summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2020-11-02Clean up the code of setupTimeWaitCloseAndrei Vagin
The active_closefd has to be shutdown only for write, otherwise the second poll will always return immediately. The second poll should not be called from a separate thread. PiperOrigin-RevId: 340319071
2020-11-02Pass hashing algorithms in verity fs optsChong Cai
PiperOrigin-RevId: 340275942
2020-11-02Automated rollback of changelist 339945377Dean Deng
PiperOrigin-RevId: 340274194
2020-11-02Block external network for testsAndrei Vagin
And in this case, tests will run in separate network namespaces and will not affect each other. PiperOrigin-RevId: 340267734
2020-11-01Fix returned error when deleting non-existant addressIan Lewis
PiperOrigin-RevId: 340149214
2020-10-31net/tcpip: connect to unset loopback address has to return EADDRNOTAVAILAndrei Vagin
In the docker container, the ipv6 loopback address is not set, and connect("::1") has to return ENEADDRNOTAVAIL in this case. Without this fix, it returns EHOSTUNREACH. PiperOrigin-RevId: 340002915
2020-10-30Adjust error handling in kernfs rename.Dean Deng
Read-only directories (e.g. under /sys, /proc) should return EPERM for rename. PiperOrigin-RevId: 339979022
2020-10-30Fix rename error handling for VFS2 kernfs.Dean Deng
The non-errno error was causing panics before. PiperOrigin-RevId: 339969348
2020-10-30Automated rollback of changelist 339750876Dean Deng
PiperOrigin-RevId: 339945377
2020-10-30Separate kernel.Task.AsCopyContext() into CopyContext() and OwnCopyContext().Jamie Liu
kernel.copyContext{t} cannot be used outside of t's task goroutine, for three reasons: - t.CopyScratchBuffer() is task-goroutine-local. - Calling t.MemoryManager() without running on t's task goroutine or locking t.mu violates t.MemoryManager()'s preconditions. - kernel.copyContext passes t as context.Context to MM IO methods, which is illegal outside of t's task goroutine (cf. kernel.Task.Value()). Fix this by splitting AsCopyContext() into CopyContext() (which takes an explicit context.Context and is usable outside of the task goroutine) and OwnCopyContext() (which uses t as context.Context, but is only usable by t's task goroutine). PiperOrigin-RevId: 339933809
2020-10-30Merge pull request #4564 from zhlhahaha:1981gVisor bot
PiperOrigin-RevId: 339921446
2020-10-30Add the gVisor admission webhookKevin Krakauer
PiperOrigin-RevId: 339913577
2020-10-30Avoid creating users if user is root already.Adin Scannell
PiperOrigin-RevId: 339886754
2020-10-29Add IPv4 reassembly packetimpact testArthur Sfez
The IPv6 reassembly test was also refactored to be easily extended with more cases. PiperOrigin-RevId: 339768605
2020-10-29[infra] Deflake Go / generate (pull_request.Ayush Ranjan
#4673 does not seem to work. Try this new approach. PiperOrigin-RevId: 339754794
2020-10-29Automated rollback of changelist 339675182Dean Deng
PiperOrigin-RevId: 339750876
2020-10-29Make RedirectTarget thread safeKevin Krakauer
Fixes #4613. PiperOrigin-RevId: 339746784
2020-10-29Fix TCP wildcard bind failure when netstack is v6 onlyTing-Yu Wang
TCP endpoint unconditionly binds to v4 even when the stack only supports v6. PiperOrigin-RevId: 339739392
2020-10-29Keep magic constants out of netstackKevin Krakauer
PiperOrigin-RevId: 339721152
2020-10-29Add support for bare IPv4 in packetimpact testsArthur Sfez
PiperOrigin-RevId: 339699771
2020-10-29Delay goroutine creation during TCP handshake for accept/connect.Dean Deng
Refactor TCP handshake code so that when connect is initiated, the initial SYN is sent before creating a goroutine to handle the rest of the handshake (which blocks). Similarly, the initial SYN-ACK is sent inline when SYN is received during accept. Some additional cleanup is done as well. Eventually we would like to complete connections in the dispatcher without requiring a wakeup to complete the handshake. This refactor makes that easier. Updates #231 PiperOrigin-RevId: 339675182
2020-10-28Add url option for blog authorsIan Lewis
PiperOrigin-RevId: 339608078
2020-10-28[infra] Deflake Go / generate (pull_request) GitHub action.Ayush Ranjan
As you can see https://github.com/google/gvisor/commits/master, there are a lot of red commits. This is because the Go / generate GitHub action flakes. On merge, two variants of this workflow run: - one triggered by the pull request (copybara force pushes to the PR right before merge) - one triggered by the push (merge) If the push action ends up finishing before the pull request action can run go_branch.sh, then the changes that go_branch.sh makes is already pushed to the remote go branch. Consequently, the pull request action ends up having nothing to commit causing this action to fail. This change also fixes lint warnings. Now we skip running the go_branch.sh if we find that our current working commit has already been committed to remote. PiperOrigin-RevId: 339586760
2020-10-28Add leak checking for kernfs.Dentry.Dean Deng
Updates #1486. PiperOrigin-RevId: 339581879
2020-10-28Add logging option to leak checker.Dean Deng
Also refactor the template and CheckedObject interface to make this cleaner. Updates #1486. PiperOrigin-RevId: 339577120
2020-10-28Add the payload directly to the ICMPv4 typeArthur Sfez
This makes handling inbound fragmented packets easier, because a fragmented packet might not have an actual ICMP header but only a payload. After this change, the ICMPv4 is the last layer you can get because the payload is embedded in it. Note that this makes it consistent with the ICMPv6 implementation. While I'm here, I've also added the Ident and Sequence fields on the ICMPv4 type. Defaults are still zero. PiperOrigin-RevId: 339577094
2020-10-28Traversal embedded libraries, even for go_library rules.Adin Scannell
PiperOrigin-RevId: 339570821
2020-10-28Merge pull request #4630 from lemin9538:lemin_arm64_devgVisor bot
PiperOrigin-RevId: 339540747
2020-10-28Invalidate overlay.dentry.dirents during open() file creation.Jamie Liu
Updates #1199 PiperOrigin-RevId: 339528827
2020-10-28Avoid time.Now in NUDTamir Duberstein
Use the stack clock instead. Change NeighborEntry.UpdatedAt to UpdatedAtNanos. PiperOrigin-RevId: 339520566
2020-10-28[vfs] Refactor hostfs mmap into kernfs util.Ayush Ranjan
PiperOrigin-RevId: 339505487
2020-10-28Merge pull request #2849 from lubinszARM:pr_memory_barriergVisor bot
PiperOrigin-RevId: 339504677
2020-10-28Bump honnef.co/go/tools to v0.0.1-2020.1.6Ting-Yu Wang
PiperOrigin-RevId: 339476515
2020-10-28[runtime tests] Unexclude fixed test.Ayush Ranjan
#4641 fixed the PHP runtime test ext/standard/tests/network/bug20134.phpt. We should start testing it again. Also excluded another flaky test. Seems like a test bug. PiperOrigin-RevId: 339475716
2020-10-28Merge pull request #4543 from lubinszARM:pr_test_sigaltstackgVisor bot
PiperOrigin-RevId: 339459247
2020-10-27Merge pull request #4598 from lubinszARM:pr_kvm_precise_syncgVisor bot
PiperOrigin-RevId: 339404936
2020-10-28arm64: need to restore the sentry's TLS when in EL1Min Le
Signed-off-by: Min Le <lemin.lm@antgroup.com>
2020-10-27Merge pull request #4587 from lnsp:stacktracegVisor bot
PiperOrigin-RevId: 339385609
2020-10-27Add more cgroup unit testsFabricio Voznika
PiperOrigin-RevId: 339380431
2020-10-27Add support for Timestamp and RecordRoute IP optionsJulian Elischer
IPv4 options extend the size of the IP header and have a basic known format. The framework can process that format without needing to know about every possible option. We can add more code to handle additional option types as we need them. Bad options or mangled option entries can result in ICMP Parameter Problem packets. The first types we support are the Timestamp option and the Record Route option, included in this change. The options are processed at several points in the packet flow within the Network stack, with slightly different requirements. The framework includes a mechanism to control this at each point. Support has been added for such points which are only present in upcoming CLs such as during packet forwarding and fragmentation. With this change, 'ping -R' and 'ping -T' work against gVisor and Fuchsia. $ ping -R 192.168.1.2 PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data. 64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.990 ms NOP RR: 192.168.1.1 192.168.1.2 192.168.1.1 $ ping -T tsprespec 192.168.1.2 192.168.1.1 192.168.1.2 PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data. 64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=1.20 ms TS: 192.168.1.2 71486821 absolute 192.168.1.1 746 Unit tests included for generic options, Timestamp options and Record Route options. PiperOrigin-RevId: 339379076
2020-10-27Add SHA512 to merkle tree libraryChong Cai
PiperOrigin-RevId: 339377254
2020-10-27Wake up any waiters on an ICMP error on UDP socket.Bhasker Hariharan
This change wakes up any waiters when we receive an ICMP port unreachable control packet on an UDP socket as well as sets waiter.EventErr in the result returned by Readiness() when e.lastError is not nil. The latter is required where an epoll()/poll() is done after the error is already handled since we will never notify again in such cases. PiperOrigin-RevId: 339370469
2020-10-27Implement /proc/[pid]/memLennart
This PR implements /proc/[pid]/mem for `pkg/sentry/fs` (refer to #2716) and `pkg/sentry/fsimpl`. @majek COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/4060 from lnsp:proc-pid-mem 2caf9021254646f441be618a9bb5528610e44d43 PiperOrigin-RevId: 339369629
2020-10-27Merge pull request #4420 from workato:dev-optionsgVisor bot
PiperOrigin-RevId: 339363816
2020-10-27Pass NeighborEntry in NUD callbacksTamir Duberstein
...instead of passing its fields piecemeal. PiperOrigin-RevId: 339345899
2020-10-27Assign VFS2 overlay device numbers based on layer device numbers.Jamie Liu
In VFS1's overlayfs, files use the device and inode number of the lower layer inode if one exists, and the upper layer inode otherwise. The former behavior is inefficient (requiring lower layer lookups even if the file exists and is otherwise wholly determined by the upper layer), and somewhat dangerous if the lower layer is also observable (since both the overlay and lower layer file will have the same device and inode numbers and thus appear to be the same file, despite being behaviorally different). VFS2 overlayfs imitates Linux overlayfs (in its default configuration) instead; it always uses the inode number from the originating layer, but synthesizes a unique device number for directories and another device number for non-directory files that have not been copied-up. As it turns out, the latter is insufficient (in VFS2, and possibly Linux as well), because a given layer may include files with different device numbers. If two distinct files on such a layer have device number X and Y respectively, but share inode number Z, then the overlay will map both files to some private device number X' and inode number Z, potentially confusing applications. Fix this by assigning synthetic device numbers based on the lower layer's device number, rather than the lower layer's vfs.Filesystem. PiperOrigin-RevId: 339300341
2020-10-27Add basic address deletion to netlinkIan Lewis
Updates #3921 PiperOrigin-RevId: 339195417
2020-10-26Fix platforms blog post permalinkIan Lewis
PiperOrigin-RevId: 339182848
2020-10-26Update latest install docs to install containerd shimIan Lewis
PiperOrigin-RevId: 339182137
2020-10-26Implement command IPC_STAT for semctl.Jing Chen
PiperOrigin-RevId: 339166854
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-16 17:48:48 +0000