netdev - Re: [RFC net-next] net: dsa: add support for MC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 5 Jul 2019 12:01:49 -0400
From:   Vivien Didelot <vivien.didelot@...il.com>
To:     Ido Schimmel <idosch@...lanox.com>
Cc:     Florian Fainelli <f.fainelli@...il.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Jiri Pirko <jiri@...nulli.us>,
        "linux@...linux.org.uk" <linux@...linux.org.uk>,
        "andrew@...n.ch" <andrew@...n.ch>,
        "davem@...emloft.net" <davem@...emloft.net>
Subject: Re: [RFC net-next] net: dsa: add support for MC_DISABLED attribute

Hi Ido,

On Sun, 23 Jun 2019 07:09:52 +0000, Ido Schimmel <idosch@...lanox.com> wrote:
> > Russell, Ido, Florian, so far I understand that a multicast-unaware
> > bridge must flood unknown traffic everywhere (CPU included);
> > and a multicast-aware bridge must only flood its ports if their
> > mcast_flood is on, and known traffic targeting the bridge must be
> > offloaded accordingly. Do you guys agree with this?
> 
> When multicast snooping is enabled unregistered multicast traffic should
> only be flooded to mrouter ports.

I've figured out that this is what I need to prevent the flooding of undesired
multicast traffic to the CPU port of the switch. The bridge itself has a
multicast_router attribute which can be disabled, that is when I should drop
unknown multicast traffic.

However with SWITCHDEV_ATTR_ID_BRIDGE_MROUTER implemented, this
attribute is always called with .mrouter=0, regardless the value of
/sys/class/net/br0/bridge/multicast_router. Do I miss something here?

Thanks,

	Vivien