netdev - RE: macvlan devices and vlan interaction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <02874ECE860811409154E81DA85FBB5882C6143E@ORSMSX115.amr.corp.intel.com>
Date:   Tue, 30 Jan 2018 22:23:00 +0000
From:   "Keller, Jacob E" <jacob.e.keller@...el.com>
To:     "Yuan, Linyu (NSB - CN/Shanghai)" <linyu.yuan@...ia-sbell.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     "Duyck, Alexander H" <alexander.h.duyck@...el.com>
Subject: RE: macvlan devices and vlan interaction

> -----Original Message-----
> From: Yuan, Linyu (NSB - CN/Shanghai) [mailto:linyu.yuan@...ia-sbell.com]
> Sent: Monday, January 29, 2018 5:53 PM
> To: Keller, Jacob E <jacob.e.keller@...el.com>; netdev@...r.kernel.org
> Cc: Duyck, Alexander H <alexander.h.duyck@...el.com>
> Subject: RE: macvlan devices and vlan interaction
> 
> https://www.spinics.net/lists/netdev/msg476083.html
> 
> I also have a macvlan device question, but get no answer.
> 
> But my original thought is in __netif_receive_skb_core() we should check packet
> destination mac address,
> if it match macvlan device, change packet as receive from macvlan device, not
> lower device, then packet go to upper layer.
> 
> But I don't know how to process broadcast mac address. Do macvlan device can
> receive broadcast packet ?
> 

I don't know how macvlans behave in regards to broadcast addresses.

I do think that we should make sure macvlan filtering occurs earlier than VLAN filtering to ensure that we get the correct behavior (see the other emails on this thread).

I can't comment on how that impacts AF_PACKET, because I think AF_PACKET sockets bypass a lot of the stack don't they?

Thanks,
Jake