- dev - passt

passt: new version 2023_06_25.32660ce available
by Stefano Brivio 26 Jun '23

26 Jun '23

The new version with tag 2023_06_25.32660ce includes the following changes: 32660ce pasta: include errno in error message 594dce6 isolation: keep CAP_SYS_PTRACE when required 5b646b9 conf: Accept -a and -g without --config-net in pasta mode d034fb6 conf: Make -a/--address really imply --no-copy-addrs db29fd2 seccomp: Make seccomp.sh re-entrancy safe 3c6d1b9 conf, log: On -h / --help, print usage to stdout, not stderr d072ac2 tap: With pasta, don't reset on tap errors, handle write failures https://passt.top/passt/log/?qt=range&q=2023_06_03.429e1a7..2023_06_25.3266… Packages: - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/6113117/ permanent mirror: https://passt.top/builds/copr/0^20230625.g32660ce/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g32660ce-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_32660ce-1_all.deb -- Stefano

1 0

[PATCH] isolation: keep CAP_SYS_PTRACE when required
by Paul Holzinger 26 Jun '23

26 Jun '23

When pasta is started from an existing userns and tries to join the netns from another process it fails to open /proc/$pid/ns/net due the missing CAP_SYS_PTRACE capability in the --netns-only case. A simple reproducer for this. First create a userns: $ unshare -r Then create a new netns inside it and try to join that netns with pasta. $ unshare -n sleep inf & $ pasta --config-net --netns /proc/$!/ns/net Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- isolation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/isolation.c b/isolation.c index 19932bf..1866724 100644 --- a/isolation.c +++ b/isolation.c @@ -202,9 +202,11 @@ void isolate_initial(void) * a mapping from UID 0, which only happens with pasta spawning a child * from a non-init user namespace (pasta can't run as root), we need to * retain CAP_SETFCAP too. + * We also need to keep CAP_SYS_PTRACE in order to join an existing netns + * path under /proc/$pid/ns/net which was created in the same userns. */ if (!ns_is_init() && !geteuid()) - keep |= BIT(CAP_SETFCAP); + keep |= BIT(CAP_SETFCAP) | BIT(CAP_SYS_PTRACE); drop_caps_ep_except(keep); } -- 2.41.0

2 1

[PATCH] pasta: include errno in error message
by Paul Holzinger 26 Jun '23

26 Jun '23

When the open() or setns() calls fails pasta exits early and prints an error. However it did not include the errno so it was impossible to know why the syscall failed. Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- pasta.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pasta.c b/pasta.c index 13ab18b..27809d2 100644 --- a/pasta.c +++ b/pasta.c @@ -136,14 +136,14 @@ void pasta_open_ns(struct ctx *c, const char *netns) nfd = open(netns, O_RDONLY | O_CLOEXEC); if (nfd < 0) - die("Couldn't open network namespace %s", netns); + die("Couldn't open network namespace %s: %s", netns, strerror(errno)); c->pasta_netns_fd = nfd; NS_CALL(ns_check, c); if (c->pasta_netns_fd < 0) - die("Couldn't switch to pasta namespaces"); + die("Couldn't switch to pasta namespaces: %s", strerror(errno)); if (!c->no_netns_quit) { char buf[PATH_MAX] = { 0 }; @@ -261,7 +261,7 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, NS_CALL(pasta_wait_for_ns, c); if (c->pasta_netns_fd < 0) - die("Failed to join network namespace"); + die("Failed to join network namespace: %s", strerror(errno)); } /** -- 2.41.0

3 2

[PATCH] seccomp: Make seccomp.sh re-entrancy safe
by David Gibson 26 Jun '23

26 Jun '23

seccomp.sh generates seccomp.h piece by piece using >> directives. This means that if two instances of seccomp.h are run concurrently a corrupted version of seccomp.h will be generated. Amongst other problems this can cause spurious failures on clang-tidy. Alter seccomp.sh to build the output in a temporary file and atomic move it to seccomp.h, so concurrent invocations will still result in valud output. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- seccomp.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/seccomp.sh b/seccomp.sh index 092c24e0..e1224e0d 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -15,7 +15,7 @@ TMP="$(mktemp)" IN="$@" -OUT="seccomp.h" +OUT="$(mktemp)" [ -z "${ARCH}" ] && ARCH="$(uname -m)" [ -z "${CC}" ] && CC="cc" @@ -53,7 +53,7 @@ BST=' BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, @NR@, @R@, @L@),' # cleanup() - Remove temporary file if it exists cleanup() { - rm -f "${TMP}" + rm -f "${TMP}" "${OUT}" } trap "cleanup" EXIT @@ -254,3 +254,5 @@ for __p in ${__profiles}; do gen_profile "${__p}" ${__calls} done + +mv "${OUT}" seccomp.h -- 2.41.0

2 2

[PATCH] conf: Accept -a and -g without --config-net in pasta mode
by Stefano Brivio 23 Jun '23

23 Jun '23

While --no-copy-addrs and --no-copy-routes only make sense with --config-net, and they are implied on -g and -a, respectively, that doesn't mean we should refuse -a or -g without --config-net: they are still relevant for a number of things (including DHCP/DHCPv6/NDP configuration). Reported-by: Gianluca Stivan <me(a)yawnt.com> Fixes: cc9d16758be6 ("conf, pasta: With --config-net, copy all addresses by default") Fixes: da54641f140e ("conf, pasta: With --config-net, copy all routes by default") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- This is based on my previous patch: "conf: Make -a/--address really imply --no-copy-addrs" conf.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/conf.c b/conf.c index 16a3e64..820d597 100644 --- a/conf.c +++ b/conf.c @@ -1197,6 +1197,7 @@ void conf(struct ctx *c, int argc, char **argv) }; struct get_bound_ports_ns_arg ns_ports_arg = { .c = c }; char userns[PATH_MAX] = { 0 }, netns[PATH_MAX] = { 0 }; + bool copy_addrs_opt = false, copy_routes_opt = false; bool v4_only = false, v6_only = false; char *runas = NULL, *logfile = NULL; struct in6_addr *dns6 = c->ip6.dns; @@ -1362,14 +1363,14 @@ void conf(struct ctx *c, int argc, char **argv) die("--no-copy-routes is for pasta mode only"); warn("--no-copy-routes will be dropped soon"); - c->no_copy_routes = 1; + c->no_copy_routes = copy_routes_opt = true; break; case 19: if (c->mode != MODE_PASTA) die("--no-copy-addrs is for pasta mode only"); warn("--no-copy-addrs will be dropped soon"); - c->no_copy_addrs = 1; + c->no_copy_addrs = copy_addrs_opt = true; break; case 20: if (logfile) @@ -1682,10 +1683,10 @@ void conf(struct ctx *c, int argc, char **argv) die("Options --socket and --fd are mutually exclusive"); if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { - if (c->no_copy_routes) - die("Option --no-copy-routes needs --config-net"); - if (c->no_copy_addrs) - die("Option --no-copy-addrs needs --config-net"); + if (copy_routes_opt) + die("--no-copy-routes needs --config-net"); + if (copy_addrs_opt) + die("--no-copy-addrs needs --config-net"); } if (!ifi4 && *c->ip4.ifname_out) -- 2.39.2

1 0

[RFC v2] tcp: add support for MSG_PEEK with offset
by Jon Maloy 23 Jun '23

23 Jun '23

When reading received messages with MSG_PEEK, we would like to eliminate the need to read the leading bytes over and over again only to reach the part of the message we really want. We now introduce support for this feature, when supported by the kernel. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- tcp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tcp.c b/tcp.c index 0ed9bfa..ebaf520 100644 --- a/tcp.c +++ b/tcp.c @@ -500,7 +500,6 @@ tcp6_l2_buf[TCP_FRAMES_MEM]; static unsigned int tcp6_l2_buf_used; /* recvmsg()/sendmsg() data for tap */ -static char tcp_buf_discard [MAX_WINDOW]; static struct iovec iov_sock [TCP_FRAMES_MEM + 1]; static struct iovec tcp4_l2_iov [TCP_FRAMES_MEM]; @@ -2239,7 +2238,7 @@ static int tcp_data_from_sock(struct ctx *c, struct tcp_tap_conn *conn) mh_sock.msg_iov = iov_sock; mh_sock.msg_iovlen = fill_bufs + 1; - iov_sock[0].iov_base = tcp_buf_discard; + iov_sock[0].iov_base = NULL; iov_sock[0].iov_len = already_sent; if (( v4 && tcp4_l2_buf_used + fill_bufs > ARRAY_SIZE(tcp4_l2_buf)) || -- 2.39.0

1 0

[PATCH] conf: Make -a/--address really imply --no-copy-addrs
by Stefano Brivio 23 Jun '23

23 Jun '23

I wrote it in commit message and man page, but not in conf()... Note that -g/--gateway correctly implies --no-copy-routes already. This fixes Podman's tests: podman networking with pasta(1) - IPv4 address assignment podman networking with pasta(1) - IPv4 default route assignment where we pass -a and -g to assign an address and a default gateway that's compatible with it, but -a doesn't disable the copy of addresses, so we ignore -a, and the default gateway is incompatible with the addresses we copy -- hence no routes in the container. Link: https://github.com/containers/podman/pull/18612 Fixes: cc9d16758be6 ("conf, pasta: With --config-net, copy all addresses by default") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/conf.c b/conf.c index db9d095..16a3e64 100644 --- a/conf.c +++ b/conf.c @@ -1502,6 +1502,9 @@ void conf(struct ctx *c, int argc, char **argv) break; case 'a': + if (c->mode == MODE_PASTA) + c->no_copy_addrs = 1; + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr) && inet_pton(AF_INET6, optarg, &c->ip6.addr) && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr) && -- 2.39.2

1 0

Option parsing: Allow the same option multiple times
by Paul Holzinger 20 Jun '23

20 Jun '23

Hi all, following up on a quick discussion with Stefano on IRC. passt/pasta currently rejects most (not all) options when specified multiple times, i.e. pasta -I eth0 -I eth1 ... fails. I think it makes more sense to just use the last one instead. My use case: In podman I added a new containers.conf option[1] which allows users to set default pasta cli options. However users can also add options on the podman cli with podman run --net=pasta:... For me it would make the most sense to just append those to the config options and then let pasta deal with it. This allows some form of overwrite mechanism, i.e. by default I may have "-I" , "eth0" in containers.conf but for one specific container I want to use a different interface name and set --net=pasta:-I,eth1 on the cli. Then podman should just hand "-I eth0 -I eth1" to pasta and then pasta picks the last one. If we keep the current behavior it means I am forced to parse the options in podman and dedup them which is hard to maintain as podman would need to keep up with pasta upstream. I am willing to send a patch to change this so please let me know if anyone would object to that. [1] https://github.com/containers/common/commit/da3ac5d6d025f2933e655a0541eddbc… Thanks, Paul

3 5

[PATCH 0/2] Introduce --log-fd option
by Michal Privoznik 13 Jun '23

13 Jun '23

The idea behind this is so that libvirt can create the log file, set all DAC/SELinux labels and just pass pre-opened FD to passt. You can view my WIP patches for libvirt here: https://gitlab.com/MichalPrivoznik/libvirt/-/commit/5bbe40087d6888a7c4031a2… Michal Privoznik (2): util: Introduce set_cloexec() conf, log: Introduce --log-fd option conf.c | 29 +++++++++++++++++++++++++---- log.c | 17 ++++++++++++----- log.h | 2 +- passt.1 | 5 +++++ util.c | 17 +++++++++++++++++ util.h | 1 + 6 files changed, 61 insertions(+), 10 deletions(-) -- 2.39.3

3 9

[PATCH v2] conf, log: On -h / --help, print usage to stdout, not stderr
by Stefano Brivio 05 Jun '23

05 Jun '23

Erik suggests that this makes it easier to grep for options, and with --help we're anyway printing usage information as expected, not as part of an error report. While at it: on -h, we should exit with 0. Reported-by: Erik Sjölund <erik.sjolund(a)gmail.com> Link: https://bugs.passt.top/show_bug.cgi?id=52 Link: https://bugs.passt.top/show_bug.cgi?id=53 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- v2: Exit with 0, non with 1 as also reported by Erik conf.c | 23 ++++++++++++++++++----- log.c | 8 +++++--- log.h | 1 + 3 files changed, 24 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index ffff235..87dec50 100644 --- a/conf.c +++ b/conf.c @@ -717,10 +717,11 @@ static unsigned int conf_ip6(unsigned int ifi, } /** - * usage() - Print usage and exit + * print_usage() - Print usage, exit with given status code * @name: Executable name + * @status: Status code for exit() */ -static void usage(const char *name) +static void print_usage(const char *name, int status) { if (strstr(name, "pasta")) { info("Usage: %s [OPTION]... [COMMAND] [ARGS]...", name); @@ -856,7 +857,7 @@ static void usage(const char *name) info( " SPEC is as described for TCP above"); info( " default: none"); - exit(EXIT_FAILURE); + exit(status); pasta_opts: @@ -906,7 +907,16 @@ pasta_opts: info( " Don't copy all addresses to namespace"); info( " --ns-mac-addr ADDR Set MAC address on tap interface"); - exit(EXIT_FAILURE); + exit(status); +} + +/** + * usage() - Print usage and exit with failure + * @name: Executable name + */ +static void usage(const char *name) +{ + print_usage(name, EXIT_FAILURE); } /** @@ -1630,8 +1640,11 @@ void conf(struct ctx *c, int argc, char **argv) case 'U': /* Handle these later, once addresses are configured */ break; - case '?': case 'h': + log_to_stdout = 1; + print_usage(argv[0], EXIT_SUCCESS); + break; + case '?': default: usage(argv[0]); break; diff --git a/log.c b/log.c index 3a3d101..63d7801 100644 --- a/log.c +++ b/log.c @@ -43,17 +43,19 @@ static char log_header[BUFSIZ]; /* File header, written back on cuts */ static time_t log_start; /* Start timestamp */ int log_trace; /* --trace mode enabled */ +int log_to_stdout; /* Print to stdout instead of stderr */ #define BEFORE_DAEMON (setlogmask(0) == LOG_MASK(LOG_EMERG)) #define logfn(name, level) \ void name(const char *format, ...) { \ + FILE *out = log_to_stdout ? stdout : stderr; \ struct timespec tp; \ va_list args; \ \ if (setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) { \ clock_gettime(CLOCK_REALTIME, &tp); \ - fprintf(stderr, "%lli.%04lli: ", \ + fprintf(out, "%lli.%04lli: ", \ (long long int)tp.tv_sec - log_start, \ (long long int)tp.tv_nsec / (100L * 1000)); \ } \ @@ -70,10 +72,10 @@ void name(const char *format, ...) { \ if ((setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) || \ (BEFORE_DAEMON && !(log_opt & LOG_PERROR))) { \ va_start(args, format); \ - (void)vfprintf(stderr, format, args); \ + (void)vfprintf(out, format, args); \ va_end(args); \ if (format[strlen(format)] != '\n') \ - fprintf(stderr, "\n"); \ + fprintf(out, "\n"); \ } \ } diff --git a/log.h b/log.h index 3aab29d..a17171a 100644 --- a/log.h +++ b/log.h @@ -22,6 +22,7 @@ void debug(const char *format, ...); } while (0) extern int log_trace; +extern int log_to_stdout; void trace_init(int enable); #define trace(...) \ do { \ -- 2.39.2

2 1