netdev - Re: [PATCH v1 net] net: dsa: microchip: fix unicast frame leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Dec 2018 10:56:57 -0800
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Tristram.Ha@...rochip.com, "David S. Miller" <davem@...emloft.net>,
        Sergio Paracuellos <sergio.paracuellos@...il.com>,
        Andrew Lunn <andrew@...n.ch>, Marek Vasut <marex@...x.de>
Cc:     Pavel Machek <pavel@....cz>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        vivien.didelot@...oirfairelinux.com, UNGLinuxDriver@...rochip.com,
        netdev@...r.kernel.org
Subject: Re: [PATCH v1 net] net: dsa: microchip: fix unicast frame leak

On 12/19/18 6:59 PM, Tristram.Ha@...rochip.com wrote:
> From: Tristram Ha <Tristram.Ha@...rochip.com>
> 
> Port partitioning is done by enabling UNICAST_VLAN_BOUNDARY and changing
> the default port membership of 0x7f to other values such that there is
> no communication between ports.  In KSZ9477 the member for port 1 is
> 0x41; port 2, 0x42; port 3, 0x44; port 4, 0x48; port 5, 0x50; and port 7,
> 0x60.  Port 6 is the host port.
> 
> Setting a zero value can be used to stop port from receiving.
> 
> However, when UNICAST_VLAN_BOUNDARY is disabled and the unicast addresses
> are already learned in the dynamic MAC table, setting zero still allows
> devices connected to those ports to communicate.  This does not apply to
> multicast and broadcast addresses though.  To prevent these leaks and
> make the function of port membership consistent UNICAST_VLAN_BOUNDARY
> should never be disabled.
> 
> Note that UNICAST_VLAN_BOUNDARY is enabled by default in KSZ9477.
> 
> Fixes: b987e98e50ab90e5 ("dsa: add DSA switch driver for Microchip KSZ9477")
> Signed-off-by: Tristram Ha <Tristram.Ha@...rochip.com>

Reviewed-by: Florian Fainelli <f.fainelli@...il.com>

Thanks Tristram, much clearer!
-- 
Florian