Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751361AbbGaHiO (ORCPT ); Fri, 31 Jul 2015 03:38:14 -0400 Received: from mail-wi0-f174.google.com ([209.85.212.174]:33703 "EHLO mail-wi0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750991AbbGaHiM (ORCPT ); Fri, 31 Jul 2015 03:38:12 -0400 Date: Fri, 31 Jul 2015 09:38:09 +0200 From: Thomas Graf To: Joe Stringer Cc: Linux Netdev List , Linux Kernel , Pablo Neira Ayuso , Patrick McHardy , Justin Pettit , Pravin Shelar , Andy Zhou , Jesse Gross , Florian Westphal , Hannes Sowa Subject: Re: [PATCH net-next 1/9] openvswitch: Scrub packet in ovs_vport_receive() Message-ID: <20150731073809.GA4738@pox.localdomain> References: <1438279963-29563-1-git-send-email-joestringer@nicira.com> <1438279963-29563-2-git-send-email-joestringer@nicira.com> <20150730184010.GC11177@pox.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1665 Lines: 33 On 07/30/15 at 04:16pm, Joe Stringer wrote: > On 30 July 2015 at 11:40, Thomas Graf wrote: > > On 07/30/15 at 11:12am, Joe Stringer wrote: > >> Signed-off-by: Joe Stringer > > > > Can you write a few lines on why this is needed? I have flows which > > use the mark to communicate with netfilter through internal ports. > > The problem I was seeing is when packets come from a different > namespace on the localhost, they still have conntrack data associated. > This doesn't make sense, so the intention is to perform nf_reset(). > However, it seems like we should actually be doing a bit more - at > least the skb_dst_drop() and perhaps some of the other stuff in > skb_scrub_packet(). > > Do you want to retain the mark when transitioning between namespaces? Since we have retained it so far I think we should keep on doing that. I'm pretty sure there are users of it out there besides me. As you know, it's common to have tap devices in between OVS and the guest in OpenStack and install netfilter rules there. As for whether we should scrub it in between namespaces. Probably yes but it's definitely tremendously useful to be able to transfer some metadata (mark and dst metadata) between namespaces. The default behaviour should probably be to scrub it with a flag to keep it. If that flag is not set and nsid of port != bridge then we scrub the mark and other metadata. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/