- dev - passt

[PATCH 0/6] tcp: Fixes for issues uncovered by tests with 6.17-rc1 kernels
by Stefano Brivio 19 Aug '25

19 Aug '25

Starting from Linux kernel commit 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"), window limits are enforced more aggressively with a bigger amount of zero-window updates compared to what happened with e2142825c120 ("net: tcp: send zero-window ACK when no memory") alone, and occasional duplicate ACKs can now be seen also for local transfers with default (208 KiB) socket buffer sizes. Paul reports that, with 6.17-rc1-ish kernels, Podman tests for the pasta integration occasionally fail on the "TCP/IPv4 large transfer, tap" case. While playing with a reproducer that seems to be matching those failures: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done and a kernel including that commit, I hit a few different failures, that should be fixed by this series. Stefano Brivio (6): tcp: FIN flags have to be retransmitted as well tcp: Factor sequence rewind for retransmissions into a new function tcp: Rewind sequence when guest shrinks window to zero tcp: Fix closing logic for half-closed connections tcp: Don't try to transmit right after the peer shrank the window to zero tcp: Fast re-transmit if half-closed, make TAP_FIN_RCVD path consistent tcp.c | 170 ++++++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 118 insertions(+), 52 deletions(-) -- 2.43.0

3 16

[PATCH] treewide: Flush pcap and log files, if used, before exiting
by Stefano Brivio 15 Aug '25

15 Aug '25

I didn't imagine that occasionally truncated pcap and log files, as a result of commit a9d63f91a59a ("passt-repair: use _exit() over return"), would be such a big deal, until I tried to debug TCP issues with this beauty: while true; do ./pasta --trace -l /tmp/pasta.log -p /tmp/pasta.pcap --config-net -t 5555 -- socat TCP-LISTEN:5555 OPEN:/tmp/large.rcv,trunc & (sleep 0.3; socat -T2 OPEN:large.bin TCP:88.198.0.164:5555; ); wait; diff large.bin /tmp/large.rcv || break; done ...flush files and pcap if we're using them. Ignore fsync() errors for the log file as we obviously can't reliably log them. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 2 +- log.c | 2 +- log.h | 1 + passt.c | 1 + pasta.c | 2 ++ pcap.c | 2 +- pcap.h | 2 ++ tap.c | 4 +++- util.c | 15 +++++++++++++++ util.h | 1 + 10 files changed, 28 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 54fed07..8f188f4 100644 --- a/README.md +++ b/README.md @@ -291,7 +291,7 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted) * ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached * ✅ no external dependencies (other than a standard C library) -* ✅ restrictive seccomp profiles (30 syscalls allowed for _passt_, 41 for +* ✅ restrictive seccomp profiles (33 syscalls allowed for _passt_, 43 for _pasta_ on x86_64) * ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and [SELinux](/passt/tree/contrib/selinux) profiles available diff --git a/log.c b/log.c index 33b89fc..21e3673 100644 --- a/log.c +++ b/log.c @@ -35,7 +35,7 @@ static int log_sock = -1; /* Optional socket to system logger */ static char log_ident[BUFSIZ]; /* Identifier string for openlog() */ static int log_mask; /* Current log priority mask */ -static int log_file = -1; /* Optional log file descriptor */ +int log_file = -1; /* Optional log file descriptor */ static size_t log_size; /* Maximum log file size in bytes */ static size_t log_written; /* Currently used bytes in log file */ static size_t log_cut_size; /* Bytes to cut at start on rotation */ diff --git a/log.h b/log.h index 08aa88c..c8473c0 100644 --- a/log.h +++ b/log.h @@ -41,6 +41,7 @@ void logmsg_perror(int pri, const char *format, ...) _exit(EXIT_FAILURE); \ } while (0) +extern int log_file; extern int log_trace; extern bool log_conf_parsed; extern bool log_stderr; diff --git a/passt.c b/passt.c index 388d10f..a4ec115 100644 --- a/passt.c +++ b/passt.c @@ -170,6 +170,7 @@ static void exit_handler(int signal) { (void)signal; + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); } diff --git a/pasta.c b/pasta.c index c207692..687406b 100644 --- a/pasta.c +++ b/pasta.c @@ -70,6 +70,8 @@ void pasta_child_handler(int signal) if (pasta_child_pid && !waitid(P_PID, pasta_child_pid, &infop, WEXITED | WNOHANG)) { if (infop.si_pid == pasta_child_pid) { + fsync_pcap_and_log(); + if (infop.si_code == CLD_EXITED) _exit(infop.si_status); diff --git a/pcap.c b/pcap.c index 46d11a2..e9d8d80 100644 --- a/pcap.c +++ b/pcap.c @@ -37,7 +37,7 @@ #define PCAP_VERSION_MINOR 4 -static int pcap_fd = -1; +int pcap_fd = -1; struct pcap_pkthdr { uint32_t tv_sec; diff --git a/pcap.h b/pcap.h index 9795f2e..2aeb53e 100644 --- a/pcap.h +++ b/pcap.h @@ -6,6 +6,8 @@ #ifndef PCAP_H #define PCAP_H +extern int pcap_fd; + void pcap(const char *pkt, size_t l2len); void pcap_multiple(const struct iovec *iov, size_t frame_parts, unsigned int n, size_t offset); diff --git a/tap.c b/tap.c index 6db5d88..cddc164 100644 --- a/tap.c +++ b/tap.c @@ -1117,8 +1117,10 @@ void tap_sock_reset(struct ctx *c) { info("Client connection closed%s", c->one_off ? ", exiting" : ""); - if (c->one_off) + if (c->one_off) { + fsync_pcap_and_log(); _exit(EXIT_SUCCESS); + } /* Close the connected socket, wait for a new connection */ epoll_del(c, c->fd_tap); diff --git a/util.c b/util.c index 3e93d47..c492f90 100644 --- a/util.c +++ b/util.c @@ -34,6 +34,7 @@ #include "passt.h" #include "packet.h" #include "log.h" +#include "pcap.h" #ifdef HAS_GETRANDOM #include <sys/random.h> #endif @@ -1045,3 +1046,17 @@ void abort_with_msg(const char *fmt, ...) */ abort(); } + +/** + * fsync_pcap_and_log() - Flush pcap and log files as needed + * + * #syscalls fsync + */ +void fsync_pcap_and_log(void) +{ + if (pcap_fd != -1 && fsync(pcap_fd)) + warn_perror("Failed to flush pcap file, it might be truncated"); + + if (log_file != -1) + (void)fsync(log_file); +} diff --git a/util.h b/util.h index b5b1b31..2a8c38f 100644 --- a/util.h +++ b/util.h @@ -226,6 +226,7 @@ int read_all_buf(int fd, void *buf, size_t len); int read_remainder(int fd, const struct iovec *iov, size_t cnt, size_t skip); void close_open_files(int argc, char **argv); bool snprintf_check(char *str, size_t size, const char *format, ...); +void fsync_pcap_and_log(void); /** * af_name() - Return name of an address family -- 2.43.0

2 6

Exeter testing, next steps
by David Gibson 15 Aug '25

15 Aug '25

Today I finally had a good look at what the next steps need to be if we are to use exeter based test "for real" in the passt repo. I already have draft series which move a bunch of the simpler tests to exeter. But in order to actually use these we need some sort of runner. We're not tied to that runner, we can easily change - that's the whole point of exeter - but we need to have something. AIUI, Stefano is not happy with the idea of using either Avocado or Meson as the default which were the runners I initially focused on for exeter. I now suggest two more options: 1) Add a tool as part of exeter that will generate a BATS test script from an exeter test program. So you'd do something like: $ exetool --bats <exeter_test_program> > foo.bats $ bats foo.bats This should be pretty easy to do, it's basically what I already have for Avocado support, indeed a little easier. For reasons internal to exeter, Python is the obvious choice to implement exetool, but I could do it in shell if you really don't like that. 2) Hand-roll a minimal exeter runner as part of passt's existing test scripts. I'm thinking you could essentially point our test stuff at an exeter program as an alternative to pointing it at a file with the existing test DSL. This is more work, but still not too bad. It has the advantage of not adding another dependency, and means we could count exeter results along with our existing test results in the final summary. However, we'd lose parallel execution and filtering. Stefano, would you be willing to merge patches which add some basic exeter tests using one of these approaches? This would probably just be static checked and build tests at this point, as a proof-of-concept. If we can start introducing some exeter tests, the next step would be to work on the support library stuff for constructing more complex network environments from namespaces. I have draft series with this as well, but I was looking at splitting it into another mini-project (tentative name "sinte" - Simulated Inter Network Test Environment). -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 8

[PATCH v8 00/30] Introduce discontiguous frames management
by Laurent Vivier 15 Aug '25

15 Aug '25

This series introduces iov_tail to convey frame information between functions. This is only an API change, for the moment the memory pool is only able to store contiguous buffer, so, except for vhost-user in a special case, we only play with iovec array with only one entry. v8: - rebase - rework the two last patches to store the iovec in the p->pkt array v7: - Add a patch to fix comment style of 'Return:' - Fix ignore_arp()/accept_arp() - Fix coverity error - Fix several comments v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (30): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: Refactor vhost-user memory region handling packet: Add support for multi-vector packets arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 48 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 41 ++++++---- icmp.h | 2 +- iov.c | 102 ++++++++++++++++++++--- iov.h | 58 ++++++++++---- ip.c | 32 ++++---- ip.h | 3 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 139 +++++++++++++++++--------------- packet.h | 45 ++++------- pcap.c | 1 + tap.c | 119 +++++++++++++++------------ tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 33 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 18 ++++- vu_common.c | 48 ++++------- 26 files changed, 689 insertions(+), 434 deletions(-) -- 2.49.0

3 67

[PATCH v10 00/30] Introduce discontiguous frames management
by Laurent Vivier 15 Aug '25

15 Aug '25

This series introduces iov_tail to convey frame information between functions. v10: - rename iov_tail_drop() to iov_drop_header() - rename pool_full() to pool_can_fit() - replace NOLINTNEXTLINE(clang-analyzer-core.NonNullParamChecker) by ASSERT(iov[i].iov_base); - update iov_tail_clone() comment header v9: - address comments from David v8: - rebase - rework the two last patches to store the iovec in the p->pkt array v7: - Add a patch to fix comment style of 'Return:' - Fix ignore_arp()/accept_arp() - Fix coverity error - Fix several comments v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (30): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_drop_header(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: Refactor vhost-user memory region handling packet: Add support for multi-vector packets arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 48 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 40 +++++---- icmp.h | 2 +- iov.c | 101 ++++++++++++++++++++--- iov.h | 58 ++++++++++---- ip.c | 33 ++++---- ip.h | 3 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 144 ++++++++++++++++++--------------- packet.h | 45 ++++------- pcap.c | 1 + tap.c | 119 +++++++++++++++------------ tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 33 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 18 ++++- vu_common.c | 48 ++++------- 26 files changed, 691 insertions(+), 436 deletions(-) -- 2.49.0

2 33

[PATCH v9 00/30] Introduce discontiguous frames management
by Laurent Vivier 13 Aug '25

13 Aug '25

This series introduces iov_tail to convey frame information between functions. v9: - address comments from David v8: - rebase - rework the two last patches to store the iovec in the p->pkt array v7: - Add a patch to fix comment style of 'Return:' - Fix ignore_arp()/accept_arp() - Fix coverity error - Fix several comments v6: - Replaced iov_slice() with the clearer iov_tail_clone() for creating iovec subsets. - Standardized local header variable names (to *_storage suffix). - Renamed functions for better semantics (e.g., ignore_arp to accept_arp, packet_data to packet_get). - Corrected OPTLEN_MAX definition in TCP. - Addressed minor logic issues (e.g., DHCPv6 FQDN flags, NDP null check). - Updated ipv6_l4hdr() return type to boolean. - Improved comments and documentation across several modules. v5: - store in the pool iovec array with several entries v4: Prepare to introduce iovec array in the pool: - passe iov_tail rather than pool to ndp,icmp, dhcp, dhcpv6 and arp - remove unused pool macros - add memory regions in the pool structure, this will allow us to use the buf pointer to store the iovec array for vhost-user v3: Address comments from David Laurent Vivier (30): arp: Don't mix incoming and outgoing buffers iov: Introduce iov_tail_clone() and iov_tail_drop(). iov: Update IOV_REMOVE_HEADER() and IOV_PEEK_HEADER() tap: Use iov_tail with tap_add_packet() packet: Use iov_tail with packet_add() packet: Add packet_data() arp: Convert to iov_tail ndp: Convert to iov_tail icmp: Convert to iov_tail udp: Convert to iov_tail tcp: Convert tcp_tap_handler() to use iov_tail tcp: Convert tcp_data_from_tap() to use iov_tail dhcpv6: move offset initialization out of dhcpv6_opt() dhcpv6: Extract sending of NotOnLink status dhcpv6: Convert to iov_tail dhcpv6: Use iov_tail in dhcpv6_opt() dhcp: Convert to iov_tail ip: Use iov_tail in ipv6_l4hdr() tap: Convert tap4_handler() to iov_tail tap: Convert tap6_handler() to iov_tail packet: rename packet_data() to packet_get() arp: use iov_tail rather than pool dhcp: use iov_tail rather than pool dhcpv6: use iov_tail rather than pool icmp: use iov_tail rather than pool ndp: use iov_tail rather than pool packet: remove PACKET_POOL() and PACKET_POOL_P() packet: remove unused parameter from PACKET_POOL_DECL() packet: Refactor vhost-user memory region handling packet: Add support for multi-vector packets arp.c | 86 +++++++++++++------- arp.h | 2 +- dhcp.c | 48 ++++++----- dhcp.h | 2 +- dhcpv6.c | 223 +++++++++++++++++++++++++++++++-------------------- dhcpv6.h | 2 +- icmp.c | 40 +++++---- icmp.h | 2 +- iov.c | 102 ++++++++++++++++++++--- iov.h | 58 ++++++++++---- ip.c | 33 ++++---- ip.h | 3 +- ndp.c | 16 +++- ndp.h | 4 +- packet.c | 142 +++++++++++++++++--------------- packet.h | 45 ++++------- pcap.c | 1 + tap.c | 119 +++++++++++++++------------ tap.h | 4 +- tcp.c | 61 +++++++++----- tcp_buf.c | 2 +- udp.c | 33 +++++--- vhost_user.c | 28 +++---- virtio.c | 4 +- virtio.h | 18 ++++- vu_common.c | 48 ++++------- 26 files changed, 691 insertions(+), 435 deletions(-) -- 2.49.0

2 41

passt: new version 2025_08_05.309eefd available
by Stefano Brivio 06 Aug '25

06 Aug '25

The new version with tag 2025_08_05.309eefd includes the following changes: 309eefd selinux: pasta accesses /etc/resolv.conf a878286 treewide: By default, don't quit source after migration, keep sockets open 79de81e test: Deal with /bin, /sbin unification in Fedora 3757ea3 style: Add parentheses to function names in comments 9e0423e style: Fix 'Return' comment style https://passt.top/passt/log/?qt=range&q=2025_06_11.0293c6f..2025_08_05.309e… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9381856/ permanent mirror: https://passt.top/builds/copr/0^20250805.g309eefd/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g309eefd-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_309eefd-1_all.deb -- Stefano

1 0

[PATCH v3 0/8] use true MAC address of LAN local remote hosts
by Jon Maloy 06 Aug '25

06 Aug '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. Jon Maloy (8): netlink: Add function to extract MAC addresses from NDP/ARP table arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() tcp: make tcp_rst_no_conn() respond with correct MAC address icmp: let icmp use mac address from flowside structure arp.c | 9 ++++++++ flow.c | 21 ++++++++++++++++- flow.h | 2 ++ fwd.c | 2 +- fwd.h | 3 ++- icmp.c | 4 ++-- inany.c | 15 ++++++++++++ inany.h | 1 + ndp.c | 11 ++++++++- netlink.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++ netlink.h | 2 ++ tap.c | 24 +++++++++++-------- tap.h | 7 +++--- tcp.c | 22 +++++++++++++++--- tcp_buf.c | 27 +++++++++++----------- tcp_internal.h | 2 +- tcp_vu.c | 5 ++-- udp.c | 49 +++++++++++++++++++++------------------ 18 files changed, 207 insertions(+), 61 deletions(-) -- 2.48.1

3 20

[PATCH] selinux: pasta accesses /etc/resolv.conf
by Cathy Hu 05 Aug '25

05 Aug '25

From: Cathy Hu <cathy.hu(a)suse.com> pasta accesses /etc/resolv.conf, which needs search permissions Adresses: ---- time->Fri Jul 25 15:57:16 2025 type=AVC msg=audit(1753451836.581:16831): avc: denied { search } for pid=44182 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 ---- time->Fri Jul 25 15:58:10 2025 type=AVC msg=audit(1753451890.317:17123): avc: denied { search } for pid=45022 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 ---- time->Fri Jul 25 16:01:53 2025 type=AVC msg=audit(1753452113.557:17289): avc: denied { search } for pid=45999 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0 --- contrib/selinux/pasta.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 9440d05..c0a1e9b 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -159,10 +159,11 @@ logging_send_syslog_msg(pasta_t) allow syslogd_t self:cap_userns sys_ptrace; allow pasta_t proc_net_t:file { open read }; -allow pasta_t net_conf_t:file { open read }; allow pasta_t self:netlink_route_socket { bind create nlmsg_read nlmsg_write setopt read write }; kernel_search_network_sysctl(pasta_t) +sysnet_read_config(pasta_t) + allow pasta_t tmp_t:sock_file { create unlink write }; allow pasta_t self:tcp_socket create_stream_socket_perms; @@ -221,7 +222,6 @@ allow pasta_t kernel_t:system module_request; allow pasta_t proc_t:dir mounton; allow pasta_t proc_t:filesystem mount; -allow pasta_t net_conf_t:lnk_file read; allow pasta_t proc_net_t:lnk_file read; allow pasta_t unconfined_t:process { noatsecure rlimitinh siginh }; -- 2.50.1

2 3

[RFC v2 00/11] Add vhost-net kernel support
by Eugenio Pérez 04 Aug '25

04 Aug '25

vhost-net is a kernel device that allows to read packets from a tap device using virtio queues instead of regular read(2) and write(2). This enables a more eficient packet processing, as the memory can be written directly by the kernel to the userspace and back, instead of wasting bandwith on copies, and it enables to batch many packets in a single notification (through eventfds) both tx and rx. Namespace tx performance improves from ~26.3Gbit/s to ~36.9Gbit/s. Namespace rx performance improves from ~16BGbit/s to ~17.26Gbit/s. RFC: At this moment only these are supported: * Receive l2 packets from the vhost kernel to pasta * Send l4 tcp socket received data through vhost-kernel to namespace. TODO: Add vhost zerocopy in the tests, and compare with veth. TODO: Implement at least UDP tx. Or maybe we want UDP to be write(2) because of latency? TODO: Check style for variable declarations in for loops and use of curly brackets as long as they wrap more than a line. TODO: kerneldoc style function header comments -- v2: Add TCP tx, and integrated some comments from the previous series. Please check each patch message for details. Eugenio Pérez (11): tap: implement vhost_call_cb tap: add die() on vhost error Replace tx tap hdr with virtio_nethdr_mrg_rxbuf tcp: export memory regions to vhost virtio: Fill .next in tx queue tap: move static iov_sock to tcp_buf_data_from_sock tap: support tx through vhost tap: add tap_free_old_xmit tcp: start conversion to circular buffer Add poll(2) to used_idx tcp_buf: adding TCP tx circular buffer arp.c | 2 +- epoll_type.h | 4 + passt.c | 12 +- passt.h | 11 +- tap.c | 489 +++++++++++++++++++++++++++++++++++++++++++++++++-- tap.h | 13 +- tcp.c | 2 +- tcp_buf.c | 179 +++++++++++++++---- tcp_buf.h | 19 ++ udp.c | 2 +- 10 files changed, 675 insertions(+), 58 deletions(-) -- 2.50.0

4 45