From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=RyrBfNj9; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 4E2425A0271 for ; Wed, 14 Jan 2026 08:28:52 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1768375731; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vZwWH6Ixo1iczNqOWNAm0xpQlKx9o/HUU7fXDBj1m5c=; b=RyrBfNj9NMPan9WsATC8ZwQ2He1wLstsd5ZrXdzwkto+qHO9t6ISFzeDKmW0f1qcLCwElZ /VjPY/sW1QJGyrMdzTBnOZVTIch2BsP1g+2ucR4yjfYgFs96iWZgJRlq7WRBbm1ABeo7OE UxgvrljqFGy7sXFqNEwdxN3yi/I8Cpg= Received: from mail-ed1-f71.google.com (mail-ed1-f71.google.com [209.85.208.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-570-WbQtoL6xNxaSH21iSryiuQ-1; Wed, 14 Jan 2026 02:28:44 -0500 X-MC-Unique: WbQtoL6xNxaSH21iSryiuQ-1 X-Mimecast-MFC-AGG-ID: WbQtoL6xNxaSH21iSryiuQ_1768375724 Received: by mail-ed1-f71.google.com with SMTP id 4fb4d7f45d1cf-64b98593517so10068196a12.3 for ; Tue, 13 Jan 2026 23:28:44 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768375723; x=1768980523; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=vZwWH6Ixo1iczNqOWNAm0xpQlKx9o/HUU7fXDBj1m5c=; b=pR4C0m1WEbrFBQVckat8ljQx9Fk4HaKeroyesh2b4blx/mle6UDXB6BUrDviMB3vkQ u0JfoG6UJ3jp3NVw4M1K1J+zT5Emo5LL2s4uh6prljvIzte/I/7fFQQwatm/Sc5Hg3jU 161rIyXN4kfPY3Ss0YZxIDbyr180O9/yLBHXJk+nznZCf3ygonwRiUy6+CVnKx40aplQ /OE79/3dXuTFq3dMYJvmzrLyr97Ce+fHtSt/pFB3VuJhJfDRzaS8O+m+mmpVTGcMFT1N L0yUDZ55/lOjjA8VjVdn3i5mw+rYPxjJp+ZfQdqxnHgpC6YcDDhCeRQY/4N+M+qCXCxN MLrw== X-Gm-Message-State: AOJu0Yx8MsMe2lVPlS7kvRwugyvnKq36sqAhm5+SX1pZs6xgAHPmSx1j YpfxT4eDnqpUdGGlxluDA9O+473YypevsB7rAls/slQrqve0M2qDeba63zid/LCtEwENPQ5hQlg mnULFt1hw/NsIBf6dj4dUZWi2G0UBRz+7ycDvEPRCXwfIv3Nw30zfN5mDwyOHJsx7QB+hg9nnIr 54xeO/ZwqoLv+ONB6IgsWyxGC70fCO X-Gm-Gg: AY/fxX4OKcYnv3gP3BFV+TO+75kmiLSX/cFTBjonLBy+W+V946TPIeRgDXlRge2eSfI uQwet2mJJ7ebKbfGx/aM1nU8Vme99qLs1/Goosw9xRCnVgIi8t22W3/im/C33CJOXqcpn/lWqEv fqmzUZeyIh2kn56yM4rUOF5Ag+Dubgv2NoQBIcmy8kzPFx4hP5Pt1zUqd/7K574pCB7EP6xFlyr IRw4ERn4NGPkidhYpDOGPn2MHJ9u07a+HzKCjUj2GbMfawsqYWQ5paMvTAlKBfBCs7FdNfuAiBH MzNI+529Un8l X-Received: by 2002:a05:6402:51cc:b0:64d:5693:3e7c with SMTP id 4fb4d7f45d1cf-653ec45d61emr1178160a12.28.1768375723414; Tue, 13 Jan 2026 23:28:43 -0800 (PST) X-Received: by 2002:a05:6402:51cc:b0:64d:5693:3e7c with SMTP id 4fb4d7f45d1cf-653ec45d61emr1178139a12.28.1768375722868; Tue, 13 Jan 2026 23:28:42 -0800 (PST) MIME-Version: 1.0 References: <20251229095558.918055-1-yuhuang@redhat.com> <20260110191226.570a3f0b@elisabeth> <20260114003441.044df424@elisabeth> In-Reply-To: From: Yumei Huang Date: Wed, 14 Jan 2026 15:28:31 +0800 X-Gm-Features: AZwV_QgjOk-TzG-FeIojxhJGCaeBi1HMzX22_BTByqe3LtpjI2kUL46Ox6Ub0GA Message-ID: Subject: Re: [PATCH] conf, pasta: Add --no-tap option To: Stefano Brivio X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: r8f5Efyi9oBofIiQhC0VYR_dpAk8WmXMRq5IEcHwlps_1768375724 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 26R4Q4ERVCQET7OV5E25X7VP24CZ33H2 X-Message-ID-Hash: 26R4Q4ERVCQET7OV5E25X7VP24CZ33H2 X-MailFrom: yuhuang@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, david@gibson.dropbear.id.au X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Wed, Jan 14, 2026 at 2:31=E2=80=AFPM Yumei Huang wr= ote: > > On Wed, Jan 14, 2026 at 7:34=E2=80=AFAM Stefano Brivio wrote: > > > > On Tue, 13 Jan 2026 19:20:47 +0800 > > Yumei Huang wrote: > > > > > On Sun, Jan 11, 2026 at 2:12=E2=80=AFAM Stefano Brivio wrote: > > > > > > > > On Mon, 29 Dec 2025 17:55:58 +0800 > > > > Yumei Huang wrote: > > > > > > > > > This patch introduces a mode where we only forward loopback conne= ctions > > > > > and traffic between two namespaces (via the loopback interface, '= lo'), > > > > > without a tap device. > > > > > > > > > > With this, podman can support forwarding ::1 in custom networks w= hen using > > > > > rootlesskit for forwarding ports. > > > > > > > > > > In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is au= tomatically > > > > > enabled. Options requiring a tap device (--ns-ifname, --ns-mac-ad= dr, > > > > > --config-net, --outbound-if4/6) are rejected. > > > > > > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D149 > > > > > Signed-off-by: Yumei Huang > > > > > --- > > > > > conf.c | 56 +++++++++++++++++++++++++++++++++++++++++----------= ----- > > > > > fwd.c | 3 +++ > > > > > passt.1 | 5 +++++ > > > > > passt.h | 2 ++ > > > > > pasta.c | 3 +++ > > > > > tap.c | 11 +++++++---- > > > > > 6 files changed, 61 insertions(+), 19 deletions(-) > > > > > > > > > > diff --git a/conf.c b/conf.c > > > > > index 84ae12b..353d0a5 100644 > > > > > --- a/conf.c > > > > > +++ b/conf.c > > > > > @@ -1049,7 +1049,8 @@ pasta_opts: > > > > > " --no-copy-addrs DEPRECATED:\n" > > > > > " Don't copy all addresses to= namespace\n" > > > > > " --ns-mac-addr ADDR Set MAC address on tap inte= rface\n" > > > > > - " --no-splice Disable inbound socket spli= cing\n"); > > > > > + " --no-splice Disable inbound socket spli= cing\n" > > > > > + " --no-tap Don't create tap device\n")= ; > > > > > > > > > > passt_exit(status); > > > > > } > > > > > @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **a= rgv) > > > > > {"no-ndp", no_argument, &c->no_ndp,= 1 }, > > > > > {"no-ra", no_argument, &c->no_ra, = 1 }, > > > > > {"no-splice", no_argument, &c->no_spli= ce, 1 }, > > > > > + {"no-tap", no_argument, &c->no_tap,= 1 }, > > > > > {"freebind", no_argument, &c->freebin= d, 1 }, > > > > > {"no-map-gw", no_argument, &no_map_gw,= 1 }, > > > > > {"ipv4-only", no_argument, NULL, = '4' }, > > > > > @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **= argv) > > > > > } > > > > > } while (name !=3D -1); > > > > > > > > > > - if (c->mode !=3D MODE_PASTA) > > > > > + if (c->mode !=3D MODE_PASTA) { > > > > > c->no_splice =3D 1; > > > > > + if (c->no_tap) > > > > > + die("--no-tap is for pasta mode only"); > > > > > + } > > > > > > > > > > if (c->mode =3D=3D MODE_PASTA && !c->pasta_conf_ns) { > > > > > if (copy_routes_opt) > > > > > @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **= argv) > > > > > die("--no-copy-addrs needs --config-net"); > > > > > } > > > > > > > > > > + if (c->mode =3D=3D MODE_PASTA && c->no_tap) { > > > > > + if (c->no_splice) > > > > > + die("--no-tap is incompatible with --no-spl= ice"); > > > > > > > > I'm not sure if you need this for other reasons, but as long as it'= s > > > > called --no-tap, it's not really incompatible with --no-splice. > > > > > > I will update it to --splice-only > > > > > > > > > > > Maybe users just want to get a disconnected namespace for whatever > > > > reason ('pasta' is shorter to type than 'unshare -rUn'). > > > > > > > > > + if (*c->ip4.ifname_out || *c->ip6.ifname_out) > > > > > + die("--no-tap is incompatible with --outbou= nd-if4/6"); > > > > > + if (*c->pasta_ifn) > > > > > + die("--no-tap is incompatible with --ns-ifn= ame"); > > > > > + if (*c->guest_mac) > > > > > + die("--no-tap is incompatible with --ns-mac= -addr"); > > > > > + if (c->pasta_conf_ns) > > > > > + die("--no-tap is incompatible with --config= -net"); > > > > > > > > I guess all these checks are to save some checks later, which looks= like > > > > a good reason to have them here. > > > > > > > > If not, though, I don't think we *really* need to tell the user tha= t > > > > --ns-ifname will be ignored with --no-tap. > > > > > > > > One thing that might confuse users, though, is this: > > > > > > > > $ ./pasta --no-tap --mtu 1500 -- ip l > > > > 1: lo: mtu 65536 qdisc noqueue state UNKNOWN= mode DEFAULT group default qlen 1000 > > > > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > > > > > > > > or even this: > > > > > > > > $ ./pasta --no-tap -a 192.0.2.1 -- ip a > > > > 1: lo: mtu 65536 qdisc noqueue state UNKNOWN= group default qlen 1000 > > > > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > > > > inet 127.0.0.1/8 scope host lo > > > > valid_lft forever preferred_lft forever > > > > inet6 ::1/128 scope host proto kernel_lo > > > > valid_lft forever preferred_lft forever > > > > > > > > but I would rather *not* add conditions and checks for those even i= f > > > > there's a *slight* potential for confusion, otherwise this becomes > > > > really long. And it's really not worth it, I think. > > > > > > Then I guess we only need the c->no_splice check, right? > > > > ...maybe? About *needing*, yes, I guess so, but if other checks save > > more checks later, I would keep them. > > > > > > > + > > > > > + c->host_lo_to_ns_lo =3D 1; > > > > > + c->no_icmp =3D 1; > > > > > + c->no_ra =3D 1; > > > > > + c->no_dns =3D 1; > > > > > + c->no_dns_search =3D 1; > > > > > + } > > > > > + > > > > > if (!ifi4 && *c->ip4.ifname_out) > > > > > ifi4 =3D if_nametoindex(c->ip4.ifname_out); > > > > > > > > > > @@ -1980,9 +2004,9 @@ void conf(struct ctx *c, int argc, char **a= rgv) > > > > > log_conf_parsed =3D true; /* Stop printing everythi= ng */ > > > > > > > > > > nl_sock_init(c, false); > > > > > - if (!v6_only) > > > > > + if (!v6_only && !c->no_tap) > > > > > c->ifi4 =3D conf_ip4(ifi4, &c->ip4); > > > > > - if (!v4_only) > > > > > + if (!v4_only && !c->no_tap) > > > > > c->ifi6 =3D conf_ip6(ifi6, &c->ip6); > > > > > > > > > > if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { > > > > > @@ -1998,30 +2022,32 @@ void conf(struct ctx *c, int argc, char *= *argv) > > > > > (*c->ip6.ifname_out && !c->ifi6)) > > > > > die("External interface not usable"); > > > > > > > > > > - if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { > > > > > + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn && !c->no_tap) { > > > > > > > > You already checked that !*c->pasta_ifn above. > > > > > > I guess the check above (aka. if (*c->pasta_ifn && c->no_tap)) doesn'= t > > > affect this one? If c->pasta_ifn is assigned, we won't come to the > > > check !c->no_tap here. Otherwise, we do need to check !c->no_tap. > > > > Right, but you don't care about resetting c->pasta_ifn to the default > > value if !c->no_tap, because in that case you know that c->pasta_ifn > > wasn't set, so you can happily override it. I just realized that you probably meant when c->no_tap is set. Actually it would affect conf_print, info("Namespace interface: %s", c->pasta_ifn). But I will add a condition about c->splice_only before this line, so yes, it doesn't matter whether reset it or not. I will remove the check in v2. > > I'm not sure I fully understand it. If !c->no_tap, the condition is > the same as before without this patch, which is to not reset it if > it's specified in cmd line. We won't know if c->pasta_ifn is set > until this check, do we? > > > > I guess, at least, I haven't thoroughly checked what might happen later > > with it. > > > > > > > > > > > strncpy(c->pasta_ifn, pasta_default_ifn, > > > > > sizeof(c->pasta_ifn) - 1); > > > > > } > > > > > > > > > > if (!c->ifi4 && !v6_only) { > > > > > - info("IPv4: no external interface as template, use = local mode"); > > > > > - > > > > > - conf_ip4_local(&c->ip4); > > > > > + if (!c->no_tap) { > > > > > + info("IPv4: no external interface as templa= te, use local mode"); > > > > > + conf_ip4_local(&c->ip4); > > > > > + } > > > > > c->ifi4 =3D -1; > > > > > } > > > > > > > > > > if (!c->ifi6 && !v4_only) { > > > > > - info("IPv6: no external interface as template, use = local mode"); > > > > > - > > > > > - conf_ip6_local(&c->ip6); > > > > > + if (!c->no_tap) { > > > > > + info("IPv6: no external interface as templa= te, use local mode"); > > > > > + conf_ip6_local(&c->ip6); > > > > > + } > > > > > c->ifi6 =3D -1; > > > > > } > > > > > > > > > > - if (c->ifi4 && !no_map_gw && > > > > > + if (c->ifi4 > 0 && !no_map_gw && > > > > > IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) > > > > > c->ip4.map_host_loopback =3D c->ip4.guest_gw; > > > > > > > > > > - if (c->ifi6 && !no_map_gw && > > > > > + if (c->ifi6 > 0 && !no_map_gw && > > > > > IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) > > > > > c->ip6.map_host_loopback =3D c->ip6.guest_gw; > > > > > > > > > > @@ -2116,10 +2142,10 @@ void conf(struct ctx *c, int argc, char *= *argv) > > > > > conf_ports(c, name, optarg, &c->udp.fwd_out= ); > > > > > } while (name !=3D -1); > > > > > > > > > > - if (!c->ifi4) > > > > > + if (c->ifi4 <=3D 0) > > > > > c->no_dhcp =3D 1; > > > > > > > > > > - if (!c->ifi6) { > > > > > + if (c->ifi6 <=3D 0) { > > > > > c->no_ndp =3D 1; > > > > > c->no_dhcpv6 =3D 1; > > > > > } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { > > > > > diff --git a/fwd.c b/fwd.c > > > > > index 44a0e10..2f4a89a 100644 > > > > > --- a/fwd.c > > > > > +++ b/fwd.c > > > > > @@ -780,6 +780,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c= , uint8_t proto, > > > > > return PIF_SPLICE; > > > > > } > > > > > > > > > > + if (c->no_tap) > > > > > + return PIF_NONE; > > > > > + > > > > > if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { > > > > > if (inany_v4(&ini->eaddr)) { > > > > > if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap= _addr)) > > > > > diff --git a/passt.1 b/passt.1 > > > > > index db0d662..2d643f7 100644 > > > > > --- a/passt.1 > > > > > +++ b/passt.1 > > > > > @@ -755,6 +755,11 @@ Default is to let the tap driver build a pse= udorandom hardware address. > > > > > Disable the bypass path for inbound, local traffic. See the sect= ion \fBHandling > > > > > of local traffic in pasta\fR in the \fBNOTES\fR for more details= . > > > > > > > > > > +.TP > > > > > +.BR \-\-no-tap > > > > > +Do not create a tap device in the namespace. In this mode, only = local loopback > > > > > +traffic between namespaces is forwarded using splice. > > > > > > > > "Using splice" isn't really clear, and it's not entirely correct in= the > > > > case of UDP: there's no splice() system call there, even if we call > > > > some UDP flows "spliced" for analogy with TCP. > > > > > > > > Maybe just omit it, say: > > > > > > > > [...] In this mode, \fIpasta\fR only > > > > forwards loopback traffic between namespaces. > > > > > > Do you think we still need "Do not create a tap device in the > > > namespace" after updating it to --splice-only? > > > > Yes, I think so, because otherwise it might look like we create the tap > > device anyway, but discard all traffic from/to it. > > > > -- > > Stefano > > > > > -- > Thanks, > > Yumei Huang --=20 Thanks, Yumei Huang