mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
vendor: vishvananda/netns db3c7e526aae966c4ccfa6c8189b693d6ac5d202
full diff: 0a2b9b5464...db3c7e526a
- Use golang.org/x/sys/unix instead of syscall
- Set O_CLOEXEC when opening a network namespace
- Fixes "the container‘s netns fds leak, causing the container netns to not
clean up successfully after the container stops"
- Allows to create and delete named network namespaces
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
parent
0f41a77c69
commit
818bad6ef2
4 changed files with 70 additions and 40 deletions
|
@ -52,7 +52,7 @@ github.com/hashicorp/go-sockaddr c7188e74f6acae5a989bdc959aa7
|
|||
github.com/hashicorp/go-multierror 886a7fbe3eb1c874d46f623bfa70af45f425b3d1 # v1.0.0
|
||||
github.com/hashicorp/serf 598c54895cc5a7b1a24a398d635e8c0ea0959870
|
||||
github.com/docker/libkv 458977154600b9f23984d9f4b82e79570b5ae12b
|
||||
github.com/vishvananda/netns 0a2b9b5464df8343199164a0321edf3313202f7e
|
||||
github.com/vishvananda/netns db3c7e526aae966c4ccfa6c8189b693d6ac5d202
|
||||
github.com/vishvananda/netlink f049be6f391489d3f374498fe0c8df8449258372 # v1.1.0
|
||||
github.com/moby/ipvs 4566ccea0e08d68e9614c3e7a64a23b850c4bb35 # v1.0.1
|
||||
|
||||
|
|
2
vendor/github.com/vishvananda/netns/go.mod
generated
vendored
2
vendor/github.com/vishvananda/netns/go.mod
generated
vendored
|
@ -1,3 +1,5 @@
|
|||
module github.com/vishvananda/netns
|
||||
|
||||
go 1.12
|
||||
|
||||
require golang.org/x/sys v0.0.0-20200217220822-9197077df867
|
||||
|
|
19
vendor/github.com/vishvananda/netns/netns.go
generated
vendored
19
vendor/github.com/vishvananda/netns/netns.go
generated
vendored
|
@ -10,7 +10,8 @@ package netns
|
|||
|
||||
import (
|
||||
"fmt"
|
||||
"syscall"
|
||||
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// NsHandle is a handle to a network namespace. It can be cast directly
|
||||
|
@ -24,11 +25,11 @@ func (ns NsHandle) Equal(other NsHandle) bool {
|
|||
if ns == other {
|
||||
return true
|
||||
}
|
||||
var s1, s2 syscall.Stat_t
|
||||
if err := syscall.Fstat(int(ns), &s1); err != nil {
|
||||
var s1, s2 unix.Stat_t
|
||||
if err := unix.Fstat(int(ns), &s1); err != nil {
|
||||
return false
|
||||
}
|
||||
if err := syscall.Fstat(int(other), &s2); err != nil {
|
||||
if err := unix.Fstat(int(other), &s2); err != nil {
|
||||
return false
|
||||
}
|
||||
return (s1.Dev == s2.Dev) && (s1.Ino == s2.Ino)
|
||||
|
@ -36,11 +37,11 @@ func (ns NsHandle) Equal(other NsHandle) bool {
|
|||
|
||||
// String shows the file descriptor number and its dev and inode.
|
||||
func (ns NsHandle) String() string {
|
||||
var s syscall.Stat_t
|
||||
if ns == -1 {
|
||||
return "NS(None)"
|
||||
}
|
||||
if err := syscall.Fstat(int(ns), &s); err != nil {
|
||||
var s unix.Stat_t
|
||||
if err := unix.Fstat(int(ns), &s); err != nil {
|
||||
return fmt.Sprintf("NS(%d: unknown)", ns)
|
||||
}
|
||||
return fmt.Sprintf("NS(%d: %d, %d)", ns, s.Dev, s.Ino)
|
||||
|
@ -49,11 +50,11 @@ func (ns NsHandle) String() string {
|
|||
// UniqueId returns a string which uniquely identifies the namespace
|
||||
// associated with the network handle.
|
||||
func (ns NsHandle) UniqueId() string {
|
||||
var s syscall.Stat_t
|
||||
if ns == -1 {
|
||||
return "NS(none)"
|
||||
}
|
||||
if err := syscall.Fstat(int(ns), &s); err != nil {
|
||||
var s unix.Stat_t
|
||||
if err := unix.Fstat(int(ns), &s); err != nil {
|
||||
return "NS(unknown)"
|
||||
}
|
||||
return fmt.Sprintf("NS(%d:%d)", s.Dev, s.Ino)
|
||||
|
@ -67,7 +68,7 @@ func (ns NsHandle) IsOpen() bool {
|
|||
// Close closes the NsHandle and resets its file descriptor to -1.
|
||||
// It is not safe to use an NsHandle after Close() is called.
|
||||
func (ns *NsHandle) Close() error {
|
||||
if err := syscall.Close(int(*ns)); err != nil {
|
||||
if err := unix.Close(int(*ns)); err != nil {
|
||||
return err
|
||||
}
|
||||
(*ns) = -1
|
||||
|
|
75
vendor/github.com/vishvananda/netns/netns_linux.go
generated
vendored
75
vendor/github.com/vishvananda/netns/netns_linux.go
generated
vendored
|
@ -6,27 +6,14 @@ import (
|
|||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
// SYS_SETNS syscall allows changing the namespace of the current process.
|
||||
var SYS_SETNS = map[string]uintptr{
|
||||
"386": 346,
|
||||
"amd64": 308,
|
||||
"arm64": 268,
|
||||
"arm": 375,
|
||||
"mips": 4344,
|
||||
"mipsle": 4344,
|
||||
"mips64le": 4344,
|
||||
"ppc64": 350,
|
||||
"ppc64le": 350,
|
||||
"riscv64": 268,
|
||||
"s390x": 339,
|
||||
}[runtime.GOARCH]
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// Deprecated: use syscall pkg instead (go >= 1.5 needed).
|
||||
const (
|
||||
|
@ -36,16 +23,13 @@ const (
|
|||
CLONE_NEWPID = 0x20000000 /* New pid namespace */
|
||||
CLONE_NEWNET = 0x40000000 /* New network namespace */
|
||||
CLONE_IO = 0x80000000 /* Get io context */
|
||||
bindMountPath = "/run/netns" /* Bind mount path for named netns */
|
||||
)
|
||||
|
||||
// Setns sets namespace using syscall. Note that this should be a method
|
||||
// in syscall but it has not been added.
|
||||
func Setns(ns NsHandle, nstype int) (err error) {
|
||||
_, _, e1 := syscall.Syscall(SYS_SETNS, uintptr(ns), uintptr(nstype), 0)
|
||||
if e1 != 0 {
|
||||
err = e1
|
||||
}
|
||||
return
|
||||
return unix.Setns(int(ns), nstype)
|
||||
}
|
||||
|
||||
// Set sets the current network namespace to the namespace represented
|
||||
|
@ -57,21 +41,64 @@ func Set(ns NsHandle) (err error) {
|
|||
// New creates a new network namespace, sets it as current and returns
|
||||
// a handle to it.
|
||||
func New() (ns NsHandle, err error) {
|
||||
if err := syscall.Unshare(CLONE_NEWNET); err != nil {
|
||||
if err := unix.Unshare(CLONE_NEWNET); err != nil {
|
||||
return -1, err
|
||||
}
|
||||
return Get()
|
||||
}
|
||||
|
||||
// NewNamed creates a new named network namespace and returns a handle to it
|
||||
func NewNamed(name string) (NsHandle, error) {
|
||||
if _, err := os.Stat(bindMountPath); os.IsNotExist(err) {
|
||||
err = os.MkdirAll(bindMountPath, 0755)
|
||||
if err != nil {
|
||||
return None(), err
|
||||
}
|
||||
}
|
||||
|
||||
newNs, err := New()
|
||||
if err != nil {
|
||||
return None(), err
|
||||
}
|
||||
|
||||
namedPath := path.Join(bindMountPath, name)
|
||||
|
||||
f, err := os.OpenFile(namedPath, os.O_CREATE|os.O_EXCL, 0444)
|
||||
if err != nil {
|
||||
return None(), err
|
||||
}
|
||||
f.Close()
|
||||
|
||||
nsPath := fmt.Sprintf("/proc/%d/task/%d/ns/net", os.Getpid(), syscall.Gettid())
|
||||
err = syscall.Mount(nsPath, namedPath, "bind", syscall.MS_BIND, "")
|
||||
if err != nil {
|
||||
return None(), err
|
||||
}
|
||||
|
||||
return newNs, nil
|
||||
}
|
||||
|
||||
// DeleteNamed deletes a named network namespace
|
||||
func DeleteNamed(name string) error {
|
||||
namedPath := path.Join(bindMountPath, name)
|
||||
|
||||
err := syscall.Unmount(namedPath, syscall.MNT_DETACH)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return os.Remove(namedPath)
|
||||
}
|
||||
|
||||
// Get gets a handle to the current threads network namespace.
|
||||
func Get() (NsHandle, error) {
|
||||
return GetFromThread(os.Getpid(), syscall.Gettid())
|
||||
return GetFromThread(os.Getpid(), unix.Gettid())
|
||||
}
|
||||
|
||||
// GetFromPath gets a handle to a network namespace
|
||||
// identified by the path
|
||||
func GetFromPath(path string) (NsHandle, error) {
|
||||
fd, err := syscall.Open(path, syscall.O_RDONLY, 0)
|
||||
fd, err := unix.Open(path, unix.O_RDONLY|unix.O_CLOEXEC, 0)
|
||||
if err != nil {
|
||||
return -1, err
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue