This passes a fully connected stream socket to passt.
Signed-off-by: Richard W.M. Jones <rjones(a)redhat.com>
---
conf.c | 15 +++++++++++++++
passt.1 | 10 ++++++++++
passt.c | 2 +-
passt.h | 2 ++
tap.c | 22 +++++++++++++++++++++-
5 files changed, 49 insertions(+), 2 deletions(-)
diff --git a/conf.c b/conf.c
index 1adcf83..5e08bd6 100644
--- a/conf.c
+++ b/conf.c
@@ -1089,6 +1089,7 @@ void conf(struct ctx *c, int argc, char **argv)
{"log-file", required_argument, NULL, 'l' },
{"help", no_argument, NULL, 'h' },
{"socket", required_argument, NULL, 's' },
+ {"fd", required_argument, NULL, 'F' },
{"ns-ifname", required_argument, NULL, 'I' },
{"pcap", required_argument, NULL, 'p' },
{"pid", required_argument, NULL, 'P' },
@@ -1366,6 +1367,15 @@ void conf(struct ctx *c, int argc, char **argv)
usage(argv[0]);
}
break;
+ case 'F':
+ if (c->sock_fd >= 0) {
+ err("Multiple --fd options given");
+ usage(argv[0]);
+ }
+
+ errno = 0;
+ c->sock_fd = strtol(optarg, NULL, 0);
+ break;
case 'I':
if (*c->pasta_ifn) {
err("Multiple --ns-ifname options given");
@@ -1600,6 +1610,11 @@ void conf(struct ctx *c, int argc, char **argv)
usage(argv[0]);
}
+ if (*c->sock_path && c->sock_fd >= 0) {
+ err("Options --socket and --fd are mutually exclusive");
+ usage(argv[0]);
+ }
+
ret = conf_ugid(runas, &uid, &gid);
if (ret)
usage(argv[0]);
diff --git a/passt.1 b/passt.1
index e34a3e0..66d5eb6 100644
--- a/passt.1
+++ b/passt.1
@@ -297,6 +297,16 @@ Path for UNIX domain socket used by \fBqemu\fR(1) or \fBqrap\fR(1) to
connect to
Default is to probe a free socket, not accepting connections, starting from
\fI/tmp/passt_1.socket\fR to \fI/tmp/passt_64.socket\fR.
+.TP
+.BR \-F ", " \-\-fd " " \fIFD
+Pass a pre-opened, connected socket to
+\fBpasst\fR.
+Usually the socket is opened in the parent process and
+\fBpasst\fR
+inherits it when run as a child. This allows the parent process to
+open sockets using another address family or requiring special
+privileges.
+
.TP
.BR \-1 ", " \-\-one-off
Quit after handling a single client connection, that is, once the client closes
diff --git a/passt.c b/passt.c
index 7d323c2..ef4643e 100644
--- a/passt.c
+++ b/passt.c
@@ -187,7 +187,7 @@ int main(int argc, char **argv)
isolate_initial();
- c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = -1;
+ c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = c.sock_fd = -1;
sigemptyset(&sa.sa_mask);
sa.sa_flags = 0;
diff --git a/passt.h b/passt.h
index e93eea8..32fc4ae 100644
--- a/passt.h
+++ b/passt.h
@@ -149,6 +149,7 @@ struct ip6_ctx {
* @stderr: Force logging to stderr
* @nofile: Maximum number of open files (ulimit -n)
* @sock_path: Path for UNIX domain socket
+ * @sock_fd: Connected UNIX domain socket
* @pcap: Path for packet capture file
* @pid_file: Path to PID file, empty string if not configured
* @pasta_netns_fd: File descriptor for network namespace in pasta mode
@@ -198,6 +199,7 @@ struct ctx {
int stderr;
int nofile;
char sock_path[UNIX_PATH_MAX];
+ int sock_fd;
char pcap[PATH_MAX];
char pid_file[PATH_MAX];
int one_off;
diff --git a/tap.c b/tap.c
index abeff25..418a788 100644
--- a/tap.c
+++ b/tap.c
@@ -1063,6 +1063,24 @@ static void tap_sock_tun_init(struct ctx *c)
epoll_ctl(c->epollfd, EPOLL_CTL_ADD, c->fd_tap, &ev);
}
+/**
+ * tap_sock_fd_init() - Set up a connected socket (c->sock_fd)
+ * @c: Execution context
+ */
+void tap_sock_fd_init(struct ctx *c)
+{
+ struct epoll_event ev = { 0 };
+
+ c->fd_tap = c->sock_fd;
+ c->sock_fd = -1;
+
+ info("Setting up fd %d as tap socket", c->fd_tap);
+
+ ev.data.fd = c->fd_tap;
+ ev.events = EPOLLIN | EPOLLRDHUP;
+ epoll_ctl(c->epollfd, EPOLL_CTL_ADD, c->fd_tap, &ev);
+}
+
/**
* tap_sock_init() - Create and set up AF_UNIX socket or tuntap file descriptor
* @c: Execution context
@@ -1087,7 +1105,9 @@ void tap_sock_init(struct ctx *c)
}
if (c->mode == MODE_PASST) {
- if (c->fd_tap_listen == -1)
+ if (c->sock_fd >= 0)
+ tap_sock_fd_init(c);
+ else if (c->fd_tap_listen == -1)
tap_sock_unix_init(c);
} else {
tap_sock_tun_init(c);
--
2.37.0.rc2