June 2024 - dev

[PATCH 0/9] Some more static checker fixes
by David Gibson 08 Jun '24

08 Jun '24

This series includes a number of fixes related to the static checkers: * Fedora 40 has updated to Cppcheck 2.14.1 which introduces some new warnings. Fix them. * Jon's recent patch caused a small cppcheck regression. I assume neither Jon nor Stefano is using sufficiently recent cppcheck versions to catch it. Fix that too. * We were disabling the bugprone-macro parentheses check in clang-tidy. I don't think that's a good idea. Re-enable it and fix existing warnings. * It might also be a good idea to enable the bugprone-narrowing-conversions check. Fix a number of issues across the tree which, amongst other things trigger that warning. There are lots of other places that trigger the warning which I haven't fixed yet, so don't enable it yet. David Gibson (9): tcp: Make pointer const in tcp_revert_seq udp: Make rport calculation more local cppcheck: Suppress constParameterCallback errors Remove pointless macro parameters in CALL_PROTO_HANDLER clang-tidy: Enable the bugprone-macro-parentheses check util: Use unsigned indices for bits in bitmaps conf: Safer parsing of MAC addresses lineread: Use ssize_t for line lengths util: Use 'long' to represent millisecond durations Makefile | 3 +-- conf.c | 55 +++++++++++++++++++++++++++++++++++----------------- lineread.c | 10 ++++------ lineread.h | 7 ++++--- passt.c | 6 +++--- tap.c | 37 ++++++++++++++++++----------------- tcp.c | 10 +++++----- tcp_splice.c | 4 ++-- udp.c | 3 +-- util.c | 10 +++++----- util.h | 8 ++++---- 11 files changed, 85 insertions(+), 68 deletions(-) -- 2.45.2

2 12

[PATCH v2 0/1] Some more static checker fixes
by David Gibson 08 Jun '24

08 Jun '24

This series includes a number of fixes related to the static checkers: * Fedora 40 has updated to Cppcheck 2.14.1 which introduces some new warnings. Fix them. * Jon's recent patch caused a small cppcheck regression. I assume neither Jon nor Stefano is using sufficiently recent cppcheck versions to catch it. Fix that too. * We were disabling the bugprone-macro parentheses check in clang-tidy. I don't think that's a good idea. Re-enable it and fix existing warnings. * It might also be a good idea to enable the bugprone-narrowing-conversions check. Fix a number of issues across the tree which, amongst other things trigger that warning. There are lots of other places that trigger the warning which I haven't fixed yet, so don't enable it yet. Changes since v2: * Rebased after most of the series was applied * Avoid triggering unmatchedSuppression on earlier cppcheck versions David Gibson (1): cppcheck: Suppress constParameterCallback errors pasta.c | 1 + tcp.c | 1 + tcp_splice.c | 1 + 3 files changed, 3 insertions(+) -- 2.45.2

1 1

passt: new version 2024_06_07.8a83b53 available
by Stefano Brivio 07 Jun '24

07 Jun '24

The new version with tag 2024_06_07.8a83b53 includes the following changes: 8a83b53 selinux: Allow access to user_devpts ec416fd tcp, flow: Fix some error paths which didn't clean up flows properly 3f63743 util: Use 'long' to represent millisecond durations f9e8ee0 lineread: Use ssize_t for line lengths c919bbb conf: Safer parsing of MAC addresses bda80ef util: Use unsigned indices for bits in bitmaps 0e36fe1 clang-tidy: Enable the bugprone-macro-parentheses check 7094b91 Remove pointless macro parameters in CALL_PROTO_HANDLER c80fa6a udp: Make rport calculation more local d2afb4b tcp: Make pointer const in tcp_revert_seq b3aeb00 log: Remove log_to_stdout option 7cb2088 conf: Don't print usage via the logging subsystem e651197 conf: Remove unhelpful usage() wrapper e84a01e tcp: move seq_to_tap update to when frame is queued https://passt.top/passt/log/?qt=range&q=2024_05_23.765eb0b..2024_06_07.8a83… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7558696/ permanent mirror: https://passt.top/builds/copr/0^20240607.g8a83b53/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1eddc56-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1eddc56-1_all.deb -- Stefano

1 0

[PATCH] tcp, flow: Fix some error paths which didn't clean up flows properly
by David Gibson 07 Jun '24

07 Jun '24

Flow table entries need to be fully initialised before returning to the main epoll loop. Commit 0060acd1 ("flow: Clarify and enforce flow state transitions") now enforces that: once a flow is allocated we must either cancel it, or activate it before returning to the main loop, or we will hit an ASSERT(). Some error paths in tcp_conn_from_tap() weren't correctly updated for this requirement - we can exit with a flow entry incompletely initialised. Correct that by cancelling the flows in those situations. I don't have enough information to be certain if this is the cause for podman bug 22925, but it plausibly could be. Fixes: 0060acd1 ("flow: Clarify and enforce flow state transitions") Link: https://github.com/containers/podman/issues/22925 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tcp.c b/tcp.c index 0dccde9c..cb613cf3 100644 --- a/tcp.c +++ b/tcp.c @@ -2067,7 +2067,7 @@ static void tcp_conn_from_tap(struct ctx *c, sa_family_t af, if (!bind(s, sa, sl)) { tcp_rst(c, conn); /* Nobody is listening then */ - return; + goto cancel; } if (errno != EADDRNOTAVAIL && errno != EACCES) conn_flag(c, conn, LOCAL); @@ -2080,7 +2080,7 @@ static void tcp_conn_from_tap(struct ctx *c, sa_family_t af, if (connect(s, sa, sl)) { if (errno != EINPROGRESS) { tcp_rst(c, conn); - return; + goto cancel; } tcp_get_sndbuf(conn); @@ -2088,7 +2088,7 @@ static void tcp_conn_from_tap(struct ctx *c, sa_family_t af, tcp_get_sndbuf(conn); if (tcp_send_flag(c, conn, SYN | ACK)) - return; + goto cancel; conn_event(c, conn, TAP_SYN_ACK_SENT); } -- 2.45.2

2 1

[PATCH] selinux: Allow access to user_devpts
by Derek Schrock 07 Jun '24

07 Jun '24

Allow access to user_devpts. $ pasta --version pasta 0^20240510.g7288448-1.fc40.x86_64 ... $ awk '' < /dev/null $ pasta --version $ While this might be a awk bug it appears pasta should still have access to devpts. --- contrib/selinux/pasta.te | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 0ceda06..4e36c3f 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -211,3 +211,4 @@ allow pasta_t ifconfig_t:process { noatsecure rlimitinh siginh }; allow pasta_t netutils_t:process { noatsecure rlimitinh siginh }; allow pasta_t ping_t:process { noatsecure rlimitinh siginh }; allow pasta_t user_tty_device_t:chr_file { append read write }; +allow pasta_t user_devpts_t:chr_file { append read write }; -- 2.45.0

3 7

[PATCH v6] tcp: Make pointer const in tcp_revert_seq
by David Gibson 06 Jun '24

06 Jun '24

The th pointer could be const, which causes a cppcheck warning on at least some cppcheck versions (e.g. Cppcheck 2.13.0 in Fedora 40). Fixes: e84a01e94 "tcp: move seq_to_tap update to when frame is queued" Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tcp.c b/tcp.c index 89a5b19a..ff1198dd 100644 --- a/tcp.c +++ b/tcp.c @@ -1261,8 +1261,8 @@ static void tcp_revert_seq(struct tcp_tap_conn **conns, struct iovec (*frames)[T int i; for (i = 0; i < num_frames; i++) { + const struct tcphdr *th = frames[i][TCP_IOV_PAYLOAD].iov_base; struct tcp_tap_conn *conn = conns[i]; - struct tcphdr *th = frames[i][TCP_IOV_PAYLOAD].iov_base; uint32_t seq = ntohl(th->seq); if (SEQ_LE(conn->seq_to_tap, seq)) -- 2.45.2

1 1

[PATCH v2 0/3] conf, log: Fix regression in usage() printing
by David Gibson 05 Jun '24

05 Jun '24

Erik Sjölund pointed out a regression where we're no long printing the --help message to stdout, but to stderr instead. I'm not actually sure what caused the regression, but it was made possible by the fact that the original fix was pretty strange to begin with. It introduced some hacks to force the logging subsystem to go to stdout, which have presumably failed in some subtle way. But, there's really no reason to run usage() through the logging subsystem in the first place - it just adds complexity. Link: https://bugs.passt.top/show_bug.cgi?id=90 Link: https://bugs.passt.top/show_bug.cgi?id=52 Changes since v1: * Use multi-line strings heavily in 2/3 David Gibson (3): conf: Remove unhelpful usage() wrapper conf: Don't print usage via the logging subsystem log: Remove log_to_stdout option conf.c | 337 ++++++++++++++++++++++++++++----------------------------- log.c | 8 +- log.h | 1 - 3 files changed, 170 insertions(+), 176 deletions(-) -- 2.45.1

2 4

[PATCH v8] tcp: move seq_to_tap update to when frame is queued
by Jon Maloy 05 Jun '24

05 Jun '24

commit a469fc393fa1 ("tcp, tap: Don't increase tap-side sequence counter for dropped frames") delayed update of conn->seq_to_tap until the moment the corresponding frame has been successfully pushed out. This has the advantage that we immediately can make a new attempt to transmit a frame after a failed trasnmit, rather than waiting for the peer to later discover a gap and trigger the fast retransmit mechanism to solve the problem. This approach has turned out to cause a problem with spurious sequence number updates during peer-initiated retransmits, and we have realized it may not be the best way to solve the above issue. We now restore the previous method, by updating the said field at the moment a frame is added to the outqueue. To retain the advantage of having a quick re-attempt based on local failure detection, we now scan through the part of the outqueue that had do be dropped, and restore the sequence counter for each affected connection to the most appropriate value. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Re-spun loop in tcp_revert_seq() and some other changes based on feedback from Stefano Brivio. - Added paranoid test to avoid that seq_to_tap becomes lower than seq_ack_from_tap. v3: - Identical to v2. Called v3 because it was embedded in a series with that version. v4: - In tcp_revert_seq(), we read the sequence number from the TCP header instead of keeping a copy in struct tcp_buf_seq_update. - Since the only remaining field in struct tcp_buf_seq_update is a pointer to struct tcp_tap_conn, we eliminate the struct altogether, and make the tcp6/tcp3_buf_seq_update arrays into arrays of said pointer. - Removed 'paranoid' test in tcp_revert_seq. If it happens, it is not fatal, and will be caught by other code anyway. - Separated from the series again. v5: - Changed way to index array within tcp_revert_seq() v6-v7: No changes. v8: Fixed missing indexing of tcp4/6_frame_conns array in tcp_payload_flush(). --- tcp.c | 61 ++++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 39 insertions(+), 22 deletions(-) diff --git a/tcp.c b/tcp.c index 06acb41..89a5b19 100644 --- a/tcp.c +++ b/tcp.c @@ -408,16 +408,6 @@ static int tcp_sock_ns [NUM_PORTS][IP_VERSIONS]; */ static union inany_addr low_rtt_dst[LOW_RTT_TABLE_SIZE]; -/** - * tcp_buf_seq_update - Sequences to update with length of frames once sent - * @seq: Pointer to sequence number sent to tap-side, to be updated - * @len: TCP payload length - */ -struct tcp_buf_seq_update { - uint32_t *seq; - uint16_t len; -}; - /* Static buffers */ /** * struct tcp_payload_t - TCP header and data to send segments with payload @@ -459,7 +449,8 @@ static struct tcp_payload_t tcp4_payload[TCP_FRAMES_MEM]; static_assert(MSS4 <= sizeof(tcp4_payload[0].data), "MSS4 is greater than 65516"); -static struct tcp_buf_seq_update tcp4_seq_update[TCP_FRAMES_MEM]; +/* References tracking the owner connection of frames in the tap outqueue */ +static struct tcp_tap_conn *tcp4_frame_conns[TCP_FRAMES_MEM]; static unsigned int tcp4_payload_used; static struct tap_hdr tcp4_flags_tap_hdr[TCP_FRAMES_MEM]; @@ -481,7 +472,8 @@ static struct tcp_payload_t tcp6_payload[TCP_FRAMES_MEM]; static_assert(MSS6 <= sizeof(tcp6_payload[0].data), "MSS6 is greater than 65516"); -static struct tcp_buf_seq_update tcp6_seq_update[TCP_FRAMES_MEM]; +/* References tracking the owner connection of frames in the tap outqueue */ +static struct tcp_tap_conn *tcp6_frame_conns[TCP_FRAMES_MEM]; static unsigned int tcp6_payload_used; static struct tap_hdr tcp6_flags_tap_hdr[TCP_FRAMES_MEM]; @@ -1257,25 +1249,51 @@ static void tcp_flags_flush(const struct ctx *c) tcp4_flags_used = 0; } +/** + * tcp_revert_seq() - Revert affected conn->seq_to_tap after failed transmission + * @conns: Array of connection pointers corresponding to queued frames + * @frames: Two-dimensional array containing queued frames with sub-iovs + * @num_frames: Number of entries in the two arrays to be compared + */ +static void tcp_revert_seq(struct tcp_tap_conn **conns, struct iovec (*frames)[TCP_NUM_IOVS], + int num_frames) +{ + int i; + + for (i = 0; i < num_frames; i++) { + struct tcp_tap_conn *conn = conns[i]; + struct tcphdr *th = frames[i][TCP_IOV_PAYLOAD].iov_base; + uint32_t seq = ntohl(th->seq); + + if (SEQ_LE(conn->seq_to_tap, seq)) + continue; + + conn->seq_to_tap = seq; + } +} + /** * tcp_payload_flush() - Send out buffers for segments with data * @c: Execution context */ static void tcp_payload_flush(const struct ctx *c) { - unsigned i; size_t m; m = tap_send_frames(c, &tcp6_l2_iov[0][0], TCP_NUM_IOVS, tcp6_payload_used); - for (i = 0; i < m; i++) - *tcp6_seq_update[i].seq += tcp6_seq_update[i].len; + if (m != tcp6_payload_used) { + tcp_revert_seq(&tcp6_frame_conns[m], &tcp6_l2_iov[m], + tcp6_payload_used - m); + } tcp6_payload_used = 0; m = tap_send_frames(c, &tcp4_l2_iov[0][0], TCP_NUM_IOVS, tcp4_payload_used); - for (i = 0; i < m; i++) - *tcp4_seq_update[i].seq += tcp4_seq_update[i].len; + if (m != tcp4_payload_used) { + tcp_revert_seq(&tcp4_frame_conns[m], &tcp4_l2_iov[m], + tcp4_payload_used - m); + } tcp4_payload_used = 0; } @@ -2129,10 +2147,11 @@ static int tcp_sock_consume(const struct tcp_tap_conn *conn, uint32_t ack_seq) static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, ssize_t dlen, int no_csum, uint32_t seq) { - uint32_t *seq_update = &conn->seq_to_tap; struct iovec *iov; size_t l4len; + conn->seq_to_tap = seq + dlen; + if (CONN_V4(conn)) { struct iovec *iov_prev = tcp4_l2_iov[tcp4_payload_used - 1]; const uint16_t *check = NULL; @@ -2142,8 +2161,7 @@ static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, check = &iph->check; } - tcp4_seq_update[tcp4_payload_used].seq = seq_update; - tcp4_seq_update[tcp4_payload_used].len = dlen; + tcp4_frame_conns[tcp4_payload_used] = conn; iov = tcp4_l2_iov[tcp4_payload_used++]; l4len = tcp_l2_buf_fill_headers(c, conn, iov, dlen, check, seq); @@ -2151,8 +2169,7 @@ static void tcp_data_to_tap(const struct ctx *c, struct tcp_tap_conn *conn, if (tcp4_payload_used > TCP_FRAMES_MEM - 1) tcp_payload_flush(c); } else if (CONN_V6(conn)) { - tcp6_seq_update[tcp6_payload_used].seq = seq_update; - tcp6_seq_update[tcp6_payload_used].len = dlen; + tcp6_frame_conns[tcp6_payload_used] = conn; iov = tcp6_l2_iov[tcp6_payload_used++]; l4len = tcp_l2_buf_fill_headers(c, conn, iov, dlen, NULL, seq); -- 2.42.0

3 6

[PATCH 0/3] conf, log: Fix regression in usage() printing
by David Gibson 05 Jun '24

05 Jun '24

Erik Sjölund pointed out a regression where we're no long printing the --help message to stdout, but to stderr instead. I'm not actually sure what caused the regression, but it was made possible by the fact that the original fix was pretty strange to begin with. It introduced some hacks to force the logging subsystem to go to stdout, which have presumably failed in some subtle way. But, there's really no reason to run usage() through the logging subsystem in the first place - it just adds complexity. Link: https://bugs.passt.top/show_bug.cgi?id=90 Link: https://bugs.passt.top/show_bug.cgi?id=52 David Gibson (3): conf: Remove unhelpful usage() wrapper conf: Don't print usage via the logging subsystem log: Remove log_to_stdout option conf.c | 329 ++++++++++++++++++++++++++++----------------------------- log.c | 8 +- log.h | 1 - 3 files changed, 163 insertions(+), 175 deletions(-) -- 2.45.1

2 5

[PATCH v4 0/3] Support for SO_PEEK_OFF socket option
by Jon Maloy 04 Jun '24

04 Jun '24

Latest changes based on feedback. Notably, removed fast retransmit when peer advertises zero-window. Jon Maloy (3): tcp: move seq_to_tap update to when frame is queued tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 149 ++++++++++++++++++++++++++++++++++++++++------------- tcp_conn.h | 2 + 2 files changed, 116 insertions(+), 35 deletions(-) -- 2.42.0

3 17