Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add user-mode networking feature to Windows/WSL #18303

Merged
merged 2 commits into from
Apr 26, 2023

Conversation

n1hility
Copy link
Member

@n1hility n1hility commented Apr 21, 2023

Certain VPN setups or other specialized networking configs will block traffic from the virtual WSL networking device, resulting in the podman WSL backend from being unable to contact systems on the VPN, and potentially losing internet access altogether. While some VPN providers provide configuration options to allow traffic from VMs, users may be prevented by policy from changing these options, or they may require networking infrastructure changes that require time to implement.

This PR adds a user-mode networking capability to podman machine on Windows, that works around this issue by rerouting all traffic over a user-space process running on the host, similar to the setup in use on Linux and Mac.

It adds a --user-mode-networking flag to podman machine init and podman machine set to configure the specified machine instance for user-mode networking.

When specified, init will provision an additional WSL distribution for dynamically configuring and running the user-mode networking environment. The user-mode network dist replaces the WSL network configuration with a tap device that is tunneled to a gvproxy.exe process running on the host (using the stdio transport, which was recently contributed to gvisor-tap-vsock by the wsl-vpnkit author). All traffic from all running WSL distributions (including DNS) is rerouted over this process. podman machine start launches this special dist along with any machine instance configured to require it. The usage of the user-mode env dist is reference counted with cooperative file-locking: subsequent machine starts will share the same instance, and the last user-mode-net requiring machine will stop the networking dist, restoring the standard WSL network as part of its shutdown.

Machine instances that do not require user-mode networking will still participate in the user-mode network when running (required since the kernel is shared across all WSL dists), but they will not prevent the user-mode network from closing. Instead, traffic will begin to flow over the standard WSL network setup.

Since the qemu backend on Linux and Mac are designed around user-mode networking, this option is restricted to always be true on those platforms.

This PR also includes a commit to address an unrelated win installer CI failure that was showing up in the verification of this PR (an environment-varying go build issue can be triggered where it over-eagerly builds unnessecary transitive deps, including gpgme that won't normally build cleanly on Windows)

A follow-up PR will add a section to the Windows tutorial.

Windows: Add a user-mode networking option to improve interop with VPN configs that drop traffic from WSL networking

[NO NEW TESTS NEEDED]

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Apr 21, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: n1hility

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 21, 2023
@n1hility n1hility changed the title Add user mode networking feature to Windows Add user mode networking feature to Windows/WSL Apr 21, 2023
@n1hility n1hility changed the title Add user mode networking feature to Windows/WSL Add user-mode networking feature to Windows/WSL Apr 21, 2023
@n1hility n1hility force-pushed the user-mode branch 10 times, most recently from 4bb5026 to a4afae0 Compare April 23, 2023 20:04
Resolves Win Installer CI issues where dep processing variance can
pull in gpgme, which doesn't compile on Windows without a
specialized msys2 setup.

Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
@n1hility
Copy link
Member Author

n1hility commented Apr 24, 2023

PTAL @containers/podman-maintainers

(Also FYI @baude this updates the installer/zip bundled gvproxy version to the same version (0.6.1) that we have been testing with hyper-v)

Copy link
Member

@Luap99 Luap99 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just some drive by comments, I have no way of actually reviewing/testing this.

cmd/podman/machine/init.go Show resolved Hide resolved
docs/source/markdown/podman-machine-init.1.md Outdated Show resolved Hide resolved
@n1hility
Copy link
Member Author

@Luap99 thanks for the feedback. I updated the PR to address your notes.

Ill keep an eye on the next test run, but shouldn't have an impact

Signed-off-by: Jason T. Greene <jason.greene@redhat.com>
@n1hility
Copy link
Member Author

Looks like tests came back green on the updates to Paul's notes

PTAL @containers/podman-maintainers when you get a chance.

@baude
Copy link
Member

baude commented Apr 26, 2023

LGTM

@rhatdan
Copy link
Member

rhatdan commented Apr 26, 2023

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 26, 2023
@openshift-merge-robot openshift-merge-robot merged commit 832b098 into containers:main Apr 26, 2023
@Bharath-vi
Copy link

I getting this error after restarting my sysytem, do we need to add these file everytime ?

cp: cannot stat '/mnt/wsl/resolv.conf': No such file or directory
Error: error setting up user-mode networking: exit status 1

I have enabled user mode networking, got this error

PS C:\Users> podman machine start
Starting machine "podman-machine-default"
Starting user-mode networking...
cp: cannot stat '/mnt/wsl/resolv.conf': No such file or directory
Error: error setting up user-mode networking: exit status 1

then, i have added resolv.conf and wsl.conf
resolv.conf
nameserver 1.1.1.1
nameserver 8.8.8.8
wsl.conf
[network]
generateResolvConf = false

@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Nov 13, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 13, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants