netdev - [Issue] Handling NETDEV_UP/NETDEV_DOWN for macvlan/ipvlan in Namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Z67lt5v6vrltiRyG@fedora>
Date: Fri, 14 Feb 2025 06:41:59 +0000
From: Hangbin Liu <liuhangbin@...il.com>
To: netdev@...r.kernel.org
Cc: Nikolay Aleksandrov <razor@...ckwall.org>,
	Travis Brown <travisb@...sta.com>, Di Zhu <zhudi21@...wei.com>,
	Venkat Venkatsubra <venkat.x.venkatsubra@...cle.com>
Subject: [Issue] Handling NETDEV_UP/NETDEV_DOWN for macvlan/ipvlan in
 Namespace

Hi folks,

Our QE team reported an issue where, if macvlan/ipvlan is moved to a namespace,
link up/down events from the lower device are not propagated to the upper link.
e.g.

# ip link add lower type dummy
# ip link add link lower name macvlan type macvlan mode bridge
# ip link set lower up
# ip netns add ns1
# ip link set macvlan netns ns1
# ip -n ns1 link set macvlan up
# ip link set lower down
# ip -n ns1 link show macvlan
4: macvlan@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 1a:f2:01:99:06:bc brd ff:ff:ff:ff:ff:ff link-netnsid 0

After reviewing the code, I found that netif_stacked_transfer_operstate()
only transfers the carrier state but does not handle device_close/open()
operations.

I noticed that VLAN handles this state properly—if the lower link goes down
in the default network namespace, the VLAN interface in the namespace also
goes down.

I’ve drafted a patch to make ipvlan/macvlan follow VLAN’s behavior. However,
I’m a bit concerned about whether we should allow control of a device in a
namespace from the default network. For example, if a user sets ipvlan/macvlan
down in the namespace while the admin sets the lower device up, should we
bring ipvlan/macvlan up as well? For VLAN, it follows the lower device’s state.
e.g.

# ip link add link lower name lower.2 type vlan id 2
# ip link set lower.2 netns ns1
# ip -n ns1 link show lower.2
5: lower.2@if3: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether b6:82:39:94:f1:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0
# ip link set lower down
# ip link set lower up
# ip -n ns1 link show lower.2
5: lower.2@if3: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether b6:82:39:94:f1:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0

Looking forward to your thoughts.

Best,
Hangbin