From: ebiederm@xmission•com (Eric W. Biederman)
To: Benjamin LaHaise <bcrl@kvack•org>
Cc: rsa <ravi.mlists@gmail•com>, netdev@vger•kernel.org
Subject: Re: switching network namespace midway
Date: Wed, 24 Oct 2012 18:37:16 -0700 [thread overview]
Message-ID: <87ip9zqqlv.fsf@xmission.com> (raw)
In-Reply-To: <20121024212116.GG15034@kvack.org> (Benjamin LaHaise's message of "Wed, 24 Oct 2012 17:21:16 -0400")
Benjamin LaHaise <bcrl@kvack•org> writes:
> On Wed, Oct 24, 2012 at 02:11:14PM -0700, Eric W. Biederman wrote:
>> rsa <ravi.mlists@gmail•com> writes:
>>
>> > Assuming I have a tunnel interface where two route lookups are done --
>> > one for innter
>> > packet and the other for outer -- do you see any issues in switching
>> > the network
>> > namespace prior to second route lookup (and restore to the original namespace
>> > after the second lookup is done)?
>> >
>> > If so, are there any other calls other than sk_change_net() needed?
>>
>> In general sk_change_net is a bad idea.
>>
>> Most likely what you want to do is simply memorize both struct net's
>> that you care about and perform the routing lookup as appropriate.
>>
>> Certainly you don't want to be calling sk_change_net for every packet
>> that goes through your tunnel.
>
> I've actually done this with L2TP. The packets coming into the system from
> the tunnel are received on one UDP socket in one "struct net", but the
> decapsulated packets are received on a "struct net_device" that is in a
> different "struct net". No special coding is required -- just move the
> tunnel's net_device into another namespace after creation and it works as
> expected. Using sk_change_net() would be full of races and is really not
> required for the vast majority of use cases.
Yes. Although L2TP is not an example of code I would copy. Any other
tunnel would be better. I haven't looked closely at L2TP but it keeps
popping up as a poster child for small little network namespace bugs
that I don't want to think about.
Last I looked to use L2TP it required a magic userspace that I couldn't
find and I haven't cared enough to write. Ben would you be interested
in helping flush out the network namespace bugs out of L2TP?
Eric
next prev parent reply other threads:[~2012-10-25 1:37 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-23 17:49 switching network namespace midway rsa
2012-10-24 21:11 ` Eric W. Biederman
2012-10-24 21:21 ` Benjamin LaHaise
2012-10-25 1:37 ` Eric W. Biederman [this message]
2012-10-25 14:38 ` Benjamin LaHaise
2012-10-25 16:21 ` Stephen Hemminger
2012-10-28 5:43 ` Eric W. Biederman
2012-10-29 14:23 ` Stephen Hemminger
2012-10-30 0:21 ` Eric W. Biederman
2012-10-30 8:55 ` James Chapman
2012-10-25 15:12 ` rsa
2012-10-25 15:29 ` rsa
2012-10-25 15:59 ` Benjamin LaHaise
2012-10-25 16:15 ` Eric W. Biederman
2012-11-02 2:25 ` Benjamin LaHaise
2012-11-02 6:18 ` Eric W. Biederman
2012-11-02 14:03 ` Benjamin LaHaise
2012-11-02 20:45 ` Eric W. Biederman
2013-06-24 14:13 ` [RFC PATCH net-next 0/2] sit: allow to switch netns during encap/decap Nicolas Dichtel
2013-06-24 14:13 ` [RFC PATCH net-next 1/2] dev: introduce dev_cleanup_skb() Nicolas Dichtel
2013-06-24 18:13 ` Ben Hutchings
2013-06-24 19:05 ` Eric W. Biederman
2013-06-24 14:13 ` [RFC PATCH net-next 2/2] sit: add support of x-netns Nicolas Dichtel
2013-06-24 19:28 ` Eric W. Biederman
2013-06-24 21:11 ` Nicolas Dichtel
2013-06-24 22:42 ` Eric W. Biederman
2013-06-25 14:10 ` Nicolas Dichtel
2013-06-25 14:24 ` [PATCH v2 net-next 0/2] sit: allow to switch netns during encap/decap Nicolas Dichtel
2013-06-25 14:24 ` [PATCH v2 net-next 1/2] dev: introduce skb_scrub_packet() Nicolas Dichtel
2013-06-25 14:24 ` [PATCH v2 net-next 2/2] sit: add support of x-netns Nicolas Dichtel
2013-06-25 23:56 ` David Miller
2013-06-26 1:35 ` Eric W. Biederman
2013-06-26 5:48 ` David Miller
2013-06-26 10:03 ` Eric W. Biederman
2013-06-26 10:22 ` Eric Dumazet
2013-06-26 12:15 ` Nicolas Dichtel
2013-06-26 14:11 ` [PATCH v3 net-next 0/2] sit: allow to switch netns during encap/decap Nicolas Dichtel
2013-06-26 14:11 ` [PATCH v3 net-next 1/2] dev: introduce skb_scrub_packet() Nicolas Dichtel
2013-06-26 14:11 ` [PATCH v3 net-next 2/2] sit: add support of x-netns Nicolas Dichtel
2013-06-28 5:36 ` [PATCH v3 net-next 0/2] sit: allow to switch netns during encap/decap David Miller
2013-07-03 15:00 ` [PATCH net-next 0/3] ipip/ip6tnl: " Nicolas Dichtel
2013-07-03 15:00 ` [PATCH net-next 1/3] sit: fix tunnel update via netlink Nicolas Dichtel
2013-07-03 15:00 ` [PATCH net-next 2/3] ipip: add x-netns support Nicolas Dichtel
2013-07-03 15:00 ` [PATCH net-next 3/3] ip6tnl: " Nicolas Dichtel
2013-07-04 21:56 ` [PATCH net-next 0/3] ipip/ip6tnl: allow to switch netns during encap/decap David Miller
2013-08-13 15:51 ` [PATCH net-next v2 0/4] " Nicolas Dichtel
2013-08-13 15:51 ` [PATCH net-next v2 1/4] dev: move skb_scrub_packet() after eth_type_trans() Nicolas Dichtel
2013-08-13 15:51 ` [PATCH net-next v2 2/4] ipv4 tunnels: use net_eq() helper to check netns Nicolas Dichtel
2013-08-13 15:51 ` [PATCH net-next v2 3/4] ipip: add x-netns support Nicolas Dichtel
2013-08-13 15:51 ` [PATCH net-next v2 4/4] ip6tnl: " Nicolas Dichtel
2013-08-15 8:01 ` [PATCH net-next v2 0/4] ipip/ip6tnl: allow to switch netns during encap/decap David Miller
2013-06-26 13:49 ` [PATCH v2 net-next 2/2] sit: add support of x-netns Nicolas Dichtel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ip9zqqlv.fsf@xmission.com \
--to=ebiederm@xmission$(echo .)com \
--cc=bcrl@kvack$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=ravi.mlists@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox