Skip to content

Fix MACsec race condition by assigning both veth MACs atomically #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GyulyVGC merged 1 commit into from
Sep 8, 2026
Merged

Fix MACsec race condition by assigning both veth MACs atomically #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ All Nullnet releases with the relative changes are documented in this file.
- Install BPF linker as a prebuilt binary rather than compiling it from source ([#158](https://github.com/NullNet-ai/nullnet/pull/158))
### Removed
### Fixed
- Set both same-host veth MAC addresses at creation to prevent udev races from breaking encrypted connections ([#185](https://github.com/NullNet-ai/nullnet/pull/185))
- Stop a teardown from corrupting a chain that is still being set up ([#167](https://github.com/NullNet-ai/nullnet/pull/167) — fixes [#166](https://github.com/NullNet-ai/nullnet/issues/166))
- Reject a service name claimed by more than one stack, instead of resolving it to an arbitrary stack ([#165](https://github.com/NullNet-ai/nullnet/pull/165) — fixes [#129](https://github.com/NullNet-ai/nullnet/issues/129))
- Show the date alongside the time for timestamps from before today, instead of `hh:mm:ss` only, in the topology panels, Sessions, and Events pages ([#159](https://github.com/NullNet-ai/nullnet/pull/159) — fixes [#135](https://github.com/NullNet-ai/nullnet/issues/135))
Expand Down
20 changes: 8 additions & 12 deletions members/nullnet-client/src/commands/vxlan.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ use super::netlink::{delete_link, get_link_by_name, set_link_mtu_up};
use futures::StreamExt;
use ipnetwork::Ipv4Network;
use nullnet_liberror::{Error, ErrorHandler, Location, location};
use rtnetlink::packet_route::link::LinkMessage;
use rtnetlink::packet_route::link::{InfoData, InfoVeth, LinkMessage};
use rtnetlink::{Handle, LinkBridge, LinkUnspec, LinkVeth, LinkVxlan};
use std::collections::HashMap;
use std::fs::File;
Expand Down Expand Up @@ -231,6 +231,13 @@ async fn setup_same_host(
.add(
LinkVeth::new(&veth_s, &veth_c)
.address(mac_s.clone())
// Set both MACs at creation so udev never sees a random peer
// address and races us with MACAddressPolicy=persistent.
.set_info_data(InfoData::Veth(InfoVeth::Peer(
LinkUnspec::new_with_name(&veth_c)
.address(mac_c.clone())
.build(),
)))
.build(),
)
.execute()
Expand All @@ -242,17 +249,6 @@ async fn setup_same_host(
}
let link_s = get_link_by_name(handle, &veth_s).await?;
let link_c = get_link_by_name(handle, &veth_c).await?;
handle
.link()
.set(
LinkUnspec::new_with_index(link_c.header.index)
.address(mac_c.clone())
.build(),
)
.execute()
.await
.handle_err(location!())?;

let (local_link, local_veth, peer_mac, macsec_suffix) = if params.br_name.ends_with("_s") {
(link_s, veth_s.as_str(), mac_c, "s")
} else {
Expand Down