- dev - passt

[PATCH 00/12] Updates and fixes for documentation and Fedora package
by Stefano Brivio 18 Aug '22

18 Aug '22

This series introduces a rewrite of the doc/demo.sh script for passt and pasta, which was entirely outdated, some changes to make packaging easier, and a number of fixes to the Fedora spec file template. Most issues addressed here were reported by Fedora package reviewers at: https://bugzilla.redhat.com/show_bug.cgi?id=2106611 Stefano Brivio (12): doc: Rewrite demo script README: Add link to Copr repositories Makefile: Ugly hack to get a "plain" Markdown version of README Makefile: Install demo.sh too, uninstall stuff under /usr/share fedora: Install "plain" README, instead of web version, and demo script fedora: Introduce own rpkg macro for changelog fedora: Start Release tag from 1, not 0 fedora: Drop VCS tag from spec file fedora: Change source URL to HEAD link with explicit commit SHA fedora: Build SELinux subpackage as noarch fedora: Don't hardcode CFLAGS setting, use %set_build_flags macro instead fedora: Fix man pages wildcards in spec file Makefile | 34 +++- README.md | 37 ++-- contrib/fedora/passt.spec | 26 +-- contrib/fedora/rpkg.macros | 38 +++++ doc/demo.sh | 340 +++++++++++++++++++++++++------------ 5 files changed, 334 insertions(+), 141 deletions(-) -- 2.35.1

1 12

[PATCH] Makefile: Ugly hack to get a "plain" Markdown version of README
by Stefano Brivio 10 Aug '22

10 Aug '22

Distribution packages reasonably expect to have a human-readable Markdown version of the README under /usr/share/doc/, but all we have right now is a heavily web-oriented version. Introduce a ugly hack to strip web-oriented parts from the current README and install it. It should probably work the other way around: a human-readable README could be used as a source for the web page. But cgit needs a file that's in the tree, not something that can be built, and https://passt.top/ is based on cgit. It should eventually be doable to work around this in cgit, instead. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 0de872e..f03d117 100644 --- a/Makefile +++ b/Makefile @@ -90,7 +90,7 @@ else BIN := passt pasta qrap endif -all: $(BIN) $(MANPAGES) +all: $(BIN) $(MANPAGES) docs static: CFLAGS += -static -DGLIBC_NO_STATIC_NSS static: clean all @@ -123,12 +123,14 @@ valgrind: all clean: $(RM) $(BIN) *.o seccomp.h pasta.1 \ passt.tar passt.tar.gz *.deb *.rpm \ - passt.pid + passt.pid README.plain.md -install: $(BIN) $(MANPAGES) +install: $(BIN) $(MANPAGES) docs mkdir -p $(DESTDIR)$(prefix)/bin $(DESTDIR)$(prefix)/share/man/man1 cp -d $(BIN) $(DESTDIR)$(prefix)/bin cp -d $(MANPAGES) $(DESTDIR)$(prefix)/share/man/man1 + mkdir -p $(DESTDIR)$(prefix)/share/doc/passt + cp -d README.plain.md $(DESTDIR)$(prefix)/share/doc/passt/README.md uninstall: $(RM) $(BIN:%=$(DESTDIR)$(prefix)/bin/%) @@ -147,6 +149,28 @@ pkgs: static --description="User-mode networking for VMs and namespaces" \ -k --version=g$(shell git rev-parse --short HEAD) passt.tar.gz +# TODO: This hack makes a "plain" Markdown version of README.md that can be +# reasonably shipped as documentation file, while the current README.md is +# definitely intended for web browser consumption. It should probably work the +# other way around: the web version should be obtained by adding HTML and +# JavaScript portions to a plain Markdown, instead. However, cgit needs to use +# a file in the git tree. Find a better way around this. +docs: README.md + @( \ + skip=0; \ + while read l; do \ + case $$l in \ + "## Demo") exit 0 ;; \ + "<!"*) ;; \ + "</"*) skip=1 ;; \ + "<"*) skip=2 ;; \ + esac; \ + \ + [ $$skip -eq 0 ] && echo "$$l"; \ + [ $$skip -eq 1 ] && skip=0; \ + done < README.md; \ + ) > README.plain.md + # Checkers currently disabled for clang-tidy: # - llvmlibc-restrict-system-libc-headers # TODO: this is Linux-only for the moment, nice to fix eventually -- 2.35.1

1 0

[PATCH] README: Add link to Copr repositories
by Stefano Brivio 10 Aug '22

10 Aug '22

These have packages covering all recent versions of CentOS Stream, EPEL, Fedora, Mageia and OpenSUSE Tumbleweed. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index 2cd40c7..2d7ae3c 100644 --- a/README.md +++ b/README.md @@ -537,6 +537,10 @@ See also the [test logs](/builds/latest/test/). make pkgs + * or use one of the unofficial + [repositories](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for + CentOS Stream, EPEL, Fedora, Mageia and OpenSUSE Tumbleweed + * have a look at the _man_ page for synopsis and options: man ./passt.1 @@ -581,6 +585,10 @@ See also the [test logs](/builds/latest/test/). make pkgs + * or use one of the unofficial + [repositories](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for + CentOS Stream, EPEL, Fedora, Mageia and OpenSUSE Tumbleweed + * have a look at the _man_ page for synopsis and options: man ./pasta.1 -- 2.35.1

1 0

[PATCH] doc: Rewrite demo script
by Stefano Brivio 10 Aug '22

10 Aug '22

The original demo script was written when pasta wasn't a thing yet, so it needed to run as root, set up a veth pair, and configure addresses and routes by itself. Now pasta can do all that for us, and become part of the demo as well. Further, extend it to start qemu, optionally preparing a basic demo image with mbuto (https://mbuto.sh), and execute one logical step at a time, for clarity. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 29 ++--- doc/demo.sh | 340 +++++++++++++++++++++++++++++++++++----------------- 2 files changed, 244 insertions(+), 125 deletions(-) diff --git a/README.md b/README.md index 628b9bb..2cd40c7 100644 --- a/README.md +++ b/README.md @@ -541,25 +541,11 @@ See also the [test logs](/builds/latest/test/). man ./passt.1 -* run the demo script, that creates a network namespace called `passt`, sets up - sets up a _veth_ pair and and addresses, together with NAT for IPv4 and NDP - proxying for IPv6, then starts _passt_ in the network namespace: +* run the demo script, that detaches user and network namespaces, configures the + new network namespace using `pasta`, starts `passt` and, optionally, `qemu`: doc/demo.sh -* from the same network namespace, start qemu. At the moment, qemu doesn't - support UNIX domain sockets for the `socket` back-end. Two alternatives: - - * use the _qrap_ wrapper, which maps a tap socket descriptor to _passt_'s - UNIX domain socket, for example: - - ip netns exec passt ./qrap 5 qemu-system-x86_64 ... -net socket,fd=5 -net nic,model=virtio ... - - * or patch qemu with [this patch](/passt/tree/qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch) - and start it like this: - - qemu-system-x86_64 ... -net socket,connect=/tmp/passt.socket -net nic,model=virtio - * alternatively, you can use libvirt, with [this patch](/passt/tree/libvirt/0001-conf-Introduce-support-for-UNIX-domain-socket-as-qem.patch), to start qemu (with the patch mentioned above), with this kind of network interface configuration: @@ -613,6 +599,17 @@ See also the [test logs](/builds/latest/test/). dhclient -6 + * alternatively, start pasta as: + + ./pasta --config-net + + to let pasta configure networking in the namespace by itself, using + `netlink` + + * ...or run the demo script: + + doc/demo.sh + * and that's it, you should now have TCP connections, UDP, and ICMP/ICMPv6 echo working from/to the namespace for IPv4 and IPv6 diff --git a/doc/demo.sh b/doc/demo.sh index f49110a..d39a10e 100755 --- a/doc/demo.sh +++ b/doc/demo.sh @@ -4,122 +4,244 @@ # # PASST - Plug A Simple Socket Transport # -# demo.sh - Set up namespaces, addresses and routes to show PASST functionality +# demo.sh - Set up namespace with pasta, start qemu and passt, step by step # -# Copyright (c) 2020-2021 Red Hat GmbH +# Copyright (c) 2020-2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio(a)redhat.com> -get_token() { - IFS=' ' - __next=0 - for __token in ${@}; do - [ ${__next} -eq 2 ] && echo "${__token}" && return - [ "${__token}" = "${1}" ] && __next=$((__next + 1)) - done - unset IFS +# mbuto_profile() - Profile for https://mbuto.sh/, sourced, return after setting +mbuto_profile() { + PROGS="${PROGS:-ash,dash,bash ip mount ls ln chmod insmod mkdir sleep + lsmod modprobe find grep mknod mv rm umount iperf3 dhclient cat + hostname chown socat dd strace ping killall sysctl wget,curl}" + + KMODS="${KMODS:- virtio_net virtio_pci}" + + LINKS="${LINKS:- + ash,dash,bash /init + ash,dash,bash /bin/sh}" + + DIRS="${DIRS} /tmp /sbin /var/log /var/run /var/lib" + + # shellcheck disable=SC2016 + FIXUP="${FIXUP}"' + cat > /sbin/dhclient-script << EOF +#!/bin/sh + +[ -n "\${new_interface_mtu}" ] && ip link set dev \${interface} mtu \${new_interface_mtu} + +[ -n "\${new_ip_address}" ] && ip addr add \${new_ip_address}/\${new_subnet_mask} dev \${interface} +[ -n "\${new_routers}" ] && for r in \${new_routers}; do ip route add default via \${r} dev \${interface}; done +[ -n "\${new_domain_name_servers}" ] && for d in \${new_domain_name_servers}; do echo "nameserver \${d}" >> /etc/resolv.conf; done +[ -n "\${new_domain_name}" ] && echo "search \${new_domain_name}" >> /etc/resolf.conf +[ -n "\${new_domain_search}" ] && (printf "search"; for d in \${new_domain_search}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf +[ -n "\${new_ip6_address}" ] && ip addr add \${new_ip6_address}/\${new_ip6_prefixlen} dev \${interface} +[ -n "\${new_dhcp6_name_servers}" ] && for d in \${new_dhcp6_name_servers}; do echo "nameserver \${d}%\${interface}" >> /etc/resolv.conf; done +[ -n "\${new_dhcp6_domain_search}" ] && (printf "search"; for d in \${new_dhcp6_domain_search}; do printf " %s" "\${d}"; done; printf "\n") >> /etc/resolv.conf +[ -n "\${new_host_name}" ] && hostname "\${new_host_name}" +exit 0 +EOF + + chmod 755 /sbin/dhclient-script + + mkdir -p /etc/dhcp + echo "timeout 3;" > /etc/dhcp/dhclient.conf + + ln -s /sbin /usr/sbin + :> /etc/fstab + + echo + echo "The guest is up and running. Networking is not configured yet:" + echo + echo "$ ip address show" + echo + ip address show + echo + echo "...the next step will take care of that." + read x + + echo "$ ip link set dev eth0 up" + ip link set dev eth0 up + sleep 3 + echo "$ /sbin/dhclient -4 -1" + /sbin/dhclient -4 -1 + sleep 2 + echo "$ /sbin/dhclient -6 -1" + /sbin/dhclient -6 -1 + sleep 2 + echo + echo "$ ip address show" + ip address show + echo + echo "$ ip route show" + ip route show + echo + echo "...done." + read x + + echo "Checking connectivity..." + echo + echo "$ wget --no-check-certificate https://passt.top/ || curl -k https://passt.top/" + wget --no-check-certificate https://passt.top/ || curl -k https://passt.top/ + echo "...done." + read x + + echo "An interactive shell will start now. When you are done," + echo "use ^C to terminate the guest and exit the demo." + echo + + sh +m +' } -ipv6_dev() { get_token "dev" $(ip -o -6 route show default | grep via); } -ipv6_devaddr() { get_token "inet6" $(ip -o -6 addr show dev "${1}" scope global); } -ipv6_ll_addr() { get_token "inet6" $(ip -o -6 addr show dev "${1}" scope link); } -ipv6_mask() { echo ${1#*/}; } -ipv6_mangle() { - IFS=':' - __c=0 - for __16b in ${1%%/*}; do - if [ ${__c} -lt 7 ]; then - printf "${__16b}:" - else - printf "%04x\n" $((0xabc0 + ${2})) && break - fi - __c=$((__c + 1)) - done - unset IFS +[ "${0##*/}" = "mbuto" ] && mbuto_profile && return 0 + +# cmd() - Show command being executed, then run it +# $@: Command and arguments +cmd() { + echo "$" "$@" + "$@" +} + +# next() - Go to next step once a key is pressed, sets $KEY +next() { + KEY="$(dd ibs=1 count=1 2>/dev/null)" + echo } -ndp_setup() { - sysctl -w net.ipv6.conf.all.proxy_ndp=1 - ip -6 neigh add proxy "${1}" dev "$(ipv6_dev)" +# cleanup() - Terminate pasta and passt, clean up, restore TTY settings +cleanup() { + [ -f "${DEMO_DIR}/pasta.pid" ] && kill "$(cat "${DEMO_DIR}/pasta.pid")" + [ -f "${DEMO_DIR}/passt.pid" ] && kill "$(cat "${DEMO_DIR}/passt.pid")" + rm -rf "${DEMO_DIR}" 2>/dev/null + [ -n "${STTY_BACKUP}" ] && stty "${STTY_BACKUP}" +} + +# start_pasta_delayed() - Start pasta once $DEMO_DIR/pasta.wait is gone +start_pasta_delayed() { + trap '' EXIT + while [ -d "${DEMO_DIR}/pasta.wait" ]; do sleep 1; done + cmd pasta --config-net -P "${DEMO_DIR}/pasta.pid" \ + "$(cat "${DEMO_DIR}/shell.pid")" + echo + echo "...pasta is running." + exit 0 +} - for i in `seq 1 63`; do - __neigh="$(ipv6_mangle ${1} ${i})" - if [ "${__neigh}" != "${1}" ]; then - ip -6 neigh add proxy "${__neigh}" dev "${2}" - fi - done +# into_ns() - Entry point and demo script to run inside new namespace +into_ns() { + echo "We're in the new namespace now." + next + + echo "Networking is not configured yet:" + echo + cmd ip link show + echo + cmd ip address show + next + + echo "Let's run pasta(1) to configure networking and connect this" + echo "namespace. Note that we'll run pasta(1) from outside this" + echo "namespace, because it needs to implement the connection between" + echo "this namespace and the initial (\"outer\") one." + next + + echo "$$" > "${DEMO_DIR}/shell.pid" + rmdir "${DEMO_DIR}/pasta.wait" + next + + echo "Back to the new namespace, networking is configured:" + echo + cmd ip link show + echo + cmd ip address show + next + + echo "and we can now start passt(1), to connect this namespace to a" + echo "virtual machine. If you want to start a shell in this namespace," + echo "press 's' now. Exiting the shell will resume the script." + next + [ "${KEY}" = "s" ] && ${SHELL} + + cmd passt -P "${DEMO_DIR}/passt.pid" + echo + echo "...passt is running." + next + + __arch="$(uname -m)" + case ${__arch} in + x86_64) + __arch_supported=1 + __qemu_arch="qemu-system-x86_64 -M pc,accel=kvm:tcg" + ;; + *) + __arch_supported=0 + ;; + esac + + if [ "${__arch_supported}" -eq 1 ]; then + echo "We're ready to start a virtual machine now. This script" + echo "can download and use mbuto (https://mbuto.sh/) to build a" + echo "basic initramfs image. Otherwise, press 's' to skip this" + echo "step, and start an existing virtual machine yourself." + echo "You'll need to use the qrap(1) wrapper, with qemu options" + echo "as reported above." + + next + else + echo "This script doesn't know, yet, how to run a virtual" + echo "machine on your architecture (${__arch}). Please start an" + echo "existing virtual machine yourself, using the qrap(1)" + echo "wrapper, with qemu options as reported above." + echo + fi + + if [ "${__arch_supported}" -eq 0 ] || [ "${KEY}" = "s" ]; then + echo "Start a virtual machine now. Pressing any key here will" + echo "terminate passt and pasta, and clean up." + next + + exit 0 + fi + + cmd git -C "${DEMO_DIR}" clone git://mbuto.sh/mbuto + echo + cmd "${DEMO_DIR}/mbuto/mbuto" \ + -p "$(realpath "${0}")" -f "${DEMO_DIR}/demo.img" + echo + echo "The guest image is ready. The next step will start the guest." + echo "Use ^C to terminate it." + next + + cmd qrap 5 qemu-system-x86_64 -M pc,accel=kvm:tcg \ + -smp "$(nproc)" -m 1024 \ + -nographic -serial stdio -nodefaults -no-reboot -vga none \ + -initrd "${DEMO_DIR}/demo.img" \ + -kernel "/boot/vmlinuz-$(uname -r)" -append "console=ttyS0" \ + -net socket,fd=5 -net nic,model=virtio || : } -ns_idx=0 -for i in `seq 1 63`; do - ns="passt_${i}" - ns_idx=${i} - - busy=0 - for p in $(pidof passt); do - [ "$(ip netns identify ${p})" = "${ns}" ] && busy=1 && break - done - [ ${busy} -eq 0 ] && break -done - -[ ${busy} -ne 0 ] && echo "Couldn't create namespace" && exit 1 - -ip netns del "${ns}" 2>/dev/null || : -ip netns add "${ns}" -ip link del "veth_${ns}" 2>/dev/null || : -ip link add "veth_${ns}" up netns "${ns}" type veth peer name "veth_${ns}" -ip link set dev "veth_${ns}" up -ip link set dev "veth_${ns}" mtu 65535 -ip -n "${ns}" link set dev "veth_${ns}" mtu 65535 -ip -n "${ns}" link set dev lo up - -ipv4_main="192.0.2.$(((ns_idx - 1) * 4 + 1))" -ipv4_ns="192.0.2.$(((ns_idx - 1) * 4 + 2))" - -ip -n "${ns}" addr add "${ipv4_ns}/30" dev "veth_${ns}" -ip addr add "${ipv4_main}/30" dev "veth_${ns}" -ip -n "${ns}" route add default via "${ipv4_main}" - -sysctl -w net.ipv4.ip_forward=1 -nft delete table "${ns}_nat" 2>/dev/null || : -nft add table "${ns}_nat" -nft add chain "${ns}_nat" postrouting '{ type nat hook postrouting priority -100 ; }' -nft add rule "${ns}_nat" postrouting ip saddr "${ipv4_ns}" masquerade - -ipv6_addr="$(ipv6_devaddr "$(ipv6_dev)")" -if [ -n "${ipv6_addr}" ]; then - ipv6_passt="$(ipv6_mangle "${ipv6_addr}" ${ns_idx})" - ndp_setup "${ipv6_passt}" "veth_${ns}" - ip -n "${ns}" addr add "${ipv6_passt}/$(ipv6_mask "${ipv6_addr}")" dev "veth_${ns}" - ip addr add "${ipv6_addr}" dev "veth_${ns}" - ip route add "${ipv6_passt}" dev "veth_${ns}" - passt_ll="$(ipv6_ll_addr "veth_${ns}")" - main_ll="$(get_token "link/ether" $(ip -o link show "veth_${ns}"))" - ip neigh add "${passt_ll%%/*}" dev "veth_${ns}" lladdr "${main_ll}" - ip -n "${ns}" route add default via "${passt_ll%%/*}" dev "veth_${ns}" - - sysctl -w net.ipv6.conf.all.forwarding=1 -else - ipv6_passt= -fi - -ethtool -K "veth_${ns}" tx off -ip netns exec "${ns}" ethtool -K "veth_${ns}" tx off -ip netns exec "${ns}" sysctl -w net.ipv4.ping_group_range="0 2147483647" - - -sysctl -w net.core.rmem_max=16777216 -sysctl -w net.core.wmem_max=16777216 -sysctl -w net.core.rmem_default=16777216 -sysctl -w net.core.wmem_default=16777216 -sysctl -w net.ipv4.tcp_rmem="16777216 131072 16777216" -sysctl -w net.ipv4.tcp_wmem="16777216 131072 16777216" - -echo -echo "Namespace ${ns} set up, addresses:" -echo " ${ipv4_ns}" -echo " ${ipv6_passt}" -echo -echo "Starting passt..." -echo - -ip netns exec "${ns}" ./passt -f -e -t all -u all +STTY_BACKUP="$(stty -g)" +stty -icanon + +trap cleanup EXIT INT +[ "${1}" = "into_ns" ] && into_ns && exit 0 + +DEMO_DIR="$(mktemp -d)" +mkdir "${DEMO_DIR}/pasta.wait" + +echo "This script sets up a network and user namespace using pasta(1), then" +echo "starts a virtual machine in it, connected via passt(1), pausing at every" +echo "step. Press any key to go to the next step." +next + +echo "Let's create the network and user namespace, first. This could be done" +echo "with pasta(1) itself (just issue \`pasta\`), but for the sake of this" +echo "script we'll create it first with unshare(1), and run the next steps" +echo "of this script from there." +next + +start_pasta_delayed & +DEMO_DIR="${DEMO_DIR}" cmd unshare -rUn "${0}" into_ns + +exit 0 -- 2.35.1

1 0

[PATCH] contrib, test: Rebase Podman patch, enable three-way merge on git am in demo
by Stefano Brivio 01 Aug '22

01 Aug '22

Given that a three-way git merge was enough to cope with context changes in man pages, it's probably a good idea to enable that for 'git am' in the demo too. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- ...001-libpod-Add-pasta-networking-mode.patch | 32 +++++++++---------- test/demo/podman | 2 +- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch b/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch index cb1bab9..ac82a44 100644 --- a/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch +++ b/contrib/podman/0001-libpod-Add-pasta-networking-mode.patch @@ -1,4 +1,4 @@ -From 3aa86f0fd0d420c11d328c673e8162300172925a Mon Sep 17 00:00:00 2001 +From 27b0bf3a0ad6c57c7713aef1ded8cad6d4cd4d4a Mon Sep 17 00:00:00 2001 From: Stefano Brivio <sbrivio(a)redhat.com> Date: Mon, 2 May 2022 16:12:07 +0200 Subject: [PATCH] libpod: Add pasta networking mode @@ -56,7 +56,7 @@ SPDX-License-Identifier: Apache-2.0 create mode 100644 libpod/networking_pasta.go diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md -index 67bb573e2..3b96de4d7 100644 +index b3e707e45..03a754e4c 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -717,10 +717,15 @@ Valid _mode_ values are: @@ -115,8 +115,8 @@ index 67bb573e2..3b96de4d7 100644 + #### **--network-alias**=*alias* - Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a name only for a specific network, use the alias option as described under the **--network** option. -@@ -1592,8 +1631,9 @@ In order for users to run rootless, there must be an entry for their username in + Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +@@ -1595,8 +1634,9 @@ In order for users to run rootless, there must be an entry for their username in Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. The fuse-overlayfs package provides a userspace overlay storage driver, otherwise users need to use @@ -128,7 +128,7 @@ index 67bb573e2..3b96de4d7 100644 ## ENVIRONMENT -@@ -1642,7 +1682,9 @@ page. +@@ -1645,7 +1685,9 @@ page. NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. ## SEE ALSO @@ -140,10 +140,10 @@ index 67bb573e2..3b96de4d7 100644 ## HISTORY October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman `<dwalsh(a)redhat.com>` diff --git a/docs/source/markdown/podman-pod-create.1.md b/docs/source/markdown/podman-pod-create.1.md -index de9a34bfa..e711d6823 100644 +index 7b63ac51d..03174d1a6 100644 --- a/docs/source/markdown/podman-pod-create.1.md +++ b/docs/source/markdown/podman-pod-create.1.md -@@ -193,10 +193,15 @@ Valid _mode_ values are: +@@ -263,10 +263,15 @@ Valid _mode_ values are: - **interface_name**: Specify a name for the created network interface inside the container. For example to set a static ipv4 address and a static mac address, use `--network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99`. @@ -159,7 +159,7 @@ index de9a34bfa..e711d6823 100644 - **ns:**_path_: Path to a network namespace to join. - **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones. - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf: -@@ -212,6 +217,43 @@ Valid _mode_ values are: +@@ -282,6 +287,43 @@ Valid _mode_ values are: Note: Rootlesskit changes the source IP address of incoming packets to an IP address in the container network namespace, usually `10.0.2.100`. If your application requires the real source IP address, e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for rootless containers when connected to user-defined networks. - **port_handler=slirp4netns**: Use the slirp4netns port forwarding, it is slower than rootlesskit but preserves the correct source IP address. This port handler cannot be used for user-defined networks. @@ -202,8 +202,8 @@ index de9a34bfa..e711d6823 100644 + #### **--network-alias**=*alias* - Add a network-scoped alias for the pod, setting the alias for all networks that the pod joins. To set a name only for a specific network, use the alias option as described under the **--network** option. -@@ -599,6 +641,8 @@ $ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loo + Add a network-scoped alias for the pod, setting the alias for all networks that the container joins. To set a +@@ -672,6 +714,8 @@ $ podman pod create --network slirp4netns:outbound_addr=127.0.0.1,allow_host_loo $ podman pod create --network slirp4netns:cidr=192.168.0.0/24 @@ -213,7 +213,7 @@ index de9a34bfa..e711d6823 100644 ``` diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md -index 4566a73d0..8f8b5b4c1 100644 +index 8c889f0a5..0ad667fc2 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -734,10 +734,15 @@ Valid _mode_ values are: @@ -275,8 +275,8 @@ index 4566a73d0..8f8b5b4c1 100644 + #### **--network-alias**=*alias* - Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a name only for a specific network, use the alias option as described under the **--network** option. -@@ -1964,8 +2006,9 @@ In order for users to run rootless, there must be an entry for their username in + Add a network-scoped alias for the container, setting the alias for all networks that the container joins. To set a +@@ -1967,8 +2009,9 @@ In order for users to run rootless, there must be an entry for their username in Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed. The **fuse-overlayfs** package provides a userspace overlay storage driver, otherwise users need to use @@ -288,7 +288,7 @@ index 4566a73d0..8f8b5b4c1 100644 ## ENVIRONMENT -@@ -2012,7 +2055,7 @@ page. +@@ -2015,7 +2058,7 @@ page. NOTE: Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. ## SEE ALSO @@ -511,10 +511,10 @@ index f0d4e9153..2c4b40509 100644 portMappings, expose, err := createPortMappings(s, imageData) if err != nil { diff --git a/pkg/specgen/generate/pod_create.go b/pkg/specgen/generate/pod_create.go -index 212d613fe..b50fe3586 100644 +index 4e6362c9b..fa8a01c84 100644 --- a/pkg/specgen/generate/pod_create.go +++ b/pkg/specgen/generate/pod_create.go -@@ -163,6 +163,12 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) { +@@ -200,6 +200,12 @@ func MapSpec(p *specgen.PodSpecGenerator) (*specgen.SpecGenerator, error) { p.InfraContainerSpec.NetworkOptions = p.NetworkOptions p.InfraContainerSpec.NetNS.NSMode = specgen.Slirp } diff --git a/test/demo/podman b/test/demo/podman index 100adc1..f3411d8 100644 --- a/test/demo/podman +++ b/test/demo/podman @@ -32,7 +32,7 @@ say , patch it sleep 1 host cp ../contrib/podman/0001-libpod-Add-pasta-networking-mode.patch __TEMPDIR__/podman host cd __TEMPDIR__/podman -host git am 0001-libpod-Add-pasta-networking-mode.patch +host git am -3 0001-libpod-Add-pasta-networking-mode.patch sleep 1 say , and build it. -- 2.35.1

1 0

[PATCH 0/7] Improved selection of external interface and IP configuration
by David Gibson 01 Aug '22

01 Aug '22

The current semantics for selecting an external interface are quite confusing - depending on details it can pick either the interface associated with the first default route, or the lowest numbered interface with a default route, which might not be the same.The logic for checking the interface in the tests isn't quite identical which can lead to test failures when there are multiple external routes. This series fixes that bug and makes a number of follow on clean ups to the detection / configuration of IP parameters from the host. David Gibson (7): Allow different external interfaces for IPv4 and IPv6 connectivity Separately locate external interfaces for IPv4 and IPv6 Initialize host side MAC when in IPv6 only mode Move passt mac_guest init to be more symmetric with pasta Clarify semantics of c->v4 and c->v6 variables Separate IPv4 and IPv6 configuration Make substructures for IPv4 and IPv6 specific context information arp.c | 2 +- conf.c | 326 ++++++++++++++++++++++-------------------- dhcp.c | 22 +-- dhcpv6.c | 18 +-- ndp.c | 16 +-- netlink.c | 79 +--------- netlink.h | 2 +- passt.c | 6 +- passt.h | 78 +++++----- pasta.c | 14 +- tap.c | 32 +++-- tcp.c | 56 ++++---- test/dhcp/passt | 3 +- test/dhcp/pasta | 3 +- test/ndp/passt | 4 +- test/two_guests/basic | 3 +- udp.c | 70 ++++----- util.c | 6 +- util.h | 6 - 19 files changed, 357 insertions(+), 389 deletions(-) -- 2.37.1

2 10

[PATCH] passt.1: Default host interfaces are now selected based on IP version
by Stefano Brivio 30 Jul '22

30 Jul '22

Reflect the changes from commit 4b2e018d70f3 ("Allow different external interfaces for IPv4 and IPv6 connectivity") into the manual. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.1 | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/passt.1 b/passt.1 index 4e06c0c..378778c 100644 --- a/passt.1 +++ b/passt.1 @@ -138,8 +138,8 @@ Assign IPv4 \fIaddr\fR via DHCP (\fByiaddr\fR), or \fIaddr\fR via DHCPv6 (option for an IPv6 \fIaddr\fR. This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). -By default, assigned IPv4 and IPv6 addresses are taken from the host interface -with the first default route. +By default, assigned IPv4 and IPv6 addresses are taken from the host interfaces +with the first default route for the corresponding IP version. .TP .BR \-n ", " \-\-netmask " " \fImask @@ -153,8 +153,8 @@ according to the CIDR block of the assigned address (RFC 4632). .BR \-M ", " \-\-mac-addr " " \fIaddr Use source MAC address \fIaddr\fR when communicating to the guest or to the target namespace. -Default is to use the MAC address of the interface with the first default route -on the host. +Default is to use the MAC address of the interface with the first IPv4 default +route on the host. .TP .BR \-g ", " \-\-gateway " " \fIaddr @@ -163,7 +163,7 @@ Assign IPv4 \fIaddr\fR as default gateway via DHCP (option 3), or IPv6 This option can be specified zero (for defaults) to two times (once for IPv4, once for IPv6). By default, IPv4 and IPv6 addresses are taken from the host interface with the -first default route. +first default route for the corresponding IP version. Note: these addresses are also used as source address for packets directed to the guest or to the target namespace having a loopback or local source address, @@ -173,7 +173,8 @@ to allow mapping of local traffic to guest and target namespace. See the .TP .BR \-i ", " \-\-interface " " \fIname Use host interface \fIname\fR to derive addresses and routes. -Default is to use the interface with the first default route. +Default is to use the interfaces with the first default routes for each IP +version. .TP .BR \-D ", " \-\-dns " " \fIaddr -- 2.35.1

1 0

[PATCH] test: Expand root partition of Debian sid amd64 and aarch64 images
by Stefano Brivio 30 Jul '22

30 Jul '22

A couple of days ago, we started running out of space there as we're about to install gcc -- about 50 MiB are missing. Given that virt-resize (which could be conveniently invoked by the Makefile for tests) reorders partitions if we expand the first one, resize the image using qemu-img from the test script itself, and then take care of expanding root partition and filesystem online later. This is probably a temporary hack, so I'm not looking for a more generic or elegant solution at the moment. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/distro/debian | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/test/distro/debian b/test/distro/debian index abbbaa2..1548761 100644 --- a/test/distro/debian +++ b/test/distro/debian @@ -184,10 +184,19 @@ sleep 1 hostb reset +# HACK: We need some additional space to install gcc-12 on 'sid' images for +# amd64 and aarch64, but if we use virt-resize to call resize2fs in the +# preparation step, partitions will be rearranged and we would also need to +# adjust boot parameters. Instead, resize the images offline first, and expand +# partitions and filesystems online, later. + test Debian GNU/Linux sid (experimental), amd64 +host qemu-img resize __BASEPATH__/prepared-debian-sid-nocloud-amd64-daily.qcow2 4G host ./qrap 5 qemu-system-x86_64 -M pc,accel=kvm:tcg -m 1024 -nographic -serial stdio -nodefaults -no-reboot -nographic -vga none __BASEPATH__/prepared-debian-sid-nocloud-amd64-daily.qcow2 -net socket,fd=5 -net nic,model=virtio -snapshot sleep 2 +host growpart /dev/sda 1 +host resize2fs -p /dev/sda1 host apt-get update host apt-get -y install make gcc netcat-openbsd @@ -202,8 +211,11 @@ sleep 1 test Debian GNU/Linux sid (experimental), aarch64 +host qemu-img resize __BASEPATH__/prepared-debian-sid-nocloud-arm64-daily.qcow2 4G host ./qrap 5 qemu-system-aarch64 -m 2048 -cpu cortex-a57 -smp 2 -M virt -bios __BASEPATH__/QEMU_EFI.fd -nographic -serial stdio -nodefaults -no-reboot -nographic -vga none __BASEPATH__/prepared-debian-sid-nocloud-arm64-daily.qcow2 -net socket,fd=5 -net nic,model=virtio -snapshot sleep 2 +host growpart /dev/vda 1 +host resize2fs -p /dev/vda1 host apt-get update host apt-get -y install make gcc netcat-openbsd -- 2.35.1

1 0

[PATCH] passt: Truncate PID file on open()
by Stefano Brivio 23 Jul '22

23 Jul '22

Otherwise, if the current PID has fewer digits than a previously written one, the content will be wrong. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passt.c b/passt.c index a8d94b4..01eed1b 100644 --- a/passt.c +++ b/passt.c @@ -390,7 +390,7 @@ int main(int argc, char **argv) if (*c.pid_file) { if ((pidfile_fd = open(c.pid_file, - O_CREAT | O_WRONLY | O_CLOEXEC, + O_CREAT | O_TRUNC | O_WRONLY | O_CLOEXEC, S_IRUSR | S_IWUSR)) < 0) { perror("PID file open"); exit(EXIT_FAILURE); -- 2.35.1

2 1

[PATCH 00/18] Test fixes, batch 5
by David Gibson 21 Jul '22

21 Jul '22

Here's yet another batch of fixes to make the tests more robust against different environments. With this lot, I'm now able to run the pasta, passt, passt_in_ns and two_guests tests on my Fedora system. I'm still hitting problems with the perf tests. This series (specifically 11/18) updates the demo to use socat instead of openbsd netcat. This is needed, or the change to socat in the mbuto image would break the demo. However, I'm hitting unrelated problems trying to run the demos, so the switch to socat is, alas, untested. David Gibson (18): tests: Remove no longer needed /usr/bin/bash link tests: Let Fedora find dhclient-script in /usr/sbin tests: Add rudimentary debugging to dhclient-script tests: Add some extra dhclient support directories to mbuto.img tests: More robust parsing of resolv.conf for DHCP tests tests: Handle the case of a nameserver on host localhost tests: Correctly handle domain search list in dhclient-script tests: Fix detection of empty 'hout' responses in passt{,_in_ns} tests tests: Fix creation of test file in udp passt tests valgrind needs futex tests: Use socat instead of netcat tests: Remove unnecessary ^D in passt_in_ns teardown tests: Remove unnecessary truncation of temporary files in udp tests tests: Use dhclient --no-pid for namespaces in two_guests tests tests: Clean up better after iperf tests tests: No need to retrieve host ifname in ndp/pasta tests: Correct determination of host interface name in tests demo: Use git protocol downloads Makefile | 2 +- test/README.md | 2 +- test/demo/passt | 10 +-- test/demo/pasta | 14 ++--- test/dhcp/passt | 22 +++---- test/lib/setup | 24 ++++++-- test/lib/test | 2 +- test/ndp/pasta | 5 +- test/passt.mbuto | 18 +++--- test/tcp/passt | 36 +++++------ test/tcp/passt_in_ns | 138 +++++++++++++++++++++--------------------- test/tcp/pasta | 58 +++++++++--------- test/two_guests/basic | 24 ++++---- test/udp/passt | 26 ++++---- test/udp/passt_in_ns | 82 +++++++++++-------------- test/udp/pasta | 34 +++++------ 16 files changed, 247 insertions(+), 250 deletions(-) -- 2.36.1

2 25