From: Benjamin LaHaise <bcrl@kvack.org>
To: James Chapman <jchapman@katalix.com>
Cc: "François Cachereul" <f.cachereul@alphalink.fr>,
"Paul Mackerras" <paulus@samba.org>,
netdev@vger.kernel.org, linux-ppp@vger.kernel.org
Subject: Re: [RFC PATCH net-next] ppp: Allow ppp device connected to an l2tp session to change of namespace
Date: Thu, 24 Oct 2013 15:53:54 +0000 [thread overview]
Message-ID: <20131024155354.GQ2704@kvack.org> (raw)
In-Reply-To: <5269402E.2070203@katalix.com>
On Thu, Oct 24, 2013 at 04:43:42PM +0100, James Chapman wrote:
> I'm thinking about the implications of a skb in the net namespace of the
> ppp interface passing through a tunnel socket which is in another
> namespace. I think net namespaces are completely isolated.
>
> To keep your ppp interfaces isolated from each other, have you
> considered using netfilter to prevent data being passed between ppp
> interfaces?
Using network namespaces for this is far more efficient. We've already
added support for doing this to other tunneling interfaces. This approach
also makes creating VPNs where there is re-use of the private address space
between different customers far easier to implement.
-ben
--
"Thought is the essence of where you are now."
WARNING: multiple messages have this Message-ID (diff)
From: Benjamin LaHaise <bcrl@kvack.org>
To: James Chapman <jchapman@katalix.com>
Cc: "François Cachereul" <f.cachereul@alphalink.fr>,
"Paul Mackerras" <paulus@samba.org>,
netdev@vger.kernel.org, linux-ppp@vger.kernel.org
Subject: Re: [RFC PATCH net-next] ppp: Allow ppp device connected to an l2tp session to change of namespace
Date: Thu, 24 Oct 2013 11:53:54 -0400 [thread overview]
Message-ID: <20131024155354.GQ2704@kvack.org> (raw)
In-Reply-To: <5269402E.2070203@katalix.com>
On Thu, Oct 24, 2013 at 04:43:42PM +0100, James Chapman wrote:
> I'm thinking about the implications of a skb in the net namespace of the
> ppp interface passing through a tunnel socket which is in another
> namespace. I think net namespaces are completely isolated.
>
> To keep your ppp interfaces isolated from each other, have you
> considered using netfilter to prevent data being passed between ppp
> interfaces?
Using network namespaces for this is far more efficient. We've already
added support for doing this to other tunneling interfaces. This approach
also makes creating VPNs where there is re-use of the private address space
between different customers far easier to implement.
-ben
--
"Thought is the essence of where you are now."
next prev parent reply other threads:[~2013-10-24 15:53 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-24 10:30 [RFC PATCH net-next] ppp: Allow ppp device connected to an l2tp session to change of namespace François Cachereul
2013-10-24 10:30 ` François Cachereul
2013-10-24 10:55 ` James Chapman
2013-10-24 10:55 ` James Chapman
2013-10-24 13:41 ` François Cachereul
2013-10-24 13:41 ` François Cachereul
2013-10-24 15:43 ` James Chapman
2013-10-24 15:43 ` James Chapman
2013-10-24 15:53 ` Benjamin LaHaise [this message]
2013-10-24 15:53 ` Benjamin LaHaise
2013-10-24 16:51 ` James Chapman
2013-10-24 16:51 ` James Chapman
2013-10-25 8:27 ` François Cachereul
2013-10-25 8:27 ` François Cachereul
2013-10-25 8:24 ` François Cachereul
2013-10-25 8:24 ` François Cachereul
2013-10-24 14:23 ` Sergei Shtylyov
2013-10-24 14:23 ` Sergei Shtylyov
2013-10-25 8:05 ` terry white
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131024155354.GQ2704@kvack.org \
--to=bcrl@kvack.org \
--cc=f.cachereul@alphalink.fr \
--cc=jchapman@katalix.com \
--cc=linux-ppp@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paulus@samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.