- dev - passt

passt: new version 2023_03_17.dd23496 available
by Stefano Brivio 17 Mar '23

17 Mar '23

The new version with tag 2023_03_17.dd23496 includes the following changes: dd23496 fedora: Refresh SELinux labels in scriptlets, require -selinux package 87a6550 Makefile: Enable external override for TARGET 7727804 passt.1: Fix description of --mtu option 4e6178f log: Avoid time_t/__syscall_slong_t format mismatch with long int on X32 ABI https://passt.top/passt/log/?qt=range&q=2023_03_10.70c0765..2023_03_17.dd23… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5653690/ permanent mirror: https://passt.top/builds/copr/0^20230317.gdd23496/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdd23496-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0dd23496-1_all.deb -- Stefano

1 0

[PATCH] fedora: Refresh SELinux labels in scriptlets, require -selinux package
by Stefano Brivio 16 Mar '23

16 Mar '23

Instead of: https://fedoraproject.org/wiki/SELinux_Policy_Modules_Packaging_Draft follow this: https://fedoraproject.org/wiki/PackagingDrafts/SELinux_Independent_Policy which seems to make more sense and fixes the issue that, on a fresh install, without a reboot, the file contexts for the binaries are not actually updated. In detail: - labels are refreshed using the selinux_relabel_pre and selinux_relabel_post on install, upgrade, and uninstall - use the selinux_modules_install and selinux_modules_uninstall macros, instead of calling 'semodule' directly (no functional changes in our case) - require the -selinux package on SELinux-enabled environments and if the current system policy is "targeted" Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 51cad90..f6aa117 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -8,6 +8,7 @@ # Author: Stefano Brivio <sbrivio(a)redhat.com> %global git_hash {{{ git_head }}} +%global selinuxtype targeted Name: passt Version: {{{ git_version }}} @@ -19,6 +20,7 @@ URL: https://passt.top/ Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz BuildRequires: gcc, make, checkpolicy, selinux-policy-devel +Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) %description passt implements a translation layer between a Layer-2 network interface and @@ -66,13 +68,21 @@ install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/p install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if popd +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + %post selinux -semodule -i %{_datadir}/selinux/packages/%{name}/passt.pp 2>/dev/null || : -semodule -i %{_datadir}/selinux/packages/%{name}/pasta.pp 2>/dev/null || : +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/passt.pp +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{name}/pasta.pp + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} passt + %selinux_modules_uninstall -s %{selinuxtype} pasta +fi -%preun selinux -semodule -r passt 2>/dev/null || : -semodule -r pasta 2>/dev/null || : +%posttrans selinux +%selinux_relabel_post -s %{selinuxtype} %files %license LICENSES/{AGPL-3.0-or-later.txt,BSD-3-Clause.txt} -- 2.39.2

1 0

[PATCH] log: Avoid time_t/__syscall_slong_t format mismatch with long int on X32 ABI
by Stefano Brivio 14 Mar '23

14 Mar '23

On X32 (ILP32 using AMD64 system call ABI) and glibc, struct timespec::tv_nsec is __syscall_slong_t and not a long int, see also https://sourceware.org/bugzilla/show_bug.cgi?id=16437 and timespec(3type). Fine, we could cast that down to long and be done with it. But it turns out that also time_t (not guaranteed to be equivalent to any type) is a long long int, and there we can't downcast. To keep it simple, cast both to long long int, and change formats to %lli, to avoid format warnings from gcc. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- log.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/log.c b/log.c index d2f08fa..d7411ba 100644 --- a/log.c +++ b/log.c @@ -53,9 +53,9 @@ void name(const char *format, ...) { \ \ if (setlogmask(0) & LOG_MASK(LOG_DEBUG) && log_file == -1) { \ clock_gettime(CLOCK_REALTIME, &tp); \ - fprintf(stderr, "%li.%04li: ", \ - tp.tv_sec - log_start, \ - tp.tv_nsec / (100L * 1000)); \ + fprintf(stderr, "%lli.%04lli: ", \ + (long long int)tp.tv_sec - log_start, \ + (long long int)tp.tv_nsec / (100L * 1000)); \ } \ \ if ((LOG_MASK(LOG_PRI(level)) & log_mask) || BEFORE_DAEMON) { \ @@ -225,8 +225,9 @@ static void logfile_rotate_fallocate(int fd, struct timespec *ts) return; n = snprintf(buf, BUFSIZ, - "%s - log truncated at %li.%04li", log_header, - ts->tv_sec - log_start, ts->tv_nsec / (100L * 1000)); + "%s - log truncated at %lli.%04lli", log_header, + (long long int)(ts->tv_sec - log_start), + (long long int)(ts->tv_nsec / (100L * 1000))); /* Avoid partial lines by padding the header with spaces */ nl = memchr(buf + n + 1, '\n', BUFSIZ - n - 1); @@ -256,9 +257,9 @@ static void logfile_rotate_move(int fd, struct timespec *ts) char buf[BUFSIZ], *nl; header_len = snprintf(buf, BUFSIZ, - "%s - log truncated at %li.%04li\n", log_header, - ts->tv_sec - log_start, - ts->tv_nsec / (100L * 1000)); + "%s - log truncated at %lli.%04lli\n", log_header, + (long long int)(ts->tv_sec - log_start), + (long long int)(ts->tv_nsec / (100L * 1000))); if (lseek(fd, 0, SEEK_SET) == -1) return; if (write(fd, buf, header_len) == -1) @@ -349,8 +350,9 @@ void logfile_write(int pri, const char *format, va_list ap) if (clock_gettime(CLOCK_REALTIME, &ts)) return; - n = snprintf(buf, BUFSIZ, "%li.%04li: %s", - ts.tv_sec - log_start, ts.tv_nsec / (100L * 1000), + n = snprintf(buf, BUFSIZ, "%lli.%04lli: %s", + (long long int)(ts.tv_sec - log_start), + (long long int)(ts.tv_nsec / (100L * 1000)), logfile_prefix[pri]); n += vsnprintf(buf + n, BUFSIZ - n, format, ap); -- 2.39.2

2 1

[PATCH] fedora: Install SELinux interface files to shared include directory
by Stefano Brivio 10 Mar '23

10 Mar '23

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 7f67bee..62713a8 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -61,7 +61,9 @@ ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx pushd contrib/selinux make -f %{_datadir}/selinux/devel/Makefile install -p -m 644 -D passt.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/passt.pp +install -p -m 644 -D passt.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/passt.if install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{name}/pasta.pp +install -p -m 644 -D pasta.if %{buildroot}%{_datadir}/selinux/devel/include/contrib/pasta.if popd %post selinux @@ -93,7 +95,9 @@ semodule -r pasta 2>/dev/null || : %files selinux %dir %{_datadir}/selinux/packages/%{name} %{_datadir}/selinux/packages/%{name}/passt.pp +%{_datadir}/selinux/devel/include/passt.if %{_datadir}/selinux/packages/%{name}/pasta.pp +%{_datadir}/selinux/devel/include/pasta.if %changelog {{{ passt_git_changelog }}} -- 2.39.2

1 0

[PATCH 0/3] Clean up SELinux policy, split interface in smaller bits
by Stefano Brivio 10 Mar '23

10 Mar '23

Stefano Brivio (3): contrib/selinux: Drop "example" from headers: this is the actual policy contrib/selinux: Drop unused passt_read_data() interface contrib/selinux: Split interfaces into smaller bits contrib/selinux/passt.fc | 2 +- contrib/selinux/passt.if | 81 ++++++++++++++++++++++++++++++---------- contrib/selinux/passt.te | 2 +- contrib/selinux/pasta.fc | 2 +- contrib/selinux/pasta.if | 2 +- contrib/selinux/pasta.te | 2 +- 6 files changed, 67 insertions(+), 24 deletions(-) -- 2.39.2

1 3

[libvirt PATCH 0/4] qemu/security: start passt process with correct SELinux label
by Laine Stump 10 Mar '23

10 Mar '23

All the necessary explanation is in Path 3/4 We may want to turn on this same behavior for some other external processes, but right now the one we need it for is passt. Resolves: https://bugzilla.redhat.com/2172267 Laine Stump (4): util: add an API to retrieve the resolved path to a virCommand's binary security: make args to virSecuritySELinuxContextAddRange() const security: make it possible to set SELinux label of child process from its binary qemu: set SELinux label of passt process to its own binary's label src/libvirt_private.syms | 1 + src/qemu/qemu_dbus.c | 2 +- src/qemu/qemu_passt.c | 2 +- src/qemu/qemu_process.c | 2 +- src/qemu/qemu_security.c | 5 ++- src/qemu/qemu_security.h | 1 + src/qemu/qemu_slirp.c | 2 +- src/qemu/qemu_tpm.c | 3 +- src/qemu/qemu_vhost_user_gpu.c | 2 +- src/security/security_apparmor.c | 1 + src/security/security_dac.c | 1 + src/security/security_driver.h | 1 + src/security/security_manager.c | 8 +++- src/security/security_manager.h | 1 + src/security/security_nop.c | 1 + src/security/security_selinux.c | 77 ++++++++++++++++++++++++++++++-- src/security/security_stack.c | 5 ++- src/util/vircommand.c | 51 ++++++++++++++++----- src/util/vircommand.h | 1 + 19 files changed, 143 insertions(+), 24 deletions(-) -- 2.39.2

3 7

passt: new version 2023_03_09.7c7625d available
by Stefano Brivio 09 Mar '23

09 Mar '23

The new version with tag 2023_03_09.7c7625d includes the following changes: 7c7625d README: Update Features section, plus minor improvements 294d6dc contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0 42fb625 contrib: Drop QEMU out-of-tree patches f3cd0f9 contrib: Drop Podman out-of-tree patch, integration is upstream now d7272f1 tcp: Clamp MSS value when queueing data to tap, also for pasta bb2b67c conf: Terminate on EMFILE or ENFILE on sockets for port mapping 5aea2f8 tcp, udp: Fix partial success return codes in {tcp,udp}_sock_init() 73992c4 tcp, udp, util: Pass socket creation errors all the way up 5068761 util: Carry own definition of __bswap_constant{16,32} 89e38f5 treewide: Fix header includes to build with musl 5c58fea conf, passt: Rename stderr to force_stderr fde8004 netlink: Use 8 KiB * netlink message header size as response buffer a9c59dd conf, icmp, tcp, udp: Add options to bind to outbound address and interface 70148ce conf, passt.h: Rename "outbound" interface to "template" interface d361fe6 contrib/selinux: Let interface users set paths for log, PID, socket files de9b0cb contrib/selinux: Allow binding and connecting to all UDP and TCP ports 41bc669 contrib/selinux: Let passt write to stdout and stderr when it starts 009af75 contrib/selinux: Drop duplicate init_daemon_domain() rule 8323621 udp: Fix signedness warning on 32-bits architectures f6b6b66 Makefile: Fix SuperH 4 builds: it's AUDIT_ARCH_SH, not AUDIT_ARCH_SH4 0d8c114 Makefile, seccomp.sh: Fix cross-builds, adjust syscalls list to compiler https://passt.top/passt/log/?qt=range&q=2023_02_27.c538ee8..2023_03_09.7c76… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5617634/ permanent mirror: https://passt.top/builds/copr/0^20230309.g7c7625d/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g7c7625d-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_7c7625d-1_all.deb -- Stefano

1 0

[PATCH v4 0/2] Implement explicit outbound address and interface selection
by Stefano Brivio 09 Mar '23

09 Mar '23

v4: In 2/2, use --outbound-if4 and --outbound-if6, by default, to also assign "template" interface indices Stefano Brivio (2): conf, passt.h: Rename "outbound" interface to "template" interface conf, icmp, tcp, udp: Add options to bind to outbound address and interface conf.c | 112 ++++++++++++++++++++++++++++++++++++++++++++++++-------- icmp.c | 24 ++++++++++-- passt.1 | 29 ++++++++++++++- passt.h | 14 ++++++- tcp.c | 60 ++++++++++++++++++++++++++++++ udp.c | 54 ++++++++++++++++++--------- 6 files changed, 252 insertions(+), 41 deletions(-) -- 2.39.2

2 4

[PATCH 0/2] Implement explicit outbound address and interface selection
by Stefano Brivio 09 Mar '23

09 Mar '23

Stefano Brivio (2): conf, passt.h: Rename "outbound" interface to "template" interface conf, icmp, tcp, udp: Add options to bind to outbound address and interface conf.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++++++------ icmp.c | 24 +++++++++++++--- passt.1 | 19 ++++++++++++ passt.h | 14 +++++++-- tcp.c | 60 ++++++++++++++++++++++++++++++++++++++ udp.c | 54 +++++++++++++++++++++++----------- 6 files changed, 228 insertions(+), 32 deletions(-) -- 2.39.2

2 7

[PATCH] README: Update Features section, plus minor improvements
by Stefano Brivio 08 Mar '23

08 Mar '23

...it's been a while. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- README.md | 75 +++++++++++++++++++++---------------------------------- 1 file changed, 28 insertions(+), 47 deletions(-) diff --git a/README.md b/README.md index 46cbd9f..1f800b2 100644 --- a/README.md +++ b/README.md @@ -274,8 +274,10 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ starting from 4.18 kernel version * ✅ starting from 3.13 kernel version * ✅ run-time selection of AVX2 build -* ⌚ [_musl_](https://bugs.passt.top/show_bug.cgi?id=4) and - [_uClibc-ng_](https://bugs.passt.top/show_bug.cgi?id=5) +* C libraries: + * ✅ glibc + * ✅ [_musl_](https://bugs.passt.top/show_bug.cgi?id=4) + * ⌚ [_uClibc-ng_](https://bugs.passt.top/show_bug.cgi?id=5) * ⌚ [FreeBSD](https://bugs.passt.top/show_bug.cgi?id=6), [Darwin](https://bugs.passt.top/show_bug.cgi?id=6) * ⌚ [NetBSD](https://bugs.passt.top/show_bug.cgi?id=7), @@ -306,8 +308,8 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ✅ optional NAT, not required * ✅ all protocols * ✅ _pasta_: auto-detection of bound ports -* 🛠 run-time configuration of port ranges without autodetection -* 🛠 configuration of port ranges for autodetection +* ⌚ run-time configuration of port ranges without autodetection +* ⌚ configuration of port ranges for autodetection * 💡 [add](https://lists.passt.top/) [your](https://bugs.passt.top/) [ideas](https://chat.passt.top) @@ -327,33 +329,37 @@ speeding up local connections, and usually requiring NAT. _pasta_: * ⌚ eBPF support (might not improve performance over vhost-user) ### Interfaces -* ✅ qemu, libvirt support with [`qrap` wrapper](/passt/tree/qrap.c) -* ✅ out-of-tree patches for [qemu](/passt/tree/contrib/qemu) and - [libvirt](/passt/tree/contrib/libvirt) available +* ✅ native [qemu](https://bugs.passt.top/show_bug.cgi?id=11) support (_passt_) +* ✅ native [libvirt](https://bugs.passt.top/show_bug.cgi?id=12) support + (_passt_) * ✅ Podman [integration](https://github.com/containers/podman/pull/16141) + (_pasta_) * ✅ bug-to-bug compatible [_slirp4netns_ replacement](/passt/tree/slirp4netns.sh) * ✅ out-of-tree patch for [Kata Containers](/passt/tree/contrib/kata-containers) available -* 🛠 native [qemu](https://bugs.passt.top/show_bug.cgi?id=11), - [libvirt](https://bugs.passt.top/show_bug.cgi?id=12) support * ⌚ drop-in replacement for VPNKit (rootless Docker) ### Availability +* ✅ official [packages](https://gitlab.com/redhat/centos-stream/rpms/passt) for + CentOS Stream * ✅ official [packages](https://tracker.debian.org/pkg/passt) for Debian * ✅ official [packages](https://src.fedoraproject.org/rpms/passt) for Fedora +* ✅ official [packages](https://packages.ubuntu.com/lunar/passt) for Ubuntu +* ✅ unofficial [packages](https://aur.archlinux.org/packages/passt-git) for + Arch Linux * ✅ unofficial - [packages](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for CentOS - Stream, EPEL, Mageia + [packages](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) for EPEL, + Mageia +* 🛠 official + [packages](https://build.opensuse.org/package/show/Virtualization:containers… + for openSUSE * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 static builds for other RPM-based distributions * ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64 - static builds for Debian-based distributions + static builds for other Debian-based distributions * ✅ testing on non-x86_64 architectures (aarch64, armv7l, i386, ppc64, ppc64le, s390x) -* 🛠 official - [openSUSE packages](https://build.opensuse.org/package/show/home:dfaggioli:devel/pass… -* ⌚ official packages for Arch Linux ### Services * ✅ built-in [ARP proxy](/passt/tree/arp.c) @@ -534,16 +540,7 @@ See also the [test logs](/builds/latest/test/). cd passt make - * alternatively, install one of the available packages: - - * [Debian](https://tracker.debian.org/pkg/passt) (official) - * [Fedora](https://src.fedoraproject.org/rpms/passt) (official) - * [CentOS Stream](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [EPEL](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [openSUSE](https://build.opensuse.org/package/show/home:dfaggioli:devel/pass… (unofficial) - * [Debian-based](/builds/latest/x86_64/) (unofficial, from static x86_64 builds) - * [Other RPM-based distributions](/builds/latest/x86_64/) (unofficial, from static x86_64 builds) + * alternatively, install one of the [available packages](#availability) Static binaries and packages are simply built with: @@ -558,17 +555,9 @@ See also the [test logs](/builds/latest/test/). doc/demo.sh -* alternatively, you can use libvirt, with - [this patch](/passt/tree/libvirt/0001-conf-Introduce-support-for-UNIX-domain-socket-as-qem.patch), - to start qemu (with [these patches](/passt/tree/contrib/qemu)), and this kind - of network interface configuration: - - <interface type='client'> - <mac address='52:54:00:02:6b:60'/> - <source path='/tmp/passt.socket'/> - <model type='virtio'/> - <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> - </interface> +* alternatively, you can use + [libvirt](https://libvirt.org/formatdomain.html#userspace-slirp-or-passt-con… + to start QEMU * and that's it, you should now have TCP connections, UDP, and ICMP/ICMPv6 echo working from/to the guest for IPv4 and IPv6 @@ -584,16 +573,7 @@ See also the [test logs](/builds/latest/test/). cd passt make - * alternatively, install one of the available packages: - - * [Debian](https://tracker.debian.org/pkg/passt) (official) - * [Fedora](https://src.fedoraproject.org/rpms/passt) (official) - * [CentOS Stream](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [EPEL](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/) (unofficial) - * [openSUSE](https://build.opensuse.org/package/show/home:dfaggioli:devel/pass… (unofficial) - * [Debian-based](/builds/latest/x86_64/) (unofficial, from static x86_64 builds) - * [Other RPM-based distributions](/builds/latest/x86_64/) (unofficial, from static x86_64 builds) + * alternatively, install one of the [available packages](#availability) Static binaries and packages are simply built with: @@ -655,7 +635,8 @@ See also the [test logs](/builds/latest/test/). * ...or [file a bug](https://bugs.passt.top/enter_bug.cgi) ### [Chat](/passt/chat) -* Somebody might be available on [IRC](https://irc.passt.top) +* Somebody might be available on [IRC](https://irc.passt.top) on `#passt` at + [Libera.Chat](https://libera.chat/) ### Weekly development [meeting](https://pad.passt.top/p/weekly) * Open to everybody! Feel free to join and propose a different time directly on -- 2.39.2

2 1