- dev - passt

[PATCH] pasta: Strip RTA_PREFSRC when copying routes to the namespace
by David Gibson 23 Aug '23

23 Aug '23

Host routes can include a preferred source address (RTA_PREFSRC), which must be one of the host's addresses. However when using pasta with -a the namespace might be given a different address, not on the host. This seems to occur pretty routinely depending on the network configuration systems in place on the host. With --config-net we will try to copy host routes to the namespace. If one of those includes an RTA_PREFSRC, but the namespace doesn't have the host address, this will fail with -EINVAL, causing pasta to fail. Fix this by stripping off RTA_PREFSRC attributes from routes as we copy them to the namespace. This is by no means infallible, bit it should at least handle common cases for the time being. Link: https://bugs.passt.top/show_bug.cgi?id=71 Link: https://github.com/containers/podman/pull/19699#issuecomment-1688769287 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- netlink.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/netlink.c b/netlink.c index f55f2c3..98f08e7 100644 --- a/netlink.c +++ b/netlink.c @@ -462,8 +462,21 @@ int nl_route_dup(int s_src, unsigned int ifi_src, for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { - if (rta->rta_type == RTA_OIF) + if (rta->rta_type == RTA_OIF) { + /* The host obviously list's the host interface + * id here, we need to change it to the + * namespace's interface id + */ *(unsigned int *)RTA_DATA(rta) = ifi_dst; + } else if (rta->rta_type == RTA_PREFSRC) { + /* Host routes might include a preferred source + * address, which must be one of the host's + * addresses. However, with -a pasta will use a + * different namespace address, making such a + * route invalid in the namespace. Strip off + * RTA_PREFSRC attributes to avoid that. */ + rta->rta_type = RTA_UNSPEC; + } } } -- 2.41.0

2 1

[PATCH] test: Add Podman system test with bats for pasta
by Stefano Brivio 23 Aug '23

23 Aug '23

Ugly as hell, but we keep breaking things otherwise, and I keep forgetting to run this manually (as long as it's based on my local Podman setup, that's the only alternative). We need to clone the Podman repository as distribution packages don't contain test scripts, typically. While at it, build the latest version which is what really matters. As we're planning anyway to revamp the test framework, I'd be inclined to just add this without too many thoughts, and have it as a nice-to-have requirement reminder for the new framework. Link: https://github.com/containers/podman/pull/19699 Suggested-by: Paul Holzinger <pholzing(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/README.md | 4 ++-- test/pasta_podman/bats | 22 ++++++++++++++++++++++ test/run | 4 ++++ 3 files changed, 28 insertions(+), 2 deletions(-) create mode 100644 test/pasta_podman/bats diff --git a/test/README.md b/test/README.md index 03c7f57..0936b04 100644 --- a/test/README.md +++ b/test/README.md @@ -28,8 +28,8 @@ on a system, i.e. common utilities such as a shell are not included here. Example for Debian, and possibly most Debian-based distributions: - build-essential git jq strace iperf3 qemu-system-x86 tmux sipcalc bc - clang-tidy cppcheck isc-dhcp-common psmisc linux-cpupower socat + build-essential git jq strace iperf3 qemu-system-x86 tmux sipcalc bats bc + catatonit clang-tidy cppcheck go isc-dhcp-common psmisc linux-cpupower socat netcat-openbsd fakeroot lz4 lm-sensors qemu-system-arm qemu-system-ppc qemu-system-misc qemu-system-x86 valgrind diff --git a/test/pasta_podman/bats b/test/pasta_podman/bats new file mode 100644 index 0000000..f36da7c --- /dev/null +++ b/test/pasta_podman/bats @@ -0,0 +1,22 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/pasta_podman/bats - Build Podman, run pasta system test with bats +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio <sbrivio(a)redhat.com> + +htools git make go bats catatonit ip jq socat + +test Podman system test with bats + +host git -C __STATEDIR__ clone https://github.com/containers/podman.git +host make -C __STATEDIR__/podman +hout WD pwd +host printf "[engine]\nhelper_binaries_dir=['__WD__']\n" > __STATEDIR__/containers.conf +host PODMAN="__STATEDIR__/podman/bin/podman" CONTAINERS_CONF_OVERRIDE="__STATEDIR__/containers.conf" bats __STATEDIR__/podman/test/system/505-networking-pasta.bats diff --git a/test/run b/test/run index 8f4f845..3b37663 100755 --- a/test/run +++ b/test/run @@ -82,6 +82,10 @@ run() { test pasta_options/log_to_file teardown pasta_options + setup build + test pasta_podman/bats + teardown build + setup memory test memory/passt teardown memory -- 2.39.2

2 2

[PATCH] netlink: Set IFA_ADDRESS, not just IFA_LOCAL, while adding IPv4 addresses
by Stefano Brivio 23 Aug '23

23 Aug '23

Otherwise, we actually configure the address, but it's not usable because no local route is added by the kernel. Link: https://github.com/containers/podman/pull/19699 Fixes: cfe7509e5c16 ("netlink: Use struct in_addr for IPv4 addresses, not bare uint32_t") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 1 + 1 file changed, 1 insertion(+) diff --git a/netlink.c b/netlink.c index f55f2c3..7e9caf4 100644 --- a/netlink.c +++ b/netlink.c @@ -629,6 +629,7 @@ int nl_addr_set(int s, unsigned int ifi, sa_family_t af, memcpy(&req.set.a4.l, addr, sizeof(req.set.a4.l)); req.set.a4.rta_l.rta_len = rta_len; req.set.a4.rta_l.rta_type = IFA_LOCAL; + memcpy(&req.set.a4.a, addr, sizeof(req.set.a4.a)); req.set.a4.rta_a.rta_len = rta_len; req.set.a4.rta_a.rta_type = IFA_ADDRESS; } -- 2.39.2

1 0

[PATCH v4 0/9] Flow Table Preliminaries
by David Gibson 22 Aug '23

22 Aug '23

I'm still working on bunch of things to start implementing the generalised flow table. However, I think this set of preliminary clean ups and fixes stand well enough on their own that they're ready for merge now. Sorry for the quick resend, noticed a dumb error in the last patch. Changes since v3: * Remove the now unused tcp.splice_conn_count Changes since v2: * Fix a formatting error in the in_epoll patch * Add patch for inany.h include guards * Add patch to remove broken pressure estimates for tcp_defer_handler() Changes since v1: * Add missing patch moving in_epoll flag David Gibson (9): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp: Consistent usage of ports in tcp_seq_init() tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers tcp: Move in_epoll flag out of common connection structure inany: Add missing double include guard to inany.h tcp: Remove broken pressure calculations for tcp_defer_handler() icmp.c | 12 ++- icmp.h | 3 +- inany.h | 5 ++ passt.c | 10 +-- passt.h | 4 +- pasta.c | 2 +- tap.c | 29 ++++---- tcp.c | 203 ++++++++++++++++++++++----------------------------- tcp.h | 7 +- tcp_conn.h | 18 +++-- tcp_splice.c | 6 +- udp.c | 37 ++++------ udp.h | 5 +- util.h | 4 +- 14 files changed, 156 insertions(+), 189 deletions(-) -- 2.41.0

2 13

[PATCH v3 0/9] Flow Table Preliminaries
by David Gibson 22 Aug '23

22 Aug '23

I'm still working on bunch of things to start implementing the generalised flow table. However, I think this set of preliminary clean ups and fixes stand well enough on their own that they're ready for merge now. Changes since v2: * Fix a formatting error in the in_epoll patch * Add patch for inany.h include guards * Add patch to remove broken pressure estimates for tcp_defer_handler() Changes since v1: * Add missing patch moving in_epoll flag David Gibson (9): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp: Consistent usage of ports in tcp_seq_init() tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers tcp: Move in_epoll flag out of common connection structure inany: Add missing double include guard to inany.h tcp: Remove broken pressure calculations for tcp_defer_handler() icmp.c | 12 ++- icmp.h | 3 +- inany.h | 5 ++ passt.c | 10 +-- passt.h | 4 +- pasta.c | 2 +- tap.c | 29 ++++---- tcp.c | 203 ++++++++++++++++++++++----------------------------- tcp.h | 5 +- tcp_conn.h | 18 +++-- tcp_splice.c | 4 +- udp.c | 37 ++++------ udp.h | 5 +- util.h | 4 +- 14 files changed, 156 insertions(+), 185 deletions(-) -- 2.41.0

1 9

passt: new version 2023_08_18.0af928e available
by Stefano Brivio 20 Aug '23

20 Aug '23

The new version with tag 2023_08_18.0af928e includes the following changes: 0af928e selinux: Fix domain transitions for typical commands pasta might run 30817fd selinux: Allow pasta_t to read nsfs entries 9776521 selinux: Add rules for sysctl and /proc/net accesses 56b8633 selinux: Update policy to fix user/group settings 6205905 selinux: Fix user namespace creation after breaking kernel change 0c42326 selinux: Use explicit paths for binaries in file context 479a9e1 fedora: Install pasta as hard link to ensure SELinux file context match 5f1fcff tap: Fix format specifier in tap4_is_fragment() warning da0aeb9 netlink: Don't propagate host address expiry to the container b4f8ffd netlink: Correctly calculate attribute length for address messages 4b9f4c2 netlink: Remove redundant check on nlmsg_type 5ed4e03 conf: Demote overlapping port ranges error to a warning ae5f6c8 epoll: Use different epoll types for passt and pasta tap fds eda4f19 epoll: Split listening Unix domain socket into its own type 485b5fb epoll: Split handling of listening TCP sockets into their own handler e6f81e5 epoll: Split handling of TCP timerfds into its own handler function 8271a2e epoll: Tiny cleanup to udp_sock_handler() 05f606a epoll: Split handling of ICMP and ICMPv6 sockets d850caa epoll: Fold sock_handler into general switch on epoll event fd 6a6735e epoll: Always use epoll_ref for the epoll data variable 3401644 epoll: Generalize epoll_ref to cover things other than sockets e26282b tap: Fold reset handling into tap_handler_passt() 0d870c5 tap: Fold reset handling into tap_handler_pasta() 548e05f tap: Clean up behaviour for errors on listening Unix socket 28877b0 tap: Clean up tap reset path b2bea00 tap: fix seq->p.count limit 02b30e7 netlink: Propagate errors for "dup" operations 5103811 netlink: Propagate errors for "dump" operations 4d6e9d0 netlink: Always process all responses to a netlink request 8de9805 netlink: Propagate errors for "set" operations a309318 netlink: Add nl_foreach_oftype to filter response message types 99ddd7c netlink: Split nl_req() to allow processing multiple response datagrams 8ec757d netlink: Clearer reasoning about the netlink response buffer size 9d4ab98 netlink: Add nl_do() helper for simple operations with error checking 282581b netlink: Fill in netlink header fields from nl_req() f62600b netlink: Treat send() or recv() errors as fatal 0a568c8 netlink: Start sequence number from 1 instead of 0 dee7594 netlink: Make nl_*_dup() use a separate datagram for each request 576df71 netlink: Explicitly pass netlink sockets to operations cfe7509 netlink: Use struct in_addr for IPv4 addresses, not bare uint32_t 257a6b0 netlink: Split nl_route() into separate operation functions eff3bcb netlink: Split nl_addr() into separate operation functions e96182e netlink: Split up functionality of nl_link() 0cf7bf3 tap: Remove unnecessary global tun_ns_fd 7bc9b66 tap: More detailed error reporting in tap_ns_tun() 6920add util: Make ns_enter() a void function and report setns() errors b15ce5b Use static assertion to verify that union epoll_ref is the right size 8218d99 Use C11 anonymous members to make poll refs less verbose to use 649068a Allow C11 code, not just C99 code 023d684 Revert "MAKE: Fix parallel builds; .o files; .gitignore; new makedocs" cc2a6be MAKE: Fix parallel builds; .o files; .gitignore; new makedocs e01759e tap: Explicitly drop IPv4 fragments, and give a warning 4c98d3b conf: Correct length checking of interface names in conf_ports() c4017cc conf: Fix size checking of -I interface name https://passt.top/passt/log/?qt=range&q=2023_06_27.289301b..2023_08_18.0af9… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6317140/ permanent mirror: https://passt.top/builds/copr/0^20230818.g0af928e/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g0af928e-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0af928e-1_all.deb -- Stefano

1 0

[PATCH v2 0/7] Extensive bandaging for SELinux policy issues, old and new
by Stefano Brivio 17 Aug '23

17 Aug '23

The most important fix here is actually the one that allows pasta and passt to create user namespaces (and hence, to start -- we need that for sandboxing) with recent kernels on e.g. Fedora Rawhide -- that's patch 3/7. But there are a number of other issues, some old, some new, that would currently prevent pasta from e.g. starting a shell, or simply run 'ip address show', again at least on Fedora Rawhide. Fix them. v2: Actually override pasta symlinks with hard links in 1/7 Stefano Brivio (7): fedora: Install pasta as hard link to ensure SELinux file context match selinux: Use explicit paths for binaries in file context selinux: Fix user namespace creation after breaking kernel change selinux: Update policy to fix user/group settings selinux: Add rules for sysctl and /proc/net accesses selinux: Allow pasta_t to read nsfs entries selinux: Fix domain transitions for typical commands pasta might run contrib/fedora/passt.spec | 7 +++++++ contrib/selinux/passt.fc | 3 ++- contrib/selinux/passt.te | 10 ++++++++-- contrib/selinux/pasta.fc | 3 ++- contrib/selinux/pasta.te | 33 ++++++++++++++++++++++++++++++--- 5 files changed, 49 insertions(+), 7 deletions(-) -- 2.39.2

2 9

[PATCH v2 0/7] Flow Table Preliminaries
by David Gibson 17 Aug '23

17 Aug '23

I'm still working on bunch of things to start implementing the generalised flow table. However, I think this set of preliminary clean ups and fixes stand well enough on their own that they're ready for merge now. Based on the epoll patch series. Changes since v1: * Add missing patch moving in_epoll flag David Gibson (7): tap: Don't clobber source address in tap6_handler() tap: Pass source address to protocol handler functions tcp: More precise terms for addresses and ports tcp: Consistent usage of ports in tcp_seq_init() tcp, udp: Don't include destination address in partially precomputed csums tcp, udp: Don't pre-fill IPv4 destination address in headers tcp: Move in_epoll flag out of common connection structure icmp.c | 12 ++-- icmp.h | 3 +- passt.c | 10 ++- passt.h | 4 +- pasta.c | 2 +- tap.c | 29 ++++---- tcp.c | 194 +++++++++++++++++++++++---------------------------- tcp.h | 5 +- tcp_conn.h | 18 ++--- tcp_splice.c | 4 +- udp.c | 37 ++++------ udp.h | 5 +- util.h | 4 +- 13 files changed, 151 insertions(+), 176 deletions(-) -- 2.41.0

1 8

[PATCH 0/3] pasta: Don't propagate host address lifetimes to the container
by David Gibson 16 Aug '23

16 Aug '23

We realized in yesterday's call that podman issue 19405 could be explained by the fact that along with other attributes we're copying the lifetime of host addresses to the container. Here is a fix for that bug, along with a couple of other small fixes to the netlink code I noticed as I was making it. Link: https://github.com/containers/podman/issues/19405 Link: https://bugs.passt.top/show_bug.cgi?id=70 David Gibson (3): netlink: Remove redundant check on nlmsg_type netlink: Correctly calculate attribute length for address messages netlink: Don't propagate host address expiry to the container netlink.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) -- 2.41.0

2 4

[PATCH 0/7] Extensive bandaging for SELinux policy issues, old and new
by Stefano Brivio 16 Aug '23

16 Aug '23

The most important fix here is actually the one that allows pasta and passt to create user namespaces (and hence, to start -- we need that for sandboxing) with recent kernels on e.g. Fedora Rawhide -- that's patch 3/7. But there are a number of other issues, some old, some new, that would currently prevent pasta from e.g. starting a shell, or simply run 'ip address show', again at least on Fedora Rawhide. Fix them. Stefano Brivio (7): fedora: Install pasta as hard link to ensure SELinux file context match selinux: Use explicit paths for binaries in file context selinux: Fix user namespace creation after breaking kernel change selinux: Update policy to fix user/group settings selinux: Add rules for sysctl and /proc/net accesses selinux: Allow pasta_t to read nsfs entries selinux: Fix domain transitions for typical commands pasta might run contrib/fedora/passt.spec | 4 ++++ contrib/selinux/passt.fc | 3 ++- contrib/selinux/passt.te | 10 ++++++++-- contrib/selinux/pasta.fc | 3 ++- contrib/selinux/pasta.te | 33 ++++++++++++++++++++++++++++++--- 5 files changed, 46 insertions(+), 7 deletions(-) -- 2.39.2

2 15

2025

2024

2023

2022

2021

dev