netdev - Re: [PATCH] net: bridge: allow IPv6 when multicast flood is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Mar 2017 09:57:07 +0000
From:   Mike Manning <mmanning@...cade.com>
To:     Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
CC:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        "Stephen Hemminger" <stephen@...workplumber.org>,
        <bridge@...ts.linux-foundation.org>
Subject: Re: [PATCH] net: bridge: allow IPv6 when multicast flood is disabled

On 28/02/17 09:20, Nikolay Aleksandrov wrote:
> We are aware of this and have discussed it, but I’m not sure this is the best way to fix it,
> it will still allow local IPv4 mcast to be flooded on all ports even with that flag removed and
> that definitely changes user-visible behaviour (even if it is okay) and will not be appropriate
> for -net.
> 
> Let me get back to you on this one.
> 
> Thanks,
>  Nik
> 
Thanks for your comments, I have sent a v2 patch accordingly in case you have no better suggestion.
We need per-port disabling of multicast flooding, but have to apply this patch to allow IPv6
connectivity so as to make it usable. There is no noteworthy impact on IPv4 as the fix only allows
packets originated by the device. As this feature is new to the 4.9 kernel, there are no backwards
compatibility issues with prior kernel versions if this fix is also applied to the 4.9 kernel.