- dev - passt

Porting to macOS
by DUO Labs 10 Sep '24

10 Sep '24

I started doing some preliminary work on porting passt to macOS (I would have responded to issue 6 directly, but I can't seem to make an account); however, I wanted to know how exactly the system works --- does it _require_ a tap device, or can I safely remove that file from the compilation target (I know that pasta requires it, though)?

2 1

[PATCH 0/4] tcp: unify IPv4 and IPv6 l2 tap queues
by Jon Maloy 09 Sep '24

09 Sep '24

This should save us some memory and code. Jon Maloy (4): tcp: create unified struct for IPv4 and IPv6 header tcp: update ip address in l2 tap queues on the fly tcp: unify l2 TCPv4 and TCPv6 queues and structures tcp: change prefix tcp4_ to tcp_ where applicable tcp.c | 22 ++--- tcp_buf.c | 259 +++++++++++++++++------------------------------------- tcp_buf.h | 3 + 3 files changed, 98 insertions(+), 186 deletions(-) -- 2.45.2

3 8

passt: new version 2024_09_06.6b38f07 available
by Stefano Brivio 06 Sep '24

06 Sep '24

The new version with tag 2024_09_06.6b38f07 includes the following changes: 6b38f07 apparmor: Allow read access to /proc/sys/net/ipv4/ip_local_port_range 116bc82 selinux: Allow read access to /proc/sys/net/ipv4/ip_local_port_range a33ecaf tap: Don't risk truncating frames on full buffer in tap_pasta_input() d2a1dc7 tap: Restructure in tap_pasta_input() 11e2905 tap: Improve handling of EINTR in tap_passt_input() 49fc4e0 tap: Split out handling of EPOLLIN events 63513e5 util: Fix order of operands and carry of one second in timespec_diff_us() 748ef4c cppcheck: Work around some cppcheck 2.15.0 redundantInitialization warnings afedc24 tcp: Use EPOLLET for any state of not established connections aff5a49 udp: Handle more error conditions in udp_sock_errs() bd99f02 udp: Treat errors getting errors as unrecoverable bd092ca udp: Split socket error handling out from udp_sock_recv() 88bfa38 flow: Helpers to log details of a flow 1166401 udp: Allow UDP flows to be prematurely closed 7ad9f9b flow: Fix incorrect hash probe in flowside_lookup() 0ea60e5 log: Don't prefix log file messages with time and severity if they're continuations 3836396 Makefile: Enable _FORTIFY_SOURCE iff needed eedc81b fwd, conf: Probe host's ephemeral ports 4a41dc5 conf, fwd: Don't attempt to forward port 0 1daf6f4 conf, fwd: Make ephemeral port logic more flexible 712ca32 seccomp.sh: Try to account for terminal width while formatting list of system calls e0be6bc udp: Use dual stack sockets for port forwarding when possible c78b194 udp: Remove unnnecessary local from udp_sock_init() 620e19a udp: Merge udp[46]_mh_recv arrays 418feb3 test: Look for possible sshd-session paths (if it's there at all) in mbuto's profile https://passt.top/passt/log/?qt=range&q=2024_08_21.1d6142f..2024_09_06.6b38… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7989588/ permanent mirror: https://passt.top/builds/copr/0^20240906.g6b38f07/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g6b38f07-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_6b38f07-1_all.deb -- Stefano

1 0

[PATCH 0/2] LSM rules for /proc/sys/net/ipv4/ip_local_port_range
by Stefano Brivio 06 Sep '24

06 Sep '24

I just applied these because we break (at least) Debian and Fedora packages otherwise, but I'm posting this here if anybody wants to review. Stefano Brivio (2): selinux: Allow read access to /proc/sys/net/ipv4/ip_local_port_range apparmor: Allow read access to /proc/sys/net/ipv4/ip_local_port_range contrib/apparmor/abstractions/passt | 2 ++ contrib/selinux/passt.te | 3 +++ contrib/selinux/pasta.te | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) -- 2.43.0

1 2

[PATCH 0/4] Fix possible truncation of frames from /dev/net/tun
by David Gibson 06 Sep '24

06 Sep '24

These changes started off as part of the series re-introducing EPOLLET for tap event handling. That's now turned out to be of lower priority, but along the way we fixed a bug where we could truncate frames from the kernel tap interface. This is a respin of that patch, plus a few minor preliminary cleanups. Various minor tweaks based on feedback from the original posting as part of the tap EPOLLET series. David Gibson (4): tap: Split out handling of EPOLLIN events tap: Improve handling of EINTR in tap_passt_input() tap: Restructure in tap_pasta_input() tap: Don't risk truncating frames on full buffer in tap_pasta_input() tap.c | 98 +++++++++++++++++++++++++++++++++++------------------------ 1 file changed, 58 insertions(+), 40 deletions(-) -- 2.46.0

2 5

[PATCH 0/6] RFC: Possible fixes for bug 94 and bug 95
by David Gibson 06 Sep '24

06 Sep '24

As discussed on IRC through the last day, here's a more polished version of possible fixes for bug 94 (EPOLLRDHUP storm) and bug 95 (EPOLLERR storm). Both of those were sub-problems arising while investigating podman bug 23686. We're pretty confident about the EPOLLRDHUP fix (bug 94, patch 1/6), based on Stefano's testing. I ended up rewriting Stefano's draft patch for the EPOLLERR case (bug 95, remaining patches), because I thought of a possibility we hadn't discussed yet: we weren't getting an error from the socket error queue, but we might be able to get one with the SO_ERROR getsockopt(). My examination of the kernel code suggests that's plausible, and that if that's the case using SO_ERROR should also clear that error condition. Link: https://bugs.passt.top/show_bug.cgi?id=94 Link: https://bugs.passt.top/show_bug.cgi?id=95 Link: https://github.com/containers/podman/issues/23686 David Gibson (6): flow: Fix incorrect hash probe in flowside_lookup() udp: Allow UDP flows to be prematurely closed flow: Helpers to log details of a flow udp: Split socket error handling out from udp_sock_recv() udp: Treat errors getting errors as unrecoverable udp: Handle more error conditions in udp_sock_errs() flow.c | 53 ++++++++++++++++++++------------ flow.h | 7 +++++ udp.c | 88 +++++++++++++++++++++++++++++++++++++++++++++--------- udp_flow.c | 18 ++++++++++- udp_flow.h | 4 +++ 5 files changed, 136 insertions(+), 34 deletions(-) -- 2.46.0

2 7

[PATCH v2] cppcheck: Work around some cppcheck 2.15.0 redundantInitialization warnings
by David Gibson 06 Sep '24

06 Sep '24

cppcheck-2.15.0 has apparently broadened when it throws a warning about redundant initialization to include some cases where we have an initializer for some fields, but then set other fields in the function body. This is arguably a false positive: although we are technically overwriting the zero-initialization the compiler supplies for fields not explicitly initialized, this sort of construct makes sense when there are some fields we know at the top of the function where the initializer is, but others that require more complex calculation. That said, in the two places this shows up, it's pretty easy to work around. The results are arguably slightly clearer than what we had, since they move the parts of the initialization closer together. So do that rather than having ugly suppressions or dealing with the tedious process of reporting a cppcheck false positive. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- pasta.c | 3 ++- udp.c | 10 ++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/pasta.c b/pasta.c index 1900693d..307fb4a7 100644 --- a/pasta.c +++ b/pasta.c @@ -427,12 +427,12 @@ static int pasta_netns_quit_timer(void) */ void pasta_netns_quit_init(const struct ctx *c) { - union epoll_ref ref = { .type = EPOLL_TYPE_NSQUIT_INOTIFY }; struct epoll_event ev = { .events = EPOLLIN }; int flags = O_NONBLOCK | O_CLOEXEC; struct statfs s = { 0 }; bool try_inotify = true; int fd = -1, dir_fd; + union epoll_ref ref; if (c->mode != MODE_PASTA || c->no_netns_quit || !*c->netns_base) return; @@ -463,6 +463,7 @@ void pasta_netns_quit_init(const struct ctx *c) ref.type = EPOLL_TYPE_NSQUIT_TIMER; } else { close(dir_fd); + ref.type = EPOLL_TYPE_NSQUIT_INOTIFY; } if (fd > FD_REF_MAX) diff --git a/udp.c b/udp.c index bd9051e1..aae6d142 100644 --- a/udp.c +++ b/udp.c @@ -713,16 +713,14 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, int udp_sock_init(const struct ctx *c, int ns, sa_family_t af, const void *addr, const char *ifname, in_port_t port) { - union udp_listen_epoll_ref uref = { .port = port }; + union udp_listen_epoll_ref uref = { + .pif = ns ? PIF_SPLICE : PIF_HOST, + .port = port, + }; int r4 = FD_REF_MAX + 1, r6 = FD_REF_MAX + 1; ASSERT(!c->no_udp); - if (ns) - uref.pif = PIF_SPLICE; - else - uref.pif = PIF_HOST; - if (af == AF_UNSPEC && c->ifi4 && c->ifi6) { int s; -- 2.46.0

2 1

[PATCH] util: Fix missing carry of one second, as nanoseconds, in timespec_diff_us()
by Stefano Brivio 06 Sep '24

06 Sep '24

If the nanoseconds of the minuend timestamp are less than the nanoseconds of the subtrahend timestamp, we need to carry one second in the subtraction. I subtracted this second from the minuend, but didn't actually carry it in the subtraction of nanoseconds, and logged timestamps would jump back whenever we switched to the first branch of timespec_diff_us() from the second one. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util.c b/util.c index 6e64279..eede4e5 100644 --- a/util.c +++ b/util.c @@ -249,7 +249,7 @@ void sock_probe_mem(struct ctx *c) int64_t timespec_diff_us(const struct timespec *a, const struct timespec *b) { if (a->tv_nsec < b->tv_nsec) { - return (b->tv_nsec - a->tv_nsec) / 1000 + + return (a->tv_nsec + 1000000000 - b->tv_nsec) / 1000 + (a->tv_sec - b->tv_sec - 1) * 1000000; } -- 2.43.0

2 3

[PATCH] tcp: Use EPOLLET for any state of not established connections
by Stefano Brivio 06 Sep '24

06 Sep '24

Currently, for not established connections, we monitor sockets with edge-triggered events (EPOLLET) if we are in the TAP_SYN_RCVD state (outbound connection being established) but not in the TAP_SYN_ACK_SENT case of it (socket is connected, and we sent SYN,ACK to the container/guest). While debugging https://bugs.passt.top/show_bug.cgi?id=94, I spotted another possibility for a short EPOLLRDHUP storm (10 seconds), which doesn't seem to happen in actual use cases, but I could reproduce it: start a connection from a container, while dropping (using netfilter) ACK segments coming out of the container itself. On the server side, outside the container, accept the connection and shutdown the writing side of it immediately. At this point, we're in the TAP_SYN_ACK_SENT case (not just a mere TAP_SYN_RCVD state), we get EPOLLRDHUP from the socket, but we don't have any reasonable way to handle it other than waiting for the tap side to complete the three-way handshake. So we'll just keep getting this EPOLLRDHUP until the SYN_TIMEOUT kicks in. Always enable EPOLLET when EPOLLRDHUP is the only epoll event we subscribe to: in this case, getting multiple EPOLLRDHUP reports is totally useless. In the only remaining non-established state, SOCK_ACCEPTED, for inbound connections, we're anyway discarding EPOLLRDHUP events until we established the conection, because we don't know what to do with them until we get an answer from the tap side, so it's safe to enable EPOLLET also in that case. Link: https://bugs.passt.top/show_bug.cgi?id=94 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This is based on: [PATCH 0/6] RFC: Possible fixes for bug 94 and bug 95 tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tcp.c b/tcp.c index 77c62f0..f9fe1b9 100644 --- a/tcp.c +++ b/tcp.c @@ -440,7 +440,7 @@ static uint32_t tcp_conn_epoll_events(uint8_t events, uint8_t conn_flags) if (events == TAP_SYN_RCVD) return EPOLLOUT | EPOLLET | EPOLLRDHUP; - return EPOLLRDHUP; + return EPOLLET | EPOLLRDHUP; } /** -- 2.43.0

1 0

[PATCH 0/6] RFC: Clean up tap-side event handling
by David Gibson 05 Sep '24

05 Sep '24

This is a draft patch working towards adding EPOLLOUT handling to the tap code, which could then be used to "unstick" flows which have unsent data from the socket side. For now that's just a stub, but makes what I think are some worthwhile cleanups to the tap side event handling in the meantime. David Gibson (6): tap: Split out handling of EPOLLIN events tap: Improve handling of EINTR in tap_passt_input() tap: Restructure in tap_pasta_input() tap: Don't risk truncating frames on full buffer in tap_pasta_input() tap: Re-introduce EPOLLET for tap connections tap: Stub EPOLLOUT handling tap.c | 131 +++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 88 insertions(+), 43 deletions(-) -- 2.46.0

2 22