The standard library assert(3), at least with glibc, hits our seccomp filter and dies with SIGSYS before it's able to print a message, making it near useless. Therefore, since 7a8ed9459dfe ("Make assertions actually useful") we've instead used our own implementation, named ASSERT(). This makes our code look slightly odd though - ASSERT() has the same overall effect as assert(), it's just a different implementation. More importantly this makes it awkward to share code between passt/pasta proper and things that compile in a more typical environment. We're going to want that for our upcoming dynamic configuration tool. Address this by overriding the standard library's assert() implementation with our own, instead of giving ours its own name. The standard assert() is supposed to be omitted if NDEBUG is defined, which ours doesn't do. Implement that as well, so ours doesn't unexpectedly differ. For the -DNDEBUG case we do this by *not* overriding assert(), since it will be a no-op anyway. This requires a few places to add a #include to let us compile (albeit with warnings) when -DNDEBUG. Signed-off-by: David Gibson --- Makefile | 2 +- conf.c | 6 ++-- flow.c | 80 ++++++++++++++++++++++++++-------------------------- flow_table.h | 2 +- fwd.c | 14 ++++----- icmp.c | 14 ++++----- inany.h | 4 +-- iov.c | 3 +- isolation.c | 2 +- lineread.c | 5 ++-- netlink.c | 2 +- packet.c | 4 +-- passt.c | 2 +- pif.c | 4 +-- tap.c | 6 ++-- tcp.c | 24 ++++++++-------- tcp_splice.c | 10 +++---- tcp_vu.c | 8 +++--- udp.c | 22 +++++++-------- udp_flow.c | 4 +-- udp_vu.c | 4 +-- util.c | 6 ++-- util.h | 15 ++++++++-- vhost_user.c | 8 +++--- virtio.c | 5 ++-- vu_common.c | 4 +-- 26 files changed, 136 insertions(+), 124 deletions(-) diff --git a/Makefile b/Makefile index fe016f30..513dc6c6 100644 --- a/Makefile +++ b/Makefile @@ -188,5 +188,5 @@ cppcheck: $(PASST_SRCS) $(HEADERS) --inline-suppr \ --suppress=missingIncludeSystem \ --suppress=unusedStructMember \ - $(filter -D%,$(FLAGS) $(CFLAGS) $(CPPFLAGS)) -D CPPCHECK_6936 \ + $(filter -D%,$(FLAGS) $(CFLAGS) $(CPPFLAGS)) -D CPPCHECK_6936 \ $^ diff --git a/conf.c b/conf.c index dafac463..940fb9e9 100644 --- a/conf.c +++ b/conf.c @@ -161,7 +161,7 @@ static void conf_ports_range_except(const struct ctx *c, char optname, else if (optname == 'u' || optname == 'U') proto = IPPROTO_UDP; else - ASSERT(0); + assert(0); if (addr) { if (!c->ifi4 && inany_v4(addr)) { @@ -186,7 +186,7 @@ static void conf_ports_range_except(const struct ctx *c, char optname, /* FIXME: Once the fwd bitmaps are removed, move this * workaround to the caller */ - ASSERT(!addr && ifname && !strcmp(ifname, "lo")); + assert(!addr && ifname && !strcmp(ifname, "lo")); warn( "SO_BINDTODEVICE unavailable, forwarding only 127.0.0.1 and ::1 for '-%c %s'", optname, optarg); @@ -1743,7 +1743,7 @@ void conf(struct ctx *c, int argc, char **argv) die("Invalid host nameserver address: %s", optarg); case 25: /* Already handled in conf_mode() */ - ASSERT(c->mode == MODE_VU); + assert(c->mode == MODE_VU); break; case 26: vu_print_capabilities(); diff --git a/flow.c b/flow.c index 735d3c5f..4282da2e 100644 --- a/flow.c +++ b/flow.c @@ -216,7 +216,7 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, const char *ifname = NULL; union sockaddr_inany sa; - ASSERT(pif_is_socket(pif)); + assert(pif_is_socket(pif)); pif_sockaddr(c, &sa, pif, &tgt->oaddr, tgt->oport); @@ -244,7 +244,7 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, /* If we add new socket pifs, they'll need to be implemented * here */ - ASSERT(0); + assert(0); } } @@ -341,8 +341,8 @@ static void flow_set_state(struct flow_common *f, enum flow_state state) { uint8_t oldstate = f->state; - ASSERT(state < FLOW_NUM_STATES); - ASSERT(oldstate < FLOW_NUM_STATES); + assert(state < FLOW_NUM_STATES); + assert(oldstate < FLOW_NUM_STATES); f->state = state; flow_log_(f, true, LOG_DEBUG, "%s -> %s", flow_state_str[oldstate], @@ -369,7 +369,7 @@ int flow_epollfd(const struct flow_common *f) */ void flow_epollid_set(struct flow_common *f, int epollid) { - ASSERT(epollid < EPOLLFD_ID_SIZE); + assert(epollid < EPOLLFD_ID_SIZE); f->epollid = epollid; } @@ -407,7 +407,7 @@ int flow_epoll_set(const struct flow_common *f, int command, uint32_t events, */ void flow_epollid_register(int epollid, int epollfd) { - ASSERT(epollid < EPOLLFD_ID_SIZE); + assert(epollid < EPOLLFD_ID_SIZE); epoll_id_to_fd[epollid] = epollfd; } @@ -421,10 +421,10 @@ static void flow_initiate_(union flow *flow, uint8_t pif) { struct flow_common *f = &flow->f; - ASSERT(pif != PIF_NONE); - ASSERT(flow_new_entry == flow && f->state == FLOW_STATE_NEW); - ASSERT(f->type == FLOW_TYPE_NONE); - ASSERT(f->pif[INISIDE] == PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); + assert(pif != PIF_NONE); + assert(flow_new_entry == flow && f->state == FLOW_STATE_NEW); + assert(f->type == FLOW_TYPE_NONE); + assert(f->pif[INISIDE] == PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); f->pif[INISIDE] = pif; flow_set_state(f, FLOW_STATE_INI); @@ -474,7 +474,7 @@ struct flowside *flow_initiate_sa(union flow *flow, uint8_t pif, if (inany_from_sockaddr(&ini->eaddr, &ini->eport, ssa) < 0) { char str[SOCKADDR_STRLEN]; - ASSERT_WITH_MSG(0, "Bad socket address %s", + assert_with_msg(0, "Bad socket address %s", sockaddr_ntop(ssa, str, sizeof(str))); } if (daddr) @@ -508,10 +508,10 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, const struct fwd_table *fwd; uint8_t tgtpif = PIF_NONE; - ASSERT(flow_new_entry == flow && f->state == FLOW_STATE_INI); - ASSERT(f->type == FLOW_TYPE_NONE); - ASSERT(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); - ASSERT(flow->f.state == FLOW_STATE_INI); + assert(flow_new_entry == flow && f->state == FLOW_STATE_INI); + assert(f->type == FLOW_TYPE_NONE); + assert(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); + assert(flow->f.state == FLOW_STATE_INI); switch (f->pif[INISIDE]) { case PIF_TAP: @@ -574,10 +574,10 @@ union flow *flow_set_type(union flow *flow, enum flow_type type) { struct flow_common *f = &flow->f; - ASSERT(type != FLOW_TYPE_NONE); - ASSERT(flow_new_entry == flow && f->state == FLOW_STATE_TGT); - ASSERT(f->type == FLOW_TYPE_NONE); - ASSERT(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] != PIF_NONE); + assert(type != FLOW_TYPE_NONE); + assert(flow_new_entry == flow && f->state == FLOW_STATE_TGT); + assert(f->type == FLOW_TYPE_NONE); + assert(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] != PIF_NONE); f->type = type; flow_set_state(f, FLOW_STATE_TYPED); @@ -590,8 +590,8 @@ union flow *flow_set_type(union flow *flow, enum flow_type type) */ void flow_activate(struct flow_common *f) { - ASSERT(&flow_new_entry->f == f && f->state == FLOW_STATE_TYPED); - ASSERT(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] != PIF_NONE); + assert(&flow_new_entry->f == f && f->state == FLOW_STATE_TYPED); + assert(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] != PIF_NONE); flow_set_state(f, FLOW_STATE_ACTIVE); flow_new_entry = NULL; @@ -606,26 +606,26 @@ union flow *flow_alloc(void) { union flow *flow = &flowtab[flow_first_free]; - ASSERT(!flow_new_entry); + assert(!flow_new_entry); if (flow_first_free >= FLOW_MAX) return NULL; - ASSERT(flow->f.state == FLOW_STATE_FREE); - ASSERT(flow->f.type == FLOW_TYPE_NONE); - ASSERT(flow->free.n >= 1); - ASSERT(flow_first_free + flow->free.n <= FLOW_MAX); + assert(flow->f.state == FLOW_STATE_FREE); + assert(flow->f.type == FLOW_TYPE_NONE); + assert(flow->free.n >= 1); + assert(flow_first_free + flow->free.n <= FLOW_MAX); if (flow->free.n > 1) { union flow *next; /* Use one entry from the cluster */ - ASSERT(flow_first_free <= FLOW_MAX - 2); + assert(flow_first_free <= FLOW_MAX - 2); next = &flowtab[++flow_first_free]; - ASSERT(FLOW_IDX(next) < FLOW_MAX); - ASSERT(next->f.type == FLOW_TYPE_NONE); - ASSERT(next->free.n == 0); + assert(FLOW_IDX(next) < FLOW_MAX); + assert(next->f.type == FLOW_TYPE_NONE); + assert(next->free.n == 0); next->free.n = flow->free.n - 1; next->free.next = flow->free.next; @@ -649,12 +649,12 @@ union flow *flow_alloc(void) */ void flow_alloc_cancel(union flow *flow) { - ASSERT(flow_new_entry == flow); - ASSERT(flow->f.state == FLOW_STATE_NEW || + assert(flow_new_entry == flow); + assert(flow->f.state == FLOW_STATE_NEW || flow->f.state == FLOW_STATE_INI || flow->f.state == FLOW_STATE_TGT || flow->f.state == FLOW_STATE_TYPED); - ASSERT(flow_first_free > FLOW_IDX(flow)); + assert(flow_first_free > FLOW_IDX(flow)); flow_set_state(&flow->f, FLOW_STATE_FREE); memset(flow, 0, sizeof(*flow)); @@ -704,7 +704,7 @@ static uint64_t flow_sidx_hash(const struct ctx *c, flow_sidx_t sidx) const struct flowside *side = &f->side[sidx.sidei]; uint8_t pif = f->pif[sidx.sidei]; - ASSERT(pif != PIF_NONE); + assert(pif != PIF_NONE); return flow_hash(c, FLOW_PROTO(f), pif, side); } @@ -897,7 +897,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) flow_timer_run = *now; } - ASSERT(!flow_new_entry); /* Incomplete flow at end of cycle */ + assert(!flow_new_entry); /* Incomplete flow at end of cycle */ /* Check which flows we might need to close first, but don't free them * yet as it's not safe to do that in the middle of flow_foreach(). @@ -907,7 +907,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) switch (flow->f.type) { case FLOW_TYPE_NONE: - ASSERT(false); + assert(false); break; case FLOW_TCP: closed = tcp_flow_defer(&flow->tcp); @@ -942,7 +942,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) unsigned skip = flow->free.n; /* First entry of a free cluster must have n >= 1 */ - ASSERT(skip); + assert(skip); if (free_head) { /* Merge into preceding free cluster */ @@ -965,7 +965,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) case FLOW_STATE_TGT: case FLOW_STATE_TYPED: /* Incomplete flow at end of cycle */ - ASSERT(false); + assert(false); break; case FLOW_STATE_ACTIVE: @@ -975,7 +975,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) if (free_head) { /* Add slot to current free cluster */ - ASSERT(FLOW_IDX(flow) == + assert(FLOW_IDX(flow) == FLOW_IDX(free_head) + free_head->n); free_head->n++; flow->free.n = flow->free.next = 0; @@ -992,7 +992,7 @@ void flow_defer_handler(const struct ctx *c, const struct timespec *now) break; default: - ASSERT(false); + assert(false); } } diff --git a/flow_table.h b/flow_table.h index 8fb7b5c3..7694e726 100644 --- a/flow_table.h +++ b/flow_table.h @@ -176,7 +176,7 @@ static inline flow_sidx_t flow_sidx(const struct flow_common *f, unsigned sidei) { /* cppcheck-suppress [knownConditionTrueFalse, unmatchedSuppression] */ - ASSERT(sidei == !!sidei); + assert(sidei == !!sidei); return (flow_sidx_t){ .sidei = sidei, diff --git a/fwd.c b/fwd.c index bedbf98a..f3b4bf2a 100644 --- a/fwd.c +++ b/fwd.c @@ -352,7 +352,7 @@ void fwd_rule_add(struct fwd_table *fwd, uint8_t proto, uint8_t flags, struct fwd_rule *new; unsigned i, port; - ASSERT(!(flags & ~allowed_flags)); + assert(!(flags & ~allowed_flags)); if (fwd->count >= ARRAY_SIZE(fwd->rules)) die("Too many port forwarding ranges"); @@ -402,7 +402,7 @@ void fwd_rule_add(struct fwd_table *fwd, uint8_t proto, uint8_t flags, die("Invalid interface name: %s", ifname); } - ASSERT(first <= last); + assert(first <= last); new->first = first; new->last = last; @@ -450,7 +450,7 @@ const struct fwd_rule *fwd_rule_search(const struct fwd_table *fwd, char ostr[INANY_ADDRSTRLEN], rstr[INANY_ADDRSTRLEN]; const struct fwd_rule *rule = &fwd->rules[hint]; - ASSERT((unsigned)hint < fwd->count); + assert((unsigned)hint < fwd->count); if (fwd_rule_match(rule, ini, proto)) return rule; @@ -521,14 +521,14 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, bool bound_one = false; unsigned port, idx; - ASSERT(pif_is_socket(pif)); + assert(pif_is_socket(pif)); if (!*ifname) ifname = NULL; idx = rule - fwd->rules; - ASSERT(idx < MAX_FWD_RULES); - ASSERT(!(rule->flags & FWD_SCAN && !scanmap)); + assert(idx < MAX_FWD_RULES); + assert(!(rule->flags & FWD_SCAN && !scanmap)); for (port = rule->first; port <= rule->last; port++) { int fd = rule->socks[port - rule->first]; @@ -554,7 +554,7 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, else if (rule->proto == IPPROTO_UDP) fd = udp_listen(c, pif, idx, addr, ifname, port); else - ASSERT(0); + assert(0); if (fd < 0) { char astr[INANY_ADDRSTRLEN]; diff --git a/icmp.c b/icmp.c index 0b0f593c..18b6106a 100644 --- a/icmp.c +++ b/icmp.c @@ -58,7 +58,7 @@ static struct icmp_ping_flow *ping_at_sidx(flow_sidx_t sidx) if (!flow) return NULL; - ASSERT(flow->f.type == FLOW_PING4 || flow->f.type == FLOW_PING6); + assert(flow->f.type == FLOW_PING4 || flow->f.type == FLOW_PING6); return &flow->ping; } @@ -80,7 +80,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref) if (c->no_icmp) return; - ASSERT(pingf); + assert(pingf); n = recvfrom(ref.fd, buf, sizeof(buf), 0, &sr.sa, &sl); if (n < 0) { @@ -109,7 +109,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref) ih6->icmp6_identifier = htons(ini->eport); seq = ntohs(ih6->icmp6_sequence); } else { - ASSERT(0); + assert(0); } /* In PASTA mode, we'll get any reply we send, discard them. */ @@ -131,7 +131,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref) const struct in_addr *saddr = inany_v4(&ini->oaddr); const struct in_addr *daddr = inany_v4(&ini->eaddr); - ASSERT(saddr && daddr); /* Must have IPv4 addresses */ + assert(saddr && daddr); /* Must have IPv4 addresses */ tap_icmp4_send(c, *saddr, *daddr, buf, pingf->f.tap_omac, n); } else if (pingf->f.type == FLOW_PING6) { const struct in6_addr *saddr = &ini->oaddr.a6; @@ -256,7 +256,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, int cnt; (void)saddr; - ASSERT(pif == PIF_TAP); + assert(pif == PIF_TAP); if (af == AF_INET) { struct icmphdr ih_storage; @@ -287,7 +287,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, id = ntohs(ih->icmp6_identifier); seq = ntohs(ih->icmp6_sequence); } else { - ASSERT(0); + assert(0); } cnt = iov_tail_clone(&iov[0], MAX_IOV_ICMP, data); @@ -304,7 +304,7 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, tgt = &pingf->f.side[TGTSIDE]; - ASSERT(flow_proto[pingf->f.type] == proto); + assert(flow_proto[pingf->f.type] == proto); pingf->ts = now->tv_sec; pif_sockaddr(c, &sa, PIF_HOST, &tgt->eaddr, 0); diff --git a/inany.h b/inany.h index 9891ed6b..30e24164 100644 --- a/inany.h +++ b/inany.h @@ -86,7 +86,7 @@ static inline socklen_t socklen_inany(const union sockaddr_inany *sa) case AF_INET6: return sizeof(sa->sa6); default: - ASSERT(0); + assert(0); } } @@ -268,7 +268,7 @@ static inline void inany_from_af(union inany_addr *aa, aa->v4mapped.a4 = *((struct in_addr *)addr); } else { /* Not valid to call with other address families */ - ASSERT(0); + assert(0); } } diff --git a/iov.c b/iov.c index 31a3f5bc..ae074393 100644 --- a/iov.c +++ b/iov.c @@ -21,6 +21,7 @@ * GNU GPL, version 2 or (at your option) any later version. */ +#include #include #include "util.h" @@ -118,7 +119,7 @@ size_t iov_to_buf(const struct iovec *iov, size_t iov_cnt, for (copied = 0; copied < bytes && i < iov_cnt; i++) { size_t len = MIN(iov[i].iov_len - offset, bytes - copied); - ASSERT(iov[i].iov_base); + assert(iov[i].iov_base); memcpy((char *)buf + copied, (char *)iov[i].iov_base + offset, len); diff --git a/isolation.c b/isolation.c index b25f3498..7e6225df 100644 --- a/isolation.c +++ b/isolation.c @@ -396,7 +396,7 @@ void isolate_postfork(const struct ctx *c) prog.filter = filter_vu; break; default: - ASSERT(0); + assert(0); } if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) || diff --git a/lineread.c b/lineread.c index 4225de61..b9ceae10 100644 --- a/lineread.c +++ b/lineread.c @@ -12,6 +12,7 @@ * Author: David Gibson */ +#include #include #include #include @@ -44,8 +45,8 @@ static ssize_t peek_line(struct lineread *lr, bool eof) char *nl; /* Sanity checks (which also document invariants) */ - ASSERT(lr->next_line + lr->count >= lr->next_line); - ASSERT(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); + assert(lr->next_line + lr->count >= lr->next_line); + assert(lr->next_line + lr->count <= LINEREAD_BUFFER_SIZE); nl = memchr(lr->buf + lr->next_line, '\n', lr->count); diff --git a/netlink.c b/netlink.c index e07b47f4..6b74e882 100644 --- a/netlink.c +++ b/netlink.c @@ -160,7 +160,7 @@ static uint32_t nl_send(int s, void *req, uint16_t type, */ static int nl_status(const struct nlmsghdr *nh, ssize_t n, uint32_t seq) { - ASSERT(NLMSG_OK(nh, n)); + assert(NLMSG_OK(nh, n)); if (nh->nlmsg_seq != seq) die("netlink: Unexpected sequence number (%u != %u)", diff --git a/packet.c b/packet.c index 890561bb..1cb74b74 100644 --- a/packet.c +++ b/packet.c @@ -168,7 +168,7 @@ bool packet_get_do(const struct pool *p, size_t idx, { size_t i; - ASSERT_WITH_MSG(p->count <= p->size, + assert_with_msg(p->count <= p->size, "Corrupted pool count: %zu, size: %zu, %s:%i", p->count, p->size, func, line); @@ -188,7 +188,7 @@ bool packet_get_do(const struct pool *p, size_t idx, data->off = 0; for (i = 0; i < data->cnt; i++) { - ASSERT_WITH_MSG(!packet_check_range(p, data->iov[i].iov_base, + assert_with_msg(!packet_check_range(p, data->iov[i].iov_base, data->iov[i].iov_len, func, line), "Corrupt packet pool, %s:%i", func, line); diff --git a/passt.c b/passt.c index fc3b89b8..f84419c7 100644 --- a/passt.c +++ b/passt.c @@ -305,7 +305,7 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events) break; default: /* Can't happen */ - ASSERT(0); + assert(0); } stats.events[ref.type]++; print_stats(c, &stats, &now); diff --git a/pif.c b/pif.c index 82a3b5e4..1e807247 100644 --- a/pif.c +++ b/pif.c @@ -39,7 +39,7 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, { const struct in_addr *v4 = inany_v4(addr); - ASSERT(pif_is_socket(pif)); + assert(pif_is_socket(pif)); if (v4) { sa->sa_family = AF_INET; @@ -83,7 +83,7 @@ int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, union epoll_ref ref; int ret; - ASSERT(pif_is_socket(pif)); + assert(pif_is_socket(pif)); if (!addr) { ref.fd = sock_l4_dualstack_any(c, type, port, ifname); diff --git a/tap.c b/tap.c index eaa6111a..1049e023 100644 --- a/tap.c +++ b/tap.c @@ -117,7 +117,7 @@ unsigned long tap_l2_max_len(const struct ctx *c) return L2_MAX_LEN_VU; } /* NOLINTEND(bugprone-branch-clone) */ - ASSERT(0); + assert(0); return 0; /* Unreachable, for cppcheck's sake */ } @@ -543,7 +543,7 @@ size_t tap_send_frames(const struct ctx *c, const struct iovec *iov, case MODE_VU: /* fall through */ default: - ASSERT(0); + assert(0); } if (m < nframes) @@ -1536,7 +1536,7 @@ void tap_backend_init(struct ctx *c) } if (c->fd_tap != -1) { /* Passed as --fd */ - ASSERT(c->one_off); + assert(c->one_off); tap_start_connection(c); return; } diff --git a/tcp.c b/tcp.c index 9d91c3c8..b1458624 100644 --- a/tcp.c +++ b/tcp.c @@ -461,7 +461,7 @@ static struct tcp_tap_conn *conn_at_sidx(flow_sidx_t sidx) if (!flow) return NULL; - ASSERT(flow->f.type == FLOW_TCP); + assert(flow->f.type == FLOW_TCP); return &flow->tcp; } @@ -966,7 +966,7 @@ size_t tcp_fill_headers(const struct ctx *c, struct tcp_tap_conn *conn, const struct in_addr *src4 = inany_v4(&tapside->oaddr); const struct in_addr *dst4 = inany_v4(&tapside->eaddr); - ASSERT(src4 && dst4); + assert(src4 && dst4); l3len += + sizeof(*ip4h); @@ -1879,7 +1879,7 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, if (conn->events == CLOSED) return p->count - idx; - ASSERT(conn->events & ESTABLISHED); + assert(conn->events & ESTABLISHED); for (i = idx, iov_i = 0; i < (int)p->count; i++) { uint32_t seq, seq_offset, ack_seq; @@ -2260,8 +2260,8 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, return 1; } - ASSERT(flow->f.type == FLOW_TCP); - ASSERT(pif_at_sidx(sidx) == PIF_TAP); + assert(flow->f.type == FLOW_TCP); + assert(pif_at_sidx(sidx) == PIF_TAP); conn = &flow->tcp; flow_trace(conn, "packet length %zu from tap", l4len); @@ -2500,7 +2500,7 @@ void tcp_listen_handler(const struct ctx *c, union epoll_ref ref, union flow *flow; int s; - ASSERT(!c->no_tcp); + assert(!c->no_tcp); if (!(flow = flow_alloc())) return; @@ -2570,8 +2570,8 @@ void tcp_timer_handler(const struct ctx *c, union epoll_ref ref) struct itimerspec check_armed = { { 0 }, { 0 } }; struct tcp_tap_conn *conn = &FLOW(ref.flow)->tcp; - ASSERT(!c->no_tcp); - ASSERT(conn->f.type == FLOW_TCP); + assert(!c->no_tcp); + assert(conn->f.type == FLOW_TCP); /* We don't reset timers on ~ACK_FROM_TAP_DUE, ~ACK_TO_TAP_DUE. If the * timer is currently armed, this event came from a previous setting, @@ -2632,8 +2632,8 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, { struct tcp_tap_conn *conn = conn_at_sidx(ref.flowside); - ASSERT(!c->no_tcp); - ASSERT(pif_at_sidx(ref.flowside) != PIF_TAP); + assert(!c->no_tcp); + assert(pif_at_sidx(ref.flowside) != PIF_TAP); if (conn->events == CLOSED) return; @@ -2701,7 +2701,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, unsigned rule, { int s; - ASSERT(!c->no_tcp); + assert(!c->no_tcp); if (!c->ifi4) { if (!addr) @@ -2853,7 +2853,7 @@ static void tcp_get_rto_params(struct ctx *c) */ int tcp_init(struct ctx *c) { - ASSERT(!c->no_tcp); + assert(!c->no_tcp); tcp_get_rto_params(c); diff --git a/tcp_splice.c b/tcp_splice.c index d60981ca..42ee8abc 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -105,7 +105,7 @@ static struct tcp_splice_conn *conn_at_sidx(flow_sidx_t sidx) if (!flow) return NULL; - ASSERT(flow->f.type == FLOW_TCP_SPLICE); + assert(flow->f.type == FLOW_TCP_SPLICE); return &flow->tcp_splice; } @@ -369,7 +369,7 @@ static int tcp_splice_connect(const struct ctx *c, struct tcp_splice_conn *conn) else if (tgtpif == PIF_SPLICE) conn->s[1] = tcp_conn_sock_ns(c, af); else - ASSERT(0); + assert(0); if (conn->s[1] < 0) return -1; @@ -457,7 +457,7 @@ void tcp_splice_conn_from_sock(const struct ctx *c, union flow *flow, int s0) struct tcp_splice_conn *conn = FLOW_SET_TYPE(flow, FLOW_TCP_SPLICE, tcp_splice); - ASSERT(c->mode == MODE_PASTA); + assert(c->mode == MODE_PASTA); conn->s[0] = s0; conn->s[1] = -1; @@ -489,7 +489,7 @@ void tcp_splice_sock_handler(struct ctx *c, union epoll_ref ref, uint8_t lowat_set_flag, lowat_act_flag; int eof, never_read; - ASSERT(conn->f.type == FLOW_TCP_SPLICE); + assert(conn->f.type == FLOW_TCP_SPLICE); if (conn->events == SPLICE_CLOSED) return; @@ -779,7 +779,7 @@ void tcp_splice_timer(struct tcp_splice_conn *conn) { unsigned sidei; - ASSERT(!(conn->flags & CLOSING)); + assert(!(conn->flags & CLOSING)); flow_foreach_sidei(sidei) { if ((conn->flags & RCVLOWAT_SET(sidei)) && diff --git a/tcp_vu.c b/tcp_vu.c index fd734e85..826a38d1 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -94,7 +94,7 @@ int tcp_vu_send_flag(const struct ctx *c, struct tcp_tap_conn *conn, int flags) if (elem_cnt != 1) return -1; - ASSERT(flags_elem[0].in_sg[0].iov_len >= + assert(flags_elem[0].in_sg[0].iov_len >= MAX(hdrlen + sizeof(*opts), ETH_ZLEN + VNET_HLEN)); vu_set_vnethdr(flags_elem[0].in_sg[0].iov_base, 1); @@ -221,7 +221,7 @@ static ssize_t tcp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, /* reserve space for headers in iov */ iov = &elem[elem_cnt].in_sg[0]; - ASSERT(iov->iov_len >= hdrlen); + assert(iov->iov_len >= hdrlen); iov->iov_base = (char *)iov->iov_base + hdrlen; iov->iov_len -= hdrlen; head[(*head_cnt)++] = elem_cnt; @@ -298,7 +298,7 @@ static void tcp_vu_prepare(const struct ctx *c, struct tcp_tap_conn *conn, /* we guess the first iovec provided by the guest can embed * all the headers needed by L2 frame, including any padding */ - ASSERT(iov[0].iov_len >= hdrlen); + assert(iov[0].iov_len >= hdrlen); eh = vu_eth(base); @@ -445,7 +445,7 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) ssize_t dlen; size_t l2len; - ASSERT(frame_size >= hdrlen); + assert(frame_size >= hdrlen); dlen = frame_size - hdrlen; vu_set_vnethdr(iov->iov_base, buf_cnt); diff --git a/udp.c b/udp.c index 2275c16b..1fc5a42c 100644 --- a/udp.c +++ b/udp.c @@ -271,7 +271,7 @@ size_t udp_update_hdr4(struct iphdr *ip4h, struct udp_payload_t *bp, size_t l4len = dlen + sizeof(bp->uh); size_t l3len = l4len + sizeof(*ip4h); - ASSERT(src && dst); + assert(src && dst); ip4h->tot_len = htons(l3len); ip4h->daddr = dst->s_addr; @@ -431,7 +431,7 @@ static void udp_send_tap_icmp4(const struct ctx *c, size_t msglen = sizeof(msg) - sizeof(msg.data) + dlen; size_t l4len = dlen + sizeof(struct udphdr); - ASSERT(dlen <= ICMP4_MAX_DLEN); + assert(dlen <= ICMP4_MAX_DLEN); memset(&msg, 0, sizeof(msg)); msg.icmp4h.type = ee->ee_type; msg.icmp4h.code = ee->ee_code; @@ -480,7 +480,7 @@ static void udp_send_tap_icmp6(const struct ctx *c, size_t msglen = sizeof(msg) - sizeof(msg.data) + dlen; size_t l4len = dlen + sizeof(struct udphdr); - ASSERT(dlen <= ICMP6_MAX_DLEN); + assert(dlen <= ICMP6_MAX_DLEN); memset(&msg, 0, sizeof(msg)); msg.icmp6h.icmp6_type = ee->ee_type; msg.icmp6h.icmp6_code = ee->ee_code; @@ -628,7 +628,7 @@ static int udp_sock_recverr(const struct ctx *c, int s, flow_sidx_t sidx, } uflow = udp_at_sidx(sidx); - ASSERT(uflow); + assert(uflow); fromside = &uflow->f.side[sidx.sidei]; toside = &uflow->f.side[!sidx.sidei]; topif = uflow->f.pif[!sidx.sidei]; @@ -692,7 +692,7 @@ static int udp_sock_errs(const struct ctx *c, int s, flow_sidx_t sidx, socklen_t errlen; int rc, err; - ASSERT(!c->no_udp); + assert(!c->no_udp); /* Empty the error queue */ while ((rc = udp_sock_recverr(c, s, sidx, pif, port)) > 0) @@ -772,7 +772,7 @@ static int udp_peek_addr(int s, union sockaddr_inany *src, */ static int udp_sock_recv(const struct ctx *c, int s, struct mmsghdr *mmh, int n) { - ASSERT(!c->no_udp); + assert(!c->no_udp); n = recvmmsg(s, mmh, n, 0, NULL); if (n < 0) { @@ -940,7 +940,7 @@ void udp_sock_handler(const struct ctx *c, union epoll_ref ref, { struct udp_flow *uflow = udp_at_sidx(ref.flowside); - ASSERT(!c->no_udp && uflow); + assert(!c->no_udp && uflow); if (events & EPOLLERR) { if (udp_sock_errs(c, ref.fd, ref.flowside, PIF_NONE, 0) < 0) { @@ -1023,7 +1023,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, in_port_t src, dst; uint8_t topif; - ASSERT(!c->no_udp); + assert(!c->no_udp); if (!packet_get(p, idx, &data)) return 1; @@ -1061,7 +1061,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, toside = flowside_at_sidx(tosidx); s = uflow->s[tosidx.sidei]; - ASSERT(s >= 0); + assert(s >= 0); pif_sockaddr(c, &to_sa, topif, &toside->eaddr, toside->eport); @@ -1141,7 +1141,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, unsigned rule, { int s; - ASSERT(!c->no_udp); + assert(!c->no_udp); if (!c->ifi4) { if (!addr) @@ -1209,7 +1209,7 @@ static void udp_get_timeout_params(struct ctx *c) */ int udp_init(struct ctx *c) { - ASSERT(!c->no_udp); + assert(!c->no_udp); udp_get_timeout_params(c); diff --git a/udp_flow.c b/udp_flow.c index 00238372..7e2453e7 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -31,7 +31,7 @@ struct udp_flow *udp_at_sidx(flow_sidx_t sidx) if (!flow) return NULL; - ASSERT(flow->f.type == FLOW_UDP); + assert(flow->f.type == FLOW_UDP); return &flow->udp; } @@ -280,7 +280,7 @@ flow_sidx_t udp_flow_from_tap(const struct ctx *c, union flow *flow; flow_sidx_t sidx; - ASSERT(pif == PIF_TAP); + assert(pif == PIF_TAP); sidx = flow_lookup_af(c, IPPROTO_UDP, pif, af, saddr, daddr, srcport, dstport); diff --git a/udp_vu.c b/udp_vu.c index 5effca77..7939290f 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -75,7 +75,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, int iov_cnt, iov_used; size_t hdrlen, l2len; - ASSERT(!c->no_udp); + assert(!c->no_udp); if (!vu_queue_enabled(vq) || !vu_queue_started(vq)) { debug("Got UDP packet, but RX virtqueue not usable yet"); @@ -97,7 +97,7 @@ static int udp_vu_sock_recv(const struct ctx *c, struct vu_virtq *vq, int s, return -1; /* reserve space for the headers */ - ASSERT(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN)); + assert(iov_vu[0].iov_len >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN)); iov_vu[0].iov_base = (char *)iov_vu[0].iov_base + hdrlen; iov_vu[0].iov_len -= hdrlen; diff --git a/util.c b/util.c index a4f2be42..22318c00 100644 --- a/util.c +++ b/util.c @@ -84,7 +84,7 @@ static int sock_l4_(const struct ctx *c, enum epoll_type type, socktype = SOCK_DGRAM | SOCK_NONBLOCK; break; default: - ASSERT(0); + assert(0); } fd = socket(af, socktype, proto); @@ -884,7 +884,7 @@ int read_all_buf(int fd, void *buf, size_t len) while (left) { ssize_t rc; - ASSERT(left <= len); + assert(left <= len); do rc = read(fd, p, left); @@ -924,7 +924,7 @@ int read_remainder(int fd, const struct iovec *iov, size_t cnt, size_t skip) ssize_t rc; if (offset) { - ASSERT(offset < iov[i].iov_len); + assert(offset < iov[i].iov_len); /* Read the remainder of the partially read buffer */ if (read_all_buf(fd, (char *)iov[i].iov_base + offset, iov[i].iov_len - offset) < 0) diff --git a/util.h b/util.h index 4cbb5da3..2fc5cd74 100644 --- a/util.h +++ b/util.h @@ -73,11 +73,20 @@ void abort_with_msg(const char *fmt, ...) * Therefore, avoid using the usual do while wrapper we use to force the macro * to act like a single statement requiring a ';'. */ -#define ASSERT_WITH_MSG(expr, ...) \ +#ifndef NDEBUG +#define assert_with_msg(expr, ...) \ ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) -#define ASSERT(expr) \ - ASSERT_WITH_MSG((expr), "ASSERTION FAILED in %s (%s:%d): %s", \ +/* The standard library assert() hits our seccomp filter and dies before it can + * actually print a message. So, replace it with our own version. + */ +#undef assert +#define assert(expr) \ + assert_with_msg((expr), "ASSERTION FAILED in %s (%s:%d): %s", \ __func__, __FILE__, __LINE__, STRINGIFY(expr)) +#else +#define assert_with_msg(expr, ...) \ + ((void)(expr), 0 ? (void)0 : abort_with_msg(__VA_ARGS__)) +#endif #ifdef P_tmpdir #define TMPDIR P_tmpdir diff --git a/vhost_user.c b/vhost_user.c index 9fe12411..75665ec6 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -216,9 +216,9 @@ static int vu_message_read_default(int conn_fd, struct vhost_user_msg *vmsg) cmsg->cmsg_type == SCM_RIGHTS) { size_t fd_size; - ASSERT(cmsg->cmsg_len >= CMSG_LEN(0)); + assert(cmsg->cmsg_len >= CMSG_LEN(0)); fd_size = cmsg->cmsg_len - CMSG_LEN(0); - ASSERT(fd_size <= sizeof(vmsg->fds)); + assert(fd_size <= sizeof(vmsg->fds)); vmsg->fd_num = fd_size / sizeof(int); memcpy(vmsg->fds, CMSG_DATA(cmsg), fd_size); break; @@ -272,7 +272,7 @@ static void vu_message_write(int conn_fd, struct vhost_user_msg *vmsg) }; int rc; - ASSERT(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); + assert(vmsg->fd_num <= VHOST_MEMORY_BASELINE_NREGIONS); if (vmsg->fd_num > 0) { size_t fdsize = vmsg->fd_num * sizeof(int); struct cmsghdr *cmsg; @@ -483,7 +483,7 @@ static bool vu_set_mem_table_exec(struct vu_dev *vdev, } } - ASSERT(vdev->memory.nregions < VHOST_USER_MAX_RAM_SLOTS); + assert(vdev->memory.nregions < VHOST_USER_MAX_RAM_SLOTS); return false; } diff --git a/virtio.c b/virtio.c index 447137ee..f71dea1d 100644 --- a/virtio.c +++ b/virtio.c @@ -72,6 +72,7 @@ * SUCH DAMAGE. */ +#include #include #include #include @@ -402,8 +403,8 @@ static bool virtqueue_map_desc(const struct vu_dev *dev, { unsigned int num_sg = *p_num_sg; - ASSERT(num_sg < max_num_sg); - ASSERT(sz); + assert(num_sg < max_num_sg); + assert(sz); while (sz) { uint64_t len = sz; diff --git a/vu_common.c b/vu_common.c index 5f2ce18e..75ad43d3 100644 --- a/vu_common.c +++ b/vu_common.c @@ -43,7 +43,7 @@ int vu_packet_check_range(struct vdev_memory *memory, /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ const char *base = (const char *)base_addr; - ASSERT(base_addr >= dev_region[i].mmap_addr); + assert(base_addr >= dev_region[i].mmap_addr); if (len <= dev_region[i].size && base <= ptr && (size_t)(ptr - base) <= dev_region[i].size - len) @@ -167,7 +167,7 @@ static void vu_handle_tx(struct vu_dev *vdev, int index, int out_sg_count; int count; - ASSERT(VHOST_USER_IS_QUEUE_TX(index)); + assert(VHOST_USER_IS_QUEUE_TX(index)); tap_flush_pools(); -- 2.53.0

Add basic command line option parsing using getopt_long() to pesto. Implement --help, --version, --quiet and --verbose options, along with a debug() macro to print debugging messages when given the verbose option. Signed-off-by: David Gibson --- common.h | 8 ++++++ conf.c | 45 +++++++++++++++++---------------- passt.h | 12 ++++----- pesto.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++------ util.h | 8 ------ 5 files changed, 108 insertions(+), 42 deletions(-) diff --git a/common.h b/common.h index 76a95609..927d20a4 100644 --- a/common.h +++ b/common.h @@ -8,6 +8,14 @@ #ifndef COMMON_H #define COMMON_H +#define VERSION_BLOB \ + VERSION "\n" \ + "Copyright Red Hat\n" \ + "GNU General Public License, version 2 or later\n" \ + " https://www.gnu.org/licenses/old-licenses/gpl-2.0.html\n" \ + "This is free software: you are free to change and redistribute it.\n" \ + "There is NO WARRANTY, to the extent permitted by law.\n\n" + /* FPRINTF() intentionally silences cert-err33-c clang-tidy warnings */ #define FPRINTF(f, ...) (void)fprintf(f, __VA_ARGS__) diff --git a/conf.c b/conf.c index 031de352..e862b023 100644 --- a/conf.c +++ b/conf.c @@ -1146,6 +1146,9 @@ static void conf_print(const struct ctx *c) char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; int i; + if (c->fd_control_listen >= 0) + info("Configuration socket: %s", c->control_path); + if (c->ifi4 > 0 || c->ifi6 > 0) { info("Template interface: %s%s%s%s%s", c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", @@ -1433,15 +1436,15 @@ static void conf_open_files(struct ctx *c) die_perror("Couldn't open PID file %s", c->pidfile); } - c->fd_conf = -1; - if (*c->conf_path) { - c->fd_conf_listen = sock_unix(c->conf_path); - if (c->fd_conf_listen < 0) { + c->fd_control = -1; + if (*c->control_path) { + c->fd_control_listen = sock_unix(c->control_path); + if (c->fd_control_listen < 0) { die_perror("Couldn't open control socket %s", - c->conf_path); + c->control_path); } } else { - c->fd_conf_listen = -1; + c->fd_control_listen = -1; } } @@ -1486,13 +1489,13 @@ static void conf_sock_listen(const struct ctx *c) { union epoll_ref ref = { .type = EPOLL_TYPE_CONF_LISTEN }; - if (c->fd_conf_listen < 0) + if (c->fd_control_listen < 0) return; - if (listen(c->fd_conf_listen, 0)) + if (listen(c->fd_control_listen, 0)) die_perror("Couldn't listen on configuration socket"); - ref.fd = c->fd_conf_listen; + ref.fd = c->fd_control_listen; if (epoll_add(c->epollfd, EPOLLIN | EPOLLET, ref)) die_perror("Couldn't add configuration socket to epoll"); } @@ -1847,11 +1850,11 @@ void conf(struct ctx *c, int argc, char **argv) c->fd_tap = -1; break; case 'c': - ret = snprintf(c->conf_path, sizeof(c->conf_path), "%s", - optarg); + ret = snprintf(c->control_path, sizeof(c->control_path), + "%s", optarg); if (ret <= 0 || ret >= (int)sizeof(c->sock_path)) die("Invalid configuration path: %s", optarg); - c->fd_conf_listen = c->fd_conf = -1; + c->fd_control_listen = c->fd_control = -1; break; case 'F': errno = 0; @@ -2295,10 +2298,10 @@ void conf(struct ctx *c, int argc, char **argv) FWD_SCAN); } + conf_sock_listen(c); + if (!c->quiet) conf_print(c); - - conf_sock_listen(c); } /** @@ -2322,7 +2325,7 @@ void conf_listen_handler(struct ctx *c, uint32_t events) return; } - fd = accept4(c->fd_conf_listen, NULL, NULL, SOCK_NONBLOCK); + fd = accept4(c->fd_control_listen, NULL, NULL, SOCK_NONBLOCK); if (fd < 0) { warn_perror("accept4() on configuration listening socket"); return; @@ -2332,7 +2335,7 @@ void conf_listen_handler(struct ctx *c, uint32_t events) warn_perror("Can't get configuration client credentials"); /* Another client is already connected: accept and close right away. */ - if (c->fd_conf != -1) { + if (c->fd_control != -1) { info("Discarding configuration client, PID %i", uc.pid); goto fail; } @@ -2350,7 +2353,7 @@ void conf_listen_handler(struct ctx *c, uint32_t events) goto fail; } - c->fd_conf = fd; + c->fd_control = fd; info("Accepted configuration client, PID %i", uc.pid); if (!PESTO_PROTOCOL_VERSION) { warn( @@ -2375,7 +2378,7 @@ void conf_handler(struct ctx *c, uint32_t events) ssize_t n; do { - n = read(c->fd_conf, discard, sizeof(discard)); + n = read(c->fd_control, discard, sizeof(discard)); if (n > 0) debug("Discarded %zd bytes of config data", n); } while (n > 0); @@ -2398,7 +2401,7 @@ void conf_handler(struct ctx *c, uint32_t events) close: debug("Closing configuration socket"); - epoll_ctl(c->epollfd, EPOLL_CTL_DEL, c->fd_conf, NULL); - close(c->fd_conf); - c->fd_conf = -1; + epoll_ctl(c->epollfd, EPOLL_CTL_DEL, c->fd_control, NULL); + close(c->fd_control); + c->fd_control = -1; } diff --git a/passt.h b/passt.h index 6bb748fb..4245c4c8 100644 --- a/passt.h +++ b/passt.h @@ -158,7 +158,7 @@ struct ip6_ctx { * @foreground: Run in foreground, don't log to stderr by default * @nofile: Maximum number of open files (ulimit -n) * @sock_path: Path for UNIX domain socket - * @conf_path: Path for configuration UNIX domain socket + * @control_path: Path for control/configuration UNIX domain socket * @repair_path: TCP_REPAIR helper path, can be "none", empty for default * @pcap: Path for packet capture file * @pidfile: Path to PID file, empty string if not configured @@ -170,8 +170,8 @@ struct ip6_ctx { * @epollfd: File descriptor for epoll instance * @fd_tap_listen: File descriptor for listening AF_UNIX socket, if any * @fd_tap: AF_UNIX socket, tuntap device, or pre-opened socket - * @fd_conf_listen: Listening configuration socket, if any - * @fd_conf: Configuration socket, if any + * @fd_control_listen: Listening control/configuration socket, if any + * @fd_control: Control/configuration socket, if any * @fd_repair_listen: File descriptor for listening TCP_REPAIR socket, if any * @fd_repair: Connected AF_UNIX socket for TCP_REPAIR helper * @our_tap_mac: Pasta/passt's MAC on the tap link @@ -227,7 +227,7 @@ struct ctx { int foreground; int nofile; char sock_path[UNIX_PATH_MAX]; - char conf_path[UNIX_PATH_MAX]; + char control_path[UNIX_PATH_MAX]; char repair_path[UNIX_PATH_MAX]; char pcap[PATH_MAX]; @@ -245,8 +245,8 @@ struct ctx { int epollfd; int fd_tap_listen; int fd_tap; - int fd_conf_listen; - int fd_conf; + int fd_control_listen; + int fd_control; int fd_repair_listen; int fd_repair; unsigned char our_tap_mac[ETH_ALEN]; diff --git a/pesto.c b/pesto.c index edc07e77..a8c134f5 100644 --- a/pesto.c +++ b/pesto.c @@ -15,6 +15,7 @@ #include #include #include +#include #include #include #include @@ -42,6 +43,32 @@ exit(EXIT_FAILURE); \ } while (0) +#define debug(...) \ + do { \ + if (verbosity > 1) { \ + FPRINTF(stderr, __VA_ARGS__); \ + FPRINTF(stderr, "\n"); \ + } \ + } while (0) + +/** + * usage() - Print usage, exit with given status code + * @name: Executable name + * @f: Stream to print usage info to + * @status: Status code for exit(2) + */ +static void usage(const char *name, FILE *f, int status) +{ + FPRINTF(f, "Usage: %s [OPTION]... PATH\n", name); + FPRINTF(f, + "\n" + " -v, --verbose Be more verbose\n" + " -q, --quiet Be less verbose\n" + " -h, --help Display this help message and exit\n" + " --version Show version and exit\n"); + exit(status); +} + /** * main() - Entry point and whole program with loop * @argc: Argument count @@ -56,13 +83,20 @@ */ int main(int argc, char **argv) { + const struct option options[] = { + {"quiet", no_argument, NULL, 'q' }, + {"verbose", no_argument, NULL, 'v' }, + {"help", no_argument, NULL, 'h' }, + {"version", no_argument, NULL, 1 }, + { 0 }, + }; struct sockaddr_un a = { AF_UNIX, "" }; + const char *optstring = "vh"; struct pesto_hello hello; struct sock_fprog prog; + int optname, ret, s; uint32_t s_version; - int ret, s; - - prctl(PR_SET_DUMPABLE, 0); + int verbosity = 1; prog.len = (unsigned short)sizeof(filter_pesto) / sizeof(filter_pesto[0]); @@ -71,15 +105,40 @@ int main(int argc, char **argv) prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) die("Failed to apply seccomp filter"); - if (argc < 2) - die("Usage: %s CONTROLPATH", argv[0]); + do { + optname = getopt_long(argc, argv, optstring, options, NULL); + + switch (optname) { + case -1: + case 0: + break; + case 'h': + usage(argv[0], stdout, EXIT_SUCCESS); + break; + case 'q': + verbosity--; + break; + case 'v': + verbosity++; + break; + case 1: + FPRINTF(stdout, "pesto "); + FPRINTF(stdout, VERSION_BLOB); + exit(EXIT_SUCCESS); + default: + usage(argv[0], stderr, EXIT_FAILURE); + } + } while (optname != -1); + + if (argc - optind != 1) + usage(argv[0], stderr, EXIT_FAILURE); if ((s = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) die("Failed to create AF_UNIX socket: %s", strerror(errno)); - ret = snprintf(a.sun_path, sizeof(a.sun_path), "%s", argv[1]); + ret = snprintf(a.sun_path, sizeof(a.sun_path), "%s", argv[optind]); if (ret <= 0 || ret >= (int)sizeof(a.sun_path)) - die("Invalid socket path \"%s\"", argv[1]); + die("Invalid socket path \"%s\"", argv[optind]); ret = connect(s, (struct sockaddr *)&a, sizeof(a)); if (ret < 0) { @@ -87,6 +146,8 @@ int main(int argc, char **argv) a.sun_path, strerror(errno)); } + debug("Connected to passt/pasta control socket"); + ret = seread_var(s, &hello); if (ret < 0) die("Couldn't read server greeting: %s", strerror(errno)); @@ -96,6 +157,8 @@ int main(int argc, char **argv) s_version = ntohl(hello.version); + debug("Server protocol version: %"PRIu32, s_version); + if (s_version > PESTO_PROTOCOL_VERSION) { die("Unknown server protocol version %"PRIu32" > %"PRIu32"\n", s_version, PESTO_PROTOCOL_VERSION); diff --git a/util.h b/util.h index e7993f4d..d7c397f6 100644 --- a/util.h +++ b/util.h @@ -21,14 +21,6 @@ #include "log.h" -#define VERSION_BLOB \ - VERSION "\n" \ - "Copyright Red Hat\n" \ - "GNU General Public License, version 2 or later\n" \ - " https://www.gnu.org/licenses/old-licenses/gpl-2.0.html\n" \ - "This is free software: you are free to change and redistribute it.\n" \ - "There is NO WARRANTY, to the extent permitted by law.\n\n" - #ifndef SECCOMP_RET_KILL_PROCESS #define SECCOMP_RET_KILL_PROCESS SECCOMP_RET_KILL #endif -- 2.53.0

Currently we store the inbound (PIF_HOST) and outbound (PIF_SPLICE) forwarding tables in separate fields of struct ctx. In a number of places this requires somewhat awkward if or switch constructs to select the right table for updates. Conceptually simplify that by using an index of forwarding tables by pif, which as a bonus keeps track generically which pifs have implemented forwarding tables so far. For now this doesn't simplify a lot textually, because many places that need this also have other special cases to apply by pif. It does simplify a few crucial places though, and we expect it will become more useful as the flexibility of the forwarding table is improved. Signed-off-by: David Gibson --- conf.c | 53 +++++++++++++++++++++++++++------------------- flow.c | 22 +++++++------------ fwd.c | 65 ++++++++++++++++++++++++++++++--------------------------- fwd.h | 4 ++-- passt.h | 3 +-- 5 files changed, 77 insertions(+), 70 deletions(-) diff --git a/conf.c b/conf.c index 940fb9e9..6af3c8a5 100644 --- a/conf.c +++ b/conf.c @@ -1252,11 +1252,12 @@ dns6: } } - info("Inbound forwarding:"); - fwd_rules_print(&c->fwd_in); - if (c->mode == MODE_PASTA) { - info("Outbound forwarding:"); - fwd_rules_print(&c->fwd_out); + for (i = 0; i < PIF_NUM_TYPES; i++) { + if (!c->fwd[i]) + continue; + + info("Forwarding from %s:", pif_name(i)); + fwd_rules_print(c->fwd[i]); } } @@ -2154,18 +2155,24 @@ void conf(struct ctx *c, int argc, char **argv) /* Forwarding options can be parsed now, after IPv4/IPv6 settings */ fwd_probe_ephemeral(); + fwd_rule_init(c); optind = 0; do { name = getopt_long(argc, argv, optstring, options, NULL); - if (name == 't') - conf_ports(c, name, optarg, &c->fwd_in, &tcp_in_mode); - else if (name == 'u') - conf_ports(c, name, optarg, &c->fwd_in, &udp_in_mode); - else if (name == 'T') - conf_ports(c, name, optarg, &c->fwd_out, &tcp_out_mode); - else if (name == 'U') - conf_ports(c, name, optarg, &c->fwd_out, &udp_out_mode); + if (name == 't') { + conf_ports(c, name, optarg, c->fwd[PIF_HOST], + &tcp_in_mode); + } else if (name == 'u') { + conf_ports(c, name, optarg, c->fwd[PIF_HOST], + &udp_in_mode); + } else if (name == 'T') { + conf_ports(c, name, optarg, c->fwd[PIF_SPLICE], + &tcp_out_mode); + } else if (name == 'U') { + conf_ports(c, name, optarg, c->fwd[PIF_SPLICE], + &udp_out_mode); + } } while (name != -1); if (c->mode == MODE_PASTA) @@ -2224,20 +2231,24 @@ void conf(struct ctx *c, int argc, char **argv) udp_out_mode = fwd_default; if (tcp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 't', "auto", &c->fwd_in, NULL, NULL, - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 't', "auto", c->fwd[PIF_HOST], + NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (tcp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'T', "auto", &c->fwd_out, NULL, "lo", - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'T', "auto", c->fwd[PIF_SPLICE], + NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (udp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'u', "auto", &c->fwd_in, NULL, NULL, - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'u', "auto", c->fwd[PIF_HOST], + NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (udp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'U', "auto", &c->fwd_out, NULL, "lo", - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'U', "auto", c->fwd[PIF_SPLICE], + NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (!c->quiet) diff --git a/flow.c b/flow.c index 81333dbc..11cd5752 100644 --- a/flow.c +++ b/flow.c @@ -503,10 +503,10 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, { char estr[INANY_ADDRSTRLEN], ostr[INANY_ADDRSTRLEN]; struct flow_common *f = &flow->f; + const struct fwd_table *fwd = c->fwd[f->pif[INISIDE]]; const struct flowside *ini = &f->side[INISIDE]; struct flowside *tgt = &f->side[TGTSIDE]; const struct fwd_rule *rule = NULL; - const struct fwd_table *fwd; uint8_t tgtpif = PIF_NONE; assert(flow_new_entry == flow && f->state == FLOW_STATE_INI); @@ -514,6 +514,11 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, assert(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); assert(flow->f.state == FLOW_STATE_INI); + if (fwd) { + if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) + goto norule; + } + switch (f->pif[INISIDE]) { case PIF_TAP: memcpy(f->tap_omac, MAC_UNDEF, ETH_ALEN); @@ -521,20 +526,10 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, break; case PIF_SPLICE: - fwd = &c->fwd_out; - - if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) - goto norule; - tgtpif = fwd_nat_from_splice(rule, proto, ini, tgt); break; case PIF_HOST: - fwd = &c->fwd_in; - - if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) - goto norule; - tgtpif = fwd_nat_from_host(c, rule, proto, ini, tgt); fwd_neigh_mac_get(c, &tgt->oaddr, f->tap_omac); break; @@ -1014,8 +1009,7 @@ static int flow_migrate_source_rollback(struct ctx *c, unsigned bound, int ret) debug("...roll back migration"); - if (fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in) < 0) + if (fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in) < 0) die("Failed to re-establish listening sockets"); foreach_established_tcp_flow(flow) { @@ -1148,7 +1142,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, * fix that is to not allow local to local migration, which arguably we * should (use namespaces for testing instead). */ debug("Stop listen()s"); - fwd_listen_close(&c->fwd_in); + fwd_listen_close(c->fwd[PIF_HOST]); debug("Sending %u flows", count); diff --git a/fwd.c b/fwd.c index 7844a674..3395a28e 100644 --- a/fwd.c +++ b/fwd.c @@ -331,6 +331,21 @@ bool fwd_port_is_ephemeral(in_port_t port) return (port >= fwd_ephemeral_min) && (port <= fwd_ephemeral_max); } +/* Forwarding table storage, generally accessed via pointers in struct ctx */ +static struct fwd_table fwd_in; +static struct fwd_table fwd_out; + +/** + * fwd_rule_init() - Initialise forwarding tables + * @c: Execution context + */ +void fwd_rule_init(struct ctx *c) +{ + c->fwd[PIF_HOST] = &fwd_in; + if (c->mode == MODE_PASTA) + c->fwd[PIF_SPLICE] = &fwd_out; +} + /** * fwd_rule_add() - Add a rule to a forwarding table * @fwd: Table to add to @@ -505,19 +520,17 @@ void fwd_rules_print(const struct fwd_table *fwd) /** fwd_sync_one() - Create or remove listening sockets for a forward entry * @c: Execution context - * @fwd: Forwarding table - * @idx: Rule index * @pif: Interface to create listening sockets for + * @idx: Rule index * @tcp: Bitmap of TCP ports to listen for on FWD_SCAN entries * @udp: Bitmap of UDP ports to listen for on FWD_SCAN entries * * Return: 0 on success, -1 on failure */ -static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, - unsigned idx, uint8_t pif, +static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx, const uint8_t *tcp, const uint8_t *udp) { - const struct fwd_rule *rule = &fwd->rules[idx]; + const struct fwd_rule *rule = &c->fwd[pif]->rules[idx]; const union inany_addr *addr = fwd_rule_addr(rule); const char *ifname = rule->ifname; const uint8_t *map = NULL; @@ -598,7 +611,6 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, /** struct fwd_listen_args - arguments for fwd_listen_init_() * @c: Execution context - * @fwd: Forwarding table * @tcpmap: Bitmap of TCP ports to auto-forward * @udpmap: Bitmap of TCP ports to auto-forward * @pif: Interface to create listening sockets for @@ -606,7 +618,6 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, */ struct fwd_listen_args { const struct ctx *c; - const struct fwd_table *fwd; const uint8_t *tcpmap, *udpmap; uint8_t pif; int ret; @@ -625,9 +636,8 @@ static int fwd_listen_sync_(void *arg) if (a->pif == PIF_SPLICE) ns_enter(a->c); - for (i = 0; i < a->fwd->count; i++) { - a->ret = fwd_sync_one(a->c, a->fwd, i, a->pif, - a->tcpmap, a->udpmap); + for (i = 0; i < a->c->fwd[a->pif]->count; i++) { + a->ret = fwd_sync_one(a->c, a->pif, i, a->tcpmap, a->udpmap); if (a->ret < 0) break; } @@ -637,21 +647,17 @@ static int fwd_listen_sync_(void *arg) /** fwd_listen_sync() - Call fwd_listen_sync_() in correct namespace * @c: Execution context - * @fwd: Forwarding information * @pif: Interface to create listening sockets for * @tcp: Scanning state for TCP * @udp: Scanning state for UDP * * Return: 0 on success, -1 on failure */ -int fwd_listen_sync(const struct ctx *c, const struct fwd_table *fwd, - uint8_t pif, +int fwd_listen_sync(const struct ctx *c, uint8_t pif, const struct fwd_scan *tcp, const struct fwd_scan *udp) { struct fwd_listen_args a = { - .c = c, .fwd = fwd, - .tcpmap = tcp->map, .udpmap = udp->map, - .pif = pif, + .c = c, .tcpmap = tcp->map, .udpmap = udp->map, .pif = pif, }; if (pif == PIF_SPLICE) @@ -695,12 +701,11 @@ void fwd_listen_close(const struct fwd_table *fwd) */ int fwd_listen_init(const struct ctx *c) { - if (fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in) < 0) + if (fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in) < 0) return -1; if (c->mode == MODE_PASTA) { - if (fwd_listen_sync(c, &c->fwd_out, PIF_SPLICE, + if (fwd_listen_sync(c, PIF_SPLICE, &c->tcp.scan_out, &c->udp.scan_out) < 0) return -1; } @@ -851,16 +856,16 @@ static void fwd_scan_ports(struct ctx *c) uint8_t excl_tcp_out[PORT_BITMAP_SIZE], excl_udp_out[PORT_BITMAP_SIZE]; uint8_t excl_tcp_in[PORT_BITMAP_SIZE], excl_udp_in[PORT_BITMAP_SIZE]; - current_listen_map(excl_tcp_out, &c->fwd_in, IPPROTO_TCP); - current_listen_map(excl_tcp_in, &c->fwd_out, IPPROTO_TCP); - current_listen_map(excl_udp_out, &c->fwd_in, IPPROTO_UDP); - current_listen_map(excl_udp_in, &c->fwd_out, IPPROTO_UDP); + current_listen_map(excl_tcp_out, c->fwd[PIF_HOST], IPPROTO_TCP); + current_listen_map(excl_tcp_in, c->fwd[PIF_SPLICE], IPPROTO_TCP); + current_listen_map(excl_udp_out, c->fwd[PIF_HOST], IPPROTO_UDP); + current_listen_map(excl_udp_in, c->fwd[PIF_SPLICE], IPPROTO_UDP); - fwd_scan_ports_tcp(&c->fwd_out, &c->tcp.scan_out, excl_tcp_out); - fwd_scan_ports_tcp(&c->fwd_in, &c->tcp.scan_in, excl_tcp_in); - fwd_scan_ports_udp(&c->fwd_out, &c->udp.scan_out, + fwd_scan_ports_tcp(c->fwd[PIF_SPLICE], &c->tcp.scan_out, excl_tcp_out); + fwd_scan_ports_tcp(c->fwd[PIF_HOST], &c->tcp.scan_in, excl_tcp_in); + fwd_scan_ports_udp(c->fwd[PIF_SPLICE], &c->udp.scan_out, &c->tcp.scan_out, excl_udp_out); - fwd_scan_ports_udp(&c->fwd_in, &c->udp.scan_in, + fwd_scan_ports_udp(c->fwd[PIF_HOST], &c->udp.scan_in, &c->tcp.scan_in, excl_udp_in); } @@ -912,10 +917,8 @@ void fwd_scan_ports_timer(struct ctx *c, const struct timespec *now) fwd_scan_ports(c); - fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in); - fwd_listen_sync(c, &c->fwd_out, PIF_SPLICE, - &c->tcp.scan_out, &c->udp.scan_out); + fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in); + fwd_listen_sync(c, PIF_SPLICE, &c->tcp.scan_out, &c->udp.scan_out); } /** diff --git a/fwd.h b/fwd.h index 958eee25..b387d926 100644 --- a/fwd.h +++ b/fwd.h @@ -108,6 +108,7 @@ struct fwd_scan { #define FWD_PORT_SCAN_INTERVAL 1000 /* ms */ +void fwd_rule_init(struct ctx *c); void fwd_rule_add(struct fwd_table *fwd, uint8_t proto, uint8_t flags, const union inany_addr *addr, const char *ifname, in_port_t first, in_port_t last, in_port_t to); @@ -119,8 +120,7 @@ void fwd_rules_print(const struct fwd_table *fwd); void fwd_scan_ports_init(struct ctx *c); void fwd_scan_ports_timer(struct ctx * c, const struct timespec *now); -int fwd_listen_sync(const struct ctx *c, const struct fwd_table *fwd, - uint8_t pif, +int fwd_listen_sync(const struct ctx *c, uint8_t pif, const struct fwd_scan *tcp, const struct fwd_scan *udp); void fwd_listen_close(const struct fwd_table *fwd); int fwd_listen_init(const struct ctx *c); diff --git a/passt.h b/passt.h index b614bdf0..5fc4e07f 100644 --- a/passt.h +++ b/passt.h @@ -264,8 +264,7 @@ struct ctx { unsigned int pasta_ifi; int pasta_conf_ns; - struct fwd_table fwd_in; - struct fwd_table fwd_out; + struct fwd_table *fwd[PIF_NUM_TYPES]; int no_tcp; struct tcp_ctx tcp; -- 2.53.0

inany contains a number of helpful functions for dealing with addresses which might be IPv4 or IPv6. We're going to want to use that in pesto. For the most part inany doesn't depend on other passt/pasta internals, however it does depend on siphash.h, which pesto doesn't need. Move the single dependent function, inany_siphash_feed() to siphash.h, renaming to match. Use that include inany.[ch] into pesto as well as passt/pasta. While we're there reformat pesto.c's header comment to match the convention used in most other files. Signed-off-by: David Gibson --- Makefile | 6 +++--- common.h | 7 +++++++ flow.c | 4 ++-- fwd.c | 2 +- inany.c | 16 +++++++++++++--- inany.h | 16 ++-------------- iov.c | 1 + siphash.h | 13 +++++++++++++ util.h | 7 ------- virtio.c | 1 + 10 files changed, 43 insertions(+), 30 deletions(-) diff --git a/Makefile b/Makefile index b9f20bb5..92809813 100644 --- a/Makefile +++ b/Makefile @@ -44,14 +44,14 @@ PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c \ udp.c udp_flow.c udp_vu.c util.c vhost_user.c virtio.c vu_common.c QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c -PESTO_SRCS = pesto.c ip.c serialise.c +PESTO_SRCS = pesto.c inany.c ip.c serialise.c SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 -PESTO_HEADERS = common.h ip.h pesto.h serialise.h +PESTO_HEADERS = common.h inany.h ip.h pesto.h serialise.h PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h epoll_ctl.h \ - flow.h fwd.h flow_table.h icmp.h icmp_flow.h inany.h iov.h isolation.h \ + flow.h fwd.h flow_table.h icmp.h icmp_flow.h iov.h isolation.h \ lineread.h log.h migrate.h ndp.h netlink.h packet.h passt.h pasta.h \ pcap.h pif.h repair.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h \ tcp_internal.h tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h \ diff --git a/common.h b/common.h index 7d6ba5c1..7d37b926 100644 --- a/common.h +++ b/common.h @@ -19,6 +19,13 @@ /* FPRINTF() intentionally silences cert-err33-c clang-tidy warnings */ #define FPRINTF(f, ...) (void)fprintf(f, __VA_ARGS__) +#ifndef MIN +#define MIN(x, y) (((x) < (y)) ? (x) : (y)) +#endif +#ifndef MAX +#define MAX(x, y) (((x) > (y)) ? (x) : (y)) +#endif + #define BIT(n) (1UL << (n)) #ifndef __bswap_constant_16 diff --git a/flow.c b/flow.c index 11cd5752..607d0a41 100644 --- a/flow.c +++ b/flow.c @@ -678,8 +678,8 @@ static uint64_t flow_hash(const struct ctx *c, uint8_t proto, uint8_t pif, { struct siphash_state state = SIPHASH_INIT(c->hash_secret); - inany_siphash_feed(&state, &side->oaddr); - inany_siphash_feed(&state, &side->eaddr); + siphash_feed_inany(&state, &side->oaddr); + siphash_feed_inany(&state, &side->eaddr); return siphash_final(&state, 38, (uint64_t)proto << 40 | (uint64_t)pif << 32 | diff --git a/fwd.c b/fwd.c index 3395a28e..192969b7 100644 --- a/fwd.c +++ b/fwd.c @@ -86,7 +86,7 @@ static size_t neigh_table_slot(const struct ctx *c, struct siphash_state st = SIPHASH_INIT(c->hash_secret); uint32_t i; - inany_siphash_feed(&st, key); + siphash_feed_inany(&st, key); i = siphash_final(&st, sizeof(*key), 0); return ((size_t)i) & (NEIGH_TABLE_SIZE - 1); diff --git a/inany.c b/inany.c index 2a586ed1..426d2a64 100644 --- a/inany.c +++ b/inany.c @@ -1,9 +1,19 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later - * Copyright Red Hat - * Author: David Gibson +// SPDX-License-Identifier: GPL-2.0-or-later + +/* PASST - Plug A Simple Socket Transport + * for qemu/UNIX domain socket mode + * + * PASTA - Pack A Subtle Tap Abstraction + * for network namespace/tap device mode + * + * PESTO - Programmable Extensible Socket Translation Orchestrator + * front-end for passt(1) and pasta(1) forwarding configuration * * inany.c - Types and helpers for handling addresses which could be * IPv6 or IPv4 (encoded as IPv4-mapped IPv6 addresses) + * + * Copyright Red Hat + * Author: David Gibson */ #include diff --git a/inany.h b/inany.h index 30e24164..6a1ff3c0 100644 --- a/inany.h +++ b/inany.h @@ -10,12 +10,11 @@ #define INANY_H #include +#include +#include #include #include "ip.h" -#include "siphash.h" - -struct siphash_state; /** union inany_addr - Represents either an IPv4 or IPv6 address * @a6: Address as an IPv6 address, may be IPv4-mapped @@ -299,17 +298,6 @@ static inline int inany_from_sockaddr(union inany_addr *dst, in_port_t *port, return -1; } -/** inany_siphash_feed- Fold IPv[46] address into an in-progress siphash - * @state: siphash state - * @aa: inany to hash - */ -static inline void inany_siphash_feed(struct siphash_state *state, - const union inany_addr *aa) -{ - siphash_feed(state, (uint64_t)aa->u32[0] << 32 | aa->u32[1]); - siphash_feed(state, (uint64_t)aa->u32[2] << 32 | aa->u32[3]); -} - #define INANY_ADDRSTRLEN MAX(INET_ADDRSTRLEN, INET6_ADDRSTRLEN) bool inany_matches(const union inany_addr *a, const union inany_addr *b); diff --git a/iov.c b/iov.c index ae074393..d291ee51 100644 --- a/iov.c +++ b/iov.c @@ -24,6 +24,7 @@ #include #include +#include "common.h" #include "util.h" #include "iov.h" diff --git a/siphash.h b/siphash.h index bbddcac0..313b8947 100644 --- a/siphash.h +++ b/siphash.h @@ -47,6 +47,8 @@ #include #include +#include "inany.h" + /** * struct siphash_state - Internal state of siphash calculation */ @@ -101,6 +103,17 @@ static inline void siphash_feed(struct siphash_state *state, uint64_t in) state->v[0] ^= in; } +/** siphash_feed_inany() - Fold IPv[46] address into an in-progress siphash + * @state: siphash state + * @aa: inany to hash + */ +static inline void siphash_feed_inany(struct siphash_state *state, + const union inany_addr *aa) +{ + siphash_feed(state, (uint64_t)aa->u32[0] << 32 | aa->u32[1]); + siphash_feed(state, (uint64_t)aa->u32[2] << 32 | aa->u32[3]); +} + /** * siphash_final() - Finalize SipHash calculations * @v: siphash state (4 x 64-bit integers) diff --git a/util.h b/util.h index 5357814c..45792f46 100644 --- a/util.h +++ b/util.h @@ -28,13 +28,6 @@ #define IP_MAX_MTU USHRT_MAX #endif -#ifndef MIN -#define MIN(x, y) (((x) < (y)) ? (x) : (y)) -#endif -#ifndef MAX -#define MAX(x, y) (((x) > (y)) ? (x) : (y)) -#endif - #define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) #define DIV_ROUND_CLOSEST(n, d) (((n) + (d) / 2) / (d)) #define ROUND_DOWN(x, y) ((x) & ~((y) - 1)) diff --git a/virtio.c b/virtio.c index f71dea1d..72b78af1 100644 --- a/virtio.c +++ b/virtio.c @@ -80,6 +80,7 @@ #include #include +#include "common.h" #include "util.h" #include "virtio.h" #include "vhost_user.h" -- 2.53.0

Most things in ip.[ch] related purely to IP addresses and headers with no dependency on other passt/pasta internals. A number of these will be useful to re-use in pesto. The exception is ipv6_l4hdr() which uses iov_tail. The only caller of this is in tap.c, so move the function there. Along with moving the constant byteswapping functions to common.h, that lets ip.[ch] to be linked into pesto as well as passt/pasta. Signed-off-by: David Gibson --- Makefile | 15 +++++++-------- common.h | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ ip.c | 56 +++----------------------------------------------------- ip.h | 3 +-- tap.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ util.h | 48 ------------------------------------------------ 6 files changed, 113 insertions(+), 111 deletions(-) diff --git a/Makefile b/Makefile index d085c9c1..b9f20bb5 100644 --- a/Makefile +++ b/Makefile @@ -44,19 +44,18 @@ PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c \ udp.c udp_flow.c udp_vu.c util.c vhost_user.c virtio.c vu_common.c QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c -PESTO_SRCS = pesto.c serialise.c +PESTO_SRCS = pesto.c ip.c serialise.c SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 -PESTO_HEADERS = common.h pesto.h serialise.h +PESTO_HEADERS = common.h ip.h pesto.h serialise.h PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h epoll_ctl.h \ - flow.h fwd.h flow_table.h icmp.h icmp_flow.h inany.h iov.h ip.h \ - isolation.h lineread.h log.h migrate.h ndp.h netlink.h packet.h \ - passt.h pasta.h pcap.h pif.h repair.h siphash.h tap.h tcp.h tcp_buf.h \ - tcp_conn.h tcp_internal.h tcp_splice.h tcp_vu.h udp.h udp_flow.h \ - udp_internal.h udp_vu.h util.h vhost_user.h virtio.h vu_common.h \ - $(PESTO_HEADERS) + flow.h fwd.h flow_table.h icmp.h icmp_flow.h inany.h iov.h isolation.h \ + lineread.h log.h migrate.h ndp.h netlink.h packet.h passt.h pasta.h \ + pcap.h pif.h repair.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h \ + tcp_internal.h tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h \ + udp_vu.h util.h vhost_user.h virtio.h vu_common.h $(PESTO_HEADERS) HEADERS = $(PASST_HEADERS) seccomp.h C := \#include \nint main(){int a=getrandom(0, 0, 0);} diff --git a/common.h b/common.h index 927d20a4..7d6ba5c1 100644 --- a/common.h +++ b/common.h @@ -19,4 +19,54 @@ /* FPRINTF() intentionally silences cert-err33-c clang-tidy warnings */ #define FPRINTF(f, ...) (void)fprintf(f, __VA_ARGS__) +#define BIT(n) (1UL << (n)) + +#ifndef __bswap_constant_16 +#define __bswap_constant_16(x) \ + ((uint16_t) ((((x) >> 8) & 0xff) | (((x) & 0xff) << 8))) +#endif + +#ifndef __bswap_constant_32 +#define __bswap_constant_32(x) \ + ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | \ + (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)) +#endif + +#ifndef __bswap_constant_32 +#define __bswap_constant_32(x) \ + ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | \ + (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)) +#endif + +#ifndef __bswap_constant_64 +#define __bswap_constant_64(x) \ + ((((x) & 0xff00000000000000ULL) >> 56) | \ + (((x) & 0x00ff000000000000ULL) >> 40) | \ + (((x) & 0x0000ff0000000000ULL) >> 24) | \ + (((x) & 0x000000ff00000000ULL) >> 8) | \ + (((x) & 0x00000000ff000000ULL) << 8) | \ + (((x) & 0x0000000000ff0000ULL) << 24) | \ + (((x) & 0x000000000000ff00ULL) << 40) | \ + (((x) & 0x00000000000000ffULL) << 56)) +#endif + +#if __BYTE_ORDER == __BIG_ENDIAN +#define htons_constant(x) (x) +#define htonl_constant(x) (x) +#define htonll_constant(x) (x) +#define ntohs_constant(x) (x) +#define ntohl_constant(x) (x) +#define ntohll_constant(x) (x) +#else +#define htons_constant(x) (__bswap_constant_16(x)) +#define htonl_constant(x) (__bswap_constant_32(x)) +#define htonll_constant(x) (__bswap_constant_64(x)) +#define ntohs_constant(x) (__bswap_constant_16(x)) +#define ntohl_constant(x) (__bswap_constant_32(x)) +#define ntohll_constant(x) (__bswap_constant_64(x)) +#endif + +#define ntohll(x) (be64toh((x))) +#define htonll(x) (htobe64((x))) + #endif /* _COMMON_H */ diff --git a/ip.c b/ip.c index 0ea62998..4e4e0bf5 100644 --- a/ip.c +++ b/ip.c @@ -6,6 +6,9 @@ * PASTA - Pack A Subtle Tap Abstraction * for network namespace/tap device mode * + * PESTO - Programmable Extensible Socket Translation Orchestrator + * front-end for passt(1) and pasta(1) forwarding configuration + * * ip.c - IP related functions * * Copyright (c) 2020-2021 Red Hat GmbH @@ -15,61 +18,8 @@ #include #include -#include "util.h" #include "ip.h" -#define IPV6_NH_OPT(nh) \ - ((nh) == 0 || (nh) == 43 || (nh) == 44 || (nh) == 50 || \ - (nh) == 51 || (nh) == 60 || (nh) == 135 || (nh) == 139 || \ - (nh) == 140 || (nh) == 253 || (nh) == 254) - -/** - * ipv6_l4hdr() - Find pointer to L4 header in IPv6 packet and extract protocol - * @data: IPv6 packet - * @proto: Filled with L4 protocol number - * @dlen: Data length (payload excluding header extensions), set on return - * - * Return: true if the L4 header is found and @data, @proto, @dlen are set, - * false on error. Outputs are indeterminate on failure. - */ -bool ipv6_l4hdr(struct iov_tail *data, uint8_t *proto, size_t *dlen) -{ - struct ipv6_opt_hdr o_storage; - const struct ipv6_opt_hdr *o; - struct ipv6hdr ip6h_storage; - const struct ipv6hdr *ip6h; - int hdrlen; - uint8_t nh; - - ip6h = IOV_REMOVE_HEADER(data, ip6h_storage); - if (!ip6h) - return false; - - nh = ip6h->nexthdr; - if (!IPV6_NH_OPT(nh)) - goto found; - - while ((o = IOV_PEEK_HEADER(data, o_storage))) { - nh = o->nexthdr; - hdrlen = (o->hdrlen + 1) * 8; - - if (IPV6_NH_OPT(nh)) - iov_drop_header(data, hdrlen); - else - goto found; - } - - return false; - -found: - if (nh == IPPROTO_NONE) - return false; - - *dlen = iov_tail_size(data); - *proto = nh; - return true; -} - /** * ipproto_name() - Get IP protocol name from number * @proto: IP protocol number diff --git a/ip.h b/ip.h index d0de6c8d..f6c29e00 100644 --- a/ip.h +++ b/ip.h @@ -9,7 +9,7 @@ #include #include -#include "util.h" +#include "common.h" #define IN4_IS_ADDR_UNSPECIFIED(a) \ (((struct in_addr *)(a))->s_addr == htonl_constant(INADDR_ANY)) @@ -117,7 +117,6 @@ static inline uint32_t ip6_get_flow_lbl(const struct ipv6hdr *ip6h) ip6h->flow_lbl[2]; } -bool ipv6_l4hdr(struct iov_tail *data, uint8_t *proto, size_t *dlen); const char *ipproto_name(uint8_t proto); /* IPv6 link-local all-nodes multicast address, ff02::1 */ diff --git a/tap.c b/tap.c index 1049e023..185ab471 100644 --- a/tap.c +++ b/tap.c @@ -881,6 +881,58 @@ append: return in->count; } +#define IPV6_NH_OPT(nh) \ + ((nh) == 0 || (nh) == 43 || (nh) == 44 || (nh) == 50 || \ + (nh) == 51 || (nh) == 60 || (nh) == 135 || (nh) == 139 || \ + (nh) == 140 || (nh) == 253 || (nh) == 254) + +/** + * ipv6_l4hdr() - Find pointer to L4 header in IPv6 packet and extract protocol + * @data: IPv6 packet + * @proto: Filled with L4 protocol number + * @dlen: Data length (payload excluding header extensions), set on return + * + * Return: true if the L4 header is found and @data, @proto, @dlen are set, + * false on error. Outputs are indeterminate on failure. + */ +static bool ipv6_l4hdr(struct iov_tail *data, uint8_t *proto, size_t *dlen) +{ + struct ipv6_opt_hdr o_storage; + const struct ipv6_opt_hdr *o; + struct ipv6hdr ip6h_storage; + const struct ipv6hdr *ip6h; + int hdrlen; + uint8_t nh; + + ip6h = IOV_REMOVE_HEADER(data, ip6h_storage); + if (!ip6h) + return false; + + nh = ip6h->nexthdr; + if (!IPV6_NH_OPT(nh)) + goto found; + + while ((o = IOV_PEEK_HEADER(data, o_storage))) { + nh = o->nexthdr; + hdrlen = (o->hdrlen + 1) * 8; + + if (IPV6_NH_OPT(nh)) + iov_drop_header(data, hdrlen); + else + goto found; + } + + return false; + +found: + if (nh == IPPROTO_NONE) + return false; + + *dlen = iov_tail_size(data); + *proto = nh; + return true; +} + /** * tap6_handler() - IPv6 packet handler for tap file descriptor * @c: Execution context diff --git a/util.h b/util.h index d7c397f6..5357814c 100644 --- a/util.h +++ b/util.h @@ -106,54 +106,6 @@ void abort_with_msg(const char *fmt, ...) #define MAC_UNDEF MAC_BROADCAST #define MAC_IS_UNDEF(addr) (!memcmp((addr), MAC_UNDEF, ETH_ALEN)) -#ifndef __bswap_constant_16 -#define __bswap_constant_16(x) \ - ((uint16_t) ((((x) >> 8) & 0xff) | (((x) & 0xff) << 8))) -#endif - -#ifndef __bswap_constant_32 -#define __bswap_constant_32(x) \ - ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | \ - (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)) -#endif - -#ifndef __bswap_constant_32 -#define __bswap_constant_32(x) \ - ((((x) & 0xff000000) >> 24) | (((x) & 0x00ff0000) >> 8) | \ - (((x) & 0x0000ff00) << 8) | (((x) & 0x000000ff) << 24)) -#endif - -#ifndef __bswap_constant_64 -#define __bswap_constant_64(x) \ - ((((x) & 0xff00000000000000ULL) >> 56) | \ - (((x) & 0x00ff000000000000ULL) >> 40) | \ - (((x) & 0x0000ff0000000000ULL) >> 24) | \ - (((x) & 0x000000ff00000000ULL) >> 8) | \ - (((x) & 0x00000000ff000000ULL) << 8) | \ - (((x) & 0x0000000000ff0000ULL) << 24) | \ - (((x) & 0x000000000000ff00ULL) << 40) | \ - (((x) & 0x00000000000000ffULL) << 56)) -#endif - -#if __BYTE_ORDER == __BIG_ENDIAN -#define htons_constant(x) (x) -#define htonl_constant(x) (x) -#define htonll_constant(x) (x) -#define ntohs_constant(x) (x) -#define ntohl_constant(x) (x) -#define ntohll_constant(x) (x) -#else -#define htons_constant(x) (__bswap_constant_16(x)) -#define htonl_constant(x) (__bswap_constant_32(x)) -#define htonll_constant(x) (__bswap_constant_64(x)) -#define ntohs_constant(x) (__bswap_constant_16(x)) -#define ntohl_constant(x) (__bswap_constant_32(x)) -#define ntohll_constant(x) (__bswap_constant_64(x)) -#endif - -#define ntohll(x) (be64toh((x))) -#define htonll(x) (htobe64((x))) - extern uint8_t eth_pad[ETH_ZLEN]; /** -- 2.53.0

Move the logic for formatting forwarding rules into strings from fwd_rules_print() into fwd_rule.c where it can be shared with pesto. We also make the function explicitly construct a string, rather than directly printing with info(), for greater flexibility. Signed-off-by: David Gibson --- Makefile | 11 ++++---- fwd.c | 40 +++--------------------------- fwd_rule.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ fwd_rule.h | 11 ++++++++ 4 files changed, 94 insertions(+), 41 deletions(-) create mode 100644 fwd_rule.c diff --git a/Makefile b/Makefile index bc325482..44c396e7 100644 --- a/Makefile +++ b/Makefile @@ -38,13 +38,14 @@ FLAGS += -DVERSION=\"$(VERSION)\" FLAGS += -DDUAL_STACK_SOCKETS=$(DUAL_STACK_SOCKETS) PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c \ - flow.c fwd.c icmp.c igmp.c inany.c iov.c ip.c isolation.c lineread.c \ - log.c mld.c ndp.c netlink.c migrate.c packet.c passt.c pasta.c pcap.c \ - pif.c repair.c serialise.c tap.c tcp.c tcp_buf.c tcp_splice.c tcp_vu.c \ - udp.c udp_flow.c udp_vu.c util.c vhost_user.c virtio.c vu_common.c + flow.c fwd.c fwd_rule.c icmp.c igmp.c inany.c iov.c ip.c isolation.c \ + lineread.c log.c mld.c ndp.c netlink.c migrate.c packet.c passt.c \ + pasta.c pcap.c pif.c repair.c serialise.c tap.c tcp.c tcp_buf.c \ + tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c vhost_user.c \ + virtio.c vu_common.c QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c -PESTO_SRCS = pesto.c inany.c ip.c serialise.c +PESTO_SRCS = pesto.c fwd_rule.c inany.c ip.c serialise.c SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 diff --git a/fwd.c b/fwd.c index f157eeb6..72028e70 100644 --- a/fwd.c +++ b/fwd.c @@ -304,20 +304,6 @@ parse_err: warn("Unable to parse %s", PORT_RANGE_SYSCTL); } -/** - * fwd_rule_addr() - Return match address for a rule - * @rule: Forwarding rule - * - * Return: matching address for rule, NULL if it matches all addresses - */ -static const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule) -{ - if (rule->flags & FWD_DUAL_STACK_ANY) - return NULL; - - return &rule->addr; -} - /** * fwd_port_is_ephemeral() - Is port number ephemeral? * @port: Port number @@ -495,28 +481,10 @@ void fwd_rules_print(const struct fwd_table *fwd) unsigned i; for (i = 0; i < fwd->count; i++) { - const struct fwd_rule *rule = &fwd->rules[i].rule; - const char *percent = *rule->ifname ? "%" : ""; - const char *weak = "", *scan = ""; - char addr[INANY_ADDRSTRLEN]; - - inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr)); - if (rule->flags & FWD_WEAK) - weak = " (best effort)"; - if (rule->flags & FWD_SCAN) - scan = " (auto-scan)"; - - if (rule->first == rule->last) { - info(" %s [%s]%s%s:%hu => %hu %s%s", - ipproto_name(rule->proto), addr, percent, - rule->ifname, rule->first, rule->to, weak, scan); - } else { - info(" %s [%s]%s%s:%hu-%hu => %hu-%hu %s%s", - ipproto_name(rule->proto), addr, percent, - rule->ifname, rule->first, rule->last, - rule->to, rule->last - rule->first + rule->to, - weak, scan); - } + char rulestr[FWD_RULE_STRLEN]; + + info(" %s", fwd_rule_ntop(&fwd->rules[i].rule, + rulestr, sizeof(rulestr))); } } diff --git a/fwd_rule.c b/fwd_rule.c new file mode 100644 index 00000000..dfbdf683 --- /dev/null +++ b/fwd_rule.c @@ -0,0 +1,73 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +/* PASST - Plug A Simple Socket Transport + * for qemu/UNIX domain socket mode + * + * PASTA - Pack A Subtle Tap Abstraction + * for network namespace/tap device mode + * + * PESTO - Programmable Extensible Socket Translation Orchestrator + * front-end for passt(1) and pasta(1) forwarding configuration + * + * fwd_rule.c - Helpers for working with forwarding rule specifications + * + * Copyright Red Hat + * Author: David Gibson + */ + +#include + +#include "fwd_rule.h" + +/** + * fwd_rule_addr() - Return match address for a rule + * @rule: Forwarding rule + * + * Return: matching address for rule, NULL if it matches all addresses + */ +const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule) +{ + if (rule->flags & FWD_DUAL_STACK_ANY) + return NULL; + + return &rule->addr; +} + +/** + * fwd_rule_ntop() - Format forwarding rule as a string + * @rule: Rule to format + * @dst: Buffer to store output (should have FWD_RULE_STRLEN bytes) + * @size: Size of @dst + */ +const char *fwd_rule_ntop(const struct fwd_rule *rule, char *dst, size_t size) +{ + const char *percent = *rule->ifname ? "%" : ""; + const char *weak = "", *scan = ""; + char addr[INANY_ADDRSTRLEN]; + int len; + + inany_ntop(fwd_rule_addr(rule), addr, sizeof(addr)); + if (rule->flags & FWD_WEAK) + weak = " (best effort)"; + if (rule->flags & FWD_SCAN) + scan = " (auto-scan)"; + + if (rule->first == rule->last) { + len = snprintf(dst, size, + "%s [%s]%s%s:%hu => %hu %s%s", + ipproto_name(rule->proto), addr, percent, + rule->ifname, rule->first, rule->to, weak, scan); + } else { + in_port_t tolast = rule->last - rule->first + rule->to; + len = snprintf(dst, size, + "%s [%s]%s%s:%hu-%hu => %hu-%hu %s%s", + ipproto_name(rule->proto), addr, percent, + rule->ifname, rule->first, rule->last, + rule->to, tolast, weak, scan); + } + + if (len < 0 || (size_t)len >= size) + return NULL; + + return dst; +} diff --git a/fwd_rule.h b/fwd_rule.h index 84ec5cbe..59db0e95 100644 --- a/fwd_rule.h +++ b/fwd_rule.h @@ -42,4 +42,15 @@ struct fwd_rule { uint8_t flags; }; +const union inany_addr *fwd_rule_addr(const struct fwd_rule *rule); + +#define FWD_RULE_STRLEN \ + (IPPROTO_STRLEN - 1 \ + + INANY_ADDRSTRLEN - 1 \ + + IFNAMSIZ - 1 \ + + sizeof(" (best effort)") - 1 \ + + sizeof(" (auto-scan)") - 1 \ + + 15) +const char *fwd_rule_ntop(const struct fwd_rule *rule, char *dst, size_t size); + #endif /* FWD_RULE_H */ -- 2.53.0

On Thu, 19 Mar 2026 17:11:48 +1100 David Gibson wrote:

Currently we store the inbound (PIF_HOST) and outbound (PIF_SPLICE) forwarding tables in separate fields of struct ctx. In a number of places this requires somewhat awkward if or switch constructs to select the right table for updates. Conceptually simplify that by using an index of forwarding tables by pif, which as a bonus keeps track generically which pifs have implemented forwarding tables so far.

For now this doesn't simplify a lot textually, because many places that need this also have other special cases to apply by pif. It does simplify a few crucial places though, and we expect it will become more useful as the flexibility of the forwarding table is improved.

Signed-off-by: David Gibson --- conf.c | 53 +++++++++++++++++++++++++++------------------- flow.c | 22 +++++++------------ fwd.c | 65 ++++++++++++++++++++++++++++++--------------------------- fwd.h | 4 ++-- passt.h | 3 +-- 5 files changed, 77 insertions(+), 70 deletions(-)

diff --git a/conf.c b/conf.c index 940fb9e9..6af3c8a5 100644 --- a/conf.c +++ b/conf.c @@ -1252,11 +1252,12 @@ dns6: } }

- info("Inbound forwarding:"); - fwd_rules_print(&c->fwd_in); - if (c->mode == MODE_PASTA) { - info("Outbound forwarding:"); - fwd_rules_print(&c->fwd_out); + for (i = 0; i < PIF_NUM_TYPES; i++) { + if (!c->fwd[i]) + continue; + + info("Forwarding from %s:", pif_name(i));

I don't have a good solution to propose but it's slightly annoying that we're changing very clear "Inbound forwarding" and "Outbound forwarding" indications to "Forwarding from: " HOST | TAP | SPLICE. Should we perhaps introduce a PIF_INBOUND_MAX value that's the same as HOST, and then: if (i <= PIF_INBOUND_MAX) info("Inbound forwarding:"); else info("Outbound forwarding:"); ? I'm fine keeping it as it is, I would just have a slight preference to make it as clear as it was before. This is something users can now look at to double check things and I have the feeling we're avoid a bunch of bug reports as a result.

+ fwd_rules_print(c->fwd[i]); } }

@@ -2154,18 +2155,24 @@ void conf(struct ctx *c, int argc, char **argv)

/* Forwarding options can be parsed now, after IPv4/IPv6 settings */ fwd_probe_ephemeral(); + fwd_rule_init(c); optind = 0; do { name = getopt_long(argc, argv, optstring, options, NULL);

- if (name == 't') - conf_ports(c, name, optarg, &c->fwd_in, &tcp_in_mode); - else if (name == 'u') - conf_ports(c, name, optarg, &c->fwd_in, &udp_in_mode); - else if (name == 'T') - conf_ports(c, name, optarg, &c->fwd_out, &tcp_out_mode); - else if (name == 'U') - conf_ports(c, name, optarg, &c->fwd_out, &udp_out_mode); + if (name == 't') { + conf_ports(c, name, optarg, c->fwd[PIF_HOST], + &tcp_in_mode); + } else if (name == 'u') { + conf_ports(c, name, optarg, c->fwd[PIF_HOST], + &udp_in_mode); + } else if (name == 'T') { + conf_ports(c, name, optarg, c->fwd[PIF_SPLICE], + &tcp_out_mode); + } else if (name == 'U') { + conf_ports(c, name, optarg, c->fwd[PIF_SPLICE], + &udp_out_mode); + } } while (name != -1);

if (c->mode == MODE_PASTA) @@ -2224,20 +2231,24 @@ void conf(struct ctx *c, int argc, char **argv) udp_out_mode = fwd_default;

if (tcp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 't', "auto", &c->fwd_in, NULL, NULL, - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 't', "auto", c->fwd[PIF_HOST], + NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (tcp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'T', "auto", &c->fwd_out, NULL, "lo", - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'T', "auto", c->fwd[PIF_SPLICE], + NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (udp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'u', "auto", &c->fwd_in, NULL, NULL, - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'u', "auto", c->fwd[PIF_HOST], + NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); } if (udp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'U', "auto", &c->fwd_out, NULL, "lo", - 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + conf_ports_range_except(c, 'U', "auto", c->fwd[PIF_SPLICE], + NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, + FWD_SCAN); }

if (!c->quiet) diff --git a/flow.c b/flow.c index 81333dbc..11cd5752 100644 --- a/flow.c +++ b/flow.c @@ -503,10 +503,10 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, { char estr[INANY_ADDRSTRLEN], ostr[INANY_ADDRSTRLEN]; struct flow_common *f = &flow->f; + const struct fwd_table *fwd = c->fwd[f->pif[INISIDE]]; const struct flowside *ini = &f->side[INISIDE]; struct flowside *tgt = &f->side[TGTSIDE]; const struct fwd_rule *rule = NULL; - const struct fwd_table *fwd; uint8_t tgtpif = PIF_NONE;

assert(flow_new_entry == flow && f->state == FLOW_STATE_INI); @@ -514,6 +514,11 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, assert(f->pif[INISIDE] != PIF_NONE && f->pif[TGTSIDE] == PIF_NONE); assert(flow->f.state == FLOW_STATE_INI);

+ if (fwd) { + if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) + goto norule; + } + switch (f->pif[INISIDE]) { case PIF_TAP: memcpy(f->tap_omac, MAC_UNDEF, ETH_ALEN); @@ -521,20 +526,10 @@ struct flowside *flow_target(const struct ctx *c, union flow *flow, break;

case PIF_SPLICE: - fwd = &c->fwd_out; - - if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) - goto norule; - tgtpif = fwd_nat_from_splice(rule, proto, ini, tgt); break;

case PIF_HOST: - fwd = &c->fwd_in; - - if (!(rule = fwd_rule_search(fwd, ini, proto, rule_hint))) - goto norule; - tgtpif = fwd_nat_from_host(c, rule, proto, ini, tgt); fwd_neigh_mac_get(c, &tgt->oaddr, f->tap_omac); break; @@ -1014,8 +1009,7 @@ static int flow_migrate_source_rollback(struct ctx *c, unsigned bound, int ret)

debug("...roll back migration");

- if (fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in) < 0) + if (fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in) < 0) die("Failed to re-establish listening sockets");

foreach_established_tcp_flow(flow) { @@ -1148,7 +1142,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage, * fix that is to not allow local to local migration, which arguably we * should (use namespaces for testing instead). */ debug("Stop listen()s"); - fwd_listen_close(&c->fwd_in); + fwd_listen_close(c->fwd[PIF_HOST]);

debug("Sending %u flows", count);

diff --git a/fwd.c b/fwd.c index 7844a674..3395a28e 100644 --- a/fwd.c +++ b/fwd.c @@ -331,6 +331,21 @@ bool fwd_port_is_ephemeral(in_port_t port) return (port >= fwd_ephemeral_min) && (port <= fwd_ephemeral_max); }

+/* Forwarding table storage, generally accessed via pointers in struct ctx */ +static struct fwd_table fwd_in; +static struct fwd_table fwd_out; + +/** + * fwd_rule_init() - Initialise forwarding tables + * @c: Execution context + */ +void fwd_rule_init(struct ctx *c) +{ + c->fwd[PIF_HOST] = &fwd_in; + if (c->mode == MODE_PASTA) + c->fwd[PIF_SPLICE] = &fwd_out; +} + /** * fwd_rule_add() - Add a rule to a forwarding table * @fwd: Table to add to @@ -505,19 +520,17 @@ void fwd_rules_print(const struct fwd_table *fwd)

/** fwd_sync_one() - Create or remove listening sockets for a forward entry * @c: Execution context - * @fwd: Forwarding table - * @idx: Rule index * @pif: Interface to create listening sockets for + * @idx: Rule index * @tcp: Bitmap of TCP ports to listen for on FWD_SCAN entries * @udp: Bitmap of UDP ports to listen for on FWD_SCAN entries * * Return: 0 on success, -1 on failure */ -static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, - unsigned idx, uint8_t pif, +static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx, const uint8_t *tcp, const uint8_t *udp) { - const struct fwd_rule *rule = &fwd->rules[idx]; + const struct fwd_rule *rule = &c->fwd[pif]->rules[idx]; const union inany_addr *addr = fwd_rule_addr(rule); const char *ifname = rule->ifname; const uint8_t *map = NULL; @@ -598,7 +611,6 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd,

/** struct fwd_listen_args - arguments for fwd_listen_init_() * @c: Execution context - * @fwd: Forwarding table * @tcpmap: Bitmap of TCP ports to auto-forward * @udpmap: Bitmap of TCP ports to auto-forward * @pif: Interface to create listening sockets for @@ -606,7 +618,6 @@ static int fwd_sync_one(const struct ctx *c, const struct fwd_table *fwd, */ struct fwd_listen_args { const struct ctx *c; - const struct fwd_table *fwd; const uint8_t *tcpmap, *udpmap; uint8_t pif; int ret; @@ -625,9 +636,8 @@ static int fwd_listen_sync_(void *arg) if (a->pif == PIF_SPLICE) ns_enter(a->c);

- for (i = 0; i < a->fwd->count; i++) { - a->ret = fwd_sync_one(a->c, a->fwd, i, a->pif, - a->tcpmap, a->udpmap); + for (i = 0; i < a->c->fwd[a->pif]->count; i++) { + a->ret = fwd_sync_one(a->c, a->pif, i, a->tcpmap, a->udpmap); if (a->ret < 0) break; } @@ -637,21 +647,17 @@ static int fwd_listen_sync_(void *arg)

/** fwd_listen_sync() - Call fwd_listen_sync_() in correct namespace * @c: Execution context - * @fwd: Forwarding information * @pif: Interface to create listening sockets for * @tcp: Scanning state for TCP * @udp: Scanning state for UDP * * Return: 0 on success, -1 on failure */ -int fwd_listen_sync(const struct ctx *c, const struct fwd_table *fwd, - uint8_t pif, +int fwd_listen_sync(const struct ctx *c, uint8_t pif, const struct fwd_scan *tcp, const struct fwd_scan *udp) { struct fwd_listen_args a = { - .c = c, .fwd = fwd, - .tcpmap = tcp->map, .udpmap = udp->map, - .pif = pif, + .c = c, .tcpmap = tcp->map, .udpmap = udp->map, .pif = pif, };

if (pif == PIF_SPLICE) @@ -695,12 +701,11 @@ void fwd_listen_close(const struct fwd_table *fwd) */ int fwd_listen_init(const struct ctx *c) { - if (fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in) < 0) + if (fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in) < 0) return -1;

if (c->mode == MODE_PASTA) { - if (fwd_listen_sync(c, &c->fwd_out, PIF_SPLICE, + if (fwd_listen_sync(c, PIF_SPLICE, &c->tcp.scan_out, &c->udp.scan_out) < 0) return -1; } @@ -851,16 +856,16 @@ static void fwd_scan_ports(struct ctx *c) uint8_t excl_tcp_out[PORT_BITMAP_SIZE], excl_udp_out[PORT_BITMAP_SIZE]; uint8_t excl_tcp_in[PORT_BITMAP_SIZE], excl_udp_in[PORT_BITMAP_SIZE];

- current_listen_map(excl_tcp_out, &c->fwd_in, IPPROTO_TCP); - current_listen_map(excl_tcp_in, &c->fwd_out, IPPROTO_TCP); - current_listen_map(excl_udp_out, &c->fwd_in, IPPROTO_UDP); - current_listen_map(excl_udp_in, &c->fwd_out, IPPROTO_UDP); + current_listen_map(excl_tcp_out, c->fwd[PIF_HOST], IPPROTO_TCP); + current_listen_map(excl_tcp_in, c->fwd[PIF_SPLICE], IPPROTO_TCP); + current_listen_map(excl_udp_out, c->fwd[PIF_HOST], IPPROTO_UDP); + current_listen_map(excl_udp_in, c->fwd[PIF_SPLICE], IPPROTO_UDP);

- fwd_scan_ports_tcp(&c->fwd_out, &c->tcp.scan_out, excl_tcp_out); - fwd_scan_ports_tcp(&c->fwd_in, &c->tcp.scan_in, excl_tcp_in); - fwd_scan_ports_udp(&c->fwd_out, &c->udp.scan_out, + fwd_scan_ports_tcp(c->fwd[PIF_SPLICE], &c->tcp.scan_out, excl_tcp_out); + fwd_scan_ports_tcp(c->fwd[PIF_HOST], &c->tcp.scan_in, excl_tcp_in); + fwd_scan_ports_udp(c->fwd[PIF_SPLICE], &c->udp.scan_out, &c->tcp.scan_out, excl_udp_out); - fwd_scan_ports_udp(&c->fwd_in, &c->udp.scan_in, + fwd_scan_ports_udp(c->fwd[PIF_HOST], &c->udp.scan_in, &c->tcp.scan_in, excl_udp_in); }

@@ -912,10 +917,8 @@ void fwd_scan_ports_timer(struct ctx *c, const struct timespec *now)

fwd_scan_ports(c);

- fwd_listen_sync(c, &c->fwd_in, PIF_HOST, - &c->tcp.scan_in, &c->udp.scan_in); - fwd_listen_sync(c, &c->fwd_out, PIF_SPLICE, - &c->tcp.scan_out, &c->udp.scan_out); + fwd_listen_sync(c, PIF_HOST, &c->tcp.scan_in, &c->udp.scan_in); + fwd_listen_sync(c, PIF_SPLICE, &c->tcp.scan_out, &c->udp.scan_out); }

/** diff --git a/fwd.h b/fwd.h index 958eee25..b387d926 100644 --- a/fwd.h +++ b/fwd.h @@ -108,6 +108,7 @@ struct fwd_scan {

#define FWD_PORT_SCAN_INTERVAL 1000 /* ms */

+void fwd_rule_init(struct ctx *c); void fwd_rule_add(struct fwd_table *fwd, uint8_t proto, uint8_t flags, const union inany_addr *addr, const char *ifname, in_port_t first, in_port_t last, in_port_t to); @@ -119,8 +120,7 @@ void fwd_rules_print(const struct fwd_table *fwd); void fwd_scan_ports_init(struct ctx *c); void fwd_scan_ports_timer(struct ctx * c, const struct timespec *now);

-int fwd_listen_sync(const struct ctx *c, const struct fwd_table *fwd, - uint8_t pif, +int fwd_listen_sync(const struct ctx *c, uint8_t pif, const struct fwd_scan *tcp, const struct fwd_scan *udp); void fwd_listen_close(const struct fwd_table *fwd); int fwd_listen_init(const struct ctx *c); diff --git a/passt.h b/passt.h index b614bdf0..5fc4e07f 100644 --- a/passt.h +++ b/passt.h @@ -264,8 +264,7 @@ struct ctx { unsigned int pasta_ifi; int pasta_conf_ns;

- struct fwd_table fwd_in; - struct fwd_table fwd_out; + struct fwd_table *fwd[PIF_NUM_TYPES];

Nit: the struct documentation should be updated accordingly.

int no_tcp; struct tcp_ctx tcp;

-- Stefano

Move conf_ports_range_except(), conf_ports(), and related to helpers to ports.c, so that they can be used from pesto in the future. We'll need to make those independent from passt-specific bits, but this patch just moves them out, first. Signed-off-by: Stefano Brivio --- Makefile | 13 +- conf.c | 363 +-------------------------------------------------- ports.c | 385 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ports.h | 35 +++++ 4 files changed, 428 insertions(+), 368 deletions(-) create mode 100644 ports.c create mode 100644 ports.h diff --git a/Makefile b/Makefile index 44c396e..47d4c95 100644 --- a/Makefile +++ b/Makefile @@ -40,9 +40,9 @@ FLAGS += -DDUAL_STACK_SOCKETS=$(DUAL_STACK_SOCKETS) PASST_SRCS = arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c \ flow.c fwd.c fwd_rule.c icmp.c igmp.c inany.c iov.c ip.c isolation.c \ lineread.c log.c mld.c ndp.c netlink.c migrate.c packet.c passt.c \ - pasta.c pcap.c pif.c repair.c serialise.c tap.c tcp.c tcp_buf.c \ - tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c vhost_user.c \ - virtio.c vu_common.c + pasta.c pcap.c pif.c ports.c repair.c serialise.c tap.c tcp.c \ + tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c \ + vhost_user.c virtio.c vu_common.c QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c PESTO_SRCS = pesto.c fwd_rule.c inany.c ip.c serialise.c @@ -54,9 +54,10 @@ PESTO_HEADERS = common.h fwd_rule.h inany.h ip.h pesto.h serialise.h PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h epoll_ctl.h \ flow.h fwd.h flow_table.h icmp.h icmp_flow.h iov.h isolation.h \ lineread.h log.h migrate.h ndp.h netlink.h packet.h passt.h pasta.h \ - pcap.h pif.h repair.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h \ - tcp_internal.h tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h \ - udp_vu.h util.h vhost_user.h virtio.h vu_common.h $(PESTO_HEADERS) + pcap.h pif.h ports.h repair.h siphash.h tap.h tcp.h tcp_buf.h \ + tcp_conn.h tcp_internal.h tcp_splice.h tcp_vu.h udp.h udp_flow.h \ + udp_internal.h udp_vu.h util.h vhost_user.h virtio.h vu_common.h \ + $(PESTO_HEADERS) HEADERS = $(PASST_HEADERS) seccomp.h C := \#include \nint main(){int a=getrandom(0, 0, 0);} diff --git a/conf.c b/conf.c index b235221..de4c3c6 100644 --- a/conf.c +++ b/conf.c @@ -52,6 +52,7 @@ #include "conf.h" #include "pesto.h" #include "serialise.h" +#include "ports.h" #define NETNS_RUN_DIR "/run/netns" @@ -69,368 +70,6 @@ const char *pasta_default_ifn = "tap0"; -/** - * next_chunk() - Return the next piece of a string delimited by a character - * @s: String to search - * @c: Delimiter character - * - * Return: if another @c is found in @s, returns a pointer to the - * character *after* the delimiter, if no further @c is in @s, - * return NULL - */ -static char *next_chunk(const char *s, char c) -{ - char *sep = strchr(s, c); - return sep ? sep + 1 : NULL; -} - -/** - * port_range() - Represents a non-empty range of ports - * @first: First port number in the range - * @last: Last port number in the range (inclusive) - * - * Invariant: @last >= @first - */ -struct port_range { - in_port_t first, last; -}; - -/** - * parse_port_range() - Parse a range of port numbers '<first>[-<last>]' - * @s: String to parse - * @endptr: Update to the character after the parsed range (similar to - * strtol() etc.) - * @range: Update with the parsed values on success - * - * Return: -EINVAL on parsing error, -ERANGE on out of range port - * numbers, 0 on success - */ -static int parse_port_range(const char *s, char **endptr, - struct port_range *range) -{ - unsigned long first, last; - - last = first = strtoul(s, endptr, 10); - if (*endptr == s) /* Parsed nothing */ - return -EINVAL; - if (**endptr == '-') { /* we have a last value too */ - const char *lasts = *endptr + 1; - last = strtoul(lasts, endptr, 10); - if (*endptr == lasts) /* Parsed nothing */ - return -EINVAL; - } - - if ((last < first) || (last >= NUM_PORTS)) - return -ERANGE; - - range->first = first; - range->last = last; - - return 0; -} - -/** - * conf_ports_range_except() - Set up forwarding for a range of ports minus a - * bitmap of exclusions - * @c: Execution context - * @optname: Short option name, t, T, u, or U - * @optarg: Option argument (port specification) - * @fwd: Forwarding table to be updated - * @addr: Listening address - * @ifname: Listening interface - * @first: First port to forward - * @last: Last port to forward - * @exclude: Bitmap of ports to exclude (may be NULL) - * @to: Port to translate @first to when forwarding - * @flags: Flags for forwarding entries - */ -static void conf_ports_range_except(const struct ctx *c, char optname, - const char *optarg, struct fwd_table *fwd, - const union inany_addr *addr, - const char *ifname, - uint16_t first, uint16_t last, - const uint8_t *exclude, uint16_t to, - uint8_t flags) -{ - unsigned delta = to - first; - unsigned base, i; - uint8_t proto; - - if (first == 0) { - die("Can't forward port 0 for option '-%c %s'", - optname, optarg); - } - - if (optname == 't' || optname == 'T') - proto = IPPROTO_TCP; - else if (optname == 'u' || optname == 'U') - proto = IPPROTO_UDP; - else - assert(0); - - if (addr) { - if (!c->ifi4 && inany_v4(addr)) { - die("IPv4 is disabled, can't use -%c %s", - optname, optarg); - } else if (!c->ifi6 && !inany_v4(addr)) { - die("IPv6 is disabled, can't use -%c %s", - optname, optarg); - } - } - - for (base = first; base <= last; base++) { - if (exclude && bitmap_isset(exclude, base)) - continue; - - for (i = base; i <= last; i++) { - if (exclude && bitmap_isset(exclude, i)) - break; - } - - if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { - /* FIXME: Once the fwd bitmaps are removed, move this - * workaround to the caller - */ - assert(!addr && ifname && !strcmp(ifname, "lo")); - warn( -"SO_BINDTODEVICE unavailable, forwarding only 127.0.0.1 and ::1 for '-%c %s'", - optname, optarg); - - if (c->ifi4) { - fwd_rule_add(fwd, proto, flags, - &inany_loopback4, NULL, - base, i - 1, base + delta); - } - if (c->ifi6) { - fwd_rule_add(fwd, proto, flags, - &inany_loopback6, NULL, - base, i - 1, base + delta); - } - } else { - fwd_rule_add(fwd, proto, flags, addr, ifname, - base, i - 1, base + delta); - } - base = i - 1; - } -} - -/** - * enum fwd_mode - Overall forwarding mode for a direction and protocol - * @FWD_MODE_UNSET Initial value, not parsed/configured yet - * @FWD_MODE_SPEC Forward specified ports - * @FWD_MODE_NONE No forwarded ports - * @FWD_MODE_AUTO Automatic detection and forwarding based on bound ports - * @FWD_MODE_ALL Bind all free ports - */ -enum fwd_mode { - FWD_MODE_UNSET = 0, - FWD_MODE_SPEC, - FWD_MODE_NONE, - FWD_MODE_AUTO, - FWD_MODE_ALL, -}; - -/** - * conf_ports() - Parse port configuration options, initialise UDP/TCP sockets - * @c: Execution context - * @optname: Short option name, t, T, u, or U - * @optarg: Option argument (port specification) - * @fwd: Forwarding table to be updated - * @mode: Overall port forwarding mode (updated) - */ -static void conf_ports(const struct ctx *c, char optname, const char *optarg, - struct fwd_table *fwd, enum fwd_mode *mode) -{ - union inany_addr addr_buf = inany_any6, *addr = &addr_buf; - char buf[BUFSIZ], *spec, *ifname = NULL, *p; - uint8_t exclude[PORT_BITMAP_SIZE] = { 0 }; - bool exclude_only = true; - unsigned i; - - if (!strcmp(optarg, "none")) { - if (*mode) - goto mode_conflict; - - *mode = FWD_MODE_NONE; - return; - } - - if ((optname == 't' || optname == 'T') && c->no_tcp) - die("TCP port forwarding requested but TCP is disabled"); - if ((optname == 'u' || optname == 'U') && c->no_udp) - die("UDP port forwarding requested but UDP is disabled"); - - if (!strcmp(optarg, "auto")) { - if (*mode) - goto mode_conflict; - - if (c->mode != MODE_PASTA) - die("'auto' port forwarding is only allowed for pasta"); - - if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { - warn( -"'-%c auto' enabled without unprivileged SO_BINDTODEVICE", optname); - warn( -"Forwarding from addresses other than 127.0.0.1 will not work"); - } - *mode = FWD_MODE_AUTO; - return; - } - - if (!strcmp(optarg, "all")) { - if (*mode) - goto mode_conflict; - - if (c->mode == MODE_PASTA) - die("'all' port forwarding is only allowed for passt"); - - *mode = FWD_MODE_ALL; - - /* Exclude ephemeral ports */ - for (i = 0; i < NUM_PORTS; i++) - if (fwd_port_is_ephemeral(i)) - bitmap_set(exclude, i); - - conf_ports_range_except(c, optname, optarg, fwd, - NULL, NULL, - 1, NUM_PORTS - 1, exclude, - 1, FWD_WEAK); - return; - } - - if (*mode > FWD_MODE_SPEC) - die("Specific ports cannot be specified together with all/none/auto"); - - *mode = FWD_MODE_SPEC; - - strncpy(buf, optarg, sizeof(buf) - 1); - - if ((spec = strchr(buf, '/'))) { - *spec = 0; - spec++; - - if (optname != 't' && optname != 'u') - goto bad; - - if ((ifname = strchr(buf, '%'))) { - *ifname = 0; - ifname++; - - /* spec is already advanced one past the '/', - * so the length of the given ifname is: - * (spec - ifname - 1) - */ - if (spec - ifname - 1 >= IFNAMSIZ) - goto bad; - - } - - if (ifname == buf + 1) { /* Interface without address */ - addr = NULL; - } else { - p = buf; - - /* Allow square brackets for IPv4 too for convenience */ - if (*p == '[' && p[strlen(p) - 1] == ']') { - p[strlen(p) - 1] = '\0'; - p++; - } - - if (!inany_pton(p, addr)) - goto bad; - } - } else { - spec = buf; - - addr = NULL; - } - - /* Mark all exclusions first, they might be given after base ranges */ - p = spec; - do { - struct port_range xrange; - - if (*p != '~') { - /* Not an exclude range, parse later */ - exclude_only = false; - continue; - } - p++; - - if (parse_port_range(p, &p, &xrange)) - goto bad; - if ((*p != '\0') && (*p != ',')) /* Garbage after the range */ - goto bad; - - for (i = xrange.first; i <= xrange.last; i++) { - if (bitmap_isset(exclude, i)) - die("Overlapping excluded ranges %s", optarg); - - bitmap_set(exclude, i); - } - } while ((p = next_chunk(p, ','))); - - if (ifname && c->no_bindtodevice) { - die( -"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", - optname, optarg); - } - /* Outbound forwards come from guest loopback */ - if ((optname == 'T' || optname == 'U') && !ifname) - ifname = "lo"; - - if (exclude_only) { - /* Exclude ephemeral ports */ - for (i = 0; i < NUM_PORTS; i++) - if (fwd_port_is_ephemeral(i)) - bitmap_set(exclude, i); - - conf_ports_range_except(c, optname, optarg, fwd, - addr, ifname, - 1, NUM_PORTS - 1, exclude, - 1, FWD_WEAK); - return; - } - - /* Now process base ranges, skipping exclusions */ - p = spec; - do { - struct port_range orig_range, mapped_range; - - if (*p == '~') - /* Exclude range, already parsed */ - continue; - - if (parse_port_range(p, &p, &orig_range)) - goto bad; - - if (*p == ':') { /* There's a range to map to as well */ - if (parse_port_range(p + 1, &p, &mapped_range)) - goto bad; - if ((mapped_range.last - mapped_range.first) != - (orig_range.last - orig_range.first)) - goto bad; - } else { - mapped_range = orig_range; - } - - if ((*p != '\0') && (*p != ',')) /* Garbage after the ranges */ - goto bad; - - conf_ports_range_except(c, optname, optarg, fwd, - addr, ifname, - orig_range.first, orig_range.last, - exclude, - mapped_range.first, 0); - } while ((p = next_chunk(p, ','))); - - return; -bad: - die("Invalid port specifier %s", optarg); -mode_conflict: - die("Port forwarding mode '%s' conflicts with previous mode", optarg); -} - /** * add_dns4() - Possibly add the IPv4 address of a DNS resolver to configuration * @c: Execution context diff --git a/ports.c b/ports.c new file mode 100644 index 0000000..5480176 --- /dev/null +++ b/ports.c @@ -0,0 +1,385 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +/* PASST - Plug A Simple Socket Transport + * for qemu/UNIX domain socket mode + * + * PASTA - Pack A Subtle Tap Abstraction + * for network namespace/tap device mode + * + * PESTO - Programmable Extensible Socket Translation Orchestrator + * front-end for passt(1) and pasta(1) forwarding configuration + * + * ports.c - Parse port options + * + * Copyright (c) 2026 Red Hat GmbH + * Author: Stefano Brivio + * Author: David Gibson + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "common.h" +#include "util.h" +#include "ip.h" +#include "passt.h" +#include "common.h" +#include "pesto.h" +#include "ports.h" + +/** + * next_chunk() - Return the next piece of a string delimited by a character + * @s: String to search + * @c: Delimiter character + * + * Return: if another @c is found in @s, returns a pointer to the + * character *after* the delimiter, if no further @c is in @s, + * return NULL + */ +static char *next_chunk(const char *s, char c) +{ + char *sep = strchr(s, c); + return sep ? sep + 1 : NULL; +} + +/** + * port_range() - Represents a non-empty range of ports + * @first: First port number in the range + * @last: Last port number in the range (inclusive) + * + * Invariant: @last >= @first + */ +struct port_range { + in_port_t first, last; +}; + +/** + * parse_port_range() - Parse a range of port numbers '<first>[-<last>]' + * @s: String to parse + * @endptr: Update to the character after the parsed range (similar to + * strtol() etc.) + * @range: Update with the parsed values on success + * + * Return: -EINVAL on parsing error, -ERANGE on out of range port + * numbers, 0 on success + */ +static int parse_port_range(const char *s, char **endptr, + struct port_range *range) +{ + unsigned long first, last; + + last = first = strtoul(s, endptr, 10); + if (*endptr == s) /* Parsed nothing */ + return -EINVAL; + if (**endptr == '-') { /* we have a last value too */ + const char *lasts = *endptr + 1; + last = strtoul(lasts, endptr, 10); + if (*endptr == lasts) /* Parsed nothing */ + return -EINVAL; + } + + if ((last < first) || (last >= NUM_PORTS)) + return -ERANGE; + + range->first = first; + range->last = last; + + return 0; +} + +/** + * conf_ports_range_except() - Set up forwarding for a range of ports minus a + * bitmap of exclusions + * @c: Execution context + * @optname: Short option name, t, T, u, or U + * @optarg: Option argument (port specification) + * @fwd: Forwarding table to be updated + * @addr: Listening address + * @ifname: Listening interface + * @first: First port to forward + * @last: Last port to forward + * @exclude: Bitmap of ports to exclude (may be NULL) + * @to: Port to translate @first to when forwarding + * @flags: Flags for forwarding entries + */ +void conf_ports_range_except(const struct ctx *c, char optname, + const char *optarg, struct fwd_table *fwd, + const union inany_addr *addr, + const char *ifname, uint16_t first, uint16_t last, + const uint8_t *exclude, uint16_t to, uint8_t flags) +{ + unsigned delta = to - first; + unsigned base, i; + uint8_t proto; + + if (first == 0) { + die("Can't forward port 0 for option '-%c %s'", + optname, optarg); + } + + if (optname == 't' || optname == 'T') + proto = IPPROTO_TCP; + else if (optname == 'u' || optname == 'U') + proto = IPPROTO_UDP; + else + assert(0); + + if (addr) { + if (!c->ifi4 && inany_v4(addr)) { + die("IPv4 is disabled, can't use -%c %s", + optname, optarg); + } else if (!c->ifi6 && !inany_v4(addr)) { + die("IPv6 is disabled, can't use -%c %s", + optname, optarg); + } + } + + for (base = first; base <= last; base++) { + if (exclude && bitmap_isset(exclude, base)) + continue; + + for (i = base; i <= last; i++) { + if (exclude && bitmap_isset(exclude, i)) + break; + } + + if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { + /* FIXME: Once the fwd bitmaps are removed, move this + * workaround to the caller + */ + assert(!addr && ifname && !strcmp(ifname, "lo")); + warn( +"SO_BINDTODEVICE unavailable, forwarding only 127.0.0.1 and ::1 for '-%c %s'", + optname, optarg); + + if (c->ifi4) { + fwd_rule_add(fwd, proto, flags, + &inany_loopback4, NULL, + base, i - 1, base + delta); + } + if (c->ifi6) { + fwd_rule_add(fwd, proto, flags, + &inany_loopback6, NULL, + base, i - 1, base + delta); + } + } else { + fwd_rule_add(fwd, proto, flags, addr, ifname, + base, i - 1, base + delta); + } + base = i - 1; + } +} + +/** + * conf_ports() - Parse port configuration options, initialise UDP/TCP sockets + * @c: Execution context + * @optname: Short option name, t, T, u, or U + * @optarg: Option argument (port specification) + * @fwd: Forwarding table to be updated + * @mode: Overall port forwarding mode (updated) + */ +void conf_ports(const struct ctx *c, char optname, const char *optarg, + struct fwd_table *fwd, enum fwd_mode *mode) +{ + union inany_addr addr_buf = inany_any6, *addr = &addr_buf; + char buf[BUFSIZ], *spec, *ifname = NULL, *p; + uint8_t exclude[PORT_BITMAP_SIZE] = { 0 }; + bool exclude_only = true; + unsigned i; + + if (!strcmp(optarg, "none")) { + if (*mode) + goto mode_conflict; + + *mode = FWD_MODE_NONE; + return; + } + + if ((optname == 't' || optname == 'T') && c->no_tcp) + die("TCP port forwarding requested but TCP is disabled"); + if ((optname == 'u' || optname == 'U') && c->no_udp) + die("UDP port forwarding requested but UDP is disabled"); + + if (!strcmp(optarg, "auto")) { + if (*mode) + goto mode_conflict; + + if (c->mode != MODE_PASTA) + die("'auto' port forwarding is only allowed for pasta"); + + if ((optname == 'T' || optname == 'U') && c->no_bindtodevice) { + warn( +"'-%c auto' enabled without unprivileged SO_BINDTODEVICE", optname); + warn( +"Forwarding from addresses other than 127.0.0.1 will not work"); + } + *mode = FWD_MODE_AUTO; + return; + } + + if (!strcmp(optarg, "all")) { + if (*mode) + goto mode_conflict; + + if (c->mode == MODE_PASTA) + die("'all' port forwarding is only allowed for passt"); + + *mode = FWD_MODE_ALL; + + /* Exclude ephemeral ports */ + for (i = 0; i < NUM_PORTS; i++) + if (fwd_port_is_ephemeral(i)) + bitmap_set(exclude, i); + + conf_ports_range_except(c, optname, optarg, fwd, + NULL, NULL, + 1, NUM_PORTS - 1, exclude, + 1, FWD_WEAK); + return; + } + + if (*mode > FWD_MODE_SPEC) + die("Specific ports cannot be specified together with all/none/auto"); + + *mode = FWD_MODE_SPEC; + + strncpy(buf, optarg, sizeof(buf) - 1); + + if ((spec = strchr(buf, '/'))) { + *spec = 0; + spec++; + + if (optname != 't' && optname != 'u') + goto bad; + + if ((ifname = strchr(buf, '%'))) { + *ifname = 0; + ifname++; + + /* spec is already advanced one past the '/', + * so the length of the given ifname is: + * (spec - ifname - 1) + */ + if (spec - ifname - 1 >= IFNAMSIZ) + goto bad; + + } + + if (ifname == buf + 1) { /* Interface without address */ + addr = NULL; + } else { + p = buf; + + /* Allow square brackets for IPv4 too for convenience */ + if (*p == '[' && p[strlen(p) - 1] == ']') { + p[strlen(p) - 1] = '\0'; + p++; + } + + if (!inany_pton(p, addr)) + goto bad; + } + } else { + spec = buf; + + addr = NULL; + } + + /* Mark all exclusions first, they might be given after base ranges */ + p = spec; + do { + struct port_range xrange; + + if (*p != '~') { + /* Not an exclude range, parse later */ + exclude_only = false; + continue; + } + p++; + + if (parse_port_range(p, &p, &xrange)) + goto bad; + if ((*p != '\0') && (*p != ',')) /* Garbage after the range */ + goto bad; + + for (i = xrange.first; i <= xrange.last; i++) { + if (bitmap_isset(exclude, i)) + die("Overlapping excluded ranges %s", optarg); + + bitmap_set(exclude, i); + } + } while ((p = next_chunk(p, ','))); + + if (ifname && c->no_bindtodevice) { + die( +"Device binding for '-%c %s' unsupported (requires kernel 5.7+)", + optname, optarg); + } + /* Outbound forwards come from guest loopback */ + if ((optname == 'T' || optname == 'U') && !ifname) + ifname = "lo"; + + if (exclude_only) { + /* Exclude ephemeral ports */ + for (i = 0; i < NUM_PORTS; i++) + if (fwd_port_is_ephemeral(i)) + bitmap_set(exclude, i); + + conf_ports_range_except(c, optname, optarg, fwd, + addr, ifname, + 1, NUM_PORTS - 1, exclude, + 1, FWD_WEAK); + return; + } + + /* Now process base ranges, skipping exclusions */ + p = spec; + do { + struct port_range orig_range, mapped_range; + + if (*p == '~') + /* Exclude range, already parsed */ + continue; + + if (parse_port_range(p, &p, &orig_range)) + goto bad; + + if (*p == ':') { /* There's a range to map to as well */ + if (parse_port_range(p + 1, &p, &mapped_range)) + goto bad; + if ((mapped_range.last - mapped_range.first) != + (orig_range.last - orig_range.first)) + goto bad; + } else { + mapped_range = orig_range; + } + + if ((*p != '\0') && (*p != ',')) /* Garbage after the ranges */ + goto bad; + + conf_ports_range_except(c, optname, optarg, fwd, + addr, ifname, + orig_range.first, orig_range.last, + exclude, + mapped_range.first, 0); + } while ((p = next_chunk(p, ','))); + + return; +bad: + die("Invalid port specifier %s", optarg); +mode_conflict: + die("Port forwarding mode '%s' conflicts with previous mode", optarg); +} diff --git a/ports.h b/ports.h new file mode 100644 index 0000000..3ef50e6 --- /dev/null +++ b/ports.h @@ -0,0 +1,35 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later + * Copyright (c) 2026 Red Hat GmbH + * Author: Stefano Brivio + */ + +#ifndef PORTS_H +#define PORTS_H + +/** + * enum fwd_mode - Overall forwarding mode for a direction and protocol + * @FWD_MODE_UNSET Initial value, not parsed/configured yet + * @FWD_MODE_SPEC Forward specified ports + * @FWD_MODE_NONE No forwarded ports + * @FWD_MODE_AUTO Automatic detection and forwarding based on bound ports + * @FWD_MODE_ALL Bind all free ports + */ +enum fwd_mode { + FWD_MODE_UNSET = 0, + FWD_MODE_SPEC, + FWD_MODE_NONE, + FWD_MODE_AUTO, + FWD_MODE_ALL, +}; + +void conf_ports_range_except(const struct ctx *c, char optname, + const char *optarg, struct fwd_table *fwd, + const union inany_addr *addr, + const char *ifname, uint16_t first, uint16_t last, + const uint8_t *exclude, uint16_t to, + uint8_t flags); +void conf_ports(const struct ctx *c, char optname, const char *optarg, + struct fwd_table *fwd, enum fwd_mode *mode); + + +#endif /* PORTS_H */ -- 2.43.0

*** DO NOT USE ***: this introduces a security weakness as it allows passt to dynamically allocate memory based on external input (needed by fwd_rule_seread(), which will need either a replacement or a rewrite). This adds parsing of options using conf_ports() in pesto, builds rules, takes them out of the table (!) and sends them one by one to passt, which now receives them and uses them to replace the current forwarding table. This part works. This also adds a convenience implementation that closes all current sockets and tries to synchronise listening sockets from the new set of rules. This partially works, but for some reason sockets don't bind correctly, and I couldn't quite wrap my head around the complexity of the new "fwd_rule_state" and the fact that with this we can't simply dump rules in the tables and re-sync them (this part was very simple and it worked in my earlier draft). I'm sharing this part as well anyway as it might be convenient if it's useful to build a quick hack that makes the whole flow work with Podman, but that's about it. Signed-off-by: Stefano Brivio --- Makefile | 2 +- conf.c | 65 +++++++++++++++++++++++++++++++++++++++-- fwd.c | 8 ++++-- fwd.h | 2 +- pesto.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-- pif.h | 2 ++ util.c | 2 ++ 7 files changed, 160 insertions(+), 9 deletions(-) diff --git a/Makefile b/Makefile index b6b6a82..2423570 100644 --- a/Makefile +++ b/Makefile @@ -51,7 +51,7 @@ SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 PESTO_HEADERS = common.h fwd_rule.h inany.h ip.h pesto.h serialise.h ports.h \ - lineread.h + lineread.h pif.h PASST_HEADERS = arch.h arp.h checksum.h conf.h dhcp.h dhcpv6.h epoll_ctl.h \ flow.h fwd.h flow_table.h icmp.h icmp_flow.h iov.h isolation.h \ lineread.h log.h migrate.h ndp.h netlink.h packet.h passt.h pasta.h \ diff --git a/conf.c b/conf.c index 8e54b85..10fef65 100644 --- a/conf.c +++ b/conf.c @@ -2041,6 +2041,49 @@ static int conf_send_rules(const struct ctx *c, int fd) return 0; } +/** + * conf_send_rules() - Send current forwarding rules to dynamic update client (pesto) + * @c: Execution context + * @fd: Socket to the client + * + * Return: 0 on success, -1 on failure + */ +static int conf_recv_rules(const struct ctx *c, int fd) +{ + unsigned pif, i, j; + + for (i = 0; i < PIF_NUM_TYPES; i++) { + struct fwd_table *fwd; + struct fwd_rule r; + uint32_t count; + uint8_t num; + + if (seread_u8(fd, &num)) + return -1; + + pif = num; + if (pif == PIF_NONE) + return 0; + + fwd = c->fwd[pif]; + if (!fwd) + continue; + + fwd_listen_close(fwd); + + if (seread_u32(fd, &count)) + return -1; + + for (j = 0; j < count; j++) { + fwd_rule_seread(fd, &r); + fwd_rule_add(fwd, r.proto, 0, &r.addr, NULL, + r.first, r.last, r.to); + } + } + + return 0; +} + /** * conf_listen_handler() - Handle events on configuration listening socket * @c: Execution context @@ -2055,14 +2098,14 @@ void conf_listen_handler(struct ctx *c, uint32_t events) union epoll_ref ref = { .type = EPOLL_TYPE_CONF }; struct ucred uc = { 0 }; socklen_t len = sizeof(uc); - int fd, rc; + int fd, rc, i; if (events != EPOLLIN) { err("Unexpected event 0x%04x on configuration socket", events); return; } - fd = accept4(c->fd_control_listen, NULL, NULL, SOCK_NONBLOCK); + fd = accept4(c->fd_control_listen, NULL, NULL, 0); if (fd < 0) { warn_perror("accept4() on configuration listening socket"); return; @@ -2103,6 +2146,24 @@ void conf_listen_handler(struct ctx *c, uint32_t events) if (conf_send_rules(c, fd) < 0) goto fail; + if (conf_recv_rules(c, fd) < 0) + goto fail; + + info("Received new forwarding table:"); + for (i = 0; i < PIF_NUM_TYPES; i++) { + if (!c->fwd[i]) + continue; + + info("Forwarding from %s:", pif_name(i)); + fwd_rules_print(c->fwd[i]); + } + + memset(&c->tcp.scan_in, 0, PORT_BITMAP_SIZE); + memset(&c->tcp.scan_out, 0, PORT_BITMAP_SIZE); + memset(&c->udp.scan_in, 0, PORT_BITMAP_SIZE); + memset(&c->udp.scan_out, 0, PORT_BITMAP_SIZE); + fwd_listen_init(c); + return; fail: diff --git a/fwd.c b/fwd.c index 4592af2..eda382e 100644 --- a/fwd.c +++ b/fwd.c @@ -487,12 +487,12 @@ int fwd_listen_sync(const struct ctx *c, uint8_t pif, /** fwd_listen_close() - Close all listening sockets * @fwd: Forwarding information */ -void fwd_listen_close(const struct fwd_table *fwd) +void fwd_listen_close(struct fwd_table *fwd) { unsigned i; for (i = 0; i < fwd->count; i++) { - const struct fwd_rule_state *rs = &fwd->rules[i]; + struct fwd_rule_state *rs = &fwd->rules[i]; unsigned port; for (port = rs->rule.first; port <= rs->rule.last; port++) { @@ -503,9 +503,11 @@ void fwd_listen_close(const struct fwd_table *fwd) } } } + + fwd->sock_count = 0; } -/** fwd_listen_init() - Set up listening sockets at start up +/** fwd_listen_init() - Set up listening sockets * @c: Execution context * * Return: 0 on success, -1 on failure diff --git a/fwd.h b/fwd.h index 00450a4..d2a0c39 100644 --- a/fwd.h +++ b/fwd.h @@ -51,7 +51,7 @@ void fwd_scan_ports_timer(struct ctx * c, const struct timespec *now); int fwd_listen_sync(const struct ctx *c, uint8_t pif, const struct fwd_scan *tcp, const struct fwd_scan *udp); -void fwd_listen_close(const struct fwd_table *fwd); +void fwd_listen_close(struct fwd_table *fwd); int fwd_listen_init(const struct ctx *c); bool nat_inbound(const struct ctx *c, const union inany_addr *addr, diff --git a/pesto.c b/pesto.c index 42fa7f2..85683fa 100644 --- a/pesto.c +++ b/pesto.c @@ -38,6 +38,7 @@ #include "fwd_rule.h" #include "pesto.h" #include "log.h" +#include "pif.h" int verbosity = 1; @@ -65,6 +66,36 @@ static void usage(const char *name, FILE *f, int status) FPRINTF(f, "Usage: %s [OPTION]... PATH\n", name); FPRINTF(f, "\n" + " -t, --tcp-ports SPEC TCP inbound port forwarding\n" + " can be specified multiple times\n" + " SPEC can be:\n" + " 'none': don't forward any ports\n" + " 'auto': forward all ports currently bound in namespace\n" + " 'all': forward all unbound, non-ephemeral ports\n" + " a comma-separated list, optionally ranged with '-'\n" + " and optional target ports after ':', with optional\n" + " address specification suffixed by '/' and optional\n" + " interface prefixed by '%%'. Examples:\n" + " -t 22 Forward local port 22 to port 22 in netns\n" + " -t 22:23 Forward local port 22 to port 23\n" + " -t 22,25 Forward ports 22, 25 to ports 22, 25\n" + " -t 22-80 Forward ports 22 to 80\n" + " -t 22-80:32-90 Forward ports 22 to 80 to\n" + " corresponding port numbers plus 10\n" + " -t 192.0.2.1/5 Bind port 5 of 192.0.2.1\n" + " -t 5-25,~10-20 Forward ports 5 to 9, and 21 to 25\n" + " -t ~25 Forward all bound ports except for 25\n" + " IPv6 bound ports are also forwarded for IPv4\n" + " -u, --udp-ports SPEC UDP inbound port forwarding\n" + " SPEC is as described for TCP above\n" + " IPv6 bound ports are also forwarded for IPv4\n" + " unless specified, with '-t auto', UDP ports with numbers\n" + " corresponding to forwarded TCP port numbers are\n" + " forwarded too\n" + " -T, --tcp-ns SPEC TCP port forwarding to init namespace\n" + " SPEC is as described above\n" + " -U, --udp-ns SPEC UDP port forwarding to init namespace\n" + " SPEC is as described above\n" " -v, --verbose Be more verbose\n" " -q, --quiet Be less verbose\n" " -h, --help Display this help message and exit\n" @@ -221,7 +252,7 @@ static void show_state(const struct conf_state *state) * * Return: 0 on success, won't return on failure * - * #syscalls:pesto connect write close exit_group fstat brk getrandom + * #syscalls:pesto connect write close exit_group fstat brk getrandom openat * #syscalls:pesto socket s390x:socketcall i686:socketcall * #syscalls:pesto recvfrom recvmsg arm:recv ppc64le:recv * #syscalls:pesto sendto sendmsg arm:send ppc64le:send @@ -233,15 +264,22 @@ int main(int argc, char **argv) {"verbose", no_argument, NULL, 'v' }, {"help", no_argument, NULL, 'h' }, {"version", no_argument, NULL, 1 }, + {"tcp-ports", required_argument, NULL, 't' }, + {"udp-ports", required_argument, NULL, 'u' }, + {"tcp-ns", required_argument, NULL, 'T' }, + {"udp-ns", required_argument, NULL, 'U' }, { 0 }, }; + struct fwd_table fwd_in = { .count = 0 }, fwd_out = { .count = 0 }; struct sockaddr_un a = { AF_UNIX, "" }; - const char *optstring = "vh"; + const char *optstring = "vht:u:T:U:"; + enum fwd_mode fwd_default; struct pesto_hello hello; struct conf_state *state; struct sock_fprog prog; int optname, ret, s; uint32_t s_version; + unsigned i; prog.len = (unsigned short)sizeof(filter_pesto) / sizeof(filter_pesto[0]); @@ -250,6 +288,8 @@ int main(int argc, char **argv) prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) die("Failed to apply seccomp filter"); + fwd_probe_ephemeral(); + do { optname = getopt_long(argc, argv, optstring, options, NULL); @@ -266,6 +306,18 @@ int main(int argc, char **argv) case 'v': verbosity++; break; + case 't': + case 'u': + fwd_default = FWD_MODE_UNSET; + conf_ports(optname, optarg, &fwd_in, &fwd_default, + true, true, true); + break; + case 'T': + case 'U': + fwd_default = FWD_MODE_UNSET; + conf_ports(optname, optarg, &fwd_out, &fwd_default, + true, true, true); + break; case 1: FPRINTF(stdout, "pesto "); FPRINTF(stdout, VERSION_BLOB); @@ -291,6 +343,22 @@ int main(int argc, char **argv) a.sun_path, strerror(errno)); } + debug("Inbound rules from command line:"); + for (i = 0; i < fwd_in.count; i++) { + const struct fwd_rule *rule = &fwd_in.rules[i].rule; + char rulestr[FWD_RULE_STRLEN]; + + debug(" %s", fwd_rule_ntop(rule, rulestr, sizeof(rulestr))); + } + + debug("Outbound rules from command line:"); + for (i = 0; i < fwd_out.count; i++) { + const struct fwd_rule *rule = &fwd_out.rules[i].rule; + char rulestr[FWD_RULE_STRLEN]; + + debug(" %s", fwd_rule_ntop(rule, rulestr, sizeof(rulestr))); + } + debug("Connected to passt/pasta control socket"); ret = seread_var(s, &hello); @@ -324,5 +392,21 @@ int main(int argc, char **argv) show_state(state); + if (fwd_in.count) { + sewrite_u8(s, PIF_HOST); + sewrite_u32(s, fwd_in.count); + for (i = 0; i < fwd_in.count; i++) + fwd_rule_sewrite(s, &fwd_in.rules[i].rule); + } + + if (fwd_out.count) { + sewrite_u8(s, PIF_SPLICE); + sewrite_u32(s, fwd_out.count); + for (i = 0; i < fwd_out.count; i++) + fwd_rule_sewrite(s, &fwd_out.rules[i].rule); + } + + sewrite_u8(s, PIF_NONE); + exit(0); } diff --git a/pif.h b/pif.h index 7bb58e5..c96a090 100644 --- a/pif.h +++ b/pif.h @@ -35,6 +35,7 @@ enum pif_type { PIF_NUM_TYPES, }; +#ifndef PESTO extern const char *pif_type_str[]; static inline const char *pif_type(enum pif_type pt) @@ -66,5 +67,6 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, int pif_listen(const struct ctx *c, enum epoll_type type, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port, unsigned rule); +#endif /* !PESTO */ #endif /* PIF_H */ diff --git a/util.c b/util.c index ff5094e..069c126 100644 --- a/util.c +++ b/util.c @@ -990,6 +990,8 @@ bool snprintf_check(char *str, size_t size, const char *format, ...) * * Assumes that the random data is essential, and will die() if unable to obtain * it. + * + * #syscalls getrandom brk */ void raw_random(void *buf, size_t buflen) { -- 2.43.0