Re: [PATCH v3 net-next 00/15] neighbour: Namespacify arp_tbl and nd_tbl.
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-08-13 06:17:21
On Wed, Aug 12, 2026 at 1:03 AM Ido Schimmel [off-list ref] wrote:
On Tue, Aug 11, 2026 at 11:39:36AM -0700, Kuniyuki Iwashima wrote:quoted
On Tue, Aug 11, 2026 at 9:55 AM Ido Schimmel [off-list ref] wrote:quoted
Another thing worth a discussion is the policy regarding the initial values in each namespace. With this patchset, new namespaces all get the same default values instead of inheriting from the initial namespace: # sysctl net.ipv4.neigh.default.gc_thresh1 net.ipv4.neigh.default.gc_thresh1 = 128 # sysctl -wq net.ipv4.neigh.default.gc_thresh1=129 # ip netns add ns1 # ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1 net.ipv4.neigh.default.gc_thresh1 = 128 Assuming that today people configure the initial namespace before creating namespaces, changing the policy to inherit from the initial namespace will probably result in fewer regression reports. There is a knob that controls this policy for other settings (see devconf_inherit_init_net).I considered adding a new knob like tcp_chlid_ehash_entries to control the behaviour, but I was wondering if it might be rather confusing to people in the future that only GC attributes are inherited. But I don't have strong preference here.Why only GC attributes and not all the default parameters? IOW, everything under /proc/sys/net/ipv{4,6}/neigh/default/. Something like [1]. With it, I get: # sysctl net.ipv4.neigh.default.gc_thresh1 net.ipv4.neigh.default.gc_thresh1 = 128 # sysctl net.ipv4.neigh.default.base_reachable_time_ms net.ipv4.neigh.default.base_reachable_time_ms = 30000 # sysctl -wq net.ipv4.neigh.default.gc_thresh1=129 # sysctl -wq net.ipv4.neigh.default.base_reachable_time_ms=40000 # ip netns add ns1 # ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1 net.ipv4.neigh.default.gc_thresh1 = 129 # ip netns exec ns1 sysctl net.ipv4.neigh.default.base_reachable_time_ms net.ipv4.neigh.default.base_reachable_time_ms = 40000 I think that's closer to the existing behavior. We can add something like net.core.neigh_inherit_init_net to make the policy configurable: 0 - Use default values. 1 - Inherit from initial network namespace. Default.
Sounds good, I'll add sysctl and neigh_table_inherit() to patch 12. Thanks !
quoted hunk ↗ jump to hunk
[1]diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 07c62268fc3b..0b55baecc55c 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c@@ -1913,6 +1913,22 @@ static void neigh_table_clear(struct net *net, struct neigh_table *tbl) neigh_table_put(tbl); } +static void neigh_table_inherit(struct net *net, struct neigh_table *tbl, + int index) +{ + const struct neigh_table *init_tbl = init_net.neigh_tables[index]; + + if (net_eq(net, &init_net)) + return; + + tbl->gc_interval = READ_ONCE(init_tbl->gc_interval); + tbl->gc_thresh1 = READ_ONCE(init_tbl->gc_thresh1); + tbl->gc_thresh2 = READ_ONCE(init_tbl->gc_thresh2); + tbl->gc_thresh3 = READ_ONCE(init_tbl->gc_thresh3); + + memcpy(tbl->parms.data, init_tbl->parms.data, sizeof(tbl->parms.data)); +} + int neigh_table_register(struct net *net, struct neigh_table *tbl, int index) { int err;@@ -1923,6 +1939,9 @@ int neigh_table_register(struct net *net, struct neigh_table *tbl, int index) goto err; } + /* Must be called before neigh_table_init(). */ + neigh_table_inherit(net, tbl, index); + err = neigh_table_init(net, tbl); if (err) goto free_table;