July 2026 - dev

[PATCH v2 0/2] pasta: Do not configure ID mappings when invoked with --netns-only
by Dwayne B. Bent 23 Jul '26

23 Jul '26

Patch revised based on comments: 1. Reordered test and code commits to not break bisections. 2. Added `Link:` lines to commit messages. Otherwise code and test are the same. Thanks. Dwayne B. Bent (2): pasta: Do not configure ID mappings when invoked with --netns-only pasta: Regression test for bug 216 conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 5 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 test/pasta_options/netns_only -- 2.55.0

2 4

[PATCH 0/2] Allow users to give source address with --gateway also for IPv6
by Stefano Brivio 23 Jul '26

23 Jul '26

...just like it happens with IPv4. This offers a solution for https://bugs.passt.top/show_bug.cgi?id=217, as Podman can specify --address and --gateway for IPv6 local mode, and provide a unique local address, without the need to introduce other options. Further options might be more appropriate, strictly speaking, but as the future perspective is to eventually generalise NAT tables, it would be nice to avoid them right now. Stefano Brivio (2): conf: Honour --address, --gateway, --netmask in local mode as well conf, fwd: Prefer same-scope address as inbound source address from host conf.c | 23 +++++++++++++++++++---- fwd.c | 6 +++++- passt.h | 2 ++ 3 files changed, 26 insertions(+), 5 deletions(-) -- 2.43.0

2 4

[PATCH] passt.1: Clearer and more detailed description of --map-guest-addr
by David Gibson 23 Jul '26

23 Jul '26

It's been pointed out in bug 132 and elsewhere that the man page's description of the --map-guest-addr isn't very clear. It's technically correct, but hard to follow. In my defense as its author, this is largely because the problem the option is addressing is itself quite subtle and hard to explain. In particular while it's usually about host <-> guest communication, it may not be if -a is also used, and the semantics need to accomodate that. Anyway, here's an attempt to make clearer what it does - and why it more or less has to work that way. Reviews on clarity most welcome - I've had my head in the forwarding and address translation for the better part of a year, so it's natural that I've somewhat lost sight of what is and isn't obvious to someone coming fresh. Cc: Paul Holzinger <pholzing(a)redhat.com> Cc: Jan Rodak <jrodak(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=132 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.1 | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/passt.1 b/passt.1 index 995590a6..19901c1e 100644 --- a/passt.1 +++ b/passt.1 @@ -405,18 +405,34 @@ sandboxing process fails. .TP .BR \-\-map-guest-addr " " \fIaddr -Translate \fIaddr\fR in the guest to be equal to the guest's assigned -address on the host. That is, packets from the guest to \fIaddr\fR -will be redirected to the address assigned to the guest with \fB-a\fR, -or by default the host's global address. This allows the guest to -access services available on the host's global address, even though its -own address shadows that of the host. - -If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one -IPv6 address can be translated, and if the option is specified -multiple times, the last one for each address type takes effect. - -By default, mapping happens as described for the \-\-map-host-loopback option. +Because passt cannot allocate addresses in the host's network +environment, the guest or namespace will typically share an address +with some other "shadowed" interface in the host's network or the +wider internet. By default, the shadowed interface will be the host's +own primary interface, because that's the address given to the guest. +If the guest address is assigned with \fB-a\fR, however, the shadowed +interface will be whatever host-visible interface has the same +address, which could belong to any node on the host's network or the +internet. + +The guest or namespace cannot communicate with the shadowed interface +using its host-visible address: because that's the same as the guest's +address, sending packets there would loop back to the guest before +they're seen by passt to forward. + +\fB--map-guest-addr\fR allows the guest to communicate with the +shadowed interface via the address \fIaddr\fR instead. Packets from +the guest to \fIaddr\fR are translated into packets from the host to +the shadowed interface. Similarly, packets from the shadowed +interface to the host which are forwarded by passt's \fB-t\fR or +\fB-u\fR options will be translated to appear as if from \fIaddr\fR to +the guest's address. + +\fB--map-guest-addr none\fR or omitting \fB--map-guest-addr\fR +entirely means no address is mapped, and the guest will be unable to +communicate with the shadowed interface. Only one IPv4 and one IPv6 +address can be translated, and if the option is specified multiple +times, the last one for each address family takes effect. .TP .BR \-4 ", " \-\-ipv4-only -- 2.55.0

2 2

[PATCH v3] feat: Add cli option '--pass-fds' for pasta mode.
by Richard Lawrence 23 Jul '26

23 Jul '26

From: Richard Lawrence <rarensu(a)tamu.edu> When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. The `pass-fds` option accepts a comma-separated list of file descriptor numbers. `conf_pass_fds()` parses the command line argument, then `isolate_fds()` skips closing the specified fds by calling `close_range()` on the gaps between them. Additionally, the tap fd is safely relocated to the lowest unused fd number which it at least 3, to avoid accidentally overwriting an existing fd. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++- conf.h | 3 +++ isolation.c | 73 ++++++++++++++++++++++++++++++++++++++++++---------- passt.1 | 5 ++++ 4 files changed, 140 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index 0fcba5c..729816d 100644 --- a/conf.c +++ b/conf.c @@ -732,7 +732,9 @@ pasta_opts: " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" " --no-splice Disable inbound socket splicing\n" - " --splice-only Only enable loopback forwarding\n"); + " --splice-only Only enable loopback forwarding\n" + " --pass-fds FDS Comma-separated list of fds to pass to\n" + " the spawned command\n"); passt_exit(status); } @@ -1183,6 +1185,71 @@ int conf_tap_fd(int argc, char **argv) return val; } +/** + * conf_pass_fds() - Read fds as supplied by --pass-fds command line option + * @argc: Argument count + * @argv: Command line options + * @fds: Array where we store the parsed fds + * @max_fds: Maximum size of the array + * + * Return: number of parsed fds, or -1 if option not specified + */ +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds) +{ + const struct option opt[] = { { "pass-fds", required_argument, NULL, 33 }, + { 0 }, }; + const char *fdsarg = NULL; + int name, fds_cnt = 0; + int old_opterr; + + old_opterr = opterr; + opterr = 0; + optind = 0; + do { + name = getopt_long(argc, argv, "-:", opt, NULL); + if (name == 33) + fdsarg = optarg; + } while (name != -1); + opterr = old_opterr; + + if (!fdsarg) + return -1; + + const char *orig_fdsarg = fdsarg; + + while (*fdsarg) { + unsigned long val; + char *endptr; + + val = strtoul(fdsarg, &endptr, 10); + if (fdsarg == endptr) { + die("Invalid character in --pass-fds option '%s' (near '%s')", + orig_fdsarg, fdsarg); + } + + if (val > INT_MAX) { + die("Invalid file descriptor in --pass-fds option '%s' (near '%s')", + orig_fdsarg, fdsarg); + } + + if (fds_cnt >= max_fds) + die("Too many file descriptors in --pass-fds"); + + fds[fds_cnt++] = (int)val; + + if (*endptr == ',') + fdsarg = endptr + 1; + else if (*endptr == '\0') + fdsarg = endptr; + else { + die("Invalid character in --pass-fds option '%s' (near '%s')", + orig_fdsarg, endptr); + } + } + + return fds_cnt; +} + /** * conf_addr() - Configure guest address with -a option * @c: Execution context @@ -1331,6 +1398,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"pass-fds", required_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1572,6 +1640,10 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--pass-fds is for pasta mode only"); + break; case 'd': c->debug = 1; c->quiet = 0; diff --git a/conf.h b/conf.h index 19bf9bc..28a9acc 100644 --- a/conf.h +++ b/conf.h @@ -6,7 +6,10 @@ #ifndef CONF_H #define CONF_H +#define PASS_FDS_MAX 1024 + enum passt_modes conf_mode(int argc, char *argv[]); +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds); int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..25f599b 100644 --- a/isolation.c +++ b/isolation.c @@ -249,32 +249,77 @@ void isolate_initial(void) } /* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr + * isolate_fds() - Close leaked files, but not --fd, --pass-fds, standard streams * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd + * @argv: Command line options * * Should: - * - close all open files except for standard streams and the one from --fd + * - close all open files except for standard streams, --fd, and --pass-fds * - move the --fd descriptor out of the range 0-2 * * Return: new fd number for descriptor from --fd, or -1 if not specified */ int isolate_fds(int argc, char **argv) { - int fd, close_from = STDERR_FILENO + 1; + int fds[PASS_FDS_MAX + 1]; + int fds_cnt = 0; + int prev_fd; + int next_fd; + int tap_fd; + int rc = 0; + int i; + + tap_fd = conf_tap_fd(argc, argv); + if (tap_fd >= 0 && tap_fd < 3) { + /* Move the tap fd to a safer location */ + int new_fd = fcntl(tap_fd, F_DUPFD, STDERR_FILENO + 1); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); + + close(tap_fd); + tap_fd = new_fd; + } + + if (tap_fd >= 0) + /* Keep the tap fd */ + fds[fds_cnt++] = tap_fd; + + rc = conf_pass_fds(argc, argv, fds + fds_cnt, PASS_FDS_MAX); + if (rc > 0) + /* Keep the pass-fds */ + fds_cnt += rc; - fd = conf_tap_fd(argc, argv); + rc = 0; - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + /* Keep standard streams */ + prev_fd = STDERR_FILENO; + + while (1) { + next_fd = -1; + + /* Find the next-lowest fd to keep */ + for (i = 0; i < fds_cnt; i++) { + if (fds[i] > prev_fd && (next_fd == -1 || fds[i] < next_fd)) + next_fd = fds[i]; + } + + if (next_fd == -1) + break; + + if (next_fd > prev_fd + 1) { + /* Close fds between two kept fds */ + if (close_range(prev_fd + 1, next_fd - 1, CLOSE_RANGE_UNSHARE)) + rc = -1; + } + prev_fd = next_fd; } + + /* Close all other fds */ + if (close_range(prev_fd + 1, ~0U, CLOSE_RANGE_UNSHARE)) + rc = -1; - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { + if (rc) { if (errno == ENOSYS || errno == EINVAL) { /* This probably means close_range() or the * CLOSE_RANGE_UNSHARE flag is not supported by the @@ -288,7 +333,7 @@ int isolate_fds(int argc, char **argv) } } - return fd; + return tap_fd; } /** diff --git a/passt.1 b/passt.1 index 995590a..bcd3aff 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ of local traffic in pasta\fR in the \fBNOTES\fR for more details. Do not create a tap device in the namespace. In this mode, \fIpasta\fR only forwards loopback traffic between namespaces. +.TP +.BR \-\-pass\-fds " " \fIfds\fR +Pass a comma-separated list of file descriptors to the spawned command. +These file descriptors will be kept open. + .SH EXAMPLES .SS \fBpasta -- 2.52.0

4 6

[PATCH 0/2] pasta: Do not configure ID mappings when invoked with --netns-only
by Dwayne B. Bent 22 Jul '26

22 Jul '26

This is a narrow fix for bug 216 where `pasta` attempts to configure user and group ID mappings when invoked with `--netns-only`. A new `bool` argument `config_idmaps` was added to `pasta_start_ns()` that guards the logic to configure user and group ID mappings. It is set to `false` when `netns_only` is `true`. OpenAI Codex was used to explore and understand the codebase. Code written myself. Test written by Codex guided and reviewed by me. Dwayne B. Bent (2): pasta: Regression test for bug 216 pasta: Do not configure ID mappings when invoked with --netns-only conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 5 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 test/pasta_options/netns_only -- 2.55.0

2 4

[PATCH] udp, icmp: Remove unused timer_run fields from protocol contexts
by Laurent Vivier 21 Jul '26

21 Jul '26

Since 260075bde769 ("tcp, udp, fwd: Run all port scanning from a single timer"), CALL_PROTO_HANDLER() is only used for TCP. UDP and ICMP timers now run from flow_defer_handler(), making the timer_run fields in struct udp_ctx and struct icmp_ctx dead stores. Remove the unused fields, drop struct icmp_ctx entirely (it has no remaining members), and stop initialising them in timer_init(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- icmp.h | 7 ------- passt.c | 2 +- passt.h | 2 -- udp.h | 2 -- 4 files changed, 1 insertion(+), 12 deletions(-) diff --git a/icmp.h b/icmp.h index e8b928b61370..556260461995 100644 --- a/icmp.h +++ b/icmp.h @@ -19,12 +19,5 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, struct iov_tail *data, const struct timespec *now); void icmp_init(void); -/** - * struct icmp_ctx - Execution context for ICMP routines - * @timer_run: Timestamp of most recent timer run - */ -struct icmp_ctx { - struct timespec timer_run; -}; #endif /* ICMP_H */ diff --git a/passt.c b/passt.c index b1d35d5bf988..677c8471a105 100644 --- a/passt.c +++ b/passt.c @@ -141,7 +141,7 @@ static void random_init(struct ctx *c) */ static void timer_init(struct ctx *c, const struct timespec *now) { - c->tcp.timer_run = c->udp.timer_run = c->icmp.timer_run = *now; + c->tcp.timer_run = *now; } /** diff --git a/passt.h b/passt.h index 3a072945c382..205d7eecede7 100644 --- a/passt.h +++ b/passt.h @@ -194,7 +194,6 @@ struct ip6_ctx { * @no_udp: Disable UDP operation * @udp: Context for UDP protocol handler * @no_icmp: Disable ICMP operation - * @icmp: Context for ICMP protocol handler * @mtu: MTU passed via DHCP/NDP * @no_dns: Do not source/use DNS servers for any purpose * @no_dns_search: Do not source/use domain search lists for any purpose @@ -279,7 +278,6 @@ struct ctx { int no_udp; struct udp_ctx udp; int no_icmp; - struct icmp_ctx icmp; int no_dns; int no_dns_search; diff --git a/udp.h b/udp.h index 9ea7de682caf..b50283eab198 100644 --- a/udp.h +++ b/udp.h @@ -26,14 +26,12 @@ void udp_update_l2_buf(const unsigned char *eth_d); * struct udp_ctx - Execution context for UDP * @scan_in: Port scanning state for inbound packets * @scan_out: Port scanning state for outbound packets - * @timer_run: Timestamp of most recent timer run * @timeout: Timeout for unidirectional flows (in s) * @stream_timeout: Timeout for stream-like flows (in s) */ struct udp_ctx { struct fwd_scan scan_in; struct fwd_scan scan_out; - struct timespec timer_run; int timeout; int stream_timeout; }; -- 2.54.0

3 3

[PATCH v5 0/7] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 21 Jul '26

21 Jul '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. RFC 3396 option splitting for concatenation-requiring options has also been introduce as a separate patch. Anshu Kumari (7): dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option state management with enum opt_state dhcp: Add option overload dhcp: Add --dhcp-opt with option table and value parser dhcp: Add --dhcp-boot command-line option dhcp: Add RFC 3396 option splitting for concatenation-requiring options dhcp: Handle FQDN option with RFC 3396 concatenation conf.c | 30 ++- dhcp.c | 591 +++++++++++++++++++++++++++++++++++++++++++++++++++----- dhcp.h | 2 + passt.1 | 49 +++++ 4 files changed, 621 insertions(+), 51 deletions(-) -- 2.54.0

2 15

[PATCH v5 1/7] dhcp: Refactor fill_one() to operate on a generic buffer
by Anshu Kumari 20 Jul '26

20 Jul '26

Change fill_one() to accept a buffer pointer and capacity instead of a struct msg pointer. This is a pure refactor with no behavior change, preparing for option overload support where fill_one() will also write into the file and sname fields. Link: https://bugs.passt.top/show_bug.cgi?id=192 Signed-off-by: Anshu Kumari <anskuma(a)redhat.com> --- v5: - Restore debug messages for skipped options in fill() - Add /* code and length of option */ comment in size check - Use buf + *offset instead of &buf[*offset] for memcpy v3: - Restored removed comments: "If we don't have space to write the option, then just skip" and "Move to option". v2: - Renamed parameter cap → size. --- dhcp.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/dhcp.c b/dhcp.c index c3c7422..bb72b72 100644 --- a/dhcp.c +++ b/dhcp.c @@ -131,28 +131,29 @@ struct msg { } __attribute__((__packed__)); /** - * fill_one() - Fill a single option in message - * @m: Message to fill + * fill_one() - Fill a single option into a buffer + * @buf: Buffer to write option + * @size: Usable size of @buf (excluding end marker) * @o: Option number - * @offset: Current offset within options field, updated on insertion + * @offset: Current offset within @buf, updated on insertion * - * Return: false if m has space to write the option, true otherwise + * Return: false if @buf has space to write the option, true otherwise */ -static bool fill_one(struct msg *m, int o, int *offset) +static bool fill_one(uint8_t *buf, size_t size, int o, int *offset) { size_t slen = opts[o].slen; /* If we don't have space to write the option, then just skip */ - if (*offset + 2 /* code and length of option */ + slen > OPT_MAX) + if (*offset + 2 /* code and length of option */ + slen > size) return true; - m->o[*offset] = o; - m->o[*offset + 1] = slen; + buf[*offset] = o; + buf[*offset + 1] = slen; /* Move to option */ *offset += 2; - memcpy(&m->o[*offset], opts[o].s, slen); + memcpy(buf + *offset, opts[o].s, slen); opts[o].sent = 1; *offset += slen; @@ -177,19 +178,19 @@ static int fill(struct msg *m) * Put it there explicitly, unless requested via option 55. */ if (opts[55].clen > 0 && !memchr(opts[55].c, 53, opts[55].clen)) - if (fill_one(m, 53, &offset)) - debug("DHCP: skipping option 53"); + if (fill_one(m->o, OPT_MAX, 53, &offset)) + debug("DHCP: skipping option 53"); for (i = 0; i < opts[55].clen; i++) { o = opts[55].c[i]; if (opts[o].slen != -1) - if (fill_one(m, o, &offset)) + if (fill_one(m->o, OPT_MAX, o, &offset)) debug("DHCP: skipping option %i", o); } for (o = 0; o < 255; o++) { if (opts[o].slen != -1 && !opts[o].sent) - if (fill_one(m, o, &offset)) + if (fill_one(m->o, OPT_MAX, o, &offset)) debug("DHCP: skipping option %i", o); } -- 2.54.0

2 1

[PATCH v2] feat: Add cli option '--pass-fds' for pasta mode.
by Richard Lawrence 19 Jul '26

19 Jul '26

From: Richard Lawrence <rarensu(a)tamu.edu> When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. The `pass-fds` option accepts a comma-separated list of file descriptor numbers. `conf_pass_fds()` parses the command line argument, then `isolate_fds()` skips closing the specified fds by calling `close_range()` on the gaps between them. Additionally, the tap fd is safely relocated to the lowest unused fd number which it at least 3, to avoid accidentally overwriting an existing fd. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++- conf.h | 1 + isolation.c | 68 ++++++++++++++++++++++++++++++++++++++++++----------- passt.1 | 5 ++++ 4 files changed, 125 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index 0fcba5c..3246735 100644 --- a/conf.c +++ b/conf.c @@ -732,7 +732,9 @@ pasta_opts: " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" " --no-splice Disable inbound socket splicing\n" - " --splice-only Only enable loopback forwarding\n"); + " --splice-only Only enable loopback forwarding\n" + " --pass-fds FDS Comma-separated list of fds to pass to\n" + " the spawned command\n"); passt_exit(status); } @@ -1183,6 +1185,63 @@ int conf_tap_fd(int argc, char **argv) return val; } +/** + * conf_pass_fds() - Read fds as supplied by --pass-fds command line option + * @argc: Argument count + * @argv: Command line options + * @fds: Array where we store the parsed fds + * @max_fds: Maximum size of the array + * + * Return: number of parsed fds, or -1 if option not specified + */ +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds) +{ + const struct option opt[] = { { "pass-fds", required_argument, NULL, 33 }, + { 0 }, }; + const char *fdsarg = NULL; + int name, fds_cnt = 0; + int old_opterr; + + old_opterr = opterr; + opterr = 0; + optind = 0; + do { + name = getopt_long(argc, argv, "-:", opt, NULL); + if (name == 33) + fdsarg = optarg; + } while (name != -1); + opterr = old_opterr; + + if (!fdsarg) + return -1; + + while (*fdsarg) { + unsigned long val; + char *endptr; + + val = strtoul(fdsarg, &endptr, 10); + if (fdsarg == endptr) + die("Invalid --pass-fds option: %s", fdsarg); + + if (val > INT_MAX) + die("Invalid file descriptor in --pass-fds: %lu", val); + + if (fds_cnt >= max_fds) + die("Too many file descriptors in --pass-fds"); + + fds[fds_cnt++] = (int)val; + + if (*endptr == ',') + fdsarg = endptr + 1; + else if (*endptr == '\0') + fdsarg = endptr; + else + die("Invalid character in --pass-fds option: %s", fdsarg); + } + + return fds_cnt; +} + /** * conf_addr() - Configure guest address with -a option * @c: Execution context @@ -1331,6 +1390,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"pass-fds", required_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1572,6 +1632,10 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--pass-fds is for pasta mode only"); + break; case 'd': c->debug = 1; c->quiet = 0; diff --git a/conf.h b/conf.h index 19bf9bc..3489f35 100644 --- a/conf.h +++ b/conf.h @@ -7,6 +7,7 @@ #define CONF_H enum passt_modes conf_mode(int argc, char *argv[]); +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds); int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..0632f7f 100644 --- a/isolation.c +++ b/isolation.c @@ -249,32 +249,72 @@ void isolate_initial(void) } /* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr + * isolate_fds() - Close leaked files, but not --fd, --pass-fds, standard streams * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd + * @argv: Command line options * * Should: - * - close all open files except for standard streams and the one from --fd + * - close all open files except for standard streams, --fd, and --pass-fds * - move the --fd descriptor out of the range 0-2 * * Return: new fd number for descriptor from --fd, or -1 if not specified */ int isolate_fds(int argc, char **argv) { - int fd, close_from = STDERR_FILENO + 1; + int prev_fd = STDERR_FILENO; // Keep standard streams + int fds[1024 + 1]; + int fds_cnt = 0; + int tap_fd; + int rc = 0; + + tap_fd = conf_tap_fd(argc, argv); + if (tap_fd >= 0 && tap_fd < 3) { + /* Move the passed fd to a more convenient location */ + int new_fd = fcntl(tap_fd, F_DUPFD, 3); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); - fd = conf_tap_fd(argc, argv); + close(tap_fd); + tap_fd = new_fd; + } - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + if (tap_fd >= 0) + /* Keep the tap fd */ + fds[fds_cnt++] = tap_fd; + + rc = conf_pass_fds(argc, argv, fds + fds_cnt, 1024); + if (rc > 0) + /* Keep the pass-fds */ + fds_cnt += rc; + + rc = 0; + + while (1) { + int min_fd = -1; + + /* Find the next-lowest fd to keep */ + for (int i = 0; i < fds_cnt; i++) { + if (fds[i] > prev_fd && (min_fd == -1 || fds[i] < min_fd)) + min_fd = fds[i]; + } + + if (min_fd == -1) + break; + + if (min_fd > prev_fd + 1) { + /* Close fds between two kept fds */ + if (close_range(prev_fd + 1, min_fd - 1, CLOSE_RANGE_UNSHARE)) + rc = -1; + } + prev_fd = min_fd; } + + /* Close all other fds */ + if (close_range(prev_fd + 1, ~0U, CLOSE_RANGE_UNSHARE)) + rc = -1; - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { + if (rc) { if (errno == ENOSYS || errno == EINVAL) { /* This probably means close_range() or the * CLOSE_RANGE_UNSHARE flag is not supported by the @@ -288,7 +328,7 @@ int isolate_fds(int argc, char **argv) } } - return fd; + return tap_fd; } /** diff --git a/passt.1 b/passt.1 index 995590a..bcd3aff 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ of local traffic in pasta\fR in the \fBNOTES\fR for more details. Do not create a tap device in the namespace. In this mode, \fIpasta\fR only forwards loopback traffic between namespaces. +.TP +.BR \-\-pass\-fds " " \fIfds\fR +Pass a comma-separated list of file descriptors to the spawned command. +These file descriptors will be kept open. + .SH EXAMPLES .SS \fBpasta -- 2.52.0

2 2

[PATCH] pif: Add message to static_assert for C11 compliance, fix build with gcc 8
by Stefano Brivio 19 Jul '26

19 Jul '26

Seen with gcc 8.5: --- In file included from passt.h:18, from qrap.c:36: pif.h: In function 'pif_type': pif.h:48:44: error: expected ',' before ')' token static_assert(sizeof("?") <= PIF_NAME_SIZE); ^ make: *** [Makefile:105: qrap] Error 1 --- As noted in ba84a3b17af8 ("treewide: Add messages to static_assert() calls"), static_assert() calls need a message to comply with C11. The form without message is supported starting from C23 only. Fixes: cbcd4284111f ("pif: Limit pif names to 128 bytes") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- pif.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pif.h b/pif.h index 3a1e2e5..dedcaa5 100644 --- a/pif.h +++ b/pif.h @@ -45,7 +45,7 @@ static inline const char *pif_type(enum pif_type pt) return pif_type_str[pt]; else return "?"; - static_assert(sizeof("?") <= PIF_NAME_SIZE); + static_assert(sizeof("?") <= PIF_NAME_SIZE, "PIF_NAME_SIZE too small"); } static inline const char *pif_name(uint8_t pif) -- 2.43.0

2 2