Documentation
¶
Overview ¶
Package ateomnet provides shared networking configuration logic for Substrate runtime agents.
Index ¶
- Constants
- Variables
- func AllowUnprivilegedPorts() error
- func CleanupSandboxNetwork(network *SandboxNetwork) error
- func CreateNetNSWithoutSwitching(name string) (netns.NsHandle, error)
- func ListenInNetNS(ctx context.Context, ns netns.NsHandle, ports []uint16) (_ []net.Listener, retErr error)
- func MustParseAddr(cidr string) *netlink.Addr
- func MustParseIP(s string) net.IP
- func MustParseMAC(s string) net.HardwareAddr
- func NetNSDialer(ns netns.NsHandle) func(context.Context, string, string) (net.Conn, error)
- func NetNSDo(ctx context.Context, targetNS netns.NsHandle, do func(context.Context) error) error
- func SandboxGatewayNetNSName(actorUID string) string
- func SandboxResolvConf(podResolvConf []byte) []byte
- func WriteRootfsResolvConf(rootfs string, content []byte) error
- type SandboxNetwork
- type SandboxNetworkConfig
- type SandboxSession
- type SessionHolder
Constants ¶
const ( ActorVethName = "eth0" ActorVethGateway = "169.254.17.1" ActorVethIP = "169.254.17.2" // ActorVethSubnet is the point-to-point /30 the actor veth lives on. ActorVethSubnet = "169.254.17.0/30" )
Variables ¶
var ( HostVethAddr = MustParseAddr(hostVethLocalAddress) ActorVethAddr = MustParseAddr(actorVethLocalAddress) ActorVethGwIP = MustParseIP(ActorVethGateway) )
Functions ¶
func AllowUnprivilegedPorts ¶ added in v0.2.0
func AllowUnprivilegedPorts() error
AllowUnprivilegedPorts lets this namespace bind ports below 1024 without CAP_NET_BIND_SERVICE, which is how atunnel answers a sandbox's DNS on 53. The sysctl is per-namespace and grants nothing outside it.
func CleanupSandboxNetwork ¶ added in v0.2.0
func CleanupSandboxNetwork(network *SandboxNetwork) error
CleanupSandboxNetwork closes namespace handles and removes their names.
func CreateNetNSWithoutSwitching ¶
CreateNetNSWithoutSwitching creates a named netns and returns its handle, restoring the caller's current netns before returning.
The caller owns the name exclusively, so a name still present when this runs was left behind by an earlier incarnation and is removed first. The kernel creates the name with O_EXCL, so without that removal a single failed teardown would wedge the name for good: nothing could ever create it again. Removal only unmounts and unlinks the name. Anything still holding the namespace keeps it alive, and existing handles stay usable.
func ListenInNetNS ¶ added in v0.2.0
func ListenInNetNS(ctx context.Context, ns netns.NsHandle, ports []uint16) (_ []net.Listener, retErr error)
ListenInNetNS opens wildcard TCP listeners inside ns. Sockets retain their namespace and can be served from another namespace.
func MustParseAddr ¶
MustParseAddr parses a CIDR string into a netlink.Addr, panicking on error.
func MustParseIP ¶
MustParseIP parses an IPv4 string into a net.IP, panicking on error.
func MustParseMAC ¶
func MustParseMAC(s string) net.HardwareAddr
MustParseMAC parses a MAC address string into a net.HardwareAddr, panicking on error.
func NetNSDialer ¶ added in v0.2.0
NetNSDialer dials TCP or UDP IP literals in ns, pinning a thread only until the socket is created.
func SandboxGatewayNetNSName ¶ added in v0.2.0
SandboxGatewayNetNSName names the namespace holding the veth peer and atunnel's sockets for one actor.
func SandboxResolvConf ¶ added in v0.2.0
SandboxResolvConf replaces nameservers with the sandbox gateway while preserving the pod's search domains and options for Kubernetes DNS.
func WriteRootfsResolvConf ¶ added in v0.2.0
WriteRootfsResolvConf installs content at /etc/resolv.conf inside rootfs.
os.Root confines path traversal; unlinking prevents writes through existing links.
Types ¶
type SandboxNetwork ¶ added in v0.2.0
type SandboxNetwork struct {
// ActorUID is the Actor resource's UID. It names the namespaces, so a
// teardown can find them again.
ActorUID string
// RuntimeNetNS is what the sandbox runs in, whichever runtime that is: the
// micro-VM's tap lives here, and gVisor claims every interface here and
// moves their addresses into its own stack.
RuntimeNetNS netns.NsHandle
// GatewayNetNS holds the sandbox's default gateway, DNS relay, and atunnel
// sockets. This is local to the sandbox, not the external egress gateway.
// For microVMs it shares RuntimeNetNS.
//
// TODO: we hope gVisor can take that same single-namespace shape soon,
// once runsc can be given one interface rather than claiming every
// interface in the namespace it runs in.
GatewayNetNS netns.NsHandle
}
SandboxNetwork holds a sandbox's runtime and gateway namespaces.
func SetupSandboxNetwork ¶ added in v0.2.0
func SetupSandboxNetwork(ctx context.Context, cfg SandboxNetworkConfig) (_ *SandboxNetwork, retErr error)
SetupSandboxNetwork creates isolated networking with fixed sandbox addresses. gVisor uses a veth pair across runtime and gateway namespaces because it takes over every interface in its namespace. MicroVMs use a tap in one namespace. nftables at the sandbox's default gateway redirect outbound TCP to atunnel, preserving SO_ORIGINAL_DST. Traffic to the gateway address is not redirected, so DNS over UDP and TCP reaches the relay's own sockets.
type SandboxNetworkConfig ¶ added in v0.2.0
type SandboxNetworkConfig struct {
ActorUID string
// Veth separates gVisor's interfaces from the kernel-owned gateway.
// MicroVMs use a tap in a single namespace instead.
Veth bool
// EgressPort is where atunnel serves this actor. Every TCP connection the
// actor makes is redirected to it, whatever port it was aimed at.
EgressPort uint16
// DNSPort is where the DNS relay answers, on the sandbox's default gateway.
DNSPort uint16
}
SandboxNetworkConfig describes one actor's private networking.
type SandboxSession ¶ added in v0.2.0
type SandboxSession struct {
Network *SandboxNetwork
// contains filtered or unexported fields
}
SandboxSession owns a sandbox's network and serving sockets.
func ServeSandbox ¶ added in v0.2.0
func ServeSandbox(ctx context.Context, cfg SandboxNetworkConfig, egress egressServer, dns dnsServer) (_ *SandboxSession, retErr error)
ServeSandbox builds a sandbox's network and serves egress and DNS from its gateway namespace. A nil server leaves that unserved, which fails closed.
func (*SandboxSession) Close ¶ added in v0.2.0
func (s *SandboxSession) Close(ctx context.Context) error
Close cancels the work in flight, closes the sockets, waits for the serving goroutines, then removes the namespaces. ctx bounds only the wait; the namespaces go either way, since leaving them wedges the next activation. Idempotent, and every step's error is returned.
type SessionHolder ¶ added in v0.2.0
type SessionHolder struct {
// contains filtered or unexported fields
}
SessionHolder is the one sandbox session a worker is serving, for the ateoms to share what is otherwise the same locking, replacement and dialing in both.
func (*SessionHolder) Close ¶ added in v0.2.0
func (h *SessionHolder) Close(ctx context.Context) error
Close releases the held session, if any.
func (*SessionHolder) Dialer ¶ added in v0.2.0
Dialer reaches whichever sandbox is held when the dial happens.
func (*SessionHolder) Replace ¶ added in v0.2.0
func (h *SessionHolder) Replace(ctx context.Context, next *SandboxSession) error
Replace closes whatever session is held and installs next. A previous actor's session can still be here if its teardown never ran, and overwriting it would leak both namespaces, their /run/netns mounts and the goroutines serving them.
func (*SessionHolder) Session ¶ added in v0.2.0
func (h *SessionHolder) Session() *SandboxSession
Session is what is held, or nil between activations.
Source Files