The important change here is in tcpip/tcpip.go, where tcpip.Address is defined.
The rest is updating uses of tcpip.Address.
This is preparation for netip.Addr or []byte based addresses, which should save
us a bunch of allocations. Currently, we allocate every time we want to, say,
get a tcpip.Address from a header. This is because the header is a byte slice,
but Address is a string. Strings are immutable, so Go allocates and copies.
PiperOrigin-RevId: 532284732
A few minor fixes. The biggest change is that the blocking implementation needs
to wait on POLLHUP and POLLERR events, in addition to readable/writable events.
We also need to track shutdown state in the socket.
PiperOrigin-RevId: 529816115
The blocking implementation needs to wait on POLLHUP and POLLERR events, in
addition to readable/writable events. That fixed at least one test.
There's still two unresolved issues in the tests, but we can enable the rest
of the suite while we figure out those two.
PiperOrigin-RevId: 525849045
And enable all of the netlink tests that depend on this functionality.
Specifially, this CL implements hostinet.stack:
* .RemoveInterface()
* .AddInterfaceAddr()
* .RemoveInterfaceAddr()
Applications use netlink messages to call into these methods. For hostinet, we
use netlink messages to the host to implement these methods.
Note that the netlink messages are not simple passed from the application to
the host -- they are parsed first and only carefully crafted messages are sent
to the host.
This CL required a lot of refactoring to the existing netlink code in the
hostinet package, as well as a bunch of new functionality. All of that code has
been collected in hostinet/netlink.go
I also changed how we handle CAP_NET_ADMIN and CAP_NET_RAW in tests, since we
must drop those capabilities inside the sandbox if we don't have them on the
host. The new solution is cleaner and does not rely on google-specific env
variables.
PiperOrigin-RevId: 522685544
Previously we were initializing these at startup and they could never change.
Now they are read dynamically every time they are requested. This is a
pre-requisite for implementing methods that mutate the interfaces
(stack.AddInterface()).
PiperOrigin-RevId: 522109098
No functional changes. Refactored some methods into smaller chunks for easy
reuse. Got rid of some needlessly exported methods.
PiperOrigin-RevId: 520748526
This catches up the interface to the `EmitUnimplementedEvent` method signature
on `kernel.Kernel`.
Also add build-time test to verify that `kernel.Kernel` implements this
interface, in order to catch such breakages at build time in the future.
PiperOrigin-RevId: 519000411
Most of these buffers can be truncated in the Sentry before returning to the
application.
IP_TOS is a bit funny, since it is interpreted as a 8, 16, or 32-bit int
depending on the buffer size, so simple truncation does not work. We allow all
sizes to be passed to the host.
PiperOrigin-RevId: 513880257
Fixes:
* Support for SO_MULTICAST_IF socket option.
* Support IPPROTO_ICMP protocol.
The tests that require raw sockets are disabled on hostinet, since those are
not yet supported.
PiperOrigin-RevId: 509563771
Fixes:
* Pass through some more recvmmsg flags.
* Pass through some more get/setsockopt flags.
* Allow IP_MULTICAST_LOOP/TTL to have variable size, since it can be 8 or 32
bits.
* Convert IPPROTO_IP to IPPROTO_TCP/UDP so it can be returned properly by
getsockopt(SO_PROTO).
* Disable one test that requires CAP_SYS_ADMIN on the host. Will have to come
back to these.
PiperOrigin-RevId: 508938466
This was mostly a matter of allowing more get/setsockopts. Also had to support
getsockopt with a null option, because apparantly Linux allows that.
PiperOrigin-RevId: 508460614
There is a lot of duplication between the get/setsockopt handlers for hostinet
and the filters. This CL introduces an intermediate type hostinet.SockOpt which
is used to generate both handlers and filters.
There is no functional change.
PiperOrigin-RevId: 508430221
A few fixes in here:
* Linux does not transition the state of a non-blocking socket to SS_CONNECTED
when the connect happens asynchronously. Instead, it leaves the state as
SS_CONNECTING (seems like a Linux bug, but OK). This can introduce weird
behavior for subsequent connect() calls. gVisor now forces the state to
update to SS_CONNECTED by calling connect() twice.
* Socket shutdown events are slightly different between gVisor and linux. We
already assert different behavior between the two environments, and now we
also have to check for gVisor+hostinet instead of just gvisor.
* Handle send/recv timeouts, which fixes blocking for read()/write() syscalls.
* Handle cases like MSG_PEEK where the senderAddress is not returned.
* Pass through some more socketopts, and allow them in the syscall filters.
Something is still wrong with shutdown() and poll() calls, so those tests are
temporarily disabled. I'm looking at those next.
This also fixes a number of other syscall test suites, so those are enabled as
well.
PiperOrigin-RevId: 508397317
This enables hostinet to start on both IPv4-only and IPv6-only hosts.
Note that hostinet doesn't have a way to prevent applications inside gVisor
from trying to send, for example, IPv6 packets on an IPv4-only host. The result
of trying to do so is environment-dependent, but will likely fail during calls
to connect(), send(), and the like.
Fixes#8253.
PiperOrigin-RevId: 492579750
This change removes all endpoint goroutines and all TCP processing is now done
inline in the TCP processor loop. TCP timers directly invoke handlers as
required rather than assert a waker.
UnlockUser is also simplified to just queue the endpoint to the processor
instead of trying to process segments inline. This allows us to centralize logic
for TCP state handling in the processor. This potentially could involve an extra
wakeup but now that endpoint goroutines do not exist this is not such a big
concern as in case of busy servers the processor goroutines will already be
running anyway.
This change also allows us to clean up S/R as now restoring a TCP endpoint does
not require restarting a goroutine and moving it to the right logical point but
only requires that we restart any timers that may have been running when the
save was done and restore any port bindings as required.
Endpoint.Release is now removed in favor of Endpoint.Abort by using Abort in
places where we use Endpoint.Release.
Updates #231
PiperOrigin-RevId: 442673015
Linux behaves differently for regular files and dirs for poll(2)/select(2)
compared to epoll_ctl(2). The latter returns EPERM for file and dirs.
I've also changed host FDs to behave like the underlying FD in regards
to epoll to keep it compatible with docker.
Fixes#7134
PiperOrigin-RevId: 429412692
Docker maps stdin to `/dev/null` which doesn't support epoll. Host FD
was ignoring the error and suceeding the epoll_ctl call from the
container, giving false impressing that epoll would be notified.
This required plumbing failure to all waiter.Waitable.EventRegister
callers and implementers.
Closes#6795
PiperOrigin-RevId: 414797621
Instead of passing the event mask at registratrion time, pass the mask as part
of the waiter. This makes the mask immutable and simplifies the architecture of
waiters. This is also necessary for a future fix that will allow the fdnotifier
to keep persistent entries, as opposed to requiring constant updates.
This change is intended to be a no-op in terms of function. The only exception
is signalfd, where this mask was abused. To handle this case, the operation of
signalfd changed to allow one layer of indirection.
PiperOrigin-RevId: 409702998
Change marshal.Marshallable method signatures to return the remaining buffer.
This makes it easier to implement these method manually. Without this, we would
have to manually do buffer shifting which is error prone.
tools/go_marshal/test:benchmark test does not show change in performance.
Additionally fixed some marshalling bugs in fsimpl/fuse.
Updated multiple callpoints to get rid of redundant slice indexing work and
simplified code using this new signature.
Updates #6450
PiperOrigin-RevId: 407857019
Removes package syserror and moves still relevant code to either linuxerr
or to syserr (to be later removed).
Internal errors are converted from random types to *errors.Error types used
in linuxerr. Internal errors are in linuxerr/internal.go.
PiperOrigin-RevId: 390724202
This change will allow us to remove the default link in a packetimpact test so
we can reduce indeterministic behaviors as required in https://fxbug.dev/78430.
This will also help with testing #1388.
Updates #578, #1388.
PiperOrigin-RevId: 387896847
