- dev - passt

[PATCH v2 1/5] util: Be more defensive about buffer overruns in read_file()
by David Gibson 07 Jan '26

07 Jan '26

clang-21.1.7 complains about read_file(), thinking that total_read might come to exceed buf_size, leading to an out of bounds access at the end of the function. In fact, the semantics of read()'s return mean this can't ever happen. But we already have to check for the total_read == buf_size case, so it's basically free to change it to >= and suppress the error. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> Reviewed-by: Laurent Vivier <lvivier(a)redhat.com> --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 27303950..a48f727c 100644 --- a/util.c +++ b/util.c @@ -715,7 +715,7 @@ static ssize_t read_file(const char *path, char *buf, size_t buf_size) close(fd); - if (total_read == buf_size) { + if (total_read >= buf_size) { buf[buf_size - 1] = '\0'; return -ENOBUFS; } -- 2.52.0

1 0

[PATCH 0/5] Fixes for Fedora 43 (or other bitrot)
by David Gibson 07 Jan '26

07 Jan '26

While away, I updated my laptop to Fedora 43. Naturally a bunch of things in the passt tests broke. First there were the usual breakages due to a new static checker version (also one real bug). Then several other problems. David Gibson (5): util: Be more defensive about buffer overruns in read_file() migrate: Don't use terminator element for versions[] array treewide: Don't rely on terminator records in ip[46].dns arrays test: Handle Operating System Command escapes in terminal output test: Include sshd-auth in mbuto guest image conf.c | 8 ++++++-- dhcp.c | 4 +++- dhcpv6.c | 4 +++- migrate.c | 3 +-- ndp.c | 4 +++- passt.h | 4 ++-- test/lib/term | 4 ++-- test/passt.mbuto | 6 ++++++ util.c | 2 +- 9 files changed, 27 insertions(+), 12 deletions(-) -- 2.52.0

2 13

[PATCH 2/2] fwd: Minor cleanup to fwd_nat_from_splice()
by David Gibson 06 Jan '26

06 Jan '26

The order we do things in this function is slightly odd, and we have a redundant assignment to tgt->oport. Remove that, and re-order for clarity. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/fwd.c b/fwd.c index 9b701ad0..961c533f 100644 --- a/fwd.c +++ b/fwd.c @@ -660,13 +660,15 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, return PIF_NONE; } + /* Preserve the src & dest (loopback) addresses */ + tgt->oaddr = ini->eaddr; tgt->eaddr = ini->oaddr; - /* Preserve the specific loopback address used, but let the kernel pick - * a source port on the target side - */ - tgt->oaddr = ini->eaddr; + /* Let the kernel pick a host side source port */ tgt->oport = 0; + if (proto == IPPROTO_UDP) + /* But for UDP preserve the source port */ + tgt->oport = ini->eport; tgt->eport = ini->oport; if (proto == IPPROTO_TCP) @@ -674,12 +676,6 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, else if (proto == IPPROTO_UDP) tgt->eport += c->udp.fwd_out.delta[tgt->eport]; - /* Let the kernel pick a host side source port */ - tgt->oport = 0; - if (proto == IPPROTO_UDP) - /* But for UDP preserve the source port */ - tgt->oport = ini->eport; - return PIF_HOST; } -- 2.52.0

1 0

[PATCH 3/3] fwd, tcp, udp: Consolidate epoll refs for listening sockets
by David Gibson 05 Jan '26

05 Jan '26

The epoll references we use for TCP listening sockets and UDP "listening" sockets have identical information. Combine them into a single structure. Note that, despite the name, epoll_ref.udp was only ever used for "listening" sockets, not flow sockets. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- epoll_ctl.h | 6 ++---- fwd.h | 14 ++++++++++++++ tcp.c | 8 ++++---- tcp.h | 14 -------------- udp.c | 6 +++--- udp.h | 15 --------------- 6 files changed, 23 insertions(+), 40 deletions(-) diff --git a/epoll_ctl.h b/epoll_ctl.h index 02b081e2..3f802e76 100644 --- a/epoll_ctl.h +++ b/epoll_ctl.h @@ -21,8 +21,7 @@ * @fd: File descriptor number (implies < 2^24 total descriptors) * @flow: Index of the flow this fd is linked to * @flowside: Index and side of a flow this fd is linked to - * @tcp_listen: TCP-specific reference part for listening sockets - * @udp: UDP-specific reference part + * @listen: Information for listening sockets * @data: Data handled by protocol handlers * @nsdir_fd: netns dirfd for fallback timer checking if namespace is gone * @queue: vhost-user queue index for this fd @@ -35,8 +34,7 @@ union epoll_ref { union { uint32_t flow; flow_sidx_t flowside; - union tcp_listen_epoll_ref tcp_listen; - union udp_listen_epoll_ref udp; + union fwd_listen_ref listen; uint32_t data; int nsdir_fd; int queue; diff --git a/fwd.h b/fwd.h index 77925822..bf41907b 100644 --- a/fwd.h +++ b/fwd.h @@ -16,6 +16,20 @@ struct flowside; void fwd_probe_ephemeral(void); bool fwd_port_is_ephemeral(in_port_t port); +/** + * union fwd_listen_ref - information about a single listening socket + * @port: Bound port number of the socket + * @pif: pif in which the socket is listening + * @fe: Index of forwarding entry + */ +union fwd_listen_ref { + struct { + in_port_t port; + uint8_t pif; + }; + uint32_t u32; +}; + enum fwd_ports_mode { FWD_UNSET = 0, FWD_SPEC = 1, diff --git a/tcp.c b/tcp.c index e7fa85f3..9fc385d2 100644 --- a/tcp.c +++ b/tcp.c @@ -2485,8 +2485,8 @@ void tcp_listen_handler(const struct ctx *c, union epoll_ref ref, * address, record that as our address, as implemented for vhost-user * mode only, below. */ - ini = flow_initiate_sa(flow, ref.tcp_listen.pif, &sa, - NULL, ref.tcp_listen.port); + ini = flow_initiate_sa(flow, ref.listen.pif, &sa, + NULL, ref.listen.port); if (getsockname(s, &sa.sa, &sl) || inany_from_sockaddr(&ini->oaddr, &ini->oport, &sa) < 0) @@ -2685,7 +2685,7 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, int tcp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) { - union tcp_listen_epoll_ref tref = { + union fwd_listen_ref ref = { .port = port, .pif = pif, }; @@ -2722,7 +2722,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, } s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, - port, tref.u32); + port, ref.u32); if (fwd->mode == FWD_AUTO) { if (!addr || inany_v4(addr)) diff --git a/tcp.h b/tcp.h index 516dfef5..ef1e3544 100644 --- a/tcp.h +++ b/tcp.h @@ -30,20 +30,6 @@ void tcp_update_l2_buf(const unsigned char *eth_d); extern bool peek_offset_cap; -/** - * union tcp_listen_epoll_ref - epoll reference portion for TCP listening - * @port: Bound port number of the socket - * @pif: pif in which the socket is listening - * @u32: Opaque u32 value of reference - */ -union tcp_listen_epoll_ref { - struct { - in_port_t port; - uint8_t pif; - }; - uint32_t u32; -}; - /** * struct tcp_ctx - Execution context for TCP routines * @port_to_tap: Ports bound host-side, packets to tap or spliced diff --git a/udp.c b/udp.c index eda55c39..747d4dd4 100644 --- a/udp.c +++ b/udp.c @@ -928,7 +928,7 @@ void udp_listen_sock_handler(const struct ctx *c, const struct timespec *now) { if (events & (EPOLLERR | EPOLLIN)) - udp_sock_fwd(c, ref.fd, ref.udp.pif, ref.udp.port, now); + udp_sock_fwd(c, ref.fd, ref.listen.pif, ref.listen.port, now); } /** @@ -1141,7 +1141,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) { - union udp_listen_epoll_ref uref = { + union fwd_listen_ref ref = { .pif = pif, .port = port, }; @@ -1175,7 +1175,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, } s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, - addr, ifname, port, uref.u32); + addr, ifname, port, ref.u32); if (!addr || inany_v4(addr)) socks[V4][port] = s < 0 ? -1 : s; diff --git a/udp.h b/udp.h index 5407db3b..94c698e2 100644 --- a/udp.h +++ b/udp.h @@ -22,21 +22,6 @@ int udp_init(struct ctx *c); void udp_port_rebind_all(struct ctx *c); void udp_update_l2_buf(const unsigned char *eth_d); -/** - * union udp_listen_epoll_ref - epoll reference for "listening" UDP sockets - * @port: Source port for connected sockets, bound port otherwise - * @pif: pif for this socket - * @u32: Opaque u32 value of reference - */ -union udp_listen_epoll_ref { - struct { - in_port_t port; - uint8_t pif; - }; - uint32_t u32; -}; - - /** * struct udp_ctx - Execution context for UDP * @fwd_in: Port forwarding configuration for inbound packets -- 2.52.0

1 0

[PATCH 0/3] Clean ups to epoll references
by David Gibson 05 Jan '26

05 Jan '26

A handful of simple cleanups to epoll references. David Gibson (3): tcp: Remove unused tcp_epoll_ref epoll_ctl: Add missing description for flowside field of epoll_ref fwd, tcp, udp: Consolidate epoll refs for listening sockets epoll_ctl.h | 7 +++---- fwd.h | 14 ++++++++++++++ tcp.c | 8 ++++---- tcp.h | 24 ------------------------ udp.c | 6 +++--- udp.h | 15 --------------- 6 files changed, 24 insertions(+), 50 deletions(-) -- 2.52.0

1 2

[PATCH 0/3] Allow listen functions to return fds
by David Gibson 05 Jan '26

05 Jan '26

For future forwarding changes, it makes more sense for the tcp and udp listen functions to return socket fds, rather than just success / failure. Make the change, fixing bug 186 and adding a debugging option along the way. Link: https://bugs.passt.top/show_bug.cgi?id=186 David Gibson (3): conf: Introduce --no-bindtodevice option for testing tcp, udp, conf: Don't silently ignore listens on unsupported IP versions tcp, udp: Make {tcp,udp}_listen() return socket fds conf.c | 26 +++++++++++++++++++------- passt.1 | 6 ++++++ tcp.c | 13 ++++--------- udp.c | 10 ++++------ 4 files changed, 33 insertions(+), 22 deletions(-) -- 2.52.0

1 0

[PATCH 0/7] flow: Introduce flow_epoll_set() to centralize epoll operations
by Laurent Vivier 27 Dec '25

27 Dec '25

Currently, each protocol handler (TCP, TCP splice, ICMP/ping, UDP) has its own code to add or modify file descriptors in epoll. This leads to duplicated boilerplate across icmp.c, tcp.c, tcp_splice.c, and udp_flow.c, with each setting up epoll_ref unions and calling epoll_ctl() with flow-type-specific details. This series introduces flow_epoll_set() in flow.c to handle epoll operations for all flow types in a unified way. The function evolves across the series, progressively absorbing more responsibilities: 1. Initial version takes explicit fd, events, and ctx parameters 2. Events computation is moved inside the function by relocating tcp_conn_epoll_events() and tcp_splice_conn_epoll_events() into flow.c 3. The ctx parameter is removed by using epoll_id_to_fd[EPOLLFD_ID_DEFAULT] directly for new flows 4. The fd parameter is removed by having the function extract the file descriptor from the flow structure based on the epoll type The final API is simply: int flow_epoll_set(enum epoll_type type, const struct flow_common *f, unsigned int sidei); This centralized approach will be essential for queue pair migration in the upcoming multithreading work, where flows need to be moved between different epoll instances owned by different threads. Preparatory patches: - Patch 1 fixes EPOLL_TYPE_TCP_TIMER to use the actual timer fd - Patch 2 refactors udp_flow_sock() to assign the socket internally - Patch 3 refactors tcp_splice_conn_epoll_events() to per-side computation Core series: - Patch 4 introduces the initial flow_epoll_set() function - Patch 5 removes the ctx parameter - Patch 6 moves event computation inside flow_epoll_set() - Patch 7 removes the fd parameter, completing the refactoring Laurent Vivier (7): tcp: Update EPOLL_TYPE_TCP_TIMER fd udp_flow: Assign socket to flow inside udp_flow_sock() tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation flow: Introduce flow_epoll_set() to centralize epoll operations flow: Use epoll_id_to_fd[EPOLLFD_ID_DEFAULT] in flow_epollid_set() flow: Compute epoll events inside flow_epoll_set() flow: Have flow_epoll_set() retrieve file descriptor from flow structure flow.c | 158 +++++++++++++++++++++++++++++++++++++++++++++++++++ flow.h | 4 ++ icmp.c | 8 +-- tcp.c | 68 +++------------------- tcp_splice.c | 77 +++++-------------------- udp_flow.c | 17 ++---- 6 files changed, 190 insertions(+), 142 deletions(-) -- 2.51.1

2 14

[PATCH] selinux: Enable read and watch permissions on netns directory as well
by Stefano Brivio 24 Dec '25

24 Dec '25

With commit 7aeda16a7818 ("selinux: Transition to pasta_t in containers"), we need to make sure that pasta can access the target namespace directory passed by Podman, and, in a general case, we have all the permissions we need. But if we now start a container without the Podman changes referenced by commit fd1bcc30af07 ("selinux: add container_var_run_t type transition"), or with them, but with the container being created before those and without a reboot in between, we'll additionally need 'read' and 'watch' permissions on user_tmp_t directory as well, as user_tmp_t is still the (inconsistent) context of the namespace entry. Otherwise, on a container start/restart, we'll get SELinux denials: type=AVC msg=audit(1766451401.296:184): avc: denied { read } for pid=2159 comm="pasta.avx2" name="netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:obje ct_r:user_tmp_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1766451401.298:185): avc: denied { watch } for pid=2159 comm="pasta.avx2" path="/run/user/1001/netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1 This can be reproduced quite simply: $ podman create -q --name hello hello 6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770 [upgrade passt's SELinux policy to a version including 7aeda16a7818] $ podman start hello Error: unable to start container "6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770": pasta failed with exit code 1: netns dir open: Permission denied, exiting Reported-by: Tuomo Soini <tis(a)foobar.fi> Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 95fe42a..3eb58f6 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton; manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) files_pid_filetrans(pasta_t, pasta_pid_t, file) -allow pasta_t user_tmp_t:dir { add_name remove_name search write }; +allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write }; allow pasta_t user_tmp_t:fifo_file append; allow pasta_t user_tmp_t:file { create open write }; allow pasta_t user_tmp_t:sock_file { create unlink }; -- 2.43.0

2 2

passt: new version 2025_12_23.2ba9fd5 available
by Stefano Brivio 24 Dec '25

24 Dec '25

The new version with tag 2025_12_23.2ba9fd5 includes the following changes: 2ba9fd5 tcp: Update EPOLL_TYPE_TCP_TIMER fd 6292845 udp: Rename udp_sock_init() to udp_listen() with small cleanups 0f4ba61 tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() 75dcbc3 pasta: Warn, disable matching IP version if not supported, in local mode d2c5133 selinux: Enable read and watch permissions on netns directory as well https://passt.top/passt/log/?qt=range&q=2025_12_15.b40f5cd..2025_12_23.2ba9… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9946709/ permanent mirror: https://passt.top/builds/copr/0^20251223.g2ba9fd5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g2ba9fd5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_2ba9fd5-1_all.deb -- Stefano

1 0

[PATCH] tcp: Update EPOLL_TYPE_TCP_TIMER fd
by Laurent Vivier 24 Dec '25

24 Dec '25

For consistency with other epoll events, set the fd field to the file descriptor actually added by epoll_ctl() (conn->timer), rather than conn->sock. This is a no-op change as ref.fd is not currently used in tcp_timer_handler(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index b179e3991236..fade42b0c4d9 100644 --- a/tcp.c +++ b/tcp.c @@ -554,7 +554,7 @@ static int tcp_epoll_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer != -1) { union epoll_ref ref_t = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev_t = { .data.u64 = ref_t.u64, .events = EPOLLIN | EPOLLET }; @@ -582,7 +582,7 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) if (conn->timer == -1) { union epoll_ref ref = { .type = EPOLL_TYPE_TCP_TIMER, - .fd = conn->sock, + .fd = conn->timer, .flow = FLOW_IDX(conn) }; struct epoll_event ev = { .data.u64 = ref.u64, .events = EPOLLIN | EPOLLET }; -- 2.51.1

2 1