- dev - passt

[PATCH] tcp: Don't fast re-transmit if only our FIN is outstanding
by Aris Konstantoulas 29 Sep '26

29 Sep '26

From: Aris Konstantoulas <aris(a)ariscodes.com> In the TAP_FIN_RCVD path of tcp_tap_handler(), a bare segment from the guest acknowledging exactly seq_ack_from_tap, with an unchanged window, is taken as a duplicate ACK and triggers a fast re-transmit. If the only unacknowledged sequence number is our own FIN, that's harmful: tcp_rewind_seq() rewinds seq_to_tap and clears TAP_FIN_SENT, so tcp_data_from_sock() immediately sends the FIN again. If the guest answers that FIN with the same bare ACK, as a socket in TIME-WAIT will, we loop at packet rate: - conn->retries is never incremented on this path, so we never reach TCP_MAX_RETRIES and tcp_rst() - ACK_FROM_TAP_DUE is re-armed on every iteration, so the backed-off re-transmission in tcp_timer_handler() never fires - TAP_FIN_ACKED can't be set, as it requires TAP_FIN_SENT, which the rewind just cleared On an idle Podman host (rootless, pasta), this showed up as a single flow exchanging ~45,000 54-byte segments per second between pasta and a container whose socket was in TIME-WAIT, with pasta using ~75% of one core, until the socket was killed by hand. It recurred on the idle teardown of an HTTP/2 connection to an ACME server. With a raw-socket peer driving the same sequence against pasta at f8df3f1, pasta re-sent the FIN 727,509 times in 10 seconds. With this change it's re-transmitted by the timer at 1, 3, 7, 15, 31, 63 and 127 seconds, and the connection is reset once TCP_MAX_RETRIES is reached. Don't consider a duplicate ACK as a fast re-transmit trigger if the only outstanding sequence number is the FIN, and leave it to the timer. Fast re-transmit of data is unaffected, with or without a FIN queued after it. Fixes: bde1847960cf ("tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent") Link: https://bugs.passt.top/show_bug.cgi?id=125 Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Aris Konstantoulas <aris(a)ariscodes.com> --- Notes: Notes for reviewers, not for the commit message: - Reproducer: a raw AF_PACKET TCP peer in pasta's namespace completes a handshake, closes first, then answers each FIN from pasta with a bare ACK for seq_ack_from_tap, with an unchanged window. I can post it (Python, ~200 lines) if useful. - Open question: I haven't established how a real flow first reaches the state where the peer ACKs exactly up to, but not past, our FIN. The live capture showed the TIME-WAIT socket ACKing the sequence number of pasta's FIN itself. That would fit a FIN re-sent after the first one was already acknowledged, one sequence number further on, that is, tcp_rewind_seq() clearing TAP_FIN_SENT with nothing outstanding. Candidates are the zero-window rewind and the fast-retransmit check in tcp_data_from_tap(), neither of which checks that anything is outstanding. This patch breaks the loop in either case, but not that possible entry path. I'm happy to look into it further, possibly as part of bug 125. tcp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index 3b78d2e..e279f8a 100644 --- a/tcp.c +++ b/tcp.c @@ -2417,15 +2417,22 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, /* Established connections not accepting data from tap */ if (conn->events & TAP_FIN_RCVD) { + bool fin_only, retr; size_t dlen; - bool retr; if ((dlen = tcp_packet_data_len(th, l4len))) { flow_dbg(conn, "data segment in CLOSE-WAIT (%zu B)", dlen); } - retr = th->ack && !th->fin && + /* If only our FIN is outstanding, rewinding on a duplicate ACK + * would re-send it on every ACK, bypassing the backoff and + * retry limit of tcp_timer_handler(): let the timer do it. + */ + fin_only = (conn->events & TAP_FIN_SENT) && + conn->seq_to_tap == conn->seq_ack_from_tap + 1; + + retr = th->ack && !th->fin && !fin_only && ntohl(th->ack_seq) == conn->seq_ack_from_tap && ntohs(th->window) == conn->wnd_from_tap; -- 2.43.0

2 1

[PATCH v2 0/7] Add AFL++ fuzzing support for passt
by Anshu Kumari 28 Sep '26

28 Sep '26

This series adds integrated AFL++ fuzzing support for passt, extending the earlier work by AbdAlRahman Gad with persistent mode, bidirectional protocol fuzzing, and real TCP connection coverage via a companion test server. Each testcase is a flat buffer split into four regions: epoll events, raw L2 tap frames, test-server payloads, and getsockopt(TCP_INFO) overrides. AFL++ controls all four through mutation of a 10-byte header. Fuzz-injected epoll events are interleaved with real kernel events so protocol handshakes can complete. A standalone test server (fuzz-server) attaches to AFL++'s shared memory and sends fuzzer-controlled payload on every accepted TCP connection. AnyIP routing in a rootless user+network namespace makes every destination local, so the test server intercepts all outbound traffic from passt without mocking recv(). Deterministic wrappers replace clock_gettime(), getsockopt() and assert() to eliminate non-determinism from kernel state. Sandboxing (seccomp, namespaces, close_range, capabilities) is bypassed under FUZZING builds since AFL++ needs its own fds and syscalls. *** BLURB HERE *** Anshu Kumari (7): fuzz: Add AFL++ shared memory testcase buffer layout fuzz: Add deterministic wrappers for assert, clock and getsockopt fuzz: Guard protocol handlers against invalid fuzz-injected state fuzz: Bypass sandboxing for fuzzing builds fuzz: Add AFL++ persistent mode fuzz loop fuzz: Add host-side test server for bidirectional fuzzing fuzz: Add build targets, namespace setup and documentation Makefile | 35 +++- flow.c | 52 +++++ fuzz-server.c | 343 +++++++++++++++++++++++++++++++++ fuzz-testbuf.h | 135 +++++++++++++ fuzz.c | 102 ++++++++++ fuzz.h | 38 ++++ fuzzing/README.fuzzing.md | 129 +++++++++++++ fuzzing/fuzz-setup.sh | 24 +++ fuzzing/testcase_dir/empty.bin | Bin 0 -> 12 bytes icmp.c | 8 +- isolation.c | 23 +++ passt.c | 198 +++++++++++++++++++ tap.c | 13 ++ tcp.c | 18 +- tcp_buf.c | 1 + tcp_splice.c | 4 +- udp.c | 29 ++- udp_flow.c | 3 +- util.c | 1 + 19 files changed, 1131 insertions(+), 25 deletions(-) create mode 100644 fuzz-server.c create mode 100644 fuzz-testbuf.h create mode 100644 fuzz.c create mode 100644 fuzz.h create mode 100644 fuzzing/README.fuzzing.md create mode 100755 fuzzing/fuzz-setup.sh create mode 100644 fuzzing/testcase_dir/empty.bin -- 2.55.0

1 7

[PATCH v4] netlink: Fix nl_route_dup by 3-step processing
by Martin Schitter 26 Sep '26

26 Sep '26

Fixes: #221 Eliminate the route entries capacity limitations of nl_route_dup by copping them to the destination namespace in three successive steps to bypass dependency issues. This approach is taken from the handling used in the restore subcommand of iproute2. Signed-off-by: Martin Schitter <ms+git(a)mur.at> --- netlink.c | 207 ++++++++++++++++++++++++++---------------------------- 1 file changed, 99 insertions(+), 108 deletions(-) diff --git a/netlink.c b/netlink.c index 225b666..803cb20 100644 --- a/netlink.c +++ b/netlink.c @@ -525,6 +525,20 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw) return nl_do(s, &req, RTM_NEWROUTE, NLM_F_CREATE | NLM_F_EXCL, len); } +/** + * nl_rtattr_cmp() -- compare two routing attributes + * @rta1: Routing attribute + * @rta2: Routing attribute + * + * Return: 0 if equal + */ +static int nl_rtattr_cmp(const struct rtattr *rta1, const struct rtattr *rta2) +{ + if (!rta1 || !rta2 || rta1->rta_len != rta2->rta_len) + return 1; + return memcmp(RTA_DATA(rta1), RTA_DATA(rta2), RTA_PAYLOAD(rta1)); +} + /** * nl_route_dup() - Copy routes for given interface and address family * @s_src: Netlink socket in source namespace @@ -535,56 +549,73 @@ int nl_route_set_def(int s, unsigned int ifi, sa_family_t af, const void *gw) * * Return: 0 on success, negative error code on failure */ -int nl_route_dup(int s_src, unsigned int ifi_src, - int s_dst, unsigned int ifi_dst, sa_family_t af) +int nl_route_dup(int s_src, unsigned int ifi_src, int s_dst, + unsigned int ifi_dst, sa_family_t af) { - struct req_t { - struct nlmsghdr nlh; - struct rtmsg rtm; - struct rtattr rta; - unsigned int ifi; - } req = { - .rtm.rtm_family = af, - .rtm.rtm_table = RT_TABLE_MAIN, - .rtm.rtm_scope = RT_SCOPE_UNIVERSE, - .rtm.rtm_type = RTN_UNICAST, + /* Duplicate routes in correct order using 3 succesive stages: + * 0. ones for local addresses, + * 1. ones for local networks, + * 2. others (remote networks/hosts). + */ + for (int prio = 0; prio < 3; prio++) { + struct req_t { + struct nlmsghdr nlh; + struct rtmsg rtm; + struct rtattr rta; + unsigned int ifi; + } req = { + .rtm.rtm_family = af, + .rtm.rtm_table = RT_TABLE_MAIN, + .rtm.rtm_scope = RT_SCOPE_UNIVERSE, + .rtm.rtm_type = RTN_UNICAST, + + .rta.rta_type = RTA_OIF, + .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), + .ifi = ifi_src, + }; + ssize_t status; + struct nlmsghdr *nh; + char buf[NLBUFSIZ]; + uint32_t seq; + + seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, + sizeof(req)); + + nl_foreach(nh, status, s_src, buf, seq) { + struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); + struct rtattr *rta; + size_t na; + uint16_t flags = nh->nlmsg_flags; + int rc; - .rta.rta_type = RTA_OIF, - .rta.rta_len = RTA_LENGTH(sizeof(unsigned int)), - .ifi = ifi_src, - }; - ssize_t nlmsgs_size, left, status; - unsigned dup_routes = 0; - struct nlmsghdr *nh; - char buf[NLBUFSIZ]; - uint32_t seq; - unsigned i; - seq = nl_send(s_src, &req, RTM_GETROUTE, NLM_F_DUMP, sizeof(req)); + if (nh->nlmsg_type != RTM_NEWROUTE) + continue; - /* nl_foreach() will step through multiple response datagrams, - * which we don't want here because we need to have all the - * routes in the buffer at once. - */ - nh = nl_next(s_src, buf, NULL, &nlmsgs_size); - for (left = nlmsgs_size; - NLMSG_OK(nh, left) && (status = nl_status(nh, left, seq)) > 0; - nh = NLMSG_NEXT(nh, left)) { - struct rtmsg *rtm = (struct rtmsg *)NLMSG_DATA(nh); - bool discard = false; - struct rtattr *rta; - size_t na; + struct rtattr *tb[RTA_MAX+1] = { 0 }; - if (nh->nlmsg_type != RTM_NEWROUTE) - continue; + for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); + RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { + tb[rta->rta_type] = rta; + } - /* nexthop state flags don't apply to freshly created routes, - * and the kernel will refuse our route if they are set. - */ - rtm->rtm_flags &= ~RTNH_COMPARE_MASK; + /* Process only matching routes of current priority + * (variant of an approach used in iproute2s restore_handler) + */ + if (!(prio == 2 && tb[RTA_GATEWAY]) && + !(prio == 1 && !tb[RTA_GATEWAY] && + tb[RTA_PREFSRC] && + nl_rtattr_cmp(tb[RTA_PREFSRC], tb[RTA_DST])) && + !(prio == 0 && !tb[RTA_GATEWAY] && + (!tb[RTA_PREFSRC] || + !nl_rtattr_cmp(tb[RTA_PREFSRC], tb[RTA_DST])))) + continue; + + /* nexthop state flags don't apply to freshly created routes, + * and the kernel will refuse our route if they are set. + */ + rtm->rtm_flags &= ~RTNH_COMPARE_MASK; - for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); - rta = RTA_NEXT(rta, na)) { /* RTA_OIF and RTA_MULTIPATH attributes carry the * identifier of a host interface. If they match the * host interface we're copying from, change them to @@ -595,103 +626,63 @@ int nl_route_dup(int s_src, unsigned int ifi_src, * available), or if any interface index in nexthop * objects differ from the host interface, discard the * route altogether. - */ - if (rta->rta_type == RTA_OIF) { - if (*(unsigned int *)RTA_DATA(rta) != ifi_src) { - discard = true; - break; + */ + if (tb[RTA_OIF]) { + if (*(unsigned int *)RTA_DATA(tb[RTA_OIF]) != + ifi_src) { + continue; } - - *(unsigned int *)RTA_DATA(rta) = ifi_dst; - } else if (rta->rta_type == RTA_MULTIPATH) { - int nh_len = RTA_PAYLOAD(rta); + *(unsigned int *)RTA_DATA(tb[RTA_OIF]) = + ifi_dst; + } else if (tb[RTA_MULTIPATH]) { + int nh_len = RTA_PAYLOAD(tb[RTA_MULTIPATH]); struct rtnexthop *rtnh; - - for (rtnh = (struct rtnexthop *)RTA_DATA(rta); + bool discard = false; + for (rtnh = (struct rtnexthop *) + RTA_DATA(tb[RTA_MULTIPATH]); RTNH_OK(rtnh, nh_len); - rtnh = RTNH_NEXT_AND_DEC(rtnh, nh_len)) { + rtnh = RTNH_NEXT_AND_DEC(rtnh, + nh_len)) { int src = (int)ifi_src; - if (rtnh->rtnh_ifindex != src) { discard = true; break; } - rtnh->rtnh_ifindex = ifi_dst; } - if (discard) - break; - } else if (rta->rta_type == RTA_PREFSRC || - rta->rta_type == RTA_NH_ID) { + continue; + } else if (tb[RTA_PREFSRC]) { /* Strip RTA_PREFSRC attributes: host routes * might include a preferred source address, * which must be one of the host's addresses. * However, with -a, pasta will use a different * namespace address, making such a route * invalid in the namespace. - * - * Strip RTA_NH_ID attributes: host routes set + */ + tb[RTA_PREFSRC]->rta_type = RTA_UNSPEC; + } else if (tb[RTA_NH_ID]) { + /* Strip RTA_NH_ID attributes: host routes set * up via routing protocols (e.g. OSPF) might * contain a nexthop ID (and not nexthop * objects, which are taken care of in the * RTA_MULTIPATH case above) that's not valid * in the target namespace. */ - rta->rta_type = RTA_UNSPEC; + tb[RTA_NH_ID]->rta_type = RTA_UNSPEC; } - } - - if (discard) - nh->nlmsg_type = NLMSG_NOOP; - else - dup_routes++; - } - - if (!NLMSG_OK(nh, left)) { - /* Process any remaining datagrams in a different - * buffer so we don't overwrite the first one. - */ - char tail[NLBUFSIZ]; - unsigned extra = 0; - - nl_foreach_oftype(nh, status, s_src, tail, seq, RTM_NEWROUTE) - extra++; - - if (extra) { - err("netlink: Too many routes to duplicate"); - return -E2BIG; - } - } - if (status < 0) - return status; - - /* Routes might have dependencies between each other, and the kernel - * processes RTM_NEWROUTE messages sequentially. For n routes, we might - * need to send the requests up to n times to get all of them inserted. - * Routes that have been already inserted will return -EEXIST, but we - * can safely ignore that and repeat the requests. This avoids the need - * to calculate dependencies: let the kernel do that. - */ - for (i = 0; i < dup_routes; i++) { - for (nh = (struct nlmsghdr *)buf, left = nlmsgs_size; - NLMSG_OK(nh, left); - nh = NLMSG_NEXT(nh, left)) { - uint16_t flags = nh->nlmsg_flags; - int rc; - - if (nh->nlmsg_type != RTM_NEWROUTE) - continue; rc = nl_do(s_dst, nh, RTM_NEWROUTE, - (flags & ~NLM_F_DUMP_FILTERED) | NLM_F_CREATE, + (flags & ~NLM_F_DUMP_FILTERED) | + NLM_F_CREATE, nh->nlmsg_len); if (rc < 0 && rc != -EEXIST && rc != -ENETUNREACH && rc != -EHOSTUNREACH) return rc; } + if (status < 0) + return status; } - return 0; } -- 2.53.0

1 0

[PATCH v4] netlink: Fix nl_route_dup by 3-step processing
by Martin Schitter 26 Sep '26

26 Sep '26

This is a rewrite of my patches to fix issue #221.

1 0

passt: new version 2026_09_25.df90211 available
by Stefano Brivio 26 Sep '26

26 Sep '26

The new version with tag 2026_09_25.df90211 includes the following changes: df90211 udp: Add missing @now parameter doc to udp_flow_from_tap() f2683d1 apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only 588b545 pasta: Add --no-pidns to keep spawned command in caller's PID namespace 3a890a6 contrib/apparmor: add missing setfcap capability de8b085 vhost_user: Reset vq enable flag in vu_cleanup() d2fb3ba Add Zed editor settings cef6bce util, pasta: Remove some unneeded #includes cf3a11f util: Add missing O_CLOEXEC for !HAS_GETRANDOM path abdc94a util: Eliminate a stray trailing whitespace aa2c8f0 clangd: Add _GNU_SOURCE to default clangd options 67dfdbd udp_flow: Remove obsolete comment 553ed8b parse: Convert parse_mac() to conventions of parse.c 7bf1595 isolation: Don't create our userns as nobody a8aedb8 isolation: Create helper function to enter user namespace 9587a35 util, pasta: Generalise [ug]id_map creation 5b4bdc8 pasta: Include pasta.h in pasta.c 7e8d49b netlink: Don't warn about multiple interfaces when there's only one defc25b isolation: Include linux_dep.h for close_range() https://passt.top/passt/log/?qt=range&q=2026_07_28.f8df3f1..2026_09_25.df90… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/11037397/ permanent mirror: https://passt.top/builds/copr/0^20260925.gdf90211/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdf90211-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0df90211-1_all.deb -- Stefano

1 0

[PATCH] udp: Add missing @now parameter doc to udp_flow_from_tap()
by Laurent Vivier 26 Sep '26

26 Sep '26

udp_flow_from_tap() takes a @now parameter but its doc comment omits it. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- udp_flow.c | 1 + 1 file changed, 1 insertion(+) diff --git a/udp_flow.c b/udp_flow.c index a29f356252fe..865702ce6756 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -267,6 +267,7 @@ flow_sidx_t udp_flow_from_sock(const struct ctx *c, uint8_t pif, * @daddr: Destination address guest side * @srcport: Source port on guest side * @dstport: Destination port on guest side + * @now: Current timestamp * * Return: sidx for the destination side of the flow for this packet, or * FLOW_SIDX_NONE if we couldn't find or create a flow. -- 2.55.0

2 1

[PATCH] apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only
by Stefano Brivio 25 Sep '26

25 Sep '26

Podman overrides TMPDIR to /var/tmp, and an upcoming change in the requires pasta to write its PID file to TMPDIR. To support this in the AppArmor policy, we need to loosen the existing rule restricting file writes to /tmp/ and subpaths in order to include common alternative paths for TMPDIR: the user-tmp abstraction does exactly this. Reported-by: Giuseppe Scrivano <gscrivan(a)redhat.com> Link: https://github.com/podman-container-tools/container-libs/pull/1207 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/apparmor/usr.bin.passt | 3 +-- contrib/apparmor/usr.bin.pasta | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include <tunables/global> profile passt /usr/bin/passt{,.avx2} { include <abstractions/passt> - # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include <tunables/global> profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> - # Alternatively: include <abstractions/user-tmp> - /tmp/** rw, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), -- 2.43.0

1 0

[PATCH v10] pasta: Refactor pasta_ns_conf() to reduce nesting
by Jon Maloy 21 Sep '26

21 Sep '26

Extract address and route configuration into two new helper functions pasta_conf_addrs() and pasta_conf_routes(), and replace the outer if (c->pasta_conf_ns) block with an early return. This reduces indentation and eliminates the goto labels. No functional change. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> --- v7: -Removed redundant argument 'af' in nl_addr_set() -Removed redundant label and 'goto's in pasta_ns_conf() -Since I excluded addition of all LINKLOCAL addresses from host address array in a previous commit I can now omit this test in pasta_conf_addrs() as suggested by David. -Here is the example of agnostic usage of inany_prefix_len() I referred to in a previous commit. v8: -Do prefix_len conversion inside nl_addr_set() instead of in the calling function. -In nl_addr_set(), branch on inany_prefix_v4() return value instead of inany_af() to avoid redundant AF check and potential static checker false positives. (David) -Swap branch order in pasta_conf_routes() for consistency with pasta_conf_addrs(). (David) -Defer investigation of pre-existing IFF_NOARP / DAD interaction oddity noted by David. v9: - Broke out as standalone from multi-addr series. - Adapted to code conditions before the introduction of the unified address type. v10: - Applied all suggestions from David, more for symmetry reasons than for logical correctess. --- pasta.c | 220 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 115 insertions(+), 105 deletions(-) diff --git a/pasta.c b/pasta.c index 7ba5d75e..a9ee8348 100644 --- a/pasta.c +++ b/pasta.c @@ -290,13 +290,70 @@ void pasta_start_ns(struct ctx *c, int argc, char *argv[]) die_perror("Failed to join network namespace"); } +/** + * pasta_conf_addrs() - Configure addresses for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set configured address; if false, copy from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_addrs(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + if (!ifi) + return 0; + + if (!no_copy) + return nl_addr_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + if (af == AF_INET && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET, + &c->ip4.addr, c->ip4.prefix_len); + } else if (af == AF_INET6 && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { + return nl_addr_set(nl_sock_ns, c->pasta_ifi, AF_INET6, + &c->ip6.addr, 64); + } + return 0; +} + +/** + * pasta_conf_routes() - Configure routes for one address family in namespace + * @c: Execution context + * @af: Address family (AF_INET or AF_INET6) + * @ifi: Host interface index for this address family + * @no_copy: If true, set default route; if false, copy routes from host + * + * Return: 0 on success, negative error code on failure + */ +static int pasta_conf_routes(struct ctx *c, sa_family_t af, int ifi, + bool no_copy) +{ + const void *gw; + + if (af == AF_INET) + gw = &c->ip4.guest_gw; + else + gw = &c->ip6.guest_gw; + + if (!ifi) + return 0; + + if (!no_copy) + return nl_route_dup(nl_sock, ifi, nl_sock_ns, c->pasta_ifi, af); + + return nl_route_set_def(nl_sock_ns, c->pasta_ifi, af, gw); +} + /** * pasta_ns_conf() - Set up loopback and tap interfaces in namespace as needed * @c: Execution context */ void pasta_ns_conf(struct ctx *c) { - int rc = 0; + unsigned int flags = IFF_UP; + int rc; rc = nl_link_set_flags(nl_sock_ns, 1 /* lo */, IFF_UP, IFF_UP); if (rc < 0) @@ -315,116 +372,69 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't set MAC address in namespace: %s", strerror_(-rc)); - if (c->pasta_conf_ns) { - unsigned int flags = IFF_UP; - - if (c->mtu) - nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); - - if (c->ifi6) /* Avoid duplicate address detection on link up */ - flags |= IFF_NOARP; - - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); - - if (c->ifi4) { - if (c->ip4.no_copy_addrs) { - rc = nl_addr_set(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.addr, - c->ip4.prefix_len); - } else { - rc = nl_addr_dup(nl_sock, c->ifi4, - nl_sock_ns, c->pasta_ifi, - AF_INET); - } - - if (c->ifi4 == -1 && rc == -ENOTSUP) { - warn("IPv4 not supported, disabling"); - c->ifi4 = 0; - goto ipv4_done; - } - - if (rc < 0) { - die("Couldn't set IPv4 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip4.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET, - &c->ip4.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi4, nl_sock_ns, - c->pasta_ifi, AF_INET); - } - - if (rc < 0) { - die("Couldn't set IPv4 route(s) in guest: %s", - strerror_(-rc)); - } - } -ipv4_done: + proto_update_l2_buf(c->guest_mac); - if (c->ifi6) { - rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, - &c->ip6.addr_ll_seen); - if (rc < 0) { - warn("Can't get LL address from namespace: %s", - strerror_(-rc)); - } + if (!c->pasta_conf_ns) + return; - rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); - if (rc < 0) { - warn("Can't set nodad for LL in namespace: %s", - strerror_(-rc)); - } - - /* We dodged DAD: re-enable neighbour solicitations */ - nl_link_set_flags(nl_sock_ns, c->pasta_ifi, - 0, IFF_NOARP); - - if (c->ip6.no_copy_addrs) { - if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { - rc = nl_addr_set(nl_sock_ns, - c->pasta_ifi, AF_INET6, - &c->ip6.addr, 64); - } - } else { - rc = nl_addr_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (rc < 0) { - die("Couldn't set IPv6 address(es) in namespace: %s", - strerror_(-rc)); - } - - if (c->ip6.no_copy_routes) { - rc = nl_route_set_def(nl_sock_ns, c->pasta_ifi, - AF_INET6, - &c->ip6.guest_gw); - } else { - rc = nl_route_dup(nl_sock, c->ifi6, - nl_sock_ns, c->pasta_ifi, - AF_INET6); - } - - if (c->ifi6 == -1 && rc == -ENOTSUP) { - warn("IPv6 not supported, disabling"); - c->ifi6 = 0; - goto ipv6_done; - } - - if (rc < 0) { - die("Couldn't set IPv6 route(s) in guest: %s", + if (c->mtu) + nl_link_set_mtu(nl_sock_ns, c->pasta_ifi, c->mtu); + + if (c->ifi6) /* Avoid duplicate address detection on link up */ + flags |= IFF_NOARP; + + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, flags, flags); + + if (c->ifi4) { + rc = pasta_conf_addrs(c, AF_INET, c->ifi4, + c->ip4.no_copy_addrs); + if (c->ifi4 == -1 && rc == -ENOTSUP) { + warn("IPv4 not supported, disabling"); + c->ifi4 = 0; + } else if (rc < 0) { + die("Couldn't set IPv4 address(es) in namespace: %s", + strerror_(-rc)); + } else { + rc = pasta_conf_routes(c, AF_INET, c->ifi4, + c->ip4.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv4 route(s) in guest: %s", strerror_(-rc)); - } } } -ipv6_done: - proto_update_l2_buf(c->guest_mac); + if (c->ifi6) { + rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi, + &c->ip6.addr_ll_seen); + if (rc < 0) + warn("Can't get LL address from namespace: %s", + strerror_(-rc)); + + rc = nl_addr_set_ll_nodad(nl_sock_ns, c->pasta_ifi); + if (rc < 0) + warn("Can't set nodad for LL in namespace: %s", + strerror_(-rc)); + + /* We dodged DAD: re-enable neighbour solicitations */ + nl_link_set_flags(nl_sock_ns, c->pasta_ifi, 0, IFF_NOARP); + + rc = pasta_conf_addrs(c, AF_INET6, c->ifi6, + c->ip6.no_copy_addrs); + if (c->ifi6 == -1 && rc == -ENOTSUP) { + warn("IPv6 not supported, disabling"); + c->ifi6 = 0; + return; + } else if (rc < 0) { + die("Couldn't set IPv6 address(es) in namespace: %s", + strerror_(-rc)); + } + + rc = pasta_conf_routes(c, AF_INET6, c->ifi6, + c->ip6.no_copy_routes); + if (rc < 0) + die("Couldn't set IPv6 route(s) in guest: %s", + strerror_(-rc)); + } } /** -- 2.52.0

2 1

Re: [PATCH v2 3/3] Optimize route dependency solver.
by Stefano Brivio 21 Sep '26

21 Sep '26

On Sat, 19 Sep 2026 14:56:56 +0200 Martin Schitter <ms+git(a)mur.at> wrote: > On 9/17/26 21:08, Stefano Brivio wrote: > >> Never make more resolution attempts than there are still unresolved > >> dependency errors. > >> > >> In the context of my current mesh network with ~700 route entries > >> these changes reduce the required processing time from 5.5s to 15ms. > > > > Ouch. Nice. > > After searching for answers, how these ENETUNREACH and EHOSTUNREACH in > the dependency solver routines are actually caused, I finally looked > into the iproute2 code for the save and restore commands: > > https://github.com/iproute2/iproute2/blob/e6471d772f3e15a813e6c9a81b4b7adcf… > > Now I finally see that this task can be handled without all this stupid > trial-and-error play and doesn't require a limit of route entries if we > just reassemble the routing tables in three successive steps resp. loops: > > /* Restore routes in correct order: > * 0. ones for local addresses, > * 1. ones for local networks, > * 2. others (remote networks/hosts). > */ Just a quick comment before you risk losing a lot of time (I'm really not sure though): there *might* be interdependencies between routes in 1. and between routes in 2., especially with 'nexthop' objects. And IPv6 has several scopes. Maybe it all works thought, I haven't checked your iproute reference yet. -- Stefano

2 1

[PATCH v2] Fix for Bug #221 -- Issue concerning bigger routing tables
by Martin Schitter 19 Sep '26

19 Sep '26

v2 includes some additional small changes/fixes. [PATCH v2 1/3] Fix handling of netlink multipart route dumps. [PATCH v2 2/3] Timekeeping: Resolving Route Dependencies [PATCH v2 3/3] Optimize route dependency solver.

2 6