@@ -42,7 +42,7 @@ clone git github.com/endophage/gotuf 9bcdad0308e34a49f38448b8ad436ad8860825ce

 clone git github.com/jfrazelle/go 6e461eb70cb4187b41a84e9a567d7137bdbe0f16

 clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c

-clone git github.com/opencontainers/runc v0.0.4 # libcontainer

+clone git github.com/opencontainers/runc 08b5415ffa3769ff7c1d2f673f61382d69aabb7d # libcontainer

 # libcontainer deps (see src/github.com/docker/libcontainer/update-vendor.sh)

 clone git github.com/coreos/go-systemd v3

 clone git github.com/godbus/dbus v2

@@ -32,20 +32,20 @@ struct describing how the container is to be created.  A sample would look simil

 config := &configs.Config{

     Rootfs: rootfs,

     Capabilities: []string{

-        "CHOWN",

-        "DAC_OVERRIDE",

-        "FSETID",

-        "FOWNER",

-        "MKNOD",

-        "NET_RAW",

-        "SETGID",

-        "SETUID",

-        "SETFCAP",

-        "SETPCAP",

-        "NET_BIND_SERVICE",

-        "SYS_CHROOT",

-        "KILL",

-        "AUDIT_WRITE",

+        "CAP_CHOWN",

+        "CAP_DAC_OVERRIDE",

+        "CAP_FSETID",

+        "CAP_FOWNER",

+        "CAP_MKNOD",

+        "CAP_NET_RAW",

+        "CAP_SETGID",

+        "CAP_SETUID",

+        "CAP_SETFCAP",

+        "CAP_SETPCAP",

+        "CAP_NET_BIND_SERVICE",

+        "CAP_SYS_CHROOT",

+        "CAP_KILL",

+        "CAP_AUDIT_WRITE",

     },

     Namespaces: configs.Namespaces([]configs.Namespace{

         {Type: configs.NEWNS},

@@ -12,44 +12,44 @@ import (

 const allCapabilityTypes = capability.CAPS | capability.BOUNDS

 var capabilityList = map[string]capability.Cap{

-	"SETPCAP":          capability.CAP_SETPCAP,

-	"SYS_MODULE":       capability.CAP_SYS_MODULE,

-	"SYS_RAWIO":        capability.CAP_SYS_RAWIO,

-	"SYS_PACCT":        capability.CAP_SYS_PACCT,

-	"SYS_ADMIN":        capability.CAP_SYS_ADMIN,

-	"SYS_NICE":         capability.CAP_SYS_NICE,

-	"SYS_RESOURCE":     capability.CAP_SYS_RESOURCE,

-	"SYS_TIME":         capability.CAP_SYS_TIME,

-	"SYS_TTY_CONFIG":   capability.CAP_SYS_TTY_CONFIG,

-	"MKNOD":            capability.CAP_MKNOD,

-	"AUDIT_WRITE":      capability.CAP_AUDIT_WRITE,

-	"AUDIT_CONTROL":    capability.CAP_AUDIT_CONTROL,

-	"MAC_OVERRIDE":     capability.CAP_MAC_OVERRIDE,

-	"MAC_ADMIN":        capability.CAP_MAC_ADMIN,

-	"NET_ADMIN":        capability.CAP_NET_ADMIN,

-	"SYSLOG":           capability.CAP_SYSLOG,

-	"CHOWN":            capability.CAP_CHOWN,

-	"NET_RAW":          capability.CAP_NET_RAW,

-	"DAC_OVERRIDE":     capability.CAP_DAC_OVERRIDE,

-	"FOWNER":           capability.CAP_FOWNER,

-	"DAC_READ_SEARCH":  capability.CAP_DAC_READ_SEARCH,

-	"FSETID":           capability.CAP_FSETID,

-	"KILL":             capability.CAP_KILL,

-	"SETGID":           capability.CAP_SETGID,

-	"SETUID":           capability.CAP_SETUID,

-	"LINUX_IMMUTABLE":  capability.CAP_LINUX_IMMUTABLE,

-	"NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE,

-	"NET_BROADCAST":    capability.CAP_NET_BROADCAST,

-	"IPC_LOCK":         capability.CAP_IPC_LOCK,

-	"IPC_OWNER":        capability.CAP_IPC_OWNER,

-	"SYS_CHROOT":       capability.CAP_SYS_CHROOT,

-	"SYS_PTRACE":       capability.CAP_SYS_PTRACE,

-	"SYS_BOOT":         capability.CAP_SYS_BOOT,

-	"LEASE":            capability.CAP_LEASE,

-	"SETFCAP":          capability.CAP_SETFCAP,

-	"WAKE_ALARM":       capability.CAP_WAKE_ALARM,

-	"BLOCK_SUSPEND":    capability.CAP_BLOCK_SUSPEND,

-	"AUDIT_READ":       capability.CAP_AUDIT_READ,

+	"CAP_SETPCAP":          capability.CAP_SETPCAP,

+	"CAP_SYS_MODULE":       capability.CAP_SYS_MODULE,

+	"CAP_SYS_RAWIO":        capability.CAP_SYS_RAWIO,

+	"CAP_SYS_PACCT":        capability.CAP_SYS_PACCT,

+	"CAP_SYS_ADMIN":        capability.CAP_SYS_ADMIN,

+	"CAP_SYS_NICE":         capability.CAP_SYS_NICE,

+	"CAP_SYS_RESOURCE":     capability.CAP_SYS_RESOURCE,

+	"CAP_SYS_TIME":         capability.CAP_SYS_TIME,

+	"CAP_SYS_TTY_CONFIG":   capability.CAP_SYS_TTY_CONFIG,

+	"CAP_MKNOD":            capability.CAP_MKNOD,

+	"CAP_AUDIT_WRITE":      capability.CAP_AUDIT_WRITE,

+	"CAP_AUDIT_CONTROL":    capability.CAP_AUDIT_CONTROL,

+	"CAP_MAC_OVERRIDE":     capability.CAP_MAC_OVERRIDE,

+	"CAP_MAC_ADMIN":        capability.CAP_MAC_ADMIN,

+	"CAP_NET_ADMIN":        capability.CAP_NET_ADMIN,

+	"CAP_SYSLOG":           capability.CAP_SYSLOG,

+	"CAP_CHOWN":            capability.CAP_CHOWN,

+	"CAP_NET_RAW":          capability.CAP_NET_RAW,

+	"CAP_DAC_OVERRIDE":     capability.CAP_DAC_OVERRIDE,

+	"CAP_FOWNER":           capability.CAP_FOWNER,

+	"CAP_DAC_READ_SEARCH":  capability.CAP_DAC_READ_SEARCH,

+	"CAP_FSETID":           capability.CAP_FSETID,

+	"CAP_KILL":             capability.CAP_KILL,

+	"CAP_SETGID":           capability.CAP_SETGID,

+	"CAP_SETUID":           capability.CAP_SETUID,

+	"CAP_LINUX_IMMUTABLE":  capability.CAP_LINUX_IMMUTABLE,

+	"CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE,

+	"CAP_NET_BROADCAST":    capability.CAP_NET_BROADCAST,

+	"CAP_IPC_LOCK":         capability.CAP_IPC_LOCK,

+	"CAP_IPC_OWNER":        capability.CAP_IPC_OWNER,

+	"CAP_SYS_CHROOT":       capability.CAP_SYS_CHROOT,

+	"CAP_SYS_PTRACE":       capability.CAP_SYS_PTRACE,

+	"CAP_SYS_BOOT":         capability.CAP_SYS_BOOT,

+	"CAP_LEASE":            capability.CAP_LEASE,

+	"CAP_SETFCAP":          capability.CAP_SETFCAP,

+	"CAP_WAKE_ALARM":       capability.CAP_WAKE_ALARM,

+	"CAP_BLOCK_SUSPEND":    capability.CAP_BLOCK_SUSPEND,

+	"CAP_AUDIT_READ":       capability.CAP_AUDIT_READ,

 }

 func newCapWhitelist(caps []string) (*whitelist, error) {

@@ -5,7 +5,6 @@ package cgroups

 import (

 	"bufio"

 	"fmt"

-	"io"

 	"io/ioutil"

 	"os"

 	"path/filepath"

@@ -105,12 +104,12 @@ type Mount struct {

 	Subsystems []string

 }

-func (m Mount) GetThisCgroupDir() (string, error) {

+func (m Mount) GetThisCgroupDir(cgroups map[string]string) (string, error) {

 	if len(m.Subsystems) == 0 {

 		return "", fmt.Errorf("no subsystem for mount")

 	}

-	return GetThisCgroupDir(m.Subsystems[0])

+	return getControllerPath(m.Subsystems[0], cgroups)

 }

 func GetCgroupMounts() ([]Mount, error) {

@@ -176,23 +175,22 @@ func GetAllSubsystems() ([]string, error) {

 // Returns the relative path to the cgroup docker is running in.

 func GetThisCgroupDir(subsystem string) (string, error) {

-	f, err := os.Open("/proc/self/cgroup")

+	cgroups, err := ParseCgroupFile("/proc/self/cgroup")

 	if err != nil {

 		return "", err

 	}

-	defer f.Close()

-	return ParseCgroupFile(subsystem, f)

+	return getControllerPath(subsystem, cgroups)

 }

 func GetInitCgroupDir(subsystem string) (string, error) {

-	f, err := os.Open("/proc/1/cgroup")

+

+	cgroups, err := ParseCgroupFile("/proc/1/cgroup")

 	if err != nil {

 		return "", err

 	}

-	defer f.Close()

-	return ParseCgroupFile(subsystem, f)

+	return getControllerPath(subsystem, cgroups)

 }

 func ReadProcsFile(dir string) ([]int, error) {

@@ -219,23 +217,40 @@ func ReadProcsFile(dir string) ([]int, error) {

 	return out, nil

 }

-func ParseCgroupFile(subsystem string, r io.Reader) (string, error) {

-	s := bufio.NewScanner(r)

+func ParseCgroupFile(path string) (map[string]string, error) {

+	f, err := os.Open(path)

+	if err != nil {

+		return nil, err

+	}

+	defer f.Close()

+

+	s := bufio.NewScanner(f)

+	cgroups := make(map[string]string)

 	for s.Scan() {

 		if err := s.Err(); err != nil {

-			return "", err

+			return nil, err

 		}

 		text := s.Text()

 		parts := strings.Split(text, ":")

 		for _, subs := range strings.Split(parts[1], ",") {

-			if subs == subsystem || subs == cgroupNamePrefix+subsystem {

-				return parts[2], nil

-			}

+			cgroups[subs] = parts[2]

 		}

 	}

+	return cgroups, nil

+}

+

+func getControllerPath(subsystem string, cgroups map[string]string) (string, error) {

+

+	if p, ok := cgroups[subsystem]; ok {

+		return p, nil

+	}

+

+	if p, ok := cgroups[cgroupNamePrefix+subsystem]; ok {

+		return p, nil

+	}

 	return "", NewNotFoundError(subsystem)

 }

@@ -1,5 +1,13 @@

 package configs

+import (

+	"path/filepath"

+	"strings"

+	"syscall"

+

+	"github.com/opencontainers/runc/libcontainer/label"

+)

+

 type Mount struct {

 	// Source path for the mount.

 	Source string `json:"source"`

@@ -13,6 +21,9 @@ type Mount struct {

 	// Mount flags.

 	Flags int `json:"flags"`

+	// Propagation Flags

+	PropagationFlags []int `json:"propagation_flags"`

+

 	// Mount data applied to the mount.

 	Data string `json:"data"`

@@ -25,3 +36,40 @@ type Mount struct {

 	// Optional Command to be run after Source is mounted.

 	PostmountCmds []Command `json:"postmount_cmds"`

 }

+

+func (m *Mount) Remount(rootfs string) error {

+	var (

+		dest = m.Destination

+	)

+	if !strings.HasPrefix(dest, rootfs) {

+		dest = filepath.Join(rootfs, dest)

+	}

+

+	if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags|syscall.MS_REMOUNT), ""); err != nil {

+		return err

+	}

+	return nil

+}

+

+// Do the mount operation followed by additional mounts required to take care

+// of propagation flags.

+func (m *Mount) MountPropagate(rootfs string, mountLabel string) error {

+	var (

+		dest = m.Destination

+		data = label.FormatMountLabel(m.Data, mountLabel)

+	)

+	if !strings.HasPrefix(dest, rootfs) {

+		dest = filepath.Join(rootfs, dest)

+	}

+

+	if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), data); err != nil {

+		return err

+	}

+

+	for _, pflag := range m.PropagationFlags {

+		if err := syscall.Mount("", dest, "", uintptr(pflag), ""); err != nil {

+			return err

+		}

+	}

+	return nil

+}

@@ -423,7 +423,7 @@ func (c *linuxContainer) Checkpoint(criuOpts *CriuOpts) error {

 		return err

 	}

-	err = c.criuSwrk(nil, req, criuOpts)

+	err = c.criuSwrk(nil, req, criuOpts, false)

 	if err != nil {

 		return err

 	}

@@ -516,6 +516,7 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {

 			FileLocks:      proto.Bool(criuOpts.FileLocks),

 		},

 	}

+

 	for _, m := range c.config.Mounts {

 		switch m.Device {

 		case "bind":

@@ -573,14 +574,36 @@ func (c *linuxContainer) Restore(process *Process, criuOpts *CriuOpts) error {

 		}

 	}

-	err = c.criuSwrk(process, req, criuOpts)

+	err = c.criuSwrk(process, req, criuOpts, true)

 	if err != nil {

 		return err

 	}

 	return nil

 }

-func (c *linuxContainer) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuOpts) error {

+func (c *linuxContainer) criuApplyCgroups(pid int, req *criurpc.CriuReq) error {

+	if err := c.cgroupManager.Apply(pid); err != nil {

+		return err

+	}

+

+	path := fmt.Sprintf("/proc/%d/cgroup", pid)

+	cgroupsPaths, err := cgroups.ParseCgroupFile(path)

+	if err != nil {

+		return err

+	}

+

+	for c, p := range cgroupsPaths {

+		cgroupRoot := &criurpc.CgroupRoot{

+			Ctrl: proto.String(c),

+			Path: proto.String(p),

+		}

+		req.Opts.CgRoot = append(req.Opts.CgRoot, cgroupRoot)

+	}

+

+	return nil

+}

+

+func (c *linuxContainer) criuSwrk(process *Process, req *criurpc.CriuReq, opts *CriuOpts, applyCgroups bool) error {

 	fds, err := syscall.Socketpair(syscall.AF_LOCAL, syscall.SOCK_SEQPACKET|syscall.SOCK_CLOEXEC, 0)

 	if err != nil {

 		return err

@@ -614,6 +637,13 @@ func (c *linuxContainer) criuSwrk(process *Process, req *criurpc.CriuReq, opts *

 		}

 	}()

+	if applyCgroups {

+		err := c.criuApplyCgroups(cmd.Process.Pid, req)

+		if err != nil {

+			return err

+		}

+	}

+

 	var extFds []string

 	if process != nil {

 		extFds, err = getPipeFds(cmd.Process.Pid)

@@ -6,6 +6,7 @@ import (

 	"encoding/json"

 	"fmt"

 	"io/ioutil"

+	"net"

 	"os"

 	"strconv"

 	"strings"

@@ -14,10 +15,10 @@ import (

 	"github.com/Sirupsen/logrus"

 	"github.com/opencontainers/runc/libcontainer/cgroups"

 	"github.com/opencontainers/runc/libcontainer/configs"

-	"github.com/opencontainers/runc/libcontainer/netlink"

 	"github.com/opencontainers/runc/libcontainer/system"

 	"github.com/opencontainers/runc/libcontainer/user"

 	"github.com/opencontainers/runc/libcontainer/utils"

+	"github.com/vishvananda/netlink"

 )

 type initType string

@@ -186,7 +187,17 @@ func setupUser(config *initConfig) error {

 			return err

 		}

 	}

-

+	// change the permissions on the STDIO of the current process so that when the user

+	// is changed for the container, it's STDIO of the process matches the user.

+	for _, fd := range []uintptr{

+		os.Stdin.Fd(),

+		os.Stderr.Fd(),

+		os.Stdout.Fd(),

+	} {

+		if err := syscall.Fchown(int(fd), execUser.Uid, execUser.Gid); err != nil {

+			return err

+		}

+	}

 	suppGroups := append(execUser.Sgids, addGroups...)

 	if err := syscall.Setgroups(suppGroups); err != nil {

 		return err

@@ -223,7 +234,30 @@ func setupNetwork(config *initConfig) error {

 func setupRoute(config *configs.Config) error {

 	for _, config := range config.Routes {

-		if err := netlink.AddRoute(config.Destination, config.Source, config.Gateway, config.InterfaceName); err != nil {

+		_, dst, err := net.ParseCIDR(config.Destination)

+		if err != nil {

+			return err

+		}

+		src := net.ParseIP(config.Source)

+		if src == nil {

+			return fmt.Errorf("Invalid source for route: %s", config.Source)

+		}

+		gw := net.ParseIP(config.Gateway)

+		if gw == nil {

+			return fmt.Errorf("Invalid gateway for route: %s", config.Gateway)

+		}

+		l, err := netlink.LinkByName(config.InterfaceName)

+		if err != nil {

+			return err

+		}

+		route := &netlink.Route{

+			Scope:     netlink.SCOPE_UNIVERSE,

+			Dst:       dst,

+			Src:       src,

+			Gw:        gw,

+			LinkIndex: l.Attrs().Index,

+		}

+		if err := netlink.RouteAdd(route); err != nil {

 			return err

 		}

 	}

deleted file mode 100644

@@ -1,2 +0,0 @@

-Michael Crosby <michael@crosbymichael.com> (@crosbymichael)

-Guillaume J. Charmes <guillaume@docker.com> (@creack)

deleted file mode 100644

@@ -1,31 +0,0 @@

-// Packet netlink provide access to low level Netlink sockets and messages.

-//

-// Actual implementations are in:

-// netlink_linux.go

-// netlink_darwin.go

-package netlink

-

-import (

-	"errors"

-	"net"

-)

-

-var (

-	ErrWrongSockType   = errors.New("Wrong socket type")

-	ErrShortResponse   = errors.New("Got short response from netlink")

-	ErrInterfaceExists = errors.New("Network interface already exists")

-)

-

-// A Route is a subnet associated with the interface to reach it.

-type Route struct {

-	*net.IPNet

-	Iface   *net.Interface

-	Default bool

-}

-

-// An IfAddr defines IP network settings for a given network interface

-type IfAddr struct {

-	Iface *net.Interface

-	IP    net.IP

-	IPNet *net.IPNet

-}

deleted file mode 100644

@@ -1,1321 +0,0 @@

-package netlink

-

-import (

-	"encoding/binary"

-	"fmt"

-	"io"

-	"math/rand"

-	"net"

-	"os"

-	"sync/atomic"

-	"syscall"

-	"time"

-	"unsafe"

-)

-

-const (

-	IFNAMSIZ          = 16

-	DEFAULT_CHANGE    = 0xFFFFFFFF

-	IFLA_INFO_KIND    = 1

-	IFLA_INFO_DATA    = 2

-	VETH_INFO_PEER    = 1

-	IFLA_MACVLAN_MODE = 1

-	IFLA_VLAN_ID      = 1

-	IFLA_NET_NS_FD    = 28

-	IFLA_ADDRESS      = 1

-	IFLA_BRPORT_MODE  = 4

-	SIOC_BRADDBR      = 0x89a0

-	SIOC_BRDELBR      = 0x89a1

-	SIOC_BRADDIF      = 0x89a2

-	SIOC_BRDELIF      = 0x89a3

-)

-

-const (

-	MACVLAN_MODE_PRIVATE = 1 << iota

-	MACVLAN_MODE_VEPA

-	MACVLAN_MODE_BRIDGE

-	MACVLAN_MODE_PASSTHRU

-)

-

-var nextSeqNr uint32

-

-type ifreqHwaddr struct {

-	IfrnName   [IFNAMSIZ]byte

-	IfruHwaddr syscall.RawSockaddr

-}

-

-type ifreqIndex struct {

-	IfrnName  [IFNAMSIZ]byte

-	IfruIndex int32

-}

-

-type ifreqFlags struct {

-	IfrnName  [IFNAMSIZ]byte

-	Ifruflags uint16

-}

-

-var native binary.ByteOrder

-

-var rnd = rand.New(rand.NewSource(time.Now().UnixNano()))

-

-func init() {

-	var x uint32 = 0x01020304

-	if *(*byte)(unsafe.Pointer(&x)) == 0x01 {

-		native = binary.BigEndian

-	} else {

-		native = binary.LittleEndian

-	}

-}

-

-func getIpFamily(ip net.IP) int {

-	if len(ip) <= net.IPv4len {

-		return syscall.AF_INET

-	}

-	if ip.To4() != nil {

-		return syscall.AF_INET

-	}

-	return syscall.AF_INET6

-}

-

-type NetlinkRequestData interface {

-	Len() int

-	ToWireFormat() []byte

-}

-

-type IfInfomsg struct {

-	syscall.IfInfomsg

-}

-

-func newIfInfomsg(family int) *IfInfomsg {

-	return &IfInfomsg{

-		IfInfomsg: syscall.IfInfomsg{

-			Family: uint8(family),

-		},

-	}

-}

-

-func newIfInfomsgChild(parent *RtAttr, family int) *IfInfomsg {

-	msg := newIfInfomsg(family)

-	parent.children = append(parent.children, msg)

-	return msg

-}

-

-func (msg *IfInfomsg) ToWireFormat() []byte {

-	length := syscall.SizeofIfInfomsg

-	b := make([]byte, length)

-	b[0] = msg.Family

-	b[1] = 0

-	native.PutUint16(b[2:4], msg.Type)

-	native.PutUint32(b[4:8], uint32(msg.Index))

-	native.PutUint32(b[8:12], msg.Flags)

-	native.PutUint32(b[12:16], msg.Change)

-	return b

-}

-

-func (msg *IfInfomsg) Len() int {

-	return syscall.SizeofIfInfomsg

-}

-

-type IfAddrmsg struct {

-	syscall.IfAddrmsg

-}

-

-func newIfAddrmsg(family int) *IfAddrmsg {

-	return &IfAddrmsg{

-		IfAddrmsg: syscall.IfAddrmsg{

-			Family: uint8(family),

-		},

-	}

-}

-

-func (msg *IfAddrmsg) ToWireFormat() []byte {

-	length := syscall.SizeofIfAddrmsg

-	b := make([]byte, length)

-	b[0] = msg.Family

-	b[1] = msg.Prefixlen

-	b[2] = msg.Flags

-	b[3] = msg.Scope

-	native.PutUint32(b[4:8], msg.Index)

-	return b

-}

-

-func (msg *IfAddrmsg) Len() int {

-	return syscall.SizeofIfAddrmsg

-}

-

-type RtMsg struct {

-	syscall.RtMsg

-}

-

-func newRtMsg() *RtMsg {

-	return &RtMsg{

-		RtMsg: syscall.RtMsg{

-			Table:    syscall.RT_TABLE_MAIN,

-			Scope:    syscall.RT_SCOPE_UNIVERSE,

-			Protocol: syscall.RTPROT_BOOT,

-			Type:     syscall.RTN_UNICAST,

-		},

-	}

-}

-

-func (msg *RtMsg) ToWireFormat() []byte {

-	length := syscall.SizeofRtMsg

-	b := make([]byte, length)

-	b[0] = msg.Family

-	b[1] = msg.Dst_len

-	b[2] = msg.Src_len

-	b[3] = msg.Tos

-	b[4] = msg.Table

-	b[5] = msg.Protocol

-	b[6] = msg.Scope

-	b[7] = msg.Type

-	native.PutUint32(b[8:12], msg.Flags)

-	return b

-}

-

-func (msg *RtMsg) Len() int {

-	return syscall.SizeofRtMsg

-}

-

-func rtaAlignOf(attrlen int) int {

-	return (attrlen + syscall.RTA_ALIGNTO - 1) & ^(syscall.RTA_ALIGNTO - 1)

-}

-

-type RtAttr struct {

-	syscall.RtAttr

-	Data     []byte

-	children []NetlinkRequestData

-}

-

-func newRtAttr(attrType int, data []byte) *RtAttr {

-	return &RtAttr{

-		RtAttr: syscall.RtAttr{

-			Type: uint16(attrType),

-		},

-		children: []NetlinkRequestData{},

-		Data:     data,

-	}

-}

-

-func newRtAttrChild(parent *RtAttr, attrType int, data []byte) *RtAttr {

-	attr := newRtAttr(attrType, data)

-	parent.children = append(parent.children, attr)

-	return attr

-}

-

-func (a *RtAttr) Len() int {

-	if len(a.children) == 0 {

-		return (syscall.SizeofRtAttr + len(a.Data))

-	}

-

-	l := 0

-	for _, child := range a.children {

-		l += child.Len()

-	}

-	l += syscall.SizeofRtAttr

-	return rtaAlignOf(l + len(a.Data))

-}

-

-func (a *RtAttr) ToWireFormat() []byte {

-	length := a.Len()

-	buf := make([]byte, rtaAlignOf(length))

-

-	if a.Data != nil {

-		copy(buf[4:], a.Data)

-	} else {

-		next := 4

-		for _, child := range a.children {

-			childBuf := child.ToWireFormat()

-			copy(buf[next:], childBuf)

-			next += rtaAlignOf(len(childBuf))

-		}

-	}

-

-	if l := uint16(length); l != 0 {

-		native.PutUint16(buf[0:2], l)

-	}

-	native.PutUint16(buf[2:4], a.Type)

-	return buf

-}

-

-func uint32Attr(t int, n uint32) *RtAttr {

-	buf := make([]byte, 4)

-	native.PutUint32(buf, n)

-	return newRtAttr(t, buf)

-}

-

-type NetlinkRequest struct {

-	syscall.NlMsghdr

-	Data []NetlinkRequestData

-}

-

-func (rr *NetlinkRequest) ToWireFormat() []byte {

-	length := rr.Len

-	dataBytes := make([][]byte, len(rr.Data))

-	for i, data := range rr.Data {

-		dataBytes[i] = data.ToWireFormat()

-		length += uint32(len(dataBytes[i]))

-	}

-	b := make([]byte, length)

-	native.PutUint32(b[0:4], length)

-	native.PutUint16(b[4:6], rr.Type)

-	native.PutUint16(b[6:8], rr.Flags)

-	native.PutUint32(b[8:12], rr.Seq)

-	native.PutUint32(b[12:16], rr.Pid)

-

-	next := 16

-	for _, data := range dataBytes {

-		copy(b[next:], data)

-		next += len(data)

-	}

-	return b

-}

-

-func (rr *NetlinkRequest) AddData(data NetlinkRequestData) {

-	if data != nil {

-		rr.Data = append(rr.Data, data)

-	}

-}

-

-func newNetlinkRequest(proto, flags int) *NetlinkRequest {

-	return &NetlinkRequest{

-		NlMsghdr: syscall.NlMsghdr{

-			Len:   uint32(syscall.NLMSG_HDRLEN),

-			Type:  uint16(proto),

-			Flags: syscall.NLM_F_REQUEST | uint16(flags),

-			Seq:   atomic.AddUint32(&nextSeqNr, 1),

-		},

-	}

-}

-

-type NetlinkSocket struct {

-	fd  int

-	lsa syscall.SockaddrNetlink

-}

-

-func getNetlinkSocket() (*NetlinkSocket, error) {

-	fd, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_RAW, syscall.NETLINK_ROUTE)

-	if err != nil {

-		return nil, err

-	}

-	s := &NetlinkSocket{

-		fd: fd,

-	}

-	s.lsa.Family = syscall.AF_NETLINK

-	if err := syscall.Bind(fd, &s.lsa); err != nil {

-		syscall.Close(fd)

-		return nil, err

-	}

-

-	return s, nil

-}

-

-func (s *NetlinkSocket) Close() {

-	syscall.Close(s.fd)

-}

-

-func (s *NetlinkSocket) Send(request *NetlinkRequest) error {

-	if err := syscall.Sendto(s.fd, request.ToWireFormat(), 0, &s.lsa); err != nil {

-		return err

-	}

-	return nil

-}

-

-func (s *NetlinkSocket) Receive() ([]syscall.NetlinkMessage, error) {

-	rb := make([]byte, syscall.Getpagesize())

-	nr, _, err := syscall.Recvfrom(s.fd, rb, 0)

-	if err != nil {

-		return nil, err

-	}

-	if nr < syscall.NLMSG_HDRLEN {

-		return nil, ErrShortResponse

-	}

-	rb = rb[:nr]

-	return syscall.ParseNetlinkMessage(rb)

-}

-

-func (s *NetlinkSocket) GetPid() (uint32, error) {

-	lsa, err := syscall.Getsockname(s.fd)

-	if err != nil {

-		return 0, err

-	}

-	switch v := lsa.(type) {

-	case *syscall.SockaddrNetlink:

-		return v.Pid, nil

-	}

-	return 0, ErrWrongSockType

-}

-

-func (s *NetlinkSocket) CheckMessage(m syscall.NetlinkMessage, seq, pid uint32) error {

-	if m.Header.Seq != seq {

-		return fmt.Errorf("netlink: invalid seq %d, expected %d", m.Header.Seq, seq)

-	}

-	if m.Header.Pid != pid {

-		return fmt.Errorf("netlink: wrong pid %d, expected %d", m.Header.Pid, pid)

-	}

-	if m.Header.Type == syscall.NLMSG_DONE {

-		return io.EOF

-	}

-	if m.Header.Type == syscall.NLMSG_ERROR {

-		e := int32(native.Uint32(m.Data[0:4]))

-		if e == 0 {

-			return io.EOF

-		}

-		return syscall.Errno(-e)

-	}

-	return nil

-}

-

-func (s *NetlinkSocket) HandleAck(seq uint32) error {

-	pid, err := s.GetPid()

-	if err != nil {

-		return err

-	}

-

-outer:

-	for {

-		msgs, err := s.Receive()

-		if err != nil {

-			return err

-		}

-		for _, m := range msgs {

-			if err := s.CheckMessage(m, seq, pid); err != nil {

-				if err == io.EOF {

-					break outer

-				}

-				return err

-			}

-		}

-	}

-

-	return nil

-}

-

-func zeroTerminated(s string) []byte {

-	return []byte(s + "\000")

-}

-

-func nonZeroTerminated(s string) []byte {

-	return []byte(s)

-}

-