This avoids installing .gitignore file to compel includes.

While at it, describe why this .gitignore is needed.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

No need to use either -r (recursive) or -f (force).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

As these function is never used outside of criu/mount.c
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

rmntns_root - is fd number of opened mntns root directory, these info
doesn't help to identify mntns involved in logs, show path to these
mntns instead.
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Using --lazy-pages with pre-dump causes partial memory dump and it's not
the intention. The whole point of pre-dump is to keep amount of memory that
would be dumped during tasks freeze to minimum.

Disallow running pre-dump with --lazy-pages.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The macro __list_for_each is equivalent to list_for_each and it is not
used anywhere.
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The criu-lazy-migration.sh was copied from criu-lazy-pages.sh and was not
updated enough to actually run zdtm.py with --lazy-migrate.

Fix it.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The lazy memory dump used by the post copy migration cleans up page pipes
and parasite from zombie tasks, although for such task they are never
initialized.
Fix it.
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Raw sockets may carry any protocol they want so
lets try them out.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Otherwise there might be a raw socket with AF_INET
family and IPPROTO_ICMPV6 protocol which surely
don't have to restore it.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

for filename in *.c; do
    if sort "$filename" | uniq -d | grep include; then
        echo "$filename"
    fi
done
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

MAP_ANON has been deprecated, use MAP_ANONYMOUS instead.

https://lkml.org/lkml/2007/2/3/55Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Andrei Vagin <avagin@gmail.com>

Start test
Test is SUID
./socket-tcp-nfconntrack --pidfile=socket-tcp-nfconntrack.pid --outfile=socket-tcp-nfconntrack.out
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Andrei Vagin <avagin@gmail.com>

It is expected behaviour.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

The test is trying to write into a closed socket and the kernel sends
SIGPIPE in this case, which is perfectly normal and should not fail the
test.
Signed-off-by: Andrei Vagin <avagin@gmail.com>

On a system with more than 10 network interfaces the link_nsid check
fails:

$ criu check --feature link_nsid
Warn  (criu/cr-check.c:1237): NSID isn't supported

The function kerndat_link_nsid() uses:

 nde.ifindex = 10;

This fails as there is already an interface with ifindex 10.

This patch moves the creation of the socket into the second network
namespace and the feature check succeeds.
Suggested-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Fixes:
verify-elf: ERROR: ./usr/lib64/libcompel.so.1.0: undefined symbol: opts
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reported-by: Alexey Shabalin <>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

This reverts commit 6b0292e12614.

handle_binary() is needed for preparing PIE header during compilation.
If we need to provide API for building another compel binary, probably
it should be a separate library from libcompel.{a,so}

IOW, there is no sense to have handle_binary() included into CRIU.
For CRIU it's needed only during the build to generate parasite header.

Move handle_elf() to compel binary from library, as it was previously
corrected in commit 64bb75a8 ("compel: Drop off handle-elf routines
from library").
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Libcompel supplies to the parasite PAGE_SIZE during infection.
On ppc64/aarch64 PAGE_SIZE can be different with Large pages,
under the cover it returns __page_size.

At this moment __page_size is located in criu binary, which
prevents using libcompel as .so library in other applications
than criu on ppc64/aarch64.

Export __page_size and __page_shift in libcompel.

Fixes: #572
Fixes: 2d965008 ("ppc64/aarch64: Dynamically define PAGE_SIZE")

Cc: Adrian Reber <areber@redhat.com>
Acked-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reported-by: Alexey Shabalin
Signed-off-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Related: https://github.com/checkpoint-restore/criu/issues/577

Restoring a runc container which is running in the host's network
namespace locked the network (iptables-restore) without unlocking it.

This disables network logging if running in the host's network
namespace.
Suggested-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Adrian Reber <areber@redhat.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Recently, I introduced a new mode when a service fd are not dupped into
a fixed file descriptor number. A side effect of this is that we need to
close the old descritpor if it was installed.

Fixes: d3499999 ("criu: remove all magic of service-fd when it isn't required")

Most of the typos were found by codespell.
Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Signed-off-by: Andrei Vagin <avagin@virtuozzo.com>

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

In vz7 we've a slightly different code base where fields
2 and 3 are already used. So lets reserve them and move
raw member to another number.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Just like with other inet sockets simply fetch additional
data (such as ICMP) and restore it back then.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Raw sockets may have arbitrary protocol so we
need different helper to lookup socket.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

Just like we do for other protocols.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

So they would pass this check.

Note because we didn't allow raw socks in can_dump_ipproto
this routine won't be reached and it's safe to modify it this
way without breaking existing tests.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>

IP_FREEBIND is not supported for SOCK_RAW ipv6 sockets.
See kernel rawv6_setsockopt() for the details.

For the rest of sockets, where they begin to support it:
the actual magic happens in do_ipv6_setsockopt(), and
IPV6_ADDRFORM optname changes sk->sk_prot to refer
to tcp_prot, udp_prot and udplite_prot, which contains
link to ip_setsockopt().
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>