- user - passt

passt: new version 2025_02_17.a1e48a0 available
by Stefano Brivio 17 Feb '25

17 Feb '25

The new version with tag 2025_02_17.a1e48a0 includes the following changes: a1e48a0 test: Add migration tests 89ecf2f migrate: Migrate TCP flows 3e903bb repair, passt-repair: Build and warning fixes for musl 01b6a16 tcp_splice: A typo three years ago and SO_RCVLOWAT is gone 667caa0 tcp_splice: Don't wake up on input data if we can't write it anywhere 7c33b12 vhost_user: Clear ring address on GET_VRING_BASE 71249ef tcp, tcp_splice: Don't set SO_SNDBUF and SO_RCVBUF to maximum values 30f1e08 tcp: Keep updating window and checking for socket data after FIN from guest 98d474c contrib/selinux: Enable mapping guest memory for libvirt guests 9a84df4 selinux: Add rules needed to run tests a301158 rampstream: Add utility to test for corruption of data streams 6f122f0 tcp: Get bound address for connected inbound sockets too f3fe795 vhost_user: Make source quit after reporting migration state b899141 Add interfaces and configuration bits for passt-repair 155cd0c migrate: Migrate guest observed addresses 5911e08 migrate: Skeleton of live migration logic 836fe21 passt-repair: Fix off-by-one in check for number of file descriptors def7de4 tcp_vu: Fix off-by one in header count array adjustment 90f91fe tcp: Implement conservative zero-window probe on ACK timeout 472e2e9 tcp: Don't discard window information on keep-alive segments 31e8109 dhcp, dhcpv6: Add hostname and client fqdn ops a3d142a conf: Don't map DNS traffic to host, if host gateway is a resolver 864be47 passt-repair: Send one confirmation *per command*, not *per socket* fe8b6a7 dhcp: Don't re-use request message for reply b7b70ba passt-repair: Dodge "structurally unreachable code" warning from Coverity 0f009ea passt-repair: Fix calculation of payload length from cmsg_len a0b7f56 passt-repair: Don't use perror(), accept ECONNRESET as termination a5cca99 conf, passt.1: Un-deprecate --host-lo-to-ns-lo 0da87b3 debug: Add tcpdump to mbuto.img f66769c apparmor: Workaround for unconfined libvirtd when triggered by unprivileged user 593be32 passt-repair.1: Fix indication of TCP_REPAIR constants 9215f68 passt-repair: Build fixes for musl a9d63f9 passt-repair: use _exit() over return d0006fa treewide: use _exit() over exit() 745c163 tcp: Simplify handling of getsockname() b4a7b5d migrate: Fix several errors with passt-repair dcf014b doc: Add mock of migration source and target 52e57f9 tcp: Get socket port and address using getsockname() when connecting from guest 8c24301 Introduce passt-repair e894d9a vhost_user: Turn some vhost-user message reports to trace() e25a930 util: Add read_remainder() and read_all_buf() 71fa736 tcp_splice, udp_flow: fcntl64() support on PPC64 depends on glibc version b75ad15 vhost_user: On 32-bit ARM, mmap() is not available, mmap2() is used instead 722d347 tcp: Don't reset outbound connection on SYN retries bf28608 pasta.te: fix demo.sh and remove one duplicate rule dcd6d81 tcp: Add HOSTSIDE(x), HOSTFLOW(x) macros 0349cf6 util: Rename and make global vu_remove_watch() 10c4a9e tcp: Always pass NULL event with EPOLL_CTL_DEL dd6a685 vhost-user: Implement an empty VHOST_USER_SEND_RARP command d477a1f netlink: Skip loopback interface while looking for a template https://passt.top/passt/log/?qt=range&q=2025_01_21.4f2c8e7..2025_02_17.a1e4… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8663104/ permanent mirror: https://passt.top/builds/copr/0^20250217.ga1e48a0/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-ga1e48a0-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0a1e48a0-1_all.deb -- Stefano

1 0

passt: new version 2025_01_21.4f2c8e7 available
by Stefano Brivio 21 Jan '25

21 Jan '25

The new version with tag 2025_01_21.4f2c8e7 includes the following changes: 4f2c8e7 vhost_user: Drop packet with unsupported iovec array ec5c4d9 tcp: Set PSH flag for last incoming packets in a batch db2c91a tcp: Set ACK flag on *all* RST segments, even for client in SYN-SENT state 54bb972 tcp: Disable Nagle's algorithm (set TCP_NODELAY) on all sockets 8757834 tcp: Buffer sizes are *not* inherited on accept()/accept4() c96a88d vhost_user: remove ASSERT() on iovec number 412ed4f vhost-user: Report to front-end we support VHOST_USER_PROTOCOL_F_DEVICE_STATE 31d7002 vhost-user: add VHOST_USER_SET_DEVICE_STATE_FD command 878e163 vhost-user: add VHOST_USER_CHECK_DEVICE_STATE command 78c73e9 vhost-user: Report to front-end we support VHOST_USER_PROTOCOL_F_LOG_SHMFD 3c1d91b vhost-user: add VHOST_USER_SET_LOG_BASE command 538312a vhost-user: Pass vu_dev to more virtio functions b04195c vhost-user: add VHOST_USER_SET_LOG_FD command 6016e04 vhost-user: update protocol features and commands list a8f4fc4 tcp: Mask EPOLLIN altogether if we're blocked waiting on an ACK from the guest b8f573c tcp: Set EPOLLET when when reading from a socket fails with EAGAIN 22cf08b tcp: Don't subscribe to EPOLLOUT events on STALLED 707f77b tcp: Fix ACK sequence getting out of sync on EPOLLOUT wake-up 1b95bd6 vhost_user: fix multibuffer from linux f04b483 test/pasta_podman: Run Podman tests on a single CPU thread 2c174f1 checksum: fix checksum with odd base address 725acd1 tcp_splice: Set (again) TCP_NODELAY on both sides 3876fc7 seccomp: Unconditionally allow accept(2) even if accept4(2) is present 898e853 virtio: Use const pointer for vu_dev 324233b udp_flow: Don't block multicast and broadcast messages 2385b69 Makefile: Report error and stop if we can't set TARGET e5ba8ad README: Mark vhost-user as supported https://passt.top/passt/log/?qt=range&q=2024_12_11.09478d5..2025_01_21.4f2c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8556325/ permanent mirror: https://passt.top/builds/copr/0^20250121.g4f2c8e7/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g4f2c8e7-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4f2c8e7-1_all.deb -- Stefano

1 0

passt: new version 2024_12_11.09478d5 available
by Stefano Brivio 12 Dec '24

12 Dec '24

The new version with tag 2024_12_11.09478d5 includes the following changes: 09478d5 treewide: Dodge dynamic memory allocation in strerror() from glibc > 2.40 e24f026 pasta: make it possible to disable socket splicing 947f5cd tap: Call vu_init() with --fd 2139ad3 tap: Use a common function to start a new connection 8996d18 udp_vu: update segment size 1908297 flow: Remove over-zealous sanity checks in flow_sidx_hash() 1db4f77 udp: Improve detail of UDP endpoint sanity checking 966fdc8 perf/passt_vu_tcp: Make it shine 020c8b7 tcp_vu: Compute IPv4 header checksum if dlen changes d9c0f8e Makefile: Use make internal string functions b6e79ef tcp_vu: Remove unnecessary tcp_vu_update_check() function a6348ca tcp: Merge tcp_fill_headers[46]() with each other 2abf5ab tcp: Merge tcp_update_check_tcp[46]() 08ea3cc tcp: Pass TCP header and payload separately to tcp_fill_headers[46]() 2ee0769 tcp: Pass TCP header and payload separately to tcp_update_check_tcp[46]() 6715109 iov, checksum: Replace csum_iov() with csum_iov_tail() f931103 iov: iov tail helpers 804a7ce tcp_vu: Change 'dlen' to ssize_t in tcp_vu_data_from_sock() 00cc230 Fix build on 32bit target 6fae899 virtio: check if avail ring is configured 7e131e9 tcp: Move tcp_l2_buf_fill_headers() to tcp_buf.c 676bf54 test: Add tests for passt in vhost-user mode 28997fc vhost-user: add vhost-user b2e62f7 passt: rename tap_sock_init() to tap_backend_init() b7c292b tcp: Export headers functions 5a8b33c udp: Prepare udp.c to be shared with vhost-user 31117b2 vhost-user: introduce vhost-user API 7d1cd4d vhost-user: introduce virtio API dd143e3 packet: replace struct desc by struct iovec https://passt.top/passt/log/?qt=range&q=2024_11_27.c0fbc7e..2024_12_11.0947… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8382137/ permanent mirror: https://passt.top/builds/copr/0^20241211.g09478d5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g09478d5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_09478d5-1_all.deb -- Stefano

1 0

passt: new version 2024_11_27.c0fbc7e available
by Stefano Brivio 27 Nov '24

27 Nov '24

The new version with tag 2024_11_27.c0fbc7e includes the following changes: c0fbc7e dhcp: Honour broadcast flag (RFC 2131, 4.1) 9da2038 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) d6e9e24 dhcp: Use -1 as "missing option" length instead of 0 14b84a7 treewide: Introduce 'local mode' for disconnected setups c6e6106 test: Improve logic for waiting for SLAAC & DAD to complete in NDP tests cda7f16 ndp: Don't send first periodic router advertisement right after guest connects 2bf8ffc test/perf: Select a single IPv6 namespace address in pasta tests 6819b2e conf, passt.1: Update --mac-addr default in usage() and man page b61be84 passt.1: Fix "default" note about --map-guest-addr https://passt.top/passt/log/?qt=range&q=2024_11_21.238c69f..2024_11_27.c0fb… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8318673/ permanent mirror: https://passt.top/builds/copr/0^20241127.gc0fbc7e/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc0fbc7e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c0fbc7e-1_all.deb -- Stefano

1 0

passt: new version 2024_11_21.238c69f available
by Stefano Brivio 21 Nov '24

21 Nov '24

The new version with tag 2024_11_21.238c69f includes the following changes: 238c69f tcp: Acknowledge keep-alive segments, ignore them for the rest af464c4 tcp: Reset ACK_TO_TAP_DUE flag whenever an ACK isn't needed anymore 5ae2184 ndp: Don't send unsolicited RAs if NDP is disabled bf94927 ndp: Don't send unsolicited router advertisement if we can't, yet 5e24466 selinux: Use auth_read_passwd() interface for all our getpwnam() needs 6e1e442 ndp: Send unsolicited Router Advertisements b39760c passt: Seed libc's pseudo random number generator 71d5dee util: Add general low-level random bytes helper a60703e ndp: Make route lifetime a #define 36c070e ndp: Use struct assignment in preference to memcpy() for IPv6 addresses cbc83e1 ndp: Split out helpers for sending specific NDP message types 4e47167 ndp: Add ndp_send() helper 71f228d ndp: Remove redundant update to addr_seen 0588163 cppcheck: Don't check the system headers 14dd70e linux_dep: Fix CLOSE_RANGE_UNSHARE availability handling d64f257 linux_dep: Move close_range() conditional handling to linux_dep.h b84cd05 log: Only check for FALLOC_FL_COLLAPSE_RANGE availability at runtime 58fa550 tap, tcp, util: Add some missing SOCK_CLOEXEC flags 71869e2 passt: Use NOLINT clang-tidy block instead of NOLINTNEXTLINE d4f09c9 util: Define small and big thresholds for socket buffers as unsigned long long 87940f9 tap: Cast TAP_BUF_BYTES - ETH_MAX_MTU to ssize_t, not TAP_BUF_BYTES 1feb90f dhcpv6: Turn some option headers pointers to const 5f5e814 dhcpv6: Use for loop instead of goto to avoid false positive cppcheck warning 78da088 tcp: unify payload and flags l2 frames array 9a0e544 test: Improve test for NDP assigned prefix 910f4f9 test: Don't require 64-bit prefixes in perf tests 1699083 test: Make nstool hold robust against interruptions to control clients b456ee1 test: Rename propagating signal handler 867db07 util: Work around cppcheck bug 6936 6f913b3 udp: Don't dereference uflow before NULL check in udp_reply_sock_handler() d8e05a3 ndp: Use const pointer for ndp_ns packet 0d7b820 linux_dep: Generalise tcp_info.h to handling Linux extension compatibility c5f4e4d fwd: Squash different-signedness comparison warning 1e76a19 util: Remove unused ffsl() function 1d7cff3 clang: Add rudimentary clangd configuration c560e2f Makefile: Don't attempt to auto-detect stack size 13fc6d5 Makefile: Use -DARCH for qrap only 7917159 seccomp: Simplify handling of AUDIT_ARCH 93bce40 Makefile: Move NETNS_RUN_DIR definition to C code c938d8a netlink: RTA_PAYLOAD() returns int, not size_t f6b546c flow: Correct type of flowside_at_sidx() 30b4f88 arch: Avoid explicit access to 'environ' b78e72d clang: Move clang-tidy configuration from Makefile to .clang-tidy 8346216 Makefile: Simplify exclusion of qrap from static checks 8f1b6a0 clang: Add .clang-format file 5e93bcd test: Adjust misplaced sleeps in two_guests code 9afce0b tap: Explicitly cast TUNSETIFF to fix build warning with musl on ppc64le d165d36 tcp: Fix build against musl, __sum16 comes from linux/types.h https://passt.top/passt/log/?qt=range&q=2024_10_30.ee7d0b6..2024_11_21.238c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8293460/ permanent mirror: https://passt.top/builds/copr/0^20241121.g238c69f/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g238c69f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_238c69f-1_all.deb -- Stefano

1 0

Re: Failed to pivot_root() into empty tmpfs
by Stefano Brivio 20 Nov '24

20 Nov '24

On Tue, 19 Nov 2024 07:55:59 +0000 Piotr Bzdręga via user <passt-user(a)passt.top> wrote: > Hei guys, > I cannot register account on https://passt.top/passt/bugs. > I was trying with few e-mails. > I wanted to report bug regarding using pivot_root() in tmpfs. > > [08:47][selkie@buildroot][~] $ podman run -it 88b748efcbb3 > Error: pasta failed with exit code 1: > Couldn't get any nameserver address > Failed to pivot_root() into empty tmpfs: Invalid argument > Failed to sandbox process, exiting > > I saw that pivot_root() can be replace by chroot e.g. done in crun : > https://github.com/containers/crun/blob/83998014c5e8dee84432f6ece34363dbd1c… By the way, this is now tracked at: https://bugs.passt.top/show_bug.cgi?id=104 thanks Piotr! -- Stefano

1 0

Failed to pivot_root() into empty tmpfs
by Piotr Bzdręga 19 Nov '24

19 Nov '24

Hei guys, I cannot register account on https://passt.top/passt/bugs. I was trying with few e-mails. I wanted to report bug regarding using pivot_root() in tmpfs. [08:47][selkie@buildroot][~] $ podman run -it 88b748efcbb3 Error: pasta failed with exit code 1: Couldn't get any nameserver address Failed to pivot_root() into empty tmpfs: Invalid argument Failed to sandbox process, exiting I saw that pivot_root() can be replace by chroot e.g. done in crun : https://github.com/containers/crun/blob/83998014c5e8dee84432f6ece34363dbd1c… Piotr Bzdręga

1 0

passt: new version 2024_10_30.ee7d0b6 available
by Stefano Brivio 30 Oct '24

30 Oct '24

The new version with tag 2024_10_30.ee7d0b6 includes the following changes: ee7d0b6 util: Don't use errno after a successful call in __daemon() b1a607f udp: Take care of cert-int09-c clang-tidy warning for enum udp_iov_idx 099ace6 treewide: Address cert-err33-c clang-tidy warnings for clock and timer functions 59fe34e treewide: Suppress clang-tidy warning if we already use O_CLOEXEC 134b4d5 Makefile: Disable readability-math-missing-parentheses clang-tidy check 7442478 treewide: Silence cert-err33-c clang-tidy warnings for fprintf() 98efe7c treewide: Comply with CERT C rule ERR33-C for snprintf() 988a4d7 Makefile: Exclude qrap.c from clang-tidy checks ba38e67 tcp: unify l2 TCPv4 and TCPv6 queues and structures 2053c36 tcp: set ip and eth headers in l2 tap queues on the fly 5563d5f test: remove obsolete images f43f7d5 tcp: cleanup tcp_buf_data_from_sock() e7fcd0c tcp: Use runtime tests for TCP_INFO fields 8114381 tcp: Generalise probing for tcpi_snd_wnd field 13f0291 tcp: Remove compile-time dependency on struct tcp_info version 9e4615b tcp_splice: fcntl(2) returns the size of the pipe, if F_SETPIPE_SZ succeeds 149f457 tcp_splice: splice() all we have to the writing side, not what we just read 9e5df35 tcp: Use structures to construct initial TCP options b4dace8 fwd: Direct inbound spliced forwards to the guest's external address 58e6d68 test: Clarify test for spliced inbound transfers 1fa4211 passt.1: Clarify and update "Handling of local addresses" section ef8a516 passt.1: Mark --stderr as deprecated more prominently 53176ca test: Wait for DAD on DHCPv6 addresses 75b9c0f test: Explicitly wait for DAD to complete on SLAAC addresses f9d677b arp: Fix a handful of small warts 2d7f734 tcp: Send "empty" handshake ACK before first data segment 7612cb8 test: Pass TRACE from run_term() into ./run from_term b40880c test/lib/term: Always use printf for messages with escape sequences ff63ac9 conf: Add --dns-host option to configure host side nameserver 9d66df9 conf: Add command line switch to enable IP_FREEBIND socket option 151dbe0 udp: Update UDP checksum using an iovec array 3d484aa tcp: Update TCP checksum using an iovec array e6548c6 checksum: Add an offset argument in csum_iov() fd8334b pcap: Add an offset argument in pcap_iov() 72e7d30 tcp: Use tcp_payload_t rather than tcphdr def8acd test: Kernel binary can now be passed via the KERNEL environmental variable b55013b inany: Add inany_pton() helper cbde419 tcp, udp: Make {tcp,udp}_sock_init() take an inany address b8d4fac util, pif: Replace sock_l4() with pif_sock_l4() 204e77c udp: Don't attempt to get dual-stack sockets in nonsensical cases 8f8c4d2 tcp: Allow checksum to be disabled 4fe5f4e udp: Allow checksum to be disabled d836d9e util: Remove possible quadratic behaviour from write_remainder() bfc294b util: Add helper to write() all of a buffer bb41901 tcp: Make tcp_update_seqack_wnd()s force_seq parameter explicitly boolean 265b209 tcp: Simplify ifdef logic in tcp_update_seqack_wnd() 4aff6f9 tcp: Clean up tcpi_snd_wnd probing 7d8804b tcp: Make some extra functions private 5ff5d55 tcp: Avoid overlapping memcpy() in DUP_ACK handling 1f414ed tcp: Remove redundant initialisation of iov[TCP_IOV_ETH].iov_base https://passt.top/passt/log/?qt=range&q=2024_09_06.6b38f07..2024_10_30.ee7d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8189610/ permanent mirror: https://passt.top/builds/copr/0^20241030.gee7d0b6/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gee7d0b6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0ee7d0b6-1_all.deb -- Stefano

1 0

Re: Rootless Podman with VRRP
by David Gibson 19 Sep '24

19 Sep '24

On Mon, Sep 16, 2024 at 02:46:51PM +0000, Castelli, Anton via user wrote: > Date: Mon, 16 Sep 2024 14:46:51 +0000 > From: "Castelli, Anton" <anton.castelli(a)siu.edu> > To: "passt-user(a)passt.top" <passt-user(a)passt.top> > Subject: Rootless Podman with VRRP > List-Id: "For passt users: support, questions and answers" > <passt-user.passt.top> > > I'm trying to get a service in a rootless Podman container (BIND DNS > server) to respond correctly when using VRRP (via keeepalived) on > the host. It seems like Pasta will forward the inbound traffic to > the container from the VRRP address, but the responses will be from > the regular IP address instead of the VRRP address, which causes the > client to ignore the response. I've tried adding Pasta network > options to the container, but the behavior seems to be the same. I'm not familiar with VRRP beyond a quick skim of the wikipedia article just now. I think the (only) relevant thing is that the host has multiple addresses, but it's possible there's some other complexity on the host that I'm not factoring in yet. > OS: Centos Stream 9 > Podman: 5.2.2 > Pasta: 0^20240806.gee36266-2.el9.x86_64-pasta This version includes UDP flow tracking, which fixes some of the worst bugs with UDP forwarding / addressing, but there are still some edge cases as you've discovered. I think I know what's going on here. With TCP, once we accept() a connection, it's local address on the host is part of the accept()ed socket, so we'll always use the same address for reply packets. With UDP, however, this doesn't happen automatically: the local address for replies is controlled by the bound address of the socket we use to send them out. In this instance that will be the same socket as is listening for the incoming requests. I'm assuming that socket will be set to listen to DNS traffic on any address, so it will be bound to 0.0.0.0:53 on the host. That will see the traffic to the VRRP address, but when we go to send the reply the kernel will pick the local address according to its routing tables and it seems it's picking the default address. That is a bug, at least in principle: we should remember the local address for a UDP flow and use the same local address for replies. With the flow table we now have the means of correctly tracking this, however, we haven't implemented this (yet) because it's kind of fiddly: we'd need to use additional getsockopt() calls to determine and control the local address for datagrams on a per-packet basis. > Outside interface: > > ens18 > 10.1.1.1/24 (main IP) > 10.1.1.2/32 (VRRP IP) > > TCPdump shows the problem (note that the reply packet has source as the main IP, not the VRRP IP: > > IP 10.2.2.2.37392 > 10.1.1.2.53: 60211+ [1au] A? www.example.com. (56) > IP 10.1.1.1.53 > 10.2.2.2.37392: 60211*- 1/0/1 A 192.168.254.7 (88) > > Tried starting the container with non-default pasta options, but the result is the same: > > --network pasta:-I,tap0,-o,10.1.1.2,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp Most of those options are not relevant. --dns-forward is set by podman and won't change anything (it's about DNS requests _out_ from the container). Similarly -g, --ipv4-only and the --no-* options are unlikely to be relevant here. -a is also probably not relevant: it controls the guest's address, but this is a host side addressing problem. That said, -a 10.0.2.0 -n 24 is probably not a good idea, since it's setting the guest's address to the network address. -o is the one that you'd think is relevant, since it's supposed to control the outbound local address. The catch here is that while it will control the local address for new sockets we create to handle flows initiated by the guest, here the flow is initiated by the host and so goes through the listening socket, which is still bound to 0.0.0.0:53. > Any help with possible solutions would be greatly appreciated. I believe I have a workaround. The trick here is we want the listening socket to be bound to the VRRP address, this can be done by setting that specific IP for publishing the port so, for example: podman run --publish 10.1.1.2:53:53/udp ... (which should translate to to the pasta option "-u 10.1.1.2/53:53"). The tradeoff for this workaround is that the container will now *only* respond to DNS traffic to the VRRP address, but I'm guessing that might be what you want anyway. You could also explicitly publish any additional addresses you want to respond on. But, longer term, this is a bug that we'd like to fix when we have time. Would you mind filing a ticket on bugs.passt.top so we don't forget it? -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 5

Re: Rootless Podman with VRRP
by Stefano Brivio 17 Sep '24

17 Sep '24

On Tue, 17 Sep 2024 18:53:24 +0000 "Castelli, Anton" <anton.castelli(a)siu.edu> wrote: > Stefano, > > I've encountered an error when trying to submit the bug report. I tried twice with the same result. See attached screenshot. Sorry, my bad. Can you please try again? -- Stefano

2 1

2025

2024

2023

2022

2021

user