linux-kernel - Re: [PATCH v7] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 24 Jan 2022 22:34:32 +0800
From:   孙守鑫 <sunshouxin@...natelecom.cn>
To:     Nikolay Aleksandrov <nikolay@...dia.com>, j.vosburgh@...il.com,
        vfalico@...il.com, andy@...yhouse.net, davem@...emloft.net,
        kuba@...nel.org
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        jay.vosburgh@...onical.com, huyd12@...natelecom.cn
Subject: Re: [PATCH v7] net: bonding: Add support for IPV6 ns/na to
 balance-alb/balance-tlb mode


在 2022/1/21 16:52, Nikolay Aleksandrov 写道:
> On 21/01/2022 10:22, Sun Shouxin wrote:
>> Since ipv6 neighbor solicitation and advertisement messages
>> isn't handled gracefully in bond6 driver, we can see packet
>> drop due to inconsistency between mac address in the option
>> message and source MAC .
>>
>> Another examples is ipv6 neighbor solicitation and advertisement
>> messages from VM via tap attached to host bridge, the src mac
>> might be changed through balance-alb mode, but it is not synced
>> with Link-layer address in the option message.
>>
>> The patch implements bond6's tx handle for ipv6 neighbor
>> solicitation and advertisement messages.
>>
>> Suggested-by: Hu Yadi <huyd12@...natelecom.cn>
>> Acked-by: Jay Vosburgh <jay.vosburgh@...onical.com>
>> Signed-off-by: Sun Shouxin <sunshouxin@...natelecom.cn>
>> ---
>>   drivers/net/bonding/bond_alb.c | 36 ++++++++++++++++++++++++++++++++++
>>   1 file changed, 36 insertions(+)
>>
> Hi,
> A few comments below,


Thanks your comment, I'll adjust it and send out V8 soon.


>
>> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
>> index 533e476988f2..82b7071840b1 100644
>> --- a/drivers/net/bonding/bond_alb.c
>> +++ b/drivers/net/bonding/bond_alb.c
>> @@ -1269,6 +1269,34 @@ static int alb_set_mac_address(struct bonding *bond, void *addr)
>>   	return res;
>>   }
>>   
>> +/*determine if the packet is NA or NS*
> comments should have spaces, /* text */
>
>> +static bool __alb_determine_nd(struct icmp6hdr *hdr)
>> +{
>> +	if (hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT ||
>> +	    hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) {
>> +		return true;
>> +	}
>> +
>> +	return false;
>> +}
>> +
>> +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
>> +{
>> +	struct ipv6hdr *ip6hdr;
>> +	struct icmp6hdr *hdr;
>> +
>> +	if (skb->protocol == htons(ETH_P_IPV6)) {
> You can drop this test if you re-arrange the cases in the caller. More below.
>
>> +		ip6hdr = ipv6_hdr(skb);
>> +		if (ip6hdr->nexthdr == IPPROTO_ICMPV6) {
>> +			hdr = icmp6_hdr(skb);
> You have to use pskb_may_pull here, only the IPv6 header is pulled by the caller
> and certain to be in the linear part. Also you have to change one of the callers,
> more below.
>
>> +			if (__alb_determine_nd(hdr))
>> +				return true;
> you can do directly return __alb_determine_nd(hdr) here.
>
>> +		}
>> +	}
>> +
>> +	return false;
>> +}
>> +
>>   /************************ exported alb functions ************************/
>>   
>>   int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
>> @@ -1350,6 +1378,9 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond,>  		switch (skb->protocol) {
>>   		case htons(ETH_P_IP):
>>   		case htons(ETH_P_IPV6):
>> +			if (alb_determine_nd(skb, bond))
>> +				break;
>> +
> You can drop the IPv6 test in alb_determine_nd() if you re-arrange the cases here.
> Something like:
>    		case htons(ETH_P_IPV6):
> 			if (alb_determine_nd(skb, bond))
> 				break;
> 			fallthrough;
>    		case htons(ETH_P_IP):
>
> You should also use pskb_may_pull to make sure the IPv6 header is in the linear part
> and can be accessed.
>
>>   			hash_index = bond_xmit_hash(bond, skb);
>>   			if (bond->params.tlb_dynamic_lb) {
>>   				tx_slave = tlb_choose_channel(bond,
>> @@ -1446,6 +1477,11 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond,
>>   			break;
>>   		}
>>   
>> +		if (alb_determine_nd(skb, bond)) {
>> +			do_tx_balance = false;
>> +			break;
>> +		}
>> +
>>   		hash_start = (char *)&ip6hdr->daddr;
>>   		hash_size = sizeof(ip6hdr->daddr);
>>   		break;
>>
>> base-commit: 79e06c4c4950be2abd8ca5d2428a8c915aa62c24
> Thanks,
>   Nik
>