Re: Race condition with pasta COMMAND...

[Paul Holzinger <pholzing@redhat.com>]

Hi Stefano,

On 31/01/2023 14:02, Stefano Brivio wrote:
> Hi Paul,
>
> On Mon, 30 Jan 2023 19:08:14 +0100
> Paul Holzinger <pholzing@redhat.com> wrote:
>
>> Hi all,
>>
>> while debugging some things I used `./pasta --config-net -- nslookup
>> google.com 1.1.1.1` to test dns.
>> The problem is that does not work because the nslookup process will be
>> executed before pasta is
>> ready with the netns setup, i.e. compare `./pasta --config-net -- ip a`.
> Thanks for the report. I also hit this a couple of months ago but I
> couldn't find yet the time to deal with it:
>
>    https://bugs.passt.top/show_bug.cgi?id=37
>
>> So a workaround is to spawn a shell and sleep: `sh -c "sleep 1; nslookup
>> google.com 1.1.1.1"`
>> However this is ugly and does not ensure that the netns is ready after
>> one second. As a user
>> I would expect pasta to wait until the setup is finished before it calls
>> exec().
> Absolutely, yes.
>
> As I mentioned on that ticket, I *think* that the only way to make sure
> the setup is actually complete is to query back via netlink addresses
> and routes we configured -- simply waiting until we successfully sent
> netlink messages isn't enough, because it takes a (substantial) while
> until addresses and routes are actually available.
>
Is there any reason why we would explicitly need to query netlink
after the setup is done?
With NLM_F_ACK  it should wait long enough, no? We use it like that in
podman and never experienced an problem with the network not being
ready apart from ipv6 DAD and I don't think we need worry about this here.

From  a quick test, at least for my use case it seems to be working when
I hold the exec until the isolate_prefork() call.
>> I can send a patch if you agree and I find some time.
> That would be great, thanks in advance!
>
> If you get to it, I think you could reuse nl_route() and nl_addr() from
> netlink.c to perform the checks -- they might need to be extended a
> bit, I'm not sure.
>