netdev - Re: [PATCH net] Revert "net: team: use IFF_NO_ADDRCONF flag to prevent ipv6 addrconf"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADvbK_dU04m8VZDEAeCZx4xNTr3J8Jj=NXpcSvoMuOuefC6AoQ@mail.gmail.com>
Date:   Wed, 18 Jan 2023 11:15:18 -0500
From:   Xin Long <lucien.xin@...il.com>
To:     David Ahern <dsahern@...il.com>
Cc:     network dev <netdev@...r.kernel.org>, davem@...emloft.net,
        kuba@...nel.org, Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>, Jiri Pirko <jiri@...nulli.us>
Subject: Re: [PATCH net] Revert "net: team: use IFF_NO_ADDRCONF flag to
 prevent ipv6 addrconf"

On Tue, Jan 17, 2023 at 9:36 PM David Ahern <dsahern@...il.com> wrote:
>
> On 1/17/23 11:42 AM, Xin Long wrote:
> > This reverts commit 0aa64df30b382fc71d4fb1827d528e0eb3eff854.
> >
> > Currently IFF_NO_ADDRCONF is used to prevent all ipv6 addrconf for the
> > slave ports of team, bonding and failover devices and it means no ipv6
> > packets can be sent out through these slave ports. However, for team
> > device, "nsna_ping" link_watch requires ipv6 addrconf. Otherwise, the
> > link will be marked failure. This patch removes the IFF_NO_ADDRCONF
> > flag set for team port, and we will fix the original issue in another
> > patch, as Jakub suggested.
> >
> > Signed-off-by: Xin Long <lucien.xin@...il.com>
> > ---
> >  drivers/net/team/team.c | 2 --
> >  1 file changed, 2 deletions(-)
> >
> > diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
> > index fcd43d62d86b..d10606f257c4 100644
> > --- a/drivers/net/team/team.c
> > +++ b/drivers/net/team/team.c
> > @@ -1044,7 +1044,6 @@ static int team_port_enter(struct team *team, struct team_port *port)
> >                       goto err_port_enter;
> >               }
> >       }
> > -     port->dev->priv_flags |= IFF_NO_ADDRCONF;
> >
> >       return 0;
> >
> > @@ -1058,7 +1057,6 @@ static void team_port_leave(struct team *team, struct team_port *port)
> >  {
> >       if (team->ops.port_leave)
> >               team->ops.port_leave(team, port);
> > -     port->dev->priv_flags &= ~IFF_NO_ADDRCONF;
> >       dev_put(team->dev);
> >  }
> >
>
> What about the other patches in that set - failover device and bonding?
This only exists in Team, as nsna_ping link watch in userspace libteam
requires IPv6 addrconf to send NS packets, see rawv6_sendmsg():

        dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto out;
        }

It will break here.

For bonding, nothing actually was changed as before, it's just using
a new flag IFF_NO_ADDRCONF instead of IFF_SLAVE. and the
late added nsna_ping link watch (trying to sync with libteam) is in
kernel space, and doesn't require dst on the slave dev, see:

  bond_ns_send_all() -> bond_ns_send().

For failover device, it checks the link when net_failover_start_xmit()
directly by:

    netif_running(dev) && netif_carrier_ok(dev)

I don't think a "link watch" in userspace exists, not to mention a nsna_ping.

Thanks.