netdev - Re: [PATCH net-next] Documentation: networking: Clarify switchdev devices behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181213092630.GD1605@lunn.ch>
Date:   Thu, 13 Dec 2018 10:26:30 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, jiri@...lanox.com,
        idosch@...lanox.com, vivien.didelot@...il.com,
        nikolay@...ulusnetworks.com, roopa@...ulusnetworks.com,
        bridge@...ts.linux-foundation.org, cphealy@...il.com
Subject: Re: [PATCH net-next] Documentation: networking: Clarify switchdev
 devices behavior

> +VLAN filtering
> +~~~~~~~~~~~~~~
> +
> +The Linux bridge allows the configuration of a VLAN filtering mode (compile and
> +run time) which must be observed by the underlying switchdev network
> +device/hardware:
> +
> +- with VLAN filtering turned off: frames ingressing the device with a VID that
> +  is not programmed into the bridge/switch's VLAN table must be forwarded.
> +
> +- with VLAN filtering turned on: frames ingressing the device with a VID that is
> +  not programmed into the bridges/switch's VLAN table must be dropped.

Hi Florian

i forget the details, but there are some difference between VLAN
filtering being disabled at compile time, and disabled at runtime. I
think the expected behaviour is the same, but the switchdev API usage
is slightly different.

> +- when IGMP snooping is turned on, multicast traffic must be selectively flowing
> +  to the appropriate network ports and not flood the entire switch, that must
> +  include the CPU/management port.

224.0.0.X/32 should always be flooded, IGMP is optional for those
groups in the local subnet.

	Andrew