From: Roman Mashak <mrv@mojatatu•com>
To: Liran Alon <liran.alon@oracle•com>
Cc: <daniel@iogearbox•net>, <netdev@vger•kernel.org>,
<shmulik.ladkani@gmail•com>, <davem@davemloft•net>,
<linux-kernel@vger•kernel.org>, <yuval.shaia@oracle•com>,
<idan.brown@oracle•com>
Subject: Re: [PATCH] net: dev_forward_skb(): Scrub packet's per-netns info only when crossing netns
Date: Thu, 15 Mar 2018 10:35:42 -0400 [thread overview]
Message-ID: <85woydh0e9.fsf@mojatatu.com> (raw)
In-Reply-To: <be0d17cf-12d5-440c-adee-e943ccb199c9@default> (Liran Alon's message of "Thu, 15 Mar 2018 05:23:41 -0700 (PDT)")
Liran Alon <liran.alon@oracle•com> writes:
[...]
>> Overall I think it might be nice to not need scrubbing skb in such
>> cases,
>> although my concern would be that this has potential to break
>> existing
>> setups when they would expect mark being zero on other veth peer in
>> any
>> case since it's the behavior for a long time already. The safer
>> option
>> would be to have some sort of explicit opt-in e.g. on link creation to
>> let
>> the skb->mark pass through unscrubbed. This would definitely be a
>> useful
>> option e.g. when mark is set in the netns facing veth via
>> clsact/egress
>> on xmit and when the container is unprivileged anyway.
>>
>> Thanks,
>> Daniel
>
> I see your point in regards to backwards comparability.
> However, not scrubbing skb when it cross netns via some kernel functions compared to
> others is basically a bug which could easily break with a little bit of more refactoring.
> Therefore, it seems a bit weird to me to from now on, we will force
> every user on link creation to consider that once there was a bug leading
> to this weird behavior on specific netdevs.
> Thus, I suggest to maybe control this via a global /proc/sys/net file instead.
One valid use case could be preserving a source namespace nsid in
skb->mark when a packet crosses netns.
next prev parent reply other threads:[~2018-03-15 14:35 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-15 12:23 [PATCH] net: dev_forward_skb(): Scrub packet's per-netns info only when crossing netns Liran Alon
2018-03-15 14:35 ` Roman Mashak [this message]
2018-03-15 14:53 ` Daniel Borkmann
-- strict thread matches above, loose matches on Subject: below --
2018-03-15 17:14 Liran Alon
2018-03-20 16:24 ` Eric W. Biederman
2018-03-20 16:44 ` Liran Alon
2018-03-20 17:07 ` Ben Greear
2018-03-20 18:35 ` Eric W. Biederman
2018-03-15 16:35 Liran Alon
2018-03-15 16:50 ` Shmulik Ladkani
2018-03-15 15:05 Liran Alon
2018-03-15 15:01 Liran Alon
2018-03-15 16:11 ` Shmulik Ladkani
2018-03-15 12:14 Liran Alon
2018-03-13 15:07 Liran Alon
2018-03-13 16:13 ` Yuval Shaia
2018-03-14 12:03 ` Yuval Shaia
2018-03-15 9:21 ` Shmulik Ladkani
2018-03-15 11:56 ` Daniel Borkmann
2018-03-15 12:50 ` Shmulik Ladkani
2018-03-15 15:13 ` Daniel Borkmann
2018-03-15 15:54 ` Shmulik Ladkani
2018-03-15 17:48 ` Daniel Borkmann
2018-03-20 14:47 ` David Miller
2018-03-20 15:34 ` Liran Alon
2018-03-20 16:00 ` David Miller
2018-03-20 16:11 ` Liran Alon
2018-03-20 16:34 ` David Miller
2018-03-20 16:39 ` Liran Alon
2018-03-20 18:51 ` valdis.kletnieks
2018-03-20 21:12 ` Liran Alon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=85woydh0e9.fsf@mojatatu.com \
--to=mrv@mojatatu$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=idan.brown@oracle$(echo .)com \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=liran.alon@oracle$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=shmulik.ladkani@gmail$(echo .)com \
--cc=yuval.shaia@oracle$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox