lkml.org 
[lkml]   [2022]   [May]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH V3 net-next 1/4] net: bridge: add fdb flag to extent locked port feature
    Date
    On tor, maj 26, 2022 at 17:13, Ido Schimmel <idosch@idosch.org> wrote:
    > On Tue, May 24, 2022 at 05:21:41PM +0200, Hans Schultz wrote:
    >> Add an intermediate state for clients behind a locked port to allow for
    >> possible opening of the port for said clients. This feature corresponds
    >> to the Mac-Auth and MAC Authentication Bypass (MAB) named features. The
    >> latter defined by Cisco.
    >> Locked FDB entries will be limited in number, so as to prevent DOS
    >> attacks by spamming the port with random entries. The limit will be
    >> a per port limit as it is a port based feature and that the port flushes
    >> all FDB entries on link down.
    >
    > Why locked FDB entries need a special treatment compared to regular
    > entries? A port that has learning enabled can be spammed with random
    > source MACs just as well.
    >
    > The authorization daemon that is monitoring FDB notifications can have a
    > policy to shut down a port if the rate / number of locked entries is
    > above a given threshold.
    >
    > I don't think this kind of policy belongs in the kernel. If it resides
    > in user space, then the threshold can be adjusted. Currently it's hard
    > coded to 64 and I don't see how user space can change or monitor it.

    In the Mac-Auth/MAB context, the locked port feature is really a form of
    CPU based learning, and on mv88e6xxx switchcores, this is facilitated by
    violation interrupts. Based on miss violation interrupts, the locked
    entries are then added to a list with a timer to remove the entries
    according to the bridge timeout.
    As this is very CPU intensive compared to normal operation, the
    assessment is that all this will jam up most devices if bombarded with
    random entries at link speed, and my estimate is that any userspace
    daemon that listens to the ensuing fdb events will never get a chance
    to stop this flood and eventually the device will lock down/reset. To
    prevent this, the limit is introduced.

    Ideally this limit could be adjustable from userspace, but in real
    use-cases a cap like 64 should be more than enough, as that corresponds
    to 64 possible devices behind a port that cannot authenticate by other
    means (printers etc.) than having their mac addresses white-listed.

    The software bridge behavior was then just set to correspond to the
    offloaded behavior, but after correspondence with Nik, the software
    bridge locked entries limit will be removed.

    \
     
     \ /
      Last update: 2022-05-27 10:55    [W:4.170 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site