Displaying 20 results from an estimated 100 matches similar to: "[Bridge] [PATCH net-next 1/2] bridge: Add a limit on FDB entries"
2023 May 15
3
[Bridge] [PATCH net-next 1/2] bridge: Add a limit on FDB entries
On 15/05/2023 11:50, Johannes Nixdorf wrote:
> A malicious actor behind one bridge port may spam the kernel with packets
> with a random source MAC address, each of which will create an FDB entry,
> each of which is a dynamic allocation in the kernel.
>
> There are roughly 2^48 different MAC addresses, further limited by the
> rhashtable they are stored in to 2^31. Each entry is
2023 Jun 19
4
[Bridge] [PATCH net-next v2 0/3, iproute2-next 0/1] bridge: Add a limit on learned FDB entries
Introduce a limit on the amount of learned FDB entries on a bridge,
configured by netlink with a build time default on bridge creation in
the kernel config.
For backwards compatibility the kernel config default is disabling the
limit (0).
Without any limit a malicious actor may OOM a kernel by spamming packets
with changing MAC addresses on their bridge port, so allow the bridge
creator to limit
2023 Jun 19
2
[Bridge] [PATCH net-next v2 2/3] bridge: Add a limit on learned FDB entries
A malicious actor behind one bridge port may spam the kernel with packets
with a random source MAC address, each of which will create an FDB entry,
each of which is a dynamic allocation in the kernel.
There are roughly 2^48 different MAC addresses, further limited by the
rhashtable they are stored in to 2^31. Each entry is of the type struct
net_bridge_fdb_entry, which is currently 128 bytes big.
2023 Jun 19
1
[Bridge] [PATCH iproute2-next 1/1] iplink: bridge: Add support for bridge FDB learning limits
Support setting the FDB limit through ip link. The arguments is:
- fdb_max_learned_entries: A 32-bit unsigned integer specifying the
maximum number of learned FDB entries, with 0
disabling the limit.
Also support reading back the current number of learned FDB entries in
the bridge by this count. The returned value's name is:
-
2013 Feb 13
14
[Bridge] [PATCH v10 net-next 00/12] VLAN filtering/VLAN aware bridge
Changes since v9:
* series re-ordering so make functionality more distinct. Basic vlan
filtering is patches 1-4. Support for PVID/untagged vlans is patches
5 and 6. VLAN support for FDB/MDB is patches 7-11. Patch 12 is
still additional egress policy.
* Slight simplification to code that extracts the VID from skb. Since we
now depend on the vlan module, at the time of input skb_tci is
2013 Jan 09
16
[Bridge] [PATCH net-next V5 00/14] Add basic VLAN support to bridges
This series of patches provides an ability to add VLANs to the bridge
ports. This is similar to what can be found in most switches. The bridge
port may have any number of VLANs added to it including vlan 0 priority tagged
traffic. When vlans are added to the port, only traffic tagged with particular
vlan will forwarded over this port. Additionally, vlan ids are added to FDB
entries and become
2013 Apr 30
6
[Bridge] [PATCHv4 net-next 0/2] Add two new flags to bridge.
The following series adds 2 new flags to bridge. One flag allows
the user to control whether mac learning is performed on the interface
or not. By default mac learning is on.
The other flag allows the user to control whether unicast traffic
is flooded (send without an fdb) to a given unicast port. Default is
on.
Changes since v4:
- Implemented Stephen's suggestions.
Changes since v2:
-
2023 Jun 19
1
[Bridge] [PATCH net-next v2 1/3] bridge: Set BR_FDB_ADDED_BY_USER early in fdb_add_entry
This allows the called fdb_create to detect that the entry was added by
the user early in the process. This is in preparation to adding limits
in fdb_create that should not apply to user created fdb entries.
Signed-off-by: Johannes Nixdorf <jnixdorf-oss at avm.de>
---
Changes since v1:
- Added this change to ensure user added entries are not limited.
net/bridge/br_fdb.c | 6 +++---
1
2023 Jan 26
2
[Bridge] [PATCH net-next 01/16] net: bridge: Set strict_start_type at two policies
Make any attributes newly-added to br_port_policy or vlan_tunnel_policy
parsed strictly, to prevent userspace from passing garbage. Note that this
patchset only touches the former policy. The latter was adjusted for
completeness' sake. There do not appear to be other _deprecated calls
with non-NULL policies.
Suggested-by: Ido Schimmel <idosch at nvidia.com>
Signed-off-by: Petr Machata
2013 May 22
1
[Bridge] [PATCH] bridge: Set vlan_features to allow offloads on vlans.
When vlan device is configured on top of the brige, it does
not support any offload capabilities because the bridge
device does not initiliaze vlan_fatures. Set vlan_fatures to
be equivalent to hw_fatures.
Signed-off-by: Vlad Yasevich <vyasevic at redhat.com>
---
net/bridge/br_device.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/net/bridge/br_device.c
2009 Jul 27
8
Network Interface Problems for DomU Firewall
I am attempting to setup a firewall in a DomU. The firewall program I
eventually want to run is Shorewall.
Both my Dom0 and DomU are Debian Lenny 64 bit systems. The Dom0 has four
physical network interfaces installed. Currently, one of the NICs is hidden
using the pciback.hide command in the /boot/grub/menu.lst file. Similarly,
the hidden NIC is passed to the DomU using the pci =
2007 Sep 05
2
Server moved - networking stopped
This is all on SuSE enterprise 10
Our server was moved to a new location last night. After powerup there
was no sign of networking so our ISP reconfigured the box. Outbound
connectivity had previously been through eth1 but is now through eth0
Since restarting Xen I now have no network connectivity through the hosts.
I have tried to provide all the relevant details below. If anyone has
a moment
2007 Apr 18
1
[Bridge] [BUG/PATCH/RFC] bridge: locally generated broadcast traffic may block sender
Hello Stephen,
I may have tracked down some unexpected behaviour from a common bridge
setup, and would like to incite expert oppinion on my observations.
The issue relates to both 2.6 and 2.4 kernel series bridging code,
and as far as I can see might have been present in all releases hitherto.
Consider this setup:
- two ethernet devices in a simple bridge configuration
- bridge-interface
2023 Jun 19
1
[Bridge] [PATCH net-next v2 3/3] net: bridge: Add a configurable default FDB learning limit
This adds a Kconfig option to configure a default FDB learning limit
system wide, so a distributor building a special purpose kernel can
limit all created bridges by default.
The limit is only a soft default setting and overridable per bridge
using netlink.
Signed-off-by: Johannes Nixdorf <jnixdorf-oss at avm.de>
---
Changes since v1:
- Added a default limit in Kconfig. (deemed
2007 Apr 18
4
[Bridge] MTU Question
I have a bridge that has gigabit interfaces. The machine in question has the
fun job of being a Bridge, Firewall and SMB server. Both of the Gigabit
interfaces are connected to workstations directly via Xover cable (well
MDI-X to be exact). My question is, if I enable jumbo frames on the gigabit
interfaces will that make any difference in overall transfer rate of the
bridge? I was thinking it
2007 Apr 18
0
[Bridge] [PATCH] (4/4) bridge forwarding table RCU
Convert the bridge forwarding database over to using RCU.
This avoids a read_lock and atomic_inc/dec in the fast path
of output.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
diff -Nru a/include/linux/list.h b/include/linux/list.h
--- a/include/linux/list.h 2004-07-28 15:30:04 -07:00
+++ b/include/linux/list.h 2004-07-28 15:30:04 -07:00
@@ -678,6 +678,24 @@
pos &&
2007 Apr 18
0
[Bridge] [PATCH] (4/11) bridge - ioctl cleanup and consolidation
Merge the ioctl stub calls that just end up calling the sub-function
to do the actual ioctl. Move br_get_XXX_ifindices into the ioctl file
as well where they can be static.
diff -Nru a/net/bridge/br_device.c b/net/bridge/br_device.c
--- a/net/bridge/br_device.c 2004-05-20 10:51:05 -07:00
+++ b/net/bridge/br_device.c 2004-05-20 10:51:05 -07:00
@@ -19,21 +19,6 @@
#include <asm/uaccess.h>
2012 Nov 27
3
[Bridge] [RFC PATCH 1/2] bridge: export port_no and port_id via IFA_INFO_DATA
Based on net-next.
This patch exports port->port_no port->port_id in the end of IFA_INFO_DATA.
Cc: Herbert Xu <herbert at gondor.apana.org.au>
Cc: Stephen Hemminger <shemminger at vyatta.com>
Cc: "David S. Miller" <davem at davemloft.net>
Cc: Thomas Graf <tgraf at suug.ch>
Cc: Jesper Dangaard Brouer <brouer at redhat.com>
Signed-off-by: Cong Wang
2013 Aug 26
0
[PATCH] bridge: separate querier and query timer into IGMP/IPv4 and MLD/IPv6 ones
Currently we would still potentially suffer multicast packet loss if there
is just either an IGMP or an MLD querier: For the former case, we would
possibly drop IPv6 multicast packets, for the latter IPv4 ones. This is
because we are currently assuming that if either an IGMP or MLD querier
is present that the other one is present, too.
This patch makes the behaviour and fix added in
"bridge:
2008 Nov 22
2
windows 2008 server x86 + 3 gb memory
Hello!
I''me run windows 2008 server in Debian etch amd64 8 gb memory.
if given > 2gb memory to w2k8. dom0 is down.
In no logs anything interesting.
configs:
(logfile /var/log/xen/xend.log)
(loglevel DEBUG)
(network-script ''network-virtual bridgeip="172.16.16.1/24"
brnet="172.16.16.0/24"'')
(vif-script ''vif-bridge