Both the -D (--dns) and -S (--search) options take an optional argument. If the argument is omitted the option is disabled entirely. However, handling the optional argument requires some ugly special case handling if it's the last option on the command line, and has potential ambiguity with non-option arguments used with pasta. It can also make it more confusing to read command lines. Simplify the logic here by replacing the non-argument versions with an explicit "-D none" or "-S none". Signed-off-by: David Gibson --- conf.c | 18 ++++-------------- passt.1 | 7 ++++--- 2 files changed, 8 insertions(+), 17 deletions(-) diff --git a/conf.c b/conf.c index 4eb9e3d..6770be9 100644 --- a/conf.c +++ b/conf.c @@ -1022,8 +1022,8 @@ void conf(struct ctx *c, int argc, char **argv) {"mac-addr", required_argument, NULL, 'M' }, {"gateway", required_argument, NULL, 'g' }, {"interface", required_argument, NULL, 'i' }, - {"dns", optional_argument, NULL, 'D' }, - {"search", optional_argument, NULL, 'S' }, + {"dns", required_argument, NULL, 'D' }, + {"search", required_argument, NULL, 'S' }, {"no-tcp", no_argument, &c->no_tcp, 1 }, {"no-udp", no_argument, &c->no_udp, 1 }, {"no-icmp", no_argument, &c->no_icmp, 1 }, @@ -1077,16 +1077,6 @@ void conf(struct ctx *c, int argc, char **argv) name = getopt_long(argc, argv, optstring, options, NULL); - if ((name == 'D' || name == 'S') && !optarg && - optind < argc && *argv[optind] && *argv[optind] != '-') { - if (c->mode == MODE_PASTA) { - if (conf_ns_opt(c, nsdir, userns, argv[optind])) - optarg = argv[optind++]; - } else { - optarg = argv[optind++]; - } - } - switch (name) { case -1: case 0: @@ -1403,7 +1393,7 @@ void conf(struct ctx *c, int argc, char **argv) usage(argv[0]); } - if (!optarg) { + if (!strcmp(optarg, "none")) { c->no_dns = 1; break; } @@ -1430,7 +1420,7 @@ void conf(struct ctx *c, int argc, char **argv) usage(argv[0]); } - if (!optarg) { + if (!strcmp(optarg, "none")) { c->no_dns_search = 1; break; } diff --git a/passt.1 b/passt.1 index 9bed946..14b01b2 100644 --- a/passt.1 +++ b/passt.1 @@ -171,7 +171,7 @@ version. Use \fIaddr\fR (IPv4 or IPv6) for DHCP, DHCPv6, NDP or DNS forwarding, as configured (see options \fB--no-dhcp-dns\fR, \fB--dhcp-dns\fR, \fB--dns-forward\fR) instead of reading addresses from \fI/etc/resolv.conf\fR. -This option can be specified multiple times, and a single, empty option disables +This option can be specified multiple times. Specifying \fB-D none\fR disables usage of DNS addresses altogether. .TP @@ -186,8 +186,9 @@ This option can be specified zero to two times (once for IPv4, once for IPv6). .BR \-S ", " \-\-search " " \fIlist Use space-separated \fIlist\fR for DHCP, DHCPv6, and NDP purposes, instead of reading entries from \fI/etc/resolv.conf\fR. See options \fB--no-dhcp-search\fR -and \fB--dhcp-search\fR. A single, empty option disables the DNS domain search -list altogether. +and \fB--dhcp-search\fR. \fB--search none\fR disables the DNS domain search +list altogether (if you need to search a domain called "none" you can use +\fB--search none.\fR). .TP .BR \-\-no-dhcp-dns " " \fIaddr -- 2.37.2

The man page states that the --userns option can be given either as a path or as a name relative to --nsrun-dir. This is not correct: as the name suggests --nsrun-dir is (correctly) used only for *netns* resolution, not *userns* resolution. Signed-off-by: David Gibson --- passt.1 | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/passt.1 b/passt.1 index 14b01b2..78b10b8 100644 --- a/passt.1 +++ b/passt.1 @@ -442,9 +442,8 @@ Default is \fBauto\fR. .TP .BR \-\-userns " " \fIspec -Target user namespace to join, as path or name (i.e. suffix for --nsrun-dir). If -PID is given, without this option, the user namespace will be the one of the -corresponding process. +Target user namespace to join, as a path. If PID is given, without this option, +the user namespace will be the one of the corresponding process. This option requires PID, PATH or NAME to be specified. -- 2.37.2

After calling conf_ns_opt() we check for -ENOENT and print an error message, but conf_ns_opt() prints messages for other errors itself. For consistency move the ENOENT message into conf_ns_opt() as well. Signed-off-by: David Gibson --- conf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/conf.c b/conf.c index e76181c..47f3e41 100644 --- a/conf.c +++ b/conf.c @@ -602,6 +602,7 @@ static int conf_ns_opt(struct ctx *c, c->netns_only = netns_only_reset; + err("Namespace %s not found", optarg); return -ENOENT; } @@ -1446,8 +1447,6 @@ void conf(struct ctx *c, int argc, char **argv) if (c->mode == MODE_PASTA && optind + 1 == argc) { ret = conf_ns_opt(c, userns, argv[optind]); - if (ret == -ENOENT) - err("Namespace %s not found", argv[optind]); if (ret < 0) usage(argv[0]); } else if (c->mode == MODE_PASTA && *userns && optind == argc) { -- 2.37.2

When attaching to an existing namespace, pasta can take a PID or the name or path of a network namespace as a non-option parameter. We disambiguate based on what the parameter looks like. Make this more explicit by using a --netns option for explicitly giving the path or name, and treating a non-option argument always as a PID. Signed-off-by: David Gibson --- conf.c | 85 ++++++++++++++++++++++++++++++++++++++++----------------- passt.1 | 16 +++++++++-- 2 files changed, 73 insertions(+), 28 deletions(-) diff --git a/conf.c b/conf.c index 10b7b9f..2a18124 100644 --- a/conf.c +++ b/conf.c @@ -490,19 +490,51 @@ out: } /** - * conf_ns_opt() - Parse non-option argument to namespace paths + * conf_netns() - Parse --netns option + * @netns: buffer of size PATH_MAX, updated with netns path + * @arg: --netns argument + * + * Return: 0 on success, negative error code otherwise + */ +static int conf_netns(char *netns, const char *arg) +{ + int ret; + + if (!strchr(arg, '/')) { + /* looks like a netns name */ + ret = snprintf(netns, PATH_MAX, "%s/%s", NETNS_RUN_DIR, arg); + } else { + /* otherwise assume it's a netns path */ + ret = snprintf(netns, PATH_MAX, "%s", arg); + } + + if (ret <= 0 || ret > PATH_MAX) { + err("Network namespace name/path %s too long"); + return -E2BIG; + } + + return 0; +} + +/** + * conf_ns_pid() - Parse non-option argument as a PID * @userns: buffer of size PATH_MAX, initially contains --userns * argument (may be empty), updated with userns path - * @netns: buffer of size PATH_MAX, updated with netns path - * @arg: PID, path or name of network namespace + * @netns: buffer of size PATH_MAX, initial contains --netns + * argument (may be empty), updated with netns path + * @arg: PID of network namespace * * Return: 0 on success, negative error code otherwise */ -static int conf_ns_opt(char *userns, char *netns, const char *arg) +static int conf_ns_pid(char *userns, char *netns, const char *arg) { char *endptr; long pidval; - int ret; + + if (*netns) { + err("Both --netns and PID given"); + return -EINVAL; + } pidval = strtol(arg, &endptr, 10); if (!*endptr) { @@ -518,20 +550,7 @@ static int conf_ns_opt(char *userns, char *netns, const char *arg) return 0; } - if (!strchr(arg, '/')) { - /* looks like a netns name */ - ret = snprintf(netns, PATH_MAX, "%s/%s", NETNS_RUN_DIR, arg); - } else { - /* otherwise assume it's a netns path */ - ret = snprintf(netns, PATH_MAX, "%s", arg); - } - - if (ret <= 0 || ret > PATH_MAX) { - err("Network namespace name/path %s too long"); - return -E2BIG; - } - - return 0; + return -EINVAL; } /** @@ -708,10 +727,13 @@ static unsigned int conf_ip6(unsigned int ifi, static void usage(const char *name) { if (strstr(name, "pasta")) { - info("Usage: %s [OPTION]... [PID|PATH|NAME]", name); + info("Usage: %s [OPTION]... [COMMAND] [ARGS]...", name); + info(" %s [OPTION]... PID", name); + info(" %s [OPTION]... --netns [PATH|NAME]", name); info(""); - info("Without PID|PATH|NAME, run the default shell in a new"); - info("network and user namespace, and connect it via pasta."); + info("Without PID or --netns, run the given command or a"); + info("default shell in a new network and user namespace, and"); + info("connect it via pasta."); } else { info("Usage: %s [OPTION]...", name); } @@ -858,6 +880,7 @@ pasta_opts: info( " SPEC is as described above"); info( " default: auto"); info( " --userns NSPATH Target user namespace to join"); + info( " --netns PATH|NAME Target network namespace to join"); info( " --netns-only Don't join existing user namespace"); info( " implied if PATH or NAME are given without --userns"); info( " --config-net Configure tap interface in namespace"); @@ -1038,6 +1061,7 @@ void conf(struct ctx *c, int argc, char **argv) {"tcp-ns", required_argument, NULL, 'T' }, {"udp-ns", required_argument, NULL, 'U' }, {"userns", required_argument, NULL, 2 }, + {"netns", required_argument, NULL, 3 }, {"netns-only", no_argument, &c->netns_only, 1 }, {"config-net", no_argument, &c->pasta_conf_ns, 1 }, {"ns-mac-addr", required_argument, NULL, 4 }, @@ -1091,6 +1115,16 @@ void conf(struct ctx *c, int argc, char **argv) usage(argv[0]); } break; + case 3: + if (c->mode != MODE_PASTA) { + err("--netns is for pasta mode only"); + usage(argv[0]); + } + + ret = conf_netns(netns, optarg); + if (ret < 0) + usage(argv[0]); + break; case 4: if (c->mode != MODE_PASTA) { err("--ns-mac-addr is for pasta mode only"); @@ -1447,11 +1481,12 @@ void conf(struct ctx *c, int argc, char **argv) check_root(c); if (c->mode == MODE_PASTA && optind + 1 == argc) { - ret = conf_ns_opt(userns, netns, argv[optind]); + ret = conf_ns_pid(userns, netns, argv[optind]); if (ret < 0) usage(argv[0]); - } else if (c->mode == MODE_PASTA && *userns && optind == argc) { - err("--userns requires PID, PATH or NAME"); + } else if (c->mode == MODE_PASTA && *userns + && !*netns && optind == argc) { + err("--userns requires --netns or PID"); usage(argv[0]); } else if (optind != argc) { usage(argv[0]); diff --git a/passt.1 b/passt.1 index bbdadc1..4a09ced 100644 --- a/passt.1 +++ b/passt.1 @@ -15,7 +15,10 @@ [\fIOPTION\fR]... .br .B pasta -[\fIOPTION\fR]... [\fIPID\fR|\fIPATH\fR|\fINAME\fR] +[\fIOPTION\fR]... [\fIPID\fR] +.br +.B pasta +[\fIOPTION\fR]... \fB--netns\fR [\fIPATH\fR|\fINAME\fR] .SH DESCRIPTION @@ -59,7 +62,7 @@ or with the \fBqrap\fR(1) wrapper. equivalent functionality to network namespaces, as the one offered by \fBpasst\fR for virtual machines. -If PID, PATH or NAME are given, \fBpasta\fR associates to an existing user and +If PID or --netns are given, \fBpasta\fR associates to an existing user and network namespace. Otherwise, \fBpasta\fR creates a new user and network namespace, and spawns an interactive shell within this context. A \fItap\fR device within the network namespace is created to provide network connectivity. @@ -445,7 +448,14 @@ Default is \fBauto\fR. Target user namespace to join, as a path. If PID is given, without this option, the user namespace will be the one of the corresponding process. -This option requires PID, PATH or NAME to be specified. +This option requires --netns or a PID to be specified. + +.TP +.BR \-\-netns " " \fIspec +Target network namespace to join, as a path or a name. A name is treated as +with \fBip-netns(8)\fR as a equivalent to a path in \fI/run/netns\fR. + +This option can't be specified with a PID. .TP .BR \-\-netns-only -- 2.37.2

When not given an existing PID or network namspace to attach to, pasta spawns a shell. Most commands which can spawn a shell in an altered environment can also run other commands in that same environment, which can be useful in automation. Allow pasta to do the same thing; it can be given an arbitrary command to run in the network and user namespace which pasta creates. If neither a command nor an existing PID or netns to attach to is given, continue to spawn a default shell, as before. Signed-off-by: David Gibson --- conf.c | 27 ++++++++++++++++++--------- passt.1 | 14 +++++++++----- pasta.c | 33 +++++++++++++++++++++++---------- pasta.h | 2 +- 4 files changed, 51 insertions(+), 25 deletions(-) diff --git a/conf.c b/conf.c index 2a18124..162c2dd 100644 --- a/conf.c +++ b/conf.c @@ -550,7 +550,8 @@ static int conf_ns_pid(char *userns, char *netns, const char *arg) return 0; } - return -EINVAL; + /* Not a PID, later code will treat as a command */ + return 0; } /** @@ -1480,14 +1481,18 @@ void conf(struct ctx *c, int argc, char **argv) check_root(c); - if (c->mode == MODE_PASTA && optind + 1 == argc) { - ret = conf_ns_pid(userns, netns, argv[optind]); - if (ret < 0) + if (c->mode == MODE_PASTA) { + if (*netns && optind != argc) { + err("Both --netns and PID or command given"); usage(argv[0]); - } else if (c->mode == MODE_PASTA && *userns - && !*netns && optind == argc) { - err("--userns requires --netns or PID"); - usage(argv[0]); + } else if (optind + 1 == argc) { + ret = conf_ns_pid(userns, netns, argv[optind]); + if (ret < 0) + usage(argv[0]); + } else if (*userns && !*netns && optind == argc) { + err("--userns requires --netns or PID"); + usage(argv[0]); + } } else if (optind != argc) { usage(argv[0]); } @@ -1501,7 +1506,11 @@ void conf(struct ctx *c, int argc, char **argv) if (ret < 0) usage(argv[0]); } else { - pasta_start_ns(c); + if (*userns) { + err("Both --userns and command given"); + usage(argv[0]); + } + pasta_start_ns(c, argc - optind, argv + optind); } } diff --git a/passt.1 b/passt.1 index 4a09ced..3cc5a9d 100644 --- a/passt.1 +++ b/passt.1 @@ -15,7 +15,10 @@ [\fIOPTION\fR]... .br .B pasta -[\fIOPTION\fR]... [\fIPID\fR] +[\fIOPTION\fR]... [\fICOMMAND\fR [\fIARG\fR]...] +.br +.B pasta +[\fIOPTION\fR]... \fIPID\fR .br .B pasta [\fIOPTION\fR]... \fB--netns\fR [\fIPATH\fR|\fINAME\fR] @@ -62,10 +65,11 @@ or with the \fBqrap\fR(1) wrapper. equivalent functionality to network namespaces, as the one offered by \fBpasst\fR for virtual machines. -If PID or --netns are given, \fBpasta\fR associates to an existing user and -network namespace. Otherwise, \fBpasta\fR creates a new user and network -namespace, and spawns an interactive shell within this context. A \fItap\fR -device within the network namespace is created to provide network connectivity. +If PID or --netns are given, \fBpasta\fR associates to an existing +user and network namespace. Otherwise, \fBpasta\fR creates a new user +and network namespace, and spawns the given command or a default shell +within this context. A \fItap\fR device within the network namespace +is created to provide network connectivity. For local TCP and UDP traffic only, \fBpasta\fR also implements a bypass path directly mapping Layer-4 sockets between \fIinit\fR and target namespaces, diff --git a/pasta.c b/pasta.c index 830748f..a844af2 100644 --- a/pasta.c +++ b/pasta.c @@ -108,6 +108,7 @@ netns: struct pasta_setup_ns_arg { struct ctx *c; int euid; + char **argv; }; /** @@ -119,7 +120,6 @@ struct pasta_setup_ns_arg { static int pasta_setup_ns(void *arg) { struct pasta_setup_ns_arg *a = (struct pasta_setup_ns_arg *)arg; - char *shell; if (!a->c->netns_only) { char buf[BUFSIZ]; @@ -139,29 +139,42 @@ static int pasta_setup_ns(void *arg) FWRITE("/proc/sys/net/ipv4/ping_group_range", "0 0", "Cannot set ping_group_range, ICMP requests might fail"); - shell = getenv("SHELL") ? getenv("SHELL") : "/bin/sh"; - if (strstr(shell, "/bash")) - execve(shell, ((char *[]) { shell, "-l", NULL }), environ); - else - execve(shell, ((char *[]) { shell, NULL }), environ); + execvp(a->argv[0], a->argv); - perror("execve"); + perror("execvp"); exit(EXIT_FAILURE); } /** - * pasta_start_ns() - Fork shell in new namespace if target ns is not given + * pasta_start_ns() - Fork command in new namespace if target ns is not given * @c: Execution context + * @argc: Number of arguments for spawned command + * @argv: Command to spawn and arguments */ -void pasta_start_ns(struct ctx *c) +void pasta_start_ns(struct ctx *c, int argc, char *argv[]) { - struct pasta_setup_ns_arg arg = { .c = c, .euid = geteuid() }; + struct pasta_setup_ns_arg arg = { + .c = c, + .euid = geteuid(), + .argv = argv, + }; + char *shell = getenv("SHELL") ? getenv("SHELL") : "/bin/sh"; + char *sh_argv[] = { shell, NULL }; + char *bash_argv[] = { shell, "-l", NULL }; char ns_fn_stack[NS_FN_STACK_SIZE]; c->foreground = 1; if (!c->debug) c->quiet = 1; + if (argc == 0) { + if (strstr(shell, "/bash")) { + arg.argv = bash_argv; + } else { + arg.argv = sh_argv; + } + } + pasta_child_pid = clone(pasta_setup_ns, ns_fn_stack + sizeof(ns_fn_stack) / 2, (c->netns_only ? 0 : CLONE_NEWNET) | diff --git a/pasta.h b/pasta.h index 8c80006..19b2e54 100644 --- a/pasta.h +++ b/pasta.h @@ -6,7 +6,7 @@ #ifndef PASTA_H #define PASTA_H -void pasta_start_ns(struct ctx *c); +void pasta_start_ns(struct ctx *c, int argc, char *argv[]); void pasta_ns_conf(struct ctx *c); void pasta_child_handler(int signal); int pasta_netns_quit_init(struct ctx *c); -- 2.37.2