netdev - Re: [RFC net-next 0/6] Proposal for VRF-lite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 9 Jul 2015 22:14:05 -0700
From:	Scott Feldman <sfeldma@...il.com>
To:	David Ahern <dsa@...ulusnetworks.com>
Cc:	Netdev <netdev@...r.kernel.org>,
	Shrijeet Mukherjee <shm@...ulusnetworks.com>,
	Roopa Prabhu <roopa@...ulusnetworks.com>,
	Andy Gospodarek <gospo@...ulusnetworks.com>,
	Jonathan Toppins <jtoppins@...ulusnetworks.com>,
	Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
	ddutt@...ulusnetworks.com,
	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	Nicolas Dichtel <nicolas.dichtel@...nd.com>,
	"stephen@...workplumber.org" <stephen@...workplumber.org>,
	Jamal Hadi Salim <hadi@...atatu.com>,
	"ebiederm@...ssion.com" <ebiederm@...ssion.com>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: [RFC net-next 0/6] Proposal for VRF-lite - v2

On Mon, Jul 6, 2015 at 8:03 AM, David Ahern <dsa@...ulusnetworks.com> wrote:
> In the context of internet scale routing a requirement that always
> comes up is the need to partition the available routing tables into
> disjoint routing planes. A specific use case is the multi-tenancy
> problem where each tenant has their own unique routing tables and in
> the very least need different default gateways.

Based on this problem statement, netns would be the answer: to
partition the physical router into N virtual routers.  If routing is
offloaded, the offload device is netns-aware to preserve the
partitioning down to the HW level.

I see from earlier discussions on VRF that netns is no good because
it's an inefficient use of resources.  I wonder if that's true in a
practical way?  If I have a 48-port router, I could create 24 2-port
virtual routers using netns, each running routing stuff (bgp, lldp,
ospf, etc).  Is the netns overhead plus the routing sw duplication not
going to fit on a Cumulus-class router?

In other words, if noone had ever heard of VRF, we'd conclude netns
given the problem statement.  And then focus on inefficiencies in
netns, if the implementation didn't fit a particular target.

So my C in RFC is what's wrong with using netns?  And can those wrongs be fixed?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html