Re: multi-IP ARP announcement bugs?

--Apple-Mail-33-519244389
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed;
	delsp=yes
Content-Transfer-Encoding: 7bit

On 20 Mar 2009, at 10:24, Mark Blackman wrote:

> Hi,
>
> I'm writing to report that
>
> a) wackamole failover events seem to lead to an excess of identical
> ARP announcements (using wackamole 2.1.4)

This seems to be the usual case for subnet notifications when the
destination MAC address is unknown and the broadcast MAC is used
for each IP notification, possibly redundant, but deliberate anyway.

>
>
> b) wackamole doesn't seem to do ARP announcements for more than 2 IP
> addresses in a group  { eth0:ip1 eth0:ip2 eth0:ip3 ... }. Doing
> tcpdump I can see only two of IPs being announced on the new MAC.

To me, this appears to be logic bug where the current (2.1.4) code
only does as many IPs as it has 'Notify' entries (completely orthogonal
and no relationship to number of IPs), so I've patched the code against
2.1.4 and wackamole seems to now do grat. arp replies for every IP
in the relevant VirtualInterfaces grouping.  One other person reports
that this does the right thing for him as well, so I've attached the
patchset.

It merely moves the "completed notifications" counter into the per- 
managed-IP
structure so that the correct orthogonality is preserved. In any case,
would be interested to know what anyone else finds. The suggested  
patching
sequence for those unfamiliar with 'patch' would be something like.

tar -zxvpf wackamole-2.1.4.tar.gz
cd wackamole-2.1.4
patch < ../wackamole-2.1.4-patches.txt

Kind Regards,
Mark Blackman
Exonetric


--Apple-Mail-33-519244389
Content-Disposition: attachment;
	filename=wackamole-2.1.4-patches.txt
Content-Type: text/plain; x-unix-mode=0644; name="wackamole-2.1.4-patches.txt"
Content-Transfer-Encoding: 7bit

diff -u wackamole-2.1.4/defines.h wackamole-2.1.4-forpatchset/defines.h
--- wackamole-2.1.4/defines.h	2005-03-30 20:56:58.000000000 +0100
+++ wackamole-2.1.4-forpatchset/defines.h	2009-03-29 20:57:11.000000000 +0100
@@ -382,6 +382,7 @@
   struct in_addr netmask;
   struct in_addr network;
   unsigned char mac[ETH_ALEN];
+ int                 left_todo[MAX_NOTIF];
 };
 
 #define _if_ip(a) ((a).ipaddr)
@@ -415,7 +416,6 @@
   struct {
     int                 ifcount;
     struct interface    lVIF[MAX_PSEUDO+1];
-    int                 left_todo[MAX_NOTIF];
     arp_entry           *arpcache;
   } arp_spoof_data;    
 
diff -u wackamole-2.1.4/ife-bpf.c wackamole-2.1.4-forpatchset/ife-bpf.c
--- wackamole-2.1.4/ife-bpf.c	2005-11-18 18:50:01.000000000 +0000
+++ wackamole-2.1.4-forpatchset/ife-bpf.c	2009-04-01 14:29:58.000000000 +0100
@@ -58,6 +58,7 @@
   static unsigned char my_mac[ETH_ALEN];
   static unsigned char bc_mac[ETH_ALEN] =
                 {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+
   memset(&ifr, sizeof(struct ifreq), 0);
   strncpy(ifr.ifr_name, dev, IFNAMSIZ);
   if (ioctl(_if_bpf, BIOCSETIF, (caddr_t)&ifr) < 0) {
diff -u wackamole-2.1.4/ife-win32.c wackamole-2.1.4-forpatchset/ife-win32.c
--- wackamole-2.1.4/ife-win32.c	2005-03-30 20:56:58.000000000 +0100
+++ wackamole-2.1.4-forpatchset/ife-win32.c	2009-04-01 14:33:06.000000000 +0100
@@ -111,7 +111,6 @@
     }
   }
   else {
-    fprintf(stderr, "Call to GetAdaptersInfo failed.\n");
     if_last_error = dwRetVal;
   }
 
@@ -216,7 +215,7 @@
   int retval = -1;
   unsigned char my_mac[ETH_ALEN];
   struct get_my_mac get_mac;
-
+  
   if (-1 == pcap_findalldevs_ex("rpcap://", NULL, &alldevs, errbuf)) {
     fprintf(stderr, "Failed to enum devices: %s\n", errbuf);
     return -1;
diff -u wackamole-2.1.4/spoofmanager.c wackamole-2.1.4-forpatchset/spoofmanager.c
--- wackamole-2.1.4/spoofmanager.c	2004-07-28 21:56:53.000000000 +0100
+++ wackamole-2.1.4-forpatchset/spoofmanager.c	2009-04-01 14:34:10.000000000 +0100
@@ -106,13 +106,11 @@
  * if event driven, we do our work and reschedule ourselved for subsequent
  * passes. */
 void arp_spoof_notifier( int code, void *data ) {
-  int i, j, old;
+  int i, j, ni,old;
   entry *VE = (entry *)data;
 #ifdef DONT_USE_THREADS
   sp_time sleep_time = { 1, 0 }; /* 1 second. */
-
 #else
-
   pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, &old);
 #endif
   if( !code ) {
@@ -120,17 +118,18 @@
     if(_pif_ip_s(*VE)) {
       memcpy(&(VE->arp_spoof_data.lVIF[VE->arp_spoof_data.ifcount]),
              &(VE->pseudo_if), sizeof(struct interface) );
+      for(ni=0;ni<Num_notifications;ni++) VE->arp_spoof_data.lVIF[VE->arp_spoof_data.ifcount].left_todo[ni]=-1;
       VE->arp_spoof_data.ifcount++;
     }
     for(i=0;(i<MAX_PSEUDO) && _eif_ip_s(*VE, i);i++) {
       memcpy(&(VE->arp_spoof_data.lVIF[VE->arp_spoof_data.ifcount]), 
              &(VE->extra_ifs[i]), sizeof(struct interface) );
+      for(ni=0;ni<Num_notifications;ni++) VE->arp_spoof_data.lVIF[VE->arp_spoof_data.ifcount].left_todo[ni]=-1;
       VE->arp_spoof_data.ifcount++;
     }
 
-    for(i=0;i<Num_notifications;i++) VE->arp_spoof_data.left_todo[i]=-1;
-  }
 
+  }
 #ifndef DONT_USE_THREADS
   do {
 #endif
@@ -142,10 +141,11 @@
           /* fetch arp cache and do that */
           old+=send_arp_spoof_arp_cache( &(VE->arp_spoof_data.lVIF[j]), ni,
                                          VE->arp_spoof_data.arpcache,
-                                         &(VE->arp_spoof_data.left_todo[i]) );
+                                         &(VE->arp_spoof_data.lVIF[j].left_todo[i]) );
         } else {
+          wack_alarm(ARPING,"notifying for %s\n",inet_ntoa(VE->arp_spoof_data.lVIF[j].ipaddr));
           old+=send_arp_spoof_netblock( &(VE->arp_spoof_data.lVIF[j]), ni,
-                                        &(VE->arp_spoof_data.left_todo[i]) );
+                                        &(VE->arp_spoof_data.lVIF[j].left_todo[i]) );
         }
       }
     }
@@ -237,8 +237,10 @@
   struct interface newcidr;
   int csize, c, s;
 
+wack_alarm(ARPING, "Spoofing (netblockstart): destination:%s:%s, count:%d", n->destination.ifname,inet_ntoa(n->destination.ipaddr),*count);
   if(*count == 0) return 0;
   csize = calc_new_cidr(i, &(n->destination), &newcidr);
+  wack_alarm(ARPING, "Spoofing (cmpifname): i->ifname:%s  n->destination.ifname:%s\n",i->ifname, n->destination.ifname);
   if(strcmp(i->ifname, n->destination.ifname)) {
     return 0;
   }
@@ -247,6 +249,7 @@
   _if_ip_s(newcidr) = htonl(ntohl(_if_ip_s(newcidr))+(csize-*count));
   for(s=0,c=(csize-*count);(c<csize) && (!n->throttle || (s<n->throttle));c++) {
 wack_alarm(ARPING, "Spoofing (static): %s:%s", i->ifname, inet_ntoa(newcidr.ipaddr));
+wack_alarm(ARPING, "Spoofing (static): %s:%s:%s", inet_ntoa(newcidr.ipaddr),inet_ntoa(i->ipaddr),n->ping);
     if_send_spoof_request(i->ifname,
 			  _if_ip_s(*i), _if_ip_s(newcidr), NULL,
 			  2, n->ping);
Common subdirectories: wackamole-2.1.4/t and wackamole-2.1.4-forpatchset/t
diff -u wackamole-2.1.4/wackamole.c wackamole-2.1.4-forpatchset/wackamole.c
--- wackamole-2.1.4/wackamole.c	2007-02-06 14:34:46.000000000 +0000
+++ wackamole-2.1.4-forpatchset/wackamole.c	2009-03-26 22:42:17.000000000 +0000
@@ -199,7 +199,10 @@
   Usage( argc, argv );
   Wackamole_init();
 
-  if(Debug) wack_alarm_set( PRINT | ARPING | WACK_DEBUG | EXIT );
+  if(Debug) {
+    wack_alarm_enable_timestamp(NULL);
+    wack_alarm_set( PRINT | ARPING | WACK_DEBUG | EXIT );
+  }
   else {
     char pidstring[10];
 

--Apple-Mail-33-519244389
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed
Content-Transfer-Encoding: 7bit







>
>
> Are these known bugs? Any clues on what needs attention here?
>
> Kind Regards,
> Mark Blackman
> Exonetric
> _______________________________________________
> wackamole-users mailing list
> [email protected]
> http://lists.backhand.org/mailman/listinfo/wackamole-users


--Apple-Mail-33-519244389
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
wackamole-users mailing list
[email protected]
http://lists.backhand.org/mailman/listinfo/wackamole-users
--Apple-Mail-33-519244389--