netdev - Re: [Patch net-next] net: make neigh tables per netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 Jun 2014 15:44:28 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	ebiederm@...ssion.com
Cc:	xiyou.wangcong@...il.com, netdev@...r.kernel.org, kaber@...sh.net,
	stephen@...workplumber.org, cwang@...pensource.com,
	stefan.bader@...onical.com, stephane.graber@...onical.com,
	chris.j.arges@...onical.com, serge.hallyn@...onical.com
Subject: Re: [Patch net-next] net: make neigh tables per netns

From: ebiederm@...ssion.com (Eric W. Biederman)
Date: Thu, 26 Jun 2014 14:53:42 -0700

> The highlights of our earlier conversation.

Thanks for the context.

First of all it is clear that once you start creating containers on the
order of half the global neigh limit, yes you will run into problems as
it's easy to have 2 or more outputs in flight.

So it would perhaps be wise to scale the limits (in some way) based
upon the number of namespaces, but still keep it a global limit.

These entries consume a global resource (memory) and benefit from
global sharing, so I am still convinced that making the tables
themselves per-ns does not make any sense.

Secondly, if there are things holding onto neighbour entries for real
we should find this out.  Once could audit neigh_lookup*() invocations
to see where that might be happening.  Also neigh_create() calls with
'want_ref' set to true.

Finally, another problem are permanent neigh entries as those cannot
be reclaimed, that might be part of the main problem here.

One idea wrt. permanent entries is that we could decide that, since
they are administratively added, they don't count against the
thresholds and limits.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html