netdev - Re: Proxy ARP NetNS Awareness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <61394377-195d-455c-b782-93f7f9c3072e@6wind.com>
Date: Mon, 20 Oct 2025 11:58:12 +0200
From: Nicolas Dichtel <nicolas.dichtel@...nd.com>
To: Household Cang <canghousehold@....com>,
 Vladimir Oltean <olteanv@...il.com>, Lucas Pereira <lucasvp@...il.com>,
 Romain Gantois <romain.gantois@...tlin.com>,
 "David S. Miller" <davem@...emloft.net>
Cc: Alexandre Torgue <alexandre.torgue@...s.st.com>,
 Jose Abreu <joabreu@...opsys.com>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Maxime Coquelin <mcoquelin.stm32@...il.com>,
 Miquel Raynal <miquel.raynal@...tlin.com>,
 Maxime Chevallier <maxime.chevallier@...tlin.com>,
 Sylvain Girard <sylvain.girard@...com>,
 Pascal EBERHARD <pascal.eberhard@...com>,
 Richard Tresidder <rtresidd@...ctromag.com.au>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: Proxy ARP NetNS Awareness

Le 17/10/2025 à 08:56, Household Cang a écrit :
> Last light the Linux Librechat was focused on digging the kernel code surrounding /net/ipv4/arp.c and /net/core/net_namespace.c to answer whether the proxy_arp feature enabled by sysctl is namespace aware.
> 
> After many hours of tracing from namespace-generating unshare --net command all the way to the kernel net_namespace.c gave us some clues that the main ns and new ns converged at arp_net_init() in arp.c. And I am currently stuck on this line 1497
> 
> proc_create_net("arp", 0444, net->proc_net, &arp_seq_ops,
>             sizeof(struct neigh_seq_state))
> 
> It is unknown whether this function creates a "view" to the ARP neighbor table such that each netns has a different view to the neighbor table, OR each netns maintains its own neighbor table. Either way, the implication is whether proxy_arp enabled by sysctl is restricted to the current netns.
Each netns maintains its own neighbor tables.
The sysctl proxy_arp is per netns.

Nicolas

> 
> If proxy_arp is retricted to the current netns, then the Debian documentation on wireless bridge-less pseudo-bridge https://wiki.debian.org/BridgeNetworkConnections may be wrong in insinuating that the proxy_arp feature in the modern kernel can replace parprouted userspace program.
> 
> The current documentation with sysctl net-related options are really vague in terms of netns interaction. arp_ignore, arp_announce, arp_filter did not do a good job of disambiguating whether any of these arp features can or cannot work across namespaces, or the reasons for the behavior.
> 
> From the arp_filter option description, this line "IP addresses are owned by the complete host on Linux, not by particular interfaces." is a single-netns statement, but highly suggests that arp operations are per namespace.
> 
> When a virtual ethernet pair is created between two netns, parprouted userspace program can relay arps across namespaces, but the kernel proxy_arp cannot.
> 
> Thank you for any insights and feel free to forward to subject matter experts.
> I really want to get to the bottom of this.
> 
> Lucas
>