- user - passt

passt: new version 2023_08_23.a7e4bfb available
by Stefano Brivio 23 Aug '23

23 Aug '23

The new version with tag 2023_08_23.a7e4bfb includes the following changes: a7e4bfb pasta: Strip RTA_PREFSRC when copying routes to the namespace 5e4f7b9 netlink: Set IFA_ADDRESS, not just IFA_LOCAL, while adding IPv4 addresses 69303ca tcp: Remove broken pressure calculations for tcp_defer_handler() eb8fbdb inany: Add missing double include guard to inany.h b60fa33 tcp: Move in_epoll flag out of common connection structure 955dd32 tcp, udp: Don't pre-fill IPv4 … [View More]

1 0

passt: new version 2023_08_18.0af928e available
by Stefano Brivio 20 Aug '23

20 Aug '23

The new version with tag 2023_08_18.0af928e includes the following changes: 0af928e selinux: Fix domain transitions for typical commands pasta might run 30817fd selinux: Allow pasta_t to read nsfs entries 9776521 selinux: Add rules for sysctl and /proc/net accesses 56b8633 selinux: Update policy to fix user/group settings 6205905 selinux: Fix user namespace creation after breaking kernel change 0c42326 selinux: Use explicit paths for binaries in file context 479a9e1 … [View More]fedora: Install pasta as hard link to ensure SELinux file context match 5f1fcff tap: Fix format specifier in tap4_is_fragment() warning da0aeb9 netlink: Don't propagate host address expiry to the container b4f8ffd netlink: Correctly calculate attribute length for address messages 4b9f4c2 netlink: Remove redundant check on nlmsg_type 5ed4e03 conf: Demote overlapping port ranges error to a warning ae5f6c8 epoll: Use different epoll types for passt and pasta tap fds eda4f19 epoll: Split listening Unix domain socket into its own type 485b5fb epoll: Split handling of listening TCP sockets into their own handler e6f81e5 epoll: Split handling of TCP timerfds into its own handler function 8271a2e epoll: Tiny cleanup to udp_sock_handler() 05f606a epoll: Split handling of ICMP and ICMPv6 sockets d850caa epoll: Fold sock_handler into general switch on epoll event fd 6a6735e epoll: Always use epoll_ref for the epoll data variable 3401644 epoll: Generalize epoll_ref to cover things other than sockets e26282b tap: Fold reset handling into tap_handler_passt() 0d870c5 tap: Fold reset handling into tap_handler_pasta() 548e05f tap: Clean up behaviour for errors on listening Unix socket 28877b0 tap: Clean up tap reset path b2bea00 tap: fix seq->p.count limit 02b30e7 netlink: Propagate errors for "dup" operations 5103811 netlink: Propagate errors for "dump" operations 4d6e9d0 netlink: Always process all responses to a netlink request 8de9805 netlink: Propagate errors for "set" operations a309318 netlink: Add nl_foreach_oftype to filter response message types 99ddd7c netlink: Split nl_req() to allow processing multiple response datagrams 8ec757d netlink: Clearer reasoning about the netlink response buffer size 9d4ab98 netlink: Add nl_do() helper for simple operations with error checking 282581b netlink: Fill in netlink header fields from nl_req() f62600b netlink: Treat send() or recv() errors as fatal 0a568c8 netlink: Start sequence number from 1 instead of 0 dee7594 netlink: Make nl_*_dup() use a separate datagram for each request 576df71 netlink: Explicitly pass netlink sockets to operations cfe7509 netlink: Use struct in_addr for IPv4 addresses, not bare uint32_t 257a6b0 netlink: Split nl_route() into separate operation functions eff3bcb netlink: Split nl_addr() into separate operation functions e96182e netlink: Split up functionality of nl_link() 0cf7bf3 tap: Remove unnecessary global tun_ns_fd 7bc9b66 tap: More detailed error reporting in tap_ns_tun() 6920add util: Make ns_enter() a void function and report setns() errors b15ce5b Use static assertion to verify that union epoll_ref is the right size 8218d99 Use C11 anonymous members to make poll refs less verbose to use 649068a Allow C11 code, not just C99 code 023d684 Revert "MAKE: Fix parallel builds; .o files; .gitignore; new makedocs" cc2a6be MAKE: Fix parallel builds; .o files; .gitignore; new makedocs e01759e tap: Explicitly drop IPv4 fragments, and give a warning 4c98d3b conf: Correct length checking of interface names in conf_ports() c4017cc conf: Fix size checking of -I interface name https://passt.top/passt/log/?qt=range&q=2023_06_27.289301b..2023_08_18.0af9… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6317140/ permanent mirror: https://passt.top/builds/copr/0^20230818.g0af928e/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g0af928e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0af928e-1_all.deb -- Stefano [View Less]

1 0

Pasta-networked rootless Podman container gets Connection Refused with the host's public IP
by jklaiho＠iki.fi 28 Jun '23

28 Jun '23

Hi; I previously asked this on the Podman mailing list, but I'm not sure if the issue in question is a feature of Podman or Passt (or both), and I got no replies from the Podman list, so I figured I'd try here as well. We're running some rootless Podman containers set up to use Pasta 2023_03_29.b10b983 for networking. One of the containers needs to access the host machine port 443 with its public IP address, but this causes a Connection Refused error. Any other public IP is accessible normally.… [View More]

3 2

passt: new version 2023_06_27.289301b available
by Stefano Brivio 27 Jun '23

27 Jun '23

The new version with tag 2023_06_27.289301b includes the following change: 289301b netlink: Use correct interface index in NL_SET mode https://passt.top/passt/log/?qt=range&q=2023_06_25.32660ce..2023_06_27.2893… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, … [View More]

1 0

passt: new version 2023_06_25.32660ce available
by Stefano Brivio 26 Jun '23

26 Jun '23

The new version with tag 2023_06_25.32660ce includes the following changes: 32660ce pasta: include errno in error message 594dce6 isolation: keep CAP_SYS_PTRACE when required 5b646b9 conf: Accept -a and -g without --config-net in pasta mode d034fb6 conf: Make -a/--address really imply --no-copy-addrs db29fd2 seccomp: Make seccomp.sh re-entrancy safe 3c6d1b9 conf, log: On -h / --help, print usage to stdout, not stderr d072ac2 tap: With pasta, don't reset on tap … [View More]

1 0

passt: new version 2023_06_03.429e1a7 available
by Stefano Brivio 03 Jun '23

03 Jun '23

The new version with tag 2023_06_03.429e1a7 includes the following changes: 429e1a7 conf: Fix erroneous check of ip6->gw e3b1953 test/nstool: Fix fd leak in accept() loop 527c822 test/nstool: Provide useful error if given a path that's too long 9f61c5b passt.h: Fix description of pasta_ifi in struct ctx cc9d167 conf, pasta: With --config-net, copy all addresses by default e89da3c netlink: Add functionality to copy addresses from outer namespace a7359f0 conf: Don'… [View More]

1 0

IPv6 UDP not working
by Juan Orti 29 May '23

29 May '23

Hi, I'm testing a DNS server in a rootless container using pasta, and I have seen that the IPv6 UDP packets are not reaching the service: $ dig www.google.com @fddc:f797:78ef:70::5 +short ;; communications error to fddc:f797:78ef:70::5#53: timed out ;; communications error to fddc:f797:78ef:70::5#53: timed out ;; communications error to fddc:f797:78ef:70::5#53: timed out ; <<>> DiG 9.18.15 <<>> www.google.com @fddc:f797:78ef:70::5 +short ;; global options: +cmd ;; no … [View More]

3 6

passt: new version 2023_05_09.96f8d55 available
by Stefano Brivio 10 May '23

10 May '23

The new version with tag 2023_05_09.96f8d55 includes the following changes: 96f8d55 correct -6 option in manpage 940bd3e passt: Fix error check for signal(), improve error messages 1a3ade9 nstool: Enter holder's cwd when changing mount ns with nstool exec 98031be nstool: Advertise the holder's cwd (in its mountns) across the socket 469b69a test: Use "nstool exec" to slightly simplify tests 3372cd0 test: Initialise ${TRACE} properly 329149d nstool: Add --keep-caps … [View More]

1 0

passt: new version 2023_03_29.b10b983 available
by Stefano Brivio 30 Mar '23

30 Mar '23

The new version with tag 2023_03_29.b10b983 includes the following changes: b10b983 fedora: Adjust path for SELinux policy and interface file to latest guidelines 387f4ac fedora: Don't install useless SELinux interface file for pasta dafd92d selinux: Drop useless interface file for pasta 98a9a7d conf: Allow binding to ports on an interface without a specific address 33d88f7 tcp: Clear ACK_FROM_TAP_DUE also on unchanged ACK sequence from peer 4e73e9b tcp: Don't special … [View More]

1 0

Failed to open tun socket in namespace
by Gianluca Stivan 27 Mar '23

27 Mar '23

Hi, Thank you so much for this project! I'm running a rootless container using pasta. Everything works great but after a while (anything from minutes to hours) I see the error "Failed to open tun socket in namespace" in my systemd logs, and my container loses access to the internet. Do you happen to have any idea how I would go about debugging this? Thanks a lot in advance :) PS: I'm running pasta from podman with arguments --map-gw,--dns,<my-dns>,-i,wlan0,--outbound-if4,wireguard0,--outbound-if6,wireguard0,--config-net

2 4