February 2025 - dev

[PATCH] contrib/fedora: Actually install passt-repair SELinux policy file
by Stefano Brivio 18 Feb '25

18 Feb '25

Otherwise we build it, but we don't install it. Not an issue that warrants a a release right away as it's anyway usable. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 6a83f8b..745cf01 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -44,7 +44,7 @@ Requires(preun): %{name} Requires(preun): policycoreutils %description selinux -This package adds SELinux enforcement to passt(1) and pasta(1). +This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1). %prep %setup -q -n passt-%{git_hash} @@ -82,6 +82,7 @@ make -f %{_datadir}/selinux/devel/Makefile install -p -m 644 -D passt.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/passt.pp install -p -m 644 -D passt.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/passt.if install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp +install -p -m 644 -D passt-repair.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp popd %pre selinux @@ -90,11 +91,13 @@ popd %post selinux %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp %postun selinux if [ $1 -eq 0 ]; then %selinux_modules_uninstall -s %{selinuxtype} passt %selinux_modules_uninstall -s %{selinuxtype} pasta + %selinux_modules_uninstall -s %{selinuxtype} passt-repair fi %posttrans selinux @@ -124,6 +127,7 @@ fi %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp %{_datadir}/selinux/devel/include/distributed/passt.if %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp +%{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp %changelog {{{ passt_git_changelog }}} -- 2.43.0

1 0

[PATCH 0/3] Several small fixes
by David Gibson 18 Feb '25

18 Feb '25

As discussed on the call, here's the first of a number of pending fixes I'm clearing from my backlog. I suppoted these while working on the MTU fixes back in December, but they don't have an awful lot to do with that inherently. David Gibson (3): packet: Use flexible array member in struct pool packet: Don't pass start and offset separately to packet_check_range() tap: Remove unused ETH_HDR_INIT() macro packet.c | 36 +++++++++++++++++++----------------- packet.h | 5 ++--- tap.h | 2 -- vu_common.c | 11 ++++------- 4 files changed, 25 insertions(+), 29 deletions(-) -- 2.48.1

2 4

[PATCH v2] dhcp: Remove option 255 length byte
by Enrique Llorente 18 Feb '25

18 Feb '25

The option 255 (end of options) do not need the length byte, this change remove that allowing to have one extra byte at other dynamic options. Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- dhcp.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/dhcp.c b/dhcp.c index 401cb5b..4a209f1 100644 --- a/dhcp.c +++ b/dhcp.c @@ -64,9 +64,9 @@ static struct opt opts[255]; #define OPT_MIN 60 /* RFC 951 */ /* Total option size (excluding end option) is 576 (RFC 2131), minus - * offset of options (268), minus end option and its length (2). + * offset of options (268), minus end option (1). */ -#define OPT_MAX 306 +#define OPT_MAX 307 /** * dhcp_init() - Initialise DHCP options @@ -127,7 +127,7 @@ struct msg { uint8_t sname[64]; uint8_t file[128]; uint32_t magic; - uint8_t o[OPT_MAX + 2 /* End option and its length */ ]; + uint8_t o[OPT_MAX + 1 /* End option */ ]; } __attribute__((__packed__)); /** @@ -194,7 +194,6 @@ static int fill(struct msg *m) } m->o[offset++] = 255; - m->o[offset++] = 0; if (offset < OPT_MIN) { memset(&m->o[offset], 0, OPT_MIN - offset); -- 2.47.0

3 2

[PATCH] dhcp: Remove option 255 length byte
by Enrique Llorente 17 Feb '25

17 Feb '25

The option 255 (end of options) do not need the length byte, this change remove that allowing to have one extra byte at other dynamic options. Signed-off-by: Enrique Llorente <ellorent(a)redhat.com> --- dhcp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dhcp.c b/dhcp.c index 401cb5b..3aef13f 100644 --- a/dhcp.c +++ b/dhcp.c @@ -127,7 +127,7 @@ struct msg { uint8_t sname[64]; uint8_t file[128]; uint32_t magic; - uint8_t o[OPT_MAX + 2 /* End option and its length */ ]; + uint8_t o[OPT_MAX + 1 /* End option */ ]; } __attribute__((__packed__)); /** @@ -194,7 +194,6 @@ static int fill(struct msg *m) } m->o[offset++] = 255; - m->o[offset++] = 0; if (offset < OPT_MIN) { memset(&m->o[offset], 0, OPT_MIN - offset); -- 2.47.0

4 3

passt: new version 2025_02_17.a1e48a0 available
by Stefano Brivio 17 Feb '25

17 Feb '25

The new version with tag 2025_02_17.a1e48a0 includes the following changes: a1e48a0 test: Add migration tests 89ecf2f migrate: Migrate TCP flows 3e903bb repair, passt-repair: Build and warning fixes for musl 01b6a16 tcp_splice: A typo three years ago and SO_RCVLOWAT is gone 667caa0 tcp_splice: Don't wake up on input data if we can't write it anywhere 7c33b12 vhost_user: Clear ring address on GET_VRING_BASE 71249ef tcp, tcp_splice: Don't set SO_SNDBUF and SO_RCVBUF to maximum values 30f1e08 tcp: Keep updating window and checking for socket data after FIN from guest 98d474c contrib/selinux: Enable mapping guest memory for libvirt guests 9a84df4 selinux: Add rules needed to run tests a301158 rampstream: Add utility to test for corruption of data streams 6f122f0 tcp: Get bound address for connected inbound sockets too f3fe795 vhost_user: Make source quit after reporting migration state b899141 Add interfaces and configuration bits for passt-repair 155cd0c migrate: Migrate guest observed addresses 5911e08 migrate: Skeleton of live migration logic 836fe21 passt-repair: Fix off-by-one in check for number of file descriptors def7de4 tcp_vu: Fix off-by one in header count array adjustment 90f91fe tcp: Implement conservative zero-window probe on ACK timeout 472e2e9 tcp: Don't discard window information on keep-alive segments 31e8109 dhcp, dhcpv6: Add hostname and client fqdn ops a3d142a conf: Don't map DNS traffic to host, if host gateway is a resolver 864be47 passt-repair: Send one confirmation *per command*, not *per socket* fe8b6a7 dhcp: Don't re-use request message for reply b7b70ba passt-repair: Dodge "structurally unreachable code" warning from Coverity 0f009ea passt-repair: Fix calculation of payload length from cmsg_len a0b7f56 passt-repair: Don't use perror(), accept ECONNRESET as termination a5cca99 conf, passt.1: Un-deprecate --host-lo-to-ns-lo 0da87b3 debug: Add tcpdump to mbuto.img f66769c apparmor: Workaround for unconfined libvirtd when triggered by unprivileged user 593be32 passt-repair.1: Fix indication of TCP_REPAIR constants 9215f68 passt-repair: Build fixes for musl a9d63f9 passt-repair: use _exit() over return d0006fa treewide: use _exit() over exit() 745c163 tcp: Simplify handling of getsockname() b4a7b5d migrate: Fix several errors with passt-repair dcf014b doc: Add mock of migration source and target 52e57f9 tcp: Get socket port and address using getsockname() when connecting from guest 8c24301 Introduce passt-repair e894d9a vhost_user: Turn some vhost-user message reports to trace() e25a930 util: Add read_remainder() and read_all_buf() 71fa736 tcp_splice, udp_flow: fcntl64() support on PPC64 depends on glibc version b75ad15 vhost_user: On 32-bit ARM, mmap() is not available, mmap2() is used instead 722d347 tcp: Don't reset outbound connection on SYN retries bf28608 pasta.te: fix demo.sh and remove one duplicate rule dcd6d81 tcp: Add HOSTSIDE(x), HOSTFLOW(x) macros 0349cf6 util: Rename and make global vu_remove_watch() 10c4a9e tcp: Always pass NULL event with EPOLL_CTL_DEL dd6a685 vhost-user: Implement an empty VHOST_USER_SEND_RARP command d477a1f netlink: Skip loopback interface while looking for a template https://passt.top/passt/log/?qt=range&q=2025_01_21.4f2c8e7..2025_02_17.a1e4… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8663104/ permanent mirror: https://passt.top/builds/copr/0^20250217.ga1e48a0/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-ga1e48a0-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0a1e48a0-1_all.deb -- Stefano

1 0

[PATCH] tcp_splice: A typo three years ago and SO_RCVLOWAT is gone
by Stefano Brivio 17 Feb '25

17 Feb '25

In commit e5eefe77435a ("tcp: Refactor to use events instead of states, split out spliced implementation"), this: if (!bitmap_isset(rcvlowat_set, conn - ts) && readlen > (long)c->tcp.pipe_size / 10) { (note the !) became: if (conn->flags & lowat_set_flag && readlen > (long)c->tcp.pipe_size / 10) { in the new tcp_splice_sock_handler(). We want to check, there, if we should set SO_RCVLOWAT, only if we haven't set it already. But, instead, we're checking if it's already set before we set it, so we'll never set it, of course. Fix the check and re-enable the functionality, which should give us improved CPU utilisation in non-interactive cases where we are not transferring at full pipe capacity. Fixes: e5eefe77435a ("tcp: Refactor to use events instead of states, split out spliced implementation") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp_splice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tcp_splice.c b/tcp_splice.c index 8a39a6f..5d845c9 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -556,7 +556,7 @@ eintr: if (readlen >= (long)c->tcp.pipe_size * 10 / 100) continue; - if (conn->flags & lowat_set_flag && + if (!(conn->flags & lowat_set_flag) && readlen > (long)c->tcp.pipe_size / 10) { int lowat = c->tcp.pipe_size / 4; -- 2.43.0

2 4

[PATCH v2 0/2] Reconstruct ICMP headers for failed UDP connect
by Jon Maloy 17 Feb '25

17 Feb '25

Reconstruct incoming ICMP headers for failed UDP connect and forward back to local peer. v2: - Added patch breaking out udp header creation from function tap_udp4_send(). - Updated the ICMP creation by using the new function. - Added logics to find correct flow, depending on origin. - All done after feedback from David Gibson. Jon Maloy (2): tap: break out building of udp header from tap_udp4_send function udp: create and send ICMPv4 to local peer when applicable tap.c | 36 +++++++++++++++------ tap.h | 7 ++++ udp.c | 86 ++++++++++++++++++++++++++++++++++++++++++-------- udp_internal.h | 2 +- udp_vu.c | 4 +-- 5 files changed, 110 insertions(+), 25 deletions(-) -- 2.48.1

2 4

[PATCH v3] repair, passt-repair: Build and warning fixes for musl
by Stefano Brivio 17 Feb '25

17 Feb '25

Checked against musl 1.2.5. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v3: Now 100% more trusted, with cppcheck absolutely positive about us initialising 'buf'. v2: Now 100% more tested: don't try to use the whole buffer as msg_controllen. passt-repair.c | 4 +++- repair.c | 13 +++++++++---- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/passt-repair.c b/passt-repair.c index 1174ae3..e0c366e 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -63,6 +63,7 @@ int main(int argc, char **argv) struct cmsghdr *cmsg; struct msghdr msg; struct iovec iov; + size_t cmsg_len; int op; prctl(PR_SET_DUMPABLE, 0); @@ -138,8 +139,9 @@ loop: } } if (!n) { + cmsg_len = cmsg->cmsg_len; /* socklen_t is 'unsigned' on musl */ fprintf(stderr, "Invalid ancillary data length %zu from peer\n", - cmsg->cmsg_len); + cmsg_len); _exit(1); } diff --git a/repair.c b/repair.c index d288617..dac28a6 100644 --- a/repair.c +++ b/repair.c @@ -13,6 +13,7 @@ */ #include <errno.h> +#include <sys/socket.h> #include <sys/uio.h> #include "util.h" @@ -145,9 +146,9 @@ void repair_handler(struct ctx *c, uint32_t events) */ int repair_flush(struct ctx *c) { - struct iovec iov = { &repair_cmd, sizeof(repair_cmd) }; char buf[CMSG_SPACE(sizeof(int) * SCM_MAX_FD)] - __attribute__ ((aligned(__alignof__(struct cmsghdr)))); + __attribute__ ((aligned(__alignof__(struct cmsghdr)))) = { 0 }; + struct iovec iov = { &repair_cmd, sizeof(repair_cmd) }; struct cmsghdr *cmsg; struct msghdr msg; int8_t reply; @@ -155,8 +156,12 @@ int repair_flush(struct ctx *c) if (!repair_nfds) return 0; - msg = (struct msghdr){ NULL, 0, &iov, 1, - buf, CMSG_SPACE(sizeof(int) * repair_nfds), 0 }; + msg = (struct msghdr){ .msg_name = NULL, .msg_namelen = 0, + .msg_iov = &iov, .msg_iovlen = 1, + .msg_control = buf, + .msg_controllen = CMSG_SPACE(sizeof(int) * + repair_nfds), + .msg_flags = 0 }; cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_SOCKET; -- 2.43.0

2 1

[PATCH v27 0/2] State migration, perhaps final (#2)?
by Stefano Brivio 17 Feb '25

17 Feb '25

Compared to v25, test changes only: run all the tests we added. Compared to v26: actually commit all the tests. Stefano Brivio (2): migrate: Migrate TCP flows test: Add migration tests contrib/selinux/passt.te | 4 +- flow.c | 243 +++++++++ flow.h | 8 + migrate.c | 10 + passt.c | 6 +- repair.c | 1 - tcp.c | 919 +++++++++++++++++++++++++++++++++ tcp_conn.h | 103 ++++ test/lib/layout | 55 +- test/lib/setup | 138 ++++- test/lib/test | 48 ++ test/migrate/basic | 59 +++ test/migrate/basic_fin | 62 +++ test/migrate/bidirectional | 64 +++ test/migrate/bidirectional_fin | 64 +++ test/migrate/iperf3_bidir6 | 58 +++ test/migrate/iperf3_in4 | 50 ++ test/migrate/iperf3_in6 | 58 +++ test/migrate/iperf3_many_out6 | 60 +++ test/migrate/iperf3_out4 | 47 ++ test/migrate/iperf3_out6 | 58 +++ test/migrate/rampstream_in | 12 +- test/migrate/rampstream_out | 8 +- test/run | 42 +- 24 files changed, 2158 insertions(+), 19 deletions(-) create mode 100644 test/migrate/basic create mode 100644 test/migrate/basic_fin create mode 100644 test/migrate/bidirectional create mode 100644 test/migrate/bidirectional_fin create mode 100644 test/migrate/iperf3_bidir6 create mode 100644 test/migrate/iperf3_in4 create mode 100644 test/migrate/iperf3_in6 create mode 100644 test/migrate/iperf3_many_out6 create mode 100644 test/migrate/iperf3_out4 create mode 100644 test/migrate/iperf3_out6 -- 2.43.0

2 4

[PATCH v26 0/2] State migration, perhaps final?
by Stefano Brivio 16 Feb '25

16 Feb '25

Compared to v25, test changes only: run all the tests we added. Stefano Brivio (2): migrate: Migrate TCP flows test: Add migration tests contrib/selinux/passt.te | 4 +- flow.c | 243 ++++++++++ flow.h | 8 + migrate.c | 10 + passt.c | 6 +- repair.c | 1 - tcp.c | 919 ++++++++++++++++++++++++++++++++++++ tcp_conn.h | 103 ++++ test/lib/layout | 55 ++- test/lib/setup | 138 +++++- test/lib/test | 48 ++ test/migrate/basic | 59 +++ test/migrate/bidirectional | 64 +++ test/migrate/iperf3_bidir6 | 58 +++ test/migrate/iperf3_in4 | 50 ++ test/migrate/iperf3_in6 | 58 +++ test/migrate/iperf3_out4 | 47 ++ test/migrate/iperf3_out6 | 58 +++ test/migrate/rampstream_in | 12 +- test/migrate/rampstream_out | 8 +- test/run | 42 +- 21 files changed, 1972 insertions(+), 19 deletions(-) create mode 100644 test/migrate/basic create mode 100644 test/migrate/bidirectional create mode 100644 test/migrate/iperf3_bidir6 create mode 100644 test/migrate/iperf3_in4 create mode 100644 test/migrate/iperf3_in6 create mode 100644 test/migrate/iperf3_out4 create mode 100644 test/migrate/iperf3_out6 -- 2.43.0

1 2