- dev - passt

passt: new version 2022_11_10.4129764 available
by Stefano Brivio 10 Nov '22

10 Nov '22

The new version with tag 2022_11_10.4129764 includes the following changes: 4129764 conf: Fix mask calculation from prefix_len in conf_print() 817eedc tcp, udp: Don't initialise IPv6/IPv4 sockets if IPv4/IPv6 are not enabled 6533a4a passt: Move __setlogmask() calls before output unrelated to configuration 198f878 tap: Return -EIO from tap_handler_passt() on inconsistent packet stream 510dace tap: Keep stream consistent if qemu length descriptor spans two recv() calls https://passt.top/passt/log/?qt=range&q=2022_11_04.e308018..2022_11_10.4129… Packages: - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5030594/ permanent mirror: https://passt.top/builds/copr/0^20221110.g4129764/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_4129764-1_all.deb - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Package for other RPM-based distributions, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt-g4129764-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ -- Stefano

1 0

[PATCH 0/2] Try harder to avoid inconsistent qemu packet stream
by Stefano Brivio 10 Nov '22

10 Nov '22

...and handle the situation more reasonably if that happens. Stefano Brivio (2): tap: Keep stream consistent if qemu length descriptor spans two recv() calls tap: Return -EIO from tap_handler_passt() on inconsistent packet stream tap.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) -- 2.35.1

2 5

[PATCH 0/3] Fixes and workarounds for pasta with Podman in Google Cloud
by Stefano Brivio 10 Nov '22

10 Nov '22

These patches work around or fix some issues found while testing the Podman integration for pasta in Google Compute Engine environments. Stefano Brivio (3): conf: Consistency check between configured IPv4 netmask and gateway conf: Split the notions of read DNS addresses and offered ones udp: Check for answers to forwarded DNS queries before handling local redirects conf.c | 54 ++++++++++++++++++++++++++++++++++++++---------------- dhcp.c | 5 +++-- dhcpv6.c | 5 +++-- ndp.c | 6 +++--- passt.h | 8 ++++++-- udp.c | 17 ++++++++--------- 6 files changed, 61 insertions(+), 34 deletions(-) -- 2.35.1

2 18

[PATCH] tcp, udp: Don't initialise IPv6/IPv4 sockets if IPv4/IPv6 are not enabled
by Stefano Brivio 10 Nov '22

10 Nov '22

If we disable a given IP version automatically (no corresponding default route on host) or administratively (--ipv4-only or --ipv6-only options), we don't initialise related buffers and services (DHCP for IPv4, NDP and DHCPv6 for IPv6). The "tap" handlers will also ignore packets with a disabled IP version. However, in commit 3c6ae625101a ("conf, tcp, udp: Allow address specification for forwarded ports") I happily changed socket initialisation functions to take AF_UNSPEC meaning "any enabled IP version", but I forgot to add checks back for the "enabled" part. Reported by Paul: on a host without default IPv6 route, but IPv6 enabled, connect, using IPv6, to a port handled by pasta, which tries to send data to a tap device without initialised buffers for that IP version and exits because the resulting write() fails. Simpler way to reproduce: pasta -6 and inbound IPv4 connection, or pasta -4 and inbound IPv6 connection. Reported-by: Paul Holzinger <pholzing(a)redhat.com> Fixes: 3c6ae625101a ("conf, tcp, udp: Allow address specification for forwarded ports") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- tcp.c | 4 ++-- udp.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tcp.c b/tcp.c index 713248f..d043123 100644 --- a/tcp.c +++ b/tcp.c @@ -3213,9 +3213,9 @@ static void tcp_sock_init6(const struct ctx *c, int ns, void tcp_sock_init(const struct ctx *c, int ns, sa_family_t af, const void *addr, const char *ifname, in_port_t port) { - if (af == AF_INET || af == AF_UNSPEC) + if ((af == AF_INET || af == AF_UNSPEC) && c->ifi4) tcp_sock_init4(c, ns, addr, ifname, port); - if (af == AF_INET6 || af == AF_UNSPEC) + if ((af == AF_INET6 || af == AF_UNSPEC) && c->ifi6) tcp_sock_init6(c, ns, addr, ifname, port); } diff --git a/udp.c b/udp.c index 42a17a7..ff7f993 100644 --- a/udp.c +++ b/udp.c @@ -1129,7 +1129,7 @@ void udp_sock_init(const struct ctx *c, int ns, sa_family_t af, c->udp.fwd_in.f.delta[port]); } - if (af == AF_INET || af == AF_UNSPEC) { + if ((af == AF_INET || af == AF_UNSPEC) && c->ifi4) { if (!addr && c->mode == MODE_PASTA) bind_addr = &c->ip4.addr; else @@ -1162,7 +1162,7 @@ void udp_sock_init(const struct ctx *c, int ns, sa_family_t af, } } - if (af == AF_INET6 || af == AF_UNSPEC) { + if ((af == AF_INET6 || af == AF_UNSPEC) && c->ifi6) { if (!addr && c->mode == MODE_PASTA) bind_addr = &c->ip6.addr; else -- 2.35.1

2 1

[PATCH] conf: Fix mask calculation from prefix_len in conf_print()
by Stefano Brivio 10 Nov '22

10 Nov '22

Reported-by: Paul Holzinger <pholzing(a)redhat.com> Fixes: dd09cceaee21 ("Minor improvements to IPv4 netmask handling") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- conf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index bfecdff..1adcf83 100644 --- a/conf.c +++ b/conf.c @@ -884,7 +884,10 @@ static void conf_print(const struct ctx *c) if (c->ifi4) { if (!c->no_dhcp) { - uint32_t mask = htonl(0xffffffff << c->ip4.prefix_len); + uint32_t mask; + + mask = htonl(0xffffffff << (32 - c->ip4.prefix_len)); + info("DHCP:"); info(" assign: %s", inet_ntop(AF_INET, &c->ip4.addr, buf4, sizeof(buf4))); -- 2.35.1

2 1

[PATCH] passt: Move __setlogmask() calls before output unrelated to configuration
by Stefano Brivio 08 Nov '22

08 Nov '22

...so that we avoid printing some lines twice because log-level is still set to LOG_EMERG, as if logging configuration didn't happen yet. While at it, note that logging to stderr doesn't really depend on whether debug mode is enabled or not. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- passt.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/passt.c b/passt.c index fd703de..7d323c2 100644 --- a/passt.c +++ b/passt.c @@ -243,9 +243,16 @@ int main(int argc, char **argv) conf(&c, argc, argv); trace_init(c.trace); - if (!c.debug && (c.stderr || isatty(fileno(stdout)))) + if (c.stderr || isatty(fileno(stdout))) __openlog(log_name, LOG_PERROR, LOG_DAEMON); + if (c.debug) + __setlogmask(LOG_UPTO(LOG_DEBUG)); + else if (c.quiet) + __setlogmask(LOG_UPTO(LOG_ERR)); + else + __setlogmask(LOG_UPTO(LOG_INFO)); + quit_fd = pasta_netns_quit_init(&c); c.fd_tap = c.fd_tap_listen = -1; @@ -267,13 +274,6 @@ int main(int argc, char **argv) if (c.ifi6 && !c.no_dhcpv6) dhcpv6_init(&c); - if (c.debug) - __setlogmask(LOG_UPTO(LOG_DEBUG)); - else if (c.quiet) - __setlogmask(LOG_UPTO(LOG_ERR)); - else - __setlogmask(LOG_UPTO(LOG_INFO)); - pcap_init(&c); if (!c.foreground) { -- 2.35.1

1 0

[PATCH 00/10] RFC: Preliminaries for using share IPv4 & IPv6 sockets
by David Gibson 08 Nov '22

08 Nov '22

We want to use the same sockets to listen on both IPv4 and IPv6 addresses (at least on Linux which allows this). This isn't too complicated conceptually, but to make it work we need to unify handling of v4 and v6 connections more than we currently have. This isn't really ready to go, but I'm posting for reference. It's divided into rather a lot of steps, because I kept hitting problems and not being sure exactly what change had broken things. Based on my earlier series making handling of IPv4 addresses endian safer. David Gibson (10): tcp: no v6 flag in ref tcp: Helper to encode IPv4-mapped IPv6 addresses tcp: Partially unify IPv4 and IPv6 paths in tcp_hash_match() tcp: Hash IPv4 and IPv4-mapped-IPv6 addresses the same tcp: Take tcp_hash_insert() address from struct tcp_conn tcp: Unify IPv4 and IPv6 paths for hashing and matching tcp: Remove ugly address union from struct tcp_conn tcp: Unify initial sequence numbers for IPv4 and IPv6 tcp: Have tcp_seq_init() take its parameters from struct tcp_conn tcp: Fix small error in tcp_seq_init() time handling siphash.c | 2 + tcp.c | 202 ++++++++++++++++++--------------------------------- tcp.h | 1 - tcp_splice.c | 13 ++-- util.c | 33 +++++++++ util.h | 2 + 6 files changed, 116 insertions(+), 137 deletions(-) -- 2.38.1

2 21

[PATCH] test: Wait for network before starting passt in two_guests setup
by Stefano Brivio 07 Nov '22

07 Nov '22

As pasta now configures that target network namespace with --config-net, we need to wait for addresses and routes to be actually present. Just sending netlink messages doesn't mean this is done synchronously. A more elegant alternative, which probably makes sense regardless of this test setup, would be to query, from pasta, addresses and routes we added, and wait until they're there, before proceeding. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- test/lib/setup | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/lib/setup b/test/lib/setup index ab6d8d5..07d5056 100755 --- a/test/lib/setup +++ b/test/lib/setup @@ -208,6 +208,8 @@ setup_two_guests() { __ifname="$(context_run qemu_1 "ip -j link show | jq -rM '.[] | select(.link_type == \"ether\").ifname'")" + sleep 1 + __opts= [ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap" [ ${DEBUG} -eq 1 ] && __opts="${__opts} -d" -- 2.35.1

2 4

[PATCH] pasta: Workaround: wait for execvp() to be done in child before entering netns
by Stefano Brivio 07 Nov '22

07 Nov '22

This happens about every third time on the two_guests/basic test, and on that test only: we clone() twice, first to spawn a child, then to spawn a thread to check that we can enter the target network namespace. In this thread, we open a file descriptor associated to the target namespace. It might happen that it doesn't exist yet: the kernel can legitimately take its time to create one, after clone(). In this case, at least on a 5.15 Linux kernel, trying to open that file again always yields EACCES, and we get stuck there. This only occurs if we spawn two instances of pasta very close together, as it's done in the two_guests/basic case. I couldn't figure out what the race condition is, yet, and especially if it's a kernel issue or something we're doing wrong. However, if we wait until the execvp() in the child is done, the issue disappears. I'm not sure yet if it's just because of timing and this is hiding an unrelated race condition. The workaround consists of checking /proc/PID/exe against our own. If it's different, that means execvp() already completed and we can proceed. It's rather ugly, but much better than the alternative. Leave a FIXME there for the moment being. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- pasta.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/pasta.c b/pasta.c index db86317..36072b2 100644 --- a/pasta.c +++ b/pasta.c @@ -81,9 +81,26 @@ void pasta_child_handler(int signal) */ static int pasta_wait_for_ns(void *arg) { + char ns_exe_link[PATH_MAX], ns[PATH_MAX]; struct ctx *c = (struct ctx *)arg; int flags = O_RDONLY | O_CLOEXEC; - char ns[PATH_MAX]; + char exe[PATH_MAX] = { 0 }; + + /* FIXME: Why do we have to wait until execvp() is done in the child? + * If we don't, and the first call to open() below returns ENOENT, any + * subsequent call to it returns EACCES, at least on Linux 5.15, even + * though the observed PID is correct, and another process can open that + * path, and call setns() on that. + */ + snprintf(ns_exe_link, PATH_MAX, "/proc/%i/exe", pasta_child_pid); + if (readlink("/proc/self/exe", exe, PATH_MAX - 1) != -1) { + char ns_exe[PATH_MAX] = { 0 }; + + do { + if (readlink(ns_exe_link, ns_exe, PATH_MAX - 1) == -1) + break; + } while (!strncmp(exe, ns_exe, PATH_MAX - 1)); + } snprintf(ns, PATH_MAX, "/proc/%i/ns/net", pasta_child_pid); do -- 2.35.1

2 3

passt: new version 2022_11_04.e308018 available
by Stefano Brivio 04 Nov '22

04 Nov '22

The new version with tag 2022_11_04.e308018 includes the following changes: e308018 test/memory/passt: Change passt.avx2 path to /bin in test itself 11efaef passt, qrap, README: Update notes and documentation for AF_UNIX support in qemu 6c16977 test/perf: Finally drop workaround for virtio_net TX stall 667397d test: Switch to qemu -netdev stream option instead of using qrap 1401962 test: Wait for network before starting passt in two_guests setup db74679 udp: Check for answers to forwarded DNS queries before handling local redirects 73f50a7 conf: Split the notions of read DNS addresses and offered ones 7656a6f conf: Adjust netmask on mismatch between IPv4 address/netmask and gateway de93acb tcp: Correct function comments for address types f7653a1 Use endian-safer typing in struct tap4_l4_t 7c7b68d Use typing to reduce chances of IPv4 endianness errors dd3470d Use IPV4_IS_LOOPBACK more widely dd09cce Minor improvements to IPv4 netmask handling 2b793d9 Correct some missing endian conversions of IPv4 addresses 40fc9e6 test: Add memory/passt test cases ce2a0a5 test/lib: Add "td" directive, handled by table_value() bfd311a test/lib/perf_report: Use own flag to track initialisation 2d4468e tap: Support for detection of existing sockets on ramfs e76e65a test/lib: Move screen-scraping setup and layout functions to _ugly files ea5e046 README: Add Podman, vhost-user links, and links to Bugzilla queries 10cabe3 passt.1: Fix typo: "addressses", reported by Lintian https://passt.top/passt/log/?qt=range&q=2022_10_26.f212044..2022_11_04.e308… Packages: - Copr (CentOS Stream, EPEL, Fedora, Mageia, openSUSE): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/5010835/ permanent mirror: https://passt.top/builds/copr/0^20221104.ge308018/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0e308018-1_all.deb - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Package for other RPM-based distributions, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt-ge308018-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ -- Stefano

1 0