netdev - bonding and SR-IOV -- do we need arp_validation for loadbalancing too?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <500EC5CF.3080400@genband.com>
Date:	Tue, 24 Jul 2012 09:57:03 -0600
From:	Chris Friesen <chris.friesen@...band.com>
To:	netdev <netdev@...r.kernel.org>, Jay Vosburgh <fubar@...ibm.com>,
	andy@...yhouse.net
Subject: bonding and SR-IOV -- do we need arp_validation for loadbalancing
 too?

Hi all,

We've been starting to look at bonding VFs from separate physical 
devices in a guest, but we've run into a problem.

The host is bonding the corresponding PFs, and it uses arp monitoring. 
  What we have found is that any broadcast traffic from the guest (if 
they enable arp monitoring, for example) will be seen by the internal L2 
switch of the NIC and sent up into the host, where the bonding driver 
will count it as incoming packets and use it to mark the link as good.

The only solutions I've been able to come up with are:
1) add arp validation for load balancing modes as well as active-backup.
2) put all the VMs in VLANs

Anyone have any better ideas?

Chris

-- 

Chris Friesen
Software Designer

3500 Carling Avenue
Ottawa, Ontario K2H 8E9
www.genband.com

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html