netdev - Re: [PATCH 3/3] net: dsa: Add Vitesse VSC73xx DSA router driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 4 Mar 2019 13:26:20 +0100
From:   Linus Walleij <linus.walleij@...aro.org>
To:     Vladimir Oltean <olteanv@...il.com>
Cc:     Andrew Lunn <andrew@...n.ch>,
        Florian Fainelli <f.fainelli@...il.com>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH 3/3] net: dsa: Add Vitesse VSC73xx DSA router driver

Hi Vladimir,

On Mon, Mar 4, 2019 at 1:14 PM Vladimir Oltean <olteanv@...il.com> wrote:

> I may be in error, but I don't think we have the same understanding of what
> VLAN filtering is. As far as I understand, no VLAN filtering means that
> hardware is required to not parse, push or pop VLAN tags in whatever frames
> it receives or sends (tagged or not). Conversely, VLAN filtering enabled means
> hardware is required to parse VLAN information and enforce port membership.

OK I get it now, I hope I don't forget it the next 5 minutes.
I think I have the wrong mental model about a whole lot of things
regarding VLANs.

> Now, this is orthogonal to forwarding, in a way. I believe that if you want
> to isolate two front-panel ports from other two front-panel ports (be they WAN
> or LAN), you would want to add them to different bridges (br0 and br1).
> But indeed forwarding domain can also be limited using VLAN. In this case a
> frame will be passed from one port to another based on a compound decision
> (L2 forwarding rules allow AND VLAN port membership domain allows). You would
> want to use VLAN when you want a single port to be a member of multiple
> domains, because you can't put a single netdevice (front-panel switch port)
> in multiple bridges.
> All I'm really saying is that I don't think that inside the port_bridge_join
> callback, configuring forwarding based on VLAN is a sane thing to do.
>
> I do see that neither vitesse-vsc73xx nor rtl8366 do implement the bridge
> membership callbacks, and as I don't happen to know nearly enough about DSA, I
> wonder at what moment in time does forwarding get activated between ports.

I think I should seriously look at other DSA drivers implementing this
because I think that is what I really want to achieve here.

Yours,
Linus Walleij