From 3fefb86a9492841c3c32328bc380aa710791b87f Mon Sep 17 00:00:00 2001 From: Timo Beckers Date: Wed, 15 May 2024 13:44:37 +0200 Subject: [PATCH] Refactor netns handling, fix flakes, namespace some tests (#227) * netns: remove iproute2 dependency This commit introduces a breaking change to rtnetlink.NetNS. The existing netns implementation had a few problems. It assumed that network namespaces have names, that they would always be pinned to /var/run/netns, and that numeric/integer references are pid references. This made the NetNS type unusable for referring to existing netns by fd, such as ones created by other libraries, or by opening procfs entries directly as demonstrated in the new testutils.NetNS() function. The forced dependency on the `ip` CLI tool also wasn't reasonable for a pure-Go library. Using the old implementation in a scratch/distroless container would quickly run into roadblocks. This commit also removes the functionality of creating and pinning new netns. There are plenty of options out in the Go ecosystem for that, and providing your own is only a few lines of code. Signed-off-by: Timo Beckers * test: remove calls to unix.Setrlimit() in favor of rlimit.RemoveMemlock() ebpf-go provides this out of the box and skips setting the rlimit on kernels that support bpf memory cgroup accounting. Signed-off-by: Timo Beckers * neigh: fix flaky tests, add State field to Neigh entry The flaky tests that were documented in the code are expected. Use the State field to discard entries that can't reasonably be considered in tests. Signed-off-by: Timo Beckers * neigh: fix race in Conn.Neighbours When running tests locally, I would frequently hit "too many/little matches, expected 1, actual 0" due to other tests creating and deleting interfaces in the common host netns used by all tests. Neigh entries that fail the interface lookup can't have their Interface fields populated and should be dropped from the result since the interface is no longer there to begin with. Signed-off-by: Timo Beckers * xdp: refactor test suite to use test helpers and netns-driven tests While running the test suite for testing netns-related changes, I noticed some of the xdp tests started failing because they wanted to create a dummy interface in the host network namespace. Avoid the complexity of managing dummy interfaces altogether by running all tests within their own netns and use the existing lo device that's present by default. Signed-off-by: Timo Beckers * xdp,netkit: remove duplicate kernelMinReq in favor of testutils.SkipOnOldKernel There were two implementations of this, so move them to common testutils. Signed-off-by: Timo Beckers --------- Signed-off-by: Timo Beckers --- driver/bond_live_test.go | 13 +- driver/driver_test.go | 60 --------- driver/netkit_live_test.go | 19 +-- driver/veth_live_test.go | 17 +-- internal/testutils/netns.go | 55 ++++++++ internal/testutils/version.go | 41 ++++++ internal/unix/types_linux.go | 6 + internal/unix/types_other.go | 11 ++ link.go | 8 +- link_live_test.go | 241 +++++++++------------------------- netns.go | 68 +++++----- rtnl/neigh.go | 9 +- rtnl/neigh_live_test.go | 24 ++-- 13 files changed, 248 insertions(+), 324 deletions(-) create mode 100644 internal/testutils/netns.go create mode 100644 internal/testutils/version.go diff --git a/driver/bond_live_test.go b/driver/bond_live_test.go index ffd8d8b..14b48c3 100644 --- a/driver/bond_live_test.go +++ b/driver/bond_live_test.go @@ -10,6 +10,7 @@ import ( "github.com/google/go-cmp/cmp" "github.com/jsimonetti/rtnetlink/v2" + "github.com/jsimonetti/rtnetlink/v2/internal/testutils" "github.com/mdlayher/netlink" ) @@ -34,23 +35,15 @@ func bondSlaveT(d rtnetlink.LinkDriver) *BondSlave { } func TestBond(t *testing.T) { - // establish a netlink connection conn, err := rtnetlink.Dial(nil) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - bns, clean, err := createNS("bns1") + connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: testutils.NetNS(t)}) if err != nil { - t.Fatal(err) - } - defer clean() - - // use ns for testing arp ip targets - connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: int(bns.Value())}) - if err != nil { - t.Fatalf("failed to establish netlink socket to ns nkns: %v", err) + t.Fatalf("failed to establish netlink socket to netns: %v", err) } defer connNS.Close() diff --git a/driver/driver_test.go b/driver/driver_test.go index 054571d..63ce4db 100644 --- a/driver/driver_test.go +++ b/driver/driver_test.go @@ -4,43 +4,10 @@ package driver import ( - "bytes" - "fmt" - "os/exec" - "testing" - "github.com/jsimonetti/rtnetlink/v2" "golang.org/x/sys/unix" ) -func getKernelVersion() (kernel, major, minor int, err error) { - var uname unix.Utsname - if err := unix.Uname(&uname); err != nil { - return 0, 0, 0, err - } - - end := bytes.IndexByte(uname.Release[:], 0) - versionStr := uname.Release[:end] - - if count, _ := fmt.Sscanf(string(versionStr), "%d.%d.%d", &kernel, &major, &minor); count < 2 { - err = fmt.Errorf("failed to parse kernel version from: %q", string(versionStr)) - } - return -} - -// kernelMinReq checks if the runtime kernel is sufficient -// for the test -func kernelMinReq(t *testing.T, kernel, major int) { - k, m, _, err := getKernelVersion() - if err != nil { - t.Fatalf("failed to get host kernel version: %v", err) - } - if k < kernel || k == kernel && m < major { - t.Skipf("host kernel (%d.%d) does not meet test's minimum required version: (%d.%d)", - k, m, kernel, major) - } -} - // setupInterface create a interface for testing func setupInterface(conn *rtnetlink.Conn, name string, index, master uint32, driver rtnetlink.LinkDriver) error { attrs := &rtnetlink.LinkAttributes{ @@ -74,30 +41,3 @@ func getInterface(conn *rtnetlink.Conn, index uint32) (*rtnetlink.LinkMessage, e } return &interf, err } - -// creates a network namespace by utilizing ip commandline tool -// returns NetNS and clean function -func createNS(name string) (*rtnetlink.NetNS, func(), error) { - cmdPath, err := exec.LookPath("ip") - if err != nil { - return nil, nil, fmt.Errorf("getting ip command path failed, %w", err) - } - _, err = exec.Command(cmdPath, "netns", "add", name).Output() - if err != nil { - return nil, nil, fmt.Errorf("ip netns add %s, failed: %w", name, err) - } - - ns, err := rtnetlink.NewNetNS(name) - if err != nil { - return nil, nil, fmt.Errorf("reading ns %s, failed: %w", name, err) - } - return ns, func() { - if err := ns.Close(); err != nil { - fmt.Printf("closing ns file failed: %v", err) - } - _, err := exec.Command(cmdPath, "netns", "del", name).Output() - if err != nil { - fmt.Printf("removing netns %s failed, %v", name, err) - } - }, nil -} diff --git a/driver/netkit_live_test.go b/driver/netkit_live_test.go index 9b67a9a..9df03ad 100644 --- a/driver/netkit_live_test.go +++ b/driver/netkit_live_test.go @@ -8,30 +8,23 @@ import ( "github.com/google/go-cmp/cmp" "github.com/jsimonetti/rtnetlink/v2" + "github.com/jsimonetti/rtnetlink/v2/internal/testutils" "github.com/mdlayher/netlink" ) func TestNetkit(t *testing.T) { - kernelMinReq(t, 6, 7) + testutils.SkipOnOldKernel(t, "6.7", "netkit support") - // establish a netlink connection conn, err := rtnetlink.Dial(nil) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - // create netns - nkns, clean, err := createNS("nkns1") + ns := testutils.NetNS(t) + connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: ns}) if err != nil { - t.Fatal(err) - } - defer clean() - - // establish a netlink connection with netns - connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: int(nkns.Value())}) - if err != nil { - t.Fatalf("failed to establish netlink socket to ns nkns: %v", err) + t.Fatalf("failed to establish netlink socket to netns: %v", err) } defer connNS.Close() @@ -110,7 +103,7 @@ func TestNetkit(t *testing.T) { Index: ifPeerIndex, Attributes: &rtnetlink.LinkAttributes{ Name: "nke", - NetNS: nkns, + NetNS: rtnetlink.NetNSForFD(uint32(ns)), }, }, }, diff --git a/driver/veth_live_test.go b/driver/veth_live_test.go index 92e00be..d58748f 100644 --- a/driver/veth_live_test.go +++ b/driver/veth_live_test.go @@ -7,28 +7,21 @@ import ( "testing" "github.com/jsimonetti/rtnetlink/v2" + "github.com/jsimonetti/rtnetlink/v2/internal/testutils" "github.com/mdlayher/netlink" ) func TestVeth(t *testing.T) { - // establish a netlink connection conn, err := rtnetlink.Dial(nil) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - // create netns - vtns, clean, err := createNS("vtns1") + ns := testutils.NetNS(t) + connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: ns}) if err != nil { - t.Fatal(err) - } - defer clean() - - // establish a netlink connection with netns - connNS, err := rtnetlink.Dial(&netlink.Config{NetNS: int(vtns.Value())}) - if err != nil { - t.Fatalf("failed to establish netlink socket to ns vtns1: %v", err) + t.Fatalf("failed to establish netlink socket to netns: %v", err) } defer connNS.Close() @@ -74,7 +67,7 @@ func TestVeth(t *testing.T) { Index: ifPeerIndex, Attributes: &rtnetlink.LinkAttributes{ Name: "vte", - NetNS: vtns, + NetNS: rtnetlink.NetNSForFD(uint32(ns)), }, }, }, diff --git a/internal/testutils/netns.go b/internal/testutils/netns.go new file mode 100644 index 0000000..4da5cb8 --- /dev/null +++ b/internal/testutils/netns.go @@ -0,0 +1,55 @@ +package testutils + +import ( + "fmt" + "os" + "runtime" + "testing" + + "github.com/jsimonetti/rtnetlink/v2/internal/unix" + "golang.org/x/sync/errgroup" +) + +// NetNS returns a file descriptor to a new network namespace. +// The netns handle is automatically closed as part of test cleanup. +func NetNS(tb testing.TB) int { + tb.Helper() + + var ns *os.File + var eg errgroup.Group + eg.Go(func() error { + // Lock the new goroutine to its OS thread. Never unlock the goroutine so + // the thread dies when the goroutine ends to avoid having to restore the + // thread's netns. + runtime.LockOSThread() + + // Move the current thread to a new network namespace. + if err := unix.Unshare(unix.CLONE_NEWNET); err != nil { + return fmt.Errorf("unsharing netns: %w", err) + } + + f, err := os.OpenFile(fmt.Sprintf("/proc/%d/task/%d/ns/net", os.Getpid(), unix.Gettid()), + unix.O_RDONLY|unix.O_CLOEXEC, 0) + if err != nil { + return fmt.Errorf("opening netns handle: %w", err) + } + + // Store a namespace reference in the outer scope. + ns = f + + return nil + }) + + if err := eg.Wait(); err != nil { + tb.Fatal(err) + } + + tb.Cleanup(func() { + // Maintain a reference to the namespace until the end of the test, where + // the handle will close automatically and the namespace potentially + // disappears if there are no other references (veth/netkit peers, ..) to it. + ns.Close() + }) + + return int(ns.Fd()) +} diff --git a/internal/testutils/version.go b/internal/testutils/version.go new file mode 100644 index 0000000..0eef1b2 --- /dev/null +++ b/internal/testutils/version.go @@ -0,0 +1,41 @@ +package testutils + +import ( + "bytes" + "fmt" + "testing" + + "golang.org/x/sys/unix" +) + +func getKernelVersion(tb testing.TB) (maj, min, patch uint32) { + tb.Helper() + + var uname unix.Utsname + if err := unix.Uname(&uname); err != nil { + tb.Fatalf("getting uname: %s", err) + } + + end := bytes.IndexByte(uname.Release[:], 0) + versionStr := uname.Release[:end] + + if count, _ := fmt.Sscanf(string(versionStr), "%d.%d.%d", &maj, &min, &patch); count < 2 { + tb.Fatalf("failed to parse kernel version from %s", string(versionStr)) + } + return +} + +// SkipOnOldKernel skips the test if the host's kernel is lower than the given +// x.y target version. +func SkipOnOldKernel(tb testing.TB, target, reason string) { + maj, min, _ := getKernelVersion(tb) + + var maj_t, min_t, patch_t uint32 + if count, _ := fmt.Sscanf(target, "%d.%d.%d", &maj_t, &min_t, &patch_t); count < 2 { + tb.Fatalf("failed to parse target version from %s", target) + } + + if maj < maj_t || maj == maj_t && min < min_t { + tb.Skipf("host kernel (%d.%d) too old (minimum %d.%d): %s", maj, min, maj_t, min_t, reason) + } +} diff --git a/internal/unix/types_linux.go b/internal/unix/types_linux.go index 075b219..008597a 100644 --- a/internal/unix/types_linux.go +++ b/internal/unix/types_linux.go @@ -209,4 +209,10 @@ const ( NETKIT_REDIRECT = linux.NETKIT_REDIRECT NETKIT_L2 = linux.NETKIT_L2 NETKIT_L3 = linux.NETKIT_L3 + CLONE_NEWNET = linux.CLONE_NEWNET + O_RDONLY = linux.O_RDONLY + O_CLOEXEC = linux.O_CLOEXEC ) + +var Gettid = linux.Gettid +var Unshare = linux.Unshare diff --git a/internal/unix/types_other.go b/internal/unix/types_other.go index e0aa11a..8a30d79 100644 --- a/internal/unix/types_other.go +++ b/internal/unix/types_other.go @@ -205,4 +205,15 @@ const ( NETKIT_REDIRECT = 0x7 NETKIT_L2 = 0x0 NETKIT_L3 = 0x1 + CLONE_NEWNET = 0x40000000 + O_RDONLY = 0x0 + O_CLOEXEC = 0x80000 ) + +func Unshare(_ int) error { + return nil +} + +func Gettid() int { + return 0 +} diff --git a/link.go b/link.go index 634d8ef..4400d5a 100644 --- a/link.go +++ b/link.go @@ -403,7 +403,7 @@ func (a *LinkAttributes) encode(ae *netlink.AttributeEncoder) error { } if a.NetNS != nil { - ae.Uint32(a.NetNS.Type(), a.NetNS.Value()) + ae.Uint32(a.NetNS.value()) } return nil @@ -771,8 +771,8 @@ func (xdp *LinkXDP) encode(ae *netlink.AttributeEncoder) error { ae.Int32(unix.IFLA_XDP_FD, xdp.FD) ae.Int32(unix.IFLA_XDP_EXPECTED_FD, xdp.ExpectedFD) ae.Uint32(unix.IFLA_XDP_FLAGS, xdp.Flags) - // XDP_ATtACHED and XDP_PROG_ID are things that only can return from the kernel, - // not be send, so we don't encode them. - // source: https://elixir.bootlin.com/linux/v5.10.15/source/net/core/rtnetlink.c#L2894 + // XDP_ATTACHED and XDP_PROG_ID are things that can only be returned by the + // kernel, so we don't encode them. source: + // https://elixir.bootlin.com/linux/v5.10.15/source/net/core/rtnetlink.c#L2894 return nil } diff --git a/link_live_test.go b/link_live_test.go index 34fb0c7..e9b4f86 100644 --- a/link_live_test.go +++ b/link_live_test.go @@ -4,72 +4,23 @@ package rtnetlink import ( - "bytes" - "fmt" "testing" "github.com/cilium/ebpf" "github.com/cilium/ebpf/asm" + "github.com/cilium/ebpf/rlimit" + "github.com/jsimonetti/rtnetlink/v2/internal/testutils" + "github.com/mdlayher/netlink" "golang.org/x/sys/unix" ) -func getKernelVersion() (kernel, major, minor int, err error) { - var uname unix.Utsname - if err := unix.Uname(&uname); err != nil { - return 0, 0, 0, err - } - - end := bytes.IndexByte(uname.Release[:], 0) - versionStr := uname.Release[:end] - - if count, _ := fmt.Sscanf(string(versionStr), "%d.%d.%d", &kernel, &major, &minor); count < 2 { - err = fmt.Errorf("failed to parse kernel version from: %q", string(versionStr)) - } - return -} - -// kernelMinReq checks if the runtime kernel is sufficient -// for the test -func kernelMinReq(t *testing.T, kernel, major int) { - k, m, _, err := getKernelVersion() - if err != nil { - t.Fatalf("failed to get host kernel version: %v", err) - } - if k < kernel || k == kernel && m < major { - t.Skipf("host kernel (%d.%d) does not meet test's minimum required version: (%d.%d)", - k, m, kernel, major) - } -} +// lo accesses the loopback interface present in every network namespace. +var lo uint32 = 1 -// SetupDummyInterface create a dummy interface for testing and returns its -// properties -func SetupDummyInterface(conn *Conn, name string) (*LinkMessage, error) { - // construct dummy interface to test XDP program against - if err := conn.Link.New(&LinkMessage{ - Family: unix.AF_UNSPEC, - Index: 1001, - Flags: unix.IFF_UP, - Attributes: &LinkAttributes{ - Name: name, - Info: &LinkInfo{Kind: "dummy"}, - }, - }); err != nil { - return nil, err - } - - // get info for the dummy interface - interf, err := conn.Link.Get(1001) - if err != nil { - conn.Link.Delete(interf.Index) - return nil, err - } - return &interf, err -} +func xdpPrograms(tb testing.TB) (int32, int32) { + tb.Helper() -func GetBPFPrograms() (int32, int32, error) { - // load a BPF test program. If it fails error out of the tests - // and clean up dummy interface. The program loads XDP_PASS - // into the return value register. + // Load XDP_PASS into the return value register. bpfProgram := &ebpf.ProgramSpec{ Type: ebpf.XDP, Instructions: asm.Instructions{ @@ -80,20 +31,26 @@ func GetBPFPrograms() (int32, int32, error) { } prog1, err := ebpf.NewProgram(bpfProgram) if err != nil { - return 0, 0, err + tb.Fatal(err) } prog2, err := ebpf.NewProgram(bpfProgram) if err != nil { - return 0, 0, err + tb.Fatal(err) } + tb.Cleanup(func() { + prog1.Close() + prog2.Close() + }) + // Use the file descriptor of the programs - return int32(prog1.FD()), int32(prog2.FD()), nil + return int32(prog1.FD()), int32(prog2.FD()) } -// SendXDPMsg sends a XDP netlink msg with the specified LinkXDP properties -func SendXPDMsg(conn *Conn, ifIndex uint32, xdp *LinkXDP) error { +func attachXDP(tb testing.TB, conn *Conn, ifIndex uint32, xdp *LinkXDP) { + tb.Helper() + message := LinkMessage{ Family: unix.AF_UNSPEC, Index: ifIndex, @@ -102,46 +59,36 @@ func SendXPDMsg(conn *Conn, ifIndex uint32, xdp *LinkXDP) error { }, } - return conn.Link.Set(&message) + if err := conn.Link.Set(&message); err != nil { + tb.Fatalf("attaching program with fd %d to link at ifindex %d: %s", xdp.FD, ifIndex, err) + } } -// GetXDPProperties returns the XDP attach, XDP prog ID and errors when the +// getXDP returns the XDP attach, XDP prog ID and errors when the // interface could not be fetched -func GetXDPProperties(conn *Conn, ifIndex uint32) (uint8, uint32, error) { +func getXDP(tb testing.TB, conn *Conn, ifIndex uint32) (uint8, uint32) { + tb.Helper() + interf, err := conn.Link.Get(ifIndex) if err != nil { - return 0, 0, err + tb.Fatalf("getting link xdp properties: %s", err) } - return interf.Attributes.XDP.Attached, interf.Attributes.XDP.ProgID, nil + + return interf.Attributes.XDP.Attached, interf.Attributes.XDP.ProgID } func TestLinkXDPAttach(t *testing.T) { - // BPF loading requires a high RLIMIT_MEMLOCK. - n := uint64(1024 * 1024 * 10) - err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &unix.Rlimit{Cur: n, Max: n}) - if err != nil { - t.Fatalf("failed to increase RLIMIT_MEMLOCK: %v", err) + if err := rlimit.RemoveMemlock(); err != nil { + t.Fatal(err) } - // establish a netlink connections - conn, err := Dial(nil) + conn, err := Dial(&netlink.Config{NetNS: testutils.NetNS(t)}) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - // setup dummy interface for the test - interf, err := SetupDummyInterface(conn, "dummyXDPAttach") - if err != nil { - t.Fatalf("failed to setup dummy interface: %v", err) - } - defer conn.Link.Delete(interf.Index) - - // get a BPF program - progFD1, progFD2, err := GetBPFPrograms() - if err != nil { - t.Fatalf("failed to load bpf programs: %v", err) - } + progFD1, progFD2 := xdpPrograms(t) tests := []struct { name string @@ -182,22 +129,12 @@ func TestLinkXDPAttach(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - // attach the BPF program to the link - err = SendXPDMsg(conn, interf.Index, tt.xdp) - if err != nil { - t.Fatalf("failed to attach XDP program to link: %v", err) - } - - // validate the XDP properites of the link - attached, progID, err := GetXDPProperties(conn, interf.Index) - if err != nil { - t.Fatalf("failed to get XDP properties from the link: %v", err) - } + attachXDP(t, conn, lo, tt.xdp) + attached, progID := getXDP(t, conn, lo) if attached != unix.XDP_FLAGS_SKB_MODE { t.Fatalf("XDP attached state does not match. Got: %d, wanted: %d", attached, unix.XDP_FLAGS_SKB_MODE) } - if attached == unix.XDP_FLAGS_SKB_MODE && progID == 0 { t.Fatalf("XDP program should be attached but program ID is 0") } @@ -206,60 +143,33 @@ func TestLinkXDPAttach(t *testing.T) { } func TestLinkXDPClear(t *testing.T) { - // BPF loading requires a high RLIMIT_MEMLOCK. - n := uint64(1024 * 1024 * 10) - err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &unix.Rlimit{Cur: n, Max: n}) - if err != nil { - t.Fatalf("failed to increase RLIMIT_MEMLOCK: %v", err) + if err := rlimit.RemoveMemlock(); err != nil { + t.Fatal(err) } - // establish a netlink connections - conn, err := Dial(nil) + conn, err := Dial(&netlink.Config{NetNS: testutils.NetNS(t)}) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - // setup dummy interface for the test - interf, err := SetupDummyInterface(conn, "dummyXDPClear") - if err != nil { - t.Fatalf("failed to setup dummy interface: %v", err) - } - defer conn.Link.Delete(interf.Index) - - // get a BPF program - progFD1, _, err := GetBPFPrograms() - if err != nil { - t.Fatalf("failed to load bpf programs: %v", err) - } + progFD1, _ := xdpPrograms(t) - // attach the BPF program to the link - err = SendXPDMsg(conn, interf.Index, &LinkXDP{ + attachXDP(t, conn, lo, &LinkXDP{ FD: progFD1, Flags: unix.XDP_FLAGS_SKB_MODE, }) - if err != nil { - t.Fatalf("failed to attach XDP program to link: %v", err) - } // clear the BPF program from the link - err = SendXPDMsg(conn, interf.Index, &LinkXDP{ + attachXDP(t, conn, lo, &LinkXDP{ FD: -1, Flags: unix.XDP_FLAGS_SKB_MODE, }) - if err != nil { - t.Fatalf("failed to clear XDP program to link: %v", err) - } - - attached, progID, err := GetXDPProperties(conn, interf.Index) - if err != nil { - t.Fatalf("failed to get XDP program ID 1 from interface: %v", err) - } + attached, progID := getXDP(t, conn, lo) if progID != 0 { t.Fatalf("there is still a program loaded, while we cleared the link") } - if attached != 0 { t.Fatalf( "XDP attached state does not match. Got: %d, wanted: %d\nThere should be no program loaded", @@ -278,78 +188,53 @@ func TestLinkXDPReplace(t *testing.T) { // https://elixir.bootlin.com/linux/v5.6/source/net/core/dev.c#L8662 // source kernel 5.7: // https://elixir.bootlin.com/linux/v5.7/source/net/core/dev.c#L8674 - kernelMinReq(t, 5, 7) + testutils.SkipOnOldKernel(t, "5.7", "XDP_FLAGS_REPLACE") - // BPF loading requires a high RLIMIT_MEMLOCK. - n := uint64(1024 * 1024 * 10) - err := unix.Setrlimit(unix.RLIMIT_MEMLOCK, &unix.Rlimit{Cur: n, Max: n}) - if err != nil { - t.Fatalf("failed to increase RLIMIT_MEMLOCK: %v", err) + if err := rlimit.RemoveMemlock(); err != nil { + t.Fatal(err) } - // establish a netlink connections - conn, err := Dial(nil) + conn, err := Dial(&netlink.Config{NetNS: testutils.NetNS(t)}) if err != nil { t.Fatalf("failed to establish netlink socket: %v", err) } defer conn.Close() - // setup dummy interface for the test - interf, err := SetupDummyInterface(conn, "dummyXDPReplace") - if err != nil { - t.Fatalf("failed to setup dummy interface: %v", err) - } - defer conn.Link.Delete(interf.Index) - - // get BPF programs - progFD1, progFD2, err := GetBPFPrograms() - if err != nil { - t.Fatalf("failed to load bpf programs: %v", err) - } + progFD1, progFD2 := xdpPrograms(t) - err = SendXPDMsg(conn, interf.Index, &LinkXDP{ + attachXDP(t, conn, lo, &LinkXDP{ FD: progFD1, Flags: unix.XDP_FLAGS_SKB_MODE, }) - if err != nil { - t.Fatalf("failed to attach XDP program 1 to link: %v", err) - } - _, progID1, err := GetXDPProperties(conn, interf.Index) - if err != nil { - t.Fatalf("failed to get XDP program ID 1 from interface: %v", err) - } + _, progID1 := getXDP(t, conn, lo) - err = SendXPDMsg(conn, interf.Index, &LinkXDP{ - FD: progFD2, - ExpectedFD: progFD2, - Flags: unix.XDP_FLAGS_SKB_MODE | unix.XDP_FLAGS_REPLACE, - }) - if err == nil { + if err := conn.Link.Set(&LinkMessage{ + Family: unix.AF_UNSPEC, + Index: lo, + Attributes: &LinkAttributes{ + XDP: &LinkXDP{ + FD: progFD2, + ExpectedFD: progFD2, + Flags: unix.XDP_FLAGS_SKB_MODE | unix.XDP_FLAGS_REPLACE, + }, + }, + }); err == nil { t.Fatalf("replaced XDP program while expected FD did not match: %v", err) } - _, progID2, err := GetXDPProperties(conn, interf.Index) - if err != nil { - t.Fatalf("failed to get XDP program ID 2 from interface: %v", err) - } + _, progID2 := getXDP(t, conn, lo) if progID2 != progID1 { t.Fatal("XDP prog ID does not match previous program ID, which it should") } - err = SendXPDMsg(conn, interf.Index, &LinkXDP{ + attachXDP(t, conn, lo, &LinkXDP{ FD: progFD2, ExpectedFD: progFD1, Flags: unix.XDP_FLAGS_SKB_MODE | unix.XDP_FLAGS_REPLACE, }) - if err != nil { - t.Fatalf("could not replace XDP program: %v", err) - } - _, progID2, err = GetXDPProperties(conn, interf.Index) - if err != nil { - t.Fatalf("failed to get XDP program ID 2 from interface: %v", err) - } + _, progID2 = getXDP(t, conn, lo) if progID2 == progID1 { t.Fatal("XDP prog ID does match previous program ID, which it shouldn't") } diff --git a/netns.go b/netns.go index 1e9a8d8..55c48c1 100644 --- a/netns.go +++ b/netns.go @@ -1,54 +1,46 @@ package rtnetlink import ( - "os" - "path/filepath" - "github.com/jsimonetti/rtnetlink/v2/internal/unix" ) -// NetNS represents a Linux network namespace +// NetNS represents a Linux network namespace handle to specify in +// [LinkAttributes]. +// +// Use [NetNSForPID] to create a handle to the network namespace of an existing +// PID, or [NetNSForFD] for a handle to an existing network namespace created by +// another library. type NetNS struct { - file *os.File - pid uint32 + fd *uint32 + pid *uint32 } -// NewNetNS returns a new NetNS from the given type -// When an uint32 is given simply the pid value is set -// When a string is given a namespace file is opened with the name and the file descriptor is set -// The file descriptor should be closed after use with the Close() method -func NewNetNS[T string | uint32](t T) (*NetNS, error) { - if name, ok := any(t).(string); ok { - file, err := os.Open(filepath.Join("/var/run/netns", name)) - if err != nil { - return nil, err - } - - return &NetNS{file: file}, nil - } - return &NetNS{pid: any(t).(uint32)}, nil +// NetNSForPID returns a handle to the network namespace of an existing process +// given its pid. The process must be alive when the NetNS is used in any API +// calls. +// +// The resulting NetNS doesn't hold a hard reference to the netns (it doesn't +// increase its refcount) and becomes invalid when the process it points to +// dies. +func NetNSForPID(pid uint32) *NetNS { + return &NetNS{pid: &pid} } -// Type returns either unix.IFLA_NET_NS_FD or unix.IFLA_NET_NS_PID according ns data type -func (n *NetNS) Type() uint16 { - if n.file != nil { - return unix.IFLA_NET_NS_FD - } - return unix.IFLA_NET_NS_PID +// NetNSForFD returns a handle to an existing network namespace created by +// another library. It does not clone fd or manage its lifecycle in any way. +// The caller is responsible for making sure the underlying fd stays alive +// for the duration of any API calls using the NetNS. +func NetNSForFD(fd uint32) *NetNS { + return &NetNS{fd: &fd} } -// Value returns either a file descriptor value or the pid value of the ns -func (n *NetNS) Value() uint32 { - if n.file != nil { - return uint32(n.file.Fd()) +// value returns the type and value of the NetNS for use in netlink attributes. +func (ns *NetNS) value() (uint16, uint32) { + if ns.fd != nil { + return unix.IFLA_NET_NS_FD, *ns.fd } - return n.pid -} - -// Close closes the file descriptor -func (n *NetNS) Close() error { - if n.file != nil { - return n.file.Close() + if ns.pid != nil { + return unix.IFLA_NET_NS_PID, *ns.pid } - return nil + return 0, 0 } diff --git a/rtnl/neigh.go b/rtnl/neigh.go index 8705bba..058d928 100644 --- a/rtnl/neigh.go +++ b/rtnl/neigh.go @@ -11,6 +11,10 @@ type Neigh struct { HwAddr net.HardwareAddr // Link-layer address IP net.IP // Network-layer address Interface *net.Interface // Network interface + + // Bitfield representing the state of the neighbor entry, + // corresponding to the NUD_ constants. + State uint16 } // Neighbours lists entries from the neighbor table (e.g. the ARP table). @@ -38,7 +42,9 @@ func (c *Conn) Neighbours(ifc *net.Interface, family int) (r []*Neigh, err error if !ok { iface, err = c.LinkByIndex(ifindex) if err != nil { - return nil, err + // Received a neigh entry for a link that no longer exists, so we cannot + // populate the Interface field. Skip the entry. + continue } ifcache[ifindex] = iface } @@ -46,6 +52,7 @@ func (c *Conn) Neighbours(ifc *net.Interface, family int) (r []*Neigh, err error HwAddr: m.Attributes.LLAddress, IP: m.Attributes.Address, Interface: iface, + State: m.State, } r = append(r, p) } diff --git a/rtnl/neigh_live_test.go b/rtnl/neigh_live_test.go index bc97565..47c1c85 100644 --- a/rtnl/neigh_live_test.go +++ b/rtnl/neigh_live_test.go @@ -6,6 +6,8 @@ package rtnl import ( "net" "testing" + + "golang.org/x/sys/unix" ) func TestLiveNeighbours(t *testing.T) { @@ -27,26 +29,32 @@ func TestLiveNeighbours(t *testing.T) { } for i, e := range neigtab { t.Logf("* neighbour table entry [%d]: %v", i, e) + + // Ignore neighbor entries in internal/pseudo state. + if e.State == unix.NUD_NONE { + continue + } + // Loopback and p2p interfaces can have neigh entries with a zero IP address. if e.IP.IsUnspecified() { - // This test doesn't seem to be very reliable - // Disabling for now - // t.Error("zero e.IP, expected non-zero") continue } + if e.Interface == nil { t.Error("nil e.Interface, expected non-nil") - continue } if len(e.Interface.Name) == 0 { t.Error("zero-length e.Interface.Name") } - if e.IP.IsLoopback() { + + // Don't (always) expect hardware address info on entries marked noarp, + // as they include link-local multicast and loopback addresses that are + // valid for all interfaces on the host. + if e.State == unix.NUD_NOARP { continue } + if hardwareAddrIsUnspecified(e.HwAddr) { - // This test doesn't seem to be very reliable - // Disabling for now - // t.Error("zero e.HwAddr, expected non-zero") + t.Error("zero e.HwAddr, expected non-zero") } if hardwareAddrIsUnspecified(e.Interface.HardwareAddr) { t.Error("zero e.Interface.HardwareAddr, expected non-zero")