netdev - Re: [PATCH net-next v6 2/7] net: dsa: Add DSA driver for Hirschmann Hellcreek switches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 17 Oct 2020 12:06:21 +0200
From:   Kurt Kanzenbach <kurt@...utronix.de>
To:     Florian Fainelli <f.fainelli@...il.com>,
        Vladimir Oltean <olteanv@...il.com>
Cc:     Andrew Lunn <andrew@...n.ch>,
        Vivien Didelot <vivien.didelot@...il.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org,
        Rob Herring <robh+dt@...nel.org>, devicetree@...r.kernel.org,
        Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        Richard Cochran <richardcochran@...il.com>,
        Kamil Alkhouri <kamil.alkhouri@...offenburg.de>,
        ilias.apalodimas@...aro.org
Subject: Re: [PATCH net-next v6 2/7] net: dsa: Add DSA driver for Hirschmann Hellcreek switches

On Fri Oct 16 2020, Florian Fainelli wrote:
> I probably missed parts of this long discussion, but for this generation
> of switches, does that mean that you will only allow a bridge with
> vlan_filtering=1 to be configured and also refuse toggling of
> vlan_filtering at run time?

Nope. To sum up the driver will use "private" VLANs for the port
separation. That will lead to certain restrictions. These are:

 * Private VLANs cannot be used by the user or other kernel modules (one
   per port)
 * Mixed vlan_filtering bridges are not supported, as there's only a
   global VLAN awareness flag (ds->vlan_filtering_is_global)
 * vlan_filtering=0 bridges and having standalone ports is not
   supported
 * Same VLANs on top of standalone ports such as lan0.100 and lan1.100
   will break port separation and are also not supported

Most of these restrictions are not important at the moment, because
there are only two user ports. Either they're in a bridge or not. The
"mixed" cases are interesting.

However, as Vladimir suggested, I'll point these limitation to the hw
engineers when they start to develop these switches with more than two
user ports.

Hope that summary makes it clear.

Thanks,
Kurt

Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)