Re: Race condition with pasta COMMAND...

Hi Stefano,

On 31/01/2023 14:02, Stefano Brivio wrote:
...
  Hi Paul,

 On Mon, 30 Jan 2023 19:08:14 +0100
 Paul Holzinger <pholzing(a)redhat.com> wrote:

  Hi all,

 while debugging some things I used `./pasta --config-net -- nslookup
 google.com 1.1.1.1` to test dns.
 The problem is that does not work because the nslookup process will be
 executed before pasta is
 ready with the netns setup, i.e. compare `./pasta --config-net -- ip a`.
 
 Thanks for the report. I also hit this a couple of months ago but I
 couldn't find yet the time to deal with it:

    https://bugs.passt.top/show_bug.cgi?id=37

  So a workaround is to spawn a shell and sleep:
`sh -c "sleep 1; nslookup
 google.com 1.1.1.1"`
 However this is ugly and does not ensure that the netns is ready after
 one second. As a user
 I would expect pasta to wait until the setup is finished before it calls
 exec().
 
 Absolutely, yes.

 As I mentioned on that ticket, I *think* that the only way to make sure
 the setup is actually complete is to query back via netlink addresses
 and routes we configured -- simply waiting until we successfully sent
 netlink messages isn't enough, because it takes a (substantial) while
 until addresses and routes are actually available.

 
Is there any reason why we would explicitly need to query netlink
after the setup is done?
With NLM_F_ACK  it should wait long enough, no? We use it like that in
podman and never experienced an problem with the network not being
ready apart from ipv6 DAD and I don't think we need worry about this here.

From  a quick test, at least for my use case it seems to be working when
I hold the exec until the isolate_prefork() call.
...
 
  I can send a
patch if you agree and I find some time.
 
 That would be great, thanks in advance!

 If you get to it, I think you could reuse nl_route() and nl_addr() from
 netlink.c to perform the checks -- they might need to be extended a
 bit, I'm not sure.