From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=gibson.dropbear.id.au Authentication-Results: passt.top; dkim=pass (2048-bit key; secure) header.d=gibson.dropbear.id.au header.i=@gibson.dropbear.id.au header.a=rsa-sha256 header.s=202608 header.b=DttcEz1R; dkim-atps=neutral Received: from mail.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) by passt.top (Postfix) with ESMTPS id 20A765A0265 for ; Wed, 02 Sep 2026 11:09:26 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gibson.dropbear.id.au; s=202608; t=1788340161; bh=ysrutxUJMnHOd2EJGcxKsNnfFuqSKdOW/Rra/tmd6c4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=DttcEz1RQHhGvvtHMm80fyx/G/1L8SE1svlqIQh7m9fY/0vvlGte+CFZi4vTJCfMX nSKS8EoedXeaJOZ/cM9Ra2Wdxl/fvT80L/aR299Fh4RHr5W0IPAWgFoF9dM55iL1It EkoMBp6eU8KcMsuEcAH0kkq9pROghUnxvd26oRC+jyKtI5XomEPTx0TwdvrPF14G0s M7dIxnaKDTB6wa/G2G/YxeV/kogIRjaq4QqVobOmOXtlIHtOos68zzWFNaOSPmMS2w FGs0hNqb35iF8DmUk0jgpGDBpYVEEh8s9FCFn0ak0FzjVd65YlRk0sejFeKs1yRC9c 0cr2gKOTmNGzQ== Received: by gandalf.ozlabs.org (Postfix, from userid 1007) id 4hZcNx4fmyz4wJk; Wed, 02 Sep 2026 19:09:21 +1000 (AEST) Date: Wed, 2 Sep 2026 19:09:15 +1000 From: David Gibson To: Stefano Brivio Subject: Re: UDP drops when source port is in use in the init namespace Message-ID: References: <178828896845.2775.7538203367154726506@maja> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="nytBeLcHJtc1W2LW" Content-Disposition: inline In-Reply-To: <178828896845.2775.7538203367154726506@maja> Message-ID-Hash: Y4TXCTSNGYAQAKJU2F4F5VGILELVFRZN X-Message-ID-Hash: Y4TXCTSNGYAQAKJU2F4F5VGILELVFRZN X-MailFrom: dgibson@gandalf.ozlabs.org X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Rahul , passt-user@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: "For passt users: support, questions and answers" Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --nytBeLcHJtc1W2LW Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 01, 2026 at 08:56:01PM +0200, Stefano Brivio via user wrote: > Date: Tue, 01 Sep 2026 20:56:01 +0200 (CEST) > From: Stefano Brivio > To: Rahul > CC: passt-user@passt.top > Subject: Re: UDP drops when source port is in use in the init namespace > Organization: Red Hat > List-Id: "For passt users: support, questions and answers" > >=20 > Rahul, thanks for the report and for the investigation. Remarks and > some answers inline: >=20 > On Sun, 30 Aug 2026 11:12:44 +0100 > Rahul wrote: >=20 > > Hi, > >=20 > > I'm seeing DNS requests being dropped when using pasta 20250217. As far= as > > I can tell, UDP > > flows where the source port chosen in the namespace is already in use i= n the > > init namespace get dropped. > >=20 > > All three fwd_nat_from_*() preserve the source port for UDP: > >=20 > > tgt->oport =3D 0; > > if (proto =3D=3D IPPROTO_UDP) > > /* But for UDP preserve the source port */ > > tgt->oport =3D ini->eport; >=20 > This is intended, to offer compatibility with applications or protocols > that might rely on UDP source ports to be preserved, and, in general, > to be as transparent as possible. But: >=20 > > That forces a bind() to it, and udp_flow_sock() treats bind failure as > > fatal, so > > the flow is cancelled and the datagram dropped with no error to the sen= der. >=20 > ...this is not, that is, it would definitely be desirable to have a > fallback for bind() failures. Probably? The danger with a fallback of this sort is that if you're using a protocol which cares about the source port it will work.. until suddenly it doesn't for pretty non-obvious reasons. Theoretically another option would be to _not_ preserve the source port by default, but allow forwarding rules to specify source-port preservation, specifically for cases which do need it. But, that's a lot more work both to implement and to configure. > > I don't think I ever hit this with slirp4netns, it looks like libslirp's > > udp_attach() never > > binds a port, so the kernel just gives it a random free port. >=20 > Right, yes, slirp4netns doesn't attempt to preserve UDP source ports > outside the namespace. It's a feature we added in pasta. >=20 > > I'm not sure whether this is intended, but if it is, is there any way to > > work > > around it? >=20 > I see two ways of implementing this fallback mechanism, roughly: >=20 > 1. pass all the way to _sock_l4() via udp_flow_sock() an additional > argument to entirely ignore bind() failures (like we do for ICMP > ping sockets). It might be a rather mechanical change but not my > preferred approach as we would need an extra argument in a large > number of functions just for a corner case >=20 > 2. I think preferable: detect the failure on bind() here (it should be > EADDRINUSE, did you check?) and try again from udp_flow_sock() with > tgt->oport as 0. >=20 > Here, "tgt" means the target namespace of the connection, and > "oport" means "our port", implying the source port (because it's an > outbound connection from pasta's side). You'll also need to make sure this takes place _before_ calling getsockname() to fill in the correct final tgt->oport. > I think it would be good to try and sketch a solution (maybe starting > from 1.) to understand what approach would be more elegant and viable. >=20 > I don't have much time on my hands right now but I'll definitely > provide pointers and support if you feel like proposing a patch for > this. >=20 > As a first test / workaround for your usage: did you already check that > keeping tgt->oport as 0 in the relevant function in fwd.c works? >=20 > --=20 > Stefano >=20 > _______________________________________________ > user mailing list -- passt-user@passt.top > To unsubscribe send an email to passt-user-leave@passt.top --=20 David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson --nytBeLcHJtc1W2LW Content-Type: application/pgp-signature; name=signature.asc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEO+dNsU4E3yXUXRK2zQJF27ox2GcFAmqX57oACgkQzQJF27ox 2GdEVQ//TgBLJv3mcuQBN/SvRIvVRyU6jkPtije33j0dd/fGXOiRm2Lb78R4FtzT x9YmYbq5JZp6MgVdJZ0b9GQ0RFggsqAaP7nV8iZ2KAnarwukqTubxVJJkmqwUkp3 zAmux7YMb5PQeZAPqlOVbeYUQ7xBX+bmEvAVANJHNKYdhvsSPesEZFpP5GwvIYNc RLGOfmbEkJCgK2bEG3hAdRcIZbo0D9uMhrFfdocPSdudWnUEr9d3kAEzZkFgqgZY KB9qRclob0IjJgSa/z2bI7uMMG+XQpEiCFKJNCUwoEubJJ9kaWJOgZCKjEhPSdPl QmmJws4Wlpd57MnHD0posYpWQKBj7YyoKmLBxpNymUuGrUggMkknJ5cDSTa5bAT5 NL1KSKwNPaJ/HRMJ8q/2uRuqdsaYffmSK51z7ce40SEYiPHybn31sN1PbqpMoQOK Zpx7JbqkduK9gElzLzd7nfQK/4WkFdI+TYH9I+P/5s8da14mibPICdl88R/DnM0/ BPv7SFD3vvb67AF23sHr5uxls+WIZykcfv+G5HUQ9jIMWZrYeUwGKBv00f/5mGjE YgQx5p2kSGBNliLAiDaDWUIJd9unw/1ezxofgwmHArBxxWssFoJQLFXmT+4BzGds dDuJpEkE0nZrA9r1fkFrvjdA97Fm8nzOvT0CKNbizVvSbwe9+Is= =4Suy -----END PGP SIGNATURE----- --nytBeLcHJtc1W2LW--