netdev - Re: [PATCH net 0/2] netns: audit netdevice creation with IFLA_NET_NS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 05 Feb 2015 15:34:57 +0100
From:	Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:	Arvid Brodin <arvid.brodin@...en.se>, netdev@...r.kernel.org
CC:	davem@...emloft.net, dmitry.tarnyagin@...kless.no,
	alex.aring@...il.com, linux-wpan@...r.kernel.org
Subject: Re: [PATCH net 0/2] netns: audit netdevice creation with IFLA_NET_NS_[PID|FD]

Le 04/02/2015 21:33, Arvid Brodin a écrit :
> On 2015-02-02 16:58, Nicolas Dichtel wrote:
>> Le 30/01/2015 21:00, Arvid Brodin a écrit :
>>> On 2015-01-26 22:28, Nicolas Dichtel wrote:
[snip]
> Ok, so x-netns simply means cross-netns?
Yes
>
[snip]
>> Now, the question is: does HSR really work across netns? Why is the flag
>> NETIF_F_NETNS_LOCAL set?
>> dev_forward_skb() may be used to forward an skbuff to another netns.
>
> Here is the code snippet that sets NETIF_F_NETNS_LOCAL:
> 	/* Not sure about this. Taken from bridge code. netdev_features.h says
> 	 * it means "Does not change network namespaces".
> 	 */
> 	dev->features |= NETIF_F_NETNS_LOCAL;
>
> HSR is a bit like a bridge since it forwards packets between interfaces on the
> same Ethernet network, and the bridge code sets NETIF_F_NETNS_LOCAL. And that's
> really all the reason for the inclusion of the flag - i.e. it should be removed
> if it doesn't make sense.
>
> So, does it make sense? I'm not sure exactly, but I don't think it makes sense
> to have slaves that are in different namespaces - they are supposed to be part
> of the same ethernet network after all. But maybe having the HSR interface in a
> different namespace than the two slaves could make sense - this way you could
> force an application to only communicate using the HSR protocol, and not use any
> of the slave interfaces directly.
>
> If you agree with the above, then I guess that means NETIF_F_NETNS_LOCAL should
> not be set?
It's ok for me. But I think some tests should be done. Usually,
dev_forward_skb() or skb_scrub_packet() are called to clean structures when a
skb crosses netns.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html