From 291abe65707d970d52dd6d55d36e4c21311f6374 Mon Sep 17 00:00:00 2001 From: Kevin Krakauer Date: Tue, 15 Oct 2024 16:58:37 -0700 Subject: [PATCH] enable --net-disconnect-ok by default PiperOrigin-RevId: 686286904 --- pkg/tcpip/transport/tcp/endpoint_state.go | 11 +++++++++++ runsc/config/flags.go | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/pkg/tcpip/transport/tcp/endpoint_state.go b/pkg/tcpip/transport/tcp/endpoint_state.go index 63457f7f8..a273f31d3 100644 --- a/pkg/tcpip/transport/tcp/endpoint_state.go +++ b/pkg/tcpip/transport/tcp/endpoint_state.go @@ -19,6 +19,7 @@ import ( "fmt" "gvisor.dev/gvisor/pkg/atomicbitops" + "gvisor.dev/gvisor/pkg/log" "gvisor.dev/gvisor/pkg/sync" "gvisor.dev/gvisor/pkg/tcpip" "gvisor.dev/gvisor/pkg/tcpip/header" @@ -26,6 +27,15 @@ import ( "gvisor.dev/gvisor/pkg/tcpip/stack" ) +// logDisconnectOnce ensures we don't spam logs when many connections are terminated. +var logDisconnectOnce sync.Once + +func logDisconnect() { + logDisconnectOnce.Do(func() { + log.Infof("One or more TCP connections terminated during save") + }) +} + // beforeSave is invoked by stateify. func (e *Endpoint) beforeSave() { // Stop incoming packets. @@ -44,6 +54,7 @@ func (e *Endpoint) beforeSave() { Err: fmt.Errorf("endpoint cannot be saved in connected state: local %s:%d, remote %s:%d", e.TransportEndpointInfo.ID.LocalAddress, e.TransportEndpointInfo.ID.LocalPort, e.TransportEndpointInfo.ID.RemoteAddress, e.TransportEndpointInfo.ID.RemotePort), }) } + logDisconnect() e.resetConnectionLocked(&tcpip.ErrConnectionAborted{}) e.mu.Unlock() e.Close() diff --git a/runsc/config/flags.go b/runsc/config/flags.go index b3230a4f9..a20441c90 100644 --- a/runsc/config/flags.go +++ b/runsc/config/flags.go @@ -129,7 +129,7 @@ func RegisterFlags(flagSet *flag.FlagSet) { flagSet.Bool("EXPERIMENTAL-xdp-need-wakeup", true, "EXPERIMENTAL. Use XDP_USE_NEED_WAKEUP with XDP sockets.") // TODO(b/240191988): Figure out whether this helps and remove it as a flag. flagSet.Bool("reproduce-nat", false, "Scrape the host netns NAT table and reproduce it in the sandbox.") flagSet.Bool("reproduce-nftables", false, "Attempt to scrape and reproduce nftable rules inside the sandbox. Overrides reproduce-nat when true.") - flagSet.Bool("net-disconnect-ok", false, "Indicates whether open network connections and open unix domain sockets should be disconnected upon save.") + flagSet.Bool("net-disconnect-ok", true, "Indicates whether open network connections and open unix domain sockets should be disconnected upon save.") // Flags that control sandbox runtime behavior: accelerator related. flagSet.Bool("nvproxy", false, "EXPERIMENTAL: enable support for Nvidia GPUs")