Messages in this thread | | | From | Cong Wang <> | Date | Tue, 17 Jul 2018 10:40:09 -0700 | Subject | Re: [PATCH RFC/RFT net-next 00/17] net: Convert neighbor tables to per-namespace |
| |
On Tue, Jul 17, 2018 at 5:11 AM <dsahern@kernel.org> wrote: > > From: David Ahern <dsahern@gmail.com> > > Nikita Leshenko reported that neighbor entries in one namespace can > evict neighbor entries in another. The problem is that the neighbor > tables have entries across all namespaces without separate accounting > and with global limits on when to scan for entries to evict.
It is nothing new, people including me already noticed this before.
> > Resolve by making the neighbor tables for ipv4, ipv6 and decnet per > namespace and making the accounting and threshold limits per namespace.
The last discussion about this a long time ago concluded that neigh table entries are controllable by remote, so after moving it to per netns, it would be easier to DOS the host.
| |