review: move the bridge attach helper beside its caller and pass the lint gate

attachBridgeUp is bridge-specific (IFLA_MASTER is its whole point) and the
network package carried no backend plumbing before it, so it moves unexported
into network/bridge; the two tuning constants TuneTAP shares are exported
instead. The G115 casts carry kernel-issued ifindexes and a guarded MTU, so
they take nolint with reasons. Two-line godocs tightened to one.

Author: CMGS

network/bridge/bridge_linux.go

@@ -10,6 +10,8 @@ import (
 
 	"github.com/projecteru2/core/log"
 	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netlink/nl"
+	"golang.org/x/sys/unix"
 
 	"github.com/cocoonstack/cocoon/config"
 	"github.com/cocoonstack/cocoon/gc"
@@ -118,7 +120,7 @@ func (b *Bridge) Add(ctx context.Context, vmID string, vmCfg *types.VMConfig, sp
 		}
 		added = append(added, spec.Index)
 
-		if aErr := network.AttachBridgeUp(tapIndex, b.bridgeIdx, br.Attrs().MTU); aErr != nil {
+		if aErr := attachBridgeUp(tapIndex, b.bridgeIdx, br.Attrs().MTU); aErr != nil {
 			return nil, aErr
 		}
 
@@ -179,6 +181,26 @@ func CleanupTAPs(vmIDs []string) []string {
 	return cleaned
 }
 
+// attachBridgeUp enslaves a TAP to the bridge, applies MTU/txqlen/GRO tuning and brings it up in one RTM_SETLINK, paying the node-wide rtnl lock once.
+func attachBridgeUp(tapIndex, bridgeIndex, mtu int) error {
+	req := nl.NewNetlinkRequest(unix.RTM_SETLINK, unix.NLM_F_ACK)
+	msg := nl.NewIfInfomsg(unix.AF_UNSPEC)
+	msg.Index = int32(tapIndex) //nolint:gosec // kernel-issued ifindex fits int32
+	msg.Flags = unix.IFF_UP
+	msg.Change = unix.IFF_UP
+	req.AddData(msg)
+	req.AddData(nl.NewRtAttr(unix.IFLA_MASTER, nl.Uint32Attr(uint32(bridgeIndex)))) //nolint:gosec // kernel-issued ifindex fits uint32
+	req.AddData(nl.NewRtAttr(unix.IFLA_TXQLEN, nl.Uint32Attr(network.TAPTxQueueLen)))
+	req.AddData(nl.NewRtAttr(unix.IFLA_GRO_MAX_SIZE, nl.Uint32Attr(network.GROMaxSize)))
+	if mtu > 0 {
+		req.AddData(nl.NewRtAttr(unix.IFLA_MTU, nl.Uint32Attr(uint32(mtu)))) //nolint:gosec // guarded > 0; kernel MTU fits uint32
+	}
+	if _, err := req.Execute(unix.NETLINK_ROUTE, 0); err != nil {
+		return fmt.Errorf("attach tap %d to bridge %d: %w", tapIndex, bridgeIndex, err)
+	}
+	return nil
+}
+
 func tearDownTAPs(vmID string, indices []int, bestEffort bool) error {
 	for _, i := range indices {
 		name := tapName(vmID, i)

network/tap_linux.go

@@ -6,20 +6,17 @@ import (
 	"fmt"
 
 	"github.com/vishvananda/netlink"
-	"github.com/vishvananda/netlink/nl"
-	"golang.org/x/sys/unix"
 )
 
 const (
-	// tapTxQueueLen absorbs traffic bursts (especially UDP) without dropping; the kernel default of 1000 is too small for VM workloads.
-	tapTxQueueLen = 10000
+	// TAPTxQueueLen absorbs traffic bursts (especially UDP) without dropping; the kernel default of 1000 is too small for VM workloads.
+	TAPTxQueueLen = 10000
 
-	// groMaxSize matches the maximum virtio-net segment size so the kernel aggregates inbound packets before CH reads them.
-	groMaxSize = 65536
+	// GROMaxSize matches the maximum virtio-net segment size so the kernel aggregates inbound packets before CH reads them.
+	GROMaxSize = 65536
 )
 
 // CreateTAP adds a multi-queue TAP sized for numQueues virtio-net queues and returns its index, then closes the kernel fds (CH/QEMU reopen it by name).
-// TUNSETIFF carries no index, so netlink resolves one after the ioctl and swallows a failure to; an unresolved index must not reach a caller as valid.
 func CreateTAP(name string, numQueues int) (int, error) {
 	// queue_pairs = num_queues / 2 (TX+RX pair); multi-queue needs >1 and must match the VMM's IFF_MULTI_QUEUE expectation.
 	queuePairs := max(1, numQueues/2) //nolint:mnd
@@ -41,38 +38,18 @@ func CreateTAP(name string, numQueues int) (int, error) {
 	for _, fd := range tap.Fds {
 		_ = fd.Close()
 	}
+	// netlink's post-TUNSETIFF index lookup drops its error, so 0 can land here.
 	index := tap.Attrs().Index
 	if index == 0 {
 		return 0, fmt.Errorf("resolve index of tap %s", name)
 	}
 	return index, nil
 }
 
-// AttachBridgeUp enslaves a TAP to a bridge, applies the queue and GRO tuning and brings it up, in a single RTM_SETLINK.
-// Every netlink write serializes on the kernel's node-wide rtnl lock, so on a dense fill the op count, not the work, is the cost.
-func AttachBridgeUp(tapIndex, bridgeIndex, mtu int) error {
-	req := nl.NewNetlinkRequest(unix.RTM_SETLINK, unix.NLM_F_ACK)
-	msg := nl.NewIfInfomsg(unix.AF_UNSPEC)
-	msg.Index = int32(tapIndex)
-	msg.Flags = unix.IFF_UP
-	msg.Change = unix.IFF_UP
-	req.AddData(msg)
-	req.AddData(nl.NewRtAttr(unix.IFLA_MASTER, nl.Uint32Attr(uint32(bridgeIndex))))
-	req.AddData(nl.NewRtAttr(unix.IFLA_TXQLEN, nl.Uint32Attr(tapTxQueueLen)))
-	req.AddData(nl.NewRtAttr(unix.IFLA_GRO_MAX_SIZE, nl.Uint32Attr(groMaxSize)))
-	if mtu > 0 {
-		req.AddData(nl.NewRtAttr(unix.IFLA_MTU, nl.Uint32Attr(uint32(mtu))))
-	}
-	if _, err := req.Execute(unix.NETLINK_ROUTE, 0); err != nil {
-		return fmt.Errorf("attach tap %d to bridge %d: %w", tapIndex, bridgeIndex, err)
-	}
-	return nil
-}
-
 // TuneTAP applies best-effort performance tuning to a TAP device.
 func TuneTAP(link netlink.Link) error {
-	if err := netlink.LinkSetTxQLen(link, tapTxQueueLen); err != nil {
+	if err := netlink.LinkSetTxQLen(link, TAPTxQueueLen); err != nil {
 		return err
 	}
-	return netlink.LinkSetGROMaxSize(link, groMaxSize)
+	return netlink.LinkSetGROMaxSize(link, GROMaxSize)
 }