- dev - passt

[PATCH 0/2] Small cleanups to splice forwarding logic
by David Gibson 06 Jan '26

06 Jan '26

While working on more flexible forwarding stuff, noticed a couple of warts here. David Gibson (2): fwd: Remove now-unnecessary handling of unspecified oaddr from splice fwd: Minor cleanup to fwd_nat_from_splice() fwd.c | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) -- 2.52.0

1 1

[PATCH 3/3] fwd, tcp, udp: Consolidate epoll refs for listening sockets
by David Gibson 05 Jan '26

05 Jan '26

The epoll references we use for TCP listening sockets and UDP "listening" sockets have identical information. Combine them into a single structure. Note that, despite the name, epoll_ref.udp was only ever used for "listening" sockets, not flow sockets. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- epoll_ctl.h | 6 ++---- fwd.h | 14 ++++++++++++++ tcp.c | 8 ++++---- tcp.h | 14 -------------- udp.c | 6 +++--- udp.h | 15 --------------- 6 files changed, 23 insertions(+), 40 deletions(-) diff --git a/epoll_ctl.h b/epoll_ctl.h index 02b081e2..3f802e76 100644 --- a/epoll_ctl.h +++ b/epoll_ctl.h @@ -21,8 +21,7 @@ * @fd: File descriptor number (implies < 2^24 total descriptors) * @flow: Index of the flow this fd is linked to * @flowside: Index and side of a flow this fd is linked to - * @tcp_listen: TCP-specific reference part for listening sockets - * @udp: UDP-specific reference part + * @listen: Information for listening sockets * @data: Data handled by protocol handlers * @nsdir_fd: netns dirfd for fallback timer checking if namespace is gone * @queue: vhost-user queue index for this fd @@ -35,8 +34,7 @@ union epoll_ref { union { uint32_t flow; flow_sidx_t flowside; - union tcp_listen_epoll_ref tcp_listen; - union udp_listen_epoll_ref udp; + union fwd_listen_ref listen; uint32_t data; int nsdir_fd; int queue; diff --git a/fwd.h b/fwd.h index 77925822..bf41907b 100644 --- a/fwd.h +++ b/fwd.h @@ -16,6 +16,20 @@ struct flowside; void fwd_probe_ephemeral(void); bool fwd_port_is_ephemeral(in_port_t port); +/** + * union fwd_listen_ref - information about a single listening socket + * @port: Bound port number of the socket + * @pif: pif in which the socket is listening + * @fe: Index of forwarding entry + */ +union fwd_listen_ref { + struct { + in_port_t port; + uint8_t pif; + }; + uint32_t u32; +}; + enum fwd_ports_mode { FWD_UNSET = 0, FWD_SPEC = 1, diff --git a/tcp.c b/tcp.c index e7fa85f3..9fc385d2 100644 --- a/tcp.c +++ b/tcp.c @@ -2485,8 +2485,8 @@ void tcp_listen_handler(const struct ctx *c, union epoll_ref ref, * address, record that as our address, as implemented for vhost-user * mode only, below. */ - ini = flow_initiate_sa(flow, ref.tcp_listen.pif, &sa, - NULL, ref.tcp_listen.port); + ini = flow_initiate_sa(flow, ref.listen.pif, &sa, + NULL, ref.listen.port); if (getsockname(s, &sa.sa, &sl) || inany_from_sockaddr(&ini->oaddr, &ini->oport, &sa) < 0) @@ -2685,7 +2685,7 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, int tcp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) { - union tcp_listen_epoll_ref tref = { + union fwd_listen_ref ref = { .port = port, .pif = pif, }; @@ -2722,7 +2722,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, } s = pif_sock_l4(c, EPOLL_TYPE_TCP_LISTEN, pif, addr, ifname, - port, tref.u32); + port, ref.u32); if (fwd->mode == FWD_AUTO) { if (!addr || inany_v4(addr)) diff --git a/tcp.h b/tcp.h index 516dfef5..ef1e3544 100644 --- a/tcp.h +++ b/tcp.h @@ -30,20 +30,6 @@ void tcp_update_l2_buf(const unsigned char *eth_d); extern bool peek_offset_cap; -/** - * union tcp_listen_epoll_ref - epoll reference portion for TCP listening - * @port: Bound port number of the socket - * @pif: pif in which the socket is listening - * @u32: Opaque u32 value of reference - */ -union tcp_listen_epoll_ref { - struct { - in_port_t port; - uint8_t pif; - }; - uint32_t u32; -}; - /** * struct tcp_ctx - Execution context for TCP routines * @port_to_tap: Ports bound host-side, packets to tap or spliced diff --git a/udp.c b/udp.c index eda55c39..747d4dd4 100644 --- a/udp.c +++ b/udp.c @@ -928,7 +928,7 @@ void udp_listen_sock_handler(const struct ctx *c, const struct timespec *now) { if (events & (EPOLLERR | EPOLLIN)) - udp_sock_fwd(c, ref.fd, ref.udp.pif, ref.udp.port, now); + udp_sock_fwd(c, ref.fd, ref.listen.pif, ref.listen.port, now); } /** @@ -1141,7 +1141,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) { - union udp_listen_epoll_ref uref = { + union fwd_listen_ref ref = { .pif = pif, .port = port, }; @@ -1175,7 +1175,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, } s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, - addr, ifname, port, uref.u32); + addr, ifname, port, ref.u32); if (!addr || inany_v4(addr)) socks[V4][port] = s < 0 ? -1 : s; diff --git a/udp.h b/udp.h index 5407db3b..94c698e2 100644 --- a/udp.h +++ b/udp.h @@ -22,21 +22,6 @@ int udp_init(struct ctx *c); void udp_port_rebind_all(struct ctx *c); void udp_update_l2_buf(const unsigned char *eth_d); -/** - * union udp_listen_epoll_ref - epoll reference for "listening" UDP sockets - * @port: Source port for connected sockets, bound port otherwise - * @pif: pif for this socket - * @u32: Opaque u32 value of reference - */ -union udp_listen_epoll_ref { - struct { - in_port_t port; - uint8_t pif; - }; - uint32_t u32; -}; - - /** * struct udp_ctx - Execution context for UDP * @fwd_in: Port forwarding configuration for inbound packets -- 2.52.0

1 0

[PATCH 0/3] Clean ups to epoll references
by David Gibson 05 Jan '26

05 Jan '26

A handful of simple cleanups to epoll references. David Gibson (3): tcp: Remove unused tcp_epoll_ref epoll_ctl: Add missing description for flowside field of epoll_ref fwd, tcp, udp: Consolidate epoll refs for listening sockets epoll_ctl.h | 7 +++---- fwd.h | 14 ++++++++++++++ tcp.c | 8 ++++---- tcp.h | 24 ------------------------ udp.c | 6 +++--- udp.h | 15 --------------- 6 files changed, 24 insertions(+), 50 deletions(-) -- 2.52.0

1 2

[PATCH 3/3] tcp, udp: Make {tcp,udp}_listen() return socket fds
by David Gibson 05 Jan '26

05 Jan '26

{tcp,udp}_listen() currently return 0 on success, rather than the socket fd they created. Historically, that was because these functions could sometimes create multiple sockets. We've now refactored things to avoid that, so it makes more sense for them to return the socket on success. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 14 +++++++------- tcp.c | 7 ++----- udp.c | 4 ++-- 3 files changed, 11 insertions(+), 14 deletions(-) diff --git a/conf.c b/conf.c index cc3c20a9..5db49653 100644 --- a/conf.c +++ b/conf.c @@ -149,7 +149,7 @@ static void conf_ports_range_except(const struct ctx *c, char optname, { bool bound_one = false; unsigned i; - int ret; + int fd; if (first == 0) { die("Can't forward port 0 for option '-%c %s'", @@ -185,23 +185,23 @@ static void conf_ports_range_except(const struct ctx *c, char optname, fwd->delta[i] = to - first; if (optname == 't') - ret = tcp_listen(c, PIF_HOST, addr, ifname, i); + fd = tcp_listen(c, PIF_HOST, addr, ifname, i); else if (optname == 'u') - ret = udp_listen(c, PIF_HOST, addr, ifname, i); + fd = udp_listen(c, PIF_HOST, addr, ifname, i); else /* No way to check in advance for -T and -U */ - ret = 0; + fd = 0; - if (ret == -ENFILE || ret == -EMFILE) { + if (fd == -ENFILE || fd == -EMFILE) { die("Can't open enough sockets for port specifier: %s", optarg); } - if (!ret) { + if (fd >= 0) { bound_one = true; } else if (!weak) { die("Failed to bind port %u (%s) for option '-%c %s'", - i, strerror_(-ret), optname, optarg); + i, strerror_(-fd), optname, optarg); } } diff --git a/tcp.c b/tcp.c index 67007c05..80b47f3c 100644 --- a/tcp.c +++ b/tcp.c @@ -2680,7 +2680,7 @@ void tcp_sock_handler(const struct ctx *c, union epoll_ref ref, * @ifname: Name of interface to bind to, NULL for any * @port: Port, host order * - * Return: 0 on success, negative error code on failure + * Return: Socket fd on success, negative error code on failure */ int tcp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) @@ -2729,10 +2729,7 @@ int tcp_listen(const struct ctx *c, uint8_t pif, socks[port][V6] = s < 0 ? -1 : s; } - if (s < 0) - return s; - - return 0; + return s; } /** diff --git a/udp.c b/udp.c index 8cfa1e1f..63dc7c25 100644 --- a/udp.c +++ b/udp.c @@ -1136,7 +1136,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, * @ifname: Name of interface to bind to, NULL if not configured * @port: Port, host order * - * Return: 0 on success, negative error code on failure + * Return: Socket fd on success, negative error code on failure */ int udp_listen(const struct ctx *c, uint8_t pif, const union inany_addr *addr, const char *ifname, in_port_t port) @@ -1180,7 +1180,7 @@ int udp_listen(const struct ctx *c, uint8_t pif, if (!addr || !inany_v4(addr)) socks[V6][port] = s < 0 ? -1 : s; - return s < 0 ? s : 0; + return s; } /** -- 2.52.0

1 0

[PATCH 2/3] tcp, udp, conf: Don't silently ignore listens on unsupported IP versions
by David Gibson 05 Jan '26

05 Jan '26

Currently, it's possible to explicitly ask for forwarding from an IPv4 address, while disabling IPv4: $ pasta -t 192.0.2.1/12345 -6 or vice versa: $ pasta -t 2001:db8::1/12345 -4 Currently, the impossible to implement forwarding option will be silently ignored. That's potentially confusing since in a complex setup, it might not be obvious why the requested forward isn't taking effect. Specifically, it's ignored at a fairly low level: tcp_listen() and udp_listen() ignore it and return 0. Those run kind of late to give a good error message. Change the low-level functions to return -EACCES (chosen because that's what the kernel will return if you request IPv6 when it's disabled by sysctl). Most callers of {tcp,udp}_listen() ignore the return code, so this is a no-op for them. In the remaining caller, conf_ports_range_except() check for the case explicitly, and provide a meaningful error message. Of itself, this bug is insignificant, but this is a roadblock to having {tcp,udp}_listen() return socket fds, which in turn is a roadblock to my flexible forwarding work. So, might as well fix it. Link: https://bugs.passt.top/show_bug.cgi?id=186 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 10 ++++++++++ tcp.c | 6 ++---- udp.c | 6 ++---- 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 70ea168c..cc3c20a9 100644 --- a/conf.c +++ b/conf.c @@ -162,6 +162,16 @@ static void conf_ports_range_except(const struct ctx *c, char optname, optname, optarg); } + if (addr) { + if (!c->ifi4 && inany_v4(addr)) { + die("IPv4 is disabled, can't use -%c %s", + optname, optarg); + } else if (!c->ifi6 && !inany_v4(addr)) { + die("IPv6 is disabled, can't use -%c %s", + optname, optarg); + } + } + for (i = first; i <= last; i++) { if (bitmap_isset(exclude, i)) continue; diff --git a/tcp.c b/tcp.c index e7fa85f3..67007c05 100644 --- a/tcp.c +++ b/tcp.c @@ -2700,16 +2700,14 @@ int tcp_listen(const struct ctx *c, uint8_t pif, /* Restrict to v6 only */ addr = &inany_any6; else if (inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (!c->ifi6) { if (!addr) /* Restrict to v4 only */ addr = &inany_any4; else if (!inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (pif == PIF_HOST) { diff --git a/udp.c b/udp.c index eda55c39..8cfa1e1f 100644 --- a/udp.c +++ b/udp.c @@ -1162,16 +1162,14 @@ int udp_listen(const struct ctx *c, uint8_t pif, /* Restrict to v6 only */ addr = &inany_any6; else if (inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } if (!c->ifi6) { if (!addr) /* Restrict to v4 only */ addr = &inany_any4; else if (!inany_v4(addr)) - /* Nothing to do */ - return 0; + return -EACCES; } s = pif_sock_l4(c, EPOLL_TYPE_UDP_LISTEN, pif, -- 2.52.0

1 0

[PATCH 1/3] conf: Introduce --no-bindtodevice option for testing
by David Gibson 05 Jan '26

05 Jan '26

We need to support (as best we can) older kernels which don't allow unprivilieged processes to use the SO_BINDTODEVICE socket option. Fallcaks for that case are controlled by the c->no_bindtodevice variable. Currently testing behaviour of those fallbacks requires setting up a test system with a kernel that doesn't support the option, which is pretty awkward. We can test it almost as well and much more easily by adding a command line option to explicitly disable use of SO_BINDTODEVICE. Like --no-splice this is envisaged as something for developers' and testers' convenience, not a supported option for end users. The man page text reflects that. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 ++ passt.1 | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/conf.c b/conf.c index ceb9aa55..70ea168c 100644 --- a/conf.c +++ b/conf.c @@ -962,6 +962,7 @@ static void usage(const char *name, FILE *f, int status) " --no-ndp Disable NDP responses\n" " --no-dhcpv6 Disable DHCPv6 server\n" " --no-ra Disable router advertisements\n" + " --no-bindtodevice Disable SO_BINDTODEVICE\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" " -4, --ipv4-only Enable IPv4 operation only\n" @@ -1454,6 +1455,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-dhcpv6", no_argument, &c->no_dhcpv6, 1 }, {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, + {"no-bindtodevice", no_argument, &c->no_bindtodevice, 1}, {"no-splice", no_argument, &c->no_splice, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, diff --git a/passt.1 b/passt.1 index db0d6620..4859d9e5 100644 --- a/passt.1 +++ b/passt.1 @@ -348,6 +348,12 @@ namespace will be silently dropped. Disable Router Advertisements. Router Solicitations coming from guest or target namespace will be ignored. +.TP +.BR \-\-no-bindtodevice +Development/testing option, do not use. Disables use of +SO_BINDTODEVICE socket option. Implicitly enabled on older kernels +which don't permit unprivileged use of SO_BINDTODEVICE. + .TP .BR \-\-freebind Allow any binding address to be specified for \fB-t\fR and \fB-u\fR -- 2.52.0

1 0

[PATCH 0/3] Allow listen functions to return fds
by David Gibson 05 Jan '26

05 Jan '26

For future forwarding changes, it makes more sense for the tcp and udp listen functions to return socket fds, rather than just success / failure. Make the change, fixing bug 186 and adding a debugging option along the way. Link: https://bugs.passt.top/show_bug.cgi?id=186 David Gibson (3): conf: Introduce --no-bindtodevice option for testing tcp, udp, conf: Don't silently ignore listens on unsupported IP versions tcp, udp: Make {tcp,udp}_listen() return socket fds conf.c | 26 +++++++++++++++++++------- passt.1 | 6 ++++++ tcp.c | 13 ++++--------- udp.c | 10 ++++------ 4 files changed, 33 insertions(+), 22 deletions(-) -- 2.52.0

1 0

Thoughts on interface modes / multiple guest addresses
by David Gibson 05 Jan '26

05 Jan '26

Hi Jon, As discussed on the call yesterday, I've written up my thoughts on what a bunch of the address semantics should be. Turns out I'd already done some of this at: https://pad.passt.top/p/InterfaceMode I've now updated to cover some more things, and considering the possibility of multiple guest addresses.. Turns out etherpad doesn't really do tables, so it's two sections for the two suggested modes, with matching subheadings. It's still very much a draft so: * It might be unclear - please ask me to clarify anything * It will have some mistakes - make your case if you think my proposed semantics don't make sense * It will be incomplete - feel free to add extra subheadings for anything you -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

3 13

[PATCH 0/7] flow: Introduce flow_epoll_set() to centralize epoll operations
by Laurent Vivier 27 Dec '25

27 Dec '25

Currently, each protocol handler (TCP, TCP splice, ICMP/ping, UDP) has its own code to add or modify file descriptors in epoll. This leads to duplicated boilerplate across icmp.c, tcp.c, tcp_splice.c, and udp_flow.c, with each setting up epoll_ref unions and calling epoll_ctl() with flow-type-specific details. This series introduces flow_epoll_set() in flow.c to handle epoll operations for all flow types in a unified way. The function evolves across the series, progressively absorbing more responsibilities: 1. Initial version takes explicit fd, events, and ctx parameters 2. Events computation is moved inside the function by relocating tcp_conn_epoll_events() and tcp_splice_conn_epoll_events() into flow.c 3. The ctx parameter is removed by using epoll_id_to_fd[EPOLLFD_ID_DEFAULT] directly for new flows 4. The fd parameter is removed by having the function extract the file descriptor from the flow structure based on the epoll type The final API is simply: int flow_epoll_set(enum epoll_type type, const struct flow_common *f, unsigned int sidei); This centralized approach will be essential for queue pair migration in the upcoming multithreading work, where flows need to be moved between different epoll instances owned by different threads. Preparatory patches: - Patch 1 fixes EPOLL_TYPE_TCP_TIMER to use the actual timer fd - Patch 2 refactors udp_flow_sock() to assign the socket internally - Patch 3 refactors tcp_splice_conn_epoll_events() to per-side computation Core series: - Patch 4 introduces the initial flow_epoll_set() function - Patch 5 removes the ctx parameter - Patch 6 moves event computation inside flow_epoll_set() - Patch 7 removes the fd parameter, completing the refactoring Laurent Vivier (7): tcp: Update EPOLL_TYPE_TCP_TIMER fd udp_flow: Assign socket to flow inside udp_flow_sock() tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation flow: Introduce flow_epoll_set() to centralize epoll operations flow: Use epoll_id_to_fd[EPOLLFD_ID_DEFAULT] in flow_epollid_set() flow: Compute epoll events inside flow_epoll_set() flow: Have flow_epoll_set() retrieve file descriptor from flow structure flow.c | 158 +++++++++++++++++++++++++++++++++++++++++++++++++++ flow.h | 4 ++ icmp.c | 8 +-- tcp.c | 68 +++------------------- tcp_splice.c | 77 +++++-------------------- udp_flow.c | 17 ++---- 6 files changed, 190 insertions(+), 142 deletions(-) -- 2.51.1

2 14

[PATCH] selinux: Enable read and watch permissions on netns directory as well
by Stefano Brivio 24 Dec '25

24 Dec '25

With commit 7aeda16a7818 ("selinux: Transition to pasta_t in containers"), we need to make sure that pasta can access the target namespace directory passed by Podman, and, in a general case, we have all the permissions we need. But if we now start a container without the Podman changes referenced by commit fd1bcc30af07 ("selinux: add container_var_run_t type transition"), or with them, but with the container being created before those and without a reboot in between, we'll additionally need 'read' and 'watch' permissions on user_tmp_t directory as well, as user_tmp_t is still the (inconsistent) context of the namespace entry. Otherwise, on a container start/restart, we'll get SELinux denials: type=AVC msg=audit(1766451401.296:184): avc: denied { read } for pid=2159 comm="pasta.avx2" name="netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:obje ct_r:user_tmp_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1766451401.298:185): avc: denied { watch } for pid=2159 comm="pasta.avx2" path="/run/user/1001/netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1 This can be reproduced quite simply: $ podman create -q --name hello hello 6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770 [upgrade passt's SELinux policy to a version including 7aeda16a7818] $ podman start hello Error: unable to start container "6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770": pasta failed with exit code 1: netns dir open: Permission denied, exiting Reported-by: Tuomo Soini <tis(a)foobar.fi> Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 95fe42a..3eb58f6 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton; manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) files_pid_filetrans(pasta_t, pasta_pid_t, file) -allow pasta_t user_tmp_t:dir { add_name remove_name search write }; +allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write }; allow pasta_t user_tmp_t:fifo_file append; allow pasta_t user_tmp_t:file { create open write }; allow pasta_t user_tmp_t:sock_file { create unlink }; -- 2.43.0

2 2