summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authoraleks-mariusz <a+git-commit@alek.cx>2020-06-16 11:36:33 +0100
committerGiuseppe Scrivano <gscrivan@redhat.com>2020-07-15 08:04:35 +0200
commit8d12f19371eb9d91139f7b982cde2926ec8c8e74 (patch)
treed589e8dcc9b097f5e63aa2b3272c4e8e3ad35d44
parentc4843d4e9ce395f1bbcaae848e6172f5a4519a35 (diff)
downloadpodman-8d12f19371eb9d91139f7b982cde2926ec8c8e74.tar.gz
podman-8d12f19371eb9d91139f7b982cde2926ec8c8e74.tar.bz2
podman-8d12f19371eb9d91139f7b982cde2926ec8c8e74.zip
allow switching of port-forward approaches in rootless/using slirp4netns
As of podman 1.8.0, because of commit da7595a, the default approach of providing port-forwarding in rootless mode has switched (and been hard-coded) to rootlessport, for the purpose of providing super performance. The side-effect of this switch is source within the container to the port-forwarded service always appears to originate from 127.0.0.1 (see issue #5138). This commit allows a user to specify if they want to revert to the previous approach of leveraging slirp4netns add_hostfwd() api which, although not as stellar performance, restores usefulness of seeing incoming traffic origin IP addresses. The change should be transparent; when not specified, rootlessport will continue to be used, however if specifying --net slirp4netns:slirplisten the old approach will be used. Note: the above may imply the restored port-forwarding via slirp4netns is not as performant as the new rootlessport approach, however the figures shared in the original commit that introduced rootlessport are as follows: slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps, which are more than sufficient for many use cases where the origin of traffic is more important than limits that cannot be reached due to bottlenecks elsewhere. Signed-off-by: Aleks Mariusz <m.k@alek.cx> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
-rw-r--r--libpod/networking_linux.go111
-rw-r--r--pkg/namespaces/namespaces.go26
-rw-r--r--pkg/specgen/generate/namespaces.go7
-rw-r--r--pkg/specgen/namespaces.go24
4 files changed, 160 insertions, 8 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index 5a8faa7a4..db8aa219b 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -173,6 +173,19 @@ type slirpFeatures struct {
HasEnableSeccomp bool
}
+type slirp4netnsCmdArg struct {
+ Proto string `json:"proto,omitempty"`
+ HostAddr string `json:"host_addr"`
+ HostPort int32 `json:"host_port"`
+ GuestAddr string `json:"guest_addr"`
+ GuestPort int32 `json:"guest_port"`
+}
+
+type slirp4netnsCmd struct {
+ Execute string `json:"execute"`
+ Args slirp4netnsCmdArg `json:"arguments"`
+}
+
func checkSlirpFlags(path string) (*slirpFeatures, error) {
cmd := exec.Command(path, "--help")
out, err := cmd.CombinedOutput()
@@ -228,6 +241,12 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
cmdArgs = append(cmdArgs, "--enable-seccomp")
}
+ var apiSocket string
+ if havePortMapping && ctr.config.NetMode.IsPortForwardViaSlirpHostFwd() {
+ apiSocket = filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("%s.net", ctr.config.ID))
+ cmdArgs = append(cmdArgs, "--api-socket", apiSocket)
+ }
+
// the slirp4netns arguments being passed are describes as follows:
// from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns
// -c, --configure Brings up the tap interface
@@ -291,7 +310,11 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) error {
}
if havePortMapping {
- return r.setupRootlessPortMapping(ctr, netnsPath)
+ if ctr.config.NetMode.IsPortForwardViaSlirpHostFwd() {
+ return r.setupRootlessPortMappingViaSlirp(ctr, cmd, apiSocket)
+ } else {
+ return r.setupRootlessPortMappingViaRLK(ctr, netnsPath)
+ }
}
return nil
}
@@ -342,7 +365,7 @@ func waitForSync(syncR *os.File, cmd *exec.Cmd, logFile io.ReadSeeker, timeout t
return nil
}
-func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) error {
+func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath string) error {
syncR, syncW, err := os.Pipe()
if err != nil {
return errors.Wrapf(err, "failed to open pipe")
@@ -419,6 +442,90 @@ func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) err
return nil
}
+func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd, apiSocket string) (err error) {
+ const pidWaitTimeout = 60 * time.Second
+ chWait := make(chan error)
+ go func() {
+ interval := 25 * time.Millisecond
+ for i := time.Duration(0); i < pidWaitTimeout; i += interval {
+ // Check if the process is still running.
+ var status syscall.WaitStatus
+ pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil)
+ if err != nil {
+ break
+ }
+ if pid != cmd.Process.Pid {
+ continue
+ }
+ if status.Exited() || status.Signaled() {
+ chWait <- fmt.Errorf("slirp4netns exited with status %d", status.ExitStatus())
+ }
+ time.Sleep(interval)
+ }
+ }()
+ defer close(chWait)
+
+ // wait that API socket file appears before trying to use it.
+ if _, err := WaitForFile(apiSocket, chWait, pidWaitTimeout); err != nil {
+ return errors.Wrapf(err, "waiting for slirp4nets to create the api socket file %s", apiSocket)
+ }
+
+ // for each port we want to add we need to open a connection to the slirp4netns control socket
+ // and send the add_hostfwd command.
+ for _, i := range ctr.config.PortMappings {
+ conn, err := net.Dial("unix", apiSocket)
+ if err != nil {
+ return errors.Wrapf(err, "cannot open connection to %s", apiSocket)
+ }
+ defer func() {
+ if err := conn.Close(); err != nil {
+ logrus.Errorf("unable to close connection: %q", err)
+ }
+ }()
+ hostIP := i.HostIP
+ if hostIP == "" {
+ hostIP = "0.0.0.0"
+ }
+ apiCmd := slirp4netnsCmd{
+ Execute: "add_hostfwd",
+ Args: slirp4netnsCmdArg{
+ Proto: i.Protocol,
+ HostAddr: hostIP,
+ HostPort: i.HostPort,
+ GuestPort: i.ContainerPort,
+ },
+ }
+ // create the JSON payload and send it. Mark the end of request shutting down writes
+ // to the socket, as requested by slirp4netns.
+ data, err := json.Marshal(&apiCmd)
+ if err != nil {
+ return errors.Wrapf(err, "cannot marshal JSON for slirp4netns")
+ }
+ if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
+ return errors.Wrapf(err, "cannot write to control socket %s", apiSocket)
+ }
+ if err := conn.(*net.UnixConn).CloseWrite(); err != nil {
+ return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket)
+ }
+ buf := make([]byte, 2048)
+ readLength, err := conn.Read(buf)
+ if err != nil {
+ return errors.Wrapf(err, "cannot read from control socket %s", apiSocket)
+ }
+ // if there is no 'error' key in the received JSON data, then the operation was
+ // successful.
+ var y map[string]interface{}
+ if err := json.Unmarshal(buf[0:readLength], &y); err != nil {
+ return errors.Wrapf(err, "error parsing error status from slirp4netns")
+ }
+ if e, found := y["error"]; found {
+ return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e)
+ }
+ }
+ logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready")
+ return nil
+}
+
// Configure the network namespace using the container process
func (r *Runtime) setupNetNS(ctr *Container) error {
nsProcess := fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID)
diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go
index 2ffbde977..b4ec04699 100644
--- a/pkg/namespaces/namespaces.go
+++ b/pkg/namespaces/namespaces.go
@@ -17,7 +17,9 @@ const (
nsType = "ns"
podType = "pod"
privateType = "private"
+ rlkFwdType = "port_handler=rootlesskit"
shareableType = "shareable"
+ slirpFwdType = "port_handler=slirp4netns"
slirpType = "slirp4netns"
)
@@ -385,7 +387,29 @@ func (n NetworkMode) IsBridge() bool {
// IsSlirp4netns indicates if we are running a rootless network stack
func (n NetworkMode) IsSlirp4netns() bool {
- return n == slirpType
+ return n == slirpType || strings.HasPrefix(string(n), slirpType+":")
+}
+
+// IsPortForwardViaRootlessKit indicates if we are doing rootless port-forwarding via rootlesskit/rootlessport
+func (n NetworkMode) IsPortForwardViaRootlessKit() bool {
+ if !n.IsSlirp4netns() {
+ return false
+ }
+ parts := strings.SplitN(string(n), ":", 2)
+ if len(parts) == 2 {
+ return parts[1] == rlkFwdType
+ }
+ return true
+}
+
+// IsPortForwardViaSlirpHostFwd indicates if we are doing rootless port-forwarding via slirp4netns add_hostfwd()
+func (n NetworkMode) IsPortForwardViaSlirpHostFwd() bool {
+ if !n.IsSlirp4netns() {
+ return false
+ }
+ // below here, implied IsSlirp4netns() == true
+ parts := strings.SplitN(string(n), ":", 2)
+ return len(parts) > 1 && parts[1] == slirpFwdType
}
// IsNS indicates a network namespace passed in by path (ns:<path>)
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index 09d6ba445..e038fc84e 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -2,6 +2,7 @@ package generate
import (
"context"
+ "fmt"
"os"
"strings"
@@ -226,7 +227,11 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
if err != nil {
return nil, err
}
- toReturn = append(toReturn, libpod.WithNetNS(portMappings, postConfigureNetNS, "slirp4netns", nil))
+ val := "slirp4netns"
+ if s.NetNS.Value != "" {
+ val = fmt.Sprintf("slirp4netns:%s", s.NetNS.Value)
+ }
+ toReturn = append(toReturn, libpod.WithNetNS(portMappings, postConfigureNetNS, val, nil))
case specgen.Bridge:
portMappings, err := createPortMappings(ctx, s, img)
if err != nil {
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 5f56b242b..e62c8b709 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -108,7 +108,19 @@ func validateNetNS(n *Namespace) error {
return nil
}
switch n.NSMode {
- case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge, Slirp:
+ case Slirp:
+ if n.Value != "" {
+ parts := strings.Split(n.Value, ",")
+ for _, p := range parts {
+ switch p {
+ case "port_handler=slirp4netns", "port_handler=rootlesskit":
+ default:
+ return errors.Errorf("invalid value for slirp %q", n.Value)
+ }
+ }
+ }
+ break
+ case "", Default, Host, Path, FromContainer, FromPod, Private, NoNetwork, Bridge:
break
default:
return errors.Errorf("invalid network %q", n.NSMode)
@@ -119,8 +131,8 @@ func validateNetNS(n *Namespace) error {
if len(n.Value) < 1 {
return errors.Errorf("namespace mode %s requires a value", n.NSMode)
}
- } else {
- // All others must NOT set a string value
+ } else if n.NSMode != Slirp {
+ // All others except must NOT set a string value
if len(n.Value) > 0 {
return errors.Errorf("namespace value %s cannot be provided with namespace mode %s", n.Value, n.NSMode)
}
@@ -250,8 +262,12 @@ func ParseNetworkNamespace(ns string) (Namespace, []string, error) {
var cniNetworks []string
// Net defaults to Slirp on rootless
switch {
- case ns == "slirp4netns":
+ case ns == "slirp4netns", strings.HasPrefix(ns, "slirp4netns:"):
+ split := strings.SplitN(ns, ":", 2)
toReturn.NSMode = Slirp
+ if len(split) > 1 {
+ toReturn.Value = split[1]
+ }
case ns == "pod":
toReturn.NSMode = FromPod
case ns == "":