netdev - [net-next-2.6 PATCH 0/3 RFC] macvlan: MAC Address filtering support for passthru mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110906223536.6552.2062.stgit@savbu-pc100.cisco.com>
Date:	Tue, 06 Sep 2011 15:35:40 -0700
From:	Roopa Prabhu <roprabhu@...co.com>
To:	netdev@...r.kernel.org
Cc:	dragos.tatulea@...il.com, arnd@...db.de, mst@...hat.com,
	dwang2@...co.com, benve@...co.com, kaber@...sh.net, sri@...ibm.com
Subject: [net-next-2.6 PATCH 0/3 RFC] macvlan: MAC Address filtering support
	for passthru mode

This patch is an attempt at providing address filtering support for macvtap 
devices in PASSTHRU mode. Its still a work in progress.
Briefly tested for basic functionality. Wanted to get some feedback on the 
direction before proceeding.

I have hopefully CC'ed all concerned people.

PASSTHRU mode today sets the lowerdev in promiscous mode. In PASSTHRU mode
there is a 1-1 mapping between macvtap device and physical nic or VF. And all
filtering is done in lowerdev hw. The lowerdev does not need to be in 
promiscous mode as long as the guest filters are passed down to the lowerdev. 
This patch tries to remove the need for putting the lowerdev in promiscous mode. 
I have also referred to the thread below where TUNSETTXFILTER was mentioned in 
this context: 
 http://patchwork.ozlabs.org/patch/69297/

This patch basically passes the addresses got by TUNSETTXFILTER to macvlan 
lowerdev.

I have looked at previous work and discussions on this for qemu-kvm 
by Michael Tsirkin, Alex Williamson and Dragos Tatulea
http://patchwork.ozlabs.org/patch/78595/
http://patchwork.ozlabs.org/patch/47160/
https://patchwork.kernel.org/patch/474481/

Redhat bugzilla by Michael Tsirkin:
https://bugzilla.redhat.com/show_bug.cgi?id=655013

I used Michael's qemu-kvm patch for testing the changes with KVM 

I would like to cover both MAC and vlan filtering in this work.

Open Questions/Issues:
- There is a need for vlan filtering to complete the patch. It will require 
  a new tap ioctl cmd for vlans. 
  Some ideas on this are: 

  a) TUNSETVLANFILTER: This will entail we send the whole vlan bitmap filter 
	(similar to tun_filter for addresses). Passing the vlan id's to lower
	device will mean going thru the whole list of vlans every time.

  OR

  b) TUNSETVLAN with vlan id and flag to set/unset

  Does option 'b' sound ok ?

- In this implementation we make the macvlan address list same as the address 
  list that came in the filter with TUNSETTXFILTER. This will not cover cases 
  where the macvlan device needs to have other addresses that are not 
  necessarily in the filter. Is this a problem ?

- The patch currently only supports passing of IFF_PROMISC and IFF_MULTICAST 
filter flags to lowerdev

This patch series implements the following 
01/3 - macvlan: Add support for unicast filtering in macvlan 
02/3 - macvlan: Add function to set addr filter on lower device in passthru mode
03/3 - macvtap: Add support for TUNSETTXFILTER

Please comment. Thanks.

Signed-off-by: Roopa Prabhu <roprabhu@...co.com>
Signed-off-by: Christian Benvenuti <benve@...co.com>
Signed-off-by: David Wang <dwang2@...co.com>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html