search for: querier

Currently we would still potentially suffer multicast packet loss if there is just either an IGMP or an MLD querier: For the former case, we would possibly drop IPv6 multicast packets, for the latter IPv4 ones. This is because we are currently assuming that if either an IGMP or MLD querier is present that the other one is present, too. This patch makes the behaviour and fix added in "bridge: disable snoopi...

...to do multicast querying for some vid. This then does not work for ports that come up later. It works only for those ports that were already up when I set the global vlan options. Debugging through the kernel I can see that the timers are simply never started. Unless I disable and re-enable the querier for that particular vid. Admittedly, I'm working with 5.15 at the moment. But even on mainline, I do not see any relevant changes that would make this work. I have a simple-ish patch, but I'm wondering whether I'm missing something? Is maybe some action from userspace expected when...

From: Cong Wang <amwang at redhat.com> This is a long-standing bug and reported several times: https://bugzilla.redhat.com/show_bug.cgi?id=880035 http://marc.info/?l=linux-netdev&m=136164389416341&w=2 This bug can be observed in virt environment, when a KVM guest communicates with the host via multicast. After some time (should be 260 sec, I didn't measure), the multicast

...y 4 hash max 512 mc last member count 2 mc init query count 2 mc router 1 mc snooping 1 mc last member timer 0.99 mc membership timer 259.96 mc querier timer 254.96 mc query interval 124.98 mc response interval 9.99 mc init query interval 31.24 flags virbr1-nic (0) port id 0000 state disabled designated root 8000.5254007e2f5b...

...anges I would like to submit to increase the usefulness of the multicast snooping of the bridge code. The first patch is an unaltered one I had submitted before, but since it got no feedback I'm resubmitting it here for net-next. With the recently added patch to disable snooping if there is no querier (b00589af + 248ba8ec05 + 8d50af4fb), it should be a safe choice now (without these, patch 1/2 would have introduced another potential for lost IPv6 multicast packets). Both conceptually and also with some testing and fuzzing, I couldn't spot any more causes for potential packet loss. And since...

I just noticed this with NSD 4.10.0 (and earlier versions - it's not a new regression)) I have nsd set to log refused requests to syslog. After adding a DNAME type into my dns for one sub-zone that is being moved, I noticed that legitimate requests for hosts under that subdomain are working as expected, howerver they are being logged as refused. As a quick replicable test, I just did this

...which, as far as I can tell, > Samba knows nothing about. The unfortunate situation is that Samba (4.19.2) does not implement the 'ADS_UF_PASSWORD_EXPIRED' flag. It does support 'msDS-UserPasswordExpiry', but that returns and LDAP time value so it requires computation by the querier to figure out expiry. Another suggestion from ldapwiki.com: "All expired user accounts: '(&(objectCategory=Person)(objectClass=User)(!accountExpires=0)(!accountExpires=9223372036854775807))'" does not work either. Accounts on Samba always have the value '92233720368547...

...> > Samba knows nothing about. > > The unfortunate situation is that Samba (4.19.2) does not implement > the 'ADS_UF_PASSWORD_EXPIRED' flag. It does support > 'msDS-UserPasswordExpiry', but that returns and LDAP time value so it > requires computation by the querier to figure out expiry. I am on 4.18.8 and that doesn't have 'msDS-UserPasswordExpiry' or 'ms-DS-User-Password-Expired', but if it did, then the time stored would be, as you say, in Windows format. > > Another suggestion from ldapwiki.com: "All expired user accounts:...

...rget does contain an allow-query list. Op 03-07-2024 om 10:52 schreef Willem Toorop via nsd-users: > Hi Jamie, > > I can reproduce, but only if the target zone of the DNAME (or CNAME > which behaves the same) matches a zone with an allow-query option that > doesn't match the querier. > > For example with the following config in nsd.conf: > > zone: > ?? ?name: "." > ??? allow-query: 0::/128 NOKEY > > zone: > ?? ?name: "example" > ?? ?zonefile: "example" > > and an example zone that contains `nsdtest.example. CNAM...

On Fri, 27 Oct 2023 23:48:22 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > Hi Team, > > Is it possible to make a LDAP-query that returns whether an account > is expired or not? > > I am aware that it is possible to do the maths against the > "accountExpires" attribute, but that requires some scripting around > the query. > >

...I seem to have found the cause of the issue but I'm not sure what the proper fix is. The cause seems to be a kernel "regression": https://bugzilla.redhat.com/show_bug.cgi?id=880035#c56 It seems that multicast now requires explicitly setting /sys/class/<bridge>/bridge/multicast_querier to 1. What is puzzling about this is that im wonder why this behavior changeing patch was included in the RHEL/CentOS kernel. This is the first time I ever ran into this kind of problem and previously multicast seemed to work just out of the box. The other issue is that I'm not sure how to ma...

tl;dr ===== This patchset adds a single bit to the skb to indicate that a packet encountered a layer 2 miss in the bridge and extends flower to match on this metadata. This is required for non-DF (Designated Forwarder) filtering in EVPN multi-homing which prevents decapsulated BUM packets from being forwarded multiple times to the same multi-homed host. Background ========== In a typical EVPN

tl;dr ===== This patchset adds a single bit to the skb to indicate that a packet encountered a layer 2 miss in the bridge and extends flower to match on this metadata. This is required for non-DF (Designated Forwarder) filtering in EVPN multi-homing which prevents decapsulated BUM packets from being forwarded multiple times to the same multi-homed host. Background ========== In a typical EVPN

Hi Mike, Thanks for the info. I'd rather run monitoring such as tcpdump from the VM if possible and not the host as a simulation of a network appliance and with the intent eventually of giving others access to the VM and not the host. Here is the xml file for the private network: <!-- WARNING: THIS IS AN AUTO-GENERATED FILE. CHANGES TO IT ARE LIKELY TO BE OVERWRITTEN AND LOST. Changes to

...t; Samba knows nothing about. >> The unfortunate situation is that Samba (4.19.2) does not implement >> the 'ADS_UF_PASSWORD_EXPIRED' flag. It does support >> 'msDS-UserPasswordExpiry', but that returns and LDAP time value so it >> requires computation by the querier to figure out expiry. > I am on 4.18.8 and that doesn't have 'msDS-UserPasswordExpiry' or > 'ms-DS-User-Password-Expired', but if it did, then the time stored > would be, as you say, in Windows format. You mention 2 other attributes: 'msDS-UserPasswordExpiry' an...

What are the outstanding things to do before we think we can start on the 4.2 -rc''s? Does anyone have a timetable in mind? hypervisor: * ??? - Keir, Tim, Jan? tools: * libxl stable API -- we would like 4.2 to define a stable API which downstream''s can start to rely on not changing. Aspects of this are: * event handling (IanJ working