- dev - passt

[PATCH v2] passt.1: Clearer and more detailed description of --map-guest-addr
by David Gibson 28 Jul '26

28 Jul '26

It's been pointed out in bug 132 and elsewhere that the man page's description of the --map-guest-addr isn't very clear. It's technically correct, but hard to follow. In my defense as its author, this is largely because the problem the option is addressing is itself quite subtle and hard to explain. In particular while it's usually about host <-> guest communication, it may not be if -a is also used, and the semantics need to accomodate that. Anyway, here's an attempt to make clearer what it does - and why it more or less has to work that way. Reviews on clarity most welcome - I've had my head in the forwarding and address translation for the better part of a year, so it's natural that I've somewhat lost sight of what is and isn't obvious to someone coming fresh. Cc: Paul Holzinger <pholzing(a)redhat.com> Cc: Jan Rodak <jrodak(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=132 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.1 | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-) diff --git a/passt.1 b/passt.1 index 995590a6..f326f82c 100644 --- a/passt.1 +++ b/passt.1 @@ -405,18 +405,33 @@ sandboxing process fails. .TP .BR \-\-map-guest-addr " " \fIaddr -Translate \fIaddr\fR in the guest to be equal to the guest's assigned -address on the host. That is, packets from the guest to \fIaddr\fR -will be redirected to the address assigned to the guest with \fB-a\fR, -or by default the host's global address. This allows the guest to -access services available on the host's global address, even though its -own address shadows that of the host. - -If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one -IPv6 address can be translated, and if the option is specified -multiple times, the last one for each address type takes effect. - -By default, mapping happens as described for the \-\-map-host-loopback option. +Redirect outbound traffic to \fIaddr\fR to whatever node on the host +network has the same address as the guest. Rewrite inbound traffic +from that node so it appears to the guest to have come from \fIaddr\fR +instead. + +By default, the guest or namespace is given one of the host's public +addresses. While this avoids NAT in most cases, it means the guest +cannot communicate with the host using that address. +\fB--map-guest-addr\fR allows the guest to communicate with the host +via \fIaddr\fR instead. + +Note, however, that if \fB-a ADDR\fR is used, where \fBADDR\fR is not +one of the host's addresses, then \fB--map-guest-addr\fR will redirect +traffic to \fIaddr\fR to the host visible node with address +\fBADDR\fR, instead of the host itself. + +Only one IPv4 and one IPv6 address can be translated, and if the +option is specified multiple times, the last one for each address +family takes effect. \fB--map-guest-addr none\fR means no such +translation is performed for IPv4 or IPv6; this will usually make it +impossible for the guest to communicate with the host (at least using +direct IP). + +By default \fB--map-guest-addr GATEWAY\fR is implied, where +\fBGATEWAY\fR is the guest's default gateway address, unless +\fB--no-map-gw\fR is also specified, in which case \fB--map-guest-addr +none\fR is implied. .TP .BR \-4 ", " \-\-ipv4-only -- 2.55.0

2 2

[PATCH] passt.1: Clearer and more detailed description of --map-guest-addr
by David Gibson 28 Jul '26

28 Jul '26

It's been pointed out in bug 132 and elsewhere that the man page's description of the --map-guest-addr isn't very clear. It's technically correct, but hard to follow. In my defense as its author, this is largely because the problem the option is addressing is itself quite subtle and hard to explain. In particular while it's usually about host <-> guest communication, it may not be if -a is also used, and the semantics need to accomodate that. Anyway, here's an attempt to make clearer what it does - and why it more or less has to work that way. Reviews on clarity most welcome - I've had my head in the forwarding and address translation for the better part of a year, so it's natural that I've somewhat lost sight of what is and isn't obvious to someone coming fresh. Cc: Paul Holzinger <pholzing(a)redhat.com> Cc: Jan Rodak <jrodak(a)redhat.com> Link: https://bugs.passt.top/show_bug.cgi?id=132 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt.1 | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/passt.1 b/passt.1 index 995590a6..19901c1e 100644 --- a/passt.1 +++ b/passt.1 @@ -405,18 +405,34 @@ sandboxing process fails. .TP .BR \-\-map-guest-addr " " \fIaddr -Translate \fIaddr\fR in the guest to be equal to the guest's assigned -address on the host. That is, packets from the guest to \fIaddr\fR -will be redirected to the address assigned to the guest with \fB-a\fR, -or by default the host's global address. This allows the guest to -access services available on the host's global address, even though its -own address shadows that of the host. - -If \fIaddr\fR is 'none', no address is mapped. Only one IPv4 and one -IPv6 address can be translated, and if the option is specified -multiple times, the last one for each address type takes effect. - -By default, mapping happens as described for the \-\-map-host-loopback option. +Because passt cannot allocate addresses in the host's network +environment, the guest or namespace will typically share an address +with some other "shadowed" interface in the host's network or the +wider internet. By default, the shadowed interface will be the host's +own primary interface, because that's the address given to the guest. +If the guest address is assigned with \fB-a\fR, however, the shadowed +interface will be whatever host-visible interface has the same +address, which could belong to any node on the host's network or the +internet. + +The guest or namespace cannot communicate with the shadowed interface +using its host-visible address: because that's the same as the guest's +address, sending packets there would loop back to the guest before +they're seen by passt to forward. + +\fB--map-guest-addr\fR allows the guest to communicate with the +shadowed interface via the address \fIaddr\fR instead. Packets from +the guest to \fIaddr\fR are translated into packets from the host to +the shadowed interface. Similarly, packets from the shadowed +interface to the host which are forwarded by passt's \fB-t\fR or +\fB-u\fR options will be translated to appear as if from \fIaddr\fR to +the guest's address. + +\fB--map-guest-addr none\fR or omitting \fB--map-guest-addr\fR +entirely means no address is mapped, and the guest will be unable to +communicate with the shadowed interface. Only one IPv4 and one IPv6 +address can be translated, and if the option is specified multiple +times, the last one for each address family takes effect. .TP .BR \-4 ", " \-\-ipv4-only -- 2.55.0

3 6

[BUG] --map-guest-addr target resolved once at startup; host network change kills the mapping silently and permanently
by Yuxi Liu 27 Jul '26

27 Jul '26

Hello, Bug report against pasta, as used by rootless podman for host.containers.internal. What happens ------------ Rootless container, default pasta networking (podman passes --no-map-gw --map-guest-addr 169.254.1.2), on a laptop. The laptop moves to a different network (hotel wifi, home, office). From that moment, every connection from the container to 169.254.1.2 times out. Forever. General outbound from the container keeps working, so the failure looks like the host service died. The host service is fine and answers on the host the whole time. Only recreating the container fixes the route. Why it happens -------------- --map-guest-addr forwards mapped traffic to the host's external address (commit 57b7bd2). pasta resolves that address once, at startup, and never again. After the host moves networks, pasta still connect()s to the launch-time address. Nobody owns that address anymore, the SYNs vanish, and no error is logged anywhere. pasta already runs a live netlink monitor in its event loop (RTMGRP_NEIGH, neighbour events). Host address changes are the one thing it reads once at startup and never watches afterward. Re-reading the current address needs no privilege: getifaddrs() works for any process. Reproduce --------- 1. Laptop on wifi network A. Run a rootless podman container with the default pasta network. Have any service listening on the host, say port 8191. 2. In the container: curl https://www.google.com/url?q=http://host.containers.internal:8191&source=gm… -> answers. 3. Move the laptop to wifi network B. 4. Same curl -> timeout. Stays dead until the container is recreated. Versions: passt 0.0~git20250503.587980c-2 (Ubuntu 25.10), podman 5.4.2. Expected -------- One of: 1. pasta re-resolves the mapping target when the host's addresses change, or 2. the mapped route fails loudly (RST) instead of silently, or 3. the man page warns that the mapping dies permanently on host network change. Laptops are a mainstream platform for rootless podman. A silent, permanent route death on every wifi change is a serious defect for them. Workaround ---------- --map-guest-addr none --map-host-loopback 169.254.1.2 (via podman: --network=pasta:--map-guest-addr,none,--map-host-loopback,169.254.1.2). Mapped traffic then arrives on the host as 127.0.0.1, which the host owns on every network. This changes source semantics (connections appear to come from loopback), which is acceptable when you control both sides. Best regards, Yuxi Liu

4 3

[PATCH] fwd: Don't log warnings when failing to bind "weak" ports, just debug messages
by Stefano Brivio 27 Jul '26

27 Jul '26

When ports are forwarded by exclusion, we might fail to bind all privileged ports (typically lower than 1024), but that's actually expected, and we shouldn't log warnings just because of that. Now, if those ports are automatically forwarded, and we have a container binding some low ports, we'll log those warnings messages every second, which is just unnecessary noise in the system log or in log files. Use LOG_DEBUG as severity for those messages, instead of LOG_WARNING, so that they are only printed when --debug is given: that should be convenient enough to investigate things, while avoiding excess noise during regular operations. There might be more sophisticated ways to limit this noise, but this might be a significant regression in some setups, introduced by recent changes in port forwarding handling, so I'm going for a somewhat minimal fix for the moment, which can be improved later on if needed. Reported-by: frajo <frajo(a)frajo.fi> Link: https://bugs.passt.top/show_bug.cgi?id=213 Fixes: b223bec48213 ("fwd, tcp, udp: Set up listening sockets based on forward table") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- fwd.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/fwd.c b/fwd.c index 4ba0af3..5679a3d 100644 --- a/fwd.c +++ b/fwd.c @@ -392,17 +392,22 @@ static int fwd_sync_one(const struct ctx *c, uint8_t pif, unsigned idx, fd = pif_listen(c, rule->proto, pif, addr, ifname, port, idx); if (fd < 0) { char astr[INANY_ADDRSTRLEN]; + int pri = LOG_WARNING; - warn("Listen failed for %s %s port %s%s%s/%u: %s", - pif_name(pif), ipproto_name(rule->proto), - inany_ntop(addr, astr, sizeof(astr)), - ifname ? "%" : "", ifname ? ifname : "", - port, strerror_(-fd)); + if (rule->flags & FWD_WEAK) + pri = LOG_DEBUG; - if (!(rule->flags & FWD_WEAK)) - return -1; + logmsg(true, false, pri, + "Listen failed for %s %s port %s%s%s/%u: %s", + pif_name(pif), ipproto_name(rule->proto), + inany_ntop(addr, astr, sizeof(astr)), + ifname ? "%" : "", ifname ? ifname : "", + port, strerror_(-fd)); - continue; + if (rule->flags & FWD_WEAK) + continue; + + return -1; } socks[port - rule->first] = fd; -- 2.43.0

2 1

[PATCH v5 0/7] Add --dhcp-boot and --dhcp-opt options
by Anshu Kumari 27 Jul '26

27 Jul '26

This series adds support for custom DHCP options in passt, enabling network boot (PXE/UEFI HTTP Boot) and arbitrary DHCP option injection. Two new command-line flags are introduced: --dhcp-boot URL Sets the boot file URL (DHCP option 67 and the legacy boot file field) --dhcp-opt CODE,VALUE Sets any DHCP option by numeric code, with type-aware parsing per RFC 2132 The DHCP reply path is extended with option overload support (RFC 2132 option 52), allowing options to overflow into the file and sname fields when the standard options area is full. RFC 3396 option splitting for concatenation-requiring options has also been introduce as a separate patch. Anshu Kumari (7): dhcp: Refactor fill_one() to operate on a generic buffer dhcp: Add option state management with enum opt_state dhcp: Add option overload dhcp: Add --dhcp-opt with option table and value parser dhcp: Add --dhcp-boot command-line option dhcp: Add RFC 3396 option splitting for concatenation-requiring options dhcp: Handle FQDN option with RFC 3396 concatenation conf.c | 30 ++- dhcp.c | 591 +++++++++++++++++++++++++++++++++++++++++++++++++++----- dhcp.h | 2 + passt.1 | 49 +++++ 4 files changed, 621 insertions(+), 51 deletions(-) -- 2.54.0

3 20

[PATCH v2] treewide: Sandbox qrap
by Stefano Brivio 24 Jul '26

24 Jul '26

No sunsetting or rightsizing for you, qrap: dig, bury, and cover. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: After a rebase, I realised I forgot to commit two files: test/distro/ubuntu and test/build/build.py. Added here .gitignore | 1 - Makefile | 11 +- README.md | 4 - contrib/fedora/passt.spec | 2 - doc/demo.sh | 12 +- doc/passt_overview.excalidraw | 29 --- hooks/pre-push | 2 +- passt.1 | 235 ++++++++++--------- qrap.1 | 77 ------ qrap.c | 429 ---------------------------------- tap.c | 2 - test/build/build.py | 4 +- test/distro/opensuse | 2 +- test/distro/ubuntu | 2 +- 14 files changed, 130 insertions(+), 682 deletions(-) delete mode 100644 qrap.1 delete mode 100644 qrap.c diff --git a/.gitignore b/.gitignore index 3e40d9f..71420b6 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,6 @@ /pasta.avx2 /passt-repair /pesto -/qrap /pasta.1 /seccomp.h /seccomp_pesto.h diff --git a/Makefile b/Makefile index 5757aef..77474d6 100644 --- a/Makefile +++ b/Makefile @@ -39,13 +39,12 @@ PASST_SRCS = arch.c arp.c bitmap.c checksum.c conf.c dhcp.c dhcpv6.c \ parse.c passt.c pasta.c pcap.c pif.c repair.c serialise.c tap.c tcp.c \ tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c \ vhost_user.c virtio.c vu_common.c -QRAP_SRCS = qrap.c PASST_REPAIR_SRCS = passt-repair.c PESTO_SRCS = pesto.c bitmap.c fwd_rule.c inany.c ip.c lineread.c parse.c \ serialise.c -SRCS = $(PASST_SRCS) $(QRAP_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) +SRCS = $(PASST_SRCS) $(PASST_REPAIR_SRCS) $(PESTO_SRCS) -MANPAGES = passt.1 pasta.1 pesto.1 qrap.1 passt-repair.1 +MANPAGES = passt.1 pasta.1 pesto.1 passt-repair.1 PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \ epoll_ctl.h flow.h fwd.h fwd_rule.h flow_table.h icmp.h icmp_flow.h \ @@ -54,7 +53,6 @@ PASST_HEADERS = arch.h arp.h bitmap.h checksum.h conf.h dhcp.h dhcpv6.h \ serialise.h siphash.h tap.h tcp.h tcp_buf.h tcp_conn.h tcp_internal.h \ tcp_splice.h tcp_vu.h udp.h udp_flow.h udp_internal.h udp_vu.h util.h \ vhost_user.h virtio.h vu_common.h -QRAP_HEADERS = arp.h ip.h passt.h util.h PASST_REPAIR_HEADERS = linux_dep.h PESTO_HEADERS = bitmap.h common.h fwd_rule.h inany.h ip.h log.h parse.h \ pesto.h serialise.h @@ -76,7 +74,7 @@ docdir ?= $(datarootdir)/doc/passt mandir ?= $(datarootdir)/man man1dir ?= $(mandir)/man1 -BASEBIN := passt qrap passt-repair pesto +BASEBIN := passt passt-repair pesto ifeq ($(TARGET_ARCH),x86_64) BASEBIN += passt.avx2 endif @@ -112,9 +110,6 @@ passt.avx2: $(PASST_SRCS) $(PASST_HEADERS) seccomp.h pasta.avx2 pasta.1 pasta: pasta%: passt% ln -sf $< $@ -qrap: BASE_CPPFLAGS += -DARCH=\"$(TARGET_ARCH)\" -qrap: $(QRAP_SRCS) $(QRAP_HEADERS) - passt-repair: $(PASST_REPAIR_SRCS) $(PASST_REPAIR_HEADERS) seccomp_repair.h pesto: BASE_CPPFLAGS += -DPESTO diff --git a/README.md b/README.md index 8fdc0a3..43caf49 100644 --- a/README.md +++ b/README.md @@ -376,10 +376,6 @@ speeding up local connections, and usually requiring NAT. _pasta_: _passt_ exchanges packets with _qemu_ via UNIX domain socket, using the `socket` back-end in qemu. This is supported since qemu 7.2. -For older versions, the [qrap](/passt/tree/qrap.c) wrapper can be used to -connect to a UNIX domain socket and to start qemu, which can now use the file -descriptor that's already opened. - This approach, compared to using a _tap_ device, doesn't require any security capabilities, as we don't need to create any interface. diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 34838af..6c7530a 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -118,12 +118,10 @@ fi %doc %{_docdir}/%{name}/demo.sh %{_bindir}/passt %{_bindir}/pasta -%{_bindir}/qrap %{_bindir}/passt-repair %{_bindir}/pesto %{_mandir}/man1/passt.1* %{_mandir}/man1/pasta.1* -%{_mandir}/man1/qrap.1* %{_mandir}/man1/passt-repair.1* %{_mandir}/man1/pesto.1* %ifarch x86_64 diff --git a/doc/demo.sh b/doc/demo.sh index 6b0917c..b56669f 100755 --- a/doc/demo.sh +++ b/doc/demo.sh @@ -177,7 +177,7 @@ into_ns() { next [ "${KEY}" = "s" ] && ${SHELL} - cmd passt -P "${DEMO_DIR}/passt.pid" + cmd passt -P "${DEMO_DIR}/passt.pid" -s "${DEMO_DIR}/passt.socket" echo echo "...passt is running." next @@ -198,15 +198,12 @@ into_ns() { echo "can download and use mbuto (https://mbuto.sh/) to build a" echo "basic initramfs image. Otherwise, press 's' to skip this" echo "step, and start an existing virtual machine yourself." - echo "You'll need to use the qrap(1) wrapper, with qemu options" - echo "as reported above." next else echo "This script doesn't know, yet, how to run a virtual" echo "machine on your architecture (${__arch}). Please start an" - echo "existing virtual machine yourself, using the qrap(1)" - echo "wrapper, with qemu options as reported above." + echo "existing virtual machine yourself." echo fi @@ -225,12 +222,13 @@ into_ns() { next # shellcheck disable=SC2086 - cmd qrap 5 ${__qemu_arch} \ + cmd ${__qemu_arch} \ -smp "$(nproc)" -m 1024 \ -nographic -serial stdio -nodefaults -no-reboot -vga none \ -initrd "${DEMO_DIR}/demo.img" \ -kernel "/boot/vmlinuz-$(uname -r)" -append "console=ttyS0" \ - -net socket,fd=5 -net nic,model=virtio || : + -device virtio-net-pci,netdev=s \ + -netdev stream,id=s,server=off,addr.type=unix,addr.path="${DEMO_DIR}/passt.socket" || : } STTY_BACKUP="$(stty -g)" diff --git a/doc/passt_overview.excalidraw b/doc/passt_overview.excalidraw index 790728e..3217b3f 100644 --- a/doc/passt_overview.excalidraw +++ b/doc/passt_overview.excalidraw @@ -3595,35 +3595,6 @@ "baseline": 17, "textAlign": "left", "verticalAlign": "top" - }, - { - "type": "text", - "version": 1448, - "versionNonce": 1345391945, - "isDeleted": false, - "id": "c-esZiuHSm3wnTRlmIJZk", - "fillStyle": "hachure", - "strokeWidth": 1, - "strokeStyle": "dotted", - "roughness": 1, - "opacity": 100, - "angle": 4.969352159599495, - "x": 816.7081559166961, - "y": 215.74807066759342, - "strokeColor": "#2b8a3e", - "backgroundColor": "transparent", - "width": 211, - "height": 23, - "seed": 939668423, - "groupIds": [], - "strokeSharpness": "round", - "boundElementIds": [], - "fontSize": 20, - "fontFamily": 1, - "text": "(currently \"qrap\" wrapper)", - "baseline": 17, - "textAlign": "left", - "verticalAlign": "top" } ], "appState": { diff --git a/hooks/pre-push b/hooks/pre-push index 3e2d15f..8eebdbc 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -54,7 +54,7 @@ done cd .. make pkgs -scp passt passt.avx2 passt.1 qrap qrap.1 "${USER_HOST}:${BIN}" +scp passt passt.avx2 passt.1 "${USER_HOST}:${BIN}" scp pasta pasta.avx2 pasta.1 "${USER_HOST}:${BIN}" scp passt-repair passt-repair.1 "${USER_HOST}:${BIN}" scp pesto pesto.1 "${USER_HOST}:${BIN}" diff --git a/passt.1 b/passt.1 index 995590a..53e072a 100644 --- a/passt.1 +++ b/passt.1 @@ -580,8 +580,7 @@ Default is \fBnone\fR for \fBpasst\fR and \fBauto\fR for \fBpasta\fR. .TP .BR \-s ", " \-\-socket-path ", " \-\-socket " " \fIpath -Path for UNIX domain socket used by \fBqemu\fR(1) or \fBqrap\fR(1) to connect to -\fBpasst\fR. +Path for UNIX domain socket used by \fBqemu\fR(1) to connect to \fBpasst\fR. Default is to probe a free socket, not accepting connections, starting from \fI/tmp/passt_1.socket\fR to \fI/tmp/passt_64.socket\fR. @@ -762,129 +761,132 @@ forwards loopback traffic between namespaces. .RS .nf $ iperf3 -s -D -$ ./pasta -Outbound interface: eth0, namespace interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea -DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 -NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 -# -# dhclient -4 --no-pid -# dhclient -6 --no-pid + +$ pasta --config-net + # ip address show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever - inet6 ::1/128 scope host + inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever -2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UNKNOWN group default qlen 1000 - link/ether 5e:90:02:eb:b0:2a brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global eth0 +2: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether be:16:49:5a:65:dc brd ff:ff:ff:ff:ff:ff + inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global + inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:5c90:2ff:feeb:b02a/64 scope global dynamic mngtmpaddr - valid_lft 3591sec preferred_lft 3591sec - inet6 fe80::5c90:2ff:feeb:b02a/64 scope link + inet6 fe80::bc16:49ff:fe5a:65dc/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever + # ip route show -default via 192.168.1.1 dev eth0 -192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.118 +default via 88.198.0.161 dev enp9s0 proto dhcp metric 1002 +88.198.0.160/27 dev enp9s0 proto dhcp scope link metric 1002 + # ip -6 route show -2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 dev eth0 proto kernel metric 256 pref medium -2a02:6d40:3ca5:2001::/64 dev eth0 proto kernel metric 256 expires 3584sec pref medium -fe80::/64 dev eth0 proto kernel metric 256 pref medium -default via fe80::62e3:27ff:fe33:2b01 dev eth0 proto ra metric 1024 expires 3584sec pref medium +2a01:4f8:222:904::/64 dev enp9s0 proto kernel metric 256 pref medium +fe80::/64 dev enp9s0 proto kernel metric 256 pref medium +default via fe80::1 dev enp9s0 metric 1024 onlink pref medium + # iperf3 -c 127.0.0.1 -t1 Connecting to host 127.0.0.1, port 5201 -[ 5] local 127.0.0.1 port 51938 connected to 127.0.0.1 port 5201 +[ 5] local 127.0.0.1 port 59112 connected to 127.0.0.1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd -[ 5] 0.00-1.00 sec 4.46 GBytes 38.3 Gbits/sec 0 3.93 MBytes +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 2.62 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr -[ 5] 0.00-1.00 sec 4.46 GBytes 38.3 Gbits/sec 0 sender -[ 5] 0.00-1.41 sec 4.45 GBytes 27.1 Gbits/sec receiver +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 sender +[ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec receiver iperf Done. + # iperf3 -c ::1 -t1 Connecting to host ::1, port 5201 -[ 5] local ::1 port 50108 connected to ::1 port 5201 +[ 5] local ::1 port 49138 connected to ::1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd -[ 5] 0.00-1.00 sec 4.35 GBytes 37.4 Gbits/sec 0 4.99 MBytes +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 1.06 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr -[ 5] 0.00-1.00 sec 4.35 GBytes 37.4 Gbits/sec 0 sender -[ 5] 0.00-1.41 sec 4.35 GBytes 26.4 Gbits/sec receiver +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 sender +[ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec receiver iperf Done. -# ping -c1 -4 spaghetti.pizza -PING spaghetti.pizza (172.67.192.217) 56(84) bytes of data. -64 bytes from 172.67.192.217: icmp_seq=1 ttl=255 time=37.3 ms + +# ping -nc1 -4 spaghetti.pizza +PING spaghetti.pizza (5.161.47.86) 56(84) bytes of data. +64 bytes from 5.161.47.86: icmp_seq=1 ttl=255 time=99.4 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms -# ping -c1 -6 spaghetti.pizza -PING spaghetti.pizza(2606:4700:3034::6815:147a (2606:4700:3034::6815:147a)) 56 data bytes -64 bytes from 2606:4700:3034::6815:147a: icmp_seq=1 ttl=255 time=35.6 ms +rtt min/avg/max/mdev = 99.433/99.433/99.433/0.000 ms +# ping -nc1 -6 spaghetti.pizza +PING spaghetti.pizza (2a01:4f8:1c1e:d6f1::1) 56 data bytes +64 bytes from 2a01:4f8:1c1e:d6f1::1: icmp_seq=1 ttl=255 time=3.11 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms -rtt min/avg/max/mdev = 35.605/35.605/35.605/0.000 ms -# logout -$ - -.RE +rtt min/avg/max/mdev = 3.110/3.110/3.110/0.000 ms .fi +.RE .BR "Connect an existing user and network namespace" .RS .nf $ unshare -rUn -# echo $$ -2446678 +# echo $$ +1295969 .fi -.BR " [From another terminal]" + +.BR "[From another terminal]" .nf -$ ./pasta 2446678 -Outbound interface: eth0, namespace interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea +$ pasta --config-net 1295969 +Template interface: enp9s0 (IPv4), enp9s0 (IPv6) +Namespace interface: enp9s0 +MAC: + host: 9a:55:9a:55:9a:55 + NAT to host 127.0.0.1: 88.198.0.161 DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 + assign: 88.198.0.164 + mask: 255.255.255.224 + router: 88.198.0.161 +DNS: + 185.12.64.1 + 185.12.64.2 + NAT to host ::1: fe80::1 NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 - + assign: 2a01:4f8:222:904::2 + router: fe80::1 + our link-local: fe80::1 +Inbound forwarding rules (HOST): + TCP [*]:1-32767 => 1-32767 (best effort) (auto-scan) + TCP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) + UDP [*]:1-32767 => 1-32767 (best effort) (auto-scan) + UDP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) +Outbound forwarding rules (SPLICE): + TCP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) + TCP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) + UDP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) + UDP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) .fi -.BR " [Back to the original terminal]" + +.BR "[Back to the original terminal]" .nf -# dhclient -4 --no-pid -# dhclient -6 --no-pid # ip address show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever - inet6 ::1/128 scope host + inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever -2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UNKNOWN group default qlen 1000 - link/ether fa:c1:2a:27:92:a9 brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global eth0 +2: enp9s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 + link/ether 9a:44:5e:54:d3:2c brd ff:ff:ff:ff:ff:ff + inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global + inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:f8c1:2aff:fe27:92a9/64 scope global dynamic mngtmpaddr - valid_lft 3594sec preferred_lft 3594sec - inet6 fe80::f8c1:2aff:fe27:92a9/64 scope link + inet6 fe80::9844:5eff:fe54:d32c/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever .fi .RE @@ -893,72 +895,69 @@ NDP/DHCPv6: .BR "Start and connect a guest with basic port forwarding" .RS .nf -$ ./passt -f -t 2222:22 -Outbound interface: eth0 -ARP: - address: 28:16:ad:39:a9:ea +$ passt -f -t 2222:22 +UNIX domain socket bound at /tmp/passt_1.socket +No IPv6 nameserver available for NDP/DHCPv6 +Template interface: enp9s0 (IPv4), enp9s0 (IPv6) +MAC: + host: 9a:55:9a:55:9a:55 + NAT to host 127.0.0.1: 88.198.0.161 DHCP: - assign: 192.168.1.118 - mask: 255.255.255.0 - router: 192.168.1.1 - search: - redhat.com + assign: 88.198.0.164 + mask: 255.255.255.224 + router: 88.198.0.161 +DNS: + 185.12.64.1 + 185.12.64.2 + NAT to host ::1: fe80::1 NDP/DHCPv6: - assign: 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17 - router: fe80::62e3:27ff:fe33:2b01 - search: - redhat.com -UNIX domain socket bound at /tmp/passt_1.socket - -You can now start qrap: - ./qrap 5 qemu-system-x86_64 ... -net socket,fd=5 -net nic,model=virtio -or directly qemu, patched with: - qemu/0001-net-Allow-also-UNIX-domain-sockets-to-be-used-as-net.patch -as follows: - qemu-system-x86_64 ... -net socket,connect=/tmp/passt_1.socket -net nic,model=virtio - + assign: 2a01:4f8:222:904::2 + router: fe80::1 + our link-local: fe80::1 +Inbound forwarding rules (HOST): + TCP [*]:2222 => 22 + +You can now start qemu (>= 7.2, with commit 13c6be96618c): + kvm ... -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket .fi -.BR " [From another terminal]" -.nf -$ ./qrap 5 qemu-system-x86_64 test.qcow2 -m 1024 -display none -nodefaults -nographic -net socket,fd=5 -net nic,model=virtio -Connected to /tmp/passt_1.socket -.fi -.BR " [Back to the original terminal]" +.BR "[From another terminal]" .nf -passt: DHCP: ack to request -passt: from 52:54:00:12:34:56 -passt: NDP: received NS, sending NA -passt: NDP: received RS, sending RA -passt: DHCPv6: received SOLICIT, sending ADVERTISE -passt: NDP: received NS, sending NA -passt: DHCPv6: received REQUEST/RENEW/CONFIRM, sending REPLY -passt: NDP: received NS, sending NA +$ qemu-system-x86_64 -m 128 test.qcow2 -display none -nodefaults -nographic -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket +.fi +.BR "[Back to the original terminal]" +.nf +accepted connection from PID 1301736 +New guest MAC address observed: 52:54:00:12:34:56 +DHCP: offer to discover + from 52:54:00:12:34:56 +DHCP: ack to request + from 52:54:00:12:34:56 +NDP: received RS, sending RA .fi -.BR " [From yet another terminal]" + +.BR "[From yet another terminal]" .nf $ ssh -p 2222 root@localhost root@localhost's password: .fi -.BR " [...]" +.BR "[...]" .nf # ip address show -1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 +1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever -2: ens2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65520 qdisc pfifo_fast state UP group default qlen 1000 +2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff - inet 192.168.1.118/24 brd 192.168.1.255 scope global noprefixroute ens2 + inet 88.198.0.164/27 scope global eth0 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b81d:fa4a:8cdd:cf17/128 scope global noprefixroute + inet6 2a01:4f8:222:904:5054:ff:fe12:3456/64 scope global dynamic flags 100 valid_lft forever preferred_lft forever - inet6 2a02:6d40:3ca5:2001:b019:9ae2:a2fe:e6b4/64 scope global dynamic noprefixroute - valid_lft 3588sec preferred_lft 3588sec - inet6 fe80::1f98:d09f:9309:9e77/64 scope link noprefixroute + inet6 fe80::5054:ff:fe12:3456/64 scope link valid_lft forever preferred_lft forever .fi .RE diff --git a/qrap.1 b/qrap.1 deleted file mode 100644 index 98cc877..0000000 --- a/qrap.1 +++ /dev/null @@ -1,77 +0,0 @@ -.\" SPDX-License-Identifier: GPL-2.0-or-later -.\" Copyright (c) 2020-2021 Red Hat GmbH -.\" Author: Stefano Brivio <sbrivio(a)redhat.com> -.TH qrap 1 - -.SH NAME -.B qrap -\- temporary qemu wrapper connecting UNIX domain socket to file descriptor - -.SH SYNOPSIS -.B qrap -[\fIFDNUM\fR \fIQEMU_CMD\fR] [\fIQEMU_ARG\fR]... -.SH DESCRIPTION -\fBqrap\fR is a wrapper, designed specifically for usage with \fBqemu\fR(1) and -\fBpasst\fR(1), connecting a UNIX domain socket to a file descriptor, and -running \fBqemu\fR(1) with given arguments. - -A running instance of \fBpasst\fR(1) is probed checking for UNIX domain sockets, -answering a dummy ARP request, with names starting from -\fI/tmp/passt_1.socket\fR up to \fI/tmp/passt_64.socket\fR. - -If first and second arguments are not a socket number and a command, that is, -respectively, \fIFDNUM\fR and \fIQEMU_CMD\fR, \fBqrap\fR will try to locate a -qemu executable in \fBPATH\fR and patch the command line to specify a network -device and a \fInetdev\fR back-end for usage with \fBpasst\fR(1). - -If \fBqrap\fR patches the command line, it will remove any potentially -conflicting network device, that is, any \fI-netdev\fR or \fI-net\fR option, or -any \fI-device\fR option with argument starting with \fIvirtio-net-pci,\fR, -\fIvirtio-net-ccw,\fR, \fIe1000,\fR, \fIe1000e,\fR, or \fIrtl8139,\fR. - -.SH EXAMPLES - -.BR "Start qemu explicitly passing its command name and a socket number" -.RS -.nf -$ ./qrap 5 kvm test.qcow2 -m 1024 -display none -nodefaults -nographic -net socket,fd=5 -net nic,model=virtio -.fi -.RE - -.BR "Start qemu without command name and socket number, patching arguments" -.RS -.nf -$ ./qrap test.qcow2 -m 1024 -display none -nodefaults -nographic -.fi -.RE - -.SH NOTES - -This wrapper is temporary: qemu commit 13c6be96618c ("net: stream: add unix -socket") introduces native AF_UNIX socket support, and it should be included in -qemu starting from the 7.2 release. It will be around for a little bit longer to -give users enough time to switch. - -.SH AUTHOR - -Stefano Brivio <sbrivio(a)redhat.com> - -.SH REPORTING BUGS - -No public bug tracker is available at this time. For the moment being, report -issues to Stefano Brivio <sbrivio(a)redhat.com>. - -.SH COPYRIGHT - -Copyright (c) 2020-2021 Red Hat GmbH. - -\fBqrap\fR is free software: you can redistribute is and/or modify it under the -terms of the GNU General Public License as published by the Free Software -Foundation, either version 2 of the License, or (at your option) any later -version. - -.SH SEE ALSO - -\fBqemu\fR(1), \fBpasst\fR(1). - -High-level documentation is available at https://passt.top/passt/about/. diff --git a/qrap.c b/qrap.c deleted file mode 100644 index d596706..0000000 --- a/qrap.c +++ /dev/null @@ -1,429 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later - -/* PASST - Plug A Simple Socket Transport - * - * qrap.c - qemu wrapper connecting UNIX domain socket to file descriptor - * - * Copyright (c) 2020-2021 Red Hat GmbH - * Author: Stefano Brivio <sbrivio(a)redhat.com> - * - * TODO: Drop this implementation once qemu commit 13c6be96618c ("net: stream: - * add unix socket") is included in a release (7.2), and once we can reasonably - * assume existing users switched to it. - */ - -#include <stdio.h> -#include <stdint.h> -#include <stdlib.h> -#include <string.h> -#include <unistd.h> -#include <sys/types.h> -#include <sys/socket.h> -#include <errno.h> -#include <linux/limits.h> -#include <limits.h> -#include <fcntl.h> -#include <net/if_arp.h> -#include <netinet/in.h> -#include <netinet/ip6.h> -#include <netinet/if_ether.h> -#include <time.h> - -#include <linux/icmpv6.h> - -#include "util.h" -#include "ip.h" -#include "passt.h" -#include "arp.h" - -static char *qemu_names[] = { - "kvm", - "qemu-kvm", -#ifdef ARCH - ( "qemu-system-" ARCH ), -#endif - "/usr/libexec/qemu-kvm", - NULL, -}; - -/** - * struct drop_arg - Drop matching arguments on command line - * @name: Option name - * @val: Substring in option value, NULL matches any value - */ -static const struct drop_arg { - char *name; - char *val; -} drop_args[] = { - { "-netdev", NULL }, - { "-net", NULL }, - { "-device", "virtio-net-pci," }, - { "-device", "{\"driver\":\"virtio-net-pci\"," }, - { "-device", "virtio-net-ccw," }, - { "-device", "{\"driver\":\"virtio-net-ccw\"," }, - { "-device", "e1000," }, - { "-device", "{\"driver\":\"e1000\"," }, - { "-device", "e1000e," }, - { "-device", "{\"driver\":\"e1000e\"," }, - { "-device", "rtl8139," }, - { "-device", "{\"driver\":\"rtl8139\"," }, - { 0 }, -}; - -/** - * struct pci_dev - PCI devices to add on command line depending on machine name - * @mach: Machine name - * @name: Device ("-device") name to insert - * @template: Prefix for device specification (first part of address) - * @template_post: Suffix for device specification (last part of address) - * @template_json: Device prefix for when JSON is used - * @template_json_post: Device suffix for when JSON is used - * @base: Base used for PCI addresses - * @first: First usable PCI address - * @last: Last usable PCI address - */ -static const struct pci_dev { - char *mach; - char *name; - char *template; - char *template_post; - char *template_json; - char *template_json_post; - int base; - int first; - int last; -} pci_devs[] = { - { - "pc-q35", "virtio-net-pci", - "bus=pci.", ",addr=0x0", - "\"bus\":\"pci.", ",\"addr\":\"0x0\"", - 10, 3, /* 2: hotplug bus */ 31 - }, - { - "pc-", "virtio-net-pci", - "bus=pci.0,addr=0x", "", - "\"bus\":\"pci.0\",\"addr\":\"0x", "", - 16, 2, /* 1: ISA bridge */ 31 - }, - { - "s390-ccw", "virtio-net-ccw", - "devno=fe.0.", "", - "\"devno\":\"fe.0.", "", - 16, 1, 16 - }, - { 0 }, -}; - -#define DEFAULT_FD 5 - -/** - * usage() - Print usage and exit - * @name: Executable name - */ -void usage(const char *name) -{ - fprintf(stderr, "Usage: %s [FDNUM QEMU_CMD] [QEMU_ARG]...\n", name); - fprintf(stderr, "\n"); - fprintf(stderr, "If first and second arguments aren't a socket number\n" - "and a path, %s will try to locate a qemu binary\n" - "and directly patch the command line\n", name); - - exit(EXIT_FAILURE); -} - -/** - * main() - Entry point and main loop - * @argc: Argument count - * @argv: File descriptor number, then qemu with arguments - * - * Return: 0 once interrupted, non-zero on failure - */ -int main(int argc, char **argv) -{ - int i, s, qemu_argc = 0, addr_map = 0, has_dev = 0, has_json = 0, retry_on_reset, rc; - struct timeval tv = { .tv_sec = 0, .tv_usec = (long)(500 * 1000) }; - char *qemu_argv[ARG_MAX], dev_str[ARG_MAX]; - struct sockaddr_un addr = { - .sun_family = AF_UNIX, - }; - const struct pci_dev *dev = NULL; - long fd; - struct { - uint32_t vnet_len4; - struct ethhdr eh4; - struct arphdr ah; - struct arpmsg am; - - uint32_t vnet_len6; - struct ethhdr eh6; - struct ipv6hdr ip6hr; - struct icmp6hdr ihr; - struct in6_addr target; - } __attribute__((__packed__)) probe = { - .vnet_len4 = htonl(42), - { - .h_dest = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_source = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_proto = htons(ETH_P_ARP), - }, - { .ar_hrd = htons(ARPHRD_ETHER), - .ar_pro = htons(ETH_P_IP), - .ar_hln = ETH_ALEN, - .ar_pln = 4, - .ar_op = htons(ARPOP_REQUEST), - }, - { - .sha = { 0 }, .sip = { 0 }, .tha = { 0 }, .tip = { 0 }, - }, - .vnet_len6 = htonl(78), - { - .h_dest = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_source = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }, - .h_proto = htons(ETH_P_IPV6), - }, - { - .version = 6, - .payload_len = htons(24), - .nexthdr = IPPROTO_ICMPV6, - .hop_limit = 255, - .saddr = IN6ADDR_LOOPBACK_INIT, - .daddr = IN6ADDR_ANY_INIT, - }, - { - .icmp6_type = 135, - .icmp6_code = 0, - }, - IN6ADDR_ANY_INIT, - }; - char probe_r; - - if (argc >= 3) { - const char *path = getenv("PATH"); - errno = 0; - fd = strtol(argv[1], NULL, 0); - if (fd >= 3 && fd < INT_MAX && !errno && path) { - char env_path[ARG_MAX + 1], *p, command[ARG_MAX]; - - strncpy(env_path, path, ARG_MAX); - /* cppcheck-suppress strtokCalled */ - p = strtok(env_path, ":"); - while (p) { - snprintf(command, ARG_MAX, "%s/%s", p, argv[2]); - if (!access(command, X_OK)) - goto valid_args; - - /* cppcheck-suppress strtokCalled */ - p = strtok(NULL, ":"); - } - } - } - - fd = DEFAULT_FD; - - for (i = 1; i < argc - 1; i++) { - if (strcmp(argv[i], "-machine")) - continue; - - for (dev = pci_devs; dev->mach; dev++) { - if (strstr(argv[i + 1], dev->mach) == argv[i + 1]) - break; - } - } - - if (!dev || !dev->mach) - dev = pci_devs; - - for (qemu_argc = 1, i = 1; i < argc; i++) { - const struct drop_arg *a; - - for (a = drop_args; a->name; a++) { - if (!strcmp(argv[i], a->name)) { - if (!a->val) - break; - - if (i + 1 < argc && - strstr(argv[i + 1], a->val) == argv[i + 1]) - break; - } - } - if (a->name) { - i++; - continue; - } - - if (!strcmp(argv[i], "-device") && i + 1 < argc) { - const char *template = NULL; - const char *p; - - has_dev = 1; - - if ((p = strstr(argv[i + 1], dev->template))) { - template = dev->template; - } else if ((p = strstr(argv[i + 1], dev->template_json))) { - template = dev->template_json; - has_json = 1; - } - - if (template) { - long n; - - n = strtol(p + strlen(template), NULL, dev->base); - if (!errno) - addr_map |= (1 << n); - } - } - - qemu_argv[qemu_argc++] = argv[i]; - } - - for (i = dev->first; i < dev->last; i++) { - if (!(addr_map & (1 << i))) - break; - } - if (i == dev->last) { - fprintf(stderr, "Couldn't find free address for device\n"); - usage(argv[0]); - } - - if (has_dev) { - qemu_argv[qemu_argc++] = "-device"; - if (!has_json) { - if (dev->base == 16) { - snprintf(dev_str, ARG_MAX, - "%s,%s%x%s,netdev=hostnet0,x-txburst=4096", - dev->name, dev->template, i, dev->template_post); - } else if (dev->base == 10) { - snprintf(dev_str, ARG_MAX, - "%s,%s%d%s,netdev=hostnet0,x-txburst=4096", - dev->name, dev->template, i, dev->template_post); - } - } else { - if (dev->base == 16) { - snprintf(dev_str, ARG_MAX, - "{\"driver\":\"%s\",%s%x\"%s,\"netdev\":\"hostnet0\",\"x-txburst\":4096}", - dev->name, dev->template_json, i, dev->template_json_post); - } else if (dev->base == 10) { - snprintf(dev_str, ARG_MAX, - "{\"driver\":\"%s\",%s%d\"%s,\"netdev\":\"hostnet0\",\"x-txburst\":4096}", - dev->name, dev->template_json, i, dev->template_json_post); - } - } - qemu_argv[qemu_argc++] = dev_str; - } - - qemu_argv[qemu_argc++] = "-netdev"; - if (!has_json) { - qemu_argv[qemu_argc++] = "socket,fd=" STR(DEFAULT_FD) ",id=hostnet0"; - } else { - qemu_argv[qemu_argc++] = "{\"type\":\"socket\",\"fd\":\"" STR(DEFAULT_FD) "\",\"id\":\"hostnet0\"}"; - } - qemu_argv[qemu_argc] = NULL; - -valid_args: - for (i = 1; i < UNIX_SOCK_MAX; i++) { - retry_on_reset = 50; - -retry: - s = socket(AF_UNIX, SOCK_STREAM, 0); - if (s < 0) { - perror("socket"); - exit(EXIT_FAILURE); - } - - if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) - perror("setsockopt SO_RCVTIMEO"); - if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) - perror("setsockopt SO_SNDTIMEO"); - - snprintf(addr.sun_path, UNIX_PATH_MAX, UNIX_SOCK_PATH, i); - - errno = 0; - - if (connect(s, (const struct sockaddr *)&addr, sizeof(addr))) { - rc = errno; - perror("connect"); - } else if (send(s, &probe, sizeof(probe), 0) != sizeof(probe)) { - rc = errno; - perror("send"); - } else if (recv(s, &probe_r, 1, MSG_PEEK) <= 0) { - rc = errno; - perror("recv"); - } else { - break; - } - - /* FIXME: in a KubeVirt environment, libvirtd invokes qrap three - * times in a strict sequence when a virtual machine needs to - * be started, namely, when: - * - the domain XML is saved - * - the domain is started (for "probing") - * - the virtual machine is started for real - * and it often happens that the qemu process is still running - * when qrap is invoked again, so passt will refuse the new - * connection because the previous one is still active. This - * overlap seems to be anywhere between 0 and 3ms. - * - * If we get a connection reset, retry a few times, to allow for - * the previous qemu instance to terminate and, in turn, for the - * connection to passt to be closed. - * - * This should be fixed in libvirt instead. It probably makes - * sense to check this behaviour once native libvirt support is - * there, and this implies native qemu support too, so at that - * point qrap will have no reason to exist anymore -- that is, - * this FIXME will probably remain until the tool itself is - * obsoleted. - */ - if (retry_on_reset && rc == ECONNRESET) { - retry_on_reset--; - /* cppcheck-suppress usleepCalled */ - usleep(50 * 1000); - goto retry; - } - - fprintf(stderr, "Probe of %s failed\n", addr.sun_path); - - close(s); - } - - if (i == UNIX_SOCK_MAX) { - perror("connect"); - exit(EXIT_FAILURE); - } - - tv.tv_usec = 0; - if (setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv))) - perror("setsockopt, SO_RCVTIMEO reset"); - if (setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) - perror("setsockopt, SO_SNDTIMEO reset"); - - fprintf(stderr, "Connected to %s\n", addr.sun_path); - - if (dup2(s, (int)fd) < 0) { - perror("dup"); - exit(EXIT_FAILURE); - } - - close(s); - - if (qemu_argc) { - char **name; - - for (name = qemu_names; *name; name++) { - qemu_argv[0] = *name; - execvp(*name, qemu_argv); - if (errno != ENOENT) { - perror("execvp"); - usage(argv[0]); - } - } - if (errno == ENOENT) - fprintf(stderr, "Couldn't find qemu command\n"); - } else { - execvp(argv[2], argv + 2); - } - - perror("execvp"); - - return EXIT_FAILURE; -} diff --git a/tap.c b/tap.c index cf87591..dfa66c7 100644 --- a/tap.c +++ b/tap.c @@ -1377,8 +1377,6 @@ static void tap_backend_show_hints(const struct ctx *c) info("\nYou can now start qemu (>= 7.2, with commit 13c6be96618c):"); info(" kvm ... -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=%s", c->sock_path); - info("or qrap, for earlier qemu versions:"); - info(" ./qrap 5 kvm ... -net socket,fd=5 -net nic,model=virtio"); break; case MODE_VU: info("You can start qemu with:"); diff --git a/test/build/build.py b/test/build/build.py index 59de014..f97851f 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -68,7 +68,7 @@ def test_make(target: str, expected_files: list[str]) -> None: assert not p.exists(), f"{p} existed after make clean" -BINARIES = ['passt', 'pasta', 'qrap', 'passt-repair', 'pesto'] +BINARIES = ['passt', 'pasta', 'passt-repair', 'pesto'] for bin in BINARIES: @@ -104,7 +104,7 @@ def test_install_uninstall() -> None: as prefix: bindir = Path(prefix) / 'bin' mandir = Path(prefix) / 'share/man' - progs = ['passt', 'pasta', 'qrap'] + progs = ['passt', 'pasta'] # Install sh(f'make install CFLAGS="-Werror" prefix={prefix}') diff --git a/test/distro/opensuse b/test/distro/opensuse index eab722b..9ceb0bd 100644 --- a/test/distro/opensuse +++ b/test/distro/opensuse @@ -39,7 +39,7 @@ hostb ./passt -s __STATEDIR__/passt.socket -P __PIDFILE__ & sleep 1 host echo hout DNS6 sed -n 's/^nameserver $[^:]*:$$[^%]*$.*/\1\2/p' /etc/resolv.conf | head -1 -hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 qrap.1 Makefile README.md | tr '\n' ' '; echo +hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 Makefile README.md | tr '\n' ' '; echo test OpenSUSE Leap 15.1 diff --git a/test/distro/ubuntu b/test/distro/ubuntu index 8750455..266bae1 100644 --- a/test/distro/ubuntu +++ b/test/distro/ubuntu @@ -63,7 +63,7 @@ endef hostb ./passt -s __STATEDIR__/passt.socket -P __PIDFILE__ & sleep 1 host echo -hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 qrap.1 Makefile README.md | tr '\n' ' '; echo +hout GUEST_FILES ls -1 *.c *.h *.sh passt.1 Makefile README.md | tr '\n' ' '; echo test Ubuntu 14.04.5 LTS (Trusty Tahr), amd64 -- 2.43.0

2 1

[PATCH v2 0/2] Allow users to give source address with --gateway also for IPv6
by Stefano Brivio 24 Jul '26

24 Jul '26

...just like it happens with IPv4. This offers a solution for https://bugs.passt.top/show_bug.cgi?id=217, as Podman can specify --address and --gateway for IPv6, and provide a unique local address, without the need to introduce other options. Further options might be more appropriate, strictly speaking, but as the future perspective is to eventually generalise NAT tables, it would be nice to avoid them right now. v2: In 2/2, use the address passed as --gateway as source for inbound NAT from the host also when we're not in local mode Stefano Brivio (2): conf: Honour --address, --gateway, --netmask in local mode as well conf, fwd: Prefer same-scope address as inbound source address from host conf.c | 25 +++++++++++++++++++++---- fwd.c | 6 +++++- passt.h | 2 ++ 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.43.0

2 3

[PATCH v2 0/2] pasta: Do not configure ID mappings when invoked with --netns-only
by Dwayne B. Bent 23 Jul '26

23 Jul '26

Patch revised based on comments: 1. Reordered test and code commits to not break bisections. 2. Added `Link:` lines to commit messages. Otherwise code and test are the same. Thanks. Dwayne B. Bent (2): pasta: Do not configure ID mappings when invoked with --netns-only pasta: Regression test for bug 216 conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 5 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 test/pasta_options/netns_only -- 2.55.0

3 5

[PATCH v3] feat: Add cli option '--pass-fds' for pasta mode.
by Richard Lawrence 23 Jul '26

23 Jul '26

From: Richard Lawrence <rarensu(a)tamu.edu> When pasta mode is used to launch an executable (`pasta [COMMAND]`) and that executable accepts inputs in the form of arbitrary file descriptors (such as `bwrap`), then passt should not stand in the way of the parent process handing off those file descriptors to the child process. See bug 204 for additional discussion. The `pass-fds` option accepts a comma-separated list of file descriptor numbers. `conf_pass_fds()` parses the command line argument, then `isolate_fds()` skips closing the specified fds by calling `close_range()` on the gaps between them. Additionally, the tap fd is safely relocated to the lowest unused fd number which it at least 3, to avoid accidentally overwriting an existing fd. Signed-off-by: Richard Lawrence <rlawrence(a)tamu.edu> --- conf.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++++- conf.h | 3 +++ isolation.c | 73 ++++++++++++++++++++++++++++++++++++++++++---------- passt.1 | 5 ++++ 4 files changed, 140 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index 0fcba5c..729816d 100644 --- a/conf.c +++ b/conf.c @@ -732,7 +732,9 @@ pasta_opts: " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" " --no-splice Disable inbound socket splicing\n" - " --splice-only Only enable loopback forwarding\n"); + " --splice-only Only enable loopback forwarding\n" + " --pass-fds FDS Comma-separated list of fds to pass to\n" + " the spawned command\n"); passt_exit(status); } @@ -1183,6 +1185,71 @@ int conf_tap_fd(int argc, char **argv) return val; } +/** + * conf_pass_fds() - Read fds as supplied by --pass-fds command line option + * @argc: Argument count + * @argv: Command line options + * @fds: Array where we store the parsed fds + * @max_fds: Maximum size of the array + * + * Return: number of parsed fds, or -1 if option not specified + */ +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds) +{ + const struct option opt[] = { { "pass-fds", required_argument, NULL, 33 }, + { 0 }, }; + const char *fdsarg = NULL; + int name, fds_cnt = 0; + int old_opterr; + + old_opterr = opterr; + opterr = 0; + optind = 0; + do { + name = getopt_long(argc, argv, "-:", opt, NULL); + if (name == 33) + fdsarg = optarg; + } while (name != -1); + opterr = old_opterr; + + if (!fdsarg) + return -1; + + const char *orig_fdsarg = fdsarg; + + while (*fdsarg) { + unsigned long val; + char *endptr; + + val = strtoul(fdsarg, &endptr, 10); + if (fdsarg == endptr) { + die("Invalid character in --pass-fds option '%s' (near '%s')", + orig_fdsarg, fdsarg); + } + + if (val > INT_MAX) { + die("Invalid file descriptor in --pass-fds option '%s' (near '%s')", + orig_fdsarg, fdsarg); + } + + if (fds_cnt >= max_fds) + die("Too many file descriptors in --pass-fds"); + + fds[fds_cnt++] = (int)val; + + if (*endptr == ',') + fdsarg = endptr + 1; + else if (*endptr == '\0') + fdsarg = endptr; + else { + die("Invalid character in --pass-fds option '%s' (near '%s')", + orig_fdsarg, endptr); + } + } + + return fds_cnt; +} + /** * conf_addr() - Configure guest address with -a option * @c: Execution context @@ -1331,6 +1398,7 @@ void conf(struct ctx *c, int argc, char **argv) {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, {"chroot-fallback", no_argument, NULL, 32 }, + {"pass-fds", required_argument, NULL, 33 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1572,6 +1640,10 @@ void conf(struct ctx *c, int argc, char **argv) case 32: c->chroot_fallback = true; break; + case 33: + if (c->mode != MODE_PASTA) + die("--pass-fds is for pasta mode only"); + break; case 'd': c->debug = 1; c->quiet = 0; diff --git a/conf.h b/conf.h index 19bf9bc..28a9acc 100644 --- a/conf.h +++ b/conf.h @@ -6,7 +6,10 @@ #ifndef CONF_H #define CONF_H +#define PASS_FDS_MAX 1024 + enum passt_modes conf_mode(int argc, char *argv[]); +int conf_pass_fds(int argc, char **argv, int *fds, int max_fds); int conf_tap_fd(int argc, char **argv); void conf(struct ctx *c, int argc, char **argv); void conf_listen_handler(struct ctx *c, uint32_t events); diff --git a/isolation.c b/isolation.c index 94cbe7f..25f599b 100644 --- a/isolation.c +++ b/isolation.c @@ -249,32 +249,77 @@ void isolate_initial(void) } /* - * isolate_fds() - Close leaked files, but not --fd, stdin, stdout, stderr + * isolate_fds() - Close leaked files, but not --fd, --pass-fds, standard streams * @argc: Argument count - * @argv: Command line options, as we need to skip any file given via --fd + * @argv: Command line options * * Should: - * - close all open files except for standard streams and the one from --fd + * - close all open files except for standard streams, --fd, and --pass-fds * - move the --fd descriptor out of the range 0-2 * * Return: new fd number for descriptor from --fd, or -1 if not specified */ int isolate_fds(int argc, char **argv) { - int fd, close_from = STDERR_FILENO + 1; + int fds[PASS_FDS_MAX + 1]; + int fds_cnt = 0; + int prev_fd; + int next_fd; + int tap_fd; + int rc = 0; + int i; + + tap_fd = conf_tap_fd(argc, argv); + if (tap_fd >= 0 && tap_fd < 3) { + /* Move the tap fd to a safer location */ + int new_fd = fcntl(tap_fd, F_DUPFD, STDERR_FILENO + 1); + + if (new_fd < 0) + die_perror("Could not relocate --fd descriptor"); + + close(tap_fd); + tap_fd = new_fd; + } + + if (tap_fd >= 0) + /* Keep the tap fd */ + fds[fds_cnt++] = tap_fd; + + rc = conf_pass_fds(argc, argv, fds + fds_cnt, PASS_FDS_MAX); + if (rc > 0) + /* Keep the pass-fds */ + fds_cnt += rc; - fd = conf_tap_fd(argc, argv); + rc = 0; - if (fd >= 0) { - /* Move the passed fd to a more convenient location */ - if (fd != close_from && - (dup2(fd, close_from) != close_from || - close(fd))) - die_perror("Could not move --fd descriptor"); - fd = close_from++; + /* Keep standard streams */ + prev_fd = STDERR_FILENO; + + while (1) { + next_fd = -1; + + /* Find the next-lowest fd to keep */ + for (i = 0; i < fds_cnt; i++) { + if (fds[i] > prev_fd && (next_fd == -1 || fds[i] < next_fd)) + next_fd = fds[i]; + } + + if (next_fd == -1) + break; + + if (next_fd > prev_fd + 1) { + /* Close fds between two kept fds */ + if (close_range(prev_fd + 1, next_fd - 1, CLOSE_RANGE_UNSHARE)) + rc = -1; + } + prev_fd = next_fd; } + + /* Close all other fds */ + if (close_range(prev_fd + 1, ~0U, CLOSE_RANGE_UNSHARE)) + rc = -1; - if (close_range(close_from, ~0U, CLOSE_RANGE_UNSHARE)) { + if (rc) { if (errno == ENOSYS || errno == EINVAL) { /* This probably means close_range() or the * CLOSE_RANGE_UNSHARE flag is not supported by the @@ -288,7 +333,7 @@ int isolate_fds(int argc, char **argv) } } - return fd; + return tap_fd; } /** diff --git a/passt.1 b/passt.1 index 995590a..bcd3aff 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ of local traffic in pasta\fR in the \fBNOTES\fR for more details. Do not create a tap device in the namespace. In this mode, \fIpasta\fR only forwards loopback traffic between namespaces. +.TP +.BR \-\-pass\-fds " " \fIfds\fR +Pass a comma-separated list of file descriptors to the spawned command. +These file descriptors will be kept open. + .SH EXAMPLES .SS \fBpasta -- 2.52.0

4 6

[PATCH 0/2] pasta: Do not configure ID mappings when invoked with --netns-only
by Dwayne B. Bent 22 Jul '26

22 Jul '26

This is a narrow fix for bug 216 where `pasta` attempts to configure user and group ID mappings when invoked with `--netns-only`. A new `bool` argument `config_idmaps` was added to `pasta_start_ns()` that guards the logic to configure user and group ID mappings. It is set to `false` when `netns_only` is `true`. OpenAI Codex was used to explore and understand the codebase. Code written myself. Test written by Codex guided and reviewed by me. Dwayne B. Bent (2): pasta: Regression test for bug 216 pasta: Do not configure ID mappings when invoked with --netns-only conf.c | 2 +- pasta.c | 24 ++++++++++++++---------- pasta.h | 3 ++- test/pasta_options/netns_only | 19 +++++++++++++++++++ test/run | 1 + 5 files changed, 37 insertions(+), 12 deletions(-) create mode 100644 test/pasta_options/netns_only -- 2.55.0

2 4