netdev - ip link set master recursively put devices into promiscuous mode?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAGnHSE=0ZQK=e4kV3CgycM1xTE+woT607ZHRP_EZtngwVvVB-w@mail.gmail.com>
Date:   Mon, 16 Aug 2021 18:28:48 +0800
From:   Tom Yan <tom.ty89@...il.com>
To:     stephen@...workplumber.org, netdev@...r.kernel.org
Subject: ip link set master recursively put devices into promiscuous mode?

Hi,

I've bumped into a weird / bad behavior of ip link when I use it to
enslave a passthru macvlan to a bridge:

# grep . /etc/systemd/network/*.net*
[NetDev]
Name=bridge1
Kind=bridge
# ip l add macvl0 link wlan0 type macvlan mode passthru
# date; ip l set macvl0 up
Mon Aug 16 05:31:02 PM HKT 2021
# date; ip l delete macvl0
Mon Aug 16 05:31:12 PM HKT 2021
# ip l add macvl0 link wlan0 type macvlan mode passthru
# date; ip l set macvl0 up
Mon Aug 16 05:31:35 PM HKT 2021
# date; ip l set macvl0 master bridge1
Mon Aug 16 05:31:42 PM HKT 2021
# date; ip l delete macvl0
Mon Aug 16 05:31:47 PM HKT 2021
# journalctl -k | grep promisc
Aug 16 17:31:02 ideapad kernel: device wlan0 entered promiscuous mode
Aug 16 17:31:12 ideapad kernel: device wlan0 left promiscuous mode
Aug 16 17:31:35 ideapad kernel: device wlan0 entered promiscuous mode
Aug 16 17:31:42 ideapad kernel: device macvl0 entered promiscuous mode
Aug 16 17:31:47 ideapad kernel: device macvl0 left promiscuous mode

The cause became clear when I use the nopromisc flag:

# ip l add macvl0 link wlan0 type macvlan mode passthru nopromisc
# date; ip l set macvl0 up
Mon Aug 16 05:35:27 PM HKT 2021
# date; ip l set macvl0 master bridge1
Mon Aug 16 05:35:36 PM HKT 2021
# date; ip l delete macvl0
Mon Aug 16 05:35:47 PM HKT 2021
# journalctl -k | grep promisc
Aug 16 17:35:36 ideapad kernel: device macvl0 entered promiscuous mode
Aug 16 17:35:36 ideapad kernel: device wlan0 entered promiscuous mode
Aug 16 17:35:47 ideapad kernel: device macvl0 left promiscuous mode

For some reason it causes the underlying device of the macvlan to also
enter promiscuous mode. In addition to the fact that the behavior
causes the underlying device *stay* in promiscuous mode (which shows
why it is *bad*), it does not seem to be a kernel-side problem either,
as when I use systemd-networkd to enslave the macvlan, it works as
expected / desired:

# grep . /etc/systemd/network/*.net*
/etc/systemd/network/bridge1.netdev:[NetDev]
/etc/systemd/network/bridge1.netdev:Name=bridge1
/etc/systemd/network/bridge1.netdev:Kind=bridge
/etc/systemd/network/macvl0.network:[Match]
/etc/systemd/network/macvl0.network:Name=macvl0
/etc/systemd/network/macvl0.network:[Network]
/etc/systemd/network/macvl0.network:Bridge=bridge1
# date; ip l add macvl0 link wlan0 type macvlan mode passthru
Mon Aug 16 05:21:50 PM HKT 2021
# date; ip l delete macvl0
Mon Aug 16 05:22:01 PM HKT 2021
# date; ip l add macvl0 link wlan0 type macvlan mode passthru nopromisc
Mon Aug 16 05:22:09 PM HKT 2021
# date; ip l delete macvl0
Mon Aug 16 05:22:15 PM HKT 2021
# journalctl -k | grep -i promisc
Aug 16 17:21:50 ideapad kernel: device macvl0 entered promiscuous mode
Aug 16 17:21:50 ideapad kernel: device wlan0 entered promiscuous mode
Aug 16 17:22:01 ideapad kernel: device wlan0 left promiscuous mode
Aug 16 17:22:01 ideapad kernel: device macvl0 left promiscuous mode
Aug 16 17:22:09 ideapad kernel: device macvl0 entered promiscuous mode
Aug 16 17:22:15 ideapad kernel: device macvl0 left promiscuous mode

Any ideas?

Regards,
Tom