From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=haytok.jp Received: from outbound.qs.icloud.com (qs-2001k-snip6-6.eps.apple.com [IPv6:2a01:b747:3006:201::6d]) by passt.top (Postfix) with ESMTPS id 084555A0269 for ; Fri, 13 Nov 2026 09:55:37 +0100 (CET) Received: from outbound.qs.icloud.com (unknown [127.0.0.2]) by p00-icloudmta-asmtp-us-east-2d-60-percent-0 (Postfix) with ESMTPS id 1660218235BD; Fri, 13 Nov 2026 08:55:33 +0000 (UTC) X-ICL-RepId: 01a1d41e-8b66-70c8-83a0-eafa62acc80c Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=haytok.jp; s=sig1; t=1794560136; x=1826096136; bh=UBXvBvQYoVy9ttclswGiA3+tLkJYHcOiAVw9OQTYLZY=; h=From:To:Subject:Date:Message-ID:MIME-Version:x-icloud-hme; b=cauQbg6rm4V8Kvg4DXEqR/delfo/Y4bIp5J+LzA7yK1OKC8Mi+jzkkPrMl9ThOZxdrHGS3vm4qkccNmdh+OrkaFaRY8RXpho9aK6YW1mXbcE8ZTevS/9IfzvqIRoCNpoon3Yu9cBHsWkKgS0Jgy8TMj9jFgDZGuvOaQwpLLDx6NX3ZiMl6ACfq7gJ23ryrN/Jad9KTe7Fh6InFuzcHCoxmEpdEKnxlQ0B7tBwlmGnfEnIDG8TpCh2z57st+Ozcjms/nt1fyJfSfTNUudgE3HMmLTfhxnTMWWXsVnjg1an1SW53obaBWg12eVZjlDL9kZytXy3iqk1mHmUPys/0ghig== mail-alias-created-date: 1766251435121 Received: from localhost.localdomain (unknown [17.57.155.37]) by p00-icloudmta-asmtp-us-east-2d-60-percent-0 (Postfix) with ESMTPSA id BE2F1180089A; Fri, 13 Nov 2026 08:55:32 +0000 (UTC) From: Hayato Kiwata To: passt-dev@passt.top Subject: [PATCH] conf, pesto: Notify client of the result of rule updates Date: Fri, 13 Nov 2026 17:55:05 +0900 Message-ID: <20261113085505.43460-1-dev@haytok.jp> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYxMTEzMDAzNSBTYWx0ZWRfX5db8p1/wCeoQ 1cgK6vW2WNzroAWjAslO2zaL6J5MIrs4T9P6PCiUrJvCeFSENQLdlZdP81zRLlMKNnNVFvCUV9d WFH4obaQF57cuJLqheSKKElNgxNkUNJyReB81/a9tFT6nr4cb8wI2IbHFzybBfI/oBWdT9rWPot keoBa260Yj2o18od4QjuhXlmdGJqGt1yAmI+w12HjV9xmsFzEOWuqwyWrfsAS2NiZOJ7PMmy8YP Dxrbhpi78ijdzUeIQhKpHCPHbg+jqI4Hou6UN5s+0UKkqxIy0VLTBqbo333ra8L37tXW+Wg9w9A ByXQvEkeiFbQc1VF7eXFvF7ReP2rDdCBRvITNZntMjTe53QBD6QGNJaJ1xFsbA= X-Proofpoint-GUID: _GcxEj_75KnwahBL3wUD91sEkc8lj1cw X-Authority-Info-Out: v=2.4 cv=V/VwEOni c=1 sm=1 tr=0 ts=6af6d086 cx=c_apl:c_pps:t_out a=bsP7O+dXZ5uKcj+dsLqiMw==:117 a=bsP7O+dXZ5uKcj+dsLqiMw==:17 a=zJRp6_cAMcgA:10 a=VkNPw1HP01LnGYTKEx00:22 a=pNgXkJcRAAAA:8 a=iOZZ5OqNU0lWlxJecUUA:9 a=+jEqtf1s3R9VXZ0wqowq2kgwd+I=:19 a=tKe0A8swS_RTMQ4Dt1Wu:22 X-Proofpoint-ORIG-GUID: _GcxEj_75KnwahBL3wUD91sEkc8lj1cw X-JNJ: AAAAAAABzaf9hzZ7yBqGbHP+ghLmgOlx3j1vNeMX2S8yj2sp0KX1LzzM8Us5n/lS1zSSUt 7OR/5TABYDV3xnKq0bfBOAX3Rh0CwVc6f2DohOSTORsqk1jAsrHDcTp3+e/tCTmPwjrD5p rTtKjs9rbyNy5UOxuUpsmGjLxduhobYKIKg0SFuvwv3hO1fLrs6MJVknhsBHHTzyDJamSL 2KZB5KXyXxI+as1Dc7jLS+ODgXu8SdBVt9SXeVBuTqg0iXh8ST9NXsF/qeOR052RMfXMw8 qAJG3jLH5dumfHIKYWI4xyFSJFbIdnH9xzBPmjtrYulMdrwldMeJ8SbGNAMpZnjufrpw0L TbZwAbJBoIjpnbpXRqZGcI5NNPR6vl+sr8+vEVn5089DYQrZiwIfWP9VPCca6v313UwIpv AugWcLie13h9p7AKlKvNIotLe/+DuqRsE5RfUkUaiBxzA20evLbSwR8eeZPfEf050hwvBn 1feWs+pEvVFxoLyJaLQkJGv4sDb7pRcwoIIW7EwLW6hmRq34CzCDWYUzlT0ITn4vR5fOo8 sJfusC9U5lyGA+JxIvILISpWBFbEK6OijTPpW7+Y+3CMEo6wyDom2CTEC7qg0YlC6FFZy4 Me+WAvejSRitgNSuNcwpPUAXHTHj6kqswIqc8SuwmWNDoDyVF8I/A/Tx0LH8F6ruuPnofL VHoBCHopNiH0fASBcJ/FSK13sqBd4TO/smT8e8E8EN9ipQab6nr1xxVB6nmeWZ9wPEnqF6 U7TztpAAaR5FozG+i/EVQHBwyxtC6+AjpOj4q1injh4aeQCO15Ro4PGhi3vKKYcISU9RV2 5aSyw0gMaRzRxe71MpnFpSrjxfpm7iwqSqhBNk3P2LwaiGpeTOJwuHJhKRYL1pOjqUvX+9 PkwSu3GB1A8DJ9EJUqAl+L52SVN1dRw9kog7/nWwCg5dJathzww+jE4cl0tABggT9UFwhM 48iLZAytewy8Wp/38Zy9gcydDeOJVs1bQEEdvEfOmOjVrgoolER4Z/eNjp24ckWxWqinJl ixpOAcWiGPPZyaxZgs7xeMsPQ2cuRQg83/7R0y6BXJI61PS6eU6zXiSrQa3wziddT744LV Y2pgW/ZHVjOmOJ3zTb2dy37+Lxk34JuKUoHJF9hEiQ1mScU33Ykj8OMhbWO3/Va5lRb2+/ T05v5aYxKnKBFrMttUnkcTEIsyD8jlwu4IruTEfjoyB599uGqO3ukrOEuZ+q7ZCXS9MS4W lAY= X-MailFrom: dev@haytok.jp X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: XQY4455B5CST6TQUTSYUAREWCH6VSAUH X-Message-ID-Hash: XQY4455B5CST6TQUTSYUAREWCH6VSAUH X-Mailman-Approved-At: Fri, 13 Nov 2026 11:32:41 +0100 CC: Hayato Kiwata X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Since commit 1776dcb7317e ("fwd, conf: Roll back to old rules if switching to new ones fails"), pasta tries to restore the old rules when switching to new rules fails. However, pesto has no way to know that, and exits successfully as if the new rules were applied. In conf_handler(), write a one-byte status to the control socket after trying to apply the new rules. The status has three values: PESTO_STATUS_OK, PESTO_STATUS_ROLLBACK, and PESTO_STATUS_FAILED. In pesto, read the status after send_conf(), and if the update failed, print what happened and exit with a non-zero status. Note that we bump PESTO_PROTOCOL_VERSION to 3 because this adds a message from the server. If the server version is lower than that, pesto doesn't read the status. Also, if the server fails to receive rules from the client, it still closes the connection without sending a status. Link: https://archives.passt.top/passt-dev/20261025153025.600a4fe9@elisabeth/ Signed-off-by: Hayato Kiwata --- Tested with: $ pesto -A --tcp-ports=127.0.0.1/8085:80 /tmp/.pasta.sock $ pesto -A --tcp-ports=192.0.2.1/8080:80 /tmp/.pasta.sock Failed to apply new rules, old rules restored $ echo $? 1 $ pesto -s /tmp/.pasta.sock passt/pasta configuration (/tmp/.pasta.sock) HOST TCP [127.0.0.1]:8085 => 80 SPLICE $ curl -sI localhost:8085 | head -1 HTTP/1.0 200 OK --- conf.c | 10 +++++++++- pesto.c | 19 +++++++++++++++++++ pesto.h | 20 +++++++++++++++++++- 3 files changed, 47 insertions(+), 2 deletions(-) diff --git a/conf.c b/conf.c index 7be0c79..f0fc606 100644 --- a/conf.c +++ b/conf.c @@ -2273,6 +2273,7 @@ fail: void conf_handler(struct ctx *c, uint32_t events) { if (events & EPOLLIN) { + enum pesto_status status = PESTO_STATUS_OK; unsigned pif; /* Clear pending tables */ @@ -2297,11 +2298,18 @@ void conf_handler(struct ctx *c, uint32_t events) } if (fwd_listen_switch(c) < 0) { + status = PESTO_STATUS_ROLLBACK; err("Error switching to new forwarding rules"); + /* Switch back to old rules (still in c->fwd_pending) */ - if (fwd_listen_switch(c) < 0) + if (fwd_listen_switch(c) < 0) { + status = PESTO_STATUS_FAILED; err("Couldn't restore old forwarding rules"); + } } + + if (write_u8(c->fd_control, status) < 0) + warn_perror("Failed to write status on control socket"); } if (events & EPOLLHUP) { diff --git a/pesto.c b/pesto.c index eeaf274..89ece5d 100644 --- a/pesto.c +++ b/pesto.c @@ -513,6 +513,25 @@ int main(int argc, char **argv) send_conf(s, &conf); + if (s_version >= PESTO_VERSION_STATUS) { + uint8_t status; + + if (read_u8(s, &status) < 0) + die_perror("Couldn't read configuration status"); + + switch (status) { + case PESTO_STATUS_OK: + break; + case PESTO_STATUS_ROLLBACK: + die("Failed to apply new rules, old rules restored"); + case PESTO_STATUS_FAILED: + die( +"Failed to apply new rules, couldn't restore old ones"); + default: + die("Unknown configuration status %"PRIu8, status); + } + } + noupdate: if (shutdown(s, SHUT_RDWR) < 0 || close(s) < 0) die_perror("Error shutting down control socket"); diff --git a/pesto.h b/pesto.h index 8db701b..5065530 100644 --- a/pesto.h +++ b/pesto.h @@ -19,12 +19,30 @@ * but was little enough used that we decided not to implement backwards * compatiblity code (i.e. a v2 pesto will not work with a v1 pasta) */ -#define PESTO_PROTOCOL_VERSION 2 +/* Version 3 added a status byte, sent by the server after trying to apply the + * new rules (see enum pesto_status) + */ +#define PESTO_VERSION_STATUS 3 +#define PESTO_PROTOCOL_VERSION 3 /* Maximum size of a pif name, including \0 */ #define PIF_NAME_SIZE (128) #define PIF_NONE 0 +/** + * enum pesto_status - Result of a configuration update (protocol version 3+) + * + * Sent by the server as a single byte after trying to apply the new rules. + */ +enum pesto_status { + /* New rules applied */ + PESTO_STATUS_OK = 0, + /* New rules failed, old rules restored */ + PESTO_STATUS_ROLLBACK = 1, + /* New rules failed, old rules couldn't be restored either */ + PESTO_STATUS_FAILED = 2, +}; + /** * struct pesto_hello - Server introduction message * @magic: PESTO_SERVER_MAGIC -- 2.50.1 (Apple Git-155)