netdev - Re: VLAN aware bridge multicast and quierer problems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 13 Mar 2024 18:58:44 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Andrew Lunn <andrew@...n.ch>
Cc: Ido Schimmel <idosch@...dia.com>, netdev <netdev@...r.kernel.org>
Subject: Re: VLAN aware bridge multicast and quierer problems

On 3/13/24 18:56, Andrew Lunn wrote:
>> Hi Andrew,
>> Please check again, br_multicast_rcv() which is called before
>> br_multicast_querier_exists() should set brmctx and pmctx to
>> the proper vlan contexts. If vlan igmp snooping is enabled then
>> the call to br_multicast_querier_exists() is done with the vlan's
>> contexts. I'd guess per-vlan igmp snooping is not enabled (it is not
>> enabled by default).
> 
> So i have the test running, and i see:
> 
> # bridge vlan global show
> port              vlan-id
> brtest0           1
>                      mcast_snooping 1 mcast_querier 0 mcast_igmp_version 2 mcast_
> mld_version 1 mcast_last_member_count 2 mcast_last_member_interval 100 mcast_sta
> rtup_query_count 2 mcast_startup_query_interval 3125 mcast_membership_interval 2
> 6000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_respons
> e_interval 1000
>                    100
>                      mcast_snooping 1 mcast_querier 0 mcast_igmp_version 2 mcast_
> mld_version 1 mcast_last_member_count 2 mcast_last_member_interval 100 mcast_sta
> rtup_query_count 2 mcast_startup_query_interval 3125 mcast_membership_interval 2
> 6000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_respons
> e_interval 1000
>                    200
>                      mcast_snooping 1 mcast_querier 0 mcast_igmp_version 2 mcast_
> mld_version 1 mcast_last_member_count 2 mcast_last_member_interval 100 mcast_sta
> rtup_query_count 2 mcast_startup_query_interval 3125 mcast_membership_interval 2
> 6000 mcast_querier_interval 25500 mcast_query_interval 12500 mcast_query_respons
> e_interval 1000
> 
> 
> The fact that 'mcast_snooping 1' indicates to me snooping is enabled
> by default? The test case does not change any snooping configuration.
> 
> I will send you off list the test script.
> 
>    Andrew

Oh there's a misunderstanding - this is the per-vlan control of
snooping. You have to enable the global per-vlan snooping for
these to take effect (mcast_vlan_snooping).
e.g.:
$ ip l set dev br0 type bridge vlan_filtering 1 mcast_vlan_snooping 1

You should verify in ip -d link sh dev <bridge> that mcast_vlan_snooping
is 1 (enabled), it is 0 (disabled) by default.