linux-kernel - Re: SOCK_RAW does not receive broadcast (with VLAN unless PROMISC)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <91ac27070906100724v25c2328x6b343315358c8e12@mail.gmail.com>
Date:	Wed, 10 Jun 2009 17:24:58 +0300
From:	Gil Beniamini <gil.beniamini@...il.com>
To:	Brent Cook <bcook@...intsys.com>
Cc:	Patrick McHardy <kaber@...sh.net>,
	David Miller <davem@...emloft.net>,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: SOCK_RAW does not receive broadcast (with VLAN unless PROMISC)

Patrick,
My application is a "proxy" and need to support few VLANs (for example vlan 24).
I define all vlans on interface 'eth0' which is my "out i/f", while
the other interface 'eth1' (used as "in i/f") I use with PF_PACKET /
SOCK_RAW in order to handle VLANs by my application (starting with
"arp broadcast").
When I try to define the same (relevant VLAN) on eth1 (inorder to
check your suggestion), I get "Error: trying to add VLAN #24 to IF
-:eth1:- error: file exist".
It seems that linux does not allow to define the same VLAN # on more
than a single i/f?!
Thanks Gil

Brent,
Thanks I am aware of BPF and if I don't find a better solution, this
will be my filter.
Thanks Gil

On Tue, Jun 9, 2009 at 10:30 PM, Brent Cook<bcook@...intsys.com> wrote:
> On Tuesday 09 June 2009 08:08:01 am Gil Beniamini wrote:
>> Patrick,
>> On the specific NIC (eth1) no vlan is defined, and in the new Linux
>> the application receive NOTHING at all. In order to debug, I start
>> "wireshark as root" and "wireshark" set PROMISC on, and the
>> application start receive the raw packets as expected. Later I started
>> setting PROMISC by my application, and it can receive the packets even
>> when "wireshark" is not running.
>> The problem that I have with PROMISC mode, is that I need to do the
>> irelevant  unicast filtering in software rather than get it from the
>> hardware (as it works in old kernel 2.6.20).
>> Thanks a lot, Gil
>
> One solution is to attach a BPF filter to the socket. Then you will only
> receive packets for whatever you are filtering. This is still in software, but
> it is higher up in the abstraction, and undoubtedly more efficient than doing
> it at the app level.
>
> Simply compile the BPF program you wish to filter, e.g:
>
> # tcpdump -dd vlan 4
> { 0x28, 0, 0, 0x0000000c },
> { 0x15, 0, 4, 0x00008100 },
> { 0x28, 0, 0, 0x0000000e },
> { 0x54, 0, 0, 0x00000fff },
> { 0x15, 0, 1, 0x00000004 },
> { 0x6, 0, 0, 0x00000060 },
> { 0x6, 0, 0, 0x00000000 },
>
> Then attach it to your socket:
>
>    struct sock_filter filter[] = {
>      { 0x28, 0, 0, 0x0000000c },
>      { 0x15, 0, 4, 0x00008100 },
>      { 0x28, 0, 0, 0x0000000e },
>      { 0x54, 0, 0, 0x00000fff },
>      { 0x15, 0, 1, 0x00000004 },
>      { 0x6, 0, 0, 0x00000060 },
>      { 0x6, 0, 0, 0x00000000 },
>    };
>
>    struct sock_fprog inbound_filter = {
>        .len = 7, .filter = filter
>    };
>
>    if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER,
>        &inbound_filter, sizeof(inbound_filter)) < 0) {
>        return -1;
>    }
>
> Also, note, you can easily set promiscuous mode directly with socket opts too.
> If you're more curious, just look at libpcap source.
>
>  - Brent
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/