- dev - passt

[PATCH] selinux: Access to netns for podman-build, read access for netns in general
by Stefano Brivio 10 Jul '26

10 Jul '26

A few additional rules are needed when pasta is started by Podman in particular cases: - with podman-build or Buildah, pasta needs to access the target namespace reference using a procfs namespace link entry, instead of the usual directory under /run or /var/run. For that, we have a rule enabling access to container_t:lnk_file. On some systems, though, the class is 'dir' instead of 'lnk_file'. I don't have a concrete way to reproduce this or a full explanation, but in any case, an additional rule for that is obviously harmless: allow pasta_t to open, read, and search a container_t:dir - with custom networks, pasta needs to write PID files to a location indicated by Podman. If the PID file already exists, the existing permissions aren't sufficient: we also need a 'read' rule. Add that, for 'dir' and 'file' objects labeled as either container_var_run_t or ifconfig_var_run_t (this depends on the installed Podman and container-selinux versions) Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index ff74dd7..9394f97 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -175,6 +175,7 @@ allow pasta_t container_runtime_t:fifo_file { getattr write }; allow pasta_t container_runtime_t:file read; allow pasta_t container_runtime_t:lnk_file read; allow pasta_t container_t:lnk_file read; +allow pasta_t container_t:dir { open read search }; allow pasta_t pasta_port_t:tcp_socket { name_bind name_connect }; allow pasta_t pasta_port_t:udp_socket { name_bind }; allow pasta_t http_port_t:tcp_socket { name_bind name_connect }; @@ -249,10 +250,10 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; -allow pasta_t container_var_run_t:dir { add_name open rmdir write }; -allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; -allow pasta_t container_var_run_t:file { create open write }; -allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:dir { add_name open read rmdir write }; +allow pasta_t ifconfig_var_run_t:dir { add_name open read rmdir write }; +allow pasta_t container_var_run_t:file { create open read write }; +allow pasta_t ifconfig_var_run_t:file { create open read write }; allow pasta_t container_var_run_t:sock_file { getattr create open read write }; allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; -- 2.43.0

1 0

[PATCH 4/5] fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host()
by David Gibson 10 Jul '26

10 Jul '26

The order in which we translate source and destination addresses is a bit unclear in fwd_nat_from_host(). Reorder things to make it clearer: 1. Pick guest-side destination address, where options require it 2. Pick guest-side source address (needs to be different for SPLICE and TAP) 3. If (1) didn't determine destination, pick a fallback to match family and scope of source address from (2). As a small bonus this lets us make step (1) common between SPLICE and TAP paths. The value of this is a bit dubious right now, but it will make some future changes clearer. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/fwd.c b/fwd.c index 90297ef7..7d39898e 100644 --- a/fwd.c +++ b/fwd.c @@ -1041,8 +1041,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, const struct fwd_rule *rule, uint8_t proto, const struct flowside *ini, struct flowside *tgt) { - /* Common for spliced and non-spliced cases */ + /* DNAPT: Common for splice and non-spliced where possible */ tgt->eport = rule->to + (ini->oport - rule->first); + if (!inany_is_unspecified(&rule->taddr)) + tgt->eaddr = rule->taddr; + else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + tgt->eaddr = ini->oaddr; /* TODO: Allow splicing with specified target address */ if (!c->no_splice && inany_is_unspecified(&rule->taddr) && @@ -1059,10 +1063,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, * In either case, let the kernel pick the source address to * match. */ - if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) - tgt->eaddr = ini->oaddr; - /* Let the kernel pick source address and port */ + /* SNAT: (implicit) let the kernel pick source addr/port */ if (inany_v4(&ini->eaddr)) tgt->oaddr = inany_any4; else @@ -1082,6 +1084,7 @@ uint8_t fwd_nat_from_host(const struct ctx *c, if (c->splice_only) return PIF_NONE; + /* SNAT: translate source address if necessary */ if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) @@ -1094,9 +1097,6 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (!inany_is_unspecified(&rule->taddr)) - tgt->eaddr = rule->taddr; - /* Use guest address as destination, if otherwise unspecified */ if (inany_is_unspecified(&tgt->eaddr)) fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); -- 2.55.0

1 0

[PATCH 2/5] udp: Validate that we have a unicast source address
by David Gibson 10 Jul '26

10 Jul '26

When creating a UDP flow from a socket we, correctly, check that the source address is unicast - multicast addresses are not valid as a source address. However, when creating a flow from tap we only check the source address is specified, not that it is unicast. Correct this. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp_flow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/udp_flow.c b/udp_flow.c index 5a59f7f3..f59649f6 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -307,7 +307,7 @@ flow_sidx_t udp_flow_from_tap(const struct ctx *c, ini = flow_initiate_af(flow, PIF_TAP, af, saddr, srcport, daddr, dstport); - if (inany_is_unspecified(&ini->eaddr) || ini->eport == 0 || + if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0 || inany_is_unspecified(&ini->oaddr) || ini->oport == 0) { flow_dbg(flow, "Invalid endpoint on UDP packet"); flow_alloc_cancel(flow); -- 2.55.0

1 0

[PATCH 0/7] Fix issues and false positives in code coverge tool
by Jon Maloy 09 Jul '26

09 Jul '26

This series fixes minor issues found by code coverage tools in the main passt code and in documentation examples. The core code changes addresses missing fd initialisations and explicit invariant checks for unsigned arithmetic. We also fix address buffer handling, type mismatches, uninitialised variables, and resource leaks in the documentation example code. Jon Maloy (7): passt: Initialise listening socket fds to -1 udp_vu: Assert iov_tail_clone() return before assigning to msg_iovlen tap: Assert IPv6 tail size before subtracting header length doc/migration: Use strncpy() for socket path and fix argv access doc/migration: Fix buffer type mismatch in recv() call doc/platform-requirements: Initialise va_list before va_start() doc/platform-requirements: Close leaked sockets in test_close_dup() doc/migration/source.c | 2 +- doc/migration/target.c | 10 ++++------ doc/platform-requirements/common.h | 2 +- doc/platform-requirements/udp-close-dup.c | 3 +++ passt.c | 3 +++ tap.c | 4 +++- udp_vu.c | 7 +++++-- 7 files changed, 20 insertions(+), 11 deletions(-) -- 2.52.0

3 17

[PATCH v8 01/14] dhcpv6: Fix reply destination to match client's source address
by Jon Maloy 09 Jul '26

09 Jul '26

tap_ip6_daddr() selects the reply destination based on our source address type (link-local), so it always returns addr_ll_seen. But if the client sent from a global address, we would reply to an address different from what the client is expecting. Since RFC 9915 (section 18.3.10) allows clients to use global addresses for DHCPv6, we now correct this, and always respond to the address the client was using. We also remove a redundant addr_ll_seen assignment, since this is already done by tap.c when processing IPv6 packets. Note: if the client uses a global source address, our reply will still have a link-local source, creating a scope mismatch. Fixing this properly would require a mechanism to allocate a global address for the DHCPv6 server, which we currently don't have. Responding to the client's actual source address is still a net improvement over the previous behavior of replying to an unrelated cached address. Note 2: This commit isn't actually a fix to an observed problem, but rather an answer to a theoretical issue, adding completeness to the mechanism and simplifying subsequent changes in this series. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v8: -Updated commit log, acknowledging concerns expressed by David and Stefano. -Some minor changes also addressing feedback from the same persons. --- dhcpv6.c | 16 ++++++++-------- dhcpv6.h | 2 +- tap.c | 15 --------------- tap.h | 2 -- 4 files changed, 9 insertions(+), 26 deletions(-) diff --git a/dhcpv6.c b/dhcpv6.c index 97c04e2c..29c7e320 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -370,12 +370,14 @@ notonlink: /** * dhcpv6_send_ia_notonlink() - Send NotOnLink status * @c: Execution context + * @caddr: Source address of client message (reply destination) * @ia_base: Non-appropriate IA_NA or IA_TA base * @client_id_base: Client ID message option base * @len: Client ID length * @xid: Transaction ID for message exchange */ static void dhcpv6_send_ia_notonlink(struct ctx *c, + const struct in6_addr *caddr, const struct iov_tail *ia_base, const struct iov_tail *client_id_base, int len, uint32_t xid) @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, resp_not_on_link.hdr.xid = xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - xid, &resp_not_on_link, n); + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); } /** @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh)) return -1; - c->ip6.addr_ll_seen = *saddr; - src = &c->ip6.our_tap_ll; mh = IOV_REMOVE_HEADER(data, mh_storage); @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { - dhcpv6_send_ia_notonlink(c, data, &client_id_base, - ntohs(client_id->l), mh->xid); + dhcpv6_send_ia_notonlink(c, saddr, data, + &client_id_base, + ntohs(client_id->l), + mh->xid); return 1; } @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - mh->xid, &resp, n); + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); c->ip6.addr_seen = c->ip6.addr; return 1; diff --git a/dhcpv6.h b/dhcpv6.h index c706dfdb..1015a1a7 100644 --- a/dhcpv6.h +++ b/dhcpv6.h @@ -7,7 +7,7 @@ #define DHCPV6_H int dhcpv6(struct ctx *c, struct iov_tail *data, - struct in6_addr *saddr, struct in6_addr *daddr); + const struct in6_addr *saddr, const struct in6_addr *daddr); void dhcpv6_init(const struct ctx *c); #endif /* DHCPV6_H */ diff --git a/tap.c b/tap.c index 6d93c7ce..d4189617 100644 --- a/tap.c +++ b/tap.c @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len) } } -/** - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets - * @c: Execution context - * @src: Source address - * - * Return: pointer to IPv6 address - */ -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src) -{ - if (IN6_IS_ADDR_LINKLOCAL(src)) - return &c->ip6.addr_ll_seen; - return &c->ip6.addr_seen; -} - /** * tap_push_l2h() - Build an L2 header for an inbound packet * @c: Execution context diff --git a/tap.h b/tap.h index 07ca0965..b335933f 100644 --- a/tap.h +++ b/tap.h @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr src, in_port_t sport, const void *in, size_t dlen); void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_addr dst, const void *in, const void *src_mac, size_t l4len); -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src); void *tap_push_ip6h(struct ipv6hdr *ip6h, const struct in6_addr *src, const struct in6_addr *dst, size_t l4len, uint8_t proto, uint32_t flow); -- 2.52.0

2 1

[PATCH v2] isolation: Add --chroot-fallback option
by Mateusz Andrzejewski 08 Jul '26

08 Jul '26

For integrations, which use rootfs on tmpfs or initramfs, it is not allowed to use pivot_root(). It results with invalid argument (EINVAL) error. Introduce --chroot-fallback option as a workaround with MS_MOVE + chroot(). Due to weaker isolation of chroot() method (we don't unmount old root), user has tu explicitly enable fallback with the new option. First, always try to sandbox with pivot_root(). In both cases the new root is placed into an empty tmpfs. For the solution to work we keep CAP_SYS_CHROOT capability, which is dropped at the end of the isolate_prefork() function. Link: https://bugs.passt.top/show_bug.cgi?id=104 Signed-off-by: Mateusz Andrzejewski <mateusz.andrzejewski(a)mikronika.com.pl> --- Changes since v1: - added a description of the new option to the man page - renamed option to --chroot-fallback - removed auxiliary variable in conf() - passed execution context to isolate_user() - fixed indentation and other coding style issues - fixed cppcheck issue with variableScope in isolate_prefork() Direct write to &c->chroot_fallback is not valid, because it's a bool variable and compilation results with an incompatible-pointer-types warning (int* expected). To fix this, the assignment was moved to the '32' label in the switch statement and the temporary helper variable could be removed. This follows the same pattern of other boolean options. conf.c | 8 +++++- isolation.c | 71 ++++++++++++++++++++++++++++++++++++++++++----------- isolation.h | 4 +-- passt.1 | 9 +++++++ passt.h | 2 ++ 5 files changed, 77 insertions(+), 17 deletions(-) diff --git a/conf.c b/conf.c index 4755a9f..6755bf6 100644 --- a/conf.c +++ b/conf.c @@ -654,6 +654,8 @@ static void usage(const char *name, FILE *f, int status) " --no-ra Disable router advertisements\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" + " --chroot-fallback Use chroot() if pivot_root() fails\n" + " can be useful for rootfs on tmpfs or initramfs\n" " -4, --ipv4-only Enable IPv4 operation only\n" " -6, --ipv6-only Enable IPv6 operation only\n" " -t, --tcp-ports SPEC TCP port forwarding to %s\n" @@ -1233,6 +1235,7 @@ void conf(struct ctx *c, int argc, char **argv) {"migrate-no-linger", no_argument, NULL, 30 }, {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, + {"chroot-fallback", no_argument, NULL, 32 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1467,6 +1470,9 @@ void conf(struct ctx *c, int argc, char **argv) die("Can't display statistics if not running in foreground"); c->stats = strtol(optarg, NULL, 0); break; + case 32: + c->chroot_fallback = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1879,7 +1885,7 @@ void conf(struct ctx *c, int argc, char **argv) conf_open_files(c); /* Before any possible setuid() / setgid() */ - isolate_user(uid, gid, !netns_only, userns, c->mode); + isolate_user(c, uid, gid, !netns_only, userns); if (c->no_icmp) c->no_ndp = 1; diff --git a/isolation.c b/isolation.c index 7e6225d..08e4008 100644 --- a/isolation.c +++ b/isolation.c @@ -166,6 +166,31 @@ static void clamp_caps(void) die_perror("Couldn't drop inheritable capabilities"); } +/** + * move_root() - Use chroot() instead of pivot_root() for sandboxing + * + * Return: negative error code on failure, zero on success + */ +static int move_root(void) +{ + if (mount(TMPDIR, "/", "", MS_MOVE, "")) { + err_perror("Failed to move root into empty tmpfs"); + return -errno; + } + + if (chroot(".")) { + err_perror("Failed to chroot() into empty tmpfs"); + return -errno; + } + + if (chdir("/")) { + err_perror("Failed to change directory into new root"); + return -errno; + } + + return 0; +} + /** * isolate_initial() - Early, mostly config independent self isolation * @argc: Argument count @@ -195,14 +220,18 @@ void isolate_initial(int argc, char **argv) * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces * + * We have to keep CAP_SYS_CHROOT in case of --chroot-fallback option + * being enabled, so we can fallback from pivot_root() to chroot() in + * isolate_prefork(). + * * It's debatable whether it's useful to drop caps when we * retain SETUID and SYS_ADMIN, but we might as well. We drop * further capabilities in isolate_user() and * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); - + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE) | + BIT(CAP_SYS_CHROOT); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child * from a non-init user namespace (pasta can't run as root), we need to @@ -220,11 +249,11 @@ void isolate_initial(int argc, char **argv) /** * isolate_user() - Switch to final UID/GID and move into userns + * @c: Execution context * @uid: User ID to run as (in original userns) * @gid: Group ID to run as (in original userns) * @use_userns: Whether to join or create a userns * @userns: userns path to enter, may be empty - * @mode: Mode (passt or pasta) * * Should: * - set our final UID and GID @@ -232,8 +261,8 @@ void isolate_initial(int argc, char **argv) * Mustn't: * - remove filesystem access (we need that for further setup) */ -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode) +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns) { uint64_t ns_caps = 0; @@ -277,7 +306,14 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, * netns */ ns_caps |= BIT(CAP_SYS_ADMIN); - if (mode == MODE_PASTA) { + + /* Only keep CAP_SYS_CHROOT for the --chroot-fallback case. Otherwise + * it can be dropped + */ + if (c->chroot_fallback) + ns_caps |= BIT(CAP_SYS_CHROOT); + + if (c->mode == MODE_PASTA) { /* Keep CAP_NET_ADMIN, so we can configure the if */ ns_caps |= BIT(CAP_NET_ADMIN); /* Keep CAP_NET_BIND_SERVICE, so we can splice @@ -331,7 +367,7 @@ int isolate_prefork(const struct ctx *c) if (mount("", TMPDIR, "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, "nr_inodes=2,nr_blocks=0")) { - err_perror("Failed to mount empty tmpfs for pivot_root()"); + err_perror("Failed to mount empty tmpfs for sandboxing"); return -errno; } @@ -341,13 +377,20 @@ int isolate_prefork(const struct ctx *c) } if (syscall(SYS_pivot_root, ".", ".")) { - err_perror("Failed to pivot_root() into empty tmpfs"); - return -errno; - } - - if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { - err_perror("Failed to unmount original root filesystem"); - return -errno; + if (c->chroot_fallback) { + int rc; + info("Failed to pivot_root(), fallback to chroot()..."); + if ((rc = move_root())) + return rc; + } else { + err_perror("Failed to pivot_root() into empty tmpfs"); + return -errno; + } + } else { + if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { + err_perror("Failed to unmount original root filesystem"); + return -errno; + } } /* Now that initialization is more-or-less complete, we can diff --git a/isolation.h b/isolation.h index 0576168..66b6968 100644 --- a/isolation.h +++ b/isolation.h @@ -11,8 +11,8 @@ #include <unistd.h> void isolate_initial(int argc, char **argv); -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode); +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns); int isolate_prefork(const struct ctx *c); void isolate_postfork(const struct ctx *c); diff --git a/passt.1 b/passt.1 index 908fd4a..8a33c2e 100644 --- a/passt.1 +++ b/passt.1 @@ -393,6 +393,15 @@ as destination, to the host. Implied if there is no gateway on the selected default route, or if there is no default route, for any of the enabled address families. +.TP +.BR \-\-chroot-fallback +Enable a fallback to chroot() in case pivot_root() returns an error. Useful for +integrations, which use rootfs on tmpfs or initramfs, where it is not allowed to +use pivot_root(), because it results with an invalid argument error (EINVAL). + +By default, fallback is disabled. If pivot_root() fails, then the entire +sandboxing process fails. + .TP .BR \-\-map-guest-addr " " \fIaddr Translate \fIaddr\fR in the guest to be equal to the guest's assigned diff --git a/passt.h b/passt.h index 16506dc..a20148e 100644 --- a/passt.h +++ b/passt.h @@ -214,6 +214,7 @@ struct ip6_ctx { * @splice_only: Only enable loopback forwarding * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding + * @chroot_fallback: Use chroot() in case pivot_root() fails * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max * @no_bindtodevice: Unprivileged SO_BINDTODEVICE not available @@ -299,6 +300,7 @@ struct ctx { int splice_only; int host_lo_to_ns_lo; int freebind; + bool chroot_fallback; int low_wmem; int low_rmem; -- 2.43.7

2 3

[PATCH v4 0/2] Target address mapping
by David Gibson 08 Jul '26

08 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. v4: * Add suggested command line fix if attempting a forward from dual stack address to a specific address v3: * Moved target address validation to fwd_rule_add() and tidied up a bit * Some readability tweaks to man page v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++- fwd_rule.c | 114 ++++++++++++++++++++++++++++++++++++++++++++--------- fwd_rule.h | 7 +++- passt.1 | 31 ++++++++++----- pesto.h | 6 ++- 5 files changed, 134 insertions(+), 32 deletions(-) -- 2.55.0

2 3

[PATCH v2 0/2] Target address mapping
by David Gibson 07 Jul '26

07 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. Based on v4 of my parsing rework series. v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++-- fwd_rule.c | 101 +++++++++++++++++++++++++++++++++++++++++++---------- fwd_rule.h | 7 ++-- passt.1 | 31 +++++++++++----- pesto.h | 6 +++- 5 files changed, 121 insertions(+), 32 deletions(-) -- 2.55.0

2 6

[PATCH v3 2/2] fwd, fwd_rule: Implement configurable target address mapping
by David Gibson 06 Jul '26

06 Jul '26

From: Stefano Brivio <sbrivio(a)redhat.com> Add a 'taddr' field to forwarding rules, which controls the destination address on the target side. Since changing the structure alters the pesto update protocol, bump the protocol version number Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> [dwg: Split from option parsing code, added protocol version bump, explicitly exclude splicing with target address for now] Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 8 ++++++-- fwd_rule.c | 51 +++++++++++++++++++++++++++++++++++++++------------ fwd_rule.h | 7 +++++-- pesto.h | 6 +++++- 4 files changed, 55 insertions(+), 17 deletions(-) diff --git a/fwd.c b/fwd.c index 042158cf..3ae25fde 100644 --- a/fwd.c +++ b/fwd.c @@ -1023,7 +1023,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, /* Common for spliced and non-spliced cases */ tgt->eport = rule->to + (ini->oport - rule->first); - if (!c->no_splice && inany_is_loopback(&ini->eaddr) && + /* TODO: Allow splicing with specified target address */ + if (!c->no_splice && inany_is_unspecified(&rule->taddr) && + inany_is_loopback(&ini->eaddr) && (proto == IPPROTO_TCP || proto == IPPROTO_UDP)) { /* spliceable */ @@ -1074,7 +1076,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (inany_v4(&tgt->oaddr)) { + if (!inany_is_unspecified(&rule->taddr)) { + tgt->eaddr = rule->taddr; + } else if (inany_v4(&tgt->oaddr)) { tgt->eaddr = inany_from_v4(c->ip4.addr_seen); } else { if (inany_is_linklocal6(&tgt->oaddr)) diff --git a/fwd_rule.c b/fwd_rule.c index 42ec68e3..0857253d 100644 --- a/fwd_rule.c +++ b/fwd_rule.c @@ -115,10 +115,15 @@ __attribute__((noinline)) const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size) { const char *percent = *rule->ifname ? "%" : ""; + char taddr[INANY_ADDRSTRLEN] = { 0 }; const char *weak = "", *scan = ""; char addr[INANY_ADDRSTRLEN]; int len; + if (!inany_is_unspecified(&rule->taddr)) { + (void)snprintf(taddr, sizeof(taddr), "%s:", + inany_ntop(&rule->taddr, addr, sizeof(addr))); + } inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr)); if (rule->flags & FWD_WEAK) weak = " (best effort)"; @@ -127,16 +132,17 @@ const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size) if (rule->first == rule->last) { len = snprintf(dst, size, - "%s [%s]%s%s:%hu => %hu %s%s", + "%s [%s]%s%s:%hu => %s%hu %s%s", ipproto_name(rule->proto), addr, percent, - rule->ifname, rule->first, rule->to, weak, scan); + rule->ifname, rule->first, + taddr, rule->to, weak, scan); } else { in_port_t tolast = rule->last - rule->first + rule->to; len = snprintf(dst, size, - "%s [%s]%s%s:%hu-%hu => %hu-%hu %s%s", + "%s [%s]%s%s:%hu-%hu => %s%hu-%hu %s%s", ipproto_name(rule->proto), addr, percent, rule->ifname, rule->first, rule->last, - rule->to, tolast, weak, scan); + taddr, rule->to, tolast, weak, scan); } if (len < 0 || (size_t)len >= size) @@ -325,6 +331,34 @@ int fwd_rule_add(struct fwd_table *fwd, const struct fwd_rule *new) return -EINVAL; } + if (!inany_is_unspecified(&new->taddr)) { + char tastr[INANY_ADDRSTRLEN]; + + if (inany_is_multicast(&new->taddr)) { + warn("Multicast target address %s for forwarding rule", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + + if (new->flags & FWD_DUAL_STACK_ANY) { + warn("Dual stack forward to %s address %s unsupported", + inany_v4(&new->taddr) ? "IPv4" : "IPv6", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + + if (!!inany_v4(&new->addr) != !!inany_v4(&new->taddr)) { + char lastr[INANY_ADDRSTRLEN]; + + warn("Forward from %s (%s) to %s (%s) unsupported", + inany_v4(&new->addr) ? "IPv4" : "IPv6", + inany_ntop(&new->addr, lastr, sizeof(lastr)), + inany_v4(&new->taddr) ? "IPv4" : "IPv6", + inany_ntop(&new->taddr, tastr, sizeof(tastr))); + return -EINVAL; + } + } + for (i = 0; i < fwd->count; i++) { char newstr[FWD_RULE_STRLEN], rulestr[FWD_RULE_STRLEN]; @@ -393,6 +427,7 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, { struct fwd_rule rule = { .addr = addr ? *addr : inany_any6, + .taddr = tgt_addr ? *tgt_addr : inany_any6, .ifname = { 0 }, .proto = proto, .flags = flags, @@ -401,14 +436,6 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, char rulestr[FWD_RULE_STRLEN]; unsigned base, i; - if (tgt_addr && !inany_is_unspecified(tgt_addr)) { - char astr[INANY_ADDRSTRLEN]; - - info("Target address: %s", - inany_ntop(tgt_addr, astr, sizeof(astr))); - die("Target address remapping not yet implemented"); - } - if (!addr) rule.flags |= FWD_DUAL_STACK_ANY; if (ifname) { diff --git a/fwd_rule.h b/fwd_rule.h index 435be5bd..a8788318 100644 --- a/fwd_rule.h +++ b/fwd_rule.h @@ -33,6 +33,7 @@ /** * struct fwd_rule - Forwarding rule governing a range of ports * @addr: Address to forward from + * @taddr: Target side destination address * @ifname: Interface to forward from * @first: First port number to forward * @last: Last port number to forward @@ -45,6 +46,7 @@ */ struct fwd_rule { union inany_addr addr; + union inany_addr taddr; char ifname[IFNAMSIZ]; in_port_t first; in_port_t last; @@ -91,10 +93,11 @@ void fwd_probe_ephemeral(void); #define FWD_RULE_STRLEN \ (IPPROTO_STRLEN - 1 \ - + INANY_ADDRSTRLEN - 1 \ + + INANY_ADDRSTRLEN - 1 /* listen addr */ \ + + INANY_ADDRSTRLEN - 1 /* target addr */ \ + IFNAMSIZ - 1 \ + 4 * (UINT16_STRLEN - 1) \ - + sizeof(" []%:- => - (best effort) (auto-scan)")) + + sizeof(" []%:- => :- (best effort) (auto-scan)")) const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule); const char *fwd_rule_fmt(const struct fwd_rule *rule, char *dst, size_t size); diff --git a/pesto.h b/pesto.h index 980cc17d..8db701b4 100644 --- a/pesto.h +++ b/pesto.h @@ -15,7 +15,11 @@ #define PESTO_SERVER_MAGIC "basil:s" /* Version 0 is reserved for unreleased / unsupported experimental versions */ -#define PESTO_PROTOCOL_VERSION 1 +/* Version 1 had no target address field in struct fwd_rule. It was released, + * but was little enough used that we decided not to implement backwards + * compatiblity code (i.e. a v2 pesto will not work with a v1 pasta) + */ +#define PESTO_PROTOCOL_VERSION 2 /* Maximum size of a pif name, including \0 */ #define PIF_NAME_SIZE (128) -- 2.55.0

1 0

[PATCH v3 0/2] Target address mapping
by David Gibson 06 Jul '26

06 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. v3: * Moved target address validation to fwd_rule_add() and tidied up a bit * Some readability tweaks to man page v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++- fwd_rule.c | 112 ++++++++++++++++++++++++++++++++++++++++++++--------- fwd_rule.h | 7 +++- passt.1 | 31 ++++++++++----- pesto.h | 6 ++- 5 files changed, 132 insertions(+), 32 deletions(-) -- 2.55.0

1 1