netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Do not validate network namespace path across C/R.

Browse Source 
PiperOrigin-RevId: 693958084
This commit is contained in:
Nayana Bidari
2024-11-06 20:20:15 -08:00
committed by gVisor bot
parent e23347e5b5
commit 7a039fc8c5
2 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/restore.go
+16 -1
View File
@@ -362,6 +362,21 @@ func validateResources(field, cName string, oldR, newR *specs.LinuxResources) er
return nil
}
func copyNamespaceArr(namespaceArr []specs.LinuxNamespace) []specs.LinuxNamespace {
arr := make([]specs.LinuxNamespace, 0, len(namespaceArr))
for _, n := range namespaceArr {
// Namespace path can change during restore.
arr = append(arr, specs.LinuxNamespace{Type: n.Type})
}
return arr
}
func validateNamespaces(field, cName string, oldN, newN []specs.LinuxNamespace) error {
oldArr := copyNamespaceArr(oldN)
newArr := copyNamespaceArr(newN)
return validateArray(field, cName, oldArr, newArr)
}
func validateStruct(field, cName string, oldS, newS any) error {
if !reflect.DeepEqual(oldS, newS) {
return validateError(field, cName, oldS, newS)
@@ -422,7 +437,7 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error
if err := validateArray("GIDMappings", cName, oldLinux.GIDMappings, newLinux.GIDMappings); err != nil {
return err
}
if err := validateArray("Namespace", cName, oldLinux.Namespaces, newLinux.Namespaces); err != nil {
if err := validateNamespaces("Namespace", cName, oldLinux.Namespaces, newLinux.Namespaces); err != nil {
return err
}
runsc/container/container_test.go
+17 -1
View File
@@ -3697,7 +3697,7 @@ func TestSpecValidation(t *testing.T) {
wantErr: "Devices does not match across checkpoint restore",
},
{
name: "Namespace",
name: "NamespaceFail",
mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {
spec.Linux = &specs.Linux{}
restoreSpec.Linux = &specs.Linux{}
@@ -3708,6 +3708,22 @@ func TestSpecValidation(t *testing.T) {
},
wantErr: "Namespace does not match across checkpoint restore",
},
{
name: "NamespaceSuccess",
mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {
spec.Linux = &specs.Linux{}
spec.Linux.Namespaces = append(spec.Linux.Namespaces, specs.LinuxNamespace{
Type: "network",
Path: fmt.Sprintf("/proc/%d/ns/net1", os.Getpid()),
})
restoreSpec.Linux = &specs.Linux{}
restoreSpec.Linux.Namespaces = append(restoreSpec.Linux.Namespaces, specs.LinuxNamespace{
Type: "network",
Path: fmt.Sprintf("/proc/%d/ns/net2", os.Getpid()),
})
},
wantErr: "",
},
{
name: "Seccomp",
mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {