netdev - Re: [PATCH net-next 0/5] net: Improve netns handling in RTNL and ip

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241029161722.51b86c71@kernel.org>
Date: Tue, 29 Oct 2024 16:17:22 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Xiao Liang <shaw.leon@...il.com>
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>, David
 Ahern <dsahern@...nel.org>, Eric Dumazet <edumazet@...gle.com>, Paolo Abeni
 <pabeni@...hat.com>, Kuniyuki Iwashima <kuniyu@...zon.com>, Ido Schimmel
 <idosch@...dia.com>
Subject: Re: [PATCH net-next 0/5] net: Improve netns handling in RTNL and
 ip_tunnel

On Wed, 23 Oct 2024 10:31:41 +0800 Xiao Liang wrote:
> This patch series includes some netns-related improvements and fixes for
> RTNL and ip_tunnel, to make link creation more intuitive:
> 
>  - Creating link in another net namespace doesn't conflict with link names
>    in current one.
>  - Add a flag in rtnl_ops, to avoid netns change when link-netns is present
>    if possible.
>  - When creating ip tunnel (e.g. GRE) in another netns, use current as
>    link-netns if not specified explicitly.
> 
> So that
> 
>   # modprobe ip_gre netns_atomic=1
>   # ip link add netns ns1 link-netns ns2 tun0 type gre ...

Do you think the netns_atomic module param is really necessary?
I doubt anyone cares about the event popping up in the wrong
name space first.

BTW would be good to have tests for this. At least the behavior
around name / ifindex collisions in different namespaces.
You can possibly extend/re-purpose netns-name.sh for this.

For notifications you could use python and subscribe to the events
using a YNL socket. May be easier than dealing with ip monitor
as a background process. But either way is fine.