Git Product home page Git Product logo

slirp4netns's Introduction

slirp4netns: User-mode networking for unprivileged network namespaces

slirp4netns provides user-mode networking ("slirp") for unprivileged network namespaces.

Motivation

Starting with Linux 3.8, unprivileged users can create network_namespaces(7) along with user_namespaces(7). However, unprivileged network namespaces had not been very useful, because creating veth(4) pairs across the host and network namespaces still requires the root privileges. (i.e. No internet connection)

slirp4netns allows connecting a network namespace to the Internet in a completely unprivileged way, by connecting a TAP device in a network namespace to the usermode TCP/IP stack ("slirp").

Projects using slirp4netns

Kubernetes distributions:

Container engines:

Tools:

Maintenance policy

Version Status
v1.2.x ✅ Active
v1.1.x End of Life (May 2, 2022)
v1.0.x End of Life (Jun 2, 2020)
v0.4.x End of Life (Sep 30, 2020)
v0.3.x End of Life (Mar 31, 2020)
v0.2.x End of Life (Aug 30, 2019)
Early versions prior to v0.2.x End of Life (Jan 5, 2019)

See https://github.com/rootless-containers/slirp4netns/releases for the releases.

Security advisories

See https://github.com/rootless-containers/slirp4netns/security/advisories for the past security advisories.

⚠️ We had been collecting the vulnerabilities of QEMU/libslirp in this slirp4netns repo until the end of 2020, as the slirp4netns releases prior to v1.0.0 were always statically linked with a specific version of QEMU/libslirp. Starting with 2021, the vulnerabilities of libslirp are no longer collected in this slirp4netns repo, as slirp4netns >= v1.0.0 can be linked with an arbitrary version of libslirp.

Run slirp4netns --version to check the version of the linked libslirp. 

$ slirp4netns --version
slirp4netns version 1.1.8
commit: d361001f495417b880f20329121e3aa431a8f90f
libslirp: 4.4.0
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.4.3

Quick start

Install

Statically linked binaries available for x86_64, aarch64, armv7l, s390x, ppc64le, and riscv64: https://github.com/rootless-containers/slirp4netns/releases

Also available as a package on almost all Linux distributions:

e.g.

$ sudo apt-get install slirp4netns

To install slirp4netns from the source, see Install from source.

Usage

Terminal 1: Create user/network/mount namespaces

(host)$ unshare --user --map-root-user --net --mount
(namespace)$ echo $$ > /tmp/pid

In this documentation, we use (host)$ as the prompt of the host shell, (namespace)$ as the prompt of the shell running in the namespaces.

If unshare fails, try the following commands (known to be needed on Debian, Arch, and old CentOS 7.X):

(host)$ sudo sh -c 'echo "user.max_user_namespaces=28633" >> /etc/sysctl.d/userns.conf'
(host)$ [ -f /proc/sys/kernel/unprivileged_userns_clone ] && sudo sh -c 'echo "kernel.unprivileged_userns_clone=1" >> /etc/sysctl.d/userns.conf'
(host)$ sudo sysctl --system

Terminal 2: Start slirp4netns

(host)$ slirp4netns --configure --mtu=65520 --disable-host-loopback $(cat /tmp/pid) tap0
starting slirp, MTU=65520
...

Terminal 1: Make sure the tap0 is configured and connected to the Internet

(namespace)$ ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
3: tap0: <BROADCAST,UP,LOWER_UP> mtu 65520 qdisc fq_codel state UNKNOWN group default qlen 1000
    link/ether c2:28:0c:0e:29:06 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::c028:cff:fe0e:2906/64 scope link 
       valid_lft forever preferred_lft forever
(namespace)$ echo "nameserver 10.0.2.3" > /tmp/resolv.conf
(namespace)$ mount --bind /tmp/resolv.conf /etc/resolv.conf
(namespace)$ curl https://example.com

Manual

Manual: slirp4netns.1.md

Benchmarks

iperf3 (netns -> host)

Aug 28, 2018, on RootlessKit Travis: rootless-containers/rootlesskit#16

Implementation MTU=1500 MTU=4000 MTU=16384 MTU=65520
vde_plug 763 Mbps Unsupported Unsupported Unsupported
VPNKit 514 Mbps 526 Mbps 540 Mbps Unsupported
slirp4netns 1.07 Gbps 2.78 Gbps 4.55 Gbps 9.21 Gbps

slirp4netns is faster than vde_plug and VPNKit because slirp4netns is optimized to avoid copying packets across the namespaces.

The latest revision of slirp4netns is regularly benchmarked (make benchmark) on CI.

Install from source

Build dependencies (apt-get):

$ sudo apt-get install libglib2.0-dev libslirp-dev libcap-dev libseccomp-dev

Build dependencies (dnf):

$ sudo dnf install glib2-devel libslirp-devel libcap-devel libseccomp-devel

Installation steps:

$ ./autogen.sh
$ ./configure --prefix=/usr
$ make
$ sudo make install
  • libslirp needs to be v4.1.0 or later.
  • To build slirp4netns as a static binary, run ./configure with LDFLAGS=-static.
  • If you set --prefix to $HOME, you don't need to run make install with sudo.

Acknowledgement

See vendor/README.md.

License

GPL-2.0-or-later

slirp4netns's People

Contributors

5eraph avatar akihirosuda avatar ankon avatar ansemjo avatar cyphar avatar elmarco avatar giuseppe avatar helmutg avatar jnovy avatar lsm5 avatar mbargull avatar n1hility avatar rhafer avatar rohrschacht avatar saschagrunert avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

linus5 giuseppe akihirosuda lsm5 vrothberg davidvoit rhatdan 42wim danzalot gabibeyer saschagrunert freemanzyq chombourger rohrschacht elmarco retzger amruta-bandhu-chaudhury qoeb chuanchang andy198012 5eraph vladikr zmedico jonpspri beemesh rhafer jasonyangshadow w3ss simhaonline nirvananimbusa olifon mbargull aminechakr xatier c53mike networkingtechnologies iamthatiam777 pfandl drbild cbanu96 fcabralpacheco fminamot dtmrc weare0 lolalset zicklag alainlompo jbro885 suryatmodulus jfcabral alvistack fwilhe-containers ankon jackpot777 jesuis33 zzsoszz sitedata g9020 redlinejoes webzcc texasoct frenetic00 gbraad mirjunaid26 jcmarblegranite duyiwei7w n1hility jayp1255 c-eee-devops cfatduck cantelci inclyc ysiw wolfi-chainguard-demo digitaldj kkpan11 jnovy helmutg project-vacuum mhgarry azuriteglass chainguard-wolfi-bites-back

slirp4netns's Issues

`make lint` fails with clang-tidy 8 (Ubuntu 19.04)

https://github.com/rootless-containers/slirp4netns/blob/v0.4.0-beta.1/main.c

$ make lint
clang-tidy -warnings-as-errors='*' main.c slirp4netns.c api.c -- -I/usr/include/glib-2.0 -I/usr/lib/x86_64-linux-gnu/glib-2.0/include
2 warnings generated.
2 warnings generated.
2 warnings generated.
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:19: error: Potential memory leak [clang-analyzer-unix.Malloc,-warnings-as-errors]
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
                  ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:622:5: note: Calling 'parse_args'
    parse_args(argc, argv, &options);
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:12: note: Assuming the condition is true
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
           ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:5: note: Loop condition is true.  Entering loop body
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:397:9: note: Control jumps to 'case 97:'  at line 453
        switch (opt) {
        ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:454:35: note: Memory is allocated
            options->api_socket = strdup(optarg);
                                  ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:455:13: note:  Execution continues on line 395
            break;
            ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:12: note: Assuming the condition is true
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
           ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:5: note: Loop condition is true.  Entering loop body
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:397:9: note: Control jumps to 'case 97:'  at line 453
        switch (opt) {
        ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:455:13: note:  Execution continues on line 395
            break;
            ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:19: note: Potential memory leak
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
                  ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:446:17: error: Potential memory leak [clang-analyzer-unix.Malloc,-warnings-as-errors]
            if (access(options->userns_path, F_OK) == -1) {
                ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:622:5: note: Calling 'parse_args'
    parse_args(argc, argv, &options);
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:12: note: Assuming the condition is true
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
           ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:5: note: Loop condition is true.  Entering loop body
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:397:9: note: Control jumps to 'case -45:'  at line 444
        switch (opt) {
        ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:445:36: note: Memory is allocated
            options->userns_path = strdup(optarg);
                                   ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:446:17: note: Assuming the condition is false
            if (access(options->userns_path, F_OK) == -1) {
                ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:446:13: note: Taking false branch
            if (access(options->userns_path, F_OK) == -1) {
            ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:452:13: note:  Execution continues on line 395
            break;
            ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:12: note: Assuming the condition is true
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
           ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:395:5: note: Loop condition is true.  Entering loop body
    while ((opt = getopt_long(argc, argv, "ce:r:m:a:6hv", longopts, NULL)) !=
    ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:397:9: note: Control jumps to 'case -45:'  at line 444
        switch (opt) {
        ^
/home/suda/gopath/src/github.com/rootless-containers/slirp4netns/main.c:446:17: note: Potential memory leak
            if (access(options->userns_path, F_OK) == -1) {
                ^
2 warnings treated as errors
make: *** [Makefile:2133: lint] Error 2
$ clang-tidy --version
LLVM (http://llvm.org/):
  LLVM version 8.0.0

  Optimized build.
  Default target: x86_64-pc-linux-gnu
  Host CPU: skylake

Reuse existing tap setup

In the case when a network namespace exists with an already configured tap device, spawn a slirp4netns process that re-enters the namespace, and skips the tap & network configuration aspect. This will get slirp4netns running again while using an existing network namespace.

Add IPv6 support

As I can see in the source code, slirp4netns doesn't support IPv6.

Can you implement it?

port-forwarding takes time to be stable with MTU > 49192 on kernel >= 4.20 

$ MTU=65520 ./benchmarks/benchmark-iperf3-reverse.sh
...
[  5] local 127.0.0.1 port 35852 connected to 127.0.0.1 port 15201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  5.00 MBytes  41.9 Mbits/sec    3   1.31 MBytes
[  5]   1.00-2.00   sec  0.00 Bytes  0.00 bits/sec    0   1.31 MBytes
[  5]   2.00-3.00   sec  0.00 Bytes  0.00 bits/sec    0   1.31 MBytes
[  5]   3.00-4.00   sec  0.00 Bytes  0.00 bits/sec    0   1.31 MBytes
[  5]   4.00-5.00   sec  0.00 Bytes  0.00 bits/sec    0   1.31 MBytes
[  5]   5.00-6.00   sec   206 MBytes  1.73 Gbits/sec    0   1.81 MBytes
[  5]   6.00-7.00   sec   780 MBytes  6.55 Gbits/sec    0   1.81 MBytes
[  5]   7.00-8.00   sec   732 MBytes  6.14 Gbits/sec    0   1.81 MBytes
[  5]   8.00-9.00   sec   828 MBytes  6.94 Gbits/sec    0   1.81 MBytes
[  5]   9.00-10.00  sec   896 MBytes  7.52 Gbits/sec    0   1.81 MBytes
[  5]  10.00-11.00  sec  1024 MBytes  8.59 Gbits/sec    0   1.81 MBytes
[  5]  11.00-12.00  sec  1019 MBytes  8.55 Gbits/sec    0   1.81 MBytes
[  5]  12.00-13.00  sec  1.05 GBytes  8.99 Gbits/sec    0   1.81 MBytes
[  5]  13.00-14.00  sec   758 MBytes  6.35 Gbits/sec    0   1.81 MBytes
[  5]  14.00-15.00  sec   824 MBytes  6.91 Gbits/sec    0   1.81 MBytes
[  5]  15.00-16.00  sec   684 MBytes  5.73 Gbits/sec    1   1.81 MBytes
[  5]  16.00-17.00  sec   886 MBytes  7.44 Gbits/sec    0   1.81 MBytes
[  5]  17.00-18.00  sec   898 MBytes  7.53 Gbits/sec    0   1.81 MBytes
[  5]  18.00-19.00  sec   882 MBytes  7.40 Gbits/sec    0   1.81 MBytes
[  5]  19.00-20.00  sec   866 MBytes  7.27 Gbits/sec    0   1.81 MBytes
[  5]  20.00-21.00  sec   665 MBytes  5.58 Gbits/sec    1   1.81 MBytes
[  5]  21.00-22.00  sec   844 MBytes  7.08 Gbits/sec    0   1.81 MBytes
[  5]  22.00-23.00  sec   771 MBytes  6.47 Gbits/sec    0   1.81 MBytes
[  5]  23.00-24.00  sec   779 MBytes  6.54 Gbits/sec    0   1.81 MBytes
[  5]  24.00-25.00  sec   808 MBytes  6.77 Gbits/sec    0   1.81 MBytes
[  5]  25.00-26.00  sec   779 MBytes  6.53 Gbits/sec    0   1.81 MBytes
[  5]  26.00-27.00  sec   851 MBytes  7.14 Gbits/sec    0   1.87 MBytes
[  5]  27.00-28.00  sec   730 MBytes  6.12 Gbits/sec    0   1.87 MBytes
[  5]  28.00-29.00  sec   835 MBytes  7.00 Gbits/sec    0   1.87 MBytes
[  5]  29.00-30.00  sec   861 MBytes  7.23 Gbits/sec    0   2.06 MBytes
[  5]  30.00-31.00  sec   901 MBytes  7.56 Gbits/sec    0   2.06 MBytes
[  5]  31.00-32.00  sec   749 MBytes  6.28 Gbits/sec    0   2.06 MBytes
[  5]  32.00-33.00  sec   830 MBytes  6.96 Gbits/sec    0   2.06 MBytes
[  5]  33.00-34.00  sec   839 MBytes  7.04 Gbits/sec    0   2.06 MBytes
[  5]  34.00-35.00  sec   852 MBytes  7.15 Gbits/sec    0   2.06 MBytes
[  5]  35.00-36.00  sec   850 MBytes  7.13 Gbits/sec    0   2.06 MBytes
[  5]  36.00-37.00  sec   889 MBytes  7.46 Gbits/sec    0   2.19 MBytes
[  5]  37.00-38.00  sec   931 MBytes  7.81 Gbits/sec    0   2.19 MBytes
[  5]  38.00-39.00  sec   881 MBytes  7.39 Gbits/sec    0   2.19 MBytes
[  5]  39.00-40.00  sec   811 MBytes  6.81 Gbits/sec    0   2.19 MBytes
[  5]  40.00-41.00  sec   806 MBytes  6.76 Gbits/sec    0   2.19 MBytes
[  5]  41.00-42.00  sec   790 MBytes  6.63 Gbits/sec    0   2.19 MBytes
[  5]  42.00-43.00  sec   788 MBytes  6.61 Gbits/sec    0   2.19 MBytes
[  5]  43.00-44.00  sec   925 MBytes  7.76 Gbits/sec    0   2.19 MBytes
[  5]  44.00-45.00  sec   825 MBytes  6.92 Gbits/sec    0   2.19 MBytes
[  5]  45.00-46.03  sec   642 MBytes  5.22 Gbits/sec    1   2.19 MBytes
[  5]  46.03-47.00  sec   524 MBytes  4.54 Gbits/sec    0   2.19 MBytes
[  5]  47.00-48.00  sec   555 MBytes  4.66 Gbits/sec    0   2.19 MBytes
[  5]  48.00-49.00  sec   778 MBytes  6.52 Gbits/sec    0   2.19 MBytes
[  5]  49.00-50.00  sec   739 MBytes  6.20 Gbits/sec    0   2.19 MBytes
[  5]  50.00-51.00  sec   821 MBytes  6.89 Gbits/sec    0   2.25 MBytes
[  5]  51.00-52.00  sec   941 MBytes  7.90 Gbits/sec    0   2.25 MBytes
[  5]  52.00-53.00  sec   721 MBytes  6.05 Gbits/sec    0   2.25 MBytes
[  5]  53.00-54.00  sec   891 MBytes  7.48 Gbits/sec    0   2.25 MBytes
[  5]  54.00-55.00  sec   805 MBytes  6.75 Gbits/sec    0   2.25 MBytes
[  5]  55.00-56.00  sec   940 MBytes  7.89 Gbits/sec    0   2.25 MBytes
[  5]  56.00-57.00  sec   730 MBytes  6.12 Gbits/sec    0   2.25 MBytes
[  5]  57.00-58.00  sec   804 MBytes  6.74 Gbits/sec    0   2.25 MBytes
[  5]  58.00-59.00  sec   835 MBytes  7.00 Gbits/sec    0   2.25 MBytes
[  5]  59.00-60.00  sec   904 MBytes  7.58 Gbits/sec    0   2.25 MBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-60.00  sec  43.5 GBytes  6.23 Gbits/sec    6             sender
[  5]   0.00-60.00  sec  43.5 GBytes  6.23 Gbits/sec                  receive

Bad bandwidth in the first few seconds when MTU > 49192.

This seems related to #define TCP_MAXSEG_MAX 32768

slirp4netns/vendor/libslirp/src/tcp.h

Line 46 in ed51817

#define TCP_MAXSEG_MAX 32768

Modifying the TCP_MAXSEG_MAX value affects the threshold MTU to hit this issue.

Tested commit: ed51817

Reproducible envs:

  • Fedora 30, kernel 4.20.0-1.fc30.x86_64 #1 (VirtualBox)
  • Ubuntu 19.04, kernel 5.0.0-23-generic #24-Ubuntu (VMware Fusion)
  • Ubuntu 19.04, kernel 5.0.0-1011-gcp #11-Ubuntu (GCE n1-standard-2)
  • Fedora 30, kernel 5.0.9-301.fc30.x86_64 #1 (VirtualBox)
  • Fedora 30, kernel 5.1.20-300.fc30.x86_64 #1 (VirtualBox)

Unreproducible envs:

  • Ubuntu 14.04, kernel 4.4.0-101-generic (Travis)
  • Debian 9.8, kernel 4.9.0-8-amd64 #1 (GCE n1-standard-2)
  • Ubuntu 18.04, kernel 4.15.0-1037-gcp #39-Ubuntu (GCE n1-standard-2)
  • Fedora 29, kernel 4.18.16-300.fc29.x86_64 #1 (VirtualBox)
  • Debian 10, kernel 4.19.0-5-cloud-amd64 #1 (GCE n1-standard-2)

Seems related to the kernel version (>= 4.20)

[api.c] error: ‘EXIT_FAILURE’ undeclared

I'm trying to build beef372 on Debian 9, but I'm getting:

api.c:96:3: warning: incompatible implicit declaration of built-in function ‘exit’
api.c:96:3: note: include ‘<stdlib.h>’ or provide a declaration of ‘exit’
api.c:96:8: error: ‘EXIT_FAILURE’ undeclared (first use in this function)
   exit(EXIT_FAILURE);
        ^~~~~~~~~~~~

high CPU usage

bug report

I'm running slirp4netns for rootless podman on Ubuntu Bionic (18.04) LTS. I'm running a small webserver, but at about 25-30 requests in a short time, the CPU usage jumps to levels higher than 75.

version details

slirp4netns version 0.3.0-alpha.2+dev
commit: f30eaf1025798f95024291347a918316e4813745``

Allow running inside a container without creating a new namespace and get a a SLRIP-ed TAP

We at KubeVirt would like to use slirp4netns.

Our use-case is to geta tap device (ideally unconfigured, and IP data in a json file), to pass this TAP to a VM in order to run the VM unprivileged, but still in a kubernetes compatible mode (just having a proces [slirp] with TCP and UDP sockets).

But today slirp4nens is cloning the net ns, and we would like to avoid this.

Document configuration

When attempting to use slirp4netns with podman it uses the default configuration of an ip address in the range 10.0.2.0/24. When attempting to use this on :cough cough: horribly configured corporate networks it causes issues the communications between the container and resources outside of the host.

For this reason we need documentation of how to configure the network used by slirp4netns, especially when consumed by utilities like podman.

Set up loopback link

Add a flag to set the loopback device link to up. This wouldn't change the default behavior, but instead if --setup_loopback is passed it would set the link to up.

When modifying the order of rootless container logic in podman, runc no longer sets up the loopback device (since the netns is now being created beforehand). Seems like the best fit would be to to have that functionality in slirp4netns. Thoughts? Thank you!

Create github team for package maintainers

Creating github team would be useful for notifying important changes such as security fix and introduction of new dependencies.

Core maintainers

@AkihiroSuda
@giuseppe
@cyphar

Package maintainers

Fedora / Red Hat Enterprise Linux https://src.fedoraproject.org/rpms/slirp4netns

@lsm5
@rhatdan (?)
@giuseppe (?)

Arch Linux https://www.archlinux.org/packages/community/x86_64/slirp4netns/

@barthalion

openSUSE / SUSE Linux Enterprise https://build.opensuse.org/package/show/openSUSE%3AFactory/slirp4netns

Unmaintained? (@cyphar ?)

Debian GNU/Linux https://packages.debian.org/sid/slirp4netns

@siretart

NixOS https://github.com/NixOS/nixpkgs/tree/master/pkgs/tools/networking/slirp4netns

@orivej

Gentoo Linux https://packages.gentoo.org/packages/app-emulation/slirp4netns

@zmedico
@g-braeunlich

[IPv6] Inconsistency in --disable-host-loopback

I have local DNS forwarder set up. That means I have nameserver ::1 in /etc/hosts. When I do:

unshare --user --net
echo $$

then outside unshare:

slirp4netns --configure $the_pid_from_above tap0

The processes in the container can resolve domain names using the provided DNS (10.0.2.3):

$ dig asdf.com @10.0.2.3

; <<>> DiG 9.12.3-P4 <<>> asdf.com @10.0.2.3
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38467
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;asdf.com.                      IN      A

;; ANSWER SECTION:
asdf.com.               14400   IN      A       64.90.40.65

;; Query time: 106 msec
;; SERVER: 10.0.2.3#53(10.0.2.3)
;; WHEN: Thu Jun 20 16:46:39 CEST 2019
;; MSG SIZE  rcvd: 53

But if I add --disable-host-loopback, the output varies. The output on my machine (Gentoo) is:

$ dig asdf.com @10.0.2.3

; <<>> DiG 9.12.3-P4 <<>> asdf.com @10.0.2.3
;; global options: +cmd
;; connection timed out; no servers could be reached

On Fedora 30 it still works, which I believe should be the case as --disable-host-loopback should disable local access from the container using the 10.0.2.2 IP address, but not the connection from the dns forwarder.

I traced this to the fact that the setup on Fedora (using systemd-resolved) is using 127.0.0.53 whereas I am using ::1 or 127.0.0.1 even though they all point to localhost as all 127.0.0.0/8 addresses (if I put nameserver 127.0.0.53 in my resolv.conf, it works).

Either I am right and I should be able to keep nameserver ::1 in my /etc/resolv.conf OR I misunderstood the purpose of that option and this should not even work with 127.0.0.53. Please tell me it is the former 😉.

Flaky test: test-slirp4netns-ready-fd.sh

https://travis-ci.org/rootless-containers/slirp4netns/builds/475619572

PASS: tests/test-slirp4netns-configure.sh
PASS: tests/test-slirp4netns.sh
PASS: tests/test-slirp4netns-exit-fd.sh
FAIL: tests/test-slirp4netns-ready-fd.sh
============================================================================
Testsuite summary for slirp4netns 0.2.0
============================================================================
# TOTAL: 4
# PASS:  3
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0

SIGPIPE crash

slirp4netns (a28a856) crashes after running iperf3 -c 10.0.2.2 -t 1 several times

(gdb) run
Starting program: /home/suda/bin/slirp4netns -c 127779 tap0
sent tapfd=5 for tap0
received tapfd=5

Program received signal SIGPIPE, Broken pipe.
0x00007ffff7b06c4d in __libc_send (fd=10, buf=0x555555777df4, len=1460, flags=0)
    at ../sysdeps/unix/sysv/linux/send.c:28
28      ../sysdeps/unix/sysv/linux/send.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7b06c4d in __libc_send (fd=10, buf=0x555555777df4, len=1460, flags=0)
    at ../sysdeps/unix/sysv/linux/send.c:28
#1  0x00005555555581e8 in _slirp_send (so=so@entry=0x55555577fc20, buf=<optimized out>, len=<optimized out>,
    flags=flags@entry=0) at qemu/slirp/slirp.c:1045
#2  0x0000555555562490 in sbappend (so=0x55555577fc20, m=0x555555777d40) at qemu/slirp/sbuf.c:101
#3  0x000055555555b517 in tcp_input (m=0x555555777d40, iphlen=<optimized out>, inso=inso@entry=0x0,
    af=af@entry=2) at qemu/slirp/tcp_input.c:556
#4  0x00005555555617f3 in ip_input (m=<optimized out>, m@entry=0x555555777d40) at qemu/slirp/ip_input.c:205
#5  0x0000555555557dd0 in slirp_input (slirp=slirp@entry=0x555555767280,
    pkt=pkt@entry=0x555555767ca0 "RU\n", pkt_len=1514) at qemu/slirp/slirp.c:848
#6  0x00005555555566d1 in do_slirp (tapfd=5, exitfd=-1) at slirp4netns.c:90
#7  0x0000555555555cf6 in parent (exit_fd=-1, sock=3) at main.c:218
#8  main (argc=<optimized out>, argv=<optimized out>) at main.c:328

CI should detect dirty vendor

  • Make sure vendor files are not directory modified without modifying vendor_patches
  • Make sure all vendor_patches patches are applied to vendor

Flaky test: test-slirp4netns-api-socket.sh 

=====================================================
   slirp4netns 0.3.0-alpha.2+dev: ./test-suite.log
=====================================================
# TOTAL: 7
# PASS:  6
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0
.. contents:: :depth: 2
FAIL: tests/test-slirp4netns-api-socket.sh
==========================================
++ dirname ../../tests/test-slirp4netns-api-socket.sh
+ . ../../tests/common.sh
+ child=1960
+ wait_for_network_namespace 1960
+ COUNTER=0
+ unshare -r -n sleep infinity
+ '[' 0 -lt 40 ']'
+ nsenter --preserve-credentials -U -n --target=1960 true
nsenter: reassociate to namespace 'ns/user' failed: Invalid argument
+ sleep 0.5
+ let COUNTER=COUNTER+1
+ '[' 1 -lt 40 ']'
+ nsenter --preserve-credentials -U -n --target=1960 true
+ break
++ mktemp -d /tmp/slirp4netns-bench.XXXXXXXXXX
+ tmpdir=/tmp/slirp4netns-bench.bHyYykB13D
+ apisocket=/tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
+ slirp_pid=1980
+ wait_for_network_device 1960 tun11
+ COUNTER=0
+ '[' 0 -lt 40 ']'
+ nsenter --preserve-credentials -U -n --target=1960 ip addr show tun11
Device "tun11" does not exist.
+ sleep 0.5
+ slirp4netns -c 1960 --api-socket /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock tun11
sent tapfd=5 for tun11
WARNING: Support for API socket is experimental
received tapfd=5
+ let COUNTER=COUNTER+1
+ '[' 1 -lt 40 ']'
+ nsenter --preserve-credentials -U -n --target=1960 ip addr show tun11
2: tun11: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000
    link/ether c6:f7:e6:25:c4:8b brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.100/24 brd 10.0.2.255 scope global tun11
       valid_lft forever preferred_lft forever
    inet6 fe80::c4f7:e6ff:fe25:c48b/64 scope link tentative 
       valid_lft forever preferred_lft forever
+ break
+ trap cleanup EXIT
++ ncat -U /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
++ echo badjson
apifd event
api_handler: got request: badjson
+ result='{"error":{"desc":"bad request: cannot parse JSON"}}'
+ grep 'bad request: cannot parse JSON'
+ jq .error.desc
+ echo '{"error":{"desc":"bad' request: cannot parse 'JSON"}}'
"bad request: cannot parse JSON"
++ ncat -U /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
++ echo '{"unexpectedjson": 42}'
apifd event
api_handler: got request: {"unexpectedjson": 42}
+ result='{"error":{"desc":"bad request: no execute found"}}'
+ echo '{"error":{"desc":"bad' request: no execute 'found"}}'
+ jq .error.desc
+ grep 'bad request: no execute found'
"bad request: no execute found"
++ echo '{"execute": "bad"}'
++ ncat -U /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
apifd event
api_handler: got request: {"execute": "bad"}
+ result='{"error":{"desc":"bad request: unknown execute"}}'
+ echo '{"error":{"desc":"bad' request: unknown 'execute"}}'
+ jq .error.desc
+ grep 'bad request: unknown execute'
"bad request: unknown execute"
++ echo '{"execute": "add_hostfwd", "arguments":{"proto": "bad"}}'
++ ncat -U /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
apifd event
api_handler: got request: {"execute": "add_hostfwd", "arguments":{"proto": "bad"}}
+ result='{"error":{"desc":"bad request: add_hostfwd: bad arguments.proto"}}'
+ echo '{"error":{"desc":"bad' request: add_hostfwd: bad 'arguments.proto"}}'
+ jq .error.desc
+ grep 'bad request: add_hostfwd: bad arguments.proto'
"bad request: add_hostfwd: bad arguments.proto"
+ set +e
++ cat /dev/zero
++ ncat -U /tmp/slirp4netns-bench.bHyYykB13D/slirp4netns.sock
apifd event
api_handler: too large message (>= 4096 bytes)
api_handler: rc=-1
Ncat: Broken pipe.
++ true
+ result=
+ set set -e
+ echo
+ grep 'bad request: too large message'
+ jq .error.desc
+ cleanup
+ kill -9 1960 1980
+ rm -rf /tmp/slirp4netns-bench.bHyYykB13D
../../tests/test-slirp4netns-api-socket.sh: line 18:  1960 Killed                  unshare -r -n sleep infinity
FAIL tests/test-slirp4netns-api-socket.sh (exit status: 1)

https://travis-ci.org/rootless-containers/slirp4netns/builds/504109827
beef372

CAP_NET_BIND_SERVICE not working with sandbox

outside ns:

$ ./slirp4netns --version
slirp4netns version 0.4.0-beta.3
commit: 179817925a6b37e8b80ba552f3998de5c4611703
$ sudo setcap cap_net_bind_service=+ep ./slirp4netns
$ ./slirp4netns --configure --mtu=65520 --disable-host-loopback $(cat /tmp/pid) tap0  --api-socket /tmp/a.sock --create-sandbox

inside ns:

$ json='{"execute": "add_hostfwd", "arguments": {"proto": "tcp", "host_addr": "0.0.0.0", "host_port": 80, "guest_addr": "10.0.2.100", "guest_port": 80}}'
$ echo -n $json | nc -U /tmp/a.sock
{"error":{"desc":"bad request: add_hostfwd: slirp_add_hostfwd failed"}}

It works without --create-sandbox

Please tag a new stable release `0.3` - `podman` 1.0 needs it

Please tag a new stable release 0.3, as podman 1.0 was released as stable, some of it's functionality (port forwarding) needs slirp4netns version >= 0.3, the podman devs apparently consider 0.3 stable and packagers will be hesitant to touch non-stable.
See here for the corresponding discussion.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.