From mboxrd@z Thu Jan 1 00:00:00 1970 References: <1259024166-28158-1-git-send-email-arnd@arndb.de> <4B0C2824.5010502@trash.net> <200911261621.28298.arnd@arndb.de> <4B0E9FD0.4040107@trash.net> From: ebiederm@xmission.com (Eric W. Biederman) Date: Thu, 26 Nov 2009 08:38:53 -0800 In-Reply-To: <4B0E9FD0.4040107@trash.net> (Patrick McHardy's message of "Thu\, 26 Nov 2009 16\:33\:36 +0100") Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [Bridge] [PATCH 1/4] veth: move loopback logic to common location List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Patrick McHardy Cc: Herbert Xu , Eric Dumazet , Anna Fischer , netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org, Mark Smith , Gerhard Stenzel , Arnd Bergmann , Jens Osterkamp , Patrick Mullaney , Stephen Hemminger , David Miller Patrick McHardy writes: > Arnd Bergmann wrote: >> On Tuesday 24 November 2009, Patrick McHardy wrote: >>> Eric W. Biederman wrote: >>>> I don't quite follow what you intend with dev_queue_xmit when the macvlan >>>> is in one namespace and the real physical device is in another. Are >>>> you mentioning that the packet classifier runs in the namespace where >>>> the primary device lives with packets from a different namespace? >>> Exactly. And I think we should make sure that the namespace of >>> the macvlan device can't (deliberately or accidentally) cause >>> misclassification. >> >> This is independent of my series and a preexisting problem, right? > > Correct. > >> Which fields do you think need to be reset to maintain namespace >> isolation for the outbound path in macvlan? > > In addition to those already handled, I'd say > > - priority: affects qdisc classification, may refer to classes of the > old namespace > - ipvs_property: might cause packets to incorrectly skip netfilter hooks > - nf_trace: might trigger packet tracing > - nf_bridge: contains references to network devices in the old NS, > also indicates packet was bridged > - iif: index is only valid in the originating namespace > - tc_index: classification result, should only be set in the namespace > of the classifier > - tc_verd: RTTL etc. should begin at zero again > - probably secmark. Wow. I thought we were trying to reduce skbuff, where did all of those fields come from? Regarless that sounds like a good list to get stomped. Eric