netdev - Re: [PATCH v3 net-next 18/24] net: dsa: sja1105: Add support for traffic through standalone ports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 16 Apr 2019 17:09:45 -0700
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Andrew Lunn <andrew@...n.ch>, Vladimir Oltean <olteanv@...il.com>
Cc:     vivien.didelot@...il.com, davem@...emloft.net,
        netdev <netdev@...r.kernel.org>, linux-kernel@...r.kernel.org,
        Georg Waibel <georg.waibel@...sor-technik.de>
Subject: Re: [PATCH v3 net-next 18/24] net: dsa: sja1105: Add support for
 traffic through standalone ports



On 14/04/2019 20:07, Andrew Lunn wrote:
>> It fails to decode the frames, obviously. But so does any other EtherType.
> 
>> Florian was hinting
>> (https://lwn.net/ml/netdev/b52f4cdf-edcf-0757-1d6e-d4a831ec7943@gmail.com/)
>> at the recent pull requests submitted to tcpdump and libpcap that make
>> it possible to decode based on the string in
>> /sys/class/net/${master}/dsa/tagging. I admit I haven't actually
>> tested or studied those closely yet (there are more important things
>> to focus on ATM), but since my driver returns "8021q" in sysfs and
>> yours returns "edsa", I would presume tcpdump could use that
>> information.
> 
> No it does not. It is a valid EtherType, that is what is used to
> trigger the decoding, it takes no notice of what is in
> /sys/class/net/${master}/dsa/tagging, nor the extra meta-data added to
> the pcap file. There is no need. you can identify it is a Marvell EDSA
> header from the EtherType.
> 
> In fact, this tcpdump code for decoding EDSA pre-dated Florians
> patches by a few years.
> 
> You only need the code which Florian added when you cannot identify
> the header directly from the packet. And that is true for most of the
> tagging protocols. But EDSA you can.

Correct.

> 
>> Anyway, since you obviously know more on this topic than I do,
>> please make me understand what are the real problems in spoofing the
>> Ethertype as a Marvell one.
> 
> Despite there being an EDSA EtherType in the frame, what follows is
> not an ESDA header. It is like having the IPv4 EtherType but what
> following is not an IP header. Broken.
I suppose this is a valid point, but in that case any EtherType would do 
and technically using ETH_P_EDSA is just an one of the many possible 
choices for configuring the Marvell EDSA EtherType, you just need to 
pick one that is not going to trick the switching into thinking this is 
invalid LLC/SNAP.

With Vivien's latest tcpdump changes, I don't think we need to rely on 
ETH_P_EDSA to be present anyway since the kernel tells us (when available).
-- 
Florian