netdev - Re: [PATCH net-next 6/8] vxlan: Age out FDB entries based on 'updated' time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ceafd63f-ea77-4f35-9f21-78e6df6c1d23@blackwall.org>
Date: Tue, 4 Feb 2025 18:38:00 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 edumazet@...gle.com, andrew+netdev@...n.ch, horms@...nel.org,
 petrm@...dia.com
Subject: Re: [PATCH net-next 6/8] vxlan: Age out FDB entries based on
 'updated' time

On 2/4/25 16:55, Ido Schimmel wrote:
> Currently, the VXLAN driver ages out FDB entries based on their 'used'
> time which is refreshed by both the Tx and Rx paths. This means that an
> FDB entry will not age out if traffic is only forwarded to the target
> host:
> 
>  # ip link add name vx1 up type vxlan id 10010 local 192.0.2.1 dstport 4789 learning ageing 10
>  # bridge fdb add 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1
>  # bridge fdb get 00:11:22:33:44:55 br vx1 self
>  00:11:22:33:44:55 dev vx1 dst 198.51.100.1 self
>  # mausezahn vx1 -a own -b 00:11:22:33:44:55 -c 0 -p 100 -q &
>  # sleep 20
>  # bridge fdb get 00:11:22:33:44:55 br vx1 self
>  00:11:22:33:44:55 dev vx1 dst 198.51.100.1 self
> 
> This is wrong as an FDB entry will remain present when we no longer have
> an indication that the host is still behind the current remote. It is
> also inconsistent with the bridge driver:
> 
>  # ip link add name br1 up type bridge ageing_time $((10 * 100))
>  # ip link add name swp1 up master br1 type dummy
>  # bridge fdb add 00:11:22:33:44:55 dev swp1 master dynamic
>  # bridge fdb get 00:11:22:33:44:55 br br1
>  00:11:22:33:44:55 dev swp1 master br1
>  # mausezahn br1 -a own -b 00:11:22:33:44:55 -c 0 -p 100 -q &
>  # sleep 20
>  # bridge fdb get 00:11:22:33:44:55 br br1
>  Error: Fdb entry not found.
> 
> Solve this by aging out entries based on their 'updated' time, which is
> not refreshed by the Tx path:
> 
>  # ip link add name vx1 up type vxlan id 10010 local 192.0.2.1 dstport 4789 learning ageing 10
>  # bridge fdb add 00:11:22:33:44:55 dev vx1 self dynamic dst 198.51.100.1
>  # bridge fdb get 00:11:22:33:44:55 br vx1 self
>  00:11:22:33:44:55 dev vx1 dst 198.51.100.1 self
>  # mausezahn vx1 -a own -b 00:11:22:33:44:55 -c 0 -p 100 -q &
>  # sleep 20
>  # bridge fdb get 00:11:22:33:44:55 br vx1 self
>  Error: Fdb entry not found.
> 
> But is refreshed by the Rx path:
> 
>  # ip address add 192.0.2.1/32 dev lo
>  # ip link add name vx1 up type vxlan id 10010 local 192.0.2.1 dstport 4789 localbypass
>  # ip link add name vx2 up type vxlan id 20010 local 192.0.2.1 dstport 4789 learning ageing 10
>  # bridge fdb add 00:11:22:33:44:55 dev vx1 self static dst 127.0.0.1 vni 20010
>  # mausezahn vx1 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 0 -p 100 -q &
>  # sleep 20
>  # bridge fdb get 00:aa:bb:cc:dd:ee br vx2 self
>  00:aa:bb:cc:dd:ee dev vx2 dst 127.0.0.1 self
>  # pkill mausezahn
>  # sleep 20
>  # bridge fdb get 00:aa:bb:cc:dd:ee br vx2 self
>  Error: Fdb entry not found.
> 
> Reviewed-by: Petr Machata <petrm@...dia.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
>  drivers/net/vxlan/vxlan_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Nikolay Aleksandrov <razor@...ckwall.org>