summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2020-05-06Clean-up documentation.Adin Scannell
2020-05-06Add powered by gVisor logo.Adin Scannell
2020-05-06Fixup link in CODE_OF_CONDUCT.md.Adin Scannell
2020-05-06Fixup transitions for navbar.Adin Scannell
2020-05-06Add note about AArch64 support.Adin Scannell
2020-05-06Add resource model.Adin Scannell
2020-05-06Update main landing page.Adin Scannell
2020-05-06Adapt website to use g3doc sources and bazel.Adin Scannell
This adapts the merged website repository to use the image and bazel build framework. It explicitly avoids the container_image rules provided by bazel, opting instead to build with direct docker commands when necessary. The relevant build commands are incorporated into the top-level Makefile.
2020-05-06Fix cache permissions.Adin Scannell
2020-05-06Move new post image.Adin Scannell
2020-05-06Update minor formatting issues.Adin Scannell
2020-05-06Add governance and security policies.Adin Scannell
2020-05-06Merge gvisor-websiteAdin Scannell
2020-05-06Fix runsc syscall documentation generation.Adin Scannell
We can register any number of tables with any number of architectures, and need not limit the definitions to the architecture in question. This allows runsc to generate documentation for all architectures simultaneously. Similarly, this simplifies the VFSv2 patching process. PiperOrigin-RevId: 310224827
2020-05-06sniffer: fix accidental logging of good packets as badKevin Krakauer
We need to check vv.Size() instead of len(tcp), as tcp will always be 20 bytes long. PiperOrigin-RevId: 310218351
2020-05-06Internal change.gVisor bot
PiperOrigin-RevId: 310213705
2020-05-06Add maximum memory limit.Nicolas Lacasse
PiperOrigin-RevId: 310179277
2020-05-05Internal change.gVisor bot
PiperOrigin-RevId: 310057834
2020-05-05gvisor/test: use RetryEINTR for connect()Andrei Vagin
connect() returns EINTR after S/R and usually we use RetryEINTR to workaround this. PiperOrigin-RevId: 310038525
2020-05-05Support TCP zero window probes.Mithun Iyer
As per RFC 1122 4.2.2.17, when the remote advertizes zero receive window, the sender needs to probe for the window-size to become non-zero starting from the next retransmission interval. The TCP connection needs to be kept open as long as the remote is acknowledging the zero window probes. We reuse the retransmission timers to support this. Fixes #1644 PiperOrigin-RevId: 310021575
2020-05-05Internal change.gVisor bot
PiperOrigin-RevId: 310001058
2020-05-05Update vfs2 socket TODOs.Dean Deng
Three updates: - Mark all vfs2 socket syscalls as supported. - Use the same dev number and ino number generator for all types of sockets, unlike in VFS1. - Do not use host fd for hostinet metadata. Fixes #1476, #1478, #1484, 1485, #2017. PiperOrigin-RevId: 309994579
2020-05-05Update comments for synthetic gofer files in vfs2.Dean Deng
PiperOrigin-RevId: 309966538
2020-05-05Return correct name for imported host filesFabricio Voznika
Implement PrependPath() in host.filesystem to correctly format name for host files. Updates #1672 PiperOrigin-RevId: 309959135
2020-05-05Translate p9.NoUID/GID to OverflowUID/GID.Jamie Liu
p9.NoUID/GID (== uint32(-1) == auth.NoID) is not a valid auth.KUID/KGID; in particular, using it for file ownership causes capabilities to be ineffective since file capabilities require that the file's KUID and KGID are mapped into the capability holder's user namespace [1], and auth.NoID is not mapped into any user namespace. Map p9.NoUID/GID to a different, valid KUID/KGID; in the unlikely case that an application actually using the overflow KUID/KGID attempts an operation that is consequently permitted by client permission checks, the remote operation will still fail with EPERM. Since this changes the VFS2 gofer client to no longer ignore the invalid IDs entirely, this CL both permits and requires that we change synthetic mount point creation to use root credentials. [1] See fs.Inode.CheckCapability or vfs.GenericCheckPermissions. PiperOrigin-RevId: 309856455
2020-05-04Port eventfd to VFS2.Nicolas Lacasse
And move sys_timerfd.go to just timerfd.go for consistency. Updates #1475. PiperOrigin-RevId: 309835029
2020-05-04Internal change.gVisor bot
PiperOrigin-RevId: 309832671
2020-05-04Remove kernfs.Filesystem cast from GenericDirectoryFDFabricio Voznika
This allows for kerfs.Filesystem to be overridden by different implementations. Updates #1672 PiperOrigin-RevId: 309809321
2020-05-04Deflake //third_party/gvisor/test/syscalls:proc_test_nativeAndrei Vagin
There is the known issue of the linux procfs, that two consequent calls of readdir can return the same entry twice if between these calls one or more entries have been removed from this directory. PiperOrigin-RevId: 309803066
2020-05-04Internal change.gVisor bot
PiperOrigin-RevId: 309801320
2020-05-04Enable TestRunNonRoot on VFS2Fabricio Voznika
Also added back the default test dimension back which was dropped in a previous refactor. PiperOrigin-RevId: 309797327
2020-05-04Mount VSFS2 filesystem using root credentialsFabricio Voznika
PiperOrigin-RevId: 309787938
2020-05-04Merge pull request #2275 from nybidari:iptablesgVisor bot
PiperOrigin-RevId: 309783486
2020-05-04Add TTY support on VFS2 to runscFabricio Voznika
Updates #1623, #1487 PiperOrigin-RevId: 309777922
2020-05-04Fix flaky monotonic time.Adin Scannell
This change ensures that even platforms with some TSC issues (e.g. KVM), can get reliable monotonic time by applied a lower bound on each read. PiperOrigin-RevId: 309773801
2020-05-01Fix include type.Adin Scannell
PiperOrigin-RevId: 309506957
2020-05-01Run labeller only for non-forked pull requests.Adin Scannell
Otherwise the labeller will generate an error each time. PiperOrigin-RevId: 309505731
2020-05-01Support for connection tracking of TCP packets.Nayana Bidari
Connection tracking is used to track packets in prerouting and output hooks of iptables. The NAT rules modify the tuples in connections. The connection tracking code modifies the packets by looking at the modified tuples.
2020-05-01Regenerate SLAAC address on conflicts with the NICGhanan Gowripalan
If the NIC already has a generated SLAAC address, regenerate a new SLAAC address until one is generated that does not conflict with the NIC's existing addresses, up to a maximum of 10 attempts. This applies to both stable and temporary SLAAC addresses. Test: stack_test.TestMixedSLAACAddrConflictRegen PiperOrigin-RevId: 309495628
2020-05-01Automated rollback of changelist 308674219Kevin Krakauer
PiperOrigin-RevId: 309491861
2020-05-01Internal change.gVisor bot
PiperOrigin-RevId: 309467878
2020-05-01Port netstack, hostinet, and netlink sockets to VFS2.Dean Deng
All three follow the same pattern: 1. Refactor VFS1 sockets into socketOpsCommon, so that most of the methods can be shared with VFS2. 2. Create a FileDescriptionImpl with the corresponding socket operations, rewriting the few that cannot be shared with VFS1. 3. Set up a VFS2 socket provider that creates a socket by setting up a dentry in the global Kernel.socketMount and connecting it with a new FileDescription. This mostly completes the work for porting sockets to VFS2, and many syscall tests can be enabled as a result. There are several networking-related syscall tests that are still not passing: 1. net gofer tests 2. socketpair gofer tests 2. sendfile tests (splice is not implemented in VFS2 yet) Updates #1478, #1484, #1485 PiperOrigin-RevId: 309457331
2020-04-30Enable FIFO QDisc by default in runsc.Bhasker Hariharan
Updates #231 PiperOrigin-RevId: 309339316
2020-04-30FIFO QDisc implementationBhasker Hariharan
Updates #231 PiperOrigin-RevId: 309323808
2020-04-30Add gofer.InternalFilesystemOptions.LeakConnection.Jamie Liu
PiperOrigin-RevId: 309317605
2020-04-30Implement waiter.Waitable methods on VFS2 host inodes.Nicolas Lacasse
This fixes bash in Ubuntu. Updates #1672. PiperOrigin-RevId: 309298252
2020-04-30Allow to run kvm syscall tests on the RBE clusterAndrei Vagin
PiperOrigin-RevId: 309265978
2020-04-30Prefer temporary addressesGhanan Gowripalan
Implement rule 7 of Source Address Selection RFC 6724 section 5. This makes temporary (short-lived) addresses preferred over non-temporary addresses when earlier rules are equal. Test: stack_test.TestIPv6SourceAddressSelectionScopeAndSameAddress PiperOrigin-RevId: 309250975
2020-04-30Fix proc net bugs in VFS2.Dean Deng
The /proc/net/udp header was missing, and /proc/sys/net was set up as /proc/sys/net/net. Discovered while trying to run networking tests for VFS2. PiperOrigin-RevId: 309243758
2020-04-30Make tcp_close_wait_ack_test more accurateZeling Feng
Previously the test used an out-dated window size which is advertised during the handshake to generate testing packets, but the window size has changed since the handshake; currently it is using the most recent one which is advertised in DUT's ACK to our FIN packet to generate the testing outside-the-window packets. PiperOrigin-RevId: 309222921
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-11 18:49:12 +0000