Re: [PATCH v3 net-next 00/15] neighbour: Namespacify arp_tbl and nd_tbl.

On Wed, Aug 12, 2026 at 1:03 AM Ido Schimmel <[email protected]> wrote:
>
> On Tue, Aug 11, 2026 at 11:39:36AM -0700, Kuniyuki Iwashima wrote:
> > On Tue, Aug 11, 2026 at 9:55 AM Ido Schimmel <[email protected]> wrote:
> > > Another thing worth a discussion is the policy regarding the initial
> > > values in each namespace. With this patchset, new namespaces all get the
> > > same default values instead of inheriting from the initial namespace:
> > >
> > > # sysctl net.ipv4.neigh.default.gc_thresh1
> > > net.ipv4.neigh.default.gc_thresh1 = 128
> > > # sysctl -wq net.ipv4.neigh.default.gc_thresh1=129
> > > # ip netns add ns1
> > > # ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1
> > > net.ipv4.neigh.default.gc_thresh1 = 128
> > >
> > > Assuming that today people configure the initial namespace before
> > > creating namespaces, changing the policy to inherit from the initial
> > > namespace will probably result in fewer regression reports. There is a
> > > knob that controls this policy for other settings (see
> > > devconf_inherit_init_net).
> >
> > I considered adding a new knob like tcp_chlid_ehash_entries to
> > control the behaviour, but I was wondering if it might be rather
> > confusing to people in the future that only GC attributes are inherited.
> > But I don't have strong preference here.
>
> Why only GC attributes and not all the default parameters? IOW,
> everything under /proc/sys/net/ipv{4,6}/neigh/default/. Something like
> [1]. With it, I get:
>
> # sysctl net.ipv4.neigh.default.gc_thresh1
> net.ipv4.neigh.default.gc_thresh1 = 128
> # sysctl net.ipv4.neigh.default.base_reachable_time_ms
> net.ipv4.neigh.default.base_reachable_time_ms = 30000
> # sysctl -wq net.ipv4.neigh.default.gc_thresh1=129
> # sysctl -wq net.ipv4.neigh.default.base_reachable_time_ms=40000
> # ip netns add ns1
> # ip netns exec ns1 sysctl net.ipv4.neigh.default.gc_thresh1
> net.ipv4.neigh.default.gc_thresh1 = 129
> # ip netns exec ns1 sysctl net.ipv4.neigh.default.base_reachable_time_ms
> net.ipv4.neigh.default.base_reachable_time_ms = 40000
>
> I think that's closer to the existing behavior. We can add something
> like net.core.neigh_inherit_init_net to make the policy configurable:
>
> 0 - Use default values.
> 1 - Inherit from initial network namespace. Default.

Sounds good, I'll add sysctl and neigh_table_inherit() to patch 12.

Thanks !

>
> [1]
> diff --git a/net/core/neighbour.c b/net/core/neighbour.c
> index 07c62268fc3b..0b55baecc55c 100644
> --- a/net/core/neighbour.c
> +++ b/net/core/neighbour.c
> @@ -1913,6 +1913,22 @@ static void neigh_table_clear(struct net *net, struct neigh_table *tbl)
>         neigh_table_put(tbl);
>  }
>
> +static void neigh_table_inherit(struct net *net, struct neigh_table *tbl,
> +                               int index)
> +{
> +       const struct neigh_table *init_tbl = init_net.neigh_tables[index];
> +
> +       if (net_eq(net, &init_net))
> +               return;
> +
> +       tbl->gc_interval = READ_ONCE(init_tbl->gc_interval);
> +       tbl->gc_thresh1 = READ_ONCE(init_tbl->gc_thresh1);
> +       tbl->gc_thresh2 = READ_ONCE(init_tbl->gc_thresh2);
> +       tbl->gc_thresh3 = READ_ONCE(init_tbl->gc_thresh3);
> +
> +       memcpy(tbl->parms.data, init_tbl->parms.data, sizeof(tbl->parms.data));
> +}
> +
>  int neigh_table_register(struct net *net, struct neigh_table *tbl, int index)
>  {
>         int err;
> @@ -1923,6 +1939,9 @@ int neigh_table_register(struct net *net, struct neigh_table *tbl, int index)
>                 goto err;
>         }
>
> +       /* Must be called before neigh_table_init(). */
> +       neigh_table_inherit(net, tbl, index);
> +
>         err = neigh_table_init(net, tbl);
>         if (err)
>                 goto free_table;