Re: [pve-devel] [PATCH pve-common 0/2] add disable bridge learning feature

["DERUMIER, Alexandre" <Alexandre.DERUMIER@groupe-cyllene.com>]

Le jeudi 11 novembre 2021 à 11:40 +0100, Thomas Lamprecht a écrit :
On 24.09.21 10:48, Alexandre Derumier wrote:
Currently, if bridge receive an unknown dest mac (network bug/attack/..),
we are flooding packets to all bridge ports.

This can waste cpu time, even more with firewall enabled.
Also, if firewall is used with reject action, the src mac of RST
packet is the original unknown dest mac.
(This can block the server at Hetzner for example)

So, we can disable learning && unicast_flood on tap|veth|fwln port interface.
Then mac address need to be add statically in bridge fdb.

I'm a bit out of the loop of the with the whole bad hetzner network thingy, is this still
relevant as I'd see if I can get it in finally..

yes, it can still help with hetzner.
it should allow to use REJECT rules in firewall, as the reject rst packet src ip,is the original dst ip.
when bad traffic is flooded up to the fwbr bridge with unknown dst mac/ip. (because bridges are in promisc mode).



I think this patch series could be usefull for some sdn controllers,

like evpn, where we can statically register mac, but also ip address (not yet implement in this patch serie) in the controlplane.
(instead of using arp dynamic registration, this can have problem sometime with silent hosts and arp timeout)
they are also some sdn (not yet implement, but faucet sdn or some openflow sdn controller), where mac/ip registration really need to be done statically at vm start.