Commit Graph

3039 Commits

Author SHA1 Message Date
Bhasker Hariharan e838e7ab34 Automated rollback of changelist 310417191
PiperOrigin-RevId: 310963404
2020-05-11 12:09:06 -07:00
gVisor bot c5ab21b048 Internal change.
PiperOrigin-RevId: 310949277
2020-05-11 11:04:31 -07:00
Bhasker Hariharan 0cb9e1d021 Fix view.ToVectorisedView().
view.ToVectorisedView() now just returns an empty vectorised
view if the view is of zero length. Earlier it would return
a VectorisedView of zero length but with 1 empty view. This
has been a source of bugs as lower layers don't expect
zero length views in VectorisedViews.

VectorisedView.AppendView() now is a no-op if the view being
appended is of zero length.

Fixes #2658

PiperOrigin-RevId: 310942269
2020-05-11 10:35:28 -07:00
gVisor bot af2bc1c72a Internal change.
PiperOrigin-RevId: 310941717
2020-05-11 10:31:02 -07:00
Nicolas Lacasse c52195d258 Stop avoiding preadv2 and pwritev2, and add them to the filters.
Some code paths needed these syscalls anyways, so they should be included in
the filters. Given that we depend on these syscalls in some cases, there's no
real reason to avoid them any more.

PiperOrigin-RevId: 310829126
2020-05-10 17:52:20 -07:00
gVisor bot cfd30665c1 iptables - filter packets using outgoing interface.
Enables commands with -o (--out-interface) for iptables rules.
$ iptables -A OUTPUT -o eth0 -j ACCEPT

PiperOrigin-RevId: 310642286
2020-05-08 15:44:54 -07:00
Bhasker Hariharan e4d2d21f6b Add UDP send/recv packetimpact tests.
Fixes #2654

PiperOrigin-RevId: 310642216
2020-05-08 15:40:27 -07:00
Jamie Liu 21b71395a6 Pass flags to fsimpl/host.inode.open().
This has two effects: It makes flags passed to open("/proc/[pid]/fd/[hostfd]")
effective, and it prevents imported pipes/sockets/character devices from being
opened with O_NONBLOCK unconditionally (because the underlying host FD was set
to non-blocking in ImportFD()).

PiperOrigin-RevId: 310596062
2020-05-08 11:35:41 -07:00
Zeling Feng 5d7d5ed7d6 Send ACK to OTW SEQs/unacc ACKs in CLOSE_WAIT
This fixed the corresponding packetimpact test.

PiperOrigin-RevId: 310593470
2020-05-08 11:23:24 -07:00
gVisor bot c59e7b832c Merge pull request #2637 from avagin:make-vs-bazel
PiperOrigin-RevId: 310479788
2020-05-07 19:04:19 -07:00
Andrei Vagin 5d54ddcf03 make: exit with non-zero code if "bazel build" failed
Without this fix, make exits with zero code when bazel build failed:

$ make run TARGETS="--abra --kadabra"
ERROR: Unrecognized option: --abra
$ echo $?
0

Signed-off-by: Andrei Vagin <avagin@gmail.com>
2020-05-07 18:25:32 -07:00
Adin Scannell 5536073969 make: bazel docker container should clean itself up.
This change two does things:

1) Name the container based on the canonical directory path.

2) Allow the container to exit after bazel itself has exited.

The first is necessary to support multiple working directories,
while the second one allows these instances to clean up properly.

PiperOrigin-RevId: 310460748
2020-05-07 16:39:37 -07:00
Adin Scannell 7b4a913f36 Fix ARM64 build.
The common syscall definitions mean that ARM64-exclusive files need stubs in
the ARM64 build.

PiperOrigin-RevId: 310446698
2020-05-07 15:18:47 -07:00
Sam Balana 9242d3493d Capture range variable in parallel subtests
Only the last test was running before since the goroutines won't be executed
until after this loop. I added t.Log(test.name) and this is was the result:

TestListenNoAcceptNonUnicastV4/SourceUnspecified:    DestOtherMulticast
TestListenNoAcceptNonUnicastV4/DestUnspecified:      DestOtherMulticast
TestListenNoAcceptNonUnicastV4/DestOtherMulticast:   DestOtherMulticast
TestListenNoAcceptNonUnicastV4/SourceBroadcast:      DestOtherMulticast
TestListenNoAcceptNonUnicastV4/DestOurMulticast:     DestOtherMulticast
TestListenNoAcceptNonUnicastV4/DestBroadcast:        DestOtherMulticast
TestListenNoAcceptNonUnicastV4/SourceOtherMulticast: DestOtherMulticast
TestListenNoAcceptNonUnicastV4/SourceOurMulticast:   DestOtherMulticast

https://github.com/golang/go/wiki/TableDrivenTests#parallel-testing

PiperOrigin-RevId: 310440629
2020-05-07 14:46:51 -07:00
Jamie Liu 9115f26851 Allocate device numbers for VFS2 filesystems.
Updates #1197, #1198, #1672

PiperOrigin-RevId: 310432006
2020-05-07 14:01:53 -07:00
Adin Scannell 1f4087e7cd Fix tags used for determining file sets.
Updates #2569
Updates #2298

PiperOrigin-RevId: 310423629
2020-05-07 13:19:01 -07:00
Bhasker Hariharan 28b5565fdd Automated rollback of changelist 309339316
PiperOrigin-RevId: 310417191
2020-05-07 12:48:23 -07:00
Nicolas Lacasse d0b1d0233d Move pkg/sentry/vfs/{eventfd,timerfd} to new packages in pkg/sentry/fsimpl.
They don't depend on anything in VFS2, so they should be their own packages.

PiperOrigin-RevId: 310416807
2020-05-07 12:44:03 -07:00
gVisor bot 92cab8e2c3 Internal change.
PiperOrigin-RevId: 310409922
2020-05-07 12:10:02 -07:00
Nicolas Lacasse 26c60d7d5d Port signalfd to vfs2.
PiperOrigin-RevId: 310404113
2020-05-07 11:41:50 -07:00
Bhasker Hariharan 08f4846ebe Fix bugs in SACK recovery.
Every call to sender.NextSeg does not need to iterate from the
front of the writeList as in a given recovery episode we can cache
the last nextSeg returned. There cannot be a lower sequenced segment
that matches the next call to NextSeg as otherwise we would have
returned that instead in the previous call.

This fixes the issue of excessive CPU usage w/ large send buffers
where we spend a lot of time iterating from the front of the list on
every NextSeg invocation.

Further the following other bugs were also fixed:
  * Iteration of segments never sent in NextSeg() when looking for segments for
    retransmission that match step1/3/4 of the NextSeg algorithm
  * Correctly setting rescueRxt only if the rescue segment was actually sent.
  * Correctly initializing rescueRxt/highRxt when entering SACK recovery.
  * Correctly re-arming the timer only on retransmissions when SACK is in use
    and not for every segment being sent as it was being done before.
  * Copy over xmitTime and xmitCount on segment clone.
  * Move writeNext along when skipping over SACKED segments. This is required
    to prevent spurious retransmissions where we end up retransmitting data
    that was never lost.

PiperOrigin-RevId: 310387671
2020-05-07 10:26:00 -07:00
Dean Deng 16da7e790f Update privateunixsocket TODOs.
Synthetic sockets do not have the race condition issue in VFS2, and we will
get rid of privateunixsocket as well.

Fixes #1200.

PiperOrigin-RevId: 310386474
2020-05-07 10:20:48 -07:00
gVisor bot 553da2cdc8 Merge pull request #2639 from kevinGC:ipv4-frag-reassembly-test
PiperOrigin-RevId: 310380911
2020-05-07 09:58:30 -07:00
Dean Deng e0089a20e4 Remove outdated TODO for VFS2 AccessAt.
Fixes #1965.

PiperOrigin-RevId: 310380433
2020-05-07 09:53:52 -07:00
Kevin Krakauer 763b5ad596 Add basic incoming ipv4 fragment tests
Based on ipv6's TestReceiveIPv6Fragments.
2020-05-06 22:45:21 -07:00
gVisor bot feece24bf5 Merge pull request #2570 from lubinszARM:pr_clean
PiperOrigin-RevId: 310259686
2020-05-06 17:19:55 -07:00
Jamie Liu 7cd54c1f14 Remove vfs.FileDescriptionOptions.InvalidWrite.
Compare:
https://elixir.bootlin.com/linux/v5.6/source/fs/timerfd.c#L431
PiperOrigin-RevId: 310246908
2020-05-06 16:08:12 -07:00
Ghanan Gowripalan 485ca36adf Do not assume no DHCPv6 configurations
Do not assume that networks need any DHCPv6 configurations. Instead,
notify the NDP dispatcher in response to the first NDP RA's DHCPv6
flags, even if the flags indicate no DHCPv6 configurations are
available.

PiperOrigin-RevId: 310245068
2020-05-06 15:59:08 -07:00
Adin Scannell 279f1eb7ab Fix runsc syscall documentation generation.
We can register any number of tables with any number of architectures, and
need not limit the definitions to the architecture in question. This allows
runsc to generate documentation for all architectures simultaneously.

Similarly, this simplifies the VFSv2 patching process.

PiperOrigin-RevId: 310224827
2020-05-06 14:13:48 -07:00
Kevin Krakauer b08222cf3a sniffer: fix accidental logging of good packets as bad
We need to check vv.Size() instead of len(tcp), as tcp will always be 20 bytes
long.

PiperOrigin-RevId: 310218351
2020-05-06 13:38:36 -07:00
gVisor bot 4631de620a Internal change.
PiperOrigin-RevId: 310213705
2020-05-06 13:13:48 -07:00
Nicolas Lacasse 591ff0e424 Add maximum memory limit.
PiperOrigin-RevId: 310179277
2020-05-06 10:30:18 -07:00
gVisor bot 8416da33d2 Internal change.
PiperOrigin-RevId: 310057834
2020-05-05 17:58:47 -07:00
Andrei Vagin 9509c0b388 gvisor/test: use RetryEINTR for connect()
connect() returns EINTR after S/R and usually we
use RetryEINTR to workaround this.

PiperOrigin-RevId: 310038525
2020-05-05 16:01:00 -07:00
Mithun Iyer e590314fec Support TCP zero window probes.
As per RFC 1122 4.2.2.17, when the remote advertizes zero receive window,
the sender needs to probe for the window-size to become non-zero starting
from the next retransmission interval. The TCP connection needs to be kept
open as long as the remote is acknowledging the zero window probes.
We reuse the retransmission timers to support this.

Fixes #1644

PiperOrigin-RevId: 310021575
2020-05-05 14:30:52 -07:00
gVisor bot e5d9e7c3b2 Internal change.
PiperOrigin-RevId: 310001058
2020-05-05 12:43:28 -07:00
Dean Deng faf89dd31a Update vfs2 socket TODOs.
Three updates:
- Mark all vfs2 socket syscalls as supported.
- Use the same dev number and ino number generator for all types of sockets,
  unlike in VFS1.
- Do not use host fd for hostinet metadata.

Fixes #1476, #1478, #1484, 1485, #2017.

PiperOrigin-RevId: 309994579
2020-05-05 12:11:14 -07:00
Dean Deng a6dbf9596d Update comments for synthetic gofer files in vfs2.
PiperOrigin-RevId: 309966538
2020-05-05 10:01:28 -07:00
Fabricio Voznika b3bd41434c Return correct name for imported host files
Implement PrependPath() in host.filesystem to correctly format
name for host files.

Updates #1672

PiperOrigin-RevId: 309959135
2020-05-05 09:21:14 -07:00
Jamie Liu 35951c3671 Translate p9.NoUID/GID to OverflowUID/GID.
p9.NoUID/GID (== uint32(-1) == auth.NoID) is not a valid auth.KUID/KGID; in
particular, using it for file ownership causes capabilities to be ineffective
since file capabilities require that the file's KUID and KGID are mapped into
the capability holder's user namespace [1], and auth.NoID is not mapped into
any user namespace. Map p9.NoUID/GID to a different, valid KUID/KGID; in the
unlikely case that an application actually using the overflow KUID/KGID
attempts an operation that is consequently permitted by client permission
checks, the remote operation will still fail with EPERM.

Since this changes the VFS2 gofer client to no longer ignore the invalid IDs
entirely, this CL both permits and requires that we change synthetic mount point
creation to use root credentials.

[1] See fs.Inode.CheckCapability or vfs.GenericCheckPermissions.

PiperOrigin-RevId: 309856455
2020-05-05 09:19:52 -07:00
Nicolas Lacasse da71dc7fdd Port eventfd to VFS2.
And move sys_timerfd.go to just timerfd.go for consistency.

Updates #1475.

PiperOrigin-RevId: 309835029
2020-05-04 16:02:07 -07:00
gVisor bot e7ed68d225 Internal change.
PiperOrigin-RevId: 309832671
2020-05-04 15:48:45 -07:00
Fabricio Voznika 57dbd7f362 Remove kernfs.Filesystem cast from GenericDirectoryFD
This allows for kerfs.Filesystem to be overridden by
different implementations.

Updates #1672

PiperOrigin-RevId: 309809321
2020-05-04 13:40:37 -07:00
Andrei Vagin 006f978829 Deflake //third_party/gvisor/test/syscalls:proc_test_native
There is the known issue of the linux procfs, that two consequent calls of
readdir can return the same entry twice if between these calls one or more
entries have been removed from this directory.

PiperOrigin-RevId: 309803066
2020-05-04 12:58:24 -07:00
gVisor bot 660a1a1028 Internal change.
PiperOrigin-RevId: 309801320
2020-05-04 12:49:29 -07:00
Fabricio Voznika e2b0e0e272 Enable TestRunNonRoot on VFS2
Also added back the default test dimension back which was
dropped in a previous refactor.

PiperOrigin-RevId: 309797327
2020-05-04 12:29:03 -07:00
Fabricio Voznika 0a307d0072 Mount VSFS2 filesystem using root credentials
PiperOrigin-RevId: 309787938
2020-05-04 11:48:00 -07:00
gVisor bot 711439b1c3 Merge pull request #2275 from nybidari:iptables
PiperOrigin-RevId: 309783486
2020-05-04 11:23:55 -07:00
Fabricio Voznika cbc5bef2a6 Add TTY support on VFS2 to runsc
Updates #1623, #1487

PiperOrigin-RevId: 309777922
2020-05-04 10:59:20 -07:00
Adin Scannell 2c986870e3 Fix flaky monotonic time.
This change ensures that even platforms with some TSC issues (e.g. KVM),
can get reliable monotonic time by applied a lower bound on each read.

PiperOrigin-RevId: 309773801
2020-05-04 10:40:51 -07:00