November 2024 - dev

passt: new version 2024_11_27.c0fbc7e available
by Stefano Brivio 27 Nov '24

27 Nov '24

The new version with tag 2024_11_27.c0fbc7e includes the following changes: c0fbc7e dhcp: Honour broadcast flag (RFC 2131, 4.1) 9da2038 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) d6e9e24 dhcp: Use -1 as "missing option" length instead of 0 14b84a7 treewide: Introduce 'local mode' for disconnected setups c6e6106 test: Improve logic for waiting for SLAAC & DAD to complete in NDP tests cda7f16 ndp: Don't send first periodic router advertisement right after guest connects 2bf8ffc test/perf: Select a single IPv6 namespace address in pasta tests 6819b2e conf, passt.1: Update --mac-addr default in usage() and man page b61be84 passt.1: Fix "default" note about --map-guest-addr https://passt.top/passt/log/?qt=range&q=2024_11_21.238c69f..2024_11_27.c0fb… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8318673/ permanent mirror: https://passt.top/builds/copr/0^20241127.gc0fbc7e/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc0fbc7e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c0fbc7e-1_all.deb -- Stefano

1 0

[PATCH v4] treewide: Introduce 'local mode' for disconnected setups
by Stefano Brivio 27 Nov '24

27 Nov '24

There are setups where no host interface is available or configured at all, intentionally or not, temporarily or not, but users expect (Podman) containers to run in any case as they did with slirp4netns, and we're now getting reports that we broke such setups at a rather alarming rate. To this end, if we don't find any usable host interface, instead of exiting: - for IPv4, use 169.254.2.1 as guest/container address and 169.254.2.2 as default gateway - for IPv6, don't assign any address (forcibly disable DHCPv6), and use the *first* link-local address we observe to represent the guest/container. Advertise fe80::1 as default gateway - use 'tap0' as default interface name for pasta Change ifi4 and ifi6 in struct ctx to int and accept a special -1 value meaning that no host interface was selected, but the IP family is enabled. The fact that the kernel uses unsigned int values for those is not an issue as 1. one can't create so many interfaces anyway and 2. we otherwise handle those values transparently. Fix a botched conditional in conf_print() to actually skip printing DHCPv6 information if DHCPv6 is disabled (and skip printing NDP information if NDP is disabled). Link: https://github.com/containers/podman/issues/24614 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v4: In conf(), leave the (*c->ip4.ifname_out && !c->ifi4) || (*c->ip6.ifname_out && !c->ifi6) case alone: there, the user gave outbound interfaces explicitly but we couldn't use them v3: Coverity reports that, in conf(), we might supply a negative c->ifi4 to if_indextoname() after checking that (!*c->pasta_ifn). That's a false positive, because if c->ifi4 is -1, we already set c->pasta_ifn to "tap0", so we won't call if_indextoname() at all, but, to make my life simpler, add a redundant check on c->ifi4 and c->ifi6 before calling if_indextoname() on them. v2: - drop fixed link-local address for IPv6 - change addresses to be reminiscent of libslirp's default choices - add man page changes and commit message - fix several things around, from testing (checked with several --map-guest-addr and --map-host-loopback combinations etc.) conf.c | 97 ++++++++++++++++++++++++++++++++++++++++++++------------- passt.1 | 33 +++++++++++++++++--- passt.h | 8 ++--- pasta.c | 7 +++-- tap.c | 3 ++ 5 files changed, 116 insertions(+), 32 deletions(-) diff --git a/conf.c b/conf.c index d342c8a..c6bffc4 100644 --- a/conf.c +++ b/conf.c @@ -48,6 +48,20 @@ #define NETNS_RUN_DIR "/run/netns" +#define IP4_LL_GUEST_ADDR (struct in_addr){ htonl_constant(0xa9fe0201) } + /* 169.254.2.1, libslirp default: 10.0.2.1 */ + +#define IP4_LL_GUEST_GW (struct in_addr){ htonl_constant(0xa9fe0202) } + /* 169.254.2.2, libslirp default: 10.0.2.2 */ + +#define IP4_LL_PREFIX_LEN 16 + +#define IP6_LL_GUEST_GW (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x01 }}} + +const char *pasta_default_ifn = "tap0"; + /** * next_chunk - Return the next piece of a string delimited by a character * @s: String to search @@ -631,7 +645,7 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("Couldn't pick external interface: disabling IPv4"); + debug("Failed to detect external interface for IPv4"); return 0; } @@ -639,8 +653,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_route_get_def(nl_sock, ifi, AF_INET, &ip4->guest_gw); if (rc < 0) { - err("Couldn't discover IPv4 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 gateway address: %s", + strerror(-rc)); return 0; } } @@ -649,8 +663,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_addr_get(nl_sock, ifi, AF_INET, &ip4->addr, &ip4->prefix_len, NULL); if (rc < 0) { - err("Couldn't discover IPv4 address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 address: %s", + strerror(-rc)); return 0; } } @@ -677,6 +691,19 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) return ifi; } +/** + * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode + * @ip4: IPv4 context (will be written) + */ +static void conf_ip4_local(struct ip4_ctx *ip4) +{ + ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; + ip4->prefix_len = IP4_LL_PREFIX_LEN; + + ip4->no_copy_addrs = ip4->no_copy_routes = true; +} + /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -693,15 +720,15 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("Couldn't pick external interface: disabling IPv6"); + debug("Failed to detect external interface for IPv6"); return 0; } if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) { rc = nl_route_get_def(nl_sock, ifi, AF_INET6, &ip6->guest_gw); if (rc < 0) { - err("Couldn't discover IPv6 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv6 gateway address: %s", + strerror(-rc)); return 0; } } @@ -710,7 +737,7 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { - err("Couldn't discover IPv6 address: %s", strerror(-rc)); + debug("Couldn't discover IPv6 address: %s", strerror(-rc)); return 0; } @@ -726,6 +753,17 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) return ifi; } +/** + * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode + * @ip6: IPv6 context (will be written) + */ +static void conf_ip6_local(struct ip6_ctx *ip6) +{ + ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + + ip6->no_copy_addrs = ip6->no_copy_routes = true; +} + /** * usage() - Print usage, exit with given status code * @name: Executable name @@ -948,12 +986,14 @@ static void conf_print(const struct ctx *c) char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; int i; - info("Template interface: %s%s%s%s%s", - c->ifi4 ? if_indextoname(c->ifi4, ifn) : "", - c->ifi4 ? " (IPv4)" : "", - (c->ifi4 && c->ifi6) ? ", " : "", - c->ifi6 ? if_indextoname(c->ifi6, ifn) : "", - c->ifi6 ? " (IPv6)" : ""); + if (c->ifi4 > 0 || c->ifi6 > 0) { + info("Template interface: %s%s%s%s%s", + c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", + c->ifi4 > 0 ? " (IPv4)" : "", + (c->ifi4 && c->ifi6) ? ", " : "", + c->ifi6 > 0 ? if_indextoname(c->ifi6, ifn) : "", + c->ifi6 > 0 ? " (IPv6)" : ""); + } if (*c->ip4.ifname_out || *c->ip6.ifname_out) { info("Outbound interface: %s%s%s%s%s", @@ -1024,9 +1064,9 @@ static void conf_print(const struct ctx *c) if (!c->no_ndp && !c->no_dhcpv6) info("NDP/DHCPv6:"); - else if (!c->no_ndp) - info("DHCPv6:"); else if (!c->no_dhcpv6) + info("DHCPv6:"); + else if (!c->no_ndp) info("NDP:"); else goto dns6; @@ -1733,10 +1773,23 @@ void conf(struct ctx *c, int argc, char **argv) c->ifi4 = conf_ip4(ifi4, &c->ip4); if (!v4_only) c->ifi6 = conf_ip6(ifi6, &c->ip6); - if ((!c->ifi4 && !c->ifi6) || - (*c->ip4.ifname_out && !c->ifi4) || + if ((*c->ip4.ifname_out && !c->ifi4) || (*c->ip6.ifname_out && !c->ifi6)) die("External interface not usable"); + if (!c->ifi4 && !c->ifi6) { + info("No external interface as template, switch to local mode"); + + conf_ip4_local(&c->ip4); + c->ifi4 = -1; + + conf_ip6_local(&c->ip6); + c->ifi6 = -1; + + if (!*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } + } if (c->ifi4 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) @@ -1840,6 +1893,8 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; + } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + c->no_dhcpv6 = 1; } if (!c->mtu) @@ -1848,9 +1903,9 @@ void conf(struct ctx *c, int argc, char **argv) get_dns(c); if (!*c->pasta_ifn) { - if (c->ifi4) + if (c->ifi4 > 0) if_indextoname(c->ifi4, c->pasta_ifn); - else + else if (c->ifi6 > 0) if_indextoname(c->ifi6, c->pasta_ifn); } diff --git a/passt.1 b/passt.1 index 059abd3..15c8338 100644 --- a/passt.1 +++ b/passt.1 @@ -160,7 +160,9 @@ once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces with the first default route, if any, for the corresponding IP version. If no default routes are available and there is any interface with any route for a -given IP version, the first of these interfaces will be chosen instead. +given IP version, the first of these interfaces will be chosen instead. If no +such interface exists, the link-local address 169.254.2.1 is assigned for IPv4, +and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -187,7 +189,9 @@ first default route, if any, for the corresponding IP version. If the default route is a multipath one, the gateway is the first nexthop router returned by the kernel which has the highest weight in the set of paths. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, the link-local +address 169.254.2.2 is used for IPv4, and the link-local address fe80::1 is used +for IPv6. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -202,7 +206,9 @@ Default is to use the interfaces specified by \fB--outbound-if4\fR and If no interfaces are given, the interface with the first default routes for each IP version is selected. If no default routes are available and there is just one -interface with any route, that interface will be chosen instead. +interface with any route, that interface will be chosen instead. If no such +interface exists, host interfaces will be ignored for the purposes of assigning +addresses and routes, and link-local addresses will be used instead. .TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -221,7 +227,8 @@ derive IPv4 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-\-outbound-if6 " " \fIname @@ -231,7 +238,8 @@ derive IPv6 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-D ", " \-\-dns " " \fIaddr @@ -503,6 +511,7 @@ Default is \fBnone\fR. .BR \-I ", " \-\-ns-ifname " " \fIname Name of tap interface to be created in target namespace. By default, the same interface name as the external, routable interface is used. +If no such interface exists, the name \fItap0\fR will be used instead. .TP .BR \-t ", " \-\-tcp-ports " " \fIspec @@ -1031,6 +1040,20 @@ If the sending window cannot be queried, it will always be announced as the current sending buffer size to guest or target namespace. This might affect throughput of TCP connections. +.SS Local mode for disconnected setups + +If \fBpasst\fR and \fBpasta\fR fail to find a host interface with a configured +address, other than loopback addresses, they will, obviously, not attempt to +source addresses or routes from the host. + +In this case, unless configured otherwise, they will assign the IPv4 link-local +address 169.254.2.1 to the guest or target namespace, and no IPv6 address. The +notion of the guest or target namespace IPv6 address is derived from the first +link-local address observed. + +Default gateways will be assigned as the link-local address 169.254.2.2 for +IPv4, and as the link-local address fe80::1 for IPv6. + .SH LIMITATIONS Currently, IGMP/MLD proxying (RFC 4605) and support for SCTP (RFC 4960) are not diff --git a/passt.h b/passt.h index 72c7f72..799ee50 100644 --- a/passt.h +++ b/passt.h @@ -202,10 +202,10 @@ struct ip6_ctx { * @our_tap_mac: Pasta/passt's MAC on the tap link * @guest_mac: MAC address of guest or namespace, seen or configured * @hash_secret: 128-bit secret for siphash functions - * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled + * @ifi4: Template interface for IPv4, -1: none, 0: IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list - * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled + * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta @@ -258,12 +258,12 @@ struct ctx { unsigned char guest_mac[ETH_ALEN]; uint64_t hash_secret[2]; - unsigned int ifi4; + int ifi4; struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; - unsigned int ifi6; + int ifi6; struct ip6_ctx ip6; char pasta_ifn[IF_NAMESIZE]; diff --git a/pasta.c b/pasta.c index a117704..96dacc3 100644 --- a/pasta.c +++ b/pasta.c @@ -369,8 +369,11 @@ void pasta_ns_conf(struct ctx *c) 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET6, &c->ip6.addr, 64); + if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 14d9b3d..5347df4 100644 --- a/tap.c +++ b/tap.c @@ -803,6 +803,9 @@ resume: if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) { c->ip6.addr_seen = *saddr; } + + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) + c->ip6.addr = *saddr; } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.43.0

2 2

[PATCH v3] treewide: Introduce 'local mode' for disconnected setups
by Stefano Brivio 27 Nov '24

27 Nov '24

There are setups where no host interface is available or configured at all, intentionally or not, temporarily or not, but users expect (Podman) containers to run in any case as they did with slirp4netns, and we're now getting reports that we broke such setups at a rather alarming rate. To this end, if we don't find any usable host interface, instead of exiting: - for IPv4, use 169.254.2.1 as guest/container address and 169.254.2.2 as default gateway - for IPv6, don't assign any address (forcibly disable DHCPv6), and use the *first* link-local address we observe to represent the guest/container. Advertise fe80::1 as default gateway - use 'tap0' as default interface name for pasta Change ifi4 and ifi6 in struct ctx to int and accept a special -1 value meaning that no host interface was selected, but the IP family is enabled. The fact that the kernel uses unsigned int values for those is not an issue as 1. one can't create so many interfaces anyway and 2. we otherwise handle those values transparently. Fix a botched conditional in conf_print() to actually skip printing DHCPv6 information if DHCPv6 is disabled (and skip printing NDP information if NDP is disabled). Link: https://github.com/containers/podman/issues/24614 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v3: Coverity reports that, in conf(), we might supply a negative c->ifi4 to if_indextoname() after checking that (!*c->pasta_ifn). That's a false positive, because if c->ifi4 is -1, we already set c->pasta_ifn to "tap0", so we won't call if_indextoname() at all, but, to make my life simpler, add a redundant check on c->ifi4 and c->ifi6 before calling if_indextoname() on them. conf.c | 96 ++++++++++++++++++++++++++++++++++++++++++++------------- passt.1 | 33 +++++++++++++++++--- passt.h | 8 ++--- pasta.c | 7 +++-- tap.c | 3 ++ 5 files changed, 115 insertions(+), 32 deletions(-) diff --git a/conf.c b/conf.c index 86566db..c7aabeb 100644 --- a/conf.c +++ b/conf.c @@ -48,6 +48,20 @@ #define NETNS_RUN_DIR "/run/netns" +#define IP4_LL_GUEST_ADDR (struct in_addr){ htonl_constant(0xa9fe0201) } + /* 169.254.2.1, libslirp default: 10.0.2.1 */ + +#define IP4_LL_GUEST_GW (struct in_addr){ htonl_constant(0xa9fe0202) } + /* 169.254.2.2, libslirp default: 10.0.2.2 */ + +#define IP4_LL_PREFIX_LEN 16 + +#define IP6_LL_GUEST_GW (struct in6_addr) \ + {{{ 0xfe, 0x80, 0, 0, 0, 0, 0, 0, \ + 0, 0, 0, 0, 0, 0, 0, 0x01 }}} + +const char *pasta_default_ifn = "tap0"; + /** * next_chunk - Return the next piece of a string delimited by a character * @s: String to search @@ -631,7 +645,7 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) ifi = nl_get_ext_if(nl_sock, AF_INET); if (!ifi) { - info("Couldn't pick external interface: disabling IPv4"); + debug("Failed to detect external interface for IPv4"); return 0; } @@ -639,8 +653,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_route_get_def(nl_sock, ifi, AF_INET, &ip4->guest_gw); if (rc < 0) { - err("Couldn't discover IPv4 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 gateway address: %s", + strerror(-rc)); return 0; } } @@ -649,8 +663,8 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) int rc = nl_addr_get(nl_sock, ifi, AF_INET, &ip4->addr, &ip4->prefix_len, NULL); if (rc < 0) { - err("Couldn't discover IPv4 address: %s", - strerror(-rc)); + debug("Couldn't discover IPv4 address: %s", + strerror(-rc)); return 0; } } @@ -677,6 +691,19 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) return ifi; } +/** + * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode + * @ip4: IPv4 context (will be written) + */ +static void conf_ip4_local(struct ip4_ctx *ip4) +{ + ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; + ip4->prefix_len = IP4_LL_PREFIX_LEN; + + ip4->no_copy_addrs = ip4->no_copy_routes = true; +} + /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses * @ifi: Host interface to attempt (0 to determine one) @@ -693,15 +720,15 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) ifi = nl_get_ext_if(nl_sock, AF_INET6); if (!ifi) { - info("Couldn't pick external interface: disabling IPv6"); + debug("Failed to detect external interface for IPv6"); return 0; } if (IN6_IS_ADDR_UNSPECIFIED(&ip6->guest_gw)) { rc = nl_route_get_def(nl_sock, ifi, AF_INET6, &ip6->guest_gw); if (rc < 0) { - err("Couldn't discover IPv6 gateway address: %s", - strerror(-rc)); + debug("Couldn't discover IPv6 gateway address: %s", + strerror(-rc)); return 0; } } @@ -710,7 +737,7 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { - err("Couldn't discover IPv6 address: %s", strerror(-rc)); + debug("Couldn't discover IPv6 address: %s", strerror(-rc)); return 0; } @@ -726,6 +753,17 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) return ifi; } +/** + * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode + * @ip6: IPv6 context (will be written) + */ +static void conf_ip6_local(struct ip6_ctx *ip6) +{ + ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + + ip6->no_copy_addrs = ip6->no_copy_routes = true; +} + /** * usage() - Print usage, exit with given status code * @name: Executable name @@ -948,12 +986,14 @@ static void conf_print(const struct ctx *c) char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; int i; - info("Template interface: %s%s%s%s%s", - c->ifi4 ? if_indextoname(c->ifi4, ifn) : "", - c->ifi4 ? " (IPv4)" : "", - (c->ifi4 && c->ifi6) ? ", " : "", - c->ifi6 ? if_indextoname(c->ifi6, ifn) : "", - c->ifi6 ? " (IPv6)" : ""); + if (c->ifi4 > 0 || c->ifi6 > 0) { + info("Template interface: %s%s%s%s%s", + c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", + c->ifi4 > 0 ? " (IPv4)" : "", + (c->ifi4 && c->ifi6) ? ", " : "", + c->ifi6 > 0 ? if_indextoname(c->ifi6, ifn) : "", + c->ifi6 > 0 ? " (IPv6)" : ""); + } if (*c->ip4.ifname_out || *c->ip6.ifname_out) { info("Outbound interface: %s%s%s%s%s", @@ -1024,9 +1064,9 @@ static void conf_print(const struct ctx *c) if (!c->no_ndp && !c->no_dhcpv6) info("NDP/DHCPv6:"); - else if (!c->no_ndp) - info("DHCPv6:"); else if (!c->no_dhcpv6) + info("DHCPv6:"); + else if (!c->no_ndp) info("NDP:"); else goto dns6; @@ -1735,8 +1775,20 @@ void conf(struct ctx *c, int argc, char **argv) c->ifi6 = conf_ip6(ifi6, &c->ip6); if ((!c->ifi4 && !c->ifi6) || (*c->ip4.ifname_out && !c->ifi4) || - (*c->ip6.ifname_out && !c->ifi6)) - die("External interface not usable"); + (*c->ip6.ifname_out && !c->ifi6)) { + info("No external interface as template, switch to local mode"); + + conf_ip4_local(&c->ip4); + c->ifi4 = -1; + + conf_ip6_local(&c->ip6); + c->ifi6 = -1; + + if (!*c->pasta_ifn) { + strncpy(c->pasta_ifn, pasta_default_ifn, + sizeof(c->pasta_ifn) - 1); + } + } if (c->ifi4 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) @@ -1840,6 +1892,8 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; + } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + c->no_dhcpv6 = 1; } if (!c->mtu) @@ -1848,9 +1902,9 @@ void conf(struct ctx *c, int argc, char **argv) get_dns(c); if (!*c->pasta_ifn) { - if (c->ifi4) + if (c->ifi4 > 0) if_indextoname(c->ifi4, c->pasta_ifn); - else + else if (c->ifi6 > 0) if_indextoname(c->ifi6, c->pasta_ifn); } diff --git a/passt.1 b/passt.1 index f084978..f5cf8a4 100644 --- a/passt.1 +++ b/passt.1 @@ -160,7 +160,9 @@ once for IPv6). By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces with the first default route, if any, for the corresponding IP version. If no default routes are available and there is any interface with any route for a -given IP version, the first of these interfaces will be chosen instead. +given IP version, the first of these interfaces will be chosen instead. If no +such interface exists, the link-local address 169.254.2.1 is assigned for IPv4, +and no additional address will be assigned for IPv6. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -188,7 +190,9 @@ first default route, if any, for the corresponding IP version. If the default route is a multipath one, the gateway is the first nexthop router returned by the kernel which has the highest weight in the set of paths. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, the link-local +address 169.254.2.2 is used for IPv4, and the link-local address fe80::1 is used +for IPv6. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -203,7 +207,9 @@ Default is to use the interfaces specified by \fB--outbound-if4\fR and If no interfaces are given, the interface with the first default routes for each IP version is selected. If no default routes are available and there is just one -interface with any route, that interface will be chosen instead. +interface with any route, that interface will be chosen instead. If no such +interface exists, host interfaces will be ignored for the purposes of assigning +addresses and routes, and link-local addresses will be used instead. .TP .BR \-o ", " \-\-outbound " " \fIaddr @@ -222,7 +228,8 @@ derive IPv4 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-\-outbound-if6 " " \fIname @@ -232,7 +239,8 @@ derive IPv6 addresses and routes. By default, the interface given by the default route is selected. If no default routes are available and there is just one interface with any route, that -interface will be chosen instead. +interface will be chosen instead. If no such interface exists, outbound sockets +will not be bound to any specific interface. .TP .BR \-D ", " \-\-dns " " \fIaddr @@ -504,6 +512,7 @@ Default is \fBnone\fR. .BR \-I ", " \-\-ns-ifname " " \fIname Name of tap interface to be created in target namespace. By default, the same interface name as the external, routable interface is used. +If no such interface exists, the name \fItap0\fR will be used instead. .TP .BR \-t ", " \-\-tcp-ports " " \fIspec @@ -1032,6 +1041,20 @@ If the sending window cannot be queried, it will always be announced as the current sending buffer size to guest or target namespace. This might affect throughput of TCP connections. +.SS Local mode for disconnected setups + +If \fBpasst\fR and \fBpasta\fR fail to find a host interface with a configured +address, other than loopback addresses, they will, obviously, not attempt to +source addresses or routes from the host. + +In this case, unless configured otherwise, they will assign the IPv4 link-local +address 169.254.2.1 to the guest or target namespace, and no IPv6 address. The +notion of the guest or target namespace IPv6 address is derived from the first +link-local address observed. + +Default gateways will be assigned as the link-local address 169.254.2.2 for +IPv4, and as the link-local address fe80::1 for IPv6. + .SH LIMITATIONS Currently, IGMP/MLD proxying (RFC 4605) and support for SCTP (RFC 4960) are not diff --git a/passt.h b/passt.h index 72c7f72..799ee50 100644 --- a/passt.h +++ b/passt.h @@ -202,10 +202,10 @@ struct ip6_ctx { * @our_tap_mac: Pasta/passt's MAC on the tap link * @guest_mac: MAC address of guest or namespace, seen or configured * @hash_secret: 128-bit secret for siphash functions - * @ifi4: Index of template interface for IPv4, 0 if IPv4 disabled + * @ifi4: Template interface for IPv4, -1: none, 0: IPv4 disabled * @ip: IPv4 configuration * @dns_search: DNS search list - * @ifi6: Index of template interface for IPv6, 0 if IPv6 disabled + * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta @@ -258,12 +258,12 @@ struct ctx { unsigned char guest_mac[ETH_ALEN]; uint64_t hash_secret[2]; - unsigned int ifi4; + int ifi4; struct ip4_ctx ip4; struct fqdn dns_search[MAXDNSRCH]; - unsigned int ifi6; + int ifi6; struct ip6_ctx ip6; char pasta_ifn[IF_NAMESIZE]; diff --git a/pasta.c b/pasta.c index a117704..96dacc3 100644 --- a/pasta.c +++ b/pasta.c @@ -369,8 +369,11 @@ void pasta_ns_conf(struct ctx *c) 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET6, &c->ip6.addr, 64); + if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 14d9b3d..5347df4 100644 --- a/tap.c +++ b/tap.c @@ -803,6 +803,9 @@ resume: if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_seen)) { c->ip6.addr_seen = *saddr; } + + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) + c->ip6.addr = *saddr; } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.43.0

3 5

[PATCH] Fix build on 32bit target
by Laurent Vivier 27 Nov '24

27 Nov '24

Fix the following errors when built with CFLAGS="-m32 -U__AVX2__": packet.c:57:23: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 5 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=] 57 | trace("packet offset plus length %lu from size %lu, " 58 | "%s:%i", start - p->buf + len + offset, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | size_t {aka unsigned int} packet.c:57:23: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 6 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=] 57 | trace("packet offset plus length %lu from size %lu, " | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 58 | "%s:%i", start - p->buf + len + offset, 59 | p->buf_size, func, line); | ~~~~~~~~~~~ | | | size_t {aka unsigned int} vhost_user.c:139:32: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 139 | return (void *)(qemu_addr - r->qva + r->mmap_addr + | ^ vhost_user.c:439:32: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 439 | munmap((void *)r->mmap_addr, r->size + r->mmap_offset); | ^ vhost_user.c:900:32: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 900 | munmap((void *)r->mmap_addr, r->size + r->mmap_offset); | ^ virtio.c:111:32: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 111 | return (void *)(guest_addr - r->gpa + r->mmap_addr + | ^ vu_common.c:37:27: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] 37 | char *m = (char *)dev_region->mmap_addr; | ^ Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- packet.c | 2 +- vhost_user.c | 11 +++++++---- virtio.c | 5 +++-- vu_common.c | 2 +- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/packet.c b/packet.c index e5a78d079231..03a11e6ac4d9 100644 --- a/packet.c +++ b/packet.c @@ -54,7 +54,7 @@ static int packet_check_range(const struct pool *p, size_t offset, size_t len, } if (start + len + offset > p->buf + p->buf_size) { - trace("packet offset plus length %lu from size %lu, " + trace("packet offset plus length %zu from size %zu, " "%s:%i", start - p->buf + len + offset, p->buf_size, func, line); return -1; diff --git a/vhost_user.c b/vhost_user.c index 51c90db10e7b..4b8558fa851f 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -136,8 +136,9 @@ static void *qva_to_va(struct vu_dev *dev, uint64_t qemu_addr) if ((qemu_addr >= r->qva) && (qemu_addr < (r->qva + r->size))) { /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ - return (void *)(qemu_addr - r->qva + r->mmap_addr + - r->mmap_offset); + return (void *)(uintptr_t)(qemu_addr - r->qva + + r->mmap_addr + + r->mmap_offset); } } @@ -436,7 +437,8 @@ static bool vu_set_mem_table_exec(struct vu_dev *vdev, if (r->mmap_addr) { /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ - munmap((void *)r->mmap_addr, r->size + r->mmap_offset); + munmap((void *)(uintptr_t)r->mmap_addr, + r->size + r->mmap_offset); } } vdev->nregions = memory->nregions; @@ -897,7 +899,8 @@ void vu_cleanup(struct vu_dev *vdev) if (r->mmap_addr) { /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ - munmap((void *)r->mmap_addr, r->size + r->mmap_offset); + munmap((void *)(uintptr_t)r->mmap_addr, + r->size + r->mmap_offset); } } vdev->nregions = 0; diff --git a/virtio.c b/virtio.c index 0598ff479858..a76de5e00222 100644 --- a/virtio.c +++ b/virtio.c @@ -108,8 +108,9 @@ static void *vu_gpa_to_va(struct vu_dev *dev, uint64_t *plen, uint64_t guest_add if ((guest_addr + *plen) > (r->gpa + r->size)) *plen = r->gpa + r->size - guest_addr; /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ - return (void *)(guest_addr - r->gpa + r->mmap_addr + - r->mmap_offset); + return (void *)(uintptr_t)(guest_addr - r->gpa + + r->mmap_addr + + r->mmap_offset); } } diff --git a/vu_common.c b/vu_common.c index 2a18e9794b5c..0763ec053c37 100644 --- a/vu_common.c +++ b/vu_common.c @@ -34,7 +34,7 @@ int vu_packet_check_range(void *buf, size_t offset, size_t len, for (dev_region = buf; dev_region->mmap_addr; dev_region++) { /* NOLINTNEXTLINE(performance-no-int-to-ptr) */ - char *m = (char *)dev_region->mmap_addr; + char *m = (char *)(uintptr_t)dev_region->mmap_addr; if (m <= start && start + offset + len <= m + dev_region->mmap_offset + -- 2.47.0

1 0

[PATCH] virtio: check if avail ring is configured
by Laurent Vivier 27 Nov '24

27 Nov '24

If the connection to the vhost-user front end is closed during transfers virtio rings are deconfigured and not available anymore, but we can try to access them to process queued data. This can trigger a SIGSEG as we try to access unavailable memory. To fix that check vq->vring.avail is sane before accessing the vring Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- virtio.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/virtio.c b/virtio.c index 6a97435e2965..0598ff479858 100644 --- a/virtio.c +++ b/virtio.c @@ -284,6 +284,9 @@ static int virtqueue_read_next_desc(const struct vring_desc *desc, */ bool vu_queue_empty(struct vu_virtq *vq) { + if (!vq->vring.avail) + return true; + if (vq->shadow_avail_idx != vq->last_avail_idx) return false; @@ -327,6 +330,9 @@ static bool vring_can_notify(const struct vu_dev *dev, struct vu_virtq *vq) */ void vu_queue_notify(const struct vu_dev *dev, struct vu_virtq *vq) { + if (!vq->vring.avail) + return; + if (!vring_can_notify(dev, vq)) { debug("vhost-user: virtqueue can skip notify..."); return; @@ -502,6 +508,9 @@ int vu_queue_pop(struct vu_dev *dev, struct vu_virtq *vq, struct vu_virtq_elemen unsigned int head; int ret; + if (!vq->vring.avail) + return -1; + if (vu_queue_empty(vq)) return -1; @@ -591,6 +600,9 @@ void vu_queue_fill_by_index(struct vu_virtq *vq, unsigned int index, { struct vring_used_elem uelem; + if (!vq->vring.avail) + return; + idx = (idx + vq->used_idx) % vq->vring.num; uelem.id = htole32(index); @@ -633,6 +645,9 @@ void vu_queue_flush(struct vu_virtq *vq, unsigned int count) { uint16_t old, new; + if (!vq->vring.avail) + return; + /* Make sure buffer is written before we update index. */ smp_wmb(); -- 2.47.0

1 0

[PATCH] test: Improve logic for waiting for SLAAC & DAD to complete in NDP tests
by David Gibson 26 Nov '24

26 Nov '24

Since 9a0e544f05bf the NDP tests attempt to explicitly wait for DAD to complete, rather than just having a hard coded sleep. However, the conditions we use are a bit sloppy and allow for a number of possible cases where it might not work correctly. Stefano seems to be hitting one of these (though I'm not sure which) with some later patches. - We wait for *lack* of a tentative address, so if the first check occurs before we have even a tentative address it will bypass the delay - It's not entirely clear if the permanent address will always appear as soon as the tentative address disappears - We weren't filtering on interface - We were doing the filtering with ip-address options rather than in jq. However in at least in some circumstances this seems to result in an empty .addr_info field, rather than omitting it entirely, which could cause us to get the wrong result So, instead, explicitly wait for the address we need to be present: an RA provided address on the external interface. While we're here we remove the requirement that it have global scope: the "kernel_ra" check is already sufficient to make sure this address comes from an NDP RA, not something else. If it's not the global scope address we expect, better to check it and fail, rather than keep waiting. Fixes: 9a0e544f05bf ("test: Improve test for NDP assigned prefix") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/passt/ndp | 6 +++--- test/pasta/ndp | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/test/passt/ndp b/test/passt/ndp index 56b385b..516cd6b 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -17,13 +17,13 @@ htools ip jq sipcalc grep cut test Interface name gout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' guest ip link set dev __IFNAME__ up -# Wait for DAD to complete -guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done +# Wait for SLAAC & DAD to complete +guest while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select(.protocol == "kernel_ra")'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' check [ -n "__IFNAME__" ] test SLAAC: prefix -gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' +gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' gout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 diff --git a/test/pasta/ndp b/test/pasta/ndp index 2442ab5..952c1ea 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -18,11 +18,11 @@ test Interface name nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' check [ -n "__IFNAME__" ] ns ip link set dev __IFNAME__ up -# Wait for DAD to complete -ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done +# Wait for SLAAC & DAD to complete +ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select(.protocol == "kernel_ra")'; do sleep 0.1; done test SLAAC: prefix -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 -- 2.47.0

2 1

[PATCH v5 0/3] dhcp: Add support for Rapid Commit, broadcast replies
by Stefano Brivio 26 Nov '24

26 Nov '24

These are all changes coming from pending muvm experiments where I'm trying to speed up and simplify the networking setup in the guest. v5: In 2/3, keep the condition: (opts[53].clen <= 0 || opts[53].c[0] == DHCPREQUEST) as it was, instead of replacing || with && v4: In 1/3, don't swap the "BOOTP" and "DHCP" labels: we want to print "BOOTP" if option 53 isn't there or has zero length, not the other way around. Further, check that clen for option 53 is > 0 before checking if it's a DHCPDISCOVER. Given that DHCPDISCOVER is 1 (not 0), this happened to already work for BOOTP, but it worked by mistake v3: In 1/3, set 'slen' for options we won't send to -1 in dhcp_init(), and reset it for option 80 every time we handle a DHCP request. Add a comment about DHCP needing a valid message type (option 53) v2: In 3/3, add in4addr_broadcast to ip.h, instead of open-coding it in dhcp() Stefano Brivio (3): dhcp: Use -1 as "missing option" length instead of 0 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) dhcp: Honour broadcast flag (RFC 2131, 4.1) dhcp.c | 53 +++++++++++++++++++++++++++++++++++++++++------------ ip.h | 3 +++ 2 files changed, 44 insertions(+), 12 deletions(-) -- 2.43.0

1 3

[PATCH v4 0/3] dhcp: Add support for Rapid Commit, broadcast replies
by Stefano Brivio 26 Nov '24

26 Nov '24

These are all changes coming from pending muvm experiments where I'm trying to speed up and simplify the networking setup in the guest. v4: In 1/3, don't swap the "BOOTP" and "DHCP" labels: we want to print "BOOTP" if option 53 isn't there or has zero length, not the other way around. Further, check that clen for option 53 is > 0 before checking if it's a DHCPDISCOVER. Given that DHCPDISCOVER is 1 (not 0), this happened to already work for BOOTP, but it worked by mistake v3: In 1/3, set 'slen' for options we won't send to -1 in dhcp_init(), and reset it for option 80 every time we handle a DHCP request. Add a comment about DHCP needing a valid message type (option 53) v2: In 3/3, add in4addr_broadcast to ip.h, instead of open-coding it in dhcp() Stefano Brivio (3): dhcp: Use -1 as "missing option" length instead of 0 dhcp: Introduce support for Rapid Commit (option 80, RFC 4039) dhcp: Honour broadcast flag (RFC 2131, 4.1) dhcp.c | 53 +++++++++++++++++++++++++++++++++++++++++------------ ip.h | 3 +++ 2 files changed, 44 insertions(+), 12 deletions(-) -- 2.43.0

1 4

[PATCH] test/passt/ndp: Add delay in SLAAC prefix test before looking for kernel_ra address
by Stefano Brivio 26 Nov '24

26 Nov '24

I'm not exactly sure why we need this delay, but commit 9a0e544f05bf ("test: Improve test for NDP assigned prefix") broke the tests for me. I think it's because the kernel (at least all the versions I'm testing with) might not mark an address as 'kernel_ra' right away, so the jq expression doesn't return any result when we check. Fixes: 9a0e544f05bf ("test: Improve test for NDP assigned prefix") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/passt/ndp | 1 + 1 file changed, 1 insertion(+) diff --git a/test/passt/ndp b/test/passt/ndp index 56b385b..9a1c9a4 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -23,6 +23,7 @@ hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").d check [ -n "__IFNAME__" ] test SLAAC: prefix +sleep 2 gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' gout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' -- 2.43.0

2 2

[PATCH] ndp: Don't send first periodic router advertisement right after guest connects
by Stefano Brivio 26 Nov '24

26 Nov '24

This is very visible with muvm, but it also happens with QEMU: we're sending the first unsolicited router advertisement milliseconds after the guest connects. That's usually pointless because, when the hypervisor connects, the guest is typically not ready yet to process anything of that sort: it's still booting. And if we happen to send it late enough (still milliseconds), with muvm, while the message is discarded, it sometimes (slightly) delays the response to the first solicited router advertisement, which is the one we need to have coming fast. Skip sending the unsolicited advertisement on the first timer run, just calculate the next delay. Keep it simple by observing that we're probably not trying to reach the 1970s with IPv6. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- ndp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ndp.c b/ndp.c index 1752d64..37bf7a3 100644 --- a/ndp.c +++ b/ndp.c @@ -420,9 +420,13 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) interval = min_rtr_adv_interval + random() % (max_rtr_adv_interval - min_rtr_adv_interval); + if (!next_ra) + goto first; + info("NDP: sending unsolicited RA, next in %llds", (long long)interval); ndp_ra(c, &in6addr_ll_all_nodes); +first: next_ra = now->tv_sec + interval; } -- 2.43.0

2 3