May 2024 - user

passt: new version 2024_05_23.765eb0b available
by Stefano Brivio 23 May '24

23 May '24

The new version with tag 2024_05_23.765eb0b includes the following changes: 765eb0b apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring 0608ec4 conf, passt.h: Rename pid_file in struct ctx to pidfile c9b2413 conf, passt, tap: Open socket and PID files before switching UID/GID ba23b05 passt, util: Move opening of PID file to its own function 57d8aa8 util: Rename write_pidfile() to pidfile_write() cbca08c tap: Split tap_sock_unix_init() into opening and listening parts fcfb592 passt, tap: Don't use -1 as uninitialised value for fd_tap_listen d02bb6c tap: Move all-ones initialisation of mac_guest to tap_sock_init() 45b8632 conf: Don't lecture user about starting us as root 3f917b3 netlink, test: Ignore deprecated addresses cc801fb tcp: Remove interim 'tapside' field from connection 8a2accb flow: Record the pifs for each side of each flow 4357185 flow: Make side 0 always be the initiating side 0060acd flow: Clarify and enforce flow state transitions a631998 inany: Better helpers for using inany and specific family addrs together 7a832a8 flow: Properly type callbacks to protocol specific handlers 1a20370 util, tcp: Add helper to display socket addresses 3ff3a8a apparmor: Fix passt abstraction 6cdc9fd apparmor: allow netns paths on /tmp 80f7ff2 clang-tidy: Suppress macro to enum conversion warnings 29bd08f conf: Fix clang-tidy warning about using an undefined enum value 26c71db passt.c: explicitly include libgen.h for basename 623c2fd netlink: Don't duplicate routes referring to unrelated host interfaces https://passt.top/passt/log/?qt=range&q=2024_05_10.7288448..2024_05_23.765e… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7482357/ permanent mirror: https://passt.top/builds/copr/0^20240523.g765eb0b/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g765eb0b-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_765eb0b-1_all.deb -- Stefano

1 0

passt: new version 2024_05_10.7288448 available
by Stefano Brivio 10 May '24

10 May '24

The new version with tag 2024_05_10.7288448 includes the following changes: 7288448 apparmor: allow read access on /tmp for pasta 7e6a606 tcp_splice: Set OUT_WAIT_ flag whenever pipe isn't emptied 1ba76c9 udp: Single buffer for IPv4, IPv6 headers and metadata d4598e1 udp: Use the same buffer for the L2 header for all frames 6170688 udp: Share payload buffers between IPv4 and IPv6 2d16946 udp: Explicitly set checksum in guest-bound UDP headers 6c4d26a udp: Combine initialisation of IPv4 and IPv6 iovs 3f9bd86 udp: Split tap-bound UDP packets into multiple buffers using io vector fcd9308 test: Allow sftp via vsock-ssh in tests eea5d3e tcp: Update tap specific header too in tcp_fill_headers[46]() 3559899 iov: Helper macro to construct iovs covering existing variables or fields 40f8b29 tap, tcp: (Re-)abstract TAP specific header handling 68d1b0a tcp: Simplify packet length calculation when preparing headers 5566386 treewide: Standardise variable names for various packet lengths 9e22c53 checksum: Make csum_ip4_header() take a host endian length 1095a7b treewide: Remove misleading and redundant endianness notes 5d37dab tap: Remove unused structs tap_msg, tap_l4_msg 34fb381 tap: Split tap specific and L2 (ethernet) headers c27ca91 checksum: Use proto_ipv6_header_psum() for ICMPv6 as well 76e3202 netlink: Fix iterations over nexthop objects https://passt.top/passt/log/?qt=range&q=2024_04_26.d03c4e2..2024_05_10.7288… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7434838/ permanent mirror: https://passt.top/builds/copr/0^20240510.g7288448/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://build.opensuse.org/package/requests/Virtualization:containers/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g7288448-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_7288448-1_all.deb -- Stefano

1 0

Guest namespace can access host ports via secondary interface addresses
by Kangjing Huang 10 May '24

10 May '24

Hi there, I was tweaking around pasta and its usage with podman, and I realized that from pasta guest namespaces it is possible to access host ports through the address of secondary interfaces on the host. Say I have two interfaces on host, with eth0 connecting to a gateway and eth1 connected to another LAN: > $ # On host > $ ifconfig eth0 > eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.1.2 netmask 255.255.255.0 broadcast 192.168.1.255 > ... > $ ifconfig eth1 > eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.110.1 netmask 255.255.255.0 broadcast 192.168.110.255 > ... > $ ip route > default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.2 metric 1024 > 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 metric 1024 > 192.168.1.1 dev eth0 proto dhcp scope link src 192.168.1.2 metric 1024 > 192.168.110.0/24 dev eth1 proto kernel scope link src 192.168.110.1 If there is some service started on host: > $ python -m http.server > Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... From a pasta namespace, it is impossible to access the host ports by the address of the main interface: > $ pasta --config-net > $ # Now in pasta namespace > $ curl 192.168.1.2:8000 > curl: (7) Failed to connect to 192.168.1.2 port 8000 after 0 ms: Couldn't connect to server However I found that it is possible to do so by the address of the secondary interface: > $ # In same pasta environment as above > $ curl 192.168.110.1:8000 > <!DOCTYPE HTML> > <html lang="en"> > ... Is this an expected behavior? I believe this is a security escape in the container context, since containerized services can gain access to unintended resources. Thanks, Chaser Huang -- Kangjing "Chaser" Huang

2 1