- dev - passt

[PATCH 00/14] RFC: tcp: Don't use separate listening sockets for spliced and non-spliced connections
by David Gibson 15 Nov '22

15 Nov '22

We can splice TCP connections in pasta mode if and only if they originate from localhost. Currently we separate the two cases by having separate listening sockets: one listens on the host address for non-spliceable connections, the other listens on the loopback address for spliceable connections. As well as requiring twice as many listening sockets, this has the drawback of meaning that passt and pasta behaviour differ subtley but surprisingly: by default passt inbound port forwards will listen on the unspecified address, but for pasta they will be changed to listen on the host's interface address. In fact we don't need to do this. We can defer the decision about whether to splice a connection until after we've accepted it, by testing the peer address to see if it is local. At least, in principle we can. This series deals with a number of complications on the way to accomplishing that. CAVEAT: The current draft increases the size of tcp_conn above its current 64 bytes, which is likely to push it into a second cache line on some machines. This is fixable, but doing so is fiddly, and I'm still working on it. David Gibson (14): style: Minor corrections to function comments tcp: Remove unused TCP_MAX_SOCKS constant tcp: Better helpers for converting between connection pointer and index tcp_splice: Helpers for converting from index to/from tcp_splice_conn tcp: Move connection state structures into a shared header tcp: Add connection union type tcp: Improved helpers to update connections after moving tcp: Unify spliced and non-spliced connection tables tcp: Unify tcp_defer_handler and tcp_splice_defer_handler() tcp: Partially unify tcp_timer() and tcp_splice_timer() tcp: Unify the IN_EPOLL flag tcp: Separate helpers to create ns listening sockets tcp: Unify part of spliced and non-spliced conn_from_sock path tcp: Use the same sockets to listen for spliced and non-spliced connections Makefile | 3 +- conf.c | 12 +- tap.c | 6 +- tcp.c | 661 +++++++++++++++++++++++---------------------------- tcp.h | 7 +- tcp_conn.h | 208 ++++++++++++++++ tcp_splice.c | 292 +++++++++-------------- tcp_splice.h | 4 +- 8 files changed, 625 insertions(+), 568 deletions(-) create mode 100644 tcp_conn.h -- 2.38.1

2 16

[PATCH] conf, udp: Drop mostly duplicated dns_send arrays, rename related fields
by Stefano Brivio 15 Nov '22

15 Nov '22

Given that we use just the first valid DNS resolver address configured, or read from resolv.conf(5) on the host, to forward DNS queries to, in case --dns-forward is used, we don't need to duplicate dns[] to dns_send[]: - rename dns_send[] back to dns[]: those are the resolvers we advertise to the guest/container - for forwarding purposes, instead of dns[], use a single field (for each protocol version): dns_host - and rename dns_fwd to dns_match, so that it's clear this is the address we are matching DNS queries against, to decide if they need to be forwarded Suggested-by: David Gibson <david(a)gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 76 ++++++++++++++++++++++++-------------------------------- dhcp.c | 5 ++-- dhcpv6.c | 5 ++-- ndp.c | 6 ++--- passt.h | 20 +++++++-------- udp.c | 21 +++++++++------- 6 files changed, 62 insertions(+), 71 deletions(-) diff --git a/conf.c b/conf.c index 1adcf83..a995eb7 100644 --- a/conf.c +++ b/conf.c @@ -355,11 +355,9 @@ overlap: */ static void get_dns(struct ctx *c) { - struct in6_addr *dns6_send = &c->ip6.dns_send[0]; - struct in_addr *dns4_send = &c->ip4.dns_send[0]; + struct in6_addr *dns6 = &c->ip6.dns[0], dns6_tmp; + struct in_addr *dns4 = &c->ip4.dns[0], dns4_tmp; int dns4_set, dns6_set, dnss_set, dns_set, fd; - struct in6_addr *dns6 = &c->ip6.dns[0]; - struct in_addr *dns4 = &c->ip4.dns[0]; struct fqdn *s = c->dns_search; struct lineread resolvconf; int line_len; @@ -388,49 +386,44 @@ static void get_dns(struct ctx *c) *end = 0; if (!dns4_set && - dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 && - inet_pton(AF_INET, p + 1, dns4)) { + dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 + && inet_pton(AF_INET, p + 1, &dns4_tmp)) { /* Guest or container can only access local * addresses via local redirect */ - if (IN4_IS_ADDR_LOOPBACK(dns4)) { + if (IN4_IS_ADDR_LOOPBACK(&dns4_tmp)) { if (!c->no_map_gw) { - *dns4_send = c->ip4.gw; - dns4_send++; + *dns4 = c->ip4.gw; + dns4++; } } else { - *dns4_send = *dns4; - dns4_send++; + *dns4 = dns4_tmp; + dns4++; } - dns4++; - - dns4->s_addr = htonl(INADDR_ANY); - dns4_send->s_addr = htonl(INADDR_ANY); + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_host)) + c->ip4.dns_host = dns4_tmp; } if (!dns6_set && - dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 && - inet_pton(AF_INET6, p + 1, dns6)) { + dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 + && inet_pton(AF_INET6, p + 1, &dns6_tmp)) { /* Guest or container can only access local * addresses via local redirect */ - if (IN6_IS_ADDR_LOOPBACK(dns6)) { + if (IN6_IS_ADDR_LOOPBACK(&dns6_tmp)) { if (!c->no_map_gw) { - memcpy(dns6_send, &c->ip6.gw, - sizeof(*dns6_send)); - dns6_send++; + memcpy(dns6, &c->ip6.gw, + sizeof(*dns6)); + dns6++; } } else { - memcpy(dns6_send, dns6, - sizeof(*dns6_send)); - dns6_send++; + memcpy(dns6, &dns6_tmp, sizeof(*dns6)); + dns6++; } - dns6++; - - memset(dns6, 0, sizeof(*dns6)); - memset(dns6_send, 0, sizeof(*dns6_send)); + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_host)) + c->ip6.dns_host = dns6_tmp; } } else if (!dnss_set && strstr(line, "search ") == line && s == c->dns_search) { @@ -897,12 +890,10 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET, &c->ip4.gw, buf4, sizeof(buf4))); } - for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); - i++) { + for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) { if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns_send[i], buf4, - sizeof(buf4)); + inet_ntop(AF_INET, &c->ip4.dns[i], buf4, sizeof(buf4)); info(" %s", buf4); } @@ -933,8 +924,7 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET6, &c->ip6.addr_ll, buf6, sizeof(buf6))); dns6: - for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); - i++) { + for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) { if (!i) info("DNS:"); inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6)); @@ -1230,17 +1220,17 @@ void conf(struct ctx *c, int argc, char **argv) c->no_dhcp_dns_search = 1; break; case 9: - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - inet_pton(AF_INET6, optarg, &c->ip6.dns_fwd) && - !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - !IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_fwd)) + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + inet_pton(AF_INET6, optarg, &c->ip6.dns_match) && + !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + !IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_match)) break; - if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - inet_pton(AF_INET, optarg, &c->ip4.dns_fwd) && - !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - !IN4_IS_ADDR_BROADCAST(&c->ip4.dns_fwd) && - !IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_fwd)) + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + inet_pton(AF_INET, optarg, &c->ip4.dns_match) && + !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + !IN4_IS_ADDR_BROADCAST(&c->ip4.dns_match) && + !IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_match)) break; err("Invalid DNS forwarding address: %s", optarg); diff --git a/dhcp.c b/dhcp.c index 12da47a..6088886 100644 --- a/dhcp.c +++ b/dhcp.c @@ -359,9 +359,8 @@ int dhcp(const struct ctx *c, const struct pool *p) } for (i = 0, opts[6].slen = 0; - !c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); - i++) { - ((struct in_addr *)opts[6].s)[i] = c->ip4.dns_send[i]; + !c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) { + ((struct in_addr *)opts[6].s)[i] = c->ip4.dns[i]; opts[6].slen += sizeof(uint32_t); } diff --git a/dhcpv6.c b/dhcpv6.c index 67262e6..e763aed 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -379,7 +379,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset) if (c->no_dhcp_dns) goto search; - for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); i++) { + for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) { if (!i) { srv = (struct opt_dns_servers *)(buf + offset); offset += sizeof(struct opt_hdr); @@ -387,8 +387,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset) srv->hdr.l = 0; } - memcpy(&srv->addr[i], &c->ip6.dns_send[i], - sizeof(srv->addr[i])); + memcpy(&srv->addr[i], &c->ip6.dns[i], sizeof(srv->addr[i])); srv->hdr.l += sizeof(srv->addr[i]); offset += sizeof(srv->addr[i]); } diff --git a/ndp.c b/ndp.c index 6d79477..80e1f19 100644 --- a/ndp.c +++ b/ndp.c @@ -121,7 +121,7 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr) if (c->no_dhcp_dns) goto dns_done; - for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[n]); n++); + for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[n]); n++); if (n) { *p++ = 25; /* RDNSS */ *p++ = 1 + 2 * n; /* length */ @@ -130,8 +130,8 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr) p += 4; for (i = 0; i < n; i++) { - memcpy(p, &c->ip6.dns_send[i], 16); - p += 16; /* address */ + memcpy(p, &c->ip6.dns[i], 16); /* address */ + p += 16; } for (n = 0; *c->dns_search[n].n; n++) diff --git a/passt.h b/passt.h index e93eea8..6649c0a 100644 --- a/passt.h +++ b/passt.h @@ -101,9 +101,9 @@ enum passt_modes { * @addr_seen: Latest IPv4 address seen as source from tap * @prefixlen: IPv4 prefix length (netmask) * @gw: Default IPv4 gateway, network order - * @dns: Host IPv4 DNS addresses, zero-terminated, network order - * @dns_send: Offered IPv4 DNS, zero-terminated, network order - * @dns_fwd: Address forwarded (UDP) to first IPv4 DNS, network order + * @dns: DNS addresses for DHCP, zero-terminated, network order + * @dns_match: Forward DNS query if sent to this address, network order + * @dns_host: Use this DNS on the host for forwarding, network order */ struct ip4_ctx { struct in_addr addr; @@ -111,8 +111,8 @@ struct ip4_ctx { int prefix_len; struct in_addr gw; struct in_addr dns[MAXNS + 1]; - struct in_addr dns_send[MAXNS + 1]; - struct in_addr dns_fwd; + struct in_addr dns_match; + struct in_addr dns_host; }; /** @@ -122,9 +122,9 @@ struct ip4_ctx { * @addr_seen: Latest IPv6 global/site address seen as source from tap * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap * @gw: Default IPv6 gateway - * @dns: Host IPv6 DNS addresses, zero-terminated - * @dns_send: Offered IPv6 DNS addresses, zero-terminated - * @dns_fwd: Address forwarded (UDP) to first IPv6 DNS, network order + * @dns: DNS addresses for DHCPv6 and NDP, zero-terminated + * @dns_match: Forward DNS query if sent to this address + * @dns_host: Use this DNS on the host for forwarding */ struct ip6_ctx { struct in6_addr addr; @@ -133,8 +133,8 @@ struct ip6_ctx { struct in6_addr addr_ll_seen; struct in6_addr gw; struct in6_addr dns[MAXNS + 1]; - struct in6_addr dns_send[MAXNS + 1]; - struct in6_addr dns_fwd; + struct in6_addr dns_match; + struct in6_addr dns_host; }; #include <netinet/if_ether.h> diff --git a/udp.c b/udp.c index ff7f993..0aa6308 100644 --- a/udp.c +++ b/udp.c @@ -678,10 +678,10 @@ static void udp_sock_fill_data_v4(const struct ctx *c, int n, src_port = ntohs(b->s_in.sin_port); - if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && - IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns[0]) && + if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) && + IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns_host) && src_port == 53) { - b->iph.saddr = c->ip4.dns_fwd.s_addr; + b->iph.saddr = c->ip4.dns_match.s_addr; } else if (IN4_IS_ADDR_LOOPBACK(&b->s_in.sin_addr) || IN4_IS_ADDR_UNSPECIFIED(&b->s_in.sin_addr)|| IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.addr_seen)) { @@ -770,10 +770,11 @@ static void udp_sock_fill_data_v6(const struct ctx *c, int n, if (IN6_IS_ADDR_LINKLOCAL(src)) { b->ip6h.daddr = c->ip6.addr_ll_seen; b->ip6h.saddr = b->s_in6.sin6_addr; - } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && - IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns[0]) && src_port == 53) { + } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) && + IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns_host) && + src_port == 53) { b->ip6h.daddr = c->ip6.addr_seen; - b->ip6h.saddr = c->ip6.dns_fwd; + b->ip6h.saddr = c->ip6.dns_match; } else if (IN6_IS_ADDR_LOOPBACK(src) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr_seen) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr)) { @@ -1016,13 +1017,15 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, udp_tap_map[V4][src].ts = now->tv_sec; - if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && !c->no_map_gw) { + if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && + !c->no_map_gw) { if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) || (udp_tap_map[V4][dst].flags & PORT_LOOPBACK)) s_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK); else s_in.sin_addr = c->ip4.addr_seen; - } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.dns_fwd) && + } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, + &c->ip4.dns_match) && ntohs(s_in.sin_port) == 53) { s_in.sin_addr = c->ip4.dns[0]; } @@ -1045,7 +1048,7 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, s_in6.sin6_addr = c->ip6.addr; else s_in6.sin6_addr = c->ip6.addr_seen; - } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_fwd) && + } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_match) && ntohs(s_in6.sin6_port) == 53) { s_in6.sin6_addr = c->ip6.dns[0]; } else if (IN6_IS_ADDR_LINKLOCAL(&s_in6.sin6_addr)) { -- 2.35.1

2 1

passt: new version 2022_11_10.4129764 available
by Stefano Brivio 10 Nov '22

10 Nov '22

The new version with tag 2022_11_10.4129764 includes the following changes: 4129764 conf: Fix mask calculation from prefix_len in conf_print() 817eedc tcp, udp: Don't initialise IPv6/IPv4 sockets if IPv4/IPv6 are not enabled 6533a4a passt: Move __setlogmask() calls before output unrelated to configuration 198f878 tap: Return -EIO from tap_handler_passt() on inconsistent packet stream 510dace tap: Keep stream consistent if qemu length descriptor spans two recv() calls https://passt.top/passt/log/?qt=range&q=2022_11_04.e308018..2022_11_10.4129… Packages: - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5030594/ permanent mirror: https://passt.top/builds/copr/0^20221110.g4129764/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4129764-1_all.deb - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Package for other RPM-based distributions, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt-g4129764-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ -- Stefano

1 0

[PATCH 0/2] Try harder to avoid inconsistent qemu packet stream
by Stefano Brivio 10 Nov '22

10 Nov '22

...and handle the situation more reasonably if that happens. Stefano Brivio (2): tap: Keep stream consistent if qemu length descriptor spans two recv() calls tap: Return -EIO from tap_handler_passt() on inconsistent packet stream tap.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) -- 2.35.1

2 5

[PATCH 0/3] Fixes and workarounds for pasta with Podman in Google Cloud
by Stefano Brivio 10 Nov '22

10 Nov '22

These patches work around or fix some issues found while testing the Podman integration for pasta in Google Compute Engine environments. Stefano Brivio (3): conf: Consistency check between configured IPv4 netmask and gateway conf: Split the notions of read DNS addresses and offered ones udp: Check for answers to forwarded DNS queries before handling local redirects conf.c | 54 ++++++++++++++++++++++++++++++++++++++---------------- dhcp.c | 5 +++-- dhcpv6.c | 5 +++-- ndp.c | 6 +++--- passt.h | 8 ++++++-- udp.c | 17 ++++++++--------- 6 files changed, 61 insertions(+), 34 deletions(-) -- 2.35.1

2 18

[PATCH] tcp, udp: Don't initialise IPv6/IPv4 sockets if IPv4/IPv6 are not enabled
by Stefano Brivio 10 Nov '22

10 Nov '22

If we disable a given IP version automatically (no corresponding default route on host) or administratively (--ipv4-only or --ipv6-only options), we don't initialise related buffers and services (DHCP for IPv4, NDP and DHCPv6 for IPv6). The "tap" handlers will also ignore packets with a disabled IP version. However, in commit 3c6ae625101a ("conf, tcp, udp: Allow address specification for forwarded ports") I happily changed socket initialisation functions to take AF_UNSPEC meaning "any enabled IP version", but I forgot to add checks back for the "enabled" part. Reported by Paul: on a host without default IPv6 route, but IPv6 enabled, connect, using IPv6, to a port handled by pasta, which tries to send data to a tap device without initialised buffers for that IP version and exits because the resulting write() fails. Simpler way to reproduce: pasta -6 and inbound IPv4 connection, or pasta -4 and inbound IPv6 connection. Reported-by: Paul Holzinger <pholzing(a)redhat.com> Fixes: 3c6ae625101a ("conf, tcp, udp: Allow address specification for forwarded ports") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 4 ++-- udp.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tcp.c b/tcp.c index 713248f..d043123 100644 --- a/tcp.c +++ b/tcp.c @@ -3213,9 +3213,9 @@ static void tcp_sock_init6(const struct ctx *c, int ns, void tcp_sock_init(const struct ctx *c, int ns, sa_family_t af, const void *addr, const char *ifname, in_port_t port) { - if (af == AF_INET || af == AF_UNSPEC) + if ((af == AF_INET || af == AF_UNSPEC) && c->ifi4) tcp_sock_init4(c, ns, addr, ifname, port); - if (af == AF_INET6 || af == AF_UNSPEC) + if ((af == AF_INET6 || af == AF_UNSPEC) && c->ifi6) tcp_sock_init6(c, ns, addr, ifname, port); } diff --git a/udp.c b/udp.c index 42a17a7..ff7f993 100644 --- a/udp.c +++ b/udp.c @@ -1129,7 +1129,7 @@ void udp_sock_init(const struct ctx *c, int ns, sa_family_t af, c->udp.fwd_in.f.delta[port]); } - if (af == AF_INET || af == AF_UNSPEC) { + if ((af == AF_INET || af == AF_UNSPEC) && c->ifi4) { if (!addr && c->mode == MODE_PASTA) bind_addr = &c->ip4.addr; else @@ -1162,7 +1162,7 @@ void udp_sock_init(const struct ctx *c, int ns, sa_family_t af, } } - if (af == AF_INET6 || af == AF_UNSPEC) { + if ((af == AF_INET6 || af == AF_UNSPEC) && c->ifi6) { if (!addr && c->mode == MODE_PASTA) bind_addr = &c->ip6.addr; else -- 2.35.1

2 1

[PATCH] conf: Fix mask calculation from prefix_len in conf_print()
by Stefano Brivio 10 Nov '22

10 Nov '22

Reported-by: Paul Holzinger <pholzing(a)redhat.com> Fixes: dd09cceaee21 ("Minor improvements to IPv4 netmask handling") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index bfecdff..1adcf83 100644 --- a/conf.c +++ b/conf.c @@ -884,7 +884,10 @@ static void conf_print(const struct ctx *c) if (c->ifi4) { if (!c->no_dhcp) { - uint32_t mask = htonl(0xffffffff << c->ip4.prefix_len); + uint32_t mask; + + mask = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + info("DHCP:"); info(" assign: %s", inet_ntop(AF_INET, &c->ip4.addr, buf4, sizeof(buf4))); -- 2.35.1

2 1

[PATCH] passt: Move __setlogmask() calls before output unrelated to configuration
by Stefano Brivio 08 Nov '22

08 Nov '22

...so that we avoid printing some lines twice because log-level is still set to LOG_EMERG, as if logging configuration didn't happen yet. While at it, note that logging to stderr doesn't really depend on whether debug mode is enabled or not. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/passt.c b/passt.c index fd703de..7d323c2 100644 --- a/passt.c +++ b/passt.c @@ -243,9 +243,16 @@ int main(int argc, char **argv) conf(&c, argc, argv); trace_init(c.trace); - if (!c.debug && (c.stderr || isatty(fileno(stdout)))) + if (c.stderr || isatty(fileno(stdout))) __openlog(log_name, LOG_PERROR, LOG_DAEMON); + if (c.debug) + __setlogmask(LOG_UPTO(LOG_DEBUG)); + else if (c.quiet) + __setlogmask(LOG_UPTO(LOG_ERR)); + else + __setlogmask(LOG_UPTO(LOG_INFO)); + quit_fd = pasta_netns_quit_init(&c); c.fd_tap = c.fd_tap_listen = -1; @@ -267,13 +274,6 @@ int main(int argc, char **argv) if (c.ifi6 && !c.no_dhcpv6) dhcpv6_init(&c); - if (c.debug) - __setlogmask(LOG_UPTO(LOG_DEBUG)); - else if (c.quiet) - __setlogmask(LOG_UPTO(LOG_ERR)); - else - __setlogmask(LOG_UPTO(LOG_INFO)); - pcap_init(&c); if (!c.foreground) { -- 2.35.1

1 0

[PATCH 00/10] RFC: Preliminaries for using share IPv4 & IPv6 sockets
by David Gibson 08 Nov '22

08 Nov '22

We want to use the same sockets to listen on both IPv4 and IPv6 addresses (at least on Linux which allows this). This isn't too complicated conceptually, but to make it work we need to unify handling of v4 and v6 connections more than we currently have. This isn't really ready to go, but I'm posting for reference. It's divided into rather a lot of steps, because I kept hitting problems and not being sure exactly what change had broken things. Based on my earlier series making handling of IPv4 addresses endian safer. David Gibson (10): tcp: no v6 flag in ref tcp: Helper to encode IPv4-mapped IPv6 addresses tcp: Partially unify IPv4 and IPv6 paths in tcp_hash_match() tcp: Hash IPv4 and IPv4-mapped-IPv6 addresses the same tcp: Take tcp_hash_insert() address from struct tcp_conn tcp: Unify IPv4 and IPv6 paths for hashing and matching tcp: Remove ugly address union from struct tcp_conn tcp: Unify initial sequence numbers for IPv4 and IPv6 tcp: Have tcp_seq_init() take its parameters from struct tcp_conn tcp: Fix small error in tcp_seq_init() time handling siphash.c | 2 + tcp.c | 202 ++++++++++++++++++--------------------------------- tcp.h | 1 - tcp_splice.c | 13 ++-- util.c | 33 +++++++++ util.h | 2 + 6 files changed, 116 insertions(+), 137 deletions(-) -- 2.38.1

2 21

[PATCH] test: Wait for network before starting passt in two_guests setup
by Stefano Brivio 07 Nov '22

07 Nov '22

As pasta now configures that target network namespace with --config-net, we need to wait for addresses and routes to be actually present. Just sending netlink messages doesn't mean this is done synchronously. A more elegant alternative, which probably makes sense regardless of this test setup, would be to query, from pasta, addresses and routes we added, and wait until they're there, before proceeding. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/setup | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/lib/setup b/test/lib/setup index ab6d8d5..07d5056 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -208,6 +208,8 @@ setup_two_guests() { __ifname="$(context_run qemu_1 "ip -j link show | jq -rM '.[] | select(.link_type == \"ether\").ifname'")" + sleep 1 + __opts= [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" -- 2.35.1

2 4