5 Commits

Author	SHA1	Message	Date
YueGuobin	c7ffe919dc	feat: VPCS kernel datapath ... A VPCS node's single adapter anchors on a persistent TAP the server creates (tap create + set_owner via uBridge) and the vpcs process attaches to by name: -e -d <gp{id8}e0p0> -n, the same server-creates/guest-attaches shape as QEMU's netdev. -n (a vpcs fork feature) keeps the guest's ip command from ifconfig'ing the anchor on the host; the vpcs build is probed once per binary identity (vpcs_tap capability, usage scan) and gates kernel links together with ubridge_tap — anything else keeps the node on the relay (the legacy local UDP tunnel on a stock binary, an AF_PACKET endpoint on the anchor with a capable one). VPCSVM takes KernelDatapathMixin: _connect_nio dispatches kernel (enslave into the per-link bridge) / relay-on-anchor / legacy, captures pick capture start_kernel vs the bridge engine, stop runs under an execute lock and terminates the process before deleting the anchor TAPs (a held device refuses deletion), and the duplicate-port guard backstops the controller's. The NIO routes accept nio_bridge and write suspend back on update. _delete_anchor_taps verifies each tap is gone from sysfs and retries a bounded three times: a holder can release its fd a moment after its process was reaped (vpcs's daemon parent kills its console child and exits first), so the unconditional delete raced EBUSY and leaked the anchor intermittently. The vpcs side needs IFNAMSIZ (16) instead of its own IFNAMESIZ (12) for the -d name buffer — anchor names are 14 chars and truncated to a nonexistent device, which TUNSETIFF then tries to create without CAP_NET_ADMIN (fixed in the vpcs fork). e2e (tests/e2e/test_vpcs_kernel_datapath.py): kernel and relay scenarios green against the real binary — real ICMP both ways, §E.1/§ E.2 on the anchors, delay/suspend/capture, link delete/re-create, node stop/restart self-heal, zero leftovers; the relay control passes with both the fork binary and a stock one.	2026-10-12 17:19:57 +08:00
YueGuobin	c3c025ab2a	fix: resolve the code-review findings on the kernel datapath ... Compute: - Track the anchor that owns uBridge's single AF_PACKET capture slot: a second kernel port's capture is refused with a clear error (its flag rolled back), a failed start no longer wedges the port, and only the owning port's stop issues the process-wide `capture stop_kernel` (docker/qemu/iou/dynamips/switch, via the mixin's slot helpers). - Unwind failed starts instead of leaking uBridge and the anchor TAPs: QEMU's stop body runs under try/finally, QEMU and IOU start the datapath inside the launch try, Dynamips undoes a half-attached port (the retry used to be short-circuited into a silent black hole), and Docker deletes the veth pair when the namespace move fails. - Restore the relay filter guard on IOU (kernel-only filters raise NodeError, an uncompilable BPF line degrades to a warning), validate the eBPF/quota/window/bpf filter shapes before touching the bridge (short or non-numeric values surfaced as 500s after partial state), and refuse a second NIO on an occupied Docker/QEMU port (the guard IOU and Dynamips already had). - Probe fixes: `_probe_bridge_tap` survives a failing uBridge start, and the probe caches key on ctime too, so a chmod/setcap remedy re-probes. Controller: - Parse GNS3_UNIX_SOCKET_NIO like the compute does (line-anchored, truthy value) and mirror the compute's class selection in kernel_anchor_type. - Read partial capability reports defensively; make BridgeNIO.bridge required-but-nullable so an omitted key is a 422 rather than a KeyError. - Strip the packet_loss correlation slot even when it is zero: the relay filter takes exactly one argument and rejected `packet_loss 10 0`. Ethernet switch: skip ports whose absorbed anchor does not exist yet (the join is deferred by design) and roll the ports_mapping back when the VLAN reconcile fails, so a retry still diffs against the old mapping. Agent: reject device config entries without a device_name instead of silently dropping them (a malformed batch used to execute partially while reporting success). Also split the netem builder to clear C901 and drop the two per-file ruff ignores the PR had added, keeping the remove-only policy.	2026-10-06 19:55:21 +08:00
YueGuobin	4b4a0fc35f	feat(iol): anchor IOL runner containers on persistent TAPs ... IOL runner containers (IOLDockerVM, GNS3_IOL_RUNNER) had no kernel datapath: their guest leg is the runner's AF_UNIX socket pairs, so every link rode the uBridge relay. Their Ethernet bays now own persistent TAP anchors (gx names, the iol_docker key of the shared naming contract — born at node start like IOU's, before any link, so the switch fast path's deferred join can never miss them), and the per-port bridge's topology leg swaps between UDP (relay) and the anchor (kernel link) through the frozen stop -> delete -> add -> start contract — the unix binding never re-binds across a swap. - iol_docker_vm: KernelDatapathMixin hooks, the anchor lifecycle (_prepare_tap_datapath at _start_ubridge: probe ubridge_bridge_tap + ubridge_tap, sweep leftover, tap create born down), the kernel attach (ensure-then-add — tap create is strictly create-only, IFF_TUN_EXCL, so the ensure checks /sys/class/net first: an unconditional create answers EBUSY on the device the start loop just made), the release (port bridge stop + delete_nio_tap before the shared teardown) and the stop order the fd holders dictate (port bridges first, then tap delete, then the per-link bridges — all before the hypervisor stops). - vendor_docker_vm: the port-bridge creation factored into _ensure_unix_port_bridge (idempotent on the registered name), keeping the NIOBridge rejection for the generic unix-socket containers. - docker_vm: the three _kernel_veths lookups go through the _kernel_host_ifc hook — behavior-identical for DockerVM, and it is what lets the subclass route without overriding the binding methods. - kernel_anchor: the iol_docker key (gx) and kernel_anchor_type, the controller-side mapping for naming an IOL runner's anchor on the switch fast path (the marker check stays inline: this module sits below everything and must not import the controller package).	2026-10-06 00:21:09 +08:00
YueGuobin	90bcb32473	feat(esw): cascade two switches through a veth pair ... Switch-to-switch links were the last shape left on the relay: the switch fast path works by absorbing the *peer's* anchor, and a switch has none — its ports are its own bridge, and a kernel interface belongs to exactly one bridge, so two bridges cannot be joined by enslaving anything. Join them with a veth pair instead: one end per bridge, each side enslaving its own end and applying its own port mode to it — an access port on one side and a trunk on the other behaves like the real cable it models. uBridge's docker create_veth/delete_veth (the primitive every Docker adapter is already born from) creates and destroys the pair; the names derive from the link id (utils.kernel_anchor.kernel_cascade_names), so each side computes its own end and the names survive a restart. The pair belongs to the link, and the two ends are wired by two independent uBridge processes — the project-open batch drives different nodes concurrently — so the protocol is order-free: both sides create the pair when their own end is missing (one create wins; the loser's failure is re-checked against the kernel and "the pair is there" is not an error), and either side's teardown destroys it (deleting one veth end takes the other with it, so both converge on the same gone pair and the second delif answers ENOENT). A pre-existing end — this switch restarted, or a leftover from a previous life of the link id — is reused rather than recreated, because the other end may still be a live port of the peer switch; a stale tc qdisc is all a reused end can carry. No new wire format was needed: a cascade is an anchor NIO on both ends, the absorbed-anchor case plus the peer end's name. That also corrects the filter routing — the single-sided rule exists because an absorbed anchor is one interface, while a cascade has one per switch, so impairments go to both ends like any other kernel link. Tests: the wire format, the eligibility flip and the both-ends re-push on node start (controller); the naming contract (utils); the switch-side lifecycle — create, reuse, lost create race, delete destroys the pair (compute routes). Drive-by: the relay filter test's compute mock carried no awaitable `put`, so tests/controller/test_kernel_datapath_link.py failed when run alone while an argument-less full run passed; callers now get one.	2026-10-06 00:21:09 +08:00
YueGuobin	c343ce0b8f	feat(esw): wire peer anchors straight into the switch bridge ... The Ethernet switch's kernel fast path: instead of a link crossing the switch's per-port uBridge relay, the switch absorbs the peer's anchor into its own kernel bridge. The peer's interface (Docker veth host end, QEMU TAP, IOU port TAP, Dynamips port TAP) becomes the switch port, and frames cross anchor -> switch bridge -> switch ports entirely in the kernel. Wire format: the switch end receives nio_anchor ('join this interface to my own bridge' — the mirror of nio_bridge), the peer end nio_bridge with a null bridge ('your anchor is bridged elsewhere': carrier, markers and impairments only — never bridge membership, and never a bridge delete, on an interface this node does not own). Anchor names come from the shared naming contract (utils.kernel_anchor), a pure function of node type, id, adapter and port — the controller computes the peer's anchor while the node may be stopped, which is what makes links to stopped nodes wireable. Stopped peers defer the join; after any node of a link starts (UDPLink.node_started) the controller re-pushes the switch NIO, and the switch completes — or repairs, when a peer restart replaced its interface under the same name — the join against the kernel's actual membership instead of assuming it. VLAN changes now edit membership in place: only the ports whose mode/VLAN actually changed are touched, each losing exactly the previous mode's entries the new mode does not want (the dot1q admits-all entry is one range operation in both directions), and no port ever leaves the bridge to change its VLANs. This replaces the old 'reset by re-enslaving' shortcut (delif+addif on every wired port, added when the ports were the switch's own TAPs): on absorbed anchors, re-enslaving an interface owned by another node is where live testing watched links die — anchors occasionally lost their bridge membership right after a ports_mapping update (later updates then failed with delif EINVAL), reproducibly with qemu, IOU and Dynamips peers and never with Docker's veths. Eligibility: the switch side needs no capability of its own (its bridge exists by construction); the peer must be able to anchor. Switch-to-switch cascades stay on the relay — a kernel interface belongs to one bridge, and joining two bridges needs a veth pair, deferred. Verified live on a real server: qemu peers through four VLAN cycles with both anchors enslaved throughout; a mixed switch (2 IOU + 2 Dynamips, four kernel ports); Docker peers with real ICMP isolating and recovering (with both anchors still enslaved); VPCS relay ports likewise in place.	2026-10-06 00:21:09 +08:00