netdev - Re: [PATCH net] netdevsim: Restore per-network namespace accounting for fib entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 7 Aug 2019 08:27:12 +0200
From:   Jiri Pirko <jiri@...nulli.us>
To:     Jakub Kicinski <jakub.kicinski@...ronome.com>
Cc:     David Ahern <dsahern@...nel.org>, davem@...emloft.net,
        netdev@...r.kernel.org, David Ahern <dsahern@...il.com>
Subject: Re: [PATCH net] netdevsim: Restore per-network namespace accounting
 for fib entries

Wed, Aug 07, 2019 at 12:32:14AM CEST, jakub.kicinski@...ronome.com wrote:
>On Tue,  6 Aug 2019 12:15:17 -0700, David Ahern wrote:
>> From: David Ahern <dsahern@...il.com>
>> 
>> Prior to the commit in the fixes tag, the resource controller in netdevsim
>> tracked fib entries and rules per network namespace. Restore that behavior.
>> 
>> Fixes: 5fc494225c1e ("netdevsim: create devlink instance per netdevsim instance")
>> Signed-off-by: David Ahern <dsahern@...il.com>
>
>Thanks.
>
>Let's see what Jiri says, but to me this patch seems to indeed restore
>the original per-namespace accounting when the more natural way forward
>may perhaps be to make nsim only count the fib entries where

I think that:
1) netdevsim is a glorified dummy device for testing kernel api, not for
   configuring per-namespace resource limitation.
2) If the conclusion os to use devlink instead of cgroups for resourse
   limitations, it should be done in a separate code, not in netdevsim.

I would definitelly want to wait what is the result of discussion around 2)
first. But one way or another netdevsim code should not do this, I would
like to cutout the fib limitations from it instead, just to expose the
setup resource limits through debugfs like the rest of the configuration
of netdevsim.


>
>	fib_info->net == devlink_net(devlink)
>
>> -void nsim_fib_destroy(struct nsim_fib_data *data)
>> +int nsim_fib_init(void)
>>  {
>> -	unregister_fib_notifier(&data->fib_nb);
>> -	kfree(data);
>> +	int err;
>> +
>> +	err = register_pernet_subsys(&nsim_fib_net_ops);
>> +	if (err < 0) {
>> +		pr_err("Failed to register pernet subsystem\n");
>> +		goto err_out;
>> +	}
>> +
>> +	err = register_fib_notifier(&nsim_fib_nb, nsim_fib_dump_inconsistent);
>> +	if (err < 0) {
>> +		pr_err("Failed to register fib notifier\n");
>
>		unregister_pernet_subsys(&nsim_fib_net_ops);
>?
>
>> +		goto err_out;
>> +	}
>> +
>> +err_out:
>> +	return err;
>>  }