From: Maryam Tahhan <mtahhan@redhat.com>
To: Stephen Hemminger <stephen@networkplumber.org>
Cc: "ferruh.yigit@amd.com" <ferruh.yigit@amd.com>,
"lihuisong@huawei.com" <lihuisong@huawei.com>,
"fengchengwen@huawei.com" <fengchengwen@huawei.com>,
"liuyonglong@huawei.com" <liuyonglong@huawei.com>,
"Koikkara Reeny, Shibin" <shibin.koikkara.reeny@intel.com>,
"dev@dpdk.org" <dev@dpdk.org>,
Ciara Loftus <ciara.loftus@intel.com>
Subject: Re: [v2] net/af_xdp: enable a sock path alongside use_cni
Date: Mon, 11 Dec 2023 13:22:08 +0000 [thread overview]
Message-ID: <d62bb214-19f5-4f41-ba4e-5ade7080830a@redhat.com> (raw)
In-Reply-To: <CAFdtZit1v+F1UNve4wDtVJYMSPNMdFayPKHOpTyJsn_cVgMjRQ@mail.gmail.com>
On 08/12/2023 18:10, Maryam Tahhan wrote:
> Thanks Stephen, I will have a look.
>
> I've seen a few places mention that abstract sockets are attached to
> the network namespace of a process. For our use case the 2 processes
> (pods) will have separate network namespaces. So I'm not sure it will
> work. However, it should be easy to validate and I can give it a try
> in a k8s environment for completeness. Otherwise all the pods would
> need to be host networked which is not what we want at all.
>
> I was able to find a case where abstract sockets were used by
> containerd (CVE-2020-15257) [1]. Our AF_XDP DP Pod is also host
> networked and so it seems that we would be opening ourselves up to
> similar issues, in that a bad acting container could block containers
> that actually want to use afxdp_dp by simply connecting to the DP and
> just failing to handshake on all the abstract sockets it finds in,the
> host namespace.
>
> I will circle back on Mon re the first open, but considering that
> containerd abandoned this approach, I'm not sure it's the way to go
> for us. But let's cross that bridge after we have an answer to the
> first issue.
>
Hi Stephen
Circling back, I built a simple example here [1] using kind. The
abstract sockets don't work across network namespaces (which is our
scenario with the Pods) and so will not be usable for what we are trying
to do here.
The example creates a simple kind cluster. It builds a simple docker
image that incorporates socat. Then it launches 2 pods:
- The first pod is the server (it will use socat to create an abstract
socket).
- The second pod is the client (it will use socat to try to connect to
the abstract socket).
The connection attempt in the client fails.
[1] https://github.com/maryamtahhan/ans-kind-example
next prev parent reply other threads:[~2023-12-11 13:22 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-04 10:31 Maryam Tahhan
2023-12-04 17:18 ` Koikkara Reeny, Shibin
2023-12-04 18:41 ` Maryam Tahhan
2023-12-05 10:29 ` Koikkara Reeny, Shibin
2023-12-05 11:28 ` Maryam Tahhan
2023-12-05 11:54 ` Koikkara Reeny, Shibin
2023-12-08 17:23 ` Stephen Hemminger
[not found] ` <CAFdtZit1v+F1UNve4wDtVJYMSPNMdFayPKHOpTyJsn_cVgMjRQ@mail.gmail.com>
2023-12-11 13:22 ` Maryam Tahhan [this message]
2023-12-05 11:31 ` Maryam Tahhan
2023-12-05 11:49 ` Koikkara Reeny, Shibin
2023-12-05 13:43 ` Loftus, Ciara
2023-12-05 14:38 ` Maryam Tahhan
2023-12-05 14:42 ` Koikkara Reeny, Shibin
2023-12-05 18:30 ` Stephen Hemminger
2023-12-06 15:00 ` Maryam Tahhan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d62bb214-19f5-4f41-ba4e-5ade7080830a@redhat.com \
--to=mtahhan@redhat.com \
--cc=ciara.loftus@intel.com \
--cc=dev@dpdk.org \
--cc=fengchengwen@huawei.com \
--cc=ferruh.yigit@amd.com \
--cc=lihuisong@huawei.com \
--cc=liuyonglong@huawei.com \
--cc=shibin.koikkara.reeny@intel.com \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).