- dev - passt

[PATCH v2 00/23] Rework forwarding option parsing
by David Gibson 16 Apr '26

16 Apr '26

This series makes a number of significant reworks to how we process forwarding options (-t, -u, -T and -U) in passt & pasta. This is largely motivated by moving towards being able to share this code with a configuration update tool. However, along the way it also enables some forwarding configurations that were technically possible with the forwarding table but couldn't be specified on the command line, in particular bug 180. There is still a bunch of work needed to make the parsing code truly shareable with pesto, but this is a solid start. v2: * Assorted minor changes based on Stefano's review, including * Explicitly state "guest or namespace" in the manpage * Clearer description of @rulesocks field * Worked around a gcc < 15 bug causing a false positive warning * Update man page and usage() for new capabilities * Additional patches moving rule parsing out of conf.c David Gibson (23): conf: Split parsing of port specifiers from the rest of -[tuTU] parsing conf: Simplify handling of default forwarding mode conf: Move first pass handling of -[TU] next to handling of -[tu] doc: Consolidate -[tu] option descriptions for passt and pasta conf: Permit -[tTuU] all in pasta mode fwd: Better split forwarding rule specification from associated sockets fwd_rule: Move forwarding rule formatting conf: Pass protocol explicitly to conf_ports_range_except() fwd: Split rule building from rule adding fwd_rule: Move rule conflict checking from fwd_rule_add() to caller fwd: Improve error handling in fwd_rule_add() conf: Don't be strict about exclusivity of forwarding mode conf: Rework stepping through chunks of port specifiers conf: Rework checking for garbage after a range doc: Rework man page description of port specifiers conf: Move "all" handling to port specifier conf: Allow user-specified auto-scanned port forwarding ranges conf: Move SO_BINDTODEVICE workaround to conf_ports() conf: Don't pass raw commandline argument to conf_ports_spec() fwd, conf: Add capabilities bits to each forwarding table conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] Makefile | 10 +- conf.c | 524 ++++++----------------------------------- fwd.c | 261 +++------------------ fwd.h | 46 ---- fwd_rule.c | 676 +++++++++++++++++++++++++++++++++++++++++++++++++++++ fwd_rule.h | 59 +++++ passt.1 | 288 ++++++++++------------- 7 files changed, 973 insertions(+), 891 deletions(-) create mode 100644 fwd_rule.c -- 2.53.0

2 36

[PATCH v3] tap, tcp, udp: Use rate-limited logging
by Anshu Kumari 16 Apr '26

16 Apr '26

Now that rate-limited logging macros are available, promote several debug messages to higher severity levels. These messages were previously kept at debug to prevent guests from flooding host logs, but with rate limiting they can safely be made visible in normal operation. In tap.c, refactor tap4_is_fragment() to use warn_ratelimit() instead of its ad-hoc rate limiting, and promote the guest MAC address change message to info level. In tcp.c, promote the invalid TCP SYN endpoint message to warn level. In udp.c, promote dropped datagram messages to warn level, and rate-limit the unrecoverable socket error message. In udp_flow.c, promote flow allocation failures to err_ratelimit. Link: https://bugs.passt.top/show_bug.cgi?id=134 Signed-off-by: Anshu Kumari <anskuma(a)redhat.com> --- v3: - Promote flow allocation failures to err_ratelimit from warn_ratelimit. - Fix remaining alignment issues. - Cc Volker --- tap.c | 16 +++++----------- tcp.c | 6 +++--- udp.c | 12 ++++++------ udp_flow.c | 13 +++++++------ 4 files changed, 21 insertions(+), 26 deletions(-) diff --git a/tap.c b/tap.c index 1049e02..7d06189 100644 --- a/tap.c +++ b/tap.c @@ -99,7 +99,6 @@ static PACKET_POOL_NOINIT(pool_tap4, TAP_MSGS_IP4); static PACKET_POOL_NOINIT(pool_tap6, TAP_MSGS_IP6); #define TAP_SEQS 128 /* Different L4 tuples in one batch */ -#define FRAGMENT_MSG_RATE 10 /* # seconds between fragment warnings */ /** * tap_l2_max_len() - Maximum frame size (including L2 header) for current mode @@ -686,17 +685,11 @@ static bool tap4_is_fragment(const struct iphdr *iph, const struct timespec *now) { if (ntohs(iph->frag_off) & ~IP_DF) { - /* Ratelimit messages */ - static time_t last_message; static unsigned num_dropped; num_dropped++; - if (now->tv_sec - last_message > FRAGMENT_MSG_RATE) { - warn("Can't process IPv4 fragments (%u dropped)", - num_dropped); - last_message = now->tv_sec; - num_dropped = 0; - } + warn_ratelimit(now, "Can't process IPv4 fragments (%u dropped)", + num_dropped); return true; } return false; @@ -1115,8 +1108,9 @@ void tap_add_packet(struct ctx *c, struct iov_tail *data, char bufmac[ETH_ADDRSTRLEN]; memcpy(c->guest_mac, eh->h_source, ETH_ALEN); - debug("New guest MAC address observed: %s", - eth_ntop(c->guest_mac, bufmac, sizeof(bufmac))); + info_ratelimit(now, "New guest MAC address observed: %s", + eth_ntop(c->guest_mac, bufmac, + sizeof(bufmac))); proto_update_l2_buf(c->guest_mac); } diff --git a/tcp.c b/tcp.c index 8ea9be8..071bcae 100644 --- a/tcp.c +++ b/tcp.c @@ -1688,9 +1688,9 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, !inany_is_unicast(&ini->oaddr) || ini->oport == 0) { char sstr[INANY_ADDRSTRLEN], dstr[INANY_ADDRSTRLEN]; - debug("Invalid endpoint in TCP SYN: %s:%hu -> %s:%hu", - inany_ntop(&ini->eaddr, sstr, sizeof(sstr)), ini->eport, - inany_ntop(&ini->oaddr, dstr, sizeof(dstr)), ini->oport); + warn_ratelimit(now, "Invalid endpoint in TCP SYN: %s:%hu -> %s:%hu", + inany_ntop(&ini->eaddr, sstr, sizeof(sstr)), ini->eport, + inany_ntop(&ini->oaddr, dstr, sizeof(dstr)), ini->oport); goto cancel; } diff --git a/udp.c b/udp.c index 1fc5a42..52260b9 100644 --- a/udp.c +++ b/udp.c @@ -871,7 +871,7 @@ void udp_sock_fwd(const struct ctx *c, int s, int rule_hint, /* Clear errors & carry on */ if (udp_sock_errs(c, s, FLOW_SIDX_NONE, frompif, port) < 0) { - err( + err_ratelimit(now, "UDP: Unrecoverable error on listening socket: (%s port %hu)", pif_name(frompif), port); /* FIXME: what now? close/re-open socket? */ @@ -898,7 +898,7 @@ void udp_sock_fwd(const struct ctx *c, int s, int rule_hint, pif_name(frompif), pif_name(topif)); discard = true; } else { - debug("Discarding datagram without flow"); + warn_ratelimit(now, "Discarding datagram without flow"); discard = true; } @@ -1042,10 +1042,10 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, if (!(uflow = udp_at_sidx(tosidx))) { char sstr[INET6_ADDRSTRLEN], dstr[INET6_ADDRSTRLEN]; - debug("Dropping datagram with no flow %s %s:%hu -> %s:%hu", - pif_name(pif), - inet_ntop(af, saddr, sstr, sizeof(sstr)), src, - inet_ntop(af, daddr, dstr, sizeof(dstr)), dst); + warn_ratelimit(now, "Dropping datagram with no flow %s %s:%hu -> %s:%hu", + pif_name(pif), + inet_ntop(af, saddr, sstr, sizeof(sstr)), src, + inet_ntop(af, daddr, dstr, sizeof(dstr)), dst); return 1; } diff --git a/udp_flow.c b/udp_flow.c index 7e2453e..35417bc 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -235,8 +235,9 @@ flow_sidx_t udp_flow_from_sock(const struct ctx *c, uint8_t pif, if (!(flow = flow_alloc())) { char sastr[SOCKADDR_STRLEN]; - debug("Couldn't allocate flow for UDP datagram from %s %s", - pif_name(pif), sockaddr_ntop(s_in, sastr, sizeof(sastr))); + err_ratelimit(now, "Couldn't allocate flow for UDP datagram from %s %s", + pif_name(pif), + sockaddr_ntop(s_in, sastr, sizeof(sastr))); return FLOW_SIDX_NONE; } @@ -292,10 +293,10 @@ flow_sidx_t udp_flow_from_tap(const struct ctx *c, if (!(flow = flow_alloc())) { char sstr[INET6_ADDRSTRLEN], dstr[INET6_ADDRSTRLEN]; - debug("Couldn't allocate flow for UDP datagram from %s %s:%hu -> %s:%hu", - pif_name(pif), - inet_ntop(af, saddr, sstr, sizeof(sstr)), srcport, - inet_ntop(af, daddr, dstr, sizeof(dstr)), dstport); + err_ratelimit(now, "Couldn't allocate flow for UDP datagram from %s %s:%hu -> %s:%hu", + pif_name(pif), + inet_ntop(af, saddr, sstr, sizeof(sstr)), srcport, + inet_ntop(af, daddr, dstr, sizeof(dstr)), dstport); return FLOW_SIDX_NONE; } -- 2.53.0

3 4

[PATCH v1] tcp: Handle errors from tcp_send_flag()
by Anshu Kumari 15 Apr '26

15 Apr '26

tcp_send_flag() can return error codes from tcp_prepare_flags() failing TCP_INFO, or from failure to collect buffers on the vhost-user path. These errors indicate the connection requires resetting. Most callers of tcp_send_flag() were ignoring the error code and carrying on as if nothing was wrong. Check the return value at each call site and handle the error appropriately: - in tcp_data_from_tap(), return -1 so the caller resets - in tcp_tap_handler(), goto reset - in tcp_timer_handler()/tcp_sock_handler()/tcp_conn_from_sock_finish(), call tcp_rst() and return - in tcp_tap_conn_from_sock(), set CLOSING flag (flow not yet active) - in tcp_keepalive(), call tcp_rst() and continue the loop - in tcp_flow_migrate_target_ext(), goto fail The call in tcp_rst_do() is left unchecked: we are already resetting, and tcp_sock_rst() still needs to run regardless. Bug: https://bugs.passt.top/show_bug.cgi?id=194 Signed-off-by: Anshu Kumari <anskuma(a)redhat.com> --- tcp.c | 59 ++++++++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 44 insertions(+), 15 deletions(-) diff --git a/tcp.c b/tcp.c index 8ea9be8..9ce671a 100644 --- a/tcp.c +++ b/tcp.c @@ -1917,7 +1917,9 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn, "keep-alive sequence: %u, previous: %u", seq, conn->seq_from_tap); - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) + return -1; + tcp_timer_ctl(c, conn); if (setsockopt(conn->sock, SOL_SOCKET, SO_KEEPALIVE, @@ -2043,14 +2045,16 @@ eintr: * Then swiftly looked away and left. */ conn->seq_from_tap = seq_from_tap; - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) + return -1; } if (errno == EINTR) goto eintr; if (errno == EAGAIN || errno == EWOULDBLOCK) { - tcp_send_flag(c, conn, ACK | DUP_ACK); + if (tcp_send_flag(c, conn, ACK | DUP_ACK)) + return -1; return p->count - idx; } @@ -2070,7 +2074,8 @@ out: */ if (conn->seq_dup_ack_approx != (conn->seq_from_tap & 0xff)) { conn->seq_dup_ack_approx = conn->seq_from_tap & 0xff; - tcp_send_flag(c, conn, ACK | DUP_ACK); + if (tcp_send_flag(c, conn, ACK | DUP_ACK)) + return -1; } return p->count - idx; } @@ -2084,7 +2089,8 @@ out: conn_event(c, conn, TAP_FIN_RCVD); } else { - tcp_send_flag(c, conn, ACK_IF_NEEDED); + if (tcp_send_flag(c, conn, ACK_IF_NEEDED)) + return -1; } return p->count - idx; @@ -2122,7 +2128,10 @@ static void tcp_conn_from_sock_finish(const struct ctx *c, return; } - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) { + tcp_rst(c, conn); + return; + } /* The client might have sent data already, which we didn't * dequeue waiting for SYN,ACK from tap -- check now. @@ -2308,7 +2317,9 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, goto reset; } - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) + goto reset; + conn_event(c, conn, SOCK_FIN_SENT); return 1; @@ -2388,7 +2399,9 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, } conn_event(c, conn, SOCK_FIN_SENT); - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) + goto reset; + ack_due = 0; /* If we received a FIN, but the socket is in TCP_ESTABLISHED @@ -2478,7 +2491,11 @@ static void tcp_tap_conn_from_sock(const struct ctx *c, union flow *flow, conn->wnd_from_tap = WINDOW_DEFAULT; - tcp_send_flag(c, conn, SYN); + if (tcp_send_flag(c, conn, SYN)) { + conn_flag(c, conn, CLOSING); + return; + } + conn_flag(c, conn, ACK_FROM_TAP_DUE); tcp_get_sndbuf(conn); @@ -2585,7 +2602,10 @@ void tcp_timer_handler(const struct ctx *c, union epoll_ref ref) return; if (conn->flags & ACK_TO_TAP_DUE) { - tcp_send_flag(c, conn, ACK_IF_NEEDED); + if (tcp_send_flag(c, conn, ACK_IF_NEEDED)) { + tcp_rst(c, conn); + return; + } tcp_timer_ctl(c, conn); } else if (conn->flags & ACK_FROM_TAP_DUE) { if (!(conn->events & ESTABLISHED)) { @@ -2598,7 +2618,10 @@ void tcp_timer_handler(const struct ctx *c, union epoll_ref ref) tcp_rst(c, conn); } else { flow_trace(conn, "SYN timeout, retry"); - tcp_send_flag(c, conn, SYN); + if (tcp_send_flag(c, conn, SYN)) { + tcp_rst(c, conn); + return; + } conn->retries++; conn_flag(c, conn, SYN_RETRIED); tcp_timer_ctl(c, conn); @@ -2662,8 +2685,11 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, tcp_data_from_sock(c, conn); if (events & EPOLLOUT) { - if (tcp_update_seqack_wnd(c, conn, false, NULL)) - tcp_send_flag(c, conn, ACK); + if (tcp_update_seqack_wnd(c, conn, false, NULL) && + tcp_send_flag(c, conn, ACK)) { + tcp_rst(c, conn); + return; + } } return; @@ -2903,7 +2929,8 @@ static void tcp_keepalive(struct ctx *c, const struct timespec *now) if (conn->tap_inactive) { flow_dbg(conn, "No tap activity for least %us, send keepalive", KEEPALIVE_INTERVAL); - tcp_send_flag(c, conn, KEEPALIVE); + if (tcp_send_flag(c, conn, KEEPALIVE)) + tcp_rst(c, conn); } /* Ready to check fot next interval */ @@ -3926,7 +3953,9 @@ int tcp_flow_migrate_target_ext(struct ctx *c, struct tcp_tap_conn *conn, int fd if (tcp_set_peek_offset(conn, peek_offset)) goto fail; - tcp_send_flag(c, conn, ACK); + if (tcp_send_flag(c, conn, ACK)) + goto fail; + tcp_data_from_sock(c, conn); if ((rc = tcp_epoll_ctl(conn))) { -- 2.53.0

3 2

[PATCH v2] conf: use a single buffer for print formatting in conf_print()
by Jon Maloy 15 Apr '26

15 Apr '26

The function conf_print() uses three different buffers as target for address print formatting. This is unnecessary, as a single buffer of length INANY_ADDRSTRLEN has sufficient space for all address types, IPv4, IPv6 and MAC. There is no risk for conflicts, since all formatting is followed by an immediate info() printout. To make our life easier in the following commits, we do this simplification here. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Changed buffer length to INANY_ADDSTRLEN - Eliminated use of same buffer in same info() printout. --- conf.c | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/conf.c b/conf.c index dafac46..f13fef6 100644 --- a/conf.c +++ b/conf.c @@ -1136,11 +1136,12 @@ enum passt_modes conf_mode(int argc, char *argv[]) */ static void conf_print(const struct ctx *c) { - char buf4[INET_ADDRSTRLEN], buf6[INET6_ADDRSTRLEN]; - char bufmac[ETH_ADDRSTRLEN], ifn[IFNAMSIZ]; + char buf[INANY_ADDRSTRLEN]; int i; if (c->ifi4 > 0 || c->ifi6 > 0) { + char ifn[IFNAMSIZ]; + info("Template interface: %s%s%s%s%s", c->ifi4 > 0 ? if_indextoname(c->ifi4, ifn) : "", c->ifi4 > 0 ? " (IPv4)" : "", @@ -1158,28 +1159,27 @@ static void conf_print(const struct ctx *c) *c->ip6.ifname_out ? " (IPv6)" : ""); } - if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr_out) || - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_out)) { - info("Outbound address: %s%s%s", - IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr_out) ? "" : - inet_ntop(AF_INET, &c->ip4.addr_out, buf4, sizeof(buf4)), - (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr_out) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_out)) ? ", " : "", - IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_out) ? "" : - inet_ntop(AF_INET6, &c->ip6.addr_out, buf6, sizeof(buf6))); + if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr_out)) { + inet_ntop(AF_INET, &c->ip4.addr_out, buf, sizeof(buf)); + info("Outbound IPv4 address: %s", buf); + } + + if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr_out)) { + inet_ntop(AF_INET6, &c->ip6.addr_out, buf, sizeof(buf)); + info("Outbound IPv6 address: %s", buf); } if (c->mode == MODE_PASTA && !c->splice_only) info("Namespace interface: %s", c->pasta_ifn); info("MAC:"); - info(" host: %s", eth_ntop(c->our_tap_mac, bufmac, sizeof(bufmac))); + info(" host: %s", eth_ntop(c->our_tap_mac, buf, sizeof(buf))); if (c->ifi4) { if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) info(" NAT to host 127.0.0.1: %s", inet_ntop(AF_INET, &c->ip4.map_host_loopback, - buf4, sizeof(buf4))); + buf, sizeof(buf))); if (!c->no_dhcp) { uint32_t mask; @@ -1188,12 +1188,12 @@ static void conf_print(const struct ctx *c) info("DHCP:"); info(" assign: %s", - inet_ntop(AF_INET, &c->ip4.addr, buf4, sizeof(buf4))); + inet_ntop(AF_INET, &c->ip4.addr, buf, sizeof(buf))); info(" mask: %s", - inet_ntop(AF_INET, &mask, buf4, sizeof(buf4))); + inet_ntop(AF_INET, &mask, buf, sizeof(buf))); info(" router: %s", inet_ntop(AF_INET, &c->ip4.guest_gw, - buf4, sizeof(buf4))); + buf, sizeof(buf))); } for (i = 0; i < ARRAY_SIZE(c->ip4.dns); i++) { @@ -1201,8 +1201,8 @@ static void conf_print(const struct ctx *c) break; if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns[i], buf4, sizeof(buf4)); - info(" %s", buf4); + inet_ntop(AF_INET, &c->ip4.dns[i], buf, sizeof(buf)); + info(" %s", buf); } for (i = 0; *c->dns_search[i].n; i++) { @@ -1216,7 +1216,7 @@ static void conf_print(const struct ctx *c) if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) info(" NAT to host ::1: %s", inet_ntop(AF_INET6, &c->ip6.map_host_loopback, - buf6, sizeof(buf6))); + buf, sizeof(buf))); if (!c->no_ndp && !c->no_dhcpv6) info("NDP/DHCPv6:"); @@ -1228,12 +1228,12 @@ static void conf_print(const struct ctx *c) goto dns6; info(" assign: %s", - inet_ntop(AF_INET6, &c->ip6.addr, buf6, sizeof(buf6))); + inet_ntop(AF_INET6, &c->ip6.addr, buf, sizeof(buf))); info(" router: %s", - inet_ntop(AF_INET6, &c->ip6.guest_gw, buf6, sizeof(buf6))); + inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf))); info(" our link-local: %s", inet_ntop(AF_INET6, &c->ip6.our_tap_ll, - buf6, sizeof(buf6))); + buf, sizeof(buf))); dns6: for (i = 0; i < ARRAY_SIZE(c->ip6.dns); i++) { @@ -1241,8 +1241,8 @@ dns6: break; if (!i) info("DNS:"); - inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6)); - info(" %s", buf6); + inet_ntop(AF_INET6, &c->ip6.dns[i], buf, sizeof(buf)); + info(" %s", buf); } for (i = 0; *c->dns_search[i].n; i++) { -- 2.52.0

2 1

[PATCH v2 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element
by Laurent Vivier 15 Apr '26

15 Apr '26

Currently, the vhost-user path assumes each virtqueue element contains exactly one iovec entry covering the entire frame. This assumption breaks as some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. This series refactors the vhost-user data path so that frame lengths, header sizes, and padding are tracked and passed explicitly rather than being derived from iovec sizes. This decoupling is a prerequisite for correctly handling padding of multi-buffer frames. The changes in this series can be split in 3 groups: - New iov helpers (patches 1-2): iov_memset() and iov_memcopy() operate across iovec boundaries. These are needed by the final patch to pad and copy frame data when a frame spans multiple iovec entries. - Structural refactoring (patches 3-5): Move vnethdr setup into vu_flush(), separate virtqueue management from socket I/O in the UDP path, and pass iov arrays explicitly instead of using file-scoped state. These changes make it possible to pass explicit frame lengths through the stack, which is required to pad frames independently of iovec layout. - Explicit length passing throughout the stack (patches 6-10): Thread explicit L4, L2, frame, and data lengths through checksum, pcap, vu_flush(), and tcp_fill_headers(), replacing lengths that were previously derived from iovec sizes. With lengths tracked explicitly, the final patch can centralise Ethernet frame padding into vu_collect() and a new vu_pad() helper that correctly pads frames spanning multiple iovec entries. v2: - Rename iov_memcopy() to iov_memcpy() and use clearer parameter names - Use clearer code in pcap_frame() - Add braces around bodies in pcap.c and tcp_vu.c for style consistency - Extract l2len variable in tap_add_packet() and tcp_vu_send_flag() to avoid repeating the same expression - Fix indentation alignment of iov_skip_bytes() arguments in tcp_vu_c - Introduce fill_size variable in vu_flush() - Reposition comment for ETH_ZLEN in vu_collect() Laurent Vivier (10): iov: Introduce iov_memset() iov: Add iov_memcpy() to copy data between iovec arrays vu_common: Move vnethdr setup into vu_flush() udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller udp_vu: Pass iov explicitly to helpers instead of using file-scoped array checksum: Pass explicit L4 length to checksum functions pcap: Pass explicit L2 length to pcap_iov() vu_common: Pass explicit frame length to vu_flush() tcp: Pass explicit data length to tcp_fill_headers() vhost-user: Centralise Ethernet frame padding in vu_collect() and vu_pad() checksum.c | 35 ++++++----- checksum.h | 6 +- iov.c | 78 ++++++++++++++++++++++++ iov.h | 5 ++ pcap.c | 41 ++++++++++--- pcap.h | 2 +- tap.c | 7 ++- tcp.c | 14 +++-- tcp_buf.c | 3 +- tcp_internal.h | 2 +- tcp_vu.c | 66 ++++++++++---------- udp.c | 5 +- udp_vu.c | 162 ++++++++++++++++++++++++++----------------------- vu_common.c | 58 ++++++++++-------- vu_common.h | 5 +- 15 files changed, 311 insertions(+), 178 deletions(-) -- 2.53.0

2 20

[PATCH v7 0/3] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 13 Apr '26

13 Apr '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Based-on: 20260403163811.3209635-1-lvivier(a)redhat.com v7: - In udp_vu_sock_to_tap(), introduce iov_still_needed variable - Fix iov_tail @data doc comments in udp_vu_prepare()/udp_vu_csum() - Don't rewrap the virtio checksum comment in udp_update_hdr6() - Add NULL check for uh in udp_vu_csum() v6: - Rebased on top of [PATCH 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element v5: - This version doesn't change the padding system regarding v4, it's a complex task that will be addressed in another version - reorder patches and add new patches - remove IOV_PUT_HEADER()/with_header() and introduce IOV_PUSH_HEADER() - don't use the iov_tail to provide the headers to the functions - move vu_set_vnethdr() to vu_flush(), extract vu_queue_notify() - move vu_flush() inside loop in tcp_vu_data_from_sock() to flush data by frame and not by full data length v4: - rebase - replace ASSERT() by assert() v3: - include the series "Decouple iovec management from virtqueues elements" - because of this series, drop: "vu_common: Accept explicit iovec counts in vu_set_element()" "vu_common: Accept explicit iovec count per element in vu_init_elem()" "vu_common: Prepare to use multibuffer with guest RX" "vhost-user,udp: Use 2 iovec entries per element" - drop "vu_common: Pass iov_tail to vu_set_vnethdr()" as the specs insures a buffer is big enough to contain vnet header - introduce "with_header()" and merge "udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()" and "udp_vu: Use iov_tail in udp_vu_prepare()" to use it v2: - add iov_truncate(), iov_memset() - remove iov_tail_truncate() and iov_tail_zero_end() - manage 802.3 minimum frame size Laurent Vivier (3): udp_vu: Allow virtqueue elements with multiple iovec entries iov: Introduce IOV_PUSH_HEADER() macro udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() iov.c | 22 ++++++++++ iov.h | 11 +++++ udp.c | 65 +++++++++++++++------------- udp_internal.h | 4 +- udp_vu.c | 113 ++++++++++++++++++++++++++----------------------- 5 files changed, 131 insertions(+), 84 deletions(-) -- 2.53.0

2 6

[PATCH v7 00/13] Introduce multiple addresses and late binding
by Jon Maloy 13 Apr '26

13 Apr '26

This series adds handling of multiple addresses into a unified address array, so that a guest can see the same addresses on his own interface. o All addresses are stored as union inany_addr o User configured addresses are marked with a USER flag. o Host provided addresses are marked with a HOST flag. o Link local addresses are also marked with a LINKLOCAL flag. o Addresses the guest is actually using are marked with an OBSERVED flag. o Addresses eligible for DHCP assignments are marked with an DHCP flag. o Addresses eligible for DHCPv6 advertisement are marked with an DHCPV6 flag. o Addresses eligible for NDP advertisement are marked with an NDP flag. v2: - Added the earlier standalone CIDR commit to the head of the series. - Replaced the guest namespace interface subscriptions with just an address observation feature, so that it works with both PASTA and PASST. - Unified 'no_copy_addrs' and 'copy_addrs' code paths, as suggested by David G. - Multiple other changes, also based on feedback from David. - Removed the host interface subscription patches, -for now. I intend to re-add them once this series is applied. - Outstanding question: When do we add an IPv4 link local address to the guest? Only in local/opaque mode? Only when explicitly requested? Always? v3: - Unified the IPv4 and IPv6 arrays into one array - Changed prefix_len to always be in IPv6/IpV4 mapped format - Updated migration protocol to v3, handling multiple addresses - Many other smaller changes, based on feedback from the PASST team v4: - Numerous changes based on feedback - Added several new commits, mostly broken out of the pre-existing ones. v5: - Re-introduced multiple OBSERVED addresses. This actually turned out to be cleaner and with more predictable behaviour than allowing only one. - Included the DHCP and NDP patches from previous versions, improved and updated according to feedback from the team. - Likewise re-included the host-side netlink commit to support late binding. v6: - Skipped late binding commit for now. - Added commit for using a single print buffer in conf_print - Added commit for reading and adding all addresses from template interface. - Added commit for refactoring pasta_ns_conf(). - Added separate address flags for DHCP, DHCPv6, and NDP, so that those are easy to recognize for their respective functions. - Split DHCP and DHCPv6 address selection into separate commits. - Updated migration protocol to v3 for multi-address support. - Numerous other smaller changes, both after feedback from David G. and issues I have identified myself. v7: - Replaced commit #1 with one that fixes a return address issue with DHCPv6 - Modified for_each_addr() macro to take 4 arguments - Many more fixes and changes based on feedback and own findings. Jon Maloy (13): dhcpv6: Fix reply destination to match client's source address passt, pasta: Introduce unified multi-address data structures fwd: Unify guest accessibility checks with unified address array arp: Check all configured addresses in ARP filtering conf: Allow multiple -a/--address options per address family netlink, conf: Read all addresses from template interface at startup netlink, pasta: refactor function pasta_ns_conf() conf, pasta: Track observed guest IPv4 addresses in unified address array conf, pasta: Track observed guest IPv6 addresses in unified address array migrate: Update protocol to v3 for multi-address support dhcp: Select address for DHCP distribution dhcpv6: Select addresses for DHCPv6 distribution ndp: Support advertising multiple prefixes in Router Advertisements arp.c | 20 +++- conf.c | 200 ++++++++++++++++++++--------------- dhcp.c | 22 ++-- dhcpv6.c | 115 +++++++++++--------- dhcpv6.h | 2 +- fwd.c | 305 ++++++++++++++++++++++++++++++++++++++++-------------- fwd.h | 8 ++ inany.h | 44 ++++++++ ip.h | 2 + migrate.c | 240 ++++++++++++++++++++++++++++++++++++++++-- ndp.c | 131 ++++++++++++++++------- netlink.c | 70 +++++++------ netlink.h | 7 +- passt.1 | 7 +- passt.h | 78 +++++++++++--- pasta.c | 224 ++++++++++++++++++++------------------- tap.c | 37 ++----- tap.h | 2 - 18 files changed, 1054 insertions(+), 460 deletions(-) -- 2.52.0

1 12

[PATCH v7 02/13] passt, pasta: Introduce unified multi-address data structures
by Jon Maloy 13 Apr '26

13 Apr '26

As preparation for supporting multiple addresses per interface, we replace the single addr/prefix_len fields with an array. The array consists of a new struct inany_addr_entry containing an address and prefix length, both in inany_addr format. Despite a lot of code refactoring, there are only two real functional changes: - The indicated IPv6 prefix length is now properly stored, instead of being ignored and overridden with the hardcoded value 64, as has been the case until now. - Since even IPv4 addresses now are stored in IPv6 format, we also store the corresponding prefix length in that format, i.e. using the range [96,128] instead of [0,32]. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: -Using inany_addr instead of protocol specific addresses as entry address field. v3: -Merging into one array, directly in struct ctx -Changed prefix_len and flags fields in struct inany_addr_entry to uint8_t, since that makes the struct directly migratable v4: -Updated according to changes in previous commits -Updated according to feedback from David G. -Squashed IP4_MASK macro commit into this one v6: -Renamed and moved some definitions -Introduced fwd_set_addr() and fwd_get_addr() already in this commit -Eliminated first_v4/v6() functions, replaced with fwd_get_addr() -Some other changes as suggested by David G. -I kept the flag CONF_ADDR_LINKLOCAL, since it will be needed later in an address selection function. v7: -Introduced CONF_ADDR_GENERATED flag -Other fixes based on feedback from David and Stefano. -I changed signature of inany_prefix_len(), but I did not change its semantics, since the premise of David's comment is wrong: the caller does *not* explicitly know he is dealing with an IPv4 address. In fact, there are examples later in this series where it may be an IPv6 address, and the caller just trusts he gets the return value in the appropriate format. -Introduced the inverse of inany_prefix_len(), called inany_prefix_len6() which always returns the prefix in IPv6 or mapped IPv4 format. The name of the function isn't great, but any alternative I came up with became too long to be practical. --- arp.c | 12 ++++- conf.c | 143 ++++++++++++++++++++++++++++++------------------------- dhcp.c | 14 ++++-- dhcpv6.c | 15 ++++-- fwd.c | 109 ++++++++++++++++++++++++++++++++++-------- fwd.h | 4 ++ inany.h | 41 ++++++++++++++++ ip.h | 2 + ndp.c | 16 +++++-- passt.h | 67 ++++++++++++++++++++++---- pasta.c | 25 ++++++---- tap.c | 7 ++- 12 files changed, 340 insertions(+), 115 deletions(-) diff --git a/arp.c b/arp.c index bb042e9..a7fd82f 100644 --- a/arp.c +++ b/arp.c @@ -41,6 +41,8 @@ static bool ignore_arp(const struct ctx *c, const struct arphdr *ah, const struct arpmsg *am) { + const struct guest_addr *a; + if (ah->ar_hrd != htons(ARPHRD_ETHER) || ah->ar_pro != htons(ETH_P_IP) || ah->ar_hln != ETH_ALEN || @@ -54,7 +56,8 @@ static bool ignore_arp(const struct ctx *c, return true; /* Don't resolve the guest's assigned address, either. */ - if (!memcmp(am->tip, &c->ip4.addr, sizeof(am->tip))) + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a && !memcmp(am->tip, inany_v4(&a->addr), sizeof(am->tip))) return true; return false; @@ -123,12 +126,17 @@ int arp(const struct ctx *c, struct iov_tail *data) */ void arp_send_init_req(const struct ctx *c) { + const struct guest_addr *a; struct { struct ethhdr eh; struct arphdr ah; struct arpmsg am; } __attribute__((__packed__)) req; + a = fwd_get_addr(c, AF_INET, 0, 0); + if (!a) + return; + /* Ethernet header */ req.eh.h_proto = htons(ETH_P_ARP); memcpy(req.eh.h_dest, MAC_BROADCAST, sizeof(req.eh.h_dest)); @@ -145,7 +153,7 @@ void arp_send_init_req(const struct ctx *c) memcpy(req.am.sha, c->our_tap_mac, sizeof(req.am.sha)); memcpy(req.am.sip, &c->ip4.our_tap_addr, sizeof(req.am.sip)); memcpy(req.am.tha, MAC_BROADCAST, sizeof(req.am.tha)); - memcpy(req.am.tip, &c->ip4.addr, sizeof(req.am.tip)); + memcpy(req.am.tip, inany_v4(&a->addr), sizeof(req.am.tip)); debug("Sending initial ARP request for guest MAC address"); tap_send_single(c, &req, sizeof(req)); diff --git a/conf.c b/conf.c index f13fef6..591f561 100644 --- a/conf.c +++ b/conf.c @@ -728,13 +728,15 @@ static int conf_ip4_prefix(const char *arg) /** * conf_ip4() - Verify or detect IPv4 support, get relevant addresses + * @c: Execution context * @ifi: Host interface to attempt (0 to determine one) - * @ip4: IPv4 context (will be written) * * Return: interface index for IPv4, or 0 on failure. */ -static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) +static unsigned int conf_ip4(struct ctx *c, unsigned int ifi) { + struct ip4_ctx *ip4 = &c->ip4; + if (!ifi) ifi = nl_get_ext_if(nl_sock, AF_INET); @@ -753,60 +755,57 @@ static unsigned int conf_ip4(unsigned int ifi, struct ip4_ctx *ip4) } } - if (IN4_IS_ADDR_UNSPECIFIED(&ip4->addr)) { + if (!fwd_get_addr(c, AF_INET, 0, 0)) { + struct in_addr addr; + int prefix_len; int rc = nl_addr_get(nl_sock, ifi, AF_INET, - &ip4->addr, &ip4->prefix_len, NULL); + &addr, &prefix_len, NULL); if (rc < 0) { debug("Couldn't discover IPv4 address: %s", strerror_(-rc)); return 0; } - } + if (IN4_IS_ADDR_UNSPECIFIED(&addr)) + return 0; - if (!ip4->prefix_len) { - in_addr_t addr = ntohl(ip4->addr.s_addr); - if (IN_CLASSA(addr)) - ip4->prefix_len = (32 - IN_CLASSA_NSHIFT); - else if (IN_CLASSB(addr)) - ip4->prefix_len = (32 - IN_CLASSB_NSHIFT); - else if (IN_CLASSC(addr)) - ip4->prefix_len = (32 - IN_CLASSC_NSHIFT); - else - ip4->prefix_len = 32; + fwd_set_addr(c, &inany_from_v4(addr), CONF_ADDR_HOST, + prefix_len); + ip4->addr_seen = addr; } - ip4->addr_seen = ip4->addr; - ip4->our_tap_addr = ip4->guest_gw; - if (IN4_IS_ADDR_UNSPECIFIED(&ip4->addr)) - return 0; - return ifi; } /** * conf_ip4_local() - Configure IPv4 addresses and attributes for local mode - * @ip4: IPv4 context (will be written) + * @c: Execution context (will be written) */ -static void conf_ip4_local(struct ip4_ctx *ip4) +static void conf_ip4_local(struct ctx *c) { - ip4->addr_seen = ip4->addr = IP4_LL_GUEST_ADDR; - ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; - ip4->prefix_len = IP4_LL_PREFIX_LEN; + struct ip4_ctx *ip4 = &c->ip4; + ip4->addr_seen = IP4_LL_GUEST_ADDR; + ip4->our_tap_addr = ip4->guest_gw = IP4_LL_GUEST_GW; ip4->no_copy_addrs = ip4->no_copy_routes = true; + fwd_set_addr(c, &inany_from_v4(IP4_LL_GUEST_ADDR), + CONF_ADDR_GENERATED | CONF_ADDR_LINKLOCAL, + IP4_LL_PREFIX_LEN); } /** * conf_ip6() - Verify or detect IPv6 support, get relevant addresses + * @c: Execution context * @ifi: Host interface to attempt (0 to determine one) - * @ip6: IPv6 context (will be written) * * Return: interface index for IPv6, or 0 on failure. */ -static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) +static unsigned int conf_ip6(struct ctx *c, unsigned int ifi) { + struct ip6_ctx *ip6 = &c->ip6; + const struct guest_addr *a; + union inany_addr addr; int prefix_len = 0; int rc; @@ -827,21 +826,28 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) } } - rc = nl_addr_get(nl_sock, ifi, AF_INET6, - IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) ? &ip6->addr : NULL, + rc = nl_addr_get(nl_sock, ifi, AF_INET6, &addr.a6, &prefix_len, &ip6->our_tap_ll); if (rc < 0) { debug("Couldn't discover IPv6 address: %s", strerror_(-rc)); return 0; } - ip6->addr_seen = ip6->addr; + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (!a) { + if (IN6_IS_ADDR_UNSPECIFIED(&addr)) + return 0; + + fwd_set_addr(c, &addr, CONF_ADDR_HOST, prefix_len); + ip6->addr_seen = addr.a6; + } else { + ip6->addr_seen = a->addr.a6; + } if (IN6_IS_ADDR_LINKLOCAL(&ip6->guest_gw)) ip6->our_tap_ll = ip6->guest_gw; - if (IN6_IS_ADDR_UNSPECIFIED(&ip6->addr) || - IN6_IS_ADDR_UNSPECIFIED(&ip6->our_tap_ll)) + if (IN6_IS_ADDR_UNSPECIFIED(&ip6->our_tap_ll)) return 0; return ifi; @@ -849,13 +855,13 @@ static unsigned int conf_ip6(unsigned int ifi, struct ip6_ctx *ip6) /** * conf_ip6_local() - Configure IPv6 addresses and attributes for local mode - * @ip6: IPv6 context (will be written) + * @c: Execution context (will be written) */ -static void conf_ip6_local(struct ip6_ctx *ip6) +static void conf_ip6_local(struct ctx *c) { - ip6->our_tap_ll = ip6->guest_gw = IP6_LL_GUEST_GW; + c->ip6.our_tap_ll = c->ip6.guest_gw = IP6_LL_GUEST_GW; - ip6->no_copy_addrs = ip6->no_copy_routes = true; + c->ip6.no_copy_addrs = c->ip6.no_copy_routes = true; } /** @@ -1137,6 +1143,7 @@ enum passt_modes conf_mode(int argc, char *argv[]) static void conf_print(const struct ctx *c) { char buf[INANY_ADDRSTRLEN]; + const struct guest_addr *a; int i; if (c->ifi4 > 0 || c->ifi6 > 0) { @@ -1181,16 +1188,18 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET, &c->ip4.map_host_loopback, buf, sizeof(buf))); - if (!c->no_dhcp) { + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a && !c->no_dhcp) { uint32_t mask; - mask = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + mask = IN4_MASK(inany_prefix_len(&a->addr, + a->prefix_len)); info("DHCP:"); info(" assign: %s", - inet_ntop(AF_INET, &c->ip4.addr, buf, sizeof(buf))); + inany_ntop(&a->addr, buf, sizeof(buf))); info(" mask: %s", - inet_ntop(AF_INET, &mask, buf, sizeof(buf))); + inet_ntop(AF_INET, &mask, buf, sizeof(buf))); info(" router: %s", inet_ntop(AF_INET, &c->ip4.guest_gw, buf, sizeof(buf))); @@ -1201,8 +1210,8 @@ static void conf_print(const struct ctx *c) break; if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns[i], buf, sizeof(buf)); - info(" %s", buf); + info(" %s", inet_ntop(AF_INET, &c->ip4.dns[i], + buf, sizeof(buf))); } for (i = 0; *c->dns_search[i].n; i++) { @@ -1227,13 +1236,14 @@ static void conf_print(const struct ctx *c) else goto dns6; - info(" assign: %s", - inet_ntop(AF_INET6, &c->ip6.addr, buf, sizeof(buf))); + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + if (a) + info(" assign: %s", + inany_ntop(&a->addr, buf, sizeof(buf))); info(" router: %s", inet_ntop(AF_INET6, &c->ip6.guest_gw, buf, sizeof(buf))); info(" our link-local: %s", - inet_ntop(AF_INET6, &c->ip6.our_tap_ll, - buf, sizeof(buf))); + inet_ntop(AF_INET6, &c->ip6.our_tap_ll, buf, sizeof(buf))); dns6: for (i = 0; i < ARRAY_SIZE(c->ip6.dns); i++) { @@ -1241,8 +1251,10 @@ dns6: break; if (!i) info("DNS:"); - inet_ntop(AF_INET6, &c->ip6.dns[i], buf, sizeof(buf)); - info(" %s", buf); + info(" %s", + inet_ntop(AF_INET6, &c->ip6.dns[i], + buf, sizeof(buf))); + } for (i = 0; *c->dns_search[i].n; i++) { @@ -1886,19 +1898,16 @@ void conf(struct ctx *c, int argc, char **argv) IN6_IS_ADDR_V4COMPAT(&addr.a6)) die("Invalid address: %s", optarg); - if (inany_v4(&addr)) { - c->ip4.addr = *inany_v4(&addr); - c->ip4.prefix_len = prefix_len - 96; - if (c->mode == MODE_PASTA) - c->ip4.no_copy_addrs = true; - } else { - c->ip6.addr = addr.a6; - if (c->mode == MODE_PASTA) - c->ip6.no_copy_addrs = true; - } + /* Legacy behaviour: replace existing address if any */ + fwd_set_addr(c, &addr, CONF_ADDR_USER, prefix_len); + if (inany_v4(&addr)) + c->ip4.no_copy_addrs = true; + else + c->ip6.no_copy_addrs = true; break; } case 'n': { + struct guest_addr *a; int plen; if (addr_has_prefix_len) @@ -1908,8 +1917,12 @@ void conf(struct ctx *c, int argc, char **argv) if (plen < 0) die("Invalid prefix length: %s", optarg); - prefix_len_from_opt = plen + 96; - c->ip4.prefix_len = plen; + prefix_len_from_opt = plen; + + for_each_addr(a, c->addrs, c->addr_count, AF_INET) { + a->prefix_len = inany_prefix_len(&a->addr, plen); + break; + } break; } case 'M': @@ -2103,9 +2116,9 @@ void conf(struct ctx *c, int argc, char **argv) nl_sock_init(c, false); if (!v6_only && !c->splice_only) - c->ifi4 = conf_ip4(ifi4, &c->ip4); + c->ifi4 = conf_ip4(c, ifi4); if (!v4_only && !c->splice_only) - c->ifi6 = conf_ip6(ifi6, &c->ip6); + c->ifi6 = conf_ip6(c, ifi6); if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { warn("MTU %"PRIu16" is too small for IPv4 (minimum %u)", @@ -2128,7 +2141,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi4 && !v6_only) { if (!c->splice_only) { info("IPv4: no external interface as template, use local mode"); - conf_ip4_local(&c->ip4); + conf_ip4_local(c); } c->ifi4 = -1; } @@ -2136,7 +2149,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6 && !v4_only) { if (!c->splice_only) { info("IPv6: no external interface as template, use local mode"); - conf_ip6_local(&c->ip6); + conf_ip6_local(c); } c->ifi6 = -1; } @@ -2201,7 +2214,7 @@ void conf(struct ctx *c, int argc, char **argv) if (!c->ifi6) { c->no_ndp = 1; c->no_dhcpv6 = 1; - } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + } else if (!fwd_get_addr(c, AF_INET6, 0, 0)) { c->no_dhcpv6 = 1; } diff --git a/dhcp.c b/dhcp.c index 1ff8cba..f0fa212 100644 --- a/dhcp.c +++ b/dhcp.c @@ -303,6 +303,7 @@ static void opt_set_dns_search(const struct ctx *c, size_t max_len) int dhcp(const struct ctx *c, struct iov_tail *data) { char macstr[ETH_ADDRSTRLEN]; + const struct guest_addr *a; size_t mlen, dlen, opt_len; struct in_addr mask, dst; struct ethhdr eh_storage; @@ -313,6 +314,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) const struct udphdr *uh; struct msg m_storage; struct msg const *m; + struct in_addr addr; struct msg reply; unsigned int i; @@ -344,6 +346,10 @@ int dhcp(const struct ctx *c, struct iov_tail *data) m->op != BOOTREQUEST) return -1; + a = fwd_get_addr(c, AF_INET, 0, 0); + assert(a); + addr = *inany_v4(&a->addr); + reply.op = BOOTREPLY; reply.htype = m->htype; reply.hlen = m->hlen; @@ -352,7 +358,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) reply.secs = 0; reply.flags = m->flags; reply.ciaddr = m->ciaddr; - reply.yiaddr = c->ip4.addr; + reply.yiaddr = addr; reply.siaddr = 0; reply.giaddr = m->giaddr; memcpy(&reply.chaddr, m->chaddr, sizeof(reply.chaddr)); @@ -404,7 +410,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) info(" from %s", eth_ntop(m->chaddr, macstr, sizeof(macstr))); - mask.s_addr = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + mask.s_addr = IN4_MASK(inany_prefix_len(&a->addr, a->prefix_len)); memcpy(opts[1].s, &mask, sizeof(mask)); memcpy(opts[3].s, &c->ip4.guest_gw, sizeof(c->ip4.guest_gw)); memcpy(opts[54].s, &c->ip4.our_tap_addr, sizeof(c->ip4.our_tap_addr)); @@ -412,7 +418,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) /* If the gateway is not on the assigned subnet, send an option 121 * (Classless Static Routing) adding a dummy route to it. */ - if ((c->ip4.addr.s_addr & mask.s_addr) + if ((addr.s_addr & mask.s_addr) != (c->ip4.guest_gw.s_addr & mask.s_addr)) { /* a.b.c.d/32:0.0.0.0, 0:a.b.c.d */ opts[121].slen = 14; @@ -471,7 +477,7 @@ int dhcp(const struct ctx *c, struct iov_tail *data) if (m->flags & FLAG_BROADCAST) dst = in4addr_broadcast; else - dst = c->ip4.addr; + dst = addr; tap_udp4_send(c, c->ip4.our_tap_addr, 67, dst, 68, &reply, dlen); diff --git a/dhcpv6.c b/dhcpv6.c index 2db0944..0a064a9 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -318,7 +318,7 @@ static bool dhcpv6_opt(struct iov_tail *data, uint16_t type) * false otherwise and @data is unmodified */ static bool dhcpv6_ia_notonlink(struct iov_tail *data, - struct in6_addr *la) + const struct in6_addr *la) { int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }; struct opt_ia_addr opt_addr_storage; @@ -567,6 +567,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, struct opt_hdr client_id_storage; /* cppcheck-suppress [variableScope,unmatchedSuppression] */ struct opt_ia_na ia_storage; + const struct guest_addr *a; const struct in6_addr *src; struct msg_hdr mh_storage; const struct msg_hdr *mh; @@ -574,6 +575,8 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, const struct udphdr *uh; size_t mlen, n; + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + uh = IOV_REMOVE_HEADER(data, uh_storage); if (!uh) return -1; @@ -627,7 +630,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mh->type == TYPE_CONFIRM && server_id) return -1; - if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { + if (a && dhcpv6_ia_notonlink(data, &a->addr.a6)) { dhcpv6_send_ia_notonlink(c, saddr, data, &client_id_base, ntohs(client_id->l), mh->xid); @@ -680,7 +683,8 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); - c->ip6.addr_seen = c->ip6.addr; + if (a) + c->ip6.addr_seen = a->addr.a6; return 1; } @@ -691,6 +695,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, */ void dhcpv6_init(const struct ctx *c) { + const struct guest_addr *a; time_t y2k = 946684800; /* Epoch to 2000-01-01T00:00:00Z, no mktime() */ uint32_t duid_time; @@ -704,5 +709,7 @@ void dhcpv6_init(const struct ctx *c) memcpy(resp_not_on_link.server_id.duid_lladdr, c->our_tap_mac, sizeof(c->our_tap_mac)); - resp.ia_addr.addr = c->ip6.addr; + a = fwd_get_addr(c, AF_INET6, 0, CONF_ADDR_LINKLOCAL); + if (a) + resp.ia_addr.addr = a->addr.a6; } diff --git a/fwd.c b/fwd.c index bedbf98..14ce0a7 100644 --- a/fwd.c +++ b/fwd.c @@ -249,6 +249,61 @@ void fwd_neigh_table_init(const struct ctx *c) fwd_neigh_table_update(c, &mga, c->our_tap_mac, true); } +/** + * fwd_set_addr() - Add or update an address in the unified address array + * @c: Execution context + * @addr: Address to add (IPv4-mapped or IPv6) + * @flags: CONF_ADDR_* flags for this address + * @prefix_len: Prefix length in IPv6 or IPv4 format + * + * Find the first existing entry of the same address family and + * overwrite it, or create a new one if none exists + */ +void fwd_set_addr(struct ctx *c, const union inany_addr *addr, + uint8_t flags, int prefix_len) +{ + struct guest_addr *a; + + for_each_addr(a, c->addrs, c->addr_count, inany_af(addr)) { + goto found; + } + + if (c->addr_count >= MAX_GUEST_ADDRS) + return; + + a = &c->addrs[c->addr_count++]; + +found: + a->addr = *addr; + a->prefix_len = inany_prefix_len6(addr, prefix_len); + a->flags = flags; +} + +/** + * fwd_get_addr() - Get guest address entry matching criteria + * @c: Execution context + * @af: Address family (AF_INET, AF_INET6, or 0 for any) + * @incl: Flags that must be present (any-match) + * @excl: Flags that must not be present + * + * Return: first address entry matching criteria, or NULL + */ +const struct guest_addr *fwd_get_addr(const struct ctx *c, sa_family_t af, + uint8_t incl, uint8_t excl) +{ + const struct guest_addr *a; + + for_each_addr(a, c->addrs, c->addr_count, af) { + if (incl && !(a->flags & incl)) + continue; + if (a->flags & excl) + continue; + return a; + } + + return NULL; +} + /** fwd_probe_ephemeral() - Determine what ports this host considers ephemeral * * Work out what ports the host thinks are emphemeral and record it for later @@ -941,8 +996,10 @@ static bool is_dns_flow(uint8_t proto, const struct flowside *ini) * translation, false otherwise */ static bool fwd_guest_accessible4(const struct ctx *c, - const struct in_addr *addr) + const struct in_addr *addr) { + const struct guest_addr *a; + if (IN4_IS_ADDR_LOOPBACK(addr)) return false; @@ -957,7 +1014,8 @@ static bool fwd_guest_accessible4(const struct ctx *c, /* For IPv4, addr_seen is initialised to addr, so is always a valid * address */ - if (IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr) || + a = fwd_get_addr(c, AF_INET, 0, 0); + if ((a && IN4_ARE_ADDR_EQUAL(addr, inany_v4(&a->addr))) || IN4_ARE_ADDR_EQUAL(addr, &c->ip4.addr_seen)) return false; @@ -975,10 +1033,13 @@ static bool fwd_guest_accessible4(const struct ctx *c, static bool fwd_guest_accessible6(const struct ctx *c, const struct in6_addr *addr) { + const struct guest_addr *a; + if (IN6_IS_ADDR_LOOPBACK(addr)) return false; - if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.addr)) + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (a && IN6_ARE_ADDR_EQUAL(addr, &a->addr.a6)) return false; /* For IPv6, addr_seen starts unspecified, because we don't know what LL @@ -1023,16 +1084,21 @@ static bool fwd_guest_accessible(const struct ctx *c, static void nat_outbound(const struct ctx *c, const union inany_addr *addr, union inany_addr *translated) { - if (inany_equals4(addr, &c->ip4.map_host_loopback)) + const struct guest_addr *ga; + + if (inany_equals4(addr, &c->ip4.map_host_loopback)) { *translated = inany_loopback4; - else if (inany_equals6(addr, &c->ip6.map_host_loopback)) + } else if (inany_equals6(addr, &c->ip6.map_host_loopback)) { *translated = inany_loopback6; - else if (inany_equals4(addr, &c->ip4.map_guest_addr)) - *translated = inany_from_v4(c->ip4.addr); - else if (inany_equals6(addr, &c->ip6.map_guest_addr)) - translated->a6 = c->ip6.addr; - else + } else if (inany_equals4(addr, &c->ip4.map_guest_addr)) { + ga = fwd_get_addr(c, AF_INET, 0, 0); + *translated = ga ? ga->addr : inany_any4; + } else if (inany_equals6(addr, &c->ip6.map_guest_addr)) { + ga = fwd_get_addr(c, AF_INET6, 0, 0); + translated->a6 = ga ? ga->addr.a6 : in6addr_any; + } else { *translated = *addr; + } } /** @@ -1137,16 +1203,21 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback) && inany_equals6(addr, &in6addr_loopback)) { translated->a6 = c->ip6.map_host_loopback; - } else if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_guest_addr) && - inany_equals4(addr, &c->ip4.addr)) { - *translated = inany_from_v4(c->ip4.map_guest_addr); - } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && - inany_equals6(addr, &c->ip6.addr)) { - translated->a6 = c->ip6.map_guest_addr; - } else if (fwd_guest_accessible(c, addr)) { - *translated = *addr; } else { - return false; + const struct guest_addr *ga4 = fwd_get_addr(c, AF_INET, 0, 0); + const struct guest_addr *ga6 = fwd_get_addr(c, AF_INET6, 0, 0); + + if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_guest_addr) && + ga4 && inany_equals(addr, &ga4->addr)) { + *translated = inany_from_v4(c->ip4.map_guest_addr); + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && + ga6 && inany_equals(addr, &ga6->addr)) { + translated->a6 = c->ip6.map_guest_addr; + } else if (fwd_guest_accessible(c, addr)) { + *translated = *addr; + } else { + return false; + } } return true; diff --git a/fwd.h b/fwd.h index 958eee2..c5a1068 100644 --- a/fwd.h +++ b/fwd.h @@ -23,6 +23,8 @@ struct flowside; void fwd_probe_ephemeral(void); bool fwd_port_is_ephemeral(in_port_t port); +const struct guest_addr *fwd_get_addr(const struct ctx *c, sa_family_t af, + uint8_t incl, uint8_t excl); /** * struct fwd_rule - Forwarding rule governing a range of ports @@ -141,5 +143,7 @@ void fwd_neigh_table_free(const struct ctx *c, void fwd_neigh_mac_get(const struct ctx *c, const union inany_addr *addr, uint8_t *mac); void fwd_neigh_table_init(const struct ctx *c); +void fwd_set_addr(struct ctx *c, const union inany_addr *addr, + uint8_t flags, int prefix_len); #endif /* FWD_H */ diff --git a/inany.h b/inany.h index 9891ed6..0450c45 100644 --- a/inany.h +++ b/inany.h @@ -102,6 +102,16 @@ static inline struct in_addr *inany_v4(const union inany_addr *addr) return (struct in_addr *)&addr->v4mapped.a4; } +/** inany_af - Get address family of IPv[46] address + * @addr: IPv4 or IPv6 address + * + * Return: AF_INET for IPv4, AF_INET6 for IPv6 + */ +static inline sa_family_t inany_af(const union inany_addr *addr) +{ + return inany_v4(addr) ? AF_INET : AF_INET6; +} + /** inany_default_prefix_len() - Get default prefix length for address * @addr: IPv4 or iPv6 address * @@ -115,6 +125,37 @@ static inline int inany_default_prefix_len(const union inany_addr *addr) return v4 ? ip4_class_prefix_len(v4) + 96 : 64; } + +/** inany_prefix_len() - Convert prefix length to native format + * @addr: IPv4 or IPv6 address + * @prefix_len: prefix length (any format, auto-detected) + * + * Return: prefix length in native format (0-32 for IPv4, 0-128 for IPv6) + */ +static inline int inany_prefix_len(const union inany_addr *addr, + int prefix_len) +{ + if (inany_v4(addr) && prefix_len >= 96) + return prefix_len - 96; + + return prefix_len; +} + +/** inany_prefix_len6() - Convert prefix length to generic format + * @addr: IPv4 or IPv6 address + * @prefix_len: prefix length (any format, auto-detected) + * + * Return: prefix length in generic format (96-128 for IPv4, 0-128 for IPv6) + */ +static inline int inany_prefix_len6(const union inany_addr *addr, + int prefix_len) +{ + if (inany_v4(addr) && prefix_len && prefix_len <= 32) + return prefix_len + 96; + + return prefix_len; +} + /** inany_equals - Compare two IPv[46] addresses * @a, @b: IPv[46] addresses * diff --git a/ip.h b/ip.h index d0de6c8..933d98c 100644 --- a/ip.h +++ b/ip.h @@ -19,6 +19,8 @@ (ntohl(((struct in_addr *)(a))->s_addr) >> IN_CLASSA_NSHIFT == IN_LOOPBACKNET) #define IN4_IS_ADDR_MULTICAST(a) \ (IN_MULTICAST(ntohl(((struct in_addr *)(a))->s_addr))) +#define IN4_MASK(prefix) \ + ((prefix) <= 0 ? 0 : htonl(0xffffffff << (32 - (prefix)))) #define IN4_ARE_ADDR_EQUAL(a, b) \ (((struct in_addr *)(a))->s_addr == ((struct in_addr *)b)->s_addr) #define IN4ADDR_LOOPBACK_INIT \ diff --git a/ndp.c b/ndp.c index 1f2bcb0..3750fc5 100644 --- a/ndp.c +++ b/ndp.c @@ -257,7 +257,6 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) .valid_lifetime = ~0U, .pref_lifetime = ~0U, }, - .prefix = c->ip6.addr, .source_ll = { .header = { .type = OPT_SRC_L2_ADDR, @@ -265,8 +264,13 @@ static void ndp_ra(const struct ctx *c, const struct in6_addr *dst) }, }, }; + const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0); unsigned char *ptr = NULL; + ASSERT(a); + + ra.prefix = a->addr.a6; + ptr = &ra.var[0]; if (c->mtu) { @@ -460,6 +464,7 @@ first: */ void ndp_send_init_req(const struct ctx *c) { + const struct guest_addr *a = fwd_get_addr(c, AF_INET6, 0, 0); struct ndp_ns ns = { .ih = { .icmp6_type = NS, @@ -468,8 +473,13 @@ void ndp_send_init_req(const struct ctx *c) .icmp6_solicited = 0, /* Reserved */ .icmp6_override = 0, /* Reserved */ }, - .target_addr = c->ip6.addr + .target_addr = IN6ADDR_ANY_INIT }; + + if (!a) + return; + + ns.target_addr = a->addr.a6; debug("Sending initial NDP NS request for guest MAC address"); - ndp_send(c, &c->ip6.addr, &ns, sizeof(ns)); + ndp_send(c, &a->addr.a6, &ns, sizeof(ns)); } diff --git a/passt.h b/passt.h index b614bdf..f75656d 100644 --- a/passt.h +++ b/passt.h @@ -64,11 +64,28 @@ enum passt_modes { MODE_VU, }; +/* Maximum number of addresses in context address array */ +#define MAX_GUEST_ADDRS 32 + +/** + * struct guest_addr - Unified IPv4/IPv6 address entry + * @addr: IPv4 (as mapped) or IPv6 address + * @prefix_len: Prefix length in IPv6/IPv4-mapped [0,128]/[96,128] format + * @flags: CONF_ADDR_* flags + */ +struct guest_addr { + union inany_addr addr; + uint8_t prefix_len; + uint8_t flags; +#define CONF_ADDR_USER BIT(0) /* User set via -a */ +#define CONF_ADDR_HOST BIT(1) /* From host interface */ +#define CONF_ADDR_GENERATED BIT(2) /* Generated by PASST/PASTA */ +#define CONF_ADDR_LINKLOCAL BIT(3) /* Link-local address */ +}; + /** * struct ip4_ctx - IPv4 execution context - * @addr: IPv4 address assigned to guest * @addr_seen: Latest IPv4 address seen as source from tap - * @prefixlen: IPv4 prefix length (netmask) * @guest_gw: IPv4 gateway as seen by the guest * @map_host_loopback: Outbound connections to this address are NATted to the * host's 127.0.0.1 @@ -84,10 +101,7 @@ enum passt_modes { * @no_copy_addrs: Don't copy all addresses when configuring namespace */ struct ip4_ctx { - /* PIF_TAP addresses */ - struct in_addr addr; struct in_addr addr_seen; - int prefix_len; struct in_addr guest_gw; struct in_addr map_host_loopback; struct in_addr map_guest_addr; @@ -107,7 +121,6 @@ struct ip4_ctx { /** * struct ip6_ctx - IPv6 execution context - * @addr: IPv6 address assigned to guest * @addr_seen: Latest IPv6 global/site address seen as source from tap * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap * @guest_gw: IPv6 gateway as seen by the guest @@ -125,8 +138,6 @@ struct ip4_ctx { * @no_copy_addrs: Don't copy all addresses when configuring namespace */ struct ip6_ctx { - /* PIF_TAP addresses */ - struct in6_addr addr; struct in6_addr addr_seen; struct in6_addr addr_ll_seen; struct in6_addr guest_gw; @@ -181,6 +192,8 @@ struct ip6_ctx { * @fqdn: Guest FQDN * @ifi6: Template interface for IPv6, -1: none, 0: IPv6 disabled * @ip6: IPv6 configuration + * @addrs: Unified address array for both IPv4 (mapped) and IPv6 + * @addr_count: Number of active entries in @addrs array * @pasta_ifn: Name of namespace interface for pasta * @pasta_ifi: Index of namespace interface for pasta * @pasta_conf_ns: Configure namespace after creating it @@ -260,6 +273,9 @@ struct ctx { int ifi6; struct ip6_ctx ip6; + struct guest_addr addrs[MAX_GUEST_ADDRS]; + int addr_count; + char pasta_ifn[IF_NAMESIZE]; unsigned int pasta_ifi; int pasta_conf_ns; @@ -301,6 +317,41 @@ struct ctx { bool migrate_exit; }; +/** + * next_addr_idx_() - Find next address index matching family filter + * @addrs: Array of guest addresses + * @count: Number of addresses in array + * @i: Starting index + * @af: Address family filter: AF_INET, AF_INET6, or 0 for all + * + * Return: next matching index, or count if none found + */ +static inline int next_addr_idx_(const struct guest_addr *addrs, int count, + int i, sa_family_t af) +{ + for (; i < count; i++) { + sa_family_t entry_af; + + entry_af = inany_v4(&addrs[i].addr) ? AF_INET : AF_INET6; + + if (af == AF_UNSPEC || af == entry_af) + return i; + } + return i; +} + +/** + * for_each_addr() - Iterate over addresses in array + * @a: Pointer variable for current entry (struct guest_addr *) + * @addrs: Array of guest addresses (e.g., c->addrs) + * @count: Number of addresses (e.g., c->addr_count) + * @af: Address family filter: AF_INET, AF_INET6, or 0 for all + */ +#define for_each_addr(a, addrs, count, af) \ + for (int i_ = next_addr_idx_((addrs), (count), 0, (af)); \ + i_ < (count) && ((a) = &(addrs)[i_], true); \ + i_ = next_addr_idx_((addrs), (count), i_ + 1, (af))) + void proto_update_l2_buf(const unsigned char *eth_d); #endif /* PASST_H */ diff --git a/pasta.c b/pasta.c index bab945f..c51e4cd 100644 --- a/pasta.c +++ b/pasta.c @@ -330,6 +330,8 @@ void pasta_ns_conf(struct ctx *c) if (c->pasta_conf_ns) { unsigned int flags = IFF_UP; + const struct guest_addr *a; + int plen; if (c->mtu) nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); @@ -341,10 +343,15 @@ void pasta_ns_conf(struct ctx *c) if (c->ifi4) { if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); + a = fwd_get_addr(c, AF_INET, 0, 0); + if (a) { + plen = inany_prefix_len(&a->addr, + a->prefix_len); + rc = nl_addr_set(nl_sock_ns, + c->pasta_ifi, AF_INET, + inany_v4(&a->addr), + plen); + } } else { rc = nl_addr_dup(nl_sock, c->ifi4, nl_sock_ns, c->pasta_ifi, @@ -397,11 +404,13 @@ ipv4_done: 0, IFF_NOARP); if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + a = fwd_get_addr(c, AF_INET6, 0, 0); + if (a) rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } + c->pasta_ifi, + AF_INET6, + &a->addr.a6, + a->prefix_len); } else { rc = nl_addr_dup(nl_sock, c->ifi6, nl_sock_ns, c->pasta_ifi, diff --git a/tap.c b/tap.c index 59c45a3..eb93f74 100644 --- a/tap.c +++ b/tap.c @@ -936,8 +936,11 @@ resume: c->ip6.addr_seen = *saddr; } - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) - c->ip6.addr = *saddr; + if (!fwd_get_addr(c, AF_INET6, 0, 0)) { + union inany_addr addr = { .a6 = *saddr }; + + fwd_set_addr(c, &addr, CONF_ADDR_LINKLOCAL, 64); + } } else if (!IN6_IS_ADDR_UNSPECIFIED(saddr)){ c->ip6.addr_seen = *saddr; } -- 2.52.0

1 0

[PATCH 00/18] Rework forwarding option parsing
by David Gibson 09 Apr '26

09 Apr '26

This series makes a number of significant reworks to how we process forwarding options (-t, -u, -T and -U) in passt & pasta. This is largely motivated by moving towards being able to share this code with a configuration update tool. However, along the way it also enables some forwarding configurations that were technically possible with the forwarding table but couldn't be specified on the command line, in particular bug 180. There is still a bunch of work needed to make the parsing code truly shareable with pesto, but this is a solid start. David Gibson (18): conf: Split parsing of port specifiers from the rest of -[tuTU] parsing conf: Simplify handling of default forwarding mode conf: Move first pass handling of -[TU] next to handling of -[tu] doc: Consolidate -[tu] option descriptions for passt and pasta conf: Permit -[tTuU] all in pasta mode fwd: Better split forwarding rule specification from associated sockets fwd_rule: Move forwarding rule formatting conf: Pass protocol explicitly to conf_ports_range_except() fwd: Split rule building from rule adding fwd_rule: Move rule conflict checking from fwd_rule_add() to caller fwd: Improve error handling in fwd_rule_add() conf: Don't be strict about exclusivity of forwarding mode conf: Rework stepping through chunks of port specifiers conf: Rework checking for garbage after a range conf: Move "all" handling to port specifier conf: Allow user-specified auto-scanned port forwarding ranges conf: Move SO_BINDTODEVICE workaround to conf_ports() conf: Don't pass raw commandline argument to conf_ports_spec() Makefile | 10 +- conf.c | 541 ++++++++++++++++++++++++++--------------------------- fwd.c | 190 ++++++------------- fwd.h | 21 +-- fwd_rule.c | 132 +++++++++++++ fwd_rule.h | 15 ++ passt.1 | 214 +++++++-------------- 7 files changed, 542 insertions(+), 581 deletions(-) create mode 100644 fwd_rule.c -- 2.53.0

2 41

[PATCH 02/18] conf: Simplify handling of default forwarding mode
by David Gibson 08 Apr '26

08 Apr '26

For passt, the default forwarding mode is "none", which falls out naturally from the other handling: if we don't get any options, we get empty forwarding tables, which corresponds to "none" behaviour. However, for pasta the default is "auto". This is handled a bit oddly: in conf_ports() we set the mode variable, but don't set up the rules we need for "auto" mode. Instead we want until nearly the end of conf() and if the mode is FWD_MODE_AUTO or unset, we make conf_ports_range_except() calls to set up the "auto" rules. Simplify this a bit, by creating the rules within conf_ports() itself when we parse -[tuTU] auto. For the case of no forwarding options we call into conf_ports() itself with synthetic arguments. As well as making the code a little shorter, this makes it more obvious that giving no arguments really is equivalent to -[tuTU] auto. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 54 ++++++++++++++++++++++-------------------------------- 1 file changed, 22 insertions(+), 32 deletions(-) diff --git a/conf.c b/conf.c index c515480b..7d718f91 100644 --- a/conf.c +++ b/conf.c @@ -345,6 +345,10 @@ static void conf_ports(const struct ctx *c, char optname, const char *optarg, die("'auto' port forwarding is only allowed for pasta"); *mode = FWD_MODE_AUTO; + + conf_ports_range_except(c, optname, optarg, fwd, NULL, NULL, + 1, NUM_PORTS - 1, NULL, 1, FWD_SCAN); + return; } @@ -1576,7 +1580,6 @@ void conf(struct ctx *c, int argc, char **argv) enum fwd_mode udp_out_mode = FWD_MODE_UNSET; enum fwd_mode tcp_in_mode = FWD_MODE_UNSET; enum fwd_mode udp_in_mode = FWD_MODE_UNSET; - enum fwd_mode fwd_default = FWD_MODE_NONE; bool v4_only = false, v6_only = false; unsigned dns4_idx = 0, dns6_idx = 0; unsigned long max_mtu = IP_MAX_MTU; @@ -1593,10 +1596,8 @@ void conf(struct ctx *c, int argc, char **argv) gid_t gid; - if (c->mode == MODE_PASTA) { + if (c->mode == MODE_PASTA) c->no_dhcp_dns = c->no_dhcp_dns_search = 1; - fwd_default = FWD_MODE_AUTO; - } if (tap_l2_max_len(c) - ETH_HLEN < max_mtu) max_mtu = tap_l2_max_len(c) - ETH_HLEN; @@ -2244,34 +2245,23 @@ void conf(struct ctx *c, int argc, char **argv) if_indextoname(c->ifi6, c->pasta_ifn); } - if (!tcp_in_mode) - tcp_in_mode = fwd_default; - if (!tcp_out_mode) - tcp_out_mode = fwd_default; - if (!udp_in_mode) - udp_in_mode = fwd_default; - if (!udp_out_mode) - udp_out_mode = fwd_default; - - if (tcp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 't', "auto", c->fwd[PIF_HOST], - NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, - FWD_SCAN); - } - if (tcp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'T', "auto", c->fwd[PIF_SPLICE], - NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, - FWD_SCAN); - } - if (udp_in_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'u', "auto", c->fwd[PIF_HOST], - NULL, NULL, 1, NUM_PORTS - 1, NULL, 1, - FWD_SCAN); - } - if (udp_out_mode == FWD_MODE_AUTO) { - conf_ports_range_except(c, 'U', "auto", c->fwd[PIF_SPLICE], - NULL, "lo", 1, NUM_PORTS - 1, NULL, 1, - FWD_SCAN); + if (c->mode == MODE_PASTA) { + if (!tcp_in_mode) { + conf_ports(c, 't', "auto", + c->fwd[PIF_HOST], &tcp_in_mode); + } + if (!tcp_out_mode) { + conf_ports(c, 'T', "auto", + c->fwd[PIF_SPLICE], &tcp_out_mode); + } + if (!udp_in_mode) { + conf_ports(c, 'u', "auto", + c->fwd[PIF_HOST], &udp_in_mode); + } + if (!udp_out_mode) { + conf_ports(c, 'U', "auto", + c->fwd[PIF_SPLICE], &udp_out_mode); + } } if (!c->quiet) -- 2.53.0

2 2