netdev - Re: [PATCH 0/3] Namespaceify two sysctls related with route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20220822190518.67459ae3@kernel.org>
Date:   Mon, 22 Aug 2022 19:05:18 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     cgel.zte@...il.com
Cc:     davem@...emloft.net, yoshfuji@...ux-ipv6.org, dsahern@...nel.org,
        netdev@...r.kernel.org, linl@...r.kernel.org, xu.xin16@....com.cn
Subject: Re: [PATCH 0/3] Namespaceify two sysctls related with route

On Mon, 22 Aug 2022 04:53:10 +0000 cgel.zte@...il.com wrote:
> With the rise of cloud native, more and more container applications are
> deployed. The network namespace is one of the foundations of the container.
> The sysctls of error_cost and error_burst are important knobs to control
> the sending frequency of ICMP_DEST_UNREACH packet for ipv4. When different
> containers has requirements on the tuning of error_cost and error_burst,
> for host's security, the sysctls should exist per network namespace.
> 
> Different netns has different requirements on the setting of error_cost
> and error_burst, which are related with limiting the frequency of sending
> ICMP_DEST_UNREACH packets. Enable them to be configured per netns.

I'm not familiar with the IPv6 implementation either, but someone needs
to explain to me why the knob is important in v4 while entirely absent
in v6. On the surface this makes no sense. There may be a good reason,
it just needs to be stated.

Also from the patches:

Signed-off-by: CGEL ZTE <cgel.zte@...il.com>

Bots / teams can't sign off patches, I've been over this with your
colleagues. Please put your team's name in your signoff, e.g.

Signed-off-by: Minghao Chi (CGEL ZTE) <chi.minghao@....com.cn>

Thanks!