[PATCH 0/2] Namespaceify two sysctls related with route

[PATCH 0/2] Namespaceify two sysctls related with route

[cgel.zte]

From: xu xin <xu.xin16@zte.com.cn>

Different netns has different requirements on the setting of error_cost
and error_burst, which are related with limiting the frequency of sending
ICMP_DEST_UNREACH packets or outputing error message to dmesg.

xu xin (2):
  ipv4: Namespaceify route/error_cost knob
  ipv4: Namespaceify route/error_burst knob

 include/net/netns/ipv4.h |  2 ++
 net/ipv4/route.c         | 41 ++++++++++++++++++++--------------------
 2 files changed, 23 insertions(+), 20 deletions(-)

-- 
2.25.1

[PATCH 1/2] ipv4: Namespaceify route/error_cost knob

[cgel.zte]

From: xu xin <xu.xin16@zte.com.cn>

Different netns has different requirement on the setting of error_cost
sysctl which is used to limit the max frequency of sending
ICMP_DEST_UNREACH packet together with error_burst.

Enable error_cost to be configured per network namespace.

Signed-off-by: xu xin <xu.xin16@zte.com.cn>
---
 include/net/netns/ipv4.h |  1 +
 net/ipv4/route.c         | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index c7320ef356d9..319395bbad3c 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -85,6 +85,7 @@ struct netns_ipv4 {
 	u32 ip_rt_min_pmtu;
 	int ip_rt_mtu_expires;
 	int ip_rt_min_advmss;
+	int ip_rt_error_cost;
 
 	struct local_ports ip_local_ports;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 795cbe1de912..0598393e03ac 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -118,7 +118,6 @@ static int ip_rt_max_size;
 static int ip_rt_redirect_number __read_mostly	= 9;
 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
-static int ip_rt_error_cost __read_mostly	= HZ;
 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
 
 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
@@ -1005,8 +1004,8 @@ static int ip_error(struct sk_buff *skb)
 		if (peer->rate_tokens > ip_rt_error_burst)
 			peer->rate_tokens = ip_rt_error_burst;
 		peer->rate_last = now;
-		if (peer->rate_tokens >= ip_rt_error_cost)
-			peer->rate_tokens -= ip_rt_error_cost;
+		if (peer->rate_tokens >= net->ipv4.ip_rt_error_cost)
+			peer->rate_tokens -= net->ipv4.ip_rt_error_cost;
 		else
 			send = false;
 		inet_putpeer(peer);
@@ -3535,13 +3534,6 @@ static struct ctl_table ipv4_route_table[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
-	{
-		.procname	= "error_cost",
-		.data		= &ip_rt_error_cost,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
-	},
 	{
 		.procname	= "error_burst",
 		.data		= &ip_rt_error_burst,
@@ -3590,6 +3582,13 @@ static struct ctl_table ipv4_route_netns_table[] = {
 		.mode       = 0644,
 		.proc_handler   = proc_dointvec,
 	},
+	{
+		.procname   = "error_cost",
+		.data       = &init_net.ipv4.ip_rt_error_cost,
+		.maxlen     = sizeof(int),
+		.mode       = 0644,
+		.proc_handler   = proc_dointvec,
+	},
 	{ },
 };
 
@@ -3653,6 +3652,7 @@ static __net_init int netns_ip_rt_init(struct net *net)
 	net->ipv4.ip_rt_min_pmtu = DEFAULT_MIN_PMTU;
 	net->ipv4.ip_rt_mtu_expires = DEFAULT_MTU_EXPIRES;
 	net->ipv4.ip_rt_min_advmss = DEFAULT_MIN_ADVMSS;
+	net->ipv4.ip_rt_error_cost = HZ;
 	return 0;
 }
 
-- 
2.25.1

[PATCH 2/2] ipv4: Namespaceify route/error_burst knob

[cgel.zte]

From: xu xin <xu.xin16@zte.com.cn>

Different netns has different requirement on the setting of error_burst
sysctl which is used to limit the frequency of sending ICMP_DEST_UNREACH
packet.

Enable error_burst to be configured per network namespace.

Signed-off-by: xu xin <xu.xin16@zte.com.cn>
---
 include/net/netns/ipv4.h |  1 +
 net/ipv4/route.c         | 21 +++++++++++----------
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 319395bbad3c..03d16cf32508 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -86,6 +86,7 @@ struct netns_ipv4 {
 	int ip_rt_mtu_expires;
 	int ip_rt_min_advmss;
 	int ip_rt_error_cost;
+	int ip_rt_error_burst;
 
 	struct local_ports ip_local_ports;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0598393e03ac..4e40b667e3fc 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -114,11 +114,11 @@
 #define DEFAULT_MIN_PMTU (512 + 20 + 20)
 #define DEFAULT_MTU_EXPIRES (10 * 60 * HZ)
 #define DEFAULT_MIN_ADVMSS 256
+#define DEFAULT_ERROR_BURST (5 * HZ)
 static int ip_rt_max_size;
 static int ip_rt_redirect_number __read_mostly	= 9;
 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
-static int ip_rt_error_burst __read_mostly	= 5 * HZ;
 
 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
 
@@ -1001,8 +1001,8 @@ static int ip_error(struct sk_buff *skb)
 	if (peer) {
 		now = jiffies;
 		peer->rate_tokens += now - peer->rate_last;
-		if (peer->rate_tokens > ip_rt_error_burst)
-			peer->rate_tokens = ip_rt_error_burst;
+		if (peer->rate_tokens > net->ipv4.ip_rt_error_burst)
+			peer->rate_tokens = net->ipv4.ip_rt_error_burst;
 		peer->rate_last = now;
 		if (peer->rate_tokens >= net->ipv4.ip_rt_error_cost)
 			peer->rate_tokens -= net->ipv4.ip_rt_error_cost;
@@ -3534,13 +3534,6 @@ static struct ctl_table ipv4_route_table[] = {
 		.mode		= 0644,
 		.proc_handler	= proc_dointvec,
 	},
-	{
-		.procname	= "error_burst",
-		.data		= &ip_rt_error_burst,
-		.maxlen		= sizeof(int),
-		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
-	},
 	{
 		.procname	= "gc_elasticity",
 		.data		= &ip_rt_gc_elasticity,
@@ -3589,6 +3582,13 @@ static struct ctl_table ipv4_route_netns_table[] = {
 		.mode       = 0644,
 		.proc_handler   = proc_dointvec,
 	},
+	{
+		.procname   = "error_burst",
+		.data       = &init_net.ipv4.ip_rt_error_burst,
+		.maxlen     = sizeof(int),
+		.mode       = 0644,
+		.proc_handler   = proc_dointvec,
+	},
 	{ },
 };
 
@@ -3653,6 +3653,7 @@ static __net_init int netns_ip_rt_init(struct net *net)
 	net->ipv4.ip_rt_mtu_expires = DEFAULT_MTU_EXPIRES;
 	net->ipv4.ip_rt_min_advmss = DEFAULT_MIN_ADVMSS;
 	net->ipv4.ip_rt_error_cost = HZ;
+	net->ipv4.ip_rt_error_burst =  DEFAULT_ERROR_BURST;
 	return 0;
 }
 
-- 
2.25.1

Re: [PATCH 0/2] Namespaceify two sysctls related with route

[Jakub Kicinski]

On Tue, 16 Aug 2022 02:25:22 +0000 cgel.zte@gmail.com wrote:
> Different netns has different requirements on the setting of error_cost
> and error_burst, which are related with limiting the frequency of sending
> ICMP_DEST_UNREACH packets or outputing error message to dmesg.

Could you add a bit more detail about why you need this knob per netns?
The code looks fine, no objections there, what I'm confused by is that
we don't have this knob for IPv6. So is it somehow important enough for
v4 to be per-ns and yet not important enough to exist at all on v6?

Could you add Documentation in Documentation/admin-guide/sysctl/net.rst
while at it, and use READ_ONCE / WRITE_ONCE when accessing the sysctl?

Please make sure to CC the relevant maintainers. IP maintainers were
not CCed here. The get_maintainers script will tell you who to CC,
please use it.

Re: [PATCH 0/2] Namespaceify two sysctls related with route

[CGEL]

On Wed, Aug 17, 2022 at 08:52:37PM -0700, Jakub Kicinski wrote:
> On Tue, 16 Aug 2022 02:25:22 +0000 cgel.zte@gmail.com wrote:
> > Different netns has different requirements on the setting of error_cost
> > and error_burst, which are related with limiting the frequency of sending
> > ICMP_DEST_UNREACH packets or outputing error message to dmesg.
> 
> Could you add a bit more detail about why you need this knob per netns?

Yes, I have sent new-version patches which update the commit lot at
https://lore.kernel.org/all/20220822045310.203649-1-xu.xin16@zte.com.cn/

The sysctls of error_cost and error_burst are important knobs to control
the sending frequency of ICMP_DEST_UNREACH packet for ipv4. When different
containers has requirements on the tuning of error_cost and error_burst,
for host's security, the sysctls should exist per network namespace so
not to bother the host's sysctl setting.

> The code looks fine, no objections there, what I'm confused by is that
> we don't have this knob for IPv6. So is it somehow important enough for
> v4 to be per-ns and yet not important enough to exist at all on v6?
> 

Sorry, but I'm not familiar with IPv6 implementation.

> Could you add Documentation in Documentation/admin-guide/sysctl/net.rst
> while at it, and use READ_ONCE / WRITE_ONCE when accessing the sysctl?
> 

Yes, done.

> Please make sure to CC the relevant maintainers. IP maintainers were
> not CCed here. The get_maintainers script will tell you who to CC,
> please use it.

Fine, done.