- user - passt

passt: new version 2024_12_11.09478d5 available
by Stefano Brivio 12 Dec '24

12 Dec '24

The new version with tag 2024_12_11.09478d5 includes the following changes: 09478d5 treewide: Dodge dynamic memory allocation in strerror() from glibc > 2.40 e24f026 pasta: make it possible to disable socket splicing 947f5cd tap: Call vu_init() with --fd 2139ad3 tap: Use a common function to start a new connection 8996d18 udp_vu: update segment size 1908297 flow: Remove over-zealous sanity checks in flow_sidx_hash() 1db4f77 udp: Improve detail of UDP endpoint sanity checking 966fdc8 perf/passt_vu_tcp: Make it shine 020c8b7 tcp_vu: Compute IPv4 header checksum if dlen changes d9c0f8e Makefile: Use make internal string functions b6e79ef tcp_vu: Remove unnecessary tcp_vu_update_check() function a6348ca tcp: Merge tcp_fill_headers[46]() with each other 2abf5ab tcp: Merge tcp_update_check_tcp[46]() 08ea3cc tcp: Pass TCP header and payload separately to tcp_fill_headers[46]() 2ee0769 tcp: Pass TCP header and payload separately to tcp_update_check_tcp[46]() 6715109 iov, checksum: Replace csum_iov() with csum_iov_tail() f931103 iov: iov tail helpers 804a7ce tcp_vu: Change 'dlen' to ssize_t in tcp_vu_data_from_sock() 00cc230 Fix build on 32bit target 6fae899 virtio: check if avail ring is configured 7e131e9 tcp: Move tcp_l2_buf_fill_headers() to tcp_buf.c 676bf54 test: Add tests for passt in vhost-user mode 28997fc vhost-user: add vhost-user b2e62f7 passt: rename tap_sock_init() to tap_backend_init() b7c292b tcp: Export headers functions 5a8b33c udp: Prepare udp.c to be shared with vhost-user 31117b2 vhost-user: introduce vhost-user API 7d1cd4d vhost-user: introduce virtio API dd143e3 packet: replace struct desc by struct iovec https://passt.top/passt/log/?qt=range&q=2024_11_27.c0fbc7e..2024_12_11.0947… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8382137/ permanent mirror: https://passt.top/builds/copr/0^20241211.g09478d5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g09478d5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_09478d5-1_all.deb -- Stefano

1 0

passt: new version 2024_11_27.c0fbc7e available
by Stefano Brivio 27 Nov '24

27 Nov '24

The new version with tag 2024_11_27.c0fbc7e includes the following changes: c0fbc7e dhcp: Honour broadcast flag (RFC 2131, 4.1) 9da2038 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) d6e9e24 dhcp: Use -1 as "missing option" length instead of 0 14b84a7 treewide: Introduce 'local mode' for disconnected setups c6e6106 test: Improve logic for waiting for SLAAC & DAD to complete in NDP tests cda7f16 ndp: Don't send first periodic router advertisement right after guest connects 2bf8ffc test/perf: Select a single IPv6 namespace address in pasta tests 6819b2e conf, passt.1: Update --mac-addr default in usage() and man page b61be84 passt.1: Fix "default" note about --map-guest-addr https://passt.top/passt/log/?qt=range&q=2024_11_21.238c69f..2024_11_27.c0fb… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8318673/ permanent mirror: https://passt.top/builds/copr/0^20241127.gc0fbc7e/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc0fbc7e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c0fbc7e-1_all.deb -- Stefano

1 0

passt: new version 2024_11_21.238c69f available
by Stefano Brivio 21 Nov '24

21 Nov '24

The new version with tag 2024_11_21.238c69f includes the following changes: 238c69f tcp: Acknowledge keep-alive segments, ignore them for the rest af464c4 tcp: Reset ACK_TO_TAP_DUE flag whenever an ACK isn't needed anymore 5ae2184 ndp: Don't send unsolicited RAs if NDP is disabled bf94927 ndp: Don't send unsolicited router advertisement if we can't, yet 5e24466 selinux: Use auth_read_passwd() interface for all our getpwnam() needs 6e1e442 ndp: Send unsolicited Router Advertisements b39760c passt: Seed libc's pseudo random number generator 71d5dee util: Add general low-level random bytes helper a60703e ndp: Make route lifetime a #define 36c070e ndp: Use struct assignment in preference to memcpy() for IPv6 addresses cbc83e1 ndp: Split out helpers for sending specific NDP message types 4e47167 ndp: Add ndp_send() helper 71f228d ndp: Remove redundant update to addr_seen 0588163 cppcheck: Don't check the system headers 14dd70e linux_dep: Fix CLOSE_RANGE_UNSHARE availability handling d64f257 linux_dep: Move close_range() conditional handling to linux_dep.h b84cd05 log: Only check for FALLOC_FL_COLLAPSE_RANGE availability at runtime 58fa550 tap, tcp, util: Add some missing SOCK_CLOEXEC flags 71869e2 passt: Use NOLINT clang-tidy block instead of NOLINTNEXTLINE d4f09c9 util: Define small and big thresholds for socket buffers as unsigned long long 87940f9 tap: Cast TAP_BUF_BYTES - ETH_MAX_MTU to ssize_t, not TAP_BUF_BYTES 1feb90f dhcpv6: Turn some option headers pointers to const 5f5e814 dhcpv6: Use for loop instead of goto to avoid false positive cppcheck warning 78da088 tcp: unify payload and flags l2 frames array 9a0e544 test: Improve test for NDP assigned prefix 910f4f9 test: Don't require 64-bit prefixes in perf tests 1699083 test: Make nstool hold robust against interruptions to control clients b456ee1 test: Rename propagating signal handler 867db07 util: Work around cppcheck bug 6936 6f913b3 udp: Don't dereference uflow before NULL check in udp_reply_sock_handler() d8e05a3 ndp: Use const pointer for ndp_ns packet 0d7b820 linux_dep: Generalise tcp_info.h to handling Linux extension compatibility c5f4e4d fwd: Squash different-signedness comparison warning 1e76a19 util: Remove unused ffsl() function 1d7cff3 clang: Add rudimentary clangd configuration c560e2f Makefile: Don't attempt to auto-detect stack size 13fc6d5 Makefile: Use -DARCH for qrap only 7917159 seccomp: Simplify handling of AUDIT_ARCH 93bce40 Makefile: Move NETNS_RUN_DIR definition to C code c938d8a netlink: RTA_PAYLOAD() returns int, not size_t f6b546c flow: Correct type of flowside_at_sidx() 30b4f88 arch: Avoid explicit access to 'environ' b78e72d clang: Move clang-tidy configuration from Makefile to .clang-tidy 8346216 Makefile: Simplify exclusion of qrap from static checks 8f1b6a0 clang: Add .clang-format file 5e93bcd test: Adjust misplaced sleeps in two_guests code 9afce0b tap: Explicitly cast TUNSETIFF to fix build warning with musl on ppc64le d165d36 tcp: Fix build against musl, __sum16 comes from linux/types.h https://passt.top/passt/log/?qt=range&q=2024_10_30.ee7d0b6..2024_11_21.238c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8293460/ permanent mirror: https://passt.top/builds/copr/0^20241121.g238c69f/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g238c69f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_238c69f-1_all.deb -- Stefano

1 0

Re: Failed to pivot_root() into empty tmpfs
by Stefano Brivio 20 Nov '24

20 Nov '24

On Tue, 19 Nov 2024 07:55:59 +0000 Piotr Bzdręga via user <passt-user(a)passt.top> wrote: > Hei guys, > I cannot register account on https://passt.top/passt/bugs. > I was trying with few e-mails. > I wanted to report bug regarding using pivot_root() in tmpfs. > > [08:47][selkie@buildroot][~] $ podman run -it 88b748efcbb3 > Error: pasta failed with exit code 1: > Couldn't get any nameserver address > Failed to pivot_root() into empty tmpfs: Invalid argument > Failed to sandbox process, exiting > > I saw that pivot_root() can be replace by chroot e.g. done in crun : > https://github.com/containers/crun/blob/83998014c5e8dee84432f6ece34363dbd1c… By the way, this is now tracked at: https://bugs.passt.top/show_bug.cgi?id=104 thanks Piotr! -- Stefano

1 0

Failed to pivot_root() into empty tmpfs
by Piotr Bzdręga 19 Nov '24

19 Nov '24

Hei guys, I cannot register account on https://passt.top/passt/bugs. I was trying with few e-mails. I wanted to report bug regarding using pivot_root() in tmpfs. [08:47][selkie@buildroot][~] $ podman run -it 88b748efcbb3 Error: pasta failed with exit code 1: Couldn't get any nameserver address Failed to pivot_root() into empty tmpfs: Invalid argument Failed to sandbox process, exiting I saw that pivot_root() can be replace by chroot e.g. done in crun : https://github.com/containers/crun/blob/83998014c5e8dee84432f6ece34363dbd1c… Piotr Bzdręga

1 0

passt: new version 2024_10_30.ee7d0b6 available
by Stefano Brivio 30 Oct '24

30 Oct '24

The new version with tag 2024_10_30.ee7d0b6 includes the following changes: ee7d0b6 util: Don't use errno after a successful call in __daemon() b1a607f udp: Take care of cert-int09-c clang-tidy warning for enum udp_iov_idx 099ace6 treewide: Address cert-err33-c clang-tidy warnings for clock and timer functions 59fe34e treewide: Suppress clang-tidy warning if we already use O_CLOEXEC 134b4d5 Makefile: Disable readability-math-missing-parentheses clang-tidy check 7442478 treewide: Silence cert-err33-c clang-tidy warnings for fprintf() 98efe7c treewide: Comply with CERT C rule ERR33-C for snprintf() 988a4d7 Makefile: Exclude qrap.c from clang-tidy checks ba38e67 tcp: unify l2 TCPv4 and TCPv6 queues and structures 2053c36 tcp: set ip and eth headers in l2 tap queues on the fly 5563d5f test: remove obsolete images f43f7d5 tcp: cleanup tcp_buf_data_from_sock() e7fcd0c tcp: Use runtime tests for TCP_INFO fields 8114381 tcp: Generalise probing for tcpi_snd_wnd field 13f0291 tcp: Remove compile-time dependency on struct tcp_info version 9e4615b tcp_splice: fcntl(2) returns the size of the pipe, if F_SETPIPE_SZ succeeds 149f457 tcp_splice: splice() all we have to the writing side, not what we just read 9e5df35 tcp: Use structures to construct initial TCP options b4dace8 fwd: Direct inbound spliced forwards to the guest's external address 58e6d68 test: Clarify test for spliced inbound transfers 1fa4211 passt.1: Clarify and update "Handling of local addresses" section ef8a516 passt.1: Mark --stderr as deprecated more prominently 53176ca test: Wait for DAD on DHCPv6 addresses 75b9c0f test: Explicitly wait for DAD to complete on SLAAC addresses f9d677b arp: Fix a handful of small warts 2d7f734 tcp: Send "empty" handshake ACK before first data segment 7612cb8 test: Pass TRACE from run_term() into ./run from_term b40880c test/lib/term: Always use printf for messages with escape sequences ff63ac9 conf: Add --dns-host option to configure host side nameserver 9d66df9 conf: Add command line switch to enable IP_FREEBIND socket option 151dbe0 udp: Update UDP checksum using an iovec array 3d484aa tcp: Update TCP checksum using an iovec array e6548c6 checksum: Add an offset argument in csum_iov() fd8334b pcap: Add an offset argument in pcap_iov() 72e7d30 tcp: Use tcp_payload_t rather than tcphdr def8acd test: Kernel binary can now be passed via the KERNEL environmental variable b55013b inany: Add inany_pton() helper cbde419 tcp, udp: Make {tcp,udp}_sock_init() take an inany address b8d4fac util, pif: Replace sock_l4() with pif_sock_l4() 204e77c udp: Don't attempt to get dual-stack sockets in nonsensical cases 8f8c4d2 tcp: Allow checksum to be disabled 4fe5f4e udp: Allow checksum to be disabled d836d9e util: Remove possible quadratic behaviour from write_remainder() bfc294b util: Add helper to write() all of a buffer bb41901 tcp: Make tcp_update_seqack_wnd()s force_seq parameter explicitly boolean 265b209 tcp: Simplify ifdef logic in tcp_update_seqack_wnd() 4aff6f9 tcp: Clean up tcpi_snd_wnd probing 7d8804b tcp: Make some extra functions private 5ff5d55 tcp: Avoid overlapping memcpy() in DUP_ACK handling 1f414ed tcp: Remove redundant initialisation of iov[TCP_IOV_ETH].iov_base https://passt.top/passt/log/?qt=range&q=2024_09_06.6b38f07..2024_10_30.ee7d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8189610/ permanent mirror: https://passt.top/builds/copr/0^20241030.gee7d0b6/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gee7d0b6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0ee7d0b6-1_all.deb -- Stefano

1 0

Re: Rootless Podman with VRRP
by David Gibson 19 Sep '24

19 Sep '24

On Mon, Sep 16, 2024 at 02:46:51PM +0000, Castelli, Anton via user wrote: > Date: Mon, 16 Sep 2024 14:46:51 +0000 > From: "Castelli, Anton" <anton.castelli(a)siu.edu> > To: "passt-user(a)passt.top" <passt-user(a)passt.top> > Subject: Rootless Podman with VRRP > List-Id: "For passt users: support, questions and answers" > <passt-user.passt.top> > > I'm trying to get a service in a rootless Podman container (BIND DNS > server) to respond correctly when using VRRP (via keeepalived) on > the host. It seems like Pasta will forward the inbound traffic to > the container from the VRRP address, but the responses will be from > the regular IP address instead of the VRRP address, which causes the > client to ignore the response. I've tried adding Pasta network > options to the container, but the behavior seems to be the same. I'm not familiar with VRRP beyond a quick skim of the wikipedia article just now. I think the (only) relevant thing is that the host has multiple addresses, but it's possible there's some other complexity on the host that I'm not factoring in yet. > OS: Centos Stream 9 > Podman: 5.2.2 > Pasta: 0^20240806.gee36266-2.el9.x86_64-pasta This version includes UDP flow tracking, which fixes some of the worst bugs with UDP forwarding / addressing, but there are still some edge cases as you've discovered. I think I know what's going on here. With TCP, once we accept() a connection, it's local address on the host is part of the accept()ed socket, so we'll always use the same address for reply packets. With UDP, however, this doesn't happen automatically: the local address for replies is controlled by the bound address of the socket we use to send them out. In this instance that will be the same socket as is listening for the incoming requests. I'm assuming that socket will be set to listen to DNS traffic on any address, so it will be bound to 0.0.0.0:53 on the host. That will see the traffic to the VRRP address, but when we go to send the reply the kernel will pick the local address according to its routing tables and it seems it's picking the default address. That is a bug, at least in principle: we should remember the local address for a UDP flow and use the same local address for replies. With the flow table we now have the means of correctly tracking this, however, we haven't implemented this (yet) because it's kind of fiddly: we'd need to use additional getsockopt() calls to determine and control the local address for datagrams on a per-packet basis. > Outside interface: > > ens18 > 10.1.1.1/24 (main IP) > 10.1.1.2/32 (VRRP IP) > > TCPdump shows the problem (note that the reply packet has source as the main IP, not the VRRP IP: > > IP 10.2.2.2.37392 > 10.1.1.2.53: 60211+ [1au] A? www.example.com. (56) > IP 10.1.1.1.53 > 10.2.2.2.37392: 60211*- 1/0/1 A 192.168.254.7 (88) > > Tried starting the container with non-default pasta options, but the result is the same: > > --network pasta:-I,tap0,-o,10.1.1.2,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp Most of those options are not relevant. --dns-forward is set by podman and won't change anything (it's about DNS requests _out_ from the container). Similarly -g, --ipv4-only and the --no-* options are unlikely to be relevant here. -a is also probably not relevant: it controls the guest's address, but this is a host side addressing problem. That said, -a 10.0.2.0 -n 24 is probably not a good idea, since it's setting the guest's address to the network address. -o is the one that you'd think is relevant, since it's supposed to control the outbound local address. The catch here is that while it will control the local address for new sockets we create to handle flows initiated by the guest, here the flow is initiated by the host and so goes through the listening socket, which is still bound to 0.0.0.0:53. > Any help with possible solutions would be greatly appreciated. I believe I have a workaround. The trick here is we want the listening socket to be bound to the VRRP address, this can be done by setting that specific IP for publishing the port so, for example: podman run --publish 10.1.1.2:53:53/udp ... (which should translate to to the pasta option "-u 10.1.1.2/53:53"). The tradeoff for this workaround is that the container will now *only* respond to DNS traffic to the VRRP address, but I'm guessing that might be what you want anyway. You could also explicitly publish any additional addresses you want to respond on. But, longer term, this is a bug that we'd like to fix when we have time. Would you mind filing a ticket on bugs.passt.top so we don't forget it? -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 5

Re: Rootless Podman with VRRP
by Stefano Brivio 17 Sep '24

17 Sep '24

On Tue, 17 Sep 2024 18:53:24 +0000 "Castelli, Anton" <anton.castelli(a)siu.edu> wrote: > Stefano, > > I've encountered an error when trying to submit the bug report. I tried twice with the same result. See attached screenshot. Sorry, my bad. Can you please try again? -- Stefano

2 1

Re: Rootless Podman with VRRP
by Stefano Brivio 17 Sep '24

17 Sep '24

Hi Anton, On Tue, 17 Sep 2024 15:22:04 +0000 "Castelli, Anton via user" <passt-user(a)passt.top> wrote: > I will be happy to submit a bug report. Unfortunately, I'm having > trouble getting signed up. I've tried to send the new account email > to both my work email address and a personal Gmail address. I have > not received the email in either case (I've checked the spam folders > too). You should have the email now, I'm currently reviewing subscription requests manually because of an influx of malicious automated requests. -- Stefano

2 1

Rootless Podman with VRRP
by Castelli, Anton 16 Sep '24

16 Sep '24

I'm trying to get a service in a rootless Podman container (BIND DNS server) to respond correctly when using VRRP (via keeepalived) on the host. It seems like Pasta will forward the inbound traffic to the container from the VRRP address, but the responses will be from the regular IP address instead of the VRRP address, which causes the client to ignore the response. I've tried adding Pasta network options to the container, but the behavior seems to be the same. OS: Centos Stream 9 Podman: 5.2.2 Pasta: 0^20240806.gee36266-2.el9.x86_64-pasta Outside interface: ens18 10.1.1.1/24 (main IP) 10.1.1.2/32 (VRRP IP) TCPdump shows the problem (note that the reply packet has source as the main IP, not the VRRP IP: IP 10.2.2.2.37392 > 10.1.1.2.53: 60211+ [1au] A? www.example.com. (56) IP 10.1.1.1.53 > 10.2.2.2.37392: 60211*- 1/0/1 A 192.168.254.7 (88) Tried starting the container with non-default pasta options, but the result is the same: --network pasta:-I,tap0,-o,10.1.1.2,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp Any help with possible solutions would be greatly appreciated. Thanks, -- ANTON CASTELLI Network Engineer V OFFICE OF INFORMATION TECHNOLOGY MAIL CODE 4622 SOUTHERN ILLINOIS UNIVERSITY 625 WHAM DRIVE ROOM B15 CARBONDALE, ILLINOIS 62901 anton.castelli(a)siu.edu P: 618.453.6424 OIT.SIU.EDU

1 0

2024

2023

2022

2021

user