netdev - Sending ARP probes (for arp_ip_target) over backup slaves

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 17 Sep 2021 00:27:36 +0000
From:   Venkat Venkatsubra <venkat.x.venkatsubra@...cle.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     Konrad Wilk <konrad.wilk@...cle.com>,
        Jay Vosburgh <jay.vosburgh@...onical.com>
Subject: Sending ARP probes (for arp_ip_target) over backup slaves

For illustration purposes if we use this config for a bondeth0 
with slaves eth0 and eth1

"mode=active-backup arp_interval=100 arp_ip_target=192.168.1.1 ..."

and let's say eth0 is the current active slave and eth1 is the backup slave.

Currently bonding sends ARP requests over eth0 only.
And our switch does not forward them back over to eth1.

Let's say some packets keep coming in over eth1 every 1 second.
And this brings the eth1 state to up (arp_validate not set).

time t0:
ARP probe sent over eth0.
ARP reply comes back over eth0.
So, eth0 remains up.
But eth1 link state goes down due to lack of any incoming packets.

time t0 + 1 second
eth1 comes back up again due to arrival of that "some" packet.
But only to go down quite soon again 
(no more incoming packets for another second).

And this keeps repeating.

Now, if we send the ARP probes over eth1 as well (every arp_interval),
ARP response returns back for us over eth1.
And this helps eth1's link state remain up and not go down.
And we avoid the continuous link flapping.

Seeking suggestion on adding a new option to select whether
the ARP probes need to be sent over the backup slaves too.
If there is a usefulness (at least in some scenarios), I can send out a patch.
The part that some might be able to relate is where some switches 
don't forward the ARP request over eth0 back on to eth1.

Thanks,

Venkat