linux-kernel - Re: [PATCH RFC] net: bridge: handle ports in locked mode for ll learning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z16i0MArCT_46dKa@shredder>
Date: Sun, 15 Dec 2024 11:35:12 +0200
From: Ido Schimmel <idosch@...dia.com>
To: Jonas Gorski <jonas.gorski@...dn.de>
Cc: Vladimir Oltean <vladimir.oltean@....com>,
	Roopa Prabhu <roopa@...dia.com>,
	Nikolay Aleksandrov <razor@...ckwall.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Hans Schultz <schultz.hans@...il.com>,
	"Hans J. Schultz" <netdev@...io-technology.com>,
	bridge@...ts.linux.dev, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH RFC] net: bridge: handle ports in locked mode for ll
 learning

On Fri, Dec 13, 2024 at 12:25:20PM +0100, Jonas Gorski wrote:
> So in conclusion, I agree with the original patch. Shall I resend it? Should
> I extend the commit message?

Yes. I would use something like:

"
There are legitimate use cases for enabling learning on a locked bridge
port such as MAC Authentication Bypass (MAB) or when user space
authorizes hosts using dynamic FDB entries.

Currently, by default, the bridge will autonomously populate its FDB
with addresses learned from link-local frames. This is true even when a
port is locked which defeats the purpose of the "locked" bridge port
option. The behavior can be controlled by the "no_linklocal_learn"
bridge option, but it is easy to miss which leads to insecure
configurations.

Fix this by skipping learning from link-local frames when a port is
locked.

Fixes: a21d9a670d81 ("net: bridge: Add support for bridge port in locked mode")
"