netdev - Re: bonding driver issue when configured for active/backup and using ARP monitoring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 04 Jan 2021 18:51:25 -0800
From:   Jay Vosburgh <jay.vosburgh@...onical.com>
To:     "Finer, Howard" <hfiner@...n.com>
cc:     "andy@...yhouse.net" <andy@...yhouse.net>,
        "vfalico@...il.com" <vfalico@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: bonding driver issue when configured for active/backup and using ARP monitoring

Finer, Howard <hfiner@...n.com> wrote:

>Please advise if there is any update here, and if not how we can go about
>getting an update to the driver to rectify the issue.

	As it happens, I've been looking at this today, and have a
couple of questions about your configuration:

	- Is there an IP address on the same subnet as the arp_ip_target
configured directly on the bond, or on a VLAN logically above the bond?

	- Is the "arp_ip_target" address reachable via an interface
other than the bond (or VLAN above it)?  This can be checked via "ip
route get [arp_ip_target]", i.e., if the target address for bond0 is
1.2.3.4, the command "ip route get 1.2.3.4" will return something like

1.2.3.4 dev bond0 src [...]

	If an interface other than bond0 (or a VLAN above it) is listed,
then there's a path to the arp_ip_target that doesn't go through the
bond.

	The ARP monitor logic can only handle a limited set of
configurations, so if your configuration is outside of that it can
misbehave in some ways.

	-J

---
	-Jay Vosburgh, jay.vosburgh@...onical.com