Re: Two issues with Netplex

--===============3550739333501108187==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-YLbjabcbV/rdnKuvBHLR"


--=-YLbjabcbV/rdnKuvBHLR
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable

Am Donnerstag, den 07.11.2013, 19:34 +0100 schrieb Thomas Calderon:
> Hi there,
>=20
>=20
> I am having two issues with netplex at the moment.
>=20
>=20
> The first one is related to rpc-ssl support. The netplex service is
> configured with SSL enabled (TLSv1) and if you are connecting with a
> client that forces newer TLS versions (openssl s_client -connect
> host:port -tls1_1), an Ssl exception is raised.

Well, the ocaml-ssl bindings only offer TLS-1.0, even if openssl
supports more. That's basically a problem of the bindings. (Fyi, I'm
currently implementing complete bindings for GnuTLS to overcome all
limitations with ocaml-ssl.)

> However, the container process still continues to run but is not able
> to process any data, netplex then spawn a new child process to handle
> subsequent connections.=20
> From the client side, the socket is closed and we end up not knowing
> in which state the "zombie" container is.
> We looked for a proper way to fix this in our code, but the exception
> is caught from within rpc_netplex.ml (line 183), is there a proper way
> to handle this case from our code or is it only a fix you can
> provide ?

You could close fd, and then call when_done() from the is_error
callback. This is how it is indicated that the task is done.

Probably this is really the best thing you can do here. When I
programmed this I could probably not imagine what kind of things can go
wrong at this spot, and hence opted to do nothing.

> The second issue is related the function
> "Netplex_cenv.system_shutdown()". This function can be used to
> completely shutdown the service, I would like to know if it is
> possible to restrict this function to be only callable from within the
> controller instance ? This way a container process could not call this
> function and stop the service and all the other containers from
> running.

Without modifying the sources, there is probably no way to get this
effect.

What's actually happening is that the controller accepts requests on the
admin socket (which is a Unix domain socket visible in the filesystem),
and if the container wants to do a system shutdown, is just connects to
this socket, and invokes the right RPC. I don't see how you could
prevent the container from doing so even if the connect code were
removed from the netplex sources. Maybe the only way is to set a
password on this service, and not telling the container the password.

Out of curiosity, what's your concern with system shutdowns?=20

Gerd

>=20
> Thanks.
>=20
>=20
> Thomas C.
>=20
>=20
> -------------------------------------------------------------------------=
-----
> November Webinars for C, C++, Fortran Developers
> Accelerate application performance with scalable programming models. Expl=
ore
> techniques for threading, error checking, porting, and tuning. Get the mo=
st=20
> from the latest Intel processors and coprocessors. See abstracts and regi=
ster
> http://pubads.g.doubleclick.net/gampad/clk?id=3D60136231&iu=3D/4140/ostg.=
clktrk
> _______________________________________________ Ocamlnet-devel mailing li=
st [email protected] https://lists.sourceforge.net/lists=
/listinfo/ocamlnet-devel

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------


--=-YLbjabcbV/rdnKuvBHLR
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAABAgAGBQJSf3ruAAoJEAaM4b9ZLB5TM00H/0WFDLfDb+8t/DQjNe44weI7
vpQKhVvkie0pkqMkHR8pW18FSi7zaiSx5qXgnmER1wPH75RMQ9+WiU241qOUvIL9
GfuHFjYuPz/CLfACbvffTQ80EFnnCCbQfmpCfqmvFkZ8eXL7noUUrAVpZCwqdQMD
NEqq2WWSc5a0IrTHQKOQIoZWNQTGWgOt85UmYS1C+ZW2Nyb+hFROTY8QZoqWKfmD
LiRbNF5eOtaq1GwV8qQsUCBm0+o/1AqStZqIT8teKj9EZ17EIl1LocQ6aH99NwnF
KPGHoBswZ7PpImGE/nEHS18hrsDj20KlNJr3Y9vLnTxcHFTlNu+olmrOs+LOUJw=
=rjBo
-----END PGP SIGNATURE-----

--=-YLbjabcbV/rdnKuvBHLR--



--===============3550739333501108187==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
November Webinars for C, C++, Fortran Developers
Accelerate application performance with scalable programming models. Explore
techniques for threading, error checking, porting, and tuning. Get the most 
from the latest Intel processors and coprocessors. See abstracts and register
http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk
--===============3550739333501108187==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============3550739333501108187==--