Re: [PATCH v3 net-next 00/15] neighbour: Namespacify arp_tbl and nd_tbl.

[Ido Schimmel <idosch@nvidia.com>]

On Tue, Aug 11, 2026 at 11:39:36AM -0700, Kuniyuki Iwashima wrote:
> On Tue, Aug 11, 2026 at 9:55 AM Ido Schimmel <idosch@nvidia.com> wrote:
> > Another thing worth a discussion is the policy regarding the initial
> > values in each namespace. With this patchset, new namespaces all get the
> > same default values instead of inheriting from the initial namespace:
> >
> > # sysctl net.ipv4.neigh.default.gc_thresh1
> > net.ipv4.neigh.default.gc_thresh1 = 128
> > # sysctl -wq net.ipv4.neigh.default.gc_thresh1=129
> > # ip netns add ns1
> > # ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1
> > net.ipv4.neigh.default.gc_thresh1 = 128
> >
> > Assuming that today people configure the initial namespace before
> > creating namespaces, changing the policy to inherit from the initial
> > namespace will probably result in fewer regression reports. There is a
> > knob that controls this policy for other settings (see
> > devconf_inherit_init_net).
> 
> I considered adding a new knob like tcp_chlid_ehash_entries to
> control the behaviour, but I was wondering if it might be rather
> confusing to people in the future that only GC attributes are inherited.
> But I don't have strong preference here.

Why only GC attributes and not all the default parameters? IOW,
everything under /proc/sys/net/ipv{4,6}/neigh/default/. Something like
[1]. With it, I get:

# sysctl net.ipv4.neigh.default.gc_thresh1
net.ipv4.neigh.default.gc_thresh1 = 128
# sysctl net.ipv4.neigh.default.base_reachable_time_ms
net.ipv4.neigh.default.base_reachable_time_ms = 30000
# sysctl -wq net.ipv4.neigh.default.gc_thresh1=129
# sysctl -wq net.ipv4.neigh.default.base_reachable_time_ms=40000
# ip netns add ns1
# ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1
net.ipv4.neigh.default.gc_thresh1 = 129
# ip netns exec ns1 sysctl net.ipv4.neigh.default.base_reachable_time_ms
net.ipv4.neigh.default.base_reachable_time_ms = 40000

I think that's closer to the existing behavior. We can add something
like net.core.neigh_inherit_init_net to make the policy configurable:

0 - Use default values.
1 - Inherit from initial network namespace. Default.

[1]
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 07c62268fc3b..0b55baecc55c 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1913,6 +1913,22 @@ static void neigh_table_clear(struct net *net, struct neigh_table *tbl)
 	neigh_table_put(tbl);
 }
 
+static void neigh_table_inherit(struct net *net, struct neigh_table *tbl,
+				int index)
+{
+	const struct neigh_table *init_tbl = init_net.neigh_tables[index];
+
+	if (net_eq(net, &init_net))
+		return;
+
+	tbl->gc_interval = READ_ONCE(init_tbl->gc_interval);
+	tbl->gc_thresh1 = READ_ONCE(init_tbl->gc_thresh1);
+	tbl->gc_thresh2 = READ_ONCE(init_tbl->gc_thresh2);
+	tbl->gc_thresh3 = READ_ONCE(init_tbl->gc_thresh3);
+
+	memcpy(tbl->parms.data, init_tbl->parms.data, sizeof(tbl->parms.data));
+}
+
 int neigh_table_register(struct net *net, struct neigh_table *tbl, int index)
 {
 	int err;
@@ -1923,6 +1939,9 @@ int neigh_table_register(struct net *net, struct neigh_table *tbl, int index)
 		goto err;
 	}
 
+	/* Must be called before neigh_table_init(). */
+	neigh_table_inherit(net, tbl, index);
+
 	err = neigh_table_init(net, tbl);
 	if (err)
 		goto free_table;