Messages in this thread | | | Date | Tue, 23 Aug 2022 01:56:06 +0000 | From | CGEL <> | Subject | Re: [PATCH 0/2] Namespaceify two sysctls related with route |
| |
On Wed, Aug 17, 2022 at 08:52:37PM -0700, Jakub Kicinski wrote: > On Tue, 16 Aug 2022 02:25:22 +0000 cgel.zte@gmail.com wrote: > > Different netns has different requirements on the setting of error_cost > > and error_burst, which are related with limiting the frequency of sending > > ICMP_DEST_UNREACH packets or outputing error message to dmesg. > > Could you add a bit more detail about why you need this knob per netns?
Yes, I have sent new-version patches which update the commit lot at https://lore.kernel.org/all/20220822045310.203649-1-xu.xin16@zte.com.cn/
The sysctls of error_cost and error_burst are important knobs to control the sending frequency of ICMP_DEST_UNREACH packet for ipv4. When different containers has requirements on the tuning of error_cost and error_burst, for host's security, the sysctls should exist per network namespace so not to bother the host's sysctl setting.
> The code looks fine, no objections there, what I'm confused by is that > we don't have this knob for IPv6. So is it somehow important enough for > v4 to be per-ns and yet not important enough to exist at all on v6? >
Sorry, but I'm not familiar with IPv6 implementation.
> Could you add Documentation in Documentation/admin-guide/sysctl/net.rst > while at it, and use READ_ONCE / WRITE_ONCE when accessing the sysctl? >
Yes, done.
> Please make sure to CC the relevant maintainers. IP maintainers were > not CCed here. The get_maintainers script will tell you who to CC, > please use it.
Fine, done.
| |