- dev - passt

passt: new version 2026_05_07.1afd4ed available
by Stefano Brivio 08 May '26

08 May '26

The new version with tag 2026_05_07.1afd4ed includes the following changes: 1afd4ed hooks: Copy static build of pesto and related man page to server 82523bc fedora: Install pesto, its SELinux policy, and the man page from the spec file 5335770 selinux: Add file context and type enforcement for pesto b3b2632 apparmor: Add policy file for pesto 2692ef3 pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules e371d34 fwd_rule: Fix static checkers warnings in fwd_rule_add() 4ff9887 conf, fwd: Allow switching to new rules received from pesto 7c5b1d7 pesto, conf: Send updated rules from pesto back to passt/pasta cbd58d6 pesto: Parse and add new rules from command line fa06768 pesto: Read current ruleset from passt/pasta and optionally display it 24c7ef9 inany: Prepare inany.[ch] for sharing with pesto tool c9f7ed1 ip: Prepare ip.[ch] for sharing with pesto tool ba3047a pesto: Expose list of pifs to pesto and display them f1d893c pesto, conf: Have pesto connect to passt and check versions 8ad7dd4 pesto, log: Share log.h (but not log.c) with pesto tool 02236db pesto: Introduce stub configuration tool 6cf93ed fwd_rule: Fix some format specifiers cbcd428 pif: Limit pif names to 128 bytes 393c87e fwd: Generalise fwd_rules_info() 279b679 fwd_rule: Move conflict checking back within fwd_rule_add() c0e0c2f fwd, conf: Move rule parsing code to fwd_rule.[ch] 21d565d fwd_rule: Move ephemeral port probing to fwd_rule.c 0aeda87 conf, fwd: Stricter rule checking in fwd_rule_add() a458719 tcp: Use SO_MEMINFO for accurate send buffer overhead accounting ec96f01 tcp: Handle errors from tcp_send_flag() a287375 fwd, conf: Add capabilities bits to each forwarding table 2230d5b conf: Don't pass raw commandline argument to conf_ports_spec() 0521f83 conf: Move SO_BINDTODEVICE workaround to conf_ports() 4e09ddf conf: Allow user-specified auto-scanned port forwarding ranges bf7eebc conf: Move "all" handling to port specifier 0a466eb doc: Rework man page description of port specifiers 831857e tcp: Replace send buffer boost with EPOLLOUT monitoring ea5a4bb conf: Rework checking for garbage after a range 42c49e8 conf: Rework stepping through chunks of port specifiers d62a552 conf: Don't be strict about exclusivity of forwarding mode b68cac0 fwd: Improve error handling in fwd_rule_add() 2bffb63 fwd_rule: Move rule conflict checking from fwd_rule_add() to caller 02742fa fwd: Split rule building from rule adding 2093b33 conf: Pass protocol explicitly to conf_ports_range_except() f9d9926 fwd_rule: Move forwarding rule formatting 438b0df fwd: Better split forwarding rule specification from associated sockets dbe0ba1 conf: Permit -[tTuU] all in pasta mode a47b6ac doc: Consolidate -[tu] option descriptions for passt and pasta 189a3c5 conf: Move first pass handling of -[TU] next to handling of -[tu] de8ebc5 conf: Simplify handling of default forwarding mode 4d8aa0a conf: Split parsing of port specifiers from the rest of -[tuTU] parsing 5ac9cf1 tap, tcp, udp: Use rate-limited logging 926f5b4 conf: use a single buffer for print formatting in conf_print() f758d93 log: Add rate-limiting macros for log messages 6dad076 fwd: Split forwarding rule specification from its implementation state 51eaaa7 bitmap: Split bitmap helper functions into their own module 93c3e35 ip: Define a bound for the string returned by ipproto_name() ed187c3 conf: Remove redundant warning when SO_BINDTODEVICE is unavailable 72e7162 conf: Move check for disabled interfaces earlier 9c37a48 conf: Move check for mapping port 0 to caller 66e26b9 conf: Don't bother complaining about overlapping excluded ranges 1f9ee4f fwd, conf: Expose ephemeral ports as bitmap rather than function 35c56c5 fwd: Allow FWD_DUAL_STACK_ANY flag to be passed directly to fwd_rule_add() 559d4dc fwd: Store forwarding tables indexed by (origin) pif 1f974cc fwd: Look up rule index in fwd_sync_one() 0dc9f20 fwd: Move selecting correct scan bitmap into fwd_sync_one() b7a4718 serialise: Add helpers for serialising unsigned integers 8081aa5 serialise: Split functions user for serialisation from util.c 41b0c7b vhost_user: Fix assorted minor cppcheck warnings e2794c7 fwd: Comparing rule can be const 57117e4 conf: runas can be const bc872d9 treewide: Spell ASSERT() as assert() 451fb76 vu_common: Move iovec management into vu_collect() f5391ae vu_handle_tx: Pass actual remaining out_sg capacity to vu_queue_pop() b9d076d virtio: Pass iovec arrays as separate parameters to vu_queue_pop() 47e56fd pif: Remove unused PIF_NAMELEN b5e6ef4 doc: Fix formatting of (DEPRECATED) notes in man page 744d6df Makefile: Use $^ to avoid duplication in static checker rules 1b32bfe conf: Parse all forwarding options at the same time ea239bf conf: Don't defer handling of --dns option ee0e20e fwd: Always open /proc/net{tcp,tcp6,udp,udp6} in pasta mode d460ca3 fwd: Unify TCP and UDP forwarding tables bb2e4dd fwd: Split forwarding table from port scanning state d30e0b7 Fix misnamed field in struct ctx comments 4fa0076 fwd: Don't initialise unused port bitmaps d2438ef tcp: Remove stale description of port_to_tap field 0294fae conf, fwd: Make overall forwarding mode local to conf path 831e983 netlink: Allow NULL to be passed as addr parameter to nl_addr_get (again) 251e676 netlink: Return prefix length for IPv6 addresses in nl_addr_get() 045560c iov: Add iov_truncate() helper and use it in vu handlers 994bb76 tcp: Avoid comparison of expressions with different signedness in RTT_SET() ab77097 tcp: Avoid comparison of expressions with different signedness in tcp_timer_handler() 5766fe8 migrate: Rename v1 address functions to v2 for clarity 71a0d6c vu_common: Always set num_buffers in virtio-net header 685864d clang-tidy: Don't insist on #ifdef over #if defined() 9ee7805 fwd, pif: Replace with pif_sock_l4() with pif_listen() 7d0fe08 tcp: Use flow_foreach_of_type() in tcp_{keepalive,inactivity} adbf5c1 Add missing includes to headers d2f7c21 tcp: Send TCP keepalive segments after a period of tap-side inactivity a681e44 tcp: Extend tcp_send_flag() to send TCP keepalive segments 1820103 tcp: Re-introduce inactivity timeouts based on a clock algorithm e48ce41 tcp: Remove non-working activity timeout mechanism eb3babf tcp_vu, udp_vu: Fix comment headers for header length functions 66e5941 Fix build when HAS_GETRANDOM is undefined 8636c73 tcp_vu, udp_vu: Account for virtio net header in minimum frame size de5b694 tcp_vu: vu_pad() expects l2 length c320191 conf: Support CIDR notation for -a/--address option 02af38d virtio: Introduce VNET_HLEN macro for virtio net header length 812cdb8 tcp: Move tap header update out of tcp_fill_headers() bebafa7 udp: Split activity timeouts for UDP flows 036fb87 checksum: add VSX fast path for POWER8/POWER9 af7b81b migrate: Use forward table information to close() listening sockets 768baf4 tcp, tcp_splice: Check for failures of shutdown(2) 3581ded tcp: Eliminate FIN_TIMEOUT e992b14 tcp: Retransmit FINs like data segments e3f70c0 tcp_splice: Force TCP RST on abnormal close conditions cce94e9 tcp: Properly propagate tap-side RST to socket side 07390d1 doc: Add test program verifying socket RST behaviour 69ce8ee tcp: Add error checking for flow_epoll_set() in tcp_flow_migrate_target() https://passt.top/passt/log/?qt=range&q=2026_01_20.386b5f5..2026_05_07.1afd… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10433312/ permanent mirror: https://passt.top/builds/copr/0^20260507.g1afd4ed/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1afd4ed-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1afd4ed-1_all.deb -- Stefano

1 0

[PATCH v3] tcp: Use SO_MEMINFO for accurate send buffer overhead accounting
by Jon Maloy 07 May '26

07 May '26

The TCP window advertised to the guest/container must balance two competing needs: large enough to trigger kernel socket buffer auto-tuning, but not so large that sendmsg() partially fails, causing retransmissions. The current approach uses the difference (SNDBUF_GET() - SIOCOUTQ), but SNDBUF_GET() returns a scaled value that only roughly accounts for per-skb overhead. The clamped_scale approximation doesn't accurately track the actual per-segment overhead, which can lead to both excessive retransmissions and reduced throughput. We now introduce the use of SO_MEMINFO to obtain SK_MEMINFO_SNDBUF and SK_MEMINFO_WMEM_QUEUED from the kernel. The latter is presented in the kernel's own accounting units, i.e. including the sk_buff overhead, and matches exactly what the kernel's own sk_stream_memory_free() function is using. When data is queued and the overhead ratio is observable, we calculate the per-segment overhead as (wmem_queued - sendq) / num_segments, then determine how many additional segments should fit in the remaining buffer space, considering the calculated per-mss overhead. This approach treats segments as discrete quantities, and produces a more accurate estimate of available buffer space than a linear scaling factor does. When the ratio cannot be observed, e.g. because the queue is empty or we are in a transient state, we fall back to the existing clamped_scale calculation (scaling between 100% and 75% of buffer capacity). When SO_MEMINFO succeeds, we also use SK_MEMINFO_SNDBUF directly to set SNDBUF, avoiding a separate SO_SNDBUF getsockopt() call. If SO_MEMINFO is unavailable, we fall back to the pre-existing SNDBUF_GET() - SIOCOUTQ calculation. Link: https://bugs.passt.top/show_bug.cgi?id=138 Link: https://github.com/containers/podman/issues/28219 Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: Updated according to feedback from Stefano. Segment-based discrete overhead calculation instead of linear ratio. v3: Addressed Stefano's v2 feedback: - Extracted window calculation into tcp_wnd_from_sndbuf() - Use wmem_queued instead of SIOCOUTQ for fallback and SWS check --- tcp.c | 137 ++++++++++++++++++++++++++++++++++------------------- tcp_conn.h | 2 +- 2 files changed, 89 insertions(+), 50 deletions(-) diff --git a/tcp.c b/tcp.c index 43b8fdb..61160cf 100644 --- a/tcp.c +++ b/tcp.c @@ -295,6 +295,7 @@ #include <arpa/inet.h> #include <linux/sockios.h> +#include <linux/sock_diag.h> #include "checksum.h" #include "util.h" @@ -1017,6 +1018,90 @@ size_t tcp_fill_headers(const struct ctx *c, struct tcp_tap_conn *conn, return MAX(l3len + sizeof(struct ethhdr), ETH_ZLEN); } +/** + * tcp_wnd_from_sndbuf() - Calculate window from available send buffer space + * @s: Socket file descriptor + * @conn: Connection pointer + * @tinfo: tcp_info from kernel + * + * Return: window value to advertise, not scaled + */ +static uint32_t tcp_wnd_from_sndbuf(int s, struct tcp_tap_conn *conn, + const struct tcp_info_linux *tinfo) +{ + uint32_t rtt_ms_ceiling = DIV_ROUND_UP(tinfo->tcpi_rtt, 1000); + uint32_t mem[SK_MEMINFO_VARS]; + socklen_t mem_sl = sizeof(mem); + int mss = MSS_GET(conn); + uint32_t limit, sendq; + + if (ioctl(s, SIOCOUTQ, &sendq)) { + debug_perror("SIOCOUTQ on socket %i, assuming 0", s); + sendq = 0; + } + + if (getsockopt(s, SOL_SOCKET, SO_MEMINFO, &mem, &mem_sl)) { + tcp_get_sndbuf(conn); + + if (sendq > SNDBUF_GET(conn)) /* Due to memory pressure? */ + limit = 0; + else + limit = SNDBUF_GET(conn) - sendq; + } else { + uint32_t sndbuf = mem[SK_MEMINFO_SNDBUF]; + uint32_t wmemq = mem[SK_MEMINFO_WMEM_QUEUED]; + uint32_t scaled = clamped_scale(sndbuf, sndbuf, SNDBUF_SMALL, + SNDBUF_BIG, 75); + + SNDBUF_SET(conn, MIN(INT_MAX, scaled)); + + if (wmemq > sndbuf) { + limit = 0; + } else if (!sendq || !mss || wmemq <= sendq) { + limit = SNDBUF_GET(conn) - wmemq; + } else { + uint32_t used_segs = MAX(sendq / mss, 1); + uint32_t overhead = (wmemq - sendq) / used_segs; + uint32_t remaining = sndbuf - wmemq; + uint32_t avail_segs = remaining / (mss + overhead); + + limit = avail_segs * mss; + } + } + + /* If the sender uses mechanisms to prevent Silly Window + * Syndrome (SWS, described in RFC 813 Section 3) it's critical + * that, should the window ever become less than the MSS, we + * advertise a new value once it increases again to be above it. + * + * The mechanism to avoid SWS in the kernel is, implicitly, + * implemented by Nagle's algorithm (which was proposed after + * RFC 813). + * + * To this end, for simplicity, approximate a window value below + * the MSS to zero, as we already have mechanisms in place to + * force updates after the window becomes zero. This matches the + * suggestion from RFC 813, Section 4. + * + * But don't do this if, either: + * + * - there's nothing in the outbound queue: the size of the + * sending buffer is limiting us, and it won't increase if we + * don't send data, so there's no point in waiting, or + * + * - we haven't sent data in a while (somewhat arbitrarily, ten + * times the RTT), as that might indicate that the receiver + * will only process data in batches that are large enough, + * but we won't send enough to fill one because we're stuck + * with pending data in the outbound queue + */ + if (limit < (uint32_t)MSS_GET(conn) && sendq && + tinfo->tcpi_last_data_sent < rtt_ms_ceiling * 10) + limit = 0; + + return MIN(tinfo->tcpi_snd_wnd, limit); +} + /** * tcp_update_seqack_wnd() - Update ACK sequence and window to guest/tap * @c: Execution context @@ -1124,56 +1209,10 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn, } } - if ((conn->flags & LOCAL) || tcp_rtt_dst_low(conn)) { + if ((conn->flags & LOCAL) || tcp_rtt_dst_low(conn)) new_wnd_to_tap = tinfo->tcpi_snd_wnd; - } else { - unsigned rtt_ms_ceiling = DIV_ROUND_UP(tinfo->tcpi_rtt, 1000); - uint32_t sendq; - int limit; - - if (ioctl(s, SIOCOUTQ, &sendq)) { - debug_perror("SIOCOUTQ on socket %i, assuming 0", s); - sendq = 0; - } - tcp_get_sndbuf(conn); - - if ((int)sendq > SNDBUF_GET(conn)) /* Due to memory pressure? */ - limit = 0; - else - limit = SNDBUF_GET(conn) - (int)sendq; - - /* If the sender uses mechanisms to prevent Silly Window - * Syndrome (SWS, described in RFC 813 Section 3) it's critical - * that, should the window ever become less than the MSS, we - * advertise a new value once it increases again to be above it. - * - * The mechanism to avoid SWS in the kernel is, implicitly, - * implemented by Nagle's algorithm (which was proposed after - * RFC 813). - * - * To this end, for simplicity, approximate a window value below - * the MSS to zero, as we already have mechanisms in place to - * force updates after the window becomes zero. This matches the - * suggestion from RFC 813, Section 4. - * - * But don't do this if, either: - * - * - there's nothing in the outbound queue: the size of the - * sending buffer is limiting us, and it won't increase if we - * don't send data, so there's no point in waiting, or - * - * - we haven't sent data in a while (somewhat arbitrarily, ten - * times the RTT), as that might indicate that the receiver - * will only process data in batches that are large enough, - * but we won't send enough to fill one because we're stuck - * with pending data in the outbound queue - */ - if (limit < MSS_GET(conn) && sendq && - tinfo->tcpi_last_data_sent < rtt_ms_ceiling * 10) - limit = 0; - - new_wnd_to_tap = MIN((int)tinfo->tcpi_snd_wnd, limit); - } + else + new_wnd_to_tap = tcp_wnd_from_sndbuf(s, conn, tinfo); new_wnd_to_tap = MIN(new_wnd_to_tap, MAX_WINDOW); if (!(conn->events & ESTABLISHED)) diff --git a/tcp_conn.h b/tcp_conn.h index 6985426..9f5bee0 100644 --- a/tcp_conn.h +++ b/tcp_conn.h @@ -98,7 +98,7 @@ struct tcp_tap_conn { #define SNDBUF_BITS 24 unsigned int sndbuf :SNDBUF_BITS; #define SNDBUF_SET(conn, bytes) (conn->sndbuf = ((bytes) >> (32 - SNDBUF_BITS))) -#define SNDBUF_GET(conn) (conn->sndbuf << (32 - SNDBUF_BITS)) +#define SNDBUF_GET(conn) ((uint32_t)(conn->sndbuf << (32 - SNDBUF_BITS))) uint8_t seq_dup_ack_approx; -- 2.52.0

2 1

[PATCH v11 00/23] Dynamic configuration update implementation
by Stefano Brivio 07 May '26

07 May '26

Changes in v11: * Drop debugging left-overs in 10/23, reported by Paul * In 9/23, don't declare argv as const argument for conf_pasta_ns(), because some versions of gcc (perhaps depending on the glibc version?), at least gcc 16.0.1 from Fedora Rawhide, are not happy with that. Suppress the cppcheck warning instead Changes in v10: * For some reason, changes in 9/23 now trigger seemingly unrelated, but valid, cppcheck warnings: fix them directly there * In 19/23, only consider exact matches for rules we're deleting, report an error if there are conflicts that are not exact matches. Further, address (other) comments by Laurent: a typo in the man page, a typo in a comment in fwd_rule_del(), and a serious issue in pesto's main where we would use the "inbound" table for -T / -U Changes in v9: * Rework Makefile changes and solve conflicts so that we can drop the dependency on "Improvements to static checker invocation" * In 8/23, drop the "experimental" note from the man page * In 10/23, switch to protocol version 1, add basil to the magic sauce * In 11/23, initialise struct pesto_pif_info sent by the server (details in commit message) * In 15/23, add description for -s / --show to pesto.1 as well * In 18/23, make comments about redundant checks more verbose * In 19/23, make it clear that tables handled by fwd_rule_del() can't refer to any open socket, add a TODO to fwd_rule_clear() in that sense as well, and use pif_conf_by_name() in pesto to find the table we need to clear * Add 19/23 to 23/23 (LSM policies, packaging stuff) to make pesto ready for shipping Changes in v8: * Implement --add, --delete, and --clear in 19/19, to add forwarding rules instead of replacing tables, delete existing rules, and explicitly clear tables * Address Laurent's comments for 15/19 and 17/19 * In 10/19, instead of passing SOCK_NONBLOCK to accept4(), explicitly set O_NONBLOCK on the listening socket. Using SOCK_NONBLOCK doesn't do what we want, as it results in setting O_NONBLOCK on the new socket rather than on the listening one * Note: 18/19 is left as it is, I didn't address pending comments yet * Note: this doesn't include yet changes for AppArmor and SELinux policies, as well as changes for the template Fedora spec file. I'm still working on them Changes in v7: * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18, 12/18, 14/18, 15/18 (details in commit messages of single patches, before my Signed-off-by) * Note: this doesn't include yet --add and --delete, I'm still working on that Changes in v6: * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18 * Dodged all warnings from static checkers (Coverity Scan and clang-tidy) with changes in 10/18, 11/18, 16/18, and with a new patch, 18/18 * This does *not* include yet the implementation of --add and --delete switches for pesto as I originally intended, I'm rather far from being done with those. At the moment I just have a "mode selection" implementation for command line parsing but merging rules to / removing rules from / clearing the current table is something I barely started (and what I have at the moment isn't really valuable anyway) David wrote: --- Here's the next draft of dynamic configuration updates. This now can successfully update rules, though I've not tested it very extensively. Patches 1..8/18 are preliminary reworks that make sense even without pesto - feel free to apply if you're happy with them. I don't think the rest should be applied yet; we need to at least harden it so passt can't be blocked indefinitely by a client which sends a partial update then waits. Based on my earlier series reworking static checking invocation. TODO: - Don't allow a client which sends a partial configuration then blocks also block passt - Allow pesto to clear existing configuration, not just add - Allow pesto selectively delete existing rules, not just add Changes in v5: * If multiple clients connect at once, they're now blocked until the first one finishes, instead of later ones being discarded Changes in v4: * Merged with remainder of forward rule parsing rework series * Fix some bugs in rule checking pointed out by Laurent * Significantly cleaned up option parsing code * Changed from replacing all existing rules to adding new rules (clear and remove still TBD) * Somewhat simplified protocol (pif names and rules sent in a single pass) * pesto is now allocation free * Fixed commit message and style nits pointed out by Stefano Changes in v3: * Removed already applied ASSERT() rename * Renamed serialisation functions * Incorporated Stefano's extensions, reworked and fixed * Several additional cleanups / preliminary reworks Changes in v2: * Removed already applied cleanups * Reworked assert() patch to handle -DNDEBUG properly * Numerous extra patches: * Factored out serialisation helpers and use them for migration as well * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto * Reworks to share some forwarding rule datatypes with pesto * Implemented sending pif names and current ruleset to pesto --- David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and display them ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (6): fwd_rule: Fix static checkers warnings in fwd_rule_add() pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules apparmor: Add policy file for pesto selinux: Add file context and type enforcement for pesto fedora: Install pesto, its SELinux policy, and the man page from the spec file hooks: Copy static build of pesto and related man page to server .gitignore | 2 + Makefile | 35 +- common.h | 116 ++++++ conf.c | 696 ++++++++++++++------------------ conf.h | 2 + contrib/apparmor/usr.bin.pesto | 23 ++ contrib/fedora/passt.spec | 14 +- contrib/selinux/pesto.fc | 11 + contrib/selinux/pesto.te | 95 +++++ epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++------ fwd.h | 41 +- fwd_rule.c | 705 +++++++++++++++++++++++++++++++-- fwd_rule.h | 68 +++- hooks/pre-push | 1 + inany.c | 19 +- inany.h | 17 +- ip.c | 56 +-- ip.h | 4 +- lineread.c | 2 +- log.h | 53 ++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pasta.c | 4 +- pesto.1 | 275 +++++++++++++ pesto.c | 522 ++++++++++++++++++++++++ pesto.h | 54 +++ pif.c | 2 +- pif.h | 7 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 64 ++- util.h | 110 +---- 36 files changed, 2419 insertions(+), 798 deletions(-) create mode 100644 common.h create mode 100644 contrib/apparmor/usr.bin.pesto create mode 100644 contrib/selinux/pesto.fc create mode 100644 contrib/selinux/pesto.te create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

2 27

[PATCH v9 00/23] Dynamic configuration update implementation
by Stefano Brivio 07 May '26

07 May '26

Changes in v9: * Rework Makefile changes and solve conflicts so that we can drop the dependency on "Improvements to static checker invocation" * In 8/23, drop the "experimental" note from the man page * In 10/23, switch to protocol version 1, add basil to the magic sauce * In 11/23, initialise struct pesto_pif_info sent by the server (details in commit message) * In 15/23, add description for -s / --show to pesto.1 as well * In 18/23, make comments about redundant checks more verbose * In 19/23, make it clear that tables handled by fwd_rule_del() can't refer to any open socket, add a TODO to fwd_rule_clear() in that sense as well, and use pif_conf_by_name() in pesto to find the table we need to clear * Add 19/23 to 23/23 (LSM policies, packaging stuff) to make pesto ready for shipping Changes in v8: * Implement --add, --delete, and --clear in 19/19, to add forwarding rules instead of replacing tables, delete existing rules, and explicitly clear tables * Address Laurent's comments for 15/19 and 17/19 * In 10/19, instead of passing SOCK_NONBLOCK to accept4(), explicitly set O_NONBLOCK on the listening socket. Using SOCK_NONBLOCK doesn't do what we want, as it results in setting O_NONBLOCK on the new socket rather than on the listening one * Note: 18/19 is left as it is, I didn't address pending comments yet * Note: this doesn't include yet changes for AppArmor and SELinux policies, as well as changes for the template Fedora spec file. I'm still working on them Changes in v7: * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18, 12/18, 14/18, 15/18 (details in commit messages of single patches, before my Signed-off-by) * Note: this doesn't include yet --add and --delete, I'm still working on that Changes in v6: * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18 * Dodged all warnings from static checkers (Coverity Scan and clang-tidy) with changes in 10/18, 11/18, 16/18, and with a new patch, 18/18 * This does *not* include yet the implementation of --add and --delete switches for pesto as I originally intended, I'm rather far from being done with those. At the moment I just have a "mode selection" implementation for command line parsing but merging rules to / removing rules from / clearing the current table is something I barely started (and what I have at the moment isn't really valuable anyway) David wrote: --- Here's the next draft of dynamic configuration updates. This now can successfully update rules, though I've not tested it very extensively. Patches 1..8/18 are preliminary reworks that make sense even without pesto - feel free to apply if you're happy with them. I don't think the rest should be applied yet; we need to at least harden it so passt can't be blocked indefinitely by a client which sends a partial update then waits. Based on my earlier series reworking static checking invocation. TODO: - Don't allow a client which sends a partial configuration then blocks also block passt - Allow pesto to clear existing configuration, not just add - Allow pesto selectively delete existing rules, not just add Changes in v5: * If multiple clients connect at once, they're now blocked until the first one finishes, instead of later ones being discarded Changes in v4: * Merged with remainder of forward rule parsing rework series * Fix some bugs in rule checking pointed out by Laurent * Significantly cleaned up option parsing code * Changed from replacing all existing rules to adding new rules (clear and remove still TBD) * Somewhat simplified protocol (pif names and rules sent in a single pass) * pesto is now allocation free * Fixed commit message and style nits pointed out by Stefano Changes in v3: * Removed already applied ASSERT() rename * Renamed serialisation functions * Incorporated Stefano's extensions, reworked and fixed * Several additional cleanups / preliminary reworks Changes in v2: * Removed already applied cleanups * Reworked assert() patch to handle -DNDEBUG properly * Numerous extra patches: * Factored out serialisation helpers and use them for migration as well * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto * Reworks to share some forwarding rule datatypes with pesto * Implemented sending pif names and current ruleset to pesto --- David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and display them ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (6): fwd_rule: Fix static checkers warnings in fwd_rule_add() pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules apparmor: Add policy file for pesto selinux: Add file context and type enforcement for pesto fedora: Install pesto, its SELinux policy, and the man page from the spec file hooks: Copy static build of pesto and related man page to server .gitignore | 2 + Makefile | 35 +- common.h | 116 ++++++ conf.c | 696 +++++++++++++++------------------ conf.h | 2 + contrib/apparmor/usr.bin.pesto | 23 ++ contrib/fedora/passt.spec | 14 +- contrib/selinux/pesto.fc | 11 + contrib/selinux/pesto.te | 95 +++++ epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++------ fwd.h | 41 +- fwd_rule.c | 691 ++++++++++++++++++++++++++++++-- fwd_rule.h | 68 +++- hooks/pre-push | 1 + inany.c | 19 +- inany.h | 17 +- ip.c | 56 +-- ip.h | 4 +- lineread.c | 2 +- log.h | 53 ++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pesto.1 | 275 +++++++++++++ pesto.c | 522 +++++++++++++++++++++++++ pesto.h | 54 +++ pif.c | 2 +- pif.h | 7 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 52 +++ util.h | 110 +----- 35 files changed, 2393 insertions(+), 794 deletions(-) create mode 100644 common.h create mode 100644 contrib/apparmor/usr.bin.pesto create mode 100644 contrib/selinux/pesto.fc create mode 100644 contrib/selinux/pesto.te create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

3 36

[PATCH v10 00/23] Dynamic configuration update implementation
by Stefano Brivio 06 May '26

06 May '26

Changes in v10: * For some reason, changes in 9/23 now trigger seemingly unrelated, but valid, cppcheck warnings: fix them directly there * In 19/23, only consider exact matches for rules we're deleting, report an error if there are conflicts that are not exact matches. Further, address (other) comments by Laurent: a typo in the man page, a typo in a comment in fwd_rule_del(), and a serious issue in pesto's main where we would use the "inbound" table for -T / -U Changes in v9: * Rework Makefile changes and solve conflicts so that we can drop the dependency on "Improvements to static checker invocation" * In 8/23, drop the "experimental" note from the man page * In 10/23, switch to protocol version 1, add basil to the magic sauce * In 11/23, initialise struct pesto_pif_info sent by the server (details in commit message) * In 15/23, add description for -s / --show to pesto.1 as well * In 18/23, make comments about redundant checks more verbose * In 19/23, make it clear that tables handled by fwd_rule_del() can't refer to any open socket, add a TODO to fwd_rule_clear() in that sense as well, and use pif_conf_by_name() in pesto to find the table we need to clear * Add 19/23 to 23/23 (LSM policies, packaging stuff) to make pesto ready for shipping Changes in v8: * Implement --add, --delete, and --clear in 19/19, to add forwarding rules instead of replacing tables, delete existing rules, and explicitly clear tables * Address Laurent's comments for 15/19 and 17/19 * In 10/19, instead of passing SOCK_NONBLOCK to accept4(), explicitly set O_NONBLOCK on the listening socket. Using SOCK_NONBLOCK doesn't do what we want, as it results in setting O_NONBLOCK on the new socket rather than on the listening one * Note: 18/19 is left as it is, I didn't address pending comments yet * Note: this doesn't include yet changes for AppArmor and SELinux policies, as well as changes for the template Fedora spec file. I'm still working on them Changes in v7: * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18, 12/18, 14/18, 15/18 (details in commit messages of single patches, before my Signed-off-by) * Note: this doesn't include yet --add and --delete, I'm still working on that Changes in v6: * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18 * Dodged all warnings from static checkers (Coverity Scan and clang-tidy) with changes in 10/18, 11/18, 16/18, and with a new patch, 18/18 * This does *not* include yet the implementation of --add and --delete switches for pesto as I originally intended, I'm rather far from being done with those. At the moment I just have a "mode selection" implementation for command line parsing but merging rules to / removing rules from / clearing the current table is something I barely started (and what I have at the moment isn't really valuable anyway) David wrote: --- Here's the next draft of dynamic configuration updates. This now can successfully update rules, though I've not tested it very extensively. Patches 1..8/18 are preliminary reworks that make sense even without pesto - feel free to apply if you're happy with them. I don't think the rest should be applied yet; we need to at least harden it so passt can't be blocked indefinitely by a client which sends a partial update then waits. Based on my earlier series reworking static checking invocation. TODO: - Don't allow a client which sends a partial configuration then blocks also block passt - Allow pesto to clear existing configuration, not just add - Allow pesto selectively delete existing rules, not just add Changes in v5: * If multiple clients connect at once, they're now blocked until the first one finishes, instead of later ones being discarded Changes in v4: * Merged with remainder of forward rule parsing rework series * Fix some bugs in rule checking pointed out by Laurent * Significantly cleaned up option parsing code * Changed from replacing all existing rules to adding new rules (clear and remove still TBD) * Somewhat simplified protocol (pif names and rules sent in a single pass) * pesto is now allocation free * Fixed commit message and style nits pointed out by Stefano Changes in v3: * Removed already applied ASSERT() rename * Renamed serialisation functions * Incorporated Stefano's extensions, reworked and fixed * Several additional cleanups / preliminary reworks Changes in v2: * Removed already applied cleanups * Reworked assert() patch to handle -DNDEBUG properly * Numerous extra patches: * Factored out serialisation helpers and use them for migration as well * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto * Reworks to share some forwarding rule datatypes with pesto * Implemented sending pif names and current ruleset to pesto --- David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and display them ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (6): fwd_rule: Fix static checkers warnings in fwd_rule_add() pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules apparmor: Add policy file for pesto selinux: Add file context and type enforcement for pesto fedora: Install pesto, its SELinux policy, and the man page from the spec file hooks: Copy static build of pesto and related man page to server .gitignore | 2 + Makefile | 35 +- common.h | 116 ++++++ conf.c | 698 ++++++++++++++------------------ conf.h | 2 + contrib/apparmor/usr.bin.pesto | 23 ++ contrib/fedora/passt.spec | 14 +- contrib/selinux/pesto.fc | 11 + contrib/selinux/pesto.te | 95 +++++ epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++------ fwd.h | 41 +- fwd_rule.c | 705 +++++++++++++++++++++++++++++++-- fwd_rule.h | 68 +++- hooks/pre-push | 1 + inany.c | 19 +- inany.h | 17 +- ip.c | 56 +-- ip.h | 4 +- lineread.c | 2 +- log.h | 53 ++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pasta.c | 4 +- pesto.1 | 275 +++++++++++++ pesto.c | 522 ++++++++++++++++++++++++ pesto.h | 54 +++ pif.c | 2 +- pif.h | 7 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 64 ++- util.h | 110 +---- 36 files changed, 2421 insertions(+), 798 deletions(-) create mode 100644 common.h create mode 100644 contrib/apparmor/usr.bin.pesto create mode 100644 contrib/selinux/pesto.fc create mode 100644 contrib/selinux/pesto.te create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

3 26

[PATCH v8 00/19] Dynamic configuration update implementation
by Stefano Brivio 06 May '26

06 May '26

Changes in v8: * Implement --add, --delete, and --clear in 19/19, to add forwarding rules instead of replacing tables, delete existing rules, and explicitly clear tables * Address Laurent's comments for 15/19 and 17/19 * In 10/19, instead of passing SOCK_NONBLOCK to accept4(), explicitly set O_NONBLOCK on the listening socket. Using SOCK_NONBLOCK doesn't do what we want, as it results in setting O_NONBLOCK on the new socket rather than on the listening one * Note: 18/19 is left as it is, I didn't address pending comments yet * Note: this doesn't include yet changes for AppArmor and SELinux policies, as well as changes for the template Fedora spec file. I'm still working on them Changes in v7: * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18, 12/18, 14/18, 15/18 (details in commit messages of single patches, before my Signed-off-by) * Note: this doesn't include yet --add and --delete, I'm still working on that Changes in v6: * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18 * Dodged all warnings from static checkers (Coverity Scan and clang-tidy) with changes in 10/18, 11/18, 16/18, and with a new patch, 18/18 * This does *not* include yet the implementation of --add and --delete switches for pesto as I originally intended, I'm rather far from being done with those. At the moment I just have a "mode selection" implementation for command line parsing but merging rules to / removing rules from / clearing the current table is something I barely started (and what I have at the moment isn't really valuable anyway) David wrote: --- Here's the next draft of dynamic configuration updates. This now can successfully update rules, though I've not tested it very extensively. Patches 1..8/18 are preliminary reworks that make sense even without pesto - feel free to apply if you're happy with them. I don't think the rest should be applied yet; we need to at least harden it so passt can't be blocked indefinitely by a client which sends a partial update then waits. Based on my earlier series reworking static checking invocation. TODO: - Don't allow a client which sends a partial configuration then blocks also block passt - Allow pesto to clear existing configuration, not just add - Allow pesto selectively delete existing rules, not just add Changes in v5: * If multiple clients connect at once, they're now blocked until the first one finishes, instead of later ones being discarded Changes in v4: * Merged with remainder of forward rule parsing rework series * Fix some bugs in rule checking pointed out by Laurent * Significantly cleaned up option parsing code * Changed from replacing all existing rules to adding new rules (clear and remove still TBD) * Somewhat simplified protocol (pif names and rules sent in a single pass) * pesto is now allocation free * Fixed commit message and style nits pointed out by Stefano Changes in v3: * Removed already applied ASSERT() rename * Renamed serialisation functions * Incorporated Stefano's extensions, reworked and fixed * Several additional cleanups / preliminary reworks Changes in v2: * Removed already applied cleanups * Reworked assert() patch to handle -DNDEBUG properly * Numerous extra patches: * Factored out serialisation helpers and use them for migration as well * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto * Reworks to share some forwarding rule datatypes with pesto * Implemented sending pif names and current ruleset to pesto --- David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and display them ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (2): fwd_rule: Fix static checkers warnings in fwd_rule_add() pesto, conf, fwd_rule: Add options and modes to add, delete, clear rules .gitignore | 2 + Makefile | 53 ++-- common.h | 116 +++++++++ conf.c | 696 ++++++++++++++++++++++----------------------------- conf.h | 2 + epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++++--------- fwd.h | 41 +-- fwd_rule.c | 680 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd_rule.h | 68 ++++- inany.c | 19 +- inany.h | 17 +- ip.c | 56 +---- ip.h | 4 +- lineread.c | 2 +- log.h | 53 +++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pesto.1 | 271 ++++++++++++++++++++ pesto.c | 520 ++++++++++++++++++++++++++++++++++++++ pesto.h | 54 ++++ pif.c | 2 +- pif.h | 7 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 52 ++++ util.h | 110 +------- 30 files changed, 2252 insertions(+), 792 deletions(-) create mode 100644 common.h create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

3 43

[PATCH v7 00/18] Dynamic configuration update implementation
by Stefano Brivio 06 May '26

06 May '26

Changes in v7: * Addressed comments from Laurent in 6/18, 8/18, 9/18, 10/18, 11/18, 12/18, 14/18, 15/18 (details in commit messages of single patches, before my Signed-off-by) * Note: this doesn't include yet --add and --delete, I'm still working on that David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and display them ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (1): fwd_rule: Fix static checkers warnings in fwd_rule_add() .gitignore | 2 + Makefile | 53 ++-- common.h | 116 +++++++++ conf.c | 701 +++++++++++++++++++++++---------------------------- conf.h | 2 + epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++++--------- fwd.h | 41 +-- fwd_rule.c | 611 ++++++++++++++++++++++++++++++++++++++++++-- fwd_rule.h | 66 ++++- inany.c | 19 +- inany.h | 17 +- ip.c | 56 +--- ip.h | 4 +- lineread.c | 2 +- log.h | 53 +++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pesto.1 | 176 +++++++++++++ pesto.c | 475 ++++++++++++++++++++++++++++++++++ pesto.h | 54 ++++ pif.c | 2 +- pif.h | 7 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 52 ++++ util.h | 110 +------- 30 files changed, 2046 insertions(+), 792 deletions(-) create mode 100644 common.h create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

3 38

[PATCH v2 00/13] Improvements to static checker invocation
by David Gibson 06 May '26

06 May '26

While working on pesto, I ran into a number of awkward errors with the static checkers. This series reworks the invocation of the checkers in a way that will let us deal with that. As a bonus, it also gives us static checking for passt-repair and qrap. It also makes a few other cleanups to the Makefile that seemed natural along the way. v2: - Fixed nasty test failure in test/build/build.py David Gibson (13): Makefile: Use make variables for static checker configuration cppcheck: Split out essential defines into a BASE_CPPFLAGS variable Makefile: Remove preprocessor flags from $(FLAGS) Makefile: Remove non-standard $(FLAGS) variable Makefile: Make conditional definition of $(BIN) clearer Makefile: Use common binary compilation rule Makefile: Remove unhelpful $(HEADERS) variable Makefile: Add header dependencies for secondary binaries Makefile: Split static checker targets passt-repair: Split out inotify handling to its own function passt-repair: Simplify construction of Unix path from inotify passt-repair: Run static checkers qrap: Run static checkers Makefile | 106 ++++++++++++++++----------- linux_dep.h | 2 +- passt-repair.c | 171 ++++++++++++++++++++++++-------------------- qrap.c | 42 ++++++----- test/build/build.py | 4 +- 5 files changed, 190 insertions(+), 135 deletions(-) -- 2.53.0

3 30

[PATCH v6 00/18] Dynamic configuration update implementation
by Stefano Brivio 05 May '26

05 May '26

Changes in v6: * Addressed comments from Jon in 10/18, 11/18, 14/18, and 16/18 * Dodged all warnings from static checkers (Coverity Scan and clang-tidy) with changes in 10/18, 11/18, 16/18, and with a new patch, 18/18 * This does *not* include yet the implementation of --add and --delete switches for pesto as I originally intended, I'm rather far from being done with those. At the moment I just have a "mode selection" implementation for command line parsing but merging rules to / removing rules from / clearing the current table is something I barely started (and what I have at the moment isn't really valuable anyway) David wrote: --- Here's the next draft of dynamic configuration updates. This now can successfully update rules, though I've not tested it very extensively. Patches 1..8/18 are preliminary reworks that make sense even without pesto - feel free to apply if you're happy with them. I don't think the rest should be applied yet; we need to at least harden it so passt can't be blocked indefinitely by a client which sends a partial update then waits. Based on my earlier series reworking static checking invocation. TODO: - Don't allow a client which sends a partial configuration then blocks also block passt - Allow pesto to clear existing configuration, not just add - Allow pesto selectively delete existing rules, not just add Changes in v5: * If multiple clients connect at once, they're now blocked until the first one finishes, instead of later ones being discarded Changes in v4: * Merged with remainder of forward rule parsing rework series * Fix some bugs in rule checking pointed out by Laurent * Significantly cleaned up option parsing code * Changed from replacing all existing rules to adding new rules (clear and remove still TBD) * Somewhat simplified protocol (pif names and rules sent in a single pass) * pesto is now allocation free * Fixed commit message and style nits pointed out by Stefano Changes in v3: * Removed already applied ASSERT() rename * Renamed serialisation functions * Incorporated Stefano's extensions, reworked and fixed * Several additional cleanups / preliminary reworks Changes in v2: * Removed already applied cleanups * Reworked assert() patch to handle -DNDEBUG properly * Numerous extra patches: * Factored out serialisation helpers and use them for migration as well * Reworked to allow ip.[ch] and inany.[ch] to be shared with pesto * Reworks to share some forwarding rule datatypes with pesto * Implemented sending pif names and current ruleset to pesto --- David Gibson (17): conf, fwd: Stricter rule checking in fwd_rule_add() fwd_rule: Move ephemeral port probing to fwd_rule.c fwd, conf: Move rule parsing code to fwd_rule.[ch] fwd_rule: Move conflict checking back within fwd_rule_add() fwd: Generalise fwd_rules_info() pif: Limit pif names to 128 bytes fwd_rule: Fix some format specifiers pesto: Introduce stub configuration tool pesto, log: Share log.h (but not log.c) with pesto tool pesto, conf: Have pesto connect to passt and check versions pesto: Expose list of pifs to pesto and optionally display ip: Prepare ip.[ch] for sharing with pesto tool inany: Prepare inany.[ch] for sharing with pesto tool pesto: Read current ruleset from passt/pasta and optionally display it pesto: Parse and add new rules from command line pesto, conf: Send updated rules from pesto back to passt/pasta conf, fwd: Allow switching to new rules received from pesto Stefano Brivio (1): fwd_rule: Fix static checkers warnings in fwd_rule_add() .gitignore | 2 + Makefile | 54 ++-- common.h | 122 +++++++++ conf.c | 701 +++++++++++++++++++++++---------------------------- conf.h | 2 + epoll_type.h | 4 + flow.c | 4 +- fwd.c | 169 ++++--------- fwd.h | 41 +-- fwd_rule.c | 612 ++++++++++++++++++++++++++++++++++++++++++-- fwd_rule.h | 66 ++++- inany.c | 19 +- inany.h | 17 +- ip.c | 56 +--- ip.h | 4 +- lineread.c | 2 +- log.h | 59 ++++- passt.1 | 5 + passt.c | 8 + passt.h | 8 + pesto.1 | 46 ++++ pesto.c | 472 ++++++++++++++++++++++++++++++++++ pesto.h | 54 ++++ pif.c | 2 +- pif.h | 8 +- serialise.c | 7 + serialise.h | 1 + siphash.h | 13 + tap.c | 52 ++++ util.h | 110 +------- 30 files changed, 1928 insertions(+), 792 deletions(-) create mode 100644 common.h create mode 100644 pesto.1 create mode 100644 pesto.c create mode 100644 pesto.h -- 2.43.0

2 38

[PATCH v5 01/18] conf, fwd: Stricter rule checking in fwd_rule_add()
by David Gibson 04 May '26

04 May '26

Although fwd_rule_add() performs some sanity checks on the rule it is given, there are invalid rules we don't check for, assuming that its callers will do that. That won't be enough when we can get rules inserted by a dynamic update client without going through the existing parsing code. So, add stricter checks to fwd_rule_add(), which is now possible thanks to the capabilities bits in the struct fwd_table. Where those duplicate existing checks in the callers, remove the old copies. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 21 --------------------- fwd.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++----- 2 files changed, 47 insertions(+), 26 deletions(-) diff --git a/conf.c b/conf.c index 6e884e54..b470b0d8 100644 --- a/conf.c +++ b/conf.c @@ -176,8 +176,6 @@ static void conf_ports_range_except(struct fwd_table *fwd, uint8_t proto, die("Invalid interface name: %s", ifname); } - assert(first != 0); - for (base = first; base <= last; base++) { if (exclude && bitmap_isset(exclude, base)) continue; @@ -310,10 +308,6 @@ static void conf_ports_spec(struct fwd_table *fwd, uint8_t proto, if (p != ep) /* Garbage after the ranges */ goto bad; - if (orig_range.first == 0) { - die("Can't forward port 0 included in '%s'", spec); - } - conf_ports_range_except(fwd, proto, addr, ifname, orig_range.first, orig_range.last, exclude, @@ -356,11 +350,6 @@ static void conf_ports(char optname, const char *optarg, struct fwd_table *fwd) return; } - if (proto == IPPROTO_TCP && !(fwd->caps & FWD_CAP_TCP)) - die("TCP port forwarding requested but TCP is disabled"); - if (proto == IPPROTO_UDP && !(fwd->caps & FWD_CAP_UDP)) - die("UDP port forwarding requested but UDP is disabled"); - strncpy(buf, optarg, sizeof(buf) - 1); if ((spec = strchr(buf, '/'))) { @@ -405,16 +394,6 @@ static void conf_ports(char optname, const char *optarg, struct fwd_table *fwd) addr = NULL; } - if (addr) { - if (!(fwd->caps & FWD_CAP_IPV4) && inany_v4(addr)) { - die("IPv4 is disabled, can't use -%c %s", - optname, optarg); - } else if (!(fwd->caps & FWD_CAP_IPV6) && !inany_v4(addr)) { - die("IPv6 is disabled, can't use -%c %s", - optname, optarg); - } - } - if (optname == 'T' || optname == 'U') { assert(!addr && !ifname); diff --git a/fwd.c b/fwd.c index c7fd1a9d..979c1494 100644 --- a/fwd.c +++ b/fwd.c @@ -367,17 +367,59 @@ int fwd_rule_add(struct fwd_table *fwd, const struct fwd_rule *new) new->first, new->last); return -EINVAL; } + if (!new->first) { + warn("Forwarding rule attempts to map from port 0"); + return -EINVAL; + } + if (!new->to || + (in_port_t)(new->to + new->last - new->first) < new->to) { + warn("Forwarding rule attempts to map to port 0"); + return -EINVAL; + } if (new->flags & ~allowed_flags) { warn("Rule has invalid flags 0x%hhx", new->flags & ~allowed_flags); return -EINVAL; } - if (new->flags & FWD_DUAL_STACK_ANY && - !inany_equals(&new->addr, &inany_any6)) { - char astr[INANY_ADDRSTRLEN]; + if (new->flags & FWD_DUAL_STACK_ANY) { + if (!inany_equals(&new->addr, &inany_any6)) { + char astr[INANY_ADDRSTRLEN]; - warn("Dual stack rule has non-wildcard address %s", - inany_ntop(&new->addr, astr, sizeof(astr))); + warn("Dual stack rule has non-wildcard address %s", + inany_ntop(&new->addr, astr, sizeof(astr))); + return -EINVAL; + } + if (!(fwd->caps & FWD_CAP_IPV4)) { + warn("Dual stack forward, but IPv4 not enabled"); + return -EINVAL; + } + if (!(fwd->caps & FWD_CAP_IPV6)) { + warn("Dual stack forward, but IPv6 not enabled"); + return -EINVAL; + } + } else { + if (inany_v4(&new->addr) && !(fwd->caps & FWD_CAP_IPV4)) { + warn("IPv4 forward, but IPv4 not enabled"); + return -EINVAL; + } + if (!inany_v4(&new->addr) && !(fwd->caps & FWD_CAP_IPV6)) { + warn("IPv6 forward, but IPv6 not enabled"); + return -EINVAL; + } + } + if (new->proto == IPPROTO_TCP) { + if (!(fwd->caps & FWD_CAP_TCP)) { + warn("Can't add TCP forwarding rule, TCP not enabled"); + return -EINVAL; + } + } else if (new->proto == IPPROTO_UDP) { + if (!(fwd->caps & FWD_CAP_UDP)) { + warn("Can't add UDP forwarding rule, UDP not enabled"); + return -EINVAL; + } + } else { + warn("Unsupported protocol 0x%hhx (%s) for forwarding rule", + new->proto, ipproto_name(new->proto)); return -EINVAL; } -- 2.53.0

3 4