sm: networkmanager: support port ranges in allowed connections - #286
Open
MykolaSuperman wants to merge 104 commits into
Open
sm: networkmanager: support port ranges in allowed connections#286MykolaSuperman wants to merge 104 commits into
MykolaSuperman wants to merge 104 commits into
Conversation
This patch resets dbus connection and retries the call if it fails with -ENOTCONN error, which indicates that the connection is lost. Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Some commands are designed to return non-zero exit codes in case of expected conditions, like quota returns 1 on exceeded quota, and the output is still valid and parsable. Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
quota command returns 1 exit code when quota overflow happens. This commit adds handling of this case and returns appropriate error code. Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Release ContainerRuntime::mMutex before invoking OnInstancesStatusesReceived to break an AB/BA lock order cycle: - Thread A holds Monitoring::mMutex, waits for ContainerRuntime::mMutex - Thread B holds ContainerRuntime::mMutex, waits for Monitoring::mMutex UpdateRunStatus now builds the status list under the lock, releases it, then calls the callback. Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Catch base Poco::Exception instead of Poco::Net::NetException in ConnectToCloud so that non-network exceptions (e.g. certificate errors) do not escape the catch block and crash the connection loop. Guard the erase of mDiscoveryResponse connection info against a null pointer. Include command output in ExecCommand error messages so callers can diagnose subprocess failures without extra logging. Return output even on failure so callers that need it (e.g. imagehandler) can log it. Log src/dst paths and the wrapped error when UnpackTarImage fails so that "Failed to unpack layer" errors carry enough context to diagnose the root cause. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
SyncMessageSender::SendSync and SMHandler::SendMessage each protected mStream->Write() with their own separate mutex, so two concurrent callers could call Write() at the same time. gRPC does not allow concurrent writes on a single stream and aborted with: GRPC_CALL_ERROR_TOO_MANY_OPERATIONS Pass SMHandler::mMutex into SyncMessageSender::Init as an external write mutex. SendSync now locks that shared mutex only for the Write call while using its internal mutex for bookkeeping and condvar wait. SendMessage already uses SMHandler::mMutex, so all writes are serialized through a single lock. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Server::Shutdown() with no deadline performs a graceful shutdown that waits indefinitely for existing RPC streams to close. When the SM client keeps sending monitoring data, ReadMessages stays in mStream->Read() and the server never shuts down within systemd's stop timeout, causing CM to be killed with SIGKILL after 90 seconds. Pass a deadline of now + cServerShutdownDelay (5s) to Server::Shutdown() so that gRPC force-closes all connections after that interval. This unblocks the pending Read() at the transport level, allowing ReadMessages to exit and the server threads to complete. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Instances that share a network (same subnet) should communicate without firewall restrictions; filtering must apply only across different networks. Prepend two same-subnet accept rules to each instance chain (intra-subnet in/out) so same-network flows are accepted before the per-instance access rules and the terminal drop, while cross-network traffic keeps the existing exposed-ports/allow-public behaviour. The rules are gated on the instance subnet being known and rely on each AoS network owning a distinct subnet, so a same-subnet match is equivalent to same-network. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
UnitInstanceStatusArray now stores UnitInstanceStatus* instead of values. Update instance field access in InstanceToJSON to use arrow operator and update tests to allocate instances in a backing store and push pointers. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
…trips Resolve interface indexes via if_nametoindex (a cheap ioctl) instead of dumping the whole link table in SetMasterLink and AddAddr, and bring links up as part of creation (IFF_UP in AddLink) so CreateBridge/CreateVlan no longer need a separate SetupLink. Drop the dead GetAddrList probe in CreateBridge. Add CreateVethToNamespace, which creates the veth pair with the peer placed directly into the target netns (named, up) and the host side up and enslaved to the bridge in a single RTM_NEWLINK, and ConfigureInstanceInterface, which brings the interface up, assigns the address and installs the default route in a single namespace entry. CreateVlan gains a master parameter so the vlan is enslaved to the bridge at creation (via IFLA_MASTER / LinkAttrs). These collapse the per-instance and per-network setup into far fewer netlink round-trips and namespace switches. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Attach now creates the veth pair with the peer placed directly into the instance netns (named, up, enslaved to the bridge) via CreateVethToNamespace and configures it via ConfigureInstanceInterface, replacing the create + move + rename + setmaster + setup + addr + route sequence. This removes most netlink round-trips and collapses the three namespace switches into one. Tests updated to the new call sequence. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Release Runner::mMutex before invoking RunStatusReceiverItf::UpdateRunStatus to break an AB/BA lock order cycle: - Thread pool workers hold Instance::mMutex (in Instance::Start/Stop) and block on Runner::mMutex (via Runner::StartInstance/StopInstance). - Runner::MonitorContainers holds Runner::mMutex and blocks on the same Instance::mMutex, reached through UpdateRunStatus -> ContainerRuntime::UpdateRunStatus -> Instance::UpdateRunStatus. Once triggered, Runner::mMutex is held forever, wedging every worker thread as well as the shutdown path (Runner::Stop joins the monitoring thread), so the whole aos_sm_app hangs, including on close. MonitorContainers now copies the running-instances snapshot under the lock, releases it, then invokes the receiver outside the critical section, mirroring how instancesToRestart is already handled. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
std::filesystem::path::operator/= replaces the whole path instead of
appending when the right-hand side is itself absolute (starts with
'/'), so JoinPath("/sys/fs/cgroup", "/system.slice/...", ...) silently
dropped "/sys/fs/cgroup" and returned just the cgroup path itself.
Every caller here means "append this component", so strip a leading
'/' from entry/entries (never from base) before appending.
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
mInstanceMonitoringCache (std::unordered_map) was read and mutated from StartInstanceMonitoring, StopInstanceMonitoring, and GetInstanceMonitoringData with no synchronization, all of which run concurrently from the launcher's worker thread pool. Concurrent insert/erase/lookup on the same unordered_map is undefined behavior. Guard all three with a mutex. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Containers used to be started as systemd services, so the cgroup path had to match what systemd created, including its "\x2d" unit-name escaping. Now crun creates the cgroup directly via the cgroupfs driver, so that constraint no longer applies and the path can be set directly. Move it into itf/consts.hpp so instance, monitoring and logprovider share one definition instead of drifting copies. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
sync() flushes all mounts system-wide, not just the one being unmounted, so calling it before every umount() serialized container stop across the thread pool under concurrent load (254 instances, ~150ms -> ~9ms for a full stop without it). umount() already flushes the affected filesystem, so the extra sync() was redundant. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
- Move ExecCommand out of the general-purpose utils.hpp/cpp into a dedicated exec.hpp/cpp, since most utils.hpp consumers don't need process-spawning code pulled in. - Rework ExecCommand to spawn via posix_spawn instead of the exec-based Poco::Process::launch, building an explicit per-call envp (dropping NOTIFY_SOCKET) instead of mutating the process-wide environment. - Add ExecDetachedCommand for commands that daemonize into a long-running process, letting it inherit real stdout/stderr instead of a pipe that would have to be closed once the launcher command exits. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
- Switch StartContainer from libcrun_container_run (in-process) to ExecDetachedCommand invoking "crun run -d", so the container process inherits real stdout/stderr instead of losing output once the in-process call returned. - Drop pid-file generation, no longer needed since crun tracks its own state under --root and CheckProcessAlive already reads that state directly. - Make the crun state root and executable path configurable (crunStateRoot/crunExecutable) instead of hardcoded constants, defaulting to the previous values. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Fix journal alerts after rotate: use sd_journal_wait (poll + sd_journal_process) in the monitor loop, because sd_journal_process() or any other sd_journal method does not detect rotation without polling the journal fd. Signed-off-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Instance::PrepareNetwork now fetches DNS servers and hosts from the network manager and writes them into the container's resolv.conf and hosts files, via new WriteResolvConf/WriteHosts helpers. File writes go through a new FileSystemItf::WriteFile method rather than raw std::ofstream calls, keeping all disk I/O behind the mockable file system interface, consistent with the rest of Instance. The concrete FileSystem implementation and its mock are updated to match. Unit tests are updated/added accordingly: FileSystem gets direct WriteFile coverage, and the container runtime Network test now verifies the exact resolv.conf and hosts content written on instance start. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Take InstanceIDProviderItf by pointer instead of reference so LogProvider can be initialized without a container runtime. GetInstanceLog and GetInstanceCrashLog now return eNotSupported when no provider is set. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
InstanceInfoProviderItf and the per-instance alert path in journal alerts are no longer relevant. ContainerRuntime no longer implements GetInstanceInfoByID either. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Add WITH_RUNTIME_BOOT, WITH_RUNTIME_ROOTFS and WITH_RUNTIME_CONTAINER options, each gating its runtimes/ source dir and library dependency. Runtimes::GetContainerRuntime is now always declared and simply returns nullptr when container support is compiled out, so callers no longer need their own WITH_RUNTIME_CONTAINER guard. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Deploy OpenSSL, pkcs11provider and (when the container runtime is built) crun from the conan cache into the install prefix, since conan only tracks them under ~/.conan2 and apps need them at runtime. Set CMAKE_INSTALL_RPATH so installed binaries resolve these over whatever the system provides, and add `build.sh install` / --install-prefix to drive it. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Implement InterfaceManagerItf::GetLink over libnl: look the link up in an rtnetlink cache and report its kind, master name, vlan ID and admin state, mapping a missing link to eNotFound. Implement NamespaceManagerItf::IsNetworkNamespaceExist over the /run/netns path already used to create and delete namespaces. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
DNSServer::Init truncated addnhosts and signalled dnsmasq, so adopting a dnsmasq that survived an SM crash wiped the records of every instance on that network, including the ones still running. Load the file into the record map instead, leaving it and the running dnsmasq untouched. The instance id is now persisted as a trailing hosts comment, which the parser needs to key the records and which dnsmasq stops reading names at. Drop CreateServerRollsBackWhenInitFails: it injected the failure through the SIGHUP that Init no longer sends, and Init has no other failure a test can trigger without contorting the code under test. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Start dropped every instance chain and masquerade rule it found in the table. After a crash that cut the traffic of the instances that kept running: the forward base chain drops by default and nothing re-adds their rules, since an adopted instance never goes through AddInstance again. Leave the table as it is on Start and add RemoveOrphans, which deletes only the chains and masquerade rules that no longer belong to a known instance or network. Surviving masquerade rules are taken back into the rule cache, so a later AddMasquerade for the same network stays a no-op. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Add a Commit overload that echoes the batch (NFT_CTX_OUTPUT_ECHO) and returns the kernel-assigned handles of the rules it added, parsed from the same "# handle N" output ListChainRules already relies on. This lets callers record handles at creation time and delete those rules later by handle, without re-listing the chain. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
The root TBF and ingress qdiscs sit on the host veth and are destroyed with it when the teardown path removes the interface (veth / namespace deletion), so Clear no longer issues the two redundant qdisc deletes and removes only the separate IFB netdev (which does not die with the veth). Cuts the per-instance teardown from three tc/netlink round-trips to one. Tests to be updated separately. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Implement BeginTransaction/CommitTransaction/RollbackTransaction on the SM database using the Poco session begin/commit/rollback, so a burst of writes (e.g. a mass instance start or teardown) commits in a single fsync instead of one per statement and is discarded as a whole when the batch fails. Each call is a no-op when it does not match the session transaction state. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Implement BeginBatch/FlushBatch/Revert. In batch mode AddInstance and RemoveInstance stage their nft operations into a single shared transaction (serialized by a mutex, since the launcher stages from its worker pool) instead of committing per instance; FlushBatch commits the lot in one nft round-trip and keeps the handles it reported. Revert deletes those handles from the forward chain and drops the instance chains the batch created, so the caller can fall back to a per-instance apply. Outside batch mode AddInstance/RemoveInstance commit immediately as before. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Mirror the firewall batch primitives. StartInstanceMonitoring and StopInstanceMonitoring stage their nft operations into a single shared transaction while a batch is open (guarded by its own mutex, the launcher stages concurrently); FlushBatch commits them in one nft round-trip and keeps the reported handles. Revert deletes those handles from the forward chain, drops the counter chains the batch created and discards their monitoring state without persisting it, so a per-instance retry starts from scratch. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
The veth's root and ingress qdiscs die with the interface, so Clear only removes the IFB device: drop the DelRootTBFQDisc/DelIngressQDisc expectations from the Clear tests and make the failure case fail on the IFB delete. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Cover the batch primitives: AddInstance/RemoveInstance stage into a single transaction that is committed once by FlushBatch, the immediate per-instance commit is back after the flush, Revert deletes the flushed handles and the chains the batch created, and a failed flush leaves nothing to revert. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Mirror the firewall batch coverage: start and stop stage into a single transaction committed once by FlushBatch, Revert deletes the flushed handles and the counter chains the batch created without persisting their counters, and the reverted instance is unknown again so a per-instance retry really re-applies instead of returning early. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Cover the transaction primitives against the real SQLite database: writes staged in a transaction survive CommitTransaction, are discarded by RollbackTransaction, and commit/rollback outside a transaction are no-ops that leave later writes working. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Implement AbortBatch: leave batch mode and drop the staged transaction, which discards everything queued in it without touching the kernel. The recorded batch chains and flushed handles go with it, so a later Revert has nothing to undo. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Implement AbortBatch: leave batch mode and drop the staged transaction without touching the kernel. StartInstanceMonitoring registers the instance even while staging and returns early for an already known instance, so the abort must also drop that state or the per-instance retry would report success without applying anything. Revert shares the same state-clearing helper. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
A failed batch commit left the staged instances registered in mInstanceChains, so the per-instance retry that follows returned early and the traffic monitor was silently never applied for them. Drop the staged monitoring state on the failure path too, the same way AbortBatch and Revert already do. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Stage an instance in a batch whose commit fails, then assert the per-instance retry builds and commits its own transaction instead of returning early for an instance the failed batch left registered. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Add a Commit overload that echoes the batch and parses the added rules (like ListChainRules), so callers can attribute added jumps to their target chains when many instances are committed together. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
AddInstance/UpdateInstance and the batch flush now record the two forward-chain jump handles per instance, and RemoveInstance deletes them directly by handle instead of listing and scanning the whole forward chain. This turns a mass teardown from O(N^2) into O(N). It falls back to the chain scan when handles are not tracked (e.g. after an SM restart). Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
… handle The batch flush records the two forward-chain jump handles per instance; StopInstanceMonitoring deletes them directly by handle instead of scanning the forward chain, turning a mass teardown from O(N^2) into O(N). It falls back to the chain scan when handles are not tracked. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
…ardown Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
ParseRuleLine constructed a dozen std::regex objects on every call, so parsing the echoed rules of a mass batch commit recompiled thousands of regexes and dominated the flush. Make them static const so each is compiled once, restoring the mass-start flush time. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
The batch Commit overload only needs the added forward-chain jumps to map handles to their target chains, so parse just the jump target and handle per line instead of running the full rule parser over every added rule. This restores the mass-start flush time. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Rely on C++17 class template argument deduction for std::lock_guard on the batch mutex instead of spelling out std::lock_guard<std::mutex>. Signed-off-by: Mykola Solianko <mykola_solianko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Aos core library APIs (crypto provider, PKCS11 manager, cert loader, cert handler, space allocators, image manager, launcher, monitoring, network manager, node config handler, etc.) now take an allocator as part of their redesigned Init signatures, so every app entry point (cm, iam, mp, sm) gains a HeapAllocator member and passes it through. Also refactors the IAM app to move its Init/Start/Stop logic out of App into a new AosCore class, matching the pattern already used by cm and sm, which keeps App as a thin Poco::Util::ServerApplication wrapper around AosCore. Updates the affected unit tests to construct a HeapAllocator and pass it to the library calls whose signatures changed, and fixes FSPlatform::GetDirSize to call the renamed common::utils::CalculateSize helper instead of the removed aos::fs::CalculateSize. Signed-off-by: Oleksandr Grytsov <al1img@gmail.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
std::accumulate was seeded with an int literal 0, so the running
total was accumulated as int and only converted to uintmax_t on
return. Directories whose aggregate size exceeds INT_MAX (~2 GiB)
overflowed before conversion, which can make SpaceAllocator receive
a bogus size and make incorrect allocation or cleanup decisions.
Seed the accumulator with uintmax_t{0} instead, and add a regression
test that sums two sub-INT_MAX sparse files whose total crosses
INT_MAX.
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
The templateRecursion suppressions are no longer needed for these two make_unique<Alerts> calls. Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com> Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com> Reviewed-by: Mykola Kobets <mykola_kobets@epam.com> Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
An allowed connection may now request an inclusive port range, so
DDS/RTPS (UDP 7400:7650) needs one rule instead of one per port:
allowedConnections: <itemID>/<from>:<to>[/<proto>]
Exposed ports stay a flat list of individual port/protocol entries, as
OCI defines them, and are rejected if they carry a range. A single port
keeps working unchanged.
ParsePortRange in common/utils is the single validator for both CM and
SM, so the two sides cannot diverge and open a policy hole.
A requested range resolves only when every port of it is exposed with
the same protocol: RuleExists was string equality on the port, a range
that is only partially exposed now fails closed.
FWRule gains mDstPortEnd, emitted as the nft range `dport <from>-<to>`
and parsed back by ParseRuleLine, otherwise ListChainRules would report
rules that differ from the added ones and RemoveOrphans would delete
live rules.
Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
MykolaSuperman
force-pushed
the
feature/firewall-port-ranges
branch
from
August 18, 2026 12:03
2f298e5 to
9c00f6c
Compare
al1img
approved these changes
Aug 21, 2026
al1img
left a comment
al1img
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.