netdev - Re: [PATCH iproute2 v2] ip: reset netns after each command in batch mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 10 Jun 2019 22:36:58 +0200
From:   Matteo Croce <mcroce@...hat.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     netdev <netdev@...r.kernel.org>,
        Andrea Claudi <aclaudi@...hat.com>,
        David Ahern <dsahern@...nel.org>,
        "Eric W . Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH iproute2 v2] ip: reset netns after each command in batch mode

On Mon, Jun 10, 2019 at 7:48 PM Stephen Hemminger
<stephen@...workplumber.org> wrote:
>
> On Fri,  7 Jun 2019 22:41:22 +0200
> Matteo Croce <mcroce@...hat.com> wrote:
>
> > When creating a new netns or executing a program into an existing one,
> > the unshare() or setns() calls will change the current netns.
> > In batch mode, this can run commands on the wrong interfaces, as the
> > ifindex value is meaningful only in the current netns. For example, this
> > command fails because veth-c doesn't exists in the init netns:
>
> Applied, thanks.

Great!

I was thinking about the code flow when running ip netns exec in batch
or doall mode:

1) save the current netns()
2) change netns with setns()
3) clear the clear vrf associations with vrf_reset()
4) fork(), exec in the child
5) restore the previous netns in the parent

With a little rework (adding a parameter to cmd_exec), we could change
the netns directly in the child, so the parent doesn't need steps
1,2,3,5
This could save some errors where the previous state can't be
restored, eg. netns, vrp or the like.

I have a draft patch for this which, by the way, eliminates some dead
code, I will send to the ML soon.

Regards,
-- 
Matteo Croce
per aspera ad upstream