- dev - passt

[PATCH v2 0/7] Extensive bandaging for SELinux policy issues, old and new
by Stefano Brivio 17 Aug '23

17 Aug '23

The most important fix here is actually the one that allows pasta and passt to create user namespaces (and hence, to start -- we need that for sandboxing) with recent kernels on e.g. Fedora Rawhide -- that's patch 3/7. But there are a number of other issues, some old, some new, that would currently prevent pasta from e.g. starting a shell, or simply run 'ip address show', again at least on Fedora Rawhide. Fix them. v2: Actually override pasta symlinks with hard links in 1/7 Stefano Brivio (7): fedora: Install pasta as hard link to ensure SELinux file context match selinux: Use explicit paths for binaries in file context selinux: Fix user namespace creation after breaking kernel change selinux: Update policy to fix user/group settings selinux: Add rules for sysctl and /proc/net accesses selinux: Allow pasta_t to read nsfs entries selinux: Fix domain transitions for typical commands pasta might run contrib/fedora/passt.spec | 7 +++++++ contrib/selinux/passt.fc | 3 ++- contrib/selinux/passt.te | 10 ++++++++-- contrib/selinux/pasta.fc | 3 ++- contrib/selinux/pasta.te | 33 ++++++++++++++++++++++++++++++--- 5 files changed, 49 insertions(+), 7 deletions(-) -- 2.39.2

2 9

[PATCH v2 0/7] Flow Table Preliminaries
by David Gibson 17 Aug '23

17 Aug '23

I'm still working on bunch of things to start implementing the generalised flow table. However, I think this set of preliminary clean ups and fixes stand well enough on their own that they're ready for merge now. Based on the epoll patch series. Changes since v1: * Add missing patch moving in_epoll flag David Gibson (7): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp: Consistent usage of ports in tcp_seq_init() tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers tcp: Move in_epoll flag out of common connection structure icmp.c | 12 ++-- icmp.h | 3 +- passt.c | 10 ++- passt.h | 4 +- pasta.c | 2 +- tap.c | 29 ++++---- tcp.c | 194 +++++++++++++++++++++++---------------------------- tcp.h | 5 +- tcp_conn.h | 18 ++--- tcp_splice.c | 4 +- udp.c | 37 ++++------ udp.h | 5 +- util.h | 4 +- 13 files changed, 151 insertions(+), 176 deletions(-) -- 2.41.0

1 8

[PATCH 0/3] pasta: Don't propagate host address lifetimes to the container
by David Gibson 16 Aug '23

16 Aug '23

We realized in yesterday's call that podman issue 19405 could be explained by the fact that along with other attributes we're copying the lifetime of host addresses to the container. Here is a fix for that bug, along with a couple of other small fixes to the netlink code I noticed as I was making it. Link: https://github.com/containers/podman/issues/19405 Link: https://bugs.passt.top/show_bug.cgi?id=70 David Gibson (3): netlink: Remove redundant check on nlmsg_type netlink: Correctly calculate attribute length for address messages netlink: Don't propagate host address expiry to the container netlink.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) -- 2.41.0

2 4

[PATCH 0/7] Extensive bandaging for SELinux policy issues, old and new
by Stefano Brivio 16 Aug '23

16 Aug '23

The most important fix here is actually the one that allows pasta and passt to create user namespaces (and hence, to start -- we need that for sandboxing) with recent kernels on e.g. Fedora Rawhide -- that's patch 3/7. But there are a number of other issues, some old, some new, that would currently prevent pasta from e.g. starting a shell, or simply run 'ip address show', again at least on Fedora Rawhide. Fix them. Stefano Brivio (7): fedora: Install pasta as hard link to ensure SELinux file context match selinux: Use explicit paths for binaries in file context selinux: Fix user namespace creation after breaking kernel change selinux: Update policy to fix user/group settings selinux: Add rules for sysctl and /proc/net accesses selinux: Allow pasta_t to read nsfs entries selinux: Fix domain transitions for typical commands pasta might run contrib/fedora/passt.spec | 4 ++++ contrib/selinux/passt.fc | 3 ++- contrib/selinux/passt.te | 10 ++++++++-- contrib/selinux/pasta.fc | 3 ++- contrib/selinux/pasta.te | 33 ++++++++++++++++++++++++++++++--- 5 files changed, 46 insertions(+), 7 deletions(-) -- 2.39.2

2 15

[PATCH] tap: Fix format specifier in tap4_is_fragment() warning
by Stefano Brivio 16 Aug '23

16 Aug '23

Spotted by Coverity, relatively harmless. Fixes: e01759e2fab0 ("tap: Explicitly drop IPv4 fragments, and give a warning") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tap.c b/tap.c index a6f8692..760deb7 100644 --- a/tap.c +++ b/tap.c @@ -561,7 +561,8 @@ static bool tap4_is_fragment(const struct iphdr *iph, num_dropped++; if (now->tv_sec - last_message > FRAGMENT_MSG_RATE) { - warn("Can't process IPv4 fragments (%lu dropped)", num_dropped); + warn("Can't process IPv4 fragments (%u dropped)", + num_dropped); last_message = now->tv_sec; num_dropped = 0; } -- 2.39.2

2 1

[PATCH] conf: Demote overlapping port ranges error to a warning
by David Gibson 13 Aug '23

13 Aug '23

We give a fatal error if the port ranges from any port forwarding specifiers overlap. This occurs even if those port ranges are specifically bound to different addresses, so there's not really any overlap. Right now, we can't 100% handle this case correctly, because our data structures don't have a way to represent per-address forwarding. However, there are a number of cases that will actually work just fine: e.g. mapping the same port to the same port on two different addresses (say :: and 127.0.0.1). We have long term plans to fix this properly, but that is still some time away. For the time being, demote this error to a warning so that the cases that already work will be allowed. Link: https://bugs.passt.top/show_bug.cgi?id=56 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/conf.c b/conf.c index 0631b00..0ad6e23 100644 --- a/conf.c +++ b/conf.c @@ -303,7 +303,7 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, for (i = xrange.first; i <= xrange.last; i++) { if (bitmap_isset(exclude, i)) - goto overlap; + die("Overlapping excluded ranges %s", optarg); bitmap_set(exclude, i); } @@ -370,7 +370,8 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, for (i = orig_range.first; i <= orig_range.last; i++) { if (bitmap_isset(fwd->map, i)) - goto overlap; + warn( +"Altering mapping of already mapped port number: %s", optarg); if (bitmap_isset(exclude, i)) continue; @@ -406,8 +407,6 @@ enfile: die("Can't open enough sockets for port specifier: %s", optarg); bad: die("Invalid port specifier %s", optarg); -overlap: - die("Overlapping port specifier %s", optarg); mode_conflict: die("Port forwarding mode '%s' conflicts with previous mode", optarg); bind_fail: -- 2.41.0

2 1

[PATCH] tap: fix seq->p.count limit
by Laurent Vivier 13 Aug '23

13 Aug '23

The number of items in pool_l4_t is defined to UIO_MAXIOV, not TAP_SEQS. TAP_SEQS is the number of the messages. Fix the value used to compare seq->p.count with. Fix: bb708111833e ("treewide: Packet abstraction with mandatory boundary checks") Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tap.c b/tap.c index e034f9468267..69bd19a2a91a 100644 --- a/tap.c +++ b/tap.c @@ -678,7 +678,7 @@ resume: seq->daddr.s_addr = iph->daddr; \ } while (0) - if (seq && L4_MATCH(iph, uh, seq) && seq->p.count < TAP_SEQS) + if (seq && L4_MATCH(iph, uh, seq) && seq->p.count < UIO_MAXIOV) goto append; if (seq_count == TAP_SEQS) @@ -686,7 +686,7 @@ resume: for (seq = tap4_l4 + seq_count - 1; seq >= tap4_l4; seq--) { if (L4_MATCH(iph, uh, seq)) { - if (seq->p.count >= TAP_SEQS) + if (seq->p.count >= UIO_MAXIOV) seq = NULL; break; } @@ -840,7 +840,7 @@ resume: } while (0) if (seq && L4_MATCH(ip6h, proto, uh, seq) && - seq->p.count < TAP_SEQS) + seq->p.count < UIO_MAXIOV) goto append; if (seq_count == TAP_SEQS) @@ -848,7 +848,7 @@ resume: for (seq = tap6_l4 + seq_count - 1; seq >= tap6_l4; seq--) { if (L4_MATCH(ip6h, proto, uh, seq)) { - if (seq->p.count >= TAP_SEQS) + if (seq->p.count >= UIO_MAXIOV) seq = NULL; break; } -- 2.41.0

3 4

[PATCH v3 00/13] Clean up to tap errors and epoll dispatch
by David Gibson 13 Aug '23

13 Aug '23

Getting from an epoll event to the relevant handler function is currently several levels of functions and tests. This series simplifies this to be pretty close to a single switch on a value in the epoll ref dispatching directly to the appropriate handler. Doing this requires some preliminary cleaning up of the handling of errors or disconnects on the tap device. Changes since v2: * Removed a (pre-existing) redundant close() and EPOLL_CTL_DEL in one of the tap reset paths * Fixed incorrect parameter to trace() message Changes since v1: * Give listening TCP sockets their own reference type * Fold "tap reset" series into this one Changes since v2 of tap reset series: * More thorough cleanup of handling error events on the listening Unix socket. Changes since v1 of the tap reset series: * Two extra patches that further clean up the reset path David Gibson (13): tap: Clean up tap reset path tap: Clean up behaviour for errors on listening Unix socket tap: Fold reset handling into tap_handler_pasta() tap: Fold reset handling into tap_handler_passt() epoll: Generalize epoll_ref to cover things other than sockets epoll: Always use epoll_ref for the epoll data variable epoll: Fold sock_handler into general switch on epoll event fd epoll: Split handling of ICMP and ICMPv6 sockets epoll: Tiny cleanup to udp_sock_handler() epoll: Split handling of TCP timerfds into its own handler function epoll: Split handling of listening TCP sockets into their own handler epoll: Split listening Unix domain socket into its own type epoll: Use different epoll types for passt and pasta tap fds icmp.c | 118 ++++++++++++++++++++++++------------------- icmp.h | 9 ++-- passt.c | 90 +++++++++++++++++++-------------- passt.h | 56 ++++++++++++++++----- pasta.c | 8 ++- tap.c | 138 +++++++++++++++++++++++++-------------------------- tap.h | 7 ++- tcp.c | 84 +++++++++++++------------------ tcp.h | 28 +++++++---- tcp_conn.h | 4 +- tcp_splice.c | 8 +-- tcp_splice.h | 2 +- udp.c | 16 +++--- util.c | 27 +++++++--- 14 files changed, 334 insertions(+), 261 deletions(-) -- 2.41.0

2 14

[PATCH 0/6] Flow Table Preliminaries
by David Gibson 11 Aug '23

11 Aug '23

I'm still working on bunch of things to start implementing the generalised flow table. However, I think this set of preliminary clean ups and fixes stand well enough on their own that they're ready for merge now. Based on the epoll patch series. David Gibson (6): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp: Consistent usage of ports in tcp_seq_init() tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers icmp.c | 12 ++-- icmp.h | 3 +- passt.c | 10 ++- passt.h | 4 +- pasta.c | 2 +- tap.c | 29 ++++----- tcp.c | 188 ++++++++++++++++++++++++----------------------------- tcp.h | 5 +- tcp_conn.h | 12 ++-- udp.c | 37 ++++------- udp.h | 5 +- util.h | 4 +- 12 files changed, 142 insertions(+), 169 deletions(-) -- 2.41.0

1 7

[PATCH 0/9] Clean up to epoll dispatch
by David Gibson 11 Aug '23

11 Aug '23

Getting from an epoll event to the relevant handler function is currently several levels of functions and tests. This series simplifies this to be pretty close to a single switch on a value in the epoll ref dispatching directly to the appropriate handler. Based on the tap reset series. David Gibson (9): epoll: Generalize epoll_ref to cover things other than sockets epoll: Always use epoll_ref for the epoll data variable epoll: Fold sock_handler into general switch on epoll event fd epoll: Split handling of ICMP and ICMPv6 sockets epoll: Tiny cleanup to udp_sock_handler() epoll: Split handling of TCP timerfds into its own handler function epoll: Split handling of listening TCP sockets into their own handler epoll: Split listening Unix domain socket into its own type epoll: Use different epoll types for passt and pasta tap fds icmp.c | 118 +++++++++++++++++++++++++++++---------------------- icmp.h | 9 ++-- passt.c | 90 +++++++++++++++++++++++---------------- passt.h | 52 ++++++++++++++++++----- pasta.c | 8 +++- tap.c | 63 +++++++++++++-------------- tap.h | 7 ++- tcp.c | 64 ++++++++++------------------ tcp.h | 11 +++-- tcp_conn.h | 4 +- tcp_splice.c | 4 +- udp.c | 16 +++---- util.c | 27 +++++++++--- 13 files changed, 263 insertions(+), 210 deletions(-) -- 2.41.0

2 16

2024

2023

2022

2021

dev