netdev - [PATCH net-next 0/2] bridge: Prevent unicast ARP/NS packets from being suppressed by bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <cover.1744123493.git.petrm@nvidia.com>
Date: Tue, 8 Apr 2025 17:40:22 +0200
From: Petr Machata <petrm@...dia.com>
To: "David S. Miller" <davem@...emloft.net>, Eric Dumazet
	<edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
	<pabeni@...hat.com>, Simon Horman <horms@...nel.org>,
	<netdev@...r.kernel.org>
CC: Nikolay Aleksandrov <razor@...ckwall.org>, Ido Schimmel
	<idosch@...dia.com>, <bridge@...ts.linux.dev>, Petr Machata
	<petrm@...dia.com>, <mlxsw@...dia.com>
Subject: [PATCH net-next 0/2] bridge: Prevent unicast ARP/NS packets from being suppressed by bridge

From: Amit Cohen <amcohen@...dia.com>

Currently, unicast ARP requests/NS packets are replied by bridge when
suppression is enabled, then they are also forwarded, which results two
replicas of ARP reply/NA - one from the bridge and second from the target.

The purpose of ARP/ND suppression is to reduce flooding in the broadcast
domain, which is not relevant for unicast packets. In addition, the use
case of unicast ARP/NS is to poll a specific host, so it does not make
sense to have the switch answer on behalf of the host.

Forward ARP requests/NS packets and prevent the bridge from replying to
them.

Patch set overview:
Patch #1 prevents unicast ARP/NS packets from being suppressed by bridge
Patch #2 adds test cases for unicast ARP/NS with suppression enabled

Amit Cohen (2):
  net: bridge: Prevent unicast ARP/NS packets from being suppressed by
    bridge
  selftests: test_bridge_neigh_suppress: Test unicast ARP/NS with
    suppression

 net/bridge/br_arp_nd_proxy.c                  |   7 +
 .../net/test_bridge_neigh_suppress.sh         | 125 ++++++++++++++++++
 2 files changed, 132 insertions(+)

-- 
2.47.0