netdev - Re: [Bridge] [RFC net-next Patch 0/3] net: bridge: mrp: Add support for Media Redundancy Protocol(MRP)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <da02006c-dc9d-ce1a-861e-4fc1c1dc2830@fiberby.net>
Date:   Thu, 9 Jan 2020 17:41:33 +0000
From:   Asbjørn Sloth Tønnesen <ast@...erby.net>
To:     Stephen Hemminger <stephen@...workplumber.org>,
        Horatiu Vultur <horatiu.vultur@...rochip.com>
Cc:     andrew@...n.ch, jakub.kicinski@...ronome.com,
        nikolay@...ulusnetworks.com, netdev@...r.kernel.org,
        roopa@...ulusnetworks.com, bridge@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org, vivien.didelot@...il.com,
        UNGLinuxDriver@...rochip.com, anirudh.venkataramanan@...el.com,
        jiri@...lanox.com, jeffrey.t.kirsher@...el.com, dsahern@...il.com,
        olteanv@...il.com, davem@...emloft.net,
        Jesper Dangaard Brouer <brouer@...hat.com>
Subject: Re: [Bridge] [RFC net-next Patch 0/3] net: bridge: mrp: Add support
 for Media Redundancy Protocol(MRP)

Hi Horatiu and Stephen,

Horatiu, thanks for giving this a try. I am looking forward to maybe someday
be able to run ERPS on white box switches.

On 1/9/20 4:19 PM, Stephen Hemminger wrote:
> Can this be implemented in userspace?
> 
> Putting STP in the kernel was a mistake (even original author says so).
> Adding more control protocols in kernel is a security and stability risk.

Another case is VRRP, ERPS (ITU-T G.8032), VRRP group.

My use-case might not be common, but I have machines with about 10k net_dev (QinQ),
I would like to be able to do VRRP group on the outer VLANs, which are only a few
hundred instances without excessive context switching. I would then keep the the
normal keep-alive state machine in kernel, basically a BPF-based timed periodic
packet emitter facility and a XDP recieve hook. So only setup and event handling
has to context switched to user-space.

Unfortunately I haven't had time to explore this yet, but I think such an approach
could solve a few of the reasons that scalable bridge/ring/ha protocols have to wait
20 years before being implemented in Linux.

-- 
Best regards
Asbjørn Sloth Tønnesen
Network Engineer
Fiberby ApS - AS42541