netdev - Re: [PATCH iproute2-next] ip: iplink_bridge: Support fdb_local_vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f41661e4-a7c2-4565-8167-3eb452402133@blackwall.org>
Date: Mon, 15 Sep 2025 17:52:50 +0300
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Petr Machata <petrm@...dia.com>, David Ahern <dsahern@...il.com>,
 netdev@...r.kernel.org
Cc: Ido Schimmel <idosch@...dia.com>, Andy Roulin <aroulin@...dia.com>
Subject: Re: [PATCH iproute2-next] ip: iplink_bridge: Support fdb_local_vlan_0

On 9/15/25 17:21, Petr Machata wrote:
> Add support for the new bridge option BR_BOOLOPT_FDB_LOCAL_VLAN_0.
> 
> Signed-off-by: Petr Machata <petrm@...dia.com>
> ---

Please CC me as well on bridge patches.

>   ip/iplink_bridge.c    | 19 +++++++++++++++++++
>   man/man8/ip-link.8.in | 14 ++++++++++++++
>   2 files changed, 33 insertions(+)
> 
> diff --git a/ip/iplink_bridge.c b/ip/iplink_bridge.c
> index 76e69086..f7f010fd 100644
> --- a/ip/iplink_bridge.c
> +++ b/ip/iplink_bridge.c
> @@ -36,6 +36,7 @@ static void print_explain(FILE *f)
>   		"		  [ group_fwd_mask MASK ]\n"
>   		"		  [ group_address ADDRESS ]\n"
>   		"		  [ no_linklocal_learn NO_LINKLOCAL_LEARN ]\n"
> +		"		  [ fdb_local_vlan_0 FDB_LOCAL_VLAN_0 ]\n"
>   		"		  [ fdb_max_learned FDB_MAX_LEARNED ]\n"
>   		"		  [ vlan_filtering VLAN_FILTERING ]\n"
>   		"		  [ vlan_protocol VLAN_PROTOCOL ]\n"
> @@ -427,6 +428,18 @@ static int bridge_parse_opt(struct link_util *lu, int argc, char **argv,
>   				bm.optval |= mofn_bit;
>   			else
>   				bm.optval &= ~mofn_bit;
> +		} else if (strcmp(*argv, "fdb_local_vlan_0") == 0) {
> +			__u32 bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
> +			__u8 value;
> +
> +			NEXT_ARG();
> +			if (get_u8(&value, *argv, 0))
> +				invarg("invalid fdb_local_vlan_0", *argv);
> +			bm.optmask |= bit;
> +			if (value)
> +				bm.optval |= bit;
> +			else
> +				bm.optval &= ~bit;
>   		} else if (matches(*argv, "help") == 0) {
>   			explain();
>   			return -1;
> @@ -637,6 +650,7 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>   		__u32 mofn_bit = 1 << BR_BOOLOPT_MDB_OFFLOAD_FAIL_NOTIFICATION;
>   		__u32 mcvl_bit = 1 << BR_BOOLOPT_MCAST_VLAN_SNOOPING;
>   		__u32 no_ll_learn_bit = 1 << BR_BOOLOPT_NO_LL_LEARN;
> +		__u32 fdb_vlan_0_bit = 1 << BR_BOOLOPT_FDB_LOCAL_VLAN_0;
>   		__u32 mst_bit = 1 << BR_BOOLOPT_MST_ENABLE;
>   		struct br_boolopt_multi *bm;

nit: the block vars seem arranged in reverse xmas tree, could you please keep it?

>   
> @@ -661,6 +675,11 @@ static void bridge_print_opt(struct link_util *lu, FILE *f, struct rtattr *tb[])
>   				   "mdb_offload_fail_notification",
>   				   "mdb_offload_fail_notification %u ",
>   				   !!(bm->optval & mofn_bit));
> +		if (bm->optval & fdb_vlan_0_bit)
> +			print_uint(PRINT_ANY,
> +				   "fdb_local_vlan_0",
> +				   "fdb_local_vlan_0 %u ",
> +				   !!(bm->optval & fdb_vlan_0_bit));
>   	}
>   
>   	if (tb[IFLA_BR_MCAST_ROUTER])
> diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
> index e3297c57..8bc11257 100644
> --- a/man/man8/ip-link.8.in
> +++ b/man/man8/ip-link.8.in
> @@ -1725,6 +1725,8 @@ the following additional arguments are supported:
>   ] [
>   .BI no_linklocal_learn " NO_LINKLOCAL_LEARN "
>   ] [
> +.BI fdb_local_vlan_0 " FDB_LOCAL_VLAN_0 "
> +] [
>   .BI fdb_max_learned " FDB_MAX_LEARNED "
>   ] [
>   .BI vlan_filtering " VLAN_FILTERING "
> @@ -1852,6 +1854,18 @@ or off
>   When disabled, the bridge will not learn from link-local frames (default:
>   enabled).
>   
> +.BI fdb_local_vlan_0 " FDB_LOCAL_VLAN_0 "
> +When disabled, local FDB entries (i.e. those for member port addresses and
> +address of the bridge itself) are kept at VLAN 0 as well as any member VLANs.
> +When the option is enabled, they are only kept at VLAN 0.
> +
> +When this option is enabled, when making a forwarding decision, the bridge looks
> +at VLAN 0 for a matching entry that is permanent, but not added by user. However
> +in all other ways the entry only exists on VLAN 0. This affects dumping, where
> +the entries are not shown on non-0 VLANs, and FDB get and flush do not find the
> +entry on non-0 VLANs. When the entry is deleted, it affects forwarding on all
> +VLANs.
> +

Please add what is the default.

>   .BI fdb_max_learned " FDB_MAX_LEARNED "
>   - set the maximum number of learned FDB entries. If
>   .RI ( FDB_MAX_LEARNED " == 0) "