mirror of
https://github.com/checkpoint-restore/criu
synced 2025-08-22 01:51:51 +00:00
Compare commits
2 Commits
622b4ed448
...
799504d9ff
| Author | SHA1 | Date | |
|---|---|---|---|
|
799504d9ff | ||
|
75eaa65f81 |
@ -23,6 +23,45 @@
|
||||
#include "compel/infect.h"
|
||||
#include "pstree.h"
|
||||
|
||||
/*
|
||||
* cr_user_pac_* are a copy of the corresponding uapi structs
|
||||
* in arch/arm64/include/uapi/asm/ptrace.h
|
||||
*/
|
||||
struct cr_user_pac_address_keys {
|
||||
__uint128_t apiakey;
|
||||
__uint128_t apibkey;
|
||||
__uint128_t apdakey;
|
||||
__uint128_t apdbkey;
|
||||
};
|
||||
|
||||
struct cr_user_pac_generic_keys {
|
||||
__uint128_t apgakey;
|
||||
};
|
||||
|
||||
/*
|
||||
* The following HWCAP constants are copied from
|
||||
* arch/arm64/include/uapi/asm/hwcap.h
|
||||
*/
|
||||
#ifndef HWCAP_PACA
|
||||
#define HWCAP_PACA (1 << 30)
|
||||
#endif
|
||||
|
||||
#ifndef HWCAP_PACG
|
||||
#define HWCAP_PACG (1UL << 31)
|
||||
#endif
|
||||
|
||||
/*
|
||||
* The following NT_ARM_PAC constants are copied from
|
||||
* include/uapi/linux/elf.h
|
||||
*/
|
||||
#ifndef NT_ARM_PACA_KEYS
|
||||
#define NT_ARM_PACA_KEYS 0x407 /* ARM pointer authentication address keys */
|
||||
#endif
|
||||
|
||||
#ifndef NT_ARM_PACG_KEYS
|
||||
#define NT_ARM_PACG_KEYS 0x408
|
||||
#endif
|
||||
|
||||
#ifndef NT_ARM_PAC_ENABLED_KEYS
|
||||
#define NT_ARM_PAC_ENABLED_KEYS 0x40a /* AArch64 pointer authentication enabled keys. */
|
||||
#endif
|
||||
@ -33,8 +72,8 @@ extern unsigned long getauxval(unsigned long type);
|
||||
|
||||
static int save_pac_keys(int pid, CoreEntry *core)
|
||||
{
|
||||
struct user_pac_address_keys paca;
|
||||
struct user_pac_generic_keys pacg;
|
||||
struct cr_user_pac_address_keys paca;
|
||||
struct cr_user_pac_generic_keys pacg;
|
||||
PacKeys *pac_entry;
|
||||
long pac_enabled_key;
|
||||
struct iovec iov;
|
||||
@ -228,8 +267,8 @@ int restore_gpregs(struct rt_sigframe *f, UserRegsEntry *r)
|
||||
int arch_ptrace_restore(int pid, struct pstree_item *item)
|
||||
{
|
||||
unsigned long hwcaps = getauxval(AT_HWCAP);
|
||||
struct user_pac_address_keys upaca;
|
||||
struct user_pac_generic_keys upacg;
|
||||
struct cr_user_pac_address_keys upaca;
|
||||
struct cr_user_pac_generic_keys upacg;
|
||||
PacAddressKeys *paca;
|
||||
PacGenericKeys *pacg;
|
||||
long pac_enabled_keys;
|
||||
|
||||
@ -2119,7 +2119,7 @@ static int restore_root_task(struct pstree_item *init)
|
||||
* the '--empty-ns net' mode no iptables C/R is done and we
|
||||
* need to return these rules by hands.
|
||||
*/
|
||||
ret = network_lock_internal();
|
||||
ret = network_lock_internal(/* restore = */ true);
|
||||
if (ret)
|
||||
goto out_kill;
|
||||
}
|
||||
|
||||
@ -31,7 +31,7 @@ extern int collect_net_namespaces(bool for_dump);
|
||||
|
||||
extern int network_lock(void);
|
||||
extern void network_unlock(void);
|
||||
extern int network_lock_internal(void);
|
||||
extern int network_lock_internal(bool restore);
|
||||
|
||||
extern struct ns_desc net_ns_desc;
|
||||
|
||||
|
||||
30
criu/net.c
30
criu/net.c
@ -3206,12 +3206,12 @@ static inline FILE *redirect_nftables_output(struct nft_ctx *nft)
|
||||
}
|
||||
#endif
|
||||
|
||||
static inline int nftables_lock_network_internal(void)
|
||||
static inline int nftables_lock_network_internal(bool restore)
|
||||
{
|
||||
#if defined(CONFIG_HAS_NFTABLES_LIB_API_0) || defined(CONFIG_HAS_NFTABLES_LIB_API_1)
|
||||
cleanup_file FILE *fp = NULL;
|
||||
struct nft_ctx *nft;
|
||||
int ret = 0;
|
||||
int ret = 0, exit_code = -1;
|
||||
char table[32];
|
||||
char buf[128];
|
||||
|
||||
@ -3224,11 +3224,16 @@ static inline int nftables_lock_network_internal(void)
|
||||
|
||||
fp = redirect_nftables_output(nft);
|
||||
if (!fp)
|
||||
goto out;
|
||||
goto err2;
|
||||
|
||||
snprintf(buf, sizeof(buf), "create table %s", table);
|
||||
if (NFT_RUN_CMD(nft, buf))
|
||||
ret = NFT_RUN_CMD(nft, buf);
|
||||
if (ret) {
|
||||
/* The network has been locked on dump. */
|
||||
if (restore && errno == EEXIST)
|
||||
return 0;
|
||||
goto err2;
|
||||
}
|
||||
|
||||
snprintf(buf, sizeof(buf), "add chain %s output { type filter hook output priority 0; policy drop; }", table);
|
||||
if (NFT_RUN_CMD(nft, buf))
|
||||
@ -3246,17 +3251,16 @@ static inline int nftables_lock_network_internal(void)
|
||||
if (NFT_RUN_CMD(nft, buf))
|
||||
goto err1;
|
||||
|
||||
goto out;
|
||||
|
||||
exit_code = 0;
|
||||
out:
|
||||
nft_ctx_free(nft);
|
||||
return exit_code;
|
||||
err1:
|
||||
snprintf(buf, sizeof(buf), "delete table %s", table);
|
||||
NFT_RUN_CMD(nft, buf);
|
||||
err2:
|
||||
ret = -1;
|
||||
pr_err("Locking network failed using nftables\n");
|
||||
out:
|
||||
nft_ctx_free(nft);
|
||||
return ret;
|
||||
goto out;
|
||||
#else
|
||||
pr_err("CRIU was built without libnftables support\n");
|
||||
return -1;
|
||||
@ -3288,7 +3292,7 @@ static int iptables_network_lock_internal(void)
|
||||
return ret;
|
||||
}
|
||||
|
||||
int network_lock_internal(void)
|
||||
int network_lock_internal(bool restore)
|
||||
{
|
||||
int ret = 0, nsret;
|
||||
|
||||
@ -3301,7 +3305,7 @@ int network_lock_internal(void)
|
||||
if (opts.network_lock_method == NETWORK_LOCK_IPTABLES)
|
||||
ret = iptables_network_lock_internal();
|
||||
else if (opts.network_lock_method == NETWORK_LOCK_NFTABLES)
|
||||
ret = nftables_lock_network_internal();
|
||||
ret = nftables_lock_network_internal(restore);
|
||||
|
||||
if (restore_ns(nsret, &net_ns_desc))
|
||||
ret = -1;
|
||||
@ -3427,7 +3431,7 @@ int network_lock(void)
|
||||
if (run_scripts(ACT_NET_LOCK))
|
||||
return -1;
|
||||
|
||||
return network_lock_internal();
|
||||
return network_lock_internal(false);
|
||||
}
|
||||
|
||||
void network_unlock(void)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user