netdev - Re: [PATCH net 2/2] net: mscc: ocelot: refuse to overwrite the port's native vlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 27 Oct 2019 01:58:34 +0300
From:   Vladimir Oltean <olteanv@...il.com>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        Joergen Andreasen <joergen.andreasen@...rochip.com>,
        "Allan W. Nielsen" <allan.nielsen@...rochip.com>,
        Antoine Tenart <antoine.tenart@...tlin.com>,
        Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Andrew Lunn <andrew@...n.ch>
Subject: Re: [PATCH net 2/2] net: mscc: ocelot: refuse to overwrite the port's
 native vlan

On Sat, 26 Oct 2019 at 23:34, Florian Fainelli <f.fainelli@...il.com> wrote:
>
>
>
> On 10/26/2019 11:04 AM, Vladimir Oltean wrote:
> > The switch driver keeps a "vid" variable per port, which signifies _the_
> > VLAN ID that is stripped on that port's egress (aka the native VLAN on a
> > trunk port).
> >
> > That is the way the hardware is designed (mostly). The port->vid is
> > programmed into REW:PORT:PORT_VLAN_CFG:PORT_VID and the rewriter is told
> > to send all traffic as tagged except the one having port->vid.
> >
> > There exists a possibility of finer-grained egress untagging decisions:
> > using the VCAP IS1 engine, one rule can be added to match every
> > VLAN-tagged frame whose VLAN should be untagged, and set POP_CNT=1 as
> > action. However, the IS1 can hold at most 512 entries, and the VLANs are
> > in the order of 6 * 4096.
> >
> > So the code is fine for now. But this sequence of commands:
> >
> > $ bridge vlan add dev swp0 vid 1 pvid untagged
> > $ bridge vlan add dev swp0 vid 2 untagged
> >
> > makes untagged and pvid-tagged traffic be sent out of swp0 as tagged
> > with VID 1, despite user's request.
> >
> > Prevent that from happening. The user should temporarily remove the
> > existing untagged VLAN (1 in this case), add it back as tagged, and then
> > add the new untagged VLAN (2 in this case).>
> > Cc: Antoine Tenart <antoine.tenart@...tlin.com>
> > Cc: Alexandre Belloni <alexandre.belloni@...tlin.com>
> > Fixes: 7142529f1688 ("net: mscc: ocelot: add VLAN filtering")
> > Signed-off-by: Vladimir Oltean <olteanv@...il.com>
>
> Reviewed-by: Florian Fainelli <f.fainelli@...il.com>
>

Thanks, Florian.

> [snip]
>
> > +     if (untagged && port->vid != vid) {
> > +             if (port->vid) {
> > +                     dev_err(ocelot->dev,
> > +                             "Port already has a native VLAN: %d\n",
> > +                             port->vid);
>
> This sounds like a extended netlink ack candidate for improving user
> experience, but this should do for now.
> --
> Florian

I know what you're saying. I wanted to drag in minimal dependencies
for the fix. The driver is going to see major rework anyway soon (will
gain a DSA front-end), hence the reason why I copied the DSA people to
the fixes. Having extack propagate to more drivers is always welcome,
and DSA would be a good start to see that being implemented.

Regards,
-Vladimir