trf: Add client traffic management to the CLI #3959

The new smuggling facility allows mgt to abuse the heritage process and sneak file descriptors to the cache process via a socket pair. This new trade route will allow the cache to escape its jail and get privileged file descriptors anyway. The smuggler's fence is hidden in plain sight, in the heritage facility, which explains such a smug attitude. Signed-off-by: Dridi Boukelmoune <dridi.boukelmoune@gmail.com>

It will be used by the file descriptor smuggler to pass nonces for listen sockets.

We use the Traffic VSM segment to pass the nonces to the cache process, and this how they synchronize in case of partial success. Though not likely during startup, it is still possible to fail the transfer of a file descriptor, for example when running into a limit. It will become less unlikely once this may happen at any point of the cache run time.

The interface offered for operations is a set of traffic.accept, traffic.refuse and traffic.status commands with similar semantics as start, stop and status. The child process will eventually listen to the traffic.start and traffic.refuse commands, but for now only a pseudo accept_traffic parameter is added in struct params. It will be used when tasks running on worker threads reach certain points to decide whether to keep processing requests or not.

It will be used internally to interrupt blocking accept(2) calls.

The accept tasks pool themselves in order to later block on the pool_accepting variable. There could be a more efficient scheduling policy, but once we stop accepting new traffic the workload will mechanically wind down and having one worker per pool per listen socket stuck in a sleep loop ought to be an acceptable trade off, just like during the cache startup. This is triggered by MGT via the cache's CLI, using the same traffic management commands. When the acceptor shutdown is triggered, worker threads tracked as busy accepting new connections are signaled with the no-op SIGUSR1. The CLI thread waits for the last busy worker to signal that nothing else is using the listen sockets, so they can be closed safely, getting rid of an unfortunate race condition.

Stop accepting new streams but allow ongoing transactions to complete gracefully. Since this is an error condition that allows the rx loop to continue, avoid sending a GOAWAY frame more than once.

Otherwise it leads to this sequence of events: - client sends request - request proceeds - client triggers timeout_linger - client session enters waiter - traffic.refuse - client sends request - client session leaves the waiter - request proceeds The last step is the one traffic.refuse is supposed to prevent.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

trf: Add client traffic management to the CLI #3959

trf: Add client traffic management to the CLI #3959

Commits on Jul 17, 2023

trf: Add client traffic management to the CLI #3959

Are you sure you want to change the base?

trf: Add client traffic management to the CLI #3959

Commits on Jul 17, 2023