On 24.09.21 10:48, Alexandre Derumier wrote: > Currently, if bridge receive an unknown dest mac (network bug/attack/..), > we are flooding packets to all bridge ports. > > This can waste cpu time, even more with firewall enabled. > Also, if firewall is used with reject action, the src mac of RST > packet is the original unknown dest mac. > (This can block the server at Hetzner for example) > > So, we can disable learning && unicast_flood on tap|veth|fwln port interface. > Then mac address need to be add statically in bridge fdb. > > > Alexandre Derumier (2): > network: add support for disabling bridge learning on tap|veth|fwln > ports > Inotify: add bridge-disable-mac-learning option to bridges. > > src/PVE/INotify.pm | 4 +++- > src/PVE/Network.pm | 60 +++++++++++++++++++++++++++++++++++++++++----- > 2 files changed, 57 insertions(+), 7 deletions(-) >
applied, thanks! But I moved from the single flag to an $opts hash for the tap_plug option, nicer to use than those overly long parameter flags list, that often have lots of slightly confusing undef mixed in. You need to adapt the calling site of the relevant open patches though (sorry for the added work). _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
