passt(1) General Commands Manual passt(1) (NAME) passt - pasta - (SYNOPSIS) passt []... pasta []... [ []...] pasta []... PID pasta []... --netns [|] (DESCRIPTION) passt passt (Plug A Simple Socket Transport) (user-mode) . (data plane) (TCP UDP ping) . ARP DHCP NDP DHCPv6 . IP (port bindings) . (Port forwarding) . slirp4netns(1) passt TCP : TCP (stateful) ( ) . qemu(1) (UNIX domain socket) passt . 7.2 qemu . qemu qrap(1) . pasta pasta (Pack A Subtle Tap Abstraction) (network namespaces) passt . PID --netns pasta . pasta (shell) . tap . TCP UDP pasta (bypass path) init . (OPTIONS) . -d, --debug (system logger). --trace . --debug . --stats DELAY DELAY . . -q, --quiet . -f, --foreground . PID PID . . -e, --stderr () . . -l, --log-file PATH PATH . : . --log-size SIZE SIZE . . . ( ) . --runas UID|UID:GID|LOGIN|LOGIN:GROUP UID ( UID ) UID GID . (login) . ( UID 0 CAP_SETUID) . nobody . -c, --conf-path path () pesto(1) passt pasta . -h, --help . --version . -p, --pcap file tap ( ) file pcap. : . -P, --pid file PID file ( ). -m, --mtu mtu mtu DHCP ( 26) NDP ( 5). MTU . MTU MTU 802.3 802.3 ( IPv4). -a, --address addr[/prefix_len] addr IPv4 DHCP (yiaddr) addr DHCPv6 ( 5) addr NDP ( 3) addr IPv6. /prefix_len (- IPv4 - IPv6) CIDR ( 192.0.2.1/24). -n --netmask . CIDR -n . IPv6 . ( ) ( IPv4 IPv6) . IPv4 IPv6 IP . IP . IP (link-local) 169.254.2.1 IPv4 IPv6 . -n, --netmask mask IPv4 mask DHCP ( 1). CIDR -a --address ( -a 192.0.2.1/24). -n CIDR . . . . -M, --mac-addr addr MAC addr . MAC 9a:55:9a:55:9a:55 . -g, --gateway addr addr IPv4 (default gateway) DHCP ( 3) addr IPv6 NDP DHCPv6. ( ) ( IPv4 IPv6) . IPv4 IPv6 IP . (multipath) (nexthop) . . IP 169.254.2.2 IPv4 fe80::1 IPv6 . : loopback . (NOTES) . -i, --interface name name . --outbound-if4 --outbound- if6 IPv4 IPv6 . IP . . . -o, --outbound addr IPv4 addr TCP UDP ICMP IPv4 IPv6 addr IPv6 . ( ) ( IPv4 IPv6) . . --outbound-if4 name IPv4 name IPv4 ( -i --interface ). . . . --outbound-if6 name IPv6 name IPv6 ( -i --interface ). . . . -D, --dns addr ( DHCP DHCPv6 NDP) addr (IPv4 IPv6) (nameserver) ( --no-dhcp-dns --dhcp-dns ) /etc/resolv.conf. . -D none DNS . /etc/resolv.conf addr . --dns 127.0.0.1 . --dns-forward addr addr (IPv4 IPv6) ( IP ) --dns- host . UDP TCP . . ( IPv4 IPv6) . --dns-host addr --dns-forward . ( IPv4 IPv6) . /etc/resolv.conf . -S, --search list list DHCP DHCPv6 NDP /etc/resolv.conf. --no-dhcp-search --dhcp-search . --search none DNS ( "none" --search none. ). --no-dhcp-dns passt IPv4 DHCP ( 23) IPv6 NDP ( 25) DHCPv6 ( 23) DNS . . --dhcp-dns pasta IPv4 DHCP ( 23) IPv6 NDP ( 25) DHCPv6 ( 23) DNS. . --no-dhcp-search passt DNS DHCP ( 119) NDP ( 31) DHCPv6 ( 24) . DNS . --dhcp-search pasta DNS DHCP ( 119) NDP ( 31) DHCPv6 ( 24). DNS . --no-tcp TCP. TCP TCP . --no-udp UDP. UDP UDP . --no-icmp ICMP/ICMPv6. ICMP ICMPv6 . --no-ndp . --no-dhcp DHCP. DHCP . IPv4 . --no-ndp (Neighbor Discovery). NDP . NDP . --no-dhcpv6 DHCPv6. DHCPv6 . --no-ra (Router Advertisements). (Router Solicitations) . --freebind (binding address) -t -u. . --freebind IP_FREEBIND IPV6_FREEBIND . . --map-host-loopback addr addr . addr . 127.0.0.1 ::1 . addr 'none' ( --no-map-gw ). IPv4 IPv6 . --no-map- gw . --no-map-gw TCP UDP . . --chroot-fallback chroot() pivot_root() ( ) . tmpfs initramfs pivot_root() (EINVAL) . . pivot_root() sandbox . --map-guest-addr addr addr . addr -a (global) . (shadow ). addr 'none' . IPv4 IPv6 . --map-host-loopback . -4, --ipv4-only IPv4. IPv6 . IPv6 IPv6 . -6, --ipv6-only IPv6. IPv4 . IPv4 IPv4 . -H, --hostname name (hostname) . name 12 DHCP (hostname). --fqdn name (FQDN) . name Client FQDN: 81 DHCP 39 DHCPv6. -t, --tcp-ports spec TCP . spec : none [address[%interface]/]ports ... . ( 5.7 ) . ports : first[-last][:[toaddr/]tofirst[-tolast]] first[-last][:toaddr] (Include range). first last ( ) tofirst tolast toaddr. toaddr . tofirst tolast first last . last first . ~first[-last] (Exclude range). first last. . all[:toaddr] (non- ephemeral) toaddr. toaddr . ( ) (NOTES) . . auto pasta. (bound) . ( ) /proc/net/tcp /proc/net/tcp6 proc(5) . . 'all' . . : -t all -t ::1/all ::1 -t 22 22 22 -t 22:23 22 23 -t 22,25 22 25 22 25 -t 22-80 22 80 -t 22-80:32-90 22 80 32 90 -t 192.0.2.1/22 22 192.0.2.1 22 -t 192.0.2.1%eth0/22 22 192.0.2.1 eth0 22 -t %eth0/22 22 eth0 22 -t 0.0.0.0/5000:192.0.2.5/6000 5000 IPv4 6000 192.0.2.5. -t 127.0.0.6/all:192.0.2.6 127.0.0.6 192.0.2.6. -t 2000-5000,~3000-3010 2000 5000 3000 3010 -t 192.0.2.1/20-30,~25 192.0.2.1 20 24 26 30 -t ~20000-20010 20000 20010 -t auto -t ::1/auto ::1 -t 8000-8010,auto 8000-8010 passt none pasta auto . -u, --udp-ports spec UDP . spec TCP . : UDP TCP . IPv6 IPv4 . passt none pasta auto . passt -s, --socket-path, --socket path (UNIX domain socket) qemu(1) passt. /tmp/passt_1.socket /tmp/passt_64.socket . --vhost-user vhost-user. vhost-user --socket . --print-capabilities back-end JSON vhost-user . --repair-path path passt-repair(1) passt TCP_REPAIR (migration). --repair-path none ( "none" ./ ). --vhost-user .repair . --vhost-user . --migrate-exit () . passt . . . (REPORTING BUGS) . --migrate-no-linger () TCP . (connection resets) . . . (REPORTING BUGS) . -F, --fd FD passt. passt . . --one-off . -1, --one-off . : passt . --migrate-no-linger . pasta -I, --ns-ifname name tap . . tap0 . -T, --tcp-ns spec TCP init. spec TCP . auto . -U, --udp-ns spec UDP init. spec UDP . auto . --host-lo-to-ns-lo -t -u loopback loopback . . --no-splice . --userns spec . PID . --netns spec . ip-netns(8) /run/netns . PID . --netns-only (sandboxing) . PATH NAME --userns . --no-netns-quit . (bound) procfs ( PID ) pasta . --config-net : tap. --no-copy-routes () --config-net : . -g, --gateway IP . . . . (REPORTING BUGS) . --no-copy-addrs () --config-net : . -a, --address IP . ( link-local) . . . (REPORTING BUGS) . --ns-mac-addr addr MAC addr tap . tap . --no-splice . pasta (NOTES) . --splice-only tap . pasta loopback . (EXAMPLES) pasta $ iperf3 -s -D $ pasta --config-net # ip address show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever 2: enp9s0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 link/ether be:16:49:5a:65:dc brd ff:ff:ff:ff:ff:ff inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::bc16:49ff:fe5a:65dc/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever # ip route show default via 88.198.0.161 dev enp9s0 proto dhcp metric 1002 88.198.0.160/27 dev enp9s0 proto dhcp scope link metric 1002 # ip -6 route show 2a01:4f8:222:904::/64 dev enp9s0 proto kernel metric 256 pref medium fe80::/64 dev enp9s0 proto kernel metric 256 pref medium default via fe80::1 dev enp9s0 metric 1024 onlink pref medium # iperf3 -c 127.0.0.1 -t1 Connecting to host 127.0.0.1, port 5201 [ 5] local 127.0.0.1 port 59112 connected to 127.0.0.1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 2.62 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec 0 sender [ 5] 0.00-1.00 sec 3.89 GBytes 33.4 Gbits/sec receiver iperf Done. # iperf3 -c ::1 -t1 Connecting to host ::1, port 5201 [ 5] local ::1 port 49138 connected to ::1 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 1.06 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec 0 sender [ 5] 0.00-1.00 sec 4.32 GBytes 37.0 Gbits/sec receiver iperf Done. # ping -nc1 -4 spaghetti.pizza PING spaghetti.pizza (5.161.47.86) 56(84) bytes of data. 64 bytes from 5.161.47.86: icmp_seq=1 ttl=255 time=99.4 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 99.433/99.433/99.433/0.000 ms # ping -nc1 -6 spaghetti.pizza PING spaghetti.pizza (2a01:4f8:1c1e:d6f1::1) 56 data bytes 64 bytes from 2a01:4f8:1c1e:d6f1::1: icmp_seq=1 ttl=255 time=3.11 ms --- spaghetti.pizza ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 3.110/3.110/3.110/0.000 ms $ unshare -rUn # echo $$ 1295969 [ ] $ pasta --config-net 1295969 Template interface: enp9s0 (IPv4), enp9s0 (IPv6) Namespace interface: enp9s0 MAC: host: 9a:55:9a:55:9a:55 NAT to host 127.0.0.1: 88.198.0.161 DHCP: assign: 88.198.0.164 mask: 255.255.255.224 router: 88.198.0.161 DNS: 185.12.64.1 185.12.64.2 NAT to host ::1: fe80::1 NDP/DHCPv6: assign: 2a01:4f8:222:904::2 router: fe80::1 our link-local: fe80::1 Inbound forwarding rules (HOST): TCP [*]:1-32767 => 1-32767 (best effort) (auto-scan) TCP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) UDP [*]:1-32767 => 1-32767 (best effort) (auto-scan) UDP [*]:61000-65535 => 61000-65535 (best effort) (auto-scan) Outbound forwarding rules (SPLICE): TCP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) TCP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) UDP [*]%lo:1-32767 => 1-32767 (best effort) (auto-scan) UDP [*]%lo:61000-65535 => 61000-65535 (best effort) (auto-scan) [ ] # ip address show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host proto kernel_lo valid_lft forever preferred_lft forever 2: enp9s0: mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000 link/ether 9a:44:5e:54:d3:2c brd ff:ff:ff:ff:ff:ff inet 88.198.0.164/27 brd 88.198.0.191 scope global noprefixroute enp9s0 valid_lft forever preferred_lft forever inet6 2a01:4f8:222:904::2/64 scope global nodad valid_lft forever preferred_lft forever inet6 fe80::9844:5eff:fe54:d32c/64 scope link nodad proto kernel_ll valid_lft forever preferred_lft forever passt $ passt -f -t 2222:22 UNIX domain socket bound at /tmp/passt_1.socket No IPv6 nameserver available for NDP/DHCPv6 Template interface: enp9s0 (IPv4), enp9s0 (IPv6) MAC: host: 9a:55:9a:55:9a:55 NAT to host 127.0.0.1: 88.198.0.161 DHCP: assign: 88.198.0.164 mask: 255.255.255.224 router: 88.198.0.161 DNS: 185.12.64.1 185.12.64.2 NAT to host ::1: fe80::1 NDP/DHCPv6: assign: 2a01:4f8:222:904::2 router: fe80::1 our link-local: fe80::1 Inbound forwarding rules (HOST): TCP [*]:2222 => 22 You can now start qemu (>= 7.2, with commit 13c6be96618c): kvm ... -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket [ ] $ qemu-system-x86_64 -m 128 test.qcow2 -display none -nodefaults -nographic -device virtio-net-pci,netdev=s -netdev stream,id=s,server=off,addr.type=unix,addr.path=/tmp/passt_1.socket [ ] accepted connection from PID 1301736 New guest MAC address observed: 52:54:00:12:34:56 DHCP: offer to discover from 52:54:00:12:34:56 DHCP: ack to request from 52:54:00:12:34:56 NDP: received RS, sending RA [ ] $ ssh -p 2222 root@localhost root@localhost's password: [...] # ip address show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff inet 88.198.0.164/27 scope global eth0 valid_lft forever preferred_lft forever inet6 2a01:4f8:222:904:5054:ff:fe12:3456/64 scope global dynamic flags 100 valid_lft forever preferred_lft forever inet6 fe80::5054:ff:fe12:3456/64 scope link valid_lft forever preferred_lft forever (NOTES) Loopback passt pasta loopback ( 127.0.0.0/8 ::1) . loopback : loopback -loopback . --map-host- loopback ( pasta ). IPv4 IPv6 ( ) -- (subnet) . --no-map-gw --map-host-loopback none loopback . loopback . IPv6 link-local link-local . IPv4 IPv6 . passt pasta 127.0.0.1 127.0.0.10 IPv4 192.0.2.1 192.0.2.2 192.0.2.1 192.0.2.2 . --map- host-loopback loopback . DNS --map-host-loopback loopback --dns- forward ( ). / . pasta pasta init . tap : pasta . TCP splice(2) UDP recvmmsg(2) sendmmsg(2) . . passt . loopback loopback --host-lo-to-ns-lo loopback . . ( ) passt pasta : o sysctl sys.net.ipv4.ip_unprivileged_port_start passt pasta . root: sysctl -w net.ipv4.ip_unprivileged_port_start=443 : passt pasta . o CAP_NET_BIND_SERVICE services(5) capabilities(7) . passt pasta . LSM ( ) AppArmor SELinux Smack TOMOYO passt pasta . pasta pasta () . root : for p in $(which passt passt.avx2); do setcap 'cap_net_bind_service=+ep' "${p}" done ICMP/ICMPv6 (Echo requests) ICMP ICMPv6 "ping" 2.6.30 . ( RFC 792 14 ICMP RFC 4443 4.1 ICMPv6 ) passt pasta "port" -- Echo "ping" . bind(2) SELinux . bind(2) . ICMP ICMPv6 ping_group_range PID passt pasta icmp(7) . loopback pasta pasta loopback lo (UP ). loopback . TCP TCP_INFO 5.3 TCP TCP TCP passt pasta TCP_INFO tcp(7) . 5.3 8f7baad7f035 ("tcp: Add snd_wnd to TCP_INFO") ( snd_wnd) . . TCP . passt pasta IP loopback IP . IPv4 169.254.2.1 IPv6 . IPv6 link-local . 169.254.2.2 IPv4 fe80::1 IPv6 . (LIMITATIONS) IGMP/MLD ( RFC 4605) SCTP ( RFC 4960) . TCP Selective Acknowledgment ( RFC 2018) (PAWS) (RTTM) RFC 7232 . (AUTHORS) Stefano Brivio , David Gibson . (REPORTING BUGS) https://passt.top/passt/bugs passt-user@passt.top https://passt.top/passt/lists . (COPYRIGHT) (c) 2020-2022 Red Hat GmbH. passt pasta : (GNU GPL) ( ) / . (SEE ALSO) namespaces(7), qemu(1), qrap(1), slirp4netns(1). https://passt.top/passt/about . passt(1)