April 2025 - dev

[PATCH v4] udp: support traceroute
by Jon Maloy 03 Apr '25

03 Apr '25

Now that ICMP pass-through from socket-to-tap is in place, it is easy to support UDP based traceroute functionality in direction tap-to-socket. We fix that in this commit. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Using ancillary data instead of setsockopt to transfer outgoing TTL. - Support IPv6 v3: - Storing ttl per packet instead of per flow. This may not be elegant, but much less intrusive than changing the flow criteria. This eliminates the need for the extra, flow-changing patch we introduced in v2. v4: - Going back to something similar to the original solution, but storing current ttl in struct udp_flow, plus ensuring that all packets in a struct tap4_l4_t/tap6_l4_t instance, have the same ttl. After input from David Gibson. --- packet.h | 2 ++ tap.c | 18 ++++++++++++++---- udp.c | 17 ++++++++++++++++- udp.h | 3 ++- udp_flow.c | 1 + udp_flow.h | 1 + 6 files changed, 36 insertions(+), 6 deletions(-) diff --git a/packet.h b/packet.h index c94780a..e84e123 100644 --- a/packet.h +++ b/packet.h @@ -11,6 +11,8 @@ /* Maximum size of a single packet stored in pool, including headers */ #define PACKET_MAX_LEN ((size_t)UINT16_MAX) +#define DEFAULT_TTL 64 + /** * struct pool - Generic pool of packets stored in a buffer * @buf: Buffer storing packet descriptors, diff --git a/tap.c b/tap.c index 3a6fcbe..e65d592 100644 --- a/tap.c +++ b/tap.c @@ -563,6 +563,7 @@ PACKET_POOL_DECL(pool_l4, UIO_MAXIOV, pkt_buf); * @dest: Destination port * @saddr: Source address * @daddr: Destination address + * @ttl: Time to live * @msg: Array of messages that can be handled in a single call */ static struct tap4_l4_t { @@ -574,6 +575,8 @@ static struct tap4_l4_t { struct in_addr saddr; struct in_addr daddr; + uint8_t ttl; + struct pool_l4_t p; } tap4_l4[TAP_SEQS /* Arbitrary: TAP_MSGS in theory, so limit in users */]; @@ -586,6 +589,7 @@ static struct tap4_l4_t { * @dest: Destination port * @saddr: Source address * @daddr: Destination address + * @hop_limit: Hop limit * @msg: Array of messages that can be handled in a single call */ static struct tap6_l4_t { @@ -598,6 +602,8 @@ static struct tap6_l4_t { struct in6_addr saddr; struct in6_addr daddr; + uint8_t hop_limit; + struct pool_l4_t p; } tap6_l4[TAP_SEQS /* Arbitrary: TAP_MSGS in theory, so limit in users */]; @@ -786,7 +792,8 @@ resume: #define L4_MATCH(iph, uh, seq) \ ((seq)->protocol == (iph)->protocol && \ (seq)->source == (uh)->source && (seq)->dest == (uh)->dest && \ - (seq)->saddr.s_addr == (iph)->saddr && (seq)->daddr.s_addr == (iph)->daddr) + (seq)->saddr.s_addr == (iph)->saddr && \ + (seq)->daddr.s_addr == (iph)->daddr && (seq)->ttl == (iph)->ttl) #define L4_SET(iph, uh, seq) \ do { \ @@ -795,6 +802,7 @@ resume: (seq)->dest = (uh)->dest; \ (seq)->saddr.s_addr = (iph)->saddr; \ (seq)->daddr.s_addr = (iph)->daddr; \ + (seq)->ttl = (iph)->ttl; \ } while (0) if (seq && L4_MATCH(iph, uh, seq) && seq->p.count < UIO_MAXIOV) @@ -843,7 +851,7 @@ append: for (k = 0; k < p->count; ) k += udp_tap_handler(c, PIF_TAP, AF_INET, &seq->saddr, &seq->daddr, - p, k, now); + seq->ttl, p, k, now); } } @@ -966,7 +974,8 @@ resume: (seq)->dest == (uh)->dest && \ (seq)->flow_lbl == ip6_get_flow_lbl(ip6h) && \ IN6_ARE_ADDR_EQUAL(&(seq)->saddr, saddr) && \ - IN6_ARE_ADDR_EQUAL(&(seq)->daddr, daddr)) + IN6_ARE_ADDR_EQUAL(&(seq)->daddr, daddr) && \ + (seq)->hop_limit == (ip6h)->hop_limit) #define L4_SET(ip6h, proto, uh, seq) \ do { \ @@ -976,6 +985,7 @@ resume: (seq)->flow_lbl = ip6_get_flow_lbl(ip6h); \ (seq)->saddr = *saddr; \ (seq)->daddr = *daddr; \ + (seq)->hop_limit = (ip6h)->hop_limit; \ } while (0) if (seq && L4_MATCH(ip6h, proto, uh, seq) && @@ -1026,7 +1036,7 @@ append: for (k = 0; k < p->count; ) k += udp_tap_handler(c, PIF_TAP, AF_INET6, &seq->saddr, &seq->daddr, - p, k, now); + seq->hop_limit, p, k, now); } } diff --git a/udp.c b/udp.c index 39431d7..bc93292 100644 --- a/udp.c +++ b/udp.c @@ -849,6 +849,7 @@ fail: * @af: Address family, AF_INET or AF_INET6 * @saddr: Source address * @daddr: Destination address + * @ttl: TTL or hop limit for packets to be sent in this call * @p: Pool of UDP packets, with UDP headers * @idx: Index of first packet to process * @now: Current timestamp @@ -859,7 +860,8 @@ fail: */ int udp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, const void *saddr, const void *daddr, - const struct pool *p, int idx, const struct timespec *now) + uint8_t ttl, const struct pool *p, int idx, + const struct timespec *now) { const struct flowside *toside; struct mmsghdr mm[UIO_MAXIOV]; @@ -938,6 +940,19 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, mm[i].msg_hdr.msg_controllen = 0; mm[i].msg_hdr.msg_flags = 0; + if (ttl != uflow->ttl[tosidx.sidei]) { + uflow->ttl[tosidx.sidei] = ttl; + if (af == AF_INET) { + if (setsockopt(s, IPPROTO_IP, IP_TTL, + &ttl, sizeof(ttl)) < 0) + perror("setsockopt (IP_TTL)"); + } else { + if (setsockopt(s, IPPROTO_IPV6, IPV6_HOPLIMIT, + &ttl, sizeof(ttl)) < 0) + perror("setsockopt (IP_TTL)"); + } + } + count++; } diff --git a/udp.h b/udp.h index de2df6d..041fad4 100644 --- a/udp.h +++ b/udp.h @@ -15,7 +15,8 @@ void udp_reply_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t events, const struct timespec *now); int udp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, const void *saddr, const void *daddr, - const struct pool *p, int idx, const struct timespec *now); + uint8_t ttl, const struct pool *p, int idx, + const struct timespec *now); int udp_sock_init(const struct ctx *c, int ns, const union inany_addr *addr, const char *ifname, in_port_t port); int udp_init(struct ctx *c); diff --git a/udp_flow.c b/udp_flow.c index bf4b896..39372c2 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -137,6 +137,7 @@ static flow_sidx_t udp_flow_new(const struct ctx *c, union flow *flow, uflow = FLOW_SET_TYPE(flow, FLOW_UDP, udp); uflow->ts = now->tv_sec; uflow->s[INISIDE] = uflow->s[TGTSIDE] = -1; + uflow->ttl[INISIDE] = uflow->ttl[TGTSIDE] = DEFAULT_TTL; if (s_ini >= 0) { /* When using auto port-scanning the listening port could go diff --git a/udp_flow.h b/udp_flow.h index 9a1b059..606ac08 100644 --- a/udp_flow.h +++ b/udp_flow.h @@ -21,6 +21,7 @@ struct udp_flow { bool closed :1; time_t ts; int s[SIDES]; + uint8_t ttl[SIDES]; }; struct udp_flow *udp_at_sidx(flow_sidx_t sidx); -- 2.48.1

1 0

[PATCH 00/18] Introduce discontiguous frames management
by Laurent Vivier 03 Apr '25

03 Apr '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. Laurent Vivier (18): arp: Don't mix incoming and outgoing buffers iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_base() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: Convert to iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail tap: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert to iov_tail arp.c | 90 ++++++++++++++++++++++++------------ dhcp.c | 38 ++++++++------- dhcpv6.c | 70 +++++++++++++++------------- icmp.c | 38 +++++++++------ iov.c | 130 ++++++++++++++++++++++++++++++++++++++++++++++++---- iov.h | 54 ++++++++++++++++------ ip.c | 27 +++++------ ip.h | 3 +- ndp.c | 7 ++- packet.c | 58 ++++++++++------------- packet.h | 19 ++++---- pcap.c | 1 + tap.c | 86 ++++++++++++++++++++++------------ tap.h | 2 +- tcp.c | 41 +++++++++++------ tcp_buf.c | 2 +- udp.c | 37 ++++++++++----- vu_common.c | 25 ++-------- 18 files changed, 474 insertions(+), 254 deletions(-) -- 2.49.0

2 20

[PATCH 0/3] Add vhost-net kernel support
by Eugenio Pérez 03 Apr '25

03 Apr '25

vhost-net is a kernel device that allows to read packets from a tap device using virtio queues instead of regular read(2) and write(2). This enables a more eficient packet processing, as the memory can be written directly by the kernel to the userspace and back, instead of wasting bandwith on copies, and it enables to batch many packets in a single notification (through eventfds) both tx and rx. --- RFC: At this moment only to receive packets from the vhost kernel to the pasta binary is supported. It does not even support to refill more rx descriptors so the kernel can keep receiving packets! Just for early review to make sure we're on the same page. Eugenio Pérez (3): tap: specify the packet pool tap: implement vhost_call_cb tap: add die() on vhost error epoll_type.h | 4 + passt.c | 8 ++ passt.h | 13 +- tap.c | 366 +++++++++++++++++++++++++++++++++++++++++++++++++-- tap.h | 6 +- vu_common.c | 7 +- 6 files changed, 387 insertions(+), 17 deletions(-) -- 2.49.0

4 9

[PATCH 0/3] udp: Further preliminaries towards using connected sockets on both sides
by David Gibson 03 Apr '25

03 Apr '25

Some additional small cleanups David Gibson (3): udp: Remove redundant udp_at_sidx() call in udp_tap_handler() udp: Simplify updates to UDP flow timestamp udp: Correct some seccomp filter annotations udp.c | 23 +++++++++-------------- udp_vu.c | 9 +-------- udp_vu.h | 3 +-- 3 files changed, 11 insertions(+), 24 deletions(-) -- 2.49.0

2 5

[PATCH] passt-repair: Correct off-by-one error verifying name
by David Gibson 02 Apr '25

02 Apr '25

passt-repair will generate an error if the name it gets from the kernel is too long or not NUL terminated. Downstream testing has reported occasionally seeing this error in practice. In turns out there is a trivial off-by-one error in the check: ev->len is the length of the name, including terminating \0 characters, so to check for a \0 at the end of the buffer we need to check ev->name[len - 1] not ev->name[len]. Fixes: 42a854a52 ("pasta, passt-repair: Support multiple events per...") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt-repair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passt-repair.c b/passt-repair.c index 86f02934..440c77ae 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -157,7 +157,7 @@ int main(int argc, char **argv) } } while (!found); - if (ev->len > NAME_MAX + 1 || ev->name[ev->len] != '\0') { + if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') { fprintf(stderr, "Invalid filename from inotify\n"); _exit(1); } -- 2.49.0

2 1

[PATCH 0/4] RFC: bind() migrated connections in repair mode
by David Gibson 02 Apr '25

02 Apr '25

Downstream testing recently discovered that inbound connections can't be migrated properly, because the new socket gets an address conflict with its corresponding listening socket. It turns out this can be avoided by delaying bind() until after we're already in repair mode. Patch 4/4 is the actual fix here. Patch 3/4 adds a test program checking the behaviour to doc/platform-requirements. Patches 1 & 2 fix minor problems I spotted in doc/platform-requirements writing 3/4. Only 4/4 will need to be backported. David Gibson (4): platform requirements: Fix clang-tidy warning platform requirements: Add attributes to die() function platform requirements: Add test for address conflicts with TCP_REPAIR migrate, tcp: bind() migrated sockets in repair mode doc/platform-requirements/.gitignore | 1 + doc/platform-requirements/Makefile | 4 +- doc/platform-requirements/common.h | 1 + doc/platform-requirements/listen-vs-repair.c | 128 ++++++++++++++++++ .../reuseaddr-priority.c | 6 +- tcp.c | 38 ++++-- 6 files changed, 162 insertions(+), 16 deletions(-) create mode 100644 doc/platform-requirements/listen-vs-repair.c -- 2.49.0

2 5

2025

2024

2023

2022

2021

dev April 2025