On 9/20/18 1:58 AM, Mike Manning wrote:
> Services currently have to be VRF-aware if they are using an unbound
> socket. One cannot have multiple service instances running in the
> default and other VRFs for services that are not VRF-aware and listen
> on an unbound socket. This is because there is no way of isolating
> packets received in the default VRF from those arriving in other VRFs.
>
> This series provides this isolation subject to the existing kernel
> parameter net.ipv4.tcp_l3mdev_accept not being set, given that this is
> documented as allowing a single service instance to work across all
> VRF domains. The functionality applies to UDP & TCP services, for IPv4
> and IPv6, in particular adding VRF table handling for IPv6 multicast.
>
> Example of running ssh instances in default and blue VRF:
>
> $ /usr/sbin/sshd -D
> $ ip vrf exec vrf-blue /usr/sbin/sshd
> $ ss -ta | egrep 'State|ssh'
> State Recv-Q Send-Q Local Address:Port Peer Address:Port
> LISTEN 0128 0.0.0.0%vrf-blue:ssh 0.0.0.0:*
> LISTEN 01280.0.0.0:ssh 0.0.0.0:*
> ESTAB 00 192.168.122.220:ssh 192.168.122.1:50282
> LISTEN 0128 [::]%vrf-blue:ssh[::]:*
> LISTEN 0128 [::]:ssh[::]:*
> ESTAB 00 [3000::2]%vrf-blue:ssh [3000::9]:45896
> ESTAB 00[2000::2]:ssh [2000::9]:46398
>
Hi Dave:
I need some time to review and more importantly test this patch set
before it is committed. I am traveling tomorrow afternoon through Sunday
evening, so I need a few days into next week to get to this.
Thanks,
David
