passt, branch 2023_03_10.70c0765

fedora: Install SELinux interface files to shared include directory

2023-03-10T19:01:41+00:00

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Split interfaces into smaller bits

2023-03-10T19:01:41+00:00

...to fit accepted Fedora practices.

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Drop unused passt_read_data() interface

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib/selinux: Drop "example" from headers: this is the actual policy

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

README: Update Features section, plus minor improvements

2023-03-09T02:44:21+00:00

...it's been a while.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0

2023-03-09T02:44:21+00:00

...and in any case, this patch doesn't offer any advantage over the
current upstream integration.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop QEMU out-of-tree patches

2023-03-09T02:44:21+00:00

Native support was introduced with commit 13c6be96618c, QEMU 7.2.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop Podman out-of-tree patch, integration is upstream now

2023-03-09T02:44:21+00:00

See https://github.com/containers/podman/pull/16141, shipped in
Podman 4.4.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

tcp: Clamp MSS value when queueing data to tap, also for pasta

2023-03-09T02:44:21+00:00

Tom reports that a pattern of repated ~1 MiB chunks downloads over
NNTP over TLS, on Podman 4.4 using pasta as network back-end, results
in pasta taking one full CPU thread after a while, and the download
never succeeds.

On that setup, we end up re-sending the same frame over and over,
with a consistent 65 534 bytes size, and never get an
acknowledgement from the tap-side client. This only happens for the
default MTU value (65 520 bytes) or for values that are slightly
smaller than that (down to 64 499 bytes).

We hit this condition because the MSS value we use in
tcp_data_from_sock(), only in pasta mode, is simply clamped to
USHRT_MAX, and not to the actual size of the buffers we pre-cooked
for sending, which is a bit less than that.

It looks like we got away with it until commit 0fb7b2b9080a ("tap:
Use different io vector bases depending on tap type") fixed the
setting of iov_len.

Luckily, since it's pasta, we're queueing up to two frames at a time,
so the worst that can happen is a badly segmented TCP stream: we
always have some space at the tail of the buffer.

Clamp the MSS value to the appropriate maximum given by struct
tcp{4,6}_buf_data_t, no matter if we're running in pasta or passt
mode.

While at it, fix the comments to those structs to reflect the current
struct size. This is not really relevant for any further calculation
or consideration, but it's convenient to know while debugging this
kind of issues.

Thanks to Tom for reporting the issue in a very detailed way and for
providing a test setup.

Reported-by: Tom Mombourquette 
Link: https://github.com/containers/podman/issues/17703
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

conf: Terminate on EMFILE or ENFILE on sockets for port mapping

2023-03-09T02:44:21+00:00

In general, we don't terminate or report failures if we fail to bind
to some ports out of a given port range specifier, to allow users to
conveniently specify big port ranges (or "all") without having to
care about ports that might already be in use.

However, running out of the open file descriptors quota is a
different story: we can't do what the user requested in a very
substantial way.

For example, if the user specifies '-t all' and we can only bind
1024 sockets, the behaviour is rather unexpected.

Fail whenever socket creation returns -ENFILE or -EMFILE.

Link: https://bugs.passt.top/show_bug.cgi?id=27
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson