From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753340AbcAGVrz (ORCPT ); Thu, 7 Jan 2016 16:47:55 -0500 Received: from out01.mta.xmission.com ([166.70.13.231]:57605 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752552AbcAGVrw (ORCPT ); Thu, 7 Jan 2016 16:47:52 -0500 From: ebiederm@xmission.com (Eric W. Biederman) To: Nikolay Borisov Cc: davem@davemloft.net, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, edumazet@google.com, fan.du@intel.com, kaber@trash.net, jmorris@namei.org, alexander.h.duyck@redhat.com, kuznet@ms2.inr.ac.ru, operations@siteground.com References: <1452177525-13244-1-git-send-email-kernel@kyup.com> Date: Thu, 07 Jan 2016 15:38:13 -0600 In-Reply-To: <1452177525-13244-1-git-send-email-kernel@kyup.com> (Nikolay Borisov's message of "Thu, 7 Jan 2016 16:38:42 +0200") Message-ID: <87twmpax4q.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX1893vDHe559jGCSe2cHOGW4AncvIAcKckY= X-SA-Exim-Connect-IP: 97.121.81.63 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.4999] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa02 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa02 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: *;Nikolay Borisov X-Spam-Relay-Country: X-Spam-Timing: total 598 ms - load_scoreonly_sql: 0.06 (0.0%), signal_user_changed: 3.9 (0.7%), b_tie_ro: 2.8 (0.5%), parse: 1.16 (0.2%), extract_message_metadata: 29 (4.8%), get_uri_detail_list: 2.9 (0.5%), tests_pri_-1000: 12 (2.0%), tests_pri_-950: 2.1 (0.4%), tests_pri_-900: 1.70 (0.3%), tests_pri_-400: 34 (5.6%), check_bayes: 32 (5.3%), b_tokenize: 11 (1.9%), b_tok_get_all: 9 (1.5%), b_comp_prob: 4.5 (0.8%), b_tok_touch_all: 3.3 (0.6%), b_finish: 0.86 (0.1%), tests_pri_0: 501 (83.8%), check_dkim_signature: 0.83 (0.1%), check_dkim_adsp: 4.5 (0.8%), tests_pri_500: 8 (1.3%), rewrite_mail: 0.00 (0.0%) Subject: Re: [PATCH 0/3] Namespaceify tcp keepalive machinery X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Nikolay Borisov writes: > The following patch series enables the tcp keepalive mechanism > to be configured per net namespace. This is especially useful > if you have multiple containers hosted on one node and one of > them is under DoS- in such situations one thing which could > be done is to configure the tcp keepalive settings such that > connections for that particular container are being reset > faster. > > Another scenario where not being able to control those knob > comes per container is problematic is occurs the value of > net.netfilter.nf_conntrack_tcp_timeout_established is set > below the keepalive interval, in such situations the server won't > send an RST packet resulting in applications not trying to > reconnect and stale connection waiting. Changing the global > keepalive value is a possible solution but it might interfere > with other containers. > > The three patches gradually convert each of the affected knobs > to be per netns. I thought it would be easier for review than > put everything in one patch. If people deem it more appropriate > to squash everything in one patch (maybe after review) I'd > be more than happy to do it. > > The patches have been compile-tested on 4.4 and functionally > tested on 3.12 and they work as expected. > > These are based off 4.4-rc8 Acked-by: "Eric W. Biederman" I took a quick skim and there appears to be nothing scary in your patches and the separation of the patches did make the review easy. All of the knobs are already per socket with a global default. Moving that global to be per network namespace appears straight forward in your patches. > Nikolay Borisov (3): > ipv4: Namespaceify tcp_keepalive_time sysctl knob > ipv4: Namespecify tcp_keepalive_probes sysctl knob > ipv4: Namespecify the tcp_keepalive_intvl sysctl knob > > include/net/netns/ipv4.h | 4 ++++ > include/net/tcp.h | 15 +++++++++------ > net/ipv4/sysctl_net_ipv4.c | 42 +++++++++++++++++++++--------------------- > net/ipv4/tcp_ipv4.c | 4 ++++ > net/ipv4/tcp_timer.c | 3 --- > 5 files changed, 38 insertions(+), 30 deletions(-)