- dev - passt

[PATCH v2 0/8] use true mac address of LAN local remote hosts
by Jon Maloy 14 Jun '25

14 Jun '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. Jon Maloy (8): netlink: Add function to extract mac addresses from arp table arp: respond with true mac address of LAN local remote hosts flow: add mac address of LAN local remote hosts to flow udp: forward external source mac address through tap interface tcp: forward external source mac address through tap interface tap: change signature of function tap_push_l2h() tcp: make tcp_rst_no_conn() respond with correct mac address icmp: let icmp use mac address from flowside structure arp.c | 9 ++++++++ flow.c | 13 ++++++++++- flow.h | 2 ++ fwd.c | 2 +- fwd.h | 3 ++- icmp.c | 4 ++-- ndp.c | 13 ++++++++++- netlink.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ netlink.h | 1 + tap.c | 24 +++++++++++++-------- tap.h | 7 +++--- tcp.c | 20 ++++++++++++++--- tcp_buf.c | 27 +++++++++++------------ tcp_internal.h | 2 +- tcp_vu.c | 5 ++--- udp.c | 33 +++++++++++++--------------- 16 files changed, 166 insertions(+), 57 deletions(-) -- 2.48.1

3 17

passt: new version 2025_06_11.0293c6f available
by Stefano Brivio 11 Jun '25

11 Jun '25

The new version with tag 2025_06_11.0293c6f includes the following changes: 0293c6f fedora: Hide restorecon(8) errors in post-transaction scriptlet 98da8a9 fedora: Add container-selinux as dependency for passt-selinux https://passt.top/passt/log/?qt=range&q=2025_06_06.754c6d7..2025_06_11.0293… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9153303/ permanent mirror: https://passt.top/builds/copr/0^20250611.g0293c6f/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g0293c6f-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0293c6f-1_all.deb -- Stefano

1 0

[PATCH v6 00/30] Introduce discontiguous frames management
by Laurent Vivier 11 Jun '25

11 Jun '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (30): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: add memory regions information into pool packet: use buf to store iovec array arp.c | 86 ++++++++++++------- arp.h | 2 +- dhcp.c | 47 ++++++----- dhcp.h | 2 +- dhcpv6.c | 222 +++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 102 +++++++++++++++++++++-- iov.h | 58 +++++++++---- ip.c | 32 ++++---- ip.h | 3 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 227 ++++++++++++++++++++++++++++++++++++++------------- packet.h | 57 ++++++------- pcap.c | 1 + tap.c | 134 +++++++++++++++++------------- tap.h | 4 +- tcp.c | 61 ++++++++++---- tcp_buf.c | 2 +- udp.c | 33 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 18 +++- vu_common.c | 48 ++++------- 26 files changed, 799 insertions(+), 437 deletions(-) -- 2.49.0

2 35

[PATCH] fedora: Hide restorecon(8) errors in post-transaction scriptlet
by Stefano Brivio 11 Jun '25

11 Jun '25

Commit e01932353869 ("fedora: Separately restore context for /run/user in %posttrans selinux") added a call to restorecon for /run/user in the passt-selinux post-transaction scriptlet, and we can't give a path that's more specific than that, but it often contains FUSE mountpoints that are not accessible as root, resulting in warnings as the package is installed. Hide the errors, a failure in relabeling wouldn't be really problematic in any case. Link: https://bodhi.fedoraproject.org/updates/FEDORA-2025-f454466bb6 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2371159 Fixes: e01932353869 ("fedora: Separately restore context for /run/user in %posttrans selinux") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index e52f50f..663289f 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -107,8 +107,13 @@ fi # (see selabel_file(5)) in order to restore only the file contexts which # actually changed. However, as file_contexts doesn't support %{USERID} # substitutions, this will not work for specific file contexts that pasta needs -# to have under /run/user. Restore those explicitly. -restorecon -R /run/user +# to have under /run/user. +# +# Restore those explicitly, hiding errors from restorecon(8): we can't pass a +# path that's more specific than this, but at the same time /run/user often +# contains FUSE mountpoints that can't be accessed as root, leading to +# "Permission denied" messages, but not failures. +restorecon -R /run/user 2>/dev/null %files %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} -- 2.43.0

2 1

vhost-kernel net on pasta: from 26 to 37Gbit/s
by Eugenio Perez Martin 11 Jun '25

11 Jun '25

Hi! Some updates on the integration. The main culprit was to allow pasta to keep reading packets using the regular read() on the tap device. I thought that part was completely disabled, but I guess the kernel is able to omit the notification on tap as long as the userspace does not read it. My scenario: in different CPUs, all in the same NUMA. I run iperf server on CPU 11 with "iperf3 -A 11 -s". All odds CPUs are isolated with isolcpus=1,3,... nohz=on nohz_full=1,3,... With vanilla pasta isolated to CPUs 1,3 with taskset, and just --config-net option, and running iperf with "iperf3 -A 5 -c 10.6.68.254 -w 8M": - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 30.7 GBytes 26.4 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 30.7 GBytes 26.3 Gbits/sec receiver Now trying with the vhost patches we get a slightly worse performance: - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 25.5 GBytes 21.9 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 25.5 GBytes 21.8 Gbits/sec receiver Now vhost patch still lacks optimizations like disabling notifications or batch more rx available buffer notifications. At the moment it refills the rx buffers in each iteration, and does not set the no_notify bit which makes the kernel skip the used buffer notifications if pasta is actively checking the queue, which is not optimal. Now if I isolate the vhost kernel thread [1] I get way more performance as expected: - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 43.1 GBytes 37.1 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 43.1 GBytes 36.9 Gbits/sec receiver After analyzing perf output, rep_movs_alternative is the most called function in the three iperf3 (~20%Self), passt.avx2 (~15%Self) and vhost (~15%Self), But I don't see any of them consuming 100% of CPU in top: pasta consumes ~85% %CPU, both iperf3 client and server consumes 60%, and vhost consumes ~53%. So... I have mixed feelings about this :). By "default" it seems to have less performance, but my test is maybe too synthetic. There is room for improvement with the mentioned optimizations so I'd continue applying them, continuing with UDP and TCP zerocopy, and developing zerocopy vhost rx. With these numbers I think the series should not be merged at the moment. I could send it as RFC if you want but I've not applied the comments the first one received, POC style :). Thanks! [1] Notes to reproduce it, I'm able to see it with top -H and then set with taskset. Either the latest changes on the module or the way pasta behaves does not allow me to see in classical ps output.

3 10

[PATCH] fedora: Add container-selinux as dependency for passt-selinux
by Stefano Brivio 10 Jun '25

10 Jun '25

Commit 7aeda16a7818 ("selinux: Transition to pasta_t in containers") introduces usage of container_user_r, container_runtime_t, and container_t, which are provided by the container-selinux package. Link: https://bodhi.fedoraproject.org/updates/FEDORA-2025-f454466bb6 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2371159 Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index e7feaf8..e52f50f 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -38,7 +38,9 @@ requiring any capabilities or privileges. BuildArch: noarch Summary: SELinux support for passt and pasta Requires: selinux-policy-%{selinuxtype} +Requires: container-selinux Requires(post): selinux-policy-%{selinuxtype} +Requires(post): container-selinux Requires(post): policycoreutils Requires(post): libselinux-utils Requires(preun): policycoreutils -- 2.43.0

1 0

[0/4] use true mac address of LAN local remote hosts
by Jon Maloy 07 Jun '25

07 Jun '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs use this information. These commits introduces this for ARP, NTP, UDP and TCP, while it is still missing for ICMP. Jon Maloy (4): netlink: Add function to extract mac addresses from arp table arp: respond with true mac address of LAN local remote hosts udp: forward external source mac address through tap interface tcp: forward external source mac address through tap interface arp.c | 9 ++++++++ flow.c | 13 ++++++++++- flow.h | 2 ++ fwd.c | 2 +- fwd.h | 3 ++- ndp.c | 11 ++++++++++ netlink.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++ netlink.h | 1 + tcp.c | 5 ++++- tcp_buf.c | 27 +++++++++++------------ tcp_internal.h | 2 +- tcp_vu.c | 5 ++--- udp.c | 29 +++++++++++-------------- 13 files changed, 130 insertions(+), 38 deletions(-) -- 2.48.1

1 4

passt: new version 2025_06_06.754c6d7 available
by Stefano Brivio 06 Jun '25

06 Jun '25

The new version with tag 2025_06_06.754c6d7 includes the following changes: 754c6d7 flow, repair: Proper error handling for missing passt-repair helper on target a2088fe fedora: Depend on SELinux tools and policy version, drop circular dependency d21bcd9 fedora: Call %selinux_modules_* macros only once 081df67 conf: flush stdout before early exit bcb5596 passt-repair: Fix missing newlines in error messages 2c88349 Correct various function comment headers 515b5ee tap: Avoid bogus missingReturn cppcheck warning in tap_l2_max_len() e019323 fedora: Separately restore context for /run/user in %posttrans selinux 7aeda16 selinux: Transition to pasta_t in containers 3262c9b iov: Standardize function comment headers b915375 virtio: Correct and align comment headers 2fd0944 vhost_user: Correct and align function comment headers 2046976 codespell: Correct typos in comments and error message 4234ace test: Display count of skipped tests in status and summary 2d3d69c flow: Fix clang error (clang-analyzer-security.PointerSub) 0f7bf10 ndp: Fix Clang analyzer warning (clang-analyzer-security.PointerSub) a6b9832 virtio: Fix Clang warning (bugprone-sizeof-expression, cert-arr39-c) 570e7b4 dhcpv6: fix GCC error (unterminated-string-initialization) https://passt.top/passt/log/?qt=range&q=2025_05_12.8ec1341..2025_06_06.754c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9138699/ permanent mirror: https://passt.top/builds/copr/0^20250606.g754c6d7/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g754c6d7-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_754c6d7-1_all.deb -- Stefano

1 0

conf: flush stdout before early exit
by Jon Maloy 06 Jun '25

06 Jun '25

Before doing an early exit any contents of stdout is normally flushed. This doesn't happen when the output goes into a pipe and we return with _exit(). We now add an explicit flush in such cases. Fixes: d0006fa784a7 ("treewide: use _exit() over exit()") Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- conf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/conf.c b/conf.c index a6d7e22..a1d55a3 100644 --- a/conf.c +++ b/conf.c @@ -975,6 +975,7 @@ static void usage(const char *name, FILE *f, int status) " SPEC is as described for TCP above\n" " default: none\n"); + fflush(f); _exit(status); pasta_opts: @@ -1029,6 +1030,7 @@ pasta_opts: " --ns-mac-addr ADDR Set MAC address on tap interface\n" " --no-splice Disable inbound socket splicing\n"); + fflush(f); _exit(status); } @@ -1594,6 +1596,7 @@ void conf(struct ctx *c, int argc, char **argv) FPRINTF(stdout, c->mode == MODE_PASTA ? "pasta " : "passt "); FPRINTF(stdout, VERSION_BLOB); + fflush(stdout); _exit(EXIT_SUCCESS); case 15: ret = snprintf(c->ip4.ifname_out, -- 2.48.1

4 5

[PATCH 0/1] selinux: Transition to pasta_t in containers
by Max Chernoff 06 Jun '25

06 Jun '25

Hi, Currently, pasta runs in the container_runtime_exec_t context when running in a container. This commit updates the SELinux policy so that pasta instead runs in the pasta_t context. I'm more familiar with CIL, so I initially developed the modified policy in CIL, and then later ported it to the kernel policy language. My original CIL source is available here: https://github.com/gucci-on-fleek/maxchernoff.ca/blob/master/etc/selinux/lo… I've tested this on Fedora 42 with rootless Podman, with both unconfined (unconfined_u) and confined (user_u) users, and with both TCP and UDP. I've never actually used the email workflow for Git before, so please let me know if I've done something wrong. Thanks, -- Max Max Chernoff (1): selinux: Transition to pasta_t in containers contrib/selinux/pasta.fc | 10 ++++++---- contrib/selinux/pasta.te | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 4 deletions(-) -- 2.49.0

3 19