Skip to content

podnet v0.4.0-beta.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Nov 14:37
· 435 commits to main since this release
v0.4.0-beta.2
5465007

A prerelease of podnet, for tests. It follows v0.4.0-beta.1.

A user of cfrs reads the notes of v0.4.0-beta.1 first. They give the
rename and the move from cfrs.

Binaries

File System
podnet-x86_64-unknown-linux-musl Linux x86-64
podnet-aarch64-unknown-linux-musl Linux ARM64
podnet-armv7-unknown-linux-musleabihf Linux ARMv7 (32-bit, hard float)
podnet-arm-unknown-linux-musleabihf Linux ARMv6 (32-bit, hard float)
podnet-i686-unknown-linux-musl Linux x86 (32-bit)
podnet-riscv64gc-unknown-linux-musl Linux RISC-V 64
podnet-loongarch64-unknown-linux-musl Linux LoongArch64
podnet-powerpc64le-unknown-linux-musl Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host.
podnet.1 is the manual page. SHA256SUMS lists each file.

The image is ghcr.io/podutils/podnet:v0.4.0-beta.2 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify podnet-x86_64-unknown-linux-musl --repo PodUtils/podnet
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/PodUtils/podnet/.github/workflows/release.yml@refs/tags/v0.4.0-beta.2 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.4.0-beta.2   # rebuild and compare (x86_64, aarch64)

podnet update does the first three checks itself.

Breaking

A command or a script written for v0.4.0-beta.1 must change for each item
below.

  1. Each message of podnet pod and podnet pod doctor starts with
    podnet pod: (was podnet-netns:). podnet pod --version prints the
    line of podnet --version (T-135). Change each script that matches the
    old prefix.
  2. The seccomp backend has a new default ceiling of tracked sockets:
    (RLIMIT_NOFILE - 64) / 2, from 64 to 65536 (was 4096). The supervisor
    raises its soft limit to the hard limit after it starts the program. The
    program keeps its limit. Use --flow-budget N (64 to 1048576) to set the
    old value. A value above the default gives a warning (T-181).
  3. A socket call that fails because the supervisor has no descriptor for a
    socket pair gets EMFILE (was EIO) (T-181).
  4. At the exit of a seccomp pod, one line on stderr gives the counts of the
    refused socket calls, when a call was refused (T-181).
  5. The seccomp backend gives the program the accepted inbound connection
    itself, with no relay and no socket pair. The accepted socket has the name
    of the listening socket, and the supervisor reads no byte of it (T-150).
    With --flow-log, the pod relays each TCP flow again, to count bytes
    (T-157).
  6. The netns backend: podnet pod returns the exit code of the first program
    at once. The pod and its router stay until each process of the namespace
    ends. A script that waited for the end of the router must wait for the
    processes (T-108).
  7. podnet warp nc refuses a destination name over 255 bytes with
    invalid destination: ... is longer than the 255 bytes of SOCKS5. Before,
    it cut the name. The error words of the SOCKS5 datagram path are those of
    pod-proxy. A reply with a SOCKS version other than 5 is refused
    (T-224).
  8. A seccomp pod answers a connect or a datagram that a reject or block
    rule refuses with ECONNREFUSED (connect) or EACCES (datagram). A
    -r rule with an unknown action is a usage error, exit 64 (T-156).

The keys of podnet doctor --json do not change. podnet pod doctor --json
has the new key flow_budget (T-181) and a new row for netfilter (T-152).

Changes for a tester

Pod backends (podnet pod, warp exec, warp shell):

  • -r takes the actions reject and block, for TCP and for datagrams
    (T-156).
  • --default-action allow|reject and --flow-log FILE (T-157). The log has
    one JSON line for each decision and one at the close of each relayed TCP
    flow, with bytes_out and bytes_in.
  • --learn FILE records the destinations. --fail-on-violation FILE refuses
    a destination that is not in FILE, and exits 4 when the program exits 0
    (T-158). Both are a usage error with --serve.
  • --flow-budget N and the row flow budget (seccomp) of pod doctor
    (T-181).
  • pod doctor has the row netfilter in a namespace (not a backend). No
    backend uses it (T-152).
  • The seccomp relay has a buffer of 64 KiB for each direction (T-151).
  • The seccomp backend gives the accepted inbound connection to the program
    (T-150).
  • The netns backend: generic UDP, with a flow table (60 s idle, 256 flows)
    (T-111). The pod lives past its first program (T-108). A large TCP
    download keeps full speed with a bounded buffer (T-226).
  • podnet-netns uses pod_proxy::udp for the SOCKS5 datagram path (T-224).
  • Fuzz targets for the seccomp handlers: seccomp_sendto, seccomp_sendmsg,
    seccomp_sockopt (T-154).

WARP:

  • The send poller of the WARP QUIC socket keeps its wake-up (T-225).

Tunnel and services:

  • podnet connect URL --stdio carries one stream on stdin and stdout, for an
    SSH ProxyCommand through tunnel --forward (T-082).
  • serve --tar: GET /PATH/?tar gives a directory as one tar stream
    (T-085).

Git:

  • An SSH server for git-upload-pack and git-receive-pack, with host key,
    authorized_keys (ed25519 and ecdsa) and anon_read (T-093). It is a
    library item; no command starts it yet.

Virtual network:

  • net socksify --cidr (repeatable), PODNET_SOCKS_CIDRS and
    net shim --socks-route send chosen destinations to the SOCKS5 door
    (T-167).
  • net passwd-shim and the row passwd entry for this uid of net doctor
    (T-168).
  • A reader of a wg-quick file, with optional reserved bytes (T-116). It is a
    library item.

The CLI and doctor:

  • podnet pod --version prints the line of podnet --version (T-135).

Build and crates:

  • The code moved into the crates podnet-core, podnet-serve and
    podnet-vnet, and into smaller files. The library paths stay the same
    through re-exports (T-046, T-047, T-048, T-051, T-033, T-034, T-037,
    T-038, T-040, T-041, T-042, T-044).
  • podnet takes the shared crates of PodUtils/podcrates up to v0.13.0,
    with pod-ws (T-137).
  • CI checks the citations of the last commit (T-015). The live step updates
    from v0.4.0-beta.1 (T-024). The publish to crates.io is a switch (T-023).

What to report

Open an issue in PodUtils/podnet with the output of podnet doctor --json
and podnet pod doctor --json, the command, and the stderr of the command
with -v.

Limits

  • This is a beta. Each item of Breaking can change again before the stable
    release.
  • No crates.io release of podnet exists.
  • The Rekor inclusion proof is not checked by podnet update.
  • T-152: the netfilter probe is not measured on a container, and not on a
    runner with AppArmor limits on user namespaces. No backend uses it.
  • T-181: the counters are for each pod. The per-door counters wait for the
    router. The run of 5000 connections is not measured.
  • T-093: podnet git serve does not exist yet (T-094).
  • T-151: the netns TCP path was slow for a large transfer before T-226; the
    speed on a real proxy is not measured.
  • T-167: the external shim of the issue is not measured. T-168: ssh-keygen
    on a host with no passwd entry is not measured.
  • T-154: the libFuzzer run is not made for this release.
  • T-111: a full queue of a UDP flow holds the datagram, with no failover.
  • T-116: a wg-quick file with PresharedKey is read, but the WireGuard code
    does not use it yet.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Build, tests and CI

  • secrets: the allow file names each commit with 12 hex digits (9026797)
  • secrets: allow the test URL of mask() at its path in podnet-core (5bf153d)

Other

  • T-023: publish.yml packs the crates only when the switch crates-io is true (707435f)
  • T-040: move the seccomp filter to seccomp/filter.rs (9a0e8af)
  • T-040: move the memory access to seccomp/mem.rs (ab4ada4)
  • T-040: move the notification helpers to seccomp/notif.rs (5c64f66)
  • T-040: move the send calls to seccomp/send.rs (51d9d18)
  • T-040: move listen and accept to seccomp/accept.rs (8ce76c3)
  • T-040: move the TUN device to netns/tun.rs (90e8851)
  • T-040: move the descriptor passing to netns/fdpass.rs (082056c)
  • T-040: move the stack of the netns backend to netns/backend.rs (e45914d)
  • T-040: move the packet builders to netns/packet.rs (934b7cf)
  • T-040: remove seccomp.rs and netns.rs from the size allowlist (07a9ac0)
  • T-040: cite the new files of seccomp/ and netns/ (6f57e61)
  • T-040: done (9a0e8af to 6f57e61) (908b9b7)
  • T-154: fuzz targets for the seccomp handlers (6389505)
  • T-154: done (6389505) (095ad98)
  • Merge T-040 (the split of the pod backends) and T-154 (fuzz targets of the seccomp handlers) (e51efec)
  • T-023: done (v0.4.0-beta.1 at e756ce2; release 42729897311, release-proofs 42731594509) (6480b40)
  • record: T-023 status done (the Done section came first in 6480b40) (ddb2a8d)
  • record: the work order drops T-023 (done) (98fe7c0)
  • T-137: move each podcrates tag to v0.9.0 (191f2b4)
  • T-224: podnet-netns calls pod_proxy::udp for the SOCKS5 datagram path (127c095)
  • T-224: done (127c095) (620134c)
  • Merge T-137 (podcrates v0.9.0) and T-224 (pod_proxy::udp in podnet-netns) (24cc236)
  • record: State: podcrates v0.9.0; the datagram path of upstream.rs is podnet's no more (T-224); v0.4.0-beta.1 (be18168)
  • record: map COORD-009 (#417) (b1d7835)
  • T-033: split src/detach.rs into supervise, unix and tests files (d0a6df0)
  • T-033: split src/update.rs into cosign and tests files (a8e648d)
  • T-033: split src/doctor.rs into clock_check, tls_check and tests files (9d9b2ed)
  • T-034: split src/vnet/stack.rs into reactor, service, socket, proof and tests files (8cb6ea8)
  • T-033, T-034: done (d0a6df0, a8e648d, 9d9b2ed, 8cb6ea8) (57f28d9)
  • Merge the splits T-033 (detach, update, doctor) and T-034 (vnet stack) (18839c4)
  • T-037: split src/share.rs into src/share/ (ba9be1d)
  • T-037: done (ba9be1d) (b96de75)
  • T-038: split src/feature/mod.rs into src/feature/ (fee6f4f)
  • T-038: done (fee6f4f) (6c21a2d)
  • T-041: split tests/pod_seccomp.rs into tests/pod_seccomp/ (0824db1)
  • T-041: split tests/cli.rs into tests/cli/ (1cbdad4)
  • T-041: split tests/detach.rs into tests/detach/ (3e89ce7)
  • T-041: share the compile and run harness of the shim tests (88674cf)
  • T-041: update the paths of the split test files (f9f33a6)
  • T-041: done (0824db1, 1cbdad4, 3e89ce7, 88674cf) (3b3319f)
  • Merge the splits T-037 (share), T-038 (feature) and T-041 (the four large test files) (5114a0c)
  • T-137: move each podcrates tag to v0.10.0 (3a9317b)
  • record: map COORD-010 (#418); podnet is on podcrates v0.10.0 (be5ee88)
  • T-042: move previous_of from update to detach (25378d9)
  • T-042: move the origin dial from net to origin::dial (b87ba27)
  • T-042: remove the doc link from util to feature (42a9c93)
  • T-042: move the type Refused from cloudflare::rpc to hop (ffddf71)
  • T-042: move the type Refusal from quicktunnel to report (c154ccf)
  • T-044: move RULE_KEYS from config to ingress (3714039)
  • T-044: make relay use connect for the CONNECT tunnel (bc0f58d)
  • T-044: make transport use connect for the CONNECT tunnel (f1f69c4)
  • T-044: the layer check skips each file of a test module (a8a36bf)
  • T-044: ShareLink::from_quick_tunnel takes the URL (799d4be)
  • T-042: the verifier test allows src/origin/dial.rs, not src/net.rs (22b00a2)
  • T-042: done (25378d9, b87ba27, 42a9c93, ffddf71, c154ccf, 22b00a2); T-043, T-044: blocked (c9aa04a)
  • Merge T-042 (done) and T-044 (partial cuts; blocked on takes): 9 upward references cut (a026974)
  • record: T-012 blocked: podcrates v0.10.0 has no WARP stand-in; it comes with pod-warp (podcrates T-028) (b2b508c)
  • T-024: test and live step for the podnet release v0.4.0-beta.1 (94cc57c)
  • T-024: done (94cc57c) (5cfcfdd)
  • T-015: CI checks the citations of the last commit (6a63aae)
  • T-015: done (6a63aae) (722c2c4)
  • Merge T-024 (update checks against v0.4.0-beta.1), T-015 (citations in CI); T-025 blocked on the owner (e38d558)
  • record: COORD #416, #417 and #418 closed (podcrates 629b00a, 7ff9e42) (629a7c9)
  • T-024: the live update step installs v0.4.0-beta.1 with --force (1e6b8f1)
  • T-046: add the crate podnet-core with the build facts and the macros (dede6df)
  • T-046: done (dede6df) (3963786)
  • T-047: move the core modules to the crate podnet-core (4693062)
  • T-047: done (4693062) (47204bc)
  • Merge T-046 (the workspace for more crates) and T-047 (the crate podnet-core) (0bb7802)
  • T-137: move each podcrates tag to v0.11.0 (740eb0b)
  • record: podnet is on podcrates v0.11.0 (b2f499b)
  • record: map COORD-011 (#419) (76ffb5e)
  • T-051: move the service modules to the crate podnet-serve (585acd0)
  • T-051: done (585acd0) (c4f19bd)
  • Merge T-051: the crate podnet-serve (38bc5ab)
  • T-048: move the userspace network to the crate podnet-vnet (b333b53)
  • T-048: done (b333b53) (6529979)
  • Merge T-048: the crate podnet-vnet with the C sources of the shims (0e18e66)
  • CI: the secrets allow file keeps the line of the history; the live rollback check starts from this build (74f57ad)
  • T-082: add connect --stdio for an SSH ProxyCommand (f16a790)
  • T-082: done (f16a790) (fe74528)
  • record: T-083: blocked on pod-relay (d933345)
  • T-085: add a ustar writer and reader, and serve --tar (6fafd3f)
  • T-085: done (6fafd3f) (60a76df)
  • T-168: add net passwd-shim and a passwd row in net doctor (0c9d3ff)
  • T-168: done (0c9d3ff) (e324a5e)
  • T-167: route chosen destinations to the SOCKS5 door (571d7b5)
  • T-167: done (571d7b5) (74ded8b)
  • Merge M6: T-082 (connect --stdio), T-085 (tar of a directory), T-167 (socksify routes), T-168 (passwd shim); T-083 blocked on pod-relay (5fdf452)
  • record: #413 asks pod-relay for a handler target (T-083) (0783d6d)
  • T-108, T-107: the pod lives past its first program (c08818a)
  • T-108, T-107: done (c08818a) (c38b941)
  • T-111: netns: generic UDP (b63fa79)
  • T-111: done (b63fa79) (3810f84)
  • T-156: pod: a reject action in -r, for TCP and for datagrams (727dc98)
  • T-156: done (727dc98) (5907aae)
  • T-157: pod: --default-action and a JSON flow record (c3ecc07)
  • T-157: done (c3ecc07) (c178d65)
  • T-135: podnet pod prints its own program name in each message and in --version (266e15a)
  • T-135: done (266e15a) (40e317e)
  • Merge M7: T-107, T-108 (the pod lives past its first program), T-111 (netns UDP), T-156 (reject), T-157 (default action, flow log), T-135 (22d99a1)
  • record: #354, #364 and #365 closed (ci 42767983253, live 42767982942, secrets 42767982853 at 5bf153d) (cbe9053)
  • T-225: the send poller of the WARP QUIC socket keeps its wake-up (8bd5331)
  • T-225: done (8bd5331) (d2a1534)
  • T-093: add an SSH server for git upload-pack and receive-pack (93751c9)
  • T-093: done (93751c9) (5b9ae1b)
  • T-116: read a wg-quick file into a WireGuard peer (1d44c85)
  • T-116: done (1d44c85) (2afa59e)
  • T-116: add base64 of podnet-vnet to the lock file of fuzz (097f3de)
  • Merge T-093 and T-116 (git SSH server, wg-quick reader) (3b29ef9)
  • T-158: pod: --learn and --fail-on-violation (dea1f91)
  • T-158: done (dea1f91) (caf838b)
  • T-150: seccomp: the program holds an accepted inbound connection (974fce0)
  • T-150: done (974fce0) (9529965)
  • T-181: seccomp: a budget of tracked sockets with counters and a doctor row (05c9468)
  • T-181: done (05c9468) (76e2b02)
  • T-151: seccomp: a relay buffer of 64 KiB for each direction (4b758d0)
  • T-151: done (4b758d0) (474f78a)
  • T-152: pod doctor: a probe of netfilter in a user and net namespace (07d150b)
  • T-152: done (07d150b) (522c499)
  • T-150: the inbound test skips on a host with no loopback (985f3a9)
  • Merge T-158, T-150, T-181, T-151, T-152 (pod learn, inbound hold, flow budget, relay buffer, netfilter probe) (c524003)
  • T-226: the netns backend sends each ready segment and holds a bounded buffer (f81e7e6)
  • T-226: done (f81e7e6) (99014d5)
  • T-137: take pod-ws of podcrates v0.13.0 (5eace6e)
  • T-137: record the take of pod-ws (5eace6e) (2fed3ff)
  • Record: GitHub #351 and #355 are closed (T-150, T-151, T-157, T-158) (9ea656d)
  • T-227: version 0.4.0-beta.2 and its release note (5465007)
Assets 15
Loading