From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6E647ECAAD4 for ; Mon, 29 Aug 2022 11:35:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:Message-ID:References:In-Reply-To:Subject:Cc:To:From :Date:MIME-Version:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=PF0cgRmFhWUAH3doAqqq7lOsJy1DDIxMIBZZx2gqotE=; b=yUByVRRDMOn0UcwBTK+jEyBsfQ E2e2nheNKdXREUALWrh1DQaMFAkqyqENnSy6paXZAKuBrrIDNheyMV1Mw4JtR5AyfzsmXKSZpXkzd yYNoNgRkXAj0cv/60/9pQp7GEomCHuY4Ei7F3yAkJ5SaX37Y1LtGu7EI4kE1W7ic1ideH2VVhFQFi mc1OGIY4ZliQ5XuwSHSuev4Si9iKr5gpXbfxT4Iz939eduDJI87tEB8Sn1Nf6kLXCRpybvCjawFd2 BOB7e1zpATIo22VDMQ6QAOqY/5QJJh20xiGK609J478/yB3K8jTrs5XZC51hHF3SgVE6pQAbBOkQ6 uV5PBc2g==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oSd2N-008BhT-08; Mon, 29 Aug 2022 11:34:39 +0000 Received: from mailout-taastrup.gigahost.dk ([46.183.139.199]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oSd2C-008BUr-DK; Mon, 29 Aug 2022 11:34:29 +0000 Received: from mailout.gigahost.dk (mailout.gigahost.dk [89.186.169.112]) by mailout-taastrup.gigahost.dk (Postfix) with ESMTP id A21921884505; Mon, 29 Aug 2022 11:34:21 +0000 (UTC) Received: from smtp.gigahost.dk (smtp.gigahost.dk [89.186.169.109]) by mailout.gigahost.dk (Postfix) with ESMTP id 9954B25032B7; Mon, 29 Aug 2022 11:34:21 +0000 (UTC) Received: by smtp.gigahost.dk (Postfix, from userid 1000) id 8D1D49EC0003; Mon, 29 Aug 2022 11:34:21 +0000 (UTC) X-Screener-Id: 413d8c6ce5bf6eab4824d0abaab02863e8e3f662 MIME-Version: 1.0 Date: Mon, 29 Aug 2022 13:34:21 +0200 From: netdev@kapio-technology.com To: Ido Schimmel Cc: davem@davemloft.net, kuba@kernel.org, netdev@vger.kernel.org, Florian Fainelli , Andrew Lunn , Vivien Didelot , Vladimir Oltean , Eric Dumazet , Paolo Abeni , Kurt Kanzenbach , Hauke Mehrtens , Woojung Huh , UNGLinuxDriver@microchip.com, Sean Wang , Landen Chao , DENG Qingfang , Matthias Brugger , Claudiu Manoil , Alexandre Belloni , Jiri Pirko , Ivan Vecera , Roopa Prabhu , Nikolay Aleksandrov , Shuah Khan , Christian Marangi , Daniel Borkmann , Yuwei Wang , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, bridge@lists.linux-foundation.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v5 net-next 1/6] net: bridge: add locked entry fdb flag to extend locked port feature In-Reply-To: References: <20220826114538.705433-1-netdev@kapio-technology.com> <20220826114538.705433-2-netdev@kapio-technology.com> User-Agent: Gigahost Webmail Message-ID: X-Sender: netdev@kapio-technology.com X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220829_043428_780219_4CE2B4EE X-CRM114-Status: GOOD ( 17.23 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 2022-08-27 17:19, Ido Schimmel wrote: > > How about the below (untested): > > diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c > index 68b3e850bcb9..9143a94a1c57 100644 > --- a/net/bridge/br_input.c > +++ b/net/bridge/br_input.c > @@ -109,9 +109,18 @@ int br_handle_frame_finish(struct net *net, > struct sock *sk, struct sk_buff *skb > struct net_bridge_fdb_entry *fdb_src = > br_fdb_find_rcu(br, eth_hdr(skb)->h_source, > vid); > > - if (!fdb_src || READ_ONCE(fdb_src->dst) != p || > - test_bit(BR_FDB_LOCAL, &fdb_src->flags)) > + if (!fdb_src) { > + if (p->flags & BR_PORT_MAB) { > + __set_bit(BR_FDB_ENTRY_LOCKED, &flags); > + br_fdb_update(br, p, > eth_hdr(skb)->h_source, > + vid, flags); > + } > + goto drop; > + } else if (READ_ONCE(fdb_src->dst) != p || > + test_bit(BR_FDB_LOCAL, &fdb_src->flags) || > + test_bit(BR_FDB_LOCKED, &fdb_src->flags)) { > goto drop; > + } > } > > The semantics are very clear, IMO. On FDB miss, add a locked FDB entry > and drop the packet. On FDB mismatch, drop the packet. > > Entry can roam from an unauthorized port to an authorized port, but not > the other way around. Not sure what is the use case for allowing > roaming > between unauthorized ports. > > Note that with the above, locked entries are not refreshed and will > therefore age out unless replaced by user space. > Okay, I got the semantics (locked/unlocked vs unauthorized/authorized) reversed, so I will go with your suggestion. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel