- dev - passt

[PATCH 0/5] RFC: Fix bug 209
by David Gibson 13 Jul '26

13 Jul '26

Here are a handful of changes to forwarding ant multicast handling, that fix bug 209. It also gets us closer to correct multicast handling, though we're certainly not there yet - multicast things currently only really work at all because IP_MULTICAST_ALL defaults to on, and for the common protocols the host is likely to be already a group member. RFC, because a tmux change has broken the tests for me, and I wanted to send this out before I sort out how to fix that. I have run the subset of tests covered by "make bats", which includes the podman tests. David Gibson (5): fwd: Clarify semantics of --host-lo-to-ns-lo udp: Validate that we have a unicast source address fwd: Rework default address logic for inbound flows fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host() fwd: Don't rewrite inbound multicast destinations conf.c | 2 ++ fwd.c | 61 ++++++++++++++++++++++++++++++++++-------------------- passt.1 | 9 ++++---- udp_flow.c | 2 +- 4 files changed, 46 insertions(+), 28 deletions(-) -- 2.55.0

2 3

[PATCH 3/5] fwd: Rework default address logic for inbound flows
by David Gibson 13 Jul '26

13 Jul '26

fwd_nat_from_host() needs to determine the guest side destination address for the new flow. In some cases that's controlled by the forwarding rule or -host-lo-to-ns-lo logic, but by default we use the observed guest address. We need to pick the right one to match the source address, though. Currently this is done with similar, but not quite identical logic in the spliced and non-spliced paths. Introduce a new fwd_default_guest_addr() helper to make explicit: * We have the same logic for splice and tap paths * This is a fallback path if nothing else determined the address (we use this default nearly all the time now, but it might change in future) * We're matching IP family and scope with the guest side source address Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 44 ++++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/fwd.c b/fwd.c index 84400948..90297ef7 100644 --- a/fwd.c +++ b/fwd.c @@ -1005,6 +1005,27 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, return true; } +/** + * fwd_default_geuest_addr() - Get appropriate guest address to send to + * @c: Execution context + * @guest_addr: Updated with chosen guest address + * @template: Address to match IP version and scope of + * + * Sets @guest_addr to have the address of the guest, matching the IP version + * and scope of @template where possible. + */ +static void fwd_default_guest_addr(const struct ctx *c, + union inany_addr *guest_addr, + const union inany_addr *template) +{ + if (inany_v4(template)) + *guest_addr = inany_from_v4(c->ip4.addr_seen); + else if (inany_is_linklocal6(template)) + guest_addr->a6 = c->ip6.addr_ll_seen; + else + guest_addr->a6 = c->ip6.addr_seen; +} + /** * fwd_nat_from_host() - Determine to forward a flow from the host interface * @c: Execution context @@ -1040,13 +1061,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, */ if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) tgt->eaddr = ini->oaddr; - else if (inany_v4(&ini->eaddr)) - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); - else - tgt->eaddr.a6 = c->ip6.addr_seen; /* Let the kernel pick source address and port */ - if (inany_v4(&tgt->eaddr)) + if (inany_v4(&ini->eaddr)) tgt->oaddr = inany_any4; else tgt->oaddr = inany_any6; @@ -1056,6 +1073,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, /* But for UDP preserve the source port */ tgt->oport = ini->eport; + /* Use guest address as destination, if otherwise unspecified */ + if (inany_is_unspecified(&tgt->eaddr)) + fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); return PIF_SPLICE; } @@ -1074,16 +1094,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (!inany_is_unspecified(&rule->taddr)) { + if (!inany_is_unspecified(&rule->taddr)) tgt->eaddr = rule->taddr; - } else if (inany_v4(&tgt->oaddr)) { - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); - } else { - if (inany_is_linklocal6(&tgt->oaddr)) - tgt->eaddr.a6 = c->ip6.addr_ll_seen; - else - tgt->eaddr.a6 = c->ip6.addr_seen; - } + + /* Use guest address as destination, if otherwise unspecified */ + if (inany_is_unspecified(&tgt->eaddr)) + fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); return PIF_TAP; } -- 2.55.0

2 2

[PATCH 1/5] fwd: Clarify semantics of --host-lo-to-ns-lo
by David Gibson 13 Jul '26

13 Jul '26

The semantics of --host-lo-to-ns-lo as described in the man page don't quite make sense: It says without the option forwarded packets will appear to come _from_ the guest's public address, which is not usually true. Instead the packets will arrive *to* the guest's public address. The exact semantics are also a bit confusing in general. Rewrite both the man page and code to clarify this. The new rule is that it redirects connections addressed to a host loopback address to the same loopback address in the guest. This is notionally different from what we had in two ways: * We can now deliver to nonstandard loopback addresses within the guest, not just the default one. This is technically a behavioural change, but I think will be less surprising behaviour. * The decision is now made on the original _destination_ address, rather than source address. That's different theoreically, but not in practice, since loopback packets must have loopback addresses for both source and destination. We make it explicitly incompatible with --no-splice - previously it was allowed, but would have no effect in that case. As well as being more precise right now, these semantics will intersect better with upcoming remapping of target address by forwarding rules. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 2 ++ fwd.c | 22 ++++++++++------------ passt.1 | 9 +++++---- 3 files changed, 17 insertions(+), 16 deletions(-) diff --git a/conf.c b/conf.c index 6d83daef..5b6cc2be 100644 --- a/conf.c +++ b/conf.c @@ -1796,6 +1796,8 @@ void conf(struct ctx *c, int argc, char **argv) if (c->splice_only) die("--splice-only is for pasta mode only"); } + if (c->no_splice && c->host_lo_to_ns_lo) + die("--host-lo-to-ns-lo is incompatible with --no-splice"); if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) diff --git a/fwd.c b/fwd.c index 3ae25fde..84400948 100644 --- a/fwd.c +++ b/fwd.c @@ -1038,21 +1038,19 @@ uint8_t fwd_nat_from_host(const struct ctx *c, * In either case, let the kernel pick the source address to * match. */ - if (inany_v4(&ini->eaddr)) { - if (c->host_lo_to_ns_lo) - tgt->eaddr = inany_loopback4; - else - tgt->eaddr = inany_from_v4(c->ip4.addr_seen); + if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + tgt->eaddr = ini->oaddr; + else if (inany_v4(&ini->eaddr)) + tgt->eaddr = inany_from_v4(c->ip4.addr_seen); + else + tgt->eaddr.a6 = c->ip6.addr_seen; + + /* Let the kernel pick source address and port */ + if (inany_v4(&tgt->eaddr)) tgt->oaddr = inany_any4; - } else { - if (c->host_lo_to_ns_lo) - tgt->eaddr = inany_loopback6; - else - tgt->eaddr.a6 = c->ip6.addr_seen; + else tgt->oaddr = inany_any6; - } - /* Let the kernel pick source port */ tgt->oport = 0; if (proto == IPPROTO_UDP) /* But for UDP preserve the source port */ diff --git a/passt.1 b/passt.1 index a8a06311..4f2a8e41 100644 --- a/passt.1 +++ b/passt.1 @@ -672,10 +672,11 @@ Default is \fBauto\fR. .TP .BR \-\-host-lo-to-ns-lo -If specified, connections forwarded with \fB\-t\fR and \fB\-u\fR from -the host's loopback address will appear on the loopback address in the -guest as well. Without this option such forwarded packets will appear -to come from the guest's public address. +If specified, connections to a host loopback address forwarded with +\fB\-t\fR or \fB\-u\fR will be delivered to the same loopback address +on the guest. Without this option such connections are forwarded to +the guest's public address. This option is incompatible with +\fB--no-splice\fR. .TP .BR \-\-userns " " \fIspec -- 2.55.0

2 2

[PATCH] selinux: Access to netns for podman-build, read access for netns in general
by Stefano Brivio 10 Jul '26

10 Jul '26

A few additional rules are needed when pasta is started by Podman in particular cases: - with podman-build or Buildah, pasta needs to access the target namespace reference using a procfs namespace link entry, instead of the usual directory under /run or /var/run. For that, we have a rule enabling access to container_t:lnk_file. On some systems, though, the class is 'dir' instead of 'lnk_file'. I don't have a concrete way to reproduce this or a full explanation, but in any case, an additional rule for that is obviously harmless: allow pasta_t to open, read, and search a container_t:dir - with custom networks, pasta needs to write PID files to a location indicated by Podman. If the PID file already exists, the existing permissions aren't sufficient: we also need a 'read' rule. Add that, for 'dir' and 'file' objects labeled as either container_var_run_t or ifconfig_var_run_t (this depends on the installed Podman and container-selinux versions) Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index ff74dd7..9394f97 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -175,6 +175,7 @@ allow pasta_t container_runtime_t:fifo_file { getattr write }; allow pasta_t container_runtime_t:file read; allow pasta_t container_runtime_t:lnk_file read; allow pasta_t container_t:lnk_file read; +allow pasta_t container_t:dir { open read search }; allow pasta_t pasta_port_t:tcp_socket { name_bind name_connect }; allow pasta_t pasta_port_t:udp_socket { name_bind }; allow pasta_t http_port_t:tcp_socket { name_bind name_connect }; @@ -249,10 +250,10 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; -allow pasta_t container_var_run_t:dir { add_name open rmdir write }; -allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; -allow pasta_t container_var_run_t:file { create open write }; -allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:dir { add_name open read rmdir write }; +allow pasta_t ifconfig_var_run_t:dir { add_name open read rmdir write }; +allow pasta_t container_var_run_t:file { create open read write }; +allow pasta_t ifconfig_var_run_t:file { create open read write }; allow pasta_t container_var_run_t:sock_file { getattr create open read write }; allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; -- 2.43.0

1 0

[PATCH 4/5] fwd: Reorder DNAPT and SNAT steps in fwd_nat_from_host()
by David Gibson 10 Jul '26

10 Jul '26

The order in which we translate source and destination addresses is a bit unclear in fwd_nat_from_host(). Reorder things to make it clearer: 1. Pick guest-side destination address, where options require it 2. Pick guest-side source address (needs to be different for SPLICE and TAP) 3. If (1) didn't determine destination, pick a fallback to match family and scope of source address from (2). As a small bonus this lets us make step (1) common between SPLICE and TAP paths. The value of this is a bit dubious right now, but it will make some future changes clearer. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- fwd.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/fwd.c b/fwd.c index 90297ef7..7d39898e 100644 --- a/fwd.c +++ b/fwd.c @@ -1041,8 +1041,12 @@ uint8_t fwd_nat_from_host(const struct ctx *c, const struct fwd_rule *rule, uint8_t proto, const struct flowside *ini, struct flowside *tgt) { - /* Common for spliced and non-spliced cases */ + /* DNAPT: Common for splice and non-spliced where possible */ tgt->eport = rule->to + (ini->oport - rule->first); + if (!inany_is_unspecified(&rule->taddr)) + tgt->eaddr = rule->taddr; + else if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) + tgt->eaddr = ini->oaddr; /* TODO: Allow splicing with specified target address */ if (!c->no_splice && inany_is_unspecified(&rule->taddr) && @@ -1059,10 +1063,8 @@ uint8_t fwd_nat_from_host(const struct ctx *c, * In either case, let the kernel pick the source address to * match. */ - if (c->host_lo_to_ns_lo && inany_is_loopback(&ini->oaddr)) - tgt->eaddr = ini->oaddr; - /* Let the kernel pick source address and port */ + /* SNAT: (implicit) let the kernel pick source addr/port */ if (inany_v4(&ini->eaddr)) tgt->oaddr = inany_any4; else @@ -1082,6 +1084,7 @@ uint8_t fwd_nat_from_host(const struct ctx *c, if (c->splice_only) return PIF_NONE; + /* SNAT: translate source address if necessary */ if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) @@ -1094,9 +1097,6 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (!inany_is_unspecified(&rule->taddr)) - tgt->eaddr = rule->taddr; - /* Use guest address as destination, if otherwise unspecified */ if (inany_is_unspecified(&tgt->eaddr)) fwd_default_guest_addr(c, &tgt->eaddr, &tgt->oaddr); -- 2.55.0

1 0

[PATCH 2/5] udp: Validate that we have a unicast source address
by David Gibson 10 Jul '26

10 Jul '26

When creating a UDP flow from a socket we, correctly, check that the source address is unicast - multicast addresses are not valid as a source address. However, when creating a flow from tap we only check the source address is specified, not that it is unicast. Correct this. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- udp_flow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/udp_flow.c b/udp_flow.c index 5a59f7f3..f59649f6 100644 --- a/udp_flow.c +++ b/udp_flow.c @@ -307,7 +307,7 @@ flow_sidx_t udp_flow_from_tap(const struct ctx *c, ini = flow_initiate_af(flow, PIF_TAP, af, saddr, srcport, daddr, dstport); - if (inany_is_unspecified(&ini->eaddr) || ini->eport == 0 || + if (!inany_is_unicast(&ini->eaddr) || ini->eport == 0 || inany_is_unspecified(&ini->oaddr) || ini->oport == 0) { flow_dbg(flow, "Invalid endpoint on UDP packet"); flow_alloc_cancel(flow); -- 2.55.0

1 0

[PATCH 0/7] Fix issues and false positives in code coverge tool
by Jon Maloy 09 Jul '26

09 Jul '26

This series fixes minor issues found by code coverage tools in the main passt code and in documentation examples. The core code changes addresses missing fd initialisations and explicit invariant checks for unsigned arithmetic. We also fix address buffer handling, type mismatches, uninitialised variables, and resource leaks in the documentation example code. Jon Maloy (7): passt: Initialise listening socket fds to -1 udp_vu: Assert iov_tail_clone() return before assigning to msg_iovlen tap: Assert IPv6 tail size before subtracting header length doc/migration: Use strncpy() for socket path and fix argv access doc/migration: Fix buffer type mismatch in recv() call doc/platform-requirements: Initialise va_list before va_start() doc/platform-requirements: Close leaked sockets in test_close_dup() doc/migration/source.c | 2 +- doc/migration/target.c | 10 ++++------ doc/platform-requirements/common.h | 2 +- doc/platform-requirements/udp-close-dup.c | 3 +++ passt.c | 3 +++ tap.c | 4 +++- udp_vu.c | 7 +++++-- 7 files changed, 20 insertions(+), 11 deletions(-) -- 2.52.0

3 17

[PATCH v8 01/14] dhcpv6: Fix reply destination to match client's source address
by Jon Maloy 09 Jul '26

09 Jul '26

tap_ip6_daddr() selects the reply destination based on our source address type (link-local), so it always returns addr_ll_seen. But if the client sent from a global address, we would reply to an address different from what the client is expecting. Since RFC 9915 (section 18.3.10) allows clients to use global addresses for DHCPv6, we now correct this, and always respond to the address the client was using. We also remove a redundant addr_ll_seen assignment, since this is already done by tap.c when processing IPv6 packets. Note: if the client uses a global source address, our reply will still have a link-local source, creating a scope mismatch. Fixing this properly would require a mechanism to allocate a global address for the DHCPv6 server, which we currently don't have. Responding to the client's actual source address is still a net improvement over the previous behavior of replying to an unrelated cached address. Note 2: This commit isn't actually a fix to an observed problem, but rather an answer to a theoretical issue, adding completeness to the mechanism and simplifying subsequent changes in this series. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v8: -Updated commit log, acknowledging concerns expressed by David and Stefano. -Some minor changes also addressing feedback from the same persons. --- dhcpv6.c | 16 ++++++++-------- dhcpv6.h | 2 +- tap.c | 15 --------------- tap.h | 2 -- 4 files changed, 9 insertions(+), 26 deletions(-) diff --git a/dhcpv6.c b/dhcpv6.c index 97c04e2c..29c7e320 100644 --- a/dhcpv6.c +++ b/dhcpv6.c @@ -370,12 +370,14 @@ notonlink: /** * dhcpv6_send_ia_notonlink() - Send NotOnLink status * @c: Execution context + * @caddr: Source address of client message (reply destination) * @ia_base: Non-appropriate IA_NA or IA_TA base * @client_id_base: Client ID message option base * @len: Client ID length * @xid: Transaction ID for message exchange */ static void dhcpv6_send_ia_notonlink(struct ctx *c, + const struct in6_addr *caddr, const struct iov_tail *ia_base, const struct iov_tail *client_id_base, int len, uint32_t xid) @@ -405,8 +407,7 @@ static void dhcpv6_send_ia_notonlink(struct ctx *c, resp_not_on_link.hdr.xid = xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - xid, &resp_not_on_link, n); + tap_udp6_send(c, src, 547, caddr, 546, xid, &resp_not_on_link, n); } /** @@ -590,8 +591,6 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (mlen + sizeof(*uh) != ntohs(uh->len) || mlen < sizeof(*mh)) return -1; - c->ip6.addr_ll_seen = *saddr; - src = &c->ip6.our_tap_ll; mh = IOV_REMOVE_HEADER(data, mh_storage); @@ -630,8 +629,10 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, if (dhcpv6_ia_notonlink(data, &c->ip6.addr)) { - dhcpv6_send_ia_notonlink(c, data, &client_id_base, - ntohs(client_id->l), mh->xid); + dhcpv6_send_ia_notonlink(c, saddr, data, + &client_id_base, + ntohs(client_id->l), + mh->xid); return 1; } @@ -680,8 +681,7 @@ int dhcpv6(struct ctx *c, struct iov_tail *data, resp.hdr.xid = mh->xid; - tap_udp6_send(c, src, 547, tap_ip6_daddr(c, src), 546, - mh->xid, &resp, n); + tap_udp6_send(c, src, 547, saddr, 546, mh->xid, &resp, n); c->ip6.addr_seen = c->ip6.addr; return 1; diff --git a/dhcpv6.h b/dhcpv6.h index c706dfdb..1015a1a7 100644 --- a/dhcpv6.h +++ b/dhcpv6.h @@ -7,7 +7,7 @@ #define DHCPV6_H int dhcpv6(struct ctx *c, struct iov_tail *data, - struct in6_addr *saddr, struct in6_addr *daddr); + const struct in6_addr *saddr, const struct in6_addr *daddr); void dhcpv6_init(const struct ctx *c); #endif /* DHCPV6_H */ diff --git a/tap.c b/tap.c index 6d93c7ce..d4189617 100644 --- a/tap.c +++ b/tap.c @@ -160,21 +160,6 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len) } } -/** - * tap_ip6_daddr() - Normal IPv6 destination address for inbound packets - * @c: Execution context - * @src: Source address - * - * Return: pointer to IPv6 address - */ -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src) -{ - if (IN6_IS_ADDR_LINKLOCAL(src)) - return &c->ip6.addr_ll_seen; - return &c->ip6.addr_seen; -} - /** * tap_push_l2h() - Build an L2 header for an inbound packet * @c: Execution context diff --git a/tap.h b/tap.h index 07ca0965..b335933f 100644 --- a/tap.h +++ b/tap.h @@ -96,8 +96,6 @@ void tap_udp4_send(const struct ctx *c, struct in_addr src, in_port_t sport, const void *in, size_t dlen); void tap_icmp4_send(const struct ctx *c, struct in_addr src, struct in_addr dst, const void *in, const void *src_mac, size_t l4len); -const struct in6_addr *tap_ip6_daddr(const struct ctx *c, - const struct in6_addr *src); void *tap_push_ip6h(struct ipv6hdr *ip6h, const struct in6_addr *src, const struct in6_addr *dst, size_t l4len, uint8_t proto, uint32_t flow); -- 2.52.0

2 1

[PATCH v2] isolation: Add --chroot-fallback option
by Mateusz Andrzejewski 08 Jul '26

08 Jul '26

For integrations, which use rootfs on tmpfs or initramfs, it is not allowed to use pivot_root(). It results with invalid argument (EINVAL) error. Introduce --chroot-fallback option as a workaround with MS_MOVE + chroot(). Due to weaker isolation of chroot() method (we don't unmount old root), user has tu explicitly enable fallback with the new option. First, always try to sandbox with pivot_root(). In both cases the new root is placed into an empty tmpfs. For the solution to work we keep CAP_SYS_CHROOT capability, which is dropped at the end of the isolate_prefork() function. Link: https://bugs.passt.top/show_bug.cgi?id=104 Signed-off-by: Mateusz Andrzejewski <mateusz.andrzejewski(a)mikronika.com.pl> --- Changes since v1: - added a description of the new option to the man page - renamed option to --chroot-fallback - removed auxiliary variable in conf() - passed execution context to isolate_user() - fixed indentation and other coding style issues - fixed cppcheck issue with variableScope in isolate_prefork() Direct write to &c->chroot_fallback is not valid, because it's a bool variable and compilation results with an incompatible-pointer-types warning (int* expected). To fix this, the assignment was moved to the '32' label in the switch statement and the temporary helper variable could be removed. This follows the same pattern of other boolean options. conf.c | 8 +++++- isolation.c | 71 ++++++++++++++++++++++++++++++++++++++++++----------- isolation.h | 4 +-- passt.1 | 9 +++++++ passt.h | 2 ++ 5 files changed, 77 insertions(+), 17 deletions(-) diff --git a/conf.c b/conf.c index 4755a9f..6755bf6 100644 --- a/conf.c +++ b/conf.c @@ -654,6 +654,8 @@ static void usage(const char *name, FILE *f, int status) " --no-ra Disable router advertisements\n" " --freebind Bind to any address for forwarding\n" " --no-map-gw Don't map gateway address to host\n" + " --chroot-fallback Use chroot() if pivot_root() fails\n" + " can be useful for rootfs on tmpfs or initramfs\n" " -4, --ipv4-only Enable IPv4 operation only\n" " -6, --ipv6-only Enable IPv6 operation only\n" " -t, --tcp-ports SPEC TCP port forwarding to %s\n" @@ -1233,6 +1235,7 @@ void conf(struct ctx *c, int argc, char **argv) {"migrate-no-linger", no_argument, NULL, 30 }, {"stats", required_argument, NULL, 31 }, {"conf-path", required_argument, NULL, 'c' }, + {"chroot-fallback", no_argument, NULL, 32 }, { 0 }, }; const char *optstring = "+dqfel:hs:c:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1467,6 +1470,9 @@ void conf(struct ctx *c, int argc, char **argv) die("Can't display statistics if not running in foreground"); c->stats = strtol(optarg, NULL, 0); break; + case 32: + c->chroot_fallback = true; + break; case 'd': c->debug = 1; c->quiet = 0; @@ -1879,7 +1885,7 @@ void conf(struct ctx *c, int argc, char **argv) conf_open_files(c); /* Before any possible setuid() / setgid() */ - isolate_user(uid, gid, !netns_only, userns, c->mode); + isolate_user(c, uid, gid, !netns_only, userns); if (c->no_icmp) c->no_ndp = 1; diff --git a/isolation.c b/isolation.c index 7e6225d..08e4008 100644 --- a/isolation.c +++ b/isolation.c @@ -166,6 +166,31 @@ static void clamp_caps(void) die_perror("Couldn't drop inheritable capabilities"); } +/** + * move_root() - Use chroot() instead of pivot_root() for sandboxing + * + * Return: negative error code on failure, zero on success + */ +static int move_root(void) +{ + if (mount(TMPDIR, "/", "", MS_MOVE, "")) { + err_perror("Failed to move root into empty tmpfs"); + return -errno; + } + + if (chroot(".")) { + err_perror("Failed to chroot() into empty tmpfs"); + return -errno; + } + + if (chdir("/")) { + err_perror("Failed to change directory into new root"); + return -errno; + } + + return 0; +} + /** * isolate_initial() - Early, mostly config independent self isolation * @argc: Argument count @@ -195,14 +220,18 @@ void isolate_initial(int argc, char **argv) * - CAP_SYS_ADMIN, so that we can setns() to the netns. * - Keep CAP_NET_ADMIN, so that we can configure interfaces * + * We have to keep CAP_SYS_CHROOT in case of --chroot-fallback option + * being enabled, so we can fallback from pivot_root() to chroot() in + * isolate_prefork(). + * * It's debatable whether it's useful to drop caps when we * retain SETUID and SYS_ADMIN, but we might as well. We drop * further capabilities in isolate_user() and * isolate_prefork(). */ keep = BIT(CAP_NET_BIND_SERVICE) | BIT(CAP_SETUID) | BIT(CAP_SETGID) | - BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE); - + BIT(CAP_SYS_ADMIN) | BIT(CAP_NET_ADMIN) | BIT(CAP_DAC_OVERRIDE) | + BIT(CAP_SYS_CHROOT); /* Since Linux 5.12, if we want to update /proc/self/uid_map to create * a mapping from UID 0, which only happens with pasta spawning a child * from a non-init user namespace (pasta can't run as root), we need to @@ -220,11 +249,11 @@ void isolate_initial(int argc, char **argv) /** * isolate_user() - Switch to final UID/GID and move into userns + * @c: Execution context * @uid: User ID to run as (in original userns) * @gid: Group ID to run as (in original userns) * @use_userns: Whether to join or create a userns * @userns: userns path to enter, may be empty - * @mode: Mode (passt or pasta) * * Should: * - set our final UID and GID @@ -232,8 +261,8 @@ void isolate_initial(int argc, char **argv) * Mustn't: * - remove filesystem access (we need that for further setup) */ -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode) +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns) { uint64_t ns_caps = 0; @@ -277,7 +306,14 @@ void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, * netns */ ns_caps |= BIT(CAP_SYS_ADMIN); - if (mode == MODE_PASTA) { + + /* Only keep CAP_SYS_CHROOT for the --chroot-fallback case. Otherwise + * it can be dropped + */ + if (c->chroot_fallback) + ns_caps |= BIT(CAP_SYS_CHROOT); + + if (c->mode == MODE_PASTA) { /* Keep CAP_NET_ADMIN, so we can configure the if */ ns_caps |= BIT(CAP_NET_ADMIN); /* Keep CAP_NET_BIND_SERVICE, so we can splice @@ -331,7 +367,7 @@ int isolate_prefork(const struct ctx *c) if (mount("", TMPDIR, "tmpfs", MS_NODEV | MS_NOEXEC | MS_NOSUID | MS_RDONLY, "nr_inodes=2,nr_blocks=0")) { - err_perror("Failed to mount empty tmpfs for pivot_root()"); + err_perror("Failed to mount empty tmpfs for sandboxing"); return -errno; } @@ -341,13 +377,20 @@ int isolate_prefork(const struct ctx *c) } if (syscall(SYS_pivot_root, ".", ".")) { - err_perror("Failed to pivot_root() into empty tmpfs"); - return -errno; - } - - if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { - err_perror("Failed to unmount original root filesystem"); - return -errno; + if (c->chroot_fallback) { + int rc; + info("Failed to pivot_root(), fallback to chroot()..."); + if ((rc = move_root())) + return rc; + } else { + err_perror("Failed to pivot_root() into empty tmpfs"); + return -errno; + } + } else { + if (umount2(".", MNT_DETACH | UMOUNT_NOFOLLOW)) { + err_perror("Failed to unmount original root filesystem"); + return -errno; + } } /* Now that initialization is more-or-less complete, we can diff --git a/isolation.h b/isolation.h index 0576168..66b6968 100644 --- a/isolation.h +++ b/isolation.h @@ -11,8 +11,8 @@ #include <unistd.h> void isolate_initial(int argc, char **argv); -void isolate_user(uid_t uid, gid_t gid, bool use_userns, const char *userns, - enum passt_modes mode); +void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, + const char *userns); int isolate_prefork(const struct ctx *c); void isolate_postfork(const struct ctx *c); diff --git a/passt.1 b/passt.1 index 908fd4a..8a33c2e 100644 --- a/passt.1 +++ b/passt.1 @@ -393,6 +393,15 @@ as destination, to the host. Implied if there is no gateway on the selected default route, or if there is no default route, for any of the enabled address families. +.TP +.BR \-\-chroot-fallback +Enable a fallback to chroot() in case pivot_root() returns an error. Useful for +integrations, which use rootfs on tmpfs or initramfs, where it is not allowed to +use pivot_root(), because it results with an invalid argument error (EINVAL). + +By default, fallback is disabled. If pivot_root() fails, then the entire +sandboxing process fails. + .TP .BR \-\-map-guest-addr " " \fIaddr Translate \fIaddr\fR in the guest to be equal to the guest's assigned diff --git a/passt.h b/passt.h index 16506dc..a20148e 100644 --- a/passt.h +++ b/passt.h @@ -214,6 +214,7 @@ struct ip6_ctx { * @splice_only: Only enable loopback forwarding * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding + * @chroot_fallback: Use chroot() in case pivot_root() fails * @low_wmem: Low probed net.core.wmem_max * @low_rmem: Low probed net.core.rmem_max * @no_bindtodevice: Unprivileged SO_BINDTODEVICE not available @@ -299,6 +300,7 @@ struct ctx { int splice_only; int host_lo_to_ns_lo; int freebind; + bool chroot_fallback; int low_wmem; int low_rmem; -- 2.43.7

2 3

[PATCH v4 0/2] Target address mapping
by David Gibson 08 Jul '26

08 Jul '26

Here's another draft for target address remapping. I've now given this some basic, though not extensive testing. v4: * Add suggested command line fix if attempting a forward from dual stack address to a specific address v3: * Moved target address validation to fwd_rule_add() and tidied up a bit * Some readability tweaks to man page v2: * Remove the patch altering --host-lo-to-ns-lo; it's not relevant to the change at hand. * Allow either just target address, just target port or both to be specified * Allow target address to be specified with all * Prohibit (for now) forwarding between IPv4 and IPv6 (including from to a specific address of either family). * Add the target address when formatting rules for debug display. * Updated man page for new syntax David Gibson (1): fwd_rule: Parse target addresses for forwarding rules Stefano Brivio (1): fwd, fwd_rule: Implement configurable target address mapping fwd.c | 8 +++- fwd_rule.c | 114 ++++++++++++++++++++++++++++++++++++++++++++--------- fwd_rule.h | 7 +++- passt.1 | 31 ++++++++++----- pesto.h | 6 ++- 5 files changed, 134 insertions(+), 32 deletions(-) -- 2.55.0

2 3