- dev - passt

[PATCH v2 0/2] udp: add guest-to-remote traceroute
by Jon Maloy 28 Mar '25

28 Mar '25

We add support for UDP traceroute in the tap-sock direction. More will follow when this one is settled. --- v2: - Added ttl/hop_limit as flow selection criteria - Using ancillary data instead of setsockopt() to pass on ttl/hop_limit. - Added support for IPv6 Jon Maloy (2): Add ttl to outgoing flow structure lookups udp: support traceroute with udp flow.c | 17 ++++++++++++----- flow.h | 8 ++++++-- flow_table.h | 3 ++- icmp.c | 15 ++++++++++----- icmp.h | 2 +- packet.h | 2 ++ tap.c | 25 ++++++++++++++++++------- tcp.c | 6 +++--- udp.c | 31 +++++++++++++++++++++++++++---- udp.h | 3 ++- udp_flow.c | 7 ++++--- udp_flow.h | 2 +- 12 files changed, 88 insertions(+), 33 deletions(-) -- 2.48.1

2 3

[PATCH v2] udp: correct source address for ICMP messages
by Jon Maloy 27 Mar '25

27 Mar '25

While developing traceroute forwarding tap-to-sock we found that struct msghdr.msg_name for the ICMPs in the opposite direction always contains the destination address of the original UDP message, and not, as one might expect, the one of the host which created the error message. Study of the kernel code reveals that this address instead is appended as extra data after the received struct sock_extended_err area. We now change the ICMP receive code accordingly. Fixes: 55431f0077b6 ("udp: create and send ICMPv4 to local peer when applicable") Fixes: 68b04182e07d ("udp: create and send ICMPv6 to local peer when applicable") Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: Removed stray comment and unecessary initializations, as per feedback from David Gibson --- udp.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/udp.c b/udp.c index 80520cb..9d16529 100644 --- a/udp.c +++ b/udp.c @@ -510,10 +510,13 @@ static void udp_send_conn_fail_icmp6(const struct ctx *c, */ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) { - const struct sock_extended_err *ee; + struct errhdr { + struct sock_extended_err ee; + union sockaddr_inany saddr; + }; + const struct errhdr *eh; const struct cmsghdr *hdr; - union sockaddr_inany saddr; - char buf[CMSG_SPACE(sizeof(*ee))]; + char buf[CMSG_SPACE(sizeof(struct errhdr))]; char data[ICMP6_MAX_DLEN]; int s = ref.fd; struct iovec iov = { @@ -521,8 +524,6 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) .iov_len = sizeof(data) }; struct msghdr mh = { - .msg_name = &saddr, - .msg_namelen = sizeof(saddr), .msg_iov = &iov, .msg_iovlen = 1, .msg_control = buf, @@ -553,7 +554,7 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) return -1; } - ee = (const struct sock_extended_err *)CMSG_DATA(hdr); + eh = (const struct errhdr *)CMSG_DATA(hdr); if (ref.type == EPOLL_TYPE_UDP_REPLY) { flow_sidx_t sidx = flow_sidx_opposite(ref.flowside); const struct flowside *toside = flowside_at_sidx(sidx); @@ -561,18 +562,19 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) if (hdr->cmsg_level == IPPROTO_IP) { dlen = MIN(dlen, ICMP4_MAX_DLEN); - udp_send_conn_fail_icmp4(c, ee, toside, saddr.sa4.sin_addr, + udp_send_conn_fail_icmp4(c, &eh->ee, toside, + eh->saddr.sa4.sin_addr, data, dlen); } else if (hdr->cmsg_level == IPPROTO_IPV6) { - udp_send_conn_fail_icmp6(c, ee, toside, - &saddr.sa6.sin6_addr, + udp_send_conn_fail_icmp6(c, &eh->ee, toside, + &eh->saddr.sa6.sin6_addr, data, dlen, sidx.flowi); } } else { trace("Ignoring received IP_RECVERR cmsg on listener socket"); } debug("%s error on UDP socket %i: %s", - str_ee_origin(ee), s, strerror_(ee->ee_errno)); + str_ee_origin(&eh->ee), s, strerror_(eh->ee.ee_errno)); return 1; } -- 2.48.1

3 2

[PATCH v2 0/7] UDP flow socket preliminaries
by David Gibson 27 Mar '25

27 Mar '25

As discussed on our recent call, I'm working towards using connected sockets on both sides of UDP flows. This series makes some preliminary reworks that simplify things and make that easier. v2: * Added patches 5..7, other patches unchanged. David Gibson (7): udp: Common invocation of udp_sock_errs() for vhost-user and "buf" paths udp: Simplify checking of epoll event bits udp_vu: Factor things out of udp_vu_reply_sock_data() loop udp: Share more logic between vu and non-vu reply socket paths udp: Better handling of failure to forward from reply socket udp: Always hash socket facing flowsides udp: Add helper function for creating connected UDP socket udp.c | 121 +++++++++++++++++++++-------------------- udp_flow.c | 143 ++++++++++++++++++++++++++----------------------- udp_internal.h | 2 +- udp_vu.c | 68 +++++++---------------- udp_vu.h | 9 ++-- 5 files changed, 166 insertions(+), 177 deletions(-) -- 2.49.0

2 10

[PATCH 0/2] udp: Fix some minor warts in the ICMP error propagation code
by David Gibson 26 Mar '25

26 Mar '25

While working on using connected sockets for both sides of UDP flows, I spotted a couple of minor problems in the recently added ICMP error propagation code. Here are the fixes. David Gibson (2): udp: Don't attempt to forward ICMP socket errors to other sockets udp: Improve name of UDP related ICMP sending functions udp.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) -- 2.49.0

3 5

RE: [PATCH] build: normalize arm targets
by Julian Wundrak 26 Mar '25

26 Mar '25

Thanks Stefano, Sorry for this stupid error and the overhead. --- Von: "Stefano Brivio" <sbrivio(a)redhat.com> An: "Julian Wundrak" <julian(a)wundrak.net> Cc: "undefined" <passt-dev(a)passt.top> Gesendet: Mittwoch, 26. März 2025 21:45 Betreff: Re: [PATCH] build: normalize arm targets On Wed, 26 Mar 2025 21:29:02 +0100 Stefano Brivio wrote: > Hi Julian, > > On Wed, 26 Mar 2025 20:14:31 +0000 > Julian Wundrak wrote: > > > Linux distributions use different dumpmachine outputs for the ARM > > architecture. arm, armv6l, armv7l. > > For the syscall annotation, these variants are standardized to “arm”. > > > > Signed-off-by: Julian Wundrak > > --- > > Hey everyone, > > > > This resolves bug #117. > > I hope I did everything correctly, because this is the first time I have > > had to submit a patch via git send emails. > > Then you got it right on the first attempt! I'll just add a tag in the > commit message: > > Link: https://bugs.passt.top/show_bug.cgi?id=117 > > ...and I'll run tests, then apply it. ...almost: you forgot to fix this as you mentioned in: https://bugs.passt.top/show_bug.cgi?id=117#c3 I'm fixing it up on merge as it's a trivial typo. -- Stefano

2 1

[PATCH] build: normalize arm targets
by Julian Wundrak 26 Mar '25

26 Mar '25

Linux distributions use different dumpmachine outputs for the ARM architecture. arm, armv6l, armv7l. For the syscall annotation, these variants are standardized to “arm”. Signed-off-by: Julian Wundrak <julian(a)wundrak.net> --- Hey everyone, This resolves bug #117. I hope I did everything correctly, because this is the first time I have had to submit a patch via git send emails. Julian Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index 31cbac3..1b83234 100644 --- a/Makefile +++ b/Makefile @@ -20,6 +20,7 @@ $(if $(TARGET),,$(error Failed to get target architecture)) # Get 'uname -m'-like architecture description for target TARGET_ARCH := $(firstword $(subst -, ,$(TARGET))) TARGET_ARCH := $(patsubst [:upper:],[:lower:],$(TARGET_ARCH)) +TARGET_ARCH := $(patsubst arm%,arm,$(TARGET)) TARGET_ARCH := $(subst powerpc,ppc,$(TARGET_ARCH)) # On some systems enabling optimization also enables source fortification, -- 2.49.0

2 2

[PATCH] build: normalize arm targets
by Julian Wundrak 26 Mar '25

26 Mar '25

Linux distributions use different dumpmachine outputs for the ARM architecture. arm, armv6l, armv7l. For the syscall annotation, these variants are standardized to “arm”. Signed-off-by: Julian Wundrak <julian(a)wundrak.net> --- Argh, same problem with target instead of target_arch as in comment. I squashed it, but I'm not sure, how this works with the mails. Sorry for the overhead! Julian Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index 31cbac3..3328f83 100644 --- a/Makefile +++ b/Makefile @@ -20,6 +20,7 @@ $(if $(TARGET),,$(error Failed to get target architecture)) # Get 'uname -m'-like architecture description for target TARGET_ARCH := $(firstword $(subst -, ,$(TARGET))) TARGET_ARCH := $(patsubst [:upper:],[:lower:],$(TARGET_ARCH)) +TARGET_ARCH := $(patsubst arm%,arm,$(TARGET_ARCH)) TARGET_ARCH := $(subst powerpc,ppc,$(TARGET_ARCH)) # On some systems enabling optimization also enables source fortification, -- 2.49.0

1 0

[PATCH 0/4] UDP flow socket preliminaries
by David Gibson 25 Mar '25

25 Mar '25

As discussed on our recent call, I'm working towards using connected sockets on both sides of UDP flows. This series makes some preliminary reworks that simplify things and make that easier. David Gibson (4): udp: Common invocation of udp_sock_errs() for vhost-user and "buf" paths udp: Simplify checking of epoll event bits udp_vu: Factor things out of udp_vu_reply_sock_data() loop udp: Share more logic between vu and non-vu reply socket paths udp.c | 120 +++++++++++++++++++++++++------------------------ udp_internal.h | 2 +- udp_vu.c | 68 +++++++++------------------- udp_vu.h | 9 ++-- 4 files changed, 88 insertions(+), 111 deletions(-) -- 2.49.0

1 4

[PATCH v2 00/11] Improve robustness of calculations related to frame size limits
by David Gibson 20 Mar '25

20 Mar '25

There are a number of places where we make calculations and checks around how large frames can be and where they sit in memory. Several of these are roughly correct, but can be wrong in certain edge cases. Improve robustness by clarifying what we're doing and being more careful about the edge cases. v2: * Added additional patches 5..11 * Patches 1..4 rebased but unchanged David Gibson (11): vu_common: Tighten vu_packet_check_range() packet: More cautious checks to avoid pointer arithmetic UB tap: Make size of pool_tap[46] purely a tuning parameter tap: Clarify calculation of TAP_MSGS packet: Correct type of PACKET_MAX_LEN packet: Avoid integer overflows in packet_get_do() packet: Move checks against PACKET_MAX_LEN to packet_check_range() packet: Rework packet_get() versus packet_get_try() util: Add abort_with_msg() and ASSERT_WITH_MSG() helpers packet: ASSERT on signs of pool corruption packet: Upgrade severity of most packet errors packet.c | 110 ++++++++++++++++++++++++++++++++++------------------ packet.h | 13 +++++-- passt.h | 2 - tap.c | 43 ++++++++++++++++---- tap.h | 3 +- util.c | 19 +++++++++ util.h | 25 +++++------- vu_common.c | 15 ++++--- 8 files changed, 158 insertions(+), 72 deletions(-) -- 2.48.1

2 12

passt: new version 2025_03_20.32f6212 available
by Stefano Brivio 20 Mar '25

20 Mar '25

The new version with tag 2025_03_20.32f6212 includes the following changes: 32f6212 Makefile: Enable -Wformat-security 07c2d58 conf: Include libgen.h for basename(), fix build against musl ebdd463 tcp: Flush socket before checking for more data in active close state c250ffc migrate: Bump migration version number cfb3740 migrate, tcp: Migrate RFC 7323 timestamp 28772ee migrate, tcp: More careful marshalling of mss parameter during migration 51f3c07 passt-repair: Fix build with -Werror=format-security cb5b593 tcp, flow: Better use flow specific logging heleprs 96fe554 conf: Unify several paths in conf_ports() 78f1f0f test/perf: Simplify iperf3 server lifetime management 26df8a3 conf: Limit maximum MTU based on backend frame size 9d1a6b3 pcap: Correctly set snaplen based on tap backend type b6945e0 Simplify sizing of pkt_buf c4bfa33 tap: Use explicit defines for maximum length of L2 frame 1eda8de packet: Remove redundant TAP_BUF_BYTES define c43972a packet: Give explicit name to maximum packet size 74cd82a conf: Detect vhost-user mode earlier 4b17d04 conf: Move mode detection into helper function bb00a04 conf: Use the same optstring for passt and pasta modes c8b520c flow, repair: Wait for a short while for passt-repair to connect 0470170 passt-repair: Add directory watch 2b58b22 cppcheck: Add suppressions for "logically" exported functions a83c806 vhost_user: Don't export several functions 27395e6 tcp: Don't export tcp_update_csum() 12d5b36 checksum: Don't export various functions e36c35c log: Don't export passt_vsyslog() 57d2db3 treewide: Mark assorted functions static 68b0418 udp: create and send ICMPv6 to local peer when applicable 87e6a46 tap: break out building of udp header from tap_udp6_send function 55431f0 udp: create and send ICMPv4 to local peer when applicable 82a839b tap: break out building of udp header from tap_udp4_send function 1924e25 conf: Be more precise about minimum MTUs 672d786 tcp: Send RST in response to guest packets that match no connection 1f23681 tap: Consider IPv6 flow label when building packet sequences 0081756 ip: Helpers to access IPv6 flow label 52419a6 migrate, tcp: Don't flow_alloc_cancel() during incoming migration b270821 tcp: Unconditionally move to CLOSED state on tcp_rst() 56ce03e tcp: Correct error code handling from tcp_flow_repair_socket() 39f85bc migrate, flow: Don't attempt to migrate TCP flows without passt-repair 7b92f2e migrate, flow: Trivially succeed if migrating with no flows 8747173 selinux: Fixes/workarounds for passt and passt-repair, mostly for libvirt usage be86232 seccomp.sh: Silence stty errors ea69ca6 tap: always set the no_frag flag in IPv4 headers 4dac235 contrib/fedora: Actually install passt-repair SELinux policy file 16553c8 dhcp: Add option code byte in calculation for OPT_MAX boundary check 183bedf Makefile: Use mmap2() as alternative for mmap() in valgrind extra syscalls 1cc5d4c conf: Use 0 instead of -1 as "unassigned" mtu value 3dc7da6 conf: More thorough error checking when parsing --mtu option 65e317a flow: Clean up and generalise flow traversal macros b79a22d flow: Remove unneeded bound parameter from flow traversal macros 7ffca35 flow: Remove unneeded index from foreach_* macros adb46c1 flow: Add flow_perror() helper ba0823f tcp: Don't pass both flow pointer and flow index 854bc7b tcp: Remove spurious prototype for tcp_flow_migrate_shrink_window e56c803 tcp: More type safety for tcp_flow_migrate_target_ext() 5a07eb3 tcp_vu: head_cnt need not be global 6b40651 tap: Remove unused ETH_HDR_INIT() macro 354bc0b packet: Don't pass start and offset separately to packet_check_range() 0a51060 packet: Use flexible array member in struct pool bcc4908 dhcp: Remove option 255 length byte https://passt.top/passt/log/?qt=range&q=2025_02_17.a1e48a0..2025_03_20.32f6… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/8797676/ permanent mirror: https://passt.top/builds/copr/0^20250320.g32f6212/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g32f6212-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_32f6212-1_all.deb -- Stefano

1 0