Commit Graph

2694 Commits

Author SHA1 Message Date
Andrei Vagin f97858011f Open a temp directory before changing capabilities and user ID-s
In cl/302130790, we started using a temp directory which is provided by bazel.

By default, a test process has enough permissions to open it, but there is not
any guarantee that it still will be able to do this after changing credentials.

PiperOrigin-RevId: 302702337
2020-03-24 10:58:51 -07:00
Bhasker Hariharan 7e4073af12 Move tcpip.PacketBuffer and IPTables to stack package.
This is a precursor to be being able to build an intrusive list
of PacketBuffers for use in queuing disciplines being implemented.

Updates #2214

PiperOrigin-RevId: 302677662
2020-03-24 09:06:26 -07:00
Ian Lewis a730d74b32 Support basic /proc/net/dev metrics for netstack
Fixes #506

PiperOrigin-RevId: 302540404
2020-03-23 16:12:58 -07:00
Bhasker Hariharan 369cf38bd7 Fix data race in SetSockOpt.
PiperOrigin-RevId: 302539171
2020-03-23 16:06:33 -07:00
Dean Deng 6eebaea949 Correctly release taskPathOperation for accessAt.
PiperOrigin-RevId: 302518924
2020-03-23 14:33:15 -07:00
Kevin Krakauer 8c35614760 iptables: enable iptables tests as nonblocking
PiperOrigin-RevId: 302506064
2020-03-23 13:36:26 -07:00
Eyal Soha fed59953aa Statically link libpthread for static c++ binaries.
The posix_server works fine when run in locally or in docker but fails in the
kokoro GCP build environment. Linking libpthread statically fixes it.

PiperOrigin-RevId: 302139082
2020-03-20 18:24:00 -07:00
Andrei Vagin d5fe1ce0c1 test: Create a separate /tmp mount only for tests with the shared tag
The root mount is not shared by default, but all other mounts are shared.

So if we create the /tmp mount, this means that we run tests on a shared mount
even if tests run without the --shared option.

PiperOrigin-RevId: 302130790
2020-03-20 17:20:24 -07:00
Bhasker Hariharan 1bf2e52bdb Actually wrap rand.Reader in bufio.Reader.
Updates #231

PiperOrigin-RevId: 302127697
2020-03-20 17:02:13 -07:00
Ting-Yu Wang 49aef9cee7 Remove unused variable `sndNxtList`.
PiperOrigin-RevId: 302110328
2020-03-20 15:25:15 -07:00
Dean Deng 248e46f320 Whitelist utimensat(2).
utimensat is used by hostfs for setting timestamps on imported fds. Previously,
this would crash the sandbox since utimensat was not allowed.

Correct the VFS2 version of hostfs to match the call in VFS1.

PiperOrigin-RevId: 301970121
2020-03-19 23:30:21 -07:00
Fabricio Voznika 069f1edbe4 Improve error message when pivot_root fails
PiperOrigin-RevId: 301949722
2020-03-19 20:18:03 -07:00
Zach Koopmans b9210b2855 Fix bm-tools to run on bazel.
Fixes random stuff that is broken on bazel/kokoro.
- random output coming back as "bytes" object instead of str
- missed syntax error in bazel
- a flag is missing in the version of gcloud on kokoro

PiperOrigin-RevId: 301915289
2020-03-19 16:07:05 -07:00
Zach Koopmans 57d9bd922b Remove the "frozen" bit from dirents.
Frozen was to lock down changes to the host filesystem
for hostFS. Now that hostFS is gone, it can be removed.

PiperOrigin-RevId: 301907923
2020-03-19 15:30:13 -07:00
Michael Pratt 238e80fe38 Automated rollback of changelist 300409401
PiperOrigin-RevId: 301891849
2020-03-19 14:10:37 -07:00
Eyal Soha e0fbcdcb7f Add packetimpact tests to presubmit and CI testing
PiperOrigin-RevId: 301872161
2020-03-19 12:33:29 -07:00
Jay Zhuang 8b461aa36b Remove redundant dep in BUILD
PiperOrigin-RevId: 301859066
2020-03-19 11:34:49 -07:00
Bhasker Hariharan 3a37f67917 Change SocketOperations.readMu to an RWMutex.
Also get rid of the readViewHasData as it's not required anymore.

Updates #231, #357

PiperOrigin-RevId: 301837227
2020-03-19 10:00:31 -07:00
Bhasker Hariharan fd27a917ef Address comments on workMu removal change.
Updates #231, #357

PiperOrigin-RevId: 301833669
2020-03-19 09:43:23 -07:00
Bhasker Hariharan e9e399c25d Remove workMu from tcpip.Endpoint.
workMu is removed and e.mu is now a mutex that supports TryLock.  The packet
processing path tries to lock the mutex and if its locked it will just queue the
packet and move on. The endpoint.UnlockUser() will process any backlog of
packets before unlocking the socket.

This simplifies the locking inside tcp endpoints a lot. Further the
endpoint.LockUser() implements spinning as long as the lock is not held by
another syscall goroutine. This ensures low latency as not spinning leads to the
task thread being put to sleep if the lock is held by the packet dispatch
path. This is suboptimal as the lower layer rarely holds the lock for long so
implementing spinning here helps.

If the lock is held by another task goroutine then we just proceed to call
LockUser() and the task could be put to sleep.

The protocol goroutines themselves just call e.mu.Lock() and block if the
lock is currently not available.

Updates #231, #357

PiperOrigin-RevId: 301808349
2020-03-19 07:19:58 -07:00
Dean Deng 3a42638a0b Port imported TTY fds to vfs2.
Refactor fs/host.TTYFileOperations so that the relevant functionality can be
shared with VFS2 (fsimpl/host.ttyFD).

Incorporate host.defaultFileFD into the default host.fileDescription. This way,
there is no need for a separate default_file.go. As in vfs1, the TTY file
implementation can be built on top of this default and override operations as
necessary (PRead/Read/PWrite/Write, Release, Ioctl).

Note that these changes still need to be plumbed into runsc, which refers to
imported TTYs in control/proc.go:ExecAsync.

Updates #1672.

PiperOrigin-RevId: 301718157
2020-03-18 19:12:10 -07:00
gVisor bot 79389f8abb Merge pull request #2187 from kevinGC:deflake-connectTCP
PiperOrigin-RevId: 301716568
2020-03-18 18:58:30 -07:00
Kevin Krakauer a8f9cc8798 iptables: deflake DropTCP*Port tests
These tests could timeout because net.DialTCP didn't respect the
timeout.
2020-03-18 18:16:33 -07:00
Andrei Vagin c3cee7f5a4 Deflake third_party/gvisor/pkg/gate/gate_test
TestConcurrentAll executes 1000 goroutines which never sleep,
so they are not preempted by Go's runtime. In Go 1.14, async preemption
has been added, but the added runtime.Gosched() call will do nothing
wrong in this case too.

PiperOrigin-RevId: 301705712
2020-03-18 17:42:29 -07:00
gVisor bot a0fed7ea45 Merge pull request #2061 from lubinszARM:pr_restart_syscall
PiperOrigin-RevId: 301700868
2020-03-18 17:11:43 -07:00
Ian Gudger 92a00ca91a Store segment transmit count.
This will aid in segment reordering detection.

Updates #691

PiperOrigin-RevId: 301692638
2020-03-18 16:26:36 -07:00
Kevin Krakauer b5ea65c07c iptables: skip tests for not-yet-supported features
PiperOrigin-RevId: 301686266
2020-03-18 15:52:57 -07:00
Fabricio Voznika f1d1af2a4a Fix FDTable.NewFDVFS2
It was looking at VFS1 table to determine where to
allocate the next FD from.

Updates #1035

PiperOrigin-RevId: 301678858
2020-03-18 15:13:42 -07:00
Kevin Krakauer fc16e64396 Automated rollback of changelist 301476456
PiperOrigin-RevId: 301650898
2020-03-18 13:08:11 -07:00
Eyal Soha 707664e0c4 Send the ACK later to stabilize the test.
PiperOrigin-RevId: 301614096
2020-03-18 10:18:13 -07:00
Bhasker Hariharan c29d4fc59e Automated rollback of changelist 301501607
PiperOrigin-RevId: 301578043
2020-03-18 06:36:43 -07:00
Bhasker Hariharan eddd6ce514 Wrap rand.Reader in a bufio.Reader.
rand.Read() results in a syscall to the host on every call instead
we can wrap it with a bufio.Reader to buffer and reduce number of syscalls.
This is especially important for TCP where every newly created endpoint
reads random data to initialize the timestamp offsets for the endpoint.

Updates #231

PiperOrigin-RevId: 301501607
2020-03-17 19:10:53 -07:00
Kevin Krakauer 1cc5a71a0e iptables: fix type in script name, mark some new tests as skipped
PiperOrigin-RevId: 301476456
2020-03-17 16:23:00 -07:00
Zach Koopmans 42d78ba61b Remove HostFS from Sentry.
PiperOrigin-RevId: 301402181
2020-03-17 10:30:32 -07:00
Eyal Soha 3192e55ffe Packetimpact in Go with c++ stub
PiperOrigin-RevId: 301382690
2020-03-17 08:53:27 -07:00
Andrei Vagin b55f0e5d40 fdtable: don't try to zap fdtable entry if close is called for non-existing fd
FDTable.setAll is used to zap entries, but it grows the table up to
a specified fd.

Reported-by: syzbot+9e281b0750d2d4caa190@syzkaller.appspotmail.com
PiperOrigin-RevId: 301280000
2020-03-16 18:29:58 -07:00
Fabricio Voznika 2a6c4369be Enforce file size rlimits in VFS2
Updates #1035

PiperOrigin-RevId: 301255357
2020-03-16 16:00:49 -07:00
Fabricio Voznika 0f60799a4f Add calls to vfs.CheckSetStat to fsimpls
Only gofer filesystem was calling vfs.CheckSetStat for
vfs.FilesystemImpl.SetStatAt and vfs.FileDescriptionImpl.SetStat.

Updates #1193, #1672, #1197

PiperOrigin-RevId: 301226522
2020-03-16 13:29:12 -07:00
Ting-Yu Wang 69da42885a Enable ARP resolution in TAP devices.
PiperOrigin-RevId: 301208471
2020-03-16 12:03:27 -07:00
gVisor bot 159a230b9b Merge pull request #1943 from kevinGC:ipt-filter-ip
PiperOrigin-RevId: 301197007
2020-03-16 11:13:14 -07:00
Bhasker Hariharan 52758e16e0 Prevent vnetHdr from escaping in WritePacket.
PiperOrigin-RevId: 301157950
2020-03-16 08:03:27 -07:00
Fabricio Voznika 9712775028 Disallow kernfs.Inode.SetStat for readonly inodes
Updates #1195, #1193

PiperOrigin-RevId: 300950993
2020-03-14 13:48:06 -07:00
Dean Deng 5e413cad10 Plumb VFS2 imported fds into virtual filesystem.
- When setting up the virtual filesystem, mount a host.filesystem to contain
  all files that need to be imported.
- Make read/preadv syscalls to the host in cases where preadv2 may not be
  supported yet (likewise for writing).
- Make save/restore functions in kernel/kernel.go return early if vfs2 is
  enabled.

PiperOrigin-RevId: 300922353
2020-03-14 07:14:33 -07:00
Fabricio Voznika 45a8ae240d Add remaining procfs files
Closes #1195

PiperOrigin-RevId: 300867055
2020-03-13 18:57:07 -07:00
Fabricio Voznika 829beebf0b Panic if file in FDTable has been destroyed
This will give more information about the file to
identify where possibly the extra DecRef()
would be.

PiperOrigin-RevId: 300855874
2020-03-13 17:18:10 -07:00
Jamie Liu b0f2c3e764 Fix infinite loop in semaphore.sem.wakeWaiters().
PiperOrigin-RevId: 300845134
2020-03-13 16:09:18 -07:00
Zach Koopmans d8cf54f20f Internal change
PiperOrigin-RevId: 300836270
2020-03-13 15:18:14 -07:00
Michael Pratt 6d4497de25 Fix typo
PiperOrigin-RevId: 300832988
2020-03-13 15:02:42 -07:00
Ghanan Gowripalan 645b1b2e9c Refactor SLAAC address state into SLAAC prefix state
Previously, SLAAC related state was stored on a per-address basis. This was
sufficient for the simple case of a single SLAAC address per prefix, but
future CLs will introduce temporary addresses which will result in multiple
SLAAC addresses for a prefix. This refactor allows storing multiple addresses
for a prefix in a single SLAAC prefix state.

No behaviour changes - existing tests continue to pass.

PiperOrigin-RevId: 300832812
2020-03-13 14:59:19 -07:00
Jamie Liu 1c05352970 Fix oom_score_adj.
- Make oomScoreAdj a ThreadGroup field (Linux: signal_struct::oom_score_adj).

- Avoid deadlock caused by Task.OOMScoreAdj()/SetOOMScoreAdj() locking Task.mu
  and TaskSet.mu in the wrong order (via Task.ExitState()).

PiperOrigin-RevId: 300814698
2020-03-13 13:19:13 -07:00