linux-kernel - Re: [RFC net-next 1/4] net: bridge: respect sticky flag on external learn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zy9kVceo3w-YRA8S@penguin>
Date: Sat, 9 Nov 2024 15:32:05 +0200
From: Nikolay Aleksandrov <razor@...ckwall.org>
To: Elliot Ayrey <elliot.ayrey@...iedtelesis.co.nz>
Cc: davem@...emloft.net, Roopa Prabhu <roopa@...dia.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>, bridge@...ts.linux.dev,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC net-next 1/4] net: bridge: respect sticky flag on external
 learn

On Fri, Nov 08, 2024 at 04:24:18PM +1300, Elliot Ayrey wrote:
> The fdb sticky flag is used to stop a host from roaming to another
> port. However upon receiving a switchdev notification to update an fdb
> entry the sticky flag is not respected and as long as the new entry is
> not locked the host will be allowed to roam to the new port.
> 
> Fix this by considering the sticky flag before allowing an externally
> learned host to roam.
> 
> Signed-off-by: Elliot Ayrey <elliot.ayrey@...iedtelesis.co.nz>
> ---
>  net/bridge/br_fdb.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 

So you have a sticky fdb entry added, but it is still allowed to roam in HW?

> diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
> index 1cd7bade9b3b..d0eeedc03390 100644
> --- a/net/bridge/br_fdb.c
> +++ b/net/bridge/br_fdb.c
> @@ -1457,7 +1457,8 @@ int br_fdb_external_learn_add(struct net_bridge *br, struct net_bridge_port *p,
>  
>  		fdb->updated = jiffies;
>  
> -		if (READ_ONCE(fdb->dst) != p) {
> +		if (READ_ONCE(fdb->dst) != p &&
> +		    !test_bit(BR_FDB_STICK, &fdb->flags)) {
>  			WRITE_ONCE(fdb->dst, p);
>  			modified = true;
>  		}