aboutgitcodebugslistschat
Commit message (Collapse)AuthorAgeFilesLines
* passt: Add PASTA mode, major reworkStefano Brivio2021-07-1720-1314/+2815
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | PASTA (Pack A Subtle Tap Abstraction) provides quasi-native host connectivity to an otherwise disconnected, unprivileged network and user namespace, similarly to slirp4netns. Given that the implementation is largely overlapping with PASST, no separate binary is built: 'pasta' (and 'passt4netns' for clarity) both link to 'passt', and the mode of operation is selected depending on how the binary is invoked. Usage example: $ unshare -rUn # echo $$ 1871759 $ ./pasta 1871759 # From another terminal # udhcpc -i pasta0 2>/dev/null # ping -c1 pasta.pizza PING pasta.pizza (64.190.62.111) 56(84) bytes of data. 64 bytes from 64.190.62.111 (64.190.62.111): icmp_seq=1 ttl=255 time=34.6 ms --- pasta.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 34.575/34.575/34.575/0.000 ms # ping -c1 spaghetti.pizza PING spaghetti.pizza(2606:4700:3034::6815:147a (2606:4700:3034::6815:147a)) 56 data bytes 64 bytes from 2606:4700:3034::6815:147a (2606:4700:3034::6815:147a): icmp_seq=1 ttl=255 time=29.0 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 28.967/28.967/28.967/0.000 ms This entails a major rework, especially with regard to the storage of tracked connections and to the semantics of epoll(7) references. Indexing TCP and UDP bindings merely by socket proved to be inflexible and unsuitable to handle different connection flows: pasta also provides Layer-2 to Layer-2 socket mapping between init and a separate namespace for local connections, using a pair of splice() system calls for TCP, and a recvmmsg()/sendmmsg() pair for UDP local bindings. For instance, building on the previous example: # ip link set dev lo up # iperf3 -s $ iperf3 -c ::1 -Z -w 32M -l 1024k -P2 | tail -n4 [SUM] 0.00-10.00 sec 52.3 GBytes 44.9 Gbits/sec 283 sender [SUM] 0.00-10.43 sec 52.3 GBytes 43.1 Gbits/sec receiver iperf Done. epoll(7) references now include a generic part in order to demultiplex data to the relevant protocol handler, using 24 bits for the socket number, and an opaque portion reserved for usage by the single protocol handlers, in order to track sockets back to corresponding connections and bindings. A number of fixes pertaining to TCP state machine and congestion window handling are also included here. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Skip pci.2 bus for pc-q35, add proper error reporting for probingStefano Brivio2021-07-171-12/+31
| | | | | | | | | | | On pc-q35, pci.2 is usually configured by libvirt as a hotplug bus, so we can't use address 0x0 there. Look for free busses starting from pci.3 instead. While at it, add proper error reporting for passt probing, and add some comments to structs that were previously missing. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* doc/demo.sh: Support IPv4-only environments tooStefano Brivio2021-07-171-12/+15
| | | | | | | If no IPv6 global addresses are available, proceed with just IPv4 addresses and routes. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Add support for kernels not exporting tcpi_snd_wnd via TCP_INFOStefano Brivio2021-06-081-6/+15
| | | | | | | | | | | | | | | | | | | | | Before commit 8f7baad7f035 ("tcp: Add snd_wnd to TCP_INFO"), the kernel didn't export tcpi_snd_wnd via TCP_INFO, which means we don't know what's the window size of the receiver, socket-side. To get TCP connections working in that case, ignore this value if it's zero during handshake, and use the initial window value as suggested by RFC 6928 (14 600 bytes, instead of 4 380 bytes), to keep network performance usable. To make the TCP dynamic responsive enough in this case, also check the socket for available data whenever we get an ACK segment from tap, instead of waiting until all the data from the tap is dequeued. While at it, fix the window scaling value sent for SYN and SYN, ACK segments: we want to increase the data pointer after writing the option, not the value itself. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Fix window size in initial SYN, ACK segment to guestStefano Brivio2021-06-051-4/+7
| | | | | | | | | | | | During handshake, the initial SYN, ACK segment to the guest, send as a response to the SYN segment, needs to report the unscaled value for the window, given that the handshake hasn't completed yet. While at it, fix the endianness for the window value in case TCP parameters can't be queried via TCP_INFO and we need to use the default value. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: When probing for an existing instance, also accept ENOENT on connect()Stefano Brivio2021-05-231-1/+1
| | | | | | | | The most common case is actually that no other instance created a socket with that name -- and that also means there is no other instance. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* util: On -DDEBUG, log to stderr with timestampsStefano Brivio2021-05-212-1/+27
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Also log to stderr, don't fork to background if not interactiveStefano Brivio2021-05-212-3/+3
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* icmp: Implement lazy bind for ping socketsStefano Brivio2021-05-212-3/+13
| | | | | | | | | It turns out that binding ICMP/ICMPv6 echo sockets takes a long time. Instead of binding all of them (one for each possible echo identification number, that is, 2^17) at start-up, bind them as ICMP/ICMPv6 packets are sent by the guest. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* ndp: Always answer neighbour solicitations with the requested target addressStefano Brivio2021-05-211-3/+10
| | | | | | | | The guest might try to resolve hosts other than the main host namespace (i.e. the gateway) -- just recycle the target address from the request and resolve it to the MAC address of the gateway. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Connect to the first available instance of passt, probe via ARP requestStefano Brivio2021-05-213-25/+68
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Add support for multiple instances in different network namespacesStefano Brivio2021-05-216-44/+114
| | | | | | | | | | | | | ...sharing the same filesystem. Instead of a fixed path for the UNIX domain socket, passt now uses a path with a counter, probing for existing instances, and picking the first free one. The demo script is updated accordingly -- it can now be started several times to create multiple namespaces with an instance of passt each, with addressing reflecting separate subnets, and NDP proxying between them. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Properly initialise parameters for SO_ACCEPTCONN getsockopt()Stefano Brivio2021-05-211-2/+3
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Actually enforce MAX_CONNS limitStefano Brivio2021-05-212-2/+12
| | | | | | | | | | | | | | and, given that the connection table is indexed by socket number, we also need to increase MAX_CONNS now as the ICMP implementation needs 2^17 sockets, that will be opened before TCP connections are accepted. This needs to be changed later: the connection table should be indexed by a translated number -- we're wasting 2^17 table entries otherwise. Move initialisation of TCP listening sockets as last per-protocol initialisation, this will make it easier. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* icmp: Implement ping tracking based on echo identifiersStefano Brivio2021-05-213-31/+33
| | | | | | | | | Open and bind a socket for each possible ICMP/ICMPv6 echo identifier, and add a tracking mechanism. Otherwise, multiple pings in parallel won't work, and a single ping to a different destination would make an existing ping sequence stop working. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Silence gcc -O3 warning about strncpy() buffer lengthStefano Brivio2021-05-211-1/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Close UNIX domain socket on failure before accepting new connectionsStefano Brivio2021-05-211-1/+3
| | | | | | | | The socket isn't necessarily closed, make sure we close it before getting a new one from accept(), so that we don't mix it up with protocol sockets numbering. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Introduce packet capture implementationStefano Brivio2021-05-215-2/+120
| | | | | | | | With -DDEBUG, passt now saves guest-side traffic captures in pcap format at /tmp/passt_<ISO8601 timestamp>.pcap. The timestamp refers to time and date of start-up. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Also drop -device e1000e,... from qemu command lineStefano Brivio2021-05-211-0/+1
| | | | | | | | As libvirt can pass e1000e (not just e1000) devices as well, make sure we also drop those network devices from the command line before adding the parameters we need. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* dhcp, ndp, dhcpv6: Support for multiple DNS servers, search listStefano Brivio2021-05-216-45/+312
| | | | | | | | | | | Add support for a variable amount of DNS servers, including zero, from /etc/resolv.conf, in DHCP, NDP and DHCPv6 implementations. Introduce support for domain search list for DHCP (RFC 3397), NDP (RFC 8106), and DHCPv6 (RFC 3646), also sourced from /etc/resolv.conf. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* dhcp: Increase lease time to maximum allowed valueStefano Brivio2021-05-211-5/+5
| | | | | | ...to make things simpler at least for the moment being. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: With -DDEBUG, also print protocol number for unsupported protocolsStefano Brivio2021-05-211-5/+5
| | | | | | | ...otherwise, we have no idea what's going on if we receive something unexpected. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Close socket on EPOLLHUP or EPOLLRDHUP in non-data stateStefano Brivio2021-05-211-0/+2
| | | | | | | If the peer doesn't shut down orderly, this might happen: just close the socket then. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Lowest usable PCI bus number for pc-q35 is actually 1Stefano Brivio2021-05-121-1/+1
| | | | | | ...3 was a left-over from a test. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Strip network devices from command line, set them up according to machineStefano Brivio2021-05-121-27/+94
| | | | | | | | | | | | The previous approach wasn't really robust: adding a -netdev option without libvirt knowing could result in clashes with other devices. Drop network devices from command line, check the available busses and addresses from all -device options according to the -machine parameter, and add a virtio-net device using an available address or bus. Then, add a corresponding -netdev socket option. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Adapt -net/-netdev command-line mangling to existing argumentsStefano Brivio2021-05-111-14/+22
| | | | | | | | If a socket netdev parameter is already passed, don't touch the command line. If it's not, add it, taking the id= reference from a netdev= parameter, if any. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Fix qemu name-guessing loop, add /usr/libexec/qemu-kvm as full path tooStefano Brivio2021-05-101-4/+5
| | | | | | | | | | The name-guessing loop should iterate over names, not single characters. Also add /usr/libexec/qemu-kvm as full path for execvp(): execvp() won't find it if it's not in $PATH, which is the reason why it shouldn't be under /usr/libexec/, but this seems to be the case for some current version of Fedora. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Don't fork into background until the UNIX domain socket isn't listeningStefano Brivio2021-05-101-4/+7
| | | | | | | | Once passt forks to background, it should be guaranteed that the UNIX domain socket is available, otherwise, if qemu is started right after it, it might fail to connect. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qrap: Find qemu command if not passed, patch command lineStefano Brivio2021-05-102-10/+82
| | | | | | | | | | | | | | It might be impractical to pass options to qrap when using libvirt, because the <emulator/> tag expects a path to an executable, without further arguments. If the first argument is not a plausible socket number, and the second argument is not a valid executable, look up a qemu command from a list of possible names, then start it patching the command line to include the -netdev fd= parameter corresponding to the AF_UNIX domain socket we just opened. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* icmp: Warn if "ping" socket can't be opened, don't failStefano Brivio2021-05-101-2/+16
| | | | | | | | If net.ipv4.ping_group_range doesn't include our PID, we'll fail to open sockets for ICMP and ICMPv6 echo. Warn instead of exiting, this is not fatal. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Keep just two arrays to print context IPv4 and IPv6 addressesStefano Brivio2021-05-101-9/+9
| | | | | | | | Multiple arrays, one for each address, were needed with a single fprintf(). Now that it's replaced by info(), we can have just one for each protocol version. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Don't use getprotobynumber() in debug buildStefano Brivio2021-05-101-3/+17
| | | | | | | | | With glibc, we can't reliably build a static binary with getprotobynumber(), which is currently used with -DDEBUG. Replace that with a small array of protocol strings. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* README: Mention the -DDEBUG flagStefano Brivio2021-05-101-0/+5
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* udp, passt: Introduce socket packet buffer, avoid getsockname() for UDPStefano Brivio2021-04-3010-34/+103
| | | | | | | | | | This is in preparation for scatter-gather IO on the UDP receive path: save a getsockname() syscall by setting a flag if we get the numbering of all bound sockets in a strict sequence (expected, in practice) and repurpose the tap buffer to be also a socket receive buffer, passing it down to protocol handlers. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* udp: Connection tracking for ephemeral, local ports, and related fixesStefano Brivio2021-04-2914-135/+440
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As we support UDP forwarding for packets that are sent to local ports, we actually need some kind of connection tracking for UDP. While at it, this commit introduces a number of vaguely related fixes for issues observed while trying this out. In detail: - implement an explicit, albeit minimalistic, connection tracking for UDP, to allow usage of ephemeral ports by the guest and by the host at the same time, by binding them dynamically as needed, and to allow mapping address changes for packets with a loopback address as destination - set the guest MAC address whenever we receive a packet from tap instead of waiting for an ARP request, and set it to broadcast on start, otherwise DHCPv6 might not work if all DHCPv6 requests time out before the guest starts talking IPv4 - split context IPv6 address into address we assign, global or site address seen on tap, and link-local address seen on tap, and make sure we use the addresses we've seen as destination (link-local choice depends on source address). Similarly, for IPv4, split into address we assign and address we observe, and use the address we observe as destination - introduce a clock_gettime() syscall right after epoll_wait() wakes up, so that we can remove all the other ones and pass the current timestamp to tap and socket handlers -- this is additionally needed by UDP to time out bindings to ephemeral ports and mappings between loopback address and a local address - rename sock_l4_add() to sock_l4(), no semantic changes intended - include <arpa/inet.h> in passt.c before kernel headers so that we can use <netinet/in.h> macros to check IPv6 address types, and remove a duplicate <linux/ip.h> inclusion Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Use uint32_t for IPv4 context addressesStefano Brivio2021-04-291-4/+4
| | | | | | ...so that we can compare them directly with a struct in_addr. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Avoid SO_ACCEPTCONN getsockopt() by noting listening/data sockets numbersStefano Brivio2021-04-295-56/+87
| | | | | | | ...the rest is reshuffling existing macros to use the bits we need in TCP code. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp: Preserve data sent during SOCK_SYN_SENT stateStefano Brivio2021-04-291-3/+20
| | | | | | | | | | Seen with iperf3 server on tap side: connection state is SOCK_SYN_SENT, we haven't got an ACK from the tap yet (that's why we're not in ESTABLISHED), but a data packet comes. Don't read this data until we reach the ESTABLISHED state, by keeping EPOLLIN disabled until that point. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* udp: Disable SO_ZEROCOPY againStefano Brivio2021-04-251-8/+2
| | | | | | | | ...on a second thought, this won't really help with veth, and actually causes a significant overhead as we get EPOLLERR whenever another process is tapping on the traffic. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Spare some syscalls, add some optimisations from profilingStefano Brivio2021-04-2310-49/+139
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid a bunch of syscalls on forwarding paths by: - storing minimum and maximum file descriptor numbers for each protocol, fall back to SO_PROTOCOL query only on overlaps - allocating a larger receive buffer -- this can result in more coalesced packets than sendmmsg() can take (UIO_MAXIOV, i.e. 1024), so make sure we don't exceed that within a single call to protocol tap handlers - nesting the handling loop in tap_handler() in the receive loop, so that we have better chances of filling our receive buffer in fewer calls - skipping the recvfrom() in the UDP handler on EPOLLERR -- there's nothing to be done in that case and while at it: - restore the 20ms timer interval for periodic (TCP) events, I accidentally changed that to 100ms in an earlier commit - attempt using SO_ZEROCOPY for UDP -- if it's not available, sendmmsg() will succeed anyway - fix the handling of the status code from sendmmsg(), if it fails, we'll try to discard the first message, hence return 1 from the UDP handler Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* doc/demo: Set send and receive buffers to 16MiBStefano Brivio2021-04-231-0/+6
| | | | | | | Otherwise, buffers for UNIX domain sockets are limited to about 200KB. This makes performance testing a bit more consistent. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* doc/demo: Bring up loopback interface in network namespaceStefano Brivio2021-04-221-0/+1
| | | | | | | Otherwise, connections to the local host (which becomes the guest, actually) will fail. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* dhcpv6: Don't pass DNS option, it already comes from SLAACStefano Brivio2021-04-221-5/+0
| | | | | | | | | | | | It looks like some versions of ISC's IPv6 dhclient not only discard the DNS Recursive Name Server option if other options (Domain Search List? FQDN?) are absent, but they also drop existing entries configured via SLAAC from /etc/resolv.conf. Don't pass option 23 until I figure this out, it's anyway redundant as we pass DNS information via SLAAC (RFC 8106). Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* tcp, udp: Replace loopback source address by gateway addressStefano Brivio2021-04-222-0/+15
| | | | | | | | This is symmetric with tap operation and addressing model, and allows again to reach the guest behind the tap interface by contacting the local address. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Don't unconditionally disable forking to backgroundStefano Brivio2021-04-221-1/+1
| | | | | | | ...I left this there by mistake while debugging the debug stuff. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Introduce packet batching mechanismStefano Brivio2021-04-228-118/+333
| | | | | | | | | | Receive packets in batches from AF_UNIX, check if they can be sent with a single syscall, and batch them up with sendmmsg() in case. A bit rudimentary, currently only implemented for UDP, but it seems to work. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* libvirt: Rebase to latest upstreamStefano Brivio2021-04-221-31/+32
| | | | | | The libvirt patch is now rebased on top of current HEAD, f0e5100f002a Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* qemu: Rebase patches on latest upstreamStefano Brivio2021-04-222-29/+51
| | | | | | qemu patches are now rebased on top of current HEAD, 3791642c8d60 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* doc/demo: Explicitly add route to guestStefano Brivio2021-04-221-0/+1
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
* passt: Print ports in debug messages only for protocols with portsStefano Brivio2021-04-221-2/+5
| | | | Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 19:21:44 +0000