Re: Two issues with Netplex
Thomas Calderon <[email protected]> Mon, 11 Nov 2013 09:15:01 +0100
| Newsgroups | gmane.comp.lang.ocaml.lib.net.devel |
|---|---|
| Message-ID | <CA+1ewKb9MO-mNvzmCkJ2zWF7moa8yRNnBuOLVO4qQWGCG-B-OA@mail.gmail.com> |
--===============1507122425415240141== Content-Type: multipart/alternative; boundary=047d7bdc9e684c100204eae2558f --047d7bdc9e684c100204eae2558f Content-Type: text/plain; charset=UTF-8 Hi Gerd, On Sun, Nov 10, 2013 at 1:24 PM, Gerd Stolpmann <[email protected]>wrote: > Am Donnerstag, den 07.11.2013, 19:34 +0100 schrieb Thomas Calderon: > > Hi there, > > > > > > I am having two issues with netplex at the moment. > > > > > > The first one is related to rpc-ssl support. The netplex service is > > configured with SSL enabled (TLSv1) and if you are connecting with a > > client that forces newer TLS versions (openssl s_client -connect > > host:port -tls1_1), an Ssl exception is raised. > > Well, the ocaml-ssl bindings only offer TLS-1.0, even if openssl > supports more. That's basically a problem of the bindings. (Fyi, I'm > currently implementing complete bindings for GnuTLS to overcome all > limitations with ocaml-ssl.) > OK that's what I thought as well, I added the missing symbols to ocaml-ssland some other missing features (DH/ ECDH). This is immediately available from the git version of the code, but having a GnuTLS alternative is also good news. > > > However, the container process still continues to run but is not able > > to process any data, netplex then spawn a new child process to handle > > subsequent connections. > > From the client side, the socket is closed and we end up not knowing > > in which state the "zombie" container is. > > We looked for a proper way to fix this in our code, but the exception > > is caught from within rpc_netplex.ml (line 183), is there a proper way > > to handle this case from our code or is it only a fix you can > > provide ? > > You could close fd, and then call when_done() from the is_error > callback. This is how it is indicated that the task is done. > Alright I'll look into this to fix the issue with the current ocaml-sslbindings. > > Probably this is really the best thing you can do here. When I > programmed this I could probably not imagine what kind of things can go > wrong at this spot, and hence opted to do nothing. > > > The second issue is related the function > > "Netplex_cenv.system_shutdown()". This function can be used to > > completely shutdown the service, I would like to know if it is > > possible to restrict this function to be only callable from within the > > controller instance ? This way a container process could not call this > > function and stop the service and all the other containers from > > running. > > Without modifying the sources, there is probably no way to get this > effect. > > What's actually happening is that the controller accepts requests on the > admin socket (which is a Unix domain socket visible in the filesystem), > and if the container wants to do a system shutdown, is just connects to > this socket, and invokes the right RPC. I don't see how you could > prevent the container from doing so even if the connect code were > removed from the netplex sources. Maybe the only way is to set a > password on this service, and not telling the container the password. > OK thanks for your input on that. > > Out of curiosity, what's your concern with system shutdowns? > Netplex controller can be seen as task schedulers spawning child processes to handle requests. Now let's suppose the service your are offering becomes essential on your system, then availability becomes something you really care about. For example if one of the container's flow of execution is compromised, you can can live with that as long as it cannot hurt your availability or use privileged APIs. I'll have a look at the admin socket and check if nothing more can be done here. Thanks for your answers. Thomas C. > > Gerd > > > > > Thanks. > > > > > > Thomas C. > > > > > > > ------------------------------------------------------------------------------ > > November Webinars for C, C++, Fortran Developers > > Accelerate application performance with scalable programming models. > Explore > > techniques for threading, error checking, porting, and tuning. Get the > most > > from the latest Intel processors and coprocessors. See abstracts and > register > > > http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk > > _______________________________________________ Ocamlnet-devel mailing > list [email protected] > https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel > > -- > ------------------------------------------------------------ > Gerd Stolpmann, Darmstadt, Germany [email protected] > My OCaml site: http://www.camlcity.org > Contact details: http://www.camlcity.org/contact.html > Company homepage: http://www.gerd-stolpmann.de > ------------------------------------------------------------ > > --047d7bdc9e684c100204eae2558f Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi <span>Gerd</span>,<br><br><br><div class=3D"gmail_extra= "><br><br><div class=3D"gmail_quote">On Sun, Nov 10, 2013 at 1:24 PM, <span= >Gerd</span> <span>Stolpmann</span> <span dir=3D"ltr"><<a href=3D"mailto= :[email protected]" target=3D"_blank">info@<span>gerd</span>-<span>sto= lpmann</span>.<span>de</span></a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p= x #ccc solid;padding-left:1ex">Am Donnerstag, den 07.11.2013, 19:34 +0100 s= chrieb Thomas Calderon:<br> <div>> Hi there,<br> ><br> ><br> > I am having two issues with netplex at the moment.<br> ><br> ><br> > The first one is related to rpc-ssl support. The netplex service is<br= > > configured with SSL enabled (TLSv1) and if you are connecting with a<b= r> > client that forces newer TLS versions (openssl s_client -connect<br> > host:port -tls1_1), an Ssl exception is raised.<br> <br> </div>Well, the ocaml-ssl bindings only offer TLS-1.0, even if openssl<br> supports more. That's basically a problem of the bindings. (Fyi, I'= m<br> currently implementing complete bindings for GnuTLS to overcome all<br> limitations with ocaml-ssl.)<br></blockquote><div><br></div><div>OK that= 9;s what I thought as well, I added the missing symbols to <span>ocaml</spa= n>-<span>ssl</span> and some other missing features (DH/<span>ECDH</span>).= This is immediately available from the git version of the code, but having= a <span>GnuTLS</span> alternative is also good news.<br> </div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 = 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div><br> > However, the container process still continues to run but is not able<= br> > to process any data, netplex then spawn a new child process to handle<= br> > subsequent connections.<br> > From the client side, the socket is closed and we end up not knowing<b= r> > in which state the "zombie" container is.<br> > We looked for a proper way to fix this in our code, but the exception<= br> > is caught from within <a href=3D"http://rpc_netplex.ml" target=3D"_bla= nk">rpc_netplex.ml</a> (line 183), is there a proper way<br> > to handle this case from our code or is it only a fix you can<br> > provide ?<br> <br> </div>You could close fd, and then call when_done() from the is_error<br> callback. This is how it is indicated that the task is done.<br></blockquot= e><div><br></div><div>Alright I'll look into this to fix the issue with= the current <span>ocaml</span>-<span>ssl</span> bindings.<br> </div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 = 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> Probably this is really the best thing you can do here. When I<br> programmed this I could probably not imagine what kind of things can go<br> wrong at this spot, and hence opted to do nothing.<br> <div><br> > The second issue is related the function<br> > "Netplex_cenv.system_shutdown()". This function can be used = to<br> > completely shutdown the service, I would like to know if it is<br> > possible to restrict this function to be only callable from within the= <br> > controller instance ? This way a container process could not call this= <br> > function and stop the service and all the other containers from<br> > running.<br> <br> </div>Without modifying the sources, there is probably no way to get this<b= r> effect.<br> <br> What's actually happening is that the controller accepts requests on th= e<br> admin socket (which is a Unix domain socket visible in the filesystem),<br> and if the container wants to do a system shutdown, is just connects to<br> this socket, and invokes the right RPC. I don't see how you could<br> prevent the container from doing so even if the connect code were<br> removed from the netplex sources. Maybe the only way is to set a<br> password on this service, and not telling the container the password.<br></= blockquote><div><br></div><div>OK thanks for your input on that.<br></div><= div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8e= x;border-left:1px #ccc solid;padding-left:1ex"> <br> Out of curiosity, what's your concern with system shutdowns?<br></block= quote><div><br></div><div><span>Netplex</span> controller can be seen as ta= sk schedulers spawning child processes to handle requests. <br>Now let'= s suppose the service your are offering becomes essential on your system, t= hen availability becomes something you really care about. For example if on= e of the container's <span>flow</span> of execution is compromised, you= can can live with that as long as it cannot hurt your availability or use = privileged APIs.<br> <br></div><div>I'll have a look at the admin socket and check if nothin= g more can be done here.<br><br></div><div>Thanks for your answers.<br><br>= Thomas C.<br> </div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0 = 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> Gerd<br> <br> ><br> > Thanks.<br> ><br> ><br> > Thomas C.<br> ><br> ><br> > ----------------------------------------------------------------------= --------<br> > November Webinars for C, C++, Fortran Developers<br> > Accelerate application performance with scalable programming models. E= xplore<br> > techniques for threading, error checking, porting, and tuning. Get the= most<br> > from the latest Intel processors and coprocessors. See abstracts and r= egister<br> > <a href=3D"http://pubads.g.doubleclick.net/gampad/clk?id=3D60136231&am= p;iu=3D/4140/ostg.clktrk" target=3D"_blank">http://pubads.g.doubleclick.net= /gampad/clk?id=3D60136231&iu=3D/4140/ostg.clktrk</a><br> > _______________________________________________ Ocamlnet-devel mailing= list <a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a> <a href=3D"https://lists.sour= ceforge.net/lists/listinfo/ocamlnet-devel" target=3D"_blank">https://lists.= sourceforge.net/lists/listinfo/ocamlnet-devel</a><br> <span><font color=3D"#888888"><br> --<br> ------------------------------------------------------------<br> Gerd Stolpmann, Darmstadt, Germany =C2=A0 =C2=A0<a href=3D"mailto:gerd@gerd= -stolpmann.de" target=3D"_blank">[email protected]</a><br> My OCaml site: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.caml= city.org" target=3D"_blank">http://www.camlcity.org</a><br> Contact details: =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.camlcity.= org/contact.html" target=3D"_blank">http://www.camlcity.org/contact.html</a= ><br> Company homepage: =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.gerd-stolpmann= .de" target=3D"_blank">http://www.gerd-stolpmann.de</a><br> ------------------------------------------------------------<br> <br> </font></span></blockquote></div><br></div></div> --047d7bdc9e684c100204eae2558f-- --===============1507122425415240141== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ November Webinars for C, C++, Fortran Developers Accelerate application performance with scalable programming models. Explore techniques for threading, error checking, porting, and tuning. Get the most from the latest Intel processors and coprocessors. See abstracts and register http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk --===============1507122425415240141== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ocamlnet-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel --===============1507122425415240141==--