netdev - Re: [Patch net-next] net: introduce a knob to control whether to inherit devconf config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Jan 2019 09:25:07 +0100
From:   Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:     Cong Wang <xiyou.wangcong@...il.com>, netdev@...r.kernel.org
Cc:     Zhu Yanjun <Yanjun.Zhu@...driver.com>,
        Tonghao Zhang <xiangxia.m.yue@...il.com>
Subject: Re: [Patch net-next] net: introduce a knob to control whether to
 inherit devconf config

Le 18/01/2019 à 08:27, Cong Wang a écrit :
> There have been many people complaining about the inconsistent
> behaviors of IPv4 and IPv6 devconf when creating new network
> namespaces.  Currently, for IPv4, we inherit all current settings
> from init_net, but for IPv6 we reset all setting to default.
> 
> This patch introduces a new /proc file
> /proc/sys/net/core/devconf_inherit_init_net to control the
> behavior of whether to inhert sysctl current settings from init_net.
> This file itself is only available in init_net.
> 
> As demonstrated below:
> 
> Initial setup in init_net:
>  # cat /proc/sys/net/ipv4/conf/all/rp_filter
>  2
>  # cat /proc/sys/net/ipv6/conf/all/accept_dad
>  1
> 
> Default value 0 (current behavior):
>  # ip netns del test
>  # ip netns add test
>  # ip netns exec test cat /proc/sys/net/ipv4/conf/all/rp_filter
>  2
>  # ip netns exec test cat /proc/sys/net/ipv6/conf/all/accept_dad
>  0
> 
> Set to 1 (inherit from init_net):
>  # echo 1 > /proc/sys/net/core/devconf_inherit_init_net
>  # ip netns del test
>  # ip netns add test
>  # ip netns exec test cat /proc/sys/net/ipv4/conf/all/rp_filter
>  2
>  # ip netns exec test cat /proc/sys/net/ipv6/conf/all/accept_dad
>  1
> 
> Set to 2 (reset to default):
>  # echo 2 > /proc/sys/net/core/devconf_inherit_init_net
>  # ip netns del test
>  # ip netns add test
>  # ip netns exec test cat /proc/sys/net/ipv4/conf/all/rp_filter
>  0
>  # ip netns exec test cat /proc/sys/net/ipv6/conf/all/accept_dad
>  0
> 
> Set to a value out of range (invalid):
>  # echo 3 > /proc/sys/net/core/devconf_inherit_init_net
>  -bash: echo: write error: Invalid argument
>  # echo -1 > /proc/sys/net/core/devconf_inherit_init_net
>  -bash: echo: write error: Invalid argument
> 
> Reported-by: Zhu Yanjun <Yanjun.Zhu@...driver.com>
> Reported-by: Tonghao Zhang <xiangxia.m.yue@...il.com>
> Cc: Nicolas Dichtel <nicolas.dichtel@...nd.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>
Nice!

Acked-by: Nicolas Dichtel <nicolas.dichtel@...nd.com>