netdev - net: bonding inside a bridge does not work when using arp monitoring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4F15F227.8000909@canonical.com>
Date:	Tue, 17 Jan 2012 16:11:51 -0600
From:	Chris J Arges <chris.j.arges@...onical.com>
To:	netdev@...r.kernel.org
CC:	Jiri Bohac <jbohac@...e.cz>, leonardo.borda@...onical.com
Subject: net: bonding inside a bridge does not work when using arp monitoring

Hi,

Currently arp_monitoring does not work when the below configuration is
used. The idea is to have vlans for every virtual bridge, this way we
can have many networks in a KVM (virtualization setup) while still
having arp_monitoring through br0.
PS: FYI this setup does work with miimon activated.

eth0----+ +----bond0.100----br0-100---{+virtual machines
          | |
          +----bond0----+----br0---(using fixed ip)->--{LAN where the
arp_ip_target resides}
          | |
eth1----+ +----bond0.200----br0-200---{+virtual machines

br0 --> br0 in my understanding is an untagged vlan therefore it
provides access to my LAN. So I am able to access that server from my
internal network.
br0-100 and br0-200 -> Vlans over a bridged interface will allow me to
have many virtual machines in the same vlan on each bridged interface.

More information about this bug can be found in the bug reports [2] and [3].

First thing would be to understand if this setup is correct.
In addition, any further tests can be done by myself or Leonardo Borda.

Looking at the kernel messages it looks like br0 is not able to send out
ARP notifications.
The question is:

1. Can we do that since we also have br0-{1,2}00 hooked up to bond.100
and bond.200 ?
2. Also looking at the /etc/network/interfaces configuration example the
vlans do not have an IP address which may play a role as per the
bonding.txt documentation [1].

A potentially relevant thread that I found was here [4]. Could this
patch affect this particular set up?

Thanks,
--chris j arges

[1] - http://www.kernel.org/doc/Documentation/networking/bonding.txt
[2] - https://bugs.launchpad.net/ubuntu/+source/linux/+bug/736226
[3] - https://bugzilla.kernel.org/show_bug.cgi?id=31822
[4] - http://kerneltrap.org/mailarchive/linux-netdev/2010/4/28/6275890
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html