netdev - Re: RFC Hanging clean-up of a namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20120119.152752.318442465605898328.davem@davemloft.net>
Date:	Thu, 19 Jan 2012 15:27:52 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	equinox@...c24.net
Cc:	hans.schillstrom@...csson.com, netdev@...r.kernel.org,
	ebiederm@...ssion.com
Subject: Re: RFC Hanging clean-up of a namespace

From: David Lamparter <equinox@...c24.net>
Date: Thu, 19 Jan 2012 20:53:49 +0100

> On Thu, Jan 19, 2012 at 02:31:05PM -0500, David Miller wrote:
>> >> >> Keeping the timewait sockets around is necessary to absorb any lingering
>> >> >> packets in the network meant for those sockets.
> [...]
>> >> The assumption is that the address is moving, which might not be true.
>> > 
>> > I don't understand what you mean, what address may not be moving?
>> > 
>> > We're talking about dropping a netns. All of its addresses disappear,
>> > all of its soft devices disappear. Its hard devices fall back into the
>> > init namespace, is that what you're referring to?
>> 
>> And then you immediately start up a new netns with the same address
>> and then resets go back to lingering TCP packets the time-waits would
>> have consumed.
>> 
>> The reason this is different from a host reboot is that a host reboot
>> takes some amount of time, which even if around 30 seconds is superior
>> in behavior to what can happen with netns which can be created almost
>> instantly.
> 
> Arjan van de Ven booted Linux in 5 seconds in 2008,
> cf. http://lwn.net/Articles/299483/
> 
> On the TCP timewait scale of time, this is pretty much "immediate".
> 
> [..]
>> Then if a new netns is created that tries to reuse the address used by
>> the mini-netns which hasn't cleared yet, you give -EAGAIN until all
>> the timewaits expire.
> 
> The effect of this is that you end up being unable to reboot lxc based
> virtualised hosts without waiting 2 minutes for the TCP timers to
> expire. That sounds completely unacceptable to me.

All you are saying to me is that we are on a trajectory to major problems
if it becomes pervasive that time-wait gets cancelled out and addresses
then get reused so quickly.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html