- dev - passt

[PATCH v9 0/5] Retry SYNs for inbound connections
by Yumei Huang 01 Dec '25

01 Dec '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism using the similar backoff timeout as linux kernel. Also update the data retransmission timeout using the backoff timeout. v9: - Squash the patch of adding parameter c to tcp_timer_ctl() into the later one - Fix the cppcheck error - Update the return values of read_file(), remove the error message of it and add check for buf_size - Rename RTO_INIT_ACK to RTO_INIT_AFTER_SYN_RETRIES - Round up rto_max, fix the conversion in subtraction - Some other minor fixes related to wording v8: - Remove the TCP_/tcp_ suffix from certain macro and struct member names - Add parameter struct ctx *c to tcp_timer_ctl() - Modify rto_max type from size_t to int - Clamp syn_retries and syn_linear_timeouts with MAX_SYNCNT(127) - Some other minor fixes related to wording and formatting v7: - Update read_file() and read_file_integer() - Rename tcp_syn_params_init() to tcp_get_rto_params() - Modify the implementation of the timeout assignment - Add a patch to clamp the retry timeout Yumei Huang (5): tcp: Rename "retrans" to "retries" util: Introduce read_file() and read_file_integer() function tcp: Resend SYN for inbound connections tcp: Update data retransmission timeout tcp: Clamp the retry timeout tcp.c | 107 +++++++++++++++++++++++++++++++++++++++-------------- tcp.h | 6 +++ tcp_conn.h | 13 ++++--- util.c | 90 ++++++++++++++++++++++++++++++++++++++++++++ util.h | 1 + 5 files changed, 184 insertions(+), 33 deletions(-) -- 2.51.1

3 12

[PATCH 0/3] More graceful handling of kernels without SO_BINDTODEVICE
by David Gibson 28 Nov '25

28 Nov '25

Kernels before v5.7 don't allow unprivileged processes to use the SO_BINDTODEVICE socket option, which is how we implement per-device listening (e.g. "-t ""%eth0/80"). Currently we detect this error quite late, and don't produce a particularly helpful error message. Improve error messages in this case by explicitly probing for support of the option early. More importantly this will allow me to implement fallback handling for older kernels in upcoming socket binding cleanups. Note: this series applies directly on the current main branch, I'm going to rebase my socket binding series on top of this, instead of the other way around. David Gibson (3): util: Correct error message on SO_BINDTODEVICE failure util: Extend sock_probe_mem() to sock_probe_features() conf: More useful errors for kernels without SO_BINDTODEVICE conf.c | 6 ++++++ passt.c | 2 +- passt.h | 1 + util.c | 26 +++++++++++++++++++++----- util.h | 2 +- 5 files changed, 30 insertions(+), 7 deletions(-) -- 2.51.1

1 2

[PATCH 2/3] util: Extend sock_probe_mem() to sock_probe_features()
by David Gibson 28 Nov '25

28 Nov '25

sock_probe_mem() currently checks whether we're able to allocate large socket buffers. Extend it to also check whether the SO_BINDTODEVICE socket option is available. Rename to sock_probe_features() to reflect the new functionality. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.c | 2 +- passt.h | 1 + util.c | 19 +++++++++++++++++-- util.h | 2 +- 4 files changed, 20 insertions(+), 4 deletions(-) diff --git a/passt.c b/passt.c index 4964427d..0b84ac6c 100644 --- a/passt.c +++ b/passt.c @@ -381,7 +381,7 @@ int main(int argc, char **argv) if (setrlimit(RLIMIT_NOFILE, &limit)) die_perror("Failed to set current limit for open files"); - sock_probe_mem(&c); + sock_probe_features(&c); conf(&c, argc, argv); trace_init(c.trace); diff --git a/passt.h b/passt.h index 15801b44..e7c1710a 100644 --- a/passt.h +++ b/passt.h @@ -281,6 +281,7 @@ struct ctx { int low_wmem; int low_rmem; + int no_bindtodevice; struct vu_dev *vdev; diff --git a/util.c b/util.c index 347f34f5..bad38129 100644 --- a/util.c +++ b/util.c @@ -233,12 +233,13 @@ int sock_unix(char *sock_path) } /** - * sock_probe_mem() - Check if setting high SO_SNDBUF and SO_RCVBUF is allowed + * sock_probe_features() - Probe for socket features we might use * @c: Execution context */ -void sock_probe_mem(struct ctx *c) +void sock_probe_features(struct ctx *c) { int v = INT_MAX / 2, s; + const char lo[] = "lo"; socklen_t sl; s = socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, IPPROTO_TCP); @@ -247,6 +248,7 @@ void sock_probe_mem(struct ctx *c) return; } + /* Check if setting high SO_SNDBUF and SO_RCVBUF is allowed */ sl = sizeof(v); if (setsockopt(s, SOL_SOCKET, SO_SNDBUF, &v, sizeof(v)) || getsockopt(s, SOL_SOCKET, SO_SNDBUF, &v, &sl) || @@ -259,6 +261,19 @@ void sock_probe_mem(struct ctx *c) (size_t)v < RCVBUF_BIG) c->low_rmem = 1; + /* Check if SO_BINDTODEVICE is available + * + * Supported since kernel version 5.7, commit c427bfec18f2 ("net: core: + * enable SO_BINDTODEVICE for non-root users"). Some distro kernels may + * have backports, of course. Record whether we can use it so that we + * can give more useful diagnostics. + */ + if (setsockopt(s, SOL_SOCKET, SO_BINDTODEVICE, lo, sizeof(lo)-1)) { + if (errno != EPERM) + warn_perror("Unexpected error probing SO_BINDTODEVICE"); + c->no_bindtodevice = 1; + } + close(s); } diff --git a/util.h b/util.h index a0b2ada6..200b6408 100644 --- a/util.h +++ b/util.h @@ -211,7 +211,7 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, const void *sa, socklen_t sl, const char *ifname, bool v6only); int sock_unix(char *sock_path); -void sock_probe_mem(struct ctx *c); +void sock_probe_features(struct ctx *c); long timespec_diff_ms(const struct timespec *a, const struct timespec *b); int64_t timespec_diff_us(const struct timespec *a, const struct timespec *b); void bitmap_set(uint8_t *map, unsigned bit); -- 2.51.1

1 0

[PATCH v2 0/6] vhost-user: Add multiqueue support
by Laurent Vivier 28 Nov '25

28 Nov '25

This series implements multiqueue support for vhost-user mode, allowing passt to utilize multiple queue pairs. There is no improved network performance because we keep using only one thread. The implementation introduces a --max-queues parameter to configure up to 16 queue pairs (32 virtqueues) in vhost-user mode. Packets are routed to the appropriate RX queue based on which TX queue they originated from, enabling the guest kernel to distribute network traffic across multiple queues and vCPUs. This series adds: - configuration support for multiqueue via --max-queues parameter - one packet pool per queue pair instead of shared pools - queue parameter threading throughout the network stack - a significant refactoring that propagates queue information through all protocol handlers (TCP, UDP, ICMP, ARP, DHCP, DHCPv6, NDP) - flow-aware queue routing that matches RX queue selection to the incoming TX queue, maintaining proper packet affinity - test coverage with VHOST_USER_MQ environment variable to validate multiqueue functionality across all protocols (TCP, UDP, ICMP) and services (DHCP, NDP) Current behavior: TX queue selection is controlled by the guest kernel, while RX packets are routed to queues based on their associated flows. Host-initiated flows currently default to queue 0. The RX queue of a flow is updated on each new packet from the TX queue to maintain affinity. The changes maintain backward compatibility - without --max-queues, behavior remains unchanged with single-queue operation. v2: - New patch: "tap: Remove pool parameter from tap4_handler() and tap6_handler()" to clean up unused parameters before adding queue pair parameter - Changed to one packet pool per queue pair instead of shared pools across all queue pairs - Split "multiqueue: Add queue-aware flow management..." into two patches: - "tap: Add queue pair parameter throughout the packet processing path" - "flow: Add queue pair tracking to flow management" - Updated test infrastructure patch with refined implementation Laurent Vivier (6): tap: Remove pool parameter from tap4_handler() and tap6_handler() vhost-user: Enable multiqueue vhost-user: Add queue pair parameter throughout the network stack tap: Add queue pair parameter throughout the packet processing path flow: Add queue pair tracking to flow management test: Add multiqueue support to vhost-user test infrastructure arp.c | 12 ++-- arp.h | 4 +- conf.c | 31 ++++++++- dhcp.c | 5 +- dhcp.h | 2 +- dhcpv6.c | 12 ++-- dhcpv6.h | 2 +- flow.c | 30 +++++++++ flow.h | 17 +++++ fwd.c | 4 +- icmp.c | 25 ++++--- icmp.h | 2 +- ndp.c | 32 +++++---- ndp.h | 5 +- passt.h | 2 + tap.c | 173 +++++++++++++++++++++++++++++-------------------- tap.h | 20 +++--- tcp.c | 66 +++++++++++-------- tcp.h | 11 ++-- tcp_vu.c | 8 ++- test/lib/setup | 58 +++++++++++++---- test/run | 23 +++++++ udp.c | 39 ++++++----- udp.h | 12 ++-- udp_flow.c | 8 ++- udp_flow.h | 2 +- udp_vu.c | 4 +- vhost_user.c | 38 ++++++----- virtio.h | 2 +- vu_common.c | 15 +++-- vu_common.h | 3 +- 31 files changed, 443 insertions(+), 224 deletions(-) -- 2.51.0

2 16

[PATCH] arp/ndp: don't send messages on uninitialized tap interface
by Jon Maloy 27 Nov '25

27 Nov '25

When running pasta without --config-net, the tap interface is opened and assigned a valid file descriptor, but intentionally not brought up in the namespace. This is the expected behavior when the user wants to configure the namespace manually. However, in PASTA mode the code is attempting to send ARP announcements and NDP messages (initial requests and unsolicited NAs) based solely on whether c->fd_tap is valid, without checking if the interface actually is up and ready to transmit. This results in send failures, and when debug is activated (pasta -d) we see error printouts for these early messages. We now add new function tap_is_ready() which checks both conditions: - Whether fd_tap is valid (all modes) - Whether the tap interface is up (pasta mode only). In this mode, we use the existing c->pasta_conf_ns flag, which indicates whether pasta_ns_conf() configured and brought up the interface. This test is simple, and good enough for now. We update all functions that send unsolicited ARP/NDP messages to check with the new function before making any send attempt. This eliminates spurious send errors when starting pasta without --config-net, while preserving correct behavior when the interface is properly initialized. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- arp.c | 3 +++ ndp.c | 5 +++-- tap.c | 27 +++++++++++++++++++++++++++ tap.h | 1 + 4 files changed, 34 insertions(+), 2 deletions(-) diff --git a/arp.c b/arp.c index 33b03cf..bb042e9 100644 --- a/arp.c +++ b/arp.c @@ -168,6 +168,9 @@ void arp_announce(const struct ctx *c, struct in_addr *ip, struct arpmsg am; } __attribute__((__packed__)) msg; + if (!tap_is_ready(c)) + return; + /* Ethernet header */ msg.eh.h_proto = htons(ETH_P_ARP); memcpy(msg.eh.h_dest, MAC_BROADCAST, sizeof(msg.eh.h_dest)); diff --git a/ndp.c b/ndp.c index a33239d..eb9e313 100644 --- a/ndp.c +++ b/ndp.c @@ -227,7 +227,8 @@ static void ndp_na(const struct ctx *c, const struct in6_addr *dst, */ void ndp_unsolicited_na(const struct ctx *c, const struct in6_addr *addr) { - ndp_na(c, &in6addr_ll_all_nodes, addr); + if (tap_is_ready(c)) + ndp_na(c, &in6addr_ll_all_nodes, addr); } /** @@ -411,7 +412,7 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) time_t max_rtr_adv_interval = DEFAULT_MAX_RTR_ADV_INTERVAL; time_t min_rtr_adv_interval, interval; - if (c->fd_tap < 0 || c->no_ra || now->tv_sec < next_ra) + if (!tap_is_ready(c) || c->no_ra || now->tv_sec < next_ra) return; /* We must advertise before the route's lifetime expires */ diff --git a/tap.c b/tap.c index bb139d6..44b0644 100644 --- a/tap.c +++ b/tap.c @@ -1339,6 +1339,30 @@ static void tap_sock_unix_init(const struct ctx *c) epoll_add(c->epollfd, EPOLLIN | EPOLLET, ref); } +/** + * tap_is_ready() - Check if tap interface is ready to send packets + * @c: Execution context + * + * For pasta mode, checks if the tap interface is up. + * For other modes, just checks if fd_tap is valid. + * + * Return: true if ready, false otherwise + */ +bool tap_is_ready(const struct ctx *c) +{ + if (c->fd_tap < 0) + return false; + + if (c->mode == MODE_PASTA) { + /* If pasta_conf_ns is set, the interface was configured and + * brought up during initialization. If not, it's still down. + */ + return c->pasta_conf_ns; + } + + return true; +} + /** * tap_start_connection() - start a new connection * @c: Execution context @@ -1362,6 +1386,9 @@ static void tap_start_connection(const struct ctx *c) epoll_add(c->epollfd, EPOLLIN | EPOLLRDHUP, ref); + if (!tap_is_ready(c)) + return; + if (c->ifi4) arp_send_init_req(c); if (c->ifi6 && !c->no_ndp) diff --git a/tap.h b/tap.h index 1864173..ee22a9d 100644 --- a/tap.h +++ b/tap.h @@ -109,6 +109,7 @@ size_t tap_send_frames(const struct ctx *c, const struct iovec *iov, size_t bufs_per_frame, size_t nframes); void eth_update_mac(struct ethhdr *eh, const unsigned char *eth_d, const unsigned char *eth_s); +bool tap_is_ready(const struct ctx *c); void tap_listen_handler(struct ctx *c, uint32_t events); void tap_handler_pasta(struct ctx *c, uint32_t events, const struct timespec *now); -- 2.51.1

2 1

[PATCH] test: Fix IPv6 address/prefix mismatch error
by Yumei Huang 27 Nov '25

27 Nov '25

For IPv6 addresses within the same scope group, Linux kernel preserves insertion order, where the first inserted address appears last. As a result, the ordering inside pasta differs from the host, causing a few tests to fail when they compare only the first address on each side. Fix this by checking that the guest’s first address matches any of the host’s addresses. Link: https://bugs.passt.top/show_bug.cgi?id=175 Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/migrate/basic | 4 ++-- test/migrate/basic_fin | 4 ++-- test/migrate/iperf3_bidir6 | 4 ++-- test/migrate/iperf3_in6 | 4 ++-- test/migrate/iperf3_many_out6 | 4 ++-- test/migrate/iperf3_out6 | 4 ++-- test/migrate/rampstream_in | 4 ++-- test/migrate/rampstream_out | 4 ++-- test/passt/dhcp | 4 ++-- test/passt/ndp | 6 +++--- test/passt_in_ns/dhcp | 4 ++-- test/pasta/dhcp | 4 ++-- test/pasta/ndp | 6 +++--- test/two_guests/basic | 6 +++--- 14 files changed, 31 insertions(+), 31 deletions(-) diff --git a/test/migrate/basic b/test/migrate/basic index c22fee8..bab2d76 100644 --- a/test/migrate/basic +++ b/test/migrate/basic @@ -39,8 +39,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv4: guest1/guest2 > host g1out GW1 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/migrate/basic_fin b/test/migrate/basic_fin index c35c269..1d92c92 100644 --- a/test/migrate/basic_fin +++ b/test/migrate/basic_fin @@ -39,8 +39,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv4: guest1, half-close, guest2 > host g1out GW1 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/migrate/iperf3_bidir6 b/test/migrate/iperf3_bidir6 index 60b2a9b..e95eee8 100644 --- a/test/migrate/iperf3_bidir6 +++ b/test/migrate/iperf3_bidir6 @@ -44,8 +44,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv6 host <-> guest flood, many flows, during migration diff --git a/test/migrate/iperf3_in6 b/test/migrate/iperf3_in6 index 9b7f2c6..0e863a4 100644 --- a/test/migrate/iperf3_in6 +++ b/test/migrate/iperf3_in6 @@ -44,8 +44,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv6 host to guest throughput during migration diff --git a/test/migrate/iperf3_many_out6 b/test/migrate/iperf3_many_out6 index 9b3095f..179e269 100644 --- a/test/migrate/iperf3_many_out6 +++ b/test/migrate/iperf3_many_out6 @@ -44,8 +44,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv6 guest to host flood, many flows, during migration diff --git a/test/migrate/iperf3_out6 b/test/migrate/iperf3_out6 index b94a70c..20e6e95 100644 --- a/test/migrate/iperf3_out6 +++ b/test/migrate/iperf3_out6 @@ -44,8 +44,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv6 guest to host throughput during migration diff --git a/test/migrate/rampstream_in b/test/migrate/rampstream_in index 3c7fd20..5212dfc 100644 --- a/test/migrate/rampstream_in +++ b/test/migrate/rampstream_in @@ -40,8 +40,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv4: sequence check, ramps, inbound g1out GW1 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/migrate/rampstream_out b/test/migrate/rampstream_out index 8cff6d9..897396d 100644 --- a/test/migrate/rampstream_out +++ b/test/migrate/rampstream_out @@ -40,8 +40,8 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" test TCP/IPv4: sequence check, ramps, outbound g1out GW1 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/passt/dhcp b/test/passt/dhcp index dc6b880..904faab 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -61,8 +61,8 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR6__" test DHCPv6: route gout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/passt/ndp b/test/passt/ndp index df77cdc..80b72bb 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -25,9 +25,9 @@ check [ -n "__IFNAME__" ] test SLAAC: prefix gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' gout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 -check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join("/64 ")' +hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 | tr '\n' ' ' +check echo "__HOST_PREFIX6__" | grep -wq "__PREFIX6__" test SLAAC: route gout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/passt_in_ns/dhcp b/test/passt_in_ns/dhcp index 0ccb480..9d89049 100644 --- a/test/passt_in_ns/dhcp +++ b/test/passt_in_ns/dhcp @@ -55,8 +55,8 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(",")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR6__" test DHCPv6: route gout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/pasta/dhcp b/test/pasta/dhcp index e1c66be..366935f 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -39,8 +39,8 @@ ns /sbin/dhclient -6 --no-pid __IFNAME__ ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ __ADDR6__ = __HOST_ADDR6__ ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR6__" test DHCPv6: route nsout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/pasta/ndp b/test/pasta/ndp index e482876..1d385c7 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -24,9 +24,9 @@ ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select( test SLAAC: prefix nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 -check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local]| join("/64 ")' +hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 | tr '\n' ' ' +check echo "__HOST_PREFIX6__" | grep -wq "__PREFIX6__" test SLAAC: route nsout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/two_guests/basic b/test/two_guests/basic index a9625f3..cb48bce 100644 --- a/test/two_guests/basic +++ b/test/two_guests/basic @@ -45,9 +45,9 @@ guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; guest2 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' g2out ADDR2_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' -check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] -check [ "__ADDR2_6__" = "__HOST_ADDR6__" ] +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | join(" ")' +check echo "__HOST_ADDR6__" | grep -wq "__ADDR1_6__" +check echo "__HOST_ADDR6__" | grep -wq "__ADDR2_6__" test TCP/IPv4: guest 1 > guest 2 g1out GW1 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' -- 2.51.1

3 2

[PATCH v4 0/9] Reduce differences between inbound and outbound socket binding
by David Gibson 26 Nov '25

26 Nov '25

This series is based on my series fixing bug 176 (regression in auto forwarding). The fact that outbound forwarding sockets are bound to the loopback address, whereas inbound forwarding sockets are (by default) bound to the unspecified address leads to some unexpected differences between the paths setting up each of them. An idea for tackling bug 100 suggested a different approach which will also reduce some of those differences and allow more code to be shared between the two paths. I've since discovered that this approach doesn't help for bug 100, but I think it's still worthwhile for other reasons. Patches 1..7/9 are cleanups which shouldn't change behaviour, and I think are ready to merge. 8/9 and 9/9 introduce behavioural changes, but I've made the case for them in the patch comments. v4: - Add cleanup patch removing unused structure field - Rebase, fixing conflicts with Laurent's changes - A bunch of spelling and other cosmetic fixes - Clarify relation to bug 100 and bug 113 v3: - A number of additional fixes covering the handling of IPV6_V6ONLY sockopt - Assorted trivial changes v2: - Some rearrangements and rewordings for clarity David Gibson (9): flow: Remove bogus @path field from flowside_sock_args inany: Let length of sockaddr_inany be implicit from the family util, flow, pif: Simplify sock_l4_sa() interface tcp: Merge tcp_ns_sock_init[46]() into tcp_sock_init_one() udp: Unify some more inbound/outbound parts of udp_sock_init() udp: Move udp_sock_init() special case to its caller util: Fix setting of IPV6_V6ONLY socket option tcp, udp: Remove fallback if creating dual stack socket fails tcp, udp: Bind outbound listening sockets by interface instead of address conf.c | 4 +- flow.c | 22 +++---- icmp.c | 3 +- inany.h | 17 ++++++ pif.c | 27 ++------- pif.h | 2 +- tcp.c | 164 +++++++++++++++++++-------------------------------- tcp.h | 5 +- tcp_splice.c | 5 +- udp.c | 102 +++++++++++++++----------------- udp.h | 5 +- util.c | 76 ++++++++++++++++++++---- util.h | 8 ++- 13 files changed, 221 insertions(+), 219 deletions(-) -- 2.51.1

2 13

[PATCH 0/3] Fix regression in auto port forwarding
by David Gibson 21 Nov '25

21 Nov '25

My recently merged series cleaning up the auto-port-forward scanning contained a series bug: automatic forwards would only appear on alternating seconds. This turned out to be due to a fundamentally broken premise in my thinking. I was thinking that for consistency we wanted the most recent port map information throughout the process. But that's not really true: for the purposes of exclusion what we really need to know is which of the listening sockets we scan are ours. That's given by the *prior* state of the forward maps, not the updated one based on a new scan. The series also had a number of worthwhile changes though. This series fixes it up, by reverting the most misguided of the patches and correcting behaviour of another one while preserving the accompanying code re-orgs. Link: https://bugs.passt.top/show_bug.cgi?id=176 David Gibson (3): Revert "fwd: Update all port maps before applying exclusions" fwd: Exclude ports based on prior mapping state fwd: Don't explicitly exclude reverse-direction TCP ports for UDP fwd.c | 44 ++++++++++++++++++++------------------------ 1 file changed, 20 insertions(+), 24 deletions(-) -- 2.51.1

2 2

[PATCH 3/3] fwd: Preserve non-standard loopback address when splice forwarding
by David Gibson 20 Nov '25

20 Nov '25

When forwarding "spliced" connections outwards (-T or -U) we listen on the guest's loopback and always forward to 127.0.0.1 (or ::1) on the host. However, it's also possible for clients on the guest to attempt connecting to other addresses in 127.0.0.0/8 (systemd-resolved uses 127.0.0.53 in practice). If the host side server is only listening on that specific non-standard loopback address, the forward won't work. Fix this by preserving the specific (loopback) address when forwarding such connections. Link: https://bugs.passt.top/show_bug.cgi?id=113 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fwd.c b/fwd.c index c417e0f5..44a0e109 100644 --- a/fwd.c +++ b/fwd.c @@ -660,7 +660,9 @@ uint8_t fwd_nat_from_splice(const struct ctx *c, uint8_t proto, return PIF_NONE; } - if (inany_v4(&ini->eaddr)) + if (!inany_is_unspecified(&ini->oaddr)) + tgt->eaddr = ini->oaddr; + else if (inany_v4(&ini->oaddr)) tgt->eaddr = inany_loopback4; else tgt->eaddr = inany_loopback6; -- 2.51.1

1 0

[PATCH 2/3] tcp: Always populate oaddr field for socket initiated flows
by David Gibson 20 Nov '25

20 Nov '25

When we receive a TCP connection, we get the peer address from the accept() call. In the case of a listening socket with an unspecified address (:: or 0.0.0.0) the local address of the accept()ed socket could vary. We don't get that from the accept() - we must explicitly call getsockname() to get it. Currently we avoid the latency of that extra syscall, and therefore don't populate the initiating 'oaddr' field of a flow created by an incoming TCP socket connection. This more or less works, because we rarely need that local address, but it does cause some oddities: * For migration we need the local address to recreate the socket on the destination, so we *do* call getsockname() in vhost-user mode * It limits our options in terms of forwarding connections flexibly based on the address to which they're received * It differs from UDP, where we explicitly use the IP_PKTINFO cmsg to populate oaddr. * It means (some) flow debug messages will contain wildcards instead of real local addresses In theory we can elide this call when accept()ing from a socket bound to a specific address instead of a wildcard. However to do that will need revisions to the data structures we use to keep track of listening sockets. The lack of this information is making it hard to implement some fixes we want. So, pay the price of the extra syscall to get this information, with the hope that we can later optimise it away for some cases. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/tcp.c b/tcp.c index bd25952f..e734a957 100644 --- a/tcp.c +++ b/tcp.c @@ -2354,11 +2354,9 @@ void tcp_listen_handler(const struct ctx *c, union epoll_ref ref, ini = flow_initiate_sa(flow, ref.tcp_listen.pif, &sa, NULL, ref.tcp_listen.port); - if (c->mode == MODE_VU) { /* Rebind to same address after migration */ - if (getsockname(s, &sa.sa, &sl) || - inany_from_sockaddr(&ini->oaddr, &ini->oport, &sa) < 0) - err_perror("Can't get local address for socket %i", s); - } + if (getsockname(s, &sa.sa, &sl) || + inany_from_sockaddr(&ini->oaddr, &ini->oport, &sa) < 0) + err_perror("Can't get local address for socket %i", s); if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0) { char sastr[SOCKADDR_STRLEN]; -- 2.51.1

1 0