mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Jie Yu <yujie....@gmail.com>
Subject Review Request 68158: Fixed the iptables deadlock in CNI port mapper plugin.
Date Thu, 02 Aug 2018 05:16:52 GMT

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/68158/
-----------------------------------------------------------

Review request for mesos, Avinash sridharan, Chun-Hung Hsiao, and Greg Mann.


Bugs: MESOS-9127
    https://issues.apache.org/jira/browse/MESOS-9127


Repository: mesos


Description
-------

It is possible that the port mapping cleanup command will cause iptables
to deadlock if there are a lot of entires in the iptables, because the
`sed` won't process the next line while executing `iptables -w -t nat -D
...`. But the executing of `iptables -w -t nat -D ... ` might get stuck
if the first command `iptables -w -t nat -S %s` didn't finish (because
the xtables lock is not released). The first command might not finish if
it has a lot of output, filling the pipe that `sed` hasn't had a chance
to process yet. See more details in MESOS-9127.

This patch fixed the issue by writing the commands to a file and then
executing them.


Diffs
-----

  src/slave/containerizer/mesos/isolators/network/cni/plugins/port_mapper/port_mapper.cpp
c40b57f78193520f9f0b901201b5c4c855cde8b3 


Diff: https://reviews.apache.org/r/68158/diff/1/


Testing
-------

sudo make check
```
[       OK ] CniIsolatorPortMapperTest.ROOT_INTERNET_CURL_PortMapper (8827 ms)
```


Thanks,

Jie Yu


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message