From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202512 header.b=JvAE9Cs8; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 6DE0F5A004E for ; Mon, 12 Jan 2026 05:26:22 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202512; t=1768191979; bh=aMr8CgTLJlrp32ZuZLaO/rCOSujnslFeZP395S3rM00=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=JvAE9Cs84HREBuAbD/OBWCasBu+qXPjOYyTMRjKYL51iS+a3aOgSx5LmPtvxbVOTB ZaRP/kKZmEZDX2qp+hlcU3TdK51ZxBr/pzNV/AAGSfa07OCrlujnthLaij81RYWZqy nIqlSsafAjW2lEuHBW6M5p+JflWfQTMCO0erwFczqUOLAjvNoxup9vXhIJtnu0VlaB 3nTuKEdkVd0ldWNQWFvU19kZF3HJf/9q8NYVnlMUP0fR+jtyRe4NQFYvaYdKipxqmD 2hsJwi+pt3mfKvl+1hPBJFjaUtJ3GAgvrFkc5Y50CfcV5tqcfHyKxCKZpVOOWo2sL9 P71vNyehq4gHA== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4dqK7v64kvz4wB9; Mon, 12 Jan 2026 15:26:19 +1100 (AEDT) Date: Mon, 12 Jan 2026 15:26:14 +1100 From: David Gibson To: Stefano Brivio Subject: Re: [PATCH] conf, pasta: Add --no-tap option Message-ID: References: <20251229095558.918055-1-yuhuang@redhat.com> <20260110191219.29498050@elisabeth> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="5HhtqTQqpxU1Qf1N" Content-Disposition: inline In-Reply-To: <20260110191219.29498050@elisabeth> Message-ID-Hash: XW5YLOIJ7WZ56JSCTDMP2ETQAV7CT6GZ X-Message-ID-Hash: XW5YLOIJ7WZ56JSCTDMP2ETQAV7CT6GZ X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Yumei Huang , passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --5HhtqTQqpxU1Qf1N Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jan 10, 2026 at 07:12:19PM +0100, Stefano Brivio wrote: > On Mon, 5 Jan 2026 16:53:49 +0800 > Yumei Huang wrote: >=20 > > On Mon, Jan 5, 2026 at 12:18=E2=80=AFPM David Gibson > > wrote: > > > > > > On Mon, Dec 29, 2025 at 05:55:58PM +0800, Yumei Huang wrote: =20 > > > > This patch introduces a mode where we only forward loopback connect= ions > > > > and traffic between two namespaces (via the loopback interface, 'lo= '), > > > > without a tap device. > > > > > > > > With this, podman can support forwarding ::1 in custom networks whe= n using > > > > rootlesskit for forwarding ports. > > > > > > > > In --no-tap mode, --host-lo-to-ns-lo, --no-icmp and --no-ra is auto= matically > > > > enabled. Options requiring a tap device (--ns-ifname, --ns-mac-addr, > > > > --config-net, --outbound-if4/6) are rejected. > > > > > > > > Link: https://bugs.passt.top/show_bug.cgi?id=3D149 > > > > Signed-off-by: Yumei Huang =20 > > > > > > Nice work. There are some things that need polish, but overall this > > > looks pretty good to me. Like Stefano, I'm pleasantly surprised at > > > how simple it turned out to be. > > > =20 > > > > --- > > > > conf.c | 56 +++++++++++++++++++++++++++++++++++++++++------------= --- > > > > fwd.c | 3 +++ > > > > passt.1 | 5 +++++ > > > > passt.h | 2 ++ > > > > pasta.c | 3 +++ > > > > tap.c | 11 +++++++---- > > > > 6 files changed, 61 insertions(+), 19 deletions(-) > > > > > > > > diff --git a/conf.c b/conf.c > > > > index 84ae12b..353d0a5 100644 > > > > --- a/conf.c > > > > +++ b/conf.c > > > > @@ -1049,7 +1049,8 @@ pasta_opts: > > > > " --no-copy-addrs DEPRECATED:\n" > > > > " Don't copy all addresses to n= amespace\n" > > > > " --ns-mac-addr ADDR Set MAC address on tap interf= ace\n" > > > > - " --no-splice Disable inbound socket splici= ng\n"); > > > > + " --no-splice Disable inbound socket splici= ng\n" > > > > + " --no-tap Don't create tap device\n"); = =20 > > > > > > I feel like this description can be improved, but I'm not exactly sure > > > how, yet. >=20 > A few possible alternatives: >=20 > - "Only enable loopback forwarding" I prefer this one to the one below. > - "Loopback only from/to namespace" >=20 > - call it --splice-only, and use one of the descriptions above >=20 > - call it --loopback-only, and use one of the descriptions above >=20 > > > =20 > > > > > > > > passt_exit(status); > > > > } > > > > @@ -1451,6 +1452,7 @@ void conf(struct ctx *c, int argc, char **arg= v) > > > > {"no-ndp", no_argument, &c->no_ndp, = 1 }, > > > > {"no-ra", no_argument, &c->no_ra, = 1 }, > > > > {"no-splice", no_argument, &c->no_splice= , 1 }, > > > > + {"no-tap", no_argument, &c->no_tap, = 1 }, > > > > {"freebind", no_argument, &c->freebind,= 1 }, > > > > {"no-map-gw", no_argument, &no_map_gw, = 1 }, > > > > {"ipv4-only", no_argument, NULL, = '4' }, > > > > @@ -1947,8 +1949,11 @@ void conf(struct ctx *c, int argc, char **ar= gv) > > > > } > > > > } while (name !=3D -1); > > > > > > > > - if (c->mode !=3D MODE_PASTA) > > > > + if (c->mode !=3D MODE_PASTA) { > > > > c->no_splice =3D 1; > > > > + if (c->no_tap) > > > > + die("--no-tap is for pasta mode only"); > > > > + } > > > > > > > > if (c->mode =3D=3D MODE_PASTA && !c->pasta_conf_ns) { > > > > if (copy_routes_opt) > > > > @@ -1957,6 +1962,25 @@ void conf(struct ctx *c, int argc, char **ar= gv) > > > > die("--no-copy-addrs needs --config-net"); > > > > } > > > > > > > > + if (c->mode =3D=3D MODE_PASTA && c->no_tap) { > > > > + if (c->no_splice) > > > > + die("--no-tap is incompatible with --no-splic= e"); > > > > + if (*c->ip4.ifname_out || *c->ip6.ifname_out) > > > > + die("--no-tap is incompatible with --outbound= -if4/6"); > > > > + if (*c->pasta_ifn) > > > > + die("--no-tap is incompatible with --ns-ifnam= e"); > > > > + if (*c->guest_mac) > > > > + die("--no-tap is incompatible with --ns-mac-a= ddr"); =20 > > > > > > These all make sense. It might also make sense to exclude the -i > > > option - setting a template interface also makes no sense in --no-tap > > > mode. =20 > >=20 > > Sure, I can add an if condition with if4 (as if4=3Dif6 in that case). > > > =20 > > > > + if (c->pasta_conf_ns) > > > > + die("--no-tap is incompatible with --config-n= et"); =20 > > > > > > I don't think this is right. We still can and should bring up 'lo' in > > > the --no-tap case. =20 > >=20 > > I see your point, but seems c->pasta_conf_ns is only used for tap as > > https://passt.top/passt/tree/pasta.c#n328, 'lo' is configured before > > that line. >=20 > Right, and the reason is that there are basic bits of functionality > (probing pipe sizes if I recall correctly, or anyway probing for some > kind of capability) that need the loopback interface to be up. Ah, right. Drat. In general I don't like us touching the guest netlink at all if we don't have --config-net. Hrm.. now what exactly needs this. It's not anything in sock_probe_features() - that runs in the host ns. Not pipe sizes, either - that also takes place in the host ns (and netns is irrelevant to pipes, anyway). There could well be something, but I'm not sure what it is. > On the other hand, checks we're adding here are kind of fragile because > we'll add other options in the future and probably forget to check > which ones are incompatible, so I would try a slightly different > approach: only check the options that are *obviously* conflicting with > --no-tap. I agree. > That is, the main thing "--config-net" does is to "Configure networking > in the namespace", which we still do with "--no-tap". Agreed. > Now, I see that making sure c->pasta_conf_ns is false saves you checks > elsewhere in the implementation, which is, I think, a good reason to > have this check here. >=20 > But in general we don't need to exclude all the possible options that > make no sense with --no-tap. We don't really confuse users if we allow > them (or, at least, some of them). >=20 > > > > + c->host_lo_to_ns_lo =3D 1; > > > > + c->no_icmp =3D 1; > > > > + c->no_ra =3D 1; > > > > + c->no_dns =3D 1; > > > > + c->no_dns_search =3D 1; =20 > > > > > > The reasoning for the last two items is a bit unclear to me. IIUC, > > > no_dns and no_dns_search aren't so much about "support" for DNS itself > > > but for advertising DNS settings via DHCP. Since DHCP will be > > > unsupported, so are these as a consequence. Is that right? =20 > >=20 > > Yeah, I think so. Actually I added c->no_dhcp, c->no_ndp here as well, > > then removed them as they are set in later changes(conditions about > > c->ifi4/c->ifi6), though they turn out to be not quite right :'\ >=20 > Do we care about them, though? That code won't be reachable anyway, > unless I'm missing something. Or is it to make the output of > conf_print() nicer? In that case I guess it makes sense to go and > disable things. I think we want to avoid making conf_print() output misleading, and this seems a reasonable way of doing it. --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --5HhtqTQqpxU1Qf1N Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmlkd+UACgkQzQJF27ox 2Gfo5xAAqg+ZMoSeJdIw4IxiN0F4PD7Ra5xBSdZU4GYNvIp0hFO33Rq9IDcxyYAa zjfYTB3u85DdXz5knvHON46K3cMVvaR7Z+0oW9edvIDgeMVpBaO5DS9hu4jiaC9H nxWKurI/wVTwNZ9LvYeXuEa7T8W/VK+c7xDTHo68I19shfw4zT5RzLuu7N1sdWxH FzD1vaABfxA3FemuytidwCzxqnN4LS3jbk1ECNC0G9HAa9jhyKyhyzsVbVDvf1Fl j8isdDT+k/72KCdIieBJzyeNSlp7ASQ9f1q7fVvaMLfdfMwgaS2HmDEwAzVSUOev aQyVGGPfqkFQFzFQhQxxCFA+EJZGgO4xKL7rRw8fLNTOgb06uZCDCGrXneMD65Hz GNGhzyLVdbrsV/KdVo/TrjZ7bCL7WTQwN9/smkUAvOF22HdS2iiAiDBCQslC0fDG ZUO4PzVyZ45XMCBk7MgwFRzjPYdm3t3tbxB26ON5d+e45lKOFYsUgSY2HhUsqSlb 458y/QUFwyntI3iYVWmvh+J9UD5MkG5EgW5j2mQUUc8aQr+sk4I2vBHJLO/hFcQg jY6QubgIpKrv0AYQY/3bfUBiHNjhW2NB46xw6PXHCdW3xTTcrT27f3gK8xdzCotV ATsSQkzWoqezxixMvpr0sOOPQwCmcdUZQ20XTPCsGKeDASiivZA= =fWlM -----END PGP SIGNATURE----- --5HhtqTQqpxU1Qf1N--