netdev - Re: [PATCH] net: bridge: allow IPv6 when multicast flood is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c1d9bb98-9eda-e24f-d3b3-b324b326cad6@cumulusnetworks.com>
Date:   Wed, 1 Mar 2017 13:05:49 +0200
From:   Nikolay Aleksandrov <nikolay@...ulusnetworks.com>
To:     Mike Manning <mmanning@...cade.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Stephen Hemminger <stephen@...workplumber.org>,
        bridge@...ts.linux-foundation.org
Subject: Re: [PATCH] net: bridge: allow IPv6 when multicast flood is disabled

On 01/03/17 11:57, Mike Manning wrote:
> On 28/02/17 09:20, Nikolay Aleksandrov wrote:
>> We are aware of this and have discussed it, but I’m not sure this is the best way to fix it,
>> it will still allow local IPv4 mcast to be flooded on all ports even with that flag removed and
>> that definitely changes user-visible behaviour (even if it is okay) and will not be appropriate
>> for -net.
>>
>> Let me get back to you on this one.
>>
>> Thanks,
>>  Nik
>>
> Thanks for your comments, I have sent a v2 patch accordingly in case you have no better suggestion.
> We need per-port disabling of multicast flooding, but have to apply this patch to allow IPv6
> connectivity so as to make it usable. There is no noteworthy impact on IPv4 as the fix only allows
> packets originated by the device. As this feature is new to the 4.9 kernel, there are no backwards
> compatibility issues with prior kernel versions if this fix is also applied to the 4.9 kernel.
> 

Okay, I agree and have also discussed it with some colleagues so this seems like the right way
to go. I'll review the v2 in a minute.

Thank you,
 Nik