AF_UNIX sockets crossing namespace based boundaries

AF_UNIX sockets crossing namespace based boundaries

[Donald Sharp]

I have created multiple namespaces:

sharpd@robot /v/l/frr> ip netns list
two (id: 2)
one (id: 1)
EVA (id: 0)

And am running a process in namespace two that creates a named socket
`/var/log/frr/run/zserv.api`:

sharpd@robot ~/frr> sudo ip netns exec two /usr/lib/frr/zebra -N two
--daemon -A 127.0.0.1
sharpd@robot ~/frr> sudo ss -aep -N two | grep frr
u_str LISTEN  0        5               /var/log/frr/run/zserv.api
689118                           * 0
users:(("zebra",pid=14126,fd=16)) <->
u_str LISTEN  0        5           /var/log/frr/run/two/zebra.vty
689120                           * 0
users:(("zebra",pid=14126,fd=20)) <->

in namespace one I create a different process that should attach to
the `/var/log/frr/run/zserv.api` socket, but I have not started a
zebra process to attach to it:

sharpd@robot ~/frr> sudo ip netns exec one /usr/lib/frr/bgpd -N one -t
-A 127.0.0.1 -n -f /etc/frr/one/bgpd.conf
robot#

The zebra process( in namespace two shows a bgp connection: )
[sharpd@robot frr]$ sudo tail -F /tmp/frr.two.log
2019/01/01 19:40:30 ZEBRA: client 13 says hello and bids fair to
announce only bgp routes vrf=0

In namespace one we have this:

[sharpd@robot frr]$ sudo ss -aep -N one | grep frr
u_strLISTEN 0      5       /var/log/frr/run/one/bgpd.vty 708666
       * 0            users:(("bgpd",pid=15318,fd=16)) <->
u_strESTAB  0      0          /var/log/frr/run/zserv.api 707740
       * 708667       users:(("zebra",pid=14126,fd=13)) <->
[sharpd@robot frr]$

In namespace two we have this:
[sharpd@robot frr]$ sudo ss -aep -N two | grep frr
u_str LISTEN  0        5               /var/log/frr/run/zserv.api
689118                           * 0
users:(("zebra",pid=14126,fd=16)) <->
u_str LISTEN  0        5           /var/log/frr/run/two/zebra.vty
689120                           * 0
users:(("zebra",pid=14126,fd=20)) <->
[sharpd@robot frr]$

I am running:
[sharpd@robot frr]$ uname -a
Linux robot 4.19.10-300.fc29.x86_64 #1 SMP Mon Dec 17 15:34:44 UTC
2018 x86_64 x86_64 x86_64 GNU/Linux
[sharpd@robot frr]$

When I create a zebra process per namespace all my AF_UNIX connections
end up in the right namespace.  My expectation is that named sockets
should not traverse namespaces.  Is this an invalid assumption?

Re: AF_UNIX sockets crossing namespace based boundaries

[Andrew Lunn]

On Tue, Jan 01, 2019 at 07:46:07PM -0500, Donald Sharp wrote:
> I have created multiple namespaces:
> 
> sharpd@robot /v/l/frr> ip netns list
> two (id: 2)
> one (id: 1)
> EVA (id: 0)
> 
> And am running a process in namespace two that creates a named socket
> `/var/log/frr/run/zserv.api`:

Hi Donald

Just to be sure...

Are you creating only a network name space, and not a filesystem mount
namespace?

I've successfully run hundred of FRR daemons in namespaces on Linux
for simulation work, but i always use both a network namespace and
mount namespace. /var/log/frr/run/zserv.api is clearly a filesystem
path, so you need to separate these at the filesystem level.

       Andrew

Re: AF_UNIX sockets crossing namespace based boundaries

[Donald Sharp]

I am only creating a network namespace, but I don't think this changes
my core question.

Suppose I am running FRR/zebra in the default namespace and I startup
a BGP instance in namespace one.  BGP will connect to the default
namespaces zebra instance.
Now suppose I am running FRR/zebra in the default namespace and
FRR/zebra in namespace two and I startup a BGP instance in namespace
one, BGP is connecting to the zebra instance in namespace two now.
Finally if I run zebra in namespace one and then start a bgp instance
in one, it connects to the zebra running in namespace one.

Is this the behavior we want to see?  I also haven't tested to see
which namepace gets choosen if I have multiple zebra instances running
in different namespaces and I startup a bgp process in a namespace
that doesn't have zebra also running.  Or does start order matter
here?

thanks!

donald



Is this the behavior we actually want?

On Wed, Jan 2, 2019 at 9:05 AM Andrew Lunn <andrew@lunn.ch> wrote:
>
> On Tue, Jan 01, 2019 at 07:46:07PM -0500, Donald Sharp wrote:
> > I have created multiple namespaces:
> >
> > sharpd@robot /v/l/frr> ip netns list
> > two (id: 2)
> > one (id: 1)
> > EVA (id: 0)
> >
> > And am running a process in namespace two that creates a named socket
> > `/var/log/frr/run/zserv.api`:
>
> Hi Donald
>
> Just to be sure...
>
> Are you creating only a network name space, and not a filesystem mount
> namespace?
>
> I've successfully run hundred of FRR daemons in namespaces on Linux
> for simulation work, but i always use both a network namespace and
> mount namespace. /var/log/frr/run/zserv.api is clearly a filesystem
> path, so you need to separate these at the filesystem level.
>
>        Andrew

Re: AF_UNIX sockets crossing namespace based boundaries

[Andrew Lunn]

On Wed, Jan 02, 2019 at 10:22:36AM -0500, Donald Sharp wrote:
> I am only creating a network namespace, but I don't think this changes
> my core question.
> 
> Suppose I am running FRR/zebra in the default namespace and I startup
> a BGP instance in namespace one.  BGP will connect to the default
> namespaces zebra instance.

Hi David.

We are talking about AF_UNIX here. By default, the name of the socket
is a path on a filesystem. So to me, netns plays no role here when you
reference the socket via its filesystem name. The path exists in the
filesystem namespace, and in your case with only netns, the same path
exists in all your netns.

Linux has multiple namespaces, which in theory should be
orthogonal. However in practice, they do sometime overlap, and this is
one example. There are other examples, /proc files are also netns
unaware. It seems like having an object depend on two different
namespaces at the same time is simply not supported.

	   Andrew

Re: AF_UNIX sockets crossing namespace based boundaries

[Eric W. Biederman]

Andrew Lunn <andrew@lunn.ch> writes:

> On Wed, Jan 02, 2019 at 10:22:36AM -0500, Donald Sharp wrote:
>> I am only creating a network namespace, but I don't think this changes
>> my core question.
>> 
>> Suppose I am running FRR/zebra in the default namespace and I startup
>> a BGP instance in namespace one.  BGP will connect to the default
>> namespaces zebra instance.
>
> Hi David.
>
> We are talking about AF_UNIX here. By default, the name of the socket
> is a path on a filesystem. So to me, netns plays no role here when you
> reference the socket via its filesystem name. The path exists in the
> filesystem namespace, and in your case with only netns, the same path
> exists in all your netns.
>
> Linux has multiple namespaces, which in theory should be
> orthogonal. However in practice, they do sometime overlap, and this is
> one example. There are other examples, /proc files are also netns
> unaware. It seems like having an object depend on two different
> namespaces at the same time is simply not supported.

To clarify.

It was a deliberate design choice to allow connecting to a af_unix
socket with a presence in a filesystem from other network namespaces.

We audited the code to ensure that, that case would work without
problems before actually allowing it.

Long story short.  If two processes can communicate through the
filesystem then we allow creating an af_unix socket in the filesystem
they can communicate through.

Eric