summaryrefslogtreecommitdiffstats
path: root/Documentation/networking/vrf.rst
diff options
context:
space:
mode:
authorBenjamin Poirier <bpoirier@nvidia.com>2021-08-19 17:38:54 +0900
committerDavid S. Miller <davem@davemloft.net>2021-08-23 11:53:24 +0100
commitb1165777fe0b44e9c4a482ae98ede158a82760e2 (patch)
tree137119fa5a889293c4b593a269d3889265be3372 /Documentation/networking/vrf.rst
parentf5e165e72b29d908214e554ef57f67790ba95934 (diff)
downloadlinux-stable-b1165777fe0b44e9c4a482ae98ede158a82760e2.tar.gz
linux-stable-b1165777fe0b44e9c4a482ae98ede158a82760e2.tar.bz2
linux-stable-b1165777fe0b44e9c4a482ae98ede158a82760e2.zip
doc: Document unexpected tcp_l3mdev_accept=1 behavior
As suggested by David, document a somewhat unexpected behavior that results from net.ipv4.tcp_l3mdev_accept=1. This behavior was encountered while debugging FRR, a VRF-aware application, on a system which used net.ipv4.tcp_l3mdev_accept=1 and where TCP connections for BGP with MD5 keys were failing to establish. Cc: David Ahern <dsahern@gmail.com> Signed-off-by: Benjamin Poirier <bpoirier@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'Documentation/networking/vrf.rst')
-rw-r--r--Documentation/networking/vrf.rst13
1 files changed, 13 insertions, 0 deletions
diff --git a/Documentation/networking/vrf.rst b/Documentation/networking/vrf.rst
index 0dde145043bc..0a9a6f968cb9 100644
--- a/Documentation/networking/vrf.rst
+++ b/Documentation/networking/vrf.rst
@@ -144,6 +144,19 @@ default VRF are only handled by a socket not bound to any VRF::
netfilter rules on the VRF device can be used to limit access to services
running in the default VRF context as well.
+Using VRF-aware applications (applications which simultaneously create sockets
+outside and inside VRFs) in conjunction with ``net.ipv4.tcp_l3mdev_accept=1``
+is possible but may lead to problems in some situations. With that sysctl
+value, it is unspecified which listening socket will be selected to handle
+connections for VRF traffic; ie. either a socket bound to the VRF or an unbound
+socket may be used to accept new connections from a VRF. This somewhat
+unexpected behavior can lead to problems if sockets are configured with extra
+options (ex. TCP MD5 keys) with the expectation that VRF traffic will
+exclusively be handled by sockets bound to VRFs, as would be the case with
+``net.ipv4.tcp_l3mdev_accept=0``. Finally and as a reminder, regardless of
+which listening socket is selected, established sockets will be created in the
+VRF based on the ingress interface, as documented earlier.
+
--------------------------------------------------------------------------------
Using iproute2 for VRFs