- dev - passt

[PATCH 0/3] Add vhost-net kernel support
by Eugenio Pérez 03 Apr '25

03 Apr '25

vhost-net is a kernel device that allows to read packets from a tap device using virtio queues instead of regular read(2) and write(2). This enables a more eficient packet processing, as the memory can be written directly by the kernel to the userspace and back, instead of wasting bandwith on copies, and it enables to batch many packets in a single notification (through eventfds) both tx and rx. --- RFC: At this moment only to receive packets from the vhost kernel to the pasta binary is supported. It does not even support to refill more rx descriptors so the kernel can keep receiving packets! Just for early review to make sure we're on the same page. Eugenio Pérez (3): tap: specify the packet pool tap: implement vhost_call_cb tap: add die() on vhost error epoll_type.h | 4 + passt.c | 8 ++ passt.h | 13 +- tap.c | 366 +++++++++++++++++++++++++++++++++++++++++++++++++-- tap.h | 6 +- vu_common.c | 7 +- 6 files changed, 387 insertions(+), 17 deletions(-) -- 2.49.0

4 12

[PATCH 0/3] udp: Further preliminaries towards using connected sockets on both sides
by David Gibson 03 Apr '25

03 Apr '25

Some additional small cleanups David Gibson (3): udp: Remove redundant udp_at_sidx() call in udp_tap_handler() udp: Simplify updates to UDP flow timestamp udp: Correct some seccomp filter annotations udp.c | 23 +++++++++-------------- udp_vu.c | 9 +-------- udp_vu.h | 3 +-- 3 files changed, 11 insertions(+), 24 deletions(-) -- 2.49.0

2 6

[PATCH] passt-repair: Correct off-by-one error verifying name
by David Gibson 02 Apr '25

02 Apr '25

passt-repair will generate an error if the name it gets from the kernel is too long or not NUL terminated. Downstream testing has reported occasionally seeing this error in practice. In turns out there is a trivial off-by-one error in the check: ev->len is the length of the name, including terminating \0 characters, so to check for a \0 at the end of the buffer we need to check ev->name[len - 1] not ev->name[len]. Fixes: 42a854a52 ("pasta, passt-repair: Support multiple events per...") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt-repair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/passt-repair.c b/passt-repair.c index 86f02934..440c77ae 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -157,7 +157,7 @@ int main(int argc, char **argv) } } while (!found); - if (ev->len > NAME_MAX + 1 || ev->name[ev->len] != '\0') { + if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') { fprintf(stderr, "Invalid filename from inotify\n"); _exit(1); } -- 2.49.0

2 1

[PATCH 0/4] RFC: bind() migrated connections in repair mode
by David Gibson 02 Apr '25

02 Apr '25

Downstream testing recently discovered that inbound connections can't be migrated properly, because the new socket gets an address conflict with its corresponding listening socket. It turns out this can be avoided by delaying bind() until after we're already in repair mode. Patch 4/4 is the actual fix here. Patch 3/4 adds a test program checking the behaviour to doc/platform-requirements. Patches 1 & 2 fix minor problems I spotted in doc/platform-requirements writing 3/4. Only 4/4 will need to be backported. David Gibson (4): platform requirements: Fix clang-tidy warning platform requirements: Add attributes to die() function platform requirements: Add test for address conflicts with TCP_REPAIR migrate, tcp: bind() migrated sockets in repair mode doc/platform-requirements/.gitignore | 1 + doc/platform-requirements/Makefile | 4 +- doc/platform-requirements/common.h | 1 + doc/platform-requirements/listen-vs-repair.c | 128 ++++++++++++++++++ .../reuseaddr-priority.c | 6 +- tcp.c | 38 ++++-- 6 files changed, 162 insertions(+), 16 deletions(-) create mode 100644 doc/platform-requirements/listen-vs-repair.c -- 2.49.0

2 5

[PATCH v3] udp: support traceroute
by Jon Maloy 31 Mar '25

31 Mar '25

Now that ICMP pass-through from socket-to-tap is in place, it is easy to support UDP based traceroute functionality in direction tap-to-socket. We fix that in this commit. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: - Using ancillary data instead of setsockopt to transfer outgoing TTL. - Support IPv6 v3: - Storing ttl per packet instead of per flow. This may not be elegant, but much less intrusive than changing the flow criteria. This eliminates the need for the extra, flow-changing patch we introduced in v2. --- packet.c | 28 +++++++++++++++++----------- packet.h | 30 ++++++++++++++++++++++-------- tap.c | 3 ++- udp.c | 28 ++++++++++++++++++++++++---- udp.h | 3 ++- 5 files changed, 67 insertions(+), 25 deletions(-) diff --git a/packet.c b/packet.c index 72c6158..36a32fe 100644 --- a/packet.c +++ b/packet.c @@ -89,11 +89,12 @@ bool pool_full(const struct pool *p) * @p: Existing pool * @len: Length of new descriptor * @start: Start of data + * @ttl: TTL/hop_limit for this packet * @func: For tracing: name of calling function * @line: For tracing: caller line of function call */ void packet_add_do(struct pool *p, size_t len, const char *start, - const char *func, int line) + const uint8_t ttl, const char *func, int line) { size_t idx = p->count; @@ -106,8 +107,9 @@ void packet_add_do(struct pool *p, size_t len, const char *start, if (packet_check_range(p, start, len, func, line)) return; - p->pkt[idx].iov_base = (void *)start; - p->pkt[idx].iov_len = len; + p->pkt[idx].iov.iov_base = (void *)start; + p->pkt[idx].iov.iov_len = len; + p->pkt[idx].ttl = ttl; p->count++; } @@ -125,7 +127,8 @@ void packet_add_do(struct pool *p, size_t len, const char *start, * Return: pointer to start of data range, NULL on invalid range or descriptor */ void *packet_get_try_do(const struct pool *p, size_t idx, size_t offset, - size_t len, size_t *left, const char *func, int line) + size_t len, size_t *left, uint8_t *ttl, + const char *func, int line) { char *ptr; @@ -139,18 +142,21 @@ void *packet_get_try_do(const struct pool *p, size_t idx, size_t offset, return NULL; } - if (offset > p->pkt[idx].iov_len || - len > (p->pkt[idx].iov_len - offset)) + if (offset > p->pkt[idx].iov.iov_len || + len > (p->pkt[idx].iov.iov_len - offset)) return NULL; - ptr = (char *)p->pkt[idx].iov_base + offset; + ptr = (char *)p->pkt[idx].iov.iov_base + offset; ASSERT_WITH_MSG(!packet_check_range(p, ptr, len, func, line), "Corrupt packet pool, %s:%i", func, line); if (left) - *left = p->pkt[idx].iov_len - offset - len; + *left = p->pkt[idx].iov.iov_len - offset - len; + if (ttl) + *ttl = p->pkt[idx].ttl; +; return ptr; } @@ -168,14 +174,14 @@ void *packet_get_try_do(const struct pool *p, size_t idx, size_t offset, */ void *packet_get_do(const struct pool *p, const size_t idx, size_t offset, size_t len, size_t *left, - const char *func, int line) + uint8_t *ttl, const char *func, int line) { - void *r = packet_get_try_do(p, idx, offset, len, left, func, line); + void *r = packet_get_try_do(p, idx, offset, len, left, ttl, func, line); if (!r) { trace("missing packet data length %zu, offset %zu from " "length %zu, %s:%i", - len, offset, p->pkt[idx].iov_len, func, line); + len, offset, p->pkt[idx].iov.iov_len, func, line); } return r; diff --git a/packet.h b/packet.h index c94780a..1f5142c 100644 --- a/packet.h +++ b/packet.h @@ -11,6 +11,8 @@ /* Maximum size of a single packet stored in pool, including headers */ #define PACKET_MAX_LEN ((size_t)UINT16_MAX) +#define DEFAULT_TTL 64 + /** * struct pool - Generic pool of packets stored in a buffer * @buf: Buffer storing packet descriptors, @@ -26,28 +28,36 @@ struct pool { size_t buf_size; size_t size; size_t count; - struct iovec pkt[]; + struct { + struct iovec iov; + uint8_t ttl; + uint8_t pad[3]; + } pkt[]; }; int vu_packet_check_range(void *buf, const char *ptr, size_t len); void packet_add_do(struct pool *p, size_t len, const char *start, - const char *func, int line); + const uint8_t ttl, const char *func, int line); void *packet_get_try_do(const struct pool *p, const size_t idx, size_t offset, size_t len, size_t *left, - const char *func, int line); + uint8_t *ttl, const char *func, int line); void *packet_get_do(const struct pool *p, const size_t idx, size_t offset, size_t len, size_t *left, - const char *func, int line); + uint8_t *ttl, const char *func, int line); bool pool_full(const struct pool *p); void pool_flush(struct pool *p); #define packet_add(p, len, start) \ - packet_add_do(p, len, start, __func__, __LINE__) + packet_add_do(p, len, start, DEFAULT_TTL, __func__, __LINE__) +#define packet_add_ttl(p, len, start, ttl) \ + packet_add_do(p, len, start, ttl, __func__, __LINE__) #define packet_get_try(p, idx, offset, len, left) \ - packet_get_try_do(p, idx, offset, len, left, __func__, __LINE__) + packet_get_try_do(p, idx, offset, len, left, NULL, __func__, __LINE__) #define packet_get(p, idx, offset, len, left) \ - packet_get_do(p, idx, offset, len, left, __func__, __LINE__) + packet_get_do(p, idx, offset, len, left, NULL, __func__, __LINE__) +#define packet_get_ttl(p, idx, offset, len, left, ttl) \ + packet_get_do(p, idx, offset, len, left, ttl, __func__, __LINE__) #define PACKET_POOL_DECL(_name, _size, _buf) \ struct _name ## _t { \ @@ -55,7 +65,11 @@ struct _name ## _t { \ size_t buf_size; \ size_t size; \ size_t count; \ - struct iovec pkt[_size]; \ + struct { \ + struct iovec iov; \ + uint8_t ttl; \ + uint8_t pad[3]; \ + } pkt[_size]; \ } #define PACKET_POOL_INIT_NOCAST(_size, _buf, _buf_size) \ diff --git a/tap.c b/tap.c index 3a6fcbe..ac9b3df 100644 --- a/tap.c +++ b/tap.c @@ -563,6 +563,7 @@ PACKET_POOL_DECL(pool_l4, UIO_MAXIOV, pkt_buf); * @dest: Destination port * @saddr: Source address * @daddr: Destination address + * @ttl: TTL/hop_limit for packet * @msg: Array of messages that can be handled in a single call */ static struct tap4_l4_t { @@ -821,7 +822,7 @@ resume: #undef L4_SET append: - packet_add((struct pool *)&seq->p, l4len, l4h); + packet_add_ttl((struct pool *)&seq->p, l4len, l4h, iph->ttl); } for (j = 0, seq = tap4_l4; j < seq_count; j++, seq++) { diff --git a/udp.c b/udp.c index 39431d7..5fbba49 100644 --- a/udp.c +++ b/udp.c @@ -859,8 +859,10 @@ fail: */ int udp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, const void *saddr, const void *daddr, - const struct pool *p, int idx, const struct timespec *now) + const struct pool *p, int idx, + const struct timespec *now) { + char ancillary[CMSG_SPACE(sizeof(int))]; const struct flowside *toside; struct mmsghdr mm[UIO_MAXIOV]; union sockaddr_inany to_sa; @@ -885,7 +887,9 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, src = ntohs(uh->source); dst = ntohs(uh->dest); - tosidx = udp_flow_from_tap(c, pif, af, saddr, daddr, src, dst, now); + tosidx = udp_flow_from_tap(c, pif, af, saddr, daddr, + src, dst, now); + if (!(uflow = udp_at_sidx(tosidx))) { char sstr[INET6_ADDRSTRLEN], dstr[INET6_ADDRSTRLEN]; @@ -915,8 +919,9 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, for (i = 0; i < (int)p->count - idx; i++) { struct udphdr *uh_send; size_t len; + uint8_t ttl; - uh_send = packet_get(p, idx + i, 0, sizeof(*uh), &len); + uh_send = packet_get_ttl(p, idx + i, 0, sizeof(*uh), &len, &ttl); if (!uh_send) return p->count - idx; @@ -926,7 +931,6 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, if (len) { m[i].iov_base = (char *)(uh_send + 1); m[i].iov_len = len; - mm[i].msg_hdr.msg_iov = m + i; mm[i].msg_hdr.msg_iovlen = 1; } else { @@ -938,6 +942,22 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, mm[i].msg_hdr.msg_controllen = 0; mm[i].msg_hdr.msg_flags = 0; + if (ttl != DEFAULT_TTL) { + struct cmsghdr *cmsg = (void *) ancillary; + + if (af == AF_INET) { + cmsg->cmsg_level = IPPROTO_IP; + cmsg->cmsg_type = IP_TTL; + } else { + cmsg->cmsg_level = IPPROTO_IPV6; + cmsg->cmsg_type = IPV6_HOPLIMIT; + } + cmsg->cmsg_len = CMSG_LEN(sizeof(int)); + *((int *) CMSG_DATA(cmsg)) = ttl; + mm[i].msg_hdr.msg_control = ancillary; + mm[i].msg_hdr.msg_controllen = sizeof(ancillary); + } + count++; } diff --git a/udp.h b/udp.h index de2df6d..6adbfcd 100644 --- a/udp.h +++ b/udp.h @@ -15,7 +15,8 @@ void udp_reply_sock_handler(const struct ctx *c, union epoll_ref ref, uint32_t events, const struct timespec *now); int udp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, const void *saddr, const void *daddr, - const struct pool *p, int idx, const struct timespec *now); + const struct pool *p, int idx, + const struct timespec *now); int udp_sock_init(const struct ctx *c, int ns, const union inany_addr *addr, const char *ifname, in_port_t port); int udp_init(struct ctx *c); -- 2.48.1

2 1

[PATCH v2] pasta, passt-repair: Support multiple events per read() in inotify handlers
by David Gibson 30 Mar '25

30 Mar '25

From: Stefano Brivio <sbrivio(a)redhat.com> The current code assumes that we'll get one event per read() on inotify descriptors, but that's not the case, not from documentation, and not from reports. Add loops in the two inotify handlers we have, in pasta-specific code and passt-repair, to go through all the events we receive. Link: https://bugs.passt.top/show_bug.cgi?id=119 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> [dwg: Remove unnecessary buffer expansion, use strnlen instead of strlen to make Coverity happier] Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- passt-repair.c | 27 ++++++++++++++++++++------- pasta.c | 20 +++++++++++++------- 2 files changed, 33 insertions(+), 14 deletions(-) diff --git a/passt-repair.c b/passt-repair.c index 120f7aa7..d36c9c94 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -111,14 +111,14 @@ int main(int argc, char **argv) } if ((sb.st_mode & S_IFMT) == S_IFDIR) { - char buf[sizeof(struct inotify_event) + NAME_MAX + 1]; + char buf[sizeof(struct inotify_event) + NAME_MAX + 1] + __attribute__ ((aligned(__alignof__(struct inotify_event)))); const struct inotify_event *ev; char path[PATH_MAX + 1]; + bool found = false; ssize_t n; int fd; - ev = (struct inotify_event *)buf; - if ((fd = inotify_init1(IN_CLOEXEC)) < 0) { fprintf(stderr, "inotify_init1: %i\n", errno); _exit(1); @@ -130,6 +130,8 @@ int main(int argc, char **argv) } do { + char *p; + n = read(fd, buf, sizeof(buf)); if (n < 0) { fprintf(stderr, "inotify read: %i", errno); @@ -138,11 +140,22 @@ int main(int argc, char **argv) if (n < (ssize_t)sizeof(*ev)) { fprintf(stderr, "Short inotify read: %zi", n); - _exit(1); + continue; + } + + for (p = buf; p < buf + n; p += sizeof(*ev) + ev->len) { + ev = (const struct inotify_event *)p; + + if (ev->len >= REPAIR_EXT_LEN && + !memcmp(ev->name + + strnlen(ev->name, ev->len) - + REPAIR_EXT_LEN, + REPAIR_EXT, REPAIR_EXT_LEN)) { + found = true; + break; + } } - } while (ev->len < REPAIR_EXT_LEN || - memcmp(ev->name + strlen(ev->name) - REPAIR_EXT_LEN, - REPAIR_EXT, REPAIR_EXT_LEN)); + } while (!found); snprintf(path, sizeof(path), "%s/%s", argv[1], ev->name); if ((stat(path, &sb))) { diff --git a/pasta.c b/pasta.c index fa3e7de5..017fa322 100644 --- a/pasta.c +++ b/pasta.c @@ -498,17 +498,23 @@ void pasta_netns_quit_init(const struct ctx *c) */ void pasta_netns_quit_inotify_handler(struct ctx *c, int inotify_fd) { - char buf[sizeof(struct inotify_event) + NAME_MAX + 1]; - const struct inotify_event *in_ev = (struct inotify_event *)buf; + char buf[sizeof(struct inotify_event) + NAME_MAX + 1] + __attribute__ ((aligned(__alignof__(struct inotify_event)))); + const struct inotify_event *ev; + ssize_t n; + char *p; - if (read(inotify_fd, buf, sizeof(buf)) < (ssize_t)sizeof(*in_ev)) + if ((n = read(inotify_fd, buf, sizeof(buf))) < (ssize_t)sizeof(*ev)) return; - if (strncmp(in_ev->name, c->netns_base, sizeof(c->netns_base))) - return; + for (p = buf; p < buf + n; p += sizeof(*ev) + ev->len) { + ev = (const struct inotify_event *)p; - info("Namespace %s is gone, exiting", c->netns_base); - _exit(EXIT_SUCCESS); + if (!strncmp(ev->name, c->netns_base, sizeof(c->netns_base))) { + info("Namespace %s is gone, exiting", c->netns_base); + _exit(EXIT_SUCCESS); + } + } } /** -- 2.49.0

2 2

[PATCH v2 0/2] udp: Fix some minor warts in the ICMP error propagation code
by David Gibson 28 Mar '25

28 Mar '25

While working on using connected sockets for both sides of UDP flows, I spotted a couple of minor problems in the recently added ICMP error propagation code. Here are the fixes. v2: * Rebase and fix conflict with Jon's recent fix in the same code David Gibson (2): udp: Don't attempt to forward ICMP socket errors to other sockets udp: Improve name of UDP related ICMP sending functions udp.c | 40 +++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 19 deletions(-) -- 2.49.0

2 3

[RFC PATCH] pasta, passt-repair: Support multiple events per read() in inotify handlers
by Stefano Brivio 28 Mar '25

28 Mar '25

The current code assumes that we'll get one event per read() on inotify descriptors, but that's not the case, not from documentation, and not from reports. Add loops in the two inotify handlers we have, in pasta-specific code and passt-repair, to go through all the events we receive. While in pasta the the inotify watch is in an epoll list, and we'll get epoll wakeups as long as there's data to read, in passt-repair that's not the case. So, in pasta we can simply size the buffer for a single event and try to read one, but in passt-repair, we'll need to size the buffer to a safer, reasonable amount of events. Link: https://bugs.passt.top/show_bug.cgi?id=119 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- I'm posting this as RFC because, while it seems to do the job and I tested all the code paths, Coverity isn't amused by the fact that we assume that inotify 'name' attributes (ev->name) are NULL-terminated. They actually are, but the code is not very robust. Addressing that is kind of trivial but I keep getting it wrong, so I'll start posting this and fix that up later (direct fixes/edits of this patch are also welcome, of course). passt-repair.c | 26 +++++++++++++++++++------- pasta.c | 20 +++++++++++++------- 2 files changed, 32 insertions(+), 14 deletions(-) diff --git a/passt-repair.c b/passt-repair.c index 120f7aa..86581c6 100644 --- a/passt-repair.c +++ b/passt-repair.c @@ -111,14 +111,14 @@ int main(int argc, char **argv) } if ((sb.st_mode & S_IFMT) == S_IFDIR) { - char buf[sizeof(struct inotify_event) + NAME_MAX + 1]; + char buf[(sizeof(struct inotify_event) + NAME_MAX + 1) * 128] + __attribute__ ((aligned(__alignof__(struct inotify_event)))); const struct inotify_event *ev; char path[PATH_MAX + 1]; + bool found = false; ssize_t n; int fd; - ev = (struct inotify_event *)buf; - if ((fd = inotify_init1(IN_CLOEXEC)) < 0) { fprintf(stderr, "inotify_init1: %i\n", errno); _exit(1); @@ -130,6 +130,8 @@ int main(int argc, char **argv) } do { + char *p; + n = read(fd, buf, sizeof(buf)); if (n < 0) { fprintf(stderr, "inotify read: %i", errno); @@ -138,11 +140,21 @@ int main(int argc, char **argv) if (n < (ssize_t)sizeof(*ev)) { fprintf(stderr, "Short inotify read: %zi", n); - _exit(1); + continue; + } + + for (p = buf; p < buf + n; p += sizeof(*ev) + ev->len) { + ev = (const struct inotify_event *)p; + + if (ev->len >= REPAIR_EXT_LEN && + !memcmp(ev->name + strlen(ev->name) - + REPAIR_EXT_LEN, + REPAIR_EXT, REPAIR_EXT_LEN)) { + found = true; + break; + } } - } while (ev->len < REPAIR_EXT_LEN || - memcmp(ev->name + strlen(ev->name) - REPAIR_EXT_LEN, - REPAIR_EXT, REPAIR_EXT_LEN)); + } while (!found); snprintf(path, sizeof(path), "%s/%s", argv[1], ev->name); if ((stat(path, &sb))) { diff --git a/pasta.c b/pasta.c index fa3e7de..017fa32 100644 --- a/pasta.c +++ b/pasta.c @@ -498,17 +498,23 @@ void pasta_netns_quit_init(const struct ctx *c) */ void pasta_netns_quit_inotify_handler(struct ctx *c, int inotify_fd) { - char buf[sizeof(struct inotify_event) + NAME_MAX + 1]; - const struct inotify_event *in_ev = (struct inotify_event *)buf; + char buf[sizeof(struct inotify_event) + NAME_MAX + 1] + __attribute__ ((aligned(__alignof__(struct inotify_event)))); + const struct inotify_event *ev; + ssize_t n; + char *p; - if (read(inotify_fd, buf, sizeof(buf)) < (ssize_t)sizeof(*in_ev)) + if ((n = read(inotify_fd, buf, sizeof(buf))) < (ssize_t)sizeof(*ev)) return; - if (strncmp(in_ev->name, c->netns_base, sizeof(c->netns_base))) - return; + for (p = buf; p < buf + n; p += sizeof(*ev) + ev->len) { + ev = (const struct inotify_event *)p; - info("Namespace %s is gone, exiting", c->netns_base); - _exit(EXIT_SUCCESS); + if (!strncmp(ev->name, c->netns_base, sizeof(c->netns_base))) { + info("Namespace %s is gone, exiting", c->netns_base); + _exit(EXIT_SUCCESS); + } + } } /** -- 2.43.0

2 3

[PATCH v2 0/2] udp: add guest-to-remote traceroute
by Jon Maloy 28 Mar '25

28 Mar '25

We add support for UDP traceroute in the tap-sock direction. More will follow when this one is settled. --- v2: - Added ttl/hop_limit as flow selection criteria - Using ancillary data instead of setsockopt() to pass on ttl/hop_limit. - Added support for IPv6 Jon Maloy (2): Add ttl to outgoing flow structure lookups udp: support traceroute with udp flow.c | 17 ++++++++++++----- flow.h | 8 ++++++-- flow_table.h | 3 ++- icmp.c | 15 ++++++++++----- icmp.h | 2 +- packet.h | 2 ++ tap.c | 25 ++++++++++++++++++------- tcp.c | 6 +++--- udp.c | 31 +++++++++++++++++++++++++++---- udp.h | 3 ++- udp_flow.c | 7 ++++--- udp_flow.h | 2 +- 12 files changed, 88 insertions(+), 33 deletions(-) -- 2.48.1

2 3

[PATCH v2] udp: correct source address for ICMP messages
by Jon Maloy 27 Mar '25

27 Mar '25

While developing traceroute forwarding tap-to-sock we found that struct msghdr.msg_name for the ICMPs in the opposite direction always contains the destination address of the original UDP message, and not, as one might expect, the one of the host which created the error message. Study of the kernel code reveals that this address instead is appended as extra data after the received struct sock_extended_err area. We now change the ICMP receive code accordingly. Fixes: 55431f0077b6 ("udp: create and send ICMPv4 to local peer when applicable") Fixes: 68b04182e07d ("udp: create and send ICMPv6 to local peer when applicable") Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- v2: Removed stray comment and unecessary initializations, as per feedback from David Gibson --- udp.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/udp.c b/udp.c index 80520cb..9d16529 100644 --- a/udp.c +++ b/udp.c @@ -510,10 +510,13 @@ static void udp_send_conn_fail_icmp6(const struct ctx *c, */ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) { - const struct sock_extended_err *ee; + struct errhdr { + struct sock_extended_err ee; + union sockaddr_inany saddr; + }; + const struct errhdr *eh; const struct cmsghdr *hdr; - union sockaddr_inany saddr; - char buf[CMSG_SPACE(sizeof(*ee))]; + char buf[CMSG_SPACE(sizeof(struct errhdr))]; char data[ICMP6_MAX_DLEN]; int s = ref.fd; struct iovec iov = { @@ -521,8 +524,6 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) .iov_len = sizeof(data) }; struct msghdr mh = { - .msg_name = &saddr, - .msg_namelen = sizeof(saddr), .msg_iov = &iov, .msg_iovlen = 1, .msg_control = buf, @@ -553,7 +554,7 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) return -1; } - ee = (const struct sock_extended_err *)CMSG_DATA(hdr); + eh = (const struct errhdr *)CMSG_DATA(hdr); if (ref.type == EPOLL_TYPE_UDP_REPLY) { flow_sidx_t sidx = flow_sidx_opposite(ref.flowside); const struct flowside *toside = flowside_at_sidx(sidx); @@ -561,18 +562,19 @@ static int udp_sock_recverr(const struct ctx *c, union epoll_ref ref) if (hdr->cmsg_level == IPPROTO_IP) { dlen = MIN(dlen, ICMP4_MAX_DLEN); - udp_send_conn_fail_icmp4(c, ee, toside, saddr.sa4.sin_addr, + udp_send_conn_fail_icmp4(c, &eh->ee, toside, + eh->saddr.sa4.sin_addr, data, dlen); } else if (hdr->cmsg_level == IPPROTO_IPV6) { - udp_send_conn_fail_icmp6(c, ee, toside, - &saddr.sa6.sin6_addr, + udp_send_conn_fail_icmp6(c, &eh->ee, toside, + &eh->saddr.sa6.sin6_addr, data, dlen, sidx.flowi); } } else { trace("Ignoring received IP_RECVERR cmsg on listener socket"); } debug("%s error on UDP socket %i: %s", - str_ee_origin(ee), s, strerror_(ee->ee_errno)); + str_ee_origin(&eh->ee), s, strerror_(eh->ee.ee_errno)); return 1; } -- 2.48.1

3 2