Re: Two issues with Netplex
Thomas Calderon <[email protected]> Thu, 5 Dec 2013 09:38:29 +0100
| Newsgroups | gmane.comp.lang.ocaml.lib.net.devel |
|---|---|
| Message-ID | <CA+1ewKaZw1cS+TETW=3yaD2PcBpr9eze1Xycxda0iibufXA0Fg@mail.gmail.com> |
--089e013c5af06a76fd04ecc57595 Content-Type: multipart/alternative; boundary=089e013c5af06a76f804ecc57593 --089e013c5af06a76f804ecc57593 Content-Type: text/plain; charset=UTF-8 Hi Gerd, I have successfully tested the fix you mentioned in your reply. You'll find attached a patch to address the issue (for ocamlnet-3.6.6) of child containers becoming zombies when the socket connection fails unexpectedly. It would be great if this modification could make it upstream. Regarding the system_shutdown() issue we discussed I have not made any progresses, it would be great if we could filter the RPC calls available to child containers given a policy defined by the controller process. Regards. Thomas C. On Mon, Nov 11, 2013 at 9:15 AM, Thomas Calderon <[email protected]>wrote: > Hi Gerd, > > > > > On Sun, Nov 10, 2013 at 1:24 PM, Gerd Stolpmann <[email protected]>wrote: > >> Am Donnerstag, den 07.11.2013, 19:34 +0100 schrieb Thomas Calderon: >> > Hi there, >> > >> > >> > I am having two issues with netplex at the moment. >> > >> > >> > The first one is related to rpc-ssl support. The netplex service is >> > configured with SSL enabled (TLSv1) and if you are connecting with a >> > client that forces newer TLS versions (openssl s_client -connect >> > host:port -tls1_1), an Ssl exception is raised. >> >> Well, the ocaml-ssl bindings only offer TLS-1.0, even if openssl >> supports more. That's basically a problem of the bindings. (Fyi, I'm >> currently implementing complete bindings for GnuTLS to overcome all >> limitations with ocaml-ssl.) >> > > OK that's what I thought as well, I added the missing symbols to ocaml-ssland some other missing features (DH/ > ECDH). This is immediately available from the git version of the code, > but having a GnuTLS alternative is also good news. > > >> >> > However, the container process still continues to run but is not able >> > to process any data, netplex then spawn a new child process to handle >> > subsequent connections. >> > From the client side, the socket is closed and we end up not knowing >> > in which state the "zombie" container is. >> > We looked for a proper way to fix this in our code, but the exception >> > is caught from within rpc_netplex.ml (line 183), is there a proper way >> > to handle this case from our code or is it only a fix you can >> > provide ? >> >> You could close fd, and then call when_done() from the is_error >> callback. This is how it is indicated that the task is done. >> > > Alright I'll look into this to fix the issue with the current ocaml-sslbindings. > > >> >> Probably this is really the best thing you can do here. When I >> programmed this I could probably not imagine what kind of things can go >> wrong at this spot, and hence opted to do nothing. >> >> > The second issue is related the function >> > "Netplex_cenv.system_shutdown()". This function can be used to >> > completely shutdown the service, I would like to know if it is >> > possible to restrict this function to be only callable from within the >> > controller instance ? This way a container process could not call this >> > function and stop the service and all the other containers from >> > running. >> >> Without modifying the sources, there is probably no way to get this >> effect. >> >> What's actually happening is that the controller accepts requests on the >> admin socket (which is a Unix domain socket visible in the filesystem), >> and if the container wants to do a system shutdown, is just connects to >> this socket, and invokes the right RPC. I don't see how you could >> prevent the container from doing so even if the connect code were >> removed from the netplex sources. Maybe the only way is to set a >> password on this service, and not telling the container the password. >> > > OK thanks for your input on that. > > >> >> Out of curiosity, what's your concern with system shutdowns? >> > > Netplex controller can be seen as task schedulers spawning child > processes to handle requests. > Now let's suppose the service your are offering becomes essential on your > system, then availability becomes something you really care about. For > example if one of the container's flow of execution is compromised, you > can can live with that as long as it cannot hurt your availability or use > privileged APIs. > > I'll have a look at the admin socket and check if nothing more can be done > here. > > Thanks for your answers. > > Thomas C. > > >> >> Gerd >> >> > >> > Thanks. >> > >> > >> > Thomas C. >> > >> > >> > >> ------------------------------------------------------------------------------ >> > November Webinars for C, C++, Fortran Developers >> > Accelerate application performance with scalable programming models. >> Explore >> > techniques for threading, error checking, porting, and tuning. Get the >> most >> > from the latest Intel processors and coprocessors. See abstracts and >> register >> > >> http://pubads.g.doubleclick.net/gampad/clk?id=60136231&iu=/4140/ostg.clktrk >> > _______________________________________________ Ocamlnet-devel mailing >> list [email protected] >> https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel >> >> -- >> ------------------------------------------------------------ >> Gerd Stolpmann, Darmstadt, Germany [email protected] >> My OCaml site: http://www.camlcity.org >> Contact details: http://www.camlcity.org/contact.html >> Company homepage: http://www.gerd-stolpmann.de >> ------------------------------------------------------------ >> >> > --089e013c5af06a76f804ecc57593 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi Gerd,<div><br></div><div>I have successfully tested the= fix you mentioned in your reply.=C2=A0</div><div>You'll find attached = a patch to address the issue (for ocamlnet-3.6.6) of child containers becom= ing zombies when the socket connection fails unexpectedly.<br> </div><div><div><br></div><div>It would be great if this modification could= make it upstream.</div></div><div><br></div><div>Regarding the system_shut= down() issue we discussed I have not made any progresses, it would be great= if we could filter the RPC calls available to child</div> <div>containers given a policy defined by the controller process.</div><div= ><br></div><div>Regards.</div><div><br></div><div>Thomas C.</div><div class= =3D"gmail_extra"><br><br><div class=3D"gmail_quote">On Mon, Nov 11, 2013 at= 9:15 AM, Thomas Calderon <span dir=3D"ltr"><<a href=3D"mailto:calderon.= [email protected]" target=3D"_blank">[email protected]</a>></span= > wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-= left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p= adding-left:1ex"><div dir=3D"ltr">Hi <span>Gerd</span>,<br><br><br><div cla= ss=3D"gmail_extra"> <br><br><div class=3D"gmail_quote"><div class=3D"im">On Sun, Nov 10, 2013 a= t 1:24 PM, <span>Gerd</span> <span>Stolpmann</span> <span dir=3D"ltr"><<= a href=3D"mailto:[email protected]" target=3D"_blank">info@<span>gerd<= /span>-<span>stolpmann</span>.<span>de</span></a>></span> wrote:<br> <blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-= left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;p= adding-left:1ex">Am Donnerstag, den 07.11.2013, 19:34 +0100 schrieb Thomas = Calderon:<br> <div>> Hi there,<br> ><br> ><br> > I am having two issues with netplex at the moment.<br> ><br> ><br> > The first one is related to rpc-ssl support. The netplex service is<br= > > configured with SSL enabled (TLSv1) and if you are connecting with a<b= r> > client that forces newer TLS versions (openssl s_client -connect<br> > host:port -tls1_1), an Ssl exception is raised.<br> <br> </div>Well, the ocaml-ssl bindings only offer TLS-1.0, even if openssl<br> supports more. That's basically a problem of the bindings. (Fyi, I'= m<br> currently implementing complete bindings for GnuTLS to overcome all<br> limitations with ocaml-ssl.)<br></blockquote><div><br></div></div><div>OK t= hat's what I thought as well, I added the missing symbols to <span>ocam= l</span>-<span>ssl</span> and some other missing features (DH/<span>ECDH</s= pan>). This is immediately available from the git version of the code, but = having a <span>GnuTLS</span> alternative is also good news.<br> </div><div class=3D"im"><div>=C2=A0</div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:r= gb(204,204,204);border-left-style:solid;padding-left:1ex"> <div><br> > However, the container process still continues to run but is not able<= br> > to process any data, netplex then spawn a new child process to handle<= br> > subsequent connections.<br> > From the client side, the socket is closed and we end up not knowing<b= r> > in which state the "zombie" container is.<br> > We looked for a proper way to fix this in our code, but the exception<= br> > is caught from within <a href=3D"http://rpc_netplex.ml" target=3D"_bla= nk">rpc_netplex.ml</a> (line 183), is there a proper way<br> > to handle this case from our code or is it only a fix you can<br> > provide ?<br> <br> </div>You could close fd, and then call when_done() from the is_error<br> callback. This is how it is indicated that the task is done.<br></blockquot= e><div><br></div></div><div>Alright I'll look into this to fix the issu= e with the current <span>ocaml</span>-<span>ssl</span> bindings.<br> </div><div class=3D"im"><div>=C2=A0</div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:r= gb(204,204,204);border-left-style:solid;padding-left:1ex"> <br> Probably this is really the best thing you can do here. When I<br> programmed this I could probably not imagine what kind of things can go<br> wrong at this spot, and hence opted to do nothing.<br> <div><br> > The second issue is related the function<br> > "Netplex_cenv.system_shutdown()". This function can be used = to<br> > completely shutdown the service, I would like to know if it is<br> > possible to restrict this function to be only callable from within the= <br> > controller instance ? This way a container process could not call this= <br> > function and stop the service and all the other containers from<br> > running.<br> <br> </div>Without modifying the sources, there is probably no way to get this<b= r> effect.<br> <br> What's actually happening is that the controller accepts requests on th= e<br> admin socket (which is a Unix domain socket visible in the filesystem),<br> and if the container wants to do a system shutdown, is just connects to<br> this socket, and invokes the right RPC. I don't see how you could<br> prevent the container from doing so even if the connect code were<br> removed from the netplex sources. Maybe the only way is to set a<br> password on this service, and not telling the container the password.<br></= blockquote><div><br></div></div><div>OK thanks for your input on that.<br><= /div><div class=3D"im"><div>=C2=A0</div><blockquote class=3D"gmail_quote" s= tyle=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rg= b(204,204,204);border-left-style:solid;padding-left:1ex"> <br> Out of curiosity, what's your concern with system shutdowns?<br></block= quote><div><br></div></div><div><span>Netplex</span> controller can be seen= as task schedulers spawning child processes to handle requests. <br>Now le= t's suppose the service your are offering becomes essential on your sys= tem, then availability becomes something you really care about. For example= if one of the container's <span>flow</span> of execution is compromise= d, you can can live with that as long as it cannot hurt your availability o= r use privileged APIs.<br> <br></div><div>I'll have a look at the admin socket and check if nothin= g more can be done here.<br><br></div><div>Thanks for your answers.<br><br>= Thomas C.<br> </div><div class=3D"im"><div>=C2=A0</div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:r= gb(204,204,204);border-left-style:solid;padding-left:1ex"> <br> Gerd<br> <br> ><br> > Thanks.<br> ><br> ><br> > Thomas C.<br> ><br> ><br> > ----------------------------------------------------------------------= --------<br> > November Webinars for C, C++, Fortran Developers<br> > Accelerate application performance with scalable programming models. E= xplore<br> > techniques for threading, error checking, porting, and tuning. Get the= most<br> > from the latest Intel processors and coprocessors. See abstracts and r= egister<br> > <a href=3D"http://pubads.g.doubleclick.net/gampad/clk?id=3D60136231&am= p;iu=3D/4140/ostg.clktrk" target=3D"_blank">http://pubads.g.doubleclick.net= /gampad/clk?id=3D60136231&iu=3D/4140/ostg.clktrk</a><br> > _______________________________________________ Ocamlnet-devel mailing= list <a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a> <a href=3D"https://lists.sour= ceforge.net/lists/listinfo/ocamlnet-devel" target=3D"_blank">https://lists.= sourceforge.net/lists/listinfo/ocamlnet-devel</a><br> <span><font color=3D"#888888"><br> --<br> ------------------------------------------------------------<br> Gerd Stolpmann, Darmstadt, Germany =C2=A0 =C2=A0<a href=3D"mailto:gerd@gerd= -stolpmann.de" target=3D"_blank">[email protected]</a><br> My OCaml site: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.caml= city.org" target=3D"_blank">http://www.camlcity.org</a><br> Contact details: =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"http://www.camlcity.= org/contact.html" target=3D"_blank">http://www.camlcity.org/contact.html</a= ><br> Company homepage: =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.gerd-stolpmann= .de" target=3D"_blank">http://www.gerd-stolpmann.de</a><br> ------------------------------------------------------------<br> <br> </font></span></blockquote></div></div><br></div></div> </blockquote></div><br></div></div> --089e013c5af06a76f804ecc57593-- --089e013c5af06a76fd04ecc57595 Content-Type: text/x-patch; charset=US-ASCII; name="fix-zombie-child-when-socket-fails.patch" Content-Disposition: attachment; filename="fix-zombie-child-when-socket-fails.patch" Content-Transfer-Encoding: base64 X-Attachment-Id: f_hotr3dvg0 ZGlmZiAtdXJwTiBvY2FtbG5ldC0zLjYuNi9zcmMvbmV0cGxleC9ycGNfbmV0cGxleC5tbCBvY2Ft bG5ldC0zLjYuNi1tb2Qvc3JjL25ldHBsZXgvcnBjX25ldHBsZXgubWwKLS0tIG9jYW1sbmV0LTMu Ni42L3NyYy9uZXRwbGV4L3JwY19uZXRwbGV4Lm1sCTIwMTMtMDctMjEgMTU6MDY6MDkuMDAwMDAw MDAwICswMjAwCisrKyBvY2FtbG5ldC0zLjYuNi1tb2Qvc3JjL25ldHBsZXgvcnBjX25ldHBsZXgu bWwJMjAxMy0xMi0wNCAxODowOTowOC42OTg4NzcwNDkgKzAxMDAKQEAgLTE4MSw3ICsxODEsMTMg QEAgbGV0IHJwY19mYWN0b3J5CiAJCX5pc19lcnJvcjooZnVuIGVyciAtPgogCQkJICAgICBjb250 YWluZXIgIyBsb2cgYENyaXQgCiAJCQkgICAgICAgKCJDYW5ub3QgY3JlYXRlIFJQQyBtdWx0aXBs ZXhlcjogIiBeIAotCQkJCSAgTmV0ZXhuLnRvX3N0cmluZyBlcnIpCisJCQkJICBOZXRleG4udG9f c3RyaW5nIGVycik7CisgICAgICAgICAgICAgICAgIGxldCBfID0gCisgICAgICAgICAgICAgICAg IHRyeQorICAgICAgICAgICAgICAgICAgICBVbml4LmNsb3NlIGZkCisgICAgICAgICAgICAgICAg IHdpdGgKKyAgICAgICAgICAgICAgICAgICAgXyAtPiAoKSBpbgorICAgICAgICAgICAgICAgICB3 aGVuX2RvbmUoKQogCQkJICApCiAJCW1wbGV4X2VuZwogCg== --089e013c5af06a76fd04ecc57595 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Sponsored by Intel(R) XDK Develop, test and display web and hybrid apps with a single code base. Download it for free now! http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk --089e013c5af06a76fd04ecc57595 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ocamlnet-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel --089e013c5af06a76fd04ecc57595--