netdev - Re: Bug in netlink monitor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9497b5f8-1f48-1d38-3a26-65ea03d9036f@6wind.com>
Date:   Wed, 26 Oct 2022 15:31:42 +0200
From:   Nicolas Dichtel <nicolas.dichtel@...nd.com>
To:     George Shuklin <george.shuklin@...il.com>, netdev@...r.kernel.org
Subject: Re: Bug in netlink monitor

Le 26/10/2022 à 14:41, George Shuklin a écrit :
> On 26/10/2022 11:34, Nicolas Dichtel wrote:
>> Le 25/10/2022 à 13:18, George Shuklin a écrit :
>>> I found that if veth interface is created in a namespace using netns option for
>>> ip, no events are logged in `ip monitor all-nsid`.
>>>
>>> Steps to reproduce:
>>>
>>>
>>> (console1)
>>>
>>> ip monitor all-nsid
>>>
>>>
>>> (console 2)
>>>
>>> ip net add foobar
>>>
>>> ip link add netns foobar type veth
>>>
>>>
>>> Expected results:
>>>
>>> Output in `ip monitor`. Actual result: no output, (but there are two new veth
>>> interaces in foobar namespace).
>>>
>>> Additional observation: namespace 'foobar' does not have id in output of `ip
>>> net`:
>> This is why.
>> https://man7.org/linux/man-pages/man8/ip-monitor.8.html
>>
>> "       If the all-nsid option is set, the program listens to all network
>>         namespaces that have a nsid assigned into the network namespace
>>         were the program is running"
>>
>> You can assign one with:
>> ip netns set foobar auto
>>
> Oh, I missed that.
> 
> But I think it's making things a bit odd, because there are network events in
> the system which are not visible in `ip monitor` (no matter what options are set).
It's not visible, because this netns is not visible.

> 
> Are there a way to see _all_ network events?
No. Remember that network namespace are used for isolation. There are a lot of
scenarii where you don't have to know what happen in another netns, even not
that another netns exists ;-)