Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp3022391iob; Mon, 16 May 2022 11:14:31 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwDBo0aZCa8jX6z3q0HNNXZ4WTA2hyLyTvySC1RoX4sr7XWpIO9oHUeq99CqFkGGzkZd3Vt X-Received: by 2002:aa7:d497:0:b0:42a:b6bf:67c2 with SMTP id b23-20020aa7d497000000b0042ab6bf67c2mr4694595edr.19.1652724871033; Mon, 16 May 2022 11:14:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1652724871; cv=none; d=google.com; s=arc-20160816; b=gWq7D1Nku1/cIj2TimbwCJf0yybAqfyKqC/FIzAFVZIrL2VQI47ikfrRmC0B47vxdH a1yb10BCUkik8rfQZBp6wvW7ei+JySSINW1B4jZdXiKVfiYHera/+qLXQwM13w514nYs Ahoo+8/nw9p1d43lJYO1L0mu9uGvlNf4uxH5hqpHGwXQtvfqryHVQobS1csDdExJezjm +/G8qIUE54OqbQqv9zQmOe8gYRdhzfFiA/lyVFEOnLZPo2BtPl0M5PRXGIuoKjYuVejj pvi2UJ2BTm7K7XgGFQxxJmsq0Xu+Pp2ixcPebyvFixMEejM65waSE4FmBBqNYxY8TZAW rt/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:in-reply-to:from :references:cc:to:content-language:subject:user-agent:mime-version :date:message-id:dkim-signature; bh=C02Jr/UCyAq1WaiVEroFuXNF23GLqP5faeBDBUBpdVo=; b=u8aADbNU0EXYy1L89AxplScJAzAdzScJtyXlR7x16EpcJLCH3I1vqitBe5d2pdKkmS bFfyqTYx80FBkis0jDrj3jQB/Fkz/JK1AqFY1QV/kym60qB1VD3Tf9QaZMMXSVP515R8 pxpVNcOgzUzp4956uIPeG0EI4Z7YyLpD9QUQvKX75oiWLp/lcNG8d0fJDMBGOyoawabZ Op9IU/SSOdHh8hRLt6tMyb0vHYQxTTkh14L+xja/EMGAEun9ndfO+4xt9924mwAqAg0X sZ4tKfPpGc4irOm0ufRuDqRKeTqUop0hYisceY3cev9QTfAKNNat2ZfICIsijeiyK75o /xxg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=IKVVFppd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id dm6-20020a170907948600b006df76385c76si32129ejc.278.2022.05.16.11.14.03; Mon, 16 May 2022 11:14:30 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=IKVVFppd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229993AbiEPOGn (ORCPT + 99 others); Mon, 16 May 2022 10:06:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244439AbiEPOGW (ORCPT ); Mon, 16 May 2022 10:06:22 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id DB05F3A71F for ; Mon, 16 May 2022 07:06:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1652709980; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=C02Jr/UCyAq1WaiVEroFuXNF23GLqP5faeBDBUBpdVo=; b=IKVVFppdi5fnlBvEfjSrWK3z3DTe82XcVsaE2lfo1UcQDEr5xfxTFa03JsZnp4JPtaoZCq 6oUZpMLJ/AAZBctBg2fWFsK4uxU7/4Xq9Bym8zU2Fuz1aCXBje1kJQcI+5z58PZCf9pqMy 5p7vW8t0YrGmFKRwdnTTCezWemOTlvg= Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-417-xtgPWEM7P7mqJHpB7JN5zw-1; Mon, 16 May 2022 10:06:18 -0400 X-MC-Unique: xtgPWEM7P7mqJHpB7JN5zw-1 Received: by mail-qt1-f200.google.com with SMTP id q13-20020a05622a04cd00b002f3c0e197afso11573956qtx.0 for ; Mon, 16 May 2022 07:06:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=C02Jr/UCyAq1WaiVEroFuXNF23GLqP5faeBDBUBpdVo=; b=oLkEdHtBR3r9D+5dtaL4AGMP9p3OFvsCZBm4g+525gS+yKtp2JDyyC2RAI4MfcnusM RwleKd3TEkYyLwrrR/omkigMVBWwL8Whkg46ijy3wC4skH6GhYHV9VmpNYDoBjoM7UwZ o1e+BfJY1wVMKu1cWAsetr09tXU7/SDtVCoU7+QUpOEgTTCNmqj/OB1LbmWy32777ygZ /uUs3kHFzOWokMKAIgSBP+W0diArrG9dhiSM4jUfLb4YsoBC8NeVDdNutHhXw0On5QyA oaCVVx3baWDD1MUE22Pz2ogJGlY8QF73g3UOlUGLJU+0Q8IvesX260DNZk29dz0EREZZ v8OQ== X-Gm-Message-State: AOAM530YHZ9881NUtKWUlutJ1RARc8lx0qg755dmmGyCQ9pTvyeCmVrS SA5aF3krGfIysxmX2OdE/qwQZNerEUwvm7x3a2PyhWTj3LuwvLYnrX+7OsSSIZRNKEqsyRlBqch c7J9rQYADqUlUh/SogvM7fXu4 X-Received: by 2002:ad4:5dc5:0:b0:45a:82c0:bc4a with SMTP id m5-20020ad45dc5000000b0045a82c0bc4amr15306802qvh.82.1652709977051; Mon, 16 May 2022 07:06:17 -0700 (PDT) X-Received: by 2002:ad4:5dc5:0:b0:45a:82c0:bc4a with SMTP id m5-20020ad45dc5000000b0045a82c0bc4amr15306748qvh.82.1652709976709; Mon, 16 May 2022 07:06:16 -0700 (PDT) Received: from [192.168.98.18] ([107.12.98.143]) by smtp.gmail.com with ESMTPSA id p18-20020ac87412000000b002f3d23cf87esm5991936qtq.27.2022.05.16.07.06.14 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 16 May 2022 07:06:15 -0700 (PDT) Message-ID: <6431569f-fb09-096e-7a89-284a71aa5c0f@redhat.com> Date: Mon, 16 May 2022 10:06:14 -0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.8.0 Subject: Re: [PATCH net-next v3] bond: add mac filter option for balance-xor Content-Language: en-US To: Nikolay Aleksandrov , netdev@vger.kernel.org Cc: toke@redhat.com, Long Xin , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jonathan Corbet , Jay Vosburgh , Veaceslav Falico , Andy Gospodarek , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org References: <4c9db6ac-aa24-2ca2-3e44-18cfb23ac1bc@blackwall.org> From: Jonathan Toppins In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-3.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A, RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 5/15/22 02:32, Nikolay Aleksandrov wrote: > On 15/05/2022 00:41, Nikolay Aleksandrov wrote: >> On 13/05/2022 20:43, Jonathan Toppins wrote: >>> Implement a MAC filter that prevents duplicate frame delivery when >>> handling BUM traffic. This attempts to partially replicate OvS SLB >>> Bonding[1] like functionality without requiring significant change >>> in the Linux bridging code. >>> >>> A typical network setup for this feature would be: >>> >>> .--------------------------------------------. >>> | .--------------------. | >>> | | | | >>> .-------------------. | | >>> | | Bond 0 | | | | >>> | .--'---. .---'--. | | | >>> .----|-| eth0 |-| eth1 |-|----. .-----+----. .----+------. >>> | | '------' '------' | | | Switch 1 | | Switch 2 | >>> | '---,---------------' | | +---+ | >>> | / | '----+-----' '----+------' >>> | .---'---. .------. | | | >>> | | br0 |----| VM 1 | | ~~~~~~~~~~~~~~~~~~~~~ >>> | '-------' '------' | ( ) >>> | | .------. | ( Rest of Network ) >>> | '--------| VM # | | (_____________________) >>> | '------' | >>> | Host 1 | >>> '-----------------------------' >>> >>> Where 'VM1' and 'VM#' are hosts connected to a Linux bridge, br0, with >>> bond0 and its associated links, eth0 & eth1, provide ingress/egress. One >>> can assume bond0, br1, and hosts VM1 to VM# are all contained in a >>> single box, as depicted. Interfaces eth0 and eth1 provide redundant >>> connections to the data center with the requirement to use all bandwidth >>> when the system is functioning normally. Switch 1 and Switch 2 are >>> physical switches that do not implement any advanced L2 management >>> features such as MLAG, Cisco's VPC, or LACP. >>> >>> Combining this feature with vlan+srcmac hash policy allows a user to >>> create an access network without the need to use expensive switches that >>> support features like Cisco's VCP. >>> >>> [1] https://docs.openvswitch.org/en/latest/topics/bonding/#slb-bonding >>> >>> Co-developed-by: Long Xin >>> Signed-off-by: Long Xin >>> Signed-off-by: Jonathan Toppins >>> --- >>> >>> Notes: >>> v2: >>> * dropped needless abstraction functions and put code in module init >>> * renamed variable "rc" to "ret" to stay consistent with most of the >>> code >>> * fixed parameter setting management, when arp-monitor is turned on >>> this feature will be turned off similar to how miimon and arp-monitor >>> interact >>> * renamed bond_xor_recv to bond_mac_filter_recv for a little more >>> clarity >>> * it appears the implied default return code for any bonding recv probe >>> must be `RX_HANDLER_ANOTHER`. Changed the default return code of >>> bond_mac_filter_recv to use this return value to not break skb >>> processing when the skb dev is switched to the bond dev: >>> `skb->dev = bond->dev` >>> >>> v3: Nik's comments >>> * clarified documentation >>> * fixed inline and basic reverse Christmas tree formatting >>> * zero'ed entry in mac_create >>> * removed read_lock taking in bond_mac_filter_recv >>> * made has_expired() atomic and removed critical sections >>> surrounding calls to has_expired(), this also removed the >>> use-after-free that would have occurred: >>> spin_lock_irqsave(&entry->lock, flags); >>> if (has_expired(bond, entry)) >>> mac_delete(bond, entry); >>> spin_unlock_irqrestore(&entry->lock, flags); <--- >>> * moved init/destroy of mac_filter_tbl to bond_open/bond_close >>> this removed the complex option dependencies, the only behavioural >>> change the user will see is if the bond is up and mac_filter is >>> enabled if they try and set arp_interval they will receive -EBUSY >>> * in bond_changelink moved processing of mac_filter option just below >>> mode processing >>> >>> Documentation/networking/bonding.rst | 20 +++ >>> drivers/net/bonding/Makefile | 2 +- >>> drivers/net/bonding/bond_mac_filter.c | 201 ++++++++++++++++++++++++++ >>> drivers/net/bonding/bond_mac_filter.h | 37 +++++ >>> drivers/net/bonding/bond_main.c | 30 ++++ >>> drivers/net/bonding/bond_netlink.c | 13 ++ >>> drivers/net/bonding/bond_options.c | 81 +++++++++-- >>> drivers/net/bonding/bonding_priv.h | 1 + >>> include/net/bond_options.h | 1 + >>> include/net/bonding.h | 3 + >>> include/uapi/linux/if_link.h | 1 + >>> 11 files changed, 373 insertions(+), 17 deletions(-) >>> create mode 100644 drivers/net/bonding/bond_mac_filter.c >>> create mode 100644 drivers/net/bonding/bond_mac_filter.h >>> >> > [snip] > > The same problem solved using a few nftables rules (in case you don't want to load eBPF): > $ nft 'add table netdev nt' > $ nft 'add chain netdev nt bond0EgressFilter { type filter hook egress device bond0 priority 0; }' > $ nft 'add chain netdev nt bond0IngressFilter { type filter hook ingress device bond0 priority 0; }' > $ nft 'add set netdev nt macset { type ether_addr; flags timeout; }' > $ nft 'add rule netdev nt bond0EgressFilter set update ether saddr timeout 5s @macset' > $ nft 'add rule netdev nt bond0IngressFilter ether saddr @macset counter drop' > I get the following when trying to apply this on a fedora 35 install. root@fedora ~]# ip link add bond0 type bond mode balance-xor xmit_hash_policy vlan+srcmac [root@fedora ~]# nft 'add table netdev nt' [root@fedora ~]# nft 'add chain netdev nt bond0EgressFilter { type filter hook egress device bond0 priority 0; }' Error: unknown chain hook add chain netdev nt bond0EgressFilter { type filter hook egress device bond0 priority 0; } ^^^^^^ [root@fedora ~]# uname -a Linux fedora 5.17.5-200.fc35.x86_64 #1 SMP PREEMPT Thu Apr 28 15:41:41 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux