[PATCH net-next] doc: Document unexpected tcp_l3mdev_accept=1 behavior

[PATCH net-next] doc: Document unexpected tcp_l3mdev_accept=1 behavior

[Benjamin Poirier]

As suggested by David, document a somewhat unexpected behavior that results
from net.ipv4.tcp_l3mdev_accept=1. This behavior was encountered while
debugging FRR, a VRF-aware application, on a system which used
net.ipv4.tcp_l3mdev_accept=1 and where TCP connections for BGP with MD5
keys were failing to establish.

Cc: David Ahern <dsahern@gmail.com>
Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com>
---
 Documentation/networking/vrf.rst | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/Documentation/networking/vrf.rst b/Documentation/networking/vrf.rst
index 0dde145043bc..0a9a6f968cb9 100644
--- a/Documentation/networking/vrf.rst
+++ b/Documentation/networking/vrf.rst
@@ -144,6 +144,19 @@ default VRF are only handled by a socket not bound to any VRF::
 netfilter rules on the VRF device can be used to limit access to services
 running in the default VRF context as well.
 
+Using VRF-aware applications (applications which simultaneously create sockets
+outside and inside VRFs) in conjunction with ``net.ipv4.tcp_l3mdev_accept=1``
+is possible but may lead to problems in some situations. With that sysctl
+value, it is unspecified which listening socket will be selected to handle
+connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
+socket may be used to accept new connections from a VRF. This somewhat
+unexpected behavior can lead to problems if sockets are configured with extra
+options (ex. TCP MD5 keys) with the expectation that VRF traffic will
+exclusively be handled by sockets bound to VRFs, as would be the case with
+``net.ipv4.tcp_l3mdev_accept=0``. Finally and as a reminder, regardless of
+which listening socket is selected, established sockets will be created in the
+VRF based on the ingress interface, as documented earlier.
+
 --------------------------------------------------------------------------------
 
 Using iproute2 for VRFs
-- 
2.32.0

Re: [PATCH net-next] doc: Document unexpected tcp_l3mdev_accept=1 behavior

[David Ahern]

On 8/19/21 2:38 AM, Benjamin Poirier wrote:
> As suggested by David, document a somewhat unexpected behavior that results
> from net.ipv4.tcp_l3mdev_accept=1. This behavior was encountered while
> debugging FRR, a VRF-aware application, on a system which used
> net.ipv4.tcp_l3mdev_accept=1 and where TCP connections for BGP with MD5
> keys were failing to establish.
> 
> Cc: David Ahern <dsahern@gmail.com>
> Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com>
> ---
>  Documentation/networking/vrf.rst | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/Documentation/networking/vrf.rst b/Documentation/networking/vrf.rst
> index 0dde145043bc..0a9a6f968cb9 100644
> --- a/Documentation/networking/vrf.rst
> +++ b/Documentation/networking/vrf.rst
> @@ -144,6 +144,19 @@ default VRF are only handled by a socket not bound to any VRF::
>  netfilter rules on the VRF device can be used to limit access to services
>  running in the default VRF context as well.
>  
> +Using VRF-aware applications (applications which simultaneously create sockets
> +outside and inside VRFs) in conjunction with ``net.ipv4.tcp_l3mdev_accept=1``
> +is possible but may lead to problems in some situations. With that sysctl
> +value, it is unspecified which listening socket will be selected to handle
> +connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
> +socket may be used to accept new connections from a VRF. This somewhat
> +unexpected behavior can lead to problems if sockets are configured with extra
> +options (ex. TCP MD5 keys) with the expectation that VRF traffic will
> +exclusively be handled by sockets bound to VRFs, as would be the case with
> +``net.ipv4.tcp_l3mdev_accept=0``. Finally and as a reminder, regardless of
> +which listening socket is selected, established sockets will be created in the
> +VRF based on the ingress interface, as documented earlier.
> +
>  --------------------------------------------------------------------------------
>  
>  Using iproute2 for VRFs
> 

Reviewed-by: David Ahern <dsahern@kernel.org>


I don't have the cycles right now, but if you or someone else has time
it would be good to look at ways to improve the current situation.