.gitignore

@@ -1 +1,5 @@
-SOURCES/passt-d04c48032bcf724550d0b8f652fd00efcd2dfad0.tar.xz
+/passt-4129764ecaebf05a33e22d8d95bb3d8deaa14c14.tar.xz
+/passt-4663ccc89a7fcbf9d901a80730ee925fc7f64c59.tar.xz
+/passt-4ddbcb9c0c555838b123c018a9ebc9b7e14a87e5.tar.xz
+/passt-0af928eaa020c1062fdc91598dfdc533966e2afe.tar.xz
+/passt-b86afe3559c0bd3d24bc6fed7c60466cf141224c.tar.xz

.passt.metadata

@@ -1 +0,0 @@
-ec2fcde158b88b1ed9786565025380d03aa32d56 SOURCES/passt-d04c48032bcf724550d0b8f652fd00efcd2dfad0.tar.xz

0001-selinux-Drop-user_namespace-create-allow-rules.patch

@@ -1,6 +1,6 @@
-From 7087adfbab35354f9def7edee87385b82416c722 Mon Sep 17 00:00:00 2001
+From 6977619743bbc602a865f79562b59a80921d6063 Mon Sep 17 00:00:00 2001
 From: Stefano Brivio <sbrivio@redhat.com>
-Date: Mon, 8 Dec 2025 22:32:50 -0500
+Date: Mon, 21 Aug 2023 17:52:28 +0200
 Subject: [PATCH] selinux: Drop user_namespace create allow rules
 
 Those are incompatible with current el9 kernels. I introduced them
@@ -24,29 +24,29 @@ Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
  2 files changed, 2 deletions(-)
 
 diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
-index 6995df8..76d23e8 100644
+index facc2d1..de10f45 100644
 --- a/contrib/selinux/passt.te
 +++ b/contrib/selinux/passt.te
-@@ -105,7 +105,6 @@ allow syslogd_t self:cap_userns sys_ptrace;
+@@ -93,7 +93,6 @@ allow syslogd_t self:cap_userns sys_ptrace;
  allow passt_t self:process setcap;
  allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid};
  allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
 -allow passt_t self:user_namespace create;
  
- auth_read_passwd(passt_t)
- 
+ allow passt_t passwd_file_t:file read_file_perms;
+ sssd_search_lib(passt_t)
 diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
-index 95fe42a..7e1e821 100644
+index ed70c5f..3226e37 100644
 --- a/contrib/selinux/pasta.te
 +++ b/contrib/selinux/pasta.te
-@@ -126,7 +126,6 @@ allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_
- # pasta only calls setuid and setgid with the current UID and GID, so this
- # denial is harmless. See https://bugzilla.redhat.com/show_bug.cgi?id=2330512#c10
- dontaudit pasta_t self:cap_userns { setgid setuid };
+@@ -113,7 +113,6 @@ init_daemon_domain(pasta_t, pasta_exec_t)
+ 
+ allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid };
+ allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service };
 -allow pasta_t self:user_namespace create;
  
- auth_read_passwd(pasta_t)
- 
+ allow pasta_t passwd_file_t:file read_file_perms;
+ sssd_search_lib(pasta_t)
 -- 
-2.47.1
+2.39.2
 

SOURCES/0002-selinux-Use-systemd_logind_exec_t-instead-of-systemd.patch

@@ -1,41 +0,0 @@
-From 2244df26b2cb63acb51a20485e1ca7ad0649b152 Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Mon, 22 Dec 2025 21:48:32 -0500
-Subject: [PATCH] selinux: Use systemd_logind_exec_t instead of
- systemd_user_runtimedir_exec_t
-
-On CentOS Stream 9, selinux-policy doesn't contain commit
-700b3622d575 ("Confine /usr/lib/systemd/systemd-user-runtime-dir"),
-so the file context of /usr/lib/systemd/systemd-user-runtime-dir is
-still systemd_logind_exec_t there.
-
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
----
- contrib/selinux/pasta.te | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
-index 7e1e821..d29d6c4 100644
---- a/contrib/selinux/pasta.te
-+++ b/contrib/selinux/pasta.te
-@@ -98,7 +98,7 @@ require {
- 	type container_runtime_t;
- 	type container_var_run_t;
- 	type container_t;
--	type systemd_user_runtimedir_t;
-+	type systemd_logind_exec_t;
- }
- 
- type pasta_t;
-@@ -250,7 +250,7 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootles
- type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns";
- allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write };
- allow pasta_t ifconfig_var_run_t:file { create open write };
--allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir;
-+allow systemd_logind_exec_t ifconfig_var_run_t:dir rmdir;
- 
- # Allow pasta to bind to any port
- bool pasta_bind_all_ports true;
--- 
-2.47.1
-

SOURCES/0003-tcp-Use-less-than-MSS-window-on-no-queued-data-or-no.patch

@@ -1,110 +0,0 @@
-From b40f5cd8c8e16c6eceb1f26eb895527fda84068b Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Sat, 13 Dec 2025 14:19:13 +0100
-Subject: [PATCH] tcp: Use less-than-MSS window on no queued data, or no data
- sent recently
-
-We limit the advertised window to guests and containers to the
-available length of the sending buffer, and if it's less than the MSS,
-since commit cf1925fb7b77 ("tcp: Don't limit window to less-than-MSS
-values, use zero instead"), we approximate that limit to zero.
-
-This way, we'll trigger a window update as soon as we realise that we
-can advertise a larger value, just like we do in all other cases where
-we advertise a zero-sized window.
-
-By doing that, we don't wait for the peer to send us data before we
-update the window. This matters because the guest or container might
-be trying to aggregate more data and won't send us anything at all if
-the advertised window is too small.
-
-However, this might be problematic in two situations:
-
-1. one, reported by Tyler, where the remote (receiving) peer
-   advertises a window that's smaller than what we usually get and
-   very close to the MSS, causing the kernel to give us a starting
-   size of the buffer that's less than the MSS we advertise to the
-   guest or container.
-
-   If this happens, we'll never advertise a non-zero window after
-   the handshake, and the container or guest will never send us any
-   data at all.
-
-   With a simple 'curl https://cloudflare.com/', we get, with default
-   TCP memory parameters, a 65535-byte window from the peer, and 46080
-   bytes of initial sending buffer from the kernel. But we advertised
-   a 65480-byte MSS, and we'll never actually receive the client
-   request.
-
-   This seems to be specific to Cloudflare for some reason, probably
-   deriving from a particular tuning of TCP parameters on their
-   servers.
-
-2. another one, hypothesised by David, where the peer might only be
-   willing to process (and acknowledge) data in batches.
-
-   We might have queued outbound data which is, at the same time, not
-   enough to fill one of these batches and be acknowledged and removed
-   from the sending queue, but enough to make our available buffer
-   smaller than the MSS, and the connection will hang.
-
-Take care of both cases by:
-
-a. not approximating the sending buffer to zero if we have no outboud
-   queued data at all, because in that case we don't expect the
-   available buffer to increase if we don't send any data, so there's
-   no point in waiting for it to grow larger than the MSS.
-
-   This fixes problem 1. above.
-
-b. also using the full sending buffer size if we haven't send data to
-   the socket for a while (reported by tcpi_last_data_sent). This part
-   was already suggested by David in:
-
-     https://archives.passt.top/passt-dev/aTZzgtcKWLb28zrf@zatzit/
-
-   and I'm now picking ten times the RTT as a somewhat arbitrary
-   threshold.
-
-   This is meant to take care of potential problem 2. above, but it
-   also happens to fix 1.
-
-Reported-by: Tyler Cloud <tcloud@redhat.com>
-Link: https://bugs.passt.top/show_bug.cgi?id=183
-Suggested-by: David Gibson <david@gibson.dropbear.id.au>
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
----
- tcp.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/tcp.c b/tcp.c
-index 81bc114..b179e39 100644
---- a/tcp.c
-+++ b/tcp.c
-@@ -1211,8 +1211,21 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn,
- 		 * the MSS to zero, as we already have mechanisms in place to
- 		 * force updates after the window becomes zero. This matches the
- 		 * suggestion from RFC 813, Section 4.
-+		 *
-+		 * But don't do this if, either:
-+		 *
-+		 * - there's nothing in the outbound queue: the size of the
-+		 *   sending buffer is limiting us, and it won't increase if we
-+		 *   don't send data, so there's no point in waiting, or
-+		 *
-+		 * - we haven't sent data in a while (somewhat arbitrarily, ten
-+		 *   times the RTT), as that might indicate that the receiver
-+		 *   will only process data in batches that are large enough,
-+		 *   but we won't send enough to fill one because we're stuck
-+		 *   with pending data in the outbound queue
- 		 */
--		if (limit < MSS_GET(conn))
-+		if (limit < MSS_GET(conn) && sendq &&
-+		    tinfo->tcpi_last_data_sent < tinfo->tcpi_rtt / 1000 * 10)
- 			limit = 0;
- 
- 		new_wnd_to_tap = MIN((int)tinfo->tcpi_snd_wnd, limit);
--- 
-2.47.1
-

SOURCES/0004-pasta-Warn-disable-matching-IP-version-if-not-suppor.patch

@@ -1,90 +0,0 @@
-From 75dcbc300bf09c3649823b12d30c4f24de7271d4 Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Tue, 23 Dec 2025 13:39:17 +0100
-Subject: [PATCH] pasta: Warn, disable matching IP version if not supported, in
- local mode
-
-...instead of exiting, but only if local mode is enabled, that is, if
-we couldn't find a template interface or if the user didn't specify
-one.
-
-With IPv4, we always try to set or copy an address, so check if that
-fails.
-
-With IPv6, in local mode, we rely on the link-local address that's
-automatically generated inside the target namespace, and only fail
-later, as we try to set up routes. Check if that fails, instead.
-
-Otherwise, we'll fail to start if IPv6 support is not built in or
-disabled by the kernel ("ipv6.disable=1" on the command line),
-because, in that case, we'll try to enable local mode by default, and
-then fail to set any address or route.
-
-It would probably be more elegant to check for IP version support in
-conf_ip4_local() and conf_ip6_local(), and not even try to enable
-connectivity for unsupported versions, but it looks less robust than
-trying and failing, as there might be other ways to disable a given
-IP version.
-
-Note that there's currently no way to disable IPv4 support on the
-kernel command line, that is, there's no such thing as an
-ipv4.disable boot parameter. But I guess that's due to be eventually
-implemented, one day, so let's cover that case as well, also for
-consistency.
-
-Reported-by: Iyan <iyanmv@gmail.com>
-Link: https://bugzilla.redhat.com/show_bug.cgi?id=2424192
-Fixes: 4ddd59bc6085 ("conf: Separate local mode for each IP version, don't enable disabled IP version")
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
----
- pasta.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/pasta.c b/pasta.c
-index c307b8a..0ddd6b0 100644
---- a/pasta.c
-+++ b/pasta.c
-@@ -348,6 +348,12 @@ void pasta_ns_conf(struct ctx *c)
- 						 AF_INET);
- 			}
- 
-+			if (c->ifi4 == -1 && rc == -ENOTSUP) {
-+				warn("IPv4 not supported, disabling");
-+				c->ifi4 = 0;
-+				goto ipv4_done;
-+			}
-+
- 			if (rc < 0) {
- 				die("Couldn't set IPv4 address(es) in namespace: %s",
- 				    strerror_(-rc));
-@@ -367,6 +373,7 @@ void pasta_ns_conf(struct ctx *c)
- 				    strerror_(-rc));
- 			}
- 		}
-+ipv4_done:
- 
- 		if (c->ifi6) {
- 			rc = nl_addr_get_ll(nl_sock_ns, c->pasta_ifi,
-@@ -413,12 +420,19 @@ void pasta_ns_conf(struct ctx *c)
- 						  AF_INET6);
- 			}
- 
-+			if (c->ifi6 == -1 && rc == -ENOTSUP) {
-+				warn("IPv6 not supported, disabling");
-+				c->ifi6 = 0;
-+				goto ipv6_done;
-+			}
-+
- 			if (rc < 0) {
- 				die("Couldn't set IPv6 route(s) in guest: %s",
- 				    strerror_(-rc));
- 			}
- 		}
- 	}
-+ipv6_done:
- 
- 	proto_update_l2_buf(c->guest_mac);
- }
--- 
-2.47.1
-

SOURCES/0005-selinux-Enable-read-and-watch-permissions-on-netns-d.patch

@@ -1,58 +0,0 @@
-From d2c5133990a7758bfa567fc73216393498949e9b Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Tue, 23 Dec 2025 01:59:34 +0100
-Subject: [PATCH] selinux: Enable read and watch permissions on netns directory
- as well
-
-With commit 7aeda16a7818 ("selinux: Transition to pasta_t in
-containers"), we need to make sure that pasta can access the target
-namespace directory passed by Podman, and, in a general case, we have
-all the permissions we need.
-
-But if we now start a container without the Podman changes referenced
-by commit fd1bcc30af07 ("selinux: add container_var_run_t type
-transition"), or with them, but with the container being created
-before those and without a reboot in between, we'll additionally need
-'read' and 'watch' permissions on user_tmp_t directory as well, as
-user_tmp_t is still the (inconsistent) context of the namespace entry.
-
-Otherwise, on a container start/restart, we'll get SELinux denials:
-
-  type=AVC msg=audit(1766451401.296:184): avc:  denied  { read } for  pid=2159 comm="pasta.avx2" name="netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:obje
-ct_r:user_tmp_t:s0 tclass=dir permissive=1
-  type=AVC msg=audit(1766451401.298:185): avc:  denied  { watch } for  pid=2159 comm="pasta.avx2" path="/run/user/1001/netns" dev="tmpfs" ino=60 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1
-
-This can be reproduced quite simply:
-
-  $ podman create -q --name hello hello
-  6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770
-
-  [upgrade passt's SELinux policy to a version including 7aeda16a7818]
-
-  $ podman start hello
-  Error: unable to start container "6c4eaf15a03edf799673a97d84d0331f3a3f34a11015b58c69318101a3232770": pasta failed with exit code 1:
-  netns dir open: Permission denied, exiting
-
-Reported-by: Tuomo Soini <tis@foobar.fi>
-Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers")
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
----
- contrib/selinux/pasta.te | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
-index 95fe42a..3eb58f6 100644
---- a/contrib/selinux/pasta.te
-+++ b/contrib/selinux/pasta.te
-@@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton;
- manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t)
- files_pid_filetrans(pasta_t, pasta_pid_t, file)
- 
--allow pasta_t user_tmp_t:dir { add_name remove_name search write };
-+allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write };
- allow pasta_t user_tmp_t:fifo_file append;
- allow pasta_t user_tmp_t:file { create open write };
- allow pasta_t user_tmp_t:sock_file { create unlink };
--- 
-2.47.1
-

SOURCES/0006-selinux-Enable-open-permissions-on-netns-directory-o.patch

@@ -1,68 +0,0 @@
-From 6babaa8a88eb337e4b81aeff673fcebb28015f36 Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Fri, 16 Jan 2026 16:48:46 +0100
-Subject: [PATCH 6/7] selinux: Enable open permissions on netns directory,
- operations on container_var_run_t
-
-Tuomo reports two further SELinux denials after upgrading to a
-passt-selinux version that includes the transition to pasta_t for
-containers, one I could reproduce:
-
-  denied  { open } for  pid=3343050 comm="pasta.avx2" path="/run/user/1000/netns" dev="tmpfs" ino=51 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1
-
-which I didn't take care of in the previous commit, d2c5133990a7
-("selinux: Enable read and watch permissions on netns directory as
-well"), as it didn't appear in my quick test. But I can make pasta use
-"open" on the network namespace entry by simply using it to make
-connections.
-
-So, for that, add "open" to the existing rule for user_tmp_t:dir.
-
-Then, another one I couldn't reproduce instead:
-
-  denied  { write } for  pid=3589324 comm="pasta.avx2" name="rootless-netns" dev="tmpfs" ino=36 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=dir permissive=0
-
-which, I think, comes from a specific combination of versions of
-container-selinux, Podman, and passt-selinux packages, which
-prevents the expected type transition on container_var_run_t unless
-restorecon is invoked manually, or until a reboot.
-
-Allowing the same permissions on container_var_run_t as we do on
-ifconfig_var_run_t is harmless, so do that to prevent this further
-denial.
-
-Reported-by: Tuomo Soini <tis@foobar.fi>
-Fixes: d2c5133990a7 ("selinux: Enable read and watch permissions on netns directory as well")
-Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers")
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-(cherry picked from commit a6d92ca82c9ea0b395aa56c568ee6b6e6d4ac81e)
----
- contrib/selinux/pasta.te | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
-index 22daa77..abeafa4 100644
---- a/contrib/selinux/pasta.te
-+++ b/contrib/selinux/pasta.te
-@@ -148,7 +148,7 @@ allow pasta_t root_t:dir mounton;
- manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t)
- files_pid_filetrans(pasta_t, pasta_pid_t, file)
- 
--allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write };
-+allow pasta_t user_tmp_t:dir { add_name open read remove_name search watch write };
- allow pasta_t user_tmp_t:fifo_file append;
- allow pasta_t user_tmp_t:file { create open write };
- allow pasta_t user_tmp_t:sock_file { create unlink };
-@@ -248,7 +248,9 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns";
- type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns";
- type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns";
- type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns";
-+allow pasta_t container_var_run_t:dir { add_name open rmdir write };
- allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write };
-+allow pasta_t container_var_run_t:file { create open write };
- allow pasta_t ifconfig_var_run_t:file { create open write };
- allow systemd_logind_exec_t ifconfig_var_run_t:dir rmdir;
- 
--- 
-2.47.1
-

SOURCES/0007-tcp-Fix-rounding-issue-in-check-for-approximating-wi.patch

@@ -1,74 +0,0 @@
-From dbfbc33776290260b87bb29bb5572750f9709b35 Mon Sep 17 00:00:00 2001
-From: Stefano Brivio <sbrivio@redhat.com>
-Date: Fri, 9 Jan 2026 13:52:00 +0100
-Subject: [PATCH 7/7] tcp: Fix rounding issue in check for approximating window
- to zero
-
-In general, we approximate the advertised window to zero if we would
-otherwise advertise less than a MSS worth, and the reasoning behind
-that is explained in cf1925fb7b77 ("tcp: Don't limit window to
-less-than-MSS values, use zero instead").
-
-Then, in commit b40f5cd8c8e1 ("tcp: Use less-than-MSS window on no
-queued data, or no data sent recently"), I introduced some conditions
-under which we won't do that, including a check on whether any data
-was sent recently.
-
-As an arbitrary but probably reasonable threshold, we consider data to
-have recently been sent if that occurred less than ten times the
-round-trip time (RTT) ago.
-
-The time elapsed since the last data transmission is reported by the
-kernel in milliseconds, in the tcpi_last_data_sent field of struct
-tcp_info, and the RTT is reported in microseconds instead, in
-tcpi_rtt.
-
-To avoid the risk of overflow in a simple way, for the purpose of this
-comparison, I converted tcpi_rtt to milliseconds first, but this means
-that the check will always be false (and we'll never approximate the
-window to zero) if the RTT is below one millisecond.
-
-This, in turn, reintroduces nasty delay issues in transfers in
-non-local connections which have however almost-local (low) latency.
-
-Given that we want to use ten times the RTT as an arbitrary "long
-enough" upper bound, round the RTT up while converting it to
-milliseconds.
-
-As an alternative, we could perform the comparison in microseconds,
-but we would need a slightly more complicated implementation to
-exclude overflows, and it's definitely not worth it given the nature
-of this threshold.
-
-Fixes: b40f5cd8c8e1 ("tcp: Use less-than-MSS window on no queued data, or no data sent recently")
-Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
-(cherry picked from commit 2be0e790804f99580b1c8a1781c49913440607f2)
----
- tcp.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/tcp.c b/tcp.c
-index 23fcbc3..8f4f087 100644
---- a/tcp.c
-+++ b/tcp.c
-@@ -1180,6 +1180,7 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn,
- 	if ((conn->flags & LOCAL) || tcp_rtt_dst_low(conn)) {
- 		new_wnd_to_tap = tinfo->tcpi_snd_wnd;
- 	} else {
-+		unsigned rtt_ms_ceiling = DIV_ROUND_UP(tinfo->tcpi_rtt, 1000);
- 		uint32_t sendq;
- 		int limit;
- 
-@@ -1223,7 +1224,7 @@ int tcp_update_seqack_wnd(const struct ctx *c, struct tcp_tap_conn *conn,
- 		 *   with pending data in the outbound queue
- 		 */
- 		if (limit < MSS_GET(conn) && sendq &&
--		    tinfo->tcpi_last_data_sent < tinfo->tcpi_rtt / 1000 * 10)
-+		    tinfo->tcpi_last_data_sent < rtt_ms_ceiling * 10)
- 			limit = 0;
- 
- 		new_wnd_to_tap = MIN((int)tinfo->tcpi_snd_wnd, limit);
--- 
-2.47.1
-

gating.yaml

@@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: kvm-ci.passt.x86_64.brew-build.gating.tier1.functional}

passt.spec

@@ -7,26 +7,19 @@
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
 
-%global git_hash d04c48032bcf724550d0b8f652fd00efcd2dfad0
+%global git_hash 4988e2b406313c579836dc31867d793cfe77535c
 %global selinuxtype targeted
-%global selinux_policy_version 41.41
 
 Name:		passt
-Version:	0^20251210.gd04c480
-Release:	3%{?dist}
+Version:	0^20240326.g4988e2b
+Release:	1%{?dist}
 Summary:	User-mode networking daemons for virtual machines and namespaces
-License:	GPL-2.0-or-later AND BSD-3-Clause
+License:	GPLv2+ and BSD
 Group:		System Environment/Daemons
 URL:		https://passt.top/
 Source:		https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz
 
 Patch1:		0001-selinux-Drop-user_namespace-create-allow-rules.patch
-Patch2:		0002-selinux-Use-systemd_logind_exec_t-instead-of-systemd.patch
-Patch3:		0003-tcp-Use-less-than-MSS-window-on-no-queued-data-or-no.patch
-Patch4:		0004-pasta-Warn-disable-matching-IP-version-if-not-suppor.patch
-Patch5:		0005-selinux-Enable-read-and-watch-permissions-on-netns-d.patch
-Patch6:		0006-selinux-Enable-open-permissions-on-netns-directory-o.patch
-Patch7:		0007-tcp-Fix-rounding-issue-in-check-for-approximating-wi.patch
 
 BuildRequires:	gcc, make, git, checkpolicy, selinux-policy-devel
 Requires:	(%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype})
@@ -42,24 +35,18 @@ for network namespaces: traffic is forwarded using a tap interface inside the
 namespace, without the need to create further interfaces on the host, hence not
 requiring any capabilities or privileges.
 
-%package		    selinux
-BuildArch:		    noarch
-Summary:		    SELinux support for passt and pasta
-%if 0%{?fedora} > 43
-BuildRequires:      selinux-policy-devel
-%selinux_requires_min
-%else
-BuildRequires:      pkgconfig(systemd)
-Requires(post):     libselinux-utils
-Requires(post):     policycoreutils
-%endif
-Requires:		    container-selinux
-Requires:		    selinux-policy-%{selinuxtype}
-Requires(post):		container-selinux
-Requires(post):		selinux-policy-%{selinuxtype}
+%package    selinux
+BuildArch:  noarch
+Summary:    SELinux support for passt and pasta
+Requires:   %{name} = %{version}-%{release}
+Requires:   selinux-policy
+Requires(post): %{name}
+Requires(post): policycoreutils
+Requires(preun): %{name}
+Requires(preun): policycoreutils
 
 %description selinux
-This package adds SELinux enforcement to passt(1), pasta(1), passt-repair(1).
+This package adds SELinux enforcement to passt(1) and pasta(1).
 
 %prep
 %autosetup -S git_am -n passt-%{git_hash}
@@ -97,18 +84,19 @@ make -f %{_datadir}/selinux/devel/Makefile
 install -p -m 644 -D passt.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/passt.pp
 install -p -m 644 -D passt.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/passt.if
 install -p -m 644 -D pasta.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp
-install -p -m 644 -D passt-repair.pp %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp
 popd
 
 %pre selinux
 %selinux_relabel_pre -s %{selinuxtype}
 
 %post selinux
-%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp %{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp
 
 %postun selinux
 if [ $1 -eq 0 ]; then
-	%selinux_modules_uninstall -s %{selinuxtype} passt pasta passt-repair
+	%selinux_modules_uninstall -s %{selinuxtype} passt
+	%selinux_modules_uninstall -s %{selinuxtype} pasta
 fi
 
 %posttrans selinux
@@ -122,11 +110,9 @@ fi
 %{_bindir}/passt
 %{_bindir}/pasta
 %{_bindir}/qrap
-%{_bindir}/passt-repair
 %{_mandir}/man1/passt.1*
 %{_mandir}/man1/pasta.1*
 %{_mandir}/man1/qrap.1*
-%{_mandir}/man1/passt-repair.1*
 %ifarch x86_64
 %{_bindir}/passt.avx2
 %{_mandir}/man1/passt.avx2.1*
@@ -138,58 +124,9 @@ fi
 %{_datadir}/selinux/packages/%{selinuxtype}/passt.pp
 %{_datadir}/selinux/devel/include/distributed/passt.if
 %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp
-%{_datadir}/selinux/packages/%{selinuxtype}/passt-repair.pp
 
 %changelog
-* Wed Feb 11 2026 Stefano Brivio <sbrivio@redhat.com> - 0^20251210.gd04c480-3
-- Resolves: RHEL-137588 RHEL-136313
-
-* Wed Dec 24 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20251210.gd04c480-2
-- Resolves: RHEL-136313 RHEL-136461 RHEL-137439 RHEL-137588
-
-* Wed Dec 10 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20251210.gd04c480-1
-- Resolves: RHEL-134942 RHEL-134943
-
-* Tue Dec  9 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20251209.gc3f1ba7-1
-- Resolves: RHEL-134119
-
-* Thu Oct 23 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-3
-- Resolves: RHEL-123376 RHEL-123438
-
-* Tue Jul 29 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-2
-- Resolves: RHEL-106326
-
-* Tue May 13 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250512.g8ec1341-1
-- Resolves: RHEL-84283
-
-* Thu Mar 20 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250320.g32f6212-1
-- Resolves: RHEL-84283
-
-* Mon Feb 17 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250217.ga1e48a0-1
-- Resolves: RHEL-79787
-
-* Wed Jan 22 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250121.g4f2c8e7-3
-- Resolves: RHEL-75654
-
-* Tue Jan 21 2025 Stefano Brivio <sbrivio@redhat.com> - 0^20250121.g4f2c8e7-1
-- Resolves: RHEL-75654
-
-* Thu Nov 21 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20241121.g238c69f-1
-- Resolves: RHEL-65502
-
-* Wed Aug 14 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240806-gee36266-2
-- Resolves: RHEL-54268
-
-* Wed Aug  7 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240806.gee36266-1
-- Resolves: RHEL-53189
-
-* Fri Aug  2 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240726.g57a21d2-1
-- Resolves: RHEL-52638
-
-* Mon Jun 24 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240624.g1ee2eca-1
-- Resolves: RHEL-44837
-
-* Wed May 22 2024 Stefano Brivio <sbrivio@redhat.com> - 0^20240510.g7288448-1
+* Tue May 21 2024 Marcel Haerri <mharri@redhat.com> - 0^20240326.g4988e2b-1
 - Resolves: RHEL-37647
 
 * Fri Dec 15 2023 Stefano Brivio <sbrivio@redhat.com> - 0^20231204.gb86afe3-1

sources

@@ -0,0 +1 @@
+SHA512 (passt-4988e2b406313c579836dc31867d793cfe77535c.tar.xz) = 16ce02c9b9796d0df85364e74fd3bf31715f2345c07140e59be952bfe66abfdff2d0e22939e204c46c671148ce9b22513a200848f26b06854bffdcf6f28c994f