Documentation
¶
Overview ¶
Package ateomnet provides shared networking configuration logic for Substrate runtime agents.
Index ¶
- Constants
- Variables
- func ActorEgressRedirectRule(table *nftables.Table, chain *nftables.Chain, port uint16) *nftables.Rule
- func CleanupActorNetwork(ctx context.Context, interiorNetNS netns.NsHandle) error
- func ConfigureActorVeth(ctx context.Context) error
- func CreateNetNSWithoutSwitching(name string) (netns.NsHandle, error)
- func DumpNetInfo(ctx context.Context, prefix string) error
- func EnableIPv4Forwarding() error
- func IPPayloadEqual(offset uint32, ip string) []expr.Any
- func IPSourceEqual(ip string) []expr.Any
- func InstallActorNftablesRules(egressPort uint16) error
- func MustParseAddr(cidr string) *netlink.Addr
- func MustParseIP(s string) net.IP
- func MustParseMAC(s string) net.HardwareAddr
- func NetNSDo(ctx context.Context, targetNS netns.NsHandle, do func(context.Context) error) error
- func PodIPv4() (net.IP, error)
- func RemoveActorNftablesRules() error
- func SetupActorNetwork(ctx context.Context, cfg NetworkConfig) (retErr error)
- func TCPProtocol() []expr.Any
- type NetworkConfig
Constants ¶
const ( HostVethName = "ateom0" ActorVethName = "eth0" HostVethCIDR = "169.254.17.1/30" ActorVethCIDR = "169.254.17.2/30" ActorVethGateway = "169.254.17.1" ActorVethIP = "169.254.17.2" ActorNftTableName = "ateom_actor" // ActorVethSubnet is the point-to-point /30 the actor veth lives on. ActorVethSubnet = "169.254.17.0/30" )
Variables ¶
var ( HostVethAddr = MustParseAddr(HostVethCIDR) ActorVethAddr = MustParseAddr(ActorVethCIDR) ActorVethGwIP = MustParseIP(ActorVethGateway) )
Functions ¶
func ActorEgressRedirectRule ¶
func ActorEgressRedirectRule(table *nftables.Table, chain *nftables.Chain, port uint16) *nftables.Rule
ActorEgressRedirectRule returns the prerouting rule that redirects actor TCP egress to the local atunnel egress listener on port, or nil when port is zero (tunneled egress disabled, so actor egress stays on the masquerade path).
func CleanupActorNetwork ¶
CleanupActorNetwork removes all per-activation network state owned by ateom. Intentionally idempotent.
func ConfigureActorVeth ¶
ConfigureActorVeth configures the actor veth inside the interior netns. It assumes it is already running inside the target network namespace.
func CreateNetNSWithoutSwitching ¶
CreateNetNSWithoutSwitching creates a named netns and returns its handle, restoring the caller's current netns before returning.
func DumpNetInfo ¶
DumpNetInfo dumps link and route information for debugging.
func EnableIPv4Forwarding ¶
func EnableIPv4Forwarding() error
EnableIPv4Forwarding enables IPv4 forwarding in the current network namespace.
func IPSourceEqual ¶
func InstallActorNftablesRules ¶
InstallActorNftablesRules configures the NAT and filtering rules for the actor. egressPort, when non-zero, is the local atunnel egress listener actor TCP egress is redirected to; zero leaves the redirect uninstalled.
func MustParseAddr ¶
MustParseAddr parses a CIDR string into a netlink.Addr, panicking on error.
func MustParseIP ¶
MustParseIP parses an IPv4 string into a net.IP, panicking on error.
func MustParseMAC ¶
func MustParseMAC(s string) net.HardwareAddr
MustParseMAC parses a MAC address string into a net.HardwareAddr, panicking on error.
func RemoveActorNftablesRules ¶
func RemoveActorNftablesRules() error
RemoveActorNftablesRules removes the ateom nftables table.
func SetupActorNetwork ¶
func SetupActorNetwork(ctx context.Context, cfg NetworkConfig) (retErr error)
SetupActorNetwork builds a fresh point-to-point network between the worker pod netns and the interior netns.
func TCPProtocol ¶
Types ¶
type NetworkConfig ¶
type NetworkConfig struct {
// InteriorNetNS is the target network namespace for the actor's veth pair peer.
// Used by: Both gVisor and MicroVM.
InteriorNetNS netns.NsHandle
// HostVethHWAddr is the hardware address to assign to the host veth interface.
// Used by: MicroVM (to ensure consistent MAC addresses across snapshot/restore).
HostVethHWAddr net.HardwareAddr
// SweepInteriorLinks indicates whether to delete existing links in the interior netns (excluding loopback).
// Used by: MicroVM (to clean up stale tap devices).
SweepInteriorLinks bool
// DumpNetInfo indicates whether to dump network information to the logs for debugging purposes.
// Used by: gVisor.
DumpNetInfo bool
// EgressRedirectPort is the local atunnel egress listener port actor TCP
// egress is redirected to. Zero installs no redirect, leaving actor egress
// on the masquerade path.
// Used by: Both gVisor and MicroVM.
EgressRedirectPort uint16
}
Source Files