search for: addattr32

...ison between signed and unsigned libnetlink.c: In function `rtnl_listen'': libnetlink.c:329: warning: comparison between signed and unsigned libnetlink.c: In function `rtnl_from_file'': libnetlink.c:394: warning: comparison between signed and unsigned libnetlink.c: In function `addattr32'': libnetlink.c:421: warning: comparison between signed and unsigned libnetlink.c: In function `addattr_l'': libnetlink.c:436: warning: comparison between signed and unsigned make[3]: *** [libnetlink.o] Error 1 make[3]: Leaving directory `/home/joolia/tcnge/tcng/tcsim/ulib/ipro...

...else bm.optval &= ~no_ll_learn_bit; + } else if (matches(*argv, "fdb_max_learned_entries") == 0) { + __u32 fdb_max_learned_entries; + + NEXT_ARG(); + if (get_u32(&fdb_max_learned_entries, *argv, 0)) + invarg("invalid fdb_max_learned_entries", *argv); + + addattr32(n, 1024, IFLA_BR_FDB_MAX_LEARNED_ENTRIES, fdb_max_learned_entries); } else if (matches(*argv, "fdb_flush") == 0) { addattr(n, 1024, IFLA_BR_FDB_FLUSH); } else if (matches(*argv, "vlan_default_pvid") == 0) { @@ -544,6 +553,18 @@ static void bridge_print_opt(struct link_...

...sources, and here is the point : } else if (strcmp(*argv, "fwmark") == 0) { __u32 fwmark; NEXT_ARG(); if (get_u32(&fwmark, *argv, 16)) invarg("fwmark value is invalid\n", *argv); addattr32(&req.n, sizeof(req), RTA_PROTOINFO, fwmark); get_u32() function just call strtoul(3) among a few sanity checks, and the third parameter (value 16 here) is the base used to convert the string. Here is a part of the manual page of strtoul(3) : << If base is zero or 16, the string may then...

...else bm.optval &= ~no_ll_learn_bit; + } else if (strcmp(*argv, "fdb_max_learned_entries") == 0) { + __u32 fdb_max_learned_entries; + + NEXT_ARG(); + if (get_u32(&fdb_max_learned_entries, *argv, 0)) + invarg("invalid fdb_max_learned_entries", *argv); + + addattr32(n, 1024, IFLA_BR_FDB_MAX_LEARNED_ENTRIES, fdb_max_learned_entries); } else if (matches(*argv, "fdb_flush") == 0) { addattr(n, 1024, IFLA_BR_FDB_FLUSH); } else if (matches(*argv, "vlan_default_pvid") == 0) { @@ -544,6 +553,18 @@ static void bridge_print_opt(struct link_...

...m.optval |= no_ll_learn_bit; else bm.optval &= ~no_ll_learn_bit; + } else if (strcmp(*argv, "fdb_max_learned") == 0) { + __u32 fdb_max_learned; + + NEXT_ARG(); + if (get_u32(&fdb_max_learned, *argv, 0)) + invarg("invalid fdb_max_learned", *argv); + + addattr32(n, 1024, IFLA_BR_FDB_MAX_LEARNED, fdb_max_learned); } else if (matches(*argv, "fdb_flush") == 0) { addattr(n, 1024, IFLA_BR_FDB_FLUSH); } else if (matches(*argv, "vlan_default_pvid") == 0) { @@ -544,6 +553,18 @@ static void bridge_print_opt(struct link_util *lu, FILE *...

This is based on an earlier patch from Eric Biederman adding forwarding between macvlans. I extended his approach to allow the administrator to choose the mode for each macvlan, and to implement a functional VEPA between macvlan. Still missing from this is support for communication between the lower device that the macvlans are based on. This would be extremely useful but as others have found out

This is based on an earlier patch from Eric Biederman adding forwarding between macvlans. I extended his approach to allow the administrator to choose the mode for each macvlan, and to implement a functional VEPA between macvlan. Still missing from this is support for communication between the lower device that the macvlans are based on. This would be extremely useful but as others have found out

This is based on an earlier patch from Eric Biederman adding forwarding between macvlans. I extended his approach to allow the administrator to choose the mode for each macvlan, and to implement a functional VEPA between macvlan. Still missing from this is support for communication between the lower device that the macvlans are based on. This would be extremely useful but as others have found out

Introduce a limit on the amount of learned FDB entries on a bridge, configured by netlink with a build time default on bridge creation in the kernel config. For backwards compatibility the kernel config default is disabling the limit (0). Without any limit a malicious actor may OOM a kernel by spamming packets with changing MAC addresses on their bridge port, so allow the bridge creator to limit