Namespaces and inetpeer

Namespaces and inetpeer

[Herbert Xu]

Hi:

While looking through the inetpeer code I noticed that there is
no namespace support at all.  This means that metric and other
information will be leaking across namespaces.  As IP addresses
are meant to be independent between them, this is not a good thing.

We need to get the namespace folks to fix this.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Namespaces and inetpeer

[Steffen Klassert]

On Sun, Mar 11, 2012 at 12:25:29AM +1100, Herbert Xu wrote:
> Hi:
> 
> While looking through the inetpeer code I noticed that there is
> no namespace support at all.  This means that metric and other
> information will be leaking across namespaces.  As IP addresses
> are meant to be independent between them, this is not a good thing.
> 

Actually, it would be nice if we could have an inetpeer base per
fib table. This would imply namespace awareness and it would
handle the problem when we have mulitiple routes (with different
metrics etc.) to the same ip address on policy routing.

Re: Namespaces and inetpeer

[David Miller]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 12 Mar 2012 09:57:56 +0100

> On Sun, Mar 11, 2012 at 12:25:29AM +1100, Herbert Xu wrote:
>> Hi:
>> 
>> While looking through the inetpeer code I noticed that there is
>> no namespace support at all.  This means that metric and other
>> information will be leaking across namespaces.  As IP addresses
>> are meant to be independent between them, this is not a good thing.
>> 
> 
> Actually, it would be nice if we could have an inetpeer base per
> fib table. This would imply namespace awareness and it would
> handle the problem when we have mulitiple routes (with different
> metrics etc.) to the same ip address on policy routing.

Then you will ask for one per security policy too, to handle IPSEC.

Re: Namespaces and inetpeer

[Steffen Klassert]

On Mon, Mar 12, 2012 at 02:35:05AM -0700, David Miller wrote:
> From: Steffen Klassert <steffen.klassert@secunet.com>
> Date: Mon, 12 Mar 2012 09:57:56 +0100
> 
> > On Sun, Mar 11, 2012 at 12:25:29AM +1100, Herbert Xu wrote:
> >> Hi:
> >> 
> >> While looking through the inetpeer code I noticed that there is
> >> no namespace support at all.  This means that metric and other
> >> information will be leaking across namespaces.  As IP addresses
> >> are meant to be independent between them, this is not a good thing.
> >> 
> > 
> > Actually, it would be nice if we could have an inetpeer base per
> > fib table. This would imply namespace awareness and it would
> > handle the problem when we have mulitiple routes (with different
> > metrics etc.) to the same ip address on policy routing.
> 
> Then you will ask for one per security policy too, to handle IPSEC.

Hm, I don't see why this would be needed too.

It was just an idea to handle the metrcis with policy routing.
Better ideas are very welcome of course :)

Re: Namespaces and inetpeer

[David Miller]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 12 Mar 2012 10:58:40 +0100

> On Mon, Mar 12, 2012 at 02:35:05AM -0700, David Miller wrote:
>> Then you will ask for one per security policy too, to handle IPSEC.
> 
> Hm, I don't see why this would be needed too.

Oh, that's right, we use independent kmalloc'd metrics for IPSEC
routes.

> It was just an idea to handle the metrcis with policy routing.

Right :-)

Re: Namespaces and inetpeer

[Herbert Xu]

On Mon, Mar 12, 2012 at 09:57:56AM +0100, Steffen Klassert wrote:
>
> Actually, it would be nice if we could have an inetpeer base per
> fib table. This would imply namespace awareness and it would
> handle the problem when we have mulitiple routes (with different
> metrics etc.) to the same ip address on policy routing.

How would you handle incoming ICMP need-to-frag messages?

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Namespaces and inetpeer

[Steffen Klassert]

On Mon, Mar 12, 2012 at 11:11:30PM +1100, Herbert Xu wrote:
> On Mon, Mar 12, 2012 at 09:57:56AM +0100, Steffen Klassert wrote:
> >
> > Actually, it would be nice if we could have an inetpeer base per
> > fib table. This would imply namespace awareness and it would
> > handle the problem when we have mulitiple routes (with different
> > metrics etc.) to the same ip address on policy routing.
> 
> How would you handle incoming ICMP need-to-frag messages?
> 

I thought we could do a (reverse) lookup for the fib table
on incomming ICMP messages. While this would probaply work
if the source address etc. was used as the lookup key for the
initial fib table lookup, this is a real problem if a netfilter
mark was used as the lookup key.

While looking closer at this issue, I've got some doubts if we
ever handled the metrics correct when we choose the fib tables
based on marks. And indeed, in this case it never really worked.
When we updated the mtu based on an incomming ICMP from a certain
IP address, all routes to this ip address used this updated mtu.

If we choose the fib table based on source addresses, it worked as
long as we cached the metrics in the routing cache entries.
While we probaply could fix this case, I don't see how we can handle
the metrics when the initial fib table lookup is base on marks.