gmane.linux.network.bridge

[patch] netfilter: prevent harmless integer overflow

Dan Carpenter — 2013-06-18T07:46:03

This overflow is harmless because a few lines later we check:

if (num_counters != t->private->nentries) {

But it still upsets the static checkers.

Signed-off-by: Dan Carpenter <dan.carpenter< at >oracle.com>

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 3d110c4..141350e 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
< at >< at > -1278,6 +1278,8 < at >< at > static int do_update_counters(struct net *net, const char *name,
 
 if (num_counters == 0)
 return -EINVAL;
+if (num_counters > INT_MAX / sizeof(*tmp))
+return -ENOMEM;
 
 tmp = vmalloc(num_counters * sizeof(*tmp));
 if (!tmp)

Re: [PATCH] bridge: fix switched interval for MLD Querytypes

David Miller — 2013-06-18T00:11:41

From: Linus Lüssing <linus.luessing< at >web.de>
Date: Sun, 16 Jun 2013 23:20:34 +0200


Applied, thanks.

Re: bond-mode 4 bridge-utils 3.x kernel not fully working

Jelle de Jong — 2013-06-17T11:00:11

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 29/05/13 01:10, Jelle de Jong wrote:

Anybody? I?m still unable to use bonding lacp & bridge & vlans with
kvm guest in a 3.x kernel (2.6 is working fine)

Kind regards,

Jelle de Jong
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iJwEAQECAAYFAlG+7DcACgkQ1WclBW9j5HmXUwP9EXmWz7h2K+3LkWk0NbfAdxd6
nTb2nTWGX/659DqRIIIJbxz3haxxdDIUqjS6QBkAyaG8zJLwNSa2Ks4KdL5mrRJw
hSJOqRNhv7u92tNv1uZeN+bZ8huFvvPgMaMd4Mx/vCta1isSOtSzbS9devjg4SFP
0ZX6DhG32uELhpk1AtA=
=NrXT
-----END PGP SIGNATURE-----

[PATCH] bridge: fix switched interval for MLD Query types

Linus Lüssing — 2013-06-16T21:20:34

General Queries (the one with the Multicast Address field
set to zero / '::') are supposed to have a Maximum Response Delay
of [Query Response Interval], while for Multicast-Address-Specific
Queries it is [Last Listener Query Interval] - not the other way
round. (see RFC2710, section 7.3+7.8)

Signed-off-by: Linus Lüssing <linus.luessing< at >web.de>
---
 net/bridge/br_multicast.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 81f2389..d6448e3 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
< at >< at > -465,8 +465,9 < at >< at > static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
 skb_set_transport_header(skb, skb->len);
 mldq = (struct mld_msg *) icmp6_hdr(skb);
 
-interval = ipv6_addr_any(group) ? br->multicast_last_member_interval :
-  br->multicast_query_response_interval;
+interval = ipv6_addr_any(group) ?
+br->multicast_query_response_interval :
+br->multicast_last_member_inter

Re: [PATCHv4 net-next 0/2] Add two new flags to bridge.

David Miller — 2013-06-11T09:05:04

From: Vlad Yasevich <vyasevic< at >redhat.com>
Date: Wed,  5 Jun 2013 10:07:59 -0400


Series applied, thanks.

Re: [PATCHv4 net-next 0/2] Add two new flags to bridge.

Sergei Shtylyov — 2013-06-05T14:14:11

Hello.

On 05-06-2013 18:07, Vlad Yasevich wrote:







     Hm, why your patches are listed twice?

WBR, Sergei

Re: [PATCHv4 net-next 0/2] Add two new flags to bridge.

Vlad Yasevich — 2013-06-05T14:18:46

Copy-paste error using prior version description.  There are only 2 
patches.  Sorry about that.

-vlad

[PATCHv4 net-next 2/2] bridge: Add a flag to controlunicast packet flood.

Vlad Yasevich — 2013-06-05T14:08:01

Add a flag to control flood of unicast traffic.  By default, flood is
on and the bridge will flood unicast traffic if it doesn't know
the destination.  When the flag is turned off, unicast traffic
without an FDB will not be forwarded to the specified port.

Signed-off-by: Vlad Yasevich <vyasevic< at >redhat.com>
Reviewed-by: Michael S. Tsirkin <mst< at >redhat.com>
---
 include/uapi/linux/if_link.h |    1 +
 net/bridge/br_device.c       |    8 ++++----
 net/bridge/br_forward.c      |   14 +++++++++-----
 net/bridge/br_if.c           |    2 +-
 net/bridge/br_input.c        |    9 ++++++---
 net/bridge/br_netlink.c      |    6 +++++-
 net/bridge/br_private.h      |    6 ++++--
 net/bridge/br_sysfs_if.c     |    2 ++
 8 files changed, 32 insertions(+), 16 deletions(-)

diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 8643809..da05a2698 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
< at >< at > -222,6 +222,7 < at >< at > enum {
 IFLA_BRPORT_PROTECT,/* root port protection    */

[PATCHv4 net-next 1/2] bridge: Add flag to control maclearning.

Vlad Yasevich — 2013-06-05T14:08:00

Allow user to control whether mac learning is enabled on the port.
By default, mac learning is enabled.  Disabling mac learning will
cause new dynamic FDB entries to not be created for a particular port.

Signed-off-by: Vlad Yasevich <vyasevic< at >redhat.com>
Signed-off-by: Stephen Hemminger <stephen< at >networkplumber.org>
---
 include/uapi/linux/if_link.h |    1 +
 net/bridge/br_if.c           |    2 +-
 net/bridge/br_input.c        |    6 ++++--
 net/bridge/br_netlink.c      |    6 +++++-
 net/bridge/br_private.h      |    1 +
 net/bridge/br_sysfs_if.c     |    2 ++
 6 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index b05823c..8643809 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
< at >< at > -221,6 +221,7 < at >< at > enum {
 IFLA_BRPORT_GUARD,/* bpdu guard              */
 IFLA_BRPORT_PROTECT,/* root port protection    */
 IFLA_BRPORT_FAST_LEAVE,/* multicast fast leave    */
+IFLA_BRPORT_LEARNING,/* mac learning */

[PATCHv4 net-next 0/2] Add two new flags to bridge.

Vlad Yasevich — 2013-06-05T14:07:59

The following series adds 2 new flags to bridge.  One flag allows
the user to control whether mac learning is performed on the interface
or not.  By default mac learning is on.
The other flag allows the user to control whether unicast traffic
is flooded (send without an fdb) to a given unicast port.  Default is
on.

Changes since v4:
 - Implemented Stephen's suggestions.

Changes since v2:
 - removed unused "unlock" tag.

Changes since v1:
 - Integrated suggestion from MST to not impact RTM_NEWNEIGH and to
   skip lookups when learning is disabled.

Vlad Yasevich (2):
  bridge: Add flag to control mac learning.
  bridge: Add a flag to control unicast packet flood.

Vlad Yasevich (2):
  bridge: Add flag to control mac learning.
  bridge: Add a flag to control unicast packet flood.

 include/uapi/linux/if_link.h |    2 ++
 net/bridge/br_device.c       |    8 ++++----
 net/bridge/br_forward.c      |   14 +++++++++-----
 net/bridge/br_if.c           |    2 +-
 net/bridge/br_input.c        |   15 ++++++++++-----

Re: [PATCH] iproute2: bridge: fix 'bridge link' setlink/getlink parsing

Stephen Hemminger — 2013-06-04T02:57:19

On Wed, 29 May 2013 09:20:53 -0700
John Fastabend <john.fastabend< at >gmail.com> wrote:


Looks good, applied

[PATCH] iproute2: bridge: fix 'bridge link'setlink/getlink parsing

John Fastabend — 2013-05-29T16:20:53

Use IFLA_AF_SPEC nested attributes to lookup bridge mode and when
doing strcmp() check for equality.

These appear to be typos from the original commit,

commit 64108901b737b95247b53dec8c1b8217ca8505b7
Author: Vlad Yasevich <vyasevic< at >redhat.com>
Date:   Fri Mar 15 10:01:28 2013 -0700

    bridge: Add support for setting bridge port attributes

Also set flags to BRIDGE_FLAGS_SELF instead of using OR operation.
This allows setting the bridge mode when not being used with a
master device.

To allow setting both master and self devices simultaneously we
will need to add a {self|master} field similar to fdb commands.
For now the command sets are mutually exclusive as noted in the
original commit.

With this patch 'bridge link set' works now,

# ./bridge/bridge link set dev veth1 cost 3
# ./bridge/bridge link show
10: veth1 state UP : <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master bridge0 state forwarding priority 3 cost 3

CC: Vlad Yasevich <vyasevic< at >redhat.com>
Signed-off-by: John Fastabend <john.r.fastabend< at >

Re: [PATCH] bridge: netfilter: using strlcpy() instead ofstrncpy()

Chen Gang — 2013-05-23T10:57:05

Thank you too.

Re: bond-mode 4 bridge-utils 3.x kernel not fully working

Jelle de Jong — 2013-05-29T07:54:05

Hi Wilco,

On 29/05/13 09:29, Wilco Baan Hofman wrote:

No, it was mtu 9000 (sorry for the confusion)


Yes the Cisco switch is in LACP mode and I use intel nics.
http://paste.debian.net/6686/

I noticed that incoming IPv6 traffic doesn't work anymore, the br0
interface recieved the IPv6 IP and I can ping it on the local-host but
not from an other server, the IPv6 works again to moment I remove the
bonding.

Remember tcpdump does show traffic coming in and out the br0 device but
not the vnet0 device that is used for the kvm guest.

Kind regards,

Jelle de Jong

Re: bond-mode 4 bridge-utils 3.x kernel not fully working

Wilco Baan Hofman — 2013-05-29T07:29:03




Does this one really say mtu 900 instead of 9000? 
Is your eth1 up? 
Did you try non-kvm traffic over the bonding interface?
Is the switch in LACP mode?

Regards,

Wilco Baan Hofman

bond-mode 4 bridge-utils 3.x kernel not fully working

Jelle de Jong — 2013-05-28T23:10:47

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello everybody,

I also sent this email to bonding-devel< at >lists.sourceforge.net

I spent ours debugging and finding out what points to the problem.

I run kvm quests with bridged networking on a bonding lacp set-up,
with the 2.6 kernel this has been working fine for years. But with the
3.x kernel this doesn?t work any more.

Traffic comes out the KVM quests but doesn?t come in. If I disable
bonding everything just works again.

# working with 2.6 not working with 3.x
cat /etc/network/interfaces
auto lo
  iface lo inet loopback

auto bond0
  iface bond0 inet manual
  slaves eth0 eth1
  bond-mode 4
  bond-miimon 100
  pre-up /sbin/ifconfig bond0 mtu 9000

auto br0
  iface br0 inet dhcp
  bridge_fd 0
  bridge_stp on
  bridge_ports bond0

# working with 3.x but no bonding!!
cat /etc/network/interfaces
auto lo
  iface lo inet loopback

auto eth0
  iface eth0 inet manual
  mtu 900

auto br0
  iface br0 inet dhcp
  bridge_fd 0
  bridge_stp on
  bridge_ports eth0

# una

Re: [PATCHv2 net-next] bridge: Set vlan_features to allow offloads on vlans.

David Miller — 2013-05-24T01:51:43

From: Vlad Yasevich <vyasevic< at >redhat.com>
Date: Wed, 22 May 2013 13:49:34 -0400


Applied to net-next, thanks Vlad.

Re: [PATCH] bridge: netfilter: using strlcpy() instead ofstrncpy()

Pablo Neira Ayuso — 2013-05-23T10:56:00

Applied, thanks.

[PATCHv2 net-next] bridge: Set vlan_features to allowoffloads on vlans.

Vlad Yasevich — 2013-05-22T17:49:34

When vlan device is configured on top of the brige, it does
not support any offload capabilities because the bridge
device does not initiliaze vlan_fatures.  Set vlan_fatures to
be equivalent to hw_fatures.

Signed-off-by: Vlad Yasevich <vyasevic< at >redhat.com>
---
 net/bridge/br_device.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 9673128..75f3239 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
< at >< at > -22,6 +22,9 < at >< at >
 #include <asm/uaccess.h>
 #include "br_private.h"
 
+#define COMMON_FEATURES (NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | \
+ NETIF_F_GSO_MASK | NETIF_F_HW_CSUM)
+
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
< at >< at > -346,12 +349,10 < at >< at > void br_dev_setup(struct net_device *dev)
 dev->tx_queue_len = 0;
 dev->priv_flags = IFF_EBRIDGE;
 
-dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |

Re: [PATCH] bridge: Set vlan_features to allow offloads onvlans.

Vlad Yasevich — 2013-05-22T16:39:17

Yep, you are right.  I guess it would confuse things a bit 802.1ad was
configured on top of the bridge.

I'll fix that.
-vlad

Re: [PATCH] bridge: Set vlan_features to allow offloads onvlans.

Ben Hutchings — 2013-05-22T16:12:44

I think you need to mask out NETIF_F_HW_VLAN_CTAG_TX (although maybe the
vlan driver should take care of that itself).

Ben.