Commit Graph

4220 Commits

Author SHA1 Message Date
Kevin Krakauer bd69afdcd1 Count packets dropped by iptables in IPStats
PiperOrigin-RevId: 332486383
2020-09-18 11:13:19 -07:00
gVisor bot dedef43923 Merge pull request #3972 from btw616:fix/comments
PiperOrigin-RevId: 332486111
2020-09-18 11:07:31 -07:00
Mithun Iyer fcf8d7c6dd Enqueue TCP sends arriving in SYN_SENT state.
TCP needs to enqueue any send requests arriving when the connection is in
SYN_SENT state. The data should be sent out soon after completion of the
connection handshake.

Fixes #3995

PiperOrigin-RevId: 332482041
2020-09-18 10:49:21 -07:00
Fabricio Voznika 93fd164fa2 Add "Containing a Real Vulnerability" blog post
PiperOrigin-RevId: 332477119
2020-09-18 10:28:07 -07:00
Rahat Mahmood ef7d9a6fcd Fix definition of SchedParam.
Linux defines this struct as:

struct sched_param {
  int priority;
}

... in include/linux/sched.h.

PiperOrigin-RevId: 332473133
2020-09-18 10:09:14 -07:00
Michael Pratt 313e1988c4 Drop ARCH_GET_FS
Go does not call arch_prctl(ARCH_GET_FS), nor am I sure it ever did. Drop the
filter.

PiperOrigin-RevId: 332470532
2020-09-18 09:57:27 -07:00
Ghanan Gowripalan 360006d894 Use common parsing utilities when sniffing
Extract parsing utilities so they can be used by the sniffer.

Fixes #3930

PiperOrigin-RevId: 332401880
2020-09-18 00:48:09 -07:00
Rahat Mahmood 07d832dbb5 fuse.DeviceFD needs to hold a reference on the associated filesystem.
This fixes a use-after-free in fuse.DeviceFD.Release.

PiperOrigin-RevId: 332394146
2020-09-17 23:37:41 -07:00
Kevin Krakauer 2fbd31e726 Test IPv4 WritePackets stats
IPv6 tests will be added in another CL along with ip6tables.

PiperOrigin-RevId: 332389102
2020-09-17 22:50:53 -07:00
Kevin Krakauer 0b8d306e64 ip6tables: filter table support
`ip6tables -t filter` is now usable. NAT support will come in a future CL.

#3549

PiperOrigin-RevId: 332381801
2020-09-17 21:54:48 -07:00
Nayana Bidari d34bda0273 {Set,Get} SO_LINGER on all endpoints.
SO_LINGER is a socket level option and should be stored on all endpoints even
though it is used to linger only for TCP endpoints.

PiperOrigin-RevId: 332369252
2020-09-17 20:00:33 -07:00
Ayush Ranjan c0b74be54c Fix root tests target in Makefile.
PiperOrigin-RevId: 332358833
2020-09-17 18:27:10 -07:00
Ayush Ranjan 23fcbd8722 [testing] Use container address to talk to server running inside container.
Docker does not have IPv6 port forwarding as tracked by the following issue:
https://github.com/moby/moby/issues/11518

So when running bazel itself inside a docker container, we can not use the host
port bindings to communicate with sockets inside the container. This was causing
integration tests and image tests to fail when run through our Makefile targets.

PiperOrigin-RevId: 332355051
2020-09-17 17:58:08 -07:00
Chong Cai 1e8beb5f1d Change sizeofInt32 to string size
This constant is used to represent int32 stored in file xattrs. The
integers are stored as strings there, so the real size should be the
string size (number of digits) instead of an int size (4 bytes).

PiperOrigin-RevId: 332353217
2020-09-17 17:44:58 -07:00
Chong Cai f1f844daab Set mode when creating Merkle tree file
PiperOrigin-RevId: 332340342
2020-09-17 16:28:43 -07:00
Dean Deng 319d1b8ba0 Complete vfs2 implementation of fallocate.
This change includes overlay, special regular gofer files, and hostfs.

Fixes #3589.

PiperOrigin-RevId: 332330860
2020-09-17 15:38:44 -07:00
gVisor bot 8070cc3386 Merge pull request #3979 from jinmouil:feature/fuse-fix
PiperOrigin-RevId: 332328860
2020-09-17 15:28:36 -07:00
Bhasker Hariharan a4db85fff2 Return ENOPROTOOPT for all SOL_PACKET options.
This is required to make tcpdump work. tcpdump falls back to not using things
like PACKET_RX_RING if setsockopt returns ENOPROTOOPT. This used to be the case
before 6f8fb7e0db.

Fixes #3981

PiperOrigin-RevId: 332326517
2020-09-17 15:16:54 -07:00
Jinmou Li 15f50c8da6 Fix kernfs unlinkat and rmdirat incorrect resolved path name 2020-09-17 21:07:12 +00:00
Ayush Ranjan d796b100ec Provide testing container with docker config file.
This is needed by test/e2e/integration_test:TestCheckpointRestore to check for
filesystem versioning.

PiperOrigin-RevId: 332285566
2020-09-17 12:11:41 -07:00
Fabricio Voznika da07e38f7c Remove option to panic gofer
Gofer panics are suppressed by p9 server and an error
is returned to the caller, making it effectively the
same as returning EROFS.

PiperOrigin-RevId: 332282959
2020-09-17 12:01:45 -07:00
Jamie Liu f0b1bd434e Deflake vdso_clock_gettime test.
PiperOrigin-RevId: 332281930
2020-09-17 11:59:55 -07:00
Jamie Liu 51a2fe8eb4 Disable nodejs12.4 test async-hooks/test-statwatcher.
PiperOrigin-RevId: 332281912
2020-09-17 11:53:10 -07:00
Fabricio Voznika a11061d78a Add VFS2 overlay support in runsc
All tests under runsc are passing with overlay enabled.

Updates #1487, #1199

PiperOrigin-RevId: 332181267
2020-09-17 01:09:42 -07:00
Tiwei Bie ed4570e6f0 fsimpl: improve the "implements" comments
As noticed by @ayushr2, the "implements" comments are not
consistent, e.g.

// IterDirents implements kernfs.inodeDynamicLookup.
// Generate implements vfs.DynamicBytesSource.Generate.

This patch improves this by making the comments like this
consistently include the package name (when the interface
and struct are not in the same package) and method name.

Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
2020-09-17 11:45:09 +08:00
gVisor bot ae59e52979 Merge pull request #3934 from avagin:feature/fuse
PiperOrigin-RevId: 332122081
2020-09-16 17:12:57 -07:00
Chong Cai 2868308555 Implement OpenAt() for verity fs
OpenAt() for verity fs is implemented by opening both the target file or
directory and the corresponding Merkle tree file in the underlying file
system. Generally they are only open for read. In allowRuntimeEnable
mode, the Merkle tree file is also open for write.

PiperOrigin-RevId: 332116423
2020-09-16 16:43:34 -07:00
Zeling Feng 64aae6bbd6 Cleanup device name confusion in packetimpact testbench
There are two device names on the test net.
- The sniffer/injector device which is always a linux device. Only the
testbench library is interested in this device.
- The device which is on the DUT. It happens to be the same device as
the former if DUT is linux. An individual test might be interested in
this device if the test cares about the device name.

PiperOrigin-RevId: 332112968
2020-09-16 16:26:10 -07:00
Nayana Bidari b6d165fe98 Automated rollback of changelist 329526153
PiperOrigin-RevId: 332097286
2020-09-16 15:06:55 -07:00
Ghanan Gowripalan 29ce0ad160 Bind loopback subnets' lifetime to perm address
The lifetime of addreses in a loopback interface's associated subnets
should be bound to their respective permanent addresses.

This change also fixes a race when the stack attempts to get an IPv4
rereferencedNetworkEndpoint for an address in an associated subnet on
a loopback interface. Before this change, the stack would only check
if an IPv4 address is contained in an associated subnet while holding
a read lock but wouldn't do this same check after releasing the read
lock for a write lock to create a temporary address. This may cause
the stack to bind the lifetime of the address to a new (temporary)
endpoint instead of the associated subnet's permanent address.

Test: integration_test.TestLoopbackSubnetLifetimeBoundToAddr
PiperOrigin-RevId: 332094719
2020-09-16 14:56:52 -07:00
Chong Cai 3749e70a69 Implement PRead for verity fs
PRead is implemented by read from the underlying file in blocks, and
verify each block. The verified contents are saved into the output
buffer.

PiperOrigin-RevId: 332092267
2020-09-16 14:45:39 -07:00
Ting-Yu Wang 666397c5c8 Gracefully translate unknown errno.
Neither POSIX.1 nor Linux defines an upperbound for errno.

PiperOrigin-RevId: 332085017
2020-09-16 14:12:22 -07:00
Ayush Ranjan 0356c7ef32 [runtime tests] Add documentation.
Added a README describing what these tests are, how they work and how to run
them locally. Also reorganized the exclude files into a directory.

PiperOrigin-RevId: 332079697
2020-09-16 13:48:26 -07:00
gVisor bot 49857849f9 Merge pull request #3893 from lubinszARM:pr_n1_03
PiperOrigin-RevId: 332069743
2020-09-16 13:03:01 -07:00
Jinmou Li c4c302a27e fuse: fix data race in fusefs Release()
fix #3956
2020-09-16 12:22:17 -07:00
Jinmou Li 70cf503b4c fuse: fix FUSE_RELEASE reply handling
fix #3963
2020-09-16 12:22:17 -07:00
Jinmou Li 26879c32b8 FUSE readdir test fix ino initialization 2020-09-16 12:22:17 -07:00
Jinmou Li 5c080f07de Update fuse.md design doc with design details 2020-09-16 12:22:17 -07:00
Andrei Vagin 5bf05ad3ce test/fuse: use the getdents syscall instead of opendir/readdir
opendir() is a libc wrapper. Different libc-s can implement it
differently.
2020-09-16 12:22:17 -07:00
Andrei Vagin 99fca1bf9a test/fuse: clean up 2020-09-16 12:22:17 -07:00
Jinmou Li 96fb1e60c3 Fix FUSE connection control lock ordering and race in unit test 2020-09-16 12:22:17 -07:00
Andrei Vagin 3ea925a423 fuse: don't pass lock by value
copylocks: directory.go:34:7: Allocate passes lock by value:
fuse/fuse.directoryFD contains fuse/fuse.fileDescription contains
pkg/sentry/vfs/vfs.FileDescription contains pkg/sync/sync.Mutex
2020-09-16 12:22:17 -07:00
Andrei Vagin 92a020c798 fuse: fix a compile time error
readdir_test.cc:134:24: error: variable length arrays are a C99 feature [-Werror,-Wvla-extension]
  char readdir_payload[readdir_payload_size];
2020-09-16 12:22:17 -07:00
Andrei Vagin f148242aba Revert "fuse: add benchmarking support for FUSE"
test/fuse/benchmark/read_benchmark.cc:34: Failure
Expected: (fuse_prefix) != (nullptr), actual: NULL vs (nullptr)
external/com_google_benchmark/src/benchmark_runner.cc:120: RunInThread:
Check `st.iterations() >= st.max_iterations' failed. Benchmark returned
before State::KeepRunning() returned false!
--- FAIL: Benchmarks_BM_Read/262144/real_time (0.29s)
    runner.go:502: test "Benchmarks.BM_Read/262144/real_time" failed
    with error exit status 134, want nil
FAIL
2020-09-16 12:22:17 -07:00
Jinmou Li 113928754c Fix FUSE unit test after vfs interface change 2020-09-16 12:22:17 -07:00
Jinmou Li 093b0ab6c5 Fix FUSE go unit test merge conflict mistake 2020-09-16 12:22:14 -07:00
Ghanan Gowripalan 87c5c0ad25 Receive broadcast packets on interested endpoints
When a broadcast packet is received by the stack, the packet should be
delivered to each endpoint that may be interested in the packet. This
includes all any address and specified broadcast address listeners.

Test: integration_test.TestReuseAddrAndBroadcast
PiperOrigin-RevId: 332060652
2020-09-16 12:20:45 -07:00
Andrei Vagin c6e749fb32 fs/fuse: Move the 'marshal' and 'primitive' packages to the 'pkg' directory. 2020-09-16 12:19:30 -07:00
Boyuan He 8ab32686e2 fuse_open: add padding to open out request 2020-09-16 12:19:30 -07:00
Craig Chi dd10352729 Unexport fusefs.inode.nodeID 2020-09-16 12:19:30 -07:00