diff options
Diffstat (limited to 'vendor/github.com/containernetworking/plugins/pkg')
7 files changed, 0 insertions, 640 deletions
diff --git a/vendor/github.com/containernetworking/plugins/pkg/ns/README.md b/vendor/github.com/containernetworking/plugins/pkg/ns/README.md deleted file mode 100644 index 1e265c7..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/ns/README.md +++ /dev/null @@ -1,41 +0,0 @@ -### Namespaces, Threads, and Go -On Linux each OS thread can have a different network namespace. Go's thread scheduling model switches goroutines between OS threads based on OS thread load and whether the goroutine would block other goroutines. This can result in a goroutine switching network namespaces without notice and lead to errors in your code. - -### Namespace Switching -Switching namespaces with the `ns.Set()` method is not recommended without additional strategies to prevent unexpected namespace changes when your goroutines switch OS threads. - -Go provides the `runtime.LockOSThread()` function to ensure a specific goroutine executes on its current OS thread and prevents any other goroutine from running in that thread until the locked one exits. Careful usage of `LockOSThread()` and goroutines can provide good control over which network namespace a given goroutine executes in. - -For example, you cannot rely on the `ns.Set()` namespace being the current namespace after the `Set()` call unless you do two things. First, the goroutine calling `Set()` must have previously called `LockOSThread()`. Second, you must ensure `runtime.UnlockOSThread()` is not called somewhere in-between. You also cannot rely on the initial network namespace remaining the current network namespace if any other code in your program switches namespaces, unless you have already called `LockOSThread()` in that goroutine. Note that `LockOSThread()` prevents the Go scheduler from optimally scheduling goroutines for best performance, so `LockOSThread()` should only be used in small, isolated goroutines that release the lock quickly. - -### Do() The Recommended Thing -The `ns.Do()` method provides **partial** control over network namespaces for you by implementing these strategies. All code dependent on a particular network namespace (including the root namespace) should be wrapped in the `ns.Do()` method to ensure the correct namespace is selected for the duration of your code. For example: - -```go -err = targetNs.Do(func(hostNs ns.NetNS) error { - dummy := &netlink.Dummy{ - LinkAttrs: netlink.LinkAttrs{ - Name: "dummy0", - }, - } - return netlink.LinkAdd(dummy) -}) -``` - -Note this requirement to wrap every network call is very onerous - any libraries you call might call out to network services such as DNS, and all such calls need to be protected after you call `ns.Do()`. All goroutines spawned from within the `ns.Do` will not inherit the new namespace. The CNI plugins all exit very soon after calling `ns.Do()` which helps to minimize the problem. - -When a new thread is spawned in Linux, it inherits the namespace of its parent. In versions of go **prior to 1.10**, if the runtime spawns a new OS thread, it picks the parent randomly. If the chosen parent thread has been moved to a new namespace (even temporarily), the new OS thread will be permanently "stuck in the wrong namespace", and goroutines will non-deterministically switch namespaces as they are rescheduled. - -In short, **there was no safe way to change network namespaces, even temporarily, from within a long-lived, multithreaded Go process**. If you wish to do this, you must use go 1.10 or greater. - - -### Creating network namespaces -Earlier versions of this library managed namespace creation, but as CNI does not actually utilize this feature (and it was essentially unmaintained), it was removed. If you're writing a container runtime, you should implement namespace management yourself. However, there are some gotchas when doing so, especially around handling `/var/run/netns`. A reasonably correct reference implementation, borrowed from `rkt`, can be found in `pkg/testutils/netns_linux.go` if you're in need of a source of inspiration. - - -### Further Reading - - https://github.com/golang/go/wiki/LockOSThread - - http://morsmachine.dk/go-scheduler - - https://github.com/containernetworking/cni/issues/262 - - https://golang.org/pkg/runtime/ - - https://www.weave.works/blog/linux-namespaces-and-go-don-t-mix diff --git a/vendor/github.com/containernetworking/plugins/pkg/ns/ns_linux.go b/vendor/github.com/containernetworking/plugins/pkg/ns/ns_linux.go deleted file mode 100644 index 31ad5f6..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/ns/ns_linux.go +++ /dev/null @@ -1,216 +0,0 @@ -// Copyright 2015-2017 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package ns - -import ( - "fmt" - "os" - "runtime" - "sync" - "syscall" - - "golang.org/x/sys/unix" -) - -// Returns an object representing the current OS thread's network namespace -func GetCurrentNS() (NetNS, error) { - return GetNS(getCurrentThreadNetNSPath()) -} - -func getCurrentThreadNetNSPath() string { - // /proc/self/ns/net returns the namespace of the main thread, not - // of whatever thread this goroutine is running on. Make sure we - // use the thread's net namespace since the thread is switching around - return fmt.Sprintf("/proc/%d/task/%d/ns/net", os.Getpid(), unix.Gettid()) -} - -func (ns *netNS) Close() error { - if err := ns.errorIfClosed(); err != nil { - return err - } - - if err := ns.file.Close(); err != nil { - return fmt.Errorf("Failed to close %q: %v", ns.file.Name(), err) - } - ns.closed = true - - return nil -} - -func (ns *netNS) Set() error { - if err := ns.errorIfClosed(); err != nil { - return err - } - - if err := unix.Setns(int(ns.Fd()), unix.CLONE_NEWNET); err != nil { - return fmt.Errorf("Error switching to ns %v: %v", ns.file.Name(), err) - } - - return nil -} - -type NetNS interface { - // Executes the passed closure in this object's network namespace, - // attempting to restore the original namespace before returning. - // However, since each OS thread can have a different network namespace, - // and Go's thread scheduling is highly variable, callers cannot - // guarantee any specific namespace is set unless operations that - // require that namespace are wrapped with Do(). Also, no code called - // from Do() should call runtime.UnlockOSThread(), or the risk - // of executing code in an incorrect namespace will be greater. See - // https://github.com/golang/go/wiki/LockOSThread for further details. - Do(toRun func(NetNS) error) error - - // Sets the current network namespace to this object's network namespace. - // Note that since Go's thread scheduling is highly variable, callers - // cannot guarantee the requested namespace will be the current namespace - // after this function is called; to ensure this wrap operations that - // require the namespace with Do() instead. - Set() error - - // Returns the filesystem path representing this object's network namespace - Path() string - - // Returns a file descriptor representing this object's network namespace - Fd() uintptr - - // Cleans up this instance of the network namespace; if this instance - // is the last user the namespace will be destroyed - Close() error -} - -type netNS struct { - file *os.File - closed bool -} - -// netNS implements the NetNS interface -var _ NetNS = &netNS{} - -const ( - // https://github.com/torvalds/linux/blob/master/include/uapi/linux/magic.h - NSFS_MAGIC = 0x6e736673 - PROCFS_MAGIC = 0x9fa0 -) - -type NSPathNotExistErr struct{ msg string } - -func (e NSPathNotExistErr) Error() string { return e.msg } - -type NSPathNotNSErr struct{ msg string } - -func (e NSPathNotNSErr) Error() string { return e.msg } - -func IsNSorErr(nspath string) error { - stat := syscall.Statfs_t{} - if err := syscall.Statfs(nspath, &stat); err != nil { - if os.IsNotExist(err) { - err = NSPathNotExistErr{msg: fmt.Sprintf("failed to Statfs %q: %v", nspath, err)} - } else { - err = fmt.Errorf("failed to Statfs %q: %v", nspath, err) - } - return err - } - - switch stat.Type { - case PROCFS_MAGIC, NSFS_MAGIC: - return nil - default: - return NSPathNotNSErr{msg: fmt.Sprintf("unknown FS magic on %q: %x", nspath, stat.Type)} - } -} - -// Returns an object representing the namespace referred to by @path -func GetNS(nspath string) (NetNS, error) { - err := IsNSorErr(nspath) - if err != nil { - return nil, err - } - - fd, err := os.Open(nspath) - if err != nil { - return nil, err - } - - return &netNS{file: fd}, nil -} - -func (ns *netNS) Path() string { - return ns.file.Name() -} - -func (ns *netNS) Fd() uintptr { - return ns.file.Fd() -} - -func (ns *netNS) errorIfClosed() error { - if ns.closed { - return fmt.Errorf("%q has already been closed", ns.file.Name()) - } - return nil -} - -func (ns *netNS) Do(toRun func(NetNS) error) error { - if err := ns.errorIfClosed(); err != nil { - return err - } - - containedCall := func(hostNS NetNS) error { - threadNS, err := GetCurrentNS() - if err != nil { - return fmt.Errorf("failed to open current netns: %v", err) - } - defer threadNS.Close() - - // switch to target namespace - if err = ns.Set(); err != nil { - return fmt.Errorf("error switching to ns %v: %v", ns.file.Name(), err) - } - defer threadNS.Set() // switch back - - return toRun(hostNS) - } - - // save a handle to current network namespace - hostNS, err := GetCurrentNS() - if err != nil { - return fmt.Errorf("Failed to open current namespace: %v", err) - } - defer hostNS.Close() - - var wg sync.WaitGroup - wg.Add(1) - - var innerError error - go func() { - defer wg.Done() - runtime.LockOSThread() - innerError = containedCall(hostNS) - }() - wg.Wait() - - return innerError -} - -// WithNetNSPath executes the passed closure under the given network -// namespace, restoring the original namespace afterwards. -func WithNetNSPath(nspath string, toRun func(NetNS) error) error { - ns, err := GetNS(nspath) - if err != nil { - return err - } - defer ns.Close() - return ns.Do(toRun) -} diff --git a/vendor/github.com/containernetworking/plugins/pkg/testutils/bad_reader.go b/vendor/github.com/containernetworking/plugins/pkg/testutils/bad_reader.go deleted file mode 100644 index f9d0ade..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/testutils/bad_reader.go +++ /dev/null @@ -1,33 +0,0 @@ -// Copyright 2016 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package testutils - -import "errors" - -// BadReader is an io.Reader which always errors -type BadReader struct { - Error error -} - -func (r *BadReader) Read(buffer []byte) (int, error) { - if r.Error != nil { - return 0, r.Error - } - return 0, errors.New("banana") -} - -func (r *BadReader) Close() error { - return nil -} diff --git a/vendor/github.com/containernetworking/plugins/pkg/testutils/cmd.go b/vendor/github.com/containernetworking/plugins/pkg/testutils/cmd.go deleted file mode 100644 index ce600f6..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/testutils/cmd.go +++ /dev/null @@ -1,112 +0,0 @@ -// Copyright 2016 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package testutils - -import ( - "io/ioutil" - "os" - - "github.com/containernetworking/cni/pkg/skel" - "github.com/containernetworking/cni/pkg/types" - "github.com/containernetworking/cni/pkg/version" -) - -func envCleanup() { - os.Unsetenv("CNI_COMMAND") - os.Unsetenv("CNI_PATH") - os.Unsetenv("CNI_NETNS") - os.Unsetenv("CNI_IFNAME") - os.Unsetenv("CNI_CONTAINERID") -} - -func CmdAdd(cniNetns, cniContainerID, cniIfname string, conf []byte, f func() error) (types.Result, []byte, error) { - os.Setenv("CNI_COMMAND", "ADD") - os.Setenv("CNI_PATH", os.Getenv("PATH")) - os.Setenv("CNI_NETNS", cniNetns) - os.Setenv("CNI_IFNAME", cniIfname) - os.Setenv("CNI_CONTAINERID", cniContainerID) - defer envCleanup() - - // Redirect stdout to capture plugin result - oldStdout := os.Stdout - r, w, err := os.Pipe() - if err != nil { - return nil, nil, err - } - - os.Stdout = w - err = f() - w.Close() - - var out []byte - if err == nil { - out, err = ioutil.ReadAll(r) - } - os.Stdout = oldStdout - - // Return errors after restoring stdout so Ginkgo will correctly - // emit verbose error information on stdout - if err != nil { - return nil, nil, err - } - - // Plugin must return result in same version as specified in netconf - versionDecoder := &version.ConfigDecoder{} - confVersion, err := versionDecoder.Decode(conf) - if err != nil { - return nil, nil, err - } - - result, err := version.NewResult(confVersion, out) - if err != nil { - return nil, nil, err - } - - return result, out, nil -} - -func CmdAddWithArgs(args *skel.CmdArgs, f func() error) (types.Result, []byte, error) { - return CmdAdd(args.Netns, args.ContainerID, args.IfName, args.StdinData, f) -} - -func CmdCheck(cniNetns, cniContainerID, cniIfname string, conf []byte, f func() error) error { - os.Setenv("CNI_COMMAND", "CHECK") - os.Setenv("CNI_PATH", os.Getenv("PATH")) - os.Setenv("CNI_NETNS", cniNetns) - os.Setenv("CNI_IFNAME", cniIfname) - os.Setenv("CNI_CONTAINERID", cniContainerID) - defer envCleanup() - - return f() -} - -func CmdCheckWithArgs(args *skel.CmdArgs, f func() error) error { - return CmdCheck(args.Netns, args.ContainerID, args.IfName, args.StdinData, f) -} - -func CmdDel(cniNetns, cniContainerID, cniIfname string, f func() error) error { - os.Setenv("CNI_COMMAND", "DEL") - os.Setenv("CNI_PATH", os.Getenv("PATH")) - os.Setenv("CNI_NETNS", cniNetns) - os.Setenv("CNI_IFNAME", cniIfname) - os.Setenv("CNI_CONTAINERID", cniContainerID) - defer envCleanup() - - return f() -} - -func CmdDelWithArgs(args *skel.CmdArgs, f func() error) error { - return CmdDel(args.Netns, args.ContainerID, args.IfName, f) -} diff --git a/vendor/github.com/containernetworking/plugins/pkg/testutils/netns_linux.go b/vendor/github.com/containernetworking/plugins/pkg/testutils/netns_linux.go deleted file mode 100644 index 6d56e40..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/testutils/netns_linux.go +++ /dev/null @@ -1,157 +0,0 @@ -// Copyright 2018 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package testutils - -import ( - "crypto/rand" - "fmt" - "os" - "path" - "runtime" - "strings" - "sync" - - "github.com/containernetworking/plugins/pkg/ns" - "golang.org/x/sys/unix" -) - -const nsRunDir = "/var/run/netns" - -// Creates a new persistent (bind-mounted) network namespace and returns an object -// representing that namespace, without switching to it. -func NewNS() (ns.NetNS, error) { - - b := make([]byte, 16) - _, err := rand.Reader.Read(b) - if err != nil { - return nil, fmt.Errorf("failed to generate random netns name: %v", err) - } - - // Create the directory for mounting network namespaces - // This needs to be a shared mountpoint in case it is mounted in to - // other namespaces (containers) - err = os.MkdirAll(nsRunDir, 0755) - if err != nil { - return nil, err - } - - // Remount the namespace directory shared. This will fail if it is not - // already a mountpoint, so bind-mount it on to itself to "upgrade" it - // to a mountpoint. - err = unix.Mount("", nsRunDir, "none", unix.MS_SHARED|unix.MS_REC, "") - if err != nil { - if err != unix.EINVAL { - return nil, fmt.Errorf("mount --make-rshared %s failed: %q", nsRunDir, err) - } - - // Recursively remount /var/run/netns on itself. The recursive flag is - // so that any existing netns bindmounts are carried over. - err = unix.Mount(nsRunDir, nsRunDir, "none", unix.MS_BIND|unix.MS_REC, "") - if err != nil { - return nil, fmt.Errorf("mount --rbind %s %s failed: %q", nsRunDir, nsRunDir, err) - } - - // Now we can make it shared - err = unix.Mount("", nsRunDir, "none", unix.MS_SHARED|unix.MS_REC, "") - if err != nil { - return nil, fmt.Errorf("mount --make-rshared %s failed: %q", nsRunDir, err) - } - - } - - nsName := fmt.Sprintf("cnitest-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:]) - - // create an empty file at the mount point - nsPath := path.Join(nsRunDir, nsName) - mountPointFd, err := os.Create(nsPath) - if err != nil { - return nil, err - } - mountPointFd.Close() - - // Ensure the mount point is cleaned up on errors; if the namespace - // was successfully mounted this will have no effect because the file - // is in-use - defer os.RemoveAll(nsPath) - - var wg sync.WaitGroup - wg.Add(1) - - // do namespace work in a dedicated goroutine, so that we can safely - // Lock/Unlock OSThread without upsetting the lock/unlock state of - // the caller of this function - go (func() { - defer wg.Done() - runtime.LockOSThread() - // Don't unlock. By not unlocking, golang will kill the OS thread when the - // goroutine is done (for go1.10+) - - var origNS ns.NetNS - origNS, err = ns.GetNS(getCurrentThreadNetNSPath()) - if err != nil { - return - } - defer origNS.Close() - - // create a new netns on the current thread - err = unix.Unshare(unix.CLONE_NEWNET) - if err != nil { - return - } - - // Put this thread back to the orig ns, since it might get reused (pre go1.10) - defer origNS.Set() - - // bind mount the netns from the current thread (from /proc) onto the - // mount point. This causes the namespace to persist, even when there - // are no threads in the ns. - err = unix.Mount(getCurrentThreadNetNSPath(), nsPath, "none", unix.MS_BIND, "") - if err != nil { - err = fmt.Errorf("failed to bind mount ns at %s: %v", nsPath, err) - } - })() - wg.Wait() - - if err != nil { - return nil, fmt.Errorf("failed to create namespace: %v", err) - } - - return ns.GetNS(nsPath) -} - -// UnmountNS unmounts the NS held by the netns object -func UnmountNS(ns ns.NetNS) error { - nsPath := ns.Path() - // Only unmount if it's been bind-mounted (don't touch namespaces in /proc...) - if strings.HasPrefix(nsPath, nsRunDir) { - if err := unix.Unmount(nsPath, 0); err != nil { - return fmt.Errorf("failed to unmount NS: at %s: %v", nsPath, err) - } - - if err := os.Remove(nsPath); err != nil { - return fmt.Errorf("failed to remove ns path %s: %v", nsPath, err) - } - } - - return nil -} - -// getCurrentThreadNetNSPath copied from pkg/ns -func getCurrentThreadNetNSPath() string { - // /proc/self/ns/net returns the namespace of the main thread, not - // of whatever thread this goroutine is running on. Make sure we - // use the thread's net namespace since the thread is switching around - return fmt.Sprintf("/proc/%d/task/%d/ns/net", os.Getpid(), unix.Gettid()) -} diff --git a/vendor/github.com/containernetworking/plugins/pkg/testutils/ping.go b/vendor/github.com/containernetworking/plugins/pkg/testutils/ping.go deleted file mode 100644 index 5ee9db1..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/testutils/ping.go +++ /dev/null @@ -1,55 +0,0 @@ -// Copyright 2017 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package testutils - -import ( - "bytes" - "fmt" - "os/exec" - "strconv" - "syscall" -) - -// Ping shells out to the `ping` command. Returns nil if successful. -func Ping(saddr, daddr string, isV6 bool, timeoutSec int) error { - args := []string{ - "-c", "1", - "-W", strconv.Itoa(timeoutSec), - "-I", saddr, - daddr, - } - - bin := "ping" - if isV6 { - bin = "ping6" - } - - cmd := exec.Command(bin, args...) - var stderr bytes.Buffer - cmd.Stderr = &stderr - - if err := cmd.Run(); err != nil { - switch e := err.(type) { - case *exec.ExitError: - return fmt.Errorf("%v exit status %d: %s", - args, e.Sys().(syscall.WaitStatus).ExitStatus(), - stderr.String()) - default: - return err - } - } - - return nil -} diff --git a/vendor/github.com/containernetworking/plugins/pkg/utils/buildversion/buildversion.go b/vendor/github.com/containernetworking/plugins/pkg/utils/buildversion/buildversion.go deleted file mode 100644 index 734d418..0000000 --- a/vendor/github.com/containernetworking/plugins/pkg/utils/buildversion/buildversion.go +++ /dev/null @@ -1,26 +0,0 @@ -// Copyright 2019 CNI authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// Buildversion is a destination for the linker trickery so we can auto -// set the build-version -package buildversion - -import "fmt" - -// This is overridden in the linker script -var BuildVersion = "version unknown" - -func BuildString(pluginName string) string { - return fmt.Sprintf("CNI %s plugin %s", pluginName, BuildVersion) -} |