Container does not "see?" connection untill data is sent when using pasta

[shunkica]

I am running an custom FTP server in a Podman container. The container is running with the slirp4netns port_handler, because I need the original client IP.

I recently found about the pasta networking mode and tried the switch today.

After the switch, I encountered a strange issue where the FTP server does not send the initial "220 Waiting for authentication..." message upon client connection. The message is only sent after the client sends some input to the server.

This happens when I try to connect to the server from a different machine:

telnet my.server 2100
Trying my.server...
Connected to my.server.
Escape character is '^]'.
HELLO
220 Waiting for authentication...
502 Unknown command

But when tried directly from the host machine of the container it works as expected:

telnet 127.0.0.1 2100
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
220 Waiting for authentication...

I am using this port configuration in the quadlet file:

PublishPort=2100:21
PublishPort=50000-50100:50000-50100

And this is my containers.conf:

[engine]
runtime = "/usr/bin/crun"
[network]
default_rootless_network_cmd = "pasta"

Another strange thing that I figured out is that if I put the container in a pod, then it works as expected.

@sbrivio-rh do you have any insight for me? I am happy to provide any additional details you need.

VERSION_ID="9.3"
podman-4.6.1-9.el9_3.x86_64
passt-0^20230818.g0af928e-4.el9.x86_64

[Luap99]

passt-0^20230818.g0af928e-4.el9.x86_64

Note that this is very old pasta version so you likely should test with the latest version first.

[shunkica]

It is the latest available using the package manager. I will try building from source and see if that fixes the issue.

[sbrivio-rh]

Known, fixed issue, see another case (VNC) and commit fixing that (originally reported with SMTP). You should be able to use 0^20231204.gb86afe3-1.el9, which fixes this.