netdev - Re: MDB offloading of local ipv4 multicast groups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 16 Sep 2016 08:22:51 +0200
From:   John Crispin <john@...ozen.org>
To:     Ido Schimmel <idosch@...sch.org>
Cc:     Elad Raz <eladr@...lanox.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Ido Schimmel <idosch@...lanox.com>,
        Jiri Pirko <jiri@...lanox.com>,
        Nikolay Aleksandrov <nikolay@...ulusnetworks.com>,
        "David S. Miller" <davem@...emloft.net>
Subject: Re: MDB offloading of local ipv4 multicast groups



On 15/09/2016 22:42, Ido Schimmel wrote:
> On Thu, Sep 15, 2016 at 08:58:50PM +0200, John Crispin wrote:
>> Hi,
>>
>> While adding MDB support to the qca8k dsa driver I found that ipv4 mcast
>> groups don't always get propagated to the dsa driver. In my setup there
>> are 2 clients connected to the switch, both running a mdns client. The
>> .port_mdb_add() callback is properly called for 33:33:00:00:00:FB but
>> 01:00:5E:00:00:FB never got propagated to the dsa driver.
>>
>> The reason is that the call to ipv4_is_local_multicast() here [1] will
>> return true and the notifier is never called. Is this intentional or is
>> there something missing in the code ?
> 
> I believe this is based on RFC 4541:
> 
> "Packets with a destination IP (DIP) address in the 224.0.0.X range
> which are not IGMP must be forwarded on all ports."
> https://tools.ietf.org/html/rfc4541
> 
> But, we are missing the offloading of router ports, which is needed for
> the device to correctly flood unregistered multicast packets. That's
> also according to the mentioned RFC:
> 
> "If a switch receives an unregistered packet, it must forward that
> packet on all ports to which an IGMP router is attached."
> 
> Implemented at br_flood_multicast()
> 
> However, the marking is done per-port and not per-{port, VID}. We need
> that in case vlan filtering is enabled. I think Nik is working on that,
> but he can correct me if I'm wrong :). The switchdev bits can be added
> soon after.
> 

thanks for the explanation. i was not aware the the local groups should
always be flooded to all ports.

	John