netdev - Re: [PATCH iproute2-next] ip: Clarify MACVLAN private mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210426210233.7941b7f1@hermes.local>
Date:   Mon, 26 Apr 2021 21:02:33 -0700
From:   Stephen Hemminger <stephen@...workplumber.org>
To:     Jethro Beekman <kernel@...ekman.nl>
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH iproute2-next] ip: Clarify MACVLAN private mode

On Sat, 24 Apr 2021 23:28:52 +0200
Jethro Beekman <kernel@...ekman.nl> wrote:

> Traffic isn't really "disallowed" but rather some broadcast traffic is filtered.
> 
> Signed-off-by: Jethro Beekman <kernel@...ekman.nl>
> ---
>  man/man8/ip-link.8.in | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
> index fd67e611..a4abae5f 100644
> --- a/man/man8/ip-link.8.in
> +++ b/man/man8/ip-link.8.in
> @@ -1366,10 +1366,12 @@ the following additional arguments are supported:
>  .BR /dev/tapX " to be used just like a " tuntap " device."
>  
>  .B mode private
> -- Do not allow communication between
> +- Do not allow broadcast communication between
>  .B macvlan
>  instances on the same physical interface, even if the external switch supports
> -hairpin mode.
> +hairpin mode. Unicast traffic is transmitted over the physical interface as in
> +.B vepa
> +mode, but the lack of ARP responses may hamper communication.

The grammar here is a little awkward. It is using passive voice and the two clauses
in compound sentence don't match. Let me consult the grammar expert (my spouse is
a writer) and reword this in next release.


>  .B mode vepa
>  - Virtual Ethernet Port Aggregator mode. Data from one
> @@ -1394,7 +1396,7 @@ forces the underlying interface into promiscuous mode. Passing the
>  using standard tools.
>  
>  .B mode source
> -- allows one to set a list of allowed mac address, which is used to match
> +- Allows one to set a list of allowed mac address, which is used to match
>  against source mac address from received frames on underlying interface. This
>  allows creating mac based VLAN associations, instead of standard port or tag
>  based. The feature is useful to deploy 802.1x mac based behavior,

The original is also awkward wording here. Lets get rid of passive voice as well.