Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'net-notify-users-when-an-iface-cannot-change-its-netns'
Nicolas Dichtel says:
====================
net: notify users when an iface cannot change its netns
This series adds a way to see if an interface cannot be moved to another netns.
Documentation/netlink/specs/rt_link.yaml | 3 ++
.../networking/net_cachelines/net_device.rst | 2 +-
Documentation/networking/switchdev.rst | 2 +-
drivers/net/amt.c | 2 +-
drivers/net/bonding/bond_main.c | 2 +-
drivers/net/ethernet/adi/adin1110.c | 2 +-
.../net/ethernet/marvell/prestera/prestera_main.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +-
drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
drivers/net/ethernet/rocker/rocker_main.c | 2 +-
drivers/net/ethernet/ti/cpsw_new.c | 2 +-
drivers/net/loopback.c | 2 +-
drivers/net/net_failover.c | 2 +-
drivers/net/team/team_core.c | 2 +-
drivers/net/vrf.c | 2 +-
include/linux/netdevice.h | 9 +++--
include/uapi/linux/if_link.h | 1 +
net/batman-adv/soft-interface.c | 2 +-
net/bridge/br_device.c | 2 +-
net/core/dev.c | 45 +++++++++++++++++-----
net/core/rtnetlink.c | 5 ++-
net/hsr/hsr_device.c | 2 +-
net/ieee802154/6lowpan/core.c | 2 +-
net/ieee802154/core.c | 10 ++---
net/ipv4/ip_tunnel.c | 2 +-
net/ipv4/ipmr.c | 2 +-
net/ipv6/ip6_gre.c | 2 +-
net/ipv6/ip6_tunnel.c | 2 +-
net/ipv6/ip6mr.c | 2 +-
net/ipv6/sit.c | 2 +-
net/openvswitch/vport-internal_dev.c | 2 +-
net/wireless/core.c | 10 ++---
tools/testing/selftests/net/forwarding/README | 2 +-
34 files changed, 86 insertions(+), 53 deletions(-)
Comments are welcome.
Regards,
Nicolas
====================
Link: https://patch.msgid.link/20250228102144.154802-1-nicolas.dichtel@6wind.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+86
-53
+3
Documentation/netlink/specs/rt_link.yaml
+3
Documentation/netlink/specs/rt_link.yaml
+1
-1
Documentation/networking/net_cachelines/net_device.rst
+1
-1
Documentation/networking/net_cachelines/net_device.rst
···
167
167
unsigned:1 threaded napi_poll(napi_enable,dev_set_threaded)
168
168
unsigned_long:1 see_all_hwtstamp_requests
169
169
unsigned_long:1 change_proto_down
170
-
unsigned_long:1 netns_local
170
+
unsigned_long:1 netns_immutable
171
171
unsigned_long:1 fcoe_mtu
172
172
struct list_head net_notifier_list
173
173
struct macsec_ops* macsec_ops
+1
-1
Documentation/networking/switchdev.rst
+1
-1
Documentation/networking/switchdev.rst
+1
-1
drivers/net/amt.c
+1
-1
drivers/net/amt.c
···
3099
3099
dev->addr_len = 0;
3100
3100
dev->priv_flags |= IFF_NO_QUEUE;
3101
3101
dev->lltx = true;
3102
-
dev->netns_local = true;
3102
+
dev->netns_immutable = true;
3103
3103
dev->features |= NETIF_F_GSO_SOFTWARE;
3104
3104
dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM;
3105
3105
dev->hw_features |= NETIF_F_FRAGLIST | NETIF_F_RXCSUM;
+1
-1
drivers/net/bonding/bond_main.c
+1
-1
drivers/net/bonding/bond_main.c
···
6025
6025
bond_dev->lltx = true;
6026
6026
6027
6027
/* Don't allow bond devices to change network namespaces. */
6028
-
bond_dev->netns_local = true;
6028
+
bond_dev->netns_immutable = true;
6029
6029
6030
6030
/* By default, we declare the bond to be fully
6031
6031
* VLAN hardware accelerated capable. Special
+1
-1
drivers/net/ethernet/adi/adin1110.c
+1
-1
drivers/net/ethernet/adi/adin1110.c
···
1599
1599
netdev->netdev_ops = &adin1110_netdev_ops;
1600
1600
netdev->ethtool_ops = &adin1110_ethtool_ops;
1601
1601
netdev->priv_flags |= IFF_UNICAST_FLT;
1602
-
netdev->netns_local = true;
1602
+
netdev->netns_immutable = true;
1603
1603
1604
1604
port_priv->phydev = get_phy_device(priv->mii_bus, i + 1, false);
1605
1605
if (IS_ERR(port_priv->phydev)) {
+1
-1
drivers/net/ethernet/marvell/prestera/prestera_main.c
+1
-1
drivers/net/ethernet/marvell/prestera/prestera_main.c
+2
-2
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+2
-2
drivers/net/ethernet/mellanox/mlx5/core/en_main.c
···
4423
4423
4424
4424
if (mlx5e_is_uplink_rep(priv)) {
4425
4425
features = mlx5e_fix_uplink_rep_features(netdev, features);
4426
-
netdev->netns_local = true;
4426
+
netdev->netns_immutable = true;
4427
4427
} else {
4428
-
netdev->netns_local = false;
4428
+
netdev->netns_immutable = false;
4429
4429
}
4430
4430
4431
4431
mutex_unlock(&priv->state_lock);
+1
-1
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+1
-1
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+1
-1
drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+1
-1
drivers/net/ethernet/mellanox/mlxsw/spectrum.c
···
1579
1579
NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
1580
1580
dev->vlan_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
1581
1581
dev->lltx = true;
1582
-
dev->netns_local = true;
1582
+
dev->netns_immutable = true;
1583
1583
1584
1584
dev->min_mtu = ETH_MIN_MTU;
1585
1585
dev->max_mtu = MLXSW_PORT_MAX_MTU - MLXSW_PORT_ETH_FRAME_HDR;
+1
-1
drivers/net/ethernet/rocker/rocker_main.c
+1
-1
drivers/net/ethernet/rocker/rocker_main.c
+1
-1
drivers/net/ethernet/ti/cpsw_new.c
+1
-1
drivers/net/ethernet/ti/cpsw_new.c
+1
-1
drivers/net/loopback.c
+1
-1
drivers/net/loopback.c
···
172
172
dev->flags = IFF_LOOPBACK;
173
173
dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
174
174
dev->lltx = true;
175
-
dev->netns_local = true;
175
+
dev->netns_immutable = true;
176
176
netif_keep_dst(dev);
177
177
dev->hw_features = NETIF_F_GSO_SOFTWARE;
178
178
dev->features = NETIF_F_SG | NETIF_F_FRAGLIST
+1
-1
drivers/net/net_failover.c
+1
-1
drivers/net/net_failover.c
···
734
734
failover_dev->lltx = true;
735
735
736
736
/* Don't allow failover devices to change network namespaces. */
737
-
failover_dev->netns_local = true;
737
+
failover_dev->netns_immutable = true;
738
738
739
739
failover_dev->hw_features = FAILOVER_VLAN_FEATURES |
740
740
NETIF_F_HW_VLAN_CTAG_TX |
+1
-1
drivers/net/team/team_core.c
+1
-1
drivers/net/team/team_core.c
+1
-1
drivers/net/vrf.c
+1
-1
drivers/net/vrf.c
···
1617
1617
dev->lltx = true;
1618
1618
1619
1619
/* don't allow vrf devices to change network namespaces. */
1620
-
dev->netns_local = true;
1620
+
dev->netns_immutable = true;
1621
1621
1622
1622
/* does not make sense for a VLAN to be added to a vrf device */
1623
1623
dev->features |= NETIF_F_VLAN_CHALLENGED;
+5
-4
include/linux/netdevice.h
+5
-4
include/linux/netdevice.h
···
2021
2021
* regardless of source, even if those aren't
2022
2022
* HWTSTAMP_SOURCE_NETDEV
2023
2023
* @change_proto_down: device supports setting carrier via IFLA_PROTO_DOWN
2024
-
* @netns_local: interface can't change network namespaces
2024
+
* @netns_immutable: interface can't change network namespaces
2025
2025
* @fcoe_mtu: device supports maximum FCoE MTU, 2158 bytes
2026
2026
*
2027
2027
* @net_notifier_list: List of per-net netdev notifier block
···
2429
2429
/* priv_flags_slow, ungrouped to save space */
2430
2430
unsigned long see_all_hwtstamp_requests:1;
2431
2431
unsigned long change_proto_down:1;
2432
-
unsigned long netns_local:1;
2432
+
unsigned long netns_immutable:1;
2433
2433
unsigned long fcoe_mtu:1;
2434
2434
2435
2435
struct list_head net_notifier_list;
···
4191
4191
int dev_set_alias(struct net_device *, const char *, size_t);
4192
4192
int dev_get_alias(const struct net_device *, char *, size_t);
4193
4193
int __dev_change_net_namespace(struct net_device *dev, struct net *net,
4194
-
const char *pat, int new_ifindex);
4194
+
const char *pat, int new_ifindex,
4195
+
struct netlink_ext_ack *extack);
4195
4196
static inline
4196
4197
int dev_change_net_namespace(struct net_device *dev, struct net *net,
4197
4198
const char *pat)
4198
4199
{
4199
-
return __dev_change_net_namespace(dev, net, pat, 0);
4200
+
return __dev_change_net_namespace(dev, net, pat, 0, NULL);
4200
4201
}
4201
4202
int __dev_set_mtu(struct net_device *, int);
4202
4203
int dev_set_mtu(struct net_device *, int);
+1
include/uapi/linux/if_link.h
+1
include/uapi/linux/if_link.h
+1
-1
net/batman-adv/soft-interface.c
+1
-1
net/batman-adv/soft-interface.c
···
1037
1037
dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
1038
1038
dev->priv_flags |= IFF_NO_QUEUE;
1039
1039
dev->lltx = true;
1040
-
dev->netns_local = true;
1040
+
dev->netns_immutable = true;
1041
1041
1042
1042
/* can't call min_mtu, because the needed variables
1043
1043
* have not been initialized yet
+1
-1
net/bridge/br_device.c
+1
-1
net/bridge/br_device.c
···
488
488
SET_NETDEV_DEVTYPE(dev, &br_type);
489
489
dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
490
490
dev->lltx = true;
491
-
dev->netns_local = true;
491
+
dev->netns_immutable = true;
492
492
493
493
dev->features = COMMON_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
494
494
NETIF_F_HW_VLAN_STAG_TX;
+35
-10
net/core/dev.c
+35
-10
net/core/dev.c
···
12131
12131
* is already taken in the destination network namespace.
12132
12132
* @new_ifindex: If not zero, specifies device index in the target
12133
12133
* namespace.
12134
+
* @extack: netlink extended ack
12134
12135
*
12135
12136
* This function shuts down a device interface and moves it
12136
12137
* to a new network namespace. On success 0 is returned, on
···
12141
12140
*/
12142
12141
12143
12142
int __dev_change_net_namespace(struct net_device *dev, struct net *net,
12144
-
const char *pat, int new_ifindex)
12143
+
const char *pat, int new_ifindex,
12144
+
struct netlink_ext_ack *extack)
12145
12145
{
12146
12146
struct netdev_name_node *name_node;
12147
12147
struct net *net_old = dev_net(dev);
···
12153
12151
12154
12152
/* Don't allow namespace local devices to be moved. */
12155
12153
err = -EINVAL;
12156
-
if (dev->netns_local)
12154
+
if (dev->netns_immutable) {
12155
+
NL_SET_ERR_MSG(extack, "The interface netns is immutable");
12157
12156
goto out;
12157
+
}
12158
12158
12159
12159
/* Ensure the device has been registered */
12160
-
if (dev->reg_state != NETREG_REGISTERED)
12160
+
if (dev->reg_state != NETREG_REGISTERED) {
12161
+
NL_SET_ERR_MSG(extack, "The interface isn't registered");
12161
12162
goto out;
12163
+
}
12162
12164
12163
12165
/* Get out if there is nothing todo */
12164
12166
err = 0;
···
12175
12169
err = -EEXIST;
12176
12170
if (netdev_name_in_use(net, dev->name)) {
12177
12171
/* We get here if we can't use the current device name */
12178
-
if (!pat)
12172
+
if (!pat) {
12173
+
NL_SET_ERR_MSG(extack,
12174
+
"An interface with the same name exists in the target netns");
12179
12175
goto out;
12176
+
}
12180
12177
err = dev_prep_valid_name(net, dev, pat, new_name, EEXIST);
12181
-
if (err < 0)
12178
+
if (err < 0) {
12179
+
NL_SET_ERR_MSG_FMT(extack,
12180
+
"Unable to use '%s' for the new interface name in the target netns",
12181
+
pat);
12182
12182
goto out;
12183
+
}
12183
12184
}
12184
12185
/* Check that none of the altnames conflicts. */
12185
12186
err = -EEXIST;
12186
-
netdev_for_each_altname(dev, name_node)
12187
-
if (netdev_name_in_use(net, name_node->name))
12187
+
netdev_for_each_altname(dev, name_node) {
12188
+
if (netdev_name_in_use(net, name_node->name)) {
12189
+
NL_SET_ERR_MSG_FMT(extack,
12190
+
"An interface with the altname %s exists in the target netns",
12191
+
name_node->name);
12188
12192
goto out;
12193
+
}
12194
+
}
12189
12195
12190
12196
/* Check that new_ifindex isn't used yet. */
12191
12197
if (new_ifindex) {
12192
12198
err = dev_index_reserve(net, new_ifindex);
12193
-
if (err < 0)
12199
+
if (err < 0) {
12200
+
NL_SET_ERR_MSG_FMT(extack,
12201
+
"The ifindex %d is not available in the target netns",
12202
+
new_ifindex);
12194
12203
goto out;
12204
+
}
12195
12205
} else {
12196
12206
/* If there is an ifindex conflict assign a new one */
12197
12207
err = dev_index_reserve(net, dev->ifindex);
12198
12208
if (err == -EBUSY)
12199
12209
err = dev_index_reserve(net, 0);
12200
-
if (err < 0)
12210
+
if (err < 0) {
12211
+
NL_SET_ERR_MSG(extack,
12212
+
"Unable to allocate a new ifindex in the target netns");
12201
12213
goto out;
12214
+
}
12202
12215
new_ifindex = err;
12203
12216
}
12204
12217
···
12558
12533
char fb_name[IFNAMSIZ];
12559
12534
12560
12535
/* Ignore unmoveable devices (i.e. loopback) */
12561
-
if (dev->netns_local)
12536
+
if (dev->netns_immutable)
12562
12537
continue;
12563
12538
12564
12539
/* Leave virtual devices for the generic cleanup */
+4
-1
net/core/rtnetlink.c
+4
-1
net/core/rtnetlink.c
···
1292
1292
+ nla_total_size(4) /* IFLA_TSO_MAX_SEGS */
1293
1293
+ nla_total_size(1) /* IFLA_OPERSTATE */
1294
1294
+ nla_total_size(1) /* IFLA_LINKMODE */
1295
+
+ nla_total_size(1) /* IFLA_NETNS_IMMUTABLE */
1295
1296
+ nla_total_size(4) /* IFLA_CARRIER_CHANGES */
1296
1297
+ nla_total_size(4) /* IFLA_LINK_NETNSID */
1297
1298
+ nla_total_size(4) /* IFLA_GROUP */
···
2047
2046
netif_running(dev) ? READ_ONCE(dev->operstate) :
2048
2047
IF_OPER_DOWN) ||
2049
2048
nla_put_u8(skb, IFLA_LINKMODE, READ_ONCE(dev->link_mode)) ||
2049
+
nla_put_u8(skb, IFLA_NETNS_IMMUTABLE, dev->netns_immutable) ||
2050
2050
nla_put_u32(skb, IFLA_MTU, READ_ONCE(dev->mtu)) ||
2051
2051
nla_put_u32(skb, IFLA_MIN_MTU, READ_ONCE(dev->min_mtu)) ||
2052
2052
nla_put_u32(skb, IFLA_MAX_MTU, READ_ONCE(dev->max_mtu)) ||
···
2236
2234
[IFLA_ALLMULTI] = { .type = NLA_REJECT },
2237
2235
[IFLA_GSO_IPV4_MAX_SIZE] = NLA_POLICY_MIN(NLA_U32, MAX_TCP_HEADER + 1),
2238
2236
[IFLA_GRO_IPV4_MAX_SIZE] = { .type = NLA_U32 },
2237
+
[IFLA_NETNS_IMMUTABLE] = { .type = NLA_REJECT },
2239
2238
};
2240
2239
2241
2240
static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
···
3028
3025
3029
3026
new_ifindex = nla_get_s32_default(tb[IFLA_NEW_IFINDEX], 0);
3030
3027
3031
-
err = __dev_change_net_namespace(dev, tgt_net, pat, new_ifindex);
3028
+
err = __dev_change_net_namespace(dev, tgt_net, pat, new_ifindex, extack);
3032
3029
if (err)
3033
3030
goto errout;
3034
3031
+1
-1
net/hsr/hsr_device.c
+1
-1
net/hsr/hsr_device.c
+1
-1
net/ieee802154/6lowpan/core.c
+1
-1
net/ieee802154/6lowpan/core.c
···
116
116
ldev->netdev_ops = &lowpan_netdev_ops;
117
117
ldev->header_ops = &lowpan_header_ops;
118
118
ldev->needs_free_netdev = true;
119
-
ldev->netns_local = true;
119
+
ldev->netns_immutable = true;
120
120
}
121
121
122
122
static int lowpan_validate(struct nlattr *tb[], struct nlattr *data[],
+5
-5
net/ieee802154/core.c
+5
-5
net/ieee802154/core.c
···
226
226
list_for_each_entry(wpan_dev, &rdev->wpan_dev_list, list) {
227
227
if (!wpan_dev->netdev)
228
228
continue;
229
-
wpan_dev->netdev->netns_local = false;
229
+
wpan_dev->netdev->netns_immutable = false;
230
230
err = dev_change_net_namespace(wpan_dev->netdev, net, "wpan%d");
231
231
if (err)
232
232
break;
233
-
wpan_dev->netdev->netns_local = true;
233
+
wpan_dev->netdev->netns_immutable = true;
234
234
}
235
235
236
236
if (err) {
···
242
242
list) {
243
243
if (!wpan_dev->netdev)
244
244
continue;
245
-
wpan_dev->netdev->netns_local = false;
245
+
wpan_dev->netdev->netns_immutable = false;
246
246
err = dev_change_net_namespace(wpan_dev->netdev, net,
247
247
"wpan%d");
248
248
WARN_ON(err);
249
-
wpan_dev->netdev->netns_local = true;
249
+
wpan_dev->netdev->netns_immutable = true;
250
250
}
251
251
252
252
return err;
···
291
291
switch (state) {
292
292
/* TODO NETDEV_DEVTYPE */
293
293
case NETDEV_REGISTER:
294
-
dev->netns_local = true;
294
+
dev->netns_immutable = true;
295
295
wpan_dev->identifier = ++rdev->wpan_dev_id;
296
296
list_add_rcu(&wpan_dev->list, &rdev->wpan_dev_list);
297
297
rdev->devlist_generation++;
+1
-1
net/ipv4/ip_tunnel.c
+1
-1
net/ipv4/ip_tunnel.c
···
1162
1162
* Allowing to move it to another netns is clearly unsafe.
1163
1163
*/
1164
1164
if (!IS_ERR(itn->fb_tunnel_dev)) {
1165
-
itn->fb_tunnel_dev->netns_local = true;
1165
+
itn->fb_tunnel_dev->netns_immutable = true;
1166
1166
itn->fb_tunnel_dev->mtu = ip_tunnel_bind_dev(itn->fb_tunnel_dev);
1167
1167
ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
1168
1168
itn->type = itn->fb_tunnel_dev->type;
+1
-1
net/ipv4/ipmr.c
+1
-1
net/ipv4/ipmr.c
+1
-1
net/ipv6/ip6_gre.c
+1
-1
net/ipv6/ip6_gre.c
···
1620
1620
/* FB netdevice is special: we have one, and only one per netns.
1621
1621
* Allowing to move it to another netns is clearly unsafe.
1622
1622
*/
1623
-
ign->fb_tunnel_dev->netns_local = true;
1623
+
ign->fb_tunnel_dev->netns_immutable = true;
1624
1624
1625
1625
ip6gre_fb_tunnel_init(ign->fb_tunnel_dev);
1626
1626
ign->fb_tunnel_dev->rtnl_link_ops = &ip6gre_link_ops;
+1
-1
net/ipv6/ip6_tunnel.c
+1
-1
net/ipv6/ip6_tunnel.c
···
2265
2265
/* FB netdevice is special: we have one, and only one per netns.
2266
2266
* Allowing to move it to another netns is clearly unsafe.
2267
2267
*/
2268
-
ip6n->fb_tnl_dev->netns_local = true;
2268
+
ip6n->fb_tnl_dev->netns_immutable = true;
2269
2269
2270
2270
err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
2271
2271
if (err < 0)
+1
-1
net/ipv6/ip6mr.c
+1
-1
net/ipv6/ip6mr.c
+1
-1
net/ipv6/sit.c
+1
-1
net/ipv6/sit.c
···
1859
1859
/* FB netdevice is special: we have one, and only one per netns.
1860
1860
* Allowing to move it to another netns is clearly unsafe.
1861
1861
*/
1862
-
sitn->fb_tunnel_dev->netns_local = true;
1862
+
sitn->fb_tunnel_dev->netns_immutable = true;
1863
1863
1864
1864
t = netdev_priv(sitn->fb_tunnel_dev);
1865
1865
t->net = net;
+1
-1
net/openvswitch/vport-internal_dev.c
+1
-1
net/openvswitch/vport-internal_dev.c
+5
-5
net/wireless/core.c
+5
-5
net/wireless/core.c
···
162
162
list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
163
163
if (!wdev->netdev)
164
164
continue;
165
-
wdev->netdev->netns_local = false;
165
+
wdev->netdev->netns_immutable = false;
166
166
err = dev_change_net_namespace(wdev->netdev, net, "wlan%d");
167
167
if (err)
168
168
break;
169
-
wdev->netdev->netns_local = true;
169
+
wdev->netdev->netns_immutable = true;
170
170
}
171
171
172
172
if (err) {
···
178
178
list) {
179
179
if (!wdev->netdev)
180
180
continue;
181
-
wdev->netdev->netns_local = false;
181
+
wdev->netdev->netns_immutable = false;
182
182
err = dev_change_net_namespace(wdev->netdev, net,
183
183
"wlan%d");
184
184
WARN_ON(err);
185
-
wdev->netdev->netns_local = true;
185
+
wdev->netdev->netns_immutable = true;
186
186
}
187
187
188
188
return err;
···
1513
1513
SET_NETDEV_DEVTYPE(dev, &wiphy_type);
1514
1514
wdev->netdev = dev;
1515
1515
/* can only change netns with wiphy */
1516
-
dev->netns_local = true;
1516
+
dev->netns_immutable = true;
1517
1517
1518
1518
cfg80211_init_wdev(wdev);
1519
1519
break;
+1
-1
tools/testing/selftests/net/forwarding/README
+1
-1
tools/testing/selftests/net/forwarding/README
···
6
6
7
7
Unfortunately, these namespaces can not be used with actual switching
8
8
ASICs, as their ports can not be migrated to other network namespaces
9
-
(dev->netns_local) and most of them probably do not support the
9
+
(dev->netns_immutable) and most of them probably do not support the
10
10
L1-separation provided by namespaces.
11
11
12
12
However, a similar kind of flexibility can be achieved by using VRFs and