From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=YCgfndTw; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 316105A0623 for ; Sat, 10 Jan 2026 19:12:33 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1768068752; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AWrQHTzDkiPExBrQIqrD7VsqcmhbwTf4ILrFQOND7wU=; b=YCgfndTwn0VwWMnQrR6HYK6PDnFflXrW6CmQDC1rMpt9ExzSsoMbulnZUL9FhffFnTGE/3 6N2Fx9f1i722K6iJ+LaJqPBrVHSXvZYs2j9IYyxW97Fg7J9I700OlY5jV7zFgMmXi/sjmM LwWnZclS7fkOds/1+kQnGA94cgtWCcc= Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-634-OOJb5X02OFym_r90p5lu_Q-1; Sat, 10 Jan 2026 13:12:30 -0500 X-MC-Unique: OOJb5X02OFym_r90p5lu_Q-1 X-Mimecast-MFC-AGG-ID: OOJb5X02OFym_r90p5lu_Q_1768068749 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-430f5dcd4cdso2704717f8f.2 for ; Sat, 10 Jan 2026 10:12:30 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768068749; x=1768673549; h=content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=AWrQHTzDkiPExBrQIqrD7VsqcmhbwTf4ILrFQOND7wU=; b=AudHRz+gia02cQ+N6FRdJMDHOIGy2dWpVlRbGJ88zZA7nywhKArmdV7su6+KP2S3tg lhO9W8383SLPfu30AbWYdUOKLPYdPrdMm01CYHAoGWt+cte1iwjEcAX1RNIKAG625jbg b/dZGWcQ5K8CX43trC+lATtPK8wUnFIiNZLlWVynjcjPbgkRvqnb7Dv+bGY8dFOsxb07 oaS5o2wR2fAkB5Zbc+Lfr4Dr6Q3YMawoOfVz0toS7nOgMUJOgPpNPIvge3XFSLJcXcy5 MUuooSf2WU9tPWL2wb+70L4d6ErhN6mydQZi6rAvWOekfnG1tiL0BBIOjk8F1rmiNrlZ Z5AA== X-Gm-Message-State: AOJu0YxxF9RoBN/M+gHxGp7LbS2SIuHSzFiwWvH5EVB/DF7LlZbVOjLT FmYr/s8PNIG1FzfkkmVfl7KyAOtv3kfYVM/5HpF0BnV/94VtqLPdv+hY2o6HC6fJWeo06sov1PI iG2Hgz1muziz1i6HUEaVqyjUvNlLvfVUfGWZqxtHn9bjg5gHamSiFwg== X-Gm-Gg: AY/fxX6QBmn0jjrJHMO9kO/x4nUe7NqPGE7VenPMleeA3DeB8k8mqx6PZF8c8UkvJul tXO9+hGXPus1biv4+90nczVke0kRqw4tvaBf0ZLLJF/uhhYW76O0TRqKHArjd44f509r0Q9bED5 aH+qGqBPRshOUxmjbNEdpzMY9caHeIHbCkZAMtnlF3i/hcw4k9JbPRQF6bihSiO3jzWlMmHOyhz fWVZO0zWPTL4gkWb60quLKomp34CGaR3EoWTQAINEpYj6PPsliN+9mQEX3bcyarKJBQB99MR7UM BHdAfAe5rVH/FzKq2k6YBqLAH1m+Wm17NbwPxnZYwYSg/fSJHHgyeUs3mOuZ6TqBJ+rqtzwW51q z/uZILktIk6Jv1R31Ss35vM4JAeLdgpre4vnG3g== X-Received: by 2002:a05:6000:26ca:b0:431:808:2d60 with SMTP id ffacd0b85a97d-432c3629aebmr16983592f8f.12.1768068749123; Sat, 10 Jan 2026 10:12:29 -0800 (PST) X-Google-Smtp-Source: AGHT+IFXUx4lGgQ9qFGtlEVEVgQ6cfi3q1di8m8a7nrd4gLrhEIsZB+ILHa1freebOPvA8KX5R9jKA== X-Received: by 2002:a05:6000:26ca:b0:431:808:2d60 with SMTP id ffacd0b85a97d-432c3629aebmr16983572f8f.12.1768068748627; Sat, 10 Jan 2026 10:12:28 -0800 (PST) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-432bd0dadcfsm28830759f8f.3.2026.01.10.10.12.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Jan 2026 10:12:28 -0800 (PST) Date: Sat, 10 Jan 2026 19:12:26 +0100 From: Stefano Brivio To: Yumei Huang Subject: Re: [PATCH] conf, pasta: Add --no-tap option Message-ID: <20260110191226.570a3f0b@elisabeth> In-Reply-To: <20251229095558.918055-1-yuhuang@redhat.com> References: <20251229095558.918055-1-yuhuang@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: niVgvVsjzETi3QK0FW09KXL2-NZGtLZV_Jy4oHGGNlg_1768068749 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: 4KSQBZEGCLR5KU7VX73VD7VZDVJWPDLV X-Message-ID-Hash: 4KSQBZEGCLR5KU7VX73VD7VZDVJWPDLV X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, david@gibson.dropbear.id.au X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Mon, 29 Dec 2025 17:55:58 +0800 Yumei Huang wrote: > This patch introduces a mode where we only forward loopback connections > and traffic between two namespaces (via the loopback interface, 'lo'), > without a tap device. > > With this, podman can support forwarding ::1 in custom networks when using > rootlesskit for forwarding ports. > > In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is automatically > enabled. Options requiring a tap device (--ns-ifname, --ns-mac-addr, > --config-net, --outbound-if4/6) are rejected. > > Link: https://bugs.passt.top/show_bug.cgi?id=149 > Signed-off-by: Yumei Huang > --- > conf.c | 56 +++++++++++++++++++++++++++++++++++++++++--------------- > fwd.c | 3 +++ > passt.1 | 5 +++++ > passt.h | 2 ++ > pasta.c | 3 +++ > tap.c | 11 +++++++---- > 6 files changed, 61 insertions(+), 19 deletions(-) > > diff --git a/conf.c b/conf.c > index 84ae12b..353d0a5 100644 > --- a/conf.c > +++ b/conf.c > @@ -1049,7 +1049,8 @@ pasta_opts: > " --no-copy-addrs DEPRECATED:\n" > " Don't copy all addresses to namespace\n" > " --ns-mac-addr ADDR Set MAC address on tap interface\n" > - " --no-splice Disable inbound socket splicing\n"); > + " --no-splice Disable inbound socket splicing\n" > + " --no-tap Don't create tap device\n"); > > passt_exit(status); > } > @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **argv) > {"no-ndp", no_argument, &c->no_ndp, 1 }, > {"no-ra", no_argument, &c->no_ra, 1 }, > {"no-splice", no_argument, &c->no_splice, 1 }, > + {"no-tap", no_argument, &c->no_tap, 1 }, > {"freebind", no_argument, &c->freebind, 1 }, > {"no-map-gw", no_argument, &no_map_gw, 1 }, > {"ipv4-only", no_argument, NULL, '4' }, > @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **argv) > } > } while (name != -1); > > - if (c->mode != MODE_PASTA) > + if (c->mode != MODE_PASTA) { > c->no_splice = 1; > + if (c->no_tap) > + die("--no-tap is for pasta mode only"); > + } > > if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { > if (copy_routes_opt) > @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **argv) > die("--no-copy-addrs needs --config-net"); > } > > + if (c->mode == MODE_PASTA && c->no_tap) { > + if (c->no_splice) > + die("--no-tap is incompatible with --no-splice"); I'm not sure if you need this for other reasons, but as long as it's called --no-tap, it's not really incompatible with --no-splice. Maybe users just want to get a disconnected namespace for whatever reason ('pasta' is shorter to type than 'unshare -rUn'). > + if (*c->ip4.ifname_out || *c->ip6.ifname_out) > + die("--no-tap is incompatible with --outbound-if4/6"); > + if (*c->pasta_ifn) > + die("--no-tap is incompatible with --ns-ifname"); > + if (*c->guest_mac) > + die("--no-tap is incompatible with --ns-mac-addr"); > + if (c->pasta_conf_ns) > + die("--no-tap is incompatible with --config-net"); I guess all these checks are to save some checks later, which looks like a good reason to have them here. If not, though, I don't think we *really* need to tell the user that --ns-ifname will be ignored with --no-tap. One thing that might confuse users, though, is this: $ ./pasta --no-tap --mtu 1500 -- ip l 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 or even this: $ ./pasta --no-tap -a 192.0.2.1 -- ip a 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever but I would rather *not* add conditions and checks for those even if there's a *slight* potential for confusion, otherwise this becomes really long. And it's really not worth it, I think. > + > + c->host_lo_to_ns_lo = 1; > + c->no_icmp = 1; > + c->no_ra = 1; > + c->no_dns = 1; > + c->no_dns_search = 1; > + } > + > if (!ifi4 && *c->ip4.ifname_out) > ifi4 = if_nametoindex(c->ip4.ifname_out); > > @@ -1980,9 +2004,9 @@ void conf(struct ctx *c, int argc, char **argv) > log_conf_parsed = true; /* Stop printing everything */ > > nl_sock_init(c, false); > - if (!v6_only) > + if (!v6_only && !c->no_tap) > c->ifi4 = conf_ip4(ifi4, &c->ip4); > - if (!v4_only) > + if (!v4_only && !c->no_tap) > c->ifi6 = conf_ip6(ifi6, &c->ip6); > > if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { > @@ -1998,30 +2022,32 @@ void conf(struct ctx *c, int argc, char **argv) > (*c->ip6.ifname_out && !c->ifi6)) > die("External interface not usable"); > > - if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { > + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn && !c->no_tap) { You already checked that !*c->pasta_ifn above. > strncpy(c->pasta_ifn, pasta_default_ifn, > sizeof(c->pasta_ifn) - 1); > } > > if (!c->ifi4 && !v6_only) { > - info("IPv4: no external interface as template, use local mode"); > - > - conf_ip4_local(&c->ip4); > + if (!c->no_tap) { > + info("IPv4: no external interface as template, use local mode"); > + conf_ip4_local(&c->ip4); > + } > c->ifi4 = -1; > } > > if (!c->ifi6 && !v4_only) { > - info("IPv6: no external interface as template, use local mode"); > - > - conf_ip6_local(&c->ip6); > + if (!c->no_tap) { > + info("IPv6: no external interface as template, use local mode"); > + conf_ip6_local(&c->ip6); > + } > c->ifi6 = -1; > } > > - if (c->ifi4 && !no_map_gw && > + if (c->ifi4 > 0 && !no_map_gw && > IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) > c->ip4.map_host_loopback = c->ip4.guest_gw; > > - if (c->ifi6 && !no_map_gw && > + if (c->ifi6 > 0 && !no_map_gw && > IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) > c->ip6.map_host_loopback = c->ip6.guest_gw; > > @@ -2116,10 +2142,10 @@ void conf(struct ctx *c, int argc, char **argv) > conf_ports(c, name, optarg, &c->udp.fwd_out); > } while (name != -1); > > - if (!c->ifi4) > + if (c->ifi4 <= 0) > c->no_dhcp = 1; > > - if (!c->ifi6) { > + if (c->ifi6 <= 0) { > c->no_ndp = 1; > c->no_dhcpv6 = 1; > } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { > diff --git a/fwd.c b/fwd.c > index 44a0e10..2f4a89a 100644 > --- a/fwd.c > +++ b/fwd.c > @@ -780,6 +780,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, > return PIF_SPLICE; > } > > + if (c->no_tap) > + return PIF_NONE; > + > if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { > if (inany_v4(&ini->eaddr)) { > if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) > diff --git a/passt.1 b/passt.1 > index db0d662..2d643f7 100644 > --- a/passt.1 > +++ b/passt.1 > @@ -755,6 +755,11 @@ Default is to let the tap driver build a pseudorandom hardware address. > Disable the bypass path for inbound, local traffic. See the section \fBHandling > of local traffic in pasta\fR in the \fBNOTES\fR for more details. > > +.TP > +.BR \-\-no-tap > +Do not create a tap device in the namespace. In this mode, only local loopback > +traffic between namespaces is forwarded using splice. "Using splice" isn't really clear, and it's not entirely correct in the case of UDP: there's no splice() system call there, even if we call some UDP flows "spliced" for analogy with TCP. Maybe just omit it, say: [...] In this mode, \fIpasta\fR only forwards loopback traffic between namespaces. ? > + > .SH EXAMPLES > > .SS \fBpasta > diff --git a/passt.h b/passt.h > index 79d01dd..0c1ec4c 100644 > --- a/passt.h > +++ b/passt.h > @@ -200,6 +200,7 @@ struct ip6_ctx { > * @no_ndp: Disable NDP handler altogether > * @no_ra: Disable router advertisements > * @no_splice: Disable socket splicing for inbound traffic > + * @no_tap: Do not create tap device > * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses > * @freebind: Allow binding of non-local addresses for forwarding > * @low_wmem: Low probed net.core.wmem_max > @@ -277,6 +278,7 @@ struct ctx { > int no_ndp; > int no_ra; > int no_splice; > + int no_tap; > int host_lo_to_ns_lo; > int freebind; > > diff --git a/pasta.c b/pasta.c > index 0ddd6b0..3510ec5 100644 > --- a/pasta.c > +++ b/pasta.c > @@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c) > die("Couldn't bring up loopback interface in namespace: %s", > strerror_(-rc)); > > + if (c->no_tap) > + return; > + > /* Get or set MAC in target namespace */ > if (MAC_IS_ZERO(c->guest_mac)) > nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_mac); > diff --git a/tap.c b/tap.c > index 9d1344b..9b4eedc 100644 > --- a/tap.c > +++ b/tap.c > @@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg) > */ > static void tap_sock_tun_init(struct ctx *c) > { > - NS_CALL(tap_ns_tun, c); > - if (c->fd_tap == -1) > - die("Failed to set up tap device in namespace"); > + if (!c->no_tap) { > + NS_CALL(tap_ns_tun, c); > + if (c->fd_tap == -1) > + die("Failed to set up tap device in namespace"); > + } > > pasta_ns_conf(c); > > - tap_start_connection(c); > + if (!c->no_tap) > + tap_start_connection(c); > } > > /** Other than that, minus pending comments, it all looks good to me. -- Stefano