Re: [PATCH] ipv6: enable net.ipv6.route sysctls in network namespace

[David Ahern <dsahern@gmail.com>]

On 9/21/21 9:32 AM, Florian Westphal wrote:
> Jakub Kicinski <kuba@kernel.org> wrote:
>> On Tue, 21 Sep 2021 09:22:04 +0300 Alexander Kuznetsov wrote:
>>> We want to increase route cache size in network namespace
>>> created with user namespace. Currently ipv6 route settings
>>> are disabled for non-initial network namespaces.
>>> Since routes are per network namespace it is safe
>>> to enable these sysctls.
> 
> Are routes accounted towards memcg or something like that?
> 
> Otherwise userns could start eating up memory by cranking the limit
> up to 11 and just adds a gazillion routes?
> 

Adding FIB entries I believe is now handled after commit:

commit 6126891c6d4f6f4ef50323d2020635ee255a796e
Author: Vasily Averin <vvs@virtuozzo.com>
Date:   Mon Jul 19 13:44:31 2021 +0300

    memcg: enable accounting for IP address and routing-related objects


The ip6_rt_max_size sysctl manages the number of dst entries (cached
dst's and exceptions) that can be created, and there should be some
limit that network namespace users can not exceed.