passt/util.c, branch 2026_07_28.f8df3f1

main: Ensure fds 0-2 are populated

2026-07-18T07:54:37+00:00

Usually fds 0-2 are stdin, stdout and stderr.  However, there are certain
use cases where passt can be invoked with one or more of those standard fds
closed.  In those cases, anything we open might be placed in one of the
standard slots.  For the handful of things we open early enough, this can
be a problem because we close fds 0-2 in __daemon(), replacing them with
dupes of /dev/null.

We could avoid closing those fds in __daemon() if they're not standard
streams.  However, leaving things other than the standard streams in fds
0-2 is a footgun: a stray printf() that occurs in a circumstance it
shouldn't could send harmful garbage to a device or socket.  It's also
likely to be confusing if debugging with strace or similar.

To avoid this, fill any missing standard streams with a dupe of /dev/null,
right after isolate_fds().  Since open()ing /dev/null itself could land in
one of those fd 0-2 slots, we need to be careful when we close it not to
leave a new gap.

Link: https://bugs.passt.top/show_bug.cgi?id=215
Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

isolation: Move close_open_files() to isolate_fds()

2026-07-18T07:54:24+00:00

Most functions in util.c are, well, utilities, that are useful in a bunch
of places.  close_open_files(), however, is very specific, it's only called
from isolate_initial(), and performs a very specific step of our self
isolation.  So, it makes more sense as a function in isolate.c - move it
there and rename it to isolate_fds().

In addition, call it directly from main() rather than from
isolate_initial().  That's pretty arbitrary now, but will make some
subsequent changes easier.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

conf: Remove duplicate parsing of -F option

2026-07-04T11:13:59+00:00

The -F option is parsed in conf() along with everything else.  However,
because it informs what fds we can close at startup, we also have a special
case parse of it in close_open_files().

At present we duplicate the parsing and validation code, which is a bit
risky.  Avoid that with a conf_tap_fd() helper.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

pif, util: Move listen(2) call from sock_l4_() to pif_listen()

2026-06-16T21:50:00+00:00

It's a bit odd to have the listen(2) call for TCP listening sockets, down
deep in sock_l4_() conditional upon the epoll type passed in.  Move it to
pif_listen(), which is at least about listening, although it does still
need to be conditional on TCP.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

cppcheck: Add workaround for cppcheck bug 14847

2026-06-16T21:49:36+00:00

It seems the function pointer argument confuses cppcheck 2.21.0 (at least),
causing it to think do_clone()'s definition has different argument names
than it's declaration, even though that's not the case.  I made a minimal
reproducer and filed a cppcheck bug for this (see link).  In the meanwhile
work around it with an explicit suppression.

Link: https://trac.cppcheck.net/ticket/14847
Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

util, passt: Close daemon-lifetime fds on exit to avoid Coverity warning

2026-06-11T23:02:35+00:00

conf_open_files() opens three file descriptors (fd_tap_listen,
fd_repair_listen, fd_control_listen) that are held for the entire
daemon lifetime.  Because no close() call exists for them
anywhere, Coverity flags each as INCOMPLETE_DEALLOCATOR. This is
clearly a false positive, but we still want to get rid of this
warning.

We now register the execution context in global area so that
passt_exit() can use it to close these descriptors before calling
_exit().  All exit paths (signal handler, die(), die_perror())
funnel through passt_exit(), so this covers all cases.

Signed-off-by: Jon Maloy 
Reviewed-by: David Gibson 
Signed-off-by: Stefano Brivio

conf, util: Disable IPv6 if explicit IPv6 socket probe fails

2026-06-10T14:48:44+00:00

In https://bugs.passt.top/show_bug.cgi?id=188, I originally reported
that if IPv6 is disabled in the kernel (for example via command line
parameter ipv6.disable=1, or disabled in build configuration), and we
attempt to forward any port, we'll exit right away after failing to
set up dual-stack listening sockets.

The original instance of that issue is now fixed for pasta by commit
75dcbc300bf0 ("pasta: Warn, disable matching IP version if not
supported, in local mode") together with the new implementation of
the rule forwarding table, starting from commit b223bec48213 ("fwd,
tcp, udp: Set up listening sockets based on forward table"), because
we first parse forwarding options, then probe for IPv6 support in the
target namespace (and disable IPv6 as a result), and finally bind
sockets once we already know that IPv6 support is disabled.

But we don't do that when invoked as passt, because we have no target
namespace and hence no probing for IPv6 support whatsoever.

Add IPv6 to the socket features we test in sock_probe_features(), and,
if we fail to create an IPv6 socket for whatever reason (which might
include security policies as well), disable IPv6 support altogether,
so that we won't attempt to use dual-stack sockets for port forwarding
either.

Note that the probe comes without any sort of debug message, because
at this point we haven't parsed the configuration yet, and we would
therefore print that regardless of the selected logging level and
other options, including --ipv4-only, which would be rather confusing.
I doubt we'll miss this kind of message though, IPv6 support being
disabled is anyway obvious from the initial configuration dump.

Reported-by: Chi Cuong HA 
Reported-by: Romain Geissler 
Link: https://bugs.passt.top/show_bug.cgi?id=188
Fixes: 4ddd59bc6085 ("conf: Separate local mode for each IP version, don't enable disabled IP version")
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

pcap: Pass explicit L2 length to pcap_iov()

2026-05-19T23:21:42+00:00

With vhost-user multibuffer frames, the iov can be larger than the
actual L2 frame. The previous approach of computing L2 length as
iov_size() - offset would overcount and write extra bytes into the
pcap file.

Pass the L2 frame length explicitly to pcap_frame() and pcap_iov(),
and write exactly that many bytes instead of the full iov remainder.

Signed-off-by: Laurent Vivier 
Reviewed-by: Jon Maloy 
Reviewed-by: David Gibson 
Signed-off-by: Stefano Brivio

bitmap: Split bitmap helper functions into their own module

2026-03-28T13:36:02+00:00

Currently bitmap functions are in util.[ch] along with a lot of other
stuff.  In preparation for sharing them with a configuration client, move
these out into their own files.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

serialise: Split functions user for serialisation from util.c

2026-03-28T13:35:41+00:00

The read_all_buf() and write_all_buf() functions in util.c are
primarily used for serialising data structures to a stream during
migraiton.  We're going to have further use for such serialisation
when we add dynamic configuration updates, where we'll want to share
the code with the client program.

To make that easier move the functions into a new serialise.c
file, and rename thematically.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio