Make fragments live in net namespaces
Status from this message: Applied.
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/10 | : Move ctl tables around.include/ include/ include/ +7 more | +169 | 1 reply | |
| 2/10 | : Make the inet_frag_queue lookup work in namespaces.include/ include/ include/ +4 more | +38 | 1 reply | |
| 3/10 | : Make the nqueues counter per-namespace.include/ include/ include/ +6 more | +24 | 1 reply | |
| 4/10 | : Make the mem counter per-namespace.include/ include/ include/ +6 more | +54 | 1 reply | |
| 5/10 | : Duplicate sysctl tables for new namespaces.include/ include/ net/ +1 more | +79 | 1 reply | |
| 6/10 | : Make the net.ipv4.ipfrag_timeout work in namespaces.include/ net/ net/ +2 more | +19 | 1 reply | |
| 7/10 | : Make thresholds work in namespaces.include/ net/ net/ +2 more | +29 | 1 reply | |
| 8/10 | : Isolate the secret interval from namespaces.include/ include/ net/ +3 more | +8 | 1 reply | |
| 9/10 | : Make the LRU list per namespace.include/ net/ net/ +2 more | +8 | 1 reply | |
| 10/10 | : Make the pernet subsystem for fragments.include/ net/ net/ +1 more | +33 | 1 reply |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH net-2.6.25 0/10] Make fragments live in net namespaces
The overall design I propose is to keep the hash table global and tag inet_frag_queue with the net. Since the fragments hash is going to be re-sizable, this is OK to keep fragments from different namespace in one hash.
To speedup the evicting process LRU list is made per namespace.
As far as the CTL-tuned variables are concerned, the timeout and thresholds are made per namespace, since they have the per namespace sense, but the secret rebuild interval is read-only in sub-namespaces.
Since fragment management code is consolidated for ipv4 and ipv6 I make them all in one go. The conntrack_reasm netns-ization is not done - we have to make at least the core netfilter per namespace first, but this reasm code is patched to keep working in the initial namespace.