- dev - passt

[PATCH] dhcp, dhcpv6: Add hostname and client fqdn ops
by Enrique Llorente 13 Nov '24

13 Nov '24

Both DHCPv4 and DHCPv6 has the capability to pass the hostname to clients, the DHCPv4 uses option 12 (hostname) while the DHCPv6 uses option 39 (client fqdn), for some virt deployments like kubevirt is expected to have the VirtualMachine name as the guest hostname. This change add the -H --hostname to configure the DHCPv4 and DHCPv6 options to will send hostname to clients. Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> wip Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- conf.c | 13 ++++++++--- dhcp.c | 6 +++++ dhcpv6.c | 59 +++++++++++++++++++++++++++++++++++++++--------- passt.h | 2 ++ test/lib/setup | 10 ++++---- test/passt.mbuto | 3 +++ test/passt/dhcp | 11 ++++++++- test/pasta/dhcp | 2 +- 8 files changed, 85 insertions(+), 21 deletions(-) diff --git a/conf.c b/conf.c index 14411b4..be35996 100644 --- a/conf.c +++ b/conf.c @@ -847,7 +847,8 @@ static void usage(const char *name, FILE *f, int status) " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" - " -6, --ipv6-only Enable IPv6 operation only\n"); + " -6, --ipv6-only Enable IPv6 operation only\n" + " -H, --hostname ADDR Hostname to configure client with\n"); if (strstr(name, "pasta")) goto pasta_opts; @@ -1303,6 +1304,7 @@ void conf(struct ctx *c, int argc, char **argv) {"map-guest-addr", required_argument, NULL, 22 }, {"host-lo-to-ns-lo", no_argument, NULL, 23 }, {"dns-host", required_argument, NULL, 24 }, + {"hostname", required_argument, NULL, 'H' }, { 0 }, }; const char *logname = (c->mode == MODE_PASTA) ? "pasta" : "passt"; @@ -1325,9 +1327,9 @@ void conf(struct ctx *c, int argc, char **argv) if (c->mode == MODE_PASTA) { c->no_dhcp_dns = c->no_dhcp_dns_search = 1; fwd_default = FWD_AUTO; - optstring = "+dqfel:hF:I:p:P:m:a:n:M:g:i:o:D:S:46t:u:T:U:"; + optstring = "+dqfel:hF:I:p:P:m:a:n:M:g:i:o:D:S:46t:u:T:U:H:"; } else { - optstring = "+dqfel:hs:F:p:P:m:a:n:M:g:i:o:D:S:461t:u:"; + optstring = "+dqfel:hs:F:p:P:m:a:n:M:g:i:o:D:S:461t:u:H:"; } c->tcp.fwd_in.mode = c->tcp.fwd_out.mode = FWD_UNSET; @@ -1680,6 +1682,11 @@ void conf(struct ctx *c, int argc, char **argv) c->one_off = true; break; + case 'H': + ret = snprintf(c->hostname.n, sizeof(c->hostname.n), "%s", optarg); + if (ret <= 0 || ret >= (int)sizeof(c->hostname.n)) + die("Invalid hostname: %s", optarg); + break; case 't': case 'u': case 'T': diff --git a/dhcp.c b/dhcp.c index a06f143..13255d9 100644 --- a/dhcp.c +++ b/dhcp.c @@ -374,6 +374,12 @@ int dhcp(const struct ctx *c, const struct pool *p) ((struct in_addr *)opts[6].s)[i] = c->ip4.dns[i]; opts[6].slen += sizeof(uint32_t); } + + size_t hostname_len = strlen(c->hostname.n); + if ( hostname_len > 0 ) { + opts[12].slen = hostname_len; + memcpy(opts[12].s, &c->hostname.n, hostname_len); + } if (!c->no_dhcp_dns_search) opt_set_dns_search(c, sizeof(m->o)); diff --git a/dhcpv6.c b/dhcpv6.c index 14a5c7e..143287e 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -48,6 +48,7 @@ struct opt_hdr { # define STATUS_NOTONLINK htons_constant(4) # define OPT_DNS_SERVERS htons_constant(23) # define OPT_DNS_SEARCH htons_constant(24) +# define OPT_CLIENT_FQDN htons_constant(39) #define STR_NOTONLINK "Prefix not appropriate for link." uint16_t l; @@ -163,6 +164,17 @@ struct opt_dns_search { char list[MAXDNSRCH * NS_MAXDNAME]; } __attribute__((packed)); +/** + * struct opt_client_fqdn - Client FQDN option (RFC 4704) + * @hdr: Option header + * @hostname: Client fqdn + */ +struct opt_client_fqdn{ + struct opt_hdr hdr; + uint8_t flags; + uint8_t hostname[NS_MAXDNAME]; +} __attribute__((packed)); + /** * struct msg_hdr - DHCPv6 client/server message header * @type: DHCP message type @@ -191,6 +203,7 @@ struct msg_hdr { * @ia_na: Non-temporary Address option * @ia_addr: Address for IA_NA * @client_id: Client Identifier, variable length + * @client_fqdn: Client FQDN, variable length * @dns_servers: DNS Recursive Name Server, here just for storage size * @dns_search: Domain Search List, here just for storage size */ @@ -203,31 +216,30 @@ static struct resp_t { struct opt_client_id client_id; struct opt_dns_servers dns_servers; struct opt_dns_search dns_search; + struct opt_client_fqdn client_fqdn; } __attribute__((__packed__)) resp = { { 0 }, SERVER_ID, - { { OPT_IA_NA, OPT_SIZE_CONV(sizeof(struct opt_ia_na) + sizeof(struct opt_ia_addr) - sizeof(struct opt_hdr)) }, 1, (uint32_t)~0U, (uint32_t)~0U }, - { { OPT_IAAADR, OPT_SIZE(ia_addr) }, IN6ADDR_ANY_INIT, (uint32_t)~0U, (uint32_t)~0U }, - { { OPT_CLIENTID, 0, }, { 0 } }, - { { OPT_DNS_SERVERS, 0, }, { IN6ADDR_ANY_INIT } }, - { { OPT_DNS_SEARCH, 0, }, { 0 }, }, + { { OPT_CLIENT_FQDN, 0, }, + (uint8_t)~0U, { 0 }, + }, }; static const struct opt_status_code sc_not_on_link = { @@ -416,12 +428,34 @@ search: return offset; } +/** + * dhcpv6_client_fqdn_fill() - Fill in client FQDN option + * @c: Execution context + * @buf: Response message buffer where options will be appended + * @offset: Offset in message buffer for new options + * + * Return: updated length of response message buffer. + */ +static size_t dhcpv6_client_fqdn_fill(const struct ctx *c, char *buf, int offset) +{ + uint16_t hostname_len = strlen(c->hostname.n); + if (hostname_len > 0) { + struct opt_client_fqdn *o = (struct opt_client_fqdn*)(buf + offset); + o->hdr.t = OPT_CLIENT_FQDN; + o->hdr.l = htons(hostname_len+2); + o->flags = 0x00; + *o->hostname = hostname_len; + memcpy(o->hostname+1, c->hostname.n, hostname_len); + offset += sizeof(struct opt_hdr) + hostname_len+2; + } + return offset; +} + /** * dhcpv6() - Check if this is a DHCPv6 message, reply as needed * @c: Execution context * @p: Packet pool, single packet starting from UDP header - * @saddr: Source IPv6 address of original message - * @daddr: Destination IPv6 address of original message + * @saddr: Source IPv6 address of original message * @daddr: Destination IPv6 address of original message * * Return: 0 if it's not a DHCPv6 message, 1 if handled, -1 on failure */ @@ -542,15 +576,18 @@ int dhcpv6(struct ctx *c, const struct pool *p, } if (ia) resp.ia_na.iaid = ((struct opt_ia_na *)ia)->iaid; - + memcpy(&resp.client_id, client_id, ntohs(client_id->l) + sizeof(struct opt_hdr)); - n = offsetof(struct resp_t, client_id) + + n = offsetof(struct resp_t, client_id) + sizeof(struct opt_hdr) + ntohs(client_id->l); - n = dhcpv6_dns_fill(c, (char *)&resp, n); + + n = dhcpv6_dns_fill(c, (char *)&resp, n); - resp.hdr.xid = mh->xid; + n = dhcpv6_client_fqdn_fill(c, (char*)&resp, n); + + resp.hdr.xid = mh->xid; tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, mh->xid, &resp, n); diff --git a/passt.h b/passt.h index 72c7f72..b25b13a 100644 --- a/passt.h +++ b/passt.h @@ -205,6 +205,7 @@ struct ip6_ctx { * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list + * @hostname: Client hostname * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta @@ -262,6 +263,7 @@ struct ctx { struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; + struct fqdn hostname; unsigned int ifi6; struct ip6_ctx ip6; diff --git a/test/lib/setup b/test/lib/setup index 5338393..9c7aac9 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -49,7 +49,7 @@ setup_passt() { context_run passt "make clean" context_run passt "make valgrind" - context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt ${__opts} -s ${STATESETUP}/passt.socket -f -t 10001 -u 10001 -P ${STATESETUP}/passt.pid" + context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt ${__opts} -s ${STATESETUP}/passt.socket -f -t 10001 -u 10001 -H passt1 -P ${STATESETUP}/passt.pid" # pidfile isn't created until passt is listening wait_for [ -f "${STATESETUP}/passt.pid" ] @@ -146,11 +146,11 @@ setup_passt_in_ns() { if [ ${VALGRIND} -eq 1 ]; then context_run passt "make clean" context_run passt "make valgrind" - context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt -f ${__opts} -s ${STATESETUP}/passt.socket -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" + context_run_bg passt "valgrind --max-stackframe=$((4 * 1024 * 1024)) --trace-children=yes --vgdb=no --error-exitcode=1 --suppressions=test/valgrind.supp ./passt -f ${__opts} -s ${STATESETUP}/passt.socket -H passt1 -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" else context_run passt "make clean" context_run passt "make" - context_run_bg passt "./passt -f ${__opts} -s ${STATESETUP}/passt.socket -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" + context_run_bg passt "./passt -f ${__opts} -s ${STATESETUP}/passt.socket -H passt1 -t 10001,10011,10021,10031 -u 10001,10011,10021,10031 -P ${STATESETUP}/passt.pid --map-host-loopback ${__map_ns4} --map-host-loopback ${__map_ns6}" fi wait_for [ -f "${STATESETUP}/passt.pid" ] @@ -215,7 +215,7 @@ setup_two_guests() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt_1 "./passt -s ${STATESETUP}/passt_1.socket -P ${STATESETUP}/passt_1.pid -f ${__opts} -t 10001 -u 10001" + context_run_bg passt_1 "./passt -s ${STATESETUP}/passt_1.socket -P ${STATESETUP}/passt_1.pid -f ${__opts} -H passt1 -t 10001 -u 10001" wait_for [ -f "${STATESETUP}/passt_1.pid" ] __opts= @@ -223,7 +223,7 @@ setup_two_guests() { [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" [ ${TRACE} -eq 1 ] && __opts="${__opts} --trace" - context_run_bg passt_2 "./passt -s ${STATESETUP}/passt_2.socket -P ${STATESETUP}/passt_2.pid -f ${__opts} -t 10004 -u 10004" + context_run_bg passt_2 "./passt -s ${STATESETUP}/passt_2.socket -P ${STATESETUP}/passt_2.pid -f ${__opts} --hostname passt2 -t 10004 -u 10004" wait_for [ -f "${STATESETUP}/passt_2.pid" ] GUEST_1_CID=94557 diff --git a/test/passt.mbuto b/test/passt.mbuto index 138d365..b959891 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -43,6 +43,8 @@ LOG=/var/log/dhclient-script.log echo \${reason} \${interface} >> \$LOG set >> \$LOG +env + [ -n "\${new_interface_mtu}" ] && ip link set dev \${interface} mtu \${new_interface_mtu} [ -n "\${new_ip_address}" ] && ip addr add \${new_ip_address}/\${new_subnet_mask} dev \${interface} @@ -55,6 +57,7 @@ set >> \$LOG [ -n "\${new_dhcp6_name_servers}" ] && for d in \${new_dhcp6_name_servers}; do echo "nameserver \${d}%\${interface}" >> /etc/resolv.conf; done [ -n "\${new_dhcp6_domain_search}" ] && (printf "search"; for d in \${new_dhcp6_domain_search}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf [ -n "\${new_host_name}" ] && hostname "\${new_host_name}" +[ -n "\${new_fqdn_hostname}" ] && hostname "\${new_fqdn_hostname}" exit 0 EOF chmod 755 /sbin/dhclient-script diff --git a/test/passt/dhcp b/test/passt/dhcp index 9925ab9..36535f2 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -11,7 +11,7 @@ # Copyright (c) 2021 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -gtools ip jq dhclient sed tr +gtools ip jq dhclient sed tr hostname htools ip jq sed tr head test Interface name @@ -47,7 +47,12 @@ gout SEARCH sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^searc hout HOST_SEARCH sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' check [ "__SEARCH__" = "__HOST_SEARCH__" ] +test DHCP: Hostname +gout HOSTNAME hostname +check [ "__HOSTNAME__" = "passt1" ] + test DHCPv6: address +guest hostname none guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done @@ -70,3 +75,7 @@ test DHCPv6: search list gout SEARCH6 sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' hout HOST_SEARCH6 sed 's/\. / /g' /etc/resolv.conf | sed 's/\.$//g' | sed -n 's/^search $.*$/\1/p' | tr ' \n' ',' | sed 's/,$//;s/$/\n/' check [ "__SEARCH6__" = "__HOST_SEARCH6__" ] + +test DHCPv6: Hostname +gout HOSTNAME hostname +check [ "__HOSTNAME__" = "passt1" ] diff --git a/test/pasta/dhcp b/test/pasta/dhcp index d4f3ad5..1f47325 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -19,7 +19,7 @@ nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifnam check [ -n "__IFNAME__" ] test DHCP: address -ns /sbin/dhclient -4 --no-pid __IFNAME__ +ns /sbin/dhclient -4 -sf test/dhclient-script --no-pid __IFNAME__ nsout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' check [ __ADDR__ = __HOST_ADDR__ ] -- 2.47.0

1 0

[PATCH 0/6] ndp: Unsolicited RAs
by David Gibson 13 Nov '24

13 Nov '24

The default route a guest obtains via NDP has an expiry. We set this to the maximum allowed, 65535s (about 18 hours). We missed, however, that after that expiry, the guest won't send a new Router Solicitation. Instead it expects an unsolicited Router Advertisement to have come at some point before the expiry. This means that on an IPv6 setup, the default will disappear after 18 hours. Correct this by sending unsolicited Router Advertisements as required by RFC 4861. Along the way we make a number of small cleanups to the NDP code. Link: https://github.com/kubevirt/kubevirt/issues/13191 David Gibson (6): ndp: Remove redundant update to addr_seen ndp: Add ndp_send() helper ndp: Split out helpers for sending specific NDP message types ndp: Use struct assignment in preference to memcpy() for IPv6 addresses ndp: Make route lifetime a #define ndp: Send unsolicited Router Advertisements ip.h | 9 +++ ndp.c | 210 ++++++++++++++++++++++++++++++++++++-------------------- ndp.h | 7 +- passt.c | 3 + 4 files changed, 152 insertions(+), 77 deletions(-) -- 2.47.0

2 11

[PATCH v2 0/4] Avoid running cppcheck on system headers
by David Gibson 08 Nov '24

08 Nov '24

It turns out cppcheck has inbuilt knowledge of the C library, and isn't typically given the system headers. Avoiding doing so reduces the runtime to less than half of what it currently is. For non-obvious reasons, this change also exposes some new warnings. Some are real, one is a cppcheck bug. Fix and/or workaround these then make the change to the cppcheck options. This is based on my earlier series with clangd configuration and fixes. v2: * Dropped patches already merged * Rebased on Stefano's series of lint fixes * Add a missing #include in 1/4 and 2/4 * Adjust 3/4 not to die if close_range() is unavailable David Gibson (4): log: Only check for FALLOC_FL_COLLAPSE_RANGE availability at runtime linux_dep: Move close_range() conditional handling to linux_dep.h linux_dep: Fix CLOSE_RANGE_UNSHARE availability handling cppcheck: Don't check the system headers Makefile | 15 +-------------- linux_dep.h | 22 ++++++++++++++++++++++ log.c | 10 ++-------- util.c | 17 +++++++++++++++-- util.h | 19 ------------------- 5 files changed, 40 insertions(+), 43 deletions(-) -- 2.47.0

2 5

[PATCH v2 0/1] RFC: IOV tail helpers
by David Gibson 08 Nov '24

08 Nov '24

As mentioned here's my draft patch adding a helper to pull headers off an IOV, checking for contiguity, alignment and so forth. It's based around the idea of an "iov tail", that is an iov from which you've already consumed (in some sense) some data from the beginning. It uses an explicit offset to track this, so we don't have to copy an entire iovec array in order to trim a bit off it. But, it's built so that if you pull enough off the front to remove some entire buffers, it won't repeatedly have to step through them working out later offsets. It may be somewhat overengineered, let me know what you think of the interface. v2: * Substantial changes to comments and names, to make the purpose clearer David Gibson (1): iov: iov tail helpers iov.c | 93 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ iov.h | 76 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 169 insertions(+) -- 2.47.0

2 2

[PATCH 0/1] RFC: IOV tail helpers
by David Gibson 08 Nov '24

08 Nov '24

As mentioned here's my draft patch adding a helper to pull headers off an IOV, checking for contiguity, alignment and so forth. It's based around the idea of an "iov tail", that is an iov from which you've already consumed (in some sense) some data from the beginning. It uses an explicit offset to track this, so we don't have to copy an entire iovec array in order to trim a bit off it. But, it's built so that if you pull enough off the front to remove some entire buffers, it won't repeatedly have to step through them working out later offsets. It may be somewhat overengineered, let me know what you think of the interface. David Gibson (1): iov: iov tail helpers iov.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ iov.h | 24 +++++++++++++++++ 2 files changed, 107 insertions(+) -- 2.47.0

2 5

[PATCH 0/2] Small fixes for nstool
by David Gibson 08 Nov '24

08 Nov '24

While working on the exeter tests, I noticed a couple of things missing in nstool. These make sense standalone, even if we don't have an urgent need for them without the exeter tests. David Gibson (2): test: Rename propagating signal handler test: Make nstool hold robust against interruptions to control clients test/nstool.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) -- 2.47.0

2 6

[PATCH 0/6] Fix some more static checker warnings
by Stefano Brivio 08 Nov '24

08 Nov '24

Stefano Brivio (6): dhcpv6: Use for loop instead of goto to avoid false positive cppcheck warning dhcpv6: Turn some option headers pointers to const tap: Cast TAP_BUF_BYTES - ETH_MAX_MTU to ssize_t, not TAP_BUF_BYTES util: Define small and big thresholds for socket buffers as unsigned long long passt: Use NOLINT clang-tidy block instead of NOLINTNEXTLINE tap, tcp, util: Add some missing SOCK_CLOEXEC flags dhcpv6.c | 51 +++++++++++++++++++++++---------------------------- passt.c | 3 ++- tap.c | 7 ++++--- tcp.c | 2 +- util.c | 3 ++- util.h | 9 ++++++--- 6 files changed, 38 insertions(+), 37 deletions(-) -- 2.43.0

2 12

[PATCH 0/8] Avoid running cppcheck on system headers
by David Gibson 08 Nov '24

08 Nov '24

It turns out cppcheck has inbuilt knowledge of the C library, and isn't typically given the system headers. Avoiding doing so reduces the runtime to less than half of what it currently is. For non-obvious reasons, this change also exposes some new warnings. Some are real, one is a cppcheck bug. Fix and/or workaround these then make the change to the cppcheck options. This is based on my earlier series with clangd configuration and fixes. David Gibson (8): linux_dep: Generalise tcp_info.h to handling Linux extension compatibility log: Only check for FALLOC_FL_COLLAPSE_RANGE availability at runtime linux_dep: Move close_range() conditional handling to linux_dep.h linux_dep: Fix CLOSE_RANGE_UNSHARE availability handling ndp: Use const pointer for ndp_ns packet udp: Don't dereference uflow before NULL check in udp_reply_sock_handler() util: Work around cppcheck bug 6936 cppcheck: Don't check the system headers Makefile | 17 ++--------------- tcp_info.h => linux_dep.h | 32 ++++++++++++++++++++++++++++---- log.c | 9 +-------- ndp.c | 4 ++-- tcp.c | 2 +- udp.c | 5 +++-- util.h | 29 ++++++++++------------------- 7 files changed, 47 insertions(+), 51 deletions(-) rename tcp_info.h => linux_dep.h (85%) -- 2.47.0

2 17

[PATCH 00/12] Minor fixups for or inspired by clangd and related tools
by David Gibson 07 Nov '24

07 Nov '24

I've been experimenting with Zed and clangd recently. Currently it generates an enormous number of largely spurious errors and warnings on the passt code base. Mostly that's due to its default configurations not suiting us. This series adds some configuration that addresses a number of those warnings, though there remain many more for now. Some of the warnings also look reasonable, so I have a grab bag of fixes or workarounds for some of those two. David Gibson (12): clang: Add .clang-format file Makefile: Simplify exclusion of qrap from static checks clang: Move clang-tidy configuration from Makefile to .clang-tidy arch: Avoid explicit access to 'environ' flow: Correct type of flowside_at_sidx() netlink: RTA_PAYLOAD() returns int, not size_t Makefile: Move NETNS_RUN_DIR definition to C code seccomp: Simplify handling of AUDIT_ARCH Makefile: Use -DARCH for qrap only Makefile: Don't attempt to auto-detect stack size clang: Add rudimentary clangd configuration util: Remove unused ffsl() function .clang-format | 126 ++++++++++++++++++++++++++++++++++++++++++++++ .clang-tidy | 93 ++++++++++++++++++++++++++++++++++ .clangd | 3 ++ Makefile | 136 +++----------------------------------------------- arch.c | 2 +- conf.c | 2 + flow_table.h | 2 +- netlink.c | 4 +- seccomp.sh | 14 +++++- util.h | 5 +- 10 files changed, 247 insertions(+), 140 deletions(-) create mode 100644 .clang-format create mode 100644 .clang-tidy create mode 100644 .clangd -- 2.47.0

2 16

[PATCH v3] tcp: unify payload and flags l2 frames array
by Jon Maloy 07 Nov '24

07 Nov '24

In order to reduce static memory and code footprint, we merge the array for l2 flag frames into the one for payload frames. This change also ensures that no flag message will be sent out over the l2 media bypassing already queued payload messages. Performance measurements with iperf3, where we force all traffic via the tap queue, show no significant difference: Dual traffic both directions sinmultaneously, with patch: ======================================================== host->ns: -------- [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-100.00 sec 36.3 GBytes 3.12 Gbits/sec 4759 sender [ 5] 0.00-100.04 sec 36.3 GBytes 3.11 Gbits/sec receiver ns->host: --------- [ ID] Interval Transfer Bitrate [ 5] 0.00-100.00 sec 321 GBytes 27.6 Gbits/sec receiver Dual traffic both directions sinmultaneously, without patch: ============================================================ host->ns: -------- [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-100.00 sec 35.0 GBytes 3.01 Gbits/sec 6001 sender [ 5] 0.00-100.04 sec 34.8 GBytes 2.99 Gbits/sec receiver ns->host -------- [ ID] Interval Transfer Bitrate [ 5] 0.00-100.00 sec 345 GBytes 29.6 Gbits/sec receiver Single connection, with patch: ============================== host->ns: --------- [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-100.00 sec 138 GBytes 11.8 Gbits/sec 922 sender [ 5] 0.00-100.04 sec 138 GBytes 11.8 Gbits/sec receiver ns->host: ----------- [ ID] Interval Transfer Bitrate [ 5] 0.00-100.00 sec 430 GBytes 36.9 Gbits/sec receiver Single connection, without patch: ================================= host->ns: ------------ [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-100.00 sec 139 GBytes 11.9 Gbits/sec 900 sender [ 5] 0.00-100.04 sec 139 GBytes 11.9 Gbits/sec receiver ns->host: --------- [ ID] Interval Transfer Bitrate [ 5] 0.00-100.00 sec 440 GBytes 37.8 Gbits/sec receiver Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> ---- v2: - Adapted to and rebased on latest release. - Removed redundant tcp_flags_push() function. - Added measurement results. v3: - Rebased on latest release. - Fixes based on comments from D. Gibson --- tcp.c | 1 - tcp_buf.c | 70 ++++++++++++-------------------------------------- tcp_buf.h | 1 - tcp_internal.h | 15 ----------- 4 files changed, 17 insertions(+), 70 deletions(-) diff --git a/tcp.c b/tcp.c index 4e0a17e..b652900 100644 --- a/tcp.c +++ b/tcp.c @@ -937,7 +937,6 @@ bool tcp_flow_defer(const struct tcp_tap_conn *conn) /* cppcheck-suppress [constParameterPointer, unmatchedSuppression] */ void tcp_defer_handler(struct ctx *c) { - tcp_flags_flush(c); tcp_payload_flush(c); } diff --git a/tcp_buf.c b/tcp_buf.c index 274e313..d29c1a9 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -20,7 +20,7 @@ #include <netinet/ip.h> -#include <linux/tcp.h> +#include <netinet/tcp.h> #include "util.h" #include "ip.h" @@ -59,22 +59,10 @@ static_assert(MSS6 <= sizeof(tcp_payload[0].data), "MSS6 is greater than 65516") static struct tcp_tap_conn *tcp_frame_conns[TCP_FRAMES_MEM]; static unsigned int tcp_payload_used; -static struct tap_hdr tcp_flags_tap_hdr[TCP_FRAMES_MEM]; -/* IPv4 headers for TCP segment without payload */ -static struct iphdr tcp4_flags_ip[TCP_FRAMES_MEM]; -/* TCP segments without payload for IPv4 frames */ -static struct tcp_flags_t tcp_flags[TCP_FRAMES_MEM]; - -static unsigned int tcp_flags_used; - -/* IPv6 headers for TCP segment without payload */ -static struct ipv6hdr tcp6_flags_ip[TCP_FRAMES_MEM]; - /* recvmsg()/sendmsg() data for tap */ static struct iovec iov_sock [TCP_FRAMES_MEM + 1]; static struct iovec tcp_l2_iov[TCP_FRAMES_MEM][TCP_NUM_IOVS]; -static struct iovec tcp_l2_flags_iov[TCP_FRAMES_MEM][TCP_NUM_IOVS]; /** * tcp_update_l2_buf() - Update Ethernet header buffers with addresses @@ -103,15 +91,6 @@ void tcp_sock_iov_init(const struct ctx *c) for (i = 0; i < ARRAY_SIZE(tcp_payload); i++) { tcp6_payload_ip[i] = ip6; tcp4_payload_ip[i] = iph; - tcp_payload[i].th.doff = sizeof(struct tcphdr) / 4; - tcp_payload[i].th.ack = 1; - } - - for (i = 0; i < ARRAY_SIZE(tcp_flags); i++) { - tcp6_flags_ip[i] = ip6; - tcp4_flags_ip[i] = iph; - tcp_flags[i].th.doff = sizeof(struct tcphdr) / 4; - tcp_flags[i].th.ack = 1; } for (i = 0; i < TCP_FRAMES_MEM; i++) { @@ -121,25 +100,6 @@ void tcp_sock_iov_init(const struct ctx *c) iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); iov[TCP_IOV_PAYLOAD].iov_base = &tcp_payload[i]; } - - for (i = 0; i < TCP_FRAMES_MEM; i++) { - struct iovec *iov = tcp_l2_flags_iov[i]; - - iov[TCP_IOV_TAP] = tap_hdr_iov(c, &tcp_flags_tap_hdr[i]); - iov[TCP_IOV_ETH].iov_len = sizeof(struct ethhdr); - iov[TCP_IOV_PAYLOAD].iov_base = &tcp_flags[i]; - } -} - -/** - * tcp_flags_flush() - Send out buffers for segments with no data (flags) - * @c: Execution context - */ -void tcp_flags_flush(const struct ctx *c) -{ - tap_send_frames(c, &tcp_l2_flags_iov[0][0], TCP_NUM_IOVS, - tcp_flags_used); - tcp_flags_used = 0; } /** @@ -171,7 +131,7 @@ static void tcp_revert_seq(const struct ctx *c, struct tcp_tap_conn **conns, } /** - * tcp_payload_flush() - Send out buffers for segments with data + * tcp_payload_flush() - Send out buffers for segments with data or flags * @c: Execution context */ void tcp_payload_flush(const struct ctx *c) @@ -197,37 +157,35 @@ void tcp_payload_flush(const struct ctx *c) */ int tcp_buf_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) { - struct tcp_flags_t *payload; + struct tcp_payload_t *payload; struct iovec *iov; size_t optlen; size_t l4len; uint32_t seq; int ret; - iov = tcp_l2_flags_iov[tcp_flags_used]; + iov = tcp_l2_iov[tcp_payload_used]; if (CONN_V4(conn)) { - iov[TCP_IOV_IP] = IOV_OF_LVALUE(tcp4_flags_ip[tcp_flags_used]); + iov[TCP_IOV_IP] = IOV_OF_LVALUE(tcp4_payload_ip[tcp_payload_used]); iov[TCP_IOV_ETH].iov_base = &tcp4_eth_src; } else { - iov[TCP_IOV_IP] = IOV_OF_LVALUE(tcp6_flags_ip[tcp_flags_used]); + iov[TCP_IOV_IP] = IOV_OF_LVALUE(tcp6_payload_ip[tcp_payload_used]); iov[TCP_IOV_ETH].iov_base = &tcp6_eth_src; } payload = iov[TCP_IOV_PAYLOAD].iov_base; seq = conn->seq_to_tap; ret = tcp_prepare_flags(c, conn, flags, &payload->th, - &payload->opts, &optlen); + (struct tcp_syn_opts *)&payload->data, &optlen); if (ret <= 0) return ret; - tcp_flags_used++; + tcp_payload_used++; l4len = tcp_l2_buf_fill_headers(conn, iov, optlen, NULL, seq, false); iov[TCP_IOV_PAYLOAD].iov_len = l4len; - if (flags & DUP_ACK) { - struct iovec *dup_iov; + struct iovec *dup_iov = tcp_l2_iov[tcp_payload_used++]; - dup_iov = tcp_l2_flags_iov[tcp_flags_used++]; memcpy(dup_iov[TCP_IOV_TAP].iov_base, iov[TCP_IOV_TAP].iov_base, iov[TCP_IOV_TAP].iov_len); dup_iov[TCP_IOV_ETH].iov_base = iov[TCP_IOV_ETH].iov_base; @@ -237,8 +195,8 @@ int tcp_buf_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) dup_iov[TCP_IOV_PAYLOAD].iov_len = l4len; } - if (tcp_flags_used > TCP_FRAMES_MEM - 2) - tcp_flags_flush(c); + if (tcp_payload_used > TCP_FRAMES_MEM - 2) + tcp_payload_flush(c); return 0; } @@ -254,6 +212,7 @@ int tcp_buf_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, ssize_t dlen, int no_csum, uint32_t seq) { + struct tcp_payload_t *payload; const uint16_t *check = NULL; struct iovec *iov; size_t l4len; @@ -274,6 +233,11 @@ static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, iov[TCP_IOV_IP] = IOV_OF_LVALUE(tcp6_payload_ip[tcp_payload_used]); iov[TCP_IOV_ETH].iov_base = &tcp6_eth_src; } + payload = iov[TCP_IOV_PAYLOAD].iov_base; + payload->th.th_off = sizeof(struct tcphdr) / 4; + payload->th.th_x2 = 0; + payload->th.th_flags = 0; + payload->th.ack = 1; l4len = tcp_l2_buf_fill_headers(conn, iov, dlen, check, seq, false); iov[TCP_IOV_PAYLOAD].iov_len = l4len; if (++tcp_payload_used > TCP_FRAMES_MEM - 1) diff --git a/tcp_buf.h b/tcp_buf.h index 49c04d4..54f5e53 100644 --- a/tcp_buf.h +++ b/tcp_buf.h @@ -7,7 +7,6 @@ #define TCP_BUF_H void tcp_sock_iov_init(const struct ctx *c); -void tcp_flags_flush(const struct ctx *c); void tcp_payload_flush(const struct ctx *c); int tcp_buf_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn); int tcp_buf_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags); diff --git a/tcp_internal.h b/tcp_internal.h index a5a47df..c846f60 100644 --- a/tcp_internal.h +++ b/tcp_internal.h @@ -134,21 +134,6 @@ struct tcp_syn_opts { .ws = TCP_OPT_WS(ws_), \ }) -/** - * struct tcp_flags_t - TCP header and data to send zero-length - * segments (flags) - * @th: TCP header - * @opts TCP options - */ -struct tcp_flags_t { - struct tcphdr th; - struct tcp_syn_opts opts; -#ifdef __AVX2__ -} __attribute__ ((packed, aligned(32))); -#else -} __attribute__ ((packed, aligned(__alignof__(unsigned int)))); -#endif - extern char tcp_buf_discard [MAX_WINDOW]; void conn_flag_do(const struct ctx *c, struct tcp_tap_conn *conn, -- 2.45.2

3 2

2024

2023

2022

2021

dev