similar to: [Bridge] [PATCH] bridge: Set vlan_features to allow offloads on vlans.

Hello Stephen, I may have tracked down some unexpected behaviour from a common bridge setup, and would like to incite expert oppinion on my observations. The issue relates to both 2.6 and 2.4 kernel series bridging code, and as far as I can see might have been present in all releases hitherto. Consider this setup: - two ethernet devices in a simple bridge configuration - bridge-interface

A malicious actor behind one bridge port may spam the kernel with packets with a random source MAC address, each of which will create an FDB entry, each of which is a dynamic allocation in the kernel. There are roughly 2^48 different MAC addresses, further limited by the rhashtable they are stored in to 2^31. Each entry is of the type struct net_bridge_fdb_entry, which is currently 128 bytes big.

The following series adds 2 new flags to bridge. One flag allows the user to control whether mac learning is performed on the interface or not. By default mac learning is on. The other flag allows the user to control whether unicast traffic is flooded (send without an fdb) to a given unicast port. Default is on. Changes since v4: - Implemented Stephen's suggestions. Changes since v2: -

Currently we would still potentially suffer multicast packet loss if there is just either an IGMP or an MLD querier: For the former case, we would possibly drop IPv6 multicast packets, for the latter IPv4 ones. This is because we are currently assuming that if either an IGMP or MLD querier is present that the other one is present, too. This patch makes the behaviour and fix added in "bridge:

Introduce a limit on the amount of learned FDB entries on a bridge, configured by netlink with a build time default on bridge creation in the kernel config. For backwards compatibility the kernel config default is disabling the limit (0). Without any limit a malicious actor may OOM a kernel by spamming packets with changing MAC addresses on their bridge port, so allow the bridge creator to limit

This adds a Kconfig option to configure a default FDB learning limit system wide, so a distributor building a special purpose kernel can limit all created bridges by default. The limit is only a soft default setting and overridable per bridge using netlink. Signed-off-by: Johannes Nixdorf <jnixdorf-oss at avm.de> --- Changes since v1: - Added a default limit in Kconfig. (deemed

I have a bridge that has gigabit interfaces. The machine in question has the fun job of being a Bridge, Firewall and SMB server. Both of the Gigabit interfaces are connected to workstations directly via Xover cable (well MDI-X to be exact). My question is, if I enable jumbo frames on the gigabit interfaces will that make any difference in overall transfer rate of the bridge? I was thinking it

On 15/05/2023 11:50, Johannes Nixdorf wrote: > A malicious actor behind one bridge port may spam the kernel with packets > with a random source MAC address, each of which will create an FDB entry, > each of which is a dynamic allocation in the kernel. > > There are roughly 2^48 different MAC addresses, further limited by the > rhashtable they are stored in to 2^31. Each entry is

Dave Miller mentioned he'd like to see SET_ETHTOOL_OPS gone. This does that. Compile tested only, but I'd seriously wonder if this broke anything. Suggested-by: Dave Miller <davem at davemloft.net> Signed-off-by: Wilfried Klaebe <w-lkml at lebenslange-mailadresse.de> --- Applies against v3.15-rc4. diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c

Dave Miller mentioned he'd like to see SET_ETHTOOL_OPS gone. This does that. Compile tested only, but I'd seriously wonder if this broke anything. Suggested-by: Dave Miller <davem at davemloft.net> Signed-off-by: Wilfried Klaebe <w-lkml at lebenslange-mailadresse.de> --- Applies against v3.15-rc4. diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ethtool.c

net: get rid of SET_ETHTOOL_OPS Dave Miller mentioned he'd like to see SET_ETHTOOL_OPS gone. This does that. Mostly done via coccinelle script: @@ struct ethtool_ops *ops; struct net_device *dev; @@ - SET_ETHTOOL_OPS(dev, ops); + dev->ethtool_ops = ops; Compile tested only, but I'd seriously wonder if this broke anything. Suggested-by: Dave Miller <davem at

net: get rid of SET_ETHTOOL_OPS Dave Miller mentioned he'd like to see SET_ETHTOOL_OPS gone. This does that. Mostly done via coccinelle script: @@ struct ethtool_ops *ops; struct net_device *dev; @@ - SET_ETHTOOL_OPS(dev, ops); + dev->ethtool_ops = ops; Compile tested only, but I'd seriously wonder if this broke anything. Suggested-by: Dave Miller <davem at

net: get rid of SET_ETHTOOL_OPS Dave Miller mentioned he'd like to see SET_ETHTOOL_OPS gone. This does that. Mostly done via coccinelle script: @@ struct ethtool_ops *ops; struct net_device *dev; @@ - SET_ETHTOOL_OPS(dev, ops); + dev->ethtool_ops = ops; Compile tested only, but I'd seriously wonder if this broke anything. Suggested-by: Dave Miller <davem at

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Danny Kukawka (2): net: replace random_ether_addr() with

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Danny Kukawka (2): net: replace random_ether_addr() with

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Danny Kukawka (2): net: replace random_ether_addr() with

Hi, The attached patches enables the bridge to filter and forward packets according to their IEEE 802.1q headers. The goals behind this change include : - Enable running STP on 802.1q tagged networks. STP packets must be untagged. It isn't obvious how else to enable STP with the current bridge and vlan code. - Add native support for an untagged vlan. Currently an untagged vlan can

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Resend due to send with too long recipients list. Sorry! Thanks to Joe

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Resend due to send with too long recipients list. Sorry! Thanks to Joe

The second part of my patch series to fix the handling of addr_assign_type for random MAC addresses. This contains the trival changes from random_ether_addr() to new eth_hw_addr_random() and code to reset the state to NET_ADDR_PERM as soon as the MAC get changed via .ndo_set_mac_address where eth_mac_addr wasn't used. Resend due to send with too long recipients list. Sorry! Thanks to Joe