- user - passt

Rootless Podman with VRRP
by Castelli, Anton 16 Sep '24

16 Sep '24

I'm trying to get a service in a rootless Podman container (BIND DNS server) to respond correctly when using VRRP (via keeepalived) on the host. It seems like Pasta will forward the inbound traffic to the container from the VRRP address, but the responses will be from the regular IP address instead of the VRRP address, which causes the client to ignore the response. I've tried adding Pasta network options to the container, but the behavior seems to be the same. OS: Centos Stream 9 Podman: 5.2.2 Pasta: 0^20240806.gee36266-2.el9.x86_64-pasta Outside interface: ens18 10.1.1.1/24 (main IP) 10.1.1.2/32 (VRRP IP) TCPdump shows the problem (note that the reply packet has source as the main IP, not the VRRP IP: IP 10.2.2.2.37392 > 10.1.1.2.53: 60211+ [1au] A? www.example.com. (56) IP 10.1.1.1.53 > 10.2.2.2.37392: 60211*- 1/0/1 A 192.168.254.7 (88) Tried starting the container with non-default pasta options, but the result is the same: --network pasta:-I,tap0,-o,10.1.1.2,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns-forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp Any help with possible solutions would be greatly appreciated. Thanks, -- ANTON CASTELLI Network Engineer V OFFICE OF INFORMATION TECHNOLOGY MAIL CODE 4622 SOUTHERN ILLINOIS UNIVERSITY 625 WHAM DRIVE ROOM B15 CARBONDALE, ILLINOIS 62901 anton.castelli(a)siu.edu P: 618.453.6424 OIT.SIU.EDU

1 0

passt: new version 2024_09_06.6b38f07 available
by Stefano Brivio 06 Sep '24

06 Sep '24

The new version with tag 2024_09_06.6b38f07 includes the following changes: 6b38f07 apparmor: Allow read access to /proc/sys/net/ipv4/ip_local_port_range 116bc82 selinux: Allow read access to /proc/sys/net/ipv4/ip_local_port_range a33ecaf tap: Don't risk truncating frames on full buffer in tap_pasta_input() d2a1dc7 tap: Restructure in tap_pasta_input() 11e2905 tap: Improve handling of EINTR in tap_passt_input() 49fc4e0 tap: Split out handling of EPOLLIN events 63513e5 util: Fix order of operands and carry of one second in timespec_diff_us() 748ef4c cppcheck: Work around some cppcheck 2.15.0 redundantInitialization warnings afedc24 tcp: Use EPOLLET for any state of not established connections aff5a49 udp: Handle more error conditions in udp_sock_errs() bd99f02 udp: Treat errors getting errors as unrecoverable bd092ca udp: Split socket error handling out from udp_sock_recv() 88bfa38 flow: Helpers to log details of a flow 1166401 udp: Allow UDP flows to be prematurely closed 7ad9f9b flow: Fix incorrect hash probe in flowside_lookup() 0ea60e5 log: Don't prefix log file messages with time and severity if they're continuations 3836396 Makefile: Enable _FORTIFY_SOURCE iff needed eedc81b fwd, conf: Probe host's ephemeral ports 4a41dc5 conf, fwd: Don't attempt to forward port 0 1daf6f4 conf, fwd: Make ephemeral port logic more flexible 712ca32 seccomp.sh: Try to account for terminal width while formatting list of system calls e0be6bc udp: Use dual stack sockets for port forwarding when possible c78b194 udp: Remove unnnecessary local from udp_sock_init() 620e19a udp: Merge udp[46]_mh_recv arrays 418feb3 test: Look for possible sshd-session paths (if it's there at all) in mbuto's profile https://passt.top/passt/log/?qt=range&q=2024_08_21.1d6142f..2024_09_06.6b38… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7989588/ permanent mirror: https://passt.top/builds/copr/0^20240906.g6b38f07/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g6b38f07-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_6b38f07-1_all.deb -- Stefano

1 0

passt: new version 2024_08_21.1d6142f available
by Stefano Brivio 21 Aug '24

21 Aug '24

The new version with tag 2024_08_21.1d6142f includes the following changes: 1d6142f README: pasta is indeed a supported back-end for rootless Docker f00ebda util: Don't stop on unrelated values when looking for --fd in close_open_files() 05453ea test: Update list of dependencies in README.md 1a66806 tcp, udp: Allow timerfd_gettime64() and recvmmsg_time64() on arm (armhf) 6e9ecf5 util: Provide own version of close_range(), and no-op fallback 7291b70 udp_flow: Add missing unistd.h include for close() 3963075 test: Duplicate existing recvfrom() valgrind suppression for recv() d6817b3 test/passt.mbuto: Install sshd-session OpenSSH's split process 34be8ee test/passt.mbuto: Run sshd from vsock proxy with absolute path aded2b6 test/lib/setup: Transform i686 kernel architecture name into QEMU name (i386) 2aea1da treewide: Allow additional system calls for i386/i686 57b7bd2 fwd, conf: Allow NAT of the guest's assigned address 8436c0d fwd: Distinguish translatable from untranslatable addresses on inbound e813a4d conf: Allow address remapped to host to be configured dbaaebb test: Reconfigure IPv6 address after changing MTU 935bd81 conf, fwd: Split notion of gateway/router from guest-visible host address 90e83d5 Don't take "our" MAC address from the host 356de97 fwd: Split notion of "our tap address" from gateway for IPv4 4d8dd1f fwd: Helpers to clarify what host addresses aren't guest accessible 975cfa5 Initialise our_tap_ll to ip6.gw when suitable 8d4baa4 Clarify which addresses in ip[46]_ctx are meaningful where a42fb9c treewide: Change misleading 'addr_ll' name c9f0ec3 util: Correct sock_l4() binding for link local addresses 57532f1 conf: Remove incorrect initialisation of addr_ll_seen 0b25cac conf: Treat --dns addresses as guest visible addresses a6066f4 conf: Correct setting of dns_match address in add_dns6() 7c083ee conf: Move adding of a nameserver from resolv.conf into subfunction 1d10760 conf: Move DNS array bounds checks into add_dns[46] 6852bd0 conf: More accurately count entries added in get_dns() c679894 conf: Use array indices rather than pointers for DNS array slots ceea52c treewide: Use struct assignment instead of memcpy() for IP addresses 905ecd2 treewide: Rename MAC address fields for clarity 066e699 util: Helper for formatting MAC addresses e6feb5a treewide: Use "our address" instead of "forwarding address" 32c3868 netlink: Fix typo in function comment for nl_addr_set() f4e9f26 pasta: Disable neighbour solicitations on device up to prevent DAD d6f0220 netlink, pasta: Fetch link-local address from namespace interface once it's up 74e508c netlink, pasta: Disable DAD for link-local addresses on namespace interface 0c74068 netlink, pasta: Turn nl_link_up() into a generic function to set link flags 8231ce5 netlink, pasta: Split MTU setting functionality out of nl_link_up() b91d337 netlink: Fix typo in function comment for nl_addr_get() 9462064 test: Speed up by cutting on eye candy and performance test duration https://passt.top/passt/log/?qt=range&q=2024_08_14.61c0b0d..2024_08_21.1d61… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): ...nope, see https://github.com/fedora-copr/copr/issues/3380 - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1d6142f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1d6142f-1_all.deb -- Stefano

1 0

Pasta 20240726 and newer crash with ASSERTION FAILED in flow_hash
by Matt Hamilton 14 Aug '24

14 Aug '24

I am using Podman in Fedora 40, which uses pasta by default for rootless container networking. Fedora 40's base version of passt is `passt-0^20240326.g4988e2b-1.fc40`, but recently two newer versions were released, `passt-0^20240726.g57a21d2-1.fc40` and `0^20240806.gee36266-1.fc40`. After upgrading, one pod kept going offline after a few minutes. The containers remained running, but could not make outbound connections. Journalctl revealed that the pasta process for the pod had crashed with: Aug 08 23:07:55 dev pasta[95859]: ASSERTION FAILED in flow_hash (flow.c:566): pif != PIF_NONE && !inany_is_unspecified(&side->eaddr) && side->eport != 0 && side->fport != 0 Aug 08 23:07:55 dev audit[95859]: SECCOMP auid=1000 uid=1000 gid=1000 ses=1 subj=unconfined_u:unconfined_r:container_runtime_t:s0-s0:c0.c1023 pid=95859 comm="pasta.avx2" exe="/usr/bin/pasta.avx2" sig=31 arch=c000003e syscall=186 compat=0 ip=0x7f8f8c23b64f code=0x80000000 Aug 08 23:07:55 dev audit[95859]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=1 subj=unconfined_u:unconfined_r:container_runtime_t:s0-s0:c0.c1023 pid=95859 comm="pasta.avx2" exe="/usr/bin/pasta.avx2" sig=31 res=1 After much debugging, I isolated the trigger to a particular container making a peer-to-peer TCP connection to a remote address with port 0. Reverting passt to version 20240326 works as expected, and the container stays online. It's been a long time since I wrote any C, but the code seems clear and checks that the endpoint and forwarding ports do not equal 0. I assume that a port 0 connection is not realistic or useful, and that actual attempt to connect over this port indicate a bug in the client code. Is this correct? I've reported the behavior to the container authors, but am checking here too in case I'm off base.

3 7

passt: new version 2024_08_14.61c0b0d available
by Stefano Brivio 14 Aug '24

14 Aug '24

The new version with tag 2024_08_14.61c0b0d includes the following changes: 61c0b0d flow: Don't crash if guest attempts to connect to port 0 baba284 conf: Don't ignore -t and -u options after -D c16141e ndp.c: Turn NDP responder into more declarative implementation f6d5a52 conf: Delay handling -D option until after addresses are configured 86bdd96 Correct inaccurate comments on ip[46]_ctx::addr fecb1b6 log: Don't prefix message with timestamp on --debug if it's a continuation baccfb9 conf: Stop parsing options at first non-option argument 09603ca passt, util: Close any open file that the parent might have leaked 755f9fd nstool: Propagate SIGTERM to processes executed in the namespace 5ca61c2 nstool: Fix some trivial typos a628cb9 log: Avoid duplicate calls to logtime() 2c7558d log: Handle errors from clock_gettime() b91bae1 log: Correct formatting of timestamps 95569e4 util: Some corrections for timespec_diff_us fbb0c95 conf, pasta: Make -g and -a skip route/addresses copy for matching IP version only https://passt.top/passt/log/?qt=range&q=2024_08_06.ee36266..2024_08_14.61c0… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7907497/ permanent mirror: https://passt.top/builds/copr/0^20240814.g61c0b0d/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g61c0b0d-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_61c0b0d-1_all.deb -- Stefano

1 0

passt: new version 2024_08_06.ee36266 available
by Stefano Brivio 06 Aug '24

06 Aug '24

The new version with tag 2024_08_06.ee36266 includes the following changes: ee36266 log, passt: Keep printing to stderr when passt is running in foreground 3a082c4 tcp_splice: Fix side in OUT_WAIT flag setting 031df33 util: Use unsigned (size_t) value for iov length e877f90 udp_flow: move all udp_flow functions to udp_flow.c 623ceb1 udp_flow: Remove udp_meta_t from the parameters of udp_flow_from_sock() a5bbefa log: Make logfile_write() private f30ed68 pasta: Save errno on signal handler entry, restore on return when needed 0149d11 pasta: modify hostname when detaching new namespace 8fae3b7 Fix typo in README file f87b11c fedora/rpkg: List myself as author for changelog entries https://passt.top/passt/log/?qt=range&q=2024_07_26.57a21d2..2024_08_06.ee36… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7871011/ permanent mirror: https://passt.top/builds/copr/0^20240806.gee36266/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gee36266-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0ee36266-1_all.deb -- Stefano

1 0

passt: new version 2024_07_26.57a21d2 available
by Stefano Brivio 26 Jul '24

26 Jul '24

The new version with tag 2024_07_26.57a21d2 includes the following changes: 57a21d2 tap: Improve handling of partially received frames on qemu socket 37e3b24 tap: Correctly handle frames of odd length 4684f60 tap: Don't use EPOLLET on Qemu sockets 9e3f235 tap: Don't attempt to carry on if we get a bad frame length from qemu a06db27 tap: Better report errors receiving from QEMU socket 77c092e log: Fetch log times with CLOCK_MONOTONIC, not CLOCK_REALTIME e5c37ba log: Initialise timestamp for relative log time also if we use a log file 327d9d4 log, util: Fix sub-second part in relative log time calculation 2ce1d37 test/lib/perf_report: Fix highlight e9a5423 test: Fix spurious test failure with systemd-resolved becf81a fwd: Broaden what we consider for DNS specific forwarding rules 0ada84e fwd: Refactor tests in fwd_nat_from_tap() for clarity 4a333c8 conf: Accept addresses enclosed by square brackets in port forwarding specifiers 6ff702f tap: Exit if we fail to bind a UNIX domain socket with explicit path f72d35a test: iperf3 3.16 introduces multiple threads, drop our own implementation of that 606e0c7 test: Update names of symbols and slabinfo entries f16f8f5 test: Fix memory/passt tests, --netns-only is not a valid option for passt 1cd7730 log: Drop newlines in the middle of the perror()-like messages 1329558 tcp: Change SO_PEEK_OFF support message to debug() d19b396 tap: Don't quit if pasta gets EIO on writev() to tap, interface might be down a09aeb4 tcp: Correctly update SO_PEEK_OFF when tcp_send_frames() drops frames 9cb6b50 tcp: probe for SO_PEEK_OFF both in tcpv4 and tcp6 882599e udp: Rename UDP listening sockets d29fa08 udp: Remove rdelta port forwarding maps d89b3aa udp: Remove obsolete socket tracking 898f797 udp: Direct datagrams from host to guest via flow table b7ad193 udp: Find or create flows for datagrams from tap interface 8126f7a udp: Remove obsolete splice tracking e0647ad udp: Handle "spliced" datagrams with per-flow sockets a45a7e9 udp: Create flows for datagrams from originating sockets 8abd06e fwd: Update flow forwarding logic for UDP c000f2a flow, icmp: Use general flow forwarding rules for ICMP 060f24e flow, tcp: Flow based NAT and port forwarding for TCP 4cd753e icmp: Manage outbound socket address via flow table 781164e flow: Helper to create sockets based on flowside 2faf6fc icmp: Eliminate icmp_id_map 2f40a01 icmp: Look up ping flows using flow hash 6d76278 icmp: Obtain destination addresses from the flowsides 5cffb1b icmp: Remove redundant id field from flow table entry 508adde tcp: Re-use flow hash for initial sequence number generation acca423 flow, tcp: Generalise TCP hash table to general flow hash table 163a339 tcp, flow: Replace TCP specific hash function with general flow hash f19a8f7 tcp_splice: Eliminate SPLICE_V6 flag 528a651 tcp: Simplify endpoint validation using flowside information e2ea10e tcp: Manage outbound address via flow table 52d45f1 tcp: Obtain guest address from flowside f9fe212 tcp, flow: Remove redundant information, repack connection structures 4e2d36e flow: Common address information for target side 8012f5f flow: Common address information for initiating side ba74b1f doc: Extend zero-recv test with methods using msghdr 01e5611 doc: Test behaviour of closing duplicate UDP sockets 66a02c9 tcp_splice: Use parameterised macros for per-side event/flag bits 5235c47 flow: Introduce flow_foreach_sidei() macro 71d7985 flow, tcp_splice: Prefer 'sidei' for variables referring to side index 9b125e7 flow, icmp, tcp: Clean up helpers for getting flow from index 2fa91ee udp: Handle errors on UDP sockets 6bd8283 util: Add AF_UNSPEC support to sockaddr_ntop() 4e1f850 udp, tcp: Tweak handling of no_udp and no_tcp flags 272d1d0 udp: Make udp_sock_recv static f79c423 conf: Don't configure port forwarding for a disabled protocol a740e16 tcp: handle shrunk window advertisements from guest e63d281 tcp: leverage support of SO_PEEK_OFF socket option when available 8bd57bf doc: Trivial fix for reuseaddr-priority ec2691a doc: Test behaviour of zero length datagram recv()s 299c407 doc: Add program to document and test assumptions about SO_REUSEADDR be0214c udp: Consolidate datagram batching 69e5393 udp: Move some more of sock_handler tasks into sub-functions c6c61a9 udp: Don't repeatedly initialise udp[46]_eth_hdr 55aff45 udp: Unify udp[46]_l2_iov 9f9b15f udp: Unify udp[46]_mh_splice fbd78b6 udp: Rename IOV and mmsghdr arrays f62c33d udp: Pass full epoll reference through more of sock handler path 8f8eb73 flow: Add flow_sidx_valid() helper 74c1c5e util: sock_l4() determine protocol from epoll type rather than the reverse b625ed5 conf: Use the right maximum buffer size for c->sock_path 403a7c1 tcp_splice: Check return value of setsockopt() for SO_RCVLOWAT 21ee1eb conf: Copy up to MAXDNSRCH - 1 bytes, not MAXDNSRCH https://passt.top/passt/log/?qt=range&q=2024_06_24.1ee2eca..2024_07_26.57a2… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7793866/ permanent mirror: https://passt.top/builds/copr/0^20240726.g57a21d2/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g57a21d2-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_57a21d2-1_all.deb -- Stefano

1 0

passt: new version 2024_06_24.1ee2eca available
by Stefano Brivio 24 Jun '24

24 Jun '24

The new version with tag 2024_06_24.1ee2eca includes the following changes: 1ee2eca udp: Reduce scope of rport in udp_invert_portmap() 0546975 Revert "udp: Make rport calculation more local" c66f034 log: Don't report syslog failures to stderr after initialisation e7323e5 conf, passt: Don't call __openlog() if a log file is used dba7f0f treewide: Replace strerror() calls 92a22fe treewide: Replace perror() calls with calls to logging functions c1140df log: Add _perror() logging function variants afd9cdc log, passt: Always print to stderr before initialisation is complete 8c2f24a conf, log: Instead of abusing log levels, add log_conf_parsed flag bca0fef conf, passt: Make --stderr do nothing, and deprecate it b748016 conf, passt: Don't try to log to stderr after we close it 65923ba conf: Accept duplicate and conflicting options, the last one wins 62de614 netlink: Strip nexthop identifiers when duplicating routes 1544a43 passt.1, qrap.1: align license description with SPDX identifier f301bb1 netlink: Ignore EHOSTUNREACH failures when duplicating routes 450a613 netlink: With no default route, pick the first interface with a route 54a9d38 tcp: Don't rely on bind() to fail to decide that connection target is valid 020ff7a siphash: Remove stale prototypes 7e87bd9 udp: Move management of udp[46]_localname into udp_splice_send() ff57f8d udp: Rework how we divide queued datagrams between sending methods 63db7dc udp: Fold checking of splice flag into udp_mmh_splice_port() 523fbc5 util: Split construction of bind socket address from the rest of sock_l4() 4070bac tap: use in->buf_size rather than sizeof(pkt_buf) 7290335 iov: remove iov_copy() 0c335d7 vhost-user: compare mode MODE_PASTA and not MODE_PASST 377b666 udp: rename udp_sock_handler() to udp_buf_sock_handler() e7ac995 udp: refactor UDP header update functions 9ecf7fe tap: refactor packets handling functions fba2b54 tcp: move buffers management functions to their own file ec26fa0 tcp: extract buffer management from tcp_send_flag() d949667 cppcheck: Suppress constParameterCallback errors https://passt.top/passt/log/?qt=range&q=2024_06_07.8a83b53..2024_06_24.1ee2… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7661289/ permanent mirror: https://passt.top/builds/copr/0^20240624.g1ee2eca/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1ee2eca-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1ee2eca-1_all.deb -- Stefano

1 0

passt: new version 2024_06_07.8a83b53 available
by Stefano Brivio 07 Jun '24

07 Jun '24

The new version with tag 2024_06_07.8a83b53 includes the following changes: 8a83b53 selinux: Allow access to user_devpts ec416fd tcp, flow: Fix some error paths which didn't clean up flows properly 3f63743 util: Use 'long' to represent millisecond durations f9e8ee0 lineread: Use ssize_t for line lengths c919bbb conf: Safer parsing of MAC addresses bda80ef util: Use unsigned indices for bits in bitmaps 0e36fe1 clang-tidy: Enable the bugprone-macro-parentheses check 7094b91 Remove pointless macro parameters in CALL_PROTO_HANDLER c80fa6a udp: Make rport calculation more local d2afb4b tcp: Make pointer const in tcp_revert_seq b3aeb00 log: Remove log_to_stdout option 7cb2088 conf: Don't print usage via the logging subsystem e651197 conf: Remove unhelpful usage() wrapper e84a01e tcp: move seq_to_tap update to when frame is queued https://passt.top/passt/log/?qt=range&q=2024_05_23.765eb0b..2024_06_07.8a83… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7558696/ permanent mirror: https://passt.top/builds/copr/0^20240607.g8a83b53/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1eddc56-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1eddc56-1_all.deb -- Stefano

1 0

apparmor blocks passt running podman
by hamish-passt＠moffatt.email 07 Jun '24

07 Jun '24

Hi, I have podman 5.1.0 and passt 0.0+20240523.765eb0bf running on Debian bookworm (via unofficial packages). When I try to run podman using passt for networking, it is blocked by apparmor (3.0.8). audit: type=1400 audit(1717756950.285:65): apparmor="DENIED" operation="open" profile="passt" name="/run/user/1000/netns/netns-cad489f7-d3c4-7730-9d15-17ae8e172da4" pid=246135 comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 I'm not familiar with apparmor so I don't know how to debug this. The installed apparmor profile files match the ones in the pasta git. Can you help? thanks, Hamish

2 1