- user - passt

CAP_NET_BIND_SERVICE does not allow binding to low ports
by Nicholas Rodrigues Lordello 14 Oct '26

14 Oct '26

Hey all, Just wanted to report what is either a documentation issur, or an issue in `passt` proper. The `man` pages document the following for binding to low numbered (i.e. service ports): or the CAP_NET_BIND_SERVICE Linux capability is granted, see services(5) and capabilities(7). [...] To grant this capability, you can issue, as root: for p in $(which passt passt.avx2); do setcap 'cap_net_bind_service=+ep' "${p}" done However, this does not work: # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt # setcap 'cap_net_bind_service=+ep' /usr/local/bin/passt.avx2 $ /usr/local/bin/passt -f -t 123 Listen failed for HOST TCP port */123: Permission denied Couldn't listen on requsted ports [1] The reason I'm asking is that `krun` uses `passt` for port forwarding and is having issues with service ports [1]. The current work-around is to set the `net.ipv4.ip_unprivileged_port_start` sysctl to a lower number in the container where `passt` is run, but since `passt` is started already with `CAP_NET_BIND_SERVICE` it would be nice for that to work and not require the `sysctl` work-around. Anyway, curious to know if this is documentation issue or actually something that should be working but isn't (or a local setup issue). Regards, Nick [1]: <https://github.com/containers/crun/issues/2251>

1 0

passt: new version 2026_10_02.cba3570 available
by Stefano Brivio 03 Oct '26

03 Oct '26

The new version with tag 2026_10_02.cba3570 includes the following changes: cba3570 tcp: Don't fast re-transmit if only our FIN is outstanding 032f082 apparmor: Fixes for new user namespace detaching procedure a51d395 util: Make setting uidmap and gidmap errors non-fatal f86196b selinux: Allow passt to use setgid and setuid capabilities in namespace 3822e7d apparmor: allow netns paths on /tmp again https://passt.top/passt/log/?qt=range&q=2026_09_25.df90211..2026_10_02.cba3… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/11066406/ permanent mirror: https://passt.top/builds/copr/0^20261002.gcba3570/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gcba3570-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0cba3570-1_all.deb -- Stefano

1 0

passt: new version 2026_09_25.df90211 available
by Stefano Brivio 26 Sep '26

26 Sep '26

The new version with tag 2026_09_25.df90211 includes the following changes: df90211 udp: Add missing @now parameter doc to udp_flow_from_tap() f2683d1 apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only 588b545 pasta: Add --no-pidns to keep spawned command in caller's PID namespace 3a890a6 contrib/apparmor: add missing setfcap capability de8b085 vhost_user: Reset vq enable flag in vu_cleanup() d2fb3ba Add Zed editor settings cef6bce util, pasta: Remove some unneeded #includes cf3a11f util: Add missing O_CLOEXEC for !HAS_GETRANDOM path abdc94a util: Eliminate a stray trailing whitespace aa2c8f0 clangd: Add _GNU_SOURCE to default clangd options 67dfdbd udp_flow: Remove obsolete comment 553ed8b parse: Convert parse_mac() to conventions of parse.c 7bf1595 isolation: Don't create our userns as nobody a8aedb8 isolation: Create helper function to enter user namespace 9587a35 util, pasta: Generalise [ug]id_map creation 5b4bdc8 pasta: Include pasta.h in pasta.c 7e8d49b netlink: Don't warn about multiple interfaces when there's only one defc25b isolation: Include linux_dep.h for close_range() https://passt.top/passt/log/?qt=range&q=2026_07_28.f8df3f1..2026_09_25.df90… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/11037397/ permanent mirror: https://passt.top/builds/copr/0^20260925.gdf90211/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdf90211-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0df90211-1_all.deb -- Stefano

1 0

Re: UDP drops when source port is in use in the init namespace
by David Gibson 02 Sep '26

02 Sep '26

On Tue, Sep 01, 2026 at 08:56:01PM +0200, Stefano Brivio via user wrote: > Date: Tue, 01 Sep 2026 20:56:01 +0200 (CEST) > From: Stefano Brivio <sbrivio(a)redhat.com> > To: Rahul <llvm.zentrik(a)gmail.com> > CC: passt-user(a)passt.top > Subject: Re: UDP drops when source port is in use in the init namespace > Organization: Red Hat > List-Id: "For passt users: support, questions and answers" > <passt-user.passt.top> > > Rahul, thanks for the report and for the investigation. Remarks and > some answers inline: > > On Sun, 30 Aug 2026 11:12:44 +0100 > Rahul <llvm.zentrik(a)gmail.com> wrote: > > > Hi, > > > > I'm seeing DNS requests being dropped when using pasta 20250217. As far as > > I can tell, UDP > > flows where the source port chosen in the namespace is already in use in the > > init namespace get dropped. > > > > All three fwd_nat_from_*() preserve the source port for UDP: > > > > tgt->oport = 0; > > if (proto == IPPROTO_UDP) > > /* But for UDP preserve the source port */ > > tgt->oport = ini->eport; > > This is intended, to offer compatibility with applications or protocols > that might rely on UDP source ports to be preserved, and, in general, > to be as transparent as possible. But: > > > That forces a bind() to it, and udp_flow_sock() treats bind failure as > > fatal, so > > the flow is cancelled and the datagram dropped with no error to the sender. > > ...this is not, that is, it would definitely be desirable to have a > fallback for bind() failures. Probably? The danger with a fallback of this sort is that if you're using a protocol which cares about the source port it will work.. until suddenly it doesn't for pretty non-obvious reasons. Theoretically another option would be to _not_ preserve the source port by default, but allow forwarding rules to specify source-port preservation, specifically for cases which do need it. But, that's a lot more work both to implement and to configure. > > I don't think I ever hit this with slirp4netns, it looks like libslirp's > > udp_attach() never > > binds a port, so the kernel just gives it a random free port. > > Right, yes, slirp4netns doesn't attempt to preserve UDP source ports > outside the namespace. It's a feature we added in pasta. > > > I'm not sure whether this is intended, but if it is, is there any way to > > work > > around it? > > I see two ways of implementing this fallback mechanism, roughly: > > 1. pass all the way to _sock_l4() via udp_flow_sock() an additional > argument to entirely ignore bind() failures (like we do for ICMP > ping sockets). It might be a rather mechanical change but not my > preferred approach as we would need an extra argument in a large > number of functions just for a corner case > > 2. I think preferable: detect the failure on bind() here (it should be > EADDRINUSE, did you check?) and try again from udp_flow_sock() with > tgt->oport as 0. > > Here, "tgt" means the target namespace of the connection, and > "oport" means "our port", implying the source port (because it's an > outbound connection from pasta's side). You'll also need to make sure this takes place _before_ calling getsockname() to fill in the correct final tgt->oport. > I think it would be good to try and sketch a solution (maybe starting > from 1.) to understand what approach would be more elegant and viable. > > I don't have much time on my hands right now but I'll definitely > provide pointers and support if you feel like proposing a patch for > this. > > As a first test / workaround for your usage: did you already check that > keeping tgt->oport as 0 in the relevant function in fwd.c works? > > -- > Stefano > > _______________________________________________ > user mailing list -- passt-user(a)passt.top > To unsubscribe send an email to passt-user-leave(a)passt.top -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

1 0

UDP drops when source port is in use in the init namespace
by Rahul 01 Sep '26

01 Sep '26

Hi, I'm seeing DNS requests being dropped when using pasta 20250217. As far as I can tell, UDP flows where the source port chosen in the namespace is already in use in the init namespace get dropped. All three fwd_nat_from_*() preserve the source port for UDP: tgt->oport = 0; if (proto == IPPROTO_UDP) /* But for UDP preserve the source port */ tgt->oport = ini->eport; That forces a bind() to it, and udp_flow_sock() treats bind failure as fatal, so the flow is cancelled and the datagram dropped with no error to the sender. I don't think I ever hit this with slirp4netns, it looks like libslirp's udp_attach() never binds a port, so the kernel just gives it a random free port. I'm not sure whether this is intended, but if it is, is there any way to work around it? Thanks

2 1

passt: new version 2026_07_28.f8df3f1 available
by Stefano Brivio 29 Jul '26

29 Jul '26

The new version with tag 2026_07_28.f8df3f1 includes the following changes: f8df3f1 fwd: Don't log warnings when failing to bind "weak" ports, just debug messages 12b02aa treewide: Sandbox qrap 4c9ec30 conf, fwd: Prefer same-scope address as inbound source address from host 4e8aa70 conf: Honour --address, --gateway, --netmask in local mode as well 37a73a2 pasta: Regression test for bug 216 ffa5cee pasta: Do not configure ID mappings when invoked with --netns-only 316cb2e pif: Add message to static_assert for C11 compliance, fix build with gcc 8 81a99ce udp, icmp: Remove unused timer_run fields from protocol contexts c80d9db main: Ensure fds 0-2 are populated fd5b080 isolation: Move --fd descriptor to a number of our choosing ab82595 conf: Make conf_tap_fd() operate more like conf_mode() 33e0fbc isolation, conf: Set c->fd_tap from early parse of --fd 0a51006 isolation: Move close_open_files() to isolate_fds() b0ca29e passt: Always close pidfile_fd, not just when daemonizing 5418bd9 tap: Fix EAGAIN/EWOULDBLOCK check in tap_pasta_input() https://passt.top/passt/log/?qt=range&q=2026_07_16.090d739..2026_07_28.f8df… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10784038/ permanent mirror: https://passt.top/builds/copr/0^20260728.gf8df3f1/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gf8df3f1-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0f8df3f1-1_all.deb -- Stefano

1 0

passt: new version 2026_07_16.090d739 available
by Stefano Brivio 17 Jul '26

17 Jul '26

The new version with tag 2026_07_16.090d739 includes the following changes: 090d739 passt.1, pesto.1: ::1 is an address, not a port 7d0c077 dhcp: Make option parsing more robust, explicitly handle options 0 and 255 10847ad CONTRIBUTING.md: The tag is "Link:", regardless of how many we have a3b9f86 udp_vu: Check iov_tail_clone() return before assigning to msg_iovlen 80cb5cf passt: Initialise listening socket fds to -1 fc6c774 fwd: Don't rewrite inbound multicast destinations 9013b59 fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() addd76d fwd: Rework default address logic for inbound flows 66fdabd udp: Validate that we have a unicast source address 26f2130 fwd: Clarify semantics of --host-lo-to-ns-lo fce9430 dhcpv6: Fix reply destination to match client's source address e74a7c2 selinux: Access to netns for podman-build, read access for netns in general 6ef3d1c isolation: Add --chroot-fallback option e67acde fwd, fwd_rule: Implement configurable target address mapping c8145c3 fwd_rule: Parse target addresses for forwarding rules bf21038 fwd_rule: Rewrite forward rule parsing using parse.c helpers 0581b0a fwd_rule: Allow "all" port specs to be combined with other options 289638b conf: Use new parsing tools to handle -a option b1d400f conf: Remove unnecessary mode checks from conf_addr() aaa0482 conf: Move address configuration into helper function 11f4fba parse: Add helpers for parsing IP addresses 4206913 parse: Move parse_port_range() to new parsing framework 8ffff9b parse: Add helper to parse unsigned integer values 9f8fcdc conf: Clean up conf_ip4_prefix() 2cdb27a conf: Remove duplicate parsing of -F option d29eb29 parse: Start splitting out parsing helpers cea54dd conf: Use parameter instead of global in conf_nat() e51a545 Makefile: Add missing PESTO_HEADERS variable edeb2a2 udp: Improve messages for errors getting errors 74863b0 flow, treewide: Promote priority of selected flow-linked messages 60cd39a flow, udp: Fix errno handling in udp_flow_sock() 780ba8a flow: Include flow details with higher priority log messages 2fbeb3b flow: Indent flow details messages d66a3f1 flow: Regularise flow specific logging helpers 3f57f03 tap: don't let overheard traffic move addr_seen when address is explicit f072bc0 tap: Trim Ethernet padding from short IPv4 frames instead of dropping them 41566e1 inany: Fix doc comment to match u32 field, not u64 ab2260a pif, util: Move listen(2) call from sock_l4_() to pif_listen() 50e3dcc fwd, pif: Remove duplicated logic between tcp_listen() and udp_listen() d5ef43d Makefile: Remove unused DUAL_STACK_SOCKETS define 6d1f38c flow: Correct misleading signature of flowside_sock_l4() 900ea8b tcp: MAX_WINDOW should be unsigned 19cd4ba tcp: Avoid SEQ_*() comparisons against 0 751a6f1 tcp: Merge common sequence logic from tcp_{buf,vu}_data_from_sock() 4604860 cppcheck: Add workaround for cppcheck bug 14847 96c4a9d cppcheck: Remove unused CPPCHECK_6936 https://passt.top/passt/log/?qt=range&q=2026_06_11.a9c61ff..2026_07_16.090d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10734380/ permanent mirror: https://passt.top/builds/copr/0^20260716.g090d739/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g090d739-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_090d739-1_all.deb -- Stefano

1 0

passt: new version 2026_06_11.a9c61ff available
by Stefano Brivio 13 Jun '26

13 Jun '26

The new version with tag 2026_06_11.a9c61ff includes the following changes: a9c61ff util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning e1a6d9e conf, util: Disable IPv6 if explicit IPv6 socket probe fails 21f4d13 tcp_splice: Improve EOF and read stall exit conditions 31d0893 passt, tcp: Inline CALL_PROTO_HANDLER() and merge tcp_timer() 2420ad2 tcp_splice: Remove questionable "optimisation" of pending bytes tracking 4ccb2ee tcp_splice: Simplify / correct OUT_WAIT flag handling cd61ad0 tcp_splice: Simplify shutdown(2) handling 987ac99 tcp_splice: Remove goto from forwarding loop 4a61870 tcp_splice: Improve EOF exit condition for the loop 1d475b1 tcp_splice: Simplify EPOLLRDHUP / eof / FIN handling 630e9bf tcp_splice: Remove never-invoked SO_RCVLOWAT logic 4b28237 tcp: Don't leak sockets on error paths 98e3c01 tcp, tcp_splice: Make helper for setting SO_LINGER socket option https://passt.top/passt/log/?qt=range&q=2026_05_26.038c51e..2026_06_11.a9c6… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10595057/ permanent mirror: https://passt.top/builds/copr/0^20260611.ga9c61ff/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-ga9c61ff-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0a9c61ff-1_all.deb -- Stefano

1 0

Passt port forwards to guest when host is "offline"
by Niklas Beierl 28 May '26

28 May '26

Hello, I hope I am not violating any mailinglist etiquette. I am not too familiar with this way of communicating and I haven't found a guide for passts list. Please feel free to point me out. I have the following Problem: I have a libvirt VM using passt as usermode networking backend. I set up a port-forward to access a service on the VM. In principle, this setup serves me well. There is just one edge-case that is very unergonomic: When the VM boots while the host (laptop) is offline, the VM get's no IP either and the the port-forward doesn't work since passt has no IP to forward to. 35.2917: ERROR: Flow 0 (INI): No rules to forward HOST TCP [127.0.0.1]:42336 -> [127.0.0.1]:3389 This unfortunately happens quite frequently because I travel a lot. I know this scenario doesn't really have an obvious, well defined solution, because passt is supposed to just make the guest believe it has the same ip as the host and in this case the host has no ip. A few things I have considered: Assigning an additional, static IP to the guest and somehow forcing traffic for it to passt. Not sure if/how this would work. Assigning an additional, static IP on some host interface, hoping passt will pick it up and advertise it via DHCP? Am I missing a more elegant approach? I was also thinking that it would perhaps be cool if passt could make port-forwards for localhost connections work irrespective of whether the host otherwise has network connectivity. Haven't thought it 100% through, but if 127.0.0.1/8 is src and dst of the connection, there is no broken return route on the guest or anything so in theory this should be possible I guess? I'd be happy to bounce ideas back and forth. For reference: The interface definition: <interface type='user'> <mac address='52:54:00:16:63:9f'/> <portForward proto='tcp'> <range start='3389'/> </portForward> <model type='e1000e'/> <backend type='passt' logFile='/tmp/win11passt.log'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> Best Niklas

3 6

passt: new version 2026_05_26.038c51e available
by Stefano Brivio 27 May '26

27 May '26

The new version with tag 2026_05_26.038c51e includes the following changes: 038c51e vhost_user: Offer VIRTIO_NET_F_GUEST_CSUM 196a9e5 ip: Wrap CASE macro body in braces for pre-C23 compatibility da00969 tcp_splice: Simplify tracking of read/written bytes ac9814e tcp_splice: Clean up flow control path for splice forwarding bda8230 tcp_splice: Avoid missing EOF recognition while forwarding aa6b796 tcp_splice: Improve error reporting 21ea343 tcp_vu: Support multibuffer frames in tcp_vu_send_flag() feb9a11 tcp_vu: Support multibuffer frames in tcp_vu_sock_recv() f8cace2 tcp_vu: Build headers on the stack and write them into the iovec 92845dd tcp: Encode checksum computation flags in a single parameter dec66c0 udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() 9361b6b iov: Introduce IOV_PUSH_HEADER() macro 28ee143 udp_vu: Allow virtqueue elements with multiple iovec entries 76fd546 selinux: Allow pasta to create and use its control socket when started by Podman cea2d19 Makefile: Remove misleading comments on BASE_*FLAGS 5038f92 netlink: Fix comments to variables for netlink sockets and sequence d00255b netlink: Use regular request/response netlink socket for initial neighbour sync b64ef53 conf, repair, tap: Document reasons for blocking Unix sockets 5ef0fc4 tap: Report accept() errors 1d16476 treewide: Add SOCK_CLOEXEC to accept() calls that are missing it db798fc vhost-user: Centralise Ethernet frame padding in vu_collect() and vu_pad() de6387a tcp: Pass explicit data length to tcp_fill_headers() d83470f vu_common: Pass explicit frame length to vu_flush() 533ef11 pcap: Pass explicit L2 length to pcap_iov() aa78f63 checksum: Pass explicit L4 length to checksum functions 7cd5afb udp_vu: Pass iov explicitly to helpers instead of using file-scoped array ee0ba3f udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller d3a4868 vu_common: Move vnethdr setup into vu_flush() d7259ea iov: Add iov_memcpy() to copy data between iovec arrays a804574 iov: Introduce iov_memset() bcc3d37 util: Fix changes to assert_with_msg() 296d7e3 fwd_rule: Allow parsing * as a forwarding address 666ef9e fwd_rule: Don't attempt dual stack listen()s if only one IP family 8bb21e3 test: Add test for builds with -DNDEBUG e514945 Fix build with -DNDEBUG fd4b637 test: Extend exeter build tests to cover more recent binaries ab12293 lib/term: Quote tr character ranges to prevent glob expansion 9b1ef47 pesto: Run static checkers on pesto sources bf63970 passt-repair: Run static checkers 3c6e797 passt-repair: Simplify construction of Unix path from inotify 1254a1f passt-repair: Split out inotify handling to its own function a2a2f40 Makefile: Split static checker targets b356b62 cppcheck, clang-tidy: Static checkers don't need non-preprocessor flags fb9be08 Makefile: Split $(FLAGS) into cpp and cc components 88ce87e Makefile: Add header dependencies for secondary binaries 9015b76 Makefile: Remove unhelpful $(HEADERS) variable d4632a4 Makefile: Use common binary compilation rule 59b14b2 Makefile: Make conditional definition of $(BIN) clearer 1cd6276 Makefile: Use make variables for static checker configuration 4de7c38 clang-tidy: Suppress some new unhelpful new warnings 97e478b treewide: Make some additional variables static 90f175d packet, clang-tidy: Packet pool buffers are not NULL 7bafe71 clang-tidy: Suppress sscanf() warning harder a82a217 clang-tidy: Squash inconsistent brace warnings in foreach macros db02221 conf: Fix not-actually-const parameter to conf_runas() and conf_ugid() 5b3ca87 virtio: Reduce scope of variable 1e6b638 netlink: erromsg should be const in nl_status() https://passt.top/passt/log/?qt=range&q=2026_05_07.1afd4ed..2026_05_26.038c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10514454/ permanent mirror: https://passt.top/builds/copr/0^20260526.g038c51e/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g038c51e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_038c51e-1_all.deb -- Stefano

1 0