On 1/24/17 5:11 PM, Alexei Starovoitov wrote: > I think bpf_get_sock_netns_id() helper or sk->netns_id field would > be good addition as well, since it will allow 'ip vrf' to be smarter today. > It's also more flexible, since bpf_type_cgroup_sock program can make > its own decision when netns_id != expecte_id instead of hard coded. > Today the ip vrf use case does: 'sk->bound_dev_if = idx; return OK;' > it will be able to: > if (sk->netns_id != expected_id) > return DROP; > sk->bound_dev_if = idx; > return OK; > or > if (sk->netns_id != expected_id) > return OK; > sk->bound_dev_if = idx; > return OK;
I agree
