Re: [PATCH net-next 4/4] net/sched: act_mirred: Implement ingress actions

[Jamal Hadi Salim]

On 16-09-24 08:07 PM, Cong Wang wrote:

On Thu, Sep 22, 2016 at 10:11 PM, Shmulik Ladkani

One problem to use your code for us is that, the RX side of veth
is inside containers, not visible to outside, perhaps we need some
more parameter to tell the netns before the device name/index?
Thoughts?

Intriguing - but this would apply for only veth?

It may be around preventing loops maybe.

Could be, but personally, I treat these constructs as (powerful)
building blocks, and "with great power comes great responsibility".

Even today, one may create loops using existing 'egress redirect',
e.g. this rediculously errorneous construct:

 # ip l add v0 type veth peer name v0p
 # tc filter add dev v0p parent ffff: basic \
    action mirred egress redirect dev v0

Detecting such loops should not be hard technically, like we do
for reclassification. We might need some bits in skb to detect
this specific case.

Note my other email. We had the feature but we took it out to save bits
on the skb.


cheers,
jamal