netdev - Re: [RFC PATCH net-next 3/3] net: dsa: never skip VLAN configuration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Jul 2022 14:34:33 +0000
From:   <Arun.Ramadoss@...rochip.com>
To:     <vladimir.oltean@....com>
CC:     <claudiu.manoil@....com>, <UNGLinuxDriver@...rochip.com>,
        <alexandre.belloni@...tlin.com>, <vivien.didelot@...il.com>,
        <andrew@...n.ch>, <idosch@...dia.com>, <linux@...pel-privat.de>,
        <petrm@...dia.com>, <f.fainelli@...il.com>, <hauke@...ke-m.de>,
        <martin.blumenstingl@...glemail.com>, <xiaoliang.yang_1@....com>,
        <kuba@...nel.org>, <pabeni@...hat.com>, <edumazet@...gle.com>,
        <netdev@...r.kernel.org>, <Woojung.Huh@...rochip.com>,
        <davem@...emloft.net>
Subject: Re: [RFC PATCH net-next 3/3] net: dsa: never skip VLAN configuration

Hi Vladimir,

On Fri, 2022-07-15 at 15:26 +0000, Vladimir Oltean wrote:
> EXTERNAL EMAIL: Do not click links or open attachments unless you
> know the content is safe
> 
> On Fri, Jul 15, 2022 at 09:23:19AM +0000, Arun.Ramadoss@...rochip.com
>  wrote:
> > Hi Vladimir,
> > 
> > We tried the following test
> > 
> > ip link set dev br0 type bridge vlan_filtering 0
> > 
> > ip link set lan1 master br0
> > ip link set lan2 master br0
> > 
> > bridge vlan add vid 10 dev lan1 pvid untagged
> > 
> > ==>
> > Packet transmitted from Host1 with vid 5 is not received by the
> > Host2
> > Packet transmitted from Host1 with vid 10 is not received by the
> > Host2
> > ==>
> > 
> > bridge vlan add vid 10 dev lan2 pvid untagged
> > 
> > ==>
> > Packet transmitted from Host1 with vid 5 is received by the Host2
> > Pa
> > cket transmitted from Host1 with vid 10 is received by the Host2
> > ==>
> > 
> > bridge vlan del vid 10 dev lan2
> > 
> > ==>
> > Packet transmitted from Host1 with vid 5 is not received by the
> > Host2
> > Packet transmitted from Host1 with vid 10 is not received by the
> > Host2
> > ==>
> > 
> > Tried this test before and after applying this patch series. And
> > got
> > the same result.
> > 
> > In summary, packets are dropped when pvid is added to vlan unaware
> > bridge. Let me know if anything need to performed on this.
> 
> I'm not surprised that forwarding is broken after removing
> "ds->configure_vlan_while_not_filtering = false", but I'm surprised
> that
> it's broken even without the change. That suggests that either the
> flag
> wasn't effective in the first place, or that the breakage is caused
> by
> other code paths (not sure which).
> 
> Do you get the "skipping configuration of VLAN" warning extack when
> you
> run the "bridge vlan add" command without the patches here? Does
> ksz_port_vlan_add() get called at all with VID 10?

There was a mistake in our testing on the latest code base of net-next. 
Today we tried in the latest net-next and following are the
observation.

Scenario 1: Before applying the patch
------------------------------
ip link set dev br0 type bridge vlan_filtering 0

bridge vlan add vid 10 dev lan1 pvid untagged
bridge vlan add vid 10 dev lan2 pvid untagged

We got warning skipping configuration of VLAN and ksz_port_vlan_add()
is not called.

Packet is received in Host2 when transmitted from Host1. So there is no
breakage in the forwarding.

Scenario 2: After applying the patch
----------------------------
ip link set dev br0 type bridge vlan_filtering 0

bridge vlan add vid 10 dev lan1 pvid untagged

--> Packet is not received in the Host2

bridge vlan add vid 10 dev lan2 pvid untagged

--> packet is received in the Host2

bridge vlan del vid 10 dev lan1

--> packet is received in the Host2

bridge vlan del vid 10 dev lan2

--> packet is received in the Host2

 * Let us know, do we need to test anything further on this.

Thanks
Arun