netdev - Re: [PATCH] macvlan: Support creating macvlans from macvlans

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 06 Mar 2009 06:17:17 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Patrick McHardy <kaber@...sh.net>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [PATCH] macvlan: Support creating macvlans from macvlans

Patrick McHardy <kaber@...sh.net> writes:

> Eric W. Biederman wrote:
>> When running in a network namespace whose only link to
>> the outside world is a macvlan device, not being
>> able to create another macvlan is a real pain.
>>
>> So modify macvlan creation to allow automatically forward
>> a creation of a macvlan on a macvlan to become a creation
>> of a macvlan on the underlying network device.
>
> I'm not sure I understand the constallation, what is the underlying
> device in this case? A device outside the namespace?

Yes.

Typical usage would be:

eth0 in the initial namespace.
A macvlan off of eth0 in each child namespace.

Which works fine until I do things like create a network namespace
when I am already inside of a network namespace.  A child of a child.
In which case I have to start rigging up something like a pair of
veths an bridging or routing to get outside connectivity.

Or roughly:
ip link add mv0 link eth0 type macvlan.
ip link add mv1 link eth0 type macvlan.
ip link set mv0 netns 1234
ip link set mv1 netns 6789

Then later I would find it very handy to do:
echo $$ -> 1234
ip link add mv3 link mv0 type macvlan
ip link set mv3 netns 101112

The fact that we only bridge traffic on the ingress from the external
world is also a pain, but that isn't trivial to fix, and fixing
it might possibly break valid macvlan users.

Eric
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html