[PATCH 0/4] Namespacify inet_peer_* sysctl knobs

[PATCH 0/4] Namespacify inet_peer_* sysctl knobs

[Nikolay Borisov]

This series make the inet_peer ttl sysctls to be namespace aware. 

Patch 1 adds a namespace association to the inet_peer_base struct, 
which in turn is used to make the sysctls namespace aware. The 
rest of the patches are straightforward. 

Nikolay Borisov (4):
  inetpeer: Add net namespace assosication in inet_peer_base
  inetpeer: Namespacify inet_peer_maxttl sysctl knob
  inetpeer: Namespacify inet_peer_minttl sysctl knob
  inetpeer: Namespacify inet_peer_threshold sysctl knob

 include/net/inetpeer.h     |  1 +
 include/net/ip.h           |  5 -----
 include/net/netns/ipv4.h   |  4 ++++
 net/ipv4/inetpeer.c        | 15 ++++++---------
 net/ipv4/route.c           |  1 +
 net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
 6 files changed, 37 insertions(+), 36 deletions(-)

-- 
2.5.0

[PATCH 1/4] inetpeer: Add net namespace assosication in inet_peer_base

[Nikolay Borisov]

This is required so that the inet_peer_* sysctls can be
namespacified

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
---
 include/net/inetpeer.h | 1 +
 net/ipv4/route.c       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 235c7811a86a..287bb54cda58 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -67,6 +67,7 @@ struct inet_peer_base {
 	struct inet_peer __rcu	*root;
 	seqlock_t		lock;
 	int			total;
+	struct net		*net;
 };
 
 void inet_peer_base_init(struct inet_peer_base *);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 85f184e429c6..4bb45e52411c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2775,6 +2775,7 @@ static int __net_init ipv4_inetpeer_init(struct net *net)
 		return -ENOMEM;
 	inet_peer_base_init(bp);
 	net->ipv4.peers = bp;
+	bp->net = net;
 	return 0;
 }
 
-- 
2.5.0

[PATCH 2/4] inetpeer: Namespacify inet_peer_maxttl sysctl knob

[Nikolay Borisov]

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
---
 include/net/ip.h           |  1 -
 include/net/netns/ipv4.h   |  2 ++
 net/ipv4/inetpeer.c        |  2 +-
 net/ipv4/sysctl_net_ipv4.c | 15 ++++++++-------
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/include/net/ip.h b/include/net/ip.h
index cbb134b2f0e4..c33d53176d3c 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -243,7 +243,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 /* From inetpeer.c */
 extern int inet_peer_threshold;
 extern int inet_peer_minttl;
-extern int inet_peer_maxttl;
 
 void ipfrag_init(void);
 
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index a69cde3ce460..b0623c4e2f0a 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -88,6 +88,8 @@ struct netns_ipv4 {
 	int sysctl_ip_dynaddr;
 	int sysctl_ip_early_demux;
 
+	int sysctl_inet_peer_maxttl;
+
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;
 #ifdef CONFIG_NET_L3_MASTER_DEV
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 86fa45809540..a9245ada56c2 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -82,7 +82,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
 					 * aggressively at this stage */
 int inet_peer_minttl __read_mostly = 120 * HZ;	/* TTL under high load: 120 sec */
-int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;	/* usual time to live: 10 min */
 
 static void inetpeer_gc_worker(struct work_struct *work)
 {
@@ -369,6 +368,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 			struct inet_peer __rcu ***stackptr)
 {
 	struct inet_peer *p, *gchead = NULL;
+	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
 	__u32 delta, ttl;
 	int cnt = 0;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1e1fe6086dd9..2aaa049cbf9d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -359,13 +359,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
-		.procname	= "inet_peer_maxttl",
-		.data		= &inet_peer_maxttl,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec_jiffies,
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),
@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
+		.procname	= "inet_peer_maxttl",
+		.data		= &init_net.ipv4.sysctl_inet_peer_maxttl,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_jiffies,
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),
@@ -991,6 +991,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_default_ttl = IPDEFTTL;
 	net->ipv4.sysctl_ip_dynaddr = 0;
 	net->ipv4.sysctl_ip_early_demux = 1;
+	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
 
 	return 0;
 
-- 
2.5.0

[PATCH 3/4] inetpeer: Namespacify inet_peer_minttl sysctl knob

[Nikolay Borisov]

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
---
 include/net/ip.h           |  1 -
 include/net/netns/ipv4.h   |  1 +
 net/ipv4/inetpeer.c        |  2 +-
 net/ipv4/sysctl_net_ipv4.c | 15 ++++++++-------
 4 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/net/ip.h b/include/net/ip.h
index c33d53176d3c..11a20a3e60c6 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -242,7 +242,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 
 /* From inetpeer.c */
 extern int inet_peer_threshold;
-extern int inet_peer_minttl;
 
 void ipfrag_init(void);
 
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index b0623c4e2f0a..1bc51c22ef42 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -89,6 +89,7 @@ struct netns_ipv4 {
 	int sysctl_ip_early_demux;
 
 	int sysctl_inet_peer_maxttl;
+	int sysctl_inet_peer_minttl;
 
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index a9245ada56c2..97e834eae90c 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -81,7 +81,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 /* Exported for sysctl_net_ipv4.  */
 int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
 					 * aggressively at this stage */
-int inet_peer_minttl __read_mostly = 120 * HZ;	/* TTL under high load: 120 sec */
 
 static void inetpeer_gc_worker(struct work_struct *work)
 {
@@ -369,6 +368,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 {
 	struct inet_peer *p, *gchead = NULL;
 	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
+	int inet_peer_minttl = base->net->ipv4.sysctl_inet_peer_minttl;
 	__u32 delta, ttl;
 	int cnt = 0;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 2aaa049cbf9d..9b55ca56b99f 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -352,13 +352,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
-		.procname	= "inet_peer_minttl",
-		.data		= &inet_peer_minttl,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec_jiffies,
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),
@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
+		.procname	= "inet_peer_minttl",
+		.data		= &init_net.ipv4.sysctl_inet_peer_minttl,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_jiffies,
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),
@@ -992,6 +992,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_dynaddr = 0;
 	net->ipv4.sysctl_ip_early_demux = 1;
 	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
+	net->ipv4.sysctl_inet_peer_minttl = 120 * HZ;      /* TTL under high load: 120 sec */
 
 	return 0;
 
-- 
2.5.0

[PATCH 4/4] inetpeer: Namespacify inet_peer_threshold sysctl knob

[Nikolay Borisov]

Signed-off-by: Nikolay Borisov <kernel@kyup.com>
---
 include/net/ip.h           |  3 ---
 include/net/netns/ipv4.h   |  1 +
 net/ipv4/inetpeer.c        | 11 ++++-------
 net/ipv4/sysctl_net_ipv4.c | 17 +++++++++--------
 4 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/include/net/ip.h b/include/net/ip.h
index 11a20a3e60c6..b9832da7e636 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -240,9 +240,6 @@ static inline int inet_is_local_reserved_port(struct net *net, int port)
 }
 #endif
 
-/* From inetpeer.c */
-extern int inet_peer_threshold;
-
 void ipfrag_init(void);
 
 void ip_static_sysctl_init(void);
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 1bc51c22ef42..c0d85ba9e5f7 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -90,6 +90,7 @@ struct netns_ipv4 {
 
 	int sysctl_inet_peer_maxttl;
 	int sysctl_inet_peer_minttl;
+	int sysctl_inet_peer_threshold;
 
 	int sysctl_fwmark_reflect;
 	int sysctl_tcp_fwmark_accept;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 97e834eae90c..6a51d3abd797 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -78,10 +78,6 @@ EXPORT_SYMBOL_GPL(inet_peer_base_init);
 
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
-/* Exported for sysctl_net_ipv4.  */
-int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries more
-					 * aggressively at this stage */
-
 static void inetpeer_gc_worker(struct work_struct *work)
 {
 	struct inet_peer *p, *n, *c;
@@ -141,11 +137,11 @@ void __init inet_initpeers(void)
 	 * myself.  --SAW
 	 */
 	if (si.totalram <= (32768*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 1; /* max pool size about 1MB on IA32 */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 1; /* max pool size about 1MB on IA32 */
 	if (si.totalram <= (16384*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 1; /* about 512KB */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 1; /* about 512KB */
 	if (si.totalram <= (8192*1024)/PAGE_SIZE)
-		inet_peer_threshold >>= 2; /* about 128KB */
+		init_net.ipv4.sysctl_inet_peer_threshold >>= 2; /* about 128KB */
 
 	peer_cachep = kmem_cache_create("inet_peer_cache",
 			sizeof(struct inet_peer),
@@ -369,6 +365,7 @@ static int inet_peer_gc(struct inet_peer_base *base,
 	struct inet_peer *p, *gchead = NULL;
 	int inet_peer_maxttl = base->net->ipv4.sysctl_inet_peer_maxttl;
 	int inet_peer_minttl = base->net->ipv4.sysctl_inet_peer_minttl;
+	int inet_peer_threshold = base->net->ipv4.sysctl_inet_peer_threshold;
 	__u32 delta, ttl;
 	int cnt = 0;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 9b55ca56b99f..36d206209879 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -345,13 +345,6 @@ static struct ctl_table ipv4_table[] = {
 		.proc_handler	= proc_dointvec
 	},
 	{
-		.procname	= "inet_peer_threshold",
-		.data		= &inet_peer_threshold,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec
-	},
-	{
 		.procname	= "tcp_fack",
 		.data		= &sysctl_tcp_fack,
 		.maxlen		= sizeof(int),
@@ -737,6 +730,13 @@ static struct ctl_table ipv4_net_table[] = {
 		.proc_handler	= proc_dointvec_jiffies,
 	},
 	{
+		.procname	= "inet_peer_threshold",
+		.data		= &init_net.ipv4.sysctl_inet_peer_threshold,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec
+	},
+	{
 		.procname	= "ip_early_demux",
 		.data		= &init_net.ipv4.sysctl_ip_early_demux,
 		.maxlen		= sizeof(int),
@@ -993,7 +993,8 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 	net->ipv4.sysctl_ip_early_demux = 1;
 	net->ipv4.sysctl_inet_peer_maxttl = 10 * 60 * HZ;  /* usual time to live: 10 min */
 	net->ipv4.sysctl_inet_peer_minttl = 120 * HZ;      /* TTL under high load: 120 sec */
-
+	net->ipv4.sysctl_inet_peer_threshold = 65536 + 128;/* start to throw entries more
+							    * aggressively at this stage */
 	return 0;
 
 err_ports:
-- 
2.5.0

Re: [PATCH 0/4] Namespacify inet_peer_* sysctl knobs

[Eric W. Biederman]

Nikolay Borisov <kernel@kyup.com> writes:

> This series make the inet_peer ttl sysctls to be namespace aware. 
>
> Patch 1 adds a namespace association to the inet_peer_base struct, 
> which in turn is used to make the sysctls namespace aware. The 
> rest of the patches are straightforward.

At a quick skim I am not certain I am comfortable with this change.

The issue is that these are not packet parameters you are tuning but
lifetimes for data structures.

Generally there are challenges making this kind of thing per namespace
because resource control can lead to DOS attack from one namespace
being able to arbitrarly control it's own resource consumption.

Is this something that is actually worth making per namespace?

Eric

> Nikolay Borisov (4):
>   inetpeer: Add net namespace assosication in inet_peer_base
>   inetpeer: Namespacify inet_peer_maxttl sysctl knob
>   inetpeer: Namespacify inet_peer_minttl sysctl knob
>   inetpeer: Namespacify inet_peer_threshold sysctl knob
>
>  include/net/inetpeer.h     |  1 +
>  include/net/ip.h           |  5 -----
>  include/net/netns/ipv4.h   |  4 ++++
>  net/ipv4/inetpeer.c        | 15 ++++++---------
>  net/ipv4/route.c           |  1 +
>  net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
>  6 files changed, 37 insertions(+), 36 deletions(-)

Re: [PATCH 0/4] Namespacify inet_peer_* sysctl knobs

[Nikolay Borisov]

On 02/17/2016 09:15 PM, Eric W. Biederman wrote:
> Nikolay Borisov <kernel@kyup.com> writes:
> 
>> This series make the inet_peer ttl sysctls to be namespace aware. 
>>
>> Patch 1 adds a namespace association to the inet_peer_base struct, 
>> which in turn is used to make the sysctls namespace aware. The 
>> rest of the patches are straightforward.
> 
> At a quick skim I am not certain I am comfortable with this change.
> 
> The issue is that these are not packet parameters you are tuning but
> lifetimes for data structures.

Right, I though the inet peer expiration might have repercussion on the
way the networking stack worked. But apparently that's not case.
> 
> Generally there are challenges making this kind of thing per namespace
> because resource control can lead to DOS attack from one namespace
> being able to arbitrarly control it's own resource consumption.
> 
> Is this something that is actually worth making per namespace?

I guess the series can be dropped if it's deemed unnecessary.


> 
> Eric
> 
>> Nikolay Borisov (4):
>>   inetpeer: Add net namespace assosication in inet_peer_base
>>   inetpeer: Namespacify inet_peer_maxttl sysctl knob
>>   inetpeer: Namespacify inet_peer_minttl sysctl knob
>>   inetpeer: Namespacify inet_peer_threshold sysctl knob
>>
>>  include/net/inetpeer.h     |  1 +
>>  include/net/ip.h           |  5 -----
>>  include/net/netns/ipv4.h   |  4 ++++
>>  net/ipv4/inetpeer.c        | 15 ++++++---------
>>  net/ipv4/route.c           |  1 +
>>  net/ipv4/sysctl_net_ipv4.c | 47 ++++++++++++++++++++++++----------------------
>>  6 files changed, 37 insertions(+), 36 deletions(-)