This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.
Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
the files in this directory to somewhere else in the filesystem keeps the
corresponding namespace alive even if all processes currently in
the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
by a file descriptor.
PiperOrigin-RevId: 550694515
When the TCP forwarder ignores a connection due to having too many
in-flight connections, it's not easy to log a message or update a metric
for later debugging. Add a metric that will be incremented in this case
so that the user of the Forwarder can observe this.
Signed-off-by: Andrew Dunham <[email protected]>
All tcpip.Endpoints use a tcpip.FullAddress to hold addresses associated
with an outgoing or incoming packet, but the struct only had a field for
a tcpip.Address. This field was overloaded to also hold a link address
(which is normally held in a tcpip.LinkAddress). This worked relatively
fine until the change to make addresses opaque types.
commit ef88b30bff required the use of a
workaround to continue passing around link addresses through the
tcpip.Address field. This workaround requires assumptions about the
size of the hardware address and unncessary jumping-through-hoops.
This change just introduces a new field to tcpip.FullAddress with type
tcpip.LinkAddress that can hold link addresses and this new field will
be used by packet endpoints.
The change referenced above is cl/532284732.
PiperOrigin-RevId: 536561363
tcp_benchmark throughput increase 2-3%, but allocations go down (25% in the
download benchmark, only 2% in the upload path).
PiperOrigin-RevId: 532523146
The important change here is in tcpip/tcpip.go, where tcpip.Address is defined.
The rest is updating uses of tcpip.Address.
This is preparation for netip.Addr or []byte based addresses, which should save
us a bunch of allocations. Currently, we allocate every time we want to, say,
get a tcpip.Address from a header. This is because the header is a byte slice,
but Address is a string. Strings are immutable, so Go allocates and copies.
PiperOrigin-RevId: 532284732
We only need baseEndpoint.mu to read e.receiver, which we copy
before calling Recv() on in.
Reported-by: [email protected]
Reported-by: [email protected]
PiperOrigin-RevId: 530970638
A few minor fixes. The biggest change is that the blocking implementation needs
to wait on POLLHUP and POLLERR events, in addition to readable/writable events.
We also need to track shutdown state in the socket.
PiperOrigin-RevId: 529816115
This introduces a `metric.FieldValue` struct type that wraps a string.
All metric interfaces that deal with field values have been updated to use
pointers to this type instead of strings.
The intent of this change is to make it more obvious that field values must
be passed using references. Prior to this change, this was done using string
pointer comparisons. Now this must be done by using a pointer to the same
`metric.FieldValue` struct.
The struct type still externally exposes its string so that it can be referred
to in value function callbacks by "custom" metrics. (Though there are no
current uses of callback metrics with fields.)
PiperOrigin-RevId: 527030738
The blocking implementation needs to wait on POLLHUP and POLLERR events, in
addition to readable/writable events. That fixed at least one test.
There's still two unresolved issues in the tests, but we can enable the rest
of the suite while we figure out those two.
PiperOrigin-RevId: 525849045
And enable all of the netlink tests that depend on this functionality.
Specifially, this CL implements hostinet.stack:
* .RemoveInterface()
* .AddInterfaceAddr()
* .RemoveInterfaceAddr()
Applications use netlink messages to call into these methods. For hostinet, we
use netlink messages to the host to implement these methods.
Note that the netlink messages are not simple passed from the application to
the host -- they are parsed first and only carefully crafted messages are sent
to the host.
This CL required a lot of refactoring to the existing netlink code in the
hostinet package, as well as a bunch of new functionality. All of that code has
been collected in hostinet/netlink.go
I also changed how we handle CAP_NET_ADMIN and CAP_NET_RAW in tests, since we
must drop those capabilities inside the sandbox if we don't have them on the
host. The new solution is cleaner and does not rely on google-specific env
variables.
PiperOrigin-RevId: 522685544
Previously we were initializing these at startup and they could never change.
Now they are read dynamically every time they are requested. This is a
pre-requisite for implementing methods that mutate the interfaces
(stack.AddInterface()).
PiperOrigin-RevId: 522109098
No functional changes. Refactored some methods into smaller chunks for easy
reuse. Got rid of some needlessly exported methods.
PiperOrigin-RevId: 520748526
This catches up the interface to the `EmitUnimplementedEvent` method signature
on `kernel.Kernel`.
Also add build-time test to verify that `kernel.Kernel` implements this
interface, in order to catch such breakages at build time in the future.
PiperOrigin-RevId: 519000411
Earlier SetBoundSocketFD() was taking ownership of bound socket FD only on
success. Having it take ownership unconditionally is cleaner.
PiperOrigin-RevId: 516903597
Most of these buffers can be truncated in the Sentry before returning to the
application.
IP_TOS is a bit funny, since it is interpreted as a 8, 16, or 32-bit int
depending on the buffer size, so simple truncation does not work. We allow all
sizes to be passed to the host.
PiperOrigin-RevId: 513880257
Fixes:
* Support for SO_MULTICAST_IF socket option.
* Support IPPROTO_ICMP protocol.
The tests that require raw sockets are disabled on hostinet, since those are
not yet supported.
PiperOrigin-RevId: 509563771
Fixes:
* Pass through some more recvmmsg flags.
* Pass through some more get/setsockopt flags.
* Allow IP_MULTICAST_LOOP/TTL to have variable size, since it can be 8 or 32
bits.
* Convert IPPROTO_IP to IPPROTO_TCP/UDP so it can be returned properly by
getsockopt(SO_PROTO).
* Disable one test that requires CAP_SYS_ADMIN on the host. Will have to come
back to these.
PiperOrigin-RevId: 508938466
This was mostly a matter of allowing more get/setsockopts. Also had to support
getsockopt with a null option, because apparantly Linux allows that.
PiperOrigin-RevId: 508460614
There is a lot of duplication between the get/setsockopt handlers for hostinet
and the filters. This CL introduces an intermediate type hostinet.SockOpt which
is used to generate both handlers and filters.
There is no functional change.
PiperOrigin-RevId: 508430221
A few fixes in here:
* Linux does not transition the state of a non-blocking socket to SS_CONNECTED
when the connect happens asynchronously. Instead, it leaves the state as
SS_CONNECTING (seems like a Linux bug, but OK). This can introduce weird
behavior for subsequent connect() calls. gVisor now forces the state to
update to SS_CONNECTED by calling connect() twice.
* Socket shutdown events are slightly different between gVisor and linux. We
already assert different behavior between the two environments, and now we
also have to check for gVisor+hostinet instead of just gvisor.
* Handle send/recv timeouts, which fixes blocking for read()/write() syscalls.
* Handle cases like MSG_PEEK where the senderAddress is not returned.
* Pass through some more socketopts, and allow them in the syscall filters.
Something is still wrong with shutdown() and poll() calls, so those tests are
temporarily disabled. I'm looking at those next.
This also fixes a number of other syscall test suites, so those are enabled as
well.
PiperOrigin-RevId: 508397317
Implement this check in netstack integration (in sentry) so that the
core netstack does not prevent an integrator from removing loopback.
PiperOrigin-RevId: 493992707
This enables hostinet to start on both IPv4-only and IPv6-only hosts.
Note that hostinet doesn't have a way to prevent applications inside gVisor
from trying to send, for example, IPv6 packets on an IPv4-only host. The result
of trying to do so is environment-dependent, but will likely fail during calls
to connect(), send(), and the like.
Fixes#8253.
PiperOrigin-RevId: 492579750
Now there's the unnamed one, and "higherID" which is the lock for the
endpoint that has a higher ID.
The lock dependency should consistently be "lower ID" -> "higher ID".
PiperOrigin-RevId: 491716600
This CL does the following:
- Add the ability for nested locks to have names.
- Give names to all current uses of nested locks in the codebase.
- Truncate `lockdep` debug stack traces to avoid the clutter from the
`lockdep` code itself
- Simplify `lockdep` to not longer require `classMap`.
PiperOrigin-RevId: 491486620
