netdev - Re: Strange routing with VRF and 5.2.7+

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7d1de949-5cf0-cb74-6ca3-52315c34a340@candelatech.com>
Date:   Fri, 20 Sep 2019 08:57:21 -0700
From:   Ben Greear <greearb@...delatech.com>
To:     netdev <netdev@...r.kernel.org>
Subject: Re: Strange routing with VRF and 5.2.7+

On 9/10/19 6:08 PM, Ben Greear wrote:
> On 9/10/19 3:17 PM, Ben Greear wrote:
>> Today we were testing creating 200 virtual station vdevs on ath9k, and using
>> VRF for the routing.
> 
> Looks like the same issue happens w/out VRF, but there I have oodles of routing
> rules, so it is an area ripe for failure.
> 
> Will upgrade to 5.2.14+ and retest, and try 4.20 as well....

Turns out, this was ipsec (strongswan) inserting a rule that pointed to a table
that we then used for a vrf w/out realizing the rule was added.

Stopping strongswan and/or reconfiguring how routing tables are assigned
resolved the issue.

Thanks,
Ben

> 
> Thanks,
> Ben
> 
>>
>> This really slows down the machine in question.
>>
>> During the minutes that it takes to bring these up and configure them,
>> we loose network connectivity on the management port.
>>
>> If I do 'ip route show', it just shows the default route out of eth0, and
>> the subnet route.  But, if I try to ping the gateway, I get an ICMP error
>> coming back from the gateway of one of the virtual stations (which should be
>> safely using VRFs and so not in use when I do a plain 'ping' from the shell).
>>
>> I tried running tshark on eth0 in the background and running ping, and it captures
>> no packets leaving eth0.
>>
>> After some time (and during this time, my various scripts will be (re)configuring
>> vrfs and stations and related vrf routing tables and such,
>> but should *not* be messing with the main routing table, then suddenly
>> things start working again.
>>
>> I am curious if anyone has seen anything similar or has suggestions for more
>> ways to debug this.  It seems reproducible, but it is a pain to
>> debug.
>>
>> Thanks,
>> Ben
>>
> 
> 


-- 
Ben Greear <greearb@...delatech.com>
Candela Technologies Inc  http://www.candelatech.com