forked from wrenn/wrenn
pptx704
8b5fa3438e
The envd port scanner used gopsutil's net.Connections() which walks
/proc/{pid}/fd to enumerate socket inodes. This corrupts Go runtime
semaphore state when the VM is paused mid-operation and restored from
a Firecracker snapshot.
Replace with a direct /proc/net/tcp + /proc/net/tcp6 parser that reads
a single file per address family — no /proc/{pid}/fd walk, no goroutines,
no WaitGroups. Also replace concurrent-map (smap) in the scanner with a
plain sync.RWMutex-protected map, since concurrent-map's Items() spawns
goroutines with a WaitGroup internally, which is equally unsafe across
snapshot boundaries.
Use socket inode instead of PID for the port forwarding map key, since
inode is available directly from /proc/net/tcp without the fd walk.
52 lines
1.2 KiB
Go
52 lines
1.2 KiB
Go
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package port
|
|
|
|
import (
|
|
"github.com/rs/zerolog"
|
|
)
|
|
|
|
// If we want to create a listener/subscriber pattern somewhere else we should move
|
|
// from a concrete implementation to combination of generics and interfaces.
|
|
|
|
type ScannerSubscriber struct {
|
|
logger *zerolog.Logger
|
|
filter *ScannerFilter
|
|
Messages chan ([]ConnStat)
|
|
id string
|
|
}
|
|
|
|
func NewScannerSubscriber(logger *zerolog.Logger, id string, filter *ScannerFilter) *ScannerSubscriber {
|
|
return &ScannerSubscriber{
|
|
logger: logger,
|
|
id: id,
|
|
filter: filter,
|
|
Messages: make(chan []ConnStat),
|
|
}
|
|
}
|
|
|
|
func (ss *ScannerSubscriber) ID() string {
|
|
return ss.id
|
|
}
|
|
|
|
func (ss *ScannerSubscriber) Destroy() {
|
|
close(ss.Messages)
|
|
}
|
|
|
|
func (ss *ScannerSubscriber) Signal(conns []ConnStat) {
|
|
// Filter isn't specified. Accept everything.
|
|
if ss.filter == nil {
|
|
ss.Messages <- conns
|
|
} else {
|
|
filtered := []ConnStat{}
|
|
for i := range conns {
|
|
// We need to access the list directly otherwise there will be implicit memory aliasing
|
|
// If the filter matched a connection, we will send it to a channel.
|
|
if ss.filter.Match(&conns[i]) {
|
|
filtered = append(filtered, conns[i])
|
|
}
|
|
}
|
|
ss.Messages <- filtered
|
|
}
|
|
}
|