Namespacify inet_peer_* sysctl knobs

PATCH In review Nikolay Borisov 2 participants 7 messages Feb 17, 2016 – Feb 18, 2016

Subsystems (3)

Networking Network drivers IPv4/IPv6

lore

Share & tools

lore

Nikolay Borisov

author

2016-02-17 10:10 UTC #0 lore raw

cover Namespacify inet_peer_* sysctl knobs

This series make the inet_peer ttl sysctls to be namespace aware.

Patch 1 adds a namespace association to the inet_peer_base struct, which in turn is used to make the sysctls namespace aware. The rest of the patches are straightforward.

Nikolay Borisov (4):
inetpeer: Add net namespace assosication in inet_peer_base
inetpeer: Namespacify inet_peer_maxttl sysctl knob
inetpeer: Namespacify inet_peer_minttl sysctl knob
inetpeer: Namespacify inet_peer_threshold sysctl knob

 include/net/inetpeer.h     |  1 +
 include/net/ip.h           |  5 -----
 include/net/netns/ipv4.h   |  4 ++++
 net/ipv4/inetpeer.c        | 15 ++++++---------
 net/ipv4/route.c           |  1 +
 net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
 6 files changed, 37 insertions(+), 36 deletions(-)

Signature · 1 line

2.5.0

Nikolay Borisov

author

2016-02-17 10:10 UTC #1 lore raw

PATCH 1/4 inetpeer: Add net namespace assosication in inet_peer_base

This is required so that the inet_peer_* sysctls can be namespacified

Signed-off-by Nikolay Borisov <[email protected]>

---
 include/net/inetpeer.h | 1 +
 net/ipv4/route.c       | 1 +
 2 files changed, 2 insertions(+)

include/net/inetpeer.h +1 -0

index 235c7811a86a..287bb54cda58 100644
@@ -67,6 +67,7 @@ struct inet_peer_base {
 	struct inet_peer __rcu	*root;
 	seqlock_t		lock;
 	int			total;
+	struct net		*net;
 };
 
 void inet_peer_base_init(struct inet_peer_base *);

net/ipv4/route.c +1 -0

index 85f184e429c6..4bb45e52411c 100644
@@ -2775,6 +2775,7 @@ static int __net_init ipv4_inetpeer_init(struct net *net)
 		return -ENOMEM;
 	inet_peer_base_init(bp);
 	net->ipv4.peers = bp;
+	bp->net = net;
 	return 0;
 }

Signature · 1 line

2.5.0

Nikolay Borisov

author

2016-02-17 10:10 UTC #2 lore raw

PATCH 2/4 inetpeer: Namespacify inet_peer_maxttl sysctl knob

In reply to Nikolay Borisov

Signed-off-by Nikolay Borisov <[email protected]>

---
 include/net/ip.h           |  1 -
 include/net/netns/ipv4.h   |  2 ++
 net/ipv4/inetpeer.c        |  2 +-
 net/ipv4/sysctl_net_ipv4.c | 15 ++++++++-------
 4 files changed, 11 insertions(+), 9 deletions(-)

include/net/ip.h +0 -1

index cbb134b2f0e4..c33d53176d3c 100644
@@ -243,7 +243,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 /* From inetpeer.c */
 extern int inet_peer_threshold;
 extern int inet_peer_minttl;
-extern int inet_peer_maxttl;
 
 void ipfrag_init(void);

include/net/netns/ipv4.h +2 -0

index a69cde3ce460..b0623c4e2f0a 100644
@@ -88,6 +88,8 @@ struct netns_ipv4 {
 	int sysctl_ip_dynaddr;
 	int sysctl_ip_early_demux;
 
+	int sysctl_inet_peer_maxttl;
+
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;
 #ifdef CONFIG_NET_L3_MASTER_DEV

net/ipv4/inetpeer.c +1 -1

index 86fa45809540..a9245ada56c2 100644
@@ -82,7 +82,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
 					 * aggressively at this stage */
 int inet_peer_minttl __read_mostly = 120 * HZ;	/* TTL under high load: 120 sec */
-int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;	/* usual time to live: 10 min */
 
 static void inetpeer_gc_worker(struct work_struct *work)
 {

@@ -369,6 +368,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 			struct inet_peer __rcu ***stackptr)
 {
 	struct inet_peer *p, *gchead = NULL;
+	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
 	__u32 delta, ttl;
 	int cnt = 0;

net/ipv4/sysctl_net_ipv4.c +8 -7

index 1e1fe6086dd9..2aaa049cbf9d 100644
@@ -359,13 +359,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
-		.procname	= "inet_peer_maxttl",
-		.data		= &inet_peer_maxttl,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec_jiffies,
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),

@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
+		.procname	= "inet_peer_maxttl",
+		.data		= &init_net.ipv4.sysctl_inet_peer_maxttl,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_jiffies,
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),

@@ -991,6 +991,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_default_ttl = IPDEFTTL;
 	net->ipv4.sysctl_ip_dynaddr = 0;
 	net->ipv4.sysctl_ip_early_demux = 1;
+	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
 
 	return 0;

Signature · 1 line

2.5.0

Nikolay Borisov

author

2016-02-17 10:10 UTC #3 lore raw

PATCH 3/4 inetpeer: Namespacify inet_peer_minttl sysctl knob

In reply to Nikolay Borisov

Signed-off-by Nikolay Borisov <[email protected]>

---
 include/net/ip.h           |  1 -
 include/net/netns/ipv4.h   |  1 +
 net/ipv4/inetpeer.c        |  2 +-
 net/ipv4/sysctl_net_ipv4.c | 15 ++++++++-------
 4 files changed, 10 insertions(+), 9 deletions(-)

include/net/ip.h +0 -1

index c33d53176d3c..11a20a3e60c6 100644
@@ -242,7 +242,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 
 /* From inetpeer.c */
 extern int inet_peer_threshold;
-extern int inet_peer_minttl;
 
 void ipfrag_init(void);

include/net/netns/ipv4.h +1 -0

index b0623c4e2f0a..1bc51c22ef42 100644
@@ -89,6 +89,7 @@ struct netns_ipv4 {
 	int sysctl_ip_early_demux;
 
 	int sysctl_inet_peer_maxttl;
+	int sysctl_inet_peer_minttl;
 
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;

net/ipv4/inetpeer.c +1 -1

index a9245ada56c2..97e834eae90c 100644
@@ -81,7 +81,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 /* Exported for sysctl_net_ipv4.  */
 int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
 					 * aggressively at this stage */
-int inet_peer_minttl __read_mostly = 120 * HZ;	/* TTL under high load: 120 sec */
 
 static void inetpeer_gc_worker(struct work_struct *work)
 {

@@ -369,6 +368,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 {
 	struct inet_peer *p, *gchead = NULL;
 	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
+	int inet_peer_minttl = base->net->ipv4.sysctl_inet_peer_minttl;
 	__u32 delta, ttl;
 	int cnt = 0;

net/ipv4/sysctl_net_ipv4.c +8 -7

index 2aaa049cbf9d..9b55ca56b99f 100644
@@ -352,13 +352,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
-		.procname	= "inet_peer_minttl",
-		.data		= &inet_peer_minttl,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec_jiffies,
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),

@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
+		.procname	= "inet_peer_minttl",
+		.data		= &init_net.ipv4.sysctl_inet_peer_minttl,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_jiffies,
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),

@@ -992,6 +992,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_dynaddr = 0;
 	net->ipv4.sysctl_ip_early_demux = 1;
 	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
+	net->ipv4.sysctl_inet_peer_minttl = 120 * HZ;      /* TTL under high load: 120 sec */
 
 	return 0;

Signature · 1 line

2.5.0

Nikolay Borisov

author

2016-02-17 10:10 UTC #4 lore raw

PATCH 4/4 inetpeer: Namespacify inet_peer_threshold sysctl knob

In reply to Nikolay Borisov

Signed-off-by Nikolay Borisov <[email protected]>

---
 include/net/ip.h           |  3 ---
 include/net/netns/ipv4.h   |  1 +
 net/ipv4/inetpeer.c        | 11 ++++-------
 net/ipv4/sysctl_net_ipv4.c | 17 +++++++++--------
 4 files changed, 14 insertions(+), 18 deletions(-)

include/net/ip.h +0 -3

index 11a20a3e60c6..b9832da7e636 100644
@@ -240,9 +240,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 }
 #endif
 
-/* From inetpeer.c */
-extern int inet_peer_threshold;
-
 void ipfrag_init(void);
 
 void ip_static_sysctl_init(void);

include/net/netns/ipv4.h +1 -0

index 1bc51c22ef42..c0d85ba9e5f7 100644
@@ -90,6 +90,7 @@ struct netns_ipv4 {
 
 	int sysctl_inet_peer_maxttl;
 	int sysctl_inet_peer_minttl;
+	int sysctl_inet_peer_threshold;
 
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;

net/ipv4/inetpeer.c +4 -7

index 97e834eae90c..6a51d3abd797 100644
@@ -78,10 +78,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
-/* Exported for sysctl_net_ipv4.  */
-int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
-					 * aggressively at this stage */
-
 static void inetpeer_gc_worker(struct work_struct *work)
 {
 	struct inet_peer *p, *n, *c;

@@ -141,11 +137,11 @@ void __init inet_initpeers(void)
 	 * myself.  --SAW
 	 */
 	if (si.totalram <= (32768*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 1; /* max pool size about 1MB on IA32 */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 1; /* max pool size about 1MB on IA32 */
 	if (si.totalram <= (16384*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 1; /* about 512KB */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 1; /* about 512KB */
 	if (si.totalram <= (8192*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 2; /* about 128KB */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 2; /* about 128KB */
 
 	peer_cachep = kmem_cache_create("inet_peer_cache",
 			sizeof(struct inet_peer),

@@ -369,6 +365,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 	struct inet_peer *p, *gchead = NULL;
 	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
 	int inet_peer_minttl = base->net->ipv4.sysctl_inet_peer_minttl;
+	int inet_peer_threshold = base->net->ipv4.sysctl_inet_peer_threshold;
 	__u32 delta, ttl;
 	int cnt = 0;

net/ipv4/sysctl_net_ipv4.c +9 -8

index 9b55ca56b99f..36d206209879 100644
@@ -345,13 +345,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
-		.procname	= "inet_peer_threshold",
-		.data		= &inet_peer_threshold,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),

@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
+		.procname	= "inet_peer_threshold",
+		.data		= &init_net.ipv4.sysctl_inet_peer_threshold,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),

@@ -993,7 +993,8 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_early_demux = 1;
 	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
 	net->ipv4.sysctl_inet_peer_minttl = 120 * HZ;      /* TTL under high load: 120 sec */
-
+	net->ipv4.sysctl_inet_peer_threshold = 65536 + 128;/* start to throw entries more
+							    * aggressively at this stage */
 	return 0;
 
 err_ports:

Signature · 1 line

2.5.0

Eric W. Biederman

2016-02-17 19:25 UTC #5 lore raw

In reply to Nikolay Borisov

Quoted 5 lines · Nikolay Borisov

This series make the inet_peer ttl sysctls to be namespace aware.
Patch 1 adds a namespace association to the inet_peer_base struct, which in turn is used to make the sysctls namespace aware. The rest of the patches are straightforward.

At a quick skim I am not certain I am comfortable with this change.

The issue is that these are not packet parameters you are tuning but lifetimes for data structures.

Generally there are challenges making this kind of thing per namespace because resource control can lead to DOS attack from one namespace being able to arbitrarly control it's own resource consumption.

Is this something that is actually worth making per namespace?

Eric

Quoted 13 lines

Nikolay Borisov (4):
inetpeer: Add net namespace assosication in inet_peer_base
inetpeer: Namespacify inet_peer_maxttl sysctl knob
inetpeer: Namespacify inet_peer_minttl sysctl knob
inetpeer: Namespacify inet_peer_threshold sysctl knob
 include/net/inetpeer.h     |  1 +
 include/net/ip.h           |  5 -----
 include/net/netns/ipv4.h   |  4 ++++
 net/ipv4/inetpeer.c        | 15 ++++++---------
 net/ipv4/route.c           |  1 +
 net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
 6 files changed, 37 insertions(+), 36 deletions(-)

Nikolay Borisov

author

2016-02-18 15:04 UTC #6 lore raw

Quoted 4 lines · Eric W. Biederman

Quoted 2 lines · Nikolay Borisov
This series make the inet_peer ttl sysctls to be namespace aware.

Quoted 8 lines

Quoted 3 lines
Patch 1 adds a namespace association to the inet_peer_base struct, which in turn is used to make the sysctls namespace aware. The rest of the patches are straightforward.
At a quick skim I am not certain I am comfortable with this change.
The issue is that these are not packet parameters you are tuning but lifetimes for data structures.

Right, I though the inet peer expiration might have repercussion on the way the networking stack worked. But apparently that's not case.

Quoted 6 lines

Generally there are challenges making this kind of thing per namespace because resource control can lead to DOS attack from one namespace being able to arbitrarly control it's own resource consumption.
Is this something that is actually worth making per namespace?

I guess the series can be dropped if it's deemed unnecessary.

Quoted 16 lines

Eric
Quoted 13 lines
Nikolay Borisov (4):
inetpeer: Add net namespace assosication in inet_peer_base
inetpeer: Namespacify inet_peer_maxttl sysctl knob
inetpeer: Namespacify inet_peer_minttl sysctl knob
inetpeer: Namespacify inet_peer_threshold sysctl knob
 include/net/inetpeer.h     |  1 +
 include/net/ip.h           |  5 -----
 include/net/netns/ipv4.h   |  4 ++++
 net/ipv4/inetpeer.c        | 15 ++++++---------
 net/ipv4/route.c           |  1 +
 net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
 6 files changed, 37 insertions(+), 36 deletions(-)