September 2026 - user

passt: new version 2026_09_25.df90211 available
by Stefano Brivio 26 Sep '26

26 Sep '26

The new version with tag 2026_09_25.df90211 includes the following changes: df90211 udp: Add missing @now parameter doc to udp_flow_from_tap() f2683d1 apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only 588b545 pasta: Add --no-pidns to keep spawned command in caller's PID namespace 3a890a6 contrib/apparmor: add missing setfcap capability de8b085 vhost_user: Reset vq enable flag in vu_cleanup() d2fb3ba Add Zed editor settings cef6bce util, pasta: Remove some unneeded #includes cf3a11f util: Add missing O_CLOEXEC for !HAS_GETRANDOM path abdc94a util: Eliminate a stray trailing whitespace aa2c8f0 clangd: Add _GNU_SOURCE to default clangd options 67dfdbd udp_flow: Remove obsolete comment 553ed8b parse: Convert parse_mac() to conventions of parse.c 7bf1595 isolation: Don't create our userns as nobody a8aedb8 isolation: Create helper function to enter user namespace 9587a35 util, pasta: Generalise [ug]id_map creation 5b4bdc8 pasta: Include pasta.h in pasta.c 7e8d49b netlink: Don't warn about multiple interfaces when there's only one defc25b isolation: Include linux_dep.h for close_range() https://passt.top/passt/log/?qt=range&q=2026_07_28.f8df3f1..2026_09_25.df90… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/11037397/ permanent mirror: https://passt.top/builds/copr/0^20260925.gdf90211/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gdf90211-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0df90211-1_all.deb -- Stefano

1 0

Re: UDP drops when source port is in use in the init namespace
by David Gibson 02 Sep '26

02 Sep '26

On Tue, Sep 01, 2026 at 08:56:01PM +0200, Stefano Brivio via user wrote: > Date: Tue, 01 Sep 2026 20:56:01 +0200 (CEST) > From: Stefano Brivio <sbrivio(a)redhat.com> > To: Rahul <llvm.zentrik(a)gmail.com> > CC: passt-user(a)passt.top > Subject: Re: UDP drops when source port is in use in the init namespace > Organization: Red Hat > List-Id: "For passt users: support, questions and answers" > <passt-user.passt.top> > > Rahul, thanks for the report and for the investigation. Remarks and > some answers inline: > > On Sun, 30 Aug 2026 11:12:44 +0100 > Rahul <llvm.zentrik(a)gmail.com> wrote: > > > Hi, > > > > I'm seeing DNS requests being dropped when using pasta 20250217. As far as > > I can tell, UDP > > flows where the source port chosen in the namespace is already in use in the > > init namespace get dropped. > > > > All three fwd_nat_from_*() preserve the source port for UDP: > > > > tgt->oport = 0; > > if (proto == IPPROTO_UDP) > > /* But for UDP preserve the source port */ > > tgt->oport = ini->eport; > > This is intended, to offer compatibility with applications or protocols > that might rely on UDP source ports to be preserved, and, in general, > to be as transparent as possible. But: > > > That forces a bind() to it, and udp_flow_sock() treats bind failure as > > fatal, so > > the flow is cancelled and the datagram dropped with no error to the sender. > > ...this is not, that is, it would definitely be desirable to have a > fallback for bind() failures. Probably? The danger with a fallback of this sort is that if you're using a protocol which cares about the source port it will work.. until suddenly it doesn't for pretty non-obvious reasons. Theoretically another option would be to _not_ preserve the source port by default, but allow forwarding rules to specify source-port preservation, specifically for cases which do need it. But, that's a lot more work both to implement and to configure. > > I don't think I ever hit this with slirp4netns, it looks like libslirp's > > udp_attach() never > > binds a port, so the kernel just gives it a random free port. > > Right, yes, slirp4netns doesn't attempt to preserve UDP source ports > outside the namespace. It's a feature we added in pasta. > > > I'm not sure whether this is intended, but if it is, is there any way to > > work > > around it? > > I see two ways of implementing this fallback mechanism, roughly: > > 1. pass all the way to _sock_l4() via udp_flow_sock() an additional > argument to entirely ignore bind() failures (like we do for ICMP > ping sockets). It might be a rather mechanical change but not my > preferred approach as we would need an extra argument in a large > number of functions just for a corner case > > 2. I think preferable: detect the failure on bind() here (it should be > EADDRINUSE, did you check?) and try again from udp_flow_sock() with > tgt->oport as 0. > > Here, "tgt" means the target namespace of the connection, and > "oport" means "our port", implying the source port (because it's an > outbound connection from pasta's side). You'll also need to make sure this takes place _before_ calling getsockname() to fill in the correct final tgt->oport. > I think it would be good to try and sketch a solution (maybe starting > from 1.) to understand what approach would be more elegant and viable. > > I don't have much time on my hands right now but I'll definitely > provide pointers and support if you feel like proposing a patch for > this. > > As a first test / workaround for your usage: did you already check that > keeping tgt->oport as 0 in the relevant function in fwd.c works? > > -- > Stefano > > _______________________________________________ > user mailing list -- passt-user(a)passt.top > To unsubscribe send an email to passt-user-leave(a)passt.top -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

1 0

UDP drops when source port is in use in the init namespace
by Rahul 01 Sep '26

01 Sep '26

Hi, I'm seeing DNS requests being dropped when using pasta 20250217. As far as I can tell, UDP flows where the source port chosen in the namespace is already in use in the init namespace get dropped. All three fwd_nat_from_*() preserve the source port for UDP: tgt->oport = 0; if (proto == IPPROTO_UDP) /* But for UDP preserve the source port */ tgt->oport = ini->eport; That forces a bind() to it, and udp_flow_sock() treats bind failure as fatal, so the flow is cancelled and the datagram dropped with no error to the sender. I don't think I ever hit this with slirp4netns, it looks like libslirp's udp_attach() never binds a port, so the kernel just gives it a random free port. I'm not sure whether this is intended, but if it is, is there any way to work around it? Thanks

2 1