[vnet] linux support #63664
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| // Teleport | ||
| // Copyright (C) 2024 Gravitational, Inc. | ||
| // | ||
| // This program is free software: you can redistribute it and/or modify | ||
| // it under the terms of the GNU Affero General Public License as published by | ||
| // the Free Software Foundation, either version 3 of the License, or | ||
| // (at your option) any later version. | ||
| // | ||
| // This program is distributed in the hope that it will be useful, | ||
| // but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| // GNU Affero General Public License for more details. | ||
| // | ||
| // You should have received a copy of the GNU Affero General Public License | ||
| // along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
|
|
||
| package vnet | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/gravitational/trace" | ||
| ) | ||
|
|
||
| const ( | ||
| tunInterfaceName = "TeleportVNet" | ||
| ) | ||
|
|
||
| // LinuxAdminProcessConfig configures RunLinuxAdminProcess. | ||
| type LinuxAdminProcessConfig struct { | ||
| // ClientApplicationServiceAddr is the address of the client application | ||
| // service the admin process connects to. | ||
| ClientApplicationServiceAddr string | ||
| // ServiceCredentialPath is the path to IPC credentials used to authenticate | ||
| // with the client application service. | ||
| ServiceCredentialPath string | ||
| } | ||
|
tangyatsu marked this conversation as resolved.
|
||
|
|
||
| // RunLinuxAdminProcess must run as root. | ||
| func RunLinuxAdminProcess(ctx context.Context, config LinuxAdminProcessConfig) error { | ||
| log.InfoContext(ctx, "Running VNet admin process") | ||
|
|
||
| serviceCreds, err := readCredentials(config.ServiceCredentialPath) | ||
| if err != nil { | ||
| return trace.Wrap(err, "reading service IPC credentials") | ||
| } | ||
| // TODO(tangyatsu): change to gRPC client over unix socket instead of TCP. | ||
| clt, err := newClientApplicationServiceClient(ctx, serviceCreds, config.ClientApplicationServiceAddr) | ||
| if err != nil { | ||
| return trace.Wrap(err, "creating user process client") | ||
| } | ||
| defer clt.close() | ||
|
|
||
| return runUnixAdminProcess(ctx, clt, tunInterfaceName) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| // Teleport | ||
| // Copyright (C) 2025 Gravitational, Inc. | ||
| // | ||
| // This program is free software: you can redistribute it and/or modify | ||
| // it under the terms of the GNU Affero General Public License as published by | ||
| // the Free Software Foundation, either version 3 of the License, or | ||
| // (at your option) any later version. | ||
| // | ||
| // This program is distributed in the hope that it will be useful, | ||
| // but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| // GNU Affero General Public License for more details. | ||
| // | ||
| // You should have received a copy of the GNU Affero General Public License | ||
| // along with this program. If not, see <http://www.gnu.org/licenses/>. | ||
|
|
||
| //go:build darwin || linux | ||
|
|
||
| package vnet | ||
|
|
||
| import ( | ||
| "context" | ||
| "errors" | ||
| "os" | ||
| "time" | ||
|
|
||
| "github.com/gravitational/trace" | ||
| "golang.org/x/sync/errgroup" | ||
| "golang.zx2c4.com/wireguard/tun" | ||
|
|
||
| vnetv1 "github.com/gravitational/teleport/gen/proto/go/teleport/lib/vnet/v1" | ||
| ) | ||
|
|
||
| func runUnixAdminProcess(ctx context.Context, clt *clientApplicationServiceClient, tunInterfaceName string) error { | ||
| tun, tunName, err := createTUNDevice(ctx, tunInterfaceName) | ||
| if err != nil { | ||
| return trace.Wrap(err) | ||
| } | ||
| defer tun.Close() | ||
|
|
||
| networkStackConfig, err := newNetworkStackConfig(ctx, tun, clt) | ||
| if err != nil { | ||
| return trace.Wrap(err, "creating network stack config") | ||
| } | ||
| networkStack, err := newNetworkStack(networkStackConfig) | ||
| if err != nil { | ||
| return trace.Wrap(err, "creating network stack") | ||
| } | ||
|
|
||
| if err := clt.ReportNetworkStackInfo(ctx, &vnetv1.NetworkStackInfo{ | ||
| InterfaceName: tunName, | ||
| Ipv6Prefix: networkStackConfig.ipv6Prefix.String(), | ||
| }); err != nil { | ||
| return trace.Wrap(err, "reporting network stack info to client application") | ||
| } | ||
|
|
||
| osConfigProvider, err := newOSConfigProvider(osConfigProviderConfig{ | ||
| clt: clt, | ||
| tunName: tunName, | ||
| ipv6Prefix: networkStackConfig.ipv6Prefix.String(), | ||
| dnsIPv6: networkStackConfig.dnsIPv6.String(), | ||
| addDNSAddress: networkStack.addDNSAddress, | ||
| }) | ||
| if err != nil { | ||
| return trace.Wrap(err, "creating OS config provider") | ||
| } | ||
| osConfigurator := newOSConfigurator(osConfigProvider) | ||
|
|
||
| g, ctx := errgroup.WithContext(ctx) | ||
| g.Go(func() error { | ||
| defer log.InfoContext(ctx, "Network stack terminated.") | ||
| if err := networkStack.run(ctx); err != nil { | ||
| return trace.Wrap(err, "running network stack") | ||
| } | ||
| return errors.New("network stack terminated") | ||
| }) | ||
| g.Go(func() error { | ||
| defer log.InfoContext(ctx, "OS configuration loop exited.") | ||
| if err := osConfigurator.runOSConfigurationLoop(ctx); err != nil { | ||
| return trace.Wrap(err, "running OS configuration loop") | ||
| } | ||
| return errors.New("OS configuration loop terminated") | ||
| }) | ||
| g.Go(func() error { | ||
| defer log.InfoContext(ctx, "Ping loop exited.") | ||
| tick := time.Tick(time.Second) | ||
| for { | ||
| select { | ||
| case <-tick: | ||
| if err := clt.Ping(ctx); err != nil { | ||
| return trace.Wrap(err, "failed to ping client application, it may have exited, shutting down") | ||
| } | ||
| case <-ctx.Done(): | ||
| return ctx.Err() | ||
| } | ||
| } | ||
| }) | ||
|
|
||
| done := make(chan error) | ||
| go func() { | ||
| done <- g.Wait() | ||
| }() | ||
|
|
||
| select { | ||
| case err := <-done: | ||
| return trace.Wrap(err, "running VNet admin process") | ||
| case <-ctx.Done(): | ||
| } | ||
|
|
||
| select { | ||
| case err := <-done: | ||
| // network stack exited cleanly within timeout | ||
| return trace.Wrap(err, "running VNet admin process") | ||
|
Collaborator
There was a problem hiding this comment. Are we intentionally returning an error for a clean exit?
Contributor
Author
There was a problem hiding this comment. this code was only in darwin version previously. my understanding is there was a bug where the network stack could hang on shutdown #58298, so “clean exit” here means it exited within the timeout window, regardless of whether it returned an error |
||
| case <-time.After(10 * time.Second): | ||
| log.ErrorContext(ctx, "VNet admin process did not exit within 10 seconds, forcing shutdown.") | ||
| os.Exit(1) | ||
| return nil | ||
| } | ||
| } | ||
|
|
||
| func createTUNDevice(ctx context.Context, interfaceName string) (tun.Device, string, error) { | ||
| log.DebugContext(ctx, "Creating TUN device.") | ||
| dev, err := tun.CreateTUN(interfaceName, mtu) | ||
| if err != nil { | ||
| return nil, "", trace.Wrap(err, "creating TUN device") | ||
| } | ||
| name, err := dev.Name() | ||
| if err != nil { | ||
| dev.Close() | ||
| return nil, "", trace.Wrap(err, "getting TUN device name") | ||
|
tangyatsu marked this conversation as resolved.
|
||
| } | ||
| return dev, name, nil | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.