[pve-devel] [PATCH pve-common 0/2] add disable bridge learning feature

Alexandre Derumier aderumier at odiso.com
Fri Sep 24 10:48:53 CEST 2021


Currently, if bridge receive an unknown dest mac (network bug/attack/..),
we are flooding packets to all bridge ports.

This can waste cpu time, even more with firewall enabled.
Also, if firewall is used with reject action, the src mac of RST
packet is the original unknown dest mac.
(This can block the server at Hetzner for example)

So, we can disable learning && unicast_flood on tap|veth|fwln port interface.
Then mac address need to be add statically in bridge fdb.


Alexandre Derumier (2):
  network: add support for disabling bridge learning on tap|veth|fwln
    ports
  Inotify: add bridge-disable-mac-learning option to bridges.

 src/PVE/INotify.pm |  4 +++-
 src/PVE/Network.pm | 60 +++++++++++++++++++++++++++++++++++++++++-----
 2 files changed, 57 insertions(+), 7 deletions(-)

-- 
2.30.2




More information about the pve-devel mailing list