On Mon, Jan 23, 2017 at 6:31 PM, David Ahern <d...@cumulusnetworks.com> wrote: > On 1/23/17 7:09 PM, Alexei Starovoitov wrote: >>> + */ >>> + if (current->nsproxy->net_ns != &init_net) >>> + return -EINVAL; >> >> this restriction I actually don't mind, since it indeed can be >> relaxed later, but please make it proper with net_eq() >> > > I do mind. Why have different restrictions for the skb and sk filters? > > I have already shown that ip can alleviate the management aspects of the > implementation -- just like ip netns does.
I'm not sure I followed what you meant. If I understood right (which is a big if) you're saying that ip vrf when run in a netns works correctly in that netns. I agree, but I think that it would continue to work (even more reliably) if the hooks only executed in the netns in which they were created. I think that would probably be a good improvement, and it could be done on top of my patch, but I'm not about to write that code for 4.10. --Andy
