Applying the series, with the commit message fixes listed in the replies to 1/6, 2/6 and 6/6. The code is fine as is.
On Tue, 10 Nov 2026 17:31:24 +0100, Denis V. Lunev wrote: > Patches 1 and 2 take the pernet struct from t->net in ip6_tunnel and > sit. Patches 3-5 backport the mainline vti6 fixes for moved tunnels, > patch 6 is the vz-only rest for vti6. Separate patches, not needed for this series; I created a task for it: 1. Please backport the mainline v7.2-rc1 series "require CAP_NET_ADMIN in the device netns for changelink": - 8165f7ff57d96 net: ip_gre (adds rtnl_dev_link_net_capable()) - 8211a26324667 net: ipip - 95cceadbfd52d net: ip_vti - 2496fa0b7d180 net: ip6_tunnel - f00a50876d281 net: ip6_gre - e2ac3b242c37d net: ip6_vti - 095515d89b19b xfrm: xfrm_interface - 27ccb68e7ccce net: sit https://virtuozzo.atlassian.net/browse/VSTOR-154864 Why: the ioctls of a moved tunnel now check CAP_NET_ADMIN in the creation netns, but changelink does not. rtnetlink checks it only in the CT user namespace, and changelink then rehashes the tunnel in the host netns. So container root can run ip link set v6 type vti6 local A remote B ikey K okey K on a vti6 the host moved in and take host IPsec traffic that matches these addresses and mark into its own device. Until 3/6 this was a panic for vti6. For ip6tnl, sit and ip6gre it is possible today. -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
