netdev - Re: [PATCH 0/2] Fix issues with vlans without REORDER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Nov 2015 14:39:06 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	vyasevich@...il.com
Cc:	netdev@...r.kernel.org, phil@....cc, kaber@...sh.net,
	vyasevic@...hat.com
Subject: Re: [PATCH 0/2] Fix issues with vlans without REORDER_HEADER

From: Vladislav Yasevich <vyasevich@...il.com>
Date: Mon, 16 Nov 2015 15:43:43 -0500

> A while ago Phil Sutter brought up an issue with vlans without
> REORDER_HEADER and bridges.  The problem was that if a vlan
> without REORDER_HEADER was a port in the bridge, the bridge ended
> up forwarding corrupted packets that still contained the vlan header.
> The same issue exists for bridge mode macvlan/macvtap devices.
> 
> An additional issue with vlans without REORDER_HEADER is that stacking
> them also doesn't work.  The reason here is that skb_reorder_vlan_header()
> function assumes that it on ETH_HLEN bytes deep into the packet.  That
> is not the case, when you a vlan without REORRDER_HEADER flag set.
> 
> This series attempts to correct these 2 issues.
> 
> 1) To solve the stacked vlans problem, the patch simply use
> skb->mac_len as an offset to start copying mac addresses that
> is part of header reordering.
> 
> 2) To fix the issue with bridge/macvlan/macvtap, the second patch
> simply doesn't write the vlan header back to the packet if the
> vlan device is either a bridge or a macvlan port.  This ends up
> being the simplest and least performance intrussive solution.
> 
> I've considered extending patch 2 to all stacked devices (essentially
> checked for the presense of rx_handler), but that feels like a broader
> restriction and _may_ break existing uses.  

Series applied, thanks for working on this Vlad.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html