lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <519DEE6E.7060700@smart-weblications.de>
Date:	Thu, 23 May 2013 12:24:46 +0200
From:	Smart Weblications GmbH - Florian Wiessner 
	<f.wiessner@...rt-weblications.de>
To:	Matthew O'Connor <liquidhorse@...il.com>
CC:	Greg KH <gregkh@...uxfoundation.org>, davem@...emloft.net,
	andy@...yhouse.net, fubar@...ibm.com,
	LKML <linux-kernel@...r.kernel.org>, stable@...r.kernel.org,
	nikolay@...hat.com, vfalico@...hat.com, zheng.x.li@...cle.com
Subject: Re: https://lkml.org/lkml/2013/2/1/531

Am 23.05.2013 01:17, schrieb Matthew O'Connor:
> This is the backported patch I submitted previously.  Hopefully this
> time around it won't be too messed up, I'm using Thunderbird instead of
> the web interface.  I have applied it successfully and without warnings
> against 3.4.46.  It builds, but is otherwise untested beyond what I did
> when I originally submitted back in Feb.  This patch applies only to the
> 3.4 series kernel, although with minor changes it will work for 3.0,
> 3.2, and 3.7.  If you're interested, I can submit the other patches
> shortly.  If this submission still does not conform to standards, please
> let me know where I went wrong.  For what it's worth I dropped the patch
> contents directly into the email, but I can attach it instead if that
> would work better.
> 


Hm, i tried to apply it to 3.4.46 but it does not work:

node02:/ocfs2/usr/src/linux-3.4.46# patch -p1 <../bridge-patch-3.4.46
patching file drivers/net/bonding/bond_alb.c
Hunk #1 FAILED at 704.
1 out of 1 hunk FAILED -- saving rejects to file drivers/net/bonding/bond_alb.c.rej
patching file drivers/net/bonding/bonding.h
patching file include/linux/etherdevice.h
Hunk #1 FAILED at 277.
1 out of 1 hunk FAILED -- saving rejects to file include/linux/etherdevice.h.rej


node02:/ocfs2/usr/src/linux-3.4.46# cat drivers/net/bonding/bond_alb.c.rej
--- drivers/net/bonding/bond_alb.c 2013-01-27 23:51:45.000000000 -0500
+++ drivers/net/bonding/bond_alb.c 2013-01-30 15:37:25.121708311 -0500
@@ -704,6 +704,12 @@
     struct arp_pkt *arp = arp_pkt(skb);
     struct slave *tx_slave = NULL;

+    /* Don't modify or load balance ARPs that do not originate locally
+     * (e.g.,arrive via a bridge).
+     */
+    if (!bond_slave_has_mac(bond, arp->mac_src))
+        return NULL;
+
     if (arp->op_code == htons(ARPOP_REPLY)) {
         /* the arp must be sent on the selected
         * rx channel


node02:/ocfs2/usr/src/linux-3.4.46# cat include/linux/etherdevice.h.rej
--- include/linux/etherdevice.h 2013-01-27 23:51:45.000000000 -0500
+++ include/linux/etherdevice.h 2013-01-30 15:37:25.121708311 -0500
@@ -277,4 +277,37 @@
 #endif
 }

+/**
+ * ether_addr_equal_64bits - Compare two Ethernet addresses
+ * @addr1: Pointer to an array of 8 bytes
+ * @addr2: Pointer to an other array of 8 bytes
+ *
+ * Compare two Ethernet addresses, returns true if equal, false otherwise.
+ *
+ * The function doesn't need any conditional branches and possibly uses
+ * word memory accesses on CPU allowing cheap unaligned memory reads.
+ * arrays = { byte1, byte2, byte3, byte4, byte5, byte6, pad1, pad2 }
+ *
+ * Please note that alignment of addr1 & addr2 are only guaranteed to be 16 bits.
+ */
+
+static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
+                                           const u8 addr2[6+2])
+{
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+        unsigned long fold = ((*(unsigned long *)addr1) ^
+                              (*(unsigned long *)addr2));
+
+        if (sizeof(fold) == 8)
+                return zap_last_2bytes(fold) == 0;
+
+        fold |= zap_last_2bytes((*(unsigned long *)(addr1 + 4)) ^
+                                (*(unsigned long *)(addr2 + 4)));
+        return fold == 0;
+#else
+        return ether_addr_equal(addr1, addr2);
+#endif
+}
+
+
 #endif    /* _LINUX_ETHERDEVICE_H */


> 
> [ Upstream commit 567b871e503316b0927e54a3d7c86d50b722d955 ]
> 
> bonding: rlb mode of bond should not alter ARP originating via bridge
> 
> Do not modify or load balance ARP packets passing through balance-alb
> mode (wherein the ARP did not originate locally, and arrived via a bridge).
> 
> Modifying pass-through ARP replies causes an incorrect MAC address
> to be placed into the ARP packet, rendering peers unable to communicate
> with the actual destination from which the ARP reply originated.
> 
> Load balancing pass-through ARP requests causes an entry to be
> created for the peer in the rlb table, and bond_alb_monitor will
> occasionally issue ARP updates to all peers in the table instrucing them
> as to which MAC address they should communicate with; this occurs when
> some event sets rx_ntt.  In the bridged case, however, the MAC address
> used for the update would be the MAC of the slave, not the actual source
> MAC of the originating destination.  This would render peers unable to
> communicate with the destinations beyond the bridge.
> 
> Signed-off-by: Matthew O'Connor <liquidhorse@...il.com>
> CC: Zheng Li <zheng.x.li@...cle.com>
> Cc: Jay Vosburgh <fubar@...ibm.com>
> Cc: Andy Gospodarek <andy@...yhouse.net>
> Cc: "David S. Miller" <davem@...emloft.net>
> 
> 
> diff -uprN linux-3.4.28/drivers/net/bonding/bond_alb.c
> linux-3.4.28-patched/drivers/net/bonding/bond_alb.c
> --- linux-3.4.28/drivers/net/bonding/bond_alb.c    2013-01-27
> 23:51:45.000000000 -0500
> +++ linux-3.4.28-patched/drivers/net/bonding/bond_alb.c    2013-01-30
> 15:37:25.121708311 -0500
> @@ -704,6 +704,12 @@ static struct slave *rlb_arp_xmit(struct
>      struct arp_pkt *arp = arp_pkt(skb);
>      struct slave *tx_slave = NULL;
>  
> +    /* Don't modify or load balance ARPs that do not originate locally
> +     * (e.g.,arrive via a bridge).
> +     */
> +    if (!bond_slave_has_mac(bond, arp->mac_src))
> +        return NULL;
> +
>      if (arp->op_code == htons(ARPOP_REPLY)) {
>          /* the arp must be sent on the selected
>          * rx channel
> diff -uprN linux-3.4.28/drivers/net/bonding/bonding.h
> linux-3.4.28-patched/drivers/net/bonding/bonding.h
> --- linux-3.4.28/drivers/net/bonding/bonding.h    2013-01-27
> 23:51:45.000000000 -0500
> +++ linux-3.4.28-patched/drivers/net/bonding/bonding.h    2013-01-30
> 15:37:25.121708311 -0500
> @@ -18,6 +18,7 @@
>  #include <linux/timer.h>
>  #include <linux/proc_fs.h>
>  #include <linux/if_bonding.h>
> +#include <linux/etherdevice.h>
>  #include <linux/cpumask.h>
>  #include <linux/in6.h>
>  #include <linux/netpoll.h>
> @@ -450,6 +451,18 @@ static inline void bond_destroy_proc_dir
>  }
>  #endif
>  
> +static inline struct slave *bond_slave_has_mac(struct bonding *bond,
> +                           const u8 *mac)
> +{
> +    int i = 0;
> +    struct slave *tmp;
> +
> +    bond_for_each_slave(bond, tmp, i)
> +        if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
> +            return tmp;
> +
> +    return NULL;
> +}
>  
>  /* exported from bond_main.c */
>  extern int bond_net_id;
> diff -uprN linux-3.4.28/include/linux/etherdevice.h
> linux-3.4.28-patched/include/linux/etherdevice.h
> --- linux-3.4.28/include/linux/etherdevice.h    2013-01-27
> 23:51:45.000000000 -0500
> +++ linux-3.4.28-patched/include/linux/etherdevice.h    2013-01-30
> 15:37:25.121708311 -0500
> @@ -277,4 +277,37 @@ static inline unsigned long compare_ethe
>  #endif
>  }
>  
> +/**
> + * ether_addr_equal_64bits - Compare two Ethernet addresses
> + * @addr1: Pointer to an array of 8 bytes
> + * @addr2: Pointer to an other array of 8 bytes
> + *
> + * Compare two Ethernet addresses, returns true if equal, false otherwise.
> + *
> + * The function doesn't need any conditional branches and possibly uses
> + * word memory accesses on CPU allowing cheap unaligned memory reads.
> + * arrays = { byte1, byte2, byte3, byte4, byte5, byte6, pad1, pad2 }
> + *
> + * Please note that alignment of addr1 & addr2 are only guaranteed to
> be 16 bits.
> + */
> +
> +static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
> +                                           const u8 addr2[6+2])
> +{
> +#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
> +        unsigned long fold = ((*(unsigned long *)addr1) ^
> +                              (*(unsigned long *)addr2));
> +
> +        if (sizeof(fold) == 8)
> +                return zap_last_2bytes(fold) == 0;
> +
> +        fold |= zap_last_2bytes((*(unsigned long *)(addr1 + 4)) ^
> +                                (*(unsigned long *)(addr2 + 4)));
> +        return fold == 0;
> +#else
> +        return ether_addr_equal(addr1, addr2);
> +#endif
> +}
> +
> +
>  #endif    /* _LINUX_ETHERDEVICE_H */
> 
> 
> 
> 
> On 05/22/2013 05:26 PM, Smart Weblications GmbH - Florian Wiessner wrote:
>> Hi Greg,
>>
>>
>> Am 22.05.2013 22:04, schrieb Greg KH:
>>
>>
>>>> https://kernel.googlesource.com/pub/scm/linux/kernel/git/jkirsher/net-next/+/567b871e503316b0927e54a3d7c86d50b722d955%5E!/
>>> Ok, that's what we need.
>>>
>>> Now, please cc: the developers / maintainers of that patch and ask them
>>> to have it included in the 3.4-stable kernel series.
>>>
>>> Then, if they agree, the network maintainer will pick it up and send it
>>> to me for inclusion.
>>>
>> i set committer	David S. Miller <davem@...emloft.net> in cc already, but do not
>> know the network maintainer...
>>
>> this seems to me that "Matthew O'Connor" <liquidhorse@...il.com> sent this to
>> netdev on 2013-02-01:
>>
>> http://lists.openwall.net/netdev/2013/02/01/86
>>
>> but i couldn't find a trace of the patch in 3.4.36?!
>>
>> Instead, i read another try to get it backported fail:
>>
>> http://permalink.gmane.org/gmane.linux.network/264198
>>
>>
>>
>>
>>
>>
> 


-- 

Mit freundlichen Grüßen,

Florian Wiessner

Smart Weblications GmbH
Martinsberger Str. 1
D-95119 Naila

fon.: +49 9282 9638 200
fax.: +49 9282 9638 205
24/7: +49 900 144 000 00 - 0,99 EUR/Min*
http://www.smart-weblications.de

--
Sitz der Gesellschaft: Naila
Geschäftsführer: Florian Wiessner
HRB-Nr.: HRB 3840 Amtsgericht Hof
*aus dem dt. Festnetz, ggf. abweichende Preise aus dem Mobilfunknetz

View attachment "bridge-patch-3.4.46.txt" of type "text/plain" (3327 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ