From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Tue, 10 Feb 2015 12:44:28 +0100 From: Linus =?utf-8?Q?L=C3=BCssing?= Message-ID: <20150210114428.GK2489@odroid> References: <1378253619-23918-1-git-send-email-linus.luessing@web.de> <54D9C4ED.6040601@parallels.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <54D9C4ED.6040601@parallels.com> Subject: Re: [Bridge] bride: IPv6 multicast snooping enhancements List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Vasily Averin Cc: Herbert Xu , netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, "David S. Miller" , Cong Wang Hi Vasily, On Tue, Feb 10, 2015 at 11:44:29AM +0300, Vasily Averin wrote: > This patch prevent forwarding of ICMPv6 in bridges, > so containers/VMs with virtual eth adapters connected in local bridge cannot ping each other via ipv6 (but can do it via ipv4) If a host wants to receive packets, then it needs to signalize that via MLD. If your host does not do that, then it is expected to not receive ICMPv6 echo requests to multicast addresses. An exception is ff02::1, that should always work. > > Could you please clarify, is it expected behavior? > Do we need to enable multicast routing or multicast_snooping on all local ports on such bridges to enable just ICMPv6? Nope, you shouldn't. You'd need multicast listeners. You shouldn't need to play with the bridge settings to fix protocols. > I believe ICMPv6 is an exception and should not be filtered by multicast spoofing. Signaling multicast joins is mandatory by the IPv6 standard. If your protocol/application does not do that, then it seems to me that the application might be broken. By the way, which kernel version(s) are you using? Cheers, Linus From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754721AbbBJLuo (ORCPT ); Tue, 10 Feb 2015 06:50:44 -0500 Received: from mail.passe0815.de ([188.40.49.9]:48715 "EHLO mail.passe0815.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753481AbbBJLum (ORCPT ); Tue, 10 Feb 2015 06:50:42 -0500 X-Greylist: delayed 369 seconds by postgrey-1.27 at vger.kernel.org; Tue, 10 Feb 2015 06:50:41 EST Date: Tue, 10 Feb 2015 12:44:28 +0100 From: Linus =?utf-8?Q?L=C3=BCssing?= To: Vasily Averin Cc: netdev@vger.kernel.org, bridge@lists.linux-foundation.org, Stephen Hemminger , "David S. Miller" , linux-kernel@vger.kernel.org, Herbert Xu , Cong Wang Subject: Re: bride: IPv6 multicast snooping enhancements Message-ID: <20150210114428.GK2489@odroid> References: <1378253619-23918-1-git-send-email-linus.luessing@web.de> <54D9C4ED.6040601@parallels.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <54D9C4ED.6040601@parallels.com> User-Agent: Mutt/1.5.21 (2010-09-15) X-GPG-Mailgate: Not encrypted, public key not found Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Vasily, On Tue, Feb 10, 2015 at 11:44:29AM +0300, Vasily Averin wrote: > This patch prevent forwarding of ICMPv6 in bridges, > so containers/VMs with virtual eth adapters connected in local bridge cannot ping each other via ipv6 (but can do it via ipv4) If a host wants to receive packets, then it needs to signalize that via MLD. If your host does not do that, then it is expected to not receive ICMPv6 echo requests to multicast addresses. An exception is ff02::1, that should always work. > > Could you please clarify, is it expected behavior? > Do we need to enable multicast routing or multicast_snooping on all local ports on such bridges to enable just ICMPv6? Nope, you shouldn't. You'd need multicast listeners. You shouldn't need to play with the bridge settings to fix protocols. > I believe ICMPv6 is an exception and should not be filtered by multicast spoofing. Signaling multicast joins is mandatory by the IPv6 standard. If your protocol/application does not do that, then it seems to me that the application might be broken. By the way, which kernel version(s) are you using? Cheers, Linus From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linus =?utf-8?Q?L=C3=BCssing?= Subject: Re: bride: IPv6 multicast snooping enhancements Date: Tue, 10 Feb 2015 12:44:28 +0100 Message-ID: <20150210114428.GK2489@odroid> References: <1378253619-23918-1-git-send-email-linus.luessing@web.de> <54D9C4ED.6040601@parallels.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Herbert Xu , netdev@vger.kernel.org, bridge@lists.linux-foundation.org, linux-kernel@vger.kernel.org, "David S. Miller" , Cong Wang To: Vasily Averin Return-path: Content-Disposition: inline In-Reply-To: <54D9C4ED.6040601@parallels.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: bridge-bounces@lists.linux-foundation.org Errors-To: bridge-bounces@lists.linux-foundation.org List-Id: netdev.vger.kernel.org Hi Vasily, On Tue, Feb 10, 2015 at 11:44:29AM +0300, Vasily Averin wrote: > This patch prevent forwarding of ICMPv6 in bridges, > so containers/VMs with virtual eth adapters connected in local bridge cannot ping each other via ipv6 (but can do it via ipv4) If a host wants to receive packets, then it needs to signalize that via MLD. If your host does not do that, then it is expected to not receive ICMPv6 echo requests to multicast addresses. An exception is ff02::1, that should always work. > > Could you please clarify, is it expected behavior? > Do we need to enable multicast routing or multicast_snooping on all local ports on such bridges to enable just ICMPv6? Nope, you shouldn't. You'd need multicast listeners. You shouldn't need to play with the bridge settings to fix protocols. > I believe ICMPv6 is an exception and should not be filtered by multicast spoofing. Signaling multicast joins is mandatory by the IPv6 standard. If your protocol/application does not do that, then it seems to me that the application might be broken. By the way, which kernel version(s) are you using? Cheers, Linus