passt, branch 2023_02_22.4ddbcb9

tcp: Disable optimisations for tcp_hash()

2023-02-22T12:16:22+00:00

I'm not sure if we're breaking some aliasing rule here, but with gcc
12.2.1 on x86_64 and -flto, the siphash_20b() call in tcp_hash()
doesn't see the connection address -- it gets all zeroes instead.

Fix this temporarily by disabling optimisations for this tcp_hash().

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow setting socket option on routing netlink socket

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow setcap on the process itself

2023-02-21T18:12:37+00:00

This is needed by the new functions in isolate.c, add the
corresponding rule.

Signed-off-by: Stefano Brivio

selinux: Switch to a more reasonable model for PID and socket files

2023-02-21T18:12:37+00:00

Instead of restricting PID files to /var/run/passt.pid, which is a
single file and unlikely to be used, use the user_tmp_t type which
should cover any reasonable need.

Signed-off-by: Stefano Brivio

selinux: Define interfaces for libvirt and similar frameworks

2023-02-21T18:12:37+00:00

Services running passt will commonly need to transition to its
domain, terminate it, connect and write to its socket.

The init_daemon_domain() macro now defines the default transition to
the passt_t domain, using the passt_exec_t type.

Signed-off-by: Stefano Brivio

selinux/passt.if: Fix typo in passt_read_data interface definition

2023-02-21T18:12:30+00:00

This is an example interface, currently unused, so it went undetected:
m4 macros need a backtick at the beginning of a block instead of a
single quote.

Fixes: 1f4b7fa0d75d ("passt, pasta: Add examples of SELinux policy modules")
Signed-off-by: Stefano Brivio

conf: Fix typo and logic in conf_ports() check for port binding

2023-02-16T18:59:07+00:00

Ouch, I accidentally pushed the previous change without running the
tests:

- we need to check, in conf_ports(), that udp_sock_init()
  managed to bind at least a port, not the opposite

- for -T and -U, we have no way to know if we'll manage to bind
  the port later, so never report an error for those

Fixes: 3d0de2c1d727 ("conf, tcp, udp: Exit if we fail to bind sockets for all given ports")
Signed-off-by: Stefano Brivio

conf, tap: Silence two false positive invalidFunctionArg from cppcheck

2023-02-16T18:19:23+00:00

The newly introduced die() calls exit(), but cppcheck doesn't see it
and warns about possibly invalid arguments used after the check which
triggers die(). Add return statements to silence the warnings.

Signed-off-by: Stefano Brivio

tcp: Remove 'zero_len' goto from tcp_data_from_sock

2023-02-16T17:56:37+00:00

This goto exists purely to move this exception case out of line.  Although
that does make the "normal" path a little clearer, it comes at the cost of
not knowing how where control will flow after jumping to the zero_len
label.  The exceptional case isn't that long, so just put it inline.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio