From 3c2cbcbf5182e9a60810d2d4c937da699f963fa3 Mon Sep 17 00:00:00 2001 From: aleks-mariusz Date: Tue, 16 Jun 2020 11:36:33 +0100 Subject: [PATCH] allow switching of port-forward approaches in rootless/using slirp4netns As of podman 1.8.0, because of commit da7595a, the default approach of providing port-forwarding in rootless mode has switched (and been hard-coded) to rootlessport, for the purpose of providing super performance. The side-effect of this switch is source within the container to the port-forwarded service always appears to originate from 127.0.0.1 (see issue #5138). This commit allows a user to specify if they want to revert to the previous approach of leveraging slirp4netns add_hostfwd() api which, although not as stellar performance, restores usefulness of seeing incoming traffic origin IP addresses. The change should be transparent; when not specified, rootlessport will continue to be used, however if specifying --net slirp4netns:slirplisten the old approach will be used. Note: the above may imply the restored port-forwarding via slirp4netns is not as performant as the new rootlessport approach, however the figures shared in the original commit that introduced rootlessport are as follows: slirp4netns: 8.3 Gbps, RootlessKit: 27.3 Gbps, which are more than sufficient for many use cases where the origin of traffic is more important than limits that cannot be reached due to bottlenecks elsewhere. Signed-off-by: Aleks Mariusz --- libpod/container_validate.go | 2 +- libpod/networking_linux.go | 111 ++++++++++++++++++++++++++++++++++- pkg/namespaces/namespaces.go | 28 ++++++++- 3 files changed, 137 insertions(+), 4 deletions(-) diff --git a/libpod/container_validate.go b/libpod/container_validate.go index b7f0aadffe..47d1540075 100644 --- a/libpod/container_validate.go +++ b/libpod/container_validate.go @@ -66,7 +66,7 @@ func (c *Container) validate() error { // Rootless has some requirements, compared to networks. if rootless.IsRootless() { - if len(c.config.Networks) > 0 { + if !c.config.NetMode.IsSlirp4netns() && len(c.config.Networks) > 0 { return errors.Wrapf(define.ErrInvalidArg, "cannot join CNI networks if running rootless") } diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go index 0c9d287015..4d91fdf441 100644 --- a/libpod/networking_linux.go +++ b/libpod/networking_linux.go @@ -173,6 +173,19 @@ type slirpFeatures struct { HasEnableSeccomp bool } +type slirp4netnsCmdArg struct { + Proto string `json:"proto,omitempty"` + HostAddr string `json:"host_addr"` + HostPort int32 `json:"host_port"` + GuestAddr string `json:"guest_addr"` + GuestPort int32 `json:"guest_port"` +} + +type slirp4netnsCmd struct { + Execute string `json:"execute"` + Args slirp4netnsCmdArg `json:"arguments"` +} + func checkSlirpFlags(path string) (*slirpFeatures, error) { cmd := exec.Command(path, "--help") out, err := cmd.CombinedOutput() @@ -228,6 +241,12 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) { cmdArgs = append(cmdArgs, "--enable-seccomp") } + var apiSocket string + if havePortMapping && ctr.config.NetMode.IsPortForwardViaSlirpHostFwd() { + apiSocket = filepath.Join(ctr.runtime.config.Engine.TmpDir, fmt.Sprintf("%s.net", ctr.config.ID)) + cmdArgs = append(cmdArgs, "--api-socket", apiSocket) + } + // the slirp4netns arguments being passed are describes as follows: // from the slirp4netns documentation: https://github.com/rootless-containers/slirp4netns // -c, --configure Brings up the tap interface @@ -291,7 +310,11 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) { } if havePortMapping { - return r.setupRootlessPortMapping(ctr, netnsPath) + if ctr.config.NetMode.IsPortForwardViaSlirpHostFwd() { + return r.setupRootlessPortMappingViaSlirp(ctr, cmd, apiSocket) + } else { + return r.setupRootlessPortMappingViaRLK(ctr, netnsPath) + } } return nil } @@ -342,7 +365,7 @@ func waitForSync(syncR *os.File, cmd *exec.Cmd, logFile io.ReadSeeker, timeout t return nil } -func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) (err error) { +func (r *Runtime) setupRootlessPortMappingViaRLK(ctr *Container, netnsPath string) (err error) { syncR, syncW, err := os.Pipe() if err != nil { return errors.Wrapf(err, "failed to open pipe") @@ -419,6 +442,90 @@ func (r *Runtime) setupRootlessPortMapping(ctr *Container, netnsPath string) (er return nil } +func (r *Runtime) setupRootlessPortMappingViaSlirp(ctr *Container, cmd *exec.Cmd, apiSocket string) (err error) { + const pidWaitTimeout = 60 * time.Second + chWait := make(chan error) + go func() { + interval := 25 * time.Millisecond + for i := time.Duration(0); i < pidWaitTimeout; i += interval { + // Check if the process is still running. + var status syscall.WaitStatus + pid, err := syscall.Wait4(cmd.Process.Pid, &status, syscall.WNOHANG, nil) + if err != nil { + break + } + if pid != cmd.Process.Pid { + continue + } + if status.Exited() || status.Signaled() { + chWait <- fmt.Errorf("slirp4netns exited with status %d", status.ExitStatus()) + } + time.Sleep(interval) + } + }() + defer close(chWait) + + // wait that API socket file appears before trying to use it. + if _, err := WaitForFile(apiSocket, chWait, pidWaitTimeout); err != nil { + return errors.Wrapf(err, "waiting for slirp4nets to create the api socket file %s", apiSocket) + } + + // for each port we want to add we need to open a connection to the slirp4netns control socket + // and send the add_hostfwd command. + for _, i := range ctr.config.PortMappings { + conn, err := net.Dial("unix", apiSocket) + if err != nil { + return errors.Wrapf(err, "cannot open connection to %s", apiSocket) + } + defer func() { + if err := conn.Close(); err != nil { + logrus.Errorf("unable to close connection: %q", err) + } + }() + hostIP := i.HostIP + if hostIP == "" { + hostIP = "0.0.0.0" + } + apiCmd := slirp4netnsCmd{ + Execute: "add_hostfwd", + Args: slirp4netnsCmdArg{ + Proto: i.Protocol, + HostAddr: hostIP, + HostPort: i.HostPort, + GuestPort: i.ContainerPort, + }, + } + // create the JSON payload and send it. Mark the end of request shutting down writes + // to the socket, as requested by slirp4netns. + data, err := json.Marshal(&apiCmd) + if err != nil { + return errors.Wrapf(err, "cannot marshal JSON for slirp4netns") + } + if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil { + return errors.Wrapf(err, "cannot write to control socket %s", apiSocket) + } + if err := conn.(*net.UnixConn).CloseWrite(); err != nil { + return errors.Wrapf(err, "cannot shutdown the socket %s", apiSocket) + } + buf := make([]byte, 2048) + readLength, err := conn.Read(buf) + if err != nil { + return errors.Wrapf(err, "cannot read from control socket %s", apiSocket) + } + // if there is no 'error' key in the received JSON data, then the operation was + // successful. + var y map[string]interface{} + if err := json.Unmarshal(buf[0:readLength], &y); err != nil { + return errors.Wrapf(err, "error parsing error status from slirp4netns") + } + if e, found := y["error"]; found { + return errors.Errorf("error from slirp4netns while setting up port redirection: %v", e) + } + } + logrus.Debug("slirp4netns port-forwarding setup via add_hostfwd is ready") + return nil +} + // Configure the network namespace using the container process func (r *Runtime) setupNetNS(ctr *Container) (err error) { nsProcess := fmt.Sprintf("/proc/%d/ns/net", ctr.state.PID) diff --git a/pkg/namespaces/namespaces.go b/pkg/namespaces/namespaces.go index 2ffbde9777..dcf9973917 100644 --- a/pkg/namespaces/namespaces.go +++ b/pkg/namespaces/namespaces.go @@ -17,7 +17,9 @@ const ( nsType = "ns" podType = "pod" privateType = "private" + rlkFwdType = "port_handler=rootlesskit" shareableType = "shareable" + slirpFwdType = "port_handler=slirp4netns" slirpType = "slirp4netns" ) @@ -385,7 +387,31 @@ func (n NetworkMode) IsBridge() bool { // IsSlirp4netns indicates if we are running a rootless network stack func (n NetworkMode) IsSlirp4netns() bool { - return n == slirpType + return n == slirpType || strings.HasPrefix(string(n), slirpType+":") +} + +// IsPortForwardViaRootlessKit indicates if we are doing rootless port-forwarding via rootlesskit/rootlessport +func (n NetworkMode) IsPortForwardViaRootlessKit() bool { + if !n.IsSlirp4netns() { + return false + } + // below here, implied IsSlirp4netns() == true + if !strings.Contains(string(n), ":") { + return true // default type + } + // below here, also contains(":") == true + parts := strings.SplitN(string(n), ":", 2) + return len(parts) == 2 && parts[1] == rlkFwdType +} + +// IsPortForwardViaSlirpHostFwd indicates if we are doing rootless port-forwarding via slirp4netns add_hostfwd() +func (n NetworkMode) IsPortForwardViaSlirpHostFwd() bool { + if !n.IsSlirp4netns() { + return false + } + // below here, implied IsSlirp4netns() == true + parts := strings.SplitN(string(n), ":", 2) + return len(parts) > 1 && parts[1] == slirpFwdType } // IsNS indicates a network namespace passed in by path (ns:)