netdev - Re: [PATCH net 1/1] bonding: fix PACKET_ORIGDEV regression on bonding masters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cd229ac2-8d79-1af5-78e3-50a2b0bb2157@ziu.info>
Date:   Fri, 18 Jan 2019 01:27:56 +0100
From:   Michal Soltys <soltys@....info>
To:     Maciej Żenczykowski <zenczykowski@...il.com>,
        David Miller <davem@...emloft.net>
Cc:     Linux NetDev <netdev@...r.kernel.org>,
        Jay Vosburgh <jay.vosburgh@...onical.com>, vincent@...nat.ch,
        Mahesh Bandewar <maheshb@...gle.com>,
        Chonggang Li <chonggangli@...gle.com>
Subject: Re: [PATCH net 1/1] bonding: fix PACKET_ORIGDEV regression on bonding
 masters

On 19/01/14 03:01, Maciej Żenczykowski wrote:
> So I don't remember the specifics...
> 
> (note I'm writing this all from memory without looking it up/testing
> it - I may be utterly wrong or dreaming)
> 
> But I seem to recall that the core problem we were trying to solve was
> that a daemon listening
> on an AF_PACKET ethertype 88CC [LLDP] socket not bound to any device
> would not receive LLDP packets
> arriving on inactive bond slaves (either active-backup or lag).
> 
> [inactive = link/carrier up, but not part of active aggregator]
> 
> This made monitoring for miscabling harder (IFIRC the only non kernel
> fix was to get the daemon to create
> a separate AF_PACKET/88CC socket bound to every physical interface in
> the system, or monitor for
> inactive slaves and add extra packet sockets as needed).
> 
> They would get re-parented to the master and then since the slave was
> inactive they would be considered RX_HANDLER_EXACT match only and not
> match the * interface.
> 
> Honestly I wasn't aware of PACKET_ORIGDEV, although I don't think it
> helps in this case - AFAICR the packets never made it to the packet
> socket.
> 
> Perhaps going from:
>    /* don't change skb->dev for link-local packets */
>    if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) return RX_HANDLER_PASS;
>    if (bond_should_deliver_exact_match(skb, slave, bond)) return
> RX_HANDLER_EXACT;
> 
> to something more like:
>    if (bond_should_deliver_exact_match(skb, slave, bond)) {
>      /* don't change skb->dev for link-local packets on inactive slaves */
>      if (is_link_local_ether_addr(eth_hdr(skb)->h_dest)) return RX_HANDLER_PASS;
>      return RX_HANDLER_EXACT;
>    }

Having checked the code (if I get the flow correctly), one 
thing/question - currently with Mahesh's fixes, not bound LLDP listener 
will receive all packets - both from active and inactive slaves directly 
(as the check for suppression is done after the link-local check).

The version above will do the suppression check first - so all inactive 
slaves - excluding non-multi/non-broad ALB - will pass it and return 
RX_HANDLER_PASS if the packet is link-local. So those will be available 
w/o binding, but active slaves' packets will be available via master 
device (but with working PACKET_ORIGDEV now - so slave device can be 
retrieved easily). This is fine in your scenario I presume ?