netdev - Re: [PATCH] net: dsa: Don't add vlans when vlan filtering is disabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <62a458f9-4b09-5098-ec06-0549812ddcf4@gmail.com>
Date:   Mon, 6 Nov 2017 15:13:19 -0800
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Andrew Lunn <andrew@...n.ch>, David Miller <davem@...emloft.net>
Cc:     netdev <netdev@...r.kernel.org>,
        Vivien Didelot <vivien.didelot@...oirfairelinux.com>
Subject: Re: [PATCH] net: dsa: Don't add vlans when vlan filtering is disabled

Hi Andrew,

On 11/06/2017 03:04 PM, Andrew Lunn wrote:
> The software bridge can be build with vlan filtering support
> included. However, by default it is turned off. In its turned off
> state, it still passes VLANs via switchev, even though they are not to
> be used. Don't pass these VLANs to the hardware. Only do so when vlan
> filtering is enabled.

Do not we have a possible interface problem here in that we should know
whether VLAN filtering is enabled or not, and in such a case switch
drivers should do the following:

- if VLAN filtering is disabled, accept VLAN programming coming from
DSA, but do not enforce that frames ingress/egressing with an unknown
VID be rejected

- if VLAN filtering is enabled, accept VLAN programming coming from DSA,
enforce that frames ingressing/egressing with an unknown VID should be
rejected

> 
> This fixes at least one corner case. There are still issues in other
> corners, such as when vlan_filtering is later enabled.
> 
> Signed-off-by: Andrew Lunn <andrew@...n.ch>
> ---
>  net/dsa/port.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/net/dsa/port.c b/net/dsa/port.c
> index bb30b1a7de3a..00d691765b9d 100644
> --- a/net/dsa/port.c
> +++ b/net/dsa/port.c
> @@ -252,7 +252,10 @@ int dsa_port_vlan_add(struct dsa_port *dp,
>  		.vlan = vlan,
>  	};
>  
> -	return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_ADD, &info);
> +	if (br_vlan_enabled(dp->bridge_dev))
> +		return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_ADD, &info);
> +
> +	return 0;
>  }
>  
>  int dsa_port_vlan_del(struct dsa_port *dp,
> @@ -264,7 +267,10 @@ int dsa_port_vlan_del(struct dsa_port *dp,
>  		.vlan = vlan,
>  	};
>  
> -	return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_DEL, &info);
> +	if (br_vlan_enabled(dp->bridge_dev))
> +		return dsa_port_notify(dp, DSA_NOTIFIER_VLAN_DEL, &info);
> +
> +	return 0;
>  }
>  
>  int dsa_port_fixed_link_register_of(struct dsa_port *dp)
> 


-- 
Florian