Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vxlan layers learns broadcast / multicast addresses from incoming packets #3191

Closed
blocktrron opened this issue Feb 17, 2024 · 1 comment · Fixed by #3204
Closed

vxlan layers learns broadcast / multicast addresses from incoming packets #3191

blocktrron opened this issue Feb 17, 2024 · 1 comment · Fixed by #3204
Labels
0. type: bug This is a bug 3. topic: batman-adv 3. topic: wireguard This is about wireguard, an in-kernel layer 3 VPN

Comments

@blocktrron
Copy link
Member

When a Gluon node receives a vxlan packet where the encapsulated ethernet source-address is a broadcast or multicast address, the Gluon node adds this source-address to it's fdb. Subsequently, all broadcast packets and therefor batman-adv OGMs are exclusively sent to this node as unicast.

image

de12d533e19496afbf99ea4486dd6000000000a61140fe8000000000000094afbffffe99ea44fe80000000000000dc12d5fffe33e1949acb12b500a60000080000003418f400ffffffffffff96afbf99ea444305000f31000aaf98e1de12d533e193de12d533e19400ce002c0401001c014700039abfab1780010000d383d63080000000c750872600000000060200041900000002010000000f3000bcdd26e99629afe64f0bde12d533e19400c2002c0401001c01fd0003419655e18001000008aa28c680000000a2b78f4a00000000060200041900000002010000

I'm unsure if this behavior is okay (or how it happens organically). However, as this allows a DoS on a wired-mesh network, we should at least apply a hotfix. I will open a pull-request for this.

I assume meshing over wireguard using vxlan should not be affected from my understabding, as it's a 1:1 peer connection. Someone with more insight into this architecture should evaluate if this is also affected.
@blocktrron blocktrron added 0. type: bug This is a bug 3. topic: batman-adv 3. topic: wireguard This is about wireguard, an in-kernel layer 3 VPN labels Feb 17, 2024
blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 17, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations
264f4d9 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
@blocktrron blocktrron mentioned this issue Feb 17, 2024
Merged
blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 17, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations
eda496f 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
blocktrron added a commit that referenced this issue Feb 21, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations (#3192)
97b9fcc 
See Gluon #3191

Link: #3191

Signed-off-by: David Bauer <mail@david-bauer.net>
@blocktrron
Copy link
Member Author

I will keep this issue open until we've backported the Fix to v2023.2 and v2023.1.

blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 22, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations (freifunk-gluon#3192)
692ca93 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
@blocktrron blocktrron mentioned this issue Feb 22, 2024
Merged
blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 22, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations
6fd05b0 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 22, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations
0aaa966 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
blocktrron added a commit that referenced this issue Feb 23, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations (#3196)
396e8f3 
See Gluon #3191

Link: #3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
openwrt-bot pushed a commit to openwrt/openwrt that referenced this issue Feb 26, 2024
@blocktrron
generic vxlan: don't learn non-unicast L2 destinations
0985262 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
blocktrron added a commit to blocktrron/gluon that referenced this issue Feb 27, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations
9ce8615 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
@blocktrron blocktrron mentioned this issue Feb 27, 2024
Merged
openwrt-bot pushed a commit to openwrt/openwrt that referenced this issue Feb 27, 2024
@blocktrron
generic vxlan: don't learn non-unicast L2 destinations
a2943e3 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 0985262)
blocktrron added a commit that referenced this issue Feb 27, 2024
@blocktrron
net vxlan: don't learn non-unicast L2 destinations (#3204)
c9e4c3b 
See Gluon #3191

Link: #3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
@rotanid rotanid linked a pull request Feb 27, 2024 that will close this issue
[v2023.1.x] net vxlan: don't learn non-unicast L2 destinations #3204
Merged
@Djfe Djfe mentioned this issue Mar 1, 2024
Open
noblemtw pushed a commit to noblemtw/openwrt-nss23-0x that referenced this issue Mar 8, 2024
@blocktrron @noblemtw
generic vxlan: don't learn non-unicast L2 destinations
83bbd2d 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
rmandrad pushed a commit to rmandrad/openwrt that referenced this issue Mar 9, 2024
@blocktrron @rmandrad
generic vxlan: don't learn non-unicast L2 destinations
604febf 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
schuettecarsten pushed a commit to schuettecarsten/openwrt that referenced this issue Apr 8, 2024
@blocktrron @schuettecarsten
generic vxlan: don't learn non-unicast L2 destinations
2ce4045 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
misanthropos pushed a commit to misanthropos/gluon that referenced this issue Apr 29, 2024
@blocktrron @misanthropos
net vxlan: don't learn non-unicast L2 destinations (freifunk-gluon#3192)
ade7730 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
hafu pushed a commit to Freifunk-Potsdam/gluon that referenced this issue Jun 2, 2024
@blocktrron @hafu
net vxlan: don't learn non-unicast L2 destinations (freifunk-gluon#3196)
9257944 
See Gluon freifunk-gluon#3191

Link: freifunk-gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 97b9fcc)
davintagas pushed a commit to davintagas/ROOterSource2305 that referenced this issue Jun 26, 2024
@blocktrron
generic vxlan: don't learn non-unicast L2 destinations
b62b618 
This patch avoids learning non-unicast targets in the vxlan FDB. They
are non-unicast and thus should be sent to the broadcast-IPv6 instead of
a unicast address

Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
Link: freifunk-gluon/gluon#3191

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 0985262fd0f0b9c33e1fb559e71c041379199a91)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
0. type: bug This is a bug 3. topic: batman-adv 3. topic: wireguard This is about wireguard, an in-kernel layer 3 VPN
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[v2023.1.x] net vxlan: don't learn non-unicast L2 destinations blocktrron/gluon
1 participant
@blocktrron