October 2025 - dev

[PATCH v6 0/4] Retry SYNs for inbound connections
by Yumei Huang 30 Oct '25

30 Oct '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism using the similar backoff timeout as linux kernel. Also update the data retransmission timeout using the backoff timeout. Yumei Huang (4): tcp: Rename "retrans" to "retries" util: Introduce read_file() and read_file_integer() function tcp: Resend SYN for inbound connections tcp: Update data retransmission timeout tcp.c | 76 +++++++++++++++++++++++++++++++++++------------- tcp.h | 5 ++++ tcp_conn.h | 12 ++++---- util.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ util.h | 8 ++++++ 5 files changed, 159 insertions(+), 26 deletions(-) -- 2.47.0

3 43

[PATCH v3 0/4] Retry SYNs for inbound connections
by Yumei Huang 29 Oct '25

29 Oct '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism using the similar backoff timeout as linux kernel. Also update the data retransmission timeout using the backoff timeout. Yumei Huang (4): tcp: Rename "retrans" to "retries" util: Introduce read_file() and read_file_long() function tcp: Resend SYN for inbound connections tcp: Update data retransmission timeout tcp.c | 79 ++++++++++++++++++++++++++++++++++------------ tcp.h | 2 ++ tcp_conn.h | 12 +++---- util.c | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ util.h | 2 ++ 5 files changed, 161 insertions(+), 26 deletions(-) -- 2.47.0

3 30

[PATCH v3 3/8] tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one()
by David Gibson 29 Oct '25

29 Oct '25

Surprisingly little logic is shared between the path for creating a listen()ing socket in the guest namespace versus in the host namespace. Improve this, by extending tcp_sock_init_one() to take a pif parameter indicating where it should open the socket. This allows tcp_ns_sock_init[46]() to be removed entirely. We generalise tcp_sock_init() in the same way, although we don't use it yet, due to some subtle differences in how we bind for -t versus -T. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 +- tcp.c | 100 +++++++++++++++++++-------------------------------------- tcp.h | 5 +-- 3 files changed, 37 insertions(+), 70 deletions(-) diff --git a/conf.c b/conf.c index 66b9e634..26f1bcc0 100644 --- a/conf.c +++ b/conf.c @@ -169,7 +169,7 @@ static void conf_ports_range_except(const struct ctx *c, char optname, fwd->delta[i] = to - first; if (optname == 't') - ret = tcp_sock_init(c, addr, ifname, i); + ret = tcp_sock_init(c, PIF_HOST, addr, ifname, i); else if (optname == 'u') ret = udp_sock_init(c, 0, addr, ifname, i); else diff --git a/tcp.c b/tcp.c index d63a16bf..5f4fc12c 100644 --- a/tcp.c +++ b/tcp.c @@ -2514,29 +2514,42 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, /** * tcp_sock_init_one() - Initialise listening socket for address and port * @c: Execution context + * @pif: Interface to open the socket for (PIF_HOST or PIF_SPLICE) * @addr: Pointer to address for binding, NULL for dual stack any * @ifname: Name of interface to bind to, NULL if not configured * @port: Port, host order * * Return: fd for the new listening socket, negative error code on failure + * + * If pif == PIF_SPLICE, the caller must have already entered the guest ns. */ -static int tcp_sock_init_one(const struct ctx *c, const union inany_addr *addr, - const char *ifname, in_port_t port) +static int tcp_sock_init_one(const struct ctx *c, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port) { union tcp_listen_epoll_ref tref = { .port = port, - .pif = PIF_HOST, + .pif = pif, }; + const struct fwd_ports *fwd; int s; - s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, PIF_HOST, addr, - ifname, port, tref.u32); + if (pif == PIF_HOST) + fwd = &c->tcp.fwd_in; + else + fwd = &c->tcp.fwd_out; + + s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, + port, tref.u32); + + if (fwd->mode == FWD_AUTO) { + int (*socks)[IP_VERSIONS] = pif == PIF_SPLICE ? + tcp_sock_ns : tcp_sock_init_ext; - if (c->tcp.fwd_in.mode == FWD_AUTO) { if (!addr || inany_v4(addr)) - tcp_sock_init_ext[port][V4] = s < 0 ? -1 : s; + socks[port][V4] = s < 0 ? -1 : s; if (!addr || !inany_v4(addr)) - tcp_sock_init_ext[port][V6] = s < 0 ? -1 : s; + socks[port][V6] = s < 0 ? -1 : s; } if (s < 0) @@ -2548,14 +2561,16 @@ static int tcp_sock_init_one(const struct ctx *c, const union inany_addr *addr, /** * tcp_sock_init() - Create listening sockets for a given host ("inbound") port * @c: Execution context + * @pif: Interface to open the socket for (PIF_HOST or PIF_SPLICE) * @addr: Pointer to address for binding, NULL if not configured * @ifname: Name of interface to bind to, NULL if not configured * @port: Port, host order * * Return: 0 on (partial) success, negative error code on (complete) failure */ -int tcp_sock_init(const struct ctx *c, const union inany_addr *addr, - const char *ifname, in_port_t port) +int tcp_sock_init(const struct ctx *c, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port) { int r4 = FD_REF_MAX + 1, r6 = FD_REF_MAX + 1; @@ -2563,72 +2578,23 @@ int tcp_sock_init(const struct ctx *c, const union inany_addr *addr, if (!addr && c->ifi4 && c->ifi6) /* Attempt to get a dual stack socket */ - if (tcp_sock_init_one(c, NULL, ifname, port) >= 0) + if (tcp_sock_init_one(c, pif, NULL, ifname, port) >= 0) return 0; /* Otherwise create a socket per IP version */ if ((!addr || inany_v4(addr)) && c->ifi4) - r4 = tcp_sock_init_one(c, addr ? addr : &inany_any4, - ifname, port); + r4 = tcp_sock_init_one(c, pif, + addr ? addr : &inany_any4, ifname, port); if ((!addr || !inany_v4(addr)) && c->ifi6) - r6 = tcp_sock_init_one(c, addr ? addr : &inany_any6, - ifname, port); + r6 = tcp_sock_init_one(c, pif, + addr ? addr : &inany_any6, ifname, port); if (IN_INTERVAL(0, FD_REF_MAX, r4) || IN_INTERVAL(0, FD_REF_MAX, r6)) return 0; return r4 < 0 ? r4 : r6; } - -/** - * tcp_ns_sock_init4() - Init socket to listen for outbound IPv4 connections - * @c: Execution context - * @port: Port, host order - */ -static void tcp_ns_sock_init4(const struct ctx *c, in_port_t port) -{ - union tcp_listen_epoll_ref tref = { - .port = port, - .pif = PIF_SPLICE, - }; - int s; - - ASSERT(c->mode == MODE_PASTA); - - s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, PIF_SPLICE, &inany_loopback4, - NULL, port, tref.u32); - if (s < 0) - s = -1; - - if (c->tcp.fwd_out.mode == FWD_AUTO) - tcp_sock_ns[port][V4] = s; -} - -/** - * tcp_ns_sock_init6() - Init socket to listen for outbound IPv6 connections - * @c: Execution context - * @port: Port, host order - */ -static void tcp_ns_sock_init6(const struct ctx *c, in_port_t port) -{ - union tcp_listen_epoll_ref tref = { - .port = port, - .pif = PIF_SPLICE, - }; - int s; - - ASSERT(c->mode == MODE_PASTA); - - s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, PIF_SPLICE, &inany_loopback6, - NULL, port, tref.u32); - if (s < 0) - s = -1; - - if (c->tcp.fwd_out.mode == FWD_AUTO) - tcp_sock_ns[port][V6] = s; -} - /** * tcp_ns_sock_init() - Init socket to listen for spliced outbound connections * @c: Execution context @@ -2639,9 +2605,9 @@ static void tcp_ns_sock_init(const struct ctx *c, in_port_t port) ASSERT(!c->no_tcp); if (c->ifi4) - tcp_ns_sock_init4(c, port); + tcp_sock_init_one(c, PIF_SPLICE, &inany_loopback4, NULL, port); if (c->ifi6) - tcp_ns_sock_init6(c, port); + tcp_sock_init_one(c, PIF_SPLICE, &inany_loopback6, NULL, port); } /** @@ -2844,7 +2810,7 @@ static void tcp_port_rebind(struct ctx *c, bool outbound) if (outbound) tcp_ns_sock_init(c, port); else - tcp_sock_init(c, NULL, NULL, port); + tcp_sock_init(c, PIF_HOST, NULL, NULL, port); } } } diff --git a/tcp.h b/tcp.h index 234a8033..fb22bac0 100644 --- a/tcp.h +++ b/tcp.h @@ -18,8 +18,9 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, const void *saddr, const void *daddr, uint32_t flow_lbl, const struct pool *p, int idx, const struct timespec *now); -int tcp_sock_init(const struct ctx *c, const union inany_addr *addr, - const char *ifname, in_port_t port); +int tcp_sock_init(const struct ctx *c, uint8_t pif, + const union inany_addr *addr, const char *ifname, + in_port_t port); int tcp_init(struct ctx *c); void tcp_timer(struct ctx *c, const struct timespec *now); void tcp_defer_handler(struct ctx *c); -- 2.51.0

1 0

[PATCH v2] tap: Update some function comments for accuracy
by David Gibson 29 Oct '25

29 Oct '25

Several of the tap_push_*() functions have doc comments claiming they take the context pointer, but don't. Some (tap_push_uh[46]) were broken fairly recently, but others (tap_push_ip[46]h) have been broken for a long time. Regardless, fix all the doc comments. Reported-by: Stefano Brivio <sbrivio(a)redhat.com> Fixes: 82a839be9 ("tap: break out building of udp header from tap_udp4_send function") Fixes: 87e6a4644 ("tap: break out building of udp header from tap_udp6_send function") Fixes: 2dbc622f5 ("tap: Split tap_ip4_send() into UDP and ICMP variants") Fixes: 9d8dd8b6f ("tap: Split tap_ip6_send() into UDP and ICMP variants") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) v2: * Added missing "Fixes" tags from v1's commit message. diff --git a/tap.c b/tap.c index 95d309bd..f3d1f660 100644 --- a/tap.c +++ b/tap.c @@ -188,7 +188,7 @@ void *tap_push_l2h(const struct ctx *c, void *buf, uint16_t proto) /** * tap_push_ip4h() - Build IPv4 header for inbound packet, with checksum - * @c: Execution context + * @ip4h: Buffer in which to build the IPv4 header * @src: IPv4 source address * @dst: IPv4 destination address * @l4len: IPv4 payload length @@ -217,7 +217,7 @@ void *tap_push_ip4h(struct iphdr *ip4h, struct in_addr src, /** * tap_push_uh4() - Build UDPv4 header with checksum - * @c: Execution context + * @uh: Buffer in which to build the UDP header * @src: IPv4 source address * @sport: UDP source port * @dst: IPv4 destination address @@ -293,7 +293,7 @@ void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_addr dst, /** * tap_push_ip6h() - Build IPv6 header for inbound packet - * @c: Execution context + * @ip6h: Buffer in which to build the IPv6 header * @src: IPv6 source address * @dst: IPv6 destination address * @l4len: L4 payload length @@ -319,7 +319,7 @@ void *tap_push_ip6h(struct ipv6hdr *ip6h, /** * tap_push_uh6() - Build UDPv6 header with checksum - * @c: Execution context + * @uh: Buffer in which to build the UDP header * @src: IPv6 source address * @sport: UDP source port * @dst: IPv6 destination address -- 2.51.0

2 4

[PATCH v2 0/3] Reduce differences between inbound and outbound socket binding
by David Gibson 29 Oct '25

29 Oct '25

The fact that outbound forwarding sockets are bound to the loopback address, whereas inbound forwarding sockets are (by default) bound to the unspecified address leads to some unexpected differences between the paths setting up each of them. Happily there's an approach to tackling bug 100 which also reduces those differences, allowing more code to be shared between the two paths. Amongst other things, this will make the next steps of flexible forwarding configuration easier. Link: https://bugs.passt.top/show_bug.cgi?id=100 v2: - Some rearrangements and rewordings for clarity David Gibson (3): tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one() udp: Unify some more inbound/outbound parts of udp_sock_init() tcp, udp: Bind outbound listening sockets by interface instead of address conf.c | 4 +- pif.c | 6 --- tcp.c | 114 +++++++++++++++++---------------------------------------- tcp.h | 5 ++- udp.c | 60 +++++++++++++++--------------- udp.h | 5 ++- 6 files changed, 70 insertions(+), 124 deletions(-) -- 2.51.0

2 5

[PATCH v2] Add reverse Christmas tree to CONTRIBUTING.md
by Yumei Huang 28 Oct '25

28 Oct '25

Also fix the copyright line. Suggested-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- CONTRIBUTING.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 75ad2a7..64c191f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@  @@ -24,6 +24,10 @@ to prepare patches and participate in the email-based review process. * Edit the source code or documentation following the [Linux kernel coding style](https://www.kernel.org/doc/html/latest/process/coding-style.html). + When adding or editing local variable declarations, please use the reverse + Christmas tree as described + [here](https://www.kernel.org/doc/Documentation/process/maintainer-kvm-x86.r… + and [here](https://hisham.hm/2018/06/16/when-listing-repeated-things-make-pyramids/). * Stage your changes: -- 2.51.0

3 2

[PATCH] fwd: Fix misspelling
by David Gibson 28 Oct '25

28 Oct '25

Mea culpa. Fixes: 1daf6f461522 ("conf, fwd: Make ephemeral port logic more flexible") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fwd.c b/fwd.c index 250cf564..31b61421 100644 --- a/fwd.c +++ b/fwd.c @@ -27,7 +27,7 @@ #include "lineread.h" #include "flow_table.h" -/* Empheral port range: values from RFC 6335 */ +/* Ephemeral port range: values from RFC 6335 */ static in_port_t fwd_ephemeral_min = (1 << 15) + (1 << 14); static in_port_t fwd_ephemeral_max = NUM_PORTS - 1; -- 2.51.0

2 1

[PATCH] test: Fix the escaping issue in memory/passt test
by Yumei Huang 28 Oct '25

28 Oct '25

Test memory/passt failed with error "objsize: No such file or directory" because of an escaping issue. Fix it. Link: https://bugs.passt.top/show_bug.cgi?id=155 Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/memory/passt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/memory/passt b/test/memory/passt index 7e45724..c5142ea 100644 --- a/test/memory/passt +++ b/test/memory/passt @@ -51,7 +51,7 @@ guest sed /proc/slabinfo -ne 's/^$[^ ]* *[^ ]* *[^ ]* *[^ ]*$.*/\\\1/p' > /tmp guest kill \$(cat /tmp/pid) guest diff -y --suppress-common-lines /tmp/meminfo.before /tmp/meminfo.after || : guest nm -td -Sr --size-sort -P /bin/passt.avx2 | head -30 | tee /tmp/nm.size -guest sed /proc/slabinfo -ne 's/$.*<objsize>$.*$/\1/p' | tail -1; (diff -y --suppress-common-lines /tmp/slabinfo.before /tmp/slabinfo.after | sort -grk8) +guest sed /proc/slabinfo -ne 's/$.*<objsize>$.*$/\\\1/p' | tail -1; (diff -y --suppress-common-lines /tmp/slabinfo.before /tmp/slabinfo.after | sort -grk8) endef def summary -- 2.47.0

3 4

Re: [PATCH] contrib/selinux: use regex instead of non-standard bash macro
by Stefano Brivio 27 Oct '25

27 Oct '25

[Cc'ing Max and Paul for awareness] Hi Danish, On Thu, 16 Oct 2025 13:10:41 +0530 Danish Prakash <contact(a)danishpraka.sh> wrote: > It might be possible to avoid using non-standard bash macro (%USERID), > and instead using regex to match user ids. This would also mean > discarding the explicit restorecon call while packaging[1]. > > [1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5 > > Link: https://bugzilla.suse.com/show_bug.cgi?id=1246291 Thanks for the patch. This link is private. Would you mind making a copy with the essential information in another ticket, or file a different ticket somewhere else (bugs.passt.top, or Podman's tracker...)? > Signed-off-by: Danish Prakash <contact(a)danishpraka.sh> > --- > contrib/fedora/passt.spec | 11 ----------- > contrib/selinux/pasta.fc | 12 ++++++------ > 2 files changed, 6 insertions(+), 17 deletions(-) > > diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec > index 663289f53d97..d1bcf4a74338 100644 > --- a/contrib/fedora/passt.spec > +++ b/contrib/fedora/passt.spec > @@ -103,17 +103,6 @@ fi > > %posttrans selinux > %selinux_relabel_post -s %{selinuxtype} > -# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file > -# (see selabel_file(5)) in order to restore only the file contexts which > -# actually changed. However, as file_contexts doesn't support %{USERID} > -# substitutions, this will not work for specific file contexts that pasta needs > -# to have under /run/user. > -# > -# Restore those explicitly, hiding errors from restorecon(8): we can't pass a > -# path that's more specific than this, but at the same time /run/user often > -# contains FUSE mountpoints that can't be accessed as root, leading to > -# "Permission denied" messages, but not failures. > -restorecon -R /run/user 2>/dev/null > > %files > %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} > diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc > index e60c6148f412..82dbcbe2b75e 100644 > --- a/contrib/selinux/pasta.fc > +++ b/contrib/selinux/pasta.fc > @@ -12,11 +12,11 @@ > /usr/bin/pasta.avx2 system_u:object_r:pasta_exec_t:s0 > /tmp/pasta\.pcap system_u:object_r:pasta_log_t:s0 > /var/run/pasta\.pid system_u:object_r:pasta_pid_t:s0 > -/run/user/%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 > -/run/user/%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 > +/run/user/[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 > +/run/user/[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 > # In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls > # back to a location under /tmp > -/tmp/storage-run-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 > -/tmp/storage-run-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 > -/tmp/containers-user-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 > -/tmp/containers-user-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 > +/tmp/storage-run-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 > +/tmp/storage-run-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 > +/tmp/containers-user-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 > +/tmp/containers-user-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 At a glance, this looks like a better solution regardless of the reported issue. It sounds too good to be true, though, so I wonder if Max remembers any reason why we couldn't do this in the first place. -- Stefano

3 2

[PATCH] Add pyramid style rule to CONTRIBUTING.md
by Yumei Huang 27 Oct '25

27 Oct '25

Also fix the copyright line. Suggested-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- CONTRIBUTING.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 75ad2a7..451cdd7 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,6 @@  @@ -24,6 +24,8 @@ to prepare patches and participate in the email-based review process. * Edit the source code or documentation following the [Linux kernel coding style](https://www.kernel.org/doc/html/latest/process/coding-style.html). + When adding or editing lists of similar items, please format in the pyramid + style as described [here](https://hisham.hm/2018/06/16/when-listing-repeated-things-make-pyramids/). * Stage your changes: -- 2.47.0

3 4