netdev - Re: [PATCH net-next 03/14] net: dsa: b53: Properly account for VLAN filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Jan 2019 13:47:55 -0500
From:   Vivien Didelot <vivien.didelot@...il.com>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     netdev@...r.kernel.org, andrew@...n.ch, davem@...emloft.net,
        idosch@...lanox.com, jiri@...lanox.com,
        ilias.apalodimas@...aro.org, ivan.khoronzhuk@...aro.org,
        roopa@...ulusnetworks.com, nikolay@...ulusnetworks.com
Subject: Re: [PATCH net-next 03/14] net: dsa: b53: Properly account for VLAN
 filtering

On Thu, 17 Jan 2019 09:48:53 -0800, Florian Fainelli <f.fainelli@...il.com> wrote:
> On 1/17/19 8:36 AM, Vivien Didelot wrote:
> > Hi Florian,
> > 
> > On Wed, 16 Jan 2019 12:00:51 -0800, Florian Fainelli <f.fainelli@...il.com> wrote:
> > 
> >> +	/* Handle the case were multiple bridges span the same switch device
> >> +	 * and one of them has a different setting than what is being requested
> >> +	 * which would be breaking filtering semantics for any of the other
> >> +	 * bridge devices.
> >> +	 */
> >> +	b53_for_each_port(dev, i) {
> >> +		bridge_dev = dsa_to_port(ds, i)->bridge_dev;
> >> +		if (bridge_dev &&
> >> +		    bridge_dev != dsa_to_port(ds, port)->bridge_dev &&
> >> +		    br_vlan_enabled(bridge_dev) != vlan_filtering) {
> >> +			netdev_err(bridge_dev,
> >> +				   "VLAN filtering is global to the switch!\n");
> >> +			return -EINVAL;
> >> +		}
> >> +	}
> >  
> > Unbridged ports must act as standard NICs and thus forward taggued frames.
> > What happens to them if there's a bridge with VLAN filtering enabled spawned
> > on other ports of your switch? Will the unbridged ports filter VLAN?
> Because VLAN filtering a global setting to the switch, unbridged network
> ports will effectively have VLAN filtering enabled, which is why the
> ndo_vlan_rx_{add,kill}_vid functions to permit that use case.

But then vlan_filtering must simply not be allowed on your switch if you
have unbridged ports, no?

I might be mixing things up here but I don't understand yet how you can
have bridged and unbridged ports working correctly on your switch when it
has global VLAN filtering turned on. I understand that the switch will drop
the tagged frames on ingress.


Thanks,

	Vivien