Add net-disconnect-ok flag to enable CapabilityDisconnectOk for link endpoints.

This allows save to proceed while there are open TCP connections. Those
connections are closed upon save.

PiperOrigin-RevId: 634800042

runsc/boot/network.go

@@ -178,6 +178,10 @@ type CreateLinksAndRoutesArgs struct {
 	// NATBlob indicates whether FilePayload also contains an iptables NAT
 	// ruleset.
 	NATBlob bool
+
+	// DisconnectOk indicates that link endpoints should have the capability
+	// CapabilityDisconnectOk set.
+	DisconnectOk bool
 }
 
 // IPWithPrefix is an address with its subnet prefix length.
@@ -324,6 +328,7 @@ func (n *Network) CreateLinksAndRoutes(args *CreateLinksAndRoutesArgs, _ *struct
 				RXChecksumOffload:    link.RXChecksumOffload,
 				GRO:                  link.GVisorGRO,
 				ProcessorsPerChannel: link.ProcessorsPerChannel,
+				DisconnectOk:         args.DisconnectOk,
 			})
 			if err != nil {
 				return err
@@ -417,6 +422,7 @@ func (n *Network) CreateLinksAndRoutes(args *CreateLinksAndRoutesArgs, _ *struct
 			InterfaceIndex:    link.InterfaceIndex,
 			Bind:              link.Bind == BindSentry,
 			GRO:               link.GVisorGRO,
+			DisconnectOk:      args.DisconnectOk,
 		})
 		if err != nil {
 			return err

runsc/config/config.go

@@ -356,6 +356,11 @@ type Config struct {
 	// present, and reproduce them in the sandbox.
 	ReproduceNftables bool `flag:"reproduce-nftables"`
 
+	// NetDisconnectOk indicates whether the link endpoint capability
+	// CapabilityDisconnectOk should be set. This allows open connections to be
+	// disconnected upon save.
+	NetDisconnectOk bool `flag:"net-disconnect-ok"`
+
 	// TestOnlyAutosaveImagePath if not empty enables auto save for syscall tests
 	// and stores the directory path to the saved state file.
 	TestOnlyAutosaveImagePath string `flag:"TESTONLY-autosave-image-path"`

runsc/config/flags.go

@@ -125,6 +125,7 @@ func RegisterFlags(flagSet *flag.FlagSet) {
 	flagSet.Bool("EXPERIMENTAL-xdp-need-wakeup", true, "EXPERIMENTAL. Use XDP_USE_NEED_WAKEUP with XDP sockets.") // TODO(b/240191988): Figure out whether this helps and remove it as a flag.
 	flagSet.Bool("reproduce-nat", false, "Scrape the host netns NAT table and reproduce it in the sandbox.")
 	flagSet.Bool("reproduce-nftables", false, "Attempt to scrape and reproduce nftable rules inside the sandbox. Overrides reproduce-nat when true.")
+	flagSet.Bool("net-disconnect-ok", false, "Indicates whether the link endpoint capability CapabilityDisconnectOk should be set. This allows open connections to be disconnected upon save.")
 
 	// Flags that control sandbox runtime behavior: accelerator related.
 	flagSet.Bool("nvproxy", false, "EXPERIMENTAL: enable support for Nvidia GPUs")
@@ -154,6 +155,7 @@ var overrideAllowlist = map[string]struct {
 	"strace-syscalls":   {},
 	"strace-log-size":   {},
 	"host-uds":          {},
+	"net-disconnect-ok": {},
 
 	"oci-seccomp": {check: checkOciSeccomp},
 }

runsc/sandbox/network.go

@@ -80,6 +80,7 @@ func createDefaultLoopbackInterface(conf *config.Config, conn *urpc.Client) erro
 	link.GVisorGRO = conf.GVisorGRO
 	if err := conn.Call(boot.NetworkCreateLinksAndRoutes, &boot.CreateLinksAndRoutesArgs{
 		LoopbackLinks: []boot.LoopbackLink{link},
+		DisconnectOk:  conf.NetDisconnectOk,
 	}, nil); err != nil {
 		return fmt.Errorf("creating loopback link and routes: %v", err)
 	}
@@ -159,7 +160,9 @@ func createInterfacesAndRoutesFromNS(conn *urpc.Client, nsPath string, conf *con
 	}
 
 	// Collect addresses and routes from the interfaces.
-	var args boot.CreateLinksAndRoutesArgs
+	args := boot.CreateLinksAndRoutesArgs{
+		DisconnectOk: conf.NetDisconnectOk,
+	}
 	for _, iface := range ifaces {
 		if iface.Flags&net.FlagUp == 0 {
 			log.Infof("Skipping down interface: %+v", iface)

runsc/sandbox/xdp.go

@@ -114,7 +114,9 @@ func prepareRedirectInterfaceArgs(bind boot.BindOpt, conf *config.Config) (boot.
 		return boot.CreateLinksAndRoutesArgs{}, net.Interface{}, fmt.Errorf("querying interfaces: %w", err)
 	}
 
-	var args boot.CreateLinksAndRoutesArgs
+	args := boot.CreateLinksAndRoutesArgs{
+		DisconnectOk: conf.NetDisconnectOk,
+	}
 	var netIface net.Interface
 	for _, iface := range ifaces {
 		if iface.Flags&net.FlagUp == 0 {