netdev - Re: [PATCH iproute2 v2 0/3] refactor the cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b4f39729-d208-8a71-6f6d-f05f00b7ec2b@gmail.com>
Date:   Mon, 17 Jun 2019 16:24:23 -0600
From:   David Ahern <dsahern@...il.com>
To:     Matteo Croce <mcroce@...hat.com>
Cc:     netdev <netdev@...r.kernel.org>,
        Stephen Hemminger <stephen@...workplumber.org>,
        David Ahern <dsahern@...nel.org>
Subject: Re: [PATCH iproute2 v2 0/3] refactor the cmd_exec()

On 6/17/19 4:20 PM, Matteo Croce wrote:
> 
> I looked for every occourrence of netns_switch():
> 
> bridge/bridge.c:                        if (netns_switch(argv[1]))
> include/namespace.h:int netns_switch(char *netns);
> ip/ip.c:                        if (netns_switch(argv[1]))
> ip/ipnetns.c:   if (netns_switch(argv[0]))
> lib/namespace.c:int netns_switch(char *name)
> lib/utils.c:    if (netns_switch(nsname))
> misc/ss.c:                      if (netns_switch(optarg))
> tc/tc.c:                        if (netns_switch(argv[1]))
> 
> the ones in {ss,tc,bridge,ip}.c are obviously handling the '-n netns'
> command line option.
> my question here is: should the VRF association be reset in all these cases?
> If we need to reset, we should really call vrf_reset() from netns_switch().
> If don't, I can add the missing vrf_reset() in ipnetns.c but I'm
> curious to know what can happen to change netns and keep VRF
> associations belonging to another netns.
> 

The VRF reset is needed on a netns exec - ie., running a command in a
network namespace.

Any netns_switch that only involves sending a netlink command in a
different namespace does not need the reset.