- dev - passt

[PATCH 00/18] slirp4netns, sandboxing, Podman integration, assorted fixes
by Stefano Brivio 22 Feb '22

22 Feb '22

This series: - completes slirp4netns(1) compatibility of slirp4netns.sh and introduces equivalent features in pasta (patches 1/18, 2/18, 6/18, 9/18) - enables namespace-based sandboxing that's _at least_ equivalent to the one implemented by slirp4netns (patches 3/18 and 4/18) - carries a number of fixes for minor ssues I found while doing this (patches 5/18, 7/18, 8/18, 10/18, 11/18) - introduce a self-quit mechanism for pasta for easier integration with container runtimes (patch 12/18) - fixes a few items in documentation and tests (patches 13/18 to 16/18) - adds Podman integration as out-of-tree patch (patch 17/18) - adds a demo for Podman operation with pasta and side-by-side comparison with slirp4netns (patch 18/18). I already ran a demo recording for the Podman demo: https://passt.top/builds/latest/web/demo_podman.webm Stefano Brivio (18): slirp4netns: Look up pasta command, exit if not found slirp4netns: Add EXIT as condition for trap passt, pasta: Namespace-based sandboxing, defer seccomp policy application passt: Make process not dumpable after sandboxing Makefile, conf, passt: Drop passt4netns references, explicit argc check slirp4netns.sh: Implement API socket option for port forwarding conf: Don't print configuration on --quiet conf: Given IPv4 address and no netmask, assign RFC 790-style classes conf, udp: Introduce basic DNS forwarding udp: Allow loopback connections from host using configured unicast address tcp, udp: Receive batching doesn't pay off when writing single frames to tap pasta: By default, quit if filesystem-bound net namespace goes away test/distro/ubuntu: Use DEBIAN_FRONTEND=noninteractive for apt on 22.04 test/perf/passt_udp: Drop threshold for 256B test man page: Update REPORTING BUGS section README, hooks: Build HTML man page on push, add a link contrib: Add patch for Podman integration test: Add demo for Podman with pasta Makefile | 10 +- README.md | 18 +- conf.c | 219 +++-- ...001-libpod-Add-pasta-networking-mode.patch | 542 +++++++++++ dhcp.c | 5 +- dhcpv6.c | 7 + hooks/pre-push | 3 + ndp.c | 6 +- passt.1 | 92 +- passt.c | 140 ++- passt.h | 28 +- pasta.c | 217 ++--- pasta.h | 2 + pcap.c | 5 +- pcap.h | 2 +- slirp4netns.sh | 198 +++- tap.c | 58 +- tcp.c | 49 +- test/demo/passt | 3 +- test/demo/pasta | 5 +- test/demo/podman | 843 ++++++++++++++++++ test/distro/ubuntu | 1 + test/lib/layout | 38 +- test/lib/setup | 49 +- test/lib/term | 10 + test/lib/test | 35 + test/perf/passt_udp | 4 +- test/run | 8 + udp.c | 76 +- util.c | 129 ++- util.h | 12 +- 31 files changed, 2430 insertions(+), 384 deletions(-) create mode 100644 contrib/podman/0001-libpod-Add-pasta-networking-mode.patch create mode 100644 test/demo/podman -- 2.34.1

1 19

[PATCH] test/perf/passt_tcp: Drop iperf3 window size for host-to-guest tests
by Stefano Brivio 01 Feb '22

01 Feb '22

With a recent 5.15 kernel, passing a huge window size to iperf3 with lower MTUs makes iperf3 stop sending packets after a few seconds -- I haven't investigated this in detail, but the window size will be adjusted dynamically anyway and not passing it doesn't actually affect throughput, so simply drop the option. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/perf/passt_tcp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/test/perf/passt_tcp b/test/perf/passt_tcp index 0db12ea..99d8fb1 100644 --- a/test/perf/passt_tcp +++ b/test/perf/passt_tcp @@ -141,19 +141,19 @@ tr TCP throughput over IPv6: host to guest bw - bw - ns ip link set dev lo mtu 1280 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 1.0 1.2 ns ip link set dev lo mtu 1500 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 9000 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 8M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 5.0 6.0 ns ip link set dev lo mtu 65520 -iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ -w 16M +iperf3c ns ::1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 6.0 6.8 ns ip link set dev lo mtu 65535 @@ -181,28 +181,28 @@ lat __LAT__ 500 350 tr TCP throughput over IPv4: host to guest ns ip link set dev lo mtu 256 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 1M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 0.3 0.5 ns ip link set dev lo mtu 576 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 1M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 0.5 1.0 ns ip link set dev lo mtu 1280 ns ip addr add ::1 dev lo -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 1500 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 4M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 2.0 3.0 ns ip link set dev lo mtu 9000 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 8M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 5.0 6.0 ns ip link set dev lo mtu 65520 -iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ -w 16M +iperf3c ns 127.0.0.1 100${i}1 __THREADS__ __OPTS__ iperf3s BW guest 100${i}1 __THREADS__ bw __BW__ 6.0 6.8 ns ip link set dev lo mtu 65535 -- 2.34.1

1 0

[PATCH] util: Avoid return of possibly truncated unsigned long in bitmap_isset()
by Stefano Brivio 01 Feb '22

01 Feb '22

Oops. If *word & BITMAP_BIT(bit) is bigger than an int (which is the case for half of the possible bits of a bitmap on 64-bit archs), we'll return that as an int, that is, zero, even if the bit at hand is set. Just return zero or one there, no callers are interested in the actual bitmap as return value. Issue found as pasta wouldn't automatically detect some bound ports. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.c b/util.c index 57b987a..94d49a6 100644 --- a/util.c +++ b/util.c @@ -366,13 +366,13 @@ void bitmap_clear(uint8_t *map, int bit) * @map: Pointer to bitmap * @bit: Bit number to check * - * Return: non-zero if given bit is set, zero if it's not + * Return: one if given bit is set, zero if it's not */ int bitmap_isset(const uint8_t *map, int bit) { unsigned long *word = (unsigned long *)map + BITMAP_WORD(bit); - return *word & BITMAP_BIT(bit); + return !!(*word & BITMAP_BIT(bit)); } /** -- 2.34.1

1 0

pending series merged and pushed
by Stefano Brivio 01 Feb '22

01 Feb '22

Hi, I just merged and pushed these series: [PATCH 00/22] Fixes for non-x86_64, older kernels/glibc, and some more [PATCH 0/4] Tests for multiple architectures and distributions [PATCH 0/4] Proof-of-concept for Kata Containers integration [PATCH] passt: Address new clang-tidy warnings from LLVM 13.0.1 [PATCH] test/distro: Avoid race between display of ns_msg and netcat exiting [PATCH] test/distro/ubuntu: Skip apt-get update for 16.04 on powerpc Enjoy, and let me know if something broke. Thanks, -- Stefano

1 0

[PATCH] test/distro/ubuntu: Skip apt-get update for 16.04 on powerpc
by Stefano Brivio 31 Jan '22

31 Jan '22

Some recent change to xenial-updates broke dependencies for gcc, it can't be installed anymore. Skipping apt-get update leaves gcc dependencies in a consistent state, though. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/distro/ubuntu | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/distro/ubuntu b/test/distro/ubuntu index 6013122..b67c1f3 100644 --- a/test/distro/ubuntu +++ b/test/distro/ubuntu @@ -154,7 +154,9 @@ host guestfish --rw -a __IMG__ -i copy-in __GUEST_FILES__ /root/ host ./qrap 5 qemu-system-ppc64 -m 1024 -M pseries -nographic -nodefaults -serial stdio -no-reboot -nographic -vga none -hda __IMG__ -net socket,fd=5 -net nic,model=virtio host PS1='$ ' host dhclient -host apt-get update +# Skip apt-get update here: some updates to xenial-updates around 2022-01-30 +# broke dependencies for libc6 and gcc-5 -- note that powerpc is not officially +# supported on this version host apt-get -y install make gcc netcat-openbsd host make clean -- 2.34.1

1 0

[PATCH] test/distro: Avoid race between display of ns_msg and netcat exiting
by Stefano Brivio 31 Jan '22

31 Jan '22

The shell might report 'nc -6 -l -p 9999 > /tmp/ns_msg' as done even after the subsequent 'echo' is done: wait one second before reading out /tmp/ns_msg, to ensure we read that instead of the "Done" message. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/distro/debian | 1 + test/distro/fedora | 1 + test/distro/opensuse | 1 + test/distro/ubuntu | 1 + 4 files changed, 4 insertions(+) diff --git a/test/distro/debian b/test/distro/debian index 6ba0b10..c506bf7 100644 --- a/test/distro/debian +++ b/test/distro/debian @@ -26,6 +26,7 @@ sleep 2 host echo "from_ns" | nc -q0 ::1 10000 sleep 2 host echo +sleep 1 hout NS_MSG cat /tmp/ns_msg check [ __NS_MSG__ = "from_init" ] hostb exit diff --git a/test/distro/fedora b/test/distro/fedora index 0a80555..f2f8f27 100644 --- a/test/distro/fedora +++ b/test/distro/fedora @@ -25,6 +25,7 @@ sleep 2 host echo "from_ns" | nc ::1 10000 sleep 2 host echo +sleep 1 hout NS_MSG cat /tmp/ns_msg check [ __NS_MSG__ = "from_init" ] hostb exit diff --git a/test/distro/opensuse b/test/distro/opensuse index 740108a..6e29b45 100644 --- a/test/distro/opensuse +++ b/test/distro/opensuse @@ -25,6 +25,7 @@ sleep 2 host echo "from_ns" | nc -N ::1 10000 sleep 2 host echo +sleep 1 hout NS_MSG cat /tmp/ns_msg check [ __NS_MSG__ = "from_init" ] hostb exit diff --git a/test/distro/ubuntu b/test/distro/ubuntu index fcd3861..6013122 100644 --- a/test/distro/ubuntu +++ b/test/distro/ubuntu @@ -25,6 +25,7 @@ sleep 2 host echo "from_ns" | nc -q0 ::1 10000 sleep 2 host echo +sleep 1 hout NS_MSG cat /tmp/ns_msg check [ __NS_MSG__ = "from_init" ] hostb exit -- 2.34.1

1 0

[PATCH] passt: Address new clang-tidy warnings from LLVM 13.0.1
by Stefano Brivio 31 Jan '22

31 Jan '22

clang-tidy from LLVM 13.0.1 reports some new warnings from these checkers: - altera-unroll-loops, altera-id-dependent-backward-branch: ignore for the moment being, add a TODO item - bugprone-easily-swappable-parameters: ignore, nothing to do about those - readability-function-cognitive-complexity: ignore for the moment being, add a TODO item - altera-struct-pack-align: ignore, alignment is forced in protocol headers - concurrency-mt-unsafe: ignore for the moment being, add a TODO item Fix bugprone-implicit-widening-of-multiplication-result warnings, though, that's doable and they seem to make sense. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 24 +++++++++++++++++++++++- checksum.c | 7 +++++-- conf.c | 4 ++-- dhcp.c | 8 ++++---- qrap.c | 2 +- tap.c | 8 ++++---- tcp.c | 10 +++++----- util.c | 8 +++++--- util.h | 6 +++--- 9 files changed, 52 insertions(+), 25 deletions(-) diff --git a/Makefile b/Makefile index 443c39d..5085578 100644 --- a/Makefile +++ b/Makefile @@ -167,6 +167,23 @@ pkgs: # # - bugprone-suspicious-string-compare # Return value of memcmp(), not really suspicious +# +# - altera-unroll-loops +# - altera-id-dependent-backward-branch +# TODO: check paths where it might make sense to improve performance +# +# - bugprone-easily-swappable-parameters +# Not much can be done about them other than being careful +# +# - readability-function-cognitive-complexity +# TODO: split reported functions +# +# - altera-struct-pack-align +# "Poor" alignment needed for structs reflecting message formats/headers +# +# - concurrency-mt-unsafe +# TODO: check again if multithreading is implemented + clang-tidy: $(wildcard *.c) $(wildcard *.h) clang-tidy -checks=*,-modernize-*,\ -clang-analyzer-valist.Uninitialized,\ @@ -187,7 +204,12 @@ clang-tidy: $(wildcard *.c) $(wildcard *.h) -bugprone-narrowing-conversions,\ -cppcoreguidelines-narrowing-conversions,\ -cppcoreguidelines-avoid-non-const-global-variables,\ - -bugprone-suspicious-string-compare \ + -bugprone-suspicious-string-compare,\ + -altera-unroll-loops,-altera-id-dependent-backward-branch,\ + -bugprone-easily-swappable-parameters,\ + -readability-function-cognitive-complexity,\ + -altera-struct-pack-align,\ + -concurrency-mt-unsafe \ --warnings-as-errors=* $(wildcard *.c) -- $(CFLAGS) ifeq ($(shell $(CC) -v 2>&1 | grep -c "gcc version"),1) diff --git a/checksum.c b/checksum.c index c9905d1..acb1e3e 100644 --- a/checksum.c +++ b/checksum.c @@ -108,10 +108,13 @@ uint16_t csum_unaligned(const void *buf, size_t len, uint32_t init) */ void csum_tcp4(struct iphdr *iph) { - struct tcphdr *th = (struct tcphdr *)((char *)iph + iph->ihl * 4); - uint16_t tlen = ntohs(iph->tot_len) - iph->ihl * 4, *p = (uint16_t *)th; + uint16_t tlen = ntohs(iph->tot_len) - iph->ihl * 4, *p; + struct tcphdr *th; uint32_t sum = 0; + th = (struct tcphdr *)((char *)iph + (intptr_t)(iph->ihl * 4)); + p = (uint16_t *)th; + sum += (iph->saddr >> 16) & 0xffff; sum += iph->saddr & 0xffff; sum += (iph->daddr >> 16) & 0xffff; diff --git a/conf.c b/conf.c index 9a9dade..abe63a1 100644 --- a/conf.c +++ b/conf.c @@ -867,7 +867,7 @@ void conf(struct ctx *c, int argc, char **argv) for (i = 0; i < ETH_ALEN; i++) { errno = 0; - b = strtol(optarg + i * 3, NULL, 16); + b = strtol(optarg + (intptr_t)i * 3, NULL, 16); if (b < 0 || b > UCHAR_MAX || errno) { err("Invalid MAC address: %s", optarg); usage(argv[0]); @@ -1032,7 +1032,7 @@ void conf(struct ctx *c, int argc, char **argv) case 'M': for (i = 0; i < ETH_ALEN; i++) { errno = 0; - b = strtol(optarg + i * 3, NULL, 16); + b = strtol(optarg + (intptr_t)i * 3, NULL, 16); if (b < 0 || b > UCHAR_MAX || errno) { err("Invalid MAC address: %s", optarg); usage(argv[0]); diff --git a/dhcp.c b/dhcp.c index 0d6d698..a052397 100644 --- a/dhcp.c +++ b/dhcp.c @@ -271,10 +271,10 @@ int dhcp(struct ctx *c, struct ethhdr *eh, size_t len) if (len < sizeof(*eh) + sizeof(*iph)) return 0; - if (len < sizeof(*eh) + iph->ihl * 4 + sizeof(*uh)) + if (len < sizeof(*eh) + (long)iph->ihl * 4 + sizeof(*uh)) return 0; - uh = (struct udphdr *)((char *)iph + iph->ihl * 4); + uh = (struct udphdr *)((char *)iph + (long)(iph->ihl * 4)); m = (struct msg *)(uh + 1); if (uh->dest != htons(67)) @@ -283,7 +283,7 @@ int dhcp(struct ctx *c, struct ethhdr *eh, size_t len) if (c->no_dhcp) return 1; - mlen = len - sizeof(*eh) - iph->ihl * 4 - sizeof(*uh); + mlen = len - sizeof(*eh) - (long)iph->ihl * 4 - sizeof(*uh); if (mlen != ntohs(uh->len) - sizeof(*uh) || mlen < offsetof(struct msg, o) || m->op != BOOTREQUEST) @@ -349,7 +349,7 @@ int dhcp(struct ctx *c, struct ethhdr *eh, size_t len) iph->daddr = c->addr4; iph->saddr = c->gw4; iph->check = 0; - iph->check = csum_unaligned(iph, iph->ihl * 4, 0); + iph->check = csum_unaligned(iph, (intptr_t)(iph->ihl * 4), 0); len += sizeof(*eh); memcpy(eh->h_dest, eh->h_source, ETH_ALEN); diff --git a/qrap.c b/qrap.c index 1eb82fa..3ee73a7 100644 --- a/qrap.c +++ b/qrap.c @@ -111,7 +111,7 @@ void usage(const char *name) */ int main(int argc, char **argv) { - struct timeval tv = { .tv_sec = 0, .tv_usec = 500 * 1000 }; + struct timeval tv = { .tv_sec = 0, .tv_usec = (long)(500 * 1000) }; int i, s, qemu_argc = 0, addr_map = 0, has_dev = 0; char *qemu_argv[ARG_MAX], dev_str[ARG_MAX]; struct sockaddr_un addr = { diff --git a/tap.c b/tap.c index 34a5705..22db9c5 100644 --- a/tap.c +++ b/tap.c @@ -131,7 +131,7 @@ void tap_ip_send(struct ctx *c, struct in6_addr *src, uint8_t proto, memcpy(&iph->saddr, &src->s6_addr[12], 4); iph->check = 0; - iph->check = csum_unaligned(iph, iph->ihl * 4, 0); + iph->check = csum_unaligned(iph, (size_t)iph->ihl * 4, 0); memcpy(data, in, len); @@ -337,9 +337,9 @@ resume: continue; iph = (struct iphdr *)(eh + 1); - if ((iph->ihl * 4) + sizeof(*eh) > len) + if ((size_t)iph->ihl * 4 + sizeof(*eh) > len) continue; - if (iph->ihl * 4 < (int)sizeof(*iph)) + if ((size_t)iph->ihl * 4 < (int)sizeof(*iph)) continue; if (iph->saddr && c->addr4_seen != iph->saddr) { @@ -347,7 +347,7 @@ resume: proto_update_l2_buf(NULL, NULL, &c->addr4_seen); } - l4h = (char *)iph + iph->ihl * 4; + l4h = (char *)iph + (size_t)iph->ihl * 4; l4_len = len - ((intptr_t)l4h - (intptr_t)eh); if (iph->protocol == IPPROTO_ICMP) { diff --git a/tcp.c b/tcp.c index 7122898..723b18e 100644 --- a/tcp.c +++ b/tcp.c @@ -345,7 +345,7 @@ #define TCP_TAP_FRAMES 256 -#define MAX_PIPE_SIZE (2 * 1024 * 1024) +#define MAX_PIPE_SIZE (2UL * 1024 * 1024) #define TCP_HASH_TABLE_LOAD 70 /* % */ #define TCP_HASH_TABLE_SIZE (MAX_TAP_CONNS * 100 / \ @@ -1040,8 +1040,8 @@ static int tcp_opt_get(struct tcphdr *th, size_t len, uint8_t type_search, uint8_t type, optlen; char *p; - if (len > (unsigned)th->doff * 4) - len = th->doff * 4; + if (len > (size_t)th->doff * 4) + len = (size_t)th->doff * 4; len -= sizeof(*th); p = (char *)(th + 1); @@ -1568,7 +1568,7 @@ static int tcp_update_seqack_wnd(struct ctx *c, struct tcp_tap_conn *conn, #else if (conn->state > ESTABLISHED || (flags & (DUP_ACK | FORCE_ACK)) || conn->local || tcp_rtt_dst_low(conn) || - conn->snd_buf < SNDBUF_SMALL) { + (unsigned long)conn->snd_buf < SNDBUF_SMALL) { conn->seq_ack_to_tap = conn->seq_from_tap; } else if (conn->seq_ack_to_tap != conn->seq_from_tap) { if (!tinfo) { @@ -2393,7 +2393,7 @@ static void tcp_data_from_tap(struct ctx *c, struct tcp_tap_conn *conn, return; } - off = th->doff * 4; + off = (size_t)th->doff * 4; if (off < sizeof(*th) || off > len) { tcp_rst(c, conn); return; diff --git a/util.c b/util.c index 46a539b..57b987a 100644 --- a/util.c +++ b/util.c @@ -51,7 +51,7 @@ void name(const char *format, ...) { \ clock_gettime(CLOCK_REALTIME, &tp); \ fprintf(stderr, "%li.%04li: ", \ tp.tv_sec - log_debug_start, \ - tp.tv_nsec / (100 * 1000)); \ + tp.tv_nsec / (100L * 1000)); \ } else { \ va_start(args, format); \ passt_vsyslog(level, format, args); \ @@ -305,12 +305,14 @@ void sock_probe_mem(struct ctx *c) sl = sizeof(v); if (setsockopt(s, SOL_SOCKET, SO_SNDBUF, &v, sizeof(v)) || - getsockopt(s, SOL_SOCKET, SO_SNDBUF, &v, &sl) || v < SNDBUF_BIG) + getsockopt(s, SOL_SOCKET, SO_SNDBUF, &v, &sl) || + (size_t)v < SNDBUF_BIG) c->low_wmem = 1; v = INT_MAX / 2; if (setsockopt(s, SOL_SOCKET, SO_RCVBUF, &v, sizeof(v)) || - getsockopt(s, SOL_SOCKET, SO_RCVBUF, &v, &sl) || v < RCVBUF_BIG) + getsockopt(s, SOL_SOCKET, SO_RCVBUF, &v, &sl) || + (size_t)v < RCVBUF_BIG) c->low_rmem = 1; close(s); diff --git a/util.h b/util.h index 800a91d..add4c1e 100644 --- a/util.h +++ b/util.h @@ -144,9 +144,9 @@ enum { .daddr = IN6ADDR_ANY_INIT, \ } -#define RCVBUF_BIG (2 * 1024 * 1024) -#define SNDBUF_BIG (4 * 1024 * 1024) -#define SNDBUF_SMALL (128 * 1024) +#define RCVBUF_BIG (2UL * 1024 * 1024) +#define SNDBUF_BIG (4UL * 1024 * 1024) +#define SNDBUF_SMALL (128UL * 1024) #include <net/if.h> #include <limits.h> -- 2.34.1

1 0

[PATCH 0/4] Proof-of-concept for Kata Containers integration
by Stefano Brivio 28 Jan '22

28 Jan '22

This series adds a proof-of-concept for Kata Containers using passt as an endpoint for user-mode networking, and related prerequisites. Stefano Brivio (4): passt, tap: Daemonise once socket is ready without waiting for connection qemu: Rebase patch for UNIX domain socket support to latest upstream libvirt, qemu: Move patches to new directory, contrib contrib: Introduce PoC for Kata Containers with user-mode networking ...gent-Add-passt-networking-model-and-.patch | 462 ++++++++++++++++++ contrib/kata-containers/README.md | 302 ++++++++++++ ...upport-for-UNIX-domain-socket-as-qem.patch | 0 ...NIX-domain-sockets-to-be-used-as-net.patch | 63 +-- ...e-EINVAL-on-netdev-socket-connection.patch | 0 passt.c | 6 +- tap.c | 62 ++- tap.h | 2 +- tcp.c | 2 +- 9 files changed, 833 insertions(+), 66 deletions(-) create mode 100644 contrib/kata-containers/0001-virtcontainers-agent-Add-passt-networking-model-and-.patch create mode 100644 contrib/kata-containers/README.md rename {libvirt => contrib/libvirt}/0001-conf-Introduce-support-for-UNIX-domain-socket-as-qem.patch (100%) rename {qemu => contrib/qemu}/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch (71%) rename {qemu => contrib/qemu}/0002-net-Don-t-ignore-EINVAL-on-netdev-socket-connection.patch (100%) -- 2.33.0

1 4

[PATCH 0/4] Tests for multiple architectures and distributions
by Stefano Brivio 28 Jan '22

28 Jan '22

This series adds tests for a mix of old and new Debian, Fedora, OpenSUSE and Ubuntu versions, on on aarch64, i386, ppc64, ppc64le, s390x, x86_64, plus prerequisites for these tests and some basic documentation about the testing framework itself. Stefano Brivio (4): test/lib/term: Allow for a wider variety of prompt characters in pane_wait() test/lib/test: Introduce 'def' directive for frequently used patterns test: Add distribution tests for several architectures and kernel versions test: Add basic documentation about test suite, and cool-retro-term profile README.md | 4 +- test/README.md | 104 ++++++++ test/distro/debian | 343 ++++++++++++++++++++++++++ test/distro/fedora | 563 +++++++++++++++++++++++++++++++++++++++++++ test/distro/opensuse | 182 ++++++++++++++ test/distro/ubuntu | 208 ++++++++++++++++ test/lib/term | 17 +- test/lib/test | 496 ++++++++++++++++++++------------------ test/run | 1 + 9 files changed, 1680 insertions(+), 238 deletions(-) create mode 100644 test/README.md create mode 100644 test/distro/debian create mode 100644 test/distro/fedora create mode 100644 test/distro/opensuse create mode 100644 test/distro/ubuntu -- 2.33.0

1 4

[PATCH 00/22] Fixes for non-x86_64, older kernels/glibc, and some more
by Stefano Brivio 28 Jan '22

28 Jan '22

This series carries fixes for issues that emerged from testing on architectures other than x86_64, older kernels and older versions of gcc and glibc (1/22 to 7/22, 9/22, 11/22 to 12/22), some logic bugs that appeared during further testing (8/22, 10/22, 20/22) and fixes for tests, scripts and documentation (remaining patches). passt and pasta should now work on multiple architectures, build starting from gcc 4.7 and glibc 2.19, and actually work on kernel versions >= 4.4 with glibc >= 2.25. Tests checking this are introduced in the next series. Note to package maintainers: ausyscall(8) is not used anymore to generate seccomp profiles. Stefano Brivio (22): tcp: Cover all usages of tcpi_snd_wnd with HAS_SND_WND tap, tcp: Fix two comparisons with different signedness reported by gcc 7 passt: Drop <linux/ipv6.h> include, carry own ipv6hdr and opt_hdr definitions Makefile, seccomp: Fix build for i386, ppc64, ppc64le util: Fall-back definitions for SECCOMP_RET_KILL_PROCESS, ETH_{MAX,MIN}_MTU seccomp: Introduce mechanism to allow per-arch syscalls tcp, netlink, HAS{BYTES_ACKED,MIN_RTT,GETRANDOM} and NETLINK_GET_STRICT_CHK conf, pasta: Explicitly pass CLONE_{NEWUSER,NEWNET} to setns() tcp, udp, util: Fixes for bitmap handling on big-endian, casts netlink: Fix swapped v4/v6-only flags in external interface detection pasta: Check for zero d_reclen returned by getdents64() syscall tcp: Don't round down MSS to >= 64KiB page size, but clamp it in any case seccomp: Add a number of alternate and per-arch syscalls demo/pasta: Don't wait for pasta to return to a prompt test/two_guests: Drop stray spaces after sleep directives perf/passt_udp: Lower failure throughput thresholds with big MTUs test/lib/setup: Don't rely on IFS to properly separate qemu arguments test/lib/video: Drop -preset ultrafast from ffmpeg arguments hooks/pre-push: Delete old versions, add -DGLIBC_NO_STATIC_NSS, disable legacy builds conf: Fix support for --stderr as short option (-e) README: Fix anchor for Performance section README: Fix link to IGMP/MLD proxy ticket Makefile | 29 ++++++++++++++++++-- README.md | 6 ++-- arp.c | 2 -- conf.c | 18 ++++++++---- dhcp.c | 2 -- dhcpv6.c | 2 -- hooks/pre-push | 18 +++++++----- icmp.c | 1 - ndp.c | 1 - netlink.c | 14 ++++++---- passt.c | 17 +++++++----- passt.h | 3 +- pasta.c | 13 +++++---- pcap.c | 2 -- qrap.c | 2 -- seccomp.sh | 63 +++++++++++++++++++++++++++++++++++------- tap.c | 5 ++-- tcp.c | 51 +++++++++++++++++++++++++++++----- test/demo/pasta | 2 +- test/lib/setup | 64 +++++++++++++++++++++---------------------- test/lib/video | 2 +- test/perf/passt_udp | 8 +++--- test/two_guests/basic | 8 +++--- udp.c | 6 ++-- util.c | 18 +++++++----- util.h | 40 +++++++++++++++++++++++++++ 26 files changed, 275 insertions(+), 122 deletions(-) -- 2.33.0

1 22