import UBI passt-0^20250512.g8ec1341-4.el10_1

.gitignore

@@ -1 +1 @@
-SOURCES/passt-a1e48a02ff3550eb7875a7df6726086e9b3a1213.tar.xz
+passt-8ec134109eb136432a29bdf5a14f8b1fd4e46208.tar.xz

.passt.metadata

@@ -1 +0,0 @@
-6561fdc75b29dc6566bc1fb30b88d6846ef5e23b SOURCES/passt-a1e48a02ff3550eb7875a7df6726086e9b3a1213.tar.xz

0001-treewide-By-default-don-t-quit-source-after-migratio.patch

@@ -0,0 +1,264 @@
+From b0b5ce0a76cf7fec0b00405732fd94e0b34e8d84 Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Thu, 17 Jul 2025 10:38:17 +0200
+Subject: [PATCH] treewide: By default, don't quit source after migration, keep
+ sockets open
+
+We are hitting an issue in the KubeVirt integration where some data is
+still sent to the source instance even after migration is complete. As
+we exit, the kernel closes our sockets and resets connections. The
+resulting RST segments are sent to peers, effectively terminating
+connections that were meanwhile migrated.
+
+At the moment, this is not done intentionally, but in the future
+KubeVirt might enable OVN-Kubernetes features where source and
+destination nodes are explicitly getting mirrored traffic for a while,
+in order to decrease migration downtime.
+
+By default, don't quit after migration is completed on the source: the
+previous behaviour can be enabled with the new, but deprecated,
+--migrate-exit option. After migration (as source), the -1 / --one-off
+option has no effect.
+
+Also, by default, keep migrated TCP sockets open (in repair mode) as
+long as we're running, and ignore events on any epoll descriptor
+representing data channels. The previous behaviour can be enabled with
+the new, equally deprecated, --migrate-no-linger option.
+
+By keeping sockets open, and not exiting, we prevent the kernel
+running on the source node to send out RST segments if further data
+reaches us.
+
+Reported-by: Nir Dothan <ndothan@redhat.com>
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+(cherry picked from commit a8782865c342eb2682cca292d5bf92b567344351)
+---
+ conf.c         | 22 ++++++++++++++++++++++
+ flow.c         |  2 +-
+ passt.1        | 29 +++++++++++++++++++++++++++++
+ passt.h        |  4 ++++
+ tcp.c          |  9 +++++++--
+ tcp_conn.h     |  3 ++-
+ test/lib/setup |  4 ++--
+ vhost_user.c   |  9 +++++++--
+ 8 files changed, 74 insertions(+), 8 deletions(-)
+
+diff --git a/conf.c b/conf.c
+index a6d7e22..1295d89 100644
+--- a/conf.c
++++ b/conf.c
+@@ -864,6 +864,14 @@ static void usage(const char *name, FILE *f, int status)
+ 		FPRINTF(f,
+ 			"  --repair-path PATH	path for passt-repair(1)\n"
+ 			"    default: append '.repair' to UNIX domain path\n");
++		FPRINTF(f,
++			"  --migrate-exit	DEPRECATED:\n"
++			"			source quits after migration\n"
++			"    default: source keeps running after migration\n");
++		FPRINTF(f,
++			"  --migrate-no-linger	DEPRECATED:\n"
++			"			close sockets on migration\n"
++			"    default: keep sockets open, ignore events\n");
+ 	}
+ 
+ 	FPRINTF(f,
+@@ -1468,6 +1476,8 @@ void conf(struct ctx *c, int argc, char **argv)
+ 		{"socket-path",	required_argument,	NULL,		's' },
+ 		{"fqdn",	required_argument,	NULL,		27 },
+ 		{"repair-path",	required_argument,	NULL,		28 },
++		{"migrate-exit", no_argument,		NULL,		29 },
++		{"migrate-no-linger", no_argument,	NULL,		30 },
+ 		{ 0 },
+ 	};
+ 	const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:";
+@@ -1683,6 +1693,18 @@ void conf(struct ctx *c, int argc, char **argv)
+ 					   optarg))
+ 				die("Invalid passt-repair path: %s", optarg);
+ 
++			break;
++		case 29:
++			if (c->mode != MODE_VU)
++				die("--migrate-exit is for vhost-user mode only");
++			c->migrate_exit = true;
++
++			break;
++		case 30:
++			if (c->mode != MODE_VU)
++				die("--migrate-no-linger is for vhost-user mode only");
++			c->migrate_no_linger = true;
++
+ 			break;
+ 		case 'd':
+ 			c->debug = 1;
+diff --git a/flow.c b/flow.c
+index 6a5c8aa..a4b65ea 100644
+--- a/flow.c
++++ b/flow.c
+@@ -1089,7 +1089,7 @@ int flow_migrate_source(struct ctx *c, const struct migrate_stage *stage,
+ 	 * as EIO).
+ 	 */
+ 	foreach_established_tcp_flow(flow) {
+-		rc = tcp_flow_migrate_source_ext(fd, &flow->tcp);
++		rc = tcp_flow_migrate_source_ext(c, fd, &flow->tcp);
+ 		if (rc) {
+ 			flow_err(flow, "Can't send extended data: %s",
+ 				 strerror_(-rc));
+diff --git a/passt.1 b/passt.1
+index 60066c2..cef98b2 100644
+--- a/passt.1
++++ b/passt.1
+@@ -439,6 +439,30 @@ Default, for \-\-vhost-user mode only, is to append \fI.repair\fR to the path
+ chosen for the hypervisor UNIX domain socket. No socket is created if not in
+ \-\-vhost-user mode.
+ 
++.TP
++.BR \-\-migrate-exit (DEPRECATED)
++Exit after a completed migration as source. By default, \fBpasst\fR keeps
++running and the migrated guest can continue using its connection, or a new guest
++can connect.
++
++Note that this configuration option is \fBdeprecated\fR and will be removed in a
++future version. It is not expected to be of any use, and it simply reflects a
++legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR
++below.
++
++.TP
++.BR \-\-migrate-no-linger (DEPRECATED)
++Close TCP sockets on the source instance once migration completes.
++
++By default, sockets are kept open, and events on data sockets are ignored, so
++that any further message reaching sockets after the source migrated is silently
++ignored, to avoid connection resets in case data is received after migration.
++
++Note that this configuration option is \fBdeprecated\fR and will be removed in a
++future version. It is not expected to be of any use, and it simply reflects a
++legacy behaviour. If you have any use for this, refer to \fBREPORTING BUGS\fR
++below.
++
+ .TP
+ .BR \-F ", " \-\-fd " " \fIFD
+ Pass a pre-opened, connected socket to \fBpasst\fR. Usually the socket is opened
+@@ -454,6 +478,11 @@ is closed.
+ Quit after handling a single client connection, that is, once the client closes
+ the socket, or once we get a socket error.
+ 
++\fBNote\fR: this option has no effect after \fBpasst\fR completes a migration as
++source, because, in that case, exiting would close sockets for active
++connections, which would in turn cause connection resets if any further data is
++received. See also the description of \fI\-\-migrate-no-linger\fR.
++
+ .TP
+ .BR \-t ", " \-\-tcp-ports " " \fIspec
+ Configure TCP port forwarding to guest. \fIspec\fR can be one of:
+diff --git a/passt.h b/passt.h
+index 8693794..4cfd6eb 100644
+--- a/passt.h
++++ b/passt.h
+@@ -241,6 +241,8 @@ struct ip6_ctx {
+  * @device_state_fd:	Device state migration channel
+  * @device_state_result: Device state migration result
+  * @migrate_target:	Are we the target, on the next migration request?
++ * @migrate_no_linger:	Close sockets as we migrate them
++ * @migrate_exit:	Exit (on source) once migration is complete
+  */
+ struct ctx {
+ 	enum passt_modes mode;
+@@ -318,6 +320,8 @@ struct ctx {
+ 	int device_state_fd;
+ 	int device_state_result;
+ 	bool migrate_target;
++	bool migrate_no_linger;
++	bool migrate_exit;
+ };
+ 
+ void proto_update_l2_buf(const unsigned char *eth_d,
+diff --git a/tcp.c b/tcp.c
+index 0ac298a..1b22f70 100644
+--- a/tcp.c
++++ b/tcp.c
+@@ -3284,12 +3284,14 @@ int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn)
+ 
+ /**
+  * tcp_flow_migrate_source_ext() - Dump queues, close sockets, send final data
++ * @c:		Execution context
+  * @fd:		Descriptor for state migration
+  * @conn:	Pointer to the TCP connection structure
+  *
+  * Return: 0 on success, negative (not -EIO) on failure, -EIO on sending failure
+  */
+-int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn)
++int tcp_flow_migrate_source_ext(const struct ctx *c,
++				int fd, const struct tcp_tap_conn *conn)
+ {
+ 	uint32_t peek_offset = conn->seq_to_tap - conn->seq_ack_from_tap;
+ 	struct tcp_tap_transfer_ext *t = &migrate_ext[FLOW_IDX(conn)];
+@@ -3334,7 +3336,10 @@ int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn)
+ 	if ((rc = tcp_flow_dump_seq(conn, &t->seq_rcv)))
+ 		goto fail;
+ 
+-	close(s);
++	if (c->migrate_no_linger)
++		close(s);
++	else
++		epoll_del(c, s);
+ 
+ 	/* Adjustments unrelated to FIN segments: sequence numbers we dumped are
+ 	 * based on the end of the queues.
+diff --git a/tcp_conn.h b/tcp_conn.h
+index 35d813d..38b5c54 100644
+--- a/tcp_conn.h
++++ b/tcp_conn.h
+@@ -236,7 +236,8 @@ int tcp_flow_repair_on(struct ctx *c, const struct tcp_tap_conn *conn);
+ int tcp_flow_repair_off(struct ctx *c, const struct tcp_tap_conn *conn);
+ 
+ int tcp_flow_migrate_source(int fd, struct tcp_tap_conn *conn);
+-int tcp_flow_migrate_source_ext(int fd, const struct tcp_tap_conn *conn);
++int tcp_flow_migrate_source_ext(const struct ctx *c, int fd,
++				const struct tcp_tap_conn *conn);
+ 
+ int tcp_flow_migrate_target(struct ctx *c, int fd);
+ int tcp_flow_migrate_target_ext(struct ctx *c, struct tcp_tap_conn *conn, int fd);
+diff --git a/test/lib/setup b/test/lib/setup
+index 575bc21..5994598 100755
+--- a/test/lib/setup
++++ b/test/lib/setup
+@@ -350,7 +350,7 @@ setup_migrate() {
+ 
+ 	sleep 1
+ 
+-	__opts="--vhost-user"
++	__opts="--vhost-user --migrate-exit --migrate-no-linger"
+ 	[ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_1.pcap"
+ 	[ ${DEBUG} -eq 1 ] && __opts="${__opts} -d"
+ 	[ ${TRACE} -eq 1 ] && __opts="${__opts} --trace"
+@@ -360,7 +360,7 @@ setup_migrate() {
+ 
+ 	context_run_bg passt_repair_1 "./passt-repair ${STATESETUP}/passt_1.socket.repair"
+ 
+-	__opts="--vhost-user"
++	__opts="--vhost-user --migrate-exit --migrate-no-linger"
+ 	[ ${PCAP} -eq 1 ] && __opts="${__opts} -p ${LOGDIR}/passt_2.pcap"
+ 	[ ${DEBUG} -eq 1 ] && __opts="${__opts} -d"
+ 	[ ${TRACE} -eq 1 ] && __opts="${__opts} --trace"
+diff --git a/vhost_user.c b/vhost_user.c
+index 105f77a..c4d3a52 100644
+--- a/vhost_user.c
++++ b/vhost_user.c
+@@ -1208,7 +1208,12 @@ void vu_control_handler(struct vu_dev *vdev, int fd, uint32_t events)
+ 	if (msg.hdr.request == VHOST_USER_CHECK_DEVICE_STATE &&
+ 	    vdev->context->device_state_result == 0 &&
+ 	    !vdev->context->migrate_target) {
+-		info("Migration complete, exiting");
+-		_exit(EXIT_SUCCESS);
++		if (vdev->context->migrate_exit) {
++			info("Migration complete, exiting");
++			_exit(EXIT_SUCCESS);
++		}
++
++		info("Migration complete");
++		vdev->context->one_off = false;
+ 	}
+ }
+-- 
+2.47.1
+

0002-tcp-Cast-operands-of-sequence-comparison-macros-to-u.patch

@@ -0,0 +1,48 @@
+From bd90a820852ff8966aeb83231c29e48849db3493 Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Fri, 29 Aug 2025 22:11:31 +0200
+Subject: [PATCH 2/3] tcp: Cast operands of sequence comparison macros to
+ uint32_t before using them
+
+Otherwise, passing signed types causes automatic promotion of the
+result of the subtractions as well, which is not what we want, as
+these macros rely on unsigned 32-bit arithmetic.
+
+The next patch introduces a ssize_t operand for SEQ_LE, illustrating
+the issue.
+
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Tested-by: Paul Holzinger <pholzing@redhat.com>
+Reviewed-by: Jon Maloy <jmaloy@redhat.com>
+(cherry picked from commit 660cd6907e14a41ad9bc77d317140c70ab416fce)
+---
+ tcp_internal.h | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tcp_internal.h b/tcp_internal.h
+index 36c6533..c80ba40 100644
+--- a/tcp_internal.h
++++ b/tcp_internal.h
+@@ -18,10 +18,14 @@
+ 						   sizeof(struct ipv6hdr), \
+ 						   sizeof(uint32_t))
+ 
+-#define SEQ_LE(a, b)			((b) - (a) < MAX_WINDOW)
+-#define SEQ_LT(a, b)			((b) - (a) - 1 < MAX_WINDOW)
+-#define SEQ_GE(a, b)			((a) - (b) < MAX_WINDOW)
+-#define SEQ_GT(a, b)			((a) - (b) - 1 < MAX_WINDOW)
++#define SEQ_LE(a, b)			\
++	((uint32_t)(b) - (uint32_t)(a) < MAX_WINDOW)
++#define SEQ_LT(a, b)			\
++	((uint32_t)(b) - (uint32_t)(a) - 1 < MAX_WINDOW)
++#define SEQ_GE(a, b)			\
++	((uint32_t)(a) - (uint32_t)(b) < MAX_WINDOW)
++#define SEQ_GT(a, b)			\
++	((uint32_t)(a) - (uint32_t)(b) - 1 < MAX_WINDOW)
+ 
+ #define FIN		(1 << 0)
+ #define SYN		(1 << 1)
+-- 
+2.47.1
+

0003-tcp-Don-t-consider-FIN-flags-with-mismatching-sequen.patch

@@ -0,0 +1,76 @@
+From f9278aab878ef58cf8502ea8f904dbb40fbbb16a Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Thu, 2 Oct 2025 00:41:54 +0200
+Subject: [PATCH 3/3] tcp: Don't consider FIN flags with mismatching sequence
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If a guest or container sends us a FIN segment but its sequence number
+doesn't match the highest sequence of data we *accepted* (not
+necessarily the highest sequence we received), that is,
+conn->seq_from_tap, plus any data we're accepting in the current
+batch, we should discard the flag (not necessarily the segment),
+because there's still data we need to receive (again) before the end
+of the stream.
+
+If we consider those FIN flags as such, we'll end up in the
+situation described below.
+
+Here, 192.168.10.102 is a HTTP server in a Podman container, and
+192.168.10.44 is a client fetching approximately 121 KB of data from
+it:
+
+   82   2.026811 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [FIN, ACK] Seq=121441 Ack=143 Win=65536 Len=0
+
+the server is done sending
+
+   83   2.026898 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [ACK] Seq=143 Ack=114394 Win=216192 Len=0
+
+pasta (client) acknowledges a previous sequence, because of
+a short sendmsg()
+
+   84   2.027324 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [FIN, ACK] Seq=143 Ack=114394 Win=216192 Len=0
+
+pasta (client) sends FIN, ACK as the client has no more data to
+send (a single GET request), while still acknowledging a previous
+sequence, because the retransmission didn't happen yet
+
+   85   2.027349 192.168.10.102 → 192.168.10.44 54 TCP 55414 → 44992 [ACK] Seq=121442 Ack=144 Win=65536 Len=0
+
+the server acknowledges the FIN, ACK
+
+   86   2.224125 192.168.10.102 → 192.168.10.44 4150 TCP [TCP Retransmission] 55414 → 44992 [ACK] Seq=114394 Ack=144 Win=65536 Len=4096 [TCP segment of a reassembled PDU]
+
+and finally a retransmission comes, but as we wrongly switched to
+the CLOSE-WAIT state,
+
+   87   2.224202 192.168.10.44 → 192.168.10.102 54 TCP 44992 → 55414 [RST] Seq=144 Win=0 Len=0
+
+we consider frame #86 as an acknowledgement for the FIN segment we
+sent, and close the connection, while we still had to re-receive
+(and finally send) the missing data segment, instead.
+
+Link: https://github.com/containers/podman/issues/27179
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+(cherry picked from commit b145441913eef6f8885b6b84531e944ff593790c)
+---
+ tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tcp.c b/tcp.c
+index 0ac298a..4428305 100644
+--- a/tcp.c
++++ b/tcp.c
+@@ -1696,7 +1696,7 @@ static int tcp_data_from_tap(const struct ctx *c, struct tcp_tap_conn *conn,
+ 			}
+ 		}
+ 
+-		if (th->fin)
++		if (th->fin && seq == seq_from_tap)
+ 			fin = 1;
+ 
+ 		if (!len)
+-- 
+2.47.1
+

SOURCES/0001-selinux-Drop-user_namespace-create-allow-rules.patch

@@ -1,51 +0,0 @@
-From 6977619743bbc602a865f79562b59a80921d6063 Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Mon, 21 Aug 2023 17:52:28 +0200
-Subject: [PATCH] selinux: Drop user_namespace create allow rules
-
-Those are incompatible with current el9 kernels. I introduced them
-upstream with commit 62059058cf24 ("selinux: Fix user namespace
-creation after breaking kernel change"), in turn as a result of
-kernel commit ed5d44d42c95 ("selinux: Implement userns_create hook"),
-but on current el9 kernels (which lack the hook) they result in
-failures such as:
-
-  Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/passt/cil:103
-  Failed to resolve AST
-  /usr/sbin/semodule:  Failed!
-  Failed to resolve allow statement at /var/lib/selinux/targeted/tmp/modules/200/pasta/cil:104
-  Failed to resolve AST
-  /usr/sbin/semodule:  Failed!
-
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
----
- contrib/selinux/passt.te | 1 -
- contrib/selinux/pasta.te | 1 -
- 2 files changed, 2 deletions(-)
-
-diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
-index c6cea34..131fadc 100644
---- a/contrib/selinux/passt.te
-+++ b/contrib/selinux/passt.te
-@@ -92,7 +92,6 @@ allow syslogd_t self:cap_userns sys_ptrace;
- allow passt_t self:process setcap;
- allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid};
- allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
--allow passt_t self:user_namespace create;
- 
- auth_read_passwd(passt_t)
- 
-diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
-index 69be081..892edae 100644
---- a/contrib/selinux/pasta.te
-+++ b/contrib/selinux/pasta.te
-@@ -110,7 +110,6 @@ init_daemon_domain(pasta_t, pasta_exec_t)
- 
- allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid };
- allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service };
--allow pasta_t self:user_namespace create;
- 
- auth_read_passwd(pasta_t)
- 
--- 
-2.39.2

passt.spec

@@ -7,19 +7,21 @@
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
-%global git_hash a1e48a02ff3550eb7875a7df6726086e9b3a1213
+%global git_hash 8ec134109eb136432a29bdf5a14f8b1fd4e46208
 %global selinuxtype targeted
 
 Name:		passt
-Version:	0^20250217.ga1e48a0
-Release:	1%{?dist}
+Version:	0^20250512.g8ec1341
+Release:	4%{?dist}
 Summary:	User-mode networking daemons for virtual machines and namespaces
 License:	GPL-2.0-or-later AND BSD-3-Clause
 Group:		System Environment/Daemons
 URL:		https://passt.top/
 Source:		https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
 
-Patch1:		0001-selinux-Drop-user_namespace-create-allow-rules.patch
+Patch1:		0001-treewide-By-default-don-t-quit-source-after-migratio.patch
+Patch2:		0002-tcp-Cast-operands-of-sequence-comparison-macros-to-u.patch
+Patch3:		0003-tcp-Don-t-consider-FIN-flags-with-mismatching-sequen.patch
 
 BuildRequires:	gcc, make, git, checkpolicy, selinux-policy-devel
 Requires:	(%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
@@ -132,92 +134,144 @@ fi
 %{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp
 
 %changelog
+* Thu Oct 23 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-4
+- Resolves: RHEL-123415 RHEL-123424
+
+* Tue Jul 29 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-2
+- Resolves: RHEL-106425
+
+* Tue May 13 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-1
+- Resolves: RHEL-84285
+
+* Thu Mar 20 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250320.g32f6212-1
+- Resolves: RHEL-84285
+
 * Mon Feb 17 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250217.ga1e48a0-1
-- Resolves: RHEL-79787
+- Resolves: RHEL-79788
 
 * Wed Jan 22 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250121.g4f2c8e7-3
-- Resolves: RHEL-75654
+- Resolves: RHEL-75657
 
 * Tue Jan 21 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250121.g4f2c8e7-1
-- Resolves: RHEL-75654
+- Resolves: RHEL-75657
 
 * Thu Nov 21 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20241121.g238c69f-1
-- Resolves: RHEL-65502
+- Resolves: RHEL-67556
+
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0^20240806.gee36266-3
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
 
 * Wed Aug 14 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240806-gee36266-2
-- Resolves: RHEL-54268
+- Resolves: RHEL-54269
 
 * Wed Aug  7 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240806.gee36266-1
-- Resolves: RHEL-53189
+- Resolves: RHEL-53190
 
 * Fri Aug  2 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240726.g57a21d2-1
-- Resolves: RHEL-52638
+- Resolves: RHEL-52639
 
 * Mon Jun 24 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240624.g1ee2eca-1
-- Resolves: RHEL-44837
+- Resolves: RHEL-44838
+
+* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 0^20240523.g765eb0b-2
+- Bump release for June 2024 mass rebuild
+
+* Thu May 23 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240523.g765eb0b-1
+- Resolves: RHEL-36045
 
 * Wed May 22 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240510.g7288448-1
 - Resolves: RHEL-37647
 
-* Fri Dec 15 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231204.gb86afe3-1
-- Resolves: RHEL-19590
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0^20231230.gf091893-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
-* Tue Aug 22 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-4
-- Switch to copies instead of links for pasta: previous workaround unreliable
-- Resolves: RHELPLAN-155811
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 0^20231230.gf091893-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
-* Tue Aug 22 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-3
-- Explicit restorecon in scriptlet as rpm(8) mix up contexts with hard links
-- Resolves: RHELPLAN-155811
+* Sat Dec 30 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231230.gf091893-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_12_04.b86afe3..2023_12_30.f091893
 
-* Mon Aug 21 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-2
-- Drop user_namespace create allow rule, incompatible with current el9 kernel
-- Resolves: RHELPLAN-155811
+* Mon Dec  4 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231204.gb86afe3-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_11_19.4f1709d..2023_12_04.b86afe3
 
-* Sat Aug 19 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-1
-- Rebase from Fedora 39
-- Resolves: RHELPLAN-155811
+* Sun Nov 19 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231119.g4f1709d-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_11_10.5ec3634..2023_11_19.4f1709d
 
-* Sun Jun 11 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230222.g4ddbcb9-4
-- Drop (pointless) patches 20, 21, 22, actually apply changes to the spec file!
-- Refresh SELinux labels in scriptlets, require -selinux package (rhbz#2183089)
-- Don't install useless SELinux interface file for pasta (rhbz#2183106)
+* Fri Nov 10 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231110.g5ec3634-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_11_07.74e6f48..2023_11_10.5ec3634
 
-* Fri Apr 28 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230222.g4ddbcb9-3
-- Refresh SELinux labels in scriptlets, require -selinux package (rhbz#2183089)
-- Don't install useless SELinux interface file for pasta (rhbz#2183106)
+* Tue Nov  7 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231107.g56d9f6d-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_10_04.f851084..2023_11_07.56d9f6d
+- SELinux: allow passt_t to use unconfined_t UNIX domain sockets for
+  --fd option (https://bugzilla.redhat.com/show_bug.cgi?id=2247221)
 
-* Thu Mar 16 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230222.g4ddbcb9-2
-- udp: Actually use host resolver to forward DNS queries (rhbz#2177075)
-- conf: Split add_dns{4,6}() out of get_dns() (rhbz#2177075)
-- conf, udp: Allow any loopback address to be used as resolver (rhbz#2177075)
-- tcp, tcp_splice: Get rid of false positive CWE-394 Coverity warning from fls() (rhbz#2177084)
-- tcp: Avoid false (but convoluted) positive Coverity CWE-476 warning (rhbz#2177084)
-- tcp: Avoid (theoretical) resource leak (CWE-772) Coverity warning (rhbz#2177084)
-- Fix definitions of SOCKET_MAX, TCP_MAX_CONNS (rhbz#2177084)
-- doc/demo: Fix and suppress ShellCheck warnings (rhbz#2177084)
-- contrib/selinux: Drop duplicate init_daemon_domain() rule (rhbz#2176813)
-- contrib/selinux: Let passt write to stdout and stderr when it starts (rhbz#2176813)
-- contrib/selinux: Allow binding and connecting to all UDP and TCP ports (rhbz#2176813)
-- contrib/selinux: Let interface users set paths for log, PID, socket files (rhbz#2176813)
-- contrib/selinux: Drop "example" from headers: this is the actual policy (rhbz#2176813)
-- contrib/selinux: Drop unused passt_read_data() interface (rhbz#2176813)
-- contrib/selinux: Split interfaces into smaller bits (rhbz#2176813)
-- fedora: Install SELinux interface files to shared include directory (rhbz#2176813)
-- tcp, udp, util: Pass socket creation errors all the way up (rhbz#2177080)
-- tcp, udp: Fix partial success return codes in {tcp,udp}_sock_init() (rhbz#2177080)
-- conf: Terminate on EMFILE or ENFILE on sockets for port mapping (rhbz#2177080)
-- tcp: Clamp MSS value when queueing data to tap, also for pasta (rhbz#2177083)
-- Fix up SELinux labels on install/uninstall, require matching -selinux package (rhbz#2176813)
-- Resolves: rhbz#2177075 rhbz#2177084 rhbz#2177080 rhbz#2177083 rhbz#2176813
+* Wed Oct  4 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231004.gf851084-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_09_08.05627dc..2023_10_04.f851084
 
-* Wed Feb 22 2023 Camilla Conte <cconte@redhat.com> - 0^20230222.g4ddbcb9-1
-- Import from fedora to CentOS/RHEL
-- Resolves: rhbz#2172244
+* Fri Sep  8 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230908.g05627dc-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_09_07.ee58f37..2023_09_08.05627dc
 
-* Wed Nov 16 2022 Miroslav Rezanina <mrezanin@redhat.com> - 0^20221110.g4129764-1
-- Import from fedora to CentOS/RHEL
-- Resolves: rhbz#2131015
+* Thu Sep  7 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230907.gee58f37-1
+- Replace pasta hard links by separate builds
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_08_23.a7e4bfb..2023_09_07.ee58f37
+
+* Wed Aug 23 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230823.ga7e4bfb-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_08_18.0af928e..2023_08_23.a7e4bfb
+
+* Fri Aug 18 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230818.g0af928e-1
+- Install pasta as hard link to ensure SELinux file context match
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_06_27.289301b..2023_08_18.0af928e
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0^20230627.g289301b-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jun 27 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230627.g289301b-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_06_25.32660ce..2023_06_27.289301b
+
+* Sun Jun 25 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230625.g32660ce-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_06_03.429e1a7..2023_06_25.32660ce
+
+* Sat Jun  3 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230603.g429e1a7-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_05_09.96f8d55..2023_06_03.429e1a7
+
+* Tue May  9 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230509.g96f8d55-1
+- Relicense to GPL 2.0, or any later version
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_29.b10b983..2023_05_09.96f8d55
+
+* Wed Mar 29 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230329.gb10b983-1
+- Adjust path for SELinux policy and interface file to latest guidelines
+- Don't install useless SELinux interface file for pasta
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_21.1ee2f7c..2023_03_29.b10b983
+
+* Tue Mar 21 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230321.g1ee2f7c-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_17.dd23496..2023_03_21.1ee2f7c
+
+* Fri Mar 17 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230317.gdd23496-1
+- Refresh SELinux labels in scriptlets, require -selinux package
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_10.70c0765..2023_03_17.dd23496
+
+* Fri Mar 10 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230310.g70c0765-1
+- Install SELinux interface files to shared include directory
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_03_09.7c7625d..2023_03_10.70c0765
+
+* Thu Mar  9 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230309.g7c7625d-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_02_27.c538ee8..2023_03_09.7c7625d
+
+* Mon Feb 27 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230227.gc538ee8-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_02_22.4ddbcb9..2023_02_27.c538ee8
+
+* Wed Feb 22 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230222.g4ddbcb9-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2023_02_16.4663ccc..2023_02_22.4ddbcb9
+
+* Thu Feb 16 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20230216.g4663ccc-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_16.ace074c..2023_02_16.4663ccc
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 0^20221116.gace074c-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Nov 16 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221116.gace074c-1
+- Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_10.4129764..2022_11_16.ace074c
 
 * Thu Nov 10 2022 Stefano Brivio <sbrivio@redhat.com> - 0^20221110.g4129764-1
 - Upstream changes: https://passt.top/passt/log/?qt=range&q=2022_11_04.e308018..2022_11_10.4129764

sources

@@ -0,0 +1 @@
+SHA512 (passt-8ec134109eb136432a29bdf5a14f8b1fd4e46208.tar.xz) = 3a63f3f62aae06ae0da2293808223f539bca1a030131c50499d5de2daa96faf887fd486b6aa71d627b5ede6de6f5310876150983a3e77fbaf9926e69af56bdab