netdev - Re: [RFC PATCH net-next 0/3] Allow bridge to function in non-promisc mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 07 Mar 2013 10:35:37 -0500
From:	Vlad Yasevich <vyasevic@...hat.com>
To:	Stephen Hemminger <stephen@...workplumber.org>
CC:	netdev@...r.kernel.org, bridge@...ts.linux-foundation.org
Subject: Re: [RFC PATCH net-next 0/3] Allow bridge to function in non-promisc
 mode

On 03/07/2013 02:19 AM, Stephen Hemminger wrote:
> I understand the desire to add more functionality, but in this case it
> would introduce lots more problems. STP would break and it doesn't seem to
> gain anything that can't be done by other means.
>
> Turning bridge into macvlan seems unnecessary. Combining apples and bananas
> doesn't always make a tasty smoothy, sometimes it is just a mess.
>
> Maybe adding a little more to macvlan to do what you want would be simpler.
>

It's not really a macvlan over the bridge.  I would agree that 
particular setup would be a bit odd.  This work enables VMs to manage
their mac addresses and to reduce the load on the host by keeping the
bridge in promisc mode.

Sadly, most kvm network configs still use bridging and have not 
transitioned to OVS.  macvlan has some limitations as well and I working
to address those, but there is a desire for non-promisc bridge.  In
this case VMs can manage their mac addresses and can write that data to
the bridge.

STP is not broken as STP uses multicast mac and we set IFF_ALLMULTI thus
continuing to receive and process STP BPDUs.

The one thing that would appear to suffer from this is VLAN reception, 
but the bridge does allow vlan config now and that would have to be 
configured if VMs wish to use vlans.

I am not changing default operation of the bridge.  Default is still 
promisc.  In fact, one can switch back and forth without any network 
outages.  This simply adds another mode the the bridge operation.

-vlad
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html