- Added a new Stats() method in inet.Stack to get the saved stats
during restore.
- Mark stack.nic, tcpip.Route and stack.addressState structs as "nosave".
These fields should not be saved because the IP addresses and routes can
change during restore and new configuration of routes and IP addresses will be
extracted from the restore spec and initialized in the saved stack.
- Changes in Restore() method in icmp, udp, tcp, packet and raw endpoint files
to support save restore of these endpoints. These changes are flag guarded by
the TESTONLY-save-restore-netstack flag.
PiperOrigin-RevId: 707639274
This CL restores the listening connections when netstack s/r is enabled.
The changes include:
- New method as a workaround to replace the new routes and nics to the loaded
stack after restore.
- New Restore() for transport layer protocols to restore the protocol level
background workers.
- Adds afterLoad() method for fdbased processors.
- Adds a test to verify listening connection is restored after checkpointing
with netstack s/r enabled.
- Few other changes to save restore fields to enable netstack s/r.
PiperOrigin-RevId: 698453124
- Adds a new flag which will enable netstack s/r. When the flag is not enabled,
there is no change in the existing behavior. The flag will be enabled only in
tests to verify the s/r functionality of netstack.
- Some additional fields in netstack were causing panic when netstack is
save/restored. Such fields are marked as 'save'/'nosave' accordingly to resolve
the panic.
PiperOrigin-RevId: 668566657
The veth devices are virtual Ethernet devices. They can act as
tunnels between network namespaces to create a bridge to a
physical network device in another namespace, but can also be
used as standalone network devices.
More information can be found here:
https://man7.org/linux/man-pages/man4/veth.4.html
PiperOrigin-RevId: 638853289
The NEWLINK commands contains many properties and here is no reason to have
another abstract interface between the Sentry and network stacks.
PiperOrigin-RevId: 627916629
Resume method resumes the endpoints after save which is required for
save/resume. This method resumes the endpoint states which were frozen during
save.
PiperOrigin-RevId: 615467468
The existing Resume method in netstack is doing the work of Restore. This
method does not resume endpoints as the resumable endpoints are only stored
during the Restore of the sandbox, rename the method appropriately.
PiperOrigin-RevId: 613320887
With S/R enabled, the kernel is replaced during the container creation
before attempting to restore in a new sandbox. The old kernel which was
being replaced did not release the resources resulting in ref leaks. This CL
releases the resources before replacing the kernel in restore.
PiperOrigin-RevId: 603822183
* If a name is in the map, it means there is a socket associated with it. When
a socket is destroyed, its name is removed from the map. If we bind another
socket to the same name, its destroy will trigger the panic:
panic: expected socket to exist at ... in abstract socket namespace
* We use TryIncRef/DecRef to check a socket, DecRef may destroy the socket but
it requires to take AbstractSocketNamespace mutex that is already taken.
PiperOrigin-RevId: 574268647
task.netns is always changed from a task goroutine under task.mu.
It means that we can access it without any locks from a task goroutine
we don't need to increment a reference counter in such cases.
In all other cases, we need to take task.mu.
PiperOrigin-RevId: 552913323
This change introduces the nsfs file system. Each new namespace allocates
a new nsfs inode.
Here are reasons why we need these inodes:
* each namespace has to have an unique id.
* proc/pid/ns/ contains one entry for each namespace. Bind mounting one of
the files in this directory to somewhere else in the filesystem keeps the
corresponding namespace alive even if all processes currently in
the namespace terminate.
* setns() allows the calling process to join an existing namespace specified
by a file descriptor.
PiperOrigin-RevId: 550694515
This change removes all endpoint goroutines and all TCP processing is now done
inline in the TCP processor loop. TCP timers directly invoke handlers as
required rather than assert a waker.
UnlockUser is also simplified to just queue the endpoint to the processor
instead of trying to process segments inline. This allows us to centralize logic
for TCP state handling in the processor. This potentially could involve an extra
wakeup but now that endpoint goroutines do not exist this is not such a big
concern as in case of busy servers the processor goroutines will already be
running anyway.
This change also allows us to clean up S/R as now restoring a TCP endpoint does
not require restarting a goroutine and moving it to the right logical point but
only requires that we restart any timers that may have been running when the
save was done and restore any port bindings as required.
Endpoint.Release is now removed in favor of Endpoint.Abort by using Abort in
places where we use Endpoint.Release.
Updates #231
PiperOrigin-RevId: 442673015
