netdev - Re: [PATCH net] net: bridge: Do not offload IGMP/MLD messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9c43747a-f73d-476d-a1dc-1646fcfb771f@gmail.com>
Date: Wed, 2 Jul 2025 10:58:33 -0400
From: Joseph Huang <joseph.huang.2024@...il.com>
To: Tobias Waldekranz <tobias@...dekranz.com>,
 Joseph Huang <Joseph.Huang@...min.com>, netdev@...r.kernel.org
Cc: Nikolay Aleksandrov <razor@...ckwall.org>,
 Ido Schimmel <idosch@...dia.com>, "David S. Miller" <davem@...emloft.net>,
 Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>,
 Florian Fainelli <f.fainelli@...il.com>,
 Vladimir Oltean <vladimir.oltean@....com>, bridge@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: bridge: Do not offload IGMP/MLD messages

On 7/2/2025 4:41 AM, Tobias Waldekranz wrote:
> On tis, jul 01, 2025 at 15:36, Joseph Huang <Joseph.Huang@...min.com> wrote:
>> Do not offload IGMP/MLD messages as it could lead to IGMP/MLD Reports
>> being unintentionally flooded to Hosts. Instead, let the bridge decide
>> where to send these IGMP/MLD messages.
> 
> Hi Joseph,
> 
> Do I understand the situation correctly that this is the case where the
> local host is sending out reports in response to a remote querier?
> 
>          mcast-listener-process (IP_ADD_MEMBERSHIP)
>             \
>             br0
>            /   \
>         swp1   swp2
>           |     |
>     QUERIER     SOME-OTHER-HOST
> 
> So in the above setup, br0 will want to br_forward() reports for
> mcast-listener-process's group(s) via swp1 to QUERIER; but since the
> source hwdom is 0, the report is eligible for tx offloading, and is
> flooded by hardware to both swp1 and swp2, reaching SOME-OTHER-HOST as
> well?

That's exactly what's happening with my setup.

Also, IIRC, the querier port (a.k.a. mrouter port) is not offloaded to 
the switch (at least not for DSA switches). So depending on the 
multicast_flood setting on the (querier) port, the Reports may not even 
reach the querier if they are tx offloaded.

Thanks,
Joseph