netdev - Re: [PATCH net-next 0/6] Disable host flooding for DSA ports under a bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <809561da-0433-297a-2dd0-9be9b5e3c65a@blackwall.org>
Date:   Fri, 8 Apr 2022 23:52:49 +0300
From:   Nikolay Aleksandrov <razor@...ckwall.org>
To:     Vladimir Oltean <vladimir.oltean@....com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Florian Fainelli <f.fainelli@...il.com>,
        Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        "UNGLinuxDriver@...rochip.com" <UNGLinuxDriver@...rochip.com>,
        Paolo Abeni <pabeni@...hat.com>,
        Roopa Prabhu <roopa@...dia.com>, Jiri Pirko <jiri@...dia.com>,
        Ido Schimmel <idosch@...dia.com>,
        Tobias Waldekranz <tobias@...dekranz.com>,
        Mattias Forsblad <mattias.forsblad@...il.com>
Subject: Re: [PATCH net-next 0/6] Disable host flooding for DSA ports under a
 bridge

On 08/04/2022 23:14, Vladimir Oltean wrote:
> On Fri, Apr 08, 2022 at 11:03:31PM +0300, Vladimir Oltean wrote:
>> For this patch series to make more sense, it should be reviewed from the
>> last patch to the first. Changes were made in the order that they were
>> just to preserve patch-with-patch functionality.
>>
>> A little while ago, some DSA switch drivers gained support for
>> IFF_UNICAST_FLT, a mechanism through which they are notified of the
>> MAC addresses required for local standalone termination.
>> A bit longer ago, DSA also gained support for offloading BR_FDB_LOCAL
>> bridge FDB entries, which are the MAC addresses required for local
>> termination when under a bridge.
>>
>> So we have come one step closer to removing the CPU from the list of
>> destinations for packets with unknown MAC DA. What remains is to check
>> whether any software L2 forwarding is enabled, and that is accomplished
>> by monitoring the neighbor bridge ports that DSA switches have.
>>
>> With these changes, DSA drivers that fulfill the requirements for
>> dsa_switch_supports_uc_filtering() and dsa_switch_supports_mc_filtering()
>> will keep flooding towards the CPU disabled for as long as no port is
>> promiscuous. The bridge won't attempt to make its ports promiscuous
>> anymore either if said ports are offloaded by switchdev (this series
>> changes that behavior). Instead, DSA will fall back by its own will to
>> promiscuous mode on bridge ports when the bridge itself becomes
>> promiscuous, or a foreign interface is detected under the same bridge.
>>
>> Vladimir Oltean (6):
>>   net: refactor all NETDEV_CHANGE notifier calls to a single function
>>   net: emit NETDEV_CHANGE for changes to IFF_PROMISC | IFF_ALLMULTI
>>   net: dsa: walk through all changeupper notifier functions
>>   net: dsa: track whether bridges have foreign interfaces in them
>>   net: dsa: monitor changes to bridge promiscuity
>>   net: bridge: avoid uselessly making offloaded ports promiscuous
>>
>>  include/net/dsa.h  |   4 +-
>>  net/bridge/br_if.c |  63 +++++++++++--------
>>  net/core/dev.c     |  34 +++++-----
>>  net/dsa/dsa_priv.h |   2 +
>>  net/dsa/port.c     |  12 ++++
>>  net/dsa/slave.c    | 150 ++++++++++++++++++++++++++++++++++++++++++---
>>  6 files changed, 215 insertions(+), 50 deletions(-)
>>
>> -- 
>> 2.25.1
>>
> 
> Hmm, Nikolay's address bounced back and I didn't notice the MAINTAINERS
> change. Updated the CC list with his new address.
> 
> Nikolay, if you want to take a look the patches are here, I hope it's
> fine if I don't resend:
> https://patchwork.kernel.org/project/netdevbpf/cover/20220408200337.718067-1-vladimir.oltean@nxp.com/

That's ok, I'll check them out tomorrow. Thanks!