- dev - passt

[PATCH 0/2] udp: Fix bugs with saved socket fds
by David Gibson 07 Nov '23

07 Nov '23

We've had some issues with DNS requests starting to fail in long running guests or containers using passt/pasta. With assistance from a reporter, I've managed to track this down to some bugs in our management of saved UDP socket fds. Link: https://bugs.passt.top/show_bug.cgi?id=57 David Gibson (2): udp: Consistently use -1 to indicate un-opened sockets in maps udp: Remove socket from udp_{tap,splice}_map when timed out conf.c | 1 + udp.c | 36 +++++++++++++++++++++++++++--------- udp.h | 1 + 3 files changed, 29 insertions(+), 9 deletions(-) -- 2.41.0

2 5

[PATCH v2 0/3] Some improvements to log functions
by David Gibson 07 Nov '23

07 Nov '23

Several small improvements to the logging functions. Changes since v1: * Added printf warning attributes * Added vlogmsg() David Gibson (3): log: Don't define logging function 4 times log: Enable format warnings log: Add vlogmsg() Makefile | 3 ++- conf.c | 2 +- log.c | 72 +++++++++++++++++++++++++++++--------------------------- log.h | 14 +++++++---- packet.c | 7 +++--- pasta.c | 2 +- tcp.c | 13 ++++++---- 7 files changed, 63 insertions(+), 50 deletions(-) -- 2.41.0

2 5

[PATCH] tcp: Remove remaining declaration of tcp_l2_mh
by Laurent Vivier 07 Nov '23

07 Nov '23

Use of tcp_l2_mh has been removed in commit 38fbfdbcb95d, but its declaration and initialization are always in the code. Remove them as they are useless. Fixes: 38fbfdbcb95d ("tcp: Get rid of iov with cached MSS, drop sendmmsg(), add deferred flush") Cc: sbrivio(a)redhat.com Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/tcp.c b/tcp.c index 945023c5b442..386cd015be1c 100644 --- a/tcp.c +++ b/tcp.c @@ -515,8 +515,6 @@ static struct iovec tcp6_l2_iov [TCP_FRAMES_MEM]; static struct iovec tcp4_l2_flags_iov [TCP_FRAMES_MEM]; static struct iovec tcp6_l2_flags_iov [TCP_FRAMES_MEM]; -static struct mmsghdr tcp_l2_mh [TCP_FRAMES_MEM]; - /* sendmsg() to socket */ static struct iovec tcp_iov [UIO_MAXIOV]; @@ -3143,7 +3141,6 @@ static void tcp_sock_refill_init(const struct ctx *c) */ int tcp_init(struct ctx *c) { - int i; #ifndef HAS_GETRANDOM int dev_random = open("/dev/random", O_RDONLY); unsigned int random_read = 0; @@ -3172,9 +3169,6 @@ int tcp_init(struct ctx *c) exit(EXIT_FAILURE); } - for (i = 0; i < ARRAY_SIZE(tcp_l2_mh); i++) - tcp_l2_mh[i] = (struct mmsghdr) { .msg_hdr.msg_iovlen = 1 }; - if (c->ifi4) tcp_sock4_iov_init(c); -- 2.41.0

3 2

[PATCH v2 00/11] tcp_splice: Better exploit symmetry between sides of connection
by David Gibson 07 Nov '23

07 Nov '23

For spliced connections, both "sides" are sockets, and for many purposes how we deal with each side is symmetric. Currently, however, we track the information for each side in independent fields in the structure, meaning we can't easily exploit that symmetry. This makes a number of reorganizations of the tcp splice code so that we can explot that symmetry to reduce code size. This will have some additional advantages when we come to integrate with the in-progress unified flow table. Based on top of the interface identifiers and automatic forwarding cleanup series. Changes since v1: * Small updates to comments and commit messages David Gibson (11): tcp_splice: Remove redundant tcp_splice_epoll_ctl() tcp_splice: Correct error handling in tcp_splice_epoll_ctl() tcp_splice: Don't handle EPOLL_CTL_DEL as part of tcp_splice_epoll_ctl() tcp_splice: Remove unnecessary forward declaration tcp_splice: Avoid awkward temporaries in tcp_splice_epoll_ctl() tcp_splice: Don't pool pipes in pairs tcp_splice: Rename sides of connection from a/b to 0/1 tcp_splice: Exploit side symmetry in tcp_splice_timer() tcp_splice: Exploit side symmetry in tcp_splice_connect_finish() tcp_splice: Exploit side symmetry in tcp_splice_destroy() tcp_splice: Simplify selection of socket and pipe sides in socket handler tcp_conn.h | 45 +++--- tcp_splice.c | 389 +++++++++++++++++++++------------------------------ 2 files changed, 179 insertions(+), 255 deletions(-) -- 2.41.0

2 12

[PATCH v2 0/4] Passt Interface Identifiers
by David Gibson 07 Nov '23

07 Nov '23

For the generalisations to forwarding we want to accomplish with the flow table, we will need a more formalised notion of passt "interfaces" - that is way that passt communicates with network, whether that be over L4 sockets (as on the host) or via an L2 tunnel. This series makes a small start on this, by introducing a type to identify passt interfaces. We don't use it for a whole lot yet, but it will become more useful in future. Based on the automatic port forwarding cleanup series Changes since v1: * Don't use a type alias for pif ids, just use bare uint8_t David Gibson (4): udp: Clean up ref initialisation in udp_sock_init() pif: Introduce notion of passt/pasta interface pif: Record originating pif in listening socket refs pif: Pass originating pif to tap handler functions Makefile | 2 +- icmp.c | 4 +++- icmp.h | 4 ++-- passt.h | 1 + pif.h | 27 +++++++++++++++++++++++++++ tap.c | 26 ++++++++++++++++---------- tcp.c | 11 ++++++++--- tcp.h | 7 ++++--- tcp_splice.c | 10 ++++++---- udp.c | 35 ++++++++++++++++++----------------- udp.h | 11 ++++++----- 11 files changed, 92 insertions(+), 46 deletions(-) create mode 100644 pif.h -- 2.41.0

2 5

[PATCH v2 0/9] Clean ups to automatic port forwarding
by David Gibson 07 Nov '23

07 Nov '23

This contains an assortment of cleanups to the code supporting the automatic port forwarding more for past - specifically get_bound_ports() and related functions. This shouldn't mae any functional changes. Based on the series with fixes for new cppcheck-2.12 warnings. Changes since v1: * Some comment tweaks based on Stefano's feedback. David Gibson (9): conf: Cleaner initialisation of default forwarding modes port_fwd: Move automatic port forwarding code to port_fwd.[ch] port_fwd: Better parameterise procfs_scan_listen() util: Add open_in_ns() helper port_fwd: Pre-open /proc/net/* files rather than on-demand port_fwd: Don't NS_CALL get_bound_ports() port_fwd: Split TCP and UDP cases for get_bound_ports() port_fwd: Move port scanning /proc fds into struct port_fwd port_fwd: Simplify get_bound_ports_*() to port_fwd_scan_*() Makefile | 2 +- conf.c | 113 +++++-------------------------------------- conf.h | 1 - passt.h | 5 -- port_fwd.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++++ port_fwd.h | 9 ++++ tcp.c | 39 +-------------- util.c | 118 +++++++++++++++++++++------------------------ util.h | 3 +- 9 files changed, 218 insertions(+), 211 deletions(-) create mode 100644 port_fwd.c -- 2.41.0

2 10

[PATCH] selinux: Allow passt to talk over unconfined_t UNIX domain socket for --fd
by Stefano Brivio 07 Nov '23

07 Nov '23

If passt is started with --fd to talk over a pre-opened UNIX domain socket, we don't really know what label might be associated to it, but at least for an unconfined_t socket, this bit of policy wouldn't belong to anywhere else: enable that here. This is rather loose, of course, but on the other hand passt will sandbox itself into an empty filesystem, so we're not really adding much to the attack surface except for what --fd is supposed to do. Reported-by: Matej Hrica <mhrica(a)redhat.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2247221 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Same with this one: I'm posting this to ease reviews, but I just applied it as I don't actually expect reviews on SELinux rules. :) contrib/selinux/passt.te | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index ea768d9..401c9c3 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -124,3 +124,4 @@ allow passt_t self:icmp_socket { bind create setopt read write }; allow passt_t user_tmp_t:dir { add_name write }; allow passt_t user_tmp_t:file { create open }; allow passt_t user_tmp_t:sock_file { create read write unlink }; +allow passt_t unconfined_t:unix_stream_socket { read write }; -- 2.39.2

1 0

[PATCH 00/11] tcp_splice: Better exploit symmetry between sides of connection
by David Gibson 06 Nov '23

06 Nov '23

For spliced connections, both "sides" are sockets, and for many purposes how we deal with each side is symmetric. Currently, however, we track the information for each side in independent fields in the structure, meaning we can't easily exploit that symmetry. This makes a number of reorganizations of the tcp splice code so that we can explot that symmetry to reduce code size. This will have some additional advantages when we come to integrate with the in-progress unified flow table. Based on top of the interface identifiers and automatic forwarding cleanup series. David Gibson (11): tcp_splice: Remove redundant tcp_splice_epoll_ctl() tcp_splice: Correct error handling in tcp_splice_epoll_ctl() tcp_splice: Don't handle EPOLL_CTL_DEL as part of tcp_splice_epoll_ctl() tcp_splice: Remove unnecessary forward declaration tcp_splice: Avoid awkward temporaries in tcp_splice_epoll_ctl() tcp_splice: Don't pool pipes in pairs tcp_splice: Rename sides of connection from a/b to 0/1 tcp_splice: Exploit side symmetry in tcp_splice_timer() tcp_splice: Exploit side symmetry in tcp_splice_connect_finish() tcp_splice: Exploit side symmetry in tcp_splice_destroy() tcp_splice: Simplify selection of socket and pipe sides in socket handler tcp_conn.h | 45 +++--- tcp_splice.c | 389 +++++++++++++++++++++------------------------------ 2 files changed, 179 insertions(+), 255 deletions(-) -- 2.41.0

2 22

[PATCH 0/4] Passt Interface Identifiers
by David Gibson 04 Nov '23

04 Nov '23

For the generalisations to forwarding we want to accomplish with the flow table, we will need a more formalised notion of passt "interfaces" - that is way that passt communicates with network, whether that be over L4 sockets (as on the host) or via an L2 tunnel. This series makes a small start on this, by introducing a type to identify passt interfaces. We don't use it for a whole lot yet, but it will become more useful in future. David Gibson (4): udp: Clean up ref initialisation in udp_sock_init() pif: Introduce notion of passt/pasta interface pif: Record originating pif in listening socket refs pif: Pass originating pif to tap handler functions Makefile | 2 +- icmp.c | 4 +++- icmp.h | 4 ++-- passt.h | 1 + pif.h | 36 ++++++++++++++++++++++++++++++++++++ tap.c | 26 ++++++++++++++++---------- tcp.c | 11 ++++++++--- tcp.h | 7 ++++--- tcp_splice.c | 10 ++++++---- udp.c | 35 ++++++++++++++++++----------------- udp.h | 11 ++++++----- 11 files changed, 101 insertions(+), 46 deletions(-) create mode 100644 pif.h -- 2.41.0

2 6

[PATCH 0/9] Clean ups to automatic port forwarding
by David Gibson 03 Nov '23

03 Nov '23

This contains an assortment of cleanups to the code supporting the automatic port forwarding more for past - specifically get_bound_ports() and related functions. This shouldn't mae any functional changes. Based on the series with fixes for new cppcheck-2.12 warnings. David Gibson (9): conf: Cleaner initialisation of default forwarding modes port_fwd: Move automatic port forwarding code to port_fwd.[ch] port_fwd: Better parameterise procfs_scan_listen() util: Add open_in_ns() helper port_fwd: Pre-open /proc/net/* files rather than on-demand port_fwd: Don't NS_CALL get_bound_ports() port_fwd: Split TCP and UDP cases for get_bound_ports() port_fwd: Move port scanning /proc fds into struct port_fwd port_fwd: Simplify get_bound_ports_*() to port_fwd_scan_*() Makefile | 2 +- conf.c | 113 +++++-------------------------------------- conf.h | 1 - passt.h | 5 -- port_fwd.c | 139 +++++++++++++++++++++++++++++++++++++++++++++++++++++ port_fwd.h | 9 ++++ tcp.c | 39 +-------------- util.c | 104 +++++++++++++++------------------------ util.h | 3 +- 9 files changed, 204 insertions(+), 211 deletions(-) create mode 100644 port_fwd.c -- 2.41.0

2 13