Repository navigation
Tap mode: add -n flag, activate interface on open, fix build/install - #66
Merged
Merged
Conversation
In tap mode, every static `ip` command runs `ifconfig tapX <max-host-id> ... up` on the host (the only system() call in the tree). That side effect conflicts with callers that own the host side of the tap (bridges, addresses, admin state), such as GNS3 anchoring a pre-created persistent tap. - new -n option clears `hostconf` and gates the autoconf block; default behavior is unchanged - fix the autoconf target in single-instance mode: use the -d tap name instead of tap<id>, mirroring open_tap() naming (previously it configured tap0 while the VPC talked to a differently named tap) - Makefile.linux: new install target; grants cap_net_admin+ep via setcap when available, best-effort with a warning since udp mode needs no privileges and setcap may be absent - docs: usage(), `ip ?` help text, INSTALL With -n, vpcs never touches host state; the tap is expected to be created and brought up by the caller. Attaching to a pre-existing persistent tap via TUNSETIFF is unchanged.
- dispatch to the OS-specific src makefile (same mapping as src/mk.sh); 'install' currently exists only in Makefile.linux - export CCOPT=-O2 so a direct make matches mk.sh builds (previously a bare make -f Makefile.linux silently built without -O2) - Makefile.linux: replace the .c.o suffix rule with a pattern rule. GNU make ignores prerequisites on suffix rules (the long-standing warning), so header changes never triggered rebuilds, and the prerequisite list itself was stale (keys.h was renamed to keydef.h long ago). Header dependencies now actually work. - INSTALL: lead with make / sudo make install
globle.h defines its own IFNAMESIZ 12, and open_tap() sized its name buffer with it while the length guard checks the kernel's IFNAMSIZ (16). A -d name longer than 12 chars passed the guard, truncated into the 12-byte buffer, and reached TUNSETIFF as a nonexistent device name — which the kernel then tried to create, needing CAP_NET_ADMIN (EPERM for an unprivileged vpcs). Use the kernel IFNAMSIZ consistently for the buffer and the strncpy.
TUNSETIFF attaches (or creates) the interface but leaves it administratively DOWN, and a down tun fd carries no frames: every outgoing packet failed with "Send packet error". The only thing that brought the interface up was the host auto-configuration's 'ifconfig ... up', so tap mode effectively required root, and even then 'ip dhcp' (which never runs autoconf) sent its first packet into a down interface. Activate the interface right after TUNSETIFF via SIOCGIFFLAGS/ SIOCSIFFLAGS on an AF_INET socket - the same CAP_NET_ADMIN already needed for TUNSETIFF. Device activation only: addresses and masks stay with the caller (see -n). Idempotent for pre-created anchors.
yueguobin
force-pushed
the
feat/no-hostconf-flag
branch
from
October 12, 2026 09:24
c48b553 to
128508d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Makes tap mode usable by callers that create and own the host side of the tap (bridges, VMs, simulators). Today vpcs assumes it owns it: every static
ipcommand runsifconfig tapX ... upon the host (the onlysystem()call in the tree), and thatupis also the only thing that ever brought the tap interface up.-nflag — skip the host auto-configuration. Default behavior unchanged; only the staticippath is affected (ip dhcpnever touched the host).open_tap()—TUNSETIFFleaves the interface administratively DOWN, and a down tun fd carries no frames: every outgoing packet failed with "Send packet error". SetIFF_UPviaSIOCSIFFLAGSright after attach (sameCAP_NET_ADMIN). This also fixesip dhcpin tap mode, which never ran autoconf and sent into a down interface.-d namedevice instead oftap<id>.Makefile—make/sudo make install/make clean, dispatching likemk.sh. Also fixes the.c.osuffix rule: GNU make ignores prerequisites on suffix rules (header changes never triggered rebuilds) and the list was stale (keys.h->keydef.h); defaultsCCOPT=-O2so a direct make matchesmk.sh.installtarget (Makefile.linux) — installs to$(BINDIR); grantscap_net_admin+epviasetcapbest-effort (warning only on failure — udp mode needs no privileges).IFNAMSIZinstead of the localIFNAMESIZ(12); names of 12-15 chars could overflow.Scope
-ndisables the host auto-configuration only. Capabilities (cap_net_adminfor/dev/net/tun+TUNSETIFF) and the tap's lifetime/teardown ordering remain the caller's concern. Attaching to a pre-created persistent tap is unchanged.Testing
Unprivileged user, binary granted
cap_net_admin+ep:ip 192.168.1.2/24on a freshly created tap completes with zero "Send packet error" (previously every outgoing packet failed); host interface isUP,LOWER_UPwhile vpcs runsip dhcptransmits cleanly (zero send errors)-nagainst a pre-created persistent tap: attach works, and the host interface's addresses and state are untouched