From 3a66d2776aa795b99054fa98fa40aa42d65a8b08 Mon Sep 17 00:00:00 2001 From: David Timber Date: Tue, 23 Jul 2024 11:36:10 +0200 Subject: [PATCH 1/9] Add "um" - mtu1280 with user-mode linux --- um/.gitignore | 1 + um/Makefile | 134 ++ um/README.md | 188 +++ um/host/dispatcher.d/mtu1280-hook | 13 + um/host/mtu1280-uml.env | 1 + um/host/mtu1280-uml.service | 11 + um/host/radvd.conf | 7 + um/host/sysctl.d/10-mtu1280-forwarding.conf | 5 + um/linux-x86_64.config | 1436 +++++++++++++++++++ um/target/apache/ip.conf | 1 + um/target/apache/site-mtu1280.conf | 12 + um/target/hostname | 1 + um/target/interfaces | 10 + um/target/mtu1280/mtu1280-init | 9 + um/target/mtu1280/mtu1280-init.sh | 30 + um/target/resolv.conf | 6 + 16 files changed, 1865 insertions(+) create mode 100644 um/.gitignore create mode 100644 um/Makefile create mode 100644 um/README.md create mode 100644 um/host/dispatcher.d/mtu1280-hook create mode 100644 um/host/mtu1280-uml.env create mode 100644 um/host/mtu1280-uml.service create mode 100644 um/host/radvd.conf create mode 100644 um/host/sysctl.d/10-mtu1280-forwarding.conf create mode 100644 um/linux-x86_64.config create mode 100644 um/target/apache/ip.conf create mode 100644 um/target/apache/site-mtu1280.conf create mode 100644 um/target/hostname create mode 100644 um/target/interfaces create mode 100644 um/target/mtu1280/mtu1280-init create mode 100644 um/target/mtu1280/mtu1280-init.sh create mode 100644 um/target/resolv.conf diff --git a/um/.gitignore b/um/.gitignore new file mode 100644 index 0000000..a007fea --- /dev/null +++ b/um/.gitignore @@ -0,0 +1 @@ +build/* diff --git a/um/Makefile b/um/Makefile new file mode 100644 index 0000000..70929ed --- /dev/null +++ b/um/Makefile @@ -0,0 +1,134 @@ +KVER = 6.6.40 +KVER_MAJOR = 6 +ALPINE_VER = 3.20.1-x86_64 +ALPINE_VER_MAJOR = 3.20 +APK_STATIC_URL = https://gitlab.alpinelinux.org/api/v4/projects/5/packages/generic/v2.12.10/x86_64/apk.static +NPROC = $(shell nproc) +# for safety because otherwise the -j option will have no value assigned and +# make will go berserk +NPROC ?= 1 + +.PHONY: first clean uninstall clean-rootimg rebuild-rootimg run-uml uninstall-all + +first: build/linux-$(KVER)_mtu1280/linux build/alpine-minirootfs-$(ALPINE_VER).tar.gz build/apk.static +rootimg: build/root.img +rebuild-rootimg: clean-rootimg rootimg + +include /etc/mtu1280/mtu1280-uml.env +run-uml: + /usr/local/bin/linux ${MTU1280_UML_OPTS} ${MTU1280_UML_OPTS_EXTRA} + +clean: + rm -rf build + +clean-rootimg: + rm -f build/root.img + +install: build/linux-$(KVER)_mtu1280/linux build/root.img + mkdir -p /usr/local/bin + mkdir -p /var/lib/mtu1280 + mkdir -p /usr/local/lib/systemd/system + mkdir -p /etc/mtu1280 + install -o 0 -g 0 -m 755 -Z build/linux-$(KVER)_mtu1280/linux /usr/local/bin + install -b -o 0 -g 0 -m 644 -Z build/root.img /var/lib/mtu1280 + install -b -o 0 -g 0 -m 644 -Z host/mtu1280-uml.env /etc/mtu1280 + install -o 0 -g 0 -m 644 -Z host/mtu1280-uml.service /usr/local/lib/systemd/system + install -o 0 -g 0 -m 755 -Z host/dispatcher.d/mtu1280-hook /etc/NetworkManager/dispatcher.d + install -o 0 -g 0 -m 644 -Z host/sysctl.d/10-mtu1280-forwarding.conf /etc/sysctl.d + sysctl -qw --system + systemctl daemon-reload + +install-radvd: + install -b -o 0 -g 0 -m 644 -Z host/radvd.conf /etc + +uninstall: + rm -f \ + /usr/local/bin/linux \ + /usr/local/lib/systemd/system/mtu1280-uml.service \ + /etc/NetworkManager/dispatcher.d/mtu1280-hook \ + /etc/sysctl.d/10-mtu1280-forwarding.conf + systemctl daemon-reload + +uninstall-all: uninstall + rm -rf /var/lib/mtu1280 + +build/linux-$(KVER).tar.xz: + mkdir -p build + cd build && wget -c \ + https://cdn.kernel.org/pub/linux/kernel/v$(KVER_MAJOR).x/linux-$(KVER).tar.xz \ + https://cdn.kernel.org/pub/linux/kernel/v$(KVER_MAJOR).x/linux-$(KVER).tar.sign || \ + rm -f linux-$(KVER).tar.xz linux-$(KVER).tar.sign +# TODO: verify signature? + +build/linux-$(KVER)/MTU1280_MARKER: build/linux-$(KVER).tar.xz + rm -rf linux-$(KVER) + cd build && tar xf linux-$(KVER).tar.xz || rm -rf linux-$(KVER) + touch build/linux-$(KVER)/MTU1280_MARKER + +build/linux-$(KVER)_mtu1280/linux: build/linux-$(KVER)/MTU1280_MARKER + mkdir -p build/linux-$(KVER)_mtu1280 + ln -fs ../../linux-x86_64.config build/linux-$(KVER)_mtu1280/.config + cd build/linux-$(KVER)_mtu1280 && \ + make -f ../linux-$(KVER)/Makefile ARCH=um -j$(NPROC) + +build/alpine-minirootfs-$(ALPINE_VER).tar.gz: + mkdir -p build + cd build && wget -c \ + https://dl-cdn.alpinelinux.org/alpine/v$(ALPINE_VER_MAJOR)/releases/x86_64/alpine-minirootfs-$(ALPINE_VER).tar.gz \ + https://dl-cdn.alpinelinux.org/alpine/v$(ALPINE_VER_MAJOR)/releases/x86_64/alpine-minirootfs-$(ALPINE_VER).tar.gz.sha256 \ + https://dl-cdn.alpinelinux.org/alpine/v$(ALPINE_VER_MAJOR)/releases/x86_64/alpine-minirootfs-$(ALPINE_VER).tar.gz.asc || \ + rm -f \ + alpine-minirootfs-$(ALPINE_VER).tar.gz \ + alpine-minirootfs-$(ALPINE_VER).tar.gz.sha256 \ + alpine-minirootfs-$(ALPINE_VER).tar.gz.asc +# TODO: verify signature? + +build/apk.static: + wget "${APK_STATIC_URL}" -cO build/apk.static + chmod 755 build/apk.static + +build/root.img: build/apk.static build/alpine-minirootfs-$(ALPINE_VER).tar.gz build/linux-$(KVER)_mtu1280/linux +ifneq ($(shell id -u), 0) + @echo "The target requires root." >&2 && exit 2 +endif + rm -f build/root.img.tmp + rm -rf build/root + mkdir build/root + + tar -C build/root -xf build/alpine-minirootfs-$(ALPINE_VER).tar.gz + + cd build/linux-$(KVER)_mtu1280 && \ + make -f ../linux-$(KVER)/Makefile ARCH=um INSTALL_MOD_PATH=../root modules_install + + echo -e "# UML console's on tty0 without login\ntty0::respawn:/bin/sh\n" \ + >> build/root/etc/inittab + + cp -f target/hostname build/root/etc + cp -f target/interfaces build/root/etc/network + cp -f target/resolv.conf build/root/etc + + mkdir -p build/root/etc/apache2/conf.d + cp target/apache/ip.conf target/apache/site-mtu1280.conf build/root/etc/apache2/conf.d + + mkdir -p build/root/usr/local/libexec/mtu1280 build/root/etc/init.d + cp target/mtu1280/mtu1280-init.sh build/root/usr/local/libexec/mtu1280/mtu1280-init.sh + chmod 755 build/root/usr/local/libexec/mtu1280/mtu1280-init.sh + cp target/mtu1280/mtu1280-init build/root/etc/init.d + chmod 755 build/root/etc/init.d/mtu1280-init + + build/apk.static --root build/root add openrc +# Github.com doesn't do IPv6 and does IPv4 with DF bit always set so the host +# is unable to fragment the packets. +# Might as well ship the repo with the image. + mkdir -p build/root/opt + git -C build/root/opt clone https://github.com/falling-sky/mod_ip + + mkdir -p build/root/etc/runlevels/default + ln -fs /etc/init.d/hostname build/root/etc/runlevels/default/hostname + ln -fs /etc/init.d/networking build/root/etc/runlevels/default/networking + ln -fs /etc/init.d/fsck build/root/etc/runlevels/default/fsck + ln -fs /etc/init.d/mtu1280-init build/root/etc/runlevels/default/mtu1280-init + + fallocate -l 2G build/root.img.tmp + mkfs.ext4 -d build/root build/root.img.tmp + mv build/root.img.tmp build/root.img diff --git a/um/README.md b/um/README.md new file mode 100644 index 0000000..6f22017 --- /dev/null +++ b/um/README.md @@ -0,0 +1,188 @@ +# MTU1280d with User-mode Linux +This is an alternative to simulating 1280 octet PMTU without packet interception +using Netfilter and the application("mtu1280d") generating ICMPv6 type 2(packet +too big) messages using user-mode Linux(UML). + +This set up is only useful if the machine has no modern kernel. If a modern +kernel is available, [the netns](/netns/README.md) set up is more favourable as +it requires less memory and less overhead. + +In this set up, the ICMPv6 messages will originate from a middlebox, which is +the host running the UML with the proper source address and hop limit. This is +more in line with the real-world scenario. + +[RFC4443](https://datatracker.ietf.org/doc/html/rfc4443#section-3.2): + +> Originating a Packet Too Big Message makes an exception to one of the +> rules as to when to originate an ICMPv6 error message. Unlike other +> messages, it is sent in response to a packet received with an IPv6 +> multicast destination address, or with a link-layer multicast or +> link-layer broadcast address. + +## Network Set Up +If the CSP supports prefix delegation to an instance, get that. AWS and GCP +supports this. Hetzner provides IPv6 connectivity to the VMs through prefix +delegation by default(although there's no DHCP support). If prefix delegation is +not available, assign multiple addresses to the instance. The point here is to +get the hypervisor to route the packets to the instance. + +Pick an address for the host which will act as the middlebox before the 1280 mtu +segment so that it can send ICMP packets. Pick another address for the UML. + +## INSTALL +Here are the packages required to build and run the UML kernel and the rootfs +image. radvd is used to set the default route on the UML system so we don't have +to manually set the link-local address of the host tap device, which could +change. + +```sh +dnf install xz gzip tar bc e2fsprogs wget git gcc make perl flex bison +# optional - to set the default route using RA +dnf install radvd +``` + +Create the tap device for the UML process to tap into. Replace `IPADDR_FROM_CSP` +with the one you picked for the inner UML host earlier. The IPv4 connectivity is +optional so the line can be deleted. + +```sh +nmcli c add \ + type tun \ + con-name tap-mtu1280 \ + ifname tap-mtu1280 \ + autoconnect yes \ + tun.mode tap \ + tun.vnet-hdr yes \ + ipv4.method disabled \ + ipv6.method link-local \ + ipv4.routes "IPADDR_FROM_CSP/32 mtu=1280" \ + ipv6.routes "IPADDR_FROM_CSP/128 mtu=1280" +``` + +There are two ways to set the IP addresses of the UML interface. You can either +edit the [interfaces file](/um/target/interfaces) before building the rootfs +image or edit it in the UML after building it. Do not set the gateway for IPv6 +as the kernel will automatically set one from the RA from the host. + +In the um directory of the project, do: + +```sh +make +sudo make rootimg +sudo make install + +# if using radvd +sudo make install-radvd +sudo systemctl enable --now radvd.service +``` + +Edit the uml launch parameters in `/etc/mtu1280/mtu1280-uml.env` to set the +mem to the proper size for the system. + +Now the UML kernel program and the root image are installed on the system. To +run the UML to edit the interfaces file or just to play with it, run: + +```sh +sudo MTU1280_UML_OPTS_EXTRA=init=/bin/sh make run-uml +``` + +If the UML process crashes trying to mmap() temp files, change the SELinux +policy: + +```sh +setsebool -P selinuxuser_execmod 1 +``` + +After making changes, don't forget to do `sync` or `umount /` before crashing +the kernel by exiting from the shell. + +You can test the UML image by letting it boot normally. The +[mtu1280-init.sh](/um/target/mtu1280/mtu1280-init.sh) script will compile and +install mod_ip. If everything goes well, you will fall through to the root +shell(getty disabled for convenience) and mod_ip will be running with the +apache2 service. + +If you're sure that the UML will boot and function on its own, run it as a +service. + +```sh +systemctl enable --now mtu1280-uml.service +``` + +## Route Check +``` + 13.|-- 2001:db8:4000:cfff::f200: 0.0% 4 81.9 42.3 29.0 81.9 26.4 + 14.|-- 2001:db8:f0:f310::1500 0.0% 4 30.1 30.1 30.1 30.1 0.0 + 15.|-- 2001:db8:f0:f310::1280 0.0% 4 30.2 31.1 30.2 33.7 1.8 +``` + +`traceroute`ing the UML host should give you something like the above(1500 the +host and 1280 the UML). + +https://tools.keycdn.com/traceroute + +## Caveats and Quirks +The script [mtu1280-hook](/um/host/dispatcher.d/mtu1280-hook) is installed on +the system to disable some offloading features of the interface. The script is +made mainly because the UML network stack cannot handle GRO frames gracefully. +The UML process becomes unstable when it receives a GRO frame routed from the +host interface. This will have negligible network performance impact as mod_ip +is not traffic-heavy, provided that it's the only service the host runs. + +The UML is not so stable. Here are few more problems with it: + +- Rebooting will make it unusable. Always power off or kill the process by + stopping the service +- The UML is more of a kernel debugging tool than a full-blown virtualization + solution. The performance and stability can become an issue +- The UML provides no virtual no serial device. If you don't have the main + serial through the stdio of the process(which is the case when it's running as + a Systemd service), there are other ways to get the shell: + - SSH: set the root password, enable and start dropbear + - Use PTY or TTY option of the UML + +Be very careful if you decide to use Dropbear on the UML. The firewall of most +CSPs support destination address in the rule set. This means that filtering must +be done on either the host or UML. + +### One Way MTU1280 +``` +ROUTER A -------------------- ROUTER B -------------------- mod_ip HOST + MTU 1280 segment MTU 1500 segment +``` + +The full-blown set up requires 3 hosts as illustrated above. As this set up is +designed to be run on a cloud instance, corners had to be cut by making the +"imaginary" MTU 1280 segment using the routing table on the host. + +``` + HOST UML +<- default route | tap device ----> <---- default route + MTU: 1500 | MTU: 1280 MTU: 1500 +``` + +So the UML can still send packets larger than 1500 octets whilst the host cannot +route packets larger than 1280 octets addressed to the UML due to the routing +constraint. Setting the MTU of the UML interface to 1280 will make it announce +the MSS of 1240 bytes in the SYN packets. Modifying the value using Netfilter +requires kernel patch because there's a safety check that disallows values +larger than that of the device. + +In function `tcpmss_mangle_packet()` in net/netfilter/xt_TCPMSS.c: + +```c + /* Never increase MSS, even when setting it, as + * doing so results in problems for hosts that rely + * on MSS being set correctly. + */ + if (oldmss <= newmss) + return 0; +``` + +Even with this check removed, the TCPMSS module is unable to modify the MSS +value to the one requested precisely. So we're left with the routing table MTU +approach. + +Some IP stack implementations could get confused or complain. However, all the +endpoint has to do is cache the new MTU and adjust the MSS of the established +connection before performing retransmission. diff --git a/um/host/dispatcher.d/mtu1280-hook b/um/host/dispatcher.d/mtu1280-hook new file mode 100644 index 0000000..8dabb00 --- /dev/null +++ b/um/host/dispatcher.d/mtu1280-hook @@ -0,0 +1,13 @@ +#!/bin/bash + +if [ "$2" != "up" ]; then + exit +fi + +# Accept RA even if forwarding is enabled and the address is manually set +sysctl -w "net.ipv6.conf.$1.accept_ra = 2" +# UML net device can't handle GRO and GSO which are enabled on the CSP instances +ethtool -K $1 \ + tcp-segmentation-offload off \ + generic-receive-offload off \ + generic-segmentation-offload off diff --git a/um/host/mtu1280-uml.env b/um/host/mtu1280-uml.env new file mode 100644 index 0000000..52f51b1 --- /dev/null +++ b/um/host/mtu1280-uml.env @@ -0,0 +1 @@ +MTU1280_UML_OPTS=uml_dir=/var/lib/mtu1280 umid=mtu1280 ubd0=/var/lib/mtu1280/root.img mem=512M vec0:transport=tap,ifname=tap-mtu1280,vec=0,gro=0 root=/dev/ubda rw diff --git a/um/host/mtu1280-uml.service b/um/host/mtu1280-uml.service new file mode 100644 index 0000000..9e98771 --- /dev/null +++ b/um/host/mtu1280-uml.service @@ -0,0 +1,11 @@ +[Unit] +Description=mtu1280 UML process +After=local-fs.target network.target radvd.service + +[Service] +EnvironmentFile=/etc/mtu1280/mtu1280-uml.env +ExecStart=/usr/local/bin/linux $MTU1280_UML_OPTS +Restart=on-failure + +[Install] +WantedBy=multi-user.target diff --git a/um/host/radvd.conf b/um/host/radvd.conf new file mode 100644 index 0000000..4fee606 --- /dev/null +++ b/um/host/radvd.conf @@ -0,0 +1,7 @@ +interface tap-mtu1280 +{ + AdvSendAdvert on; + MinRtrAdvInterval 30; + MaxRtrAdvInterval 100; + AdvSourceLLAddress on; +}; diff --git a/um/host/sysctl.d/10-mtu1280-forwarding.conf b/um/host/sysctl.d/10-mtu1280-forwarding.conf new file mode 100644 index 0000000..9c5e2e3 --- /dev/null +++ b/um/host/sysctl.d/10-mtu1280-forwarding.conf @@ -0,0 +1,5 @@ +net.ipv4.ip_forward = 1 +net.ipv6.conf.all.forwarding = 1 +net.ipv4.conf.all.forwarding = 1 +net.ipv6.conf.default.forwarding = 1 +net.ipv4.conf.default.forwarding = 1 \ No newline at end of file diff --git a/um/linux-x86_64.config b/um/linux-x86_64.config new file mode 100644 index 0000000..de9a363 --- /dev/null +++ b/um/linux-x86_64.config @@ -0,0 +1,1436 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/um 6.6.40 Kernel Configuration +# +CONFIG_CC_VERSION_TEXT="gcc (GCC) 14.1.1 20240701 (Red Hat 14.1.1-7)" +CONFIG_CC_IS_GCC=y +CONFIG_GCC_VERSION=140101 +CONFIG_CLANG_VERSION=0 +CONFIG_AS_IS_GNU=y +CONFIG_AS_VERSION=24100 +CONFIG_LD_IS_BFD=y +CONFIG_LD_VERSION=24100 +CONFIG_LLD_VERSION=0 +CONFIG_CC_CAN_LINK=y +CONFIG_CC_CAN_LINK_STATIC=y +CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y +CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y +CONFIG_TOOLS_SUPPORT_RELR=y +CONFIG_CC_HAS_ASM_INLINE=y +CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y +CONFIG_PAHOLE_VERSION=0 +CONFIG_IRQ_WORK=y + +# +# General setup +# +CONFIG_BROKEN_ON_SMP=y +CONFIG_INIT_ENV_ARG_LIMIT=128 +# CONFIG_WERROR is not set +CONFIG_LOCALVERSION="_mtu1280" +CONFIG_LOCALVERSION_AUTO=y +CONFIG_BUILD_SALT="" +CONFIG_DEFAULT_INIT="" +CONFIG_DEFAULT_HOSTNAME="mtu1280" +# CONFIG_SYSVIPC is not set +# CONFIG_POSIX_MQUEUE is not set +# CONFIG_WATCH_QUEUE is not set +# CONFIG_CROSS_MEMORY_ATTACH is not set +# CONFIG_USELIB is not set +# CONFIG_AUDIT is not set +CONFIG_HAVE_ARCH_AUDITSYSCALL=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_IRQ_SHOW=y +# end of IRQ subsystem + +CONFIG_GENERIC_CLOCKEVENTS=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ_COMMON=y +# CONFIG_HZ_PERIODIC is not set +CONFIG_NO_HZ_IDLE=y +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y +# end of Timers subsystem + +CONFIG_BPF=y + +# +# BPF subsystem +# +# CONFIG_BPF_SYSCALL is not set +# end of BPF subsystem + +CONFIG_PREEMPT_NONE_BUILD=y +CONFIG_PREEMPT_NONE=y + +# +# CPU/Task time and stats accounting +# +CONFIG_TICK_CPU_ACCOUNTING=y +CONFIG_BSD_PROCESS_ACCT=y +# CONFIG_BSD_PROCESS_ACCT_V3 is not set +# CONFIG_TASKSTATS is not set +# CONFIG_PSI is not set +# end of CPU/Task time and stats accounting + +# +# RCU Subsystem +# +CONFIG_TINY_RCU=y +# CONFIG_RCU_EXPERT is not set +CONFIG_TINY_SRCU=y +# end of RCU Subsystem + +# CONFIG_IKCONFIG is not set +# CONFIG_IKHEADERS is not set +CONFIG_LOG_BUF_SHIFT=14 + +# +# Scheduler features +# +# end of Scheduler features + +CONFIG_CC_HAS_INT128=y +CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" +CONFIG_GCC10_NO_ARRAY_BOUNDS=y +CONFIG_CC_NO_ARRAY_BOUNDS=y +# CONFIG_CGROUPS is not set +# CONFIG_NAMESPACES is not set +# CONFIG_CHECKPOINT_RESTORE is not set +# CONFIG_SCHED_AUTOGROUP is not set +# CONFIG_RELAY is not set +# CONFIG_BLK_DEV_INITRD is not set +# CONFIG_BOOT_CONFIG is not set +CONFIG_INITRAMFS_PRESERVE_MTIME=y +CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y +# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set +CONFIG_SYSCTL=y +CONFIG_HAVE_UID16=y +CONFIG_EXPERT=y +# CONFIG_UID16 is not set +CONFIG_MULTIUSER=y +# CONFIG_SGETMASK_SYSCALL is not set +CONFIG_SYSFS_SYSCALL=y +CONFIG_FHANDLE=y +CONFIG_POSIX_TIMERS=y +CONFIG_PRINTK=y +# CONFIG_BUG is not set +CONFIG_ELF_CORE=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_FUTEX_PI=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +CONFIG_IO_URING=y +CONFIG_ADVISE_SYSCALLS=y +CONFIG_MEMBARRIER=y +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_SELFTEST is not set +# CONFIG_KALLSYMS_ALL is not set +CONFIG_KALLSYMS_BASE_RELATIVE=y +# CONFIG_KCMP is not set +CONFIG_CACHESTAT_SYSCALL=y +# CONFIG_PC104 is not set + +# +# Kernel Performance Events And Counters +# +# end of Kernel Performance Events And Counters + +# CONFIG_PROFILING is not set + +# +# Kexec and crash features +# +CONFIG_CRASH_CORE=y +# end of Kexec and crash features +# end of General setup + +# +# UML-specific options +# +CONFIG_UML=y +CONFIG_MMU=y +CONFIG_NO_IOMEM=y +CONFIG_NO_IOPORT_MAP=y +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_HZ=100 +CONFIG_NR_CPUS=1 +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y + +# +# Host processor type and features +# +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +# CONFIG_MCORE2 is not set +# CONFIG_MATOM is not set +CONFIG_GENERIC_CPU=y +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_IA32_FEAT_CTL=y +CONFIG_X86_VMX_FEATURE_NAMES=y +# CONFIG_PROCESSOR_SELECT is not set +CONFIG_CPU_SUP_INTEL=y +CONFIG_CPU_SUP_AMD=y +CONFIG_CPU_SUP_HYGON=y +CONFIG_CPU_SUP_CENTAUR=y +CONFIG_CPU_SUP_ZHAOXIN=y +# end of Host processor type and features + +CONFIG_UML_X86=y +CONFIG_64BIT=y +CONFIG_X86_64=y +CONFIG_3_LEVEL_PGTABLES=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_MAY_HAVE_RUNTIME_DEPS=y +CONFIG_LD_SCRIPT_DYN=y +# CONFIG_LD_SCRIPT_DYN_RPATH is not set +CONFIG_HOSTFS=m +CONFIG_MCONSOLE=y +CONFIG_MAGIC_SYSRQ=y +CONFIG_KERNEL_STACK_ORDER=2 +# CONFIG_MMAPPER is not set +CONFIG_PGTABLE_LEVELS=3 +# CONFIG_UML_TIME_TRAVEL_SUPPORT is not set +# end of UML-specific options + +# +# UML Character Devices +# +CONFIG_STDERR_CONSOLE=y +CONFIG_SSL=y +CONFIG_NULL_CHAN=y +CONFIG_PORT_CHAN=y +CONFIG_PTY_CHAN=y +CONFIG_TTY_CHAN=y +CONFIG_XTERM_CHAN=y +CONFIG_XTERM_CHAN_DEFAULT_EMULATOR="xterm" +CONFIG_CON_ZERO_CHAN="fd:0,fd:1" +CONFIG_CON_CHAN="pts" +CONFIG_SSL_CHAN="pts" +# end of UML Character Devices + +# +# UML Network Devices +# +CONFIG_UML_NET=y +# CONFIG_UML_NET_ETHERTAP is not set +# CONFIG_UML_NET_TUNTAP is not set +# CONFIG_UML_NET_SLIP is not set +# CONFIG_UML_NET_DAEMON is not set +CONFIG_UML_NET_VECTOR=y +# CONFIG_UML_NET_VDE is not set +# CONFIG_UML_NET_MCAST is not set +# CONFIG_UML_NET_PCAP is not set +# CONFIG_UML_NET_SLIRP is not set +# end of UML Network Devices + +# CONFIG_VIRTIO_UML is not set +CONFIG_ARCH_SUSPEND_POSSIBLE=y + +# +# Power management options +# +CONFIG_SUSPEND=y +CONFIG_SUSPEND_FREEZER=y +# CONFIG_SUSPEND_SKIP_SYNC is not set +CONFIG_PM_SLEEP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_USERSPACE_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set +# end of Power management options + +CONFIG_CPU_MITIGATIONS=y + +# +# General architecture-dependent options +# +CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_ARCH_HAS_FORTIFY_SOURCE=y +CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y +CONFIG_HAVE_ASM_MODVERSIONS=y +CONFIG_HAVE_RUST=y +CONFIG_MMU_LAZY_TLB_REFCOUNT=y +CONFIG_HAVE_ARCH_SECCOMP=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +# CONFIG_SECCOMP is not set +CONFIG_ARCH_SUPPORTS_LTO_CLANG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y +CONFIG_LTO_NONE=y +CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y +CONFIG_MODULES_USE_ELF_RELA=y +CONFIG_PAGE_SIZE_LESS_THAN_64KB=y +CONFIG_PAGE_SIZE_LESS_THAN_256KB=y +# CONFIG_COMPAT_32BIT_TIME is not set +CONFIG_ARCH_NO_PREEMPT=y +CONFIG_HAVE_ARCH_VMAP_STACK=y +CONFIG_VMAP_STACK=y + +# +# GCOV-based kernel profiling +# +CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y +# end of GCOV-based kernel profiling + +CONFIG_HAVE_GCC_PLUGINS=y +CONFIG_FUNCTION_ALIGNMENT=0 +# end of General architecture-dependent options + +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +CONFIG_MODULES=y +# CONFIG_MODULE_FORCE_LOAD is not set +CONFIG_MODULE_UNLOAD=y +CONFIG_MODULE_FORCE_UNLOAD=y +# CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set +# CONFIG_MODVERSIONS is not set +# CONFIG_MODULE_SRCVERSION_ALL is not set +# CONFIG_MODULE_SIG is not set +CONFIG_MODULE_COMPRESS_NONE=y +# CONFIG_MODULE_COMPRESS_GZIP is not set +# CONFIG_MODULE_COMPRESS_XZ is not set +# CONFIG_MODULE_COMPRESS_ZSTD is not set +# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set +CONFIG_MODPROBE_PATH="/sbin/modprobe" +# CONFIG_TRIM_UNUSED_KSYMS is not set +CONFIG_BLOCK=y +CONFIG_BLOCK_LEGACY_AUTOLOAD=y +CONFIG_BLK_ICQ=y +# CONFIG_BLK_DEV_BSGLIB is not set +# CONFIG_BLK_DEV_INTEGRITY is not set +# CONFIG_BLK_DEV_ZONED is not set +# CONFIG_BLK_WBT is not set +# CONFIG_BLK_INLINE_ENCRYPTION is not set + +# +# Partition Types +# +# CONFIG_PARTITION_ADVANCED is not set +CONFIG_MSDOS_PARTITION=y +CONFIG_EFI_PARTITION=y +# end of Partition Types + +CONFIG_BLK_PM=y + +# +# IO Schedulers +# +CONFIG_MQ_IOSCHED_DEADLINE=y +CONFIG_MQ_IOSCHED_KYBER=y +CONFIG_IOSCHED_BFQ=m +# end of IO Schedulers + +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +CONFIG_INLINE_READ_UNLOCK=y +CONFIG_INLINE_READ_UNLOCK_IRQ=y +CONFIG_INLINE_WRITE_UNLOCK=y +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +CONFIG_FREEZER=y + +# +# Executable file formats +# +CONFIG_BINFMT_ELF=y +CONFIG_ELFCORE=y +CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y +CONFIG_BINFMT_SCRIPT=y +CONFIG_BINFMT_MISC=m +CONFIG_COREDUMP=y +# end of Executable file formats + +# +# Memory Management options +# +# CONFIG_SWAP is not set + +# +# SLAB allocator options +# +# CONFIG_SLAB_DEPRECATED is not set +CONFIG_SLUB=y +# CONFIG_SLUB_TINY is not set +# CONFIG_SLAB_MERGE_DEFAULT is not set +# CONFIG_SLAB_FREELIST_RANDOM is not set +# CONFIG_SLAB_FREELIST_HARDENED is not set +# CONFIG_SLUB_STATS is not set +# CONFIG_RANDOM_KMALLOC_CACHES is not set +# end of SLAB allocator options + +# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_FLATMEM=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +# CONFIG_COMPACTION is not set +# CONFIG_PAGE_REPORTING is not set +CONFIG_PHYS_ADDR_T_64BIT=y +# CONFIG_KSM is not set +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_NEED_PER_CPU_KM=y +# CONFIG_CMA is not set +# CONFIG_IDLE_PAGE_TRACKING is not set +CONFIG_VM_EVENT_COUNTERS=y +# CONFIG_PERCPU_STATS is not set + +# +# GUP_TEST needs to have DEBUG_FS enabled +# +CONFIG_MEMFD_CREATE=y +# CONFIG_ANON_VMA_NAME is not set +# CONFIG_USERFAULTFD is not set +# CONFIG_LRU_GEN is not set + +# +# Data Access Monitoring +# +# CONFIG_DAMON is not set +# end of Data Access Monitoring +# end of Memory Management options + +CONFIG_NET=y + +# +# Networking options +# +CONFIG_PACKET=y +# CONFIG_PACKET_DIAG is not set +CONFIG_UNIX=y +CONFIG_UNIX_SCM=y +CONFIG_AF_UNIX_OOB=y +# CONFIG_UNIX_DIAG is not set +# CONFIG_TLS is not set +# CONFIG_XFRM_USER is not set +# CONFIG_NET_KEY is not set +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +# CONFIG_IP_ADVANCED_ROUTER is not set +# CONFIG_IP_PNP is not set +# CONFIG_NET_IPIP is not set +# CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_SYN_COOKIES=y +# CONFIG_NET_IPVTI is not set +# CONFIG_NET_FOU is not set +# CONFIG_INET_AH is not set +# CONFIG_INET_ESP is not set +# CONFIG_INET_IPCOMP is not set +CONFIG_INET_TABLE_PERTURB_ORDER=16 +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +# CONFIG_INET_UDP_DIAG is not set +# CONFIG_INET_RAW_DIAG is not set +# CONFIG_INET_DIAG_DESTROY is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +# CONFIG_IPV6_ROUTER_PREF is not set +# CONFIG_IPV6_OPTIMISTIC_DAD is not set +# CONFIG_INET6_AH is not set +# CONFIG_INET6_ESP is not set +# CONFIG_INET6_IPCOMP is not set +# CONFIG_IPV6_MIP6 is not set +# CONFIG_IPV6_VTI is not set +# CONFIG_IPV6_SIT is not set +# CONFIG_IPV6_TUNNEL is not set +# CONFIG_IPV6_MULTIPLE_TABLES is not set +# CONFIG_IPV6_MROUTE is not set +# CONFIG_IPV6_SEG6_LWTUNNEL is not set +# CONFIG_IPV6_SEG6_HMAC is not set +# CONFIG_IPV6_RPL_LWTUNNEL is not set +# CONFIG_IPV6_IOAM6_LWTUNNEL is not set +# CONFIG_MPTCP is not set +# CONFIG_NETWORK_SECMARK is not set +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +# CONFIG_NETFILTER is not set +# CONFIG_BPFILTER is not set +# CONFIG_IP_DCCP is not set +# CONFIG_IP_SCTP is not set +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +# CONFIG_L2TP is not set +# CONFIG_BRIDGE is not set +# CONFIG_NET_DSA is not set +# CONFIG_VLAN_8021Q is not set +# CONFIG_LLC2 is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_PHONET is not set +# CONFIG_6LOWPAN is not set +# CONFIG_IEEE802154 is not set +# CONFIG_NET_SCHED is not set +# CONFIG_DCB is not set +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +# CONFIG_VSOCKETS is not set +CONFIG_NETLINK_DIAG=y +# CONFIG_MPLS is not set +# CONFIG_NET_NSH is not set +# CONFIG_HSR is not set +# CONFIG_NET_SWITCHDEV is not set +# CONFIG_NET_L3_MASTER_DEV is not set +# CONFIG_QRTR is not set +# CONFIG_NET_NCSI is not set +CONFIG_MAX_SKB_FRAGS=17 +CONFIG_NET_RX_BUSY_POLL=y +CONFIG_BQL=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# end of Network testing +# end of Networking options + +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +# CONFIG_AF_KCM is not set +# CONFIG_MCTP is not set +# CONFIG_WIRELESS is not set +# CONFIG_RFKILL is not set +# CONFIG_NET_9P is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +# CONFIG_PSAMPLE is not set +# CONFIG_NET_IFE is not set +# CONFIG_LWTUNNEL is not set +# CONFIG_FAILOVER is not set +CONFIG_ETHTOOL_NETLINK=y + +# +# Device Drivers +# +# CONFIG_PCCARD is not set + +# +# Generic Driver Options +# +# CONFIG_UEVENT_HELPER is not set +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_DEVTMPFS_SAFE is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y + +# +# Firmware loader +# +# CONFIG_FW_LOADER is not set +# end of Firmware loader + +# CONFIG_ALLOW_DEV_COREDUMP is not set +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set +CONFIG_GENERIC_CPU_DEVICES=y +# CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set +# end of Generic Driver Options + +# +# Bus devices +# +# CONFIG_MHI_BUS is not set +# CONFIG_MHI_BUS_EP is not set +# end of Bus devices + +# +# Cache Drivers +# +# end of Cache Drivers + +# CONFIG_CONNECTOR is not set + +# +# Firmware Drivers +# + +# +# ARM System Control and Management Interface Protocol +# +# end of ARM System Control and Management Interface Protocol + +# CONFIG_FIRMWARE_MEMMAP is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# Tegra firmware driver +# +# end of Tegra firmware driver +# end of Firmware Drivers + +# CONFIG_GNSS is not set +# CONFIG_MTD is not set +# CONFIG_OF is not set +CONFIG_BLK_DEV=y +# CONFIG_BLK_DEV_NULL_BLK is not set +CONFIG_BLK_DEV_UBD=y +# CONFIG_BLK_DEV_UBD_SYNC is not set +CONFIG_BLK_DEV_COW_COMMON=y +CONFIG_BLK_DEV_LOOP=m +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_DRBD is not set +# CONFIG_BLK_DEV_NBD is not set +# CONFIG_BLK_DEV_RAM is not set +# CONFIG_ATA_OVER_ETH is not set +# CONFIG_BLK_DEV_RBD is not set +# CONFIG_BLK_DEV_UBLK is not set + +# +# NVME Support +# +# CONFIG_NVME_TCP is not set +# end of NVME Support + +# +# Misc devices +# +# CONFIG_DUMMY_IRQ is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# end of EEPROM support + +# +# Texas Instruments shared transport line discipline +# +# end of Texas Instruments shared transport line discipline + +# +# Altera FPGA firmware download module (requires I2C) +# +# CONFIG_ECHO is not set +# CONFIG_PVPANIC is not set +# end of Misc devices + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# end of SCSI device support + +# CONFIG_MD is not set +# CONFIG_TARGET_CORE is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +CONFIG_DUMMY=m +# CONFIG_WIREGUARD is not set +# CONFIG_EQUALIZER is not set +# CONFIG_NET_TEAM is not set +# CONFIG_MACVLAN is not set +# CONFIG_IPVLAN is not set +# CONFIG_VXLAN is not set +# CONFIG_GENEVE is not set +# CONFIG_BAREUDP is not set +# CONFIG_GTP is not set +# CONFIG_MACSEC is not set +# CONFIG_NETCONSOLE is not set +CONFIG_TUN=m +# CONFIG_TUN_VNET_CROSS_LE is not set +# CONFIG_VETH is not set +# CONFIG_NLMON is not set +# CONFIG_ETHERNET is not set +# CONFIG_PHYLIB is not set +# CONFIG_PSE_CONTROLLER is not set +# CONFIG_MDIO_DEVICE is not set + +# +# PCS device drivers +# +# end of PCS device drivers + +# CONFIG_PPP is not set +# CONFIG_SLIP is not set + +# +# Host-side USB support is needed for USB Network Adapter support +# +# CONFIG_WLAN is not set +# CONFIG_WAN is not set + +# +# Wireless WAN +# +# CONFIG_WWAN is not set +# end of Wireless WAN + +# CONFIG_NET_FAILOVER is not set +# CONFIG_ISDN is not set + +# +# Input device support +# +# CONFIG_INPUT is not set + +# +# Hardware I/O ports +# +# CONFIG_SERIO is not set +# end of Hardware I/O ports +# end of Input device support + +# +# Character devices +# +CONFIG_TTY=y +# CONFIG_VT is not set +CONFIG_UNIX98_PTYS=y +# CONFIG_LEGACY_PTYS is not set +# CONFIG_LEGACY_TIOCSTI is not set +CONFIG_LDISC_AUTOLOAD=y +# CONFIG_N_GSM is not set +# CONFIG_NULL_TTY is not set +# CONFIG_SERIAL_DEV_BUS is not set +# CONFIG_TTY_PRINTK is not set +# CONFIG_VIRTIO_CONSOLE is not set +CONFIG_HW_RANDOM=y +CONFIG_UML_RANDOM=y +CONFIG_DEVMEM=y +# end of Character devices + +# +# I2C support +# +# CONFIG_I2C is not set +# end of I2C support + +# CONFIG_I3C is not set +# CONFIG_SPMI is not set +# CONFIG_HSI is not set +# CONFIG_PPS is not set + +# +# PTP clock support +# +# CONFIG_PTP_1588_CLOCK is not set +CONFIG_PTP_1588_CLOCK_OPTIONAL=y + +# +# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. +# +# end of PTP clock support + +# CONFIG_PINCTRL is not set +# CONFIG_GPIOLIB is not set +# CONFIG_POWER_RESET is not set +# CONFIG_POWER_SUPPLY is not set +# CONFIG_THERMAL is not set +# CONFIG_WATCHDOG is not set +# CONFIG_REGULATOR is not set + +# +# CEC support +# +# CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support + +# +# Graphics support +# +# CONFIG_AUXDISPLAY is not set +# end of Graphics support + +# CONFIG_SOUND is not set +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_RTC_CLASS is not set + +# +# DMABUF options +# +# CONFIG_SYNC_FILE is not set +# CONFIG_DMABUF_HEAPS is not set +# end of DMABUF options + +# CONFIG_UIO is not set +# CONFIG_VFIO is not set +# CONFIG_VIRT_DRIVERS is not set +# CONFIG_VIRTIO_MENU is not set +# CONFIG_VDPA is not set +# CONFIG_VHOST_MENU is not set + +# +# Microsoft Hyper-V guest support +# +# end of Microsoft Hyper-V guest support + +# CONFIG_GREYBUS is not set +# CONFIG_COMEDI is not set +# CONFIG_STAGING is not set +# CONFIG_COMMON_CLK is not set +# CONFIG_HWSPINLOCK is not set + +# +# Clock Source drivers +# +# end of Clock Source drivers + +# CONFIG_MAILBOX is not set +# CONFIG_IOMMU_SUPPORT is not set + +# +# Remoteproc drivers +# +# end of Remoteproc drivers + +# +# Rpmsg drivers +# +# end of Rpmsg drivers + +# +# SOC (System On Chip) specific Drivers +# + +# +# Amlogic SoC drivers +# +# end of Amlogic SoC drivers + +# +# Broadcom SoC drivers +# +# end of Broadcom SoC drivers + +# +# NXP/Freescale QorIQ SoC drivers +# +# end of NXP/Freescale QorIQ SoC drivers + +# +# fujitsu SoC drivers +# +# end of fujitsu SoC drivers + +# +# i.MX SoC drivers +# +# end of i.MX SoC drivers + +# +# Enable LiteX SoC Builder specific drivers +# +# end of Enable LiteX SoC Builder specific drivers + +# CONFIG_WPCM450_SOC is not set + +# +# Qualcomm SoC drivers +# +# end of Qualcomm SoC drivers + +# CONFIG_SOC_TI is not set + +# +# Xilinx SoC drivers +# +# end of Xilinx SoC drivers +# end of SOC (System On Chip) specific Drivers + +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_PWM is not set + +# +# IRQ chip support +# +# end of IRQ chip support + +# CONFIG_RESET_CONTROLLER is not set + +# +# PHY Subsystem +# +# CONFIG_GENERIC_PHY is not set +# CONFIG_PHY_CAN_TRANSCEIVER is not set + +# +# PHY drivers for Broadcom platforms +# +# end of PHY drivers for Broadcom platforms +# end of PHY Subsystem + +# CONFIG_POWERCAP is not set +# CONFIG_RAS is not set + +# +# Android +# +# CONFIG_ANDROID_BINDER_IPC is not set +# end of Android + +# CONFIG_DAX is not set +# CONFIG_NVMEM is not set + +# +# HW tracing support +# +# CONFIG_STM is not set +# end of HW tracing support + +# CONFIG_FPGA is not set +# CONFIG_TEE is not set +# CONFIG_SIOX is not set +# CONFIG_SLIMBUS is not set +# CONFIG_INTERCONNECT is not set +# CONFIG_COUNTER is not set +# CONFIG_PECI is not set +# CONFIG_HTE is not set +# end of Device Drivers + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +# CONFIG_VALIDATE_FS_PARSER is not set +CONFIG_FS_IOMAP=y +CONFIG_BUFFER_HEAD=y +# CONFIG_EXT2_FS is not set +# CONFIG_EXT3_FS is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT2=y +# CONFIG_EXT4_FS_POSIX_ACL is not set +# CONFIG_EXT4_FS_SECURITY is not set +# CONFIG_EXT4_DEBUG is not set +CONFIG_JBD2=y +# CONFIG_JBD2_DEBUG is not set +CONFIG_FS_MBCACHE=y +# CONFIG_REISERFS_FS is not set +# CONFIG_JFS_FS is not set +CONFIG_XFS_FS=y +# CONFIG_XFS_SUPPORT_V4 is not set +# CONFIG_XFS_SUPPORT_ASCII_CI is not set +# CONFIG_XFS_QUOTA is not set +# CONFIG_XFS_POSIX_ACL is not set +# CONFIG_XFS_RT is not set +# CONFIG_XFS_ONLINE_SCRUB is not set +# CONFIG_XFS_WARN is not set +# CONFIG_XFS_DEBUG is not set +# CONFIG_GFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +# CONFIG_F2FS_FS is not set +CONFIG_EXPORTFS=y +# CONFIG_EXPORTFS_BLOCK_OPS is not set +CONFIG_FILE_LOCKING=y +# CONFIG_FS_ENCRYPTION is not set +# CONFIG_FS_VERITY is not set +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +# CONFIG_FANOTIFY is not set +# CONFIG_QUOTA is not set +# CONFIG_AUTOFS_FS is not set +# CONFIG_FUSE_FS is not set +# CONFIG_OVERLAY_FS is not set + +# +# Caches +# +# CONFIG_FSCACHE is not set +# end of Caches + +# +# CD-ROM/DVD Filesystems +# +# CONFIG_ISO9660_FS is not set +# CONFIG_UDF_FS is not set +# end of CD-ROM/DVD Filesystems + +# +# DOS/FAT/EXFAT/NT Filesystems +# +# CONFIG_MSDOS_FS is not set +# CONFIG_VFAT_FS is not set +# CONFIG_EXFAT_FS is not set +# CONFIG_NTFS_FS is not set +# CONFIG_NTFS3_FS is not set +# end of DOS/FAT/EXFAT/NT Filesystems + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +# CONFIG_PROC_CHILDREN is not set +CONFIG_KERNFS=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +# CONFIG_TMPFS_POSIX_ACL is not set +# CONFIG_TMPFS_XATTR is not set +# CONFIG_TMPFS_INODE64 is not set +# CONFIG_TMPFS_QUOTA is not set +# CONFIG_CONFIGFS_FS is not set +# end of Pseudo filesystems + +# CONFIG_MISC_FILESYSTEMS is not set +# CONFIG_NETWORK_FILESYSTEMS is not set +# CONFIG_NLS is not set +# CONFIG_UNICODE is not set +CONFIG_IO_WQ=y +# end of File systems + +# +# Security options +# +# CONFIG_KEYS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +# CONFIG_SECURITYFS is not set +# CONFIG_HARDENED_USERCOPY is not set +# CONFIG_FORTIFY_SOURCE is not set +# CONFIG_STATIC_USERMODEHELPER is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf" + +# +# Kernel hardening options +# + +# +# Memory initialization +# +CONFIG_CC_HAS_AUTO_VAR_INIT_PATTERN=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_BARE=y +CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y +CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_ALL_PATTERN is not set +# CONFIG_INIT_STACK_ALL_ZERO is not set +# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set +# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y +# CONFIG_ZERO_CALL_USED_REGS is not set +# end of Memory initialization + +# +# Hardening of kernel data structures +# +# CONFIG_LIST_HARDENED is not set +# CONFIG_BUG_ON_DATA_CORRUPTION is not set +# end of Hardening of kernel data structures + +CONFIG_RANDSTRUCT_NONE=y +# end of Kernel hardening options +# end of Security options + +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +# CONFIG_CRYPTO_MANAGER is not set +# CONFIG_CRYPTO_USER is not set +CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y +# CONFIG_CRYPTO_NULL is not set +# CONFIG_CRYPTO_CRYPTD is not set +# CONFIG_CRYPTO_AUTHENC is not set +# CONFIG_CRYPTO_TEST is not set +# end of Crypto core or helper + +# +# Public-key cryptography +# +# CONFIG_CRYPTO_RSA is not set +# CONFIG_CRYPTO_DH is not set +# CONFIG_CRYPTO_ECDH is not set +# CONFIG_CRYPTO_ECDSA is not set +# CONFIG_CRYPTO_ECRDSA is not set +# CONFIG_CRYPTO_SM2 is not set +# CONFIG_CRYPTO_CURVE25519 is not set +# end of Public-key cryptography + +# +# Block ciphers +# +# CONFIG_CRYPTO_AES is not set +# CONFIG_CRYPTO_AES_TI is not set +# CONFIG_CRYPTO_ARIA is not set +# CONFIG_CRYPTO_BLOWFISH is not set +# CONFIG_CRYPTO_CAMELLIA is not set +# CONFIG_CRYPTO_CAST5 is not set +# CONFIG_CRYPTO_CAST6 is not set +# CONFIG_CRYPTO_DES is not set +# CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_SERPENT is not set +# CONFIG_CRYPTO_SM4_GENERIC is not set +# CONFIG_CRYPTO_TWOFISH is not set +# end of Block ciphers + +# +# Length-preserving ciphers and modes +# +# CONFIG_CRYPTO_ADIANTUM is not set +# CONFIG_CRYPTO_CHACHA20 is not set +# CONFIG_CRYPTO_CBC is not set +# CONFIG_CRYPTO_CFB is not set +# CONFIG_CRYPTO_CTR is not set +# CONFIG_CRYPTO_CTS is not set +# CONFIG_CRYPTO_ECB is not set +# CONFIG_CRYPTO_HCTR2 is not set +# CONFIG_CRYPTO_KEYWRAP is not set +# CONFIG_CRYPTO_LRW is not set +# CONFIG_CRYPTO_OFB is not set +# CONFIG_CRYPTO_PCBC is not set +# CONFIG_CRYPTO_XTS is not set +# end of Length-preserving ciphers and modes + +# +# AEAD (authenticated encryption with associated data) ciphers +# +# CONFIG_CRYPTO_AEGIS128 is not set +# CONFIG_CRYPTO_CHACHA20POLY1305 is not set +# CONFIG_CRYPTO_CCM is not set +# CONFIG_CRYPTO_GCM is not set +# CONFIG_CRYPTO_SEQIV is not set +# CONFIG_CRYPTO_ECHAINIV is not set +# CONFIG_CRYPTO_ESSIV is not set +# end of AEAD (authenticated encryption with associated data) ciphers + +# +# Hashes, digests, and MACs +# +# CONFIG_CRYPTO_BLAKE2B is not set +# CONFIG_CRYPTO_CMAC is not set +# CONFIG_CRYPTO_GHASH is not set +# CONFIG_CRYPTO_HMAC is not set +# CONFIG_CRYPTO_MD4 is not set +# CONFIG_CRYPTO_MD5 is not set +# CONFIG_CRYPTO_MICHAEL_MIC is not set +# CONFIG_CRYPTO_POLY1305 is not set +# CONFIG_CRYPTO_RMD160 is not set +# CONFIG_CRYPTO_SHA1 is not set +# CONFIG_CRYPTO_SHA256 is not set +# CONFIG_CRYPTO_SHA512 is not set +# CONFIG_CRYPTO_SHA3 is not set +# CONFIG_CRYPTO_SM3_GENERIC is not set +# CONFIG_CRYPTO_STREEBOG is not set +# CONFIG_CRYPTO_VMAC is not set +# CONFIG_CRYPTO_WP512 is not set +# CONFIG_CRYPTO_XCBC is not set +# CONFIG_CRYPTO_XXHASH is not set +# end of Hashes, digests, and MACs + +# +# CRCs (cyclic redundancy checks) +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32 is not set +# CONFIG_CRYPTO_CRCT10DIF is not set +# end of CRCs (cyclic redundancy checks) + +# +# Compression +# +# CONFIG_CRYPTO_DEFLATE is not set +# CONFIG_CRYPTO_LZO is not set +# CONFIG_CRYPTO_842 is not set +# CONFIG_CRYPTO_LZ4 is not set +# CONFIG_CRYPTO_LZ4HC is not set +# CONFIG_CRYPTO_ZSTD is not set +# end of Compression + +# +# Random number generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +# CONFIG_CRYPTO_DRBG_MENU is not set +# CONFIG_CRYPTO_JITTERENTROPY is not set +# end of Random number generation + +# +# Userspace interface +# +# CONFIG_CRYPTO_USER_API_HASH is not set +# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +# CONFIG_CRYPTO_USER_API_RNG is not set +# CONFIG_CRYPTO_USER_API_AEAD is not set +# end of Userspace interface + +# CONFIG_CRYPTO_HW is not set + +# +# Certificates for signature checking +# +# end of Certificates for signature checking + +# +# Library routines +# +# CONFIG_PACKING is not set +CONFIG_BITREVERSE=y +CONFIG_ARCH_HAS_STRNCPY_FROM_USER=y +CONFIG_ARCH_HAS_STRNLEN_USER=y +CONFIG_GENERIC_NET_UTILS=y +# CONFIG_CORDIC is not set +# CONFIG_PRIME_NUMBERS is not set + +# +# Crypto library routines +# +CONFIG_CRYPTO_LIB_UTILS=y +CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y +# CONFIG_CRYPTO_LIB_CHACHA is not set +# CONFIG_CRYPTO_LIB_CURVE25519 is not set +CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 +# CONFIG_CRYPTO_LIB_POLY1305 is not set +# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set +CONFIG_CRYPTO_LIB_SHA1=y +# end of Crypto library routines + +# CONFIG_CRC_CCITT is not set +CONFIG_CRC16=y +# CONFIG_CRC_T10DIF is not set +# CONFIG_CRC64_ROCKSOFT is not set +# CONFIG_CRC_ITU_T is not set +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +# CONFIG_CRC64 is not set +# CONFIG_CRC4 is not set +# CONFIG_CRC7 is not set +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +# CONFIG_RANDOM32_SELFTEST is not set +# CONFIG_XZ_DEC is not set +CONFIG_NO_DMA=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +# CONFIG_DMA_API_DEBUG is not set +CONFIG_DQL=y +CONFIG_NLATTR=y +# CONFIG_IRQ_POLL is not set +CONFIG_SBITMAP=y +# end of Library routines + +# +# Kernel hacking +# + +# +# printk and dmesg options +# +CONFIG_PRINTK_TIME=y +# CONFIG_PRINTK_CALLER is not set +# CONFIG_STACKTRACE_BUILD_ID is not set +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 +CONFIG_CONSOLE_LOGLEVEL_QUIET=4 +CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 +# CONFIG_BOOT_PRINTK_DELAY is not set +# CONFIG_DYNAMIC_DEBUG is not set +# CONFIG_DYNAMIC_DEBUG_CORE is not set +CONFIG_SYMBOLIC_ERRNAME=y +# end of printk and dmesg options + +CONFIG_DEBUG_KERNEL=y +# CONFIG_DEBUG_MISC is not set + +# +# Compile-time checks and compiler options +# +CONFIG_DEBUG_INFO=y +CONFIG_AS_HAS_NON_CONST_LEB128=y +# CONFIG_DEBUG_INFO_NONE is not set +CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y +# CONFIG_DEBUG_INFO_DWARF4 is not set +# CONFIG_DEBUG_INFO_DWARF5 is not set +# CONFIG_DEBUG_INFO_REDUCED is not set +CONFIG_DEBUG_INFO_COMPRESSED_NONE=y +# CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set +# CONFIG_DEBUG_INFO_SPLIT is not set +# CONFIG_GDB_SCRIPTS is not set +CONFIG_FRAME_WARN=1024 +# CONFIG_STRIP_ASM_SYMS is not set +# CONFIG_READABLE_ASM is not set +# CONFIG_DEBUG_SECTION_MISMATCH is not set +CONFIG_SECTION_MISMATCH_WARN_ONLY=y +# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set +CONFIG_FRAME_POINTER=y +# CONFIG_VMLINUX_MAP is not set +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# end of Compile-time checks and compiler options + +# +# Generic Kernel Debugging Instruments +# +CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 +CONFIG_MAGIC_SYSRQ_SERIAL=y +CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" +# CONFIG_DEBUG_FS is not set +# CONFIG_UBSAN is not set +CONFIG_HAVE_KCSAN_COMPILER=y +# end of Generic Kernel Debugging Instruments + +# +# Networking Debugging +# +# CONFIG_NET_DEV_REFCNT_TRACKER is not set +# CONFIG_NET_NS_REFCNT_TRACKER is not set +# CONFIG_DEBUG_NET is not set +# end of Networking Debugging + +# +# Memory Debugging +# +# CONFIG_PAGE_EXTENSION is not set +# CONFIG_DEBUG_PAGEALLOC is not set +# CONFIG_SLUB_DEBUG is not set +# CONFIG_PAGE_OWNER is not set +# CONFIG_PAGE_POISONING is not set +CONFIG_HAVE_DEBUG_KMEMLEAK=y +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_SCHED_STACK_END_CHECK is not set +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_MEMORY_INIT is not set +CONFIG_HAVE_ARCH_KASAN=y +CONFIG_HAVE_ARCH_KASAN_VMALLOC=y +CONFIG_CC_HAS_KASAN_GENERIC=y +CONFIG_CC_HAS_KASAN_SW_TAGS=y +CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y +# CONFIG_KASAN is not set +# end of Memory Debugging + +# CONFIG_DEBUG_SHIRQ is not set + +# +# Debug Oops, Lockups and Hangs +# +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_PANIC_TIMEOUT=0 +# CONFIG_SOFTLOCKUP_DETECTOR is not set +# CONFIG_DETECT_HUNG_TASK is not set +# CONFIG_WQ_WATCHDOG is not set +# CONFIG_WQ_CPU_INTENSIVE_REPORT is not set +# CONFIG_TEST_LOCKUP is not set +# end of Debug Oops, Lockups and Hangs + +# +# Scheduler Debugging +# +# CONFIG_SCHEDSTATS is not set +# end of Scheduler Debugging + +# CONFIG_DEBUG_TIMEKEEPING is not set + +# +# Lock Debugging (spinlocks, mutexes, etc...) +# +CONFIG_LOCK_DEBUGGING_SUPPORT=y +# CONFIG_PROVE_LOCKING is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set +# CONFIG_DEBUG_RWSEMS is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set +# CONFIG_SCF_TORTURE_TEST is not set +# CONFIG_CSD_LOCK_WAIT_DEBUG is not set +# end of Lock Debugging (spinlocks, mutexes, etc...) + +# CONFIG_DEBUG_IRQFLAGS is not set +CONFIG_STACKTRACE=y +# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set +# CONFIG_DEBUG_KOBJECT is not set +CONFIG_HAVE_DEBUG_BUGVERBOSE=y + +# +# Debug kernel data structures +# +# CONFIG_DEBUG_LIST is not set +# CONFIG_DEBUG_PLIST is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +# CONFIG_DEBUG_MAPLE_TREE is not set +# end of Debug kernel data structures + +# +# RCU Debugging +# +# CONFIG_RCU_SCALE_TEST is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_REF_SCALE_TEST is not set +# CONFIG_RCU_TRACE is not set +# CONFIG_RCU_EQS_DEBUG is not set +# end of RCU Debugging + +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set +# CONFIG_LATENCYTOP is not set +CONFIG_TRACING_SUPPORT=y +# CONFIG_FTRACE is not set +# CONFIG_SAMPLES is not set + +# +# um Debugging +# +# CONFIG_GPROF is not set +CONFIG_EARLY_PRINTK=y +# end of um Debugging + +# +# Kernel Testing and Coverage +# +# CONFIG_KUNIT is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +CONFIG_ARCH_HAS_KCOV=y +CONFIG_CC_HAS_SANCOV_TRACE_PC=y +# CONFIG_KCOV is not set +# CONFIG_RUNTIME_TESTING_MENU is not set +# end of Kernel Testing and Coverage + +# +# Rust hacking +# +# end of Rust hacking +# end of Kernel hacking diff --git a/um/target/apache/ip.conf b/um/target/apache/ip.conf new file mode 100644 index 0000000..86327b6 --- /dev/null +++ b/um/target/apache/ip.conf @@ -0,0 +1 @@ +LoadModule mod_ip_module modules/mod_ip.so \ No newline at end of file diff --git a/um/target/apache/site-mtu1280.conf b/um/target/apache/site-mtu1280.conf new file mode 100644 index 0000000..17e942d --- /dev/null +++ b/um/target/apache/site-mtu1280.conf @@ -0,0 +1,12 @@ + + + SetHandler mod_ip + Header append Cache-Control no-cache + Header append Pragma no-cache + Header append Expires "Thu, 01 Jan 1971 00:00:00 GMT" + + + +# +# ProxyPass "/" "http://localhost/" +# diff --git a/um/target/hostname b/um/target/hostname new file mode 100644 index 0000000..2841f9d --- /dev/null +++ b/um/target/hostname @@ -0,0 +1 @@ +mtu1280 \ No newline at end of file diff --git a/um/target/interfaces b/um/target/interfaces new file mode 100644 index 0000000..b9c3802 --- /dev/null +++ b/um/target/interfaces @@ -0,0 +1,10 @@ +auto vec0 +# Uncomment following lines and set them up with your values. +#iface vec0 inet static + #address + #netmask + #gateway +#iface vec0 inet6 static + #address + #netmask + #gateway # will use host's RA if left unset \ No newline at end of file diff --git a/um/target/mtu1280/mtu1280-init b/um/target/mtu1280/mtu1280-init new file mode 100644 index 0000000..4ea7c5c --- /dev/null +++ b/um/target/mtu1280/mtu1280-init @@ -0,0 +1,9 @@ +#!/sbin/openrc-run + +depend() { + need net +} + +command="/usr/local/libexec/mtu1280/mtu1280-init.sh" +command_args= +pidfile="/run/mtu1280-init.pid" diff --git a/um/target/mtu1280/mtu1280-init.sh b/um/target/mtu1280/mtu1280-init.sh new file mode 100644 index 0000000..56b0ee1 --- /dev/null +++ b/um/target/mtu1280/mtu1280-init.sh @@ -0,0 +1,30 @@ +#!/bin/sh +set -e +echo $$ > /run/mtu1280-init.pid + +apk update +apk upgrade +apk add \ + openrc \ + eudev-openrc \ + apache2 \ + apache2-ssl \ + apache2-proxy \ + apache2-dev \ + git \ + gcc \ + make \ + libc-dev \ + logrotate \ + dropbear \ + dropbear-ssh + +cd /opt/mod_ip +./configure +make -j$(nproc) +make install + +rc-update add apache2 default +service apache2 start + +rm -f /etc/runlevels/*/mtu1280-init diff --git a/um/target/resolv.conf b/um/target/resolv.conf new file mode 100644 index 0000000..d8187e1 --- /dev/null +++ b/um/target/resolv.conf @@ -0,0 +1,6 @@ +# Just in case the VM has no IPv4 connectivity, add public NS servers as +# fallback. udhcpc6 does not handle nameserver info! +nameserver 8.8.8.8 +nameserver 8.8.4.4 +nameserver 2001:4860:4860::8888 +nameserver 2001:4860:4860::8844 From da30d28e431376eba598423b962632888763f981 Mon Sep 17 00:00:00 2001 From: David Timber Date: Tue, 23 Jul 2024 16:27:23 +0200 Subject: [PATCH 2/9] Add netns --- netns/.gitignore | 1 + netns/Makefile | 15 +++ netns/README.md | 97 +++++++++++++++++ netns/mtu1280-netns-httpd.override.conf | 6 ++ netns/mtu1280-netns.env.sample | 3 + netns/mtu1280-netns.service | 13 +++ netns/mtu1280-netns.sh | 136 ++++++++++++++++++++++++ 7 files changed, 271 insertions(+) create mode 100644 netns/.gitignore create mode 100644 netns/Makefile create mode 100644 netns/README.md create mode 100644 netns/mtu1280-netns-httpd.override.conf create mode 100644 netns/mtu1280-netns.env.sample create mode 100644 netns/mtu1280-netns.service create mode 100755 netns/mtu1280-netns.sh diff --git a/netns/.gitignore b/netns/.gitignore new file mode 100644 index 0000000..811c41a --- /dev/null +++ b/netns/.gitignore @@ -0,0 +1 @@ +mtu1280-netns\.env \ No newline at end of file diff --git a/netns/Makefile b/netns/Makefile new file mode 100644 index 0000000..b387b04 --- /dev/null +++ b/netns/Makefile @@ -0,0 +1,15 @@ +.PHONY: uninstall + +install: + install -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env + install -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf + install -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service + install -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh + systemctl daemon-reload + +uninstall: + rm -f \ + /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf \ + /usr/local/lib/systemd/system/mtu1280-netns.service \ + /usr/local/libexec/mtu1280/mtu1280-netns.sh + systemctl daemon-reload diff --git a/netns/README.md b/netns/README.md new file mode 100644 index 0000000..39c0300 --- /dev/null +++ b/netns/README.md @@ -0,0 +1,97 @@ +# MTU1280 using Kernel Network Namespace +This set up is the "true" PMTU mismatch soft simulation using Linux kernel +netns. Each netns has its own virtual routing table and PMTU cache. The +bottleneck MTU segment is achieved through the MTU attribute of static route +entries. + +``` + ROUTER A ROUTER B + +<---------- mtu1280-a ------ mtu1280-b ------ mtu1280-c ----------> + +to internet | MTU 1280 segment | to httpd +``` + +
+$ tracepath fd12:34::3:1500:0
+ 1?: [LOCALHOST]                        0.025ms pmtu 1500
+ 1:  fd12:34::1:1280:0                                     0.128ms
+ 1:  fd12:34::1:1280:0                                     0.156ms
+ 2:  fd12:34::1:1280:0                                     0.244ms pmtu 1280
+ 2:  fd12:34::2:1280:0                                     0.235ms
+ 3:  fd12:34::3:1500:0                                     0.188ms reached
+     Resume: pmtu 1280 hops 3 back 3
+
+ +3 netns are utilised so that the MTU 1280 links are hidden from both the +internet facing gateway and httpd. This forces httpd to announce its MSS as 1440 +octets and PMTUD is carried out for each endpoint from the internet. The PMTU +caching in **mtu1280-c** is disabled so that the test clients can get the same +result all the time. The makefile recipe installs a "drop-in" service unit +config to override `NetworkNamespacePath` so httpd is launched in the mtu1280-c +netns. + +The set up should perfectly simulate the kernel's behaviour. A few down sides +over the original mtu1280d approach are + +1. more overhead as all 3 netns along the path need to be "simulated" - + routing table, neighbor cache, PMTU cache ... +1. somewhat difficult to integrate netns to most programs as they're not + designed with namespace in mind +1. complexity making it difficult to troubleshoot + +## Network Set Up +See [/um/README.md#network-set-up](/um/README.md#network-set-up). + +## INSTALL +Copy and edit the env file [mtu1280-netns.env.sample](mtu1280-netns.env.sample): + +```sh +cp mtu1280-netns.env.sample mtu1280-netns.env +vi mtu1280-netns.env +``` + +Set `MTU1280NS_ADDR_A` to the address of the first router and so on. + +- Use `MTU1280NS_ADDR_GW` if you want the script to set the IPv6 address of the + host (it is best if it's left with NetworkManager, though) +- Set `MTU1280NS_NO_OFFLOAD` to "true" to disable offloading features that + interfere with the packet capture result (for debugging) + +```sh +# Stop http as the recipe will override some settings in httpd.service +sudo systemctl stop httpd.service + +sudo make install + +sudo systemctl enable --now mtu1280-netns.service httpd.service +``` + +```sh +# To see if the mtu1280-netns.sh script is alive and httpd is running +systemctl status mtu1280-netns.service httpd.service + +# To understand and debug the magic yourself +sudo ip netns +sudo ip -6 addr +sudo ip -6 route +sudo ip -6 -n mtu1280-a addr +sudo ip -6 -n mtu1280-a route +sudo ip -6 -n mtu1280-b addr +sudo ip -6 -n mtu1280-b route +sudo ip -6 -n mtu1280-c addr +sudo ip -6 -n mtu1280-c route + +# The listening ports will show up in the ns, not the default so the ports won't +# show up in the ss command run without the ip or nsenter command +sudo ip netns exec mtu1280-c ss -tlnp + +# The PMTU cache table entries will pile up in production +sudo ip -6 -n mtu1280-c route show cache +``` + +## Other Useful Info +All settings are netns-local. + +- `ip -6 route flush cache` flushes the PMTU cache +- `sysctl -w net.ipv6.route.mtu_expires=0` disables PMTU caching diff --git a/netns/mtu1280-netns-httpd.override.conf b/netns/mtu1280-netns-httpd.override.conf new file mode 100644 index 0000000..16aa98e --- /dev/null +++ b/netns/mtu1280-netns-httpd.override.conf @@ -0,0 +1,6 @@ +[Unit] +Requires=mtu1280-netns.service +After=mtu1280-netns.service + +[Service] +NetworkNamespacePath=/run/netns/mtu1280-c diff --git a/netns/mtu1280-netns.env.sample b/netns/mtu1280-netns.env.sample new file mode 100644 index 0000000..9c61d26 --- /dev/null +++ b/netns/mtu1280-netns.env.sample @@ -0,0 +1,3 @@ +MTU1280NS_ADDR_A= +MTU1280NS_ADDR_B= +MTU1280NS_ADDR_C= \ No newline at end of file diff --git a/netns/mtu1280-netns.service b/netns/mtu1280-netns.service new file mode 100644 index 0000000..8d90ac0 --- /dev/null +++ b/netns/mtu1280-netns.service @@ -0,0 +1,13 @@ +[Unit] +Description=MTU1280 network namespace set up +Requires=network.target +After=network.target + +[Service] +Type=notify +EnvironmentFile=/etc/mtu1280/mtu1280-netns.env +ExecStart=/usr/local/libexec/mtu1280/mtu1280-netns.sh daemon +KillSignal=SIGCONT + +[Install] +WantedBy=multi-user.target diff --git a/netns/mtu1280-netns.sh b/netns/mtu1280-netns.sh new file mode 100755 index 0000000..daede44 --- /dev/null +++ b/netns/mtu1280-netns.sh @@ -0,0 +1,136 @@ +#!/bin/sh +[ -z "$MTU1280NS_NO_OFFLOAD" ] && MTU1280NS_NO_OFFLOAD=false + +mkns () { + set -e + local ll + + do_make_ns () { + ip netns add "$1" + ip netns exec "$1" sysctl -qw \ + "net.ipv4.conf.all.forwarding = 1" \ + "net.ipv4.conf.default.forwarding = 1" \ + "net.ipv4.ip_forward = 1" \ + "net.ipv6.conf.default.forwarding = 1" \ + "net.ipv6.conf.all.forwarding = 1" + } + + get_ll_addr () { + local ll + + while true + do + if [ -z "$2" ]; then + ll=$(ip -br -6 addr show dev $1 scope link | grep -Eoi 'fe[^\s/]+') + else + ll=$(ip -br -6 -n $2 addr show dev $1 scope link | grep -Eoi 'fe[^\s/]+') + fi + + if [ -z "$ll" ]; then + sleep 0.1 + else + echo "$ll" + break + fi + done + } + + no_offload () { + if ! "$MTU1280NS_NO_OFFLOAD"; then + return + fi + + if [ -z "$2" ]; then + ethtool -K "$1" tcp-segmentation-offload off generic-segmentation-offload off generic-receive-offload off + else + ip netns exec "$2" ethtool -K "$1" tcp-segmentation-offload off generic-segmentation-offload off generic-receive-offload off + fi + } + + do_make_ns mtu1280-a + do_make_ns mtu1280-b + do_make_ns mtu1280-c + + # disable PMTU caching in mtu1280-c + ip netns exec mtu1280-c sysctl -qw "net.ipv6.route.mtu_expires = 0" + + # link up system default ns -> mtu1280-a + ip link add veth-mtu1280-a type veth peer name veth-mtu1280-gw netns mtu1280-a + no_offload veth-mtu1280-a + no_offload veth-mtu1280-gw mtu1280-a + # link up mtu1280-a -> mtu1280-b + ip -n mtu1280-a link add veth-mtu1280-b type veth peer name veth-mtu1280-a netns mtu1280-b + no_offload veth-mtu1280-b mtu1280-a + no_offload veth-mtu1280-a mtu1280-b + # link up mtu1280-b -> mtu1280-c + ip -n mtu1280-b link add veth-mtu1280-c type veth peer name veth-mtu1280-b netns mtu1280-c + no_offload veth-mtu1280-c mtu1280-b + no_offload veth-mtu1280-b mtu1280-c + + if [ ! -z "$MTU1280NS_ADDR_GW" ]; then + ip -6 addr add $MTU1280NS_ADDR_GW dev veth-mtu1280-a + fi + ip -n mtu1280-a -6 addr add $MTU1280NS_ADDR_A dev veth-mtu1280-gw + ip -n mtu1280-b -6 addr add $MTU1280NS_ADDR_B dev veth-mtu1280-a + ip -n mtu1280-c -6 addr add $MTU1280NS_ADDR_C dev veth-mtu1280-b + + ip link set veth-mtu1280-a up + ip -n mtu1280-a link set lo up + ip -n mtu1280-a link set veth-mtu1280-gw up + + ip -n mtu1280-a link set veth-mtu1280-b up + ip -n mtu1280-b link set lo up + ip -n mtu1280-b link set veth-mtu1280-a up + + ip -n mtu1280-b link set veth-mtu1280-c up + ip -n mtu1280-c link set lo up + ip -n mtu1280-c link set veth-mtu1280-b up + + # default route from mtu1280-a to system + ip -n mtu1280-a -6 route add default dev veth-mtu1280-gw via $(get_ll_addr veth-mtu1280-a) + # default route from mtu1280-b to mtu1280-a (mtu 1280 segment) + ip -n mtu1280-b -6 route add default dev veth-mtu1280-a via $(get_ll_addr veth-mtu1280-b mtu1280-a) mtu 1280 + # default route from mtu1280-c to mtu1280-b + ip -n mtu1280-c -6 route add default dev veth-mtu1280-b via $(get_ll_addr veth-mtu1280-c mtu1280-b) + + # static route from system default ns to inner + ll=$(get_ll_addr veth-mtu1280-gw mtu1280-a) + ip -6 route add $MTU1280NS_ADDR_A dev veth-mtu1280-a via $ll + ip -6 route add $MTU1280NS_ADDR_B dev veth-mtu1280-a via $ll + ip -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-a via $ll + # static route from mtu1280-a to inner (mtu 1280 segment) + ll=$(get_ll_addr veth-mtu1280-a mtu1280-b) + ip -n mtu1280-a -6 route add $MTU1280NS_ADDR_B dev veth-mtu1280-b via $ll mtu 1280 + ip -n mtu1280-a -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-b via $ll mtu 1280 + # static route from mtu1280-b to inner + ll=$(get_ll_addr veth-mtu1280-b mtu1280-c) + ip -n mtu1280-b -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-c via $ll +} + +rmns () { + ip link del veth-mtu1280-a type veth + ip -n mtu1280-a link del veth-mtu1280-b type veth + ip -n mtu1280-b link del veth-mtu1280-c type veth + + ip netns del mtu1280-a + ip netns del mtu1280-b + ip netns del mtu1280-c +} + +daemon () { + mkns + + systemd-notify --status="Stopped and holding netns" + systemd-notify --ready + kill -STOP 0 + + systemd-notify --stopping + systemd-notify --status="Deleting netns" + rmns + + systemd-notify --status="" +} + +cmd="$1" +shift +"$cmd" $@ From 53b6b507c0cc518069550f5e9134c77c44e8c59b Mon Sep 17 00:00:00 2001 From: David Timber Date: Fri, 26 Jul 2024 00:50:21 +0200 Subject: [PATCH 3/9] netns/Makefile: specify install filemodes --- netns/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/netns/Makefile b/netns/Makefile index b387b04..f55c86f 100644 --- a/netns/Makefile +++ b/netns/Makefile @@ -1,10 +1,10 @@ .PHONY: uninstall install: - install -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env - install -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf - install -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service - install -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh + install -m 644 -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env + install -m 644 -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf + install -m 644 -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service + install -m 755 -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh systemctl daemon-reload uninstall: From b46bc09a64150ff4db8c152c8d94d82f5dc5b750 Mon Sep 17 00:00:00 2001 From: David Timber Date: Sun, 28 Jul 2024 15:16:37 +0200 Subject: [PATCH 4/9] Fix makefiles ... - Do not overwrite existing env file - Do not fail if the env file does not exist --- netns/Makefile | 2 +- um/Makefile | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/netns/Makefile b/netns/Makefile index f55c86f..e451718 100644 --- a/netns/Makefile +++ b/netns/Makefile @@ -1,7 +1,7 @@ .PHONY: uninstall install: - install -m 644 -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env + test -f /etc/mtu1280/mtu1280-netns.env || install -m 644 -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env install -m 644 -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf install -m 644 -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service install -m 755 -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh diff --git a/um/Makefile b/um/Makefile index 70929ed..f8503d3 100644 --- a/um/Makefile +++ b/um/Makefile @@ -14,7 +14,7 @@ first: build/linux-$(KVER)_mtu1280/linux build/alpine-minirootfs-$(ALPINE_VER).t rootimg: build/root.img rebuild-rootimg: clean-rootimg rootimg -include /etc/mtu1280/mtu1280-uml.env +-include /etc/mtu1280/mtu1280-uml.env run-uml: /usr/local/bin/linux ${MTU1280_UML_OPTS} ${MTU1280_UML_OPTS_EXTRA} @@ -31,7 +31,8 @@ install: build/linux-$(KVER)_mtu1280/linux build/root.img mkdir -p /etc/mtu1280 install -o 0 -g 0 -m 755 -Z build/linux-$(KVER)_mtu1280/linux /usr/local/bin install -b -o 0 -g 0 -m 644 -Z build/root.img /var/lib/mtu1280 - install -b -o 0 -g 0 -m 644 -Z host/mtu1280-uml.env /etc/mtu1280 + test -f /etc/mtu1280/mtu1280-uml.env || \ + install -b -o 0 -g 0 -m 644 -Z host/mtu1280-uml.env /etc/mtu1280 install -o 0 -g 0 -m 644 -Z host/mtu1280-uml.service /usr/local/lib/systemd/system install -o 0 -g 0 -m 755 -Z host/dispatcher.d/mtu1280-hook /etc/NetworkManager/dispatcher.d install -o 0 -g 0 -m 644 -Z host/sysctl.d/10-mtu1280-forwarding.conf /etc/sysctl.d From 5924bf7b01628c823a62a1049f377e28f8cd1ea4 Mon Sep 17 00:00:00 2001 From: David Timber Date: Fri, 6 Sep 2024 23:05:17 +0200 Subject: [PATCH 5/9] Add IPv4 support ... - the install target overrides the existing config - fix some grammatical errors in doc - change env file format - breaks existing config - Busybox sysctl applet support - add "rmns_q" command for ExecStartPre clean up --- netns/Makefile | 2 +- netns/README.md | 48 ++++++++++++++--------- netns/mtu1280-netns.env.sample | 13 +++++-- netns/mtu1280-netns.service | 1 + netns/mtu1280-netns.sh | 70 +++++++++++++++++++++++++--------- 5 files changed, 95 insertions(+), 39 deletions(-) diff --git a/netns/Makefile b/netns/Makefile index e451718..6f1d37a 100644 --- a/netns/Makefile +++ b/netns/Makefile @@ -1,7 +1,7 @@ .PHONY: uninstall install: - test -f /etc/mtu1280/mtu1280-netns.env || install -m 644 -b -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env + install -m 644 -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env install -m 644 -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf install -m 644 -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service install -m 755 -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh diff --git a/netns/README.md b/netns/README.md index 39c0300..ef9f574 100644 --- a/netns/README.md +++ b/netns/README.md @@ -13,7 +13,7 @@ to internet | MTU 1280 segment | to httpd ``` 
-$ tracepath fd12:34::3:1500:0
+$ tracepath -n fd12:34::3:1500:0
  1?: [LOCALHOST]                        0.025ms pmtu 1500
  1:  fd12:34::1:1280:0                                     0.128ms
  1:  fd12:34::1:1280:0                                     0.156ms
@@ -21,15 +21,22 @@ $ tracepath fd12:34::3:1500:0
  2:  fd12:34::2:1280:0                                     0.235ms
  3:  fd12:34::3:1500:0                                     0.188ms reached
      Resume: pmtu 1280 hops 3 back 3
+$ tracepath -n 10.12.80.34
+ 1?: [LOCALHOST]                      pmtu 1500
+ 1:  10.12.80.2                                            0.138ms
+ 1:  10.12.80.2                                            0.042ms
+ 2:  10.12.80.2                                            0.045ms pmtu 1280
+ 2:  10.12.80.18                                           0.055ms
+ 3:  10.12.80.34                                           0.051ms reached
+     Resume: pmtu 1280 hops 3 back 3
-3 netns are utilised so that the MTU 1280 links are hidden from both the -internet facing gateway and httpd. This forces httpd to announce its MSS as 1440 -octets and PMTUD is carried out for each endpoint from the internet. The PMTU -caching in **mtu1280-c** is disabled so that the test clients can get the same -result all the time. The makefile recipe installs a "drop-in" service unit -config to override `NetworkNamespacePath` so httpd is launched in the mtu1280-c -netns. +3 netns are create to hide the MTU 1280 links from both internet facing gateway +and httpd. This forces httpd to announce its MSS as 1440 octets and PMTUD is +carried out for each endpoint from the internet. The PMTU caching in +**mtu1280-c** is disabled so that the test clients can get the same result at +all times. The makefile recipe installs a "drop-in" service unit config to +override `NetworkNamespacePath` so httpd is run in the mtu1280-c netns. The set up should perfectly simulate the kernel's behaviour. A few down sides over the original mtu1280d approach are @@ -40,6 +47,13 @@ over the original mtu1280d approach are designed with namespace in mind 1. complexity making it difficult to troubleshoot +## IPv4 +The script was originally written to test the PMTUD of IPv6, but the IPv4 +support has been added to test the PMTUD in IPv4 networks as well. As most +operating system does not do IPv4 PMTUD by default, the use of special system +API is required to set the DF flag. It's useful when any middlebox of the ISP +blocks `Fragmentation Needed` or fragmented packets in general. + ## Network Set Up See [/um/README.md#network-set-up](/um/README.md#network-set-up). @@ -51,12 +65,12 @@ cp mtu1280-netns.env.sample mtu1280-netns.env vi mtu1280-netns.env ``` -Set `MTU1280NS_ADDR_A` to the address of the first router and so on. +Set `MTU1280NS_ADDR6_*` to the addresses of the routers. For IPv4, set +`MTU1280NS_ADDR4_*` as well. If you plan to use private IPv4 addresses, remember +to turn masquerade on and set port forwarding. -- Use `MTU1280NS_ADDR_GW` if you want the script to set the IPv6 address of the - host (it is best if it's left with NetworkManager, though) - Set `MTU1280NS_NO_OFFLOAD` to "true" to disable offloading features that - interfere with the packet capture result (for debugging) + can interfere with the packet capture result when debugging ```sh # Stop http as the recipe will override some settings in httpd.service @@ -85,13 +99,13 @@ sudo ip -6 -n mtu1280-c route # The listening ports will show up in the ns, not the default so the ports won't # show up in the ss command run without the ip or nsenter command sudo ip netns exec mtu1280-c ss -tlnp - -# The PMTU cache table entries will pile up in production -sudo ip -6 -n mtu1280-c route show cache ``` ## Other Useful Info All settings are netns-local. -- `ip -6 route flush cache` flushes the PMTU cache -- `sysctl -w net.ipv6.route.mtu_expires=0` disables PMTU caching +- Use `ip -4 route show cache` and `ip -6 route show cache` to show PMTU cache +- Use `ip -6 route flush cache` and `ip -4 route flush cache` to flush the PMTU + cache +- `sysctl -w net.ipv6.route.mtu_expires=0` and `sysctl -w + net.ipv4.route.mtu_expires=0` disables PMTU caching diff --git a/netns/mtu1280-netns.env.sample b/netns/mtu1280-netns.env.sample index 9c61d26..9498745 100644 --- a/netns/mtu1280-netns.env.sample +++ b/netns/mtu1280-netns.env.sample @@ -1,3 +1,10 @@ -MTU1280NS_ADDR_A= -MTU1280NS_ADDR_B= -MTU1280NS_ADDR_C= \ No newline at end of file +MTU1280NS_ADDR6_A=fd12:34::1:1280:0/128 +MTU1280NS_ADDR6_B=fd12:34::2:1280:0/128 +MTU1280NS_ADDR6_C=fd12:34::3:1500:0/128 +MTU1280NS_ADDR4_A0=10.12.80.1/28 +MTU1280NS_ADDR4_A1=10.12.80.2/28 +MTU1280NS_ADDR4_B0=10.12.80.17/28 +MTU1280NS_ADDR4_B1=10.12.80.18/28 +MTU1280NS_ADDR4_C0=10.12.80.33/28 +MTU1280NS_ADDR4_C1=10.12.80.34/28 +MTU1280NS_NO_OFFLOAD=false diff --git a/netns/mtu1280-netns.service b/netns/mtu1280-netns.service index 8d90ac0..f394198 100644 --- a/netns/mtu1280-netns.service +++ b/netns/mtu1280-netns.service @@ -6,6 +6,7 @@ After=network.target [Service] Type=notify EnvironmentFile=/etc/mtu1280/mtu1280-netns.env +ExecStartPre=-/usr/local/libexec/mtu1280/mtu1280-netns.sh rmns_q ExecStart=/usr/local/libexec/mtu1280/mtu1280-netns.sh daemon KillSignal=SIGCONT diff --git a/netns/mtu1280-netns.sh b/netns/mtu1280-netns.sh index daede44..7729554 100755 --- a/netns/mtu1280-netns.sh +++ b/netns/mtu1280-netns.sh @@ -1,6 +1,15 @@ #!/bin/sh [ -z "$MTU1280NS_NO_OFFLOAD" ] && MTU1280NS_NO_OFFLOAD=false +safe_run () { + if [ -z "$1" ]; then + return + fi + + shift + $@ +} + mkns () { set -e local ll @@ -8,11 +17,11 @@ mkns () { do_make_ns () { ip netns add "$1" ip netns exec "$1" sysctl -qw \ - "net.ipv4.conf.all.forwarding = 1" \ - "net.ipv4.conf.default.forwarding = 1" \ - "net.ipv4.ip_forward = 1" \ - "net.ipv6.conf.default.forwarding = 1" \ - "net.ipv6.conf.all.forwarding = 1" + "net.ipv4.conf.all.forwarding=1" \ + "net.ipv4.conf.default.forwarding=1" \ + "net.ipv4.ip_forward=1" \ + "net.ipv6.conf.default.forwarding=1" \ + "net.ipv6.conf.all.forwarding=1" } get_ll_addr () { @@ -35,6 +44,10 @@ mkns () { done } + filter_cidr () { + echo "${1%/*}" + } + no_offload () { if ! "$MTU1280NS_NO_OFFLOAD"; then return @@ -52,7 +65,8 @@ mkns () { do_make_ns mtu1280-c # disable PMTU caching in mtu1280-c - ip netns exec mtu1280-c sysctl -qw "net.ipv6.route.mtu_expires = 0" + ip netns exec mtu1280-c sysctl -qw "net.ipv4.route.mtu_expires=0" + ip netns exec mtu1280-c sysctl -qw "net.ipv6.route.mtu_expires=0" # link up system default ns -> mtu1280-a ip link add veth-mtu1280-a type veth peer name veth-mtu1280-gw netns mtu1280-a @@ -67,12 +81,19 @@ mkns () { no_offload veth-mtu1280-c mtu1280-b no_offload veth-mtu1280-b mtu1280-c - if [ ! -z "$MTU1280NS_ADDR_GW" ]; then - ip -6 addr add $MTU1280NS_ADDR_GW dev veth-mtu1280-a - fi - ip -n mtu1280-a -6 addr add $MTU1280NS_ADDR_A dev veth-mtu1280-gw - ip -n mtu1280-b -6 addr add $MTU1280NS_ADDR_B dev veth-mtu1280-a - ip -n mtu1280-c -6 addr add $MTU1280NS_ADDR_C dev veth-mtu1280-b + safe_run "$MTU1280NS_ADDR4_A0" ip -4 addr add "$MTU1280NS_ADDR4_A0" dev veth-mtu1280-a + + safe_run "$MTU1280NS_ADDR4_A1" ip -n mtu1280-a -4 addr add "$MTU1280NS_ADDR4_A1" dev veth-mtu1280-gw + safe_run "$MTU1280NS_ADDR4_B0" ip -n mtu1280-a -4 addr add "$MTU1280NS_ADDR4_B0" dev veth-mtu1280-b + + safe_run "$MTU1280NS_ADDR4_B1" ip -n mtu1280-b -4 addr add "$MTU1280NS_ADDR4_B1" dev veth-mtu1280-a + safe_run "$MTU1280NS_ADDR4_C0" ip -n mtu1280-b -4 addr add "$MTU1280NS_ADDR4_C0" dev veth-mtu1280-c + + safe_run "$MTU1280NS_ADDR4_C1" ip -n mtu1280-c -4 addr add "$MTU1280NS_ADDR4_C1" dev veth-mtu1280-b + + safe_run "$MTU1280NS_ADDR6_A" ip -n mtu1280-a -6 addr add "$MTU1280NS_ADDR6_A" dev veth-mtu1280-gw + safe_run "$MTU1280NS_ADDR6_B" ip -n mtu1280-b -6 addr add "$MTU1280NS_ADDR6_B" dev veth-mtu1280-a + safe_run "$MTU1280NS_ADDR6_C" ip -n mtu1280-c -6 addr add "$MTU1280NS_ADDR6_C" dev veth-mtu1280-b ip link set veth-mtu1280-a up ip -n mtu1280-a link set lo up @@ -87,24 +108,33 @@ mkns () { ip -n mtu1280-c link set veth-mtu1280-b up # default route from mtu1280-a to system + ip -n mtu1280-a -4 route add default dev veth-mtu1280-gw via $(filter_cidr "$MTU1280NS_ADDR4_A0") ip -n mtu1280-a -6 route add default dev veth-mtu1280-gw via $(get_ll_addr veth-mtu1280-a) # default route from mtu1280-b to mtu1280-a (mtu 1280 segment) + ip -n mtu1280-b -4 route add default dev veth-mtu1280-a via $(filter_cidr "$MTU1280NS_ADDR4_B0") mtu 1280 ip -n mtu1280-b -6 route add default dev veth-mtu1280-a via $(get_ll_addr veth-mtu1280-b mtu1280-a) mtu 1280 # default route from mtu1280-c to mtu1280-b + ip -n mtu1280-c -4 route add default dev veth-mtu1280-b via $(filter_cidr "$MTU1280NS_ADDR4_C0") ip -n mtu1280-c -6 route add default dev veth-mtu1280-b via $(get_ll_addr veth-mtu1280-c mtu1280-b) # static route from system default ns to inner ll=$(get_ll_addr veth-mtu1280-gw mtu1280-a) - ip -6 route add $MTU1280NS_ADDR_A dev veth-mtu1280-a via $ll - ip -6 route add $MTU1280NS_ADDR_B dev veth-mtu1280-a via $ll - ip -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-a via $ll + safe_run "$MTU1280NS_ADDR4_B0" ip -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_B0")" dev veth-mtu1280-a via "$(filter_cidr "$MTU1280NS_ADDR4_A1")" + safe_run "$MTU1280NS_ADDR4_B1" ip -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_B1")" dev veth-mtu1280-a via "$(filter_cidr "$MTU1280NS_ADDR4_A1")" + safe_run "$MTU1280NS_ADDR4_C0" ip -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_C0")" dev veth-mtu1280-a via "$(filter_cidr "$MTU1280NS_ADDR4_A1")" + safe_run "$MTU1280NS_ADDR4_C1" ip -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_C1")" dev veth-mtu1280-a via "$(filter_cidr "$MTU1280NS_ADDR4_A1")" + safe_run "$MTU1280NS_ADDR6_A" ip -6 route add "$MTU1280NS_ADDR6_A" dev veth-mtu1280-a via $ll + safe_run "$MTU1280NS_ADDR6_B" ip -6 route add "$MTU1280NS_ADDR6_B" dev veth-mtu1280-a via $ll + safe_run "$MTU1280NS_ADDR6_C" ip -6 route add "$MTU1280NS_ADDR6_C" dev veth-mtu1280-a via $ll # static route from mtu1280-a to inner (mtu 1280 segment) ll=$(get_ll_addr veth-mtu1280-a mtu1280-b) - ip -n mtu1280-a -6 route add $MTU1280NS_ADDR_B dev veth-mtu1280-b via $ll mtu 1280 - ip -n mtu1280-a -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-b via $ll mtu 1280 + safe_run "$MTU1280NS_ADDR4_C0" ip -n mtu1280-a -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_C0")" dev veth-mtu1280-b via "$(filter_cidr "$MTU1280NS_ADDR4_B1")" mtu 1280 + safe_run "$MTU1280NS_ADDR4_C1" ip -n mtu1280-a -4 route add "$(filter_cidr "$MTU1280NS_ADDR4_C1")" dev veth-mtu1280-b via "$(filter_cidr "$MTU1280NS_ADDR4_B1")" mtu 1280 + safe_run "$MTU1280NS_ADDR6_B" ip -n mtu1280-a -6 route add "$MTU1280NS_ADDR6_B" dev veth-mtu1280-b via $ll mtu 1280 + safe_run "$MTU1280NS_ADDR6_C" ip -n mtu1280-a -6 route add "$MTU1280NS_ADDR6_C" dev veth-mtu1280-b via $ll mtu 1280 # static route from mtu1280-b to inner ll=$(get_ll_addr veth-mtu1280-b mtu1280-c) - ip -n mtu1280-b -6 route add $MTU1280NS_ADDR_C dev veth-mtu1280-c via $ll + safe_run "$MTU1280NS_ADDR6_C" ip -n mtu1280-b -6 route add "$MTU1280NS_ADDR6_C" dev veth-mtu1280-c via $ll } rmns () { @@ -117,6 +147,10 @@ rmns () { ip netns del mtu1280-c } +rmns_q () { + rmns $@ 2> /dev/null > /dev/null +} + daemon () { mkns From c34cf511fd77c5e4cffbc7ea516b4fe57b952b31 Mon Sep 17 00:00:00 2001 From: David Timber Date: Fri, 6 Sep 2024 23:23:49 +0200 Subject: [PATCH 6/9] Fix mtu_expires, doc ... - net.ipv4.route.mtu_expires not available in some kernel config/versions - Ignore fail to set net.ipv[46].route.mtu_expires=0 - Don't mention masquerading --- netns/README.md | 2 +- netns/mtu1280-netns.sh | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/netns/README.md b/netns/README.md index ef9f574..9c04c8b 100644 --- a/netns/README.md +++ b/netns/README.md @@ -67,7 +67,7 @@ vi mtu1280-netns.env Set `MTU1280NS_ADDR6_*` to the addresses of the routers. For IPv4, set `MTU1280NS_ADDR4_*` as well. If you plan to use private IPv4 addresses, remember -to turn masquerade on and set port forwarding. +to set port forwarding. - Set `MTU1280NS_NO_OFFLOAD` to "true" to disable offloading features that can interfere with the packet capture result when debugging diff --git a/netns/mtu1280-netns.sh b/netns/mtu1280-netns.sh index 7729554..59f4ceb 100755 --- a/netns/mtu1280-netns.sh +++ b/netns/mtu1280-netns.sh @@ -64,10 +64,6 @@ mkns () { do_make_ns mtu1280-b do_make_ns mtu1280-c - # disable PMTU caching in mtu1280-c - ip netns exec mtu1280-c sysctl -qw "net.ipv4.route.mtu_expires=0" - ip netns exec mtu1280-c sysctl -qw "net.ipv6.route.mtu_expires=0" - # link up system default ns -> mtu1280-a ip link add veth-mtu1280-a type veth peer name veth-mtu1280-gw netns mtu1280-a no_offload veth-mtu1280-a @@ -135,6 +131,10 @@ mkns () { # static route from mtu1280-b to inner ll=$(get_ll_addr veth-mtu1280-b mtu1280-c) safe_run "$MTU1280NS_ADDR6_C" ip -n mtu1280-b -6 route add "$MTU1280NS_ADDR6_C" dev veth-mtu1280-c via $ll + + # disable PMTU caching in mtu1280-c + ip netns exec mtu1280-c sysctl -qw "net.ipv4.route.mtu_expires=0" || true + ip netns exec mtu1280-c sysctl -qw "net.ipv6.route.mtu_expires=0" || true } rmns () { From c334d862954f428538f36afb6759ddbdceb35c88 Mon Sep 17 00:00:00 2001 From: David Timber Date: Sat, 7 Sep 2024 02:17:16 +0200 Subject: [PATCH 7/9] Add pmtu-flush-cache --- netns/Makefile | 6 +++++- netns/pmtu-flush-cache/README.md | 19 +++++++++++++++++++ .../mtu1280-netns-flush-cache.service | 10 ++++++++++ .../mtu1280-netns-flush-cache.sh | 13 +++++++++++++ 4 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 netns/pmtu-flush-cache/README.md create mode 100644 netns/pmtu-flush-cache/mtu1280-netns-flush-cache.service create mode 100755 netns/pmtu-flush-cache/mtu1280-netns-flush-cache.sh diff --git a/netns/Makefile b/netns/Makefile index 6f1d37a..57adcd5 100644 --- a/netns/Makefile +++ b/netns/Makefile @@ -4,6 +4,8 @@ install: install -m 644 -D mtu1280-netns.env /etc/mtu1280/mtu1280-netns.env install -m 644 -b -D mtu1280-netns-httpd.override.conf /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf install -m 644 -D mtu1280-netns.service /usr/local/lib/systemd/system/mtu1280-netns.service + install -m 644 -D pmtu-flush-cache/mtu1280-netns-flush-cache.service /usr/local/lib/systemd/system/mtu1280-netns-flush-cache.service + install -m 755 -D pmtu-flush-cache/mtu1280-netns-flush-cache.sh /usr/local/bin/mtu1280-netns-flush-cache.sh install -m 755 -D mtu1280-netns.sh /usr/local/libexec/mtu1280/mtu1280-netns.sh systemctl daemon-reload @@ -11,5 +13,7 @@ uninstall: rm -f \ /etc/systemd/system/httpd.service.d/mtu1280-netns-httpd.override.conf \ /usr/local/lib/systemd/system/mtu1280-netns.service \ - /usr/local/libexec/mtu1280/mtu1280-netns.sh + /usr/local/lib/systemd/system/mtu1280-netns-flush-cache.service \ + /usr/local/libexec/mtu1280/mtu1280-netns.sh \ + /usr/local/bin/mtu1280-netns-flush-cache.sh systemctl daemon-reload diff --git a/netns/pmtu-flush-cache/README.md b/netns/pmtu-flush-cache/README.md new file mode 100644 index 0000000..11445c5 --- /dev/null +++ b/netns/pmtu-flush-cache/README.md @@ -0,0 +1,19 @@ +# Flush mtu1280-c netns pmtu cache every second +`net.ipv4.route.mtu_expires` in a netns is a [recent +invention](https://github.com/torvalds/linux/commit/1de6b15a434c0068253fea5d719f71143e7e3a79). +With the system kernel without the patch, the following error will be shown when +staring `mtu1280-netns.service`: + +``` +sysctl: cannot stat /proc/sys/net/ipv4/route/mtu_expires: No such file or directory +``` + +As a cheap and quick hack, `mtu1280-netns-flush-cache.service` can be used to +achieve `net.ipv4.route.mtu_expires=0`. + +```sh +systemctl enable --now mtu1280-netns-flush-cache.service +``` + +The service starts a shell script that flushes the mtu cache every second until +the netns is gone. diff --git a/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.service b/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.service new file mode 100644 index 0000000..f01ae7c --- /dev/null +++ b/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.service @@ -0,0 +1,10 @@ +[Unit] +Description=Flush pmtu cache in mtu1280-c netns every second +Requisite=mtu1280-netns.service + +[Service] +Type=simple +ExecStart=/usr/local/bin/mtu1280-netns-flush-cache.sh + +[Install] +WantedBy=multi-user.target diff --git a/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.sh b/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.sh new file mode 100755 index 0000000..3874c8b --- /dev/null +++ b/netns/pmtu-flush-cache/mtu1280-netns-flush-cache.sh @@ -0,0 +1,13 @@ +#!/bin/sh +a=0 +b=0 + +while [ "$a" -eq 0 ] || [ "$b" -eq 0 ] +do + sleep 1 + + ip -n mtu1280-c -4 route flush cache 2> /dev/null >/dev/null + a=$? + ip -n mtu1280-c -6 route flush cache 2> /dev/null >/dev/null + b=$? +done From 7569613c234415f7399d09bffea2acbd338b3002 Mon Sep 17 00:00:00 2001 From: David Timber Date: Mon, 9 Sep 2024 17:50:56 +0200 Subject: [PATCH 8/9] Add missing safe_run() in netns/mtu1280-netns.sh --- netns/mtu1280-netns.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/netns/mtu1280-netns.sh b/netns/mtu1280-netns.sh index 59f4ceb..f8568e7 100755 --- a/netns/mtu1280-netns.sh +++ b/netns/mtu1280-netns.sh @@ -104,13 +104,13 @@ mkns () { ip -n mtu1280-c link set veth-mtu1280-b up # default route from mtu1280-a to system - ip -n mtu1280-a -4 route add default dev veth-mtu1280-gw via $(filter_cidr "$MTU1280NS_ADDR4_A0") + safe_run "$MTU1280NS_ADDR4_A0" ip -n mtu1280-a -4 route add default dev veth-mtu1280-gw via $(filter_cidr "$MTU1280NS_ADDR4_A0") ip -n mtu1280-a -6 route add default dev veth-mtu1280-gw via $(get_ll_addr veth-mtu1280-a) # default route from mtu1280-b to mtu1280-a (mtu 1280 segment) - ip -n mtu1280-b -4 route add default dev veth-mtu1280-a via $(filter_cidr "$MTU1280NS_ADDR4_B0") mtu 1280 + safe_run "$MTU1280NS_ADDR4_B0" ip -n mtu1280-b -4 route add default dev veth-mtu1280-a via $(filter_cidr "$MTU1280NS_ADDR4_B0") mtu 1280 ip -n mtu1280-b -6 route add default dev veth-mtu1280-a via $(get_ll_addr veth-mtu1280-b mtu1280-a) mtu 1280 # default route from mtu1280-c to mtu1280-b - ip -n mtu1280-c -4 route add default dev veth-mtu1280-b via $(filter_cidr "$MTU1280NS_ADDR4_C0") + safe_run "$MTU1280NS_ADDR4_C0" ip -n mtu1280-c -4 route add default dev veth-mtu1280-b via $(filter_cidr "$MTU1280NS_ADDR4_C0") ip -n mtu1280-c -6 route add default dev veth-mtu1280-b via $(get_ll_addr veth-mtu1280-c mtu1280-b) # static route from system default ns to inner From 02b553e8d08638a433c9b4692d490b85e3dcd23e Mon Sep 17 00:00:00 2001 From: David Timber Date: Tue, 10 Sep 2024 19:24:50 +0200 Subject: [PATCH 9/9] Add Documentation= in the service unit --- netns/mtu1280-netns.service | 1 + 1 file changed, 1 insertion(+) diff --git a/netns/mtu1280-netns.service b/netns/mtu1280-netns.service index f394198..1aca794 100644 --- a/netns/mtu1280-netns.service +++ b/netns/mtu1280-netns.service @@ -1,5 +1,6 @@ [Unit] Description=MTU1280 network namespace set up +Documentation=https://github.com/si-magic/mtu1280d/tree/master/netns Requires=network.target After=network.target