Don't receive an unrelated packet

Hi All,

We are embarrassed about the problem of the network on Xen.
The application where the problem occurs receives directly the RAW packet with dev_add_pack().
This application did not work on the PV domain and the PV-on-HVM domain.

We investigated this problem.

The packet of different MAC address was not expected for this application to be received.
Because, physical NIC drops packet of different MAC address on Native Linux. Therefore, this application doesn't check whether the MAC address of the received packet is the same.

There is no problem because the packet of different MAC address is not transmitted from the bridge usually at all.
However, when the bridge does the flooding, the packet is transmitted to all ports.
Therefore, the packet of different mac address is received by the guest.

The packet of different MAC address is dropped by the emulation of qemu-dm on the HVM domain.
Therefore, the emulation of qemu-dm works like physical NIC. However, all packets are received for VNIF on the PV domain and PV-on-HVM. This application was received the packet of different MAC address and malfunctioned.
Therefore, VNIF always works as promiscuous mode.

We think whether VNIF should drop the packet on different MAC address. This patch was corrected to drop the packet with different MAC address with VNIF.

Is there a problem though want to be corrected by us like this patch? Or, is it a specification of the network of Xen?

Best Regards,

--
Takanori Kasai

# HG changeset patch
# User [email protected]
# Date 1204617252 -32400
# Node ID d1e7a5d5a5b111f249fd0041ad941885d62ed93f # Parent 1cf7ba68d855aa86b1c54c34c03fc62571eb5c94 Don't receive an unrelated packet,
and check the MAC address of the received packet.

diff -r 1cf7ba68d855 -r d1e7a5d5a5b1 drivers/xen/netfront/netfront.c
@@ -1473,8 +1473,15 @@ err:
 		/* Ethernet work: Delayed to here as it peeks the header. */
 		skb->protocol = eth_type_trans(skb, dev);
 
-		/* Pass it up. */
-		netif_receive_skb(skb);
+		if(!(skb->dev->flags & IFF_PROMISC)
+		  && !is_broadcast_ether_addr(skb->mac.raw)
+		  && !is_multicast_ether_addr(skb->mac.raw)
+		  && compare_ether_addr(skb->mac.raw, np->mac) ) {
+			kfree_skb(skb);
+		} else {
+			/* Pass it up. */
+			netif_receive_skb(skb);
+		}
 		dev->last_rx = jiffies;
 	}
 

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

It's bogus that the application does not do this filtering itself. Even disregarding Xen, what if the application were run concurrently with a tcpdump session (or anything that enables promiscuous reception)?

-- Keir