Make existing mutex and atomic ownership explicit for networking state.
Annotate self-locking helpers and synchronous forwarding paths, keeping
queue references and callback lifetime requirements in their comments.
Document collection, callback and helper identity limits where the
checker cannot enforce the existing ownership contract.
Co-authored-by: Hanzo Dev <[email protected]>
- There was no lock taken for Nftables rule evaluation.
So, it could happen that while processing and simultaneous update,
a packet could pass to half updated ruleset.
- Changed logic to replace atomic pointer, instead of
replacing fields in the Nftables.
- All the rule evaluation, can now go without needing any reader lock.
- A lock is require for updating Nftables object though,
to serialize the Netlink messages.
PiperOrigin-RevId: 957516505
This change refactors the network configuration flow during sandbox restore
and defers the creation of network links and routes in runsc to run after
seccomp filters are installed.
- Replaced ReplaceConfig with ResetConfig in inet.Stack. Introduced
inet.NetworkArgs to configure the stack during restore, updating k.LoadFrom
to use it.
- Renamed CreateLinksAndRoutes URPC to SetNetworkArgs, which now configures
host sockets before seccomp is installed, deferring link/route creation to run
after seccomp.
- Fixed S/R support by saving and restoring limit/burst state.
- Minor seccomp filter adjustments and test updates.
PiperOrigin-RevId: 945995430
Previously, during sandbox restore the network configuration was restored by
creating a new network stack (which has all the config scraped from the host)
and the replacing this new config such as NICs, routes and IP addresses from
the new stack to the loaded/restored stack.
This change refactors the process by introducing a new `inet.NetworkArgs`
interface that abstracts how the network stack is configured. The `Loader` now
implements this interface and configures the loaded stack directly using the
configuration scraped from the host during restore. `Kernel.LoadFrom` accepts
this interface (instead of stack), allowing it to configure the restored stack
using either the Loader's configuration.
PiperOrigin-RevId: 941330876
- This change enables sockets to set and get the `SO_MARK` option, which marks
outgoing packets.
- It also implements Netfilter (iptables) support for matching
packet marks using the `mark` match extension.
- Added unit and E2E tests to verify mark match and capabilities.
PiperOrigin-RevId: 938123591
When `allow-tcp-live-migration` flag is set, all established TCP connections
are not terminated during save. At the time of restore, the change tries to
find the routes and NICs with the source and destination IP address of the
connection. If it is success, the connection is restored. Enabling this flag
keeps the external connections behavior same as existing loopback connections.
Added unit test to verify the behavior with the flag on.
PiperOrigin-RevId: 929411541
The restored stack was still using the stack that was used to hold configuration,
creating a kind of spit brain scenario, where the old network stack was still
being used by parts of it.
Also added a `poisonableClock` to the early-boot stack. This clock is poisoned
immediately after restore, causing any subsequent clock/timer queries on config
stack components to panic instantly, catching missed configuration cleanup bugs.
PiperOrigin-RevId: 928766376
Previously, external connections were terminated during both restore and
resume operations, causing a reconnection after every resume. By limiting
termination to the restore only, connections now remain active during resumes
as intended.
Added tests to verify that resume does not terminate the connection.
PiperOrigin-RevId: 868830577
Only netstack supports sending link events, requests to join multicast
groups for netlink sockets continue to be denied when hostinet is in use.
connect() and sendmsg() to RTMGRP_LINK still fails.
PiperOrigin-RevId: 831688843
Before this change, the processors were closed in beforeSave which caused the
packet processing for established connections to stop even in the case of
save/resume. Do not close in beforeSave, instead close these processors in
afterLoad for restore.
PiperOrigin-RevId: 821714849
During restore there will be new NICs and routes created based on the network
config. Close these old NICs and routes in beforeSave() only for save/restore.
For save/resume, do not close them.
As new link endpoints are created during restore, there is no need to start
the associated old processor goroutines in afterLoad. Start them only for
save/resume.
PiperOrigin-RevId: 804994281
This change adds functionality to traverse the nftables ruleset
in the IPv4 and IPv6 network endpoints within netstack.
Updates #11778
PiperOrigin-RevId: 799463692
This CL adjusts the network stack's behavior to route traffic addressed to any
of the local IP addresses through the loopback interface. This change is
required to match the Linux behavior.
The CL introduces a loopbackNIC field in the Stack struct to cache the loopback
interface. This cached interface is then used in findLocalRouteRLocked to create
a local route for traffic destined to any local address.
PiperOrigin-RevId: 795893254
Added an Nftables field to the stack and functionality and error-checking for
creating a new NFTable (NFT_MSG_NEWTABLE) and retrieving that table
(NFT_MSG_GETTABLE). Removed hostinet tests, as nftables is only supported
for netstack.
PiperOrigin-RevId: 775398315
- During restore if endpoints' states are not loaded before starting
dispatchers, then the incoming packets will be queued and the dispatcher will
try to send the packets, which will result in a panic as the endpoint might
still be in an invalid state (eg: initial).
- To avoid this, wait for all the endpoints to be loaded completely before
starting the dispatchers by calling AsycnLoading.Wait() in stack.Restore() and
remove this from kernel.LoadFrom()
- Added a test to check save restore of multiple(100) listening sockets.
PiperOrigin-RevId: 762010964
- Added a new Stats() method in inet.Stack to get the saved stats
during restore.
- Mark stack.nic, tcpip.Route and stack.addressState structs as "nosave".
These fields should not be saved because the IP addresses and routes can
change during restore and new configuration of routes and IP addresses will be
extracted from the restore spec and initialized in the saved stack.
- Changes in Restore() method in icmp, udp, tcp, packet and raw endpoint files
to support save restore of these endpoints. These changes are flag guarded by
the TESTONLY-save-restore-netstack flag.
PiperOrigin-RevId: 707639274
insecureRNG and secureRNG stack fields are restored in stack.afterLoad()
tcp processor fields are restored in tcp endpoint.Restore()
PiperOrigin-RevId: 704477536
TCP probe support is implemented, unnecessarily, across the stack and and tcp
packages. It can live entirely in tcp. Additionally, it is only ever set at
initialization time, so support for dynamically adding/removing the probe isn't
necesary.
The probe is getting in the way of adding debugging for b/339664055.
PiperOrigin-RevId: 699330364
This CL restores the listening connections when netstack s/r is enabled.
The changes include:
- New method as a workaround to replace the new routes and nics to the loaded
stack after restore.
- New Restore() for transport layer protocols to restore the protocol level
background workers.
- Adds afterLoad() method for fdbased processors.
- Adds a test to verify listening connection is restored after checkpointing
with netstack s/r enabled.
- Few other changes to save restore fields to enable netstack s/r.
PiperOrigin-RevId: 698453124
The error code is based on the runc's behavior:
```shell
# ip link set dev br0 master br0
Error: Can not enslave a bridge to a bridge.
# echo $?
2
```
Reported-by: [email protected]
PiperOrigin-RevId: 679761515
Support for multicast forwarding was finished by [email protected] in
commit b63c4b3348. These TODOs are no
longer applicable and can be removed
Updates #7338
PiperOrigin-RevId: 650748952
IFLA_IFNAME is used to set an interface's name when being used
with RTM_NEWLINK and RTM_SETLINK. RTM_NEWLINK is the preferred way, it
is backwards compatible with RTM_SETLINK. For gVisor, when RTM_SETLINK is
introduced, it shall just share the implementation.
PiperOrigin-RevId: 647833657
There are 2 interfaces in gVisor which are exactly the same:
- pkg/tcpip/stack.UniqueID
- pkg/sentry/uniqueid.Provider
Before this change, both were using the Kernel as the unique number generator.
However, we want to decouple the netstack from the kernel. This coupling is
causing bugs in restore because netstack needs to be created before the Kernel
is restored. So right now, netstack ends up using a "temporary" Kernel which is
later destroyed in the restore sequence, but netstack keeps referencing it.
Before this change, the unique ID generator in pkg/tcpip/stack.Stack was used
for 2 things:
1. Provide NIC IDs which are unique across all network namespaces.
2. Implement stack.TransportEndpoint.UniqueID.
(2) is not used anywhere, so deleted it. (1) is overly unique. NIC IDs do not
need to be unique across network namespace. So instead of holding a pointer to
the kernel, added a NIC ID generator in stack.Stack itself and added
NextNICID() function with proper typing.
PiperOrigin-RevId: 646997006
Implement the core part. All packets are broadcast-ed to all ports. The next
step will be to implement forwarding and multicast group databases.
PiperOrigin-RevId: 644471256
