netdev - Re: [PATCH net-next 1/2] ipv4: Invalidate neighbour for broadcast address upon address addition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Feb 2022 12:44:47 +0800
From:   "wanghai (M)" <wanghai38@...wei.com>
To:     Ido Schimmel <idosch@...dia.com>, <netdev@...r.kernel.org>
CC:     <davem@...emloft.net>, <kuba@...nel.org>, <dsahern@...il.com>,
        <mlxsw@...dia.com>
Subject: Re: [PATCH net-next 1/2] ipv4: Invalidate neighbour for broadcast
 address upon address addition


在 2022/2/19 23:45, Ido Schimmel 写道:
> In case user space sends a packet destined to a broadcast address when a
> matching broadcast route is not configured, the kernel will create a
> unicast neighbour entry that will never be resolved [1].
>
> When the broadcast route is configured, the unicast neighbour entry will
> not be invalidated and continue to linger, resulting in packets being
> dropped.
>
> Solve this by invalidating unresolved neighbour entries for broadcast
> addresses after routes for these addresses are internally configured by
> the kernel. This allows the kernel to create a broadcast neighbour entry
> following the next route lookup.
>
> Another possible solution that is more generic but also more complex is
> to have the ARP code register a listener to the FIB notification chain
> and invalidate matching neighbour entries upon the addition of broadcast
> routes.
>
> It is also possible to wave off the issue as a user space problem, but
> it seems a bit excessive to expect user space to be that intimately
> familiar with the inner workings of the FIB/neighbour kernel code.
>
> [1] https://lore.kernel.org/netdev/55a04a8f-56f3-f73c-2aea-2195923f09d1@huawei.com/
>
> Reported-by: Wang Hai <wanghai38@...wei.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
> Wang Hai, please retest as I have changed the patch a bit.
Thanks, retested and it worked.

Tested-by: Wang Hai <wanghai38@...wei.com>

-- 
Wang Hai