netdev - Re: [Patch net-next] net: make neigh tables per netns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 26 Jun 2014 08:14:39 +0200
From:	Michal Kubecek <mkubecek@...e.cz>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Cong Wang <xiyou.wangcong@...il.com>,
	Linux Kernel Network Developers <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Patrick McHardy <kaber@...sh.net>,
	stephen hemminger <stephen@...workplumber.org>,
	Cong Wang <cwang@...pensource.com>
Subject: Re: [Patch net-next] net: make neigh tables per netns

On Wed, Jun 25, 2014 at 06:17:08PM -0700, Eric W. Biederman wrote:
> Cong Wang <xiyou.wangcong@...il.com> writes:
> 
> > On Wed, Jun 25, 2014 at 5:04 PM, Eric W. Biederman
> > <ebiederm@...ssion.com> wrote:
> 
> >> The only thing I see that you can gain by this work is getting around
> >> global limits on neighbor table size.  Something that I think is most
> >> unwise.
> >
> > Yes, this is one the benefits.
> 
> I disagree that removing a global DOS prevention check is a benefit.

Network namespaces are often used for e.g. LXC containers. In such case,
it would IMHO make sense if reaching the limits in one container didn't
affect other containers or the host system.

                                                         Michal Kubecek

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html