From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yb1-xb30.google.com (mail-yb1-xb30.google.com [IPv6:2607:f8b0:4864:20::b30]) by passt.top (Postfix) with ESMTPS id 04EC95A026D for ; Mon, 18 Sep 2023 15:44:23 +0200 (CEST) Received: by mail-yb1-xb30.google.com with SMTP id 3f1490d57ef6-d8168d08bebso4339613276.0 for ; Mon, 18 Sep 2023 06:44:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1695044662; x=1695649462; darn=passt.top; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=lUosqnSfcVZauL+WrCg6OzULld7oek3e2GE2zJyNVrQ=; b=FnHsy3/iD1qwoo+Q884UaZ+lcnS7R7t6Gek9bqrMO80u2ZEZoRbc2CHgBMedu8bXg+ Oc2a6kE+w2P58Q33bsKszGqqFqxmUwjKelhnCbIScT+/4cHrdSF09pcYvJ2W5rifWKSB UMOxWsYFJWDOJhq1ZJVgh/bkqu0ERaoMfx6c07DVMrfHZzsWQIvcs/DVi0Nbzo2TPeZ7 YoCJi6gjtdBHAzMvR3a1GtA456hK6WglLpm/Wa9R0CTEqtnGAudtfWnvUr3DpjJNGRoT T5ONm3yOdvLZDY8jVAhQcrTNSjx+IeDAJ6yLsJqdkdt50+SzxtM0L8OZ7XskQMwKxpea b9Nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695044662; x=1695649462; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lUosqnSfcVZauL+WrCg6OzULld7oek3e2GE2zJyNVrQ=; b=ZOSl+9I9La4yq3RSMl3BOo5tZ9a0tEeOGyWTTsj2lzXi7k2zYHoYADuNrvnKH5dUX+ 5rg3iHjeYpLSpBJQ6l2BIXotfZEQi3Z7rT33kIV4jPap/xuU27OhDEB36LeLkW9SMxKH hbn6Hyn+/mqv5VWm1iJ7BXPtxzThZRW4hnHMaTAWMddCc1oELrm/fZ9DWc7o0m5/1q14 JCHzR/hgVVcxmEP/a8RImGI8AkfFBPonR4kWEmBRpN/SBJrsIfkCH8+PMGoUs3yyvjd/ d8/eopOzjnj8aEWjjD448iJzhNovoTLYzbuwg8ubekmb/8gL/FXnIDDZsbZnoHjNohoo 5nTg== X-Gm-Message-State: AOJu0YzfQJvXFSABj9RStOp9KjeMt8nbWTAPzOrAGudx5gYeWRS2W0pB pqPGxibnYJRAIADzTKTNVqKSnhAbxQdZp03rlb0= X-Google-Smtp-Source: AGHT+IFbo3jJLVAh8zYlzlrWGWj5wILh0lBxDaoyc8R/+oHtZuA5FVLywbPAlU6qqc5Bc7SyzI8Ip9HOIXxup+Es6Eo= X-Received: by 2002:a25:493:0:b0:d81:7d22:4c83 with SMTP id 141-20020a250493000000b00d817d224c83mr9075033ybe.12.1695044661809; Mon, 18 Sep 2023 06:44:21 -0700 (PDT) MIME-Version: 1.0 References: <20230915142152.73499-1-edigaryev@gmail.com> <20230916143241.2a7b6c77@elisabeth> In-Reply-To: <20230916143241.2a7b6c77@elisabeth> From: Nikolay Edigaryev Date: Mon, 18 Sep 2023 17:44:10 +0400 Message-ID: Subject: Re: [PATCH] passt: introduce --fd-is-tap to allow passing TAP file descriptor To: Stefano Brivio Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 6ETV4EED67NZUZSVYXOAJEP6MAXUJAX6 X-Message-ID-Hash: 6ETV4EED67NZUZSVYXOAJEP6MAXUJAX6 X-MailFrom: edigaryev@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Stefano, David, thanks for the input! I've submitted a new patch completely replacing the previous one (because I forgot to add --signoff), but only changes the command-line arguments part as suggested. The rest is kept the same because I'm not sure if introducing more than one FD in the passt's context will make sense at this time. On Sat, Sep 16, 2023 at 4:34=E2=80=AFPM Stefano Brivio = wrote: > > Hi Nikolay, > > On Fri, 15 Sep 2023 18:21:52 +0400 > Nikolay Edigaryev wrote: > > > Problem: I have a Cloud Hypervisor virtual machine that needs both > > (1) an internet access without fiddling with iptables/Netfilter and > > (2) VM <-> host access (to be able to provision this VM over SSH) > > without dealing with passt port forwarding it doesn't seem to be > > possible to map the whole IP address, yet the users expect an IP > > instead of IP:port combination. > > > > Requirement #1 is why I've choosen passt and it's pretty much > > satisfied (thank you for this great piece of software!). > > And thanks for the patches! I'm glad to hear it's useful for you (and > with Cloud Hypervisor :)). > > Two comments: > > > Requirement #2 implies some kind of bridge interface on the host > > with one TAP interface for the VM and the other for the passt. > > > > However, only pasta can accept TAP interface FD's in it's -F/--fd, > > which is OK, but it also configures unneeded namespacing, which in > > turn results in unneeded complexity and performance overhead due > > to the need of involving veth pairs to break away from the pasta > > namespace to the host for the requirement #2 to be satisfied. > > > > I've also considered proxying the UNIX domain socket communication > > to/from a TAP interface in my own Golang code, but it incurs > > significant performance overhead. > > > > On the other hand passt seems to already can do everything I need, > > it just needs some guidance on which type of FD it's dealing with. > > > > Solution: introduce --fd-is-tap command-line flag to tell passt > > which type of FD it's being passed to and force it to use appropriate > > system calls and offset calculation. > > Did you consider adding another parameter altogether, such as --tap-fd? > > I'm asking because we recently got a request to add another (similar) > interface on that "side", that is, a VSOCK file descriptor, for usage > with podman-machine. At that point, a further --fd-is-vsock would look > a bit awkward. > > Further, David Gibson is working on a generalised flow table approach > which *should* also allow us to have multiple "taps"... and at that > point, somebody might want to pass multiple "--tap-fd" or -F options. > > I didn't really evaluate if there are drawbacks to that, though -- > maybe it's a lot more code. > > > This patch also clarifies the -F/--fd description for pasta to note > > that we're expecting a TAP device and not a UNIX domain socket. > > You should add a Signed-off-by tag here (but in general I can fix up > tags myself on merge). Other than that, the patch looks good to me in a > general sense. > > -- > Stefano >