netdev - Re: [Issue] Handling NETDEV_UP/NETDEV_DOWN for macvlan/ipvlan in Namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z7wOWyLEwxIC-d6S@fedora>
Date: Mon, 24 Feb 2025 06:14:51 +0000
From: Hangbin Liu <liuhangbin@...il.com>
To: netdev@...r.kernel.org
Cc: Nikolay Aleksandrov <razor@...ckwall.org>,
	Travis Brown <travisb@...sta.com>, Di Zhu <zhudi21@...wei.com>,
	Venkat Venkatsubra <venkat.x.venkatsubra@...cle.com>
Subject: Re: [Issue] Handling NETDEV_UP/NETDEV_DOWN for macvlan/ipvlan in
 Namespace

Hi,

any comments?

Thanks
Hangbin
On Fri, Feb 14, 2025 at 06:42:07AM +0000, Hangbin Liu wrote:
> Hi folks,
> 
> Our QE team reported an issue where, if macvlan/ipvlan is moved to a namespace,
> link up/down events from the lower device are not propagated to the upper link.
> e.g.
> 
> # ip link add lower type dummy
> # ip link add link lower name macvlan type macvlan mode bridge
> # ip link set lower up
> # ip netns add ns1
> # ip link set macvlan netns ns1
> # ip -n ns1 link set macvlan up
> # ip link set lower down
> # ip -n ns1 link show macvlan
> 4: macvlan@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
>     link/ether 1a:f2:01:99:06:bc brd ff:ff:ff:ff:ff:ff link-netnsid 0
> 
> After reviewing the code, I found that netif_stacked_transfer_operstate()
> only transfers the carrier state but does not handle device_close/open()
> operations.
> 
> I noticed that VLAN handles this state properly—if the lower link goes down
> in the default network namespace, the VLAN interface in the namespace also
> goes down.
> 
> I’ve drafted a patch to make ipvlan/macvlan follow VLAN’s behavior. However,
> I’m a bit concerned about whether we should allow control of a device in a
> namespace from the default network. For example, if a user sets ipvlan/macvlan
> down in the namespace while the admin sets the lower device up, should we
> bring ipvlan/macvlan up as well? For VLAN, it follows the lower device’s state.
> e.g.
> 
> # ip link add link lower name lower.2 type vlan id 2
> # ip link set lower.2 netns ns1
> # ip -n ns1 link show lower.2
> 5: lower.2@if3: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
>     link/ether b6:82:39:94:f1:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0
> # ip link set lower down
> # ip link set lower up
> # ip -n ns1 link show lower.2
> 5: lower.2@if3: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
>     link/ether b6:82:39:94:f1:67 brd ff:ff:ff:ff:ff:ff link-netnsid 0
> 
> Looking forward to your thoughts.
> 
> Best,
> Hangbin