YYifan Zhaonetstack: enforce IPv4-only namespace state
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
refactor(runtime): remove incomplete crash recovery state Crash remediation depended on a persisted runtime journal and startup reconcile path that could not reliably rehydrate every resource. Normal daemon operation still paid the state and lifecycle complexity. Remove reconcile and rehydrate together with recovery-only metadata. Keep SandboxRecord limited to identity, namespace, and checkpoint head. Make the network pool process-local, and publish checkpoints directly while atomically advancing the recorded checkpoint head. Crash recovery can be redesigned later without preserving these incomplete records. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 27 天前 | |
network: enforce IPv4-only sandbox networking Conch network policies currently accept only IPv4 destinations, but guest IPv6 remained enabled during cold boot and CNI results were not checked comprehensively for IPv6 data. This could leave traffic outside the documented IPv4 policy boundary. Disable IPv6 on StratoVirt and Cloud Hypervisor cold boots. Reject CNI results containing IPv6 addresses, gateways, routes, or DNS servers before accepting a slot; existing slot-creation cleanup then performs CNI rollback. Document the IPv4-only contract and add focused command-generation and CNI result validation tests. Fixes Issue #167: https://github.com/ConchSandbox/Conch/issues/167 | 7 天前 | |
netstack: bound CNI plugin operations with a timeout CNI ADD and DEL previously used only the caller context. A plugin that ignored progress or hung during execution could therefore block slot creation or cleanup indefinitely. Derive a context with a 20-second timeout for each CNI invocation while preserving any shorter caller deadline. Timeout errors continue through the existing failure and cleanup paths, keeping uncertain slots out of the reusable pool. Add tests for the default timeout and shorter caller deadlines. Fixes Issue #93: https://github.com/ConchSandbox/Conch/issues/93 | 7 天前 | |
netstack: bound CNI plugin operations with a timeout CNI ADD and DEL previously used only the caller context. A plugin that ignored progress or hung during execution could therefore block slot creation or cleanup indefinitely. Derive a context with a 20-second timeout for each CNI invocation while preserving any shorter caller deadline. Timeout errors continue through the existing failure and cleanup paths, keeping uncertain slots out of the reusable pool. Add tests for the default timeout and shorter caller deadlines. Fixes Issue #93: https://github.com/ConchSandbox/Conch/issues/93 | 7 天前 | |
netstack: migrate CNI management to libcni | 21 天前 | |
netstack: migrate CNI management to libcni | 21 天前 | |
network: enforce IPv4-only sandbox networking Conch network policies currently accept only IPv4 destinations, but guest IPv6 remained enabled during cold boot and CNI results were not checked comprehensively for IPv6 data. This could leave traffic outside the documented IPv4 policy boundary. Disable IPv6 on StratoVirt and Cloud Hypervisor cold boots. Reject CNI results containing IPv6 addresses, gateways, routes, or DNS servers before accepting a slot; existing slot-creation cleanup then performs CNI rollback. Document the IPv4-only contract and add focused command-generation and CNI result validation tests. Fixes Issue #167: https://github.com/ConchSandbox/Conch/issues/167 | 7 天前 | |
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 | |
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 | |
conchd: standardize API error responses | 21 天前 | |
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 | |
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 | |
refactor(netstack): simplify network slot lifecycle After crash recovery was removed, netstack still carried optional refill modes, configurable CNI network counts, full CNI result state, and cross-package Slot mutation. The remaining layers obscured ownership and made cleanup harder to reason about. Use one continuously refilled warm pool with a fixed CNI network count. Store only the assigned CNI IP, encapsulate ADD and DEL in CNIManager, and split namespace and guest tap operations by role. Keep mutable Slot state inside netstack and leave only allocator and queue primitives in the slot subpackage. Do not call CNI CHECK from Slot health checks because the built-in loopback configuration uses CNI 0.3.1, which does not support CHECK. Validate the namespace, interface, stored IP, and guest tap locally. Wake refill backoff when a discarded Slot releases capacity, while preserving backoff and the reserved ID when teardown fails. Update the configuration and module documentation to match the reduced contract. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 27 天前 | |
fix(network): allow CNI bridge forwarding on host Host FORWARD policies could drop sandbox traffic even when CNI routing and masquerading were configured. Sandboxes therefore could not reach external networks unless operators changed the host-wide FORWARD policy manually. Detect the host default gateway interface and add idempotent bidirectional forwarding rules between it and the configured CNI bridge when the network pool starts. Remove the rules during normal shutdown while keeping per-sandbox ingress and egress enforcement inside each network slot. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: hu-zhangying <huzhangying@huawei.com> | 23 天前 | |
netstack: enforce IPv4-only namespace state Conch rejected IPv6 data returned by CNI but did not constrain the actual sandbox network namespace. Kernel-generated or plugin-created IPv6 state could therefore fall outside the IPv4 policy boundary. Disable IPv6 autoconfiguration and router advertisements for existing and future namespace interfaces. After CNI and tap setup, reject any remaining IPv6 addresses or routes across all route tables so existing slot cleanup rolls the allocation back. Fixes Issue #167: https://github.com/ConchSandbox/Conch/issues/167 | 1 小时前 | |
refactor(netstack): simplify network slot lifecycle After crash recovery was removed, netstack still carried optional refill modes, configurable CNI network counts, full CNI result state, and cross-package Slot mutation. The remaining layers obscured ownership and made cleanup harder to reason about. Use one continuously refilled warm pool with a fixed CNI network count. Store only the assigned CNI IP, encapsulate ADD and DEL in CNIManager, and split namespace and guest tap operations by role. Keep mutable Slot state inside netstack and leave only allocator and queue primitives in the slot subpackage. Do not call CNI CHECK from Slot health checks because the built-in loopback configuration uses CNI 0.3.1, which does not support CHECK. Validate the namespace, interface, stored IP, and guest tap locally. Wake refill backoff when a discarded Slot releases capacity, while preserving backoff and the reserved ID when teardown fails. Update the configuration and module documentation to match the reduced contract. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 27 天前 | |
conchd: standardize API error responses | 21 天前 | |
feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 | |
netstack: enforce IPv4-only namespace state Conch rejected IPv6 data returned by CNI but did not constrain the actual sandbox network namespace. Kernel-generated or plugin-created IPv6 state could therefore fall outside the IPv4 policy boundary. Disable IPv6 autoconfiguration and router advertisements for existing and future namespace interfaces. After CNI and tap setup, reject any remaining IPv6 addresses or routes across all route tables so existing slot cleanup rolls the allocation back. Fixes Issue #167: https://github.com/ConchSandbox/Conch/issues/167 | 1 小时前 | |
netstack: request refill when the warm pool is empty Pool.Get previously returned an empty-pool error without notifying the background population loop. If no other event triggered a refill, later sandbox creation requests could continue finding an empty pool. Signal refillNeeded before returning the existing error. The notification is buffered and non-blocking, so concurrent empty-pool requests collapse into a single wakeup. The triggering request still fails; a later request can use the replenished capacity. Add a focused test that empties the queue and verifies that Get emits the refill notification. Fixes Issue #51: https://github.com/ConchSandbox/Conch/issues/51 | 7 天前 | |
netstack: migrate CNI management to libcni | 21 天前 | |
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 24 天前 |