On Sun, Mar 13, 2016 at 5:01 PM, Mahesh Bandewar <mahe...@google.com> wrote: >>> If I understand correctly (and as Cong already said), information are >>> leaking >>> between netns during the input phase. On the tx side, skb_scrub_packet() is >>> called, but not on the rx side. I think it's wrong. There should be an >>> explicit >>> boundary. >> >> That is not what I am complaining about. >> >> I dislike the trick of switching skb->dev pointer with skb->dev->l3_dev. >> This is not how we switch netns, nor the way how netns works. >> > How it is different from what we are doing currently? > > Current: Use skb->dev for L3 processing and derive netns from skb->dev > Proposal: use skb->dev->l3_dev for L3 processing and derive netns from > skb->dev->l3_dev
If you ever read the part you quote below, you will have the answer. > >> Look at veth pair or dev_change_net_namespace(), each time when we >> switch netns, we need to do a full reregistration or a full reentrance, we >> never just switch some pointers to switch netns. This is why I said it breaks >> isolation. ^ You miss this part. >> >> Also, it is ugly to hide such a ipvlan-specific pointer for half of the RX >> code >> path. > I think I have already mentioned, I'm adding RX code now and later > I'll add TX code to use > l3_dev to make it symmetric. This way all L3 (Tx/Rx) will use this > device reference > always. You are trying to convince me by telling me you will add more ugly code?? Seriously??
