netdev - Re: [PATCH net-next v2] bridge: Synchronize unicast filtering with FDB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20160610.223512.206489271156278288.davem@davemloft.net>
Date:	Fri, 10 Jun 2016 22:35:12 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	makita.toshiaki@....ntt.co.jp
Cc:	stephen@...workplumber.org, netdev@...r.kernel.org,
	bridge@...ts.linux-foundation.org, nikolay@...ulusnetworks.com,
	netdev@....de
Subject: Re: [PATCH net-next v2] bridge: Synchronize unicast filtering with
 FDB

From: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>
Date: Mon,  6 Jun 2016 21:20:13 +0900

> Patrick Schaaf reported that flooding due to a missing fdb entry of
> the address of macvlan on the bridge device caused high CPU
> consumption of an openvpn process behind a tap bridge port.
> Adding an fdb entry of the macvlan address can suppress flooding
> and avoid this problem.
> 
> This change makes bridge able to synchronize unicast filtering with
> fdb automatically so admin do not need to manually add an fdb entry.
> This effectively supports IFF_UNICAST_FLT in bridge, thus adding an
> macvlan device would not place bridge into promiscuous mode as well.
> 
> v2:
> - Test vlan with br_vlan_should_use() in br_fdb_sync_uc() as per
>   Nikolay Aleksandrov.
> 
> Reported-by: Patrick Schaaf <netdev@....de>
> Signed-off-by: Toshiaki Makita <makita.toshiaki@....ntt.co.jp>

I really need bridging experts to review and ACK/NACK this.

Thanks.