netdev - Re: Bridging behavior apparently changed around the Fedora 14 time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Jul 2011 02:02:42 +0200
From:	David Lamparter <equinox@...c24.net>
To:	Greg Scott <GregScott@...rasupport.com>
Cc:	Stephen Hemminger <shemminger@...tta.com>, netdev@...r.kernel.org,
	Lynn Hanson <LynnHanson@...anhills.org>,
	Joe Whalen <JoeWhalen@...anhills.org>
Subject: Re: Bridging behavior apparently changed around the Fedora 14 time

On Mon, Jul 11, 2011 at 04:08:14PM -0500, Greg Scott wrote:
> Uhmmmm - no it didn't.  Remember, I put br0 into promiscuous mode myself
> by hand - take a look at this.  Note eth0 and eth1 are not in
> promiscuous mode.  I wonder how it would behave if I put the physical
> devices into promiscuous mode and left br0 alone?  This I can easily
> test during off hours.  
> 
> [root@...c-fw2011 gregs]# ip link show
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
>     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
> 2: eth2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state
> DOWN qlen 1000
>     link/ether 00:0e:7f:2d:d0:6e brd ff:ff:ff:ff:ff:ff
> 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
>     link/ether 00:03:47:3a:59:79 brd ff:ff:ff:ff:ff:ff
> 4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
>     link/ether 00:0d:88:31:d8:24 brd ff:ff:ff:ff:ff:ff
> 5: br0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc prio
> state UNKNOWN
>     link/ether 00:03:47:3a:59:79 brd ff:ff:ff:ff:ff:ff
> [root@...c-fw2011 gregs]#

All bridge port devices should really be in promiscuous mode; either
this is just not displayed or the code is broken somewhere. On my 2.6.38
port both "ip" and "ifconfig" correctly show the devices as PROMISC
without any userspace tool setting this, no idea if this changed
recently.

However, I must say that your bug report sounds more like a 
forwarding-back-to-source-device IP-level problem. If I understand
your setup correctly, you have:

(servers)
 |
 +--------[eth0 <-br0-> eth1]------- internet
 |
(clients)

and what isn't working is the firewall forwarding packets that it
received on eth0/br0 back out on eth0/br0 on the IP level including
NATting? Or did I misunderstand?

-David

P.S.: any reason why you are (a) not using proxyarp instead of the
bridge and (b) not using a VLAN to put those servers with public IPs
in? You have a bit of a Frankennet there :/

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html