eburet-oss/gvisor-lx
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

snapshot: sagernet/gvisor v0.0.0-20260727.0-sing-box-mod.1 + SPEC 048 guard

Browse source 
Обновление снапшота с v0.0.0-20250811.0 на пин, которого требует
sing-box после мержа 235 коммитов (upstream d620bbbf2 "Update gvisor to
20260727.0"). Прежний снапшот был взят 2026-08-04 ровно с той версии,
на которой тогда стоял апстрим; разрыв возник 2026-08-05 вместе с его
бампом.

За год апстрим-gvisor изменил ~14 000 строк в 292 файлах. Значимое для
нас — сетевой стек: tcp/connect.go (PMTU-discovery + исправление
начального RTT/RTO: раньше задержка ACK внутри стека завышала стартовый
таймаут на несколько RTT), tcp/snd.go, tcp/rcv.go, stack/conntrack.go,
stack/packet_buffer.go. Всего 30 файлов в TCP и 37 в stack.

Баг SPEC 048 апстрим НЕ исправил — проверено по коду новой версии:
handleConnecting по-прежнему проверяет состояние endpoint'а, но не ep.h,
а performHandshake так же зануляет h и отпускает мьютекс до Close().
Поэтому guard перенесён (12 строк) вместе со своим тестом (45 строк).

Red/green проверен на новой базе: без guard'а тест падает с той же
nil-паникой, что в полевом крашдампе; с ним зелёный.
This commit is contained in:
Leadaxe 2026-08-05 14:53:31 +03:00
parent ffebe42860
commit 117243aa02
293 changed files with 16413 additions and 2842 deletions
Download patch file Download diff file Expand all files Collapse all files

2
pkg/tcpip/link/channel/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

2
pkg/tcpip/link/channel/queue_mutex.go
View file

@ -92,5 +92,5 @@ func queueinitLockNames() {}
func init() {
queueinitLockNames()
queueprefixIndex = locking.NewMutexClass(reflect.TypeOf(queueRWMutex{}), queuelockNames)
queueprefixIndex = locking.NewMutexClass(reflect.TypeFor[queueRWMutex](), queuelockNames)
}

6
pkg/tcpip/link/ethernet/ethernet.go
View file

@ -56,7 +56,11 @@ func (e *Endpoint) LinkAddress() tcpip.LinkAddress {
// MTU implements stack.LinkEndpoint.
func (e *Endpoint) MTU() uint32 {
return e.Endpoint.MTU()
// It prevents upper-layers from sending larger than expected packets.
if mtu := e.Endpoint.MTU(); mtu > header.EthernetMinimumSize {
return mtu - header.EthernetMinimumSize
}
return 0
}
// DeliverNetworkPacket implements stack.NetworkDispatcher.

185
pkg/tcpip/link/fdbased/endpoint.go
View file

@ -203,10 +203,6 @@ type Options struct {
// include CapabilitySaveRestore
SaveRestore bool
// DisconnectOk if true, indicates that this NIC capability set should
// include CapabilityDisconnectOk.
DisconnectOk bool
// GSOMaxSize is the maximum GSO packet size. It is zero if GSO is
// disabled.
GSOMaxSize uint32
@ -240,19 +236,21 @@ type Options struct {
// ProcessorsPerChannel is the number of goroutines used to handle packets
// from each FD.
ProcessorsPerChannel int
// IsPacketSocket indicates whether each FD is a packet socket.
// If nil, getsockname will be called.
IsPacketSocket []bool
// PreConfigured indicates that socket setup (getsockname, setsockopt)
// has already been performed on the host.
PreConfigured bool
}
// fanoutID is used for AF_PACKET based endpoints to enable PACKET_FANOUT
// support in the host kernel. This allows us to use multiple FD's to receive
// from the same underlying NIC. The fanoutID needs to be the same for a given
// set of FD's that point to the same NIC. Trying to set the PACKET_FANOUT
// option for an FD with a fanoutID already in use by another FD for a different
// NIC will return an EINVAL.
//
// Since fanoutID must be unique within the network namespace, we start with
// the PID to avoid collisions. The only way to be sure of avoiding collisions
// is to run in a new network namespace.
var fanoutID atomicbitops.Int32 = atomicbitops.FromInt32(int32(unix.Getpid()))
// fallbackFanoutID is used only when PACKET_FANOUT_FLAG_UNIQUEID is not
// supported by the host kernel. It preserves the PID-seeded best-effort behavior:
// seed from unix.Getpid() and increment per endpoint. This is not
// collision-free across sentries that share a network namespace.
var fallbackFanoutID atomicbitops.Int32 = atomicbitops.FromInt32(int32(unix.Getpid()))
// New creates a new fd-based endpoint.
//
@ -279,10 +277,6 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
caps |= stack.CapabilitySaveRestore
}
if opts.DisconnectOk {
caps |= stack.CapabilityDisconnectOk
}
if len(opts.FDs) == 0 {
return nil, fmt.Errorf("opts.FD is empty, at least one FD must be specified")
}
@ -307,17 +301,18 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
}
}
// Increment fanoutID to ensure that we don't re-use the same fanoutID
// for the next endpoint.
fid := fanoutID.Add(1)
// Fanout id allocated by the kernel for this endpoint. All AF_PACKET FDs
// belonging to this endpoint must use the same id. -1 means no AF_PACKET
// FD has allocated an id yet; 0 is a valid fanout id.
fid := int32(-1)
// Create per channel dispatchers.
for _, fd := range opts.FDs {
for i, fd := range opts.FDs {
if err := unix.SetNonblock(fd, true); err != nil {
return nil, fmt.Errorf("unix.SetNonblock(%v) failed: %v", fd, err)
}
isSocket, err := isSocketFD(fd)
isSocket, err := IsSocketFD(fd)
if err != nil {
return nil, err
}
@ -334,7 +329,34 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
opts.ProcessorsPerChannel = max(1, runtime.GOMAXPROCS(0)/len(opts.FDs))
}
inboundDispatcher, err := createInboundDispatcher(e, fd, isSocket, fid, opts)
var isPacket bool
if opts.PreConfigured {
if opts.IsPacketSocket != nil && i < len(opts.IsPacketSocket) {
isPacket = opts.IsPacketSocket[i]
} else {
return nil, fmt.Errorf("PreConfigured is true but IsPacketSocket is missing or too short (index %d, len %d)", i, len(opts.IsPacketSocket))
}
} else {
var err error
isPacket, err = IsPacketSocket(fd, isSocket)
if err != nil {
return nil, err
}
}
if isPacket && !opts.PreConfigured {
var err error
if fid < 0 {
fid, err = CreatePacketFanoutGroup(fd)
} else {
err = JoinPacketFanoutGroup(fd, fid)
}
if err != nil {
return nil, fmt.Errorf("failed to enable PACKET_FANOUT option: %v", err)
}
}
inboundDispatcher, err := createInboundDispatcher(e, fd, isSocket, opts)
if err != nil {
return nil, fmt.Errorf("createInboundDispatcher(...) = %v", err)
}
@ -344,7 +366,7 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
return e, nil
}
func createInboundDispatcher(e *endpoint, fd int, isSocket bool, fID int32, opts *Options) (linkDispatcher, error) {
func createInboundDispatcher(e *endpoint, fd int, isSocket bool, opts *Options) (linkDispatcher, error) {
// By default use the readv() dispatcher as it works with all kinds of
// FDs (tap/tun/unix domain sockets and af_packet).
inboundDispatcher, err := newReadVDispatcher(fd, e, opts)
@ -353,38 +375,6 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool, fID int32, opts
}
if isSocket {
sa, err := unix.Getsockname(fd)
if err != nil {
return nil, fmt.Errorf("unix.Getsockname(%d) = %v", fd, err)
}
switch sa.(type) {
case *unix.SockaddrLinklayer:
// Enable PACKET_FANOUT mode if the underlying socket is of type
// AF_PACKET. We do not enable PACKET_FANOUT_FLAG_DEFRAG as that will
// prevent gvisor from receiving fragmented packets and the host does the
// reassembly on our behalf before delivering the fragments. This makes it
// hard to test fragmentation reassembly code in Netstack.
//
// See: include/uapi/linux/if_packet.h (struct fanout_args).
//
// NOTE: We are using SetSockOptInt here even though the underlying
// option is actually a struct. The code follows the example in the
// kernel documentation as described at the link below:
//
// See: https://www.kernel.org/doc/Documentation/networking/packet_mmap.txt
//
// This works out because the actual implementation for the option zero
// initializes the structure and will initialize the max_members field
// to a proper value if zero.
//
// See: https://github.com/torvalds/linux/blob/7acac4b3196caee5e21fb5ea53f8bc124e6a16fc/net/packet/af_packet.c#L3881
const fanoutType = unix.PACKET_FANOUT_HASH
fanoutArg := (int(fID) & 0xffff) | fanoutType<<16
if err := unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
return nil, fmt.Errorf("failed to enable PACKET_FANOUT option: %v", err)
}
}
switch e.packetDispatchMode {
case PacketMMap:
inboundDispatcher, err = newPacketMMapDispatcher(fd, e, opts)
@ -407,7 +397,82 @@ func createInboundDispatcher(e *endpoint, fd int, isSocket bool, fID int32, opts
return inboundDispatcher, nil
}
func isSocketFD(fd int) (bool, error) {
// IsPacketSocket checks if the FD is an AF_PACKET socket.
func IsPacketSocket(fd int, isSocket bool) (bool, error) {
if !isSocket {
return false, nil
}
sa, err := unix.Getsockname(fd)
if err != nil {
return false, fmt.Errorf("unix.Getsockname(%d) = %v", fd, err)
}
_, ok := sa.(*unix.SockaddrLinklayer)
return ok, nil
}
// CreatePacketFanoutGroup enables PACKET_FANOUT for the first AF_PACKET socket
// in an endpoint and returns the fanout id the group joined.
//
// All AF_PACKET FDs that back the same endpoint must join the same fanout
// group so the host kernel consistently hashes packets for a flow to one FD.
// Fanout ids are unique within the Linux network namespace that owns the
// sockets; reusing an id for a different NIC in that namespace fails with
// EINVAL.
//
// We ask the kernel to allocate the id via PACKET_FANOUT_FLAG_UNIQUEID so the
// id is guaranteed unique within the namespace even when multiple sentries
// share it. If that setsockopt fails (e.g. the host kernel predates
// PACKET_FANOUT_FLAG_UNIQUEID), we fall back to the PID-seeded
// fallbackFanoutID, which is best-effort and not collision-free across
// sentries that share a network namespace.
//
// We do not enable PACKET_FANOUT_FLAG_DEFRAG as that will prevent gvisor from
// receiving fragmented packets and the host does the reassembly on our behalf
// before delivering the fragments. This makes it hard to test fragmentation
// reassembly code in Netstack.
//
// See: include/uapi/linux/if_packet.h (struct fanout_args).
//
// NOTE: We are using SetSockOptInt here even though the underlying option is
// actually a struct. The code follows the example in the kernel documentation
// as described at the link below:
//
// See: https://www.kernel.org/doc/Documentation/networking/packet_mmap.txt
//
// This works out because the actual implementation for the option zero
// initializes the structure and will initialize the max_members field to a
// proper value if zero.
//
// See: https://github.com/torvalds/linux/blob/7acac4b3196caee5e21fb5ea53f8bc124e6a16fc/net/packet/af_packet.c#L3881
func CreatePacketFanoutGroup(fd int) (int32, error) {
const fanoutType = unix.PACKET_FANOUT_HASH
fanoutArg := (fanoutType | unix.PACKET_FANOUT_FLAG_UNIQUEID) << 16
if err := unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
uniqueIDErr := err
fallbackID := fallbackFanoutID.Add(1)
fanoutArg = (int(fallbackID) & 0xffff) | fanoutType<<16
if err := unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg); err != nil {
return 0, fmt.Errorf("UNIQUEID failed (%v); fallback fanout id %d also failed: %v", uniqueIDErr, fanoutArg&0xffff, err)
}
return int32(fanoutArg & 0xffff), nil
}
fanoutArg, err := unix.GetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT)
if err != nil {
return 0, fmt.Errorf("getsockopt(PACKET_FANOUT) failed: %v", err)
}
return int32(fanoutArg & 0xffff), nil
}
// JoinPacketFanoutGroup joins the FD to the specified fanout group.
func JoinPacketFanoutGroup(fd int, fID int32) error {
const fanoutType = unix.PACKET_FANOUT_HASH
fanoutArg := (int(fID) & 0xffff) | fanoutType<<16
return unix.SetsockoptInt(fd, unix.SOL_PACKET, unix.PACKET_FANOUT, fanoutArg)
}
// IsSocketFD checks if the FD is a socket.
func IsSocketFD(fd int) (bool, error) {
var stat unix.Stat_t
if err := unix.Fstat(fd, &stat); err != nil {
return false, fmt.Errorf("unix.Fstat(%v,...) failed: %v", fd, err)
@ -892,7 +957,7 @@ func (e *InjectableEndpoint) InjectInbound(protocol tcpip.NetworkProtocolNumber,
// NewInjectable creates a new fd-based InjectableEndpoint.
func NewInjectable(fd int, mtu uint32, capabilities stack.LinkEndpointCapabilities) (*InjectableEndpoint, error) {
unix.SetNonblock(fd, true)
isSocket, err := isSocketFD(fd)
isSocket, err := IsSocketFD(fd)
if err != nil {
return nil, err
}

2
pkg/tcpip/link/fdbased/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

45
pkg/tcpip/link/fdbased/fdbased_state_autogen.go
View file

@ -112,7 +112,6 @@ func (o *Options) StateFields() []string {
"ClosedFunc",
"Address",
"SaveRestore",
"DisconnectOk",
"GSOMaxSize",
"GVisorGSOEnabled",
"PacketDispatchMode",
@ -122,6 +121,8 @@ func (o *Options) StateFields() []string {
"InterfaceIndex",
"GRO",
"ProcessorsPerChannel",
"IsPacketSocket",
"PreConfigured",
}
}
@ -136,16 +137,17 @@ func (o *Options) StateSave(stateSinkObject state.Sink) {
stateSinkObject.Save(3, &o.ClosedFunc)
stateSinkObject.Save(4, &o.Address)
stateSinkObject.Save(5, &o.SaveRestore)
stateSinkObject.Save(6, &o.DisconnectOk)
stateSinkObject.Save(7, &o.GSOMaxSize)
stateSinkObject.Save(8, &o.GVisorGSOEnabled)
stateSinkObject.Save(9, &o.PacketDispatchMode)
stateSinkObject.Save(10, &o.TXChecksumOffload)
stateSinkObject.Save(11, &o.RXChecksumOffload)
stateSinkObject.Save(12, &o.MaxSyscallHeaderBytes)
stateSinkObject.Save(13, &o.InterfaceIndex)
stateSinkObject.Save(14, &o.GRO)
stateSinkObject.Save(15, &o.ProcessorsPerChannel)
stateSinkObject.Save(6, &o.GSOMaxSize)
stateSinkObject.Save(7, &o.GVisorGSOEnabled)
stateSinkObject.Save(8, &o.PacketDispatchMode)
stateSinkObject.Save(9, &o.TXChecksumOffload)
stateSinkObject.Save(10, &o.RXChecksumOffload)
stateSinkObject.Save(11, &o.MaxSyscallHeaderBytes)
stateSinkObject.Save(12, &o.InterfaceIndex)
stateSinkObject.Save(13, &o.GRO)
stateSinkObject.Save(14, &o.ProcessorsPerChannel)
stateSinkObject.Save(15, &o.IsPacketSocket)
stateSinkObject.Save(16, &o.PreConfigured)
}
func (o *Options) afterLoad(context.Context) {}
@ -158,16 +160,17 @@ func (o *Options) StateLoad(ctx context.Context, stateSourceObject state.Source)
stateSourceObject.Load(3, &o.ClosedFunc)
stateSourceObject.Load(4, &o.Address)
stateSourceObject.Load(5, &o.SaveRestore)
stateSourceObject.Load(6, &o.DisconnectOk)
stateSourceObject.Load(7, &o.GSOMaxSize)
stateSourceObject.Load(8, &o.GVisorGSOEnabled)
stateSourceObject.Load(9, &o.PacketDispatchMode)
stateSourceObject.Load(10, &o.TXChecksumOffload)
stateSourceObject.Load(11, &o.RXChecksumOffload)
stateSourceObject.Load(12, &o.MaxSyscallHeaderBytes)
stateSourceObject.Load(13, &o.InterfaceIndex)
stateSourceObject.Load(14, &o.GRO)
stateSourceObject.Load(15, &o.ProcessorsPerChannel)
stateSourceObject.Load(6, &o.GSOMaxSize)
stateSourceObject.Load(7, &o.GVisorGSOEnabled)
stateSourceObject.Load(8, &o.PacketDispatchMode)
stateSourceObject.Load(9, &o.TXChecksumOffload)
stateSourceObject.Load(10, &o.RXChecksumOffload)
stateSourceObject.Load(11, &o.MaxSyscallHeaderBytes)
stateSourceObject.Load(12, &o.InterfaceIndex)
stateSourceObject.Load(13, &o.GRO)
stateSourceObject.Load(14, &o.ProcessorsPerChannel)
stateSourceObject.Load(15, &o.IsPacketSocket)
stateSourceObject.Load(16, &o.PreConfigured)
}
func (e *InjectableEndpoint) StateTypeName() string {

2
pkg/tcpip/link/fdbased/injectable_endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func injectableEndpointinitLockNames() {}
func init() {
injectableEndpointinitLockNames()
injectableEndpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(injectableEndpointRWMutex{}), injectableEndpointlockNames)
injectableEndpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[injectableEndpointRWMutex](), injectableEndpointlockNames)
}

2
pkg/tcpip/link/fdbased/processor_mutex.go
View file

@ -60,5 +60,5 @@ func processorinitLockNames() {}
func init() {
processorinitLockNames()
processorprefixIndex = locking.NewMutexClass(reflect.TypeOf(processorMutex{}), processorlockNames)
processorprefixIndex = locking.NewMutexClass(reflect.TypeFor[processorMutex](), processorlockNames)
}

45
pkg/tcpip/link/fdbased/processors.go
View file

@ -46,7 +46,6 @@ type processor struct {
func (p *processor) start(wg *sync.WaitGroup) {
defer wg.Done()
defer p.sleeper.Done()
for {
switch w := p.sleeper.Fetch(true); {
case w == &p.packetWaker:
@ -128,9 +127,10 @@ func (m *processorManager) start() {
}
// afterLoad is invoked by stateify.
func (m *processorManager) afterLoad(context.Context) {
m.wg.Add(len(m.processors))
m.start()
func (m *processorManager) afterLoad(ctx context.Context) {
// Close all the old/saved processors. There are new NICs and
// processors created during restore.
m.close()
}
func (m *processorManager) connectionHash(cid *connectionID) uint32 {
@ -215,34 +215,47 @@ func tcpipConnectionID(pkt *stack.PacketBuffer) (connectionID, bool) {
return cid, true
}
ipHdr := header.IPv6(h)
cid.srcAddr = ipHdr.SourceAddressSlice()
cid.dstAddr = ipHdr.DestinationAddressSlice()
cid.proto = header.IPv6ProtocolNumber
var tcpHdr header.TCP
if tcpip.TransportProtocolNumber(ipHdr.NextHeader()) == header.TCPProtocolNumber {
tcpHdr = header.TCP(h[header.IPv6FixedHeaderSize:][:tcpSrcDstPortLen])
if !header.IsExtensionHeader(ipHdr.NextHeader()) {
// Known transport protocols(not just TCP) store the src and dst ports
// in the first 4 bytes after the IPv6 fixed header.
tcpHdr := header.TCP(h[header.IPv6FixedHeaderSize:][:tcpSrcDstPortLen])
cid.srcPort = tcpHdr.SourcePort()
cid.dstPort = tcpHdr.DestinationPort()
} else {
// Slow path for IPv6 extension headers :(.
dataBuf := pkt.Data().ToBuffer()
dataBuf.TrimFront(header.IPv6MinimumSize)
it := header.MakeIPv6PayloadIterator(header.IPv6ExtensionHeaderIdentifier(ipHdr.NextHeader()), dataBuf)
defer it.Release()
// All fragment packets need to be processed by the same goroutine, so
// only record the ports if this is not a fragment packet.
var isFragment bool
for {
hdr, done, err := it.Next()
if done || err != nil {
break
}
if fh, ok := hdr.(header.IPv6FragmentExtHdr); ok && !fh.IsAtomic() {
isFragment = true
}
hdr.Release()
}
h, ok = pkt.Data().PullUp(int(it.HeaderOffset()) + tcpSrcDstPortLen)
if !ok {
return cid, true
if !isFragment {
h, ok = pkt.Data().PullUp(int(it.HeaderOffset()) + tcpSrcDstPortLen)
if !ok {
return cid, true
}
// Known transport protocols store the src and dst ports
// in the first 4 bytes after the IPv6 fixed header.
tcpHdr := header.TCP(h[it.HeaderOffset():][:tcpSrcDstPortLen])
cid.srcPort = tcpHdr.SourcePort()
cid.dstPort = tcpHdr.DestinationPort()
}
tcpHdr = header.TCP(h[it.HeaderOffset():][:tcpSrcDstPortLen])
}
cid.srcAddr = ipHdr.SourceAddressSlice()
cid.dstAddr = ipHdr.DestinationAddressSlice()
cid.srcPort = tcpHdr.SourcePort()
cid.dstPort = tcpHdr.DestinationPort()
cid.proto = header.IPv6ProtocolNumber
default:
return cid, true
}

2
pkg/tcpip/link/loopback/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

2
pkg/tcpip/link/muxed/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

2
pkg/tcpip/link/pipe/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

2
pkg/tcpip/link/qdisc/fifo/dispatcher_mutex.go
View file

@ -60,5 +60,5 @@ func queueDispatcherinitLockNames() {}
func init() {
queueDispatcherinitLockNames()
queueDispatcherprefixIndex = locking.NewMutexClass(reflect.TypeOf(queueDispatcherMutex{}), queueDispatcherlockNames)
queueDispatcherprefixIndex = locking.NewMutexClass(reflect.TypeFor[queueDispatcherMutex](), queueDispatcherlockNames)
}

21
pkg/tcpip/link/qdisc/fifo/fifo.go
View file

@ -22,6 +22,7 @@ import (
"github.com/sagernet/gvisor/pkg/sleep"
"github.com/sagernet/gvisor/pkg/sync"
"github.com/sagernet/gvisor/pkg/tcpip"
"github.com/sagernet/gvisor/pkg/tcpip/link/qdisc"
"github.com/sagernet/gvisor/pkg/tcpip/stack"
)
@ -60,7 +61,7 @@ type queueDispatcher struct {
mu queueDispatcherMutex `state:"nosave"`
// +checklocks:mu
queue packetBufferCircularList
queue qdisc.PacketBufferCircularList
newPacketWaker sleep.Waker `state:"nosave"`
closeWaker sleep.Waker `state:"nosave"`
@ -78,7 +79,7 @@ func New(lower stack.LinkWriter, n int, queueLen int) stack.QueueingDiscipline {
for i := range d.dispatchers {
qd := &d.dispatchers[i]
qd.lower = lower
qd.queue.init(queueLen)
qd.queue.Init(queueLen)
d.wg.Add(1)
go func() {
@ -101,19 +102,19 @@ func (qd *queueDispatcher) dispatchLoop() {
case &qd.newPacketWaker:
case &qd.closeWaker:
qd.mu.Lock()
for p := qd.queue.removeFront(); p != nil; p = qd.queue.removeFront() {
for p := qd.queue.RemoveFront(); p != nil; p = qd.queue.RemoveFront() {
p.DecRef()
}
qd.queue.decRef()
qd.queue.DecRef()
qd.mu.Unlock()
return
default:
panic("unknown waker")
}
qd.mu.Lock()
for pkt := qd.queue.removeFront(); pkt != nil; pkt = qd.queue.removeFront() {
for pkt := qd.queue.RemoveFront(); pkt != nil; pkt = qd.queue.RemoveFront() {
batch.PushBack(pkt)
if batch.Len() < BatchSize && !qd.queue.isEmpty() {
if batch.Len() < BatchSize && !qd.queue.IsEmpty() {
continue
}
qd.mu.Unlock()
@ -137,9 +138,13 @@ func (d *discipline) WritePacket(pkt *stack.PacketBuffer) tcpip.Error {
}
qd := &d.dispatchers[int(pkt.Hash)%len(d.dispatchers)]
qd.mu.Lock()
haveSpace := qd.queue.hasSpace()
if d.closed.Load() == qDiscClosed {
qd.mu.Unlock()
return &tcpip.ErrClosedForSend{}
}
haveSpace := qd.queue.HasSpace()
if haveSpace {
qd.queue.pushBack(pkt.IncRef())
qd.queue.PushBack(pkt.IncRef())
}
qd.mu.Unlock()
if !haveSpace {

32
pkg/tcpip/link/qdisc/fifo/fifo_state_autogen.go
View file

@ -64,39 +64,7 @@ func (qd *queueDispatcher) StateLoad(ctx context.Context, stateSourceObject stat
stateSourceObject.Load(1, &qd.queue)
}
func (pl *packetBufferCircularList) StateTypeName() string {
return "pkg/tcpip/link/qdisc/fifo.packetBufferCircularList"
}
func (pl *packetBufferCircularList) StateFields() []string {
return []string{
"pbs",
"head",
"size",
}
}
func (pl *packetBufferCircularList) beforeSave() {}
// +checklocksignore
func (pl *packetBufferCircularList) StateSave(stateSinkObject state.Sink) {
pl.beforeSave()
stateSinkObject.Save(0, &pl.pbs)
stateSinkObject.Save(1, &pl.head)
stateSinkObject.Save(2, &pl.size)
}
func (pl *packetBufferCircularList) afterLoad(context.Context) {}
// +checklocksignore
func (pl *packetBufferCircularList) StateLoad(ctx context.Context, stateSourceObject state.Source) {
stateSourceObject.Load(0, &pl.pbs)
stateSourceObject.Load(1, &pl.head)
stateSourceObject.Load(2, &pl.size)
}
func init() {
state.Register((*discipline)(nil))
state.Register((*queueDispatcher)(nil))
state.Register((*packetBufferCircularList)(nil))
}

93
pkg/tcpip/link/qdisc/fifo/packet_buffer_circular_list.go
View file

@ -1,93 +0,0 @@
// Copyright 2022 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at //
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package fifo
import "github.com/sagernet/gvisor/pkg/tcpip/stack"
// packetBufferCircularList is a slice-backed circular list. All operations are
// O(1) unless otherwise noted. It only allocates once, during the call to
// init().
//
// Users should call init() before using packetBufferCircularList.
//
// +stateify savable
type packetBufferCircularList struct {
pbs []*stack.PacketBuffer
head int
size int
}
// init initializes the list with the given size.
func (pl *packetBufferCircularList) init(size int) {
pl.pbs = make([]*stack.PacketBuffer, size)
}
// length returns the number of elements in the list.
//
//go:nosplit
func (pl *packetBufferCircularList) length() int {
return pl.size
}
// hasSpace returns whether there is space left in the list.
//
//go:nosplit
func (pl *packetBufferCircularList) hasSpace() bool {
return pl.size < len(pl.pbs)
}
// isEmpty returns whether the list is empty.
//
//go:nosplit
func (pl *packetBufferCircularList) isEmpty() bool {
return pl.size == 0
}
// pushBack inserts the PacketBuffer at the end of the list.
//
// Users must check beforehand that there is space via a call to hasSpace().
// Failing to do so may clobber existing entries.
//
//go:nosplit
func (pl *packetBufferCircularList) pushBack(pb *stack.PacketBuffer) {
next := (pl.head + pl.size) % len(pl.pbs)
pl.pbs[next] = pb
pl.size++
}
// removeFront returns the first element of the list or nil.
//
//go:nosplit
func (pl *packetBufferCircularList) removeFront() *stack.PacketBuffer {
if pl.isEmpty() {
return nil
}
ret := pl.pbs[pl.head]
pl.pbs[pl.head] = nil
pl.head = (pl.head + 1) % len(pl.pbs)
pl.size--
return ret
}
// decRef decreases the reference count on each stack.PacketBuffer stored in
// the list.
//
// NOTE: runs in O(n) time.
//
//go:nosplit
func (pl *packetBufferCircularList) decRef() {
for i := 0; i < pl.size; i++ {
pl.pbs[(pl.head+i)%len(pl.pbs)].DecRef()
}
}

108
pkg/tcpip/link/qdisc/packet_buffer_circular_list.go Normal file
View file

@ -0,0 +1,108 @@
// Copyright 2022 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Package qdisc provides shared building blocks used by queueing disciplines.
package qdisc
import "github.com/sagernet/gvisor/pkg/tcpip/stack"
// PacketBufferCircularList is a slice-backed circular list. All operations are
// O(1) unless otherwise noted. It only allocates once, during the call to
// Init().
//
// Users should call Init() before using PacketBufferCircularList.
//
// +stateify savable
type PacketBufferCircularList struct {
pbs []*stack.PacketBuffer
head int
size int
}
// Init initializes the list with the given size.
func (pl *PacketBufferCircularList) Init(size int) {
pl.pbs = make([]*stack.PacketBuffer, size)
}
// Length returns the number of elements in the list.
//
//go:nosplit
func (pl *PacketBufferCircularList) Length() int {
return pl.size
}
// HasSpace returns whether there is space left in the list.
//
//go:nosplit
func (pl *PacketBufferCircularList) HasSpace() bool {
return pl.size < len(pl.pbs)
}
// IsEmpty returns whether the list is empty.
//
//go:nosplit
func (pl *PacketBufferCircularList) IsEmpty() bool {
return pl.size == 0
}
// PushBack inserts the PacketBuffer at the end of the list.
//
// Users must check beforehand that there is space via a call to HasSpace().
// Failing to do so may clobber existing entries.
//
//go:nosplit
func (pl *PacketBufferCircularList) PushBack(pb *stack.PacketBuffer) {
next := (pl.head + pl.size) % len(pl.pbs)
pl.pbs[next] = pb
pl.size++
}
// PeekFront returns the first element of the list without removing it, or nil
// if empty. The list retains its reference; the caller must not DecRef. To take
// ownership, call RemoveFront, which returns the same pointer. The returned
// pointer is only valid until the next mutation of the list.
//
//go:nosplit
func (pl *PacketBufferCircularList) PeekFront() *stack.PacketBuffer {
if pl.IsEmpty() {
return nil
}
return pl.pbs[pl.head]
}
// RemoveFront returns the first element of the list or nil.
//
//go:nosplit
func (pl *PacketBufferCircularList) RemoveFront() *stack.PacketBuffer {
if pl.IsEmpty() {
return nil
}
ret := pl.pbs[pl.head]
pl.pbs[pl.head] = nil
pl.head = (pl.head + 1) % len(pl.pbs)
pl.size--
return ret
}
// DecRef decreases the reference count on each stack.PacketBuffer stored in
// the list.
//
// NOTE: runs in O(n) time.
//
//go:nosplit
func (pl *PacketBufferCircularList) DecRef() {
for i := 0; i < pl.size; i++ {
pl.pbs[(pl.head+i)%len(pl.pbs)].DecRef()
}
}

44
pkg/tcpip/link/qdisc/qdisc_state_autogen.go Normal file
View file

@ -0,0 +1,44 @@
// automatically generated by stateify.
package qdisc
import (
"context"
"github.com/sagernet/gvisor/pkg/state"
)
func (pl *PacketBufferCircularList) StateTypeName() string {
return "pkg/tcpip/link/qdisc.PacketBufferCircularList"
}
func (pl *PacketBufferCircularList) StateFields() []string {
return []string{
"pbs",
"head",
"size",
}
}
func (pl *PacketBufferCircularList) beforeSave() {}
// +checklocksignore
func (pl *PacketBufferCircularList) StateSave(stateSinkObject state.Sink) {
pl.beforeSave()
stateSinkObject.Save(0, &pl.pbs)
stateSinkObject.Save(1, &pl.head)
stateSinkObject.Save(2, &pl.size)
}
func (pl *PacketBufferCircularList) afterLoad(context.Context) {}
// +checklocksignore
func (pl *PacketBufferCircularList) StateLoad(ctx context.Context, stateSourceObject state.Source) {
stateSourceObject.Load(0, &pl.pbs)
stateSourceObject.Load(1, &pl.head)
stateSourceObject.Load(2, &pl.size)
}
func init() {
state.Register((*PacketBufferCircularList)(nil))
}

64
pkg/tcpip/link/qdisc/tbf/queue_mutex.go Normal file
View file

@ -0,0 +1,64 @@
package tbf
import (
"reflect"
"github.com/sagernet/gvisor/pkg/sync"
"github.com/sagernet/gvisor/pkg/sync/locking"
)
// Mutex is sync.Mutex with the correctness validator.
type queueMutex struct {
mu sync.Mutex
}
var queueprefixIndex *locking.MutexClass
// lockNames is a list of user-friendly lock names.
// Populated in init.
var queuelockNames []string
// lockNameIndex is used as an index passed to NestedLock and NestedUnlock,
// referring to an index within lockNames.
// Values are specified using the "consts" field of go_template_instance.
type queuelockNameIndex int
// DO NOT REMOVE: The following function automatically replaced with lock index constants.
// LOCK_NAME_INDEX_CONSTANTS
const ()
// Lock locks m.
// +checklocksignore
func (m *queueMutex) Lock() {
locking.AddGLock(queueprefixIndex, -1)
m.mu.Lock()
}
// NestedLock locks m knowing that another lock of the same type is held.
// +checklocksignore
func (m *queueMutex) NestedLock(i queuelockNameIndex) {
locking.AddGLock(queueprefixIndex, int(i))
m.mu.Lock()
}
// Unlock unlocks m.
// +checklocksignore
func (m *queueMutex) Unlock() {
locking.DelGLock(queueprefixIndex, -1)
m.mu.Unlock()
}
// NestedUnlock unlocks m knowing that another lock of the same type is held.
// +checklocksignore
func (m *queueMutex) NestedUnlock(i queuelockNameIndex) {
locking.DelGLock(queueprefixIndex, int(i))
m.mu.Unlock()
}
// DO NOT REMOVE: The following function is automatically replaced.
func queueinitLockNames() {}
func init() {
queueinitLockNames()
queueprefixIndex = locking.NewMutexClass(reflect.TypeFor[queueMutex](), queuelockNames)
}

239
pkg/tcpip/link/qdisc/tbf/tbf.go Normal file
View file

@ -0,0 +1,239 @@
// Copyright 2026 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// Package tbf provides a simplified Token Bucket Filter queueing discipline
// modeled on Linux's net/sched/sch_tbf.c. Only the single-rate bucket is
// implemented; peakrate/peakburst (Linux's second bucket) is not.
package tbf
import (
"fmt"
"time"
"github.com/sagernet/gvisor/pkg/atomicbitops"
"github.com/sagernet/gvisor/pkg/sleep"
"github.com/sagernet/gvisor/pkg/sync"
"github.com/sagernet/gvisor/pkg/tcpip"
"github.com/sagernet/gvisor/pkg/tcpip/link/qdisc"
"github.com/sagernet/gvisor/pkg/tcpip/stack"
)
const (
// BatchSize is the number of packets to write in each syscall. It is 47
// because when GVisorGSO is in use then a single 65KB TCP segment can get
// split into 46 segments of 1420 bytes and a single 216 byte segment.
BatchSize = 47
qDiscClosed = 1
)
var _ stack.QueueingDiscipline = (*discipline)(nil)
// +stateify savable
type discipline struct {
// Immutable configuration set by New.
lower stack.LinkWriter
clock tcpip.Clock `state:"nosave"`
rate uint64 // max sustained throughput, bytes/sec
burst uint32 // largest packet this TBF will pass, bytes
buffer int64 // nanoseconds needed to transmit burst bytes at rate
// Shutdown state.
wg sync.WaitGroup `state:"nosave"`
closed atomicbitops.Int32
// Wakers driving dispatchLoop.
newPacketWaker sleep.Waker `state:"nosave"`
tokenWaker sleep.Waker `state:"nosave"`
closeWaker sleep.Waker `state:"nosave"`
mu queueMutex `state:"nosave"`
// +checklocks:mu
queue qdisc.PacketBufferCircularList
// Dispatcher state: mutated only inside dispatchLoop and
// thus not protected by mu.
tokens int64 // current bucket level, ns
timeCheckpoint tcpip.MonotonicTime
watchdog tcpip.Timer `state:"nosave"`
}
// len2TimeNS returns the number of ns to transmit len bytes at rate bytes/sec.
// Linux's psched_l2t_ns avoids the divide via a precomputed mult/shift; see
// psched_ratecfg_precompute__ in net/sched/sch_generic.c.
func len2TimeNS(rate uint64, len uint32) uint64 {
const nsecPerSec = 1000000000
return uint64(len) * nsecPerSec / rate
}
func (d *discipline) dispatchLoop() {
s := sleep.Sleeper{}
s.AddWaker(&d.newPacketWaker)
s.AddWaker(&d.tokenWaker)
s.AddWaker(&d.closeWaker)
defer s.Done()
var batch stack.PacketBufferList
for {
switch w := s.Fetch(true); w {
case &d.newPacketWaker, &d.tokenWaker:
case &d.closeWaker:
if d.watchdog != nil {
d.watchdog.Stop()
}
d.mu.Lock()
for p := d.queue.RemoveFront(); p != nil; p = d.queue.RemoveFront() {
p.DecRef()
}
d.queue.DecRef()
d.mu.Unlock()
return
default:
panic("unknown waker")
}
d.mu.Lock()
for pkt := d.queue.PeekFront(); pkt != nil; pkt = d.queue.PeekFront() {
pktLen := pkt.Size()
now := d.clock.NowMonotonic()
toks := min(now.Sub(d.timeCheckpoint).Nanoseconds(), d.buffer)
toks += d.tokens
if toks > d.buffer {
toks = d.buffer
}
toks -= int64(len2TimeNS(d.rate, uint32(pktLen)))
sufficientTokens := toks >= 0
if !sufficientTokens {
// -toks is the deficit in ns: how long until enough tokens accumulate.
if d.watchdog != nil {
d.watchdog.Stop()
}
d.watchdog = d.clock.AfterFunc(time.Duration(-toks), d.tokenWaker.Assert)
break
}
d.queue.RemoveFront()
d.timeCheckpoint = now
d.tokens = toks
batch.PushBack(pkt)
possiblyAnotherPacket := batch.Len() < BatchSize && !d.queue.IsEmpty()
if possiblyAnotherPacket {
continue
}
d.mu.Unlock()
_, _ = d.lower.WritePackets(batch)
batch.Reset()
d.mu.Lock()
}
if batch.Len() > 0 {
d.mu.Unlock()
_, _ = d.lower.WritePackets(batch)
batch.Reset()
d.mu.Lock()
}
d.mu.Unlock()
}
}
// New creates a new TBF queueing discipline that will rate-limit lower to
// rate bytes/sec with bursts of up to burst bytes, queueing up to queueLen
// packets of backlog before dropping. Note that queueLen counts packets,
// not bytes as in Linux's sch_tbf.c, for consistency with the fifo qdisc.
//
// +checklocksignore: we don't have to hold locks during initialization.
func New(lower stack.LinkEndpoint, clock tcpip.Clock, rate uint64, burst, queueLen uint32) (stack.QueueingDiscipline, error) {
if rate == 0 {
return nil, fmt.Errorf("qdisc=tbf requires setting qdisc-tbf-rate")
}
if burst == 0 {
return nil, fmt.Errorf("qdisc=tbf requires setting qdisc-tbf-burst")
}
if gsoEP, ok := lower.(stack.GSOEndpoint); ok {
// HostGSOSupported endpoints can hand WritePacket a single GSO
// super-packet up to GSOMaxSize+MaxHeaderLength bytes, so the bucket
// must be able to hold one. GVisorGSOSupported segments above the
// qdisc and GSONotSupported never produces packets above the link
// MTU, both covered by the next check.
maxGSOPktLen := gsoEP.GSOMaxSize() + uint32(lower.MaxHeaderLength())
if gsoEP.SupportedGSO() == stack.HostGSOSupported && burst < uint32(maxGSOPktLen) {
return nil, fmt.Errorf("burst (%d bytes) is smaller than link's max GSO packet size (%d bytes); either increase burst or disable host GSO via --gso=false", burst, maxGSOPktLen)
}
}
maxPktLen := lower.MTU() + uint32(lower.MaxHeaderLength())
if burst < maxPktLen {
return nil, fmt.Errorf("burst (%d bytes) is smaller than max packet length (%d bytes)", burst, maxPktLen)
}
buffer := int64(len2TimeNS(rate, burst))
if buffer == 0 {
return nil, fmt.Errorf("rate (%d bytes/sec) is too high relative to burst (%d bytes); reduce qdisc-tbf-rate or increase qdisc-tbf-burst", rate, burst)
}
d := &discipline{
lower: lower,
clock: clock,
rate: rate,
burst: burst,
buffer: buffer,
tokens: buffer,
timeCheckpoint: clock.NowMonotonic(),
}
d.queue.Init(int(queueLen))
d.wg.Add(1)
go func() {
defer d.wg.Done()
d.dispatchLoop()
}()
return d, nil
}
// WritePacket implements stack.QueueingDiscipline.WritePacket.
func (d *discipline) WritePacket(pkt *stack.PacketBuffer) tcpip.Error {
if d.closed.Load() == qDiscClosed {
return &tcpip.ErrClosedForSend{}
}
if uint32(pkt.Size()) > d.burst {
// if the burst parameter is not smaller than the expected packet size,
// oversize packets should be impossible with New's GSO check
return &tcpip.ErrMessageTooLong{}
}
d.mu.Lock()
if d.closed.Load() == qDiscClosed {
d.mu.Unlock()
return &tcpip.ErrClosedForSend{}
}
haveSpace := d.queue.HasSpace()
if haveSpace {
d.queue.PushBack(pkt.IncRef())
}
d.mu.Unlock()
if !haveSpace {
return &tcpip.ErrNoBufferSpace{}
}
d.newPacketWaker.Assert()
return nil
}
// Close implements stack.QueueingDiscipline.Close.
func (d *discipline) Close() {
d.closed.Store(qDiscClosed)
d.closeWaker.Assert()
d.wg.Wait()
}

59
pkg/tcpip/link/qdisc/tbf/tbf_state_autogen.go Normal file
View file

@ -0,0 +1,59 @@
// automatically generated by stateify.
package tbf
import (
"context"
"github.com/sagernet/gvisor/pkg/state"
)
func (d *discipline) StateTypeName() string {
return "pkg/tcpip/link/qdisc/tbf.discipline"
}
func (d *discipline) StateFields() []string {
return []string{
"lower",
"rate",
"burst",
"buffer",
"closed",
"queue",
"tokens",
"timeCheckpoint",
}
}
func (d *discipline) beforeSave() {}
// +checklocksignore
func (d *discipline) StateSave(stateSinkObject state.Sink) {
d.beforeSave()
stateSinkObject.Save(0, &d.lower)
stateSinkObject.Save(1, &d.rate)
stateSinkObject.Save(2, &d.burst)
stateSinkObject.Save(3, &d.buffer)
stateSinkObject.Save(4, &d.closed)
stateSinkObject.Save(5, &d.queue)
stateSinkObject.Save(6, &d.tokens)
stateSinkObject.Save(7, &d.timeCheckpoint)
}
func (d *discipline) afterLoad(context.Context) {}
// +checklocksignore
func (d *discipline) StateLoad(ctx context.Context, stateSourceObject state.Source) {
stateSourceObject.Load(0, &d.lower)
stateSourceObject.Load(1, &d.rate)
stateSourceObject.Load(2, &d.burst)
stateSourceObject.Load(3, &d.buffer)
stateSourceObject.Load(4, &d.closed)
stateSourceObject.Load(5, &d.queue)
stateSourceObject.Load(6, &d.tokens)
stateSourceObject.Load(7, &d.timeCheckpoint)
}
func init() {
state.Register((*discipline)(nil))
}

2
pkg/tcpip/link/sharedmem/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

2
pkg/tcpip/link/sharedmem/server_endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func serverEndpointinitLockNames() {}
func init() {
serverEndpointinitLockNames()
serverEndpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(serverEndpointRWMutex{}), serverEndpointlockNames)
serverEndpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[serverEndpointRWMutex](), serverEndpointlockNames)
}

8
pkg/tcpip/link/sharedmem/sharedmem_unsafe.go
View file

@ -16,7 +16,6 @@ package sharedmem
import (
"fmt"
"reflect"
"unsafe"
"github.com/sagernet/gvisor/pkg/atomicbitops"
@ -48,12 +47,7 @@ func getBuffer(fd int) ([]byte, error) {
return nil, fmt.Errorf("failed to map memory for buffer fd: %d, error: %s", fd, err)
}
// Use unsafe to convert addr into a []byte.
var b []byte
hdr := (*reflect.SliceHeader)(unsafe.Pointer(&b))
hdr.Data = addr
hdr.Len = int(s.Size)
hdr.Cap = int(s.Size)
b := unsafe.Slice((*byte)(unsafe.Pointer(addr)), int(s.Size))
return b, nil
}

9
pkg/tcpip/link/sniffer/sniffer.go
View file

@ -353,8 +353,13 @@ func LogPacket(prefix string, dir Direction, protocol tcpip.NetworkProtocolNumbe
details += fmt.Sprintf("invalid packet: tcp data offset too small %d", offset)
break
}
if size := clone.Data().Size() + len(tcp); offset > size && !moreFragments {
details += fmt.Sprintf("invalid packet: tcp data offset %d larger than tcp packet length %d", offset, size)
if size := clone.Data().Size() + len(tcp); offset > size {
if !moreFragments {
details += fmt.Sprintf("invalid packet: tcp data offset %d larger than tcp packet length %d", offset, size)
} else {
details += fmt.Sprintf("truncated options (tcp data offset %d, tcp packet length %d)", offset, size)
}
break
}

44
pkg/tcpip/link/tun/device.go
View file

@ -17,7 +17,6 @@ package tun
import (
"fmt"
"github.com/sagernet/gvisor/pkg/atomicbitops"
"github.com/sagernet/gvisor/pkg/buffer"
"github.com/sagernet/gvisor/pkg/context"
"github.com/sagernet/gvisor/pkg/errors/linuxerr"
@ -258,10 +257,15 @@ func (d *Device) Write(data *buffer.View) (int64, error) {
case d.flags.TUN:
// TUN interface with IFF_NO_PI enabled, thus
// we need to determine protocol from version field
if data.Size() == 0 {
// Ignore bad packet.
return dataLen, nil
}
version := data.AsSlice()[0] >> 4
if version == 4 {
switch version {
case 4:
protocol = header.IPv4ProtocolNumber
} else if version == 6 {
case 6:
protocol = header.IPv6ProtocolNumber
}
}
@ -362,22 +366,26 @@ type tunEndpoint struct {
tunEndpointRefs
*channel.Endpoint
stack *stack.Stack
nicID tcpip.NICID
name string
isTap bool
persistent atomicbitops.Bool
closed atomicbitops.Bool
stack *stack.Stack
nicID tcpip.NICID
name string
isTap bool
mu endpointMutex `state:"nosave"`
onCloseAction func() `state:"nosave"`
persistent bool
closed bool
}
func (e *tunEndpoint) setPersistent(v bool) {
old := e.persistent.Swap(v)
if old == v {
e.mu.Lock()
if e.persistent == v || e.closed {
e.mu.Unlock()
return
}
e.persistent = v
e.mu.Unlock()
// Update refs without holding the lock.
if v {
e.IncRef()
} else {
@ -386,17 +394,19 @@ func (e *tunEndpoint) setPersistent(v bool) {
}
func (e *tunEndpoint) Close() {
if e.closed.Swap(true) {
e.mu.Lock()
if e.closed {
e.mu.Unlock()
return
}
if e.persistent.Load() {
e.DecRef(context.Background())
}
e.mu.Lock()
e.closed = true
decref := e.persistent
action := e.onCloseAction
e.onCloseAction = nil
e.mu.Unlock()
if decref {
e.DecRef(context.Background())
}
if action != nil {
action()
}

2
pkg/tcpip/link/tun/device_mutex.go
View file

@ -92,5 +92,5 @@ func deviceinitLockNames() {}
func init() {
deviceinitLockNames()
deviceprefixIndex = locking.NewMutexClass(reflect.TypeOf(deviceRWMutex{}), devicelockNames)
deviceprefixIndex = locking.NewMutexClass(reflect.TypeFor[deviceRWMutex](), devicelockNames)
}

2
pkg/tcpip/link/tun/endpoint_mutex.go
View file

@ -60,5 +60,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointMutex](), endpointlockNames)
}

2
pkg/tcpip/link/veth/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

3
pkg/tcpip/link/veth/veth.go
View file

@ -163,8 +163,7 @@ func (e *Endpoint) SetMTU(mtu uint32) {
// Capabilities implements stack.LinkEndpoint.Capabilities.
func (e *Endpoint) Capabilities() stack.LinkEndpointCapabilities {
// TODO(b/352384218): Enable CapabilityTXChecksumOffload.
return stack.CapabilityRXChecksumOffload | stack.CapabilitySaveRestore
return stack.CapabilityRXChecksumOffload | stack.CapabilitySaveRestore | stack.CapabilityTXChecksumOffload
}
// GSOMaxSize implements stack.GSOEndpoint.

2
pkg/tcpip/link/veth/veth_mutex.go
View file

@ -92,5 +92,5 @@ func vethinitLockNames() {}
func init() {
vethinitLockNames()
vethprefixIndex = locking.NewMutexClass(reflect.TypeOf(vethRWMutex{}), vethlockNames)
vethprefixIndex = locking.NewMutexClass(reflect.TypeFor[vethRWMutex](), vethlockNames)
}

2
pkg/tcpip/link/waitable/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}

13
pkg/tcpip/link/xdp/endpoint.go
View file

@ -88,10 +88,6 @@ type Options struct {
// include CapabilitySaveRestore
SaveRestore bool
// DisconnectOk if true, indicates that this NIC capability set should
// include CapabilityDisconnectOk.
DisconnectOk bool
// TXChecksumOffload if true, indicates that this endpoints capability
// set should include CapabilityTXChecksumOffload.
TXChecksumOffload bool
@ -109,6 +105,9 @@ type Options struct {
// GRO enables generic receive offload.
GRO bool
// QueueID is the ID of the RX queue to which the AF_XDP socket is attached.
QueueID uint32
}
// New creates a new endpoint from an AF_XDP socket.
@ -126,10 +125,6 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
caps |= stack.CapabilitySaveRestore
}
if opts.DisconnectOk {
caps |= stack.CapabilityDisconnectOk
}
if err := unix.SetNonblock(opts.FD, true); err != nil {
return nil, fmt.Errorf("unix.SetNonblock(%v) failed: %v", opts.FD, err)
}
@ -164,7 +159,7 @@ func New(opts *Options) (stack.LinkEndpoint, error) {
NDescriptors: nFrames / 2,
Bind: opts.Bind,
}
ep.control, err = xdp.NewFromSocket(opts.FD, uint32(opts.InterfaceIndex), 0 /* queueID */, xdpOpts)
ep.control, err = xdp.NewFromSocket(opts.FD, uint32(opts.InterfaceIndex), opts.QueueID, xdpOpts)
if err != nil {
return nil, fmt.Errorf("failed to create AF_XDP dispatcher: %v", err)
}

2
pkg/tcpip/link/xdp/endpoint_mutex.go
View file

@ -92,5 +92,5 @@ func endpointinitLockNames() {}
func init() {
endpointinitLockNames()
endpointprefixIndex = locking.NewMutexClass(reflect.TypeOf(endpointRWMutex{}), endpointlockNames)
endpointprefixIndex = locking.NewMutexClass(reflect.TypeFor[endpointRWMutex](), endpointlockNames)
}