Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add new none network #430

Merged
merged 1 commit into from
Apr 12, 2024
Merged

feat: add new none network #430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 25 additions & 2 deletions cmd/rootlesskit/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (
"github.com/rootless-containers/rootlesskit/v2/pkg/network/pasta"
"github.com/rootless-containers/rootlesskit/v2/pkg/network/slirp4netns"
"github.com/rootless-containers/rootlesskit/v2/pkg/network/vpnkit"
"github.com/rootless-containers/rootlesskit/v2/pkg/network/none"
"github.com/rootless-containers/rootlesskit/v2/pkg/parent"
"github.com/rootless-containers/rootlesskit/v2/pkg/port/builtin"
"github.com/rootless-containers/rootlesskit/v2/pkg/port/portutil"
Expand Down Expand Up @@ -83,7 +84,7 @@ See https://rootlesscontaine.rs/getting-started/common/ .
}, CategoryState),
Categorize(&cli.StringFlag{
Name: "net",
Usage: "network driver [host, pasta(experimental), slirp4netns, vpnkit, lxc-user-nic(experimental)]",
Usage: "network driver [host, none, pasta(experimental), slirp4netns, vpnkit, lxc-user-nic(experimental)]",
Value: "host",
}, CategoryNetwork),
Categorize(&cli.StringFlag{
Expand Down Expand Up @@ -368,7 +369,7 @@ func createParentOpt(clicontext *cli.Context, pipeFDEnvKey, stateDirEnvKey, pare
}

disableHostLoopback := clicontext.Bool("disable-host-loopback")
if !disableHostLoopback && clicontext.String("net") != "host" {
if !disableHostLoopback && clicontext.String("net") != "host" && clicontext.String("net") != "none" {
logrus.Warn("specifying --disable-host-loopback is highly recommended to prohibit connecting to 127.0.0.1:* on the host namespace (requires pasta, slirp4netns, or VPNKit)")
}

Expand All @@ -388,6 +389,26 @@ func createParentOpt(clicontext *cli.Context, pipeFDEnvKey, stateDirEnvKey, pare
if ifname != "" {
return opt, errors.New("ifname cannot be specified for --net=host")
}
case "none":
if mtu != 0 {
logrus.Warnf("unsupported mtu for --net=none: %d", mtu)
}
if ipnet != nil {
return opt, errors.New("custom cidr is not supported for --net=none")
}
if ifname != "" {
return opt, errors.New("ifname cannot be specified for --net=none")
}
switch portDriver := clicontext.String("port-driver"); portDriver {
case "none", "builtin":
// NOP
default:
return opt, errors.New("network \"none\" requires either port driver \"none\" or \"builtin\"")
}
opt.NetworkDriver, err = none.NewParentDriver()
if err != nil {
return opt, err
}
case "pasta":
logrus.Warn("\"pasta\" network driver is experimental. Needs very recent version of pasta (see docs/network.md).")
binary := clicontext.String("pasta-binary")
Expand Down Expand Up @@ -582,6 +603,8 @@ func createChildOpt(clicontext *cli.Context, pipeFDEnvKey, stateDirEnvKey string
switch s := clicontext.String("net"); s {
case "host":
// NOP
case "none":
// NOP
case "pasta":
opt.NetworkDriver = pasta.NewChildDriver()
case "slirp4netns":
Expand Down
60 changes: 60 additions & 0 deletions pkg/network/none/none.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
package none

import (
"context"
"os"
"os/exec"
"strconv"
"syscall"

"github.com/rootless-containers/rootlesskit/v2/pkg/api"
"github.com/rootless-containers/rootlesskit/v2/pkg/common"
"github.com/rootless-containers/rootlesskit/v2/pkg/messages"
"github.com/rootless-containers/rootlesskit/v2/pkg/network"
)

func NewParentDriver() (network.ParentDriver, error) {
return &parentDriver{}, nil
}

type parentDriver struct {
}

const DriverName = "none"

func (d *parentDriver) MTU() int {
return 0
}

func (d *parentDriver) Info(ctx context.Context) (*api.NetworkDriverInfo, error) {
return &api.NetworkDriverInfo{
Driver: DriverName,
}, nil
}

func (d *parentDriver) ConfigureNetwork(childPID int, stateDir, detachedNetNSPath string) (*messages.ParentInitNetworkDriverCompleted, func() error, error) {
var cleanups []func() error

if detachedNetNSPath != "" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got an error:

$ rootlesskit --net=none --detach-netns bash
WARN[0000] [rootlesskit:parent] specifying --disable-host-loopback is highly recommended to prohibit connecting to 127.0.0.1:* on the host namespace (requires pasta, slirp4netns, or VPNKit) 
nsenter: reassociate to namespace 'ns/net' failed: Operation not permitted
[rootlesskit:parent] error: failed to setup network &{}: exit status 1
[rootlesskit:child ] error: EOF

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, I never use --detach-netns actually, missed the test.

but then none network driver shouldn't have --detach-netns support since we don't have any network but loopback ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

none may support --detach-netns for consistency with other network drivers, but not a hard requirement.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry, I may not really understand --detach-netns well enough. I tried to put the sleep infinity before configure loopback, then if I end up something similar with --net=host, is this expected ?

	if detachedNetNSPath != "" {
		cmd := exec.Command("nsenter", "-t", strconv.Itoa(childPID), "-n"+detachedNetNSPath, "--no-fork", "-m", "-U", "--preserve-credentials", "sleep", "infinity")
		cmd.SysProcAttr = &syscall.SysProcAttr{
			Pdeathsig: syscall.SIGKILL,
		}
		err := cmd.Start()
		if err != nil {
			return nil, nil, err
		}
		childPID = cmd.Process.Pid
	}

	cmds := [][]string{
		[]string{"nsenter", "-t", strconv.Itoa(childPID), "--no-fork", "-n", "-m", "-U", "--preserve-credentials", "ip", "address", "add", "127.0.0.1/8", "dev", "lo"},
		[]string{"nsenter", "-t", strconv.Itoa(childPID), "--no-fork", "-n", "-m", "-U", "--preserve-credentials", "ip", "link", "set", "lo", "up"},
	}
	if err := common.Execs(os.Stderr, os.Environ(), cmds); err != nil {
		return nil, nil, err
	}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if that so, then configuring loppback when --detach-netns seems useless.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rootlesskit --net=none --detach-netns bash will run bash in the host netns, and detach a new lo-only netns in $ROOTLESSKIT_STATE_DIR/netns.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

got it, updated

cmd := exec.Command("nsenter", "-t", strconv.Itoa(childPID), "-n"+detachedNetNSPath, "-m", "-U", "--no-fork", "--preserve-credentials", "sleep", "infinity")
cmd.SysProcAttr = &syscall.SysProcAttr{
Pdeathsig: syscall.SIGKILL,
}
err := cmd.Start()
if err != nil {
return nil, nil, err
}
childPID = cmd.Process.Pid
}

cmds := [][]string{
[]string{"nsenter", "-t", strconv.Itoa(childPID), "-n", "-m", "-U", "--no-fork", "--preserve-credentials", "ip", "address", "add", "127.0.0.1/8", "dev", "lo"},
[]string{"nsenter", "-t", strconv.Itoa(childPID), "-n", "-m", "-U", "--no-fork", "--preserve-credentials", "ip", "link", "set", "lo", "up"},
}
if err := common.Execs(os.Stderr, os.Environ(), cmds); err != nil {
return nil, nil, err
}

netmsg := messages.ParentInitNetworkDriverCompleted{}
return &netmsg, common.Seq(cleanups), nil
}
Loading