[PATCH v2] conf, pasta: Add --splice-only option

[PATCH v2] conf, pasta: Add --splice-only option

[Yumei Huang]

This patch introduces a mode where we only forward loopback connections
and traffic between two namespaces (via the loopback interface, 'lo'),
without a tap device.

It might be used to fix up podman IPv4 / IPv6 loopback mapping when using
rootlesskit for forwarding ports, or a way to implement isolated containers.

In this mode, --host-lo-to-ns-lo and --no-icmp are automatically enabled.
Option --no-splice is rejected.

Link: https://bugs.passt.top/show_bug.cgi?id=149
Signed-off-by: Yumei Huang <yuhuang@redhat.com>
---
 conf.c  | 39 ++++++++++++++++++++++++++++-----------
 fwd.c   |  3 +++
 passt.1 |  5 +++++
 passt.h |  2 ++
 pasta.c |  3 +++
 tap.c   | 11 +++++++----
 6 files changed, 48 insertions(+), 15 deletions(-)

diff --git a/conf.c b/conf.c
index dbff87c..9d88ad7 100644
--- a/conf.c
+++ b/conf.c
@@ -1059,7 +1059,8 @@ pasta_opts:
 		"  --no-copy-addrs	DEPRECATED:\n"
 		"			Don't copy all addresses to namespace\n"
 		"  --ns-mac-addr ADDR	Set MAC address on tap interface\n"
-		"  --no-splice		Disable inbound socket splicing\n");
+		"  --no-splice		Disable inbound socket splicing\n"
+		"  --splice-only	Only enable loopback forwarding\n");
 
 	passt_exit(status);
 }
@@ -1142,7 +1143,7 @@ static void conf_print(const struct ctx *c)
 		     inet_ntop(AF_INET6, &c->ip6.addr_out, buf6, sizeof(buf6)));
 	}
 
-	if (c->mode == MODE_PASTA)
+	if (c->mode == MODE_PASTA && !c->splice_only)
 		info("Namespace interface: %s", c->pasta_ifn);
 
 	info("MAC:");
@@ -1465,6 +1466,7 @@ void conf(struct ctx *c, int argc, char **argv)
 		{"no-ndp",	no_argument,		&c->no_ndp,	1 },
 		{"no-ra",	no_argument,		&c->no_ra,	1 },
 		{"no-splice",	no_argument,		&c->no_splice,	1 },
+		{"splice-only",	no_argument,		&c->splice_only, 1 },
 		{"freebind",	no_argument,		&c->freebind,	1 },
 		{"no-map-gw",	no_argument,		&no_map_gw,	1 },
 		{"ipv4-only",	no_argument,		NULL,		'4' },
@@ -1961,8 +1963,11 @@ void conf(struct ctx *c, int argc, char **argv)
 		}
 	} while (name != -1);
 
-	if (c->mode != MODE_PASTA)
+	if (c->mode != MODE_PASTA) {
 		c->no_splice = 1;
+		if (c->splice_only)
+			die("--splice-only is for pasta mode only");
+	}
 
 	if (c->mode == MODE_PASTA && !c->pasta_conf_ns) {
 		if (copy_routes_opt)
@@ -1971,6 +1976,16 @@ void conf(struct ctx *c, int argc, char **argv)
 			die("--no-copy-addrs needs --config-net");
 	}
 
+	if (c->mode == MODE_PASTA && c->splice_only) {
+		if (c->no_splice)
+			die("--splice-only is incompatible with --no-splice");
+
+		c->host_lo_to_ns_lo = 1;
+		c->no_icmp = 1;
+		c->no_dns = 1;
+		c->no_dns_search = 1;
+	}
+
 	if (!ifi4 && *c->ip4.ifname_out)
 		ifi4 = if_nametoindex(c->ip4.ifname_out);
 
@@ -1994,9 +2009,9 @@ void conf(struct ctx *c, int argc, char **argv)
 	log_conf_parsed = true;		/* Stop printing everything */
 
 	nl_sock_init(c, false);
-	if (!v6_only)
+	if (!v6_only && !c->splice_only)
 		c->ifi4 = conf_ip4(ifi4, &c->ip4);
-	if (!v4_only)
+	if (!v4_only && !c->splice_only)
 		c->ifi6 = conf_ip6(ifi6, &c->ip6);
 
 	if (c->ifi4 && c->mtu < IPV4_MIN_MTU) {
@@ -2018,16 +2033,18 @@ void conf(struct ctx *c, int argc, char **argv)
 	}
 
 	if (!c->ifi4 && !v6_only) {
-		info("IPv4: no external interface as template, use local mode");
-
-		conf_ip4_local(&c->ip4);
+		if (!c->splice_only) {
+			info("IPv4: no external interface as template, use local mode");
+			conf_ip4_local(&c->ip4);
+		}
 		c->ifi4 = -1;
 	}
 
 	if (!c->ifi6 && !v4_only) {
-		info("IPv6: no external interface as template, use local mode");
-
-		conf_ip6_local(&c->ip6);
+		if (!c->splice_only) {
+			info("IPv6: no external interface as template, use local mode");
+			conf_ip6_local(&c->ip6);
+		}
 		c->ifi6 = -1;
 	}
 
diff --git a/fwd.c b/fwd.c
index 961c533..6cdb197 100644
--- a/fwd.c
+++ b/fwd.c
@@ -771,6 +771,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto,
 		return PIF_SPLICE;
 	}
 
+	if (c->splice_only)
+		return PIF_NONE;
+
 	if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) {
 		if (inany_v4(&ini->eaddr)) {
 			if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr))
diff --git a/passt.1 b/passt.1
index db0d662..8e8e179 100644
--- a/passt.1
+++ b/passt.1
@@ -755,6 +755,11 @@ Default is to let the tap driver build a pseudorandom hardware address.
 Disable the bypass path for inbound, local traffic. See the section \fBHandling
 of local traffic in pasta\fR in the \fBNOTES\fR for more details.
 
+.TP
+.BR \-\-splice-only
+Do not create a tap device in the namespace. In this mode, \fIpasta\fR only
+forwards loopback traffic between namespaces.
+
 .SH EXAMPLES
 
 .SS \fBpasta
diff --git a/passt.h b/passt.h
index f3664ce..299185b 100644
--- a/passt.h
+++ b/passt.h
@@ -200,6 +200,7 @@ struct ip6_ctx {
  * @no_ndp:		Disable NDP handler altogether
  * @no_ra:		Disable router advertisements
  * @no_splice:		Disable socket splicing for inbound traffic
+ * @splice_only:	Only enable loopback forwarding
  * @host_lo_to_ns_lo:	Map host loopback addresses to ns loopback addresses
  * @freebind:		Allow binding of non-local addresses for forwarding
  * @low_wmem:		Low probed net.core.wmem_max
@@ -277,6 +278,7 @@ struct ctx {
 	int no_ndp;
 	int no_ra;
 	int no_splice;
+	int splice_only;
 	int host_lo_to_ns_lo;
 	int freebind;
 
diff --git a/pasta.c b/pasta.c
index 0ddd6b0..bab945f 100644
--- a/pasta.c
+++ b/pasta.c
@@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c)
 		die("Couldn't bring up loopback interface in namespace: %s",
 		    strerror_(-rc));
 
+	if (c->splice_only)
+		return;
+
 	/* Get or set MAC in target namespace */
 	if (MAC_IS_ZERO(c->guest_mac))
 		nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_mac);
diff --git a/tap.c b/tap.c
index 9d1344b..eaa6111 100644
--- a/tap.c
+++ b/tap.c
@@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg)
  */
 static void tap_sock_tun_init(struct ctx *c)
 {
-	NS_CALL(tap_ns_tun, c);
-	if (c->fd_tap == -1)
-		die("Failed to set up tap device in namespace");
+	if (!c->splice_only) {
+		NS_CALL(tap_ns_tun, c);
+		if (c->fd_tap == -1)
+			die("Failed to set up tap device in namespace");
+	}
 
 	pasta_ns_conf(c);
 
-	tap_start_connection(c);
+	if (!c->splice_only)
+		tap_start_connection(c);
 }
 
 /**
-- 
2.49.0

Re: [PATCH v2] conf, pasta: Add --splice-only option

[Stefano Brivio]

On Fri, 16 Jan 2026 11:25:09 +0800
Yumei Huang <yuhuang@redhat.com> wrote:

> This patch introduces a mode where we only forward loopback connections
> and traffic between two namespaces (via the loopback interface, 'lo'),
> without a tap device.
> 
> It might be used to fix up podman IPv4 / IPv6 loopback mapping when using
> rootlesskit for forwarding ports, or a way to implement isolated containers.
> 
> In this mode, --host-lo-to-ns-lo and --no-icmp are automatically enabled.
> Option --no-splice is rejected.
> 
> Link: https://bugs.passt.top/show_bug.cgi?id=149
> Signed-off-by: Yumei Huang <yuhuang@redhat.com>
> ---
>  conf.c  | 39 ++++++++++++++++++++++++++++-----------
>  fwd.c   |  3 +++
>  passt.1 |  5 +++++
>  passt.h |  2 ++
>  pasta.c |  3 +++
>  tap.c   | 11 +++++++----
>  6 files changed, 48 insertions(+), 15 deletions(-)
> 
> diff --git a/conf.c b/conf.c
> index dbff87c..9d88ad7 100644
> --- a/conf.c
> +++ b/conf.c
> @@ -1059,7 +1059,8 @@ pasta_opts:
>  		"  --no-copy-addrs	DEPRECATED:\n"
>  		"			Don't copy all addresses to namespace\n"
>  		"  --ns-mac-addr ADDR	Set MAC address on tap interface\n"
> -		"  --no-splice		Disable inbound socket splicing\n");
> +		"  --no-splice		Disable inbound socket splicing\n"
> +		"  --splice-only	Only enable loopback forwarding\n");
>  
>  	passt_exit(status);
>  }
> @@ -1142,7 +1143,7 @@ static void conf_print(const struct ctx *c)
>  		     inet_ntop(AF_INET6, &c->ip6.addr_out, buf6, sizeof(buf6)));
>  	}
>  
> -	if (c->mode == MODE_PASTA)
> +	if (c->mode == MODE_PASTA && !c->splice_only)
>  		info("Namespace interface: %s", c->pasta_ifn);
>  
>  	info("MAC:");

Actually, I just realised, also the MAC address information printed here
is meaningless for the --splice-only mode:

$ ./pasta --debug --splice-only
0.0019: MAC:
0.0019:     host: 9a:55:9a:55:9a:55

...but that MAC address will never appear anywhere.

But in any case the patch looks good to me (with or without that
"fixed").

-- 
Stefano

Re: [PATCH v2] conf, pasta: Add --splice-only option

[Stefano Brivio]

On Fri, 16 Jan 2026 11:25:09 +0800
Yumei Huang <yuhuang@redhat.com> wrote:

> This patch introduces a mode where we only forward loopback connections
> and traffic between two namespaces (via the loopback interface, 'lo'),
> without a tap device.
> 
> It might be used to fix up podman IPv4 / IPv6 loopback mapping when using
> rootlesskit for forwarding ports, or a way to implement isolated containers.
> 
> In this mode, --host-lo-to-ns-lo and --no-icmp are automatically enabled.
> Option --no-splice is rejected.
> 
> Link: https://bugs.passt.top/show_bug.cgi?id=149
> Signed-off-by: Yumei Huang <yuhuang@redhat.com>

Applied.

-- 
Stefano