- dev - passt

[PATCH] apparmor: Upgrade ABI version to 4.0, explicitly enable user namespace creation
by Stefano Brivio 13 Jan '26

13 Jan '26

In the 3.0 AppArmor ABI version we currently use, user namespace rules are not supported, and, as long as we load confined profiles, those implicitly allow creation of user namespaces. However, ABI version 4.0 introduces rules for user namespaces, and if we don't specify any, we can't create user namespaces, see: https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction This wouldn't affect us in general, given that we're using the 3.0 ABI, but libvirt's policy uses 4.0 instead, and if our abstractions are used from there, no matter what ABI policy version we declare, rules for user namespace creation now match ABI policy version 4.0. As a result, when libvirtd runs as root, and its profile includes passt's abstraction, cf. commit 66769c2de825 ("apparmor: Workaround for unconfined libvirtd when triggered by unprivileged user"), passt can't detach user namespaces and will fail to start, as reported by Niklas: ERROR internal error: Child process (passt --one-off --socket /run/libvirt/qemu/passt/1-haos-net0.socket --pid /run/libvirt/qemu/passt/1-haos-net0-passt.pid --tcp-ports 8123) unexpected exit status 1: Multiple interfaces with IPv6 routes, picked first UNIX domain socket bound at /run/libvirt/qemu/passt/1-haos-net0.socket Couldn't create user namespace: Permission denied This isn't a problem with libvirtd running as regular user, because in that case, as a workaround, passt currently runs under its own profile, not as a libvirtd subprofile (see commit referenced above). Given that ABI 4.0 has been around for a while, being introduced in July 2023, finally take the step to upgrade to it and explicitly enable user namespace creation. No further changes are needed in the existing policies to match new features introduced in AppArmor 4.0. Reported-by: Niklas Edmundsson <nikke(a)accum.se> Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1124801 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/apparmor/abstractions/passt | 3 ++- contrib/apparmor/abstractions/pasta | 2 +- contrib/apparmor/usr.bin.passt | 2 +- contrib/apparmor/usr.bin.passt-repair | 2 +- contrib/apparmor/usr.bin.pasta | 2 +- 5 files changed, 6 insertions(+), 5 deletions(-) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 25b2ea8..0ffadaf 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -11,7 +11,7 @@ # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> - abi <abi/3.0>, + abi <abi/4.0>, include <abstractions/base> @@ -24,6 +24,7 @@ capability setpcap, capability net_admin, capability sys_ptrace, + userns, / r, # isolate_prefork(), isolation.c mount options=(rw, runbindable) -> /, diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 9f73bee..251d4a2 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -11,7 +11,7 @@ # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> - abi <abi/3.0>, + abi <abi/4.0>, include <abstractions/passt> diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index 62a4514..c123a86 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -11,7 +11,7 @@ # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -abi <abi/3.0>, +abi <abi/4.0>, include <tunables/global> diff --git a/contrib/apparmor/usr.bin.passt-repair b/contrib/apparmor/usr.bin.passt-repair index 901189d..23ff1ce 100644 --- a/contrib/apparmor/usr.bin.passt-repair +++ b/contrib/apparmor/usr.bin.passt-repair @@ -11,7 +11,7 @@ # Copyright (c) 2025 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -abi <abi/3.0>, +abi <abi/4.0>, #include <tunables/global> diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 2483968..56b5024 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -11,7 +11,7 @@ # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -abi <abi/3.0>, +abi <abi/4.0>, include <tunables/global> -- 2.43.0

2 3

[PATCH] conf, pasta: Add --no-tap option
by Yumei Huang 13 Jan '26

13 Jan '26

This patch introduces a mode where we only forward loopback connections and traffic between two namespaces (via the loopback interface, 'lo'), without a tap device. With this, podman can support forwarding ::1 in custom networks when using rootlesskit for forwarding ports. In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is automatically enabled. Options requiring a tap device (--ns-ifname, --ns-mac-addr, --config-net, --outbound-if4/6) are rejected. Link: https://bugs.passt.top/show_bug.cgi?id=149 Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- conf.c | 56 +++++++++++++++++++++++++++++++++++++++++--------------- fwd.c | 3 +++ passt.1 | 5 +++++ passt.h | 2 ++ pasta.c | 3 +++ tap.c | 11 +++++++---- 6 files changed, 61 insertions(+), 19 deletions(-) diff --git a/conf.c b/conf.c index 84ae12b..353d0a5 100644 --- a/conf.c +++ b/conf.c @@ -1049,7 +1049,8 @@ pasta_opts: " --no-copy-addrs DEPRECATED:\n" " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" - " --no-splice Disable inbound socket splicing\n"); + " --no-splice Disable inbound socket splicing\n" + " --no-tap Don't create tap device\n"); passt_exit(status); } @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, {"no-splice", no_argument, &c->no_splice, 1 }, + {"no-tap", no_argument, &c->no_tap, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **argv) } } while (name != -1); - if (c->mode != MODE_PASTA) + if (c->mode != MODE_PASTA) { c->no_splice = 1; + if (c->no_tap) + die("--no-tap is for pasta mode only"); + } if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **argv) die("--no-copy-addrs needs --config-net"); } + if (c->mode == MODE_PASTA && c->no_tap) { + if (c->no_splice) + die("--no-tap is incompatible with --no-splice"); + if (*c->ip4.ifname_out || *c->ip6.ifname_out) + die("--no-tap is incompatible with --outbound-if4/6"); + if (*c->pasta_ifn) + die("--no-tap is incompatible with --ns-ifname"); + if (*c->guest_mac) + die("--no-tap is incompatible with --ns-mac-addr"); + if (c->pasta_conf_ns) + die("--no-tap is incompatible with --config-net"); + + c->host_lo_to_ns_lo = 1; + c->no_icmp = 1; + c->no_ra = 1; + c->no_dns = 1; + c->no_dns_search = 1; + } + if (!ifi4 && *c->ip4.ifname_out) ifi4 = if_nametoindex(c->ip4.ifname_out); @@ -1980,9 +2004,9 @@ void conf(struct ctx *c, int argc, char **argv) log_conf_parsed = true; /* Stop printing everything */ nl_sock_init(c, false); - if (!v6_only) + if (!v6_only && !c->no_tap) c->ifi4 = conf_ip4(ifi4, &c->ip4); - if (!v4_only) + if (!v4_only && !c->no_tap) c->ifi6 = conf_ip6(ifi6, &c->ip6); if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { @@ -1998,30 +2022,32 @@ void conf(struct ctx *c, int argc, char **argv) (*c->ip6.ifname_out && !c->ifi6)) die("External interface not usable"); - if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn && !c->no_tap) { strncpy(c->pasta_ifn, pasta_default_ifn, sizeof(c->pasta_ifn) - 1); } if (!c->ifi4 && !v6_only) { - info("IPv4: no external interface as template, use local mode"); - - conf_ip4_local(&c->ip4); + if (!c->no_tap) { + info("IPv4: no external interface as template, use local mode"); + conf_ip4_local(&c->ip4); + } c->ifi4 = -1; } if (!c->ifi6 && !v4_only) { - info("IPv6: no external interface as template, use local mode"); - - conf_ip6_local(&c->ip6); + if (!c->no_tap) { + info("IPv6: no external interface as template, use local mode"); + conf_ip6_local(&c->ip6); + } c->ifi6 = -1; } - if (c->ifi4 && !no_map_gw && + if (c->ifi4 > 0 && !no_map_gw && IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) c->ip4.map_host_loopback = c->ip4.guest_gw; - if (c->ifi6 && !no_map_gw && + if (c->ifi6 > 0 && !no_map_gw && IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) c->ip6.map_host_loopback = c->ip6.guest_gw; @@ -2116,10 +2142,10 @@ void conf(struct ctx *c, int argc, char **argv) conf_ports(c, name, optarg, &c->udp.fwd_out); } while (name != -1); - if (!c->ifi4) + if (c->ifi4 <= 0) c->no_dhcp = 1; - if (!c->ifi6) { + if (c->ifi6 <= 0) { c->no_ndp = 1; c->no_dhcpv6 = 1; } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { diff --git a/fwd.c b/fwd.c index 44a0e10..2f4a89a 100644 --- a/fwd.c +++ b/fwd.c @@ -780,6 +780,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, return PIF_SPLICE; } + if (c->no_tap) + return PIF_NONE; + if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) diff --git a/passt.1 b/passt.1 index db0d662..2d643f7 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ Default is to let the tap driver build a pseudorandom hardware address. Disable the bypass path for inbound, local traffic. See the section \fBHandling of local traffic in pasta\fR in the \fBNOTES\fR for more details. +.TP +.BR \-\-no-tap +Do not create a tap device in the namespace. In this mode, only local loopback +traffic between namespaces is forwarded using splice. + .SH EXAMPLES .SS \fBpasta diff --git a/passt.h b/passt.h index 79d01dd..0c1ec4c 100644 --- a/passt.h +++ b/passt.h @@ -200,6 +200,7 @@ struct ip6_ctx { * @no_ndp: Disable NDP handler altogether * @no_ra: Disable router advertisements * @no_splice: Disable socket splicing for inbound traffic + * @no_tap: Do not create tap device * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding * @low_wmem: Low probed net.core.wmem_max @@ -277,6 +278,7 @@ struct ctx { int no_ndp; int no_ra; int no_splice; + int no_tap; int host_lo_to_ns_lo; int freebind; diff --git a/pasta.c b/pasta.c index 0ddd6b0..3510ec5 100644 --- a/pasta.c +++ b/pasta.c @@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't bring up loopback interface in namespace: %s", strerror_(-rc)); + if (c->no_tap) + return; + /* Get or set MAC in target namespace */ if (MAC_IS_ZERO(c->guest_mac)) nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_mac); diff --git a/tap.c b/tap.c index 9d1344b..9b4eedc 100644 --- a/tap.c +++ b/tap.c @@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg) */ static void tap_sock_tun_init(struct ctx *c) { - NS_CALL(tap_ns_tun, c); - if (c->fd_tap == -1) - die("Failed to set up tap device in namespace"); + if (!c->no_tap) { + NS_CALL(tap_ns_tun, c); + if (c->fd_tap == -1) + die("Failed to set up tap device in namespace"); + } pasta_ns_conf(c); - tap_start_connection(c); + if (!c->no_tap) + tap_start_connection(c); } /** -- 2.49.0

4 15

[PATCH v3 00/14] Introduce forwarding table
by David Gibson 13 Jan '26

13 Jan '26

This creates a new data structure for recording our port forwarding: a table of individual forwarding rules. This is intended to replace the existing forwarding mode, map and delta structures. For now, only the delta[] array is removed. map is still used, but only for automatic forwards. Mode is still used, but only has significance during configuration. There's still a lot that can be done for flexible forwarding, but this introduces the core data structure, and does enough to fix at least one concrete defect with the current logic (bug 187). I think it would be a good point to give it a solid review and maybe merge. I'm aware that this is a very large complex series, that will be difficult to review. I think that's more or less inevitable implementing a feature as broad and complex as "flexible forwarding". If it helps at all, I'm fine if it's not reviewed all at once - I won't assume review is complete until either you say so, or I get comments or R-b on each patch. This applies on top of all 3 of my outstanding series in this area: "Allow listen functions to return fds", "Clean ups to epoll references" (v2) and "Small cleanups to splice forwarding logic". David Gibson (14): inany: Extend inany_ntop() to treat NULL as a fully unspecified address conf, fwd: Keep a table of our port forwarding configuration conf: Accurately record ifname and address for outbound forwards conf, fwd: Record "auto" port forwards in forwarding table fwd: Make space to store listening sockets in forward table ip: Add ipproto_name() function fwd, tcp, udp: Set up listening sockets based on forward table tcp, udp: Remove old auto-forwarding socket arrays conf, fwd: Check forwarding table for conflicting rules fwd: Generate auto-forward exclusions from socket fd tables flow, fwd: Consult rules table when forwarding a new flow from socket fwd: Remap ports based directly on forwarding rule fwd, tcp, udp: Add forwarding rule to listening socket epoll references flow, fwd: Optimise forwarding rule lookup using epoll ref when possible conf.c | 118 +++++++++------ flow.c | 59 ++++++-- flow_table.h | 2 +- fwd.c | 379 ++++++++++++++++++++++++++++++++++++++++++++++--- fwd.h | 68 ++++++++- icmp.c | 2 +- inany.c | 28 +++- inany.h | 1 + ip.c | 26 ++++ ip.h | 2 + tcp.c | 154 ++------------------ tcp.h | 6 +- udp.c | 147 +++---------------- udp.h | 7 +- udp_flow.c | 14 +- udp_flow.h | 2 +- udp_internal.h | 4 +- 17 files changed, 641 insertions(+), 378 deletions(-) -- 2.52.0

3 25

[PATCH 3/3] igmp: Remove apparently unneeded suppression
by David Gibson 13 Jan '26

13 Jan '26

cppcheck-2.19.1 complains that the unusedFunction suppression in igmp.c doesn't match. That seems like a cppcheck bug, because the function clearly *is* unused. The function exists because otherwise the compiler fails because "ISO C forbids an empty translation unit". mld.c contains an identical unused definition for the same reason, but without the suppression. It doesn't seem to have caused unusedFunction warnings, so maybe cppcheck counts the non-empty translation unit requirement as a "use" of the function? In any case, since omitting the suppression in mld.c seems to be fine, do the same in igmp.c to stop the complaints. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- igmp.c | 1 - 1 file changed, 1 deletion(-) diff --git a/igmp.c b/igmp.c index 0e775843..a3971fc6 100644 --- a/igmp.c +++ b/igmp.c @@ -13,5 +13,4 @@ */ /* TO BE IMPLEMENTED */ -/* cppcheck-suppress unusedFunction */ __attribute__((__unused__)) static void unused(void) { } -- 2.52.0

1 0

[PATCH 2/3] epoll_ctl: Move u64 variant first for safer initialisation
by David Gibson 13 Jan '26

13 Jan '26

cppcheck-2.19.1 pointed out that an initialiser like: union epoll_ref foo = { 0 }; doesn't necessarily zero the whole union, because the first variant listed may not be the full length. I don't think this is actually broken in practice, but I'm not 100% certain about that. In any case, make it more clearly correct, and stop cppcheck complaining by moving the @u64 variant to be the first one. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- epoll_ctl.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/epoll_ctl.h b/epoll_ctl.h index 3f802e76..2c103cde 100644 --- a/epoll_ctl.h +++ b/epoll_ctl.h @@ -17,6 +17,7 @@ /** * union epoll_ref - Breakdown of reference for epoll fd bookkeeping + * @u64: Opaque reference for epoll_ctl() and epoll_wait() * @type: Type of fd (tells us what to do with events) * @fd: File descriptor number (implies < 2^24 total descriptors) * @flow: Index of the flow this fd is linked to @@ -25,9 +26,9 @@ * @data: Data handled by protocol handlers * @nsdir_fd: netns dirfd for fallback timer checking if namespace is gone * @queue: vhost-user queue index for this fd - * @u64: Opaque reference for epoll_ctl() and epoll_wait() */ union epoll_ref { + uint64_t u64; struct { enum epoll_type type:8; int32_t fd:FD_REF_BITS; @@ -40,7 +41,6 @@ union epoll_ref { int queue; }; }; - uint64_t u64; }; static_assert(sizeof(union epoll_ref) <= sizeof(union epoll_data), "epoll_ref must have same size as epoll_data"); -- 2.52.0

1 0

[PATCH 1/3] treewide: Fix more pointers which can be const
by David Gibson 13 Jan '26

13 Jan '26

Here are some more pointers which can be const, as reported by cppcheck 2.19.1. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 +- dhcpv6.c | 3 ++- vhost_user.c | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/conf.c b/conf.c index b1fc4b9f..a242fda1 100644 --- a/conf.c +++ b/conf.c @@ -1224,7 +1224,7 @@ dns6: * * Return: 0 on success, negative error code on failure */ -static int conf_runas(char *opt, unsigned int *uid, unsigned int *gid) +static int conf_runas(const char *opt, unsigned int *uid, unsigned int *gid) { const char *uopt, *gopt = NULL; char *sep = strchr(opt, ':'); diff --git a/dhcpv6.c b/dhcpv6.c index d94be23a..97c04e2c 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -320,7 +320,7 @@ static bool dhcpv6_opt(struct iov_tail *data, uint16_t type) static bool dhcpv6_ia_notonlink(struct iov_tail *data, struct in6_addr *la) { - int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }, *ia_type; + int ia_types[2] = { OPT_IA_NA, OPT_IA_TA }; struct opt_ia_addr opt_addr_storage; const struct opt_ia_addr *opt_addr; struct iov_tail current, ia_base; @@ -330,6 +330,7 @@ static bool dhcpv6_ia_notonlink(struct iov_tail *data, struct in6_addr req_addr; struct opt_hdr h_storage; const struct opt_hdr *h; + const int *ia_type; foreach(ia_type, ia_types) { current = *data; diff --git a/vhost_user.c b/vhost_user.c index 1e320bff..9fe12411 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -442,7 +442,7 @@ static bool vu_set_mem_table_exec(struct vu_dev *vdev, for (i = 0; i < vdev->memory.nregions; i++) { struct vhost_user_memory_region *msg_region = &memory->regions[i]; struct vu_dev_region *dev_region = &vdev->memory.regions[i]; - void *mmap_addr; + const void *mmap_addr; debug("vhost-user region %d", i); debug(" guest_phys_addr: 0x%016"PRIx64, -- 2.52.0

1 0

[PATCH 0/3] cppcheck-2.19.1 fixes
by David Gibson 13 Jan '26

13 Jan '26

Here are some more fixes for cppcheck warnings that I'm seeing with cppcheck-2.19.1. One looks like it might, at least theoretically be a real bug. I'm not certain if all of these are due to a new cppcheck version, or if some are just due to things merged recently that hadn't previously been checked with a recent-ish version. David Gibson (3): treewide: Fix more pointers which can be const epoll_ctl: Move u64 variant first for safer initialisation igmp: Remove apparently unneeded suppression conf.c | 2 +- dhcpv6.c | 3 ++- epoll_ctl.h | 4 ++-- igmp.c | 1 - vhost_user.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) -- 2.52.0

1 0

[PATCH v2 0/2] Allow listen functions to return fds
by David Gibson 13 Jan '26

13 Jan '26

For future forwarding changes, it makes more sense for the tcp and udp listen functions to return socket fds, rather than just success / failure. Make the change, fixing bug 186 along the way. Link: https://bugs.passt.top/show_bug.cgi?id=186 Changes in v2: * Fix several typos in comments and commit messages * Drop the --no-bindtodevice option, I was convinced it wasn't useful enough * Change from -EACCES to -EAFNOSUPPORT error code David Gibson (2): tcp, udp, conf: Don't silently ignore listens on unsupported IP versions tcp, udp: Make {tcp,udp}_listen() return socket fds conf.c | 24 +++++++++++++++++------- tcp.c | 13 ++++--------- udp.c | 10 ++++------ 3 files changed, 25 insertions(+), 22 deletions(-) -- 2.52.0

1 2

[PATCH 2/3] tcp, udp, conf: Don't silently ignore listens on unsupported IP versions
by David Gibson 13 Jan '26

13 Jan '26

Currently, it's possible to explicitly ask for forwarding from an IPv4 address, while disabling IPv4: $ pasta -t 192.0.2.1/12345 -6 or vice versa: $ pasta -t 2001:db8::1/12345 -4 Currently, the impossible to implement forwarding option will be silently ignored. That's potentially confusing since in a complex setup, it might not be obvious why the requested forward isn't taking effect. Specifically, it's ignored at a fairly low level: tcp_listen() and udp_listen() ignore it and return 0. Those run kind of late to give a good error message. Change the low-level functions to return -EACCES (chosen because that's what the kernel will return if you request IPv6 when it's disabled by sysctl). Most callers of {tcp,udp}_listen() ignore the return code, so this is a no-op for them. In the remaining caller, conf_ports_range_except() check for the case explicitly, and provide a meaningful error message. Of itself, this bug is insignificant, but this is a roadblock to having {tcp,udp}_listen() return socket fds, which in turn is a roadblock to my flexible forwarding work. So, might as well fix it. Link: https://bugs.passt.top/show_bug.cgi?id=186 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 10 ++++++++++ tcp.c | 6 ++---- udp.c | 6 ++---- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 70ea168c..cc3c20a9 100644 --- a/conf.c +++ b/conf.c @@ -162,6 +162,16 @@ static void conf_ports_range_except(const struct ctx *c, char optname, optname, optarg); } + if (addr) { + if (!c->ifi4 && inany_v4(addr)) { + die("IPv4 is disabled, can't use -%c %s", + optname, optarg); + } else if (!c->ifi6 && !inany_v4(addr)) { + die("IPv6 is disabled, can't use -%c %s", + optname, optarg); + } + } + for (i = first; i <= last; i++) { if (bitmap_isset(exclude, i)) continue; diff --git a/tcp.c b/tcp.c index e7fa85f3..67007c05 100644 --- a/tcp.c +++ b/tcp.c @@ -2700,16 +2700,14 @@ int tcp_listen(const struct ctx *c, uint8_t pif, /* Restrict to v6 only */ addr = &inany_any6; else if (inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (!c->ifi6) { if (!addr) /* Restrict to v4 only */ addr = &inany_any4; else if (!inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (pif == PIF_HOST) { diff --git a/udp.c b/udp.c index eda55c39..8cfa1e1f 100644 --- a/udp.c +++ b/udp.c @@ -1162,16 +1162,14 @@ int udp_listen(const struct ctx *c, uint8_t pif, /* Restrict to v6 only */ addr = &inany_any6; else if (inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (!c->ifi6) { if (!addr) /* Restrict to v4 only */ addr = &inany_any4; else if (!inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, -- 2.52.0

2 4

[PATCH 1/3] conf: Introduce --no-bindtodevice option for testing
by David Gibson 13 Jan '26

13 Jan '26

We need to support (as best we can) older kernels which don't allow unprivilieged processes to use the SO_BINDTODEVICE socket option. Fallcaks for that case are controlled by the c->no_bindtodevice variable. Currently testing behaviour of those fallbacks requires setting up a test system with a kernel that doesn't support the option, which is pretty awkward. We can test it almost as well and much more easily by adding a command line option to explicitly disable use of SO_BINDTODEVICE. Like --no-splice this is envisaged as something for developers' and testers' convenience, not a supported option for end users. The man page text reflects that. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 ++ passt.1 | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/conf.c b/conf.c index ceb9aa55..70ea168c 100644 --- a/conf.c +++ b/conf.c @@ -962,6 +962,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --no-bindtodevice Disable SO_BINDTODEVICE\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" @@ -1454,6 +1455,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"no-bindtodevice", no_argument, &c->no_bindtodevice, 1}, {"no-splice", no_argument, &c->no_splice, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, diff --git a/passt.1 b/passt.1 index db0d6620..4859d9e5 100644 --- a/passt.1 +++ b/passt.1 @@ -348,6 +348,12 @@ namespace will be silently dropped. Disable Router Advertisements. Router Solicitations coming from guest or target namespace will be ignored. +.TP +.BR \-\-no-bindtodevice +Development/testing option, do not use. Disables use of +SO_BINDTODEVICE socket option. Implicitly enabled on older kernels +which don't permit unprivileged use of SO_BINDTODEVICE. + .TP .BR \-\-freebind Allow any binding address to be specified for \fB-t\fR and \fB-u\fR -- 2.52.0

2 4