On Tue, Jun 26, 2018 at 7:35 PM Eric Dumazet <eric.dumazet@xxxxxxxxx> wrote: > > > > On 06/26/2018 05:44 PM, Cong Wang wrote: > > > With this, a netns could totally throttle a TCP socket in a different > > netns by holding the packets infinitely (e.g. putting them in a loop). > > This is where the isolation breaks. > > > > That is fine, really. Admin error -> Working as intended. The point is never it is an error or not, the point is one netns could influence another one with this change. > > The current scrubbing is simply wrong, not documented, and added by someone > who had absolutely not intended all the side effects. > IIRC, this skb_orphan() was introduced much earlier than TSQ, probably from the beginning of veth. Leaving the stack should be effectively equivalent to leaving the host, from the view of network isolation. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
