mirror of
https://github.com/containers/podman.git
synced 2025-05-20 00:27:03 +08:00
aa47e05ae4
Conceptually equivalent to networking by means of slirp4netns(1), with a few practical differences: - pasta(1) forks to background once networking is configured in the namespace and quits on its own once the namespace is deleted: file descriptor synchronisation and PID tracking are not needed - port forwarding is configured via command line options at start-up, instead of an API socket: this is taken care of right away as we're about to start pasta - there's no need for further selection of port forwarding modes: pasta behaves similarly to containers-rootlessport for local binds (splice() instead of read()/write() pairs, without L2-L4 translation), and keeps the original source address for non-local connections like slirp4netns does - IPv6 is not an experimental feature, and enabled by default. IPv6 port forwarding is supported - by default, addresses and routes are copied from the host, that is, container users will see the same IP address and routes as if they were in the init namespace context. The interface name is also sourced from the host upstream interface with the first default route in the routing table. This is also configurable as documented - sandboxing and seccomp(2) policies cannot be disabled - only rootless mode is supported. See https://passt.top for more details about pasta. Also add a link to the maintained build of pasta(1) manual as valid in the man page cross-reference checks: that's where the man page for the latest build actually is -- it's not on Github and it doesn't match any existing pattern, so add it explicitly. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
109 lines
2.5 KiB
Go
109 lines
2.5 KiB
Go
// SPDX-License-Identifier: Apache-2.0
|
|
//
|
|
// networking_pasta_linux.go - Start pasta(1) for user-mode connectivity
|
|
//
|
|
// Copyright (c) 2022 Red Hat GmbH
|
|
// Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
package libpod
|
|
|
|
import (
|
|
"fmt"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"github.com/containernetworking/plugins/pkg/ns"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
func (r *Runtime) setupPasta(ctr *Container, netns ns.NetNS) error {
|
|
var NoTCPInitPorts = true
|
|
var NoUDPInitPorts = true
|
|
var NoTCPNamespacePorts = true
|
|
var NoUDPNamespacePorts = true
|
|
var NoMapGW = true
|
|
|
|
path, err := r.config.FindHelperBinary("pasta", true)
|
|
if err != nil {
|
|
return fmt.Errorf("could not find pasta, the network namespace can't be configured: %w", err)
|
|
}
|
|
|
|
cmdArgs := []string{}
|
|
cmdArgs = append(cmdArgs, "--config-net")
|
|
|
|
for _, i := range ctr.convertPortMappings() {
|
|
protocols := strings.Split(i.Protocol, ",")
|
|
for _, protocol := range protocols {
|
|
var addr string
|
|
|
|
if i.HostIP != "" {
|
|
addr = fmt.Sprintf("%s/", i.HostIP)
|
|
}
|
|
|
|
switch protocol {
|
|
case "tcp":
|
|
cmdArgs = append(cmdArgs, "-t")
|
|
case "udp":
|
|
cmdArgs = append(cmdArgs, "-u")
|
|
case "default":
|
|
return fmt.Errorf("can't forward protocol: %s", protocol)
|
|
}
|
|
|
|
arg := fmt.Sprintf("%s%d-%d:%d-%d", addr,
|
|
i.HostPort,
|
|
i.HostPort+i.Range-1,
|
|
i.ContainerPort,
|
|
i.ContainerPort+i.Range-1)
|
|
cmdArgs = append(cmdArgs, arg)
|
|
}
|
|
}
|
|
|
|
cmdArgs = append(cmdArgs, ctr.config.NetworkOptions["pasta"]...)
|
|
|
|
for i, opt := range cmdArgs {
|
|
switch opt {
|
|
case "-t", "--tcp-ports":
|
|
NoTCPInitPorts = false
|
|
case "-u", "--udp-ports":
|
|
NoUDPInitPorts = false
|
|
case "-T", "--tcp-ns":
|
|
NoTCPNamespacePorts = false
|
|
case "-U", "--udp-ns":
|
|
NoUDPNamespacePorts = false
|
|
case "--map-gw":
|
|
NoMapGW = false
|
|
// not an actual pasta(1) option
|
|
cmdArgs = append(cmdArgs[:i], cmdArgs[i+1:]...)
|
|
}
|
|
}
|
|
|
|
if NoTCPInitPorts {
|
|
cmdArgs = append(cmdArgs, "-t", "none")
|
|
}
|
|
if NoUDPInitPorts {
|
|
cmdArgs = append(cmdArgs, "-u", "none")
|
|
}
|
|
if NoTCPNamespacePorts {
|
|
cmdArgs = append(cmdArgs, "-T", "none")
|
|
}
|
|
if NoUDPNamespacePorts {
|
|
cmdArgs = append(cmdArgs, "-U", "none")
|
|
}
|
|
if NoMapGW {
|
|
cmdArgs = append(cmdArgs, "--no-map-gw")
|
|
}
|
|
|
|
cmdArgs = append(cmdArgs, "--netns", netns.Path())
|
|
|
|
logrus.Debugf("pasta arguments: %s", strings.Join(cmdArgs, " "))
|
|
|
|
// pasta forks once ready, and quits once we delete the target namespace
|
|
_, err = exec.Command(path, cmdArgs...).Output()
|
|
if err != nil {
|
|
return fmt.Errorf("failed to start pasta:\n%s",
|
|
err.(*exec.ExitError).Stderr)
|
|
}
|
|
|
|
return nil
|
|
}
|