Re: VRRP packets with duplicate AH sequence number

On 2017-05-17 13:59, Quentin Armitage wrote:
> Aleksey
> 
>  Since the patch doesn't apply, just add the line
>  log_message(LOG_INFO, "Sending advert with seq no %d",
> vrrp->ipsecah_counter->seq_number);
>  at the correct place (i.e. the line before "return sendmsg(...") in
> function vrrp_send_pkt() in keepalived/vrrp/vrrp.c at around line
> 1124.
> 
>  Once you have keepalived built with the line above included, then we
> will be able to see whether keepalived is sending messages with the
> same sequence number, or whether something else is duplicating the
> packets.
> 
>  Quentin
> 
>  On Wed, 2017-05-17 at 13:40 +0300, Aleksey wrote:
> 
> I tried applying the patch but failed:
> 
> root@NODE2:~# patch -p0 <123.txt
> Ignoring potentially dangerous file name
> /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
> can't find file to patch at input line 3
> Perhaps you used the wrong -p or --strip option?
> The text leading up to this was:
> --------------------------
> |--- root/123.txt
> |+++ /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
> --------------------------
> File to patch: /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
> patching file /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
> patch: **** malformed patch at line 10: }
> 
> root@NODE2:~# cat 123.txt
> --- root/123.txt
> +++ /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
> @@ -1121,6 +1121,7 @@ vrrp_send_pkt(vrrp_t * vrrp, struct
> sockaddr_storage *addr)
>  vrrp_build_ancillary_data(&msg, cbuf, src);
>  }
> 
> +log_message(LOG_INFO, "Sending advert with seq no %d",
> vrrp->ipsecah_counter->seq_number);
>  /* Send the packet */
>  return sendmsg(vrrp->fd_out, &msg, (addr) ? 0 : MSG_DONTROUTE);
> }
> root@NODE2:~# cat -n 123.txt
>  1 --- root/123.txt
>  2 +++ /root/keepalived-1.3.5/keepalived/vrrp/vrrp.c
>  3 @@ -1121,6 +1121,7 @@ vrrp_send_pkt(vrrp_t * vrrp, struct
> sockaddr_storage *addr)
>  4 vrrp_build_ancillary_data(&msg, cbuf, src);
>  5 }
>  6
>  7 +log_message(LOG_INFO, "Sending advert with seq no %d",
> vrrp->ipsecah_counter->seq_number);
>  8 /* Send the packet */
>  9 return sendmsg(vrrp->fd_out, &msg, (addr) ? 0 :
> MSG_DONTROUTE);
>  10 }
> 
> Probably I'm doing something wrong please point me at this if so.
> 
> Thanks.

Quentin,

well, here is the output:

25127 May 17 14:53:33 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 993
25128 May 17 14:53:34 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 994
25129 May 17 14:53:35 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 995
25130 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 996
25131 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
IPSEC-AH : sequence number 996 already proceeded. Packet dropped. 
Local(997)
25132 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: bogus VRRP packet 
received on eth0 !!!
25133 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
Dropping received VRRP packet...
25134 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
IPSEC-AH : sequence number 996 already proceeded. Packet dropped. 
Local(998)
25135 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: bogus VRRP packet 
received on eth0 !!!
25136 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
Dropping received VRRP packet...
25137 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
IPSEC-AH : sequence number 996 already proceeded. Packet dropped. 
Local(999)
---some lines omitted---
25386 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
IPSEC-AH : sequence number 996 already proceeded. Packet dropped. 
Local(1082)
25387 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: bogus VRRP packet 
received on eth0 !!!
25388 May 17 14:53:36 NODE2 Keepalived_vrrp[15515]: VRRP_Instance(TEST) 
Dropping received VRRP packet...
25389 May 17 14:53:37 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 1083
25390 May 17 14:53:38 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 1084
25391 May 17 14:53:39 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 1085
25392 May 17 14:53:40 NODE2 Keepalived_vrrp[15515]: Sending advert with 
seq no 1086


Here is the tcpdump:
14:53:31.060704 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3df): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:32.061823 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e0): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:33.062940 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e1): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:34.063809 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e2): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:35.064916 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e3): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.066046 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.066072 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.066076 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.066085 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
---some lines omitted---
14:53:36.068288 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.068292 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:36.068294 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x3e4): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:37.460675 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x43b): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:38.461012 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x43c): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:39.461632 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x43d): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:40.461996 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x43e): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20
14:53:41.462617 IP 10.1.64.21 > 224.0.0.18: 
AH(spi=0x0a014015,seq=0x43f): VRRPv2, Advertisement, vrid 73, prio 200, 
authtype ah, intvl 1s, length 20



-- 
With kind regards,
Aleksey

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot