- dev - passt

[PATCH] tcp: Remove remaining declaration of tcp_l2_mh
by Laurent Vivier 07 Nov '23

07 Nov '23

Use of tcp_l2_mh has been removed in commit 38fbfdbcb95d, but its declaration and initialization are always in the code. Remove them as they are useless. Fixes: 38fbfdbcb95d ("tcp: Get rid of iov with cached MSS, drop sendmmsg(), add deferred flush") Cc: sbrivio(a)redhat.com Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/tcp.c b/tcp.c index 945023c5b442..386cd015be1c 100644 --- a/tcp.c +++ b/tcp.c @@ -515,8 +515,6 @@ static struct iovec tcp6_l2_iov [TCP_FRAMES_MEM]; static struct iovec tcp4_l2_flags_iov [TCP_FRAMES_MEM]; static struct iovec tcp6_l2_flags_iov [TCP_FRAMES_MEM]; -static struct mmsghdr tcp_l2_mh [TCP_FRAMES_MEM]; - /* sendmsg() to socket */ static struct iovec tcp_iov [UIO_MAXIOV]; @@ -3143,7 +3141,6 @@ static void tcp_sock_refill_init(const struct ctx *c) */ int tcp_init(struct ctx *c) { - int i; #ifndef HAS_GETRANDOM int dev_random = open("/dev/random", O_RDONLY); unsigned int random_read = 0; @@ -3172,9 +3169,6 @@ int tcp_init(struct ctx *c) exit(EXIT_FAILURE); } - for (i = 0; i < ARRAY_SIZE(tcp_l2_mh); i++) - tcp_l2_mh[i] = (struct mmsghdr) { .msg_hdr.msg_iovlen = 1 }; - if (c->ifi4) tcp_sock4_iov_init(c); -- 2.41.0

3 2

[PATCH v2 00/11] tcp_splice: Better exploit symmetry between sides of connection
by David Gibson 07 Nov '23

07 Nov '23

For spliced connections, both "sides" are sockets, and for many purposes how we deal with each side is symmetric. Currently, however, we track the information for each side in independent fields in the structure, meaning we can't easily exploit that symmetry. This makes a number of reorganizations of the tcp splice code so that we can explot that symmetry to reduce code size. This will have some additional advantages when we come to integrate with the in-progress unified flow table. Based on top of the interface identifiers and automatic forwarding cleanup series. Changes since v1: * Small updates to comments and commit messages David Gibson (11): tcp_splice: Remove redundant tcp_splice_epoll_ctl() tcp_splice: Correct error handling in tcp_splice_epoll_ctl() tcp_splice: Don't handle EPOLL_CTL_DEL as part of tcp_splice_epoll_ctl() tcp_splice: Remove unnecessary forward declaration tcp_splice: Avoid awkward temporaries in tcp_splice_epoll_ctl() tcp_splice: Don't pool pipes in pairs tcp_splice: Rename sides of connection from a/b to 0/1 tcp_splice: Exploit side symmetry in tcp_splice_timer() tcp_splice: Exploit side symmetry in tcp_splice_connect_finish() tcp_splice: Exploit side symmetry in tcp_splice_destroy() tcp_splice: Simplify selection of socket and pipe sides in socket handler tcp_conn.h | 45 +++--- tcp_splice.c | 389 +++++++++++++++++++++------------------------------ 2 files changed, 179 insertions(+), 255 deletions(-) -- 2.41.0

2 12

[PATCH v2 0/4] Passt Interface Identifiers
by David Gibson 07 Nov '23

07 Nov '23

For the generalisations to forwarding we want to accomplish with the flow table, we will need a more formalised notion of passt "interfaces" - that is way that passt communicates with network, whether that be over L4 sockets (as on the host) or via an L2 tunnel. This series makes a small start on this, by introducing a type to identify passt interfaces. We don't use it for a whole lot yet, but it will become more useful in future. Based on the automatic port forwarding cleanup series Changes since v1: * Don't use a type alias for pif ids, just use bare uint8_t David Gibson (4): udp: Clean up ref initialisation in udp_sock_init() pif: Introduce notion of passt/pasta interface pif: Record originating pif in listening socket refs pif: Pass originating pif to tap handler functions Makefile | 2 +- icmp.c | 4 +++- icmp.h | 4 ++-- passt.h | 1 + pif.h | 27 +++++++++++++++++++++++++++ tap.c | 26 ++++++++++++++++---------- tcp.c | 11 ++++++++--- tcp.h | 7 ++++--- tcp_splice.c | 10 ++++++---- udp.c | 35 ++++++++++++++++++----------------- udp.h | 11 ++++++----- 11 files changed, 92 insertions(+), 46 deletions(-) create mode 100644 pif.h -- 2.41.0

2 5

[PATCH v2 0/9] Clean ups to automatic port forwarding
by David Gibson 07 Nov '23

07 Nov '23

This contains an assortment of cleanups to the code supporting the automatic port forwarding more for past - specifically get_bound_ports() and related functions. This shouldn't mae any functional changes. Based on the series with fixes for new cppcheck-2.12 warnings. Changes since v1: * Some comment tweaks based on Stefano's feedback. David Gibson (9): conf: Cleaner initialisation of default forwarding modes port_fwd: Move automatic port forwarding code to port_fwd.[ch] port_fwd: Better parameterise procfs_scan_listen() util: Add open_in_ns() helper port_fwd: Pre-open /proc/net/* files rather than on-demand port_fwd: Don't NS_CALL get_bound_ports() port_fwd: Split TCP and UDP cases for get_bound_ports() port_fwd: Move port scanning /proc fds into struct port_fwd port_fwd: Simplify get_bound_ports_*() to port_fwd_scan_*() Makefile | 2 +- conf.c | 113 +++++-------------------------------------- conf.h | 1 - passt.h | 5 -- port_fwd.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++++ port_fwd.h | 9 ++++ tcp.c | 39 +-------------- util.c | 118 +++++++++++++++++++++------------------------ util.h | 3 +- 9 files changed, 218 insertions(+), 211 deletions(-) create mode 100644 port_fwd.c -- 2.41.0

2 10

[PATCH] selinux: Allow passt to talk over unconfined_t UNIX domain socket for --fd
by Stefano Brivio 07 Nov '23

07 Nov '23

If passt is started with --fd to talk over a pre-opened UNIX domain socket, we don't really know what label might be associated to it, but at least for an unconfined_t socket, this bit of policy wouldn't belong to anywhere else: enable that here. This is rather loose, of course, but on the other hand passt will sandbox itself into an empty filesystem, so we're not really adding much to the attack surface except for what --fd is supposed to do. Reported-by: Matej Hrica <mhrica(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2247221 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Same with this one: I'm posting this to ease reviews, but I just applied it as I don't actually expect reviews on SELinux rules. :) contrib/selinux/passt.te | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index ea768d9..401c9c3 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -124,3 +124,4 @@ allow passt_t self:icmp_socket { bind create setopt read write }; allow passt_t user_tmp_t:dir { add_name write }; allow passt_t user_tmp_t:file { create open }; allow passt_t user_tmp_t:sock_file { create read write unlink }; +allow passt_t unconfined_t:unix_stream_socket { read write }; -- 2.39.2

1 0

[PATCH 00/11] tcp_splice: Better exploit symmetry between sides of connection
by David Gibson 06 Nov '23

06 Nov '23

For spliced connections, both "sides" are sockets, and for many purposes how we deal with each side is symmetric. Currently, however, we track the information for each side in independent fields in the structure, meaning we can't easily exploit that symmetry. This makes a number of reorganizations of the tcp splice code so that we can explot that symmetry to reduce code size. This will have some additional advantages when we come to integrate with the in-progress unified flow table. Based on top of the interface identifiers and automatic forwarding cleanup series. David Gibson (11): tcp_splice: Remove redundant tcp_splice_epoll_ctl() tcp_splice: Correct error handling in tcp_splice_epoll_ctl() tcp_splice: Don't handle EPOLL_CTL_DEL as part of tcp_splice_epoll_ctl() tcp_splice: Remove unnecessary forward declaration tcp_splice: Avoid awkward temporaries in tcp_splice_epoll_ctl() tcp_splice: Don't pool pipes in pairs tcp_splice: Rename sides of connection from a/b to 0/1 tcp_splice: Exploit side symmetry in tcp_splice_timer() tcp_splice: Exploit side symmetry in tcp_splice_connect_finish() tcp_splice: Exploit side symmetry in tcp_splice_destroy() tcp_splice: Simplify selection of socket and pipe sides in socket handler tcp_conn.h | 45 +++--- tcp_splice.c | 389 +++++++++++++++++++++------------------------------ 2 files changed, 179 insertions(+), 255 deletions(-) -- 2.41.0

2 22

[PATCH 0/4] Passt Interface Identifiers
by David Gibson 04 Nov '23

04 Nov '23

For the generalisations to forwarding we want to accomplish with the flow table, we will need a more formalised notion of passt "interfaces" - that is way that passt communicates with network, whether that be over L4 sockets (as on the host) or via an L2 tunnel. This series makes a small start on this, by introducing a type to identify passt interfaces. We don't use it for a whole lot yet, but it will become more useful in future. David Gibson (4): udp: Clean up ref initialisation in udp_sock_init() pif: Introduce notion of passt/pasta interface pif: Record originating pif in listening socket refs pif: Pass originating pif to tap handler functions Makefile | 2 +- icmp.c | 4 +++- icmp.h | 4 ++-- passt.h | 1 + pif.h | 36 ++++++++++++++++++++++++++++++++++++ tap.c | 26 ++++++++++++++++---------- tcp.c | 11 ++++++++--- tcp.h | 7 ++++--- tcp_splice.c | 10 ++++++---- udp.c | 35 ++++++++++++++++++----------------- udp.h | 11 ++++++----- 11 files changed, 101 insertions(+), 46 deletions(-) create mode 100644 pif.h -- 2.41.0

2 6

[PATCH 0/9] Clean ups to automatic port forwarding
by David Gibson 03 Nov '23

03 Nov '23

This contains an assortment of cleanups to the code supporting the automatic port forwarding more for past - specifically get_bound_ports() and related functions. This shouldn't mae any functional changes. Based on the series with fixes for new cppcheck-2.12 warnings. David Gibson (9): conf: Cleaner initialisation of default forwarding modes port_fwd: Move automatic port forwarding code to port_fwd.[ch] port_fwd: Better parameterise procfs_scan_listen() util: Add open_in_ns() helper port_fwd: Pre-open /proc/net/* files rather than on-demand port_fwd: Don't NS_CALL get_bound_ports() port_fwd: Split TCP and UDP cases for get_bound_ports() port_fwd: Move port scanning /proc fds into struct port_fwd port_fwd: Simplify get_bound_ports_*() to port_fwd_scan_*() Makefile | 2 +- conf.c | 113 +++++-------------------------------------- conf.h | 1 - passt.h | 5 -- port_fwd.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++++ port_fwd.h | 9 ++++ tcp.c | 39 +-------------- util.c | 104 +++++++++++++++------------------------ util.h | 3 +- 9 files changed, 204 insertions(+), 211 deletions(-) create mode 100644 port_fwd.c -- 2.41.0

2 13

[PATCH] log: Don't define logging function 4 times
by David Gibson 13 Oct '23

13 Oct '23

In log.c we use a macro to define logging functions for each of 4 priority levels. The only difference between these is the priority we pass to vsyslog() and similar functions. Because it's done as a macro, however, the entire functions code is included in the binary 4 times. Rearrange this to take the priority level as a parameter to a regular function, then just use macros to define trivial wrappers which pass the priority level. This saves about 600 bytes of text in the executable (x86, non-AVX2). Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- log.c | 65 +++++++++++++++++++++++++++-------------------------------- log.h | 12 +++++++---- 2 files changed, 38 insertions(+), 39 deletions(-) diff --git a/log.c b/log.c index c57bc8d..fd33f64 100644 --- a/log.c +++ b/log.c @@ -47,36 +47,36 @@ int log_to_stdout; /* Print to stdout instead of stderr */ #define BEFORE_DAEMON (setlogmask(0) == LOG_MASK(LOG_EMERG)) -#define logfn(name, level) \ -void name(const char *format, ...) { \ - FILE *out = log_to_stdout ? stdout : stderr; \ - struct timespec tp; \ - va_list args; \ - \ - if (setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) { \ - clock_gettime(CLOCK_REALTIME, &tp); \ - fprintf(out, "%lli.%04lli: ", \ - (long long int)tp.tv_sec - log_start, \ - (long long int)tp.tv_nsec / (100L * 1000)); \ - } \ - \ - if ((LOG_MASK(LOG_PRI(level)) & log_mask) || BEFORE_DAEMON) { \ - va_start(args, format); \ - if (log_file != -1) \ - logfile_write(level, format, args); \ - else if (!(setlogmask(0) & LOG_MASK(LOG_DEBUG))) \ - passt_vsyslog(level, format, args); \ - va_end(args); \ - } \ - \ - if ((setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) || \ - (BEFORE_DAEMON && !(log_opt & LOG_PERROR))) { \ - va_start(args, format); \ - (void)vfprintf(out, format, args); \ - va_end(args); \ - if (format[strlen(format)] != '\n') \ - fprintf(out, "\n"); \ - } \ +void logmsg(int pri, const char *format, ...) +{ + FILE *out = log_to_stdout ? stdout : stderr; + struct timespec tp; + va_list args; + + if (setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) { + clock_gettime(CLOCK_REALTIME, &tp); + fprintf(out, "%lli.%04lli: ", + (long long int)tp.tv_sec - log_start, + (long long int)tp.tv_nsec / (100L * 1000)); + } + + if ((LOG_MASK(LOG_PRI(pri)) & log_mask) || BEFORE_DAEMON) { + va_start(args, format); + if (log_file != -1) + logfile_write(pri, format, args); + else if (!(setlogmask(0) & LOG_MASK(LOG_DEBUG))) + passt_vsyslog(pri, format, args); + va_end(args); + } + + if ((setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) || + (BEFORE_DAEMON && !(log_opt & LOG_PERROR))) { + va_start(args, format); + (void)vfprintf(out, format, args); + va_end(args); + if (format[strlen(format)] != '\n') + fprintf(out, "\n"); + } } /* Prefixes for log file messages, indexed by priority */ @@ -89,11 +89,6 @@ const char *logfile_prefix[] = { " ", /* LOG_DEBUG */ }; -logfn(err, LOG_ERR) -logfn(warn, LOG_WARNING) -logfn(info, LOG_INFO) -logfn(debug,LOG_DEBUG) - /** * trace_init() - Set log_trace depending on trace (debug) mode * @enable: Tracing debug mode enabled if non-zero diff --git a/log.h b/log.h index a17171a..b4fb7e9 100644 --- a/log.h +++ b/log.h @@ -6,14 +6,18 @@ #ifndef LOG_H #define LOG_H +#include <syslog.h> + #define LOGFILE_SIZE_DEFAULT (1024 * 1024UL) #define LOGFILE_CUT_RATIO 30 /* When full, cut ~30% size */ #define LOGFILE_SIZE_MIN (5UL * MAX(BUFSIZ, PAGE_SIZE)) -void err(const char *format, ...); -void warn(const char *format, ...); -void info(const char *format, ...); -void debug(const char *format, ...); +void logmsg(int pri, const char *format, ...); + +#define err(...) logmsg(LOG_ERR, __VA_ARGS__) +#define warn(...) logmsg(LOG_WARNING, __VA_ARGS__) +#define info(...) logmsg(LOG_INFO, __VA_ARGS__) +#define debug(...) logmsg(LOG_DEBUG, __VA_ARGS__) #define die(...) \ do { \ -- 2.41.0

1 1

[PATCH] arp: only send ARP replies for --gateway address
by Nikolay Edigaryev 12 Oct '23

12 Oct '23

Problem: when passt/pasta are working in a broadcast domain with more than one host machine, it will answer for all of these machines, except for the one having --address. This is akin to ARP spoofing and breaks connection with these machines if passt/pasta ARP reply arrives before the original one. Solution: only be responsible and send ARP replies for the --gateway's address. --- arp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arp.c b/arp.c index a35c1b6..f873491 100644 --- a/arp.c +++ b/arp.c @@ -67,8 +67,8 @@ int arp(const struct ctx *c, const struct pool *p) !memcmp(am->sip, am->tip, sizeof(am->sip))) return 1; - /* Don't resolve our own address, either. */ - if (!memcmp(am->tip, &c->ip4.addr, sizeof(am->tip))) + /* Don't resolve anything but gateway address. */ + if (memcmp(am->tip, &c->ip4.gw, sizeof(am->tip)) != 0) return 1; ah->ar_op = htons(ARPOP_REPLY); -- 2.39.2 (Apple Git-144)

3 5