- dev - passt

[PATCH 0/4] Further adjustments for SELinux policy files
by Stefano Brivio 08 Mar '23

08 Mar '23

This series addresses a number of issues or inconveniences shown by further testing against libvirt, essentially a 9.1.0 version patched up to fix the current breakage by starting passt in the "passt_t" domain. Stefano Brivio (4): contrib/selinux: Drop duplicate init_daemon_domain() rule contrib/selinux: Let passt write to stdout and stderr when it starts contrib/selinux: Allow binding and connecting to all UDP and TCP ports contrib/selinux: Let interface users set paths for log, PID, socket files contrib/selinux/passt.if | 26 +++++++++++++++++++++++++- contrib/selinux/passt.te | 29 ++++++++++++++++------------- 2 files changed, 41 insertions(+), 14 deletions(-) -- 2.39.2

2 5

[PATCH 1/3] musl adaptations
by KuhnChris 04 Mar '23

04 Mar '23

--- conf.c | 6 +++--- passt.c | 2 +- passt.h | 4 ++-- util.h | 14 ++++++++++++++ 4 files changed, 20 insertions(+), 6 deletions(-) diff --git a/conf.c b/conf.c index 0e512f4..c1dd9ba 100644 --- a/conf.c +++ b/conf.c @@ -1305,13 +1305,13 @@ void conf(struct ctx *c, int argc, char **argv) if (logfile) die("Can't log to both file and stderr"); - if (c->stderr) + if (c->force_stderr) die("Multiple --stderr options given"); - c->stderr = 1; + c->force_stderr = 1; break; case 'l': - if (c->stderr) + if (c->force_stderr) die("Can't log to both stderr and file"); if (logfile) diff --git a/passt.c b/passt.c index 5b8146e..f67213a 100644 --- a/passt.c +++ b/passt.c @@ -241,7 +241,7 @@ int main(int argc, char **argv) conf(&c, argc, argv); trace_init(c.trace); - if (c.stderr || isatty(fileno(stdout))) + if (c.force_stderr || isatty(fileno(stdout))) __openlog(log_name, LOG_PERROR, LOG_DAEMON); quit_fd = pasta_netns_quit_init(&c); diff --git a/passt.h b/passt.h index e0383eb..71d3602 100644 --- a/passt.h +++ b/passt.h @@ -32,7 +32,7 @@ struct tap_l4_msg { union epoll_ref; #include <stdbool.h> - +#include <bits/limits.h> #include "packet.h" #include "icmp.h" #include "port_fwd.h" @@ -197,7 +197,7 @@ struct ctx { int trace; int quiet; int foreground; - int stderr; + int force_stderr; int nofile; char sock_path[UNIX_PATH_MAX]; char pcap[PATH_MAX]; diff --git a/util.h b/util.h index 570094c..7315ce2 100644 --- a/util.h +++ b/util.h @@ -7,7 +7,10 @@ #define UTIL_H #include <stdlib.h> +#include <stdio.h> #include <stdarg.h> +#include <signal.h> +#include <byteswap.h> #include "log.h" @@ -88,6 +91,8 @@ #define MAC_ZERO ((uint8_t [ETH_ALEN]){ 0 }) #define MAC_IS_ZERO(addr) (!memcmp((addr), MAC_ZERO, ETH_ALEN)) +#if defined(__GLIBC__) || defined(__UCLIBC__) + #if __BYTE_ORDER == __BIG_ENDIAN #define htons_constant(x) (x) #define htonl_constant(x) (x) @@ -96,6 +101,15 @@ #define htonl_constant(x) (__bswap_constant_32(x)) #endif +#else + +/* mainly musl fallback */ + +#define htons_constant(x) (x) +#define htonl_constant(x) (x) + +#endif + #define IN4_IS_ADDR_UNSPECIFIED(a) \ ((a)->s_addr == htonl(INADDR_ANY)) #define IN4_IS_ADDR_BROADCAST(a) \ -- 2.38.4

2 5

[PATCH] udp: Fix signedness warning on 32-bits architectures
by Stefano Brivio 01 Mar '23

01 Mar '23

When a ssize_t is an int: udp.c: In function ‘udp_sock_handler’: udp.c:774:23: warning: comparison of integer expressions of different signedness: ‘unsigned int’ and ‘ssize_t’ {aka ‘int’} [-Wsign-compare] 774 | for (i = 0; i < n; i += m) { | ^ udp.c:781:43: warning: comparison of integer expressions of different signedness: ‘unsigned int’ and ‘ssize_t’ {aka ‘int’} [-Wsign-compare] 781 | for (m = 1; i + m < n; m++) { | Change 'i' and 'm' counters in udp_sock_handler() to signed versions, to match ssize_t n. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/udp.c b/udp.c index 20a9ea0..b7cbfdc 100644 --- a/udp.c +++ b/udp.c @@ -754,7 +754,7 @@ void udp_sock_handler(struct ctx *c, union epoll_ref ref, uint32_t events, in_port_t dstport = ref.r.p.udp.udp.port; bool v6 = ref.r.p.udp.udp.v6; struct mmsghdr *mmh_recv; - unsigned int i, m; + int i, m; if (!(events & EPOLLIN)) return; -- 2.39.1

2 1

[PATCH] Makefile, seccomp.sh: Fix cross-builds, adjust syscalls list to compiler
by Stefano Brivio 01 Mar '23

01 Mar '23

Debian cross-building automatic checks: http://crossqa.debian.net/src/passt currently fail because we don't use the right target architecture and compiler while building the system call lists and resolving their numbers in seccomp.sh. Pass ARCH and CC to seccomp.sh and use them. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 2 +- seccomp.sh | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 667ddfb..e5723a7 100644 --- a/Makefile +++ b/Makefile @@ -105,7 +105,7 @@ static: FLAGS += -static -DGLIBC_NO_STATIC_NSS static: clean all seccomp.h: seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) - @ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) + @ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ARCH="$(TARGET_ARCH)" CC="$(CC)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS) passt: $(PASST_SRCS) $(HEADERS) $(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS) diff --git a/seccomp.sh b/seccomp.sh index 31ea8da..b075efd 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -17,6 +17,9 @@ TMP="$(mktemp)" IN="$@" OUT="seccomp.h" +[ -z "${ARCH}" ] && ARCH="$(uname -m)" +[ -z "${CC}" ] && CC="cc" + HEADER="/* This file was automatically generated by $(basename ${0}) */ #ifndef AUDIT_ARCH_PPC64LE @@ -110,7 +113,7 @@ log2() { # $1: Name of syscall syscall_nr() { __in="$(printf "#include <asm-generic/unistd.h>\n#include <sys/syscall.h>\n__NR_%s" ${1})" - __out="$(echo "${__in}" | cc -E -xc - -o - | tail -1)" + __out="$(echo "${__in}" | ${CC} -E -xc - -o - | tail -1)" [ "${__out}" = "__NR_$1" ] && return 1 # Output might be in the form "(x + y)" (seen on armv6l, armv7l) @@ -125,7 +128,7 @@ filter() { case ${__c} in *:*) case ${__c} in - $(uname -m):*) + ${ARCH}:*) __arch_match=1 __c=${__c##*:} ;; -- 2.39.1

2 1

[PATCH] Makefile: Fix SuperH 4 builds: it's AUDIT_ARCH_SH, not AUDIT_ARCH_SH4
by Stefano Brivio 28 Feb '23

28 Feb '23

sh4 builds currently fail because of this: https://buildd.debian.org/status/fetch.php?pkg=passt&arch=sh4&ver=0.0%7Egit… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/Makefile b/Makefile index e5723a7..6f8bd81 100644 --- a/Makefile +++ b/Makefile @@ -31,6 +31,7 @@ AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPC64/PPC/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/PPCLE/PPC64LE/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/MIPS64EL/MIPSEL64/') AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/HPPA/PARISC/') +AUDIT_ARCH := $(shell echo $(AUDIT_ARCH) | sed 's/SH4/SH/') FLAGS := -Wall -Wextra -pedantic -std=c99 -D_XOPEN_SOURCE=700 -D_GNU_SOURCE FLAGS += -D_FORTIFY_SOURCE=2 -O2 -pie -fPIE -- 2.39.1

1 0

passt: new version 2023_02_27.c538ee8 available
by Stefano Brivio 27 Feb '23

27 Feb '23

The new version with tag 2023_02_27.c538ee8 includes the following changes: c538ee8 util: Add own prototype for __clone2() on ia64 b1b75bd contrib/apparmor: Split profile into abstractions, use them 0d547a5 qrap: Generate -netdev as JSON 4f2341f qrap: Introduce machine-specific PCI address base 8828a63 qrap: Drop args in JSON format 16f19c8 qrap: Fix support for pc machines 9cec430 qrap: Fix limits for PCI addresses d2df763 log, conf, tap: Define die() as err() plus exit(), drop cppcheck workarounds fb05a71 doc/demo: Fix and suppress ShellCheck warnings 26a0e4d Fix definitions of SOCKET_MAX, TCP_MAX_CONNS 4f523c3 tcp: Avoid (theoretical) resource leak (CWE-772) Coverity warning a1d5537 tcp: Avoid false (but convoluted) positive Coverity CWE-476 warning 5474bc5 tcp, tcp_splice: Get rid of false positive CWE-394 Coverity warning from fls() a48c5c2 treewide: Disable gcc strict aliasing rules as needed, drop workarounds da46fda tcp: Suppress knownConditionTrueFalse cppcheck false positive 834b9a3 log: Send identifier string in log messages, openlog() won't work for us bad2526 conf, udp: Allow any loopback address to be used as resolver 8ca907a conf: Split add_dns{4,6}() out of get_dns() ddf7097 udp: Actually use host resolver to forward DNS queries https://passt.top/passt/log/?qt=range&q=2023_02_22.4ddbcb9..2023_02_27.c538… Packages: - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5574807/ permanent mirror: https://passt.top/builds/copr/0^20230227.gc538ee8/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Ubuntu tracker: https://packages.ubuntu.com/lunar/passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc538ee8-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c538ee8-1_all.deb -- Stefano

1 0

[PATCH] util: Add own prototype for __clone2() on ia64
by Stefano Brivio 27 Feb '23

27 Feb '23

ia64 needs to use __clone2() as clone() is not available, but glibc doesn't export the prototype. Take it from clone(2) to avoid an implicit declaration: util.c: In function ‘do_clone’: util.c:512:16: warning: implicit declaration of function ‘__clone2’ [-Wimplicit-function-declaration] 512 | return __clone2(fn, stack_area + stack_size / 2, stack_size / 2, | ^~~~~~~~ Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- util.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/util.c b/util.c index c5ee1c0..799173f 100644 --- a/util.c +++ b/util.c @@ -495,6 +495,15 @@ int write_file(const char *path, const char *buf) return len == 0 ? 0 : -1; } +#ifdef __ia64__ +/* Needed by do_clone() below: glibc doesn't export the prototype of __clone2(), + * use the description from clone(2). + */ +int __clone2(int (*fn)(void *), void *stack_base, size_t stack_size, int flags, + void *arg, ... /* pid_t *parent_tid, struct user_desc *tls, + pid_t *child_tid */ ); +#endif + /** * do_clone() - Wrapper of __clone2() for ia64, clone() for other architectures * @fn: Entry point for child -- 2.39.1

2 1

[PATCH 0/5] qrap: Fix a number of issues
by Andrea Bolognani 27 Feb '23

27 Feb '23

Andrea Bolognani (5): qrap: Fix limits for PCI addresses qrap: Fix support for pc machines qrap: Drop args in JSON format qrap: Introduce machine-specific PCI address base qrap: Generate -netdev as JSON qrap.c | 47 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 35 insertions(+), 12 deletions(-) -- 2.39.2

3 14

[PATCH] contrib/apparmor: Split profile into abstractions, use them
by Stefano Brivio 27 Feb '23

27 Feb '23

One day, libvirt might actually support running passt to provide guest connectivity. Should libvirtd (or virtqemud) start passt, it will need to access socket and PID files in specific locations, and passt needs to accept SIGTERM in case QEMU fails to start after passt is already started. To make this more convenient, split the current profile into two abstractions, for passt and for pasta, so that external programmes can include the bits they need (and especially not include the pasta abstraction if they only need to start passt), plus whatever specific adaptation is needed. For stand-alone usage of passt and pasta, the 'passt' profile simply includes both abstractions, plus rules to create and access PID and capture files in default or reasonable ($HOME) locations. Tested on Debian with libvirt 9.0.0 together with a local fix to start passt as intended, namely libvirt commit c0efdbdb9f66 ("qemu_passt: Avoid double daemonizing passt"). This is an example of how the libvirtd profile (or virtqemud abstraction, or virtqemud profile) can use this: # support for passt network back-end /usr/bin/passt Cx -> passt, profile passt { /usr/bin/passt r, owner @{run}/user/[0-9]*/libvirt/qemu/run/passt/* rw, signal (receive) set=("term") peer=/usr/sbin/libvirtd, signal (receive) set=("term") peer=libvirtd, include if exists <abstractions/passt> } translated: - when executing /usr/bin/passt, switch to the subprofile "passt" (not the "discrete", i.e. stand-alone profile), described below. Scrub the environment (e.g. LD_PRELOAD is dropped) - in the "passt" subprofile: - allow reading the binary - allow read and write access to PID and socket files - make passt accept SIGTERM from /usr/sbin/libvirtd, and libvirtd peer names - include anything else that's needed by passt itself Suggested-by: Andrea Bolognani <abologna(a)redhat.com> Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/apparmor/abstractions/passt | 47 ++++++++++++++++++++ contrib/apparmor/abstractions/pasta | 35 +++++++++++++++ contrib/apparmor/usr.bin.passt | 67 +++-------------------------- 3 files changed, 89 insertions(+), 60 deletions(-) create mode 100644 contrib/apparmor/abstractions/passt create mode 100644 contrib/apparmor/abstractions/pasta diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt new file mode 100644 index 0000000..000e3db --- /dev/null +++ b/contrib/apparmor/abstractions/passt @@ -0,0 +1,47 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/apparmor/abstractions/passt - Abstraction for passt(1) +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio <sbrivio(a)redhat.com> + + abi <abi/3.0>, + + include <abstractions/base> + + # Alternatively: include <abstractions/nameservice> + @{etc_ro}/resolv.conf r, # get_dns(), conf.c + + capability net_bind_service, # isolation.c, conf.c + capability setuid, + capability setgid, + capability sys_admin, + capability setpcap, + capability net_admin, + capability sys_ptrace, + + / r, # isolate_prefork(), isolation.c + mount "" -> "/", + mount "" -> "/tmp/", + pivot_root "/tmp/" -> "/tmp/", + umount "/", + + network netlink raw, # nl_sock_init_do(), netlink.c + + network inet stream, # tcp.c + network inet6 stream, + + network inet dgram, # udp.c + network inet6 dgram, + + network unix stream, # tap.c + + network unix dgram, # __openlog(), log.c + + /usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta new file mode 100644 index 0000000..7d802ac --- /dev/null +++ b/contrib/apparmor/abstractions/pasta @@ -0,0 +1,35 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/apparmor/abstractions/pasta - Abstraction for pasta(1) +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio <sbrivio(a)redhat.com> + + abi <abi/3.0>, + + include <abstractions/passt> + + @{PROC}/net/tcp r, # procfs_scan_listen(), util.c + @{PROC}/net/tcp6 r, + @{PROC}/net/udp r, + @{PROC}/net/udp6 r, + + @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c + + @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), + @{PROC}/[0-9]*/ns/user r, # conf_pasta_ns() + + /dev/net/tun rw, # tap_ns_tun(), tap.c + + owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid() + owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/uid_map rw, + + owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c + /{usr/,}bin/** Ux, diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index 96b61ef..7433d01 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -16,73 +16,20 @@ abi <abi/3.0>, include <tunables/global> profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { - ### Common rules for passt and pasta - - include <abstractions/base> - - # Alternatively: include <abstractions/nameservice> - @{etc_ro}/resolv.conf r, # get_dns(), conf.c - - capability net_bind_service, # isolation.c, conf.c - capability setuid, - capability setgid, - capability sys_admin, - capability setpcap, - capability net_admin, - capability sys_ptrace, - - / r, # isolate_prefork(), isolation.c - mount "" -> "/", - mount "" -> "/tmp/", - pivot_root "/tmp/" -> "/tmp/", - umount "/", - - network netlink raw, # nl_sock_init_do(), netlink.c - - network inet stream, # tcp.c - network inet6 stream, - - network inet dgram, # udp.c - network inet6 dgram, - - network unix stream, # tap.c - - network unix dgram, # __openlog(), log.c - - # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_init(), pcap(), - # write_pidfile(), - # logfile_init() - - owner @{HOME}/** w, # pcap(), write_pidfile() - - /usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c - - - ### Rules for pasta - ### ### TODO: AppArmor doesn't give us the chance to attach a separate profile ### depending on the executable symlink. That's possible with SELinux. Two ### alternatives: implement that in AppArmor, or consider aa_change_hat(2). ### With this, rules for passt(1) could be restricted significantly. Note that ### the attach_disconnected flag is not needed for passt(1). - @{PROC}/net/tcp r, # procfs_scan_listen(), util.c - @{PROC}/net/tcp6 r, - @{PROC}/net/udp r, - @{PROC}/net/udp6 r, - - @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c + include <abstractions/passt> - @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), - @{PROC}/[0-9]*/ns/user r, # conf_pasta_ns() - - /dev/net/tun rw, # tap_ns_tun(), tap.c + # Alternatively: include <abstractions/user-tmp> + owner /tmp/** w, # tap_sock_unix_init(), pcap(), + # write_pidfile(), + # logfile_init() - owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid() - owner @{PROC}/@{pid}/setgroups w, - owner @{PROC}/@{pid}/uid_map rw, + owner @{HOME}/** w, # pcap(), write_pidfile() - owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c - /{usr/,}bin/** Ux, + include <abstractions/pasta> } -- 2.39.1

1 0

[PATCH 0/3] Allow non-127.0.0.1 loopback address as host resolver
by Stefano Brivio 27 Feb '23

27 Feb '23

This series fixes an issue with DNS resolution reported by Andrea: if both guest and host use systemd-resolved, reachable at 127.0.0.53, we need to advertise a reachable address as DNS to the guest, which we already do, but also to map UDP packets for that address and port 53 to the original host resolver address. Otherwise, DNS resolution doesn't work at all in the guest, with default options. Stefano Brivio (3): udp: Actually use host resolver to forward DNS queries conf: Split add_dns{4,6}() out of get_dns() conf, udp: Allow any loopback address to be used as resolver conf.c | 92 ++++++++++++++++++++++++++++++++++++---------------------- udp.c | 20 ++++++------- 2 files changed, 67 insertions(+), 45 deletions(-) -- 2.39.1

3 7