Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 1 Jul 2022 18:44:47 +0300
From:   Ido Schimmel <idosch@nvidia.com>
To:     Vladimir Oltean <olteanv@gmail.com>
Cc:     Hans S <schultz.hans@gmail.com>,
        Hans Schultz <hans@kapio-technology.com>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>, netdev@vger.kernel.org,
        Andrew Lunn <andrew@lunn.ch>,
        Vivien Didelot <vivien.didelot@gmail.com>,
        Florian Fainelli <f.fainelli@gmail.com>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>, Jiri Pirko <jiri@resnulli.us>,
        Ivan Vecera <ivecera@redhat.com>,
        Roopa Prabhu <roopa@nvidia.com>,
        Nikolay Aleksandrov <razor@blackwall.org>,
        Shuah Khan <shuah@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Hans Schultz <schultz.hans+netdev@gmail.com>,
        linux-kernel@vger.kernel.org, bridge@lists.linux-foundation.org,
        linux-kselftest@vger.kernel.org
Subject: Re: [PATCH net-next v1 1/1] net: bridge: ensure that link-local
 traffic cannot unlock a locked port
Message-ID: <Yr8Wb9mTTnHsMQLL@shredder>
References: <20220630111634.610320-1-hans@kapio-technology.com>
 <Yr2LFI1dx6Oc7QBo@shredder>
 <CAKUejP6LTFuw7d_1C18VvxXDuYaboD-PvSkk_ANSFjjfhyDGkg@mail.gmail.com>
 <Yr778K/7L7Wqwws2@shredder>
 <20220701152700.sf2h6wbxx6dgll7a@skbuf>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220701152700.sf2h6wbxx6dgll7a@skbuf>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pUm2x8XhY0Vx5/RuZ0AroamD1RYbNkxqnh+shZfr8L8K3e1yeFw7bS0AEsdB?=
 =?us-ascii?Q?CXYyBRhpli76GRZW0xBOwTcEmnqbpZQPmT0haqhOC5bbem7umUzYe2aPVAf8?=
 =?us-ascii?Q?JdEn61iIM54qj9kLW5rc7RDEO63z4tW8251PNqlL5at+LzTZtd4p+fv8gdms?=
 =?us-ascii?Q?sqiHxgL3myNiRQE+q3lDU/b1MVZJYmuV08YcW/u/Bbh5OxET6siigwKnSKMF?=
 =?us-ascii?Q?oYAiXifTelU9W10tstXB9d8X1NeILpDBw+eNYxMJXnD/1R8G/zFs03AwJo8f?=
 =?us-ascii?Q?c0eSYI8fw0adTOcHjmpeVi/PcULigCXuKXgJnZsG5i/ZRhS2ojc3l9bQJ3nP?=
 =?us-ascii?Q?XPnx0Pq9BAtSq7mRXrqVHd3pDHP35iTIWnJUC8gykoG5AWvY9YS+gfR+e2Wx?=
 =?us-ascii?Q?8GYRT/FsmZhOHX1iUm+2tI3l4Dh2WwQ5YX4Ov/H/I/oYjcJd7+KpSo36rtDA?=
 =?us-ascii?Q?fZBkLJtgieyOyfV6jGYJOJ4ywalJdrH6iA9bKbloGJ81v86JMSf16BTK6L3r?=
 =?us-ascii?Q?iQTFCIMx9rYM7/QcGFoB+dt1CIr3FruFLuyDGlbcZ/GkM/isSyV+IGVqFEBy?=
 =?us-ascii?Q?YMC4h8891GnCxGGPm1DNRUlw/3FXOMncIy/4MU8bNQL8j5xI07yKzghLJ8VJ?=
 =?us-ascii?Q?WyU2Qu093RA7AKDIWdM2NKeKfFuuO5Fa8Ayk5SH1ewxhTXhZ77motYS5r57D?=
 =?us-ascii?Q?HGLJo3sM0rZRj2qVoaUUGBLLgh/X4XtSrFDITf/Rw4FAHHCGytu/FL+/nQHv?=
 =?us-ascii?Q?nHgIHJMixrVfT88ZcBeGRXDungRXqdod4SuBOXq/3DBM0Kzqxv+DkZupMdSv?=
 =?us-ascii?Q?5IzHA8RsjbVoBPo1ELxvtXfitytlAn4YPdad2nNs+ZHJhL/3fyiOImLQhkqZ?=
 =?us-ascii?Q?LFlkHq/tTdCcm76iGtb/PHkMPfJdABX+FHMN0ct9yo5yO4JUY1mlMePu8gXA?=
 =?us-ascii?Q?97I4ksoVzKqBFmjBNA6Rwapo6gDaQfvmbQuL5KulsFu7SxUOCUOyzL3O1ChV?=
 =?us-ascii?Q?bVA4Wovc/KoDwFMZheJJdKkwNzsG0KiwN9zfWTgQJ6hMAhPxQ+ragYpP2ISZ?=
 =?us-ascii?Q?UGOAOyL7gDgD4osUy6KzW/DwaX5zUEs6ijZrMgMiRyBOgR+Z5yDQEO71vDbU?=
 =?us-ascii?Q?ZPnxH+iKB2WVe2C79T13Y+UVA5Hojg0PqbGP4bXDKI+Aqwha7sDpkB0vZFvi?=
 =?us-ascii?Q?s0CbVzBy2ZQqjp99Zdr8eIChCEX39Y4wfxgU6ZrhwoWeQRIX+FVsZp/5Lgch?=
 =?us-ascii?Q?Sw2CzQgscaGeMgQmi24IA0Xfh65x9WyJsM5uXgxlobivp2ell9RKcH9j1Jye?=
 =?us-ascii?Q?NMKu2EKCn7Qwtrz2XmB1dQN8QAFD4u3rruEhIbRkTQ3stXyMW0FGbM3WN+lf?=
 =?us-ascii?Q?QEoapE/+vBRXh/eEUfdlJrcZHU6fqvnpKai5F+OGHajekAYv4sYh6q3l25MV?=
 =?us-ascii?Q?lQbmjNIsYpGPj6Yohk/nijlRLMS3Ho2MF6P8k8O8uC1Ot897FUYY7pKHQ1if?=
 =?us-ascii?Q?jva0x8MemIg3kk/XEcjNNBP2FUsp/pCkCg/XNAErcqAKvWhskwJ3/pam/Uoy?=
 =?us-ascii?Q?6uh5INjpIlpWz8ckBG0Rgjv+5FElEmVQcopgwsX0?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4b8a4a07-dcb3-4346-ff32-08da5b78a364
X-MS-Exchange-CrossTenant-AuthSource: CY5PR12MB6179.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jul 2022 15:44:52.3105
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 32CQpaRlyIRTkJjGv57iPO+4LXZBlbx8/Z7b0MhKRfuMNb87yEWdbb8EsW8mpRiClUN8IkpFLc9Tu0aaNGG2zQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4893
X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Jul 01, 2022 at 06:27:00PM +0300, Vladimir Oltean wrote:
> On Fri, Jul 01, 2022 at 04:51:44PM +0300, Ido Schimmel wrote:
> > On Fri, Jul 01, 2022 at 09:47:24AM +0200, Hans S wrote:
> > > One question though... wouldn't it be an issue that the mentioned
> > > option setting is bridge wide, while the patch applies a per-port
> > > effect?
> > 
> > Why would it be an issue? To me, the bigger issue is changing the
> > semantics of "locked" in 5.20 compared to previous kernels.
> > 
> > What is even the use case for enabling learning when the port is locked?
> > In current kernels, only SAs from link local traffic will be learned,
> > but with this patch, nothing will be learned. So why enable learning in
> > the first place? As an administrator, I mark a port as "locked" so that
> > only traffic with SAs that I configured will be allowed. Enabling
> > learning when the port is locked seems to defeat the purpose?
> 
> I think if learning on a locked port doesn't make sense, the bridge
> should just reject that configuration.

I tend to agree... Let's wait for Hans to explain why learning needs to
be enabled on mv88e6xxx and see how we handle it in mv88e6xxx and the
bridge.