- dev - passt

passt: new version 2023_12_30.f091893 available
by Stefano Brivio 02 Jan '24

02 Jan '24

The new version with tag 2023_12_30.f091893 includes the following changes: f091893 netlink: Fetch most specific (longest prefix) address in nl_addr_get() 62b94c3 README: Default SLAAC prefix comes from address (not prefix) on host e197c4e README: Fix broken link to CentOS Stream package f0ccca7 test: make passt.mbuto script more robust 6a348cb tcp: make tcp_sock_set_bufsize() static (again) 57de44a util: Make sock_l4() treat empty string ifname like NULL 5cada56 treewide: Avoid in_addr_t 24d1f65 icmp: Avoid unnecessary handling of unspecified bind address b9f4314 util: Drop explicit setting to INADDR_ANY/in6addr_any in sock_l4() eae4304 util: Use htonl_constant() in more places 073f530 treewide: Add IN4ADDR_ANY_INIT macro 5463327 treewide: Use IN4ADDR_LOOPBACK_INIT more widely 1f2aab8 tcp: Fix address type for tcp_sock_init_af() 4681ea0 checksum: Don't use linux/icmp.h when netinet/ip_icmp.h will do 5d5bb8c tcp: Don't account for hash table size in tcp_hash() 64e5459 tcp: Implement hash table with indices rather than pointers 5913f26 tcp: Switch hash table to linear probing instead of chaining 89fcb56 tcp: Fix conceptually incorrect byte-order switch in tcp_tap_handler() a672705 README: Update "Availability" section fd29d62 tcp: Cast timeval fields to unsigned long long for printing 60925b8 flow: Add missing include, stdio.h baf4e2c test: Select first reported IPv6 address for guest/host comparison 00358b7 ndp: Extend lifetime of prefix, router, RDNSS and search list d491a40 test: Make handling of shell prompts with escapes a little more reliable https://passt.top/passt/log/?qt=range&q=2023_12_04.b86afe3..2023_12_30.f091… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6834693/ permanent mirror: https://passt.top/builds/copr/0^20231230.gf091893/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gf091893-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0f091893-1_all.deb -- Stefano

1 0

[PATCH] netlink: nl_addr_get() returns 0, not 9, on success
by Stefano Brivio 28 Dec '23

28 Dec '23

Fixes: 5103811e2df3 ("netlink: Propagate errors for "dump" operations") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netlink.c b/netlink.c index 379d46e..b221c79 100644 --- a/netlink.c +++ b/netlink.c @@ -535,7 +535,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, * @prefix_len: Mask or prefix length, to fill (for IPv4) * @addr_l: Link-scoped address to fill (for IPv6) * - * Return: 9 on success, negative error code on failure + * Return: 0 on success, negative error code on failure */ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, void *addr, int *prefix_len, void *addr_l) -- 2.39.2

2 1

[PATCH v2] test: make passt.mbuto script more robust
by Jon Maloy 27 Dec '23

27 Dec '23

From: Jon Paul Maloy <jmaloy(a)redhat.com> Creation of a symbolic link from /sbin to /usr/sbin fails if /sbin exists and is non-empty. This is the case on Ubuntu-23.04. We fix this by removing /sbin before creating the link. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: Move the contents of /sbin to /usr/sbin before creating the link. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/passt.mbuto | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 90816d2..75d1260 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -26,6 +26,9 @@ DIRS="${DIRS} /tmp /sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/. COPIES="${COPIES} small.bin,/root/small.bin medium.bin,/root/medium.bin big.bin,/root/big.bin" FIXUP="${FIXUP}"' + mv /sbin/* /usr/sbin || : + rm -rf /sbin + ln -s /usr/sbin /sbin cat > /sbin/dhclient-script << EOF #!/bin/sh LOG=/var/log/dhclient-script.log @@ -47,7 +50,6 @@ set >> \$LOG exit 0 EOF chmod 755 /sbin/dhclient-script - ln -s /sbin /usr/sbin ln -s /bin /usr/bin ln -s /run /var/run :> /etc/fstab -- 2.39.2

3 2

[PATCH] tcp: make tcp_sock_set_bufsize() static (again)
by Laurent Vivier 27 Dec '23

27 Dec '23

e5eefe77435a ("tcp: Refactor to use events instead of states, split out spliced implementation") has exported tcp_sock_set_bufsize() to be able to use it in tcp_splice.c, but 6ccab72d9b40 has removed its use in tcp_splice.c, so we can set it static again. Fixes: 6ccab72d9b40 ("tcp: Improve handling of fallback if socket pool is empty on new splice") Cc: david(a)gibson.dropbear.id.au Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 2 +- tcp.h | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index f506cfdd3bc7..1680b516b5b9 100644 --- a/tcp.c +++ b/tcp.c @@ -929,7 +929,7 @@ static void tcp_get_sndbuf(struct tcp_tap_conn *conn) * tcp_sock_set_bufsize() - Set SO_RCVBUF and SO_SNDBUF to maximum values * @s: Socket, can be -1 to avoid check in the caller */ -void tcp_sock_set_bufsize(const struct ctx *c, int s) +static void tcp_sock_set_bufsize(const struct ctx *c, int s) { int v = INT_MAX / 2; /* Kernel clamps and rounds, no need to check */ diff --git a/tcp.h b/tcp.h index 27b11668f258..87a6bf9f0ee8 100644 --- a/tcp.h +++ b/tcp.h @@ -23,7 +23,6 @@ int tcp_init(struct ctx *c); void tcp_timer(struct ctx *c, const struct timespec *ts); void tcp_defer_handler(struct ctx *c); -void tcp_sock_set_bufsize(const struct ctx *c, int s); void tcp_update_l2_buf(const unsigned char *eth_d, const unsigned char *eth_s); /** -- 2.42.0

3 2

[PATCH] checksum: Don't use linux/icmp.h when netinet/ip_icmp.h will do
by David Gibson 27 Dec '23

27 Dec '23

In most places where we need to get ICMP definitions, we get them from <netinet/ip_icmp.h>. However in checksum.c we instead include <linux/icmp.h>. Change it to use <netinet/ip_icmp.h> for consistency. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- checksum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checksum.c b/checksum.c index 03b8a7c..f21c9b7 100644 --- a/checksum.c +++ b/checksum.c @@ -49,11 +49,11 @@ #include <arpa/inet.h> #include <netinet/ip.h> #include <netinet/tcp.h> +#include <netinet/ip_icmp.h> #include <stddef.h> #include <stdint.h> #include <linux/udp.h> -#include <linux/icmp.h> #include <linux/icmpv6.h> /* Checksums are optional for UDP over IPv4, so we usually just set -- 2.43.0

2 1

[PATCH v2 0/4] TCP hash table changes, in preparation for flow table
by David Gibson 27 Dec '23

27 Dec '23

I now have an in-progress draft of a unified hash table to go with the unified flow table. This turns out to be easier if we first make some preliminary changes to the structure of the TCP hash table. So, here are those. Changes since v1: * Use while loops instead of some equivalent, but hard to read for loops for the hash probing. * Switch from probing forwards through hash buckets to probing backwards. This makes the code closer to the version in Knuth its based on, and thus easier to see if we've made a mistake in adaptation. * Improve the helpers for modular arithmetic in use * Correct an error where we had things exactly the wrong way around when finding entries to move during removal. * Add a patch fixing a conceptual / documentation problem in some adjacent code David Gibson (4): tcp: Fix conceptually incorrect byte-order switch in tcp_tap_handler() tcp: Switch hash table to linear probing instead of chaining tcp: Implement hash table with indices rather than pointers tcp: Don't account for hash table size in tcp_hash() flow.h | 11 +++++ tcp.c | 143 ++++++++++++++++++++++++++++------------------------- tcp_conn.h | 2 - util.h | 28 +++++++++++ 4 files changed, 114 insertions(+), 70 deletions(-) -- 2.43.0

2 5

[PATCH v2] README: Default SLAAC prefix comes from address (not prefix) on host
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Fix botched paragraph README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index c360037..916260e 100644 --- a/README.md +++ b/README.md @@ -406,13 +406,13 @@ upstream interface of the host, and the same default gateway as the default gateway of the host. Addresses are translated in case the guest is seen using a different address from the assigned one. -For IPv6, the guest or namespace is assigned, via SLAAC, the same prefix as the -upstream interface of the host, the same default route as the default route of -the host, and, if a DHCPv6 client is running in the guest or namespace, also the -same address as the upstream address of the host. This means that, with a DHCPv6 -client in the guest or namespace, addresses don't need to be translated. Should -the client use a different address, the destination address is translated for -packets going to the guest or to the namespace. +For IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from +the address of the upstream interface of the host, the same default route as the +default route of the host, and, if a DHCPv6 client is running in the guest or +namespace, also the same address as the upstream address of the host. This means +that, with a DHCPv6 client in the guest or namespace, addresses don't need to be +translated. Should the client use a different address, the destination address +is translated for packets going to the guest or to the namespace. ### Local connections with _passt_ -- 2.39.2

1 0

[PATCH] README: Default SLAAC prefix comes from address (not prefix) on host
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index c360037..e73a51d 100644 --- a/README.md +++ b/README.md @@ -406,10 +406,11 @@ upstream interface of the host, and the same default gateway as the default gateway of the host. Addresses are translated in case the guest is seen using a different address from the assigned one. -For IPv6, the guest or namespace is assigned, via SLAAC, the same prefix as the -upstream interface of the host, the same default route as the default route of -the host, and, if a DHCPv6 client is running in the guest or namespace, also the -same address as the upstream address of the host. This means that, with a DHCPv6 +For IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from +the address of the upstream interface of the hostthe same prefix as the upstream +interface of the host, the same default route as the default route of the host, +and, if a DHCPv6 client is running in the guest or namespace, also the same +address as the upstream address of the host. This means that, with a DHCPv6 client in the guest or namespace, addresses don't need to be translated. Should the client use a different address, the destination address is translated for packets going to the guest or to the namespace. -- 2.39.2

1 0

[PATCH] netlink: Fetch most specific (longest prefix) address in nl_addr_get()
by Stefano Brivio 27 Dec '23

27 Dec '23

This happened in most cases implicitly before commit eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions"): while going through results from netlink, we would only copy an address into the provided return buffer if no address had been picked yet. Because of the insertion logic in the kernel (ipv6_link_dev_addr()), the first returned address would also be the one added last, and, in case of a Linux guest using a DHCPv6 client as well as SLAAC, that would be the address assigned via DHCPv6, because SLAAC happens before the DHCPv6 exchange. The effect of, instead, picking the last returned address (first assigned) is visible when passt or pasta runs nested, given that, by default, they advertise a prefix for SLAAC usage, plus an address via DHCPv6. The first level (L1 guest) would get a /64 address by means of SLAAC, and a /128 address via DHCPv6, the latter matching the address on the host. The second level (L2 guest) would also get two addresses: a /64 via SLAAC (same prefix as the host), and a /128 via DHCPv6, matching the the L1 SLAAC-assigned address, not the one obtained via DHCPv6. That is, none of the L2 addresses would match the address on the host. The whole point of having a DHCPv6 server is to avoid (implicit) NAT when possible, though. Fix this in a more explicit way than the behaviour we initially had: pick the first address among the set of most specific ones, by comparing prefix lengths. Do this for IPv4 and for link-local addresses, too, to match in any case the implementation of the default source address selection. Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Fixes: eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/netlink.c b/netlink.c index b221c79..6e40d28 100644 --- a/netlink.c +++ b/netlink.c @@ -527,7 +527,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, } /** - * nl_addr_get() - Get IP address for given interface and address family + * nl_addr_get() - Get most specific global address, given interface and family * @s: Netlink socket * @ifi: Interface index in outer network namespace * @af: Address family @@ -540,6 +540,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, int nl_addr_get(int s, unsigned int ifi, sa_family_t af, void *addr, int *prefix_len, void *addr_l) { + uint8_t prefix_max = 0, prefix_max_ll = 0; struct req_t { struct nlmsghdr nlh; struct ifaddrmsg ifa; @@ -566,17 +567,25 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, if (rta->rta_type != IFA_ADDRESS) continue; - if (af == AF_INET) { + if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - *prefix_len = ifa->ifa_prefixlen; + + prefix_max = *prefix_len = ifa->ifa_prefixlen; } else if (af == AF_INET6 && addr && - ifa->ifa_scope == RT_SCOPE_UNIVERSE) { + ifa->ifa_scope == RT_SCOPE_UNIVERSE && + ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max = ifa->ifa_prefixlen; } if (addr_l && - af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK) + af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK && + ifa->ifa_prefixlen > prefix_max_ll) { memcpy(addr_l, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max_ll = ifa->ifa_prefixlen; + } } } return status; -- 2.39.2

1 0

[PATCH] flow: Add missing include, stdio.h
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: lemmi <lemmi(a)nerd2nerd.org> Link: https://github.com/void-linux/void-packages/actions/runs/7097192513/job/193… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- flow.c | 1 + 1 file changed, 1 insertion(+) diff --git a/flow.c b/flow.c index d24726d..a8aeb15 100644 --- a/flow.c +++ b/flow.c @@ -6,6 +6,7 @@ */ #include <stdint.h> +#include <stdio.h> #include <unistd.h> #include <string.h> -- 2.39.2

2 1