netdev - Re: [PATCH net 1/1] bonding: fix PACKET_ORIGDEV regression on bonding masters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Jan 2019 03:01:55 +0100
From:   Michal Soltys <soltys@....info>
To:     Maciej Żenczykowski <zenczykowski@...il.com>,
        David Miller <davem@...emloft.net>
Cc:     Linux NetDev <netdev@...r.kernel.org>,
        Jay Vosburgh <jay.vosburgh@...onical.com>, vincent@...nat.ch,
        Mahesh Bandewar <maheshb@...gle.com>,
        Chonggang Li <chonggangli@...gle.com>
Subject: Re: [PATCH net 1/1] bonding: fix PACKET_ORIGDEV regression on bonding
 masters

On 19/01/14 03:01, Maciej Żenczykowski wrote:
> So I don't remember the specifics...
> 
> (note I'm writing this all from memory without looking it up/testing
> it - I may be utterly wrong or dreaming)
> 
> But I seem to recall that the core problem we were trying to solve was
> that a daemon listening
> on an AF_PACKET ethertype 88CC [LLDP] socket not bound to any device
> would not receive LLDP packets
> arriving on inactive bond slaves (either active-backup or lag).
> 
> [inactive = link/carrier up, but not part of active aggregator]
> 
> This made monitoring for miscabling harder (IFIRC the only non kernel
> fix was to get the daemon to create
> a separate AF_PACKET/88CC socket bound to every physical interface in
> the system, or monitor for
> inactive slaves and add extra packet sockets as needed).
> 
> They would get re-parented to the master and then since the slave was
> inactive they would be considered RX_HANDLER_EXACT match only and not
> match the * interface.
> 
> Honestly I wasn't aware of PACKET_ORIGDEV, although I don't think it
> helps in this case - AFAICR the packets never made it to the packet
> socket.
> 
> Perhaps going from:
>    /* don't change skb->dev for link-local packets */
>    if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) return RX_HANDLER_PASS;
>    if (bond_should_deliver_exact_match(skb, slave, bond)) return
> RX_HANDLER_EXACT;
> 
> to something more like:
>    if (bond_should_deliver_exact_match(skb, slave, bond)) {
>      /* don't change skb->dev for link-local packets on inactive slaves */
>      if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) return RX_HANDLER_PASS;
>      return RX_HANDLER_EXACT;
>    }
> 
> would fix both problems?
> 

I'll test this change in bridging scenarios in coming days. And thanks 
for the explanation of what was the issue in your case.