From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f65.google.com (mail-wr1-f65.google.com [209.85.221.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8631372B58 for ; Wed, 20 May 2026 17:23:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.65 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779297826; cv=none; b=Lnpwy1YFcMQCW/fvSSPYZ1Bwusca4kXhtTRQxAy1TX3QET5qxC8/vO20SueePdVABo9P5SY0o7Ty61ftRvncdGqwIvz9mecJUfm7ErEsLGpXKFooh1dDaGbF2DOUp6TRK7/TdUQDC1j+bzdA7gYnr3Xi5ZygtD0TTx7d7ilSNFI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779297826; c=relaxed/simple; bh=dEn/DZjJ6ZkDMxdIMlTcRhfqUFij0sqTMuUmS72Qvf8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UT4+PtZvtbZMuyxPMFYMdica0GgEZ38lDiwgG2CMRJzPtX4omcUm+KM4GcwQTE2QeHlmdMklYgsb9JI94R1xjKgiNnFIjkjIGnbK1fge4R70YnJ2MKmMrYP4U0+nHdHjSxMszH1+cBG66qbG7FHA1x1MIyVL4LL5ZAfeGjRxmTk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ovn.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.221.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ovn.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-wr1-f65.google.com with SMTP id ffacd0b85a97d-44b330c5cc6so3806535f8f.1 for ; Wed, 20 May 2026 10:23:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779297822; x=1779902622; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=f/5B2KT7zWN9FEt5jFJ3UZmNoriTd7Q2p02B+ALz3Mw=; b=isewNVoH+Qio32dHDS86lEhmDzfAQtxRIZ6fpYddpCAr39wqK+hX4uwm1KKDYeB8Bp 7Vw+K+BPvbta0X/nXtEAnh28h+HsJNq2BKl+1LZ9wUsSGkMaX4BGxdXDWhxb8E3eVxvm zDbNzSPNwq4U7j8C5Qe4tHUZLf5VQDWm8T6nUvJ0RjSPz14ICZMuiGR6346jJSSYyuXv KlCsLMpuATPWNqa7817WSPL5VIrcgbeJkisSqnO74Wm6b8t+2+0VEeiBhUvrvZFx5jZB WkrTrfYMtfz0VTXhHoW96wxIGpfGZ/TitZ5J8hQTxtXDdIxrfak7dx8+o9+7hTghOtsU chsA== X-Forwarded-Encrypted: i=1; AFNElJ8eaZzKMFiMzCij+bkVSbL29rqR8/5TCADLwNsyEHERvP2/SOrgBs+eQyLphLki8U4ryjBG4W7G2t8bkpU=@vger.kernel.org X-Gm-Message-State: AOJu0Ywyxie9eSTck7nmhmftt9DKNZFqB8P/0empWYRL89kQpijMuMVS FUN+xC32Gm3pM4+TvmhLKTM3pwCCi+ukTkst7VaxITscTKqREID6fZo1 X-Gm-Gg: Acq92OHLtHscFo5m6dOfQB3fBeunukykT3AK6CRhIGT1MEY6AwZl7TGAijR2WxuSdJy tgxc/NptYebtBcpdVm2pvE1vvV0tOEHho7ZXjKjGzYCTsZgfLAnvZCF6DIQoQJc6kSM23/QVh7X dCgi4OWaktLa9+sr3tVEbKBLKgeirFQwDxvA7iR2ZRlHzo615O0KrDLawtuwiy7FhSy4OhbD2lN GDMgVsXNzSN+5DsAqYXScMbLV1s3r1xjqLUi0ui7l2aFJQ/yOHlWsUOwUA37vrIfzfFQGolrCqR h0e4kyu6i63++Ei1abdDc5jsC9+HZ8M+Nq9V6lvAj7cv4fNXZ+FQHnaiQhdM6cnhSWHSX3sgLkE g8m1iX9PDVQl1tFl3cfKABz+4D75nGCTvW9lKDqT3FRB1tYmk/Nf2IuEP2mXpDJLi7gDRef3KQS 4NtVoj4R1jGi4/CEuuURg8lcw75zJNbTO5KUMj3z3Aw0O96tbC69LkDsoN4/2TXRO3UKOAnMJ4L CH3EvP9 X-Received: by 2002:a05:6000:2503:b0:43d:d037:d59c with SMTP id ffacd0b85a97d-45e5c5ca060mr41914479f8f.16.1779297822258; Wed, 20 May 2026 10:23:42 -0700 (PDT) Received: from im-t490s.redhat.com (89-24-32-159.nat.epc.tmcz.cz. [89.24.32.159]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45da0fe0fecsm51125580f8f.26.2026.05.20.10.23.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 10:23:40 -0700 (PDT) From: Ilya Maximets To: netdev@vger.kernel.org Cc: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Donald Hunter , Shuah Khan , Kuniyuki Iwashima , Kees Cook , Adrian Moreno , Jiri Benc , Nicolas Dichtel , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Matteo Perin , Ilya Maximets Subject: [PATCH net v2 2/4] net: netlink: don't set nsid on local notifications Date: Wed, 20 May 2026 19:22:36 +0200 Message-ID: <20260520172317.175168-3-i.maximets@ovn.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260520172317.175168-1-i.maximets@ovn.org> References: <20260520172317.175168-1-i.maximets@ovn.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In most cases, notifications on sockets with NETLINK_LISTEN_ALL_NSID do not contain NSID in their ancillary data in case the event is local to the listener. However, when a self-referential NSID is allocated for a namespace, every local notification starts sending this ID to the user space. This is problematic, because the listener cannot tell if those notifications are local or not anymore without making extra requests to figure out if the provided NSID is local or not. The listener can also not figure out the local NSID beforehand as it can be allocated at any point in time by other processes, changing the structure of the future notifications for everyone. The value is practically not useful, since it's the namespace's own ID that the application has to obtain from other sources in order to figure out if it's the same or not. So, for the application it's just an extra busy work with no benefits. Moreover, applications that do not know about this quirk may be mishandling notifications with NSID set as notifications from remote namespaces. This is the case for ovs-vswitchd and the iproute2's 'ip monitor' that stops printing 'current' and starts printing the nsid number mid-session. Lack of clear documentation for this behavior is also not helping. A search though open-source projects doesn't reveal any projects that use NETNSA_NSID_NOT_ASSIGNED and rely on metadata to contain self-referential NSIDs (expected, since the value is not useful). Quite the opposite, as already mentioned, there are few applications that rely on NSID to not be present in local events. Since the value is not useful and actively harmful in some cases, let's not report it for local events, making the notifications more consistent. Also adding some blank lines for readability. Fixes: 59324cf35aba ("netlink: allow to listen "all" netns") Reported-by: Matteo Perin Signed-off-by: Ilya Maximets --- net/netlink/af_netlink.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 0742e97f256e4..7269e23b578d6 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1482,10 +1482,14 @@ static void do_one_broadcast(struct sock *sk, p->skb2 = NULL; goto out; } + NETLINK_CB(p->skb2).nsid_is_set = false; - NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net); - if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED) - NETLINK_CB(p->skb2).nsid_is_set = true; + if (!net_eq(sock_net(sk), p->net)) { + NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net); + if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED) + NETLINK_CB(p->skb2).nsid_is_set = true; + } + val = netlink_broadcast_deliver(sk, p->skb2); if (val < 0) { netlink_overrun(sk); -- 2.53.0