forked from wrenn/wrenn
pptx704
8b5fa3438e
The envd port scanner used gopsutil's net.Connections() which walks
/proc/{pid}/fd to enumerate socket inodes. This corrupts Go runtime
semaphore state when the VM is paused mid-operation and restored from
a Firecracker snapshot.
Replace with a direct /proc/net/tcp + /proc/net/tcp6 parser that reads
a single file per address family — no /proc/{pid}/fd walk, no goroutines,
no WaitGroups. Also replace concurrent-map (smap) in the scanner with a
plain sync.RWMutex-protected map, since concurrent-map's Items() spawns
goroutines with a WaitGroup internally, which is equally unsafe across
snapshot boundaries.
Use socket inode instead of PID for the port forwarding map key, since
inode is available directly from /proc/net/tcp without the fd walk.
75 lines
1.6 KiB
Go
75 lines
1.6 KiB
Go
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package port
|
|
|
|
import (
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/rs/zerolog"
|
|
)
|
|
|
|
type Scanner struct {
|
|
scanExit chan struct{}
|
|
period time.Duration
|
|
|
|
// Plain mutex-protected map instead of concurrent-map. The concurrent-map
|
|
// library's Items() spawns goroutines and uses a WaitGroup internally,
|
|
// which corrupts Go runtime semaphore state across Firecracker snapshot/restore.
|
|
mu sync.RWMutex
|
|
subs map[string]*ScannerSubscriber
|
|
}
|
|
|
|
func (s *Scanner) Destroy() {
|
|
close(s.scanExit)
|
|
}
|
|
|
|
func NewScanner(period time.Duration) *Scanner {
|
|
return &Scanner{
|
|
period: period,
|
|
subs: make(map[string]*ScannerSubscriber),
|
|
scanExit: make(chan struct{}),
|
|
}
|
|
}
|
|
|
|
func (s *Scanner) AddSubscriber(logger *zerolog.Logger, id string, filter *ScannerFilter) *ScannerSubscriber {
|
|
subscriber := NewScannerSubscriber(logger, id, filter)
|
|
|
|
s.mu.Lock()
|
|
s.subs[id] = subscriber
|
|
s.mu.Unlock()
|
|
|
|
return subscriber
|
|
}
|
|
|
|
func (s *Scanner) Unsubscribe(sub *ScannerSubscriber) {
|
|
s.mu.Lock()
|
|
delete(s.subs, sub.ID())
|
|
s.mu.Unlock()
|
|
|
|
sub.Destroy()
|
|
}
|
|
|
|
// ScanAndBroadcast starts scanning open TCP ports and broadcasts every open port to all subscribers.
|
|
func (s *Scanner) ScanAndBroadcast() {
|
|
for {
|
|
// Read directly from /proc/net/tcp and /proc/net/tcp6 instead of
|
|
// using gopsutil's net.Connections(), which walks /proc/{pid}/fd
|
|
// and causes Go runtime corruption after Firecracker snapshot/restore.
|
|
conns, _ := ReadTCPConnections()
|
|
|
|
s.mu.RLock()
|
|
for _, sub := range s.subs {
|
|
sub.Signal(conns)
|
|
}
|
|
s.mu.RUnlock()
|
|
|
|
select {
|
|
case <-s.scanExit:
|
|
return
|
|
default:
|
|
time.Sleep(s.period)
|
|
}
|
|
}
|
|
}
|