linux-kernel - Re: [PATCH net-next 0/3] vsock: support network namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z8h3OsmQxL3e48ZJ@devvm6277.cco0.facebook.com>
Date: Wed, 5 Mar 2025 08:09:30 -0800
From: Bobby Eshleman <bobbyeshleman@...il.com>
To: Stefano Garzarella <sgarzare@...hat.com>
Cc: "Michael S. Tsirkin" <mst@...hat.com>, Jakub Kicinski <kuba@...nel.org>,
	Jason Wang <jasowang@...hat.com>, davem@...emloft.net,
	Stefan Hajnoczi <stefanha@...hat.com>, linux-kernel@...r.kernel.org,
	Jorgen Hansen <jhansen@...are.com>, kvm@...r.kernel.org,
	virtualization@...ts.linux-foundation.org,
	linux-hyperv@...r.kernel.org, Dexuan Cui <decui@...rosoft.com>,
	netdev@...r.kernel.org
Subject: Re: [PATCH net-next 0/3] vsock: support network namespace

On Wed, Mar 05, 2025 at 10:30:17AM +0100, Stefano Garzarella wrote:
> On Wed, Mar 05, 2025 at 02:27:12AM -0500, Michael S. Tsirkin wrote:
> > On Tue, Mar 04, 2025 at 04:39:02PM -0800, Bobby Eshleman wrote:
> > > I think it might be a lot of complexity to bring into the picture from
> > > netdev, and I'm not sure there is a big win since the vsock device could
> > > also have a vsock->net itself? I think the complexity will come from the
> > > address translation, which I don't think netdev buys us because there
> > > would still be all of the work work to support vsock in netfilter?
> > 
> > Ugh.
> > 
> > Guys, let's remember what vsock is.
> > 
> > It's a replacement for the serial device with an interface
> > that's easier for userspace to consume, as you get
> > the demultiplexing by the port number.
> > 
> > The whole point of vsock is that people do not want
> > any firewalling, filtering, or management on it.
> > 
> > It needs to work with no configuration even if networking is
> > misconfigured or blocked.
> 
> I agree with Michael here.
> 
> It's been 5 years and my memory is bad, but using netdev seemed like a mess,
> especially because in vsock we don't have anything related to
> IP/Ethernet/ARP, etc.
> 
> I see vsock more as AF_UNIX than netdev.
> 

+1, I also agree with this.

For reference I added netdev to vsock before [1] to use qdisc and at
least from the qdisc perspect the juice wasn't worth the squeeze (tldr:
only pfifo_fast worked because vsock can't recover when other qdiscs silently
drop packets).

[1] https://lore.kernel.org/all/5a93c5aad99d79f028d349cb7e3c128c65d5d7e2.1660362668.git.bobby.eshleman@bytedance.com/

Best,
Bobby