From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: [PATCH net-next v4 0/9] vrf: allow simultaneous service instances in default and other VRFs Date: Sun, 4 Nov 2018 08:52:26 -0700 Message-ID: <28e37d43-9581-d84b-ebae-fdea8ee02242@gmail.com> References: <20181102191020.14170-1-mmanning@vyatta.att-mail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: Mike Manning , netdev@vger.kernel.org, David Miller Return-path: Received: from mail-pg1-f195.google.com ([209.85.215.195]:40160 "EHLO mail-pg1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729446AbeKEBH4 (ORCPT ); Sun, 4 Nov 2018 20:07:56 -0500 Received: by mail-pg1-f195.google.com with SMTP id z10so1188876pgp.7 for ; Sun, 04 Nov 2018 07:52:30 -0800 (PST) In-Reply-To: <20181102191020.14170-1-mmanning@vyatta.att-mail.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 11/2/18 1:10 PM, Mike Manning wrote: > Services currently have to be VRF-aware if they are using an unbound > socket. One cannot have multiple service instances running in the > default and other VRFs for services that are not VRF-aware and listen > on an unbound socket. This is because there is no easy way of isolating > packets received in the default VRF from those arriving in other VRFs. > > This series provides this isolation for stream sockets subject to the > existing kernel parameter net.ipv4.tcp_l3mdev_accept not being set, > given that this is documented as allowing a single service instance to > work across all VRF domains. Similarly, net.ipv4.udp_l3mdev_accept is > checked for datagram sockets, and net.ipv4.raw_l3mdev_accept is > introduced for raw sockets. The functionality applies to UDP & TCP > services as well as those using raw sockets, and is for IPv4 and IPv6. > > Example of running ssh instances in default and blue VRF: > > $ /usr/sbin/sshd -D > $ ip vrf exec vrf-blue /usr/sbin/sshd > $ ss -ta | egrep 'State|ssh' > State Recv-Q Send-Q Local Address:Port Peer Address:Port > LISTEN 0 128 0.0.0.0%vrf-blue:ssh 0.0.0.0:* > LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* > ESTAB 0 0 192.168.122.220:ssh 192.168.122.1:50282 > LISTEN 0 128 [::]%vrf-blue:ssh [::]:* > LISTEN 0 128 [::]:ssh [::]:* > ESTAB 0 0 [3000::2]%vrf-blue:ssh [3000::9]:45896 > ESTAB 0 0 [2000::2]:ssh [2000::9]:46398 > DaveM: I will take a look at this set the early part of this week. I just need a few days. Thanks,