has been added by bb708111833e ("treewide: Packet abstraction with mandatory boundary checks") because epoll_ref stores "conn - tc" that can change in tcp_table_compact(). But since e2e8219f13b8 ("flow, tcp: Consolidate flow pointer<->index helpers") we use FLOW_IDX() and since 8981a720aac4 ("flow: Avoid moving flow entries to compact table") flow table doesn't use a compaction procedure so FLOW_IDX() never changes. Updating the timer event is now a no-op, remove it from tcp_epoll_ctl(). Fixes: 8981a720aac4 ("flow: Avoid moving flow entries to compact table") Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/tcp.c b/tcp.c index e7fa85f346b2..5141cdc7e839 100644 --- a/tcp.c +++ b/tcp.c @@ -552,18 +552,6 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn *conn) flow_epollid_set(&conn->f, EPOLLFD_ID_DEFAULT); - if (conn->timer != -1) { - union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->timer, - .flow = FLOW_IDX(conn) }; - struct epoll_event ev_t = { .data.u64 = ref_t.u64, - .events = EPOLLIN | EPOLLET }; - - if (epoll_ctl(flow_epollfd(&conn->f), EPOLL_CTL_MOD, - conn->timer, &ev_t)) - return -errno; - } - return 0; } -- 2.52.0

2 1

[PATCH] apparmor: Allow reading TCP RTO sysctl parameters
by Stefano Brivio 08 Jan '26

08 Jan '26

From: Martin Pitt <mpitt(a)redhat.com> Since commits 3dde0e07804e ("tcp: Update data retransmission timeout") and 1a834879a2f7 ("tcp: Clamp the retry timeout") from 2025-12-02, passt reads additional TCP-related sysctl parameters from /proc to configure retransmission timeout behavior: - /proc/sys/net/ipv4/tcp_syn_retries - /proc/sys/net/ipv4/tcp_syn_linear_timeouts - /proc/sys/net/ipv4/tcp_rto_max_ms These are read by tcp_get_rto_params() during initialization. Adjust the AppArmor profile accordingly. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2426863 Link: https://github.com/cockpit-project/bots/pull/8568 Fixes: 3dde0e07804e ("tcp: Update data retransmission timeout") Fixes: 1a834879a2f7 ("tcp: Clamp the retry timeout") Signed-off-by: Martin Pitt <mpitt(a)redhat.com> [sbrivio: Minor formatting change, changed commit references] Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Martin, I took the liberty to add a newline around the lines you're adding so that we need a single comment and everything is aligned. I also changed the format of commit references to what we typically use, which is inspired by the preferred format for kernel submissions, I used this one-liner: git show -s --abbrev=12 --pretty=format:"Fixes: %h (\"%s\")" "${SHA}" which actually belongs to CONTRIBUTING.md, cf. page 1241 of my to-do book. contrib/apparmor/abstractions/passt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 43fd63f..25b2ea8 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -36,6 +36,10 @@ @{PROC}/sys/net/ipv4/ip_local_port_range r, # fwd_probe_ephemeral() + @{PROC}/sys/net/ipv4/tcp_syn_retries r, # tcp_get_rto_params(), tcp.c + @{PROC}/sys/net/ipv4/tcp_syn_linear_timeouts r, + @{PROC}/sys/net/ipv4/tcp_rto_max_ms r, + network netlink raw, # nl_sock_init_do(), netlink.c network inet stream, # tcp.c -- 2.43.0

1 0

[PATCH v3 01/14] inany: Extend inany_ntop() to treat NULL as a fully unspecified address
by David Gibson 08 Jan '26

08 Jan '26

In a number of places we're using a convention that a NULL inany represents a dual-stack unspecified address, that is one which includes both 0.0.0.0 and ::. Extend inany_ntop() to handle that convention, representing it as "*". Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- inany.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/inany.c b/inany.c index 7680439d..87a4d8b6 100644 --- a/inany.c +++ b/inany.c @@ -22,7 +22,7 @@ const union inany_addr inany_loopback4 = INANY_INIT4(IN4ADDR_LOOPBACK_INIT); const union inany_addr inany_any4 = INANY_INIT4(IN4ADDR_ANY_INIT); /** inany_ntop - Convert an IPv[46] address to text format - * @src: IPv[46] address + * @src: IPv[46] address (NULL for unspecified) * @dst: output buffer, minimum INANY_ADDRSTRLEN bytes * @size: size of buffer at @dst * @@ -30,9 +30,12 @@ const union inany_addr inany_any4 = INANY_INIT4(IN4ADDR_ANY_INIT); */ const char *inany_ntop(const union inany_addr *src, char *dst, socklen_t size) { - const struct in_addr *v4 = inany_v4(src); + const struct in_addr *v4; + + if (!src) + return strncpy(dst, "*", size); - if (v4) + if ((v4 = inany_v4(src))) return inet_ntop(AF_INET, v4, dst, size); return inet_ntop(AF_INET6, &src->a6, dst, size); -- 2.52.0

2 1

[PATCH] udp_flow: remove unneeded epoll_ref indirection
by Laurent Vivier 08 Jan '26

08 Jan '26

The fref union was used to convert flow_sidx_t to uint32_t for assignment to ref.data. This is unnecessary since epoll_ref already contains a flowside member of type flow_sidx_t, so we can assign directly. This aligns with how icmp.c and other callers assign flow_sidx_t to epoll_ref. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- udp_flow.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/udp_flow.c b/udp_flow.c index 8907f2f72741..0ba788060db7 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -74,10 +74,6 @@ static int udp_flow_sock(const struct ctx *c, { const struct flowside *side = &uflow->f.side[sidei]; uint8_t pif = uflow->f.pif[sidei]; - union { - flow_sidx_t sidx; - uint32_t data; - } fref = { .sidx = FLOW_SIDX(uflow, sidei) }; union epoll_ref ref; int rc; int s; @@ -89,7 +85,7 @@ static int udp_flow_sock(const struct ctx *c, } ref.type = EPOLL_TYPE_UDP; - ref.data = fref.data; + ref.flowside = FLOW_SIDX(uflow, sidei); ref.fd = s; flow_epollid_set(&uflow->f, EPOLLFD_ID_DEFAULT); -- 2.52.0

2 1