netdev - Proxy ARP NetNS Awareness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <21658780.3286902.1760684176107@mail.yahoo.com>
Date: Fri, 17 Oct 2025 06:56:16 +0000 (UTC)
From: Household Cang <canghousehold@....com>
To: Vladimir Oltean <olteanv@...il.com>, Lucas Pereira <lucasvp@...il.com>, 
	Romain Gantois <romain.gantois@...tlin.com>, 
	"David S. Miller" <davem@...emloft.net>
Cc: Alexandre Torgue <alexandre.torgue@...s.st.com>, 
	Jose Abreu <joabreu@...opsys.com>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, 
	Maxime Coquelin <mcoquelin.stm32@...il.com>, 
	Miquel Raynal <miquel.raynal@...tlin.com>, 
	Maxime Chevallier <maxime.chevallier@...tlin.com>, 
	Sylvain Girard <sylvain.girard@...com>, 
	Pascal EBERHARD <pascal.eberhard@...com>, 
	Richard Tresidder <rtresidd@...ctromag.com.au>, 
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Proxy ARP NetNS Awareness

Last light the Linux Librechat was focused on digging the kernel code surrounding /net/ipv4/arp.c and /net/core/net_namespace.c to answer whether the proxy_arp feature enabled by sysctl is namespace aware.

After many hours of tracing from namespace-generating unshare --net command all the way to the kernel net_namespace.c gave us some clues that the main ns and new ns converged at arp_net_init() in arp.c. And I am currently stuck on this line 1497

proc_create_net("arp", 0444, net->proc_net, &arp_seq_ops,
            sizeof(struct neigh_seq_state))

It is unknown whether this function creates a "view" to the ARP neighbor table such that each netns has a different view to the neighbor table, OR each netns maintains its own neighbor table. Either way, the implication is whether proxy_arp enabled by sysctl is restricted to the current netns.

If proxy_arp is retricted to the current netns, then the Debian documentation on wireless bridge-less pseudo-bridge https://wiki.debian.org/BridgeNetworkConnections may be wrong in insinuating that the proxy_arp feature in the modern kernel can replace parprouted userspace program.

The current documentation with sysctl net-related options are really vague in terms of netns interaction. arp_ignore, arp_announce, arp_filter did not do a good job of disambiguating whether any of these arp features can or cannot work across namespaces, or the reasons for the behavior.

>From the arp_filter option description, this line "IP addresses are owned by the complete host on Linux, not by particular interfaces." is a single-netns statement, but highly suggests that arp operations are per namespace.

When a virtual ethernet pair is created between two netns, parprouted userspace program can relay arps across namespaces, but the kernel proxy_arp cannot.

Thank you for any insights and feel free to forward to subject matter experts.
I really want to get to the bottom of this.

Lucas