August 2024 - dev

[PATCH 0/3] Dual stack sockets for UDP
by David Gibson 27 Aug '24

27 Aug '24

Here, at last, is a change to use dual stack sockets for UDP port forwards as we have for TCP for some time. With the merging of many parallel IPv4/IPv6 structures being done for the flow table and other recent work, this actually turned out much easier than I anticipated. David Gibson (3): udp: Merge udp[46]_mh_recv arrays udp: Remove unnnecessary local from udp_sock_init() udp: Use dual stack sockets for port forwarding when possible udp.c | 104 ++++++++++++++++++++++++++++++---------------------------- udp.h | 2 -- 2 files changed, 53 insertions(+), 53 deletions(-) -- 2.46.0

2 8

[PATCH] mbuto: Fix handling of binaries in /usr/libexec
by Stefano Brivio 27 Aug '24

27 Aug '24

The FHS says that binaries under /usr/libexec are not intended to run directly on the host, and not, as I incorrectly assumed (probably from some outdated distribution guidelines), on other hosts only: https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html If we move them to /usr/bin in the guest image, the helpers or programs that are supposed to run those binaries might not find them. We have, however, cases like /usr/libexec/qemu-kvm on some distributions where we might have programs, on the host, which are meant to run them, but we don't want to copy those to the guest image, and we want to run the binary we copied from /usr/libexec directly. This was the reason why I initially added this special handling. Instead of doing that, simply add /usr/libexec to the guest's $PATH, from the $FIXUP script. Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- mbuto | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/mbuto b/mbuto index a2a8147..c2fffa0 100755 --- a/mbuto +++ b/mbuto @@ -48,10 +48,13 @@ COPIES="${COPIES:-}" # Workers for time-consuming tasks such as stripping modules, see workers() THREADS="$(nproc)" -# Fix-up script to run before /init, can be omitted +# Fix-up script to run before /init, can be omitted. Note that we're adding +# /usr/libexec to PATH because, while a given program might not be intended to +# directly run on the host (that's what /usr/libexec is for), we might need to +# run it directly on the guest instead. [ -z "${FIXUP}" ] && FIXUP='#!/bin/sh -export PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/sbin:/usr/sbin: +export PATH=/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/sbin:/usr/sbin:/usr/libexec: mount -t proc proc /proc mount -t sysfs sys /sys @@ -752,14 +755,7 @@ prog_add() { unset IFS [ -z "${__bin}" ] && err "Can't source ${1}" - # Binaries in /usr/libexec are meant to run on other hosts only, so they - # can't reside in /usr/libexec on the target image. Move to /usr/bin. - if [ "$("${DIRNAME}" "${__bin}")" = "/usr/libexec" ]; then - __bindir="${wd}/usr/bin" - else - __bindir="${wd}$("${DIRNAME}" "${__bin}")" - fi - + __bindir="${wd}$("${DIRNAME}" "${__bin}")" "${MKDIR}" -p "${__bindir}" "${CP}" --preserve=all "${__bin}" "${__bindir}" -- 2.43.0

2 1

[PATCH] test: Look for possible sshd-session paths (if it's there at all) in mbuto's profile
by Stefano Brivio 27 Aug '24

27 Aug '24

Some distributions already have OpenSSH 9.8, which introduces split sshd/sshd-session binaries, and there we need to copy the binary from the host, which can be /usr/libexec/openssh/sshd-session (Fedora Rawhide), /usr/lib/ssh/sshd-session (Arch Linux), /usr/lib/openssh/sshd-session (Debian), and possibly other paths. Add at least those three, and, if we don't find sshd-session, assume we don't need it: it could very well be an older version of OpenSSH, as reported by David for Fedora 40, or perhaps another daemon (would Dropbear even work? I'm not sure). Reported-by: David Gibson <david(a)gibson.dropbear.id.au> Fixes: d6817b3930be ("test/passt.mbuto: Install sshd-session OpenSSH's split process") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/passt.mbuto | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 61865e8..138d365 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -13,8 +13,15 @@ PROGS="${PROGS:-ash,dash,bash ip mount ls insmod mkdir ln cat chmod lsmod modprobe find grep mknod mv rm umount jq iperf3 dhclient hostname sed tr chown sipcalc cut socat dd strace ping tail killall sleep sysctl - nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp - /usr/lib/openssh/sshd-session}" + nproc tcp_rr tcp_crr udp_rr which tee seq bc sshd ssh-keygen cmp}" + +# OpenSSH 9.8 introduced split binaries, with sshd being the daemon, and +# sshd-session the per-session program. We need the latter as well, and the path +# depends on the distribution. It doesn't exist on older versions. +for bin in /usr/lib/openssh/sshd-session /usr/lib/ssh/sshd-session \ + /usr/libexec/openssh/sshd-session; do + command -v "${bin}" >/dev/null && PROGS="${PROGS} ${bin}" +done KMODS="${KMODS:- virtio_net virtio_pci vmw_vsock_virtio_transport}" -- 2.43.0

2 1

[PATCH] Remove incorrect special handling of /usr/libexec
by David Gibson 26 Aug '24

26 Aug '24

The statement in the comment about /usr/libexec being only for running on other hosts simply isn't true, neither in practice nor according to the FHS spec[0]. Furthermore this logic didn't even handle it correctly, since it would only handle binaries _directly_ in /usr/libexec, not those in (explicitly FHS permitted) subdirectories under /usr/libexec. [0] https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- mbuto | 8 -------- 1 file changed, 8 deletions(-) diff --git a/mbuto b/mbuto index a2a8147..5e8ea9c 100755 --- a/mbuto +++ b/mbuto @@ -752,14 +752,6 @@ prog_add() { unset IFS [ -z "${__bin}" ] && err "Can't source ${1}" - # Binaries in /usr/libexec are meant to run on other hosts only, so they - # can't reside in /usr/libexec on the target image. Move to /usr/bin. - if [ "$("${DIRNAME}" "${__bin}")" = "/usr/libexec" ]; then - __bindir="${wd}/usr/bin" - else - __bindir="${wd}$("${DIRNAME}" "${__bin}")" - fi - "${MKDIR}" -p "${__bindir}" "${CP}" --preserve=all "${__bin}" "${__bindir}" -- 2.46.0

2 6

[PATCH 0/4] Assorted test fixes for i386/i686 and OpenSSH 9.8
by Stefano Brivio 26 Aug '24

26 Aug '24

Stefano Brivio (4): test/lib/setup: Transform i686 kernel architecture name into QEMU name (i386) test/passt.mbuto: Run sshd from vsock proxy with absolute path test/passt.mbuto: Install sshd-session OpenSSH's split process test: Duplicate existing recvfrom() valgrind suppression for recv() test/lib/setup | 10 ++++++---- test/passt.mbuto | 5 +++-- test/valgrind.supp | 9 +++++++++ 3 files changed, 18 insertions(+), 6 deletions(-) -- 2.43.0

2 11

[PATCH v3 00/15] RFC: Proof-of-concept based exeter+Avocado tests
by David Gibson 26 Aug '24

26 Aug '24

Here's another draft of my work on testing passt with Avocado and the exeter library I recently created. It includes Cleber's patch adding some basic Avocado tests and builds on that. This draft is IMO significantly less janky than the last one, but certainly not jank-free: * We create the Avocado job files from the exeter sources in the Makefile. Ideally Avocado would eventually be extended to handle this itself * The names that Avocado sees for each test aren't great Stefano, If you could look particularly at 7/15 and 15/15 which add the real tests for passt/pasta, that would be great. The more specific you can be about what you find ugly about how the tests are written, then better I can try to address that. I suspect it will be easier to actually apply the series, then look at the new test files (test/build/build.py, and test/pasta/pasta.py particularly). From there you can look at as much of the support library as you need to, rather than digging through the actual patches to look for that. Cleber, If you could look at 4..7/22 particularly to review how I'm connecting the actual tests to the Avocado runner, that would be helpful. Changes since v2: * Added mypy type checking throughout * Use exeter "scenarios" to reduce boilerplate * Folded together a number of closely related patches (from 22 patches down to 15) * Entirely avoid open-coded Python context managers in favour of contextlib.contextmanager * No longer accidentally run a lot of the "meta" tests in the "real" testsuite * So, so many assorted cleanups Cleber Rosa (1): test: run static checkers with Avocado and JSON definitions David Gibson (14): test: Adjust how we invoke tests with run_avocado test: Extend make targets to run Avocado tests test: Exeter based static tests tasst: Support library and linters for tests in Python tasst/cmdsite: Base helpers for running shell commands in various places test: Add exeter+Avocado based build tests tasst/unshare: Add helpers to run commands in Linux unshared namespaces tasst/ip: Helpers for configuring IPv4 and IPv6 tasst/veth: Helpers for constructing veth devices between namespaces tasst: Helpers to test transferring data between sites tasst: Helpers for testing NDP behaviour tasst: Helpers for testing DHCP & DHCPv6 behaviour tasst: Helpers to construct a simple network environment for tests avocado: Convert basic pasta tests test/.gitignore | 2 + test/Makefile | 59 +++++++- test/avocado/static_checkers.json | 12 ++ test/build/.gitignore | 2 + test/build/build.py | 86 +++++++++++ test/build/static_checkers.sh | 28 ++++ test/meta/.gitignore | 1 + test/meta/lint.sh | 28 ++++ test/pasta/.gitignore | 1 + test/pasta/pasta.py | 130 +++++++++++++++++ test/run_avocado | 52 +++++++ test/tasst/.gitignore | 1 + test/tasst/__init__.py | 11 ++ test/tasst/__main__.py | 40 +++++ test/tasst/cmdsite.py | 193 ++++++++++++++++++++++++ test/tasst/dhcp.py | 190 ++++++++++++++++++++++++ test/tasst/ip.py | 234 ++++++++++++++++++++++++++++++ test/tasst/ndp.py | 106 ++++++++++++++ test/tasst/pasta.py | 48 ++++++ test/tasst/scenario/__init__.py | 12 ++ test/tasst/scenario/simple.py | 108 ++++++++++++++ test/tasst/selftest/__init__.py | 16 ++ test/tasst/transfer.py | 193 ++++++++++++++++++++++++ test/tasst/unshare.py | 166 +++++++++++++++++++++ test/tasst/veth.py | 104 +++++++++++++ 25 files changed, 1822 insertions(+), 1 deletion(-) create mode 100644 test/avocado/static_checkers.json create mode 100644 test/build/.gitignore create mode 100644 test/build/build.py create mode 100644 test/build/static_checkers.sh create mode 100644 test/meta/.gitignore create mode 100644 test/meta/lint.sh create mode 100644 test/pasta/.gitignore create mode 100644 test/pasta/pasta.py create mode 100755 test/run_avocado create mode 100644 test/tasst/.gitignore create mode 100644 test/tasst/__init__.py create mode 100644 test/tasst/__main__.py create mode 100644 test/tasst/cmdsite.py create mode 100644 test/tasst/dhcp.py create mode 100644 test/tasst/ip.py create mode 100644 test/tasst/ndp.py create mode 100644 test/tasst/pasta.py create mode 100644 test/tasst/scenario/__init__.py create mode 100644 test/tasst/scenario/simple.py create mode 100644 test/tasst/selftest/__init__.py create mode 100644 test/tasst/transfer.py create mode 100644 test/tasst/unshare.py create mode 100644 test/tasst/veth.py -- 2.46.0

1 15

[PATCH v2 0/2] Adding SO_PEEK_OFF for TCPv6
by Jon Maloy 23 Aug '24

23 Aug '24

Adding SO_PEEK_OFF for TCPv6 and selftest for it. Jon Maloy (2): tcp: add SO_PEEK_OFF socket option tor TCPv6 selftests: add selftest for tcp SO_PEEK_OFF support net/ipv6/af_inet6.c | 1 + tools/testing/selftests/net/Makefile | 1 + tools/testing/selftests/net/tcp_so_peek_off.c | 181 ++++++++++++++++++ 3 files changed, 183 insertions(+) create mode 100644 tools/testing/selftests/net/tcp_so_peek_off.c -- 2.45.2

3 5

selftests: add selftest for tcp SO_PEEK_OFF support
by Jon Maloy 22 Aug '24

22 Aug '24

We add a selftest to check that the SO_PEEK_OFF feature recently added to tcp works correctly. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/net/Makefile | 1 + tools/testing/selftests/net/tcp_so_peek_off.c | 161 ++++++++++++++++++ 3 files changed, 163 insertions(+) create mode 100644 tools/testing/selftests/net/tcp_so_peek_off.c diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile index a5f1c0c27dff..70537151b59d 100644 --- a/tools/testing/selftests/Makefile +++ b/tools/testing/selftests/Makefile @@ -69,6 +69,7 @@ TARGETS += net/openvswitch TARGETS += net/tcp_ao TARGETS += net/netfilter TARGETS += net/rds +TARGETS += net/tcp_so_peek_off TARGETS += nsfs TARGETS += perf_events TARGETS += pidfd diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile index 8eaffd7a641c..5dfe912e3fbb 100644 --- a/tools/testing/selftests/net/Makefile +++ b/tools/testing/selftests/net/Makefile @@ -63,6 +63,7 @@ TEST_GEN_FILES += tcp_mmap tcp_inq psock_snd txring_overwrite TEST_GEN_FILES += udpgso udpgso_bench_tx udpgso_bench_rx ip_defrag TEST_GEN_FILES += so_txtime ipv6_flowlabel ipv6_flowlabel_mgr so_netns_cookie TEST_GEN_FILES += tcp_fastopen_backup_key +TEST_GEN_FILES += tcp_so_peek_off TEST_GEN_FILES += fin_ack_lat TEST_GEN_FILES += reuseaddr_ports_exhausted TEST_GEN_FILES += hwtstamp_config rxtimestamp timestamping txtimestamp diff --git a/tools/testing/selftests/net/tcp_so_peek_off.c b/tools/testing/selftests/net/tcp_so_peek_off.c new file mode 100644 index 000000000000..b4fd8a940795 --- /dev/null +++ b/tools/testing/selftests/net/tcp_so_peek_off.c @@ -0,0 +1,161 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <errno.h> +#include <sys/types.h> +#include <netinet/in.h> +#include <arpa/inet.h> + +int tcp_peek_offset_probe(sa_family_t af) +{ + int optv = 0; + int ret = 0; + int s; + + s = socket(af, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP); + if (s < 0) { + perror("Temporary TCP socket creation failed"); + } else { + if (!setsockopt(s, SOL_SOCKET, SO_PEEK_OFF, &optv, sizeof(int))) + ret = 1; + close(s); + } + return ret; +} + + +static void tcp_peek_offset_set(int s, int offset) +{ + if (setsockopt(s, SOL_SOCKET, SO_PEEK_OFF, &offset, sizeof(offset))) + perror("Failed to set SO_PEEK_OFF value\n"); +} + +static int tcp_peek_offset_get(int s) +{ + int offset; + socklen_t len = sizeof(offset); + + if (getsockopt(s, SOL_SOCKET, SO_PEEK_OFF, &offset, &len)) + perror("Failed to get SO_PEEK_OFF value\n"); + return offset; +} + +static int tcp_peek_offset_test(void) +{ + struct sockaddr a = { AF_INET, {0, }}; + int err = EXIT_FAILURE; + int s[2] = {0, 0}; + int recv_sock = 0; + int offset = 0; + ssize_t len; + char buf; + + s[0] = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + s[1] = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP); + + if (s[0] < 0 || s[1] < 0) { + perror("Temporary probe socket creation failed\n"); + goto out; + } + if (0 > bind(s[0], &a, sizeof(a))) { + perror("Temporary probe socket bind() failed\n"); + goto out; + } + if (0 > getsockname(s[0], &a, &((socklen_t) { sizeof(a) }))) { + perror("Temporary probe socket getsockname() failed\n"); + goto out; + } + if (0 > listen(s[0], 0)) { + perror("Temporary probe socket listen() failed\n"); + goto out; + } + if (0 <= connect(s[1], &a, sizeof(a)) || errno != EINPROGRESS) { + perror("Temporary probe socket connect() failed\n"); + goto out; + } + recv_sock = accept(s[0], NULL, NULL); + if (recv_sock <= 0) { + perror("Temporary probe socket accept() failed\n"); + goto out; + } + + /* Some basic tests of getting/setting offset */ + offset = tcp_peek_offset_get(recv_sock); + if (offset != -1) { + perror("Initial value of socket offset not -1\n"); + goto out; + } + tcp_peek_offset_set(recv_sock, 0); + offset = tcp_peek_offset_get(recv_sock); + if (offset != 0) { + perror("Failed to set socket offset to 0\n"); + goto out; + } + + /* Transfer a message */ + if (0 >= send(s[1], (char *)("ab"), 2, 0) || errno != EINPROGRESS) { + perror("Temporary probe socket send() failed\n"); + goto out; + } + /* Read first byte */ + len = recv(recv_sock, &buf, 1, MSG_PEEK); + if (len != 1 || buf != 'a') { + perror("Failed to read first byte of message\n"); + goto out; + } + offset = tcp_peek_offset_get(recv_sock); + if (offset != 1) { + perror("Offset not forwarded correctly at first byte\n"); + goto out; + } + /* Try to read beyond last byte */ + len = recv(recv_sock, &buf, 2, MSG_PEEK); + if (len != 1 || buf != 'b') { + perror("Failed to read last byte of message\n"); + goto out; + } + offset = tcp_peek_offset_get(recv_sock); + if (offset != 2) { + perror("Offset not forwarded correctly at last byte\n"); + goto out; + } + /* Flush message */ + len = recv(recv_sock, NULL, 2, MSG_TRUNC); + if (len != 2) { + perror("Failed to flush message\n"); + goto out; + } + offset = tcp_peek_offset_get(recv_sock); + if (offset != 0) { + perror("Offset not reverted correctly after flush\n"); + goto out; + } + + printf("TCP with MSG_PEEK_OFF works correctly\n"); + err = EXIT_SUCCESS; +out: + close(recv_sock); + close(s[1]); + close(s[0]); + return err; +} + +int main(int argc, char *argv[]) +{ + int cap4 = 0, cap6 = 0; + + cap4 = tcp_peek_offset_probe(AF_INET); + if (!cap4) + printf("SO_PEEK_OFF not supported for TCP/IPv4\n"); + cap6 = tcp_peek_offset_probe(AF_INET6); + if (!cap6) + printf("SO_PEEK_OFF not supported for TCP/IPv6\n"); + if (!cap4 || !cap6) + exit(EXIT_SUCCESS); + + exit(tcp_peek_offset_test()); +} + -- 2.45.2

2 1

passt: new version 2024_08_21.1d6142f available
by Stefano Brivio 21 Aug '24

21 Aug '24

The new version with tag 2024_08_21.1d6142f includes the following changes: 1d6142f README: pasta is indeed a supported back-end for rootless Docker f00ebda util: Don't stop on unrelated values when looking for --fd in close_open_files() 05453ea test: Update list of dependencies in README.md 1a66806 tcp, udp: Allow timerfd_gettime64() and recvmmsg_time64() on arm (armhf) 6e9ecf5 util: Provide own version of close_range(), and no-op fallback 7291b70 udp_flow: Add missing unistd.h include for close() 3963075 test: Duplicate existing recvfrom() valgrind suppression for recv() d6817b3 test/passt.mbuto: Install sshd-session OpenSSH's split process 34be8ee test/passt.mbuto: Run sshd from vsock proxy with absolute path aded2b6 test/lib/setup: Transform i686 kernel architecture name into QEMU name (i386) 2aea1da treewide: Allow additional system calls for i386/i686 57b7bd2 fwd, conf: Allow NAT of the guest's assigned address 8436c0d fwd: Distinguish translatable from untranslatable addresses on inbound e813a4d conf: Allow address remapped to host to be configured dbaaebb test: Reconfigure IPv6 address after changing MTU 935bd81 conf, fwd: Split notion of gateway/router from guest-visible host address 90e83d5 Don't take "our" MAC address from the host 356de97 fwd: Split notion of "our tap address" from gateway for IPv4 4d8dd1f fwd: Helpers to clarify what host addresses aren't guest accessible 975cfa5 Initialise our_tap_ll to ip6.gw when suitable 8d4baa4 Clarify which addresses in ip[46]_ctx are meaningful where a42fb9c treewide: Change misleading 'addr_ll' name c9f0ec3 util: Correct sock_l4() binding for link local addresses 57532f1 conf: Remove incorrect initialisation of addr_ll_seen 0b25cac conf: Treat --dns addresses as guest visible addresses a6066f4 conf: Correct setting of dns_match address in add_dns6() 7c083ee conf: Move adding of a nameserver from resolv.conf into subfunction 1d10760 conf: Move DNS array bounds checks into add_dns[46] 6852bd0 conf: More accurately count entries added in get_dns() c679894 conf: Use array indices rather than pointers for DNS array slots ceea52c treewide: Use struct assignment instead of memcpy() for IP addresses 905ecd2 treewide: Rename MAC address fields for clarity 066e699 util: Helper for formatting MAC addresses e6feb5a treewide: Use "our address" instead of "forwarding address" 32c3868 netlink: Fix typo in function comment for nl_addr_set() f4e9f26 pasta: Disable neighbour solicitations on device up to prevent DAD d6f0220 netlink, pasta: Fetch link-local address from namespace interface once it's up 74e508c netlink, pasta: Disable DAD for link-local addresses on namespace interface 0c74068 netlink, pasta: Turn nl_link_up() into a generic function to set link flags 8231ce5 netlink, pasta: Split MTU setting functionality out of nl_link_up() b91d337 netlink: Fix typo in function comment for nl_addr_get() 9462064 test: Speed up by cutting on eye candy and performance test duration https://passt.top/passt/log/?qt=range&q=2024_08_14.61c0b0d..2024_08_21.1d61… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): ...nope, see https://github.com/fedora-copr/copr/issues/3380 - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1d6142f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1d6142f-1_all.deb -- Stefano

1 0

[PATCH v2 00/23] Allow configuration of special case NATs
by David Gibson 21 Aug '24

21 Aug '24

Based on Stefano's recent patch for faster tests. Allow the user to specify which addresses are translated when used by the guest, rather than always being the gateway address or nothing. We also allow this remapping to go to the host's global address (more precisely the address assigned to the guest) rather than just host loopback. Along the way to implementing that make many changes to clarify what various addresses we track mean, fixing a number of small bugs as well. Paul, amongst other things, I think this will allow podman to (finally) nicely address #19213, picking an address to remap to the host's external address with --map-guest-addr, much like it already uses --dns-forward. Changes in v2: * Assorted minor stylistic fixes based on Stefano's review * Change name of the new options from --nat-* to --map-* * Shorten descriptions of new options in --help (leave the full text to the man page) * Add fix for the fact that changing MTU causes IPv6 to be temporarily deconfigured during perf tests David Gibson (23): treewide: Use "our address" instead of "forwarding address" util: Helper for formatting MAC addresses treewide: Rename MAC address fields for clarity treewide: Use struct assignment instead of memcpy() for IP addresses conf: Use array indices rather than pointers for DNS array slots conf: More accurately count entries added in get_dns() conf: Move DNS array bounds checks into add_dns[46] conf: Move adding of a nameserver from resolv.conf into subfunction conf: Correct setting of dns_match address in add_dns6() conf: Treat --dns addresses as guest visible addresses conf: Remove incorrect initialisation of addr_ll_seen util: Correct sock_l4() binding for link local addresses treewide: Change misleading 'addr_ll' name Clarify which addresses in ip[46]_ctx are meaningful where Initialise our_tap_ll to ip6.gw when suitable fwd: Helpers to clarify what host addresses aren't guest accessible fwd: Split notion of "our tap address" from gateway for IPv4 Don't take "our" MAC address from the host conf, fwd: Split notion of gateway/router from guest-visible host address test: Reconfigure IPv6 address after changing MTU conf: Allow address remapped to host to be configured fwd: Distinguish translatable from untranslatable addresses on inbound fwd, conf: Allow NAT of the guest's assigned address arp.c | 4 +- conf.c | 318 +++++++++++++++++++++++++----------------- dhcp.c | 21 +-- dhcpv6.c | 21 +-- flow.c | 72 +++++----- flow.h | 18 +-- fwd.c | 170 +++++++++++++++++----- icmp.c | 4 +- ndp.c | 9 +- passt.1 | 43 +++++- passt.c | 2 +- passt.h | 53 +++++-- pasta.c | 14 +- tap.c | 12 +- tcp.c | 33 ++--- tcp_internal.h | 2 +- test/lib/setup | 11 +- test/passt_in_ns/dhcp | 73 ++++++++++ test/passt_in_ns/tcp | 38 +++-- test/passt_in_ns/udp | 22 +-- test/perf/passt_tcp | 37 ++--- test/perf/passt_udp | 31 ++-- test/perf/pasta_tcp | 29 ++-- test/perf/pasta_udp | 25 ++-- test/run | 4 +- udp.c | 12 +- util.c | 22 ++- util.h | 4 +- 28 files changed, 712 insertions(+), 392 deletions(-) create mode 100644 test/passt_in_ns/dhcp -- 2.46.0

2 24