[LU-11894] Check for asymmetrical route messages in LNet

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.13.0, Lustre 2.12.1
• Affects Version/s: Lustre 2.12.0
• Labels: lnet patch sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Asymmetrical routes can be an issue when debugging network, and allowing them also opens the door to attacks where hostile clients inject data to the servers.

This is explained for instance in this presentation from Dave Holland from Sanger:
https://youtu.be/Yf29eyR_2AU?t=1359

The idea is to check if the LNet messages received from a remote peer are coming through a router that would normally be used by this node to reach the remote peer. If it is not the case, then it means we are dealing with asymmetrical routing, and we want to drop such messages.

The check for asymmetrical route messages could be switched on/off on a per-node basis.

I will propose a patch to implement this idea.

Comments

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/34457/
Subject: LU-11894 lnet: check for asymmetrical route messages
Project: fs/lustre-release
Branch: b2_12
Current Patch Set:
Commit: f95ab9a42241a2a7319f6fa77e570f5526771afa

[Gerrit Updater]

Minh Diep ([e-mail]) uploaded a new patch: https://review.whamcloud.com/34457
Subject: LU-11894 lnet: check for asymmetrical route messages
Project: fs/lustre-release
Branch: b2_12
Current Patch Set: 1
Commit: c08419f2eca52862c4ae36c0b43c328f5232c56b

[Peter Jones]

Landed for 2.13

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/34119/
Subject: LU-11894 lnet: check for asymmetrical route messages
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 4932febc121349d855ac9934c538ce688c140afa

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: https://review.whamcloud.com/34119
Subject: LU-11894 lnet: check for asymmetrical route messages
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 732dfb3b18b2b0830a66990e0e42ea6c97b86676