Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 1 Jul 2022 16:51:44 +0300
From:   Ido Schimmel <idosch@nvidia.com>
To:     Hans S <schultz.hans@gmail.com>
Cc:     Hans Schultz <hans@kapio-technology.com>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>, netdev@vger.kernel.org,
        Andrew Lunn <andrew@lunn.ch>,
        Vivien Didelot <vivien.didelot@gmail.com>,
        Florian Fainelli <f.fainelli@gmail.com>,
        Vladimir Oltean <olteanv@gmail.com>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>, Jiri Pirko <jiri@resnulli.us>,
        Ivan Vecera <ivecera@redhat.com>,
        Roopa Prabhu <roopa@nvidia.com>,
        Nikolay Aleksandrov <razor@blackwall.org>,
        Shuah Khan <shuah@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Hans Schultz <schultz.hans+netdev@gmail.com>,
        linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org,
        linux-kselftest@vger.kernel.org
Subject: Re: [PATCH net-next v1 1/1] net: bridge: ensure that link-local
 traffic cannot unlock a locked port
Message-ID: <Yr778K/7L7Wqwws2@shredder>
References: <20220630111634.610320-1-hans@kapio-technology.com>
 <Yr2LFI1dx6Oc7QBo@shredder>
 <CAKUejP6LTFuw7d_1C18VvxXDuYaboD-PvSkk_ANSFjjfhyDGkg@mail.gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAKUejP6LTFuw7d_1C18VvxXDuYaboD-PvSkk_ANSFjjfhyDGkg@mail.gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?SyltQoOGQIZumMPIpCw+Ie6tr0S36+7blcOVw8WVshwF2mDg+ET8GcohTroo?=
 =?us-ascii?Q?ADzs/e4Fr8hp4runa0rI8QNIZNmVI6jDLS6E9v9nvaLVg9P0AjHb7kAb3Ltw?=
 =?us-ascii?Q?6bxQrjybaY0dSC7WeAEIQ/C1Bk0WLOQKzv3uJYn+O8hUpLO9nPmyLl24XUSJ?=
 =?us-ascii?Q?ejKsMJZjk5BgL82zGSs5tzmqZEULxuCenjGY5N3LR9dKFHe7/KY2hKks5Ynb?=
 =?us-ascii?Q?eDL+XF/8Bnkeccu8VV9pXzBM6T9179fl9YT06RJbTacAEVSUIJtIsjA+t7xd?=
 =?us-ascii?Q?8Bh/+AQtbjRNgnrXiHzewFit4opKVkvU43yvsADUyNjnFYkDvE0i9mgM7eD2?=
 =?us-ascii?Q?DVK4MvDTUJ17LvBLS3byn8S4sPF3EkkGHSLGxvyrGLuOgjiS3QYSyH4G6AL0?=
 =?us-ascii?Q?tkMj9o6nUeIQ5Mk2qv8O7H9cw6DjPslXWxrGC5hEMmjIAo/hC3rCVIxoNzXK?=
 =?us-ascii?Q?wvR0XRBP7kyQyVjk25qNNXarQpnqsFmN0k4fD9ndhjIPt/p7c5W4iEiNg5tB?=
 =?us-ascii?Q?aBdan2OE1hJwFcgONH7CfUOK1q0T4PFxppWpckMvi+BbP49+7No945fRYk9+?=
 =?us-ascii?Q?7IXGSQShTGIA5MQ5RCAQLd//OjOggeTpMYncCKd8XDxaAbHrETMsBnoTNg/6?=
 =?us-ascii?Q?hZ4CcFCfbMUNcVdYMdEwemKkGeC99wpjdX+kouOgalnRVUtBPqdl1EvU1QRD?=
 =?us-ascii?Q?2mKZst7UncaRdwoTh0J5wlZ6gYCiqHKkVpbfbCXNlwCDlJgPYS0fs1NPdN/a?=
 =?us-ascii?Q?KPuHUYH0wsH/WZ1fNFbnGtKM0c3Iqb2hDCd2hLCzl6iL0SuOpxBwfKYmRs+h?=
 =?us-ascii?Q?OwWCZ2Nr3LD8RfrAlAlGOkP1m+xRTKu3Dsw8dUaPVSAQqnCgFiDivk8i38lj?=
 =?us-ascii?Q?SREiG2+I32PtAMjRm1AqgKwbn7hcBkKl41556A2h7TLdw4yjUJbbUtKyLAZh?=
 =?us-ascii?Q?/vCgsLKevW88zVaYp84VEcXH6Ph1xvLdfUdu0AcdsGNpq/LTITR0LjtPjTdk?=
 =?us-ascii?Q?oIH1s/P7AU0U9f3L2vD1h1QI2Su7q0Tv59ll6xfpd0nB4hj47q4KmkcuiiZ2?=
 =?us-ascii?Q?2CmvN6C8XMGU1uU+lgXw10PCRdSFg1c4/c5EwAvi2s0KwRN6PxQkEYi3FYsz?=
 =?us-ascii?Q?r5RK/dzQFbfvRlT0DpPOEz9IlOsV6TKbXKyW7Y48ypR1SFyFc83QXfA41lN8?=
 =?us-ascii?Q?7plIsrFGh6tBBxGSvAP07mJw1izotDYOnso6p51zIlPTUz4FGQpUP4zdh0bC?=
 =?us-ascii?Q?lIZwDq5Wup3VT/2lBaA3/46sJD36QFwCt3nCHWP2PNHRActyAP5OuV1vGEhN?=
 =?us-ascii?Q?+L4c/dHDkySstUz95+pJULrG6xraidt3UidxlBZshMPW/gNhL3X++hnsBWXV?=
 =?us-ascii?Q?bRL60kADKP1pcvKJl4nTInm8QkG9SZn/Kmk87IsTTm9O4gpe8mQq8ncWTm/0?=
 =?us-ascii?Q?h6DCg5vBYVnApNT6ItKGlW8mo2DHtHhMOw5LK3ThMldCI39LKOd0gbLl64zw?=
 =?us-ascii?Q?kJSlUxN0OYG7zIgRdXd7niHhVEnZtDA12DAl7eCGQ3baj9ybPPls9WAEd2ug?=
 =?us-ascii?Q?GevvMcWgczqnJo4RZ7a/VbshFjd4T4drzD5tcYT/?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: a650a42d-d4bd-4c45-0478-08da5b68d985
X-MS-Exchange-CrossTenant-AuthSource: CY5PR12MB6179.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jul 2022 13:51:51.2008
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3gah5qOiYCggE9h+Cx7/hcyuNouCZOPB5+V4U7rY6h6W4YCXnhIlOVrdG8Ksgdo4bCfiI9XmSyZMDVlvuhe3PQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR12MB6647
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jul 01, 2022 at 09:47:24AM +0200, Hans S wrote:
> One question though... wouldn't it be an issue that the mentioned
> option setting is bridge wide, while the patch applies a per-port
> effect?

Why would it be an issue? To me, the bigger issue is changing the
semantics of "locked" in 5.20 compared to previous kernels.

What is even the use case for enabling learning when the port is locked?
In current kernels, only SAs from link local traffic will be learned,
but with this patch, nothing will be learned. So why enable learning in
the first place? As an administrator, I mark a port as "locked" so that
only traffic with SAs that I configured will be allowed. Enabling
learning when the port is locked seems to defeat the purpose?

It would be helpful to explain why mv88e6xxx needs to have learning
enabled in the first place. IIUC, the software bridge can function
correctly with learning disabled. It might be better to solve this in
mv88e6xxx so that user space would not need to enable learning on the SW
bridge and then work around issues caused by it such as learning from
link local traffic.