Overview Repositories Revisions Requests Users Attributes Meta

Plug A Simple Socket Transport

Edit Package passt
https://passt.top/passt/about/

passt implements a translation layer between a Layer-2 network interface and
native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't
require any capabilities or privileges, and it can be used as a simple
replacement for Slirp.

Refresh
Refresh
Source Files
Filename Size Changed
_service 0000000450 450 Bytes
_servicedata 0000000221 221 Bytes
passt-0~git20230823.tar.xz 0000184864 181 KB
passt.changes 0000049070 47.9 KB
passt.spec 0000004670 4.56 KB
Revision 2 (latest revision is 19)
Dario Faggioli's avatar Dario Faggioli (dfaggioli) accepted request 1107867 from Frederic Crozat's avatar Frederic Crozat (fcrozat) (revision 2) 
- Update to version 0~git20230823:
  * pasta: Strip RTA_PREFSRC when copying routes to the namespace
  * netlink: Set IFA_ADDRESS, not just IFA_LOCAL, while adding IPv4 addresses
  * tcp: Remove broken pressure calculations for tcp_defer_handler()
  * inany: Add missing double include guard to inany.h
  * tcp: Move in_epoll flag out of common connection structure
  * tcp, udp: Don't pre-fill IPv4 destination address in headers
  * tcp, udp: Don't include destination address in partially precomputed csums
  * tcp: Consistent usage of ports in tcp_seq_init()
  * tcp: More precise terms for addresses and ports
  * tap: Pass source address to protocol handler functions
  * tap: Don't clobber source address in tap6_handler()
  * selinux: Fix domain transitions for typical commands pasta might run
  * selinux: Allow pasta_t to read nsfs entries
  * selinux: Add rules for sysctl and /proc/net accesses
  * selinux: Update policy to fix user/group settings
  * selinux: Fix user namespace creation after breaking kernel change
  * selinux: Use explicit paths for binaries in file context
  * fedora: Install pasta as hard link to ensure SELinux file context match
  * tap: Fix format specifier in tap4_is_fragment() warning
  * netlink: Don't propagate host address expiry to the container
  * netlink: Correctly calculate attribute length for address messages
  * netlink: Remove redundant check on nlmsg_type
  * conf: Demote overlapping port ranges error to a warning
  * epoll: Use different epoll types for passt and pasta tap fds
  * epoll: Split listening Unix domain socket into its own type
  * epoll: Split handling of listening TCP sockets into their own handler
  * epoll: Split handling of TCP timerfds into its own handler function
  * epoll: Tiny cleanup to udp_sock_handler()
  * epoll: Split handling of ICMP and ICMPv6 sockets
Comments 6
lukas12342's avatar
lukas12342 -

The currently packaged version of pasta does not seem to work at all (MicroOS). Only ping does work in a pasta netns but curl does not and neither do port forwards with podman.

This does work on Fedora and Arch Linux.

Berthold Höllmann's avatar
Berthold Höllmann (bhoel) -

For me pasta gives error messages:

> pasta
Could not open /proc/self/uid_map: Permission denied
Couldn't configure user mappings
Couldn't mount /proc: Permission denied
Failed to join network namespace: Permission denied
Could not open /proc/sys/net/ipv4/ping_group_range: Permission denied
Cannot set ping_group_range, ICMP requests might fail

Are there any permissions I have to set?

> rpm -qi passt
Name        : passt
Version     : 20240220.1e6f92b
Release     : 1.2
Architecture: x86_64
Install Date: Sa 06 Apr 2024 21:14:43 CEST
Group       : System/Daemons
Size        : 438994
License     : GPL-2.0-or-later AND BSD-3-Clause
Signature   : RSA/SHA512, Fr 29 Mär 2024 18:45:11 CET, Key ID 35a2f86e29b700a4
Source RPM  : passt-20240220.1e6f92b-1.2.src.rpm
Build Date  : Do 14 Mär 2024 10:40:51 CET
Build Host  : reproducible
Packager    : https://bugs.opensuse.org
Vendor      : openSUSE
URL         : https://passt.top/
Summary     : User-mode networking daemons for virtual machines and namespaces
Description :
passt implements a translation layer between a Layer-2 network interface and
native Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't
require any capabilities or privileges, and it can be used as a simple
replacement for Slirp.

pasta (same binary as passt, different command) offers equivalent functionality,
for network namespaces: traffic is forwarded using a tap interface inside the
namespace, without the need to create further interfaces on the host, hence not
requiring any capabilities or privileges.
Distribution: openSUSE Tumbleweed
Berthold Höllmann's avatar
Berthold Höllmann (bhoel) -

If I understand the spec file correctly, it fails to install the install the apparmor rules for pasta alongside the passt rules:

%if %{with apparmor}
pushd contrib/apparmor
mkdir -p %{buildroot}%{_sysconfdir}/apparmor.d/abstractions
install -m 0644 usr.bin.passt %{buildroot}%{_sysconfdir}/apparmor.d/
install -m 0644 abstractions/{passt,pasta} %{buildroot}%{_sysconfdir}/apparmor.d/abstractions
popd
%endif

Isn't there a line missing like 

install -m 0644 usr.bin.pasta %{buildroot}%{_sysconfdir}/apparmor.d/

?

Danish Prakash's avatar
Danish Prakash (danishprakash) -

The fixes discussed in boo#1221840 have been merged, can you now try to see if you're still facing the issue?

Eyad Issa's avatar
Eyad Issa (VaiTon) -

Probably related to boo#1221840

Eyad Issa's avatar
Eyad Issa (VaiTon) -

We should change the .spec file to hardlink pasta to passt, as per https://bugzilla.suse.com/show_bug.cgi?id=1221840#c28

openSUSE Build Service is sponsored by
Places