linux-kernel - Re: [PATCH v10] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Jan 2022 10:45:59 +0800
From:   孙守鑫 <sunshouxin@...natelecom.cn>
To:     j.vosburgh@...il.com, vfalico@...il.com, andy@...yhouse.net,
        davem@...emloft.net, kuba@...nel.org
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        jay.vosburgh@...onical.com, nikolay@...dia.com,
        huyd12@...natelecom.cn,
        孙守鑫 <sunshouxin@...natelecom.cn>
Subject: Re: [PATCH v10] net: bonding: Add support for IPV6 ns/na to
 balance-alb/balance-tlb mode


Any progress？


在 2022/1/28 10:39, Sun Shouxin 写道:
> Since ipv6 neighbor solicitation and advertisement messages
> isn't handled gracefully in bond6 driver, we can see packet
> drop due to inconsistency between mac address in the option
> message and source MAC .
>
> Another examples is ipv6 neighbor solicitation and advertisement
> messages from VM via tap attached to host bridge, the src mac
> might be changed through balance-alb mode, but it is not synced
> with Link-layer address in the option message.
>
> The patch implements bond6's tx handle for ipv6 neighbor
> solicitation and advertisement messages.
>
> Suggested-by: Hu Yadi <huyd12@...natelecom.cn>
> Acked-by: Jay Vosburgh <jay.vosburgh@...onical.com>
> Signed-off-by: Sun Shouxin <sunshouxin@...natelecom.cn>
> ---
> v9->v10:
> - add IPv6 header pull in alb_determine_nd.
> - combine bond_xmit_alb_slave_get's IPv6 header
> pull with alb_determine_nd's
> ---
>   drivers/net/bonding/bond_alb.c | 40 ++++++++++++++++++++++++++++++++--
>   1 file changed, 38 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
> index 533e476988f2..d9da6eb7f5c2 100644
> --- a/drivers/net/bonding/bond_alb.c
> +++ b/drivers/net/bonding/bond_alb.c
> @@ -1269,6 +1269,37 @@ static int alb_set_mac_address(struct bonding *bond, void *addr)
>   	return res;
>   }
>   
> +/* determine if the packet is NA or NS */
> +static bool __alb_determine_nd(struct icmp6hdr *hdr)
> +{
> +	if (hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT ||
> +	    hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) {
> +		return true;
> +	}
> +
> +	return false;
> +}
> +
> +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond)
> +{
> +	struct ipv6hdr *ip6hdr;
> +	struct icmp6hdr *hdr;
> +
> +	if (!pskb_network_may_pull(skb, sizeof(*ip6hdr)))
> +		return true;
> +
> +	ip6hdr = ipv6_hdr(skb);
> +	if (ip6hdr->nexthdr == IPPROTO_ICMPV6) {
> +		if (!pskb_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr)))
> +			return true;
> +
> +		hdr = icmp6_hdr(skb);
> +		return __alb_determine_nd(hdr);
> +	}
> +
> +	return false;
> +}
> +
>   /************************ exported alb functions ************************/
>   
>   int bond_alb_initialize(struct bonding *bond, int rlb_enabled)
> @@ -1348,8 +1379,11 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond,
>   	/* Do not TX balance any multicast or broadcast */
>   	if (!is_multicast_ether_addr(eth_data->h_dest)) {
>   		switch (skb->protocol) {
> -		case htons(ETH_P_IP):
>   		case htons(ETH_P_IPV6):
> +			if (alb_determine_nd(skb, bond))
> +				break;
> +			fallthrough;
> +		case htons(ETH_P_IP):
>   			hash_index = bond_xmit_hash(bond, skb);
>   			if (bond->params.tlb_dynamic_lb) {
>   				tx_slave = tlb_choose_channel(bond,
> @@ -1432,10 +1466,12 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond,
>   			break;
>   		}
>   
> -		if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) {
> +		if (alb_determine_nd(skb, bond)) {
>   			do_tx_balance = false;
>   			break;
>   		}
> +
> +		/* The IPv6 header is pulled by alb_determine_nd */
>   		/* Additionally, DAD probes should not be tx-balanced as that
>   		 * will lead to false positives for duplicate addresses and
>   		 * prevent address configuration from working.
>
> base-commit: dd81e1c7d5fb126e5fbc5c9e334d7b3ec29a16a0