From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Pwh2+GRe; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id D691A5A004E for ; Tue, 13 Jan 2026 10:57:28 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1768298247; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=AwKlGsLddHoHi+aVieq5Wd/D3Uwo+AZpFSHOp8fSrhQ=; b=Pwh2+GReYw4PmR6BxstpGMUVl1OSv+KzgsaMJxJbnmGDiwvwzvihA9dHeiJ1DrKzPsZoTm a4ZLBKkgJ/+vIkhCR4MGBcFFiJm21bJVNdD9btShaoksnTJ2/+UWJ7Lap8GSKhFdZNStWj h6MWIcAl2/bGmqS1mWZYuzsn9+JI/H0= Received: from mail-ej1-f72.google.com (mail-ej1-f72.google.com [209.85.218.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-108-3FXqUmN9OOGXP7v19zgRpg-1; Tue, 13 Jan 2026 04:57:25 -0500 X-MC-Unique: 3FXqUmN9OOGXP7v19zgRpg-1 X-Mimecast-MFC-AGG-ID: 3FXqUmN9OOGXP7v19zgRpg_1768298245 Received: by mail-ej1-f72.google.com with SMTP id a640c23a62f3a-b8723d894d7so269249666b.0 for ; Tue, 13 Jan 2026 01:57:25 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768298244; x=1768903044; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=AwKlGsLddHoHi+aVieq5Wd/D3Uwo+AZpFSHOp8fSrhQ=; b=sctQ8s5xjA3cnbtgCwEJKNLXTnL3s+v0pOeMWWx7dQCB6/O/0YgBR6s3bA8W8gV3Os R0f4vI2yQp6Ce2yOIlWy3x9p1h8GKptaDyuTtr0/EGkWgzAO4DZBqtf+NrSt6jMKElRK CJQGfDZXU70LWP5g7UojYbz5HHFdTaFaqRKHV6+g/ujABlO2rljAaTc6X4sFKWuixSTB Vi00NupTSewuu3UAeJrS9BoVjaPcq867SLZa0ceMareZhyxHSQBCVBeZ3h/nNSSgZuWj y6lHEo5FsOZBWCtP7/cPiMJ4LHLXl6OuAYSi5xb34m4DSTGct2ib6IgULr1AjmRQt9CL MHGA== X-Forwarded-Encrypted: i=1; AJvYcCVi5FQ8GXQrs+5yCVA0gP6Ya2MbncthLAT/tUCxl0VBngeioLTxmoKFTKTWIjubtae+42QnrC6f0Tc=@passt.top X-Gm-Message-State: AOJu0YyMsDpfMmXp/VkpIRlod1prkTKoE4jbuBGY6W7HTP2sfyJAh1M9 /YLPX6WNkb7/CpMuBm9LIzoM1wGC01gKmpZcBURR3kPJVzPogWHqNPMDDQOkMvRPfHaYwitwmql MTPszqBtxJJnbBztuOF5oaJqb6ba0Nea8V/YPINYe2SP0XlVhC2D+xgCiJ1VGV/gsp9Qf82EDsQ Jn6/aKVoWHZYcL5EWqSfwogAPujwMj X-Gm-Gg: AY/fxX7LWR6Orlh8mQc2LaYdOiMU1qY5bSeq8QQP1y0ryvvOqSNqfG2owdzWVEO3WAU 362hOmeI39mx9fkXnBJN4YmrJ/RYlmxixo+x3sWoBJDh2gQbjR5V5zVoJ4ycamtSpGY1KocGY4d H8yrVPxnslShAbCHV34TdGBTkEd2jY0chDB+6xOnueb7S1lpZ/AmoPY15S7i8QPPy9ee3jytrZJ CEp2sXV1dfLcNp4JutFrbzbN/h+XBRA74VptqaTHm6Go6PCh/LiLPG5m6qPQNbt6T1QuPcR82CK 7oSHKt/L3uhX X-Received: by 2002:a05:6402:27c8:b0:64b:5f4e:9e88 with SMTP id 4fb4d7f45d1cf-65097e4d851mr15844467a12.21.1768298244286; Tue, 13 Jan 2026 01:57:24 -0800 (PST) X-Google-Smtp-Source: AGHT+IHqSSW8zUJMT8Mf6E6QUloNA3cAodWxZyabZkIrTVJiOIiJ53TOfxSSMccR/gRToCm3bFyVAdnLbXGsI1wxk/U= X-Received: by 2002:a05:6402:27c8:b0:64b:5f4e:9e88 with SMTP id 4fb4d7f45d1cf-65097e4d851mr15844443a12.21.1768298243562; Tue, 13 Jan 2026 01:57:23 -0800 (PST) MIME-Version: 1.0 References: <20251229095558.918055-1-yuhuang@redhat.com> <20260110191219.29498050@elisabeth> In-Reply-To: <20260110191219.29498050@elisabeth> From: Yumei Huang Date: Tue, 13 Jan 2026 17:57:11 +0800 X-Gm-Features: AZwV_QhTFyj3ZW_d2H9HMtSCgswkJwnOY2-tWX7Sj3QMzKf3KeYlm_FSxaDSBHU Message-ID: Subject: Re: [PATCH] conf, pasta: Add --no-tap option To: Stefano Brivio X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: lsiYkiqqP07YXOY8THnznyECyNsS0MMVGfJisvUdroQ_1768298245 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: VMI2H6DW4R23RW2ZGAGYRLGYCFP7USMF X-Message-ID-Hash: VMI2H6DW4R23RW2ZGAGYRLGYCFP7USMF X-MailFrom: yuhuang@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson , passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Sun, Jan 11, 2026 at 2:12=E2=80=AFAM Stefano Brivio = wrote: > > On Mon, 5 Jan 2026 16:53:49 +0800 > Yumei Huang wrote: > > > On Mon, Jan 5, 2026 at 12:18=E2=80=AFPM David Gibson > > wrote: > > > > > > On Mon, Dec 29, 2025 at 05:55:58PM +0800, Yumei Huang wrote: > > > > This patch introduces a mode where we only forward loopback connect= ions > > > > and traffic between two namespaces (via the loopback interface, 'lo= '), > > > > without a tap device. > > > > > > > > With this, podman can support forwarding ::1 in custom networks whe= n using > > > > rootlesskit for forwarding ports. > > > > > > > > In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is auto= matically > > > > enabled. Options requiring a tap device (--ns-ifname, --ns-mac-addr= , > > > > --config-net, --outbound-if4/6) are rejected. > > > > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D149 > > > > Signed-off-by: Yumei Huang > > > > > > Nice work. There are some things that need polish, but overall this > > > looks pretty good to me. Like Stefano, I'm pleasantly surprised at > > > how simple it turned out to be. > > > > > > > --- > > > > conf.c | 56 +++++++++++++++++++++++++++++++++++++++++------------= --- > > > > fwd.c | 3 +++ > > > > passt.1 | 5 +++++ > > > > passt.h | 2 ++ > > > > pasta.c | 3 +++ > > > > tap.c | 11 +++++++---- > > > > 6 files changed, 61 insertions(+), 19 deletions(-) > > > > > > > > diff --git a/conf.c b/conf.c > > > > index 84ae12b..353d0a5 100644 > > > > --- a/conf.c > > > > +++ b/conf.c > > > > @@ -1049,7 +1049,8 @@ pasta_opts: > > > > " --no-copy-addrs DEPRECATED:\n" > > > > " Don't copy all addresses to n= amespace\n" > > > > " --ns-mac-addr ADDR Set MAC address on tap interf= ace\n" > > > > - " --no-splice Disable inbound socket splici= ng\n"); > > > > + " --no-splice Disable inbound socket splici= ng\n" > > > > + " --no-tap Don't create tap device\n"); > > > > > > I feel like this description can be improved, but I'm not exactly sur= e > > > how, yet. > > A few possible alternatives: > > - "Only enable loopback forwarding" Thanks, I will go with this and --splice-only. > > - "Loopback only from/to namespace" > > - call it --splice-only, and use one of the descriptions above > > - call it --loopback-only, and use one of the descriptions above > > > > > > > > > > > > passt_exit(status); > > > > } > > > > @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **arg= v) > > > > {"no-ndp", no_argument, &c->no_ndp, = 1 }, > > > > {"no-ra", no_argument, &c->no_ra, = 1 }, > > > > {"no-splice", no_argument, &c->no_splice= , 1 }, > > > > + {"no-tap", no_argument, &c->no_tap, = 1 }, > > > > {"freebind", no_argument, &c->freebind,= 1 }, > > > > {"no-map-gw", no_argument, &no_map_gw, = 1 }, > > > > {"ipv4-only", no_argument, NULL, = '4' }, > > > > @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **ar= gv) > > > > } > > > > } while (name !=3D -1); > > > > > > > > - if (c->mode !=3D MODE_PASTA) > > > > + if (c->mode !=3D MODE_PASTA) { > > > > c->no_splice =3D 1; > > > > + if (c->no_tap) > > > > + die("--no-tap is for pasta mode only"); > > > > + } > > > > > > > > if (c->mode =3D=3D MODE_PASTA && !c->pasta_conf_ns) { > > > > if (copy_routes_opt) > > > > @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **ar= gv) > > > > die("--no-copy-addrs needs --config-net"); > > > > } > > > > > > > > + if (c->mode =3D=3D MODE_PASTA && c->no_tap) { > > > > + if (c->no_splice) > > > > + die("--no-tap is incompatible with --no-splic= e"); > > > > + if (*c->ip4.ifname_out || *c->ip6.ifname_out) > > > > + die("--no-tap is incompatible with --outbound= -if4/6"); > > > > + if (*c->pasta_ifn) > > > > + die("--no-tap is incompatible with --ns-ifnam= e"); > > > > + if (*c->guest_mac) > > > > + die("--no-tap is incompatible with --ns-mac-a= ddr"); > > > > > > These all make sense. It might also make sense to exclude the -i > > > option - setting a template interface also makes no sense in --no-tap > > > mode. > > > > Sure, I can add an if condition with if4 (as if4=3Dif6 in that case). > > > > > > > + if (c->pasta_conf_ns) > > > > + die("--no-tap is incompatible with --config-n= et"); > > > > > > I don't think this is right. We still can and should bring up 'lo' i= n > > > the --no-tap case. > > > > I see your point, but seems c->pasta_conf_ns is only used for tap as > > https://passt.top/passt/tree/pasta.c#n328, 'lo' is configured before > > that line. > > Right, and the reason is that there are basic bits of functionality > (probing pipe sizes if I recall correctly, or anyway probing for some > kind of capability) that need the loopback interface to be up. > > On the other hand, checks we're adding here are kind of fragile because > we'll add other options in the future and probably forget to check > which ones are incompatible, so I would try a slightly different > approach: only check the options that are *obviously* conflicting with > --no-tap. > > That is, the main thing "--config-net" does is to "Configure networking > in the namespace", which we still do with "--no-tap". I added that because I thought --config-net is for tap only (as lo is configured always), and there is no tap for this mode. I can remove it, it still works without it. > > Now, I see that making sure c->pasta_conf_ns is false saves you checks > elsewhere in the implementation, which is, I think, a good reason to > have this check here. > > But in general we don't need to exclude all the possible options that > make no sense with --no-tap. We don't really confuse users if we allow > them (or, at least, some of them). I see. From a tester's perspective, we used to uncover a few bugs by combining certain options in different ways. I feel it's more user-friendly to explicitly state what is unsupported and what will be ignored, although this is not a strong preference. I can update with only excluding obvious ones. > > > > > + c->host_lo_to_ns_lo =3D 1; > > > > + c->no_icmp =3D 1; > > > > + c->no_ra =3D 1; > > > > + c->no_dns =3D 1; > > > > + c->no_dns_search =3D 1; > > > > > > The reasoning for the last two items is a bit unclear to me. IIUC, > > > no_dns and no_dns_search aren't so much about "support" for DNS itsel= f > > > but for advertising DNS settings via DHCP. Since DHCP will be > > > unsupported, so are these as a consequence. Is that right? > > > > Yeah, I think so. Actually I added c->no_dhcp, c->no_ndp here as well, > > then removed them as they are set in later changes(conditions about > > c->ifi4/c->ifi6), though they turn out to be not quite right :'\ > > Do we care about them, though? That code won't be reachable anyway, > unless I'm missing something. Or is it to make the output of > conf_print() nicer? In that case I guess it makes sense to go and > disable things. Just tried, without c->no_dns we would hit a warning "Couldn't get any nameserver address" , without c->no_dns_search, the conf_print will have lines as below, 0.0021: DNS search list: 0.0021: . 0.0021: DNS search list: 0.0022: . Apart from that, seems there is no difference with or without c->ra, c->no_dhcp, c->no_ndp. I guess we only need c->no_dns and c->no_dns_search here. > > > > > + } > > > > + > > > > if (!ifi4 && *c->ip4.ifname_out) > > > > ifi4 =3D if_nametoindex(c->ip4.ifname_out); > > > > > > > > @@ -1980,9 +2004,9 @@ void conf(struct ctx *c, int argc, char **arg= v) > > > > log_conf_parsed =3D true; /* Stop printing everything= */ > > > > > > > > nl_sock_init(c, false); > > > > - if (!v6_only) > > > > + if (!v6_only && !c->no_tap) > > > > c->ifi4 =3D conf_ip4(ifi4, &c->ip4); > > > > - if (!v4_only) > > > > + if (!v4_only && !c->no_tap) > > > > c->ifi6 =3D conf_ip6(ifi6, &c->ip6); > > > > > > > > if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { > > > > @@ -1998,30 +2022,32 @@ void conf(struct ctx *c, int argc, char **a= rgv) > > > > (*c->ip6.ifname_out && !c->ifi6)) > > > > die("External interface not usable"); > > > > > > > > - if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn) { > > > > + if (!c->ifi4 && !c->ifi6 && !*c->pasta_ifn && !c->no_tap) { > > > > strncpy(c->pasta_ifn, pasta_default_ifn, > > > > sizeof(c->pasta_ifn) - 1); > > > > } > > > > > > > > if (!c->ifi4 && !v6_only) { > > > > - info("IPv4: no external interface as template, use lo= cal mode"); > > > > - > > > > - conf_ip4_local(&c->ip4); > > > > + if (!c->no_tap) { > > > > + info("IPv4: no external interface as template= , use local mode"); > > > > + conf_ip4_local(&c->ip4); > > > > + } > > > > c->ifi4 =3D -1; > > > > } > > > > > > > > if (!c->ifi6 && !v4_only) { > > > > - info("IPv6: no external interface as template, use lo= cal mode"); > > > > - > > > > - conf_ip6_local(&c->ip6); > > > > + if (!c->no_tap) { > > > > + info("IPv6: no external interface as template= , use local mode"); > > > > + conf_ip6_local(&c->ip6); > > > > + } > > > > c->ifi6 =3D -1; > > > > } > > > > > > > > - if (c->ifi4 && !no_map_gw && > > > > + if (c->ifi4 > 0 && !no_map_gw && > > > > > > This isn't quite right. ifi4 =3D=3D -1 now occurs in two cases: loca= l > > > mode, and --no-tap mode. Not setting map_host_loopback makes sense > > > for --no-tap mode, but it's still needed for local mode. > > > > I'm a bit confused by map_host_loopback. I don't quite understand the > > use scenario. IIUC, either in --no-tap mode or local mode, guest can > > only communicate with host. > > That's not the case for local mode, the guest can communicate with any > other host. Local mode is just about addresses and routes, and the fact > that, when pasta started, there was no template interface. Oh, I thought local mode is only for host without network connectivity. Thanks for the explanation. > > > Then why do we need to set map_host_loopback? What's the benefit? > > Example: guest has 169.254.2.1 (default in local mode), and wants to use > 192.0.2.1 to refer to the host, via loopback interface. > > > > > IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) > > > > c->ip4.map_host_loopback =3D c->ip4.guest_gw; > > > > > > > > - if (c->ifi6 && !no_map_gw && > > > > + if (c->ifi6 > 0 && !no_map_gw && > > > > > > Same here. > > > > > > > IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) > > > > c->ip6.map_host_loopback =3D c->ip6.guest_gw; > > > > > > > > @@ -2116,10 +2142,10 @@ void conf(struct ctx *c, int argc, char **a= rgv) > > > > conf_ports(c, name, optarg, &c->udp.fwd_out); > > > > } while (name !=3D -1); > > > > > > > > - if (!c->ifi4) > > > > + if (c->ifi4 <=3D 0) > > > > c->no_dhcp =3D 1; > > > > > > > > - if (!c->ifi6) { > > > > + if (c->ifi6 <=3D 0) { > > > > c->no_ndp =3D 1; > > > > c->no_dhcpv6 =3D 1; > > > > > > And here. Local mode can still use NDP and DHCP, even though --no-ta= p > > > mode can't. It might be simpler to force no_ndp, no_dhcp etc. along > > > with no_ra and the rest above. > > > > Sure, I will add them. > > > > > > > } else if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.addr)) { > > > > diff --git a/fwd.c b/fwd.c > > > > index 44a0e10..2f4a89a 100644 > > > > --- a/fwd.c > > > > +++ b/fwd.c > > > > @@ -780,6 +780,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, = uint8_t proto, > > > > return PIF_SPLICE; > > > > } > > > > > > > > + if (c->no_tap) > > > > + return PIF_NONE; > > > > + > > > > if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { > > > > if (inany_v4(&ini->eaddr)) { > > > > if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_a= ddr)) > > > > diff --git a/passt.1 b/passt.1 > > > > index db0d662..2d643f7 100644 > > > > --- a/passt.1 > > > > +++ b/passt.1 > > > > @@ -755,6 +755,11 @@ Default is to let the tap driver build a pseud= orandom hardware address. > > > > Disable the bypass path for inbound, local traffic. See the sectio= n \fBHandling > > > > of local traffic in pasta\fR in the \fBNOTES\fR for more details. > > > > > > > > +.TP > > > > +.BR \-\-no-tap > > > > +Do not create a tap device in the namespace. In this mode, only lo= cal loopback > > > > +traffic between namespaces is forwarded using splice. > > > > > > This probably wants some work, because I'm not sure "tap device" and > > > "splice" are sufficiently clear in this context. > > > > Yeah, I will think about that. Thanks. > > > > > > > > > > + > > > > .SH EXAMPLES > > > > > > > > .SS \fBpasta > > > > diff --git a/passt.h b/passt.h > > > > index 79d01dd..0c1ec4c 100644 > > > > --- a/passt.h > > > > +++ b/passt.h > > > > @@ -200,6 +200,7 @@ struct ip6_ctx { > > > > * @no_ndp: Disable NDP handler altogether > > > > * @no_ra: Disable router advertisements > > > > * @no_splice: Disable socket splicing for inbound t= raffic > > > > + * @no_tap: Do not create tap device > > > > * @host_lo_to_ns_lo: Map host loopback addresses to ns loo= pback addresses > > > > * @freebind: Allow binding of non-local addresses = for forwarding > > > > * @low_wmem: Low probed net.core.wmem_max > > > > @@ -277,6 +278,7 @@ struct ctx { > > > > int no_ndp; > > > > int no_ra; > > > > int no_splice; > > > > + int no_tap; > > > > int host_lo_to_ns_lo; > > > > int freebind; > > > > > > > > diff --git a/pasta.c b/pasta.c > > > > index 0ddd6b0..3510ec5 100644 > > > > --- a/pasta.c > > > > +++ b/pasta.c > > > > @@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c) > > > > die("Couldn't bring up loopback interface in namespac= e: %s", > > > > strerror_(-rc)); > > > > > > > > + if (c->no_tap) > > > > + return; > > > > + > > > > /* Get or set MAC in target namespace */ > > > > if (MAC_IS_ZERO(c->guest_mac)) > > > > nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_ma= c); > > > > diff --git a/tap.c b/tap.c > > > > index 9d1344b..9b4eedc 100644 > > > > --- a/tap.c > > > > +++ b/tap.c > > > > @@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg) > > > > */ > > > > static void tap_sock_tun_init(struct ctx *c) > > > > { > > > > - NS_CALL(tap_ns_tun, c); > > > > - if (c->fd_tap =3D=3D -1) > > > > - die("Failed to set up tap device in namespace"); > > > > + if (!c->no_tap) { > > > > + NS_CALL(tap_ns_tun, c); > > > > + if (c->fd_tap =3D=3D -1) > > > > + die("Failed to set up tap device in namespace= "); > > > > + } > > > > > > > > pasta_ns_conf(c); > > > > > > > > - tap_start_connection(c); > > > > + if (!c->no_tap) > > > > + tap_start_connection(c); > > > > } > > > > > > > > /** > > > > -- > > > > 2.49.0 > > > > > > > > > > -- > > > David Gibson (he or they) | I'll have my music baroque, and my = code > > > david AT gibson.dropbear.id.au | minimalist, thank you, not the othe= r way > > > | around. > > > http://www.ozlabs.org/~dgibson > > > > > > > > -- > Stefano > --=20 Thanks, Yumei Huang