September 2026 - dev

[PATCH v10] pasta: Refactor pasta_ns_conf() to reduce nesting
by Jon Maloy 21 Sep '26

21 Sep '26

Extract address and route configuration into two new helper functions pasta_conf_addrs() and pasta_conf_routes(), and replace the outer if (c->pasta_conf_ns) block with an early return. This reduces indentation and eliminates the goto labels. No functional change. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- v7: -Removed redundant argument 'af' in nl_addr_set() -Removed redundant label and 'goto's in pasta_ns_conf() -Since I excluded addition of all LINKLOCAL addresses from host address array in a previous commit I can now omit this test in pasta_conf_addrs() as suggested by David. -Here is the example of agnostic usage of inany_prefix_len() I referred to in a previous commit. v8: -Do prefix_len conversion inside nl_addr_set() instead of in the calling function. -In nl_addr_set(), branch on inany_prefix_v4() return value instead of inany_af() to avoid redundant AF check and potential static checker false positives. (David) -Swap branch order in pasta_conf_routes() for consistency with pasta_conf_addrs(). (David) -Defer investigation of pre-existing IFF_NOARP / DAD interaction oddity noted by David. v9: - Broke out as standalone from multi-addr series. - Adapted to code conditions before the introduction of the unified address type. v10: - Applied all suggestions from David, more for symmetry reasons than for logical correctess. --- pasta.c | 220 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 115 insertions(+), 105 deletions(-) diff --git a/pasta.c b/pasta.c index 7ba5d75e..a9ee8348 100644 --- a/pasta.c +++ b/pasta.c @@ -290,13 +290,70 @@ void pasta_start_ns(struct ctx *c, int argc, char *argv[]) die_perror("Failed to join network namespace"); } +/** + * pasta_conf_addrs() - Configure addresses for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set configured address; if false, copy from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_addrs(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + if (!ifi) + return 0; + + if (!no_copy) + return nl_addr_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + if (af == AF_INET && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET, + &c->ip4.addr, c->ip4.prefix_len); + } else if (af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } + return 0; +} + +/** + * pasta_conf_routes() - Configure routes for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set default route; if false, copy routes from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_routes(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + const void *gw; + + if (af == AF_INET) + gw = &c->ip4.guest_gw; + else + gw = &c->ip6.guest_gw; + + if (!ifi) + return 0; + + if (!no_copy) + return nl_route_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + return nl_route_set_def(nl_sock_ns, c->pasta_ifi, af, gw); +} + /** * pasta_ns_conf() - Set up loopback and tap interfaces in namespace as needed * @c: Execution context */ void pasta_ns_conf(struct ctx *c) { - int rc = 0; + unsigned int flags = IFF_UP; + int rc; rc = nl_link_set_flags(nl_sock_ns, 1 /* lo */, IFF_UP, IFF_UP); if (rc < 0) @@ -315,116 +372,69 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't set MAC address in namespace: %s", strerror_(-rc)); - if (c->pasta_conf_ns) { - unsigned int flags = IFF_UP; - - if (c->mtu) - nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); - - if (c->ifi6) /* Avoid duplicate address detection on link up */ - flags |= IFF_NOARP; - - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); - - if (c->ifi4) { - if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); - } else { - rc = nl_addr_dup(nl_sock, c->ifi4, - nl_sock_ns, c->pasta_ifi, - AF_INET); - } - - if (c->ifi4 == -1 && rc == -ENOTSUP) { - warn("IPv4 not supported, disabling"); - c->ifi4 = 0; - goto ipv4_done; - } - - if (rc < 0) { - die("Couldn't set IPv4 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip4.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi4, nl_sock_ns, - c->pasta_ifi, AF_INET); - } - - if (rc < 0) { - die("Couldn't set IPv4 route(s) in guest: %s", - strerror_(-rc)); - } - } -ipv4_done: + proto_update_l2_buf(c->guest_mac); - if (c->ifi6) { - rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, - &c->ip6.addr_ll_seen); - if (rc < 0) { - warn("Can't get LL address from namespace: %s", - strerror_(-rc)); - } + if (!c->pasta_conf_ns) + return; - rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); - if (rc < 0) { - warn("Can't set nodad for LL in namespace: %s", - strerror_(-rc)); - } - - /* We dodged DAD: re-enable neighbour solicitations */ - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, - 0, IFF_NOARP); - - if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { - rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } - } else { - rc = nl_addr_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (rc < 0) { - die("Couldn't set IPv6 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip6.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET6, - &c->ip6.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (c->ifi6 == -1 && rc == -ENOTSUP) { - warn("IPv6 not supported, disabling"); - c->ifi6 = 0; - goto ipv6_done; - } - - if (rc < 0) { - die("Couldn't set IPv6 route(s) in guest: %s", + if (c->mtu) + nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); + + if (c->ifi6) /* Avoid duplicate address detection on link up */ + flags |= IFF_NOARP; + + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); + + if (c->ifi4) { + rc = pasta_conf_addrs(c, AF_INET, c->ifi4, + c->ip4.no_copy_addrs); + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + } else if (rc < 0) { + die("Couldn't set IPv4 address(es) in namespace: %s", + strerror_(-rc)); + } else { + rc = pasta_conf_routes(c, AF_INET, c->ifi4, + c->ip4.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv4 route(s) in guest: %s", strerror_(-rc)); - } } } -ipv6_done: - proto_update_l2_buf(c->guest_mac); + if (c->ifi6) { + rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, + &c->ip6.addr_ll_seen); + if (rc < 0) + warn("Can't get LL address from namespace: %s", + strerror_(-rc)); + + rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); + if (rc < 0) + warn("Can't set nodad for LL in namespace: %s", + strerror_(-rc)); + + /* We dodged DAD: re-enable neighbour solicitations */ + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, 0, IFF_NOARP); + + rc = pasta_conf_addrs(c, AF_INET6, c->ifi6, + c->ip6.no_copy_addrs); + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + return; + } else if (rc < 0) { + die("Couldn't set IPv6 address(es) in namespace: %s", + strerror_(-rc)); + } + + rc = pasta_conf_routes(c, AF_INET6, c->ifi6, + c->ip6.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv6 route(s) in guest: %s", + strerror_(-rc)); + } } /** -- 2.52.0

2 1

Re: [PATCH v2 3/3] Optimize route dependency solver.
by Stefano Brivio 21 Sep '26

21 Sep '26

On Sat, 19 Sep 2026 14:56:56 +0200 Martin Schitter <ms+git(a)mur.at> wrote: > On 9/17/26 21:08, Stefano Brivio wrote: > >> Never make more resolution attempts than there are still unresolved > >> dependency errors. > >> > >> In the context of my current mesh network with ~700 route entries > >> these changes reduce the required processing time from 5.5s to 15ms. > > > > Ouch. Nice. > > After searching for answers, how these ENETUNREACH and EHOSTUNREACH in > the dependency solver routines are actually caused, I finally looked > into the iproute2 code for the save and restore commands: > > https://github.com/iproute2/iproute2/blob/e6471d772f3e15a813e6c9a81b4b7adcf… > > Now I finally see that this task can be handled without all this stupid > trial-and-error play and doesn't require a limit of route entries if we > just reassemble the routing tables in three successive steps resp. loops: > > /* Restore routes in correct order: > * 0. ones for local addresses, > * 1. ones for local networks, > * 2. others (remote networks/hosts). > */ Just a quick comment before you risk losing a lot of time (I'm really not sure though): there *might* be interdependencies between routes in 1. and between routes in 2., especially with 'nexthop' objects. And IPv6 has several scopes. Maybe it all works thought, I haven't checked your iproute reference yet. -- Stefano

2 1

[PATCH v2] Fix for Bug #221 -- Issue concerning bigger routing tables
by Martin Schitter 19 Sep '26

19 Sep '26

v2 includes some additional small changes/fixes. [PATCH v2 1/3] Fix handling of netlink multipart route dumps. [PATCH v2 2/3] Timekeeping: Resolving Route Dependencies [PATCH v2 3/3] Optimize route dependency solver.

2 6

[PATCH v2 1/3] Fix handling of netlink multipart route dumps.
by Martin Schitter 19 Sep '26

19 Sep '26

This patch adds a `nl_collect` function to store all datagram chunks of a multipart route dump in one single interim buffer for further processing and dependency resolution. --- netlink.c | 79 +++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 56 insertions(+), 23 deletions(-) diff --git a/netlink.c b/netlink.c index 225b666..650a6fd 100644 --- a/netlink.c +++ b/netlink.c @@ -229,6 +229,51 @@ static struct nlmsghdr *nl_next(int s, char *buf, struct nlmsghdr *nh, ssize_t * /* NOLINTNEXTLINE(readability-inconsistent-ifelse-braces) */\ } else +/** + * nl_collect() - Collect all respose Datagrams of a netlink multi part dump + * @s: Netlink socket + * @buf: Buffer for responses (at least NLBUFSIZ long) + * @buflen: Buffer size. + * @seq: Sequence number of request we're getting responses for + * + * Return: Length of collected responses in bytes or error code < 0 + */ +int nl_collect(int s, char *buf, size_t buflen, uint32_t seq) +{ + size_t collected = 0; + struct nlmsghdr *nh; + ssize_t n; + int res; + const struct nlmsghdr* tail; + + #define NLMSG_DONE_SIZE NLMSG_LENGTH(4) + + while(collected + NLBUFSIZ < buflen){ + nh = nl_next(s, &buf[collected], NULL, &n); + debug("collect: add chunk of size n=%ld at offset=%ld, seq=%d nlmsg_len=%d", + n, collected, seq, ((const struct nlmsghdr *)&buf[collected])->nlmsg_len); + res = nl_status(nh, n, seq); + if (res < 0) /* error */ + return res; + collected += n; + + /* look for NLMSG_DONE -- it's ussualy transmitted in a seperate datagram, + * but in some rare cases also placed at the end of a multipart chunk.*/ + tail = (const struct nlmsghdr*)&buf[collected - NLMSG_DONE_SIZE]; + if (res == 0 || ( + collected >= NLMSG_DONE_SIZE + && (tail = (const struct nlmsghdr*)&buf[collected - NLMSG_DONE_SIZE]) + && NLMSG_OK(tail, NLMSG_DONE_SIZE) + && (nl_status(tail, NLMSG_DONE_SIZE, seq) == 0)) + ) { + debug("collected: %ld", collected); + return collected; + } + } + err("netlink: Too many routes to duplicate"); + return -E2BIG; +} + /** * nl_do() - Send netlink "do" request, and wait for acknowledgement * @s: Netlink socket @@ -553,21 +598,21 @@ int nl_route_dup(int s_src, unsigned int ifi_src, .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), .ifi = ifi_src, }; - ssize_t nlmsgs_size, left, status; + ssize_t nlmsgs_size, left, status = 0; unsigned dup_routes = 0; struct nlmsghdr *nh; - char buf[NLBUFSIZ]; + char buf[NLBUFSIZ * 8]; uint32_t seq; unsigned i; seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); - /* nl_foreach() will step through multiple response datagrams, - * which we don't want here because we need to have all the - * routes in the buffer at once. - */ - nh = nl_next(s_src, buf, NULL, &nlmsgs_size); - for (left = nlmsgs_size; + /* collect all the chunks of a multi part dump in one buffer.*/ + nlmsgs_size = nl_collect(s_src, buf, sizeof(buf), seq); + if (nlmsgs_size < 0) + return nlmsgs_size; + + for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; nh = NLMSG_NEXT(nh, left)) { struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); @@ -648,24 +693,12 @@ int nl_route_dup(int s_src, unsigned int ifi_src, dup_routes++; } - if (!NLMSG_OK(nh, left)) { - /* Process any remaining datagrams in a different - * buffer so we don't overwrite the first one. - */ - char tail[NLBUFSIZ]; - unsigned extra = 0; - - nl_foreach_oftype(nh, status, s_src, tail, seq, RTM_NEWROUTE) - extra++; - - if (extra) { - err("netlink: Too many routes to duplicate"); - return -E2BIG; - } - } + /* status should be 0 (=NLMSG_DONE) */ if (status < 0) return status; + debug("found %d routes in dump", dup_routes); + /* Routes might have dependencies between each other, and the kernel * processes RTM_NEWROUTE messages sequentially. For n routes, we might * need to send the requests up to n times to get all of them inserted. -- 2.53.0

2 2

[PATCH 0/7] Add vhost-net kernel support to pasta
by aerosouund 17 Sep '26

17 Sep '26

This work is based on the original v2 RFC by Eugenio Perez: Link: https://archives.passt.top/passt-dev/20250709174748.3514693-1-eperezma@redh… It is the first finished patch series for vhost-kernel support after a third RFC was submitted: Link: https://archives.passt.top/passt-dev/20260802132155.870796-1-aerosound161@g… vhost-net is a kernel device that allows reading and writing packets to a tap device using virtqueues instead of read(2), write(2), and their vectored counterparts. Frames are handed over through a shared descriptor ring, so several of them can be passed to the kernel at once rather than issuing a syscall per frame. The v3 RFC didn't yield any performance improvements because, to retain correctness, sends between pasta and the vhost-kernel thread had to be synchronous. This patch series fixes this problem through the changes introduced in the last commit, titled: "tap/tcp: Replace tcp_payload_used with a ring buffer style index" The changes reliably yield a roughly 2x speedup on the TX path (container to host). Numbers were obtained through iperf3 with the following methodology and results: Pasta command: ./pasta -f --runas 0:0 --map-guest-addr 192.168.0.5 --vhost-kernel on --config-net 2729785 Host: iperf3 -s1J Container: iperf3 -c 192.168.0.5 -t 10 -P4 -l 1M -w 32M -i1 With --vhost-kernel on: [SUM] 0.00-10.00 sec 1.36 GBytes 1.17 Gbits/sec 3643 sender [SUM] 0.00-10.00 sec 1.16 GBytes 999 Mbits/sec receiver With --vhost-kernel off: [SUM] 0.00-10.00 sec 700 MBytes 587 Mbits/sec 3556 sender [SUM] 0.00-10.10 sec 495 MBytes 411 Mbits/sec receiver Ammar Yasser (7): tap: Move the tap_hdr file to a separate file conf: Add context fields, epoll types and --vhost-kernel flag to pasta virtio: Add the pasta vhost-net interface and implementation tap: Implement the pasta vhost-net from-guest path tap, tcp, udp: Prepare the to-guest path for vhost-net tap: Implement the pasta vhost-net to-guest path tap/tcp: Replace tcp_payload_used with a ring buffer style index Makefile | 2 +- conf.c | 19 +++ epoll_type.h | 4 + passt.c | 9 ++ passt.h | 79 ++++++++++- tap.c | 364 ++++++++++++++++++++++++++++++++++++++++++++------- tap.h | 47 ++----- tap_hdr.h | 23 ++++ tcp_buf.c | 143 +++++++++++++++----- tcp_buf.h | 4 + udp.c | 41 ++++-- udp.h | 3 + util.c | 12 ++ util.h | 2 + vhost.c | 295 +++++++++++++++++++++++++++++++++++++++++ vhost.h | 79 +++++++++++ 16 files changed, 1002 insertions(+), 124 deletions(-) create mode 100644 tap_hdr.h create mode 100644 vhost.c create mode 100644 vhost.h -- 2.39.5 (Apple Git-154)

5 22

[PATCH] pasta: Add --no-pidns to keep spawned command in caller's PID namespace
by Christian Korneck 17 Sep '26

17 Sep '26

This is to allow running pasta inside a container without unmasking /proc for the whole container (Docker's --security-opt systempaths=unconfined, Podman's --security-opt unmask=ALL), which is undesirable as it exposes /proc/sysrq-trigger and other masked paths. In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a new procfs instance on /proc, so that it matches the new PID namespace. Mounting procfs in a new user namespace requires a fully visible, unobstructed procfs. Container runtimes deliberately obstruct /proc (Docker, for example, masks /proc/kcore and friends and mounts /proc/sys read-only), so the mount is refused: Couldn't mount /proc: Operation not permitted We only warn and continue, leaving the command in a new PID namespace while the visible /proc still numbers processes in the outer one. Anything resolving its own PID through /proc then fails, for example bubblewrap: bwrap: open /proc/22/ns/ns failed: No such file or directory Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and don't mount /proc, which is then not needed. User, network, mount, UTS and IPC namespaces, --config-net and port forwarding are unaffected. The option is rejected together with PID or --netns, as it only makes sense when we spawn the command ourselves. Add a test checking that, by default, the command runs in a new PID namespace, and that --no-pidns keeps it in the caller's one. Signed-off-by: Christian Korneck <christian(a)korneck.de> --- conf.c | 11 +++++++++++ passt.1 | 12 ++++++++++++ passt.h | 2 ++ pasta.c | 18 +++++++++++------- test/pasta_options/no_pidns | 25 +++++++++++++++++++++++++ test/run | 1 + 6 files changed, 62 insertions(+), 7 deletions(-) create mode 100644 test/pasta_options/no_pidns diff --git a/conf.c b/conf.c index faf2681..16b2f40 100644 --- a/conf.c +++ b/conf.c @@ -742,6 +742,7 @@ pasta_opts: " implied if PATH or NAME are given without --userns\n" " --no-netns-quit Don't quit if filesystem-bound target\n" " network namespace is deleted\n" + " --no-pidns Don't spawn command in a new PID namespace\n" " --config-net Configure tap interface in namespace\n" " --no-copy-routes DEPRECATED:\n" " Don't copy all routes to namespace\n" @@ -1348,6 +1349,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"no-pidns", no_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1589,6 +1591,12 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--no-pidns is for pasta mode only"); + + c->no_pidns = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1948,6 +1956,9 @@ void conf(struct ctx *c, int argc, char **argv) else if (optind != argc) die("Extra non-option argument: %s", argv[optind]); + if (c->no_pidns && *netns) + die("--no-pidns is incompatible with PID or --netns"); + conf_open_files(c); /* Before any possible setuid() / setgid() */ isolate_user(c, uid, gid, !netns_only, userns); diff --git a/passt.1 b/passt.1 index 53e072a..0b780fe 100644 --- a/passt.1 +++ b/passt.1 @@ -704,6 +704,18 @@ is bound to the filesystem, and the given path is deleted, or if the target network namespace is represented by a procfs entry, and that entry is deleted, representing the fact that a process with the given PID terminated. +.TP +.BR \-\-no-pidns +Don't create a new PID namespace for the spawned command or shell: keep it in +the PID namespace \fBpasta\fR itself runs in, and don't mount a new +\fIprocfs\fR instance on \fI/proc\fR for it. This is useful in environments +where mounting \fIprocfs\fR is not permitted, such as containers, where the +command would otherwise get a \fI/proc\fR view that doesn't match its own PID +namespace. Note that, without a PID namespace, processes started by the +command are not terminated once the command exits. + +This option can't be specified with a PID or with \-\-netns. + .TP .BR \-\-config-net Configure networking in the namespace: set up addresses and routes as configured diff --git a/passt.h b/passt.h index 51ccd4f..afd8e9f 100644 --- a/passt.h +++ b/passt.h @@ -195,6 +195,7 @@ struct ip6_ctx { * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it + * @no_pidns: Don't create a new PID namespace for spawned command * @fwd: Forwarding tables * @fwd_pending: Pending forward tables * @no_tcp: Disable TCP operation @@ -278,6 +279,7 @@ struct ctx { char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; + bool no_pidns; struct fwd_table *fwd[PIF_NUM_TYPES]; struct fwd_table *fwd_pending[PIF_NUM_TYPES]; diff --git a/pasta.c b/pasta.c index 5aa56b7..2d916e1 100644 --- a/pasta.c +++ b/pasta.c @@ -194,15 +194,17 @@ static int pasta_spawn_cmd(void *arg) if (prctl(PR_SET_PDEATHSIG, SIGKILL)) die_perror("Couldn't set PR_SET_PDEATHSIG"); - /* We run in a detached PID and mount namespace: mount /proc over */ - if (mount("", "/proc", "proc", 0, NULL)) + a = (const struct pasta_spawn_cmd_arg *)arg; + + /* We run in a detached mount namespace, and, unless --no-pidns was + * given, in a detached PID namespace: mount /proc over + */ + if (!a->c->no_pidns && mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc"); if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) warn("Cannot set ping_group_range, ICMP requests might fail"); - a = (const struct pasta_spawn_cmd_arg *)arg; - conf_hostname_len = strlen(a->c->hostname); if (conf_hostname_len > 0) { if (sethostname(a->c->hostname, conf_hostname_len)) @@ -243,6 +245,7 @@ static int pasta_spawn_cmd(void *arg) void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, int argc, char *argv[]) { + int flags = CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWUTS | CLONE_NEWNS; char ns_fn_stack[NS_FN_STACK_SIZE] __attribute__ ((aligned(__alignof__(max_align_t)))); struct pasta_spawn_cmd_arg arg = { @@ -293,10 +296,11 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps, sigaddset(&set, SIGUSR1); sigprocmask(SIG_BLOCK, &set, NULL); + if (!c->no_pidns) + flags |= CLONE_NEWPID; + pasta_child_pid = do_clone(pasta_spawn_cmd, ns_fn_stack, - sizeof(ns_fn_stack), - CLONE_NEWIPC | CLONE_NEWPID | CLONE_NEWNET | - CLONE_NEWUTS | CLONE_NEWNS | SIGCHLD, + sizeof(ns_fn_stack), flags | SIGCHLD, (void *)&arg); if (pasta_child_pid == -1) diff --git a/test/pasta_options/no_pidns b/test/pasta_options/no_pidns new file mode 100644 index 0000000..f565b2f --- /dev/null +++ b/test/pasta_options/no_pidns @@ -0,0 +1,25 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_options/no_pidns - Check --no-pidns handling + +htools readlink + +test Command is spawned in a new PID namespace by default +set PIDNS __STATEDIR__/pidns +set OUT __STATEDIR__/no-pidns.out +set ERR __STATEDIR__/no-pidns.err + +passt readlink /proc/self/ns/pid > __PIDNS__ +passt ./pasta -q -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" != "$(cat __OUT__)" ] + +test --no-pidns keeps command in the caller's PID namespace +passt ./pasta -q --no-pidns -- readlink /proc/self/ns/pid > __OUT__ 2> __ERR__ +check [ "$(cat __PIDNS__)" = "$(cat __OUT__)" ] +check [ ! -s __ERR__ ] diff --git a/test/run b/test/run index c4073cc..14ddbbf 100755 --- a/test/run +++ b/test/run @@ -86,6 +86,7 @@ run() { setup pasta_options test pasta_options/log_to_file test pasta_options/netns_only + test pasta_options/no_pidns teardown pasta_options setup build -- 2.55.0

3 9

[PATCH v3 0/2] [PATCH 0/2] dhcpv6: Add --dhcpv6-opt for custom DHCPv6 options
by Anshu Kumari 10 Sep '26

10 Sep '26

This series adds a --dhcpv6-opt CODE,VALUE command-line option to inject custom options into DHCPv6 replies, complementing the existing --dhcp-opt support for DHCPv4. The primary use case is UEFI HTTP Boot, which requires Vendor Class (option 16) with the correct enterprise-number + length-prefixed wire encoding per RFC 8415 Section 21.16, and Boot File URL (option 59). Value formats are determined automatically from the option code via a type table. Supported types include plain strings, IPv6 addresses (single and list), 8/16/32-bit integers, vendor class (ENTERPRISE:DATA), and length-prefixed string lists. Anshu Kumari (2): dhcpv6: Add --dhcpv6-opt with option type table and value parser dhcpv6: Inject custom options into DHCPv6 replies conf.c | 25 +++- dhcpv6.c | 363 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ dhcpv6.h | 2 + passt.1 | 31 +++++ 4 files changed, 420 insertions(+), 1 deletion(-) -- 2.55.0

3 6

[PATCH v6 0/6] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 10 Sep '26

10 Sep '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. RFC 3396 option splitting for concatenation-requiring options has also been introduce as a separate patch. Anshu Kumari (6): dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option state management with enum opt_state dhcp: Add option overload dhcp: Add --dhcp-opt with option table and value parser dhcp: Add --dhcp-boot command-line option dhcp: Add RFC 3396 option splitting for concatenation-requiring options conf.c | 31 +++- dhcp.c | 561 ++++++++++++++++++++++++++++++++++++++++++++++++++------ dhcp.h | 2 + passt.1 | 49 +++++ 4 files changed, 588 insertions(+), 55 deletions(-) -- 2.55.0

3 16

[PATCH] RFC: Don't override system's default ping_group_range for pasta
by David Gibson 09 Sep '26

09 Sep '26

When spawning a command, pasta sets the net.ipv4.ping_group_range sysctl to 0 0, meaning only group 0 can use ping sockets within the namespace. Since group 0 is the only one we map in the userns, that's equivalent to anyone being able to use ping sockets. Although the kernel default for this is 1 0 (nobody can use ping sockets), common distros - at least ones using systemd or even just systemd-udevd - appear to set it to "0 2147483647" meaning effectively anyone can use ping sockets. There's no obvious reason that we need to override the system's default behaviour here. The override was introduced in 32d07f5e5 ("passt, pasta: Completely avoid dynamic memory allocation") as part of a large chunk which kind of looks like it was meant to be in another patch, so the git history isn't particularly informative. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- pasta.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/pasta.c b/pasta.c index 5aa56b78..4248b508 100644 --- a/pasta.c +++ b/pasta.c @@ -198,9 +198,6 @@ static int pasta_spawn_cmd(void *arg) if (mount("", "/proc", "proc", 0, NULL)) warn_perror("Couldn't mount /proc"); - if (write_file("/proc/sys/net/ipv4/ping_group_range", "0 0")) - warn("Cannot set ping_group_range, ICMP requests might fail"); - a = (const struct pasta_spawn_cmd_arg *)arg; conf_hostname_len = strlen(a->c->hostname); -- 2.55.0

2 4

[PATCH 3/3] Optimize route dependency solver.
by Martin Schitter 08 Sep '26

08 Sep '26

Avoid retransmitting routes that explicitly got reported as already existing. Never make more resolution attempts than there are still unresolved dependency errors. In the context of my current mesh network with ~700 route entries these changes reduce the required processing time from 5.5s to 15ms. --- netlink.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/netlink.c b/netlink.c index 2b49fe3..1cbe5e5 100644 --- a/netlink.c +++ b/netlink.c @@ -703,13 +703,12 @@ int nl_route_dup(int s_src, unsigned int ifi_src, /* Routes might have dependencies between each other, and the kernel * processes RTM_NEWROUTE messages sequentially. For n routes, we might - * need to send the requests up to n times to get all of them inserted. - * Routes that have been already inserted will return -EEXIST, but we - * can safely ignore that and repeat the requests. This avoids the need - * to calculate dependencies: let the kernel do that. + * need to send the requests up to n times in the worst case to get all + * of them inserted. */ clock_gettime(CLOCK_MONOTONIC, &start); - for (i = 0; i < dup_routes; i++) { + for (i = dup_routes; i > 0; i--) { + int dep_errors = 0; for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; NLMSG_OK(nh, left); nh = NLMSG_NEXT(nh, left)) { @@ -722,10 +721,22 @@ int nl_route_dup(int s_src, unsigned int ifi_src, rc = nl_do(s_dst, nh, RTM_NEWROUTE, (flags & ~NLM_F_DUMP_FILTERED) | NLM_F_CREATE, nh->nlmsg_len); - if (rc < 0 && rc != -EEXIST && - rc != -ENETUNREACH && rc != -EHOSTUNREACH) + + if ( rc == -EEXIST) { + /* Exclude existing routes from further retry attempts */ + nh->nlmsg_type = NLMSG_NOOP; + } + if ( rc == -ENETUNREACH || rc == -EHOSTUNREACH){ + dep_errors++; + continue; + } + if (rc < 0) return rc; } + debug("route dependency errors: %d", dep_errors); + /* Avoid having much more resolution attempts than + * there are still unresolved dependency errors */ + i = MIN(i, dep_errors++); } clock_gettime(CLOCK_MONOTONIC, &now); debug("route dependency handling time: %f s", -- 2.53.0

1 0