mbox series

[0/2] Namespaceify two sysctls related with route

Message ID 20220816022522.81772-1-xu.xin16@zte.com.cn (mailing list archive)
Headers show
Series Namespaceify two sysctls related with route | expand

Message

CGEL Aug. 16, 2022, 2:25 a.m. UTC
From: xu xin <xu.xin16@zte.com.cn>

Different netns has different requirements on the setting of error_cost
and error_burst, which are related with limiting the frequency of sending
ICMP_DEST_UNREACH packets or outputing error message to dmesg.

xu xin (2):
  ipv4: Namespaceify route/error_cost knob
  ipv4: Namespaceify route/error_burst knob

 include/net/netns/ipv4.h |  2 ++
 net/ipv4/route.c         | 41 ++++++++++++++++++++--------------------
 2 files changed, 23 insertions(+), 20 deletions(-)

Comments

Jakub Kicinski Aug. 18, 2022, 3:52 a.m. UTC | #1
On Tue, 16 Aug 2022 02:25:22 +0000 cgel.zte@gmail.com wrote:
> Different netns has different requirements on the setting of error_cost
> and error_burst, which are related with limiting the frequency of sending
> ICMP_DEST_UNREACH packets or outputing error message to dmesg.

Could you add a bit more detail about why you need this knob per netns?
The code looks fine, no objections there, what I'm confused by is that
we don't have this knob for IPv6. So is it somehow important enough for
v4 to be per-ns and yet not important enough to exist at all on v6?

Could you add Documentation in Documentation/admin-guide/sysctl/net.rst
while at it, and use READ_ONCE / WRITE_ONCE when accessing the sysctl?

Please make sure to CC the relevant maintainers. IP maintainers were
not CCed here. The get_maintainers script will tell you who to CC,
please use it.
CGEL Aug. 23, 2022, 1:56 a.m. UTC | #2
On Wed, Aug 17, 2022 at 08:52:37PM -0700, Jakub Kicinski wrote:
> On Tue, 16 Aug 2022 02:25:22 +0000 cgel.zte@gmail.com wrote:
> > Different netns has different requirements on the setting of error_cost
> > and error_burst, which are related with limiting the frequency of sending
> > ICMP_DEST_UNREACH packets or outputing error message to dmesg.
> 
> Could you add a bit more detail about why you need this knob per netns?

Yes, I have sent new-version patches which update the commit lot at
https://lore.kernel.org/all/20220822045310.203649-1-xu.xin16@zte.com.cn/

The sysctls of error_cost and error_burst are important knobs to control
the sending frequency of ICMP_DEST_UNREACH packet for ipv4. When different
containers has requirements on the tuning of error_cost and error_burst,
for host's security, the sysctls should exist per network namespace so
not to bother the host's sysctl setting.

> The code looks fine, no objections there, what I'm confused by is that
> we don't have this knob for IPv6. So is it somehow important enough for
> v4 to be per-ns and yet not important enough to exist at all on v6?
> 

Sorry, but I'm not familiar with IPv6 implementation.

> Could you add Documentation in Documentation/admin-guide/sysctl/net.rst
> while at it, and use READ_ONCE / WRITE_ONCE when accessing the sysctl?
> 

Yes, done.

> Please make sure to CC the relevant maintainers. IP maintainers were
> not CCed here. The get_maintainers script will tell you who to CC,
> please use it.

Fine, done.