- dev - passt

[PATCH] netlink: Fetch most specific (longest prefix) address in nl_addr_get()
by Stefano Brivio 27 Dec '23

27 Dec '23

This happened in most cases implicitly before commit eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions"): while going through results from netlink, we would only copy an address into the provided return buffer if no address had been picked yet. Because of the insertion logic in the kernel (ipv6_link_dev_addr()), the first returned address would also be the one added last, and, in case of a Linux guest using a DHCPv6 client as well as SLAAC, that would be the address assigned via DHCPv6, because SLAAC happens before the DHCPv6 exchange. The effect of, instead, picking the last returned address (first assigned) is visible when passt or pasta runs nested, given that, by default, they advertise a prefix for SLAAC usage, plus an address via DHCPv6. The first level (L1 guest) would get a /64 address by means of SLAAC, and a /128 address via DHCPv6, the latter matching the address on the host. The second level (L2 guest) would also get two addresses: a /64 via SLAAC (same prefix as the host), and a /128 via DHCPv6, matching the the L1 SLAAC-assigned address, not the one obtained via DHCPv6. That is, none of the L2 addresses would match the address on the host. The whole point of having a DHCPv6 server is to avoid (implicit) NAT when possible, though. Fix this in a more explicit way than the behaviour we initially had: pick the first address among the set of most specific ones, by comparing prefix lengths. Do this for IPv4 and for link-local addresses, too, to match in any case the implementation of the default source address selection. Reported-by: Yalan Zhang <yalzhang(a)redhat.com> Fixes: eff3bcb24547 ("netlink: Split nl_addr() into separate operation functions") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/netlink.c b/netlink.c index b221c79..6e40d28 100644 --- a/netlink.c +++ b/netlink.c @@ -527,7 +527,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, } /** - * nl_addr_get() - Get IP address for given interface and address family + * nl_addr_get() - Get most specific global address, given interface and family * @s: Netlink socket * @ifi: Interface index in outer network namespace * @af: Address family @@ -540,6 +540,7 @@ int nl_route_dup(int s_src, unsigned int ifi_src, int nl_addr_get(int s, unsigned int ifi, sa_family_t af, void *addr, int *prefix_len, void *addr_l) { + uint8_t prefix_max = 0, prefix_max_ll = 0; struct req_t { struct nlmsghdr nlh; struct ifaddrmsg ifa; @@ -566,17 +567,25 @@ int nl_addr_get(int s, unsigned int ifi, sa_family_t af, if (rta->rta_type != IFA_ADDRESS) continue; - if (af == AF_INET) { + if (af == AF_INET && ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); - *prefix_len = ifa->ifa_prefixlen; + + prefix_max = *prefix_len = ifa->ifa_prefixlen; } else if (af == AF_INET6 && addr && - ifa->ifa_scope == RT_SCOPE_UNIVERSE) { + ifa->ifa_scope == RT_SCOPE_UNIVERSE && + ifa->ifa_prefixlen > prefix_max) { memcpy(addr, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max = ifa->ifa_prefixlen; } if (addr_l && - af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK) + af == AF_INET6 && ifa->ifa_scope == RT_SCOPE_LINK && + ifa->ifa_prefixlen > prefix_max_ll) { memcpy(addr_l, RTA_DATA(rta), RTA_PAYLOAD(rta)); + + prefix_max_ll = ifa->ifa_prefixlen; + } } } return status; -- 2.39.2

1 0

[PATCH] flow: Add missing include, stdio.h
by Stefano Brivio 27 Dec '23

27 Dec '23

Reported-by: lemmi <lemmi(a)nerd2nerd.org> Link: https://github.com/void-linux/void-packages/actions/runs/7097192513/job/193… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- flow.c | 1 + 1 file changed, 1 insertion(+) diff --git a/flow.c b/flow.c index d24726d..a8aeb15 100644 --- a/flow.c +++ b/flow.c @@ -6,6 +6,7 @@ */ #include <stdint.h> +#include <stdio.h> #include <unistd.h> #include <string.h> -- 2.39.2

2 1

[PATCH] tcp: Cast timeval fields to unsigned long long for printing
by Stefano Brivio 27 Dec '23

27 Dec '23

On x32, glibc defines time_t and suseconds_t (the latter, also known as __syscall_slong_t) as unsigned long long, whereas "everywhere else", including x86_64 and i686, those are unsigned long. See also https://sourceware.org/bugzilla/show_bug.cgi?id=16437 for all the gory details. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index f506cfd..1e4d2fa 100644 --- a/tcp.c +++ b/tcp.c @@ -727,8 +727,9 @@ static void tcp_timer_ctl(const struct ctx *c, struct tcp_tap_conn *conn) it.it_value.tv_sec = ACT_TIMEOUT; } - flow_dbg(conn, "timer expires in %lu.%03lus", it.it_value.tv_sec, - it.it_value.tv_nsec / 1000 / 1000); + flow_dbg(conn, "timer expires in %llu.%03llus", + (unsigned long long)it.it_value.tv_sec, + (unsigned long long)it.it_value.tv_nsec / 1000 / 1000); timerfd_settime(conn->timer, 0, &it, NULL); } -- 2.39.2

2 1

[PATCH] README: Update "Availability" section
by Stefano Brivio 27 Dec '23

27 Dec '23

It's been a while -- there are now official packages for Arch Linux, Gentoo, Void Linux. Suggested-by: Rahil Bhimjiani <me(a)rahil.website> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 6d00313..c360037 100644 --- a/README.md +++ b/README.md @@ -341,19 +341,17 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ⌚ drop-in replacement for VPNKit (rootless Docker) ### Availability -* ✅ official [packages](https://gitlab.com/redhat/centos-stream/rpms/passt) for - CentOS Stream -* ✅ official [packages](https://tracker.debian.org/pkg/passt) for Debian -* ✅ official [packages](https://src.fedoraproject.org/rpms/passt) for Fedora -* ✅ official [packages](https://packages.ubuntu.com/lunar/passt) for Ubuntu -* ✅ unofficial [packages](https://aur.archlinux.org/packages/passt-git) for - Arch Linux -* ✅ unofficial - [packages](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for EPEL, - Mageia -* 🛠 official - [packages](https://build.opensuse.org/package/show/Virtualization:containers… - for openSUSE +* official packages for: + * ✅ [Arch Linux](https://archlinux.org/packages/extra/x86_64/passt/) ([aarch64](https://archlinuxarm.org/packages/aarch64/passt), [i486](https://www.archlinux32.org/packages/?q=passt)) + * ✅ [CentOS Stream]((https://gitlab.com/redhat/centos-stream/rpms/passt) + * ✅ [Debian](https://tracker.debian.org/pkg/passt) + * ✅ [Fedora](https://src.fedoraproject.org/rpms/passt) + * ✅ [Gentoo](https://packages.gentoo.org/packages/net-misc/passt) + * ✅ [Ubuntu](https://launchpad.net/ubuntu/+source/passt) + * ✅ [Void Linux](https://voidlinux.org/packages/?q=passt) +* unofficial packages for: + * ✅ [EPEL, Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) + * 🛠 [openSUSE](https://build.opensuse.org/package/show/Virtualization:containers… * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 static builds for other RPM-based distributions * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 -- 2.39.2

2 1

[PATCH v2 00/13] Manage more flow related things from generic flow code
by David Gibson 20 Dec '23

20 Dec '23

There are a number of things that are more-or-less general to flows which are still explicitly handled in tcp.c and tcp_splice.c including allocation and freeing of flow entries, and dispatch of deferred and timer functions. Even without adding more fields to the common flow structure, we can handle a number of these in a more flow-centric way. Unlike v1 this version is based on the hash table rework series. Changes since v1: * Store the timestamp of last flow timers run in a global, rather than a ctx field * Rebased on the TCP hash table rework * Add patches 9..13/13 with changes to allocation and freeing of flow entries. David Gibson (13): flow: Make flow_table.h #include the protocol specific headers it needs treewide: Standardise on 'now' for current timestamp variables tcp, tcp_splice: Remove redundant handling from tcp_timer() tcp, tcp_splice: Move per-type cleanup logic into per-type helpers flow, tcp: Add flow-centric dispatch for deferred flow handling flow, tcp: Add handling for per-flow timers epoll: Better handling of number of epoll types tcp, tcp_splice: Avoid double layered dispatch for connected TCP sockets flow: Move flow_log_() to near top of flow.c flow: Move flow_count from context structure to a global flow: Abstract helpers for allocating new flows flow: Enforce that freeing of closed flows must happen in deferred handlers flow: Avoid moving flow entries to compact table flow.c | 201 +++++++++++++++++++++++++++++++++++++++++---------- flow.h | 5 +- flow_table.h | 34 +++++++++ icmp.c | 12 +-- icmp.h | 2 +- log.c | 34 ++++----- passt.c | 20 +++-- passt.h | 9 +-- tcp.c | 139 ++++++++--------------------------- tcp.h | 2 +- tcp_conn.h | 8 +- tcp_splice.c | 60 +++++++-------- tcp_splice.h | 6 +- udp.c | 16 ++-- udp.h | 2 +- 15 files changed, 317 insertions(+), 233 deletions(-) -- 2.43.0

1 13

[PATCH 00/11] RFC: ICMP reworks preliminary to flow table integration
by David Gibson 18 Dec '23

18 Dec '23

As with TCP, it turns out that there are a bunch of clean ups and reworks to the ICMP code which will make integration with the flow table easier, even before introducing a non-trivial version of the flow table itself. Based on the flow based dispatch, hash table rework and bind/addressing cleanup series. David Gibson (11): checksum: Don't use linux/icmp.h when netinet/ip_icmp.h will do icmp: Don't set "port" on destination sockaddr for ping sockets icmp: Remove redundant initialisation of sendto() address icmp: Don't attempt to handle "wrong direction" ping socket traffic icmp: Don't attempt to match host IDs to guest IDs icmp: Use -1 to represent "missing" sockets icmp: Simplify socket expiry scanning icmp: Share more between IPv4 and IPv6 paths in icmp_tap_handler() icmp: Consolidate icmp_sock_handler() with icmpv6_sock_handler() icmp: Warn on receive errors from ping sockets icmp: Validate packets received on ping sockets checksum.c | 2 +- icmp.c | 294 +++++++++++++++++++++++------------------------------ icmp.h | 5 +- passt.c | 4 +- 4 files changed, 132 insertions(+), 173 deletions(-) -- 2.43.0

1 11

[PATCH 0/8] Improve flow table based dispatch of timers and other handlers
by David Gibson 14 Dec '23

14 Dec '23

There are still some thing dispatched explicitly in tcp.c and tcp_splice.c that make more sense to dispatch at the flow level, even with the current "stub" version of the flow table. This should be independent of my other outstanding series. David Gibson (8): flow: Make flow_table.h #include the protocol specific headers it needs treewide: Standardise on 'now' for current timestamp variables tcp, tcp_splice: Remove redundant handling from tcp_timer() tcp, tcp_splice: Move per-type cleanup logic into per-type helpers flow, tcp: Add flow-centric dispatch for deferred flow handling flow, tcp: Add handling for per-flow timers epoll: Better handling of number of epoll types tcp, tcp_splice: Avoid double layered dispatch for connected TCP sockets flow.c | 33 +++++++++++++++++++- flow.h | 3 ++ flow_table.h | 2 ++ icmp.c | 12 ++++---- icmp.h | 2 +- log.c | 34 ++++++++++----------- passt.c | 18 ++++++++--- passt.h | 8 +++-- tcp.c | 86 +++++++++++----------------------------------------- tcp.h | 2 +- tcp_conn.h | 5 +-- tcp_splice.c | 33 ++++++++++---------- tcp_splice.h | 4 +-- udp.c | 16 +++++----- udp.h | 2 +- 15 files changed, 129 insertions(+), 131 deletions(-) -- 2.43.0

1 8

test: make passt.mbuto script more robust
by Jon Maloy 12 Dec '23

12 Dec '23

From: Jon Paul Maloy <jmaloy(a)redhat.com> Creation of a symbolic link from /sbin to /usr/sbin fails if /sbin exists and is non-empty. This is the case on Ubuntu-23.04. We fix this by removing /sbin before creating the link. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- test/passt.mbuto | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/passt.mbuto b/test/passt.mbuto index 90816d2..12d7f50 100755 --- a/test/passt.mbuto +++ b/test/passt.mbuto @@ -26,6 +26,8 @@ DIRS="${DIRS} /tmp /sbin /usr/share /var/log /var/lib /etc/ssh /run/sshd /root/. COPIES="${COPIES} small.bin,/root/small.bin medium.bin,/root/medium.bin big.bin,/root/big.bin" FIXUP="${FIXUP}"' + rm -rf /sbin + ln -s /usr/sbin /sbin cat > /sbin/dhclient-script << EOF #!/bin/sh LOG=/var/log/dhclient-script.log @@ -47,7 +49,6 @@ set >> \$LOG exit 0 EOF chmod 755 /sbin/dhclient-script - ln -s /sbin /usr/sbin ln -s /bin /usr/bin ln -s /run /var/run :> /etc/fstab -- 2.39.2

2 3

[PATCH] test: Select first reported IPv6 address for guest/host comparison
by Stefano Brivio 11 Dec '23

11 Dec '23

If we run passt nested (a guest connected via passt to a guest connected via passt to the host), the first guest (L1) typically has two IPv6 addresses: one formed from the prefix assigned via SLAAC, and another one assigned via DHCPv6 (to match the address on the host). When we select addresses for comparison, in this case, we have multiple global unicast addresses. Selecting the first reported one on both host and guest is not entirely correct (in theory, the order might differ), but works reasonably well. Use the trick from 5beef085978e ("test: Only select a single interface or gateway in tests") to ask jq(1) for the first address returned by the query. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/passt/dhcp | 8 ++++---- test/passt/ndp | 4 ++-- test/pasta/dhcp | 8 ++++---- test/pasta/ndp | 4 ++-- test/two_guests/basic | 6 +++--- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/test/passt/dhcp b/test/passt/dhcp index 7272755..b428064 100644 --- a/test/passt/dhcp +++ b/test/passt/dhcp @@ -22,8 +22,8 @@ check [ -n "__IFNAME__" ] test DHCP: address guest /sbin/dhclient -4 __IFNAME__ -gout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' -hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME__").addr_info[0].local' +gout ADDR ip -j -4 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[0].local] | .[0]' +hout HOST_ADDR ip -j -4 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME__").addr_info[0].local] | .[0]' check [ "__ADDR__" = "__HOST_ADDR__" ] test DHCP: route @@ -49,8 +49,8 @@ check [ "__SEARCH__" = "__HOST_SEARCH__" ] test DHCPv6: address guest /sbin/dhclient -6 __IFNAME__ -gout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local' +gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' check [ "__ADDR6__" = "__HOST_ADDR6__" ] test DHCPv6: route diff --git a/test/passt/ndp b/test/passt/ndp index 6de4081..7b2dbfe 100644 --- a/test/passt/ndp +++ b/test/passt/ndp @@ -21,9 +21,9 @@ hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").d check [ -n "__IFNAME__" ] test SLAAC: prefix -gout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local' +gout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local] | .[0]' gout PREFIX6 sipcalc __ADDR6__/64 | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/pasta/dhcp b/test/pasta/dhcp index 309001b..b4f6f60 100644 --- a/test/pasta/dhcp +++ b/test/pasta/dhcp @@ -20,8 +20,8 @@ check [ -n "__IFNAME__" ] test DHCP: address ns /sbin/dhclient -4 --no-pid __IFNAME__ -nsout ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' -hout HOST_ADDR ip -j -4 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[0].local' +nsout ADDR ip -j -4 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[0].local] | .[0]' +hout HOST_ADDR ip -j -4 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[0].local] | .[0]' check [ __ADDR__ = __HOST_ADDR__ ] test DHCP: route @@ -36,8 +36,8 @@ check [ __MTU__ = 65520 ] test DHCPv6: address ns /sbin/dhclient -6 --no-pid __IFNAME__ hout HOST_IFNAME6 ip -j -6 route show|jq -rM '[.[] | select(.dst == "default").dev] | .[0]' -nsout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' check [ __ADDR6__ = __HOST_ADDR6__ ] test DHCPv6: route diff --git a/test/pasta/ndp b/test/pasta/ndp index bb33110..2a8afe6 100644 --- a/test/pasta/ndp +++ b/test/pasta/ndp @@ -21,9 +21,9 @@ ns ip link set dev __IFNAME__ up sleep 2 test SLAAC: prefix -nsout ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local' +nsout ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global" and .prefixlen == 64).local] | .[0]' nsout PREFIX6 sipcalc __ADDR6__/64 | grep prefix | cut -d' ' -f4 -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM ['.[] | select(.ifname == "__IFNAME__").addr_info[] | select(.scope == "global").local] | .[0]' hout HOST_PREFIX6 sipcalc __HOST_ADDR6__/64 | grep prefix | cut -d' ' -f4 check [ "__PREFIX6__" = "__HOST_PREFIX6__" ] diff --git a/test/two_guests/basic b/test/two_guests/basic index 09fbd3e..fa0608b 100644 --- a/test/two_guests/basic +++ b/test/two_guests/basic @@ -39,9 +39,9 @@ test DHCPv6: addresses sleep 2 guest1 /sbin/dhclient -6 __IFNAME1__ guest2 /sbin/dhclient -6 __IFNAME2__ -g1out ADDR1_6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local' -g2out ADDR2_6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local' -hout HOST_ADDR6 ip -j -6 addr show|jq -rM '.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local' +g1out ADDR1_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME1__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +g2out ADDR2_6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__IFNAME2__").addr_info[] | select(.prefixlen == 128).local] | .[0]' +hout HOST_ADDR6 ip -j -6 addr show|jq -rM '[.[] | select(.ifname == "__HOST_IFNAME6__").addr_info[] | select(.scope == "global").local] | .[0]' check [ "__ADDR1_6__" = "__HOST_ADDR6__" ] check [ "__ADDR2_6__" = "__HOST_ADDR6__" ] -- 2.39.2

2 3

[PATCH 0/3] RFC: TCP hash change changes, in preparation for flow table
by David Gibson 11 Dec '23

11 Dec '23

I now have an in-progress draft of a unified hash table to go with the unified flow table. This turns out to be easier if we first make some preliminary changes to the structure of the TCP hash table. So, here those are for review. This is based on my already posted series introducing the rudimentary version of the unified flow table. David Gibson (3): tcp: Switch hash table to linear probing instead of chaining tcp: Implement hash table with indices rather than pointers tcp: Don't account for hash table size in tcp_hash() flow.h | 11 ++++ tcp.c | 144 ++++++++++++++++++++++++++++------------------------- tcp_conn.h | 2 - util.h | 13 +++++ 4 files changed, 101 insertions(+), 69 deletions(-) -- 2.43.0

2 10