From: David Ahern <dsahern@kernel.org>
To: Mike Manning <mvrmanning@gmail.com>,
netdev@vger.kernel.org, jluebbe@lasnet.de
Subject: Re: [PATCH] net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set
Date: Thu, 28 Jul 2022 20:56:56 -0600 [thread overview]
Message-ID: <3fe65335-4ffe-d0e4-26c5-009b6dfbc633@kernel.org> (raw)
In-Reply-To: <20220725181442.18041-1-mvrmanning@gmail.com>
On 7/25/22 12:14 PM, Mike Manning wrote:
> The commit 3c82a21f4320 ("net: allow binding socket in a VRF when
> there's an unbound socket") changed the inet socket lookup to avoid
> packets in a VRF from matching an unbound socket. This is to ensure the
> necessary isolation between the default and other VRFs for routing and
> forwarding. VRF-unaware processes running in the default VRF cannot
> access another VRF and have to be run with 'ip vrf exec <vrf>'. This is
> to be expected with tcp_l3mdev_accept disabled, but could be reallowed
> when this sysctl option is enabled. So instead of directly checking dif
> and sdif in inet[6]_match, here call inet_sk_bound_dev_eq(). This
> allows a match on unbound socket for non-zero sdif i.e. for packets in
> a VRF, if tcp_l3mdev_accept is enabled.
>
> Fixes: 3c82a21f4320 ("net: allow binding socket in a VRF when there's an unbound socket")
> Signed-off-by: Mike Manning <mvrmanning@gmail.com>
> Link: https://lore.kernel.org/netdev/a54c149aed38fded2d3b5fdb1a6c89e36a083b74.camel@lasnet.de/
> ---
>
> Nettest results for VRF testing remain unchanged:
>
> $ diff nettest-baseline-502c6f8cedcc.txt nettest-fix.txt
> $ tail -3 nettest-fix.txt
> Tests passed: 869
> Tests failed: 5
>
> Disclaimer: While I do not think that there should be any noticeable
> socket throughput degradation due to these changes, I am unable to
> carry out any performance tests for this, nor provide any follow-up
> support if there is any such degradation.
>
> ---
> include/net/inet6_hashtables.h | 7 +++----
> include/net/inet_hashtables.h | 19 +++----------------
> include/net/inet_sock.h | 11 +++++++++++
> 3 files changed, 17 insertions(+), 20 deletions(-)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
next prev parent reply other threads:[~2022-07-29 2:57 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-25 18:14 [PATCH] net: allow unbound socket for packets in VRF when tcp_l3mdev_accept set Mike Manning
2022-07-25 18:27 ` David Ahern
2022-07-29 2:56 ` David Ahern [this message]
2022-07-29 11:10 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3fe65335-4ffe-d0e4-26c5-009b6dfbc633@kernel.org \
--to=dsahern@kernel.org \
--cc=jluebbe@lasnet.de \
--cc=mvrmanning@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).