Skip to content

Commit f53d263

Browse files
aojeaaojea
committed
Add support for Linux Network Devices
Implement support for passing Linux Network Devices to the container network namespace. The network device is passed during the creation of the container, before the process is started. It implements the logic defined in the OCI runtime specification. Change-Id: I190d5c444f03e65bbbfe5b4bc90809c0ad0a2017 Signed-off-by: Antonio Ojea <[email protected]>
1 parent 771984c commit f53d263

11 files changed

+546
-0
lines changed

‎features.go

+3
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ var featuresCommand = cli.Command{
6363
Enabled: &t,
6464
},
6565
},
66+
NetDevices: &features.NetDevices{
67+
Enabled: &t,
68+
},
6669
},
6770
PotentiallyUnsafeConfigAnnotations: []string{
6871
"bundle",

‎libcontainer/configs/config.go

+3
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,9 @@ type Config struct {
115115
// The device nodes that should be automatically created within the container upon container start. Note, make sure that the node is marked as allowed in the cgroup as well!
116116
Devices []*devices.Device `json:"devices"`
117117

118+
// NetDevices are key-value pairs, keyed by network device name, moved to the container's network namespace.
119+
NetDevices map[string]*LinuxNetDevice `json:"netDevices"`
120+
118121
MountLabel string `json:"mount_label"`
119122

120123
// Hostname optionally sets the container's hostname if provided

‎libcontainer/configs/netdevices.go

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
package configs
2+
3+
// LinuxNetDevice represents a single network device to be added to the container's network namespace.
4+
type LinuxNetDevice struct {
5+
// Name of the device in the container namespace.
6+
Name string `json:"name,omitempty"`
7+
}

‎libcontainer/configs/validate/validator.go

+40
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ func Validate(config *configs.Config) error {
2424
cgroupsCheck,
2525
rootfs,
2626
network,
27+
netdevices,
2728
uts,
2829
security,
2930
namespaces,
@@ -70,6 +71,45 @@ func rootfs(config *configs.Config) error {
7071
return nil
7172
}
7273

74+
// https://elixir.bootlin.com/linux/v6.12/source/net/core/dev.c#L1066
75+
func devValidName(name string) bool {
76+
if len(name) == 0 || len(name) > unix.IFNAMSIZ {
77+
return false
78+
}
79+
if (name == ".") || (name == "..") {
80+
return false
81+
}
82+
if strings.ContainsAny(name, "/: ") {
83+
return false
84+
}
85+
return true
86+
}
87+
88+
func netdevices(config *configs.Config) error {
89+
if len(config.NetDevices) == 0 {
90+
return nil
91+
}
92+
if !config.Namespaces.Contains(configs.NEWNET) {
93+
return errors.New("unable to move network devices without a NET namespace")
94+
}
95+
if config.Namespaces.IsPrivate(configs.NEWNET) {
96+
return errors.New("unable to move network devices without a NET namespace")
97+
}
98+
if config.RootlessEUID || config.RootlessCgroups {
99+
return errors.New("network devices are not supported for rootless containers")
100+
}
101+
102+
for name, netdev := range config.NetDevices {
103+
if !devValidName(name) {
104+
return fmt.Errorf("invalid network device name %q", name)
105+
}
106+
if netdev.Name != "" && !devValidName(netdev.Name) {
107+
return fmt.Errorf("invalid network device name %q", netdev.Name)
108+
}
109+
}
110+
return nil
111+
}
112+
73113
func network(config *configs.Config) error {
74114
if !config.Namespaces.Contains(configs.NEWNET) {
75115
if len(config.Networks) > 0 || len(config.Routes) > 0 {

‎libcontainer/configs/validate/validator_test.go

+169
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package validate
33
import (
44
"os"
55
"path/filepath"
6+
"strings"
67
"testing"
78

89
"github.com/opencontainers/runc/libcontainer/configs"
@@ -877,3 +878,171 @@ func TestValidateIOPriority(t *testing.T) {
877878
}
878879
}
879880
}
881+
882+
func TestValidateNetDevices(t *testing.T) {
883+
testCases := []struct {
884+
name string
885+
isErr bool
886+
config *configs.Config
887+
}{
888+
{
889+
name: "network device",
890+
config: &configs.Config{
891+
Namespaces: configs.Namespaces(
892+
[]configs.Namespace{
893+
{
894+
Type: configs.NEWNET,
895+
Path: "/var/run/netns/blue",
896+
},
897+
},
898+
),
899+
NetDevices: map[string]*configs.LinuxNetDevice{
900+
"eth0": {},
901+
},
902+
},
903+
},
904+
{
905+
name: "network device rename",
906+
config: &configs.Config{
907+
Namespaces: configs.Namespaces(
908+
[]configs.Namespace{
909+
{
910+
Type: configs.NEWNET,
911+
Path: "/var/run/netns/blue",
912+
},
913+
},
914+
),
915+
NetDevices: map[string]*configs.LinuxNetDevice{
916+
"eth0": {
917+
Name: "c0",
918+
},
919+
},
920+
},
921+
},
922+
{
923+
name: "network device host network",
924+
isErr: true,
925+
config: &configs.Config{
926+
Namespaces: configs.Namespaces(
927+
[]configs.Namespace{
928+
{
929+
Type: configs.NEWNET,
930+
Path: "",
931+
},
932+
},
933+
),
934+
NetDevices: map[string]*configs.LinuxNetDevice{
935+
"eth0": {},
936+
},
937+
},
938+
},
939+
{
940+
name: "network device network namespace empty",
941+
isErr: true,
942+
config: &configs.Config{
943+
Namespaces: configs.Namespaces(
944+
[]configs.Namespace{},
945+
),
946+
NetDevices: map[string]*configs.LinuxNetDevice{
947+
"eth0": {},
948+
},
949+
},
950+
},
951+
{
952+
name: "network device rootless EUID",
953+
isErr: true,
954+
config: &configs.Config{
955+
Namespaces: configs.Namespaces(
956+
[]configs.Namespace{
957+
{
958+
Type: configs.NEWNET,
959+
Path: "/var/run/netns/blue",
960+
},
961+
},
962+
),
963+
RootlessEUID: true,
964+
NetDevices: map[string]*configs.LinuxNetDevice{
965+
"eth0": {},
966+
},
967+
},
968+
},
969+
{
970+
name: "network device rootless",
971+
isErr: true,
972+
config: &configs.Config{
973+
Namespaces: configs.Namespaces(
974+
[]configs.Namespace{
975+
{
976+
Type: configs.NEWNET,
977+
Path: "/var/run/netns/blue",
978+
},
979+
},
980+
),
981+
RootlessCgroups: true,
982+
NetDevices: map[string]*configs.LinuxNetDevice{
983+
"eth0": {},
984+
},
985+
},
986+
},
987+
{
988+
name: "network device bad name",
989+
isErr: true,
990+
config: &configs.Config{
991+
Namespaces: configs.Namespaces(
992+
[]configs.Namespace{
993+
{
994+
Type: configs.NEWNET,
995+
Path: "/var/run/netns/blue",
996+
},
997+
},
998+
),
999+
NetDevices: map[string]*configs.LinuxNetDevice{
1000+
"eth0": {
1001+
Name: "eth0/",
1002+
},
1003+
},
1004+
},
1005+
},
1006+
}
1007+
1008+
for _, tc := range testCases {
1009+
tc := tc
1010+
t.Run(tc.name, func(t *testing.T) {
1011+
config := tc.config
1012+
config.Rootfs = "/var"
1013+
1014+
err := Validate(config)
1015+
if tc.isErr && err == nil {
1016+
t.Error("expected error, got nil")
1017+
}
1018+
1019+
if !tc.isErr && err != nil {
1020+
t.Error(err)
1021+
}
1022+
})
1023+
}
1024+
}
1025+
1026+
func TestDevValidName(t *testing.T) {
1027+
testCases := []struct {
1028+
name string
1029+
valid bool
1030+
}{
1031+
{name: "", valid: false},
1032+
{name: "a", valid: true},
1033+
{name: strings.Repeat("a", unix.IFNAMSIZ), valid: true},
1034+
{name: strings.Repeat("a", unix.IFNAMSIZ+1), valid: false},
1035+
{name: ".", valid: false},
1036+
{name: "..", valid: false},
1037+
{name: "dev/null", valid: false},
1038+
{name: "valid:name", valid: false},
1039+
{name: "valid name", valid: false},
1040+
}
1041+
for _, tc := range testCases {
1042+
t.Run(tc.name, func(t *testing.T) {
1043+
if devValidName(tc.name) != tc.valid {
1044+
t.Fatalf("name %q, expected valid: %v", tc.name, tc.valid)
1045+
}
1046+
})
1047+
}
1048+
}

‎libcontainer/factory_linux.go

+11
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,17 @@ func Create(root, id string, config *configs.Config) (*Container, error) {
9191
if err := os.Mkdir(stateDir, 0o711); err != nil {
9292
return nil, err
9393
}
94+
95+
// move the specified devices to the container network namespace
96+
if nsPath := config.Namespaces.PathOf(configs.NEWNET); nsPath != "" {
97+
for name, netDevice := range config.NetDevices {
98+
err := netnsAttach(name, nsPath, *netDevice)
99+
if err != nil {
100+
return nil, err
101+
}
102+
}
103+
}
104+
94105
c := &Container{
95106
id: id,
96107
stateDir: stateDir,

0 commit comments

Comments
 (0)