287 Commits
Author SHA1 Message Date
Jamie LiuandgVisor bot 9115f26851 Allocate device numbers for VFS2 filesystems.
Updates #1197, #1198, #1672

PiperOrigin-RevId: 310432006
2020-05-07 14:01:53 -07:00
Dean DengandgVisor bot faf89dd31a Update vfs2 socket TODOs.
Three updates:
- Mark all vfs2 socket syscalls as supported.
- Use the same dev number and ino number generator for all types of sockets,
  unlike in VFS1.
- Do not use host fd for hostinet metadata.

Fixes #1476, #1478, #1484, 1485, #2017.

PiperOrigin-RevId: 309994579
2020-05-05 12:11:14 -07:00
Dean DengandgVisor bot 82bae30cee Port netstack, hostinet, and netlink sockets to VFS2.
All three follow the same pattern:
1. Refactor VFS1 sockets into socketOpsCommon, so that most of the methods can
   be shared with VFS2.
2. Create a FileDescriptionImpl with the corresponding socket operations,
   rewriting the few that cannot be shared with VFS1.
3. Set up a VFS2 socket provider that creates a socket by setting up a dentry
   in the global Kernel.socketMount and connecting it with a new
   FileDescription.

This mostly completes the work for porting sockets to VFS2, and many syscall
tests can be enabled as a result.
There are several networking-related syscall tests that are still not passing:
1. net gofer tests
2. socketpair gofer tests
2. sendfile tests (splice is not implemented in VFS2 yet)

Updates #1478, #1484, #1485

PiperOrigin-RevId: 309457331
2020-05-01 12:54:41 -07:00
Dave BaileyandgVisor bot 7c0f3bc857 Sentry metrics updates.
Sentry metrics with nanoseconds units are labeled as such, and non-cumulative
sentry metrics are supported.

PiperOrigin-RevId: 307621080
2020-04-21 09:36:43 -07:00
Ting-Yu WangandgVisor bot c9195349c9 Replace type assertion with TaskFromContext.
This should fix panic at aio callback.

PiperOrigin-RevId: 305798549
2020-04-09 18:00:33 -07:00
Andrei VaginandgVisor bot 7928aa345e Convert int and bool socket options to use GetSockOptInt and GetSockOptBool
PiperOrigin-RevId: 305699233
2020-04-09 09:31:48 -07:00
Ting-Yu WangandgVisor bot d5ddb53650 Remove out-of-date TODOs.
We already have network namespace for netstack.

PiperOrigin-RevId: 305341954
2020-04-07 14:33:48 -07:00
Dean DengandgVisor bot 5818663ebe Add FileDescriptionImpl for Unix sockets.
This change involves several steps:
- Refactor the VFS1 unix socket implementation to share methods between VFS1
  and VFS2 where possible. Re-implement the rest.
- Override the default PRead, Read, PWrite, Write, Ioctl, Release methods in
  FileDescriptionDefaultImpl.
- Add functions to create and initialize a new Dentry/Inode and FileDescription
  for a Unix socket file.

Updates #1476

PiperOrigin-RevId: 304689796
2020-04-03 14:08:54 -07:00
Dean DengandgVisor bot 5b2396d244 Fix typo in TODO comments.
PiperOrigin-RevId: 304508083
2020-04-02 17:07:13 -07:00
Nayana Bidari 92b9069b67 Support owner matching for iptables.
This feature will match UID and GID of the packet creator, for locally
generated packets. This match is only valid in the OUTPUT and POSTROUTING
chains. Forwarded packets do not have any socket associated with them.
Packets from kernel threads do have a socket, but usually no owner.
2020-03-26 12:21:24 -07:00
Bhasker HariharanandgVisor bot d8c4eff3f7 Automated rollback of changelist 301837227
PiperOrigin-RevId: 302891559
2020-03-25 08:11:21 -07:00
Bhasker HariharanandgVisor bot 7e4073af12 Move tcpip.PacketBuffer and IPTables to stack package.
This is a precursor to be being able to build an intrusive list
of PacketBuffers for use in queuing disciplines being implemented.

Updates #2214

PiperOrigin-RevId: 302677662
2020-03-24 09:06:26 -07:00
Ian LewisandgVisor bot a730d74b32 Support basic /proc/net/dev metrics for netstack
Fixes #506

PiperOrigin-RevId: 302540404
2020-03-23 16:12:58 -07:00
Bhasker HariharanandgVisor bot 369cf38bd7 Fix data race in SetSockOpt.
PiperOrigin-RevId: 302539171
2020-03-23 16:06:33 -07:00
Bhasker HariharanandgVisor bot 3a37f67917 Change SocketOperations.readMu to an RWMutex.
Also get rid of the readViewHasData as it's not required anymore.

Updates #231, #357

PiperOrigin-RevId: 301837227
2020-03-19 10:00:31 -07:00
Bhasker HariharanandgVisor bot e9e399c25d Remove workMu from tcpip.Endpoint.
workMu is removed and e.mu is now a mutex that supports TryLock.  The packet
processing path tries to lock the mutex and if its locked it will just queue the
packet and move on. The endpoint.UnlockUser() will process any backlog of
packets before unlocking the socket.

This simplifies the locking inside tcp endpoints a lot. Further the
endpoint.LockUser() implements spinning as long as the lock is not held by
another syscall goroutine. This ensures low latency as not spinning leads to the
task thread being put to sleep if the lock is held by the packet dispatch
path. This is suboptimal as the lower layer rarely holds the lock for long so
implementing spinning here helps.

If the lock is held by another task goroutine then we just proceed to call
LockUser() and the task could be put to sleep.

The protocol goroutines themselves just call e.mu.Lock() and block if the
lock is currently not available.

Updates #231, #357

PiperOrigin-RevId: 301808349
2020-03-19 07:19:58 -07:00
Nayana BidariandgVisor bot 43abb24657 Fix panic caused by invalid address for Bind in packet sockets.
PiperOrigin-RevId: 298476533
2020-03-02 16:31:52 -08:00
Andrei VaginandgVisor bot 42fb7d3491 socket: take readMu to access readView
DATA RACE in netstack.(*SocketOperations).fetchReadView

Write at 0x00c001dca138 by goroutine 1001:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*SocketOperations).fetchReadView()
      pkg/sentry/socket/netstack/netstack.go:418 +0x85
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*SocketOperations).coalescingRead()
      pkg/sentry/socket/netstack/netstack.go:2309 +0x67
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*SocketOperations).nonBlockingRead()
      pkg/sentry/socket/netstack/netstack.go:2378 +0x183d

Previous read at 0x00c001dca138 by goroutine 1111:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*SocketOperations).Ioctl()
      pkg/sentry/socket/netstack/netstack.go:2666 +0x533
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Ioctl()

Reported-by: syzbot+d4c3885fcc346f08deb6@syzkaller.appspotmail.com
PiperOrigin-RevId: 298387377
2020-03-02 10:33:15 -08:00
Nayana BidariandgVisor bot abf7ebcd38 Internal change.
PiperOrigin-RevId: 297638665
2020-02-27 11:00:41 -08:00
gVisor botandCopybara-Service 2daa21e4d7 Internal change.
PiperOrigin-RevId: 296088213
2020-02-19 16:48:57 -08:00
gVisor bot 56fd9504aa Enable IPV6_RECVTCLASS socket option for datagram sockets
Added the ability to get/set the IP_RECVTCLASS socket option on UDP endpoints.
If enabled, traffic class from the incoming Network Header passed as ancillary
data in the ControlMessages.

Adding Get/SetSockOptBool to decrease the overhead of getting/setting simple
options. (This was absorbed in a CL that will be landing before this one).

Test:
* Added unit test to udp_test.go that tests getting/setting as well as
verifying that we receive expected TOS from incoming packet.
* Added a syscall test for verifying getting/setting
* Removed test skip for existing syscall test to enable end to end test.
PiperOrigin-RevId: 295840218
2020-02-18 15:45:36 -08:00
gVisor bot 69bf39e8a4 Internal change.
PiperOrigin-RevId: 294952610
2020-02-13 10:59:52 -08:00
Eyal SohaandgVisor bot f3d9560703 recv() on a closed TCP socket returns ENOTCONN
From RFC 793 s3.9 p58 Event Processing:

If RECEIVE Call arrives in CLOSED state and the user has access to such a
connection, the return should be "error: connection does not exist"

Fixes #1598

PiperOrigin-RevId: 293494287
2020-02-05 17:56:42 -08:00
Ting-Yu WangandgVisor bot 665b614e4a Support RTM_NEWADDR and RTM_GETLINK in (rt)netlink.
PiperOrigin-RevId: 293271055
2020-02-04 18:05:03 -08:00
Bhasker HariharanandgVisor bot 51b783505b Add support for TCP_DEFER_ACCEPT.
PiperOrigin-RevId: 292233574
2020-01-29 15:53:45 -08:00