summaryrefslogtreecommitdiffhomepage
path: root/pkg
AgeCommit message (Collapse)Author
2020-10-28Merge release-20201019.0-76-g035b1c827 (automated)gVisor bot
2020-10-27Add support for Timestamp and RecordRoute IP optionsJulian Elischer
IPv4 options extend the size of the IP header and have a basic known format. The framework can process that format without needing to know about every possible option. We can add more code to handle additional option types as we need them. Bad options or mangled option entries can result in ICMP Parameter Problem packets. The first types we support are the Timestamp option and the Record Route option, included in this change. The options are processed at several points in the packet flow within the Network stack, with slightly different requirements. The framework includes a mechanism to control this at each point. Support has been added for such points which are only present in upcoming CLs such as during packet forwarding and fragmentation. With this change, 'ping -R' and 'ping -T' work against gVisor and Fuchsia. $ ping -R 192.168.1.2 PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data. 64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.990 ms NOP RR: 192.168.1.1 192.168.1.2 192.168.1.1 $ ping -T tsprespec 192.168.1.2 192.168.1.1 192.168.1.2 PING 192.168.1.2 (192.168.1.2) 56(124) bytes of data. 64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=1.20 ms TS: 192.168.1.2 71486821 absolute 192.168.1.1 746 Unit tests included for generic options, Timestamp options and Record Route options. PiperOrigin-RevId: 339379076
2020-10-28Merge release-20201019.0-75-gbc91ae17f (automated)gVisor bot
2020-10-27Add SHA512 to merkle tree libraryChong Cai
PiperOrigin-RevId: 339377254
2020-10-28Merge release-20201019.0-74-g24c33de74 (automated)gVisor bot
2020-10-27Wake up any waiters on an ICMP error on UDP socket.Bhasker Hariharan
This change wakes up any waiters when we receive an ICMP port unreachable control packet on an UDP socket as well as sets waiter.EventErr in the result returned by Readiness() when e.lastError is not nil. The latter is required where an epoll()/poll() is done after the error is already handled since we will never notify again in such cases. PiperOrigin-RevId: 339370469
2020-10-28Merge release-20201019.0-73-g1c2836da3 (automated)gVisor bot
2020-10-27Implement /proc/[pid]/memLennart
This PR implements /proc/[pid]/mem for `pkg/sentry/fs` (refer to #2716) and `pkg/sentry/fsimpl`. @majek COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/4060 from lnsp:proc-pid-mem 2caf9021254646f441be618a9bb5528610e44d43 PiperOrigin-RevId: 339369629
2020-10-27Merge release-20201019.0-70-g4d9066d1d (automated)gVisor bot
2020-10-27Pass NeighborEntry in NUD callbacksTamir Duberstein
...instead of passing its fields piecemeal. PiperOrigin-RevId: 339345899
2020-10-27Merge release-20201019.0-69-g6d50185e7 (automated)gVisor bot
2020-10-27Assign VFS2 overlay device numbers based on layer device numbers.Jamie Liu
In VFS1's overlayfs, files use the device and inode number of the lower layer inode if one exists, and the upper layer inode otherwise. The former behavior is inefficient (requiring lower layer lookups even if the file exists and is otherwise wholly determined by the upper layer), and somewhat dangerous if the lower layer is also observable (since both the overlay and lower layer file will have the same device and inode numbers and thus appear to be the same file, despite being behaviorally different). VFS2 overlayfs imitates Linux overlayfs (in its default configuration) instead; it always uses the inode number from the originating layer, but synthesizes a unique device number for directories and another device number for non-directory files that have not been copied-up. As it turns out, the latter is insufficient (in VFS2, and possibly Linux as well), because a given layer may include files with different device numbers. If two distinct files on such a layer have device number X and Y respectively, but share inode number Z, then the overlay will map both files to some private device number X' and inode number Z, potentially confusing applications. Fix this by assigning synthetic device numbers based on the lower layer's device number, rather than the lower layer's vfs.Filesystem. PiperOrigin-RevId: 339300341
2020-10-27Merge release-20201019.0-68-g59e2c9f16 (automated)gVisor bot
2020-10-27Add basic address deletion to netlinkIan Lewis
Updates #3921 PiperOrigin-RevId: 339195417
2020-10-27Merge release-20201019.0-65-gfacb2fb9c (automated)gVisor bot
2020-10-26Implement command IPC_STAT for semctl.Jing Chen
PiperOrigin-RevId: 339166854
2020-10-26Add verity tests for deleted/renamed casesChong Cai
Also change verity test to use a context with an active task. This is required to delete/rename the file in the underlying file system. PiperOrigin-RevId: 339146445
2020-10-26Merge release-20201019.0-63-g652f11380 (automated)gVisor bot
2020-10-26[vfs] kernfs: Implement LRU cache for kernfs dentries.Ayush Ranjan
Much like the VFS2 gofer client, kernfs too now caches dentries. The size of the LRU cache is configurable via mount options. Have adopted the same reference semantics from gofer client dentry. Only sysfs and procfs use this LRU cache. The rest of the kernfs users (devpts, fusefs, host, pipefs, sockfs) still use the no cache approach. PiperOrigin-RevId: 339139835
2020-10-26Merge release-20201019.0-62-g0bdcee38b (automated)gVisor bot
2020-10-26Fix SCM Rights S/R reference leak.Dean Deng
Control messages collected when peeking into a socket were being leaked. PiperOrigin-RevId: 339114961
2020-10-24Implement Seek in verity fsChong Cai
PiperOrigin-RevId: 338847417
2020-10-24Merge release-20201019.0-58-g4feb5c7c2 (automated)gVisor bot
2020-10-24Add leak checking to vfs2 structures that cannot use the refs_vfs2 template.Dean Deng
Updates #1486. PiperOrigin-RevId: 338832085
2020-10-24Merge release-20201019.0-56-g0a035a101 (automated)gVisor bot
2020-10-24Send ICMP error message if IP fragment reassembly failsToshi Kikuchi
Fixes #4427, #4428 PiperOrigin-RevId: 338805047
2020-10-23Internal change.Chong Cai
PiperOrigin-RevId: 338798433
2020-10-24Merge release-20201019.0-53-g8dfbec28a (automated)gVisor bot
2020-10-23Fix nogo tests in //pkg/sentry/socket/...Ting-Yu Wang
PiperOrigin-RevId: 338784921
2020-10-24Merge release-20201019.0-51-g9f87400f0 (automated)gVisor bot
2020-10-23Support VFS2 save/restore.Jamie Liu
Inode number consistency checks are now skipped in save/restore tests for reasons described in greatest detail in StatTest.StateDoesntChangeAfterRename. They pass in VFS1 due to the bug described in new test case SimpleStatTest.DifferentFilesHaveDifferentDeviceInodeNumberPairs. Fixes #1663 PiperOrigin-RevId: 338776148
2020-10-23Merge release-20201019.0-48-ge5c1b035a (automated)gVisor bot
2020-10-23Introduce SemidDs struct for amd64 and arm64.Jing Chen
PiperOrigin-RevId: 338756277
2020-10-23Merge release-20201019.0-45-g61b379ee1 (automated)gVisor bot
2020-10-23Merge release-20201019.0-44-g227fd9f1b (automated)gVisor bot
2020-10-23[vfs] kernfs: cleanup/refactor.Ayush Ranjan
PiperOrigin-RevId: 338728070
2020-10-23//pkg/state fixes for VFS2.Jamie Liu
- When encodeState.resolve() determines that the resolved reflect.Value is contained by a previously-resolved object, set wire.Ref.Type to the containing object's type (existing.obj.Type()) rather than the contained value's type (obj.Type()). - When encodeState.resolve() determines that the resolved reflect.Value contains a previously-resolved object, handle cases where the new object contains *multiple* previously-resolved objects. (This may cause previously-allocated object IDs to become unused; to facilitate this, change encodeState.pending to a map, and change the wire format to prefix each object with its object ID.) - Add encodeState.encodedStructs to avoid redundant encoding of structs, since deduplication of objects via encodeState.resolve() doesn't work for objects instantiated by StateSave() and passed to SaveValue() (i.e. fields tagged `state:".(whatever)"`). - Make unexported array fields deserializable via slices that refer to them by casting away their unexportedness in decodeState.decodeObject(). Updates #1663 PiperOrigin-RevId: 338727687
2020-10-23Merge release-20201019.0-43-g8db147b55 (automated)gVisor bot
2020-10-23Wait before transitioning NUD entries from Probe to FailedSam Balana
Wait an additional RetransmitTimer duration after the last probe before transitioning to Failed. The previous implementation transitions immediately to Failed after sending the last probe, which is erroneous behavior. PiperOrigin-RevId: 338723794
2020-10-23Implement Read in gvisor verity fsChong Cai
Read is implemented by PRead, with offset obtained from Seek. PiperOrigin-RevId: 338718587
2020-10-23Merge release-20201019.0-41-g6ee3520b6 (automated)gVisor bot
2020-10-23[vfs] kernfs: Implement remaining InodeAttr fields.Ayush Ranjan
Added the following fields in kernfs.InodeAttr: - blockSize - atime - mtime - ctime Also resolved all TODOs for #1193. Fixes #1193 PiperOrigin-RevId: 338714527
2020-10-23Fix TestTCPTimeWaitNewSyn.Bhasker Hariharan
Drain the notification channel after first accept as in case the first accept never blocked then the notification for the first accept will still be in the channel causing the second accept to fail as it will try to wait on the channel and return immediately due to the older notification even though there is no connection yet in the accept queue. PiperOrigin-RevId: 338710062
2020-10-23Check for verity file/Merkle file when reopenChong Cai
Even if the child dentry has been cached, we should still check whether the file and the corresponding Merkle tree file exist as expected. This ensures that we can detect deletion/renaming of files that have been previous enabled and opened. Also make all verification failures to return EIO. This helps to test verify failures. PiperOrigin-RevId: 338709055
2020-10-23Merge release-20201019.0-37-g39e9b3bb8 (automated)gVisor bot
2020-10-23Support getsockopt for SO_ACCEPTCONN.Nayana Bidari
The SO_ACCEPTCONN option is used only on getsockopt(). When this option is specified, getsockopt() indicates whether socket listening is enabled for the socket. A value of zero indicates that socket listening is disabled; non-zero that it is enabled. PiperOrigin-RevId: 338703206
2020-10-23Merge release-20201019.0-36-gdad08229b (automated)gVisor bot
2020-10-23Do not hold NIC local address in neighbor entriesGhanan Gowripalan
Previously, the NIC local address used when completing link resolution was held in the neighbor entry. A neighbor is not identified by any NIC local address so remove it. PiperOrigin-RevId: 338699695
2020-10-23Merge release-20201019.0-35-g5d909dd49 (automated)gVisor bot
2020-10-23Decrement e.synRcvdCount once handshake is complete.Bhasker Hariharan
Earlier the count was dropped only after calling e.deliverAccepted. This lead to an issue where there were no connections in SYN-RCVD state for the listening endpoint but e.synRcvdCount would not be zero because it was being reduced only when handleSynSegment returned after deliverAccepted returned. This issue is seen when the Nth SYN for a listen backlog of size N which would cause the listen backlog to be full gets dropped occasionally. This happens when the new SYN comes at when the previous completed endpoint has been delivered to the accept queue but the synRcvdCount hasn't yet been decremented because the goroutine running handleSynSegment has not yet completed. PiperOrigin-RevId: 338690646
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 16:48:02 +0000