1
0
mirror of https://passt.top/passt synced 2024-12-22 05:35:23 +00:00
passt implements a translation layer between a Layer-2 network interface and native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't require any capabilities or privileges, and it can be used as a simple replacement for Slirp.
Go to file
Stefano Brivio ff22a78d7b pasta: Don't try to watch namespaces in procfs with inotify, use timer instead
We watch network namespace entries to detect when we should quit
(unless --no-netns-quit is passed), and these might stored in a tmpfs
typically mounted at /run/user/UID or /var/run/user/UID, or found in
procfs at /proc/PID/ns/.

Currently, we try to use inotify for any possible location of those
entries, but inotify, of course, doesn't work on pseudo-filesystems
(see inotify(7)).

The man page reflects this: the description of --no-netns-quit
implies that we won't quit anyway if the namespace is not "bound to
the filesystem".

Well, we won't quit, but, since commit 9e0dbc8948 ("More
deterministic detection of whether argument is a PID, PATH or NAME"),
we try. And, indeed, this is harmless, as the caveat from that
commit message states.

Now, it turns out that Buildah, a tool to create container images,
sharing its codebase with Podman, passes a procfs entry to pasta, and
expects pasta to exit once the network namespace is not needed
anymore, that is, once the original container process, also spawned
by Buildah, terminates.

Get this to work by using the timer fallback mechanism if the
namespace name is passed as a path belonging to a pseudo-filesystem.
This is expected to be procfs, but I covered sysfs and devpts
pseudo-filesystems as well, because nothing actually prevents
creating this kind of directory structure and links there.

Note that fstatfs(), according to some versions of man pages, was
apparently "deprecated" by the LSB. My reasoning for using it is
essentially this:
  https://lore.kernel.org/linux-man/f54kudgblgk643u32tb6at4cd3kkzha6hslahv24szs4raroaz@ogivjbfdaqtb/t/#u

...that is, there was no such thing as an LSB deprecation, and
anyway there's no other way to get the filesystem type.

Also note that, while it might sound more obvious to detect the
filesystem type using fstatfs() on the file descriptor itself
(c->pasta_netns_fd), the reported filesystem type for it is nsfs, no
matter what path was given to pasta. If we use the parent directory,
we'll typically have either tmpfs or procfs reported.

If the target namespace is given as a PID, or as a PID-based procfs
entry, we don't risk races if this PID is recycled: our handle on
/proc/PID/ns will always refer to the original namespace associated
with that PID, and we don't re-open this entry from procfs to check
it.

There's, however, a remaining race possibility if the parent process
is not the one associated to the network namespace we operate on: in
that case, the parent might pass a procfs entry associated to a PID
that was recycled by the time we parse it. This can't happen if the
namespace PID matches the one of the parent, because we detach from
the controlling terminal after parsing the namespace reference.

To avoid this type of race, if desired, we could add the option for
the parent to pass a PID file descriptor, that the parent obtained
via pidfd_open(). This is beyond the scope of this change.

Update the man page to reflect that, even if the target network
namespace is passed as a procfs path or a PID, we'll now quit when
the procfs entry is gone.

Reported-by: Paul Holzinger <pholzing@redhat.com>
Link: https://github.com/containers/podman/pull/21563#issuecomment-1948200214
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2024-02-19 19:58:50 +01:00
contrib selinux: Allow pasta to remount procfs 2024-02-16 09:43:12 +01:00
doc passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
hooks passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
LICENSES passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
test test: Fix passt.mbuto for cases where /usr/sbin doesn't exist 2024-01-16 21:48:31 +01:00
.gitignore test/perf: Get iperf3 stats from client side 2023-11-07 09:56:06 +01:00
.gitpublish Add git-publish configuration file 2022-10-22 03:45:50 +02:00
arch.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
arch.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
arp.c passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
arp.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
checksum.c checksum: Don't use linux/icmp.h when netinet/ip_icmp.h will do 2023-12-27 19:29:45 +01:00
checksum.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
conf.c conf: No routable interface for IPv4 or IPv6 is informational, not a warning 2024-02-16 08:47:14 +01:00
conf.h port_fwd: Move automatic port forwarding code to port_fwd.[ch] 2023-11-07 09:53:14 +01:00
dhcp.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
dhcp.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
dhcpv6.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
dhcpv6.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
flow_table.h flow: Avoid moving flow entries to compact table 2024-01-22 23:35:37 +01:00
flow.c flow: Avoid moving flow entries to compact table 2024-01-22 23:35:37 +01:00
flow.h flow: Avoid moving flow entries to compact table 2024-01-22 23:35:37 +01:00
icmp.c icmp: Dedicated functions for starting and closing ping sequences 2024-01-22 23:36:56 +01:00
icmp.h icmp: Consolidate icmp_sock_handler() with icmpv6_sock_handler() 2024-01-22 23:36:51 +01:00
igmp.c passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
inany.h treewide: Add messages to static_assert() calls 2023-12-04 09:50:53 +01:00
isolation.c cppcheck: Make many pointers const 2023-10-04 23:23:35 +02:00
isolation.h cppcheck: Make many pointers const 2023-10-04 23:23:35 +02:00
lineread.c passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
lineread.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
log.c log: setlogmask(0) can actually result in a system call, don't use it 2024-02-14 01:10:11 +01:00
log.h log: Add vlogmsg() 2023-11-07 09:54:59 +01:00
Makefile pif: Add helpers to get the name of a pif 2023-12-04 09:51:29 +01:00
mld.c passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
ndp.c ndp: Extend lifetime of prefix, router, RDNSS and search list 2023-12-27 19:22:29 +01:00
ndp.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
netlink.c netlink: Use const rtnh pointer 2024-02-14 01:10:47 +01:00
netlink.h cppcheck: Make many pointers const 2023-10-04 23:23:35 +02:00
packet.c packet: Offset plus length is not always uint32_t, but it's always size_t 2023-12-02 03:54:47 +01:00
packet.h Avoid shadowing index(3) 2023-09-27 17:25:51 +02:00
passt.1 pasta: Don't try to watch namespaces in procfs with inotify, use timer instead 2024-02-19 19:58:50 +01:00
passt.c pasta: Add fallback timer mechanism to check if namespace is gone 2024-02-16 08:47:14 +01:00
passt.h pasta: Add fallback timer mechanism to check if namespace is gone 2024-02-16 08:47:14 +01:00
pasta.c pasta: Don't try to watch namespaces in procfs with inotify, use timer instead 2024-02-19 19:58:50 +01:00
pasta.h pasta: Add fallback timer mechanism to check if namespace is gone 2024-02-16 08:47:14 +01:00
pcap.c treewide: Use 'z' length modifier for size_t/ssize_t conversions 2023-12-02 03:54:42 +01:00
pcap.h passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
pif.c pif: Add helpers to get the name of a pif 2023-12-04 09:51:29 +01:00
pif.h pif: Remove unused pif_name() function 2024-01-16 21:49:30 +01:00
port_fwd.c port_fwd, util: Include additional headers to fix build with musl 2023-12-02 03:54:55 +01:00
port_fwd.h port_fwd, util: Don't bind UDP ports with opposite-side bound TCP ports 2023-11-22 07:19:36 +01:00
qrap.1 passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
qrap.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
README.md README: Default SLAAC prefix comes from address (not prefix) on host 2023-12-30 11:45:27 +01:00
seccomp.sh seccomp: Make seccomp.sh re-entrancy safe 2023-06-25 23:49:11 +02:00
siphash.h siphash: Make internal helpers public 2023-09-30 12:40:50 +02:00
slirp4netns.sh passt: Relicense to GPL 2.0, or any later version 2023-04-06 18:00:33 +02:00
tap.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
tap.h tcp, tap: Don't increase tap-side sequence counter for dropped frames 2023-10-04 23:39:58 +02:00
tcp_conn.h flow: Avoid moving flow entries to compact table 2024-01-22 23:35:37 +01:00
tcp_splice.c flow: Avoid moving flow entries to compact table 2024-01-22 23:35:37 +01:00
tcp_splice.h tcp, tcp_splice: Avoid double layered dispatch for connected TCP sockets 2024-01-22 23:35:25 +01:00
tcp.c tcp: Fix subtle bug in fast re-transmit path 2024-02-11 18:30:01 +01:00
tcp.h treewide: Standardise on 'now' for current timestamp variables 2024-01-22 23:35:10 +01:00
udp.c udp: udp_sock_init_ns() partially duplicats udp_port_rebind_outbound() 2024-02-14 03:24:23 +01:00
udp.h treewide: Standardise on 'now' for current timestamp variables 2024-01-22 23:35:10 +01:00
util.c treewide: Make a bunch of pointer variables pointers to const 2024-01-16 21:49:27 +01:00
util.h util: Use htonl_constant() in more places 2023-12-27 19:29:45 +01:00

passt: Plug A Simple Socket Transport

passt implements a translation layer between a Layer-2 network interface and native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't require any capabilities or privileges, and it can be used as a simple replacement for Slirp.

Overview diagram of passt

pasta: Pack A Subtle Tap Abstraction

pasta (same binary as passt, different command) offers equivalent functionality, for network namespaces: traffic is forwarded using a tap interface inside the namespace, without the need to create further interfaces on the host, hence not requiring any capabilities or privileges.

It also implements a tap bypass path for local connections: packets with a local destination address are moved directly between Layer-4 sockets, avoiding Layer-2 translations, using the splice(2) and recvmmsg(2)/sendmmsg(2) system calls for TCP and UDP, respectively.

Overview diagram of pasta

See also the man page.

Motivation

passt

When container workloads are moved to virtual machines, the network traffic is typically forwarded by interfaces operating at data link level. Some components in the containers ecosystem (such as service meshes), however, expect applications to run locally, with visible sockets and processes, for the purposes of socket redirection, monitoring, port mapping.

To solve this issue, user mode networking, as provided e.g. by libslirp, can be used. Existing solutions implement a full TCP/IP stack, replaying traffic on sockets that are local to the pod of the service mesh. This creates the illusion of application processes running on the same host, eventually separated by user namespaces.

While being almost transparent to the service mesh infrastructure, that kind of solution comes with a number of downsides:

  • three different TCP/IP stacks (guest, adaptation and host) need to be traversed for every service request
  • addressing needs to be coordinated to create the pretense of consistent addresses and routes between guest and host environments. This typically needs a NAT with masquerading, or some form of packet bridging
  • the traffic seen by the service mesh and observable externally is a distant replica of the packets forwarded to and from the guest environment:
    • TCP congestion windows and network buffering mechanisms in general operate differently from what would be naturally expected by the application
    • protocols carrying addressing information might pose additional challenges, as the applications don't see the same set of addresses and routes as they would if deployed with regular containers

passt implements a thinner layer between guest and host, that only implements what's strictly needed to pretend processes are running locally. The TCP adaptation doesn't keep per-connection packet buffers, and reflects observed sending windows and acknowledgements between the two sides. This TCP adaptation is needed as passt runs without the CAP_NET_RAW capability: it can't create raw IP sockets on the pod, and therefore needs to map packets at Layer-2 to Layer-4 sockets offered by the host kernel.

See also a detailed illustration of the problem and what lead to this approach.

pasta

On Linux, regular users can create network namespaces and run application services inside them. However, connecting namespaces to other namespaces and to external hosts requires the creation of network interfaces, such as veth pairs, which needs in turn elevated privileges or the CAP_NET_ADMIN capability. pasta, similarly to slirp4netns, solves this problem by creating a tap interface available to processes in the namespace, and mapping network traffic outside the namespace using native Layer-4 sockets.

Existing approaches typically implement a full, generic TCP/IP stack for this translation between data and transport layers, without the possibility of speeding up local connections, and usually requiring NAT. pasta:

  • avoids the need for a generic, full-fledged TCP/IP stack by coordinating TCP connection dynamics between sender and receiver
  • offers a fast bypass path for local connections: if a process connects to another process on the same host across namespaces, data is directly forwarded using pairs of Layer-4 sockets
  • with default options, maps routing and addressing information to the namespace, avoiding any need for NAT

Features

: done/supported, : out of scope, 🛠: in progress/being considered : nice-to-have, eventually

Protocols

  • IPv4
    • all features, except for
    • fragmentation
  • IPv6
    • all features, except for
    • fragmentation
    • jumbograms
  • TCP
  • UDP
  • ICMP/ICMPv6 Echo
  • IGMP/MLD proxy
  • SCTP

Portability

Security

  • no dynamic memory allocation (sbrk(2), brk(2), mmap(2) blocked via seccomp)
  • root operation not allowed outside user namespaces
  • all capabilities dropped, other than CAP_NET_BIND_SERVICE (if granted)
  • with default options, user, mount, IPC, UTS, PID namespaces are detached
  • no external dependencies (other than a standard C library)
  • restrictive seccomp profiles (30 syscalls allowed for passt, 41 for pasta on x86_64)
  • examples of AppArmor and SELinux profiles available
  • static checkers in continuous integration (clang-tidy, cppcheck)
  • clearly defined boundary-checked packet abstraction
  • 🛠️ ~5 000 LoC target
  • fuzzing, packetdrill tests
  • stricter synflood protection
  • 💡 add your ideas

Configurability

  • all addresses, ports, port ranges
  • optional NAT, not required
  • all protocols
  • pasta: auto-detection of bound ports
  • run-time configuration of port ranges without autodetection
  • configuration of port ranges for autodetection
  • 💡 add your ideas

Performance

  • maximum two (cache hot) copies on every data path
  • pasta: zero-copy for local connections by design (no configuration needed)
  • generalised coalescing and batching on every path for every supported protocol
  • 4 to 50 times IPv4 TCP throughput of existing, conceptually similar solutions depending on MTU (UDP and IPv6 hard to compare)
  • 🛠 vhost-user support for maximum one copy on every data path and lower request-response latency
  • multithreading
  • raw IP socket support if CAP_NET_RAW is granted
  • eBPF support (might not improve performance over vhost-user)

Interfaces

Availability

Services

  • built-in ARP proxy
  • minimalistic DHCP server
  • minimalistic NDP proxy with router advertisements and SLAAC support
  • minimalistic DHCPv6 server
  • fine-grained configurability of DHCP, NDP, DHCPv6 options

Interfaces and Environment

passt exchanges packets with qemu via UNIX domain socket, using the socket back-end in qemu. This is supported since qemu 7.2.

For older versions, the qrap wrapper can be used to connect to a UNIX domain socket and to start qemu, which can now use the file descriptor that's already opened.

This approach, compared to using a tap device, doesn't require any security capabilities, as we don't need to create any interface.

pasta runs out of the box with any recent (post-3.8) Linux kernel.

Services

passt and pasta provide some minimalistic implementations of networking services:

  • ARP proxy, that resolves the address of the host (which is used as gateway) to the original MAC address of the host
  • DHCP server, a simple implementation handing out one single IPv4 address to the guest or namespace, namely, the same address as the first one configured for the upstream host interface, and passing the nameservers configured on the host
  • NDP proxy, which can also assign prefix and nameserver using SLAAC
  • DHCPv6 server: a simple implementation handing out one single IPv6 address to the guest or namespace, namely, the the same address as the first one configured for the upstream host interface, and passing the nameservers configured on the host

Addresses

For IPv4, the guest or namespace is assigned, via DHCP, the same address as the upstream interface of the host, and the same default gateway as the default gateway of the host. Addresses are translated in case the guest is seen using a different address from the assigned one.

For IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from the address of the upstream interface of the host, the same default route as the default route of the host, and, if a DHCPv6 client is running in the guest or namespace, also the same address as the upstream address of the host. This means that, with a DHCPv6 client in the guest or namespace, addresses don't need to be translated. Should the client use a different address, the destination address is translated for packets going to the guest or to the namespace.

Local connections with passt

For UDP and TCP, for both IPv4 and IPv6, packets from the host addressed to a loopback address are forwarded to the guest with their source address changed to the address of the gateway or first hop of the default route. This mapping is reversed on the other way.

Local connections with pasta

Packets addressed to a loopback address in either namespace are directly forwarded to the corresponding (or configured) port in the other namespace. Similarly as passt, packets from the non-init namespace addressed to the default gateway, which are therefore sent via the tap device, will have their destination address translated to the loopback address.

Protocols

passt and pasta support TCP, UDP and ICMP/ICMPv6 echo (requests and replies). More details about the TCP implementation are described in the theory of operation, and similarly for UDP.

An IGMP/MLD proxy is currently work in progress.

Ports

passt

To avoid the need for explicit port mapping configuration, passt can bind to all unbound non-ephemeral (0-49152) TCP and UDP ports. Binding to low ports (0-1023) will fail without additional capabilities, and ports already bound (service proxies, etc.) will also not be used. Smaller subsets of ports, with port translations, are also configurable.

UDP ephemeral ports are bound dynamically, as the guest uses them.

If all ports are forwarded, service proxies and other services running in the container need to be started before passt starts.

pasta

With default options, pasta scans for bound ports on init and non-init namespaces, and automatically forwards them from the other side. Port forwarding is fully configurable with command line options.

Demo

pasta

passt

Continuous Integration

See also the test logs.

Performance

Try it

passt

  • build from source:

      git clone https://passt.top/passt
      cd passt
      make
    
    • alternatively, install one of the available packages

      Static binaries and packages are simply built with:

        make pkgs
      
  • have a look at the man page for synopsis and options:

      man ./passt.1
    
  • run the demo script, that detaches user and network namespaces, configures the new network namespace using pasta, starts passt and, optionally, qemu:

      doc/demo.sh
    
  • alternatively, you can use libvirt to start QEMU

  • and that's it, you should now have TCP connections, UDP, and ICMP/ICMPv6 echo working from/to the guest for IPv4 and IPv6

  • to connect to a service on the VM, just connect to the same port directly with the address of the current network namespace

pasta

  • build from source:

      git clone https://passt.top/passt
      cd passt
      make
    
    • alternatively, install one of the available packages

      Static binaries and packages are simply built with:

        make pkgs
      
  • have a look at the man page for synopsis and options:

      man ./pasta.1
    
  • start pasta with:

      ./pasta
    
    • alternatively, use it directly with Podman (since Podman 4.3.2, or with commit aa47e05ae4a0):

        podman run --net=pasta ...
      
  • you're now inside a new user and network namespace. For IPv6, SLAAC happens right away as pasta sets up the interface, but DHCPv6 support is available as well. For IPv4, configure the interface with a DHCP client:

      dhclient
    

    and, optionally:

      dhclient -6
    
    • alternatively, start pasta as:

        ./pasta --config-net
      

      to let pasta configure networking in the namespace by itself, using netlink

    • ...or run the demo script:

        doc/demo.sh
      
  • and that's it, you should now have TCP connections, UDP, and ICMP/ICMPv6 echo working from/to the namespace for IPv4 and IPv6

  • to connect to a service inside the namespace, just connect to the same port using the loopback address.

Contribute

Mailing Lists

  • Submit, review patches, and discuss development ideas on passt-dev

  • Ask your questions and discuss usage needs on passt-user

Bug Reports and Feature Requests

Chat

Weekly development meeting

  • Open to everybody! Feel free to join and propose a different time directly on the agenda.

Security and Vulnerability Reports

  • Please send an email to passt-sec, private list, no subscription required