- user - passt

Feature request: option to prevent guest from reaching host external addresses
by baleti 04 May '26

04 May '26

Hi, I'd like to propose a new option for passt, working title --no-map-host, as a complement to the existing --no-map-gw. The gap --no-map-gw prevents the guest from reaching host loopback services via the gateway address mapping, which is useful. However, there is currently no mechanism to prevent the guest from reaching services bound to the host's real external address (e.g. 0.0.0.0:22). Because passt proxies outbound guest connections as the host user, a connection from the guest to the host's own external IP is transparently forwarded — passt opens the socket on the host side and the connection succeeds. From the perspective of the service being connected to (e.g. sshd), it appears as a local connection. A concrete example with a typical setup: passt -t 2222 --no-map-gw --vhost-user --socket /tmp/passt-vm ss -tulpn shows: tcp LISTEN 0.0.0.0:22 sshd From inside the guest, a compromised or untrusted workload can reach sshd directly: ssh user(a)192.168.1.x # host's external IP, connection succeeds This also enables VM-to-VM lateral movement when multiple guests share the same host: each guest can reach the others' forwarded ports via the host's external IP. The operator has no indication this is happening. Services bound to 0.0.0.0 are generally considered "LAN-exposed" rather than "VM-guest-exposed", and this assumption is silently violated. Proposed option --no-map-host, which would cause passt to drop or reject TCP/UDP connections from the guest whose destination matches any of the host's own configured addresses (the same addresses passt already knows about for DHCP/NDP assignment purposes). An alternative spelling --map-host-addr none modelled on --map-host-loopback none would also be consistent with the existing option naming. This would stay entirely within passt's existing socket-layer design and require no new privileges. Why this matters for rootless setups The primary audience for passt is rootless VM deployments where TAP+bridge (the traditional isolation mechanism) is not available without privilege. In these setups, passt is the only network layer, so operators rely on it to provide whatever isolation is possible. --no-map-gw is a good step in that direction; --no-map-host would close the remaining obvious gap. Happy to discuss or test patches. Thanks for the project — it's been very useful. Best, baleti

2 1

passt: new version 2026_01_20.386b5f5 available
by Stefano Brivio 21 Jan '26

21 Jan '26

The new version with tag 2026_01_20.386b5f5 includes the following changes: 386b5f5 flow: Remove EPOLLFD_ID_INVALID 90287c2 tcp: Register fds with epoll at flow creation 0fbd7af tcp_splice: Register fds with epoll at flow creation cee7eb0 conf, pasta: Add --splice-only option 4a0d507 flow, fwd: Optimise forwarding rule lookup using epoll ref when possible fe37028 fwd, tcp, udp: Add forwarding rule to listening socket epoll references 01bcdb9 fwd: Remap ports based directly on forwarding rule f56a822 flow, fwd: Consult rules table when forwarding a new flow from socket a0af19f fwd: Generate auto-forward exclusions from socket fd tables 03a9c4b conf, fwd: Check forwarding table for conflicting rules acb7a30 tcp, udp: Remove old auto-forwarding socket arrays b223bec fwd, tcp, udp: Set up listening sockets based on forward table 0c611bc ip: Add ipproto_name() function da49557 fwd: Make space to store listening sockets in forward table e2633b9 conf, fwd: Record "auto" port forwards in forwarding table 9323ab9 conf: Accurately record ifname and address for outbound forwards bd52f61 conf, fwd: Keep a table of our port forwarding configuration 016e3d7 inany: Extend inany_ntop() to treat NULL as a fully unspecified address https://passt.top/passt/log/?qt=range&q=2026_01_17.81c97f6..2026_01_20.386b… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10039669/ permanent mirror: https://passt.top/builds/copr/0^20260120.g386b5f5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g386b5f5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_386b5f5-1_all.deb -- Stefano

1 0

Passt bugzilla 403 error
by Han Han 19 Jan '26

19 Jan '26

Get 403 error when accessing passt bugzilla via web browser or curl: $ curl 'https://bugs.passt.top/show_bug.cgi?id=192' <html> <head><title>403 Forbidden</title></head> <body> <center><h1>403 Forbidden</h1></center> <hr><center>nginx</center> </body> </html>

2 1

passt: new version 2026_01_17.81c97f6 available
by Stefano Brivio 18 Jan '26

18 Jan '26

The new version with tag 2026_01_17.81c97f6 includes the following changes: 81c97f6 hooks/pre-push: Use mandoc(1) to get HTML anchors to command-line options a6d92ca selinux: Enable open permissions on netns directory, operations on container_var_run_t 4296a59 igmp: Remove apparently unneeded suppression fa765d5 epoll_ctl: Move u64 variant first for safer initialisation 4af3d83 treewide: Fix more pointers which can be const a54274d tcp, udp: Make {tcp,udp}_listen() return socket fds d5fd945 tcp, udp, conf: Don't silently ignore listens on unsupported IP versions c0be730 flow: Introduce flow_epoll_set() to centralize epoll operations 23da651 tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation e0fdfcc udp_flow: Assign socket to flow inside udp_flow_sock() ab27852 udp_flow: remove unneeded epoll_ref indirection cce0470 tcp: cleanup timer creation 5614bdc tcp: remove timer update in tcp_epoll_ctl() faab79c apparmor: Upgrade ABI version to 4.0, explicitly enable user namespace creation 2be0e79 tcp: Fix rounding issue in check for approximating window to zero b973f4a treewide: Fix places where we incorrectly indented with spaces b98a2e8 tcp: Remove some no longer used includes 35f63d2 fwd: Minor cleanup to fwd_nat_from_splice() facc736 fwd: Remove now-unnecessary handling of unspecified oaddr from splice edac476 udp_vu: Discard datagrams when RX virtqueue is not usable 9ea9dde fwd, tcp, udp: Consolidate epoll refs for listening sockets 3b55ba8 epoll_ctl: Add missing description for flowside field of epoll_ref ad5670a tcp: Remove unused tcp_epoll_ref 9437fc2 test: Include sshd-auth in mbuto guest image ac77d0c test: Handle Operating System Command escapes in terminal output accc331 treewide: Don't rely on terminator records in ip[46].dns arrays 4a0c1a6 migrate: Don't use terminator element for versions[] array 0bd2e68 util: Be more defensive about buffer overruns in read_file() 2aa6323 apparmor: Allow reading TCP RTO sysctl parameters https://passt.top/passt/log/?qt=range&q=2025_12_23.2ba9fd5..2026_01_17.81c9… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10031035/ permanent mirror: https://passt.top/builds/copr/0^20260117.g81c97f6/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g81c97f6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_81c97f6-1_all.deb -- Stefano

1 0

passt: new version 2025_12_23.2ba9fd5 available
by Stefano Brivio 24 Dec '25

24 Dec '25

The new version with tag 2025_12_23.2ba9fd5 includes the following changes: 2ba9fd5 tcp: Update EPOLL_TYPE_TCP_TIMER fd 6292845 udp: Rename udp_sock_init() to udp_listen() with small cleanups 0f4ba61 tcp: Combine tcp_sock_init_one() and tcp_sock_init() into tcp_listen() 75dcbc3 pasta: Warn, disable matching IP version if not supported, in local mode d2c5133 selinux: Enable read and watch permissions on netns directory as well https://passt.top/passt/log/?qt=range&q=2025_12_15.b40f5cd..2025_12_23.2ba9… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9946709/ permanent mirror: https://passt.top/builds/copr/0^20251223.g2ba9fd5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g2ba9fd5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_2ba9fd5-1_all.deb -- Stefano

1 0

Re: Connecting back to the host through a dummy veth interface
by Stefano Brivio 23 Dec '25

23 Dec '25

Hi Felix, On Thu, 18 Dec 2025 13:32:36 +0100 Felix Rubio <felix(a)kngnt.org> wrote: > Hi everybody, > > I am trying to run a number of rootless podman pods and containers by different > users, while still being able to talk to each other. To this end I am creating > a dummy veth interface and publishing all the exposed ports there (this works: > I can communicate from other host services with those containers), and I am > also trying to set that dummy veth interface as the default gateway for the > pods/containers (with the expectation that then they will be able to reach > each other). However, this is not working... and I am pretty lost. > > For example, I am running the following command, trying to connect a ldap > client container to a ldap server container, unsuccessfully. > > podman run --rm --dns=10.255.255.1 --network=pasta:--outbound- > if4=cluster_dns0,--gateway=10.255.255.1 --add-host=ldap.host.internal:host-gateway sh -c "ip add && ip route && ldapwhoami -H ldaps:// > ldap.host.internal:1636" > > Is this something impossible to do, or am I doing something wrong? Sorry, I'm a bit swamped at the moment, and I plan to get back to you in a bit, but meanwhile, I think the dummy veth trick is unnecessarily complicated. I think you could simply connect "to the host" and redirect from there to the containers by means of mapped ports. See: https://blog.podman.io/2024/10/podman-5-3-changes-for-improved-networking-e… for a couple of details. But I'll try to come up with a full example next. -- Stefano

2 9

Connecting back to the host through a dummy veth interface
by Felix Rubio 18 Dec '25

18 Dec '25

Hi everybody, I am trying to run a number of rootless podman pods and containers by different users, while still being able to talk to each other. To this end I am creating a dummy veth interface and publishing all the exposed ports there (this works: I can communicate from other host services with those containers), and I am also trying to set that dummy veth interface as the default gateway for the pods/containers (with the expectation that then they will be able to reach each other). However, this is not working... and I am pretty lost. For example, I am running the following command, trying to connect a ldap client container to a ldap server container, unsuccessfully. podman run --rm --dns=10.255.255.1 --network=pasta:--outbound- if4=cluster_dns0,--gateway=10.255.255.1 --add-host=ldap.host.internal:host-gateway sh -c "ip add && ip route && ldapwhoami -H ldaps:// ldap.host.internal:1636" Is this something impossible to do, or am I doing something wrong? Thank you very much for any help you can provide! -- Felix Felix Rubio

1 0

passt: new version 2025_12_15.b40f5cd available
by Stefano Brivio 15 Dec '25

15 Dec '25

The new version with tag 2025_12_15.b40f5cd includes the following changes: b40f5cd tcp: Use less-than-MSS window on no queued data, or no data sent recently 35fa86a conf, fwd: Move initialisation of auto port scanning out of conf() 5be1a22 tcp: Remove extra space from TCP_INFO debug messages (trivial) 87f1a91 pasta: Clean up waiting pasta child on failures e6612fe treewide: Introduce passt_exit() helper d6c5b6e tcp: Suppress new instance of cppcheck bug 14191 https://passt.top/passt/log/?qt=range&q=2025_12_10.d04c480..2025_12_15.b40f… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9911424/ permanent mirror: https://passt.top/builds/copr/0^20251215.gb40f5cd/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gb40f5cd-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0b40f5cd-1_all.deb -- Stefano

1 0

passt: new version 2025_12_10.d04c480 available
by Stefano Brivio 10 Dec '25

10 Dec '25

Subject: passt: new version 2025_12_10.d04c480 available The new version with tag 2025_12_10.d04c480 includes the following changes: d04c480 pif: Correctly set scope_id for guest-side link local addresses 696709d tcp: Correct timer expiry value in trace message https://passt.top/passt/log/?qt=range&q=2025_12_09.c3f1ba7..2025_12_10.d04c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9896122/ permanent mirror: https://passt.top/builds/copr/0^20251210.gd04c480/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gd04c480-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0d04c480-1_all.deb -- Stefano

1 0

passt: new version 2025_12_09.c3f1ba7 available
by Stefano Brivio 09 Dec '25

09 Dec '25

The new version with tag 2025_12_09.c3f1ba7 includes the following changes: c3f1ba7 tcp_splice, flow: Add socket to epoll set before connect(), drop assert e8b56a3 fedora: Fix build on Fedora 43, selinux_requires_min not available on Copr builders c93515c tcp: Skip redundant ACK on partial sendmsg() failure e0f1330 tcp: Send a duplicate ACK also on complete sendmsg() failure 2b5c906 tcp: Allow exceeding the available sending buffer size in window advertisements cf1925f tcp: Don't limit window to less-than-MSS values, use zero instead 9139e60 tcp: Acknowledge everything if it looks like bulk traffic, not interactive 28f413d tcp: Don't clear ACK_TO_TAP_DUE if we're advertising a zero-sized window 000601b tcp: Adaptive interval based on RTT for socket-side acknowledgement checks 920a479 tcp: Limit advertised window to available, not total sending buffer size f423e12 tcp: Change usage factor of sending buffer in tcp_get_sndbuf() to 75% 6305b6c tcp, util: Add function for scaling to linearly interpolated factor, use it 5d83844 iov: Fix coding style of basic (non-IOV_TAIL) parts 0cb8f90 tcp, udp: Pad batched frames for vhost-user modes to 60 bytes (802.3 minimum) 68b0a36 tcp, udp: Pad batched frames to 60 bytes (802.3 minimum) in non-vhost-user modes b9cd36f udp: Fix coding style for comment to enum udp_iov_idx e3e8af7 tcp: Fix coding style for comment to enum tcp_iov_parts 1e51971 tap: Pad non-batched frames to 802.3 minimum (60 bytes) if needed 822ce09 test: Update Makefile to avoid failing on missing images 4ddd59b conf: Separate local mode for each IP version, don't enable disabled IP version 834982c vu_common: Clarify prototype of vu_collect() 7c7be67 test: Expand tmux right status bar to fit pass/fail/skipped counter and time aa809d3 tcp: Enable SO_KEEPALIVE if we see keep-alive segments from container / guest 9e2e381 seccomp: Fix build and operation on 32-bit musl targets fdbb4ef fwd: Preserve non-standard loopback address when splice forwarding e3c4c41 tcp: Always populate oaddr field for socket initiated flows cec1ca8 util: Rename sock_l4_dualstack() to sock_l4_dualstack_any() 653705c tcp, udp: Bind outbound listening sockets by interface instead of address e77cbf0 tcp, udp: Remove fallback if creating dual stack socket fails e6f6eb2 util: Fix setting of IPV6_V6ONLY socket option 74e6f12 udp: Move udp_sock_init() special case to its caller c8d4683 udp: Unify some more inbound/outbound parts of udp_sock_init() 860d3b1 tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one() 3b8b834 util, flow, pif: Simplify sock_l4_sa() interface b0523f6 inany: Let length of sockaddr_inany be implicit from the family 484dcfa flow: Remove bogus @path field from flowside_sock_args f37db87 conf: More useful errors for kernels without SO_BINDTODEVICE 0ae7b8c util: Extend sock_probe_mem() to sock_probe_features() 10e850a util: Correct error message on SO_BINDTODEVICE failure 1a83487 tcp: Clamp the retry timeout 3dde0e0 tcp: Update data retransmission timeout 0e8df13 tcp: Resend SYN for inbound connections ffecfaf util: Introduce read_file() and read_file_integer() function 785214c tcp: Rename "retrans" to "retries" 2002c7d arp/ndp: don't send messages on uninitialized tap interface 391c15a test: Fix IPv6 address/prefix mismatch error 95ab87b spec: use %selinux_requires_min macro, drop overlapping dependencies be1583f fwd: Don't explicitly exclude reverse-direction TCP ports for UDP fd3fc8d fwd: Exclude ports based on prior mapping state bdbdf4e Revert "fwd: Update all port maps before applying exclusions" 2c6590d udp: Use IP_FREEBIND for flow sockets as well as listening sockets 75b8bb9 tcp: Properly remove sockets from epoll loop when connection is closed a36031a seccomp.sh: Quote tr character ranges to prevent glob expansion 1d16439 contrib/selinux: use regex instead of SELinux template f6b6118 tcp, udp: Don't exclude ports in {tcp,udp}_port_rebind() 81942a2 fwd: Update all port maps before applying exclusions 942bfdb fwd: Check forwarding mode in fwd_scan_ports_*() rather than caller 06c3dcc fwd: Share port scanning logic between init and timer cases 1754f61 fwd: Move port exclusion handling from procfs_scan_listen() to callers 1bc7d54 fwd: Consolidate scans (not rebinds) in fwd.c 260075b tcp, udp, fwd: Run all port scanning from a single timer 1f2c08b icmp: Remove vestiges of ICMP timer 57446ca passt: Move main event loop processing into passt_worker() aaa8f34 udp: Use epoll instance management for UDP flows ca93124 icmp: Use epoll instance management for ICMP flows dd5302d tcp, flow: Replace per-connection in_epoll flag with an epollid in flow_common 05972c7 util: Move epoll registration out of sock_l4_sa() 965ea66 epoll_ctl: Extract epoll operations 8bfa47a util: Simplify epoll_del() interface to take epollfd directly 3a9dbe0 icmp: let icmp use mac address from flowside structure ad72098 tap: change signature of function tap_push_l2h() 860a487 tcp: forward external source MAC address through tap interface 627d5f7 udp: forward external source MAC address through tap interface 5d35ac3 flow: add MAC address of LAN local remote hosts to flow 7917155 arp/ndp: send ARP announcement / unsolicited NA when neigbour entry added e456c02 arp/ndp: respond with true MAC address of LAN local remote hosts 45869d6 fwd: Add cache table for ARP/NDP contents 3c46901 netlink: add subscription on changes in NDP/ARP table 3b9c7f8 Add reverse Christmas tree to CONTRIBUTING.md 7bb150c fwd: Fix misspelling b2ccb6d test: Fix the escaping issue in memory/passt test 812a7c6 test: Update the threshold value for some perf tests 4fb4c31 tap: Update some function comments for accuracy 8a6def6 passt: Rename EPOLL_EVENTS to NUM_EPOLL_EVENTS 720cc0b Fix the wrong command in CONTRIBUTING.md 6d84c90 test: For missing static checkers, skip rather than failing tests 5149f34 test: Add some missing quoting in exeter runner 898cf50 test: Use ${} consistently in lib/exeter 5da0316 isolation: keep CAP_DAC_OVERRIDE initially 518d8c1 tcp: Clarify logic calculating how much guest data to ack a947839 tcp: On partial send (incomplete sendmsg()), request a retransmission right away b145441 tcp: Don't consider FIN flags with mismatching sequence 8efa80b tcp: Completely ignore data segment in CLOSE-WAIT state, log a message b3217aa tcp: Fix ACK sequence on FIN to tap 2a16cdf test: Add linting of Python test scripts 81fd66a test: Don't delete exetool on make clean 2274c3a cppcheck: Suppress variable scope warnings in dhcpv6() ee9b236 cppcheck: Suppress a buggy cppcheck warning 065d199 cppcheck: Suppress the suppression of a suppression b4b3b08 clang-tidy: Suppress redundant expression warning 4d9c35b test: Update passt.mbuto and passt.mem.mbuto a96a962 netlink: Don't require address to be global, just not link local 7086781 test: Fix printf error when debug is enabled c54ef9e test: Update README.md f4729be test: Update mbuto profile to fix the symlink of /bin de28c20 test: Update lib/term for clearer output when DEBUG is enabled f07d7b0 test: fix 'make assets' failure as root e81c692 tap: Drop frames if no client connected https://passt.top/passt/log/?qt=range&q=2025_09_19.623dbf6..2025_12_09.c3f1… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9888020/ permanent mirror: https://passt.top/builds/copr/0^20251209.gc3f1ba7/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc3f1ba7-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c3f1ba7-1_all.deb -- Stefano

1 0