- user - passt

passt: new version 2024_06_24.1ee2eca available
by Stefano Brivio 24 Jun '24

24 Jun '24

The new version with tag 2024_06_24.1ee2eca includes the following changes: 1ee2eca udp: Reduce scope of rport in udp_invert_portmap() 0546975 Revert "udp: Make rport calculation more local" c66f034 log: Don't report syslog failures to stderr after initialisation e7323e5 conf, passt: Don't call __openlog() if a log file is used dba7f0f treewide: Replace strerror() calls 92a22fe treewide: Replace perror() calls with calls to logging functions c1140df log: Add _perror() logging function variants afd9cdc log, passt: Always print to stderr before initialisation is complete 8c2f24a conf, log: Instead of abusing log levels, add log_conf_parsed flag bca0fef conf, passt: Make --stderr do nothing, and deprecate it b748016 conf, passt: Don't try to log to stderr after we close it 65923ba conf: Accept duplicate and conflicting options, the last one wins 62de614 netlink: Strip nexthop identifiers when duplicating routes 1544a43 passt.1, qrap.1: align license description with SPDX identifier f301bb1 netlink: Ignore EHOSTUNREACH failures when duplicating routes 450a613 netlink: With no default route, pick the first interface with a route 54a9d38 tcp: Don't rely on bind() to fail to decide that connection target is valid 020ff7a siphash: Remove stale prototypes 7e87bd9 udp: Move management of udp[46]_localname into udp_splice_send() ff57f8d udp: Rework how we divide queued datagrams between sending methods 63db7dc udp: Fold checking of splice flag into udp_mmh_splice_port() 523fbc5 util: Split construction of bind socket address from the rest of sock_l4() 4070bac tap: use in->buf_size rather than sizeof(pkt_buf) 7290335 iov: remove iov_copy() 0c335d7 vhost-user: compare mode MODE_PASTA and not MODE_PASST 377b666 udp: rename udp_sock_handler() to udp_buf_sock_handler() e7ac995 udp: refactor UDP header update functions 9ecf7fe tap: refactor packets handling functions fba2b54 tcp: move buffers management functions to their own file ec26fa0 tcp: extract buffer management from tcp_send_flag() d949667 cppcheck: Suppress constParameterCallback errors https://passt.top/passt/log/?qt=range&q=2024_06_07.8a83b53..2024_06_24.1ee2… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7661289/ permanent mirror: https://passt.top/builds/copr/0^20240624.g1ee2eca/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1ee2eca-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1ee2eca-1_all.deb -- Stefano

1 0

passt: new version 2024_06_07.8a83b53 available
by Stefano Brivio 07 Jun '24

07 Jun '24

The new version with tag 2024_06_07.8a83b53 includes the following changes: 8a83b53 selinux: Allow access to user_devpts ec416fd tcp, flow: Fix some error paths which didn't clean up flows properly 3f63743 util: Use 'long' to represent millisecond durations f9e8ee0 lineread: Use ssize_t for line lengths c919bbb conf: Safer parsing of MAC addresses bda80ef util: Use unsigned indices for bits in bitmaps 0e36fe1 clang-tidy: Enable the bugprone-macro-parentheses check 7094b91 Remove pointless macro parameters in CALL_PROTO_HANDLER c80fa6a udp: Make rport calculation more local d2afb4b tcp: Make pointer const in tcp_revert_seq b3aeb00 log: Remove log_to_stdout option 7cb2088 conf: Don't print usage via the logging subsystem e651197 conf: Remove unhelpful usage() wrapper e84a01e tcp: move seq_to_tap update to when frame is queued https://passt.top/passt/log/?qt=range&q=2024_05_23.765eb0b..2024_06_07.8a83… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7558696/ permanent mirror: https://passt.top/builds/copr/0^20240607.g8a83b53/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g1eddc56-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_1eddc56-1_all.deb -- Stefano

1 0

apparmor blocks passt running podman
by hamish-passt＠moffatt.email 07 Jun '24

07 Jun '24

Hi, I have podman 5.1.0 and passt 0.0+20240523.765eb0bf running on Debian bookworm (via unofficial packages). When I try to run podman using passt for networking, it is blocked by apparmor (3.0.8). audit: type=1400 audit(1717756950.285:65): apparmor="DENIED" operation="open" profile="passt" name="/run/user/1000/netns/netns-cad489f7-d3c4-7730-9d15-17ae8e172da4" pid=246135 comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 I'm not familiar with apparmor so I don't know how to debug this. The installed apparmor profile files match the ones in the pasta git. Can you help? thanks, Hamish

2 1

passt: new version 2024_05_23.765eb0b available
by Stefano Brivio 23 May '24

23 May '24

The new version with tag 2024_05_23.765eb0b includes the following changes: 765eb0b apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring 0608ec4 conf, passt.h: Rename pid_file in struct ctx to pidfile c9b2413 conf, passt, tap: Open socket and PID files before switching UID/GID ba23b05 passt, util: Move opening of PID file to its own function 57d8aa8 util: Rename write_pidfile() to pidfile_write() cbca08c tap: Split tap_sock_unix_init() into opening and listening parts fcfb592 passt, tap: Don't use -1 as uninitialised value for fd_tap_listen d02bb6c tap: Move all-ones initialisation of mac_guest to tap_sock_init() 45b8632 conf: Don't lecture user about starting us as root 3f917b3 netlink, test: Ignore deprecated addresses cc801fb tcp: Remove interim 'tapside' field from connection 8a2accb flow: Record the pifs for each side of each flow 4357185 flow: Make side 0 always be the initiating side 0060acd flow: Clarify and enforce flow state transitions a631998 inany: Better helpers for using inany and specific family addrs together 7a832a8 flow: Properly type callbacks to protocol specific handlers 1a20370 util, tcp: Add helper to display socket addresses 3ff3a8a apparmor: Fix passt abstraction 6cdc9fd apparmor: allow netns paths on /tmp 80f7ff2 clang-tidy: Suppress macro to enum conversion warnings 29bd08f conf: Fix clang-tidy warning about using an undefined enum value 26c71db passt.c: explicitly include libgen.h for basename 623c2fd netlink: Don't duplicate routes referring to unrelated host interfaces https://passt.top/passt/log/?qt=range&q=2024_05_10.7288448..2024_05_23.765e… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7482357/ permanent mirror: https://passt.top/builds/copr/0^20240523.g765eb0b/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://software.opensuse.org/package/passt - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g765eb0b-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_765eb0b-1_all.deb -- Stefano

1 0

passt: new version 2024_05_10.7288448 available
by Stefano Brivio 10 May '24

10 May '24

The new version with tag 2024_05_10.7288448 includes the following changes: 7288448 apparmor: allow read access on /tmp for pasta 7e6a606 tcp_splice: Set OUT_WAIT_ flag whenever pipe isn't emptied 1ba76c9 udp: Single buffer for IPv4, IPv6 headers and metadata d4598e1 udp: Use the same buffer for the L2 header for all frames 6170688 udp: Share payload buffers between IPv4 and IPv6 2d16946 udp: Explicitly set checksum in guest-bound UDP headers 6c4d26a udp: Combine initialisation of IPv4 and IPv6 iovs 3f9bd86 udp: Split tap-bound UDP packets into multiple buffers using io vector fcd9308 test: Allow sftp via vsock-ssh in tests eea5d3e tcp: Update tap specific header too in tcp_fill_headers[46]() 3559899 iov: Helper macro to construct iovs covering existing variables or fields 40f8b29 tap, tcp: (Re-)abstract TAP specific header handling 68d1b0a tcp: Simplify packet length calculation when preparing headers 5566386 treewide: Standardise variable names for various packet lengths 9e22c53 checksum: Make csum_ip4_header() take a host endian length 1095a7b treewide: Remove misleading and redundant endianness notes 5d37dab tap: Remove unused structs tap_msg, tap_l4_msg 34fb381 tap: Split tap specific and L2 (ethernet) headers c27ca91 checksum: Use proto_ipv6_header_psum() for ICMPv6 as well 76e3202 netlink: Fix iterations over nexthop objects https://passt.top/passt/log/?qt=range&q=2024_04_26.d03c4e2..2024_05_10.7288… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7434838/ permanent mirror: https://passt.top/builds/copr/0^20240510.g7288448/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://build.opensuse.org/package/requests/Virtualization:containers/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g7288448-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_7288448-1_all.deb -- Stefano

1 0

Guest namespace can access host ports via secondary interface addresses
by Kangjing Huang 10 May '24

10 May '24

Hi there, I was tweaking around pasta and its usage with podman, and I realized that from pasta guest namespaces it is possible to access host ports through the address of secondary interfaces on the host. Say I have two interfaces on host, with eth0 connecting to a gateway and eth1 connected to another LAN: > $ # On host > $ ifconfig eth0 > eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.1.2 netmask 255.255.255.0 broadcast 192.168.1.255 > ... > $ ifconfig eth1 > eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 > inet 192.168.110.1 netmask 255.255.255.0 broadcast 192.168.110.255 > ... > $ ip route > default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.2 metric 1024 > 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2 metric 1024 > 192.168.1.1 dev eth0 proto dhcp scope link src 192.168.1.2 metric 1024 > 192.168.110.0/24 dev eth1 proto kernel scope link src 192.168.110.1 If there is some service started on host: > $ python -m http.server > Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... From a pasta namespace, it is impossible to access the host ports by the address of the main interface: > $ pasta --config-net > $ # Now in pasta namespace > $ curl 192.168.1.2:8000 > curl: (7) Failed to connect to 192.168.1.2 port 8000 after 0 ms: Couldn't connect to server However I found that it is possible to do so by the address of the secondary interface: > $ # In same pasta environment as above > $ curl 192.168.110.1:8000 > <!DOCTYPE HTML> > <html lang="en"> > ... Is this an expected behavior? I believe this is a security escape in the container context, since containerized services can gain access to unintended resources. Thanks, Chaser Huang -- Kangjing "Chaser" Huang

2 1

passt: new version 2024_04_26.d03c4e2 available
by Stefano Brivio 26 Apr '24

26 Apr '24

The new version with tag 2024_04_26.d03c4e2 includes the following changes: d03c4e2 netlink: Use IFA_F_NODAD also while duplicating addresses from the host bfc83b5 netlink: For IPv4, IFA_LOCAL is the interface address, not IFA_ADDRESS ff2ff2f test: Make log truncation test more robust 2681366 test: Slight simplification to pasta log tests 0804fdb udp: Correctly look up outbound socket with port remappings 9560123 tcp: Replace TCP buffer structure by an iovec array 27f1c76 conf: Don't fail if the template interface doesn't have a MAC address eca8baa conf: We're interested in the MAC address, not in the MAC itself ee338a2 pasta, util: Align stack area for clones to maximum natural alignment 5d5208b treewide: Compilers' name for armv6l and armv7l is "arm" https://passt.top/passt/log/?qt=range&q=2024_04_05.954589b..2024_04_26.d03c… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7374013/ permanent mirror: https://passt.top/builds/copr/0^20240426.gd03c4e2/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://build.opensuse.org/package/requests/Virtualization:containers/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gd03c4e2-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0d03c4e2-1_all.deb -- Stefano

1 0

passt: new version 2024_04_05.954589b available
by Stefano Brivio 05 Apr '24

05 Apr '24

The new version with tag 2024_04_05.954589b includes the following changes: 954589b test: Verify that podman tests are using the pasta binary we expect 489b28e test: catatonit may not be in $PATH f9fe3ae test: Build and download podman as a test asset e8b7821 test: Make sure to update mbuto repository ef2cb13 cppcheck: Explicitly give files to check 97e8b33 netlink: Ignore routes to link-local addresses for selecting interface 67a6258 util: Add helper to return name of address family f4e38b5 netlink: Adjust interface index inside copied nexthop objects too 88c2f08 apparmor: Fix access to procfs namespace entries in pasta's abstraction 100919c apparmor: Expand scope of @{run}/user access, allow writing PID files too dc7b7f2 apparmor: Add mount rule with explicit, empty source in passt abstraction bbea275 README.md: Alpine, Guix and OpenSUSE now have packages for passt https://passt.top/passt/log/?qt=range&q=2024_03_26.4988e2b..2024_04_05.9545… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7267305/ permanent mirror: https://passt.top/builds/copr/0^20240405.g954589b/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - openSUSE: https://build.opensuse.org/package/requests/Virtualization:containers/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g954589b-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_954589b-1_all.deb -- Stefano

1 0

passt: new version 2024_03_26.4988e2b available
by Stefano Brivio 26 Mar '24

26 Mar '24

The new version with tag 2024_03_26.4988e2b includes the following changes: 4988e2b tcp: Unconditionally force ACK for all !SYN, !RST packets 5894a24 tcp: Never automatically add the ACK flag to RST packets 16c2d8d tcp: Rearrange logic for setting ACK flag in tcp_send_flag() 99355e2 tcp: Split handling of DUP_ACK from ACK https://passt.top/passt/log/?qt=range&q=2024_03_20.71dd405..2024_03_26.4988… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7215825/ permanent mirror: https://passt.top/builds/copr/0^20240320.g71dd405/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-gc2acf02-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_0c2acf02-1_all.deb -- Stefano

1 0

passt: new version 2024_03_20.71dd405 available
by Stefano Brivio 20 Mar '24

20 Mar '24

The new version with tag 2024_03_20.71dd405 includes the following changes: 71dd405 util: fix confusion between offset in the iovec array and in the entry 639fdf0 netlink: Fix selection of template interface https://passt.top/passt/log/?qt=range&q=2024_03_19.d35bcbe..2024_03_20.71dd… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Debian tracker: https://tracker.debian.org/pkg/passt - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/7187051/ permanent mirror: https://passt.top/builds/copr/0^20240320.g71dd405/ - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g71dd405-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_71dd405-1_all.deb -- Stefano

1 0

2024

2023

2022

2021

user