- dev - passt

[net-next 0/2] tcp: add support for SO_PEEK_OFF socket option
by Jon Maloy 05 Apr '24

05 Apr '24

We add support for the SO_PEEK_OFF socket option as a new feature in TCP. In a separate patch, we fix a bug that was revealed while testing this feature. Jon Maloy (2): tcp: add support for SO_PEEK_OFF tcp: correct handling of extreme menory squeeze net/ipv4/af_inet.c | 1 + net/ipv4/tcp.c | 16 ++++++++++------ net/ipv4/tcp_output.c | 5 ++++- 3 files changed, 15 insertions(+), 7 deletions(-) -- 2.42.0

2 4

[PATCH v2 0/5] Sandbox test suite and enable podman tests on more hosts
by David Gibson 05 Apr '24

05 Apr '24

I noticed the podman tests weren't actually running on my Fedora host. This turns out to be because cataonit is not in the path on Fedora (it's in /usr/libexec). While attempting to get this working with my "test in a box" script I ran into some additional problems: the podman tests downloaded and built podman, which requires external network access. That doesn't work in an isolated network environment. Changes since v1: * Test that podman is using the correct pasta binary * Added patch to prevent make cppcheck from checking the downloaded podman source as well. David Gibson (5): cppcheck: Explicitly give files to check test: Make sure to update mbuto repository test: Build and download podman as a test asset test: catatonit may not be in $PATH test: Verify that podman tests are using the pasta binary we expect Makefile | 2 +- seccomp.sh | 4 ++-- test/.gitignore | 1 + test/Makefile | 20 +++++++++++++++++--- test/pasta_podman/bats | 15 ++++++++++----- 5 files changed, 31 insertions(+), 11 deletions(-) -- 2.44.0

2 6

[PATCH 0/2] Follow up improvements to external interface selection
by David Gibson 05 Apr '24

05 Apr '24

We just had several rapid passt/pasta releases which last minute fixes for the podman 5.0 release. One of these was to correct pasta's selection of which host interface to use. Here are a couple of less urgent follow ups to improve that logic. David Gibson (2): util: Add helper to return name of address family netlink: Ignore routes to link-local addresses for selecting interface ip.h | 9 +++++++++ netlink.c | 19 ++++++++++++++++--- util.h | 18 ++++++++++++++++++ 3 files changed, 43 insertions(+), 3 deletions(-) -- 2.44.0

2 3

[PATCH v2] netlink: Adjust interface index inside copied nexthop objects too
by Stefano Brivio 05 Apr '24

05 Apr '24

As pasta duplicates host routes into the target namespaces, interface indices might not match, so we go through RTA_OIF attributes and fix them up to match the identifier in the namespace. But RTA_OIF is not the ony attribute specifying interfaces for routes: multipath routes use RTA_MULTIPATH attributes with nexthop objects, which contain in turn interface indices. Fix them up as well. If we don't, and we have at least two host interfaces, and the host interface we use as template isn't the first one (hence the mismatching indices), we'll fail to insert multipath routes with nexthop objects, and ultimately refuse to start as the kernel unexpectedly gives us ENODEV. Link: https://github.com/containers/podman/issues/22192 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: s/interfaces/interface/ in comment netlink.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/netlink.c b/netlink.c index 9b3dba2..59e9e33 100644 --- a/netlink.c +++ b/netlink.c @@ -546,12 +546,19 @@ int nl_route_dup(int s_src, unsigned int ifi_src, for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { + /* RTA_OIF and RTA_MULTIPATH attributes carry the + * identifier of a host interface. Change them to match + * the corresponding identifier in the target namespace. + */ if (rta->rta_type == RTA_OIF) { - /* The host obviously list's the host interface - * id here, we need to change it to the - * namespace's interface id - */ *(unsigned int *)RTA_DATA(rta) = ifi_dst; + } else if (rta->rta_type == RTA_MULTIPATH) { + struct rtnexthop *rtnh; + + for (rtnh = (struct rtnexthop *)RTA_DATA(rta); + RTNH_OK(rtnh, RTA_PAYLOAD(rta)); + rtnh = RTNH_NEXT(rtnh)) + rtnh->rtnh_ifindex = ifi_dst; } else if (rta->rta_type == RTA_PREFSRC) { /* Host routes might include a preferred source * address, which must be one of the host's -- 2.43.0

2 1

[PATCH] netlink: Adjust interface index inside copied nexthop objects too
by Stefano Brivio 04 Apr '24

04 Apr '24

As pasta duplicates host routes into the target namespaces, interface indices might not match, so we go through RTA_OIF attributes and fix them up to match the identifier in the namespace. But RTA_OIF is not the ony attribute specifying interfaces for routes: multipath routes use RTA_MULTIPATH attributes with nexthop objects, which contain in turn interface indices. Fix them up as well. If we don't, and we have at least two host interfaces, and the host interface we use as template isn't the first one (hence the mismatching indices), we'll fail to insert multipath routes with nexthop objects, and ultimately refuse to start as the kernel unexpectedly gives us ENODEV. Link: https://github.com/containers/podman/issues/22192 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/netlink.c b/netlink.c index 9b3dba2..407bf71 100644 --- a/netlink.c +++ b/netlink.c @@ -546,12 +546,19 @@ int nl_route_dup(int s_src, unsigned int ifi_src, for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { + /* RTA_OIF and RTA_MULTIPATH attributes carry the + * identifier of a host interfaces. Change them to match + * the corresponding identifier in the target namespace. + */ if (rta->rta_type == RTA_OIF) { - /* The host obviously list's the host interface - * id here, we need to change it to the - * namespace's interface id - */ *(unsigned int *)RTA_DATA(rta) = ifi_dst; + } else if (rta->rta_type == RTA_MULTIPATH) { + struct rtnexthop *rtnh; + + for (rtnh = (struct rtnexthop *)RTA_DATA(rta); + RTNH_OK(rtnh, RTA_PAYLOAD(rta)); + rtnh = RTNH_NEXT(rtnh)) + rtnh->rtnh_ifindex = ifi_dst; } else if (rta->rta_type == RTA_PREFSRC) { /* Host routes might include a preferred source * address, which must be one of the host's -- 2.43.0

1 0

[PATCH] README.md: Alpine, Guix and OpenSUSE now have packages for passt
by Stefano Brivio 04 Apr '24

04 Apr '24

Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 9154425..aa2afac 100644 --- a/README.md +++ b/README.md @@ -342,16 +342,18 @@ speeding up local connections, and usually requiring NAT. _pasta_: ### Availability * official packages for: + * ✅ [Alpine Linux](https://pkgs.alpinelinux.org/packages?name=passt) * ✅ [Arch Linux](https://archlinux.org/packages/extra/x86_64/passt/) ([aarch64](https://archlinuxarm.org/packages/aarch64/passt), [i486](https://www.archlinux32.org/packages/?q=passt)) * ✅ [CentOS Stream](https://gitlab.com/redhat/centos-stream/rpms/passt) * ✅ [Debian](https://tracker.debian.org/pkg/passt) * ✅ [Fedora](https://src.fedoraproject.org/rpms/passt) * ✅ [Gentoo](https://packages.gentoo.org/packages/net-misc/passt) + * ✅ [GNU Guix](https://packages.guix.gnu.org/packages/passt/) + * ✅ [OpenSUSE](https://build.opensuse.org/package/requests/Virtualization:contai… * ✅ [Ubuntu](https://launchpad.net/ubuntu/+source/passt) * ✅ [Void Linux](https://voidlinux.org/packages/?q=passt) * unofficial packages for: * ✅ [EPEL, Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) - * 🛠 [openSUSE](https://build.opensuse.org/package/show/Virtualization:containers… * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 static builds for other RPM-based distributions * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 -- 2.43.0

2 1

[PATCH 0/3] Assorted AppArmor policy fixes for passt and pasta
by Stefano Brivio 03 Apr '24

03 Apr '24

Related to: https://github.com/containers/buildah/issues/5440 https://bugzilla.suse.com/show_bug.cgi?id=1221840 Danish Prakash (1): apparmor: Fix access to procfs namespace entries in pasta's abstraction Stefano Brivio (2): apparmor: Add mount rule with explicit, empty source in passt abstraction apparmor: Expand scope of @{run}/user access, allow writing PID files too contrib/apparmor/abstractions/passt | 1 + contrib/apparmor/abstractions/pasta | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) -- 2.43.0

1 3

passt: new version 2024_03_26.4988e2b available
by Stefano Brivio 26 Mar '24

26 Mar '24

The new version with tag 2024_03_26.4988e2b includes the following changes: 4988e2b tcp: Unconditionally force ACK for all !SYN, !RST packets 5894a24 tcp: Never automatically add the ACK flag to RST packets 16c2d8d tcp: Rearrange logic for setting ACK flag in tcp_send_flag() 99355e2 tcp: Split handling of DUP_ACK from ACK https://passt.top/passt/log/?qt=range&q=2024_03_20.71dd405..2024_03_26.4988… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7215825/ permanent mirror: https://passt.top/builds/copr/0^20240320.g71dd405/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc2acf02-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c2acf02-1_all.deb -- Stefano

1 0

[PATCH 0/4] Corrections to seeting of ACK flag in TCP packets
by David Gibson 26 Mar '24

26 Mar '24

A recently reported podman bug shows transfer failures in podman custom rootless networks connected with pasta. Analysis suggests this is triggered by pasta generating a TCP packet without the ACK flag when it should have one. The exact symptoms seem to arise because of some odd kernel behaviour - rather than simply ignoring the packet, an RST is observed killing the connection. However, there are also packets seen after the RST which don't seem to make sense. While there are some mysteries which we still hope to track down here, in the meantime it definitely seems like pasta's ACK behaviour isn't correct, and appears to trigger the other problems. So, fix it. Link: https://github.com/containers/podman/issues/22146 Link: https://bugs.passt.top/show_bug.cgi?id=84 David Gibson (4): tcp: Split handling of DUP_ACK from ACK tcp: Rearrange logic for setting ACK flag in tcp_send_flag() tcp: Never automatically add the ACK flag to RST packets tcp: Unconditionally force ACK for all !SYN, !RST packets tcp.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) -- 2.44.0

2 5

[PATCH] RFC: Sandbox testsuite in a specified network environment
by David Gibson 22 Mar '24

22 Mar '24

Currently our testsuite runs passt and pasta directly on the host machine. This means that the "host" network environment that passt/pasta uses is that of the host. However passt and the tests in particular have a number of assumptions and requirements about that environment that may not always be the case. In particular we require both IPv4 and IPv6 default routes to be available, and on the same external interface. This makes the testsuite quite fragile. Instead, alter our test scripts so that we run all the tests inside a namespace where we configure a specific environment that's suitable for them. This does, in a sense, reduce test coverage, because everyone is now testing the same network environment rather than different onces. This is probably preferable to the current case, though, where people avoid running the testsuite entirely because it doesn't work on their setup. FIXME: currently disables podman tests, because they require some external access that doesn't work in the sandbox Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/lib/sandbox | 121 +++++++++++++++++++++++++++++++++++++++++++++++ test/lib/term | 6 +-- test/run | 7 +-- 3 files changed, 128 insertions(+), 6 deletions(-) create mode 100644 test/lib/sandbox As noted, this isn't ready to merge, because it breaks the podman tests. However, Jon, Laurent and anyone else who's had trouble getting the testsuite running, I'd appreciate if you can try this and see how it works. diff --git a/test/lib/sandbox b/test/lib/sandbox new file mode 100644 index 00000000..d70c4ca5 --- /dev/null +++ b/test/lib/sandbox @@ -0,0 +1,121 @@ +#!/bin/sh +# +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# test/lib/sandbox - Run test programs in an isolated, controlled network environment +# +# Copyright Red Hat +# Author: David Gibson <david(a)gibson.dropbear.id.au> + +# DOC: Theory of Operation +# +# We want to run our tests in an isolated network environment so that: +# * Bugs can't affect things beyond the test +# * We have a known environment, independent of the host's network +# configuration +# +# To do this, we set up 3 namespaces with nstool: +# +# SANDBOX - Parent namespace to isolate us from the host +# This has no network, it's just for isolation, and to create the +# other namespaces. +# +# SIMHOST - Namespace representing the host for passt/pasta tests +# This is a network namespace representing the host where we run +# passt or pasta. It has a simple network configuration with both +# IPv4 and IPv6 over a default route to ROUTER. +# +# ROUTER - Namespace representing SIMHOST's default router +# This is a network namespace representing SIMHOST's router, and in +# a sense, all hosts external to SIMHOST. It acts as default +# gateway for SIMHOST on both IPv4 and IPv6. + +SANDBOX_CTL=sandbox.nstool +SANDBOX_CTL_HOST=sandbox-host.nstool +SANDBOX_CTL_ROUTER=sandbox-router.nstool + +SANDBOX_IP4_BCAST=192.0.2.255 +SANDBOX_IP4_MASK=24 +SANDBOX_IP4_PREFIX=192.0.2.0/$IP4_MASK +SANDBOX_IP4_HOST=192.0.2.1 +SANDBOX_IP4_ROUTER=192.0.2.2 + +SANDBOX_IP6_MASK=64 +SANDBOX_IP6_PREFIX=2001:db8:9a55::/$IP6_MASK +SANDBOX_IP6_HOST=2001:db8:9a55::1 +SANDBOX_IP6_ROUTER=2001:db8:9a55::2 + +sandbox_cleanup() { + ${NSTOOL} stop "${SANDBOX_CTL_HOST}" + ${NSTOOL} stop "${SANDBOX_CTL_ROUTER}" + ${NSTOOL} stop "${SANDBOX_CTL}" + rm -f "${SANDBOX_CTL}" "${SANDBOX_CTL_HOST}" "${SANDBOX_CTL_ROUTER}" +} + +# Run command in SANDBOX with privilege +sb_priv() { + ${NSTOOL} exec --keep-caps "${SANDBOX_CTL}" -- "$@" +} + +# Run command in SIMHOST ns with privilege +sb_priv_host() { + ${NSTOOL} exec --keep-caps "${SANDBOX_CTL_HOST}" -- "$@" +} + +# Run command in SIMHOST without privilege +sb_uhost() { + ${NSTOOL} exec "${SANDBOX_CTL_HOST}" -- "$@" +} + +# Run command in ROUTER with privilege +sb_priv_router() { + ${NSTOOL} exec --keep-caps "${SANDBOX_CTL_ROUTER}" -- "$@" +} + +sandbox() { + trap "sandbox_cleanup" EXIT + + # Create SANDBOX + unshare -Ucnpfm --mount-proc $NSTOOL hold "${SANDBOX_CTL}" & + $NSTOOL info -w "${SANDBOX_CTL}" >/dev/null + + # Create SIMHOST + sb_priv unshare -n ${NSTOOL} hold "${SANDBOX_CTL_HOST}" & + local host_rel_pid=$(${NSTOOL} exec "${SANDBOX_CTL}" -- ${NSTOOL} info -pw "${SANDBOX_CTL_HOST}") + + # Create ROUTER + sb_priv unshare -n ${NSTOOL} hold "${SANDBOX_CTL_ROUTER}" & + local router_rel_pid=$(${NSTOOL} exec "${SANDBOX_CTL}" -- ${NSTOOL} info -pw "${SANDBOX_CTL_ROUTER}") + + # Create veth between SIMHOST and ROUTER + sb_priv ip link add type veth + sb_priv ip link set veth0 netns $host_rel_pid + sb_priv ip link set veth1 netns $router_rel_pid + + # Configure network in ROUTER + sb_priv_router ip link set lo up + sb_priv_router ip -4 addr add $SANDBOX_IP4_ROUTER/$SANDBOX_IP4_MASK dev veth1 + sb_priv_router ip -6 addr add $SANDBOX_IP6_ROUTER/$SANDBOX_IP6_MASK dev veth1 + sb_priv_router ip link set veth1 up + + # Configure network in SIMHOST + sb_priv_host ip link set lo up + sb_priv_host ip -4 addr add $SANDBOX_IP4_HOST/$SANDBOX_IP4_MASK dev veth0 + sb_priv_host ip -6 addr add $SANDBOX_IP6_HOST/$SANDBOX_IP6_MASK dev veth0 + sb_priv_host ip link set veth0 up + + # Configure SIMHOST's default gateway as ROUTER + sleep 2 # Wait for SLAAC + local ip6_ll_router=$(sb_priv_router ip -6 -j addr | jq -r '.[] | select(.ifname == "veth1") | .addr_info | .[] | select(.scope == "link") | .local') + + sb_priv_host ip -4 route add default via $SANDBOX_IP4_ROUTER + sb_priv_host ip -6 route add default via $ip6_ll_router dev veth0 + + sb_uhost "$@" +} diff --git a/test/lib/term b/test/lib/term index 262937eb..9e2fbbd6 100755 --- a/test/lib/term +++ b/test/lib/term @@ -669,14 +669,14 @@ run_term() { if [ ${CI} -eq 1 ]; then printf '\e[8;50;240t' - asciinema rec --overwrite "${STATEBASE}/ci.uncut" -c "$TMUX /bin/sh -c './ci from_term'" + sandbox asciinema rec --overwrite "${STATEBASE}/ci.uncut" -c "$TMUX /bin/sh -c './ci from_term'" video_postprocess "${STATEBASE}/ci.uncut" elif [ ${DEMO} -eq 1 ]; then printf '\e[8;40;130t' - asciinema rec --overwrite "${STATEBASE}/demo.uncut" -c "$TMUX /bin/sh -c './run_demo from_term'" + sandbox asciinema rec --overwrite "${STATEBASE}/demo.uncut" -c "$TMUX /bin/sh -c './run_demo from_term'" video_postprocess "${STATEBASE}/demo.uncut" else - $TMUX /bin/sh -c "./run from_term ${*}" + sandbox $TMUX /bin/sh -c "./run from_term ${*}" fi } diff --git a/test/run b/test/run index 3b376639..a278e23a 100755 --- a/test/run +++ b/test/run @@ -44,6 +44,7 @@ COMMIT="$(git log --oneline --no-decorate -1)" . lib/context . lib/setup . lib/setup_ugly +. lib/sandbox . lib/term . lib/perf_report . lib/layout @@ -82,9 +83,9 @@ run() { test pasta_options/log_to_file teardown pasta_options - setup build - test pasta_podman/bats - teardown build + #setup build + #test pasta_podman/bats + #teardown build setup memory test memory/passt -- 2.44.0

1 0