- user - passt

IPv6 UDP not working
by Juan Orti 29 May '23

29 May '23

Hi, I'm testing a DNS server in a rootless container using pasta, and I have seen that the IPv6 UDP packets are not reaching the service: $ dig www.google.com @fddc:f797:78ef:70::5 +short ;; communications error to fddc:f797:78ef:70::5#53: timed out ;; communications error to fddc:f797:78ef:70::5#53: timed out ;; communications error to fddc:f797:78ef:70::5#53: timed out ; <<>> DiG 9.18.15 <<>> www.google.com @fddc:f797:78ef:70::5 +short ;; global options: +cmd ;; no servers could be reached TCP over IPv6 and UDP, TCP over IPv4 works fine: $ dig www.google.com @fddc:f797:78ef:70::5 +short +tcp 216.239.38.120 $ dig www.google.com @192.168.7.5 +short 216.239.38.120 $ dig www.google.com @192.168.7.5 +short +tcp216.239.38.120 The pasta process is running with these arguments: /usr/bin/pasta --config-net -u 53-53:53-53 -t 53-53:53-53 -t 3003-3003:3003-3003 -T none -U none --no-map-gw --netns /run/user/1002/netns/netns-378b62b8-bf27-3b51-1fb1-e2ebb7119647 I'm using passt-0^20230509.g96f8d55-1.fc38.x86_64 from Fedora CoreOS 38. Is this a known bug? or am I doing something wrong? Thank you.

3 6

passt: new version 2023_05_09.96f8d55 available
by Stefano Brivio 10 May '23

10 May '23

The new version with tag 2023_05_09.96f8d55 includes the following changes: 96f8d55 correct -6 option in manpage 940bd3e passt: Fix error check for signal(), improve error messages 1a3ade9 nstool: Enter holder's cwd when changing mount ns with nstool exec 98031be nstool: Advertise the holder's cwd (in its mountns) across the socket 469b69a test: Use "nstool exec" to slightly simplify tests 3372cd0 test: Initialise ${TRACE} properly 329149d nstool: Add --keep-caps option to nstool exec 0b66944 nstool: Add nstool exec command to execute commands in an nstool namespace 3bcbca5 nstool: Helpers to iterate through namespace types f6a9ea3 nstool: Add magic number to advertized information 4311066 nstool: Detect what namespaces target is in fd4a752 nstool: Replace "pid" subcommand with "info" subcommand a4b017d nstool: Split some command line parsing and socket setup to subcommands 42fb218 nstool: Move description of its operation modes from comment to usage 2884ccd nstool: Reverse parameters to nstool 4914fce nstool: Rename nsholder to nstool 55bbe3d test: Remove race between commands run in the same context ca2749e passt: Relicense to GPL 2.0, or any later version https://passt.top/passt/log/?qt=range&q=2023_03_29.b10b983..2023_05_09.96f8… Note that this is the first GPLv2+ version of passt, changing from AGPLv3+. Packages: - Arch Linux AUR: https://aur.archlinux.org/packages/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5906538/ permanent mirror: https://passt.top/builds/copr/0^20230509.g96f8d55/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g96f8d55-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_96f8d55-1_all.deb -- Stefano

1 0

passt: new version 2023_03_29.b10b983 available
by Stefano Brivio 30 Mar '23

30 Mar '23

The new version with tag 2023_03_29.b10b983 includes the following changes: b10b983 fedora: Adjust path for SELinux policy and interface file to latest guidelines 387f4ac fedora: Don't install useless SELinux interface file for pasta dafd92d selinux: Drop useless interface file for pasta 98a9a7d conf: Allow binding to ports on an interface without a specific address 33d88f7 tcp: Clear ACK_FROM_TAP_DUE also on unchanged ACK sequence from peer 4e73e9b tcp: Don't special case the handling of the ack of a syn 085672f tcp: Clarify allowed state for tcp_data_from_tap() https://passt.top/passt/log/?qt=range&q=2023_03_21.1ee2f7c..2023_03_29.b10b… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5727640/ permanent mirror: https://passt.top/builds/copr/0^20230329.gb10b983/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g02130bb-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_02130bb-1_all.deb -- Stefano

1 0

Failed to open tun socket in namespace
by Gianluca Stivan 27 Mar '23

27 Mar '23

Hi, Thank you so much for this project! I'm running a rootless container using pasta. Everything works great but after a while (anything from minutes to hours) I see the error "Failed to open tun socket in namespace" in my systemd logs, and my container loses access to the internet. Do you happen to have any idea how I would go about debugging this? Thanks a lot in advance :) PS: I'm running pasta from podman with arguments --map-gw,--dns,<my-dns>,-i,wlan0,--outbound-if4,wireguard0,--outbound-if6,wireguard0,--config-net

2 4

passt: new version 2023_03_21.1ee2f7c available
by Stefano Brivio 22 Mar '23

22 Mar '23

The new version with tag 2023_03_21.1ee2f7c includes the following changes: 1ee2f7c tcp: Don't reset ACK_TO_TAP_DUE on any ACK, reschedule timer as needed 9ffccf7 tcp: When a connection flag it set, don't negate it for debug print 89d1494 Fix false positive if cppcheck doesn't give a false positive 34ade90 Work around weird false positives with cppcheck-2.9.1 ccf6d2a udp: Actually bind detected namespace ports in init namespace 418f75a pasta: fix tcp port forwarding in auto mode https://passt.top/passt/log/?qt=range&q=2023_03_17.dd23496..2023_03_21.1ee2… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5694155/ permanent mirror: https://passt.top/builds/copr/0^20230321.g1ee2f7c/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1ee2f7c-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1ee2f7c-1_all.deb -- Stefano

1 0

passt: new version 2023_03_17.dd23496 available
by Stefano Brivio 17 Mar '23

17 Mar '23

The new version with tag 2023_03_17.dd23496 includes the following changes: dd23496 fedora: Refresh SELinux labels in scriptlets, require -selinux package 87a6550 Makefile: Enable external override for TARGET 7727804 passt.1: Fix description of --mtu option 4e6178f log: Avoid time_t/__syscall_slong_t format mismatch with long int on X32 ABI https://passt.top/passt/log/?qt=range&q=2023_03_10.70c0765..2023_03_17.dd23… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5653690/ permanent mirror: https://passt.top/builds/copr/0^20230317.gdd23496/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdd23496-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0dd23496-1_all.deb -- Stefano

1 0

passt: new version 2023_03_09.7c7625d available
by Stefano Brivio 09 Mar '23

09 Mar '23

The new version with tag 2023_03_09.7c7625d includes the following changes: 7c7625d README: Update Features section, plus minor improvements 294d6dc contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0 42fb625 contrib: Drop QEMU out-of-tree patches f3cd0f9 contrib: Drop Podman out-of-tree patch, integration is upstream now d7272f1 tcp: Clamp MSS value when queueing data to tap, also for pasta bb2b67c conf: Terminate on EMFILE or ENFILE on sockets for port mapping 5aea2f8 tcp, udp: Fix partial success return codes in {tcp,udp}_sock_init() 73992c4 tcp, udp, util: Pass socket creation errors all the way up 5068761 util: Carry own definition of __bswap_constant{16,32} 89e38f5 treewide: Fix header includes to build with musl 5c58fea conf, passt: Rename stderr to force_stderr fde8004 netlink: Use 8 KiB * netlink message header size as response buffer a9c59dd conf, icmp, tcp, udp: Add options to bind to outbound address and interface 70148ce conf, passt.h: Rename "outbound" interface to "template" interface d361fe6 contrib/selinux: Let interface users set paths for log, PID, socket files de9b0cb contrib/selinux: Allow binding and connecting to all UDP and TCP ports 41bc669 contrib/selinux: Let passt write to stdout and stderr when it starts 009af75 contrib/selinux: Drop duplicate init_daemon_domain() rule 8323621 udp: Fix signedness warning on 32-bits architectures f6b6b66 Makefile: Fix SuperH 4 builds: it's AUDIT_ARCH_SH, not AUDIT_ARCH_SH4 0d8c114 Makefile, seccomp.sh: Fix cross-builds, adjust syscalls list to compiler https://passt.top/passt/log/?qt=range&q=2023_02_27.c538ee8..2023_03_09.7c76… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5617634/ permanent mirror: https://passt.top/builds/copr/0^20230309.g7c7625d/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g7c7625d-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_7c7625d-1_all.deb -- Stefano

1 0

passt: new version 2023_02_27.c538ee8 available
by Stefano Brivio 27 Feb '23

27 Feb '23

The new version with tag 2023_02_27.c538ee8 includes the following changes: c538ee8 util: Add own prototype for __clone2() on ia64 b1b75bd contrib/apparmor: Split profile into abstractions, use them 0d547a5 qrap: Generate -netdev as JSON 4f2341f qrap: Introduce machine-specific PCI address base 8828a63 qrap: Drop args in JSON format 16f19c8 qrap: Fix support for pc machines 9cec430 qrap: Fix limits for PCI addresses d2df763 log, conf, tap: Define die() as err() plus exit(), drop cppcheck workarounds fb05a71 doc/demo: Fix and suppress ShellCheck warnings 26a0e4d Fix definitions of SOCKET_MAX, TCP_MAX_CONNS 4f523c3 tcp: Avoid (theoretical) resource leak (CWE-772) Coverity warning a1d5537 tcp: Avoid false (but convoluted) positive Coverity CWE-476 warning 5474bc5 tcp, tcp_splice: Get rid of false positive CWE-394 Coverity warning from fls() a48c5c2 treewide: Disable gcc strict aliasing rules as needed, drop workarounds da46fda tcp: Suppress knownConditionTrueFalse cppcheck false positive 834b9a3 log: Send identifier string in log messages, openlog() won't work for us bad2526 conf, udp: Allow any loopback address to be used as resolver 8ca907a conf: Split add_dns{4,6}() out of get_dns() ddf7097 udp: Actually use host resolver to forward DNS queries https://passt.top/passt/log/?qt=range&q=2023_02_22.4ddbcb9..2023_02_27.c538… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5574807/ permanent mirror: https://passt.top/builds/copr/0^20230227.gc538ee8/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc538ee8-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c538ee8-1_all.deb -- Stefano

1 0

new version 2023_02_22.4ddbcb9 available
by Stefano Brivio 22 Feb '23

22 Feb '23

The new version with tag 2023_02_22.4ddbcb9 includes the following changes: 4ddbcb9 tcp: Disable optimisations for tcp_hash() 933aa10 selinux/passt.te: Allow setting socket option on routing netlink socket 0c11355 selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed 7d9150d selinux/passt.te: Allow setcap on the process itself 01801b1 selinux: Switch to a more reasonable model for PID and socket files 4902447 selinux: Define interfaces for libvirt and similar frameworks 9136f74 selinux/passt.if: Fix typo in passt_read_data interface definition https://passt.top/passt/log/?qt=range&q=2023_02_16.4663ccc..2023_02_22.4ddb… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5556988/ permanent mirror: https://passt.top/builds/copr/0^20230222.g4ddbcb9/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4663ccc-1_all.deb - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g4663ccc-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4663ccc-1_all.deb -- Stefano

1 0

passt: new version 2023_02_16.4663ccc available
by Stefano Brivio 17 Feb '23

17 Feb '23

The new version with tag 2023_02_16.4663ccc includes the following changes: 4663ccc conf: Fix typo and logic in conf_ports() check for port binding 36f0199 conf, tap: Silence two false positive invalidFunctionArg from cppcheck 89e0fbf tcp: Remove 'zero_len' goto from tcp_data_from_sock 83b2061 tcp: Remove 'recvmsg' goto from tcp_data_from_sock 42bfd21 tap: Eliminate goto from tap_handler() b62ed9c tap: Don't pcap frames that didn't get sent d957796 passt.1: Fix typo, improve wording in examples of port forwarding specifiers 77a6d97 dhcp: Fix netmask calculation for option 1 from prefix length 7564b58 tap: Use single counter for iov elements in tap_send_frames_pasta() 3d0de2c conf, tcp, udp: Exit if we fail to bind sockets for all given ports b4f13c2 log: Don't duplicate messages on stderr before daemonising c9af6f9 convert all remaining err() followed by exit() to die() a1ab1ca log a detailed error (not usage()) when there are extra non-option arguments 60bd93e make conf_netns_opt() exit immediately after logging error ead4a98 make conf_ugid() exit immediately after logging error fe2a54e make conf_pasta_ns() exit immediately after logging error b20fe11 make conf_ports() exit immediately after logging error c864c60 eliminate most calls to usage() in conf() dac4af8 add die() to log an error message and exit with a single call 193385b log to stderr until process is daemonized, even if a log file is set dccc2ff test: Fedora 32-35 have moved to the archives 64325a0 test: Update location for Debian ppc64 images 6ccab72 tcp: Improve handling of fallback if socket pool is empty on new splice dc467d5 tcp: Split pool lookup from creating new sockets in tcp_conn_new_sock() 912d37c tcp: Move socket pool declarations around c899347 tcp: Split init and ns cases for tcp_sock_refill() e456c1c tcp: Make a helper to refill each socket pool ee8353c Makefile: Explict int type in FALLOC_FL_COLLAPSE_RANGE probe 67920b8 test/pasta_options: Ignore failures on shell 'exit' a234407 pasta: propagate exit code from child command 04dfc5b pasta: correctly exit when execvp() fails 3487b5f pasta: do not leak netlink sock into child 7a8ed94 Make assertions actually useful cc6d828 tcp: Reset ACK_FROM_TAP_DUE flag only as needed, update timer ac15359 tap: Send frames after the first one in tap_send_frames_pasta() d8921da pasta: Wait for tap to be set up before spawning command 54502cc udp: Use tap_send_frames() 2d553b5 tap: Improve handling of partial frame sends 97d1ca2 udp: Use abstracted tap header 0fb7b2b tap: Use different io vector bases depending on tap type 2416310 tcp: Use abstracted tap header 4b3d38a tap: Add "tap headers" abstraction e4443ba tcp: Consolidate calculation of total frame size dcea260 tcp: Remove redundant and incorrect initialization from *_iov_init() 716a926 util: Parameterize ethernet header initializer macro 67afaab tcp, udp: Use named field initializers in iov_init functions f5a9501 util: Introduce hton*_constant() in place of #ifdefs 6d011c1 tap, tcp: Move tap send path to tap.c e21ee41 tcp: Combine two parts of pasta tap send path together a79e774 tcp: Improve interface to tcp_l2_buf_flush() f1d2d35 tcp: Don't compute total bytes in a message until we need it 99f0be3 tcp: Combine two parts of passt tap send path together d3089eb pcap: Replace pcapm() with pcap_multiple() cb3c1ce pcap: Introduce pcap_frame() helper b93d025 udp: Don't use separate sockets to listen for spliced packets 8d503e8 udp: Decide whether to "splice" per datagram rather than per socket 8a10f23 udp: Unify udp_sock_handler_splice() with udp_sock_handler() f1ed8db udp: Pre-populate msg_names with local address c9e193b udp: Don't handle tap receive batch size calculation within a #define 4eb54fd udp: Split receive from preparation and send in udp_sock_handler() 09c00f1 udp: Split sending to passt tap interface into separate function a6e919a udp: Move sending pasta tap frames to the end of udp_sock_handler() c196953 test/perf/pasta_tcp: Add host to namespace cases for traffic via tap 37f82cc tcp: Explicitly check option length field values in tcp_opt_get() 08c01f5 test/perf/pasta_udp: Add host to namespace cases for traffic via tap 310bdbd udp: Factor out control structure management from udp_sock_fill_data_v[46] https://passt.top/passt/log/?qt=range&q=2022_11_16.ace074c..2023_02_16.4663… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5536686/ permanent mirror: https://passt.top/builds/copr/0^20230216.g4663ccc/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4663ccc-1_all.deb - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g4663ccc-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4663ccc-1_all.deb -- Stefano

1 0