Tolerate ErrDumpInterrupted when listing tun addresses (#1835)

main.go

@@ -22,12 +22,9 @@ type m = map[string]any
 
 func Main(c *config.C, configTest bool, buildVersion string, l *slog.Logger, deviceFactory overlay.DeviceFactory) (retcon *Control, reterr error) {
 	ctx, cancel := context.WithCancel(context.Background())
-	// The goroutines started below stop only when this context does, and only a caller holding the
+	// Automatically cancel the context if Main returns an error, to signal all created goroutines to quit.
-	// Control can arrange that. Cancel whenever we are not handing one back, which covers an error
-	// and a config test alike: a config test used to leave the lighthouse query worker, and a
-	// hostname resolver per dns named static host, running for the life of the process.
 	defer func() {
-		if retcon == nil {
+		if reterr != nil {
 			cancel()
 		}
 	}()

main_test.go

@@ -1,82 +0,0 @@
-package nebula
-
-import (
-	"fmt"
-	"net/netip"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/slackhq/nebula/cert"
-	cert_test "github.com/slackhq/nebula/cert_test"
-	"github.com/slackhq/nebula/config"
-	"github.com/slackhq/nebula/test"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/goleak"
-)
-
-// TestMain_ConfigTestReleasesItsGoroutines pins the rule that Main only leaves goroutines running
-// when it hands back a Control to stop them with.
-//
-// A config test gets no Control, so anything it started had nothing to stop it: the lighthouse
-// query worker, and a hostname resolver per dns named static host, ran for the life of the
-// process. That matters to every embedder that validates a config in process rather than by
-// exec'ing, dnclient and the apple clients included, because they do it on each config load and
-// the leak accumulates.
-func TestMain_ConfigTestReleasesItsGoroutines(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-
-	l := test.NewLogger()
-	dir := t.TempDir()
-
-	before := time.Now().Add(-time.Hour)
-	after := time.Now().Add(time.Hour)
-	ca, _, caKey, caPEM := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, before, after, nil, nil, nil)
-	networks := []netip.Prefix{netip.MustParsePrefix("10.0.0.1/24")}
-	_, _, keyPEM, certPEM := cert_test.NewTestCert(
-		cert.Version2, cert.Curve_CURVE25519, ca, caKey, "config-test", before, after, networks, nil, nil)
-
-	caPath := filepath.Join(dir, "ca.pem")
-	certPath := filepath.Join(dir, "cert.pem")
-	keyPath := filepath.Join(dir, "key.pem")
-	require.NoError(t, os.WriteFile(caPath, caPEM, 0o600))
-	require.NoError(t, os.WriteFile(certPath, certPEM, 0o600))
-	require.NoError(t, os.WriteFile(keyPath, keyPEM, 0o600))
-
-	// A static host by address, not by name: the query worker is the goroutine under test and a
-	// hostname would drag a real dns lookup into a unit test.
-	configBody := fmt.Sprintf(`
-pki:
-  ca: %s
-  cert: %s
-  key: %s
-static_host_map:
-  "10.0.0.2": ["192.0.2.1:4242"]
-lighthouse:
-  hosts:
-    - "10.0.0.2"
-listen:
-  host: 127.0.0.1
-  port: 0
-tun:
-  disabled: true
-firewall:
-  outbound:
-    - port: any
-      proto: any
-      host: any
-  inbound:
-    - port: any
-      proto: any
-      host: any
-`, caPath, certPath, keyPath)
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte(configBody), 0o600))
-
-	c := config.NewC(l)
-	require.NoError(t, c.Load(dir))
-
-	ctrl, err := Main(c, true, "config-test", l, nil)
-	require.NoError(t, err)
-	require.Nil(t, ctrl, "a config test hands back nothing to stop, so it must stop itself")
-}

overlay/tun_darwin.go

@@ -30,10 +30,7 @@ type tun struct {
 	Routes      atomic.Pointer[[]Route]
 	routeTree   atomic.Pointer[bart.Table[routing.Gateways]]
 	linkAddr    *netroute.LinkAddr
-	// hostOwned means the fd arrived from the OS, which has already configured addressing, mtu
+	l           *slog.Logger
-	// and routes for it. NEPacketTunnelProvider on darwin does this.
-	hostOwned bool
-	l         *slog.Logger
 }
 
 type ifReq struct {
@@ -153,48 +150,8 @@ func (t *tun) deviceBytes() (o [16]byte) {
 	return
 }
 
-// newTunFromFd adopts a utun the host already created and configured, which is how a darwin
+func newTunFromFd(_ *config.C, _ *slog.Logger, _ int, _ []netip.Prefix) (*tun, error) {
-// network extension is handed its device. Everything about moving packets is shared with newTun,
+	return nil, fmt.Errorf("newTunFromFd not supported in Darwin")
-// only the setup differs: the host owns addressing and routing here.
-func newTunFromFd(c *config.C, l *slog.Logger, deviceFd int, vpnNetworks []netip.Prefix) (*tun, error) {
-	if err := unix.SetNonblock(deviceFd, true); err != nil {
-		// We own the fd from the moment it is handed to us
-		_ = unix.Close(deviceFd)
-		return nil, fmt.Errorf("failed to set the tun fd to non-blocking mode: %w", err)
-	}
-
-	file := os.NewFile(uintptr(deviceFd), "/dev/tun")
-	t := &tun{
-		f:           file,
-		Device:      utunNameFromFd(deviceFd),
-		vpnNetworks: vpnNetworks,
-		DefaultMTU:  c.GetInt("tun.mtu", DefaultMTU),
-		hostOwned:   true,
-		l:           l,
-	}
-
-	if err := t.reload(c, true); err != nil {
-		_ = file.Close()
-		return nil, err
-	}
-
-	c.RegisterReloadCallback(func(c *config.C) {
-		if err := t.reload(c, false); err != nil {
-			util.LogWithContextIfNeeded("failed to reload tun device", err, t.l)
-		}
-	})
-
-	return t, nil
-}
-
-// utunNameFromFd asks the socket what interface it is, for logs. A blank name is not worth
-// failing a tunnel over, so an error just leaves it empty.
-func utunNameFromFd(fd int) string {
-	name, err := unix.GetsockoptString(fd, unix.AF_SYS_CONTROL, _UTUN_OPT_IFNAME)
-	if err != nil {
-		return ""
-	}
-	return name
 }
 
 func (t *tun) Close() error {
@@ -205,12 +162,6 @@ func (t *tun) Close() error {
 }
 
 func (t *tun) Activate() error {
-	// The host handed us a configured device. Its addresses, mtu and routes come from the network
-	// settings it applied, and a sandboxed extension cannot change them anyway.
-	if t.hostOwned {
-		return nil
-	}
-
 	devName := t.deviceBytes()
 
 	s, err := unix.Socket(
@@ -424,11 +375,6 @@ func getLinkAddr(name string) (*netroute.LinkAddr, error) {
 }
 
 func (t *tun) addRoutes(logErrors bool) error {
-	// The route tree is still ours, the system routing table is not
-	if t.hostOwned {
-		return nil
-	}
-
 	routes := *t.Routes.Load()
 
 	for _, r := range routes {
@@ -458,10 +404,6 @@ func (t *tun) addRoutes(logErrors bool) error {
 }
 
 func (t *tun) removeRoutes(routes []Route) error {
-	if t.hostOwned {
-		return nil
-	}
-
 	for _, r := range routes {
 		if !r.Install {
 			continue

overlay/tun_linux.go

@@ -5,6 +5,7 @@ package overlay
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -483,7 +484,16 @@ func (t *tun) addIPs(link netlink.Link) error {
 	//iterate over remainder, remove whoever shouldn't be there
 	al, err := netlink.AddrList(link, netlink.FAMILY_ALL)
 	if err != nil {
-		return fmt.Errorf("failed to get tun address list: %s", err)
+		//RTM_GETADDR dumps the whole system, so any concurrent address change
+		//interrupts it - including the kernel's async tentative->preferred
+		//flip of an IPv6 address the AddrReplace calls above just added,
+		//which makes this a race against our own setup. Partial results are
+		//still returned; the worst case is a stale address surviving until
+		//the next config reload, which beats failing startup over it.
+		if !errors.Is(err, netlink.ErrDumpInterrupted) {
+			return fmt.Errorf("failed to get tun address list: %s", err)
+		}
+		t.l.Warn("tun address list dump was interrupted, stale addresses may remain")
 	}
 
 	for i := range al {