[PATCH iproute2] ip netns: allow negative nsid

[PATCH iproute2] ip netns: allow negative nsid

[Christian Brauner]

If the kernel receives a negative nsid it will automatically assign the
next available nsid. In this case alloc_netid() will set min and max to
0 for ird_alloc(). And when max == 0 idr_alloc() will interpret this as
the maxium range, i.e. specific to nsids it will try to find an id in
the range [0,INT_MAX). This is intentionally supported in the kernel for
nsids. Commit acbe9118ce8086f765ffb0da15f80c7c01a8903a regressed ip
netns in that respect although previously the use-case was either
accidentally supported or opaquely supported such that it triggered the
original commit. From what I can gather it went as follows before:
atoi() was called with a string indicating a negative value which caused
it to return -1 which was passed to the kernel. Let's make it less
opaque and use get_integer() and set to -1 when a negative nsid was
requested. This restores the old behavior.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
 ip/ipnetns.c        | 7 +++++--
 man/man8/ip-netns.8 | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 059a4220..3d140cae 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -706,7 +706,7 @@ static int netns_set(int argc, char **argv)
 {
 	char netns_path[PATH_MAX];
 	const char *name;
-	unsigned int nsid;
+	int nsid;
 	int netns;
 
 	if (argc < 1) {
@@ -718,8 +718,11 @@ static int netns_set(int argc, char **argv)
 		return -1;
 	}
 	name = argv[0];
-	if (get_unsigned(&nsid, argv[1], 0))
+	if (get_integer(&nsid, argv[1], 0))
 		invarg("Invalid \"netnsid\" value\n", argv[1]);
+	/* If a negative nsid is specified the kernel will select the nsid. */
+	if (nsid < 0)
+		nsid = -1;
 
 	snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
 	netns = open(netns_path, O_RDONLY | O_CLOEXEC);
diff --git a/man/man8/ip-netns.8 b/man/man8/ip-netns.8
index c5310e24..ecfb56f8 100644
--- a/man/man8/ip-netns.8
+++ b/man/man8/ip-netns.8
@@ -137,6 +137,7 @@ $ ip netns del net0
 .sp
 This command assigns a id to a peer network namespace. This id is valid
 only in the current network namespace.
+If the requested id is negative the kernel will pick an available positive id.
 This id will be used by the kernel in some netlink messages. If no id is
 assigned when the kernel needs it, it will be automatically assigned by
 the kernel.
-- 
2.14.1

Re: [PATCH iproute2] ip netns: allow negative nsid

[Stephen Hemminger]

On Tue,  6 Feb 2018 16:16:15 +0100
Christian Brauner <christian.brauner@ubuntu.com> wrote:

> If the kernel receives a negative nsid it will automatically assign the
> next available nsid. In this case alloc_netid() will set min and max to
> 0 for ird_alloc(). And when max == 0 idr_alloc() will interpret this as
> the maxium range, i.e. specific to nsids it will try to find an id in
> the range [0,INT_MAX). This is intentionally supported in the kernel for
> nsids. Commit acbe9118ce8086f765ffb0da15f80c7c01a8903a regressed ip
> netns in that respect although previously the use-case was either
> accidentally supported or opaquely supported such that it triggered the
> original commit. From what I can gather it went as follows before:
> atoi() was called with a string indicating a negative value which caused
> it to return -1 which was passed to the kernel. Let's make it less
> opaque and use get_integer() and set to -1 when a negative nsid was
> requested. This restores the old behavior.
> 
> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

Rather than negative value, it would be better from user interface
point of view to use a user readable value like "auto" which encapsulates
the kernel behavior.