Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Tom Herbert
On Thu, Dec 17, 2015 at 12:33 PM, Hannes Frederic Sowa wrote: > On 17.12.2015 19:10, Tom Herbert wrote: >> On Thu, Dec 17, 2015 at 9:40 AM, Hannes Frederic Sowa >> wrote: >>> On 17.12.2015 18:32, Tom Herbert wrote: On Thu, Dec 17, 2015 at 12:49 AM, Hannes Frederic Sowa wrote: > Wit

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Hannes Frederic Sowa
On 17.12.2015 19:10, Tom Herbert wrote: > On Thu, Dec 17, 2015 at 9:40 AM, Hannes Frederic Sowa > wrote: >> On 17.12.2015 18:32, Tom Herbert wrote: >>> On Thu, Dec 17, 2015 at 12:49 AM, Hannes Frederic Sowa >>> wrote: With user namespaces a normal user can start a new network namespace

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Tom Herbert
On Thu, Dec 17, 2015 at 9:40 AM, Hannes Frederic Sowa wrote: > On 17.12.2015 18:32, Tom Herbert wrote: >> On Thu, Dec 17, 2015 at 12:49 AM, Hannes Frederic Sowa >> wrote: >>> With user namespaces a normal user can start a new network namespace >>> with all privileges and thus add new offloads, le

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Hannes Frederic Sowa
On 17.12.2015 18:32, Tom Herbert wrote: > On Thu, Dec 17, 2015 at 12:49 AM, Hannes Frederic Sowa > wrote: >> With user namespaces a normal user can start a new network namespace >> with all privileges and thus add new offloads, letting the other stack >> interpret this garbage. Because the user na

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Tom Herbert
On Thu, Dec 17, 2015 at 12:49 AM, Hannes Frederic Sowa wrote: > Hi all, > > On 17.12.2015 01:04, David Miller wrote: >> From: Hannes Frederic Sowa >> Date: Tue, 15 Dec 2015 21:01:54 +0100 >> >>> udp tunnel offloads tend to aggregate datagrams based on inner >>> headers. gro engine gets notified b

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-17 Thread Hannes Frederic Sowa
Hi all, On 17.12.2015 01:04, David Miller wrote: > From: Hannes Frederic Sowa > Date: Tue, 15 Dec 2015 21:01:54 +0100 > >> udp tunnel offloads tend to aggregate datagrams based on inner >> headers. gro engine gets notified by tunnel implementations about >> possible offloads. The match is solely

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-16 Thread David Miller
From: Hannes Frederic Sowa Date: Tue, 15 Dec 2015 21:01:54 +0100 > udp tunnel offloads tend to aggregate datagrams based on inner > headers. gro engine gets notified by tunnel implementations about > possible offloads. The match is solely based on the port number. > > Imagine a tunnel bound to p

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-16 Thread Hannes Frederic Sowa
On 15.12.2015 23:39, Tom Herbert wrote: > On Tue, Dec 15, 2015 at 12:46 PM, Hannes Frederic Sowa > wrote: >> On 15.12.2015 21:26, Tom Herbert wrote: >>> On Tue, Dec 15, 2015 at 12:01 PM, Hannes Frederic Sowa >>> wrote: udp tunnel offloads tend to aggregate datagrams based on inner heade

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-15 Thread Tom Herbert
On Tue, Dec 15, 2015 at 12:46 PM, Hannes Frederic Sowa wrote: > On 15.12.2015 21:26, Tom Herbert wrote: >> On Tue, Dec 15, 2015 at 12:01 PM, Hannes Frederic Sowa >> wrote: >>> udp tunnel offloads tend to aggregate datagrams based on inner >>> headers. gro engine gets notified by tunnel implementa

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-15 Thread Hannes Frederic Sowa
On 15.12.2015 21:26, Tom Herbert wrote: > On Tue, Dec 15, 2015 at 12:01 PM, Hannes Frederic Sowa > wrote: >> udp tunnel offloads tend to aggregate datagrams based on inner >> headers. gro engine gets notified by tunnel implementations about >> possible offloads. The match is solely based on the po

Re: [PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-15 Thread Tom Herbert
On Tue, Dec 15, 2015 at 12:01 PM, Hannes Frederic Sowa wrote: > udp tunnel offloads tend to aggregate datagrams based on inner > headers. gro engine gets notified by tunnel implementations about > possible offloads. The match is solely based on the port number. > > Imagine a tunnel bound to port 5

[PATCH net 2/2] udp: restrict offloads to one namespace

2015-12-15 Thread Hannes Frederic Sowa
udp tunnel offloads tend to aggregate datagrams based on inner headers. gro engine gets notified by tunnel implementations about possible offloads. The match is solely based on the port number. Imagine a tunnel bound to port 53, the offloading will look into all DNS packets and tries to aggregate