Re: userns, netns, and quick physical memory consumption by unprivileged user

Path	csiph.com!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Pablo Neira Ayuso <pablo@netfilter.org>
Newsgroups	linux.kernel
Subject	Re: userns, netns, and quick physical memory consumption by unprivileged user
Date	Sat, 12 Mar 2016 12:50:01 +0100
Message-ID	<rbQdr-5mt-3@gated-at.bofh.it> (permalink)
References	<rbxkt-8dl-15@gated-at.bofh.it> <rbxkt-8dl-17@gated-at.bofh.it> <rbxkt-8dl-13@gated-at.bofh.it>
X-Original-To	Florian Westphal <fw@strlen.de>
X-Virus-Status	clean(F-Secure/fsigk_smtp/522/antivirus1-rhel7.int)
MIME-Version	1.0
Content-Type	text/plain; charset=us-ascii
Content-Disposition	inline
User-Agent	Mutt/1.5.23 (2014-03-12)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	37
Organization	linux.* mail to news gateway
X-Original-Cc	"Yuriy M. Kaminskiy" <yumkam@gmail.com>, netdev@vger.kernel.org, containers@lists.osdl.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org
X-Original-Date	Sat, 12 Mar 2016 12:41:40 +0100
X-Original-Message-ID	<20160312114140.GA2023@salvia>
X-Original-References	<m3d1rclioc.fsf@gmail.com> <m3r3fhhx4c.fsf@gmail.com> <20160311153406.GB6620@breakpoint.cc>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1356407

Show key headers only | View raw

On Fri, Mar 11, 2016 at 04:34:06PM +0100, Florian Westphal wrote:
> Yuriy M. Kaminskiy <yumkam@gmail.com> wrote:
> > BTW, all those hash/conntrack/etc default sizes was calculated from
> > physical memory size in assumption there will be only *one* instance of
> > those tables. Obviously, introduction of network namespaces (and
> > especially unprivileged user-ns) thrown this assumption in the window
> > (and here comes that "falling back to vmalloc" message again; in pre-netns
> > world, those tables were allocated *once* on early system startup, with
> > typically plenty of free and unfragmented memory).
> 
> No idea how to fix this expect by removing conntrack support in net
> namespaces completely.
> 
> I'd disallow all write accesses to skb->nfct (NAT, CONNMARK,
> CONNSECMARK, ...) and then no longer clear skb->nfct when forwarding
> packet from init_ns to container.
> 
> Containers could then still test conntrack as seen from init namespace pov
> in PREROUTING/FORWARD/INPUT (but not OUTPUT, obviously).
> 
> [ OUTPUT *might* be doable as well by allowing NEW creation in output
>   but skipping nat and deferring the confirmation/commit of the new
>   entry to the table until skb leaves initns ]
> 
> We could key conntrack entries to initns conntrack table
> instead of adding one new table per netns, but seems like this only
> replaces one problem with a new one (filling/blocking initns table from
> another netns).

We can add a global perns limit in terms of conntrack entries that can
only be set via CAP_NET_ADMIN from the initns. Thus, we avoid the
filling/blocking from another netns, or hide this knob to
unpriviledged userns somehow.

In the previous netfilter workshop I remember we agreed on going
towards having a single conntrack table for netns, so I suggest we
follow that direction.

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: userns, netns, and quick physical memory consumption by  unprivileged user Florian Westphal <fw@strlen.de> - 2016-03-11 16:40 +0100
  Re: userns, netns, and quick physical memory consumption by  unprivileged user Pablo Neira Ayuso <pablo@netfilter.org> - 2016-03-12 12:50 +0100

csiph-web