netdev - balance-alb and arp-reply stomping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 8 Jan 2013 11:22:29 -0500
From:	"Matthew O'Connor" <liquidhorse@...il.com>
To:	netdev@...r.kernel.org
Subject: balance-alb and arp-reply stomping

Hi!  I've encountered what appears to be a known "issue" with
balance-alb, whereby when a bond configured thus is put into a bridge
with virtual ethernet adapters, on reply to arp requests the bond
appears to "stomp" the MAC of the outgoing replies with one of its own
adapters' MACs.  The consequence seems to be intermittent
connectivity, easily witnessed by ping-loss early in a virtual
adapter's life.  Checking the ARP cache on another machine shows that
the virtual adapter's MAC has been replaced with one of the bond
slaves'.  Other bonding modes do not exhibit this behavior.

I was wondering if this is something that had been brought up before
for fixing, and whether or not you would accept a patch if an
appropriate fix was implemented?  My naive understanding would suggest
checking the outgoing reply against a table of known slaves, and if
the MAC did not exist there then map it to a slave and transmit the
reply unmodified.

One thing I find strange about this problem: when pinging a host that
is behind said bond and bridge, I occasionally see the virtual
adapter's true MAC appear intermittently even though it would seem
gratuitous ARPs are also getting stomped.  The MAC appears and then
quickly disappears, replaced with one of the bond's slaves.  What's
more, after the virtual adapter has been a member of the bridge for a
good while (several minutes, it seems), the intermittent connectivity
seems less of an issue - for instance, I just pinged one host that
exhibited this problem the other day, and it replied to 370 pings
without a single lost packet.  Ordinarily, when the issue occurs,
50-70% of the packets appear to be lost.

I am not currently a member of this list - please CC me on replies!  THANKS!!

-- Matt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html