netdev - Re: [OpenWrt-Devel] Understanding/reimplementing forwarding acceleration used by Broadcom (ctf)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 25 Aug 2013 23:16:37 +0200
From:	Rafał Miłecki <zajec5@...il.com>
To:	OpenWrt Development List <openwrt-devel@...ts.openwrt.org>
Cc:	Network Development <netdev@...r.kernel.org>
Subject: Re: [OpenWrt-Devel] Understanding/reimplementing forwarding
 acceleration used by Broadcom (ctf)

2013/8/24 Kristian Evensen <kristian.evensen@...il.com>:
> Hi Rafal,

Thanks Kristian for your reply, unfortunately I can't make it work the
way I want :(

> On Sat, Aug 24, 2013 at 5:19 PM, Rafał Miłecki <zajec5@...il.com> wrote:
>>
>> I wonder what do you think about this solution. Is this something we
>> could try to implement ourself? Is it worth it? Is there some existing
>> project doing similar thing?
>
> This is a very interesting discovery. Have you tried to use etables
> and checked how much data you can push through the router? For
> example, have one machine connected to the LAN and one to the WAN port
> (probably using static IPs for the "WAN" is the easiest). Use MAC NAT
> (http://ebtables.sourceforge.net/examples/basic.html#ex_nat) on the
> OpenWRT router to set the destination to the machine connected to the
> WAN, push UDP traffic from a client connected to the LAN to some
> remote IP and see how much data flows through the router. Use for
> example bwm-ng on the machine connected to the WAN port to see current
> throughput (also to avoid putting any additional pressure on the
> router CPU). Be aware that unless you configure the machine connected
> to the WAN port as a router, the forwarded packets will be discarded.
>
> If this works and gives good performance, based on my understanding,
> you could implement this ctf module as an etables extension.

I've tried to setup network the way you suggested.

I configured OpenWrt router to use static 192.168.5.2 on the WAN
interface and then I set 192.168.5.1 on my monitor (bwm-ng) machine
connected to that WAN port.

OpenWrt uses 192.168.1.1 by default on LAN ports and my second (TX)
machine received some random 192.168.1.131.

I use iperf on my 192.168.1.131 TX machine, so I decided to tell iperf
to use 192.168.1.1 and redirect that traffinc (on the OpenWrt router)
to the WAN port. To do that I typed:
ebtables -t nat -A PREROUTING \
    -d $(OPENWRT_MAC) \
    -i eth0.1 \
    -j dnat --to-destination $(MONITOR_MACHINE_MAC)

eth0.1 interface is the one used for LAN ports and bridged with the br-lan:
# brctl show
bridge name bridge id STP enabled interfaces
br-lan 7fff.204e7fab3aa8 no eth0.1

Then I started:
iperf -c 192.168.1.1 --udp
on my TX machine, but no RX traffic has appeared on my monitor
(192.168.5.1) machine :(

What's worse, after executing that "ebtable" command even direct:
iperf -c 192.168.5.1 --udp
doesn't generate any RX on my monitor (192.168.5.1) machine. Flushing
-t nat makes that direct command work again.

I guess I did something wrong in my ebtables rule. Do you have any
idea what could it be? It's the first time I've heard about ebtables
to be honest.

-- 
Rafał
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html