- dev - passt

[PATCH v2 3/6] cppcheck: Suppress the suppression of a suppression
by David Gibson 02 Oct '25

02 Oct '25

Apparently cppcheck 2.18.3 no longer trips the funcArgNamesDifferent warning on our (re-)definition of close_range(). So instead we get an unmatchedSuppression warning. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- linux_dep.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_dep.h b/linux_dep.h index 1d9e1669..89e590c8 100644 --- a/linux_dep.h +++ b/linux_dep.h @@ -142,7 +142,7 @@ struct tcp_info_linux { #endif __attribute__ ((weak)) -/* cppcheck-suppress funcArgNamesDifferent */ +/* cppcheck-suppress [funcArgNamesDifferent,unmatchedSuppression] */ int close_range(unsigned int first, unsigned int last, int flags) { return syscall(SYS_close_range, first, last, flags); } -- 2.51.0

1 0

[PATCH v2 1/6] test: Add linting of Python test scripts
by David Gibson 02 Oct '25

02 Oct '25

We currently have one test moved to the new exeter based framwork written in Python. We plan to add many more, so add linting (flake8) and type checking (mypy) of those scripts. This can be invoked manually with "make flake8" or "make mypy" in test/, and is also added to the static checkers test set. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/Makefile | 14 +++++++++++++- test/build/build.py | 5 +++-- test/build/static_checkers.sh | 6 +++++- 3 files changed, 21 insertions(+), 4 deletions(-) diff --git a/test/Makefile b/test/Makefile index 49388276..61ccb075 100644 --- a/test/Makefile +++ b/test/Makefile @@ -8,6 +8,8 @@ BATS = bats -j $(shell nproc) EXETOOL = exeter/exetool/exetool WGET = wget -c +FLAKE8 = flake8 +MYPY = mypy --strict DEBIAN_IMGS = debian-8.11.0-openstack-amd64.qcow2 \ debian-10-nocloud-amd64.qcow2 \ @@ -65,11 +67,15 @@ LOCAL_ASSETS = mbuto.img mbuto.mem.img podman/bin/podman QEMU_EFI.fd \ ASSETS = $(DOWNLOAD_ASSETS) $(LOCAL_ASSETS) EXETER_PYPATH = exeter/py3 +EXETER_PYTHON = build/build.py EXETER_BATS = smoke/smoke.sh.bats \ - build/build.py.bats build/static_checkers.sh.bats + $(EXETER_PYTHON:%=%.bats) build/static_checkers.sh.bats BATS_FILES = $(EXETER_BATS) \ podman/test/system/505-networking-pasta.bats +# Python test code (for linters) +PYPKGS = $(EXETER_PYTHON) + CFLAGS = -Wall -Werror -Wextra -pedantic -std=c99 assets: $(ASSETS) @@ -128,6 +134,12 @@ medium.bin: big.bin: dd if=/dev/urandom bs=1M count=10 of=$@ +flake8: pull-exeter + PYTHONPATH=$(EXETER_PYPATH) $(FLAKE8) $(PYPKGS) + +mypy: pull-exeter + PYTHONPATH=$(EXETER_PYPATH) $(MYPY) $(PYPKGS) + $(EXETER_BATS): %.bats: % $(EXETOOL) PYTHONPATH=$(EXETER_PYPATH) $(EXETOOL) bats -- $< > $@ diff --git a/test/build/build.py b/test/build/build.py index e49287c9..e3de8305 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -18,11 +18,12 @@ import os from pathlib import Path import subprocess import tempfile -from typing import Iterable, Iterator +from typing import Iterator import exeter -def sh(cmd): + +def sh(cmd: str) -> None: """Run given command in a shell""" subprocess.run(cmd, shell=True) diff --git a/test/build/static_checkers.sh b/test/build/static_checkers.sh index 42806e79..228b99ae 100755 --- a/test/build/static_checkers.sh +++ b/test/build/static_checkers.sh @@ -21,6 +21,10 @@ exeter_set_description cppcheck "passt sources pass cppcheck" exeter_register clang_tidy make -C .. clang-tidy exeter_set_description clang_tidy "passt sources pass clang-tidy" -exeter_main "$@" +exeter_register flake8 make flake8 +exeter_set_description flake8 "passt tests in Python pass flake8" +exeter_register mypy make mypy +exeter_set_description mypy "passt tests in Python pass mypy --strict" +exeter_main "$@" -- 2.51.0

1 0

[PATCH 0/6] Test and linter fixups
by David Gibson 02 Oct '25

02 Oct '25

Before starting to convert testcases to use tunbridge, I wanted to add linting for the Python test scripts. While doing that I discovered a new crop of cppcheck and clang-tidy false positives, and a Makefile bug. Here's a batch of fixes. I didn't manage to get through the whole testsuite with this. I keep getting hangs on rampstream_out, which I *think* are unrelated. David Gibson (6): test: Convince make not to accidentally delete exetool test: Add linting of Python test scripts clang-tidy: Suppress redundant expression warning cppcheck: Suppress the suppression of a suppression cppcheck: Suppress a buggy cppcheck warning cppcheck: Suppress variable scope warnings in dhcpv6() dhcpv6.c | 8 ++++++++ linux_dep.h | 2 +- tcp.c | 5 +++++ test/Makefile | 16 +++++++++++++++- test/build/build.py | 5 +++-- test/build/static_checkers.sh | 6 +++++- vhost_user.c | 1 + 7 files changed, 38 insertions(+), 5 deletions(-) -- 2.51.0

1 4

[PATCH 2/6] test: Add linting of Python test scripts
by David Gibson 02 Oct '25

02 Oct '25

We currently have one test moved to the new exeter based framwork written in Python. We plan to add many more, so add linting (flake8) and type checking (mypy) of those scripts. This can be invoked manually with "make flake8" or "make mypy" in test/, and is also added to the static checkers test set. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/Makefile | 14 +++++++++++++- test/build/build.py | 5 +++-- test/build/static_checkers.sh | 6 +++++- 3 files changed, 21 insertions(+), 4 deletions(-) diff --git a/test/Makefile b/test/Makefile index 69987d0b..2637e0ed 100644 --- a/test/Makefile +++ b/test/Makefile @@ -8,6 +8,8 @@ BATS = bats -j $(shell nproc) EXETOOL = exeter/exetool/exetool WGET = wget -c +FLAKE8 = flake8 +MYPY = mypy --strict DEBIAN_IMGS = debian-8.11.0-openstack-amd64.qcow2 \ debian-10-nocloud-amd64.qcow2 \ @@ -65,11 +67,15 @@ LOCAL_ASSETS = mbuto.img mbuto.mem.img podman/bin/podman QEMU_EFI.fd \ ASSETS = $(DOWNLOAD_ASSETS) $(LOCAL_ASSETS) EXETER_PYPATH = exeter/py3 +EXETER_PYTHON = build/build.py EXETER_BATS = smoke/smoke.sh.bats \ - build/build.py.bats build/static_checkers.sh.bats + $(EXETER_PYTHON:%=%.bats) build/static_checkers.sh.bats BATS_FILES = $(EXETER_BATS) \ podman/test/system/505-networking-pasta.bats +# Python test code (for linters) +PYPKGS = $(EXETER_PYTHON) + CFLAGS = -Wall -Werror -Wextra -pedantic -std=c99 assets: $(ASSETS) @@ -130,6 +136,12 @@ medium.bin: big.bin: dd if=/dev/urandom bs=1M count=10 of=$@ +flake8: pull-exeter + PYTHONPATH=$(EXETER_PYPATH) $(FLAKE8) $(PYPKGS) + +mypy: pull-exeter + PYTHONPATH=$(EXETER_PYPATH) $(MYPY) $(PYPKGS) + $(EXETER_BATS): %.bats: % $(EXETOOL) PYTHONPATH=$(EXETER_PYPATH) $(EXETOOL) bats -- $< > $@ diff --git a/test/build/build.py b/test/build/build.py index e49287c9..e3de8305 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -18,11 +18,12 @@ import os from pathlib import Path import subprocess import tempfile -from typing import Iterable, Iterator +from typing import Iterator import exeter -def sh(cmd): + +def sh(cmd: str) -> None: """Run given command in a shell""" subprocess.run(cmd, shell=True) diff --git a/test/build/static_checkers.sh b/test/build/static_checkers.sh index 42806e79..228b99ae 100755 --- a/test/build/static_checkers.sh +++ b/test/build/static_checkers.sh @@ -21,6 +21,10 @@ exeter_set_description cppcheck "passt sources pass cppcheck" exeter_register clang_tidy make -C .. clang-tidy exeter_set_description clang_tidy "passt sources pass clang-tidy" -exeter_main "$@" +exeter_register flake8 make flake8 +exeter_set_description flake8 "passt tests in Python pass flake8" +exeter_register mypy make mypy +exeter_set_description mypy "passt tests in Python pass mypy --strict" +exeter_main "$@" -- 2.51.0

3 5

[PATCH 4/6] cppcheck: Suppress the suppression of a suppression
by David Gibson 01 Oct '25

01 Oct '25

Apparently cppcheck 2.18.3 no longer trips the funcArgNamesDifferent warning on our (re-)definition of close_range(). So instead we get an unmatchedSuppression warning. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- linux_dep.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_dep.h b/linux_dep.h index 1d9e1669..89e590c8 100644 --- a/linux_dep.h +++ b/linux_dep.h @@ -142,7 +142,7 @@ struct tcp_info_linux { #endif __attribute__ ((weak)) -/* cppcheck-suppress funcArgNamesDifferent */ +/* cppcheck-suppress [funcArgNamesDifferent,unmatchedSuppression] */ int close_range(unsigned int first, unsigned int last, int flags) { return syscall(SYS_close_range, first, last, flags); } -- 2.51.0

1 0

[PATCH 3/6] clang-tidy: Suppress redundant expression warning
by David Gibson 01 Oct '25

01 Oct '25

clang-tidy 20.1.8 doesn't like (VHOST_USER_MAX_VQS / 2), because it expands to (2 / 2). But in the context of the #define, this makes logical sense, so suppress the warning. I'm not sure why it isn't firing on the debug() line just below. Possibly it only complains once per expression per function, so we only have to suppress it once? Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- vhost_user.c | 1 + 1 file changed, 1 insertion(+) diff --git a/vhost_user.c b/vhost_user.c index fa343a86..223332d5 100644 --- a/vhost_user.c +++ b/vhost_user.c @@ -939,6 +939,7 @@ static bool vu_get_queue_num_exec(struct vu_dev *vdev, { (void)vdev; + /* NOLINTNEXTLINE(misc-redundant-expression) */ vmsg_set_reply_u64(vmsg, VHOST_USER_MAX_VQS / 2); debug("VHOST_USER_MAX_VQS %u", VHOST_USER_MAX_VQS / 2); -- 2.51.0

1 0

[PATCH] netlink: Don't require address to be global, just not link local
by David Gibson 01 Oct '25

01 Oct '25

nl_addr_get() will only pick up global IPv6 addresses (RT_SCOPE_UNIVERSE). This is because link-local addresses aren't suitable. However site-local addresses (in the rare occassions they're used) would be fine for our purposes. In fact, anything wider than link scope is fine, so update the check to reflect that. Change the logic in the test scripts to match as well. Reported-by: Xun Gu <xugu(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=122 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 2 +- test/demo/podman | 4 ++-- test/migrate/basic | 2 +- test/migrate/basic_fin | 2 +- test/migrate/iperf3_bidir6 | 2 +- test/migrate/iperf3_in6 | 2 +- test/migrate/iperf3_many_out6 | 2 +- test/migrate/iperf3_out6 | 2 +- test/migrate/rampstream_in | 2 +- test/migrate/rampstream_out | 2 +- test/passt/dhcp | 2 +- test/passt/ndp | 2 +- test/passt_in_ns/dhcp | 2 +- test/pasta/dhcp | 2 +- test/pasta/ndp | 2 +- test/perf/pasta_tcp | 2 +- test/perf/pasta_udp | 2 +- test/two_guests/basic | 2 +- 18 files changed, 19 insertions(+), 19 deletions(-) diff --git a/netlink.c b/netlink.c index c4367807..9fe70f2c 100644 --- a/netlink.c +++ b/netlink.c @@ -786,7 +786,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, prefix_max = *prefix_len = ifa->ifa_prefixlen; } else if (af == AF_INET6 && addr && - ifa->ifa_scope == RT_SCOPE_UNIVERSE && + ifa->ifa_scope < RT_SCOPE_LINK && ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); diff --git a/test/demo/podman b/test/demo/podman index edd403a1..393691ca 100644 --- a/test/demo/podman +++ b/test/demo/podman @@ -310,8 +310,8 @@ nl say Everything is set now, let's start sleep 2 hout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -hout ADDR4 ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' -hout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' +hout ADDR4 ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local' +hout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local' hout GW4 ip -j -4 route show|jq -rM '.[] | select(.dst == "default").gateway' hout GW6 ip -j -6 route show|jq -rM '.[] | select(.dst == "default").gateway' diff --git a/test/migrate/basic b/test/migrate/basic index 3f11f7d8..c22fee80 100644 --- a/test/migrate/basic +++ b/test/migrate/basic @@ -39,7 +39,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: guest1/guest2 > host diff --git a/test/migrate/basic_fin b/test/migrate/basic_fin index aa61ec5a..c35c2690 100644 --- a/test/migrate/basic_fin +++ b/test/migrate/basic_fin @@ -39,7 +39,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: guest1, half-close, guest2 > host diff --git a/test/migrate/iperf3_bidir6 b/test/migrate/iperf3_bidir6 index 4bfefb58..60b2a9b2 100644 --- a/test/migrate/iperf3_bidir6 +++ b/test/migrate/iperf3_bidir6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 host <-> guest flood, many flows, during migration diff --git a/test/migrate/iperf3_in6 b/test/migrate/iperf3_in6 index 16cf504f..9b7f2c60 100644 --- a/test/migrate/iperf3_in6 +++ b/test/migrate/iperf3_in6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 host to guest throughput during migration diff --git a/test/migrate/iperf3_many_out6 b/test/migrate/iperf3_many_out6 index 88133f26..9b3095f6 100644 --- a/test/migrate/iperf3_many_out6 +++ b/test/migrate/iperf3_many_out6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 guest to host flood, many flows, during migration diff --git a/test/migrate/iperf3_out6 b/test/migrate/iperf3_out6 index 21fbfcd6..b94a70c2 100644 --- a/test/migrate/iperf3_out6 +++ b/test/migrate/iperf3_out6 @@ -44,7 +44,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv6 guest to host throughput during migration diff --git a/test/migrate/rampstream_in b/test/migrate/rampstream_in index df333ba5..3c7fd200 100644 --- a/test/migrate/rampstream_in +++ b/test/migrate/rampstream_in @@ -40,7 +40,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: sequence check, ramps, inbound diff --git a/test/migrate/rampstream_out b/test/migrate/rampstream_out index 8ed3229b..8cff6d9c 100644 --- a/test/migrate/rampstream_out +++ b/test/migrate/rampstream_out @@ -40,7 +40,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ # Wait for DAD to complete on the DHCP address guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] test TCP/IPv4: sequence check, ramps, outbound diff --git a/test/passt/dhcp b/test/passt/dhcp index 145f1baa..dc6b880f 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -61,7 +61,7 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/passt/ndp b/test/passt/ndp index 516cd6b8..df77cdcc 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -25,7 +25,7 @@ check [ -n "__IFNAME__" ] test SLAAC: prefix gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' gout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/passt_in_ns/dhcp b/test/passt_in_ns/dhcp index a38a6908..0ccb4800 100644 --- a/test/passt_in_ns/dhcp +++ b/test/passt_in_ns/dhcp @@ -55,7 +55,7 @@ guest /sbin/dhclient -6 __IFNAME__ # Wait for DAD to complete guest while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/pasta/dhcp b/test/pasta/dhcp index d4f3ad58..e1c66be6 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -39,7 +39,7 @@ ns /sbin/dhclient -6 --no-pid __IFNAME__ ns while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ __ADDR6__ = __HOST_ADDR6__ ] test DHCPv6: route diff --git a/test/pasta/ndp b/test/pasta/ndp index 952c1eab..e4828765 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -24,7 +24,7 @@ ns while ! ip -j -6 addr show dev __IFNAME__ | jq -e '.[].addr_info.[] | select( test SLAAC: prefix nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.protocol == "kernel_ra") | .local + "/" + (.prefixlen | tostring)] | .[0]' nsout PREFIX6 sipcalc __ADDR6__ | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/perf/pasta_tcp b/test/perf/pasta_tcp index bc0de3c4..496d0fec 100644 --- a/test/perf/pasta_tcp +++ b/test/perf/pasta_tcp @@ -211,7 +211,7 @@ tr TCP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local] | .[0]' bw - bw - bw - diff --git a/test/perf/pasta_udp b/test/perf/pasta_udp index ab2f3e89..3a7054c9 100644 --- a/test/perf/pasta_udp +++ b/test/perf/pasta_udp @@ -196,7 +196,7 @@ tr UDP throughput over IPv6: host to ns iperf3s ns 10002 nsout IFNAME ip -j link show | jq -rM '.[] | select(.link_type == "ether").ifname' -nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope != "host" and .scope != "link").local] | .[0]' iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 8G -l 1472 bw __BW__ 0.3 0.5 iperf3 BW host __ADDR6__ 10002 __TIME__ __OPTS__ -b 12G -l 3972 diff --git a/test/two_guests/basic b/test/two_guests/basic index e2338ffd..a9625f3e 100644 --- a/test/two_guests/basic +++ b/test/two_guests/basic @@ -45,7 +45,7 @@ guest1 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; guest2 while ip -j -6 addr show tentative | jq -e '.[].addr_info'; do sleep 0.1; done g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' g2out ADDR2_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope != "host" and .scope != "link" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] check [ "__ADDR2_6__" = "__HOST_ADDR6__" ] -- 2.51.0

2 2

[PATCH v11 0/9] Use true MAC address of LAN local remote hosts
by Jon Maloy 01 Oct '25

01 Oct '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. v8: - Small fix to patch #2 so that we cover the case when a MAC addess for a host has changed. - Added a commit where we send a gratuitous ARP/ unsolicitated NA to the guest when a new host is added to the neighbour cache table. v10: - Some fixes after feedback from David Gibson - Reordered: Moved patch #9 to position #3. - Added synchronization step between ARP/NDP table contents and the neigbour table at initialization. This reduces the number of "false" ARP/NDP replies drastically, but not completly. - (Next step could be to scan over the flow table and update affeced entries when we receive a MAC address update.) v11: - Corrected the gratuitous ARP implementation to use the "ARP Announcement" model instead of the "Gratuitous ARP reply" model. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

3 26

[PATCH RFT] tcp: Fix ACK sequence on FIN to tap, handle retransmission in half-closed state
by Stefano Brivio 30 Sep '25

30 Sep '25

If we reach end-of-file on a socket (or get EPOLLRDHUP / EPOLLHUP) and send a FIN segment to the guest / container acknowledging a sequence number that's behind what we received so far, we won't have any further trigger to send an updated ACK segment, as we are now switching the epoll socket monitoring to edge-triggered mode. To avoid this situation, in tcp_update_seqack_wnd(), we set the next acknowledgement sequence to the current observed sequence, regardless of what was acknowledged socket-side. However, we don't necessarily call tcp_update_seqack_wnd() before sending the FIN segment, which might lead to this exchange, where 192.168.10.102 is a HTTP server in a Podman container, and 192.168.10.44 is a client fetching approximately 160 KB of data from it: 82 2.026811 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [FIN, ACK] Seq=121441 Ack=143 Win=65536 Len=0 the server is done sending 83 2.026898 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [ACK] Seq=143 Ack=114394 Win=216192 Len=0 pasta (client) acknowledges a previous sequence 84 2.027324 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [FIN, ACK] Seq=143 Ack=114394 Win=216192 Len=0 pasta (client) sends FIN, ACK as the client has no more data to send (a single GET request), while still acknowledging a previous sequence (because that's what the client acknowledged so far) 85 2.027349 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [ACK] Seq=121442 Ack=144 Win=65536 Len=0 the server acknowledges the FIN, ACK 86 2.224125 192.168.10.102 → 192.168.10.44 4150 TCP [TCP Retransmission] 55414 → 44992 [ACK] Seq=114394 Ack=144 Win=65536 Len=4096 [TCP segment of a reassembled PDU] ...and nothing happens for a while, until, approximately 200ms later, the server concludes that it needs to retransmit some data as it wasn't acknowledged. This is totally unnecessary, so avoid that by setting the ACK sequence to whatever we received from the container / guest, before sending a FIN segment and switching to EPOLLET. Further on: 87 2.224202 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [RST] Seq=144 Win=0 Len=0 as we see the retransmission, we conclude that this was the final ACK and close the connection. But the retransmission should instead tell us that the server is waiting for an ACK segment we never sent. To fix this, revert the TAP_FIN_RCVD event if we get a retransmission, because the peer is rewinding the sequence, which implies that the FIN will be retransmitted as well, eventually. And, until then, we shouldn't handle that side of the connection as closed. We need to process (silently discard) this data, instead. Link: https://github.com/containers/podman/issues/27179 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I couldn't reproduce the original issue, and the excerpts from the capture in the commit message are from the original report. I'm fairly sure that this is correct, but some testing in the problematic case is definitely needed. tcp.c | 4 ++++ tcp_buf.c | 14 +++++++++++++- tcp_vu.c | 7 ++++++- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index 48b1ef2..bfee56b 100644 --- a/tcp.c +++ b/tcp.c @@ -2128,6 +2128,10 @@ int tcp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, return 1; } + /* Retransmissions revert any FIN segment (last data segment) */ + if (SEQ_LT(ntohl(th->seq), conn->seq_from_tap)) + conn_event(c, conn, ~TAP_FIN_RCVD); + /* Established connections not accepting data from tap */ if (conn->events & TAP_FIN_RCVD) { bool retr; diff --git a/tcp_buf.c b/tcp_buf.c index a493b5a..cc106bc 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -368,7 +368,19 @@ int tcp_buf_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) conn_flag(c, conn, STALLED); } else if ((conn->events & (SOCK_FIN_RCVD | TAP_FIN_SENT)) == SOCK_FIN_RCVD) { - int ret = tcp_buf_send_flag(c, conn, FIN | ACK); + int ret; + + /* On TAP_FIN_SENT, we won't get further data events + * from the socket, and this might be the last ACK + * segment we send to the tap, so update its sequence to + * include everything we received until now. + * + * See also the special handling on CONN_IS_CLOSING() in + * tcp_update_seqack_wnd(). + */ + conn->seq_ack_to_tap = conn->seq_from_tap; + + ret = tcp_buf_send_flag(c, conn, FIN | ACK); if (ret) { tcp_rst(c, conn); return ret; diff --git a/tcp_vu.c b/tcp_vu.c index ebd3a1e..3ec3538 100644 --- a/tcp_vu.c +++ b/tcp_vu.c @@ -410,7 +410,12 @@ int tcp_vu_data_from_sock(const struct ctx *c, struct tcp_tap_conn *conn) conn_flag(c, conn, STALLED); } else if ((conn->events & (SOCK_FIN_RCVD | TAP_FIN_SENT)) == SOCK_FIN_RCVD) { - int ret = tcp_vu_send_flag(c, conn, FIN | ACK); + int ret; + + /* See tcp_buf_data_from_sock() */ + conn->seq_ack_to_tap = conn->seq_from_tap; + + ret = tcp_vu_send_flag(c, conn, FIN | ACK); if (ret) { tcp_rst(c, conn); return ret; -- 2.43.0

1 2

[PATCH v2] test: Fix printf error when debug is enabled
by Yumei Huang 30 Sep '25

30 Sep '25

Running test pasta/tcp with debug enabled would get stuck with below error: + printf 'DEBUG: ns socat -u OPEN:__BASEPATH__/big.bin TCP6:[__GW6__%__IFNAME__]:10003\n' lib/term: line 38: printf: `_': invalid format character The error occurs because printf interprets the % character as the start of a format specifier, and the following '_' isn't one of them. Fix it by replacing 'printf "${*}"' with 'printf "%b" "${*}"'. Also update the docstring. Link: https://bugs.passt.top/show_bug.cgi?id=154 Fixes: de28c20d8051 ("test: Update lib/term for clearer output when DEBUG is enabled") Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- test/lib/term | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/test/lib/term b/test/lib/term index 6400746..79aa2b7 100755 --- a/test/lib/term +++ b/test/lib/term @@ -29,32 +29,32 @@ PR_NC='\033[0m' PR_DELAY_INIT=100 # ms # info() - Highlight test log pane, print message to it and to log file -# $@: Message to print +# $*: Message to print info() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe - printf "${*}\n" >> "${LOGFILE}" + printf "%b\n" "${*}" >> $STATEBASE/log_pipe + printf "%b\n" "${*}" >> "${LOGFILE}" } # info_n() - Highlight, print message to pane and to log file without newline -# $@: Message to print +# $*: Message to print info_n() { tmux select-pane -t ${PANE_INFO} - printf "${*}" >> $STATEBASE/log_pipe - printf "${*}" >> "${LOGFILE}" + printf "%b" "${*}" >> $STATEBASE/log_pipe + printf "%b" "${*}" >> "${LOGFILE}" } # info_nolog() - Highlight test log pane, print message to it -# $@: Message to print +# $*: Message to print info_nolog() { tmux select-pane -t ${PANE_INFO} - printf "${*}\n" >> $STATEBASE/log_pipe + printf "%b\n" "${*}" >> $STATEBASE/log_pipe } # info_nolog() - Print message to log file -# $@: Message to print +# $*: Message to print log() { - printf "${*}\n" >> "${LOGFILE}" + printf "%b\n" "${*}" >> "${LOGFILE}" } # info_nolog_n() - Send message to pane without highlighting it, without newline @@ -363,8 +363,8 @@ status_test_start() { info_check() { switch_pane ${PANE_INFO} - printf "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe - printf "? ${*}" >> "${LOGFILE}" + printf "%b" "${PR_YELLOW}?${PR_NC} ${*}" >> $STATEBASE/log_pipe + printf "? %b" "${*}" >> "${LOGFILE}" } # info_check_passed() - Display and log a new line when a check passes -- 2.47.0

3 2