- dev - passt

[PATCH v4 0/3] Support for SO_PEEK_OFF socket option
by Jon Maloy 04 Jun '24

04 Jun '24

Latest changes based on feedback. Notably, removed fast retransmit when peer advertises zero-window. Jon Maloy (3): tcp: move seq_to_tap update to when frame is queued tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 149 ++++++++++++++++++++++++++++++++++++++++------------- tcp_conn.h | 2 + 2 files changed, 116 insertions(+), 35 deletions(-) -- 2.42.0

3 17

[PATCH v4 00/10] Add vhost-user support to passt (part 2)
by Laurent Vivier 03 Jun '24

03 Jun '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. v4: - remove "tcp: extract buffer management from tcp_conn_tap_mss()" as the MSS size can be the same between socket and vhost-user. - rename tcp_send_flag() and tcp_data_from_sock() to tcp_buf_send_flag() and tcp_buf_data_from_sock() v3: - add 3 new patches tap: use in->buf_size rather than sizeof(pkt_buf) tcp: remove tap_hdr parameter iov: remove iov_copy() v2: - compare to MODE_PASTA in conf_open_files() too - move taph out of udp_update_hdr4()/udp_update_hdr6() Laurent Vivier (10): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST iov: remove iov_copy() tcp: remove tap_hdr parameter tap: use in->buf_size rather than sizeof(pkt_buf) Makefile | 5 +- conf.c | 14 +- iov.c | 39 ---- iov.h | 3 - isolation.c | 10 +- passt.c | 4 +- tap.c | 119 +++++----- tap.h | 7 + tcp.c | 604 +++---------------------------------------------- tcp_buf.c | 536 +++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 16 ++ tcp_internal.h | 85 +++++++ udp.c | 68 +++--- udp.h | 2 +- 14 files changed, 792 insertions(+), 720 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

2 19

[PATCH v3 00/11] Add vhost-user support to passt (part 2)
by Laurent Vivier 31 May '24

31 May '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. v3: - add 3 new patches tap: use in->buf_size rather than sizeof(pkt_buf) tcp: remove tap_hdr parameter iov: remove iov_copy() v2: - compare to MODE_PASTA in conf_open_files() too - move taph out of udp_update_hdr4()/udp_update_hdr6() Laurent Vivier (11): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: extract buffer management from tcp_conn_tap_mss() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST iov: remove iov_copy() tcp: remove tap_hdr parameter tap: use in->buf_size rather than sizeof(pkt_buf) Makefile | 5 +- conf.c | 14 +- iov.c | 39 ---- iov.h | 3 - isolation.c | 10 +- passt.c | 4 +- tap.c | 119 +++++----- tap.h | 7 + tcp.c | 609 +++---------------------------------------------- tcp_buf.c | 553 ++++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 17 ++ tcp_internal.h | 77 +++++++ udp.c | 68 +++--- udp.h | 2 +- 14 files changed, 798 insertions(+), 729 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

2 12

[PATCH v7 0/3] Support for SO_PEEK_OFF
by Jon Maloy 31 May '24

31 May '24

v7: Only patch #3 updated. Jon Maloy (3): tcp: move seq_to_tap update to when frame is queued tcp: leverage support of SO_PEEK_OFF socket option when available tcp: allow retransmit when peer receive window is zero tcp.c | 164 +++++++++++++++++++++++++++++++++++++++-------------- tcp_conn.h | 2 + 2 files changed, 123 insertions(+), 43 deletions(-) -- 2.45.0

2 5

[PATCH v2 0/8] Add vhost-user support to passt (part 2)
by Laurent Vivier 28 May '24

28 May '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. v2: - compare to MODE_PASTA in conf_open_files() too - move taph out of udp_update_hdr4()/udp_update_hdr6() Laurent Vivier (8): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: extract buffer management from tcp_conn_tap_mss() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST Makefile | 5 +- conf.c | 14 +- isolation.c | 10 +- passt.c | 4 +- tap.c | 109 +++++---- tap.h | 7 + tcp.c | 603 +++---------------------------------------------- tcp_buf.c | 543 ++++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 17 ++ tcp_internal.h | 79 +++++++ udp.c | 68 +++--- udp.h | 2 +- 12 files changed, 786 insertions(+), 675 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

1 8

[PATCH 0/8] Add vhost-user support to passt (part 2)
by Laurent Vivier 27 May '24

27 May '24

Extract buffers management code from tcp.c and move it to tcp_buf.c tcp.c keeps all the generic code and will be also used by the vhost-user functions. Also compare mode to MODE_PASTA, as we will manage vhost-user mode (MODE_VU) like MODE_PASST. Laurent Vivier (8): tcp: inline tcp_l2_buf_fill_headers() tcp: extract buffer management from tcp_send_flag() tcp: extract buffer management from tcp_conn_tap_mss() tcp: move buffers management functions to their own file tap: export pool_flush()/tapX_handler()/packet_add() udp: move udpX_l2_buf_t and udpX_l2_mh_sock out of udp_update_hdrX() udp: rename udp_sock_handler() to udp_buf_sock_handler() vhost-user: compare mode MODE_PASTA and not MODE_PASST Makefile | 5 +- conf.c | 12 +- isolation.c | 10 +- passt.c | 4 +- tap.c | 109 +++++---- tap.h | 7 + tcp.c | 603 +++---------------------------------------------- tcp_buf.c | 543 ++++++++++++++++++++++++++++++++++++++++++++ tcp_buf.h | 17 ++ tcp_internal.h | 79 +++++++ udp.c | 72 +++--- udp.h | 2 +- 12 files changed, 787 insertions(+), 676 deletions(-) create mode 100644 tcp_buf.c create mode 100644 tcp_buf.h create mode 100644 tcp_internal.h -- 2.44.0

1 8

passt: new version 2024_05_23.765eb0b available
by Stefano Brivio 23 May '24

23 May '24

The new version with tag 2024_05_23.765eb0b includes the following changes: 765eb0b apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring 0608ec4 conf, passt.h: Rename pid_file in struct ctx to pidfile c9b2413 conf, passt, tap: Open socket and PID files before switching UID/GID ba23b05 passt, util: Move opening of PID file to its own function 57d8aa8 util: Rename write_pidfile() to pidfile_write() cbca08c tap: Split tap_sock_unix_init() into opening and listening parts fcfb592 passt, tap: Don't use -1 as uninitialised value for fd_tap_listen d02bb6c tap: Move all-ones initialisation of mac_guest to tap_sock_init() 45b8632 conf: Don't lecture user about starting us as root 3f917b3 netlink, test: Ignore deprecated addresses cc801fb tcp: Remove interim 'tapside' field from connection 8a2accb flow: Record the pifs for each side of each flow 4357185 flow: Make side 0 always be the initiating side 0060acd flow: Clarify and enforce flow state transitions a631998 inany: Better helpers for using inany and specific family addrs together 7a832a8 flow: Properly type callbacks to protocol specific handlers 1a20370 util, tcp: Add helper to display socket addresses 3ff3a8a apparmor: Fix passt abstraction 6cdc9fd apparmor: allow netns paths on /tmp 80f7ff2 clang-tidy: Suppress macro to enum conversion warnings 29bd08f conf: Fix clang-tidy warning about using an undefined enum value 26c71db passt.c: explicitly include libgen.h for basename 623c2fd netlink: Don't duplicate routes referring to unrelated host interfaces https://passt.top/passt/log/?qt=range&q=2024_05_10.7288448..2024_05_23.765e… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7482357/ permanent mirror: https://passt.top/builds/copr/0^20240523.g765eb0b/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g765eb0b-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_765eb0b-1_all.deb -- Stefano

1 0

[PATCH] apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring
by Stefano Brivio 23 May '24

23 May '24

Now: - we don't open the PID file in main() anymore - PID file and AF_UNIX socket are opened by pidfile_open() and tap_sock_unix_open() - write_pidfile() becomes pidfile_write() Reported-by: Richard W.M. Jones <rjones(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/apparmor/abstractions/pasta | 2 +- contrib/apparmor/usr.bin.passt | 9 ++++++--- contrib/apparmor/usr.bin.pasta | 9 ++++++--- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 581ad1b..9f73bee 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -27,7 +27,7 @@ @{PROC}/@{pid}/net/udp r, @{PROC}/@{pid}/net/udp6 r, - @{run}/user/@{uid}/** rw, # pasta_open_ns(), main() + @{run}/user/@{uid}/** rw, # pasta_open_ns() @{PROC}/[0-9]*/ns/ r, # pasta_netns_quit_init(), @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index 564f82f..9568189 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -19,9 +19,12 @@ profile passt /usr/bin/passt{,.avx2} { include <abstractions/passt> # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_init(), pcap(), - # write_pidfile(), + owner /tmp/** w, # tap_sock_unix_open(), + # tap_sock_unix_init(), pcap(), + # pidfile_open(), + # pidfile_write(), # logfile_init() - owner @{HOME}/** w, # pcap(), write_pidfile() + owner @{HOME}/** w, # pcap(), pidfile_open(), + # pidfile_write() } diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index bdfeb71..2483968 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -19,10 +19,13 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> # Alternatively: include <abstractions/user-tmp> - /tmp/** rw, # tap_sock_unix_init(), pcap(), - # write_pidfile(), + /tmp/** rw, # tap_sock_unix_open(), + # tap_sock_unix_init(), pcap(), + # pidfile_open(), + # pidfile_write(), # logfile_init(), # pasta_open_ns() - owner @{HOME}/** w, # pcap(), write_pidfile() + owner @{HOME}/** w, # pcap(), pidfile_open(), + # pidfile_write() } -- 2.43.0

2 1

[PATCH] netlink, test: Ignore deprecated addresses
by David Gibson 23 May '24

23 May '24

When we retrieve or copy host addresses we can include deprecated addresses, which is not what we want. Adjust our logic to exclude them. Similarly our tests can retrieve deprecated addresses, so exclude them there too. I hit this in practice because my router sometimes temporarily advertises an fd00:: prefix before the real delegated IPv6 prefix. The deprecated address can hang around for some time messing up my tests. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 5 +++-- test/passt/dhcp | 2 +- test/passt/ndp | 2 +- test/pasta/dhcp | 2 +- test/pasta/ndp | 2 +- test/two_guests/basic | 2 +- 6 files changed, 8 insertions(+), 7 deletions(-) diff --git a/netlink.c b/netlink.c index b1c0ccef..d3bea68c 100644 --- a/netlink.c +++ b/netlink.c @@ -696,7 +696,7 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, struct rtattr *rta; size_t na; - if (ifa->ifa_index != ifi) + if (ifa->ifa_index != ifi || ifa->ifa_flags & IFA_F_DEPRECATED) continue; for (rta = IFA_RTA(ifa), na = IFA_PAYLOAD(nh); RTA_OK(rta, na); @@ -833,7 +833,8 @@ int nl_addr_dup(int s_src, unsigned int ifi_src, ifa = (struct ifaddrmsg *)NLMSG_DATA(nh); if (rc < 0 || ifa->ifa_scope == RT_SCOPE_LINK || - ifa->ifa_index != ifi_src) + ifa->ifa_index != ifi_src || + ifa->ifa_flags & IFA_F_DEPRECATED) continue; ifa->ifa_index = ifi_dst; diff --git a/test/passt/dhcp b/test/passt/dhcp index 53ee641e..3ec2faf2 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -50,7 +50,7 @@ check [ "__SEARCH__" = "__HOST_SEARCH__" ] test DHCPv6: address guest /sbin/dhclient -6 __IFNAME__ gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/passt/ndp b/test/passt/ndp index 7b2dbfef..6bf8af30 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -23,7 +23,7 @@ check [ -n "__IFNAME__" ] test SLAAC: prefix gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local] | .[0]' gout PREFIX6 sipcalc __ADDR6__/64 | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/pasta/dhcp b/test/pasta/dhcp index 112633ab..41556b85 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -37,7 +37,7 @@ test DHCPv6: address ns /sbin/dhclient -6 --no-pid __IFNAME__ hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' check [ __ADDR6__ = __HOST_ADDR6__ ] test DHCPv6: route diff --git a/test/pasta/ndp b/test/pasta/ndp index 2a8afe62..d45ff7b8 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -23,7 +23,7 @@ sleep 2 test SLAAC: prefix nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local] | .[0]' nsout PREFIX6 sipcalc __ADDR6__/64 | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/two_guests/basic b/test/two_guests/basic index fa0608bc..4d49e851 100644 --- a/test/two_guests/basic +++ b/test/two_guests/basic @@ -41,7 +41,7 @@ guest1 /sbin/dhclient -6 __IFNAME1__ guest2 /sbin/dhclient -6 __IFNAME2__ g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' g2out ADDR2_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local] | .[0]' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global" and .deprecated != true).local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] check [ "__ADDR2_6__" = "__HOST_ADDR6__" ] -- 2.45.1

2 1

[PATCH 0/6] Final flow table preliminaries
by David Gibson 23 May '24

23 May '24

Here's a series of what I hope will be the last preliminaries for the flow table which can be applied before we take the cost of increasing the size of entries with generic address information. Changes since "Unified flow table v5": * Small fixes to state verification * New patch passing specific typed structures into deferred/timer callbacks * Terminology change from "forwarded side" to "target side" * Assorted wording and style tweaks based on Stefano's review David Gibson (6): flow: Properly type callbacks to protocol specific handlers inany: Better helpers for using inany and specific family addrs together flow: Clarify and enforce flow state transitions flow: Make side 0 always be the initiating side flow: Record the pifs for each side of each flow tcp: Remove interim 'tapside' field from connection flow.c | 209 ++++++++++++++++++++++++++++++++++----------------- flow.h | 118 +++++++++++++++++++++++++++-- flow_table.h | 10 +++ icmp.c | 18 ++--- icmp_flow.h | 2 +- inany.c | 17 +---- inany.h | 97 +++++++++++++++++++++++- pif.h | 1 - tcp.c | 68 ++++++++--------- tcp_conn.h | 7 +- tcp_splice.c | 25 +++--- 11 files changed, 417 insertions(+), 155 deletions(-) -- 2.45.1

2 7