netdev - [PATCH 3.2-longterm] bonding: ARP packet fix for balance-ALB (mode=6)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAK8PzVn6kMgWRDnSwHT32Sou7qB6E2_Axp-AgHgmN2jd9ktajg@mail.gmail.com>
Date:	Mon, 1 Apr 2013 12:38:20 -0400
From:	"Matthew O'Connor" <liquidhorse@...il.com>
To:	netdev@...r.kernel.org
Subject: [PATCH 3.2-longterm] bonding: ARP packet fix for balance-ALB (mode=6)

Do not modify or load balance ARP packets passing through balance-alb
mode (wherein the ARP did not originate locally, and arrived via a bridge).

This patch is backported from the upstream commit:
    From 567b871e503316b0927e54a3d7c86d50b722d955 Mon Sep 17 00:00:00 2001
    Subject: [PATCH] bonding: rlb mode of bond should not alter ARP
originating via bridge

Signed-off-by:  Matthew O'Connor <liquidhorse@...il.com>

---
diff -uprN linux-3.2.37/drivers/net/bonding/bond_alb.c
linux-3.2.37-patched/drivers/net/bonding/bond_alb.c
--- linux-3.2.37/drivers/net/bonding/bond_alb.c    2013-01-15
20:13:30.000000000 -0500
+++ linux-3.2.37-patched/drivers/net/bonding/bond_alb.c    2013-01-30
15:37:12.717485854 -0500
@@ -666,6 +666,12 @@ static struct slave *rlb_arp_xmit(struct
     struct arp_pkt *arp = arp_pkt(skb);
     struct slave *tx_slave = NULL;

+    /* Don't modify or load balance ARPs that do not originate locally
+     * (e.g.,arrive via a bridge).
+     */
+    if (!bond_slave_has_mac(bond, arp->mac_src))
+        return NULL;
+
     if (arp->op_code == htons(ARPOP_REPLY)) {
         /* the arp must be sent on the selected
         * rx channel
diff -uprN linux-3.2.37/drivers/net/bonding/bonding.h
linux-3.2.37-patched/drivers/net/bonding/bonding.h
--- linux-3.2.37/drivers/net/bonding/bonding.h    2013-01-15
20:13:30.000000000 -0500
+++ linux-3.2.37-patched/drivers/net/bonding/bonding.h    2013-01-30
15:37:12.729485790 -0500
@@ -18,6 +18,7 @@
 #include <linux/timer.h>
 #include <linux/proc_fs.h>
 #include <linux/if_bonding.h>
+#include <linux/etherdevice.h>
 #include <linux/cpumask.h>
 #include <linux/in6.h>
 #include <linux/netpoll.h>
@@ -436,6 +437,18 @@ static inline void bond_destroy_proc_dir
 }
 #endif

+static inline struct slave *bond_slave_has_mac(struct bonding *bond,
+                           const u8 *mac)
+{
+    int i = 0;
+    struct slave *tmp;
+
+    bond_for_each_slave(bond, tmp, i)
+        if (ether_addr_equal_64bits(mac, tmp->dev->dev_addr))
+            return tmp;
+
+    return NULL;
+}

 /* exported from bond_main.c */
 extern int bond_net_id;
diff -uprN linux-3.2.37/include/linux/etherdevice.h
linux-3.2.37-patched/include/linux/etherdevice.h
--- linux-3.2.37/include/linux/etherdevice.h    2013-01-15
20:13:30.000000000 -0500
+++ linux-3.2.37-patched/include/linux/etherdevice.h    2013-01-30
15:37:12.729485790 -0500
@@ -275,4 +275,37 @@ static inline unsigned long compare_ethe
 #endif
 }

+/**
+ * ether_addr_equal_64bits - Compare two Ethernet addresses
+ * @addr1: Pointer to an array of 8 bytes
+ * @addr2: Pointer to an other array of 8 bytes
+ *
+ * Compare two Ethernet addresses, returns true if equal, false otherwise.
+ *
+ * The function doesn't need any conditional branches and possibly uses
+ * word memory accesses on CPU allowing cheap unaligned memory reads.
+ * arrays = { byte1, byte2, byte3, byte4, byte5, byte6, pad1, pad2 }
+ *
+ * Please note that alignment of addr1 & addr2 are only guaranteed to
be 16 bits.
+ */
+
+static inline bool ether_addr_equal_64bits(const u8 addr1[6+2],
+                                           const u8 addr2[6+2])
+{
+#ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
+        unsigned long fold = ((*(unsigned long *)addr1) ^
+                              (*(unsigned long *)addr2));
+
+        if (sizeof(fold) == 8)
+                return zap_last_2bytes(fold) == 0;
+
+        fold |= zap_last_2bytes((*(unsigned long *)(addr1 + 4)) ^
+                                (*(unsigned long *)(addr2 + 4)));
+        return fold == 0;
+#else
+        return ether_addr_equal(addr1, addr2);
+#endif
+}
+
+
 #endif    /* _LINUX_ETHERDEVICE_H */
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html