netdev - Re: MACVLANs really best solution? How about a bridge with multiple bridge virtual interfaces?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 09 Mar 2009 14:33:28 -0400
From:	Brian Haley <brian.haley@...com>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
CC:	Patrick McHardy <kaber@...sh.net>,
	Mark Smith 
	<nanog@...5b20a518b8f6864949bd940457dc124746ddc.nosense.org>,
	greearb@...delatech.com, David Miller <davem@...emloft.net>,
	netdev@...r.kernel.org, shemminger@...ux-foundation.org
Subject: Re: MACVLANs really best solution? How about a bridge with multiple
 bridge virtual interfaces?

Eric W. Biederman wrote:
> There are two tricky parts.
> 
> One problem is that macvlans and the primary hardware device share the
> same transmit queue.  So when I have a broadcast packet on the primary
> devices queue I don't know if I have already sent it out to the
> macvlan devices or not.
> 
> The second problem is that when I transmit a multicast packet and I
> have a local listener.  I believe replicating the packet both at the
> ip layer and at the ethernet layer will result in receiving the packet
> locally twice.

If you want a local listener to see the packet you have to set
IP_MULTICAST_LOOP.  A packet from a local source address coming off the "wire"
will be dropped in fib_validate_source(), it would have to come over lo.  I'm
not sure how that relates to how macvlan works, just something I've run into
before (2 nics in same subnet, listener on one, sender on other,
IP_MULTICAST_LOOP=0, no packets).

-Brian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html