netdev - Re: [PATCH v3 net-next 3/3] net: dsa: mv88e6xxx: mac-auth/MAB implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6abb27f946d39602bd05cdcbea21766c@kapio-technology.com>
Date:   Sat, 07 Jan 2023 11:32:06 +0100
From:   netdev@...io-technology.com
To:     Vladimir Oltean <olteanv@...il.com>
Cc:     davem@...emloft.net, kuba@...nel.org, netdev@...r.kernel.org,
        Andrew Lunn <andrew@...n.ch>,
        Florian Fainelli <f.fainelli@...il.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3 net-next 3/3] net: dsa: mv88e6xxx: mac-auth/MAB
 implementation

On 2023-01-06 17:41, Vladimir Oltean wrote:
> On Fri, Jan 06, 2023 at 05:05:29PM +0100, Hans J. Schultz wrote:
>> This implementation for the Marvell mv88e6xxx chip series is based on
>> handling ATU miss violations occurring when packets ingress on a port
>> that is locked with learning on. This will trigger a
>> SWITCHDEV_FDB_ADD_TO_BRIDGE event, which will result in the bridge 
>> module
>> adding a locked FDB entry. This bridge FDB entry will not age out as
>> it has the extern_learn flag set.
>> 
>> Userspace daemons can listen to these events and either accept or deny
>> access for the host, by either replacing the locked FDB entry with a
>> simple entry or leave the locked entry.
>> 
>> If the host MAC address is already present on another port, a ATU
>> member violation will occur, but to no real effect, and the packet 
>> will
>> be dropped in hardware. Statistics on these violations can be shown 
>> with
>> the command and example output of interest:
>> 
>> ethtool -S ethX
>> NIC statistics:
>> ...
>>      atu_member_violation: 5
>>      atu_miss_violation: 23
>> ...
>> 
>> Where ethX is the interface of the MAB enabled port.
>> 
>> Furthermore, as added vlan interfaces where the vid is not added to 
>> the
>> VTU will cause ATU miss violations reporting the FID as
>> MV88E6XXX_FID_STANDALONE, we need to check and skip the miss 
>> violations
>> handling in this case.
>> 
>> Signed-off-by: Hans J. Schultz <netdev@...io-technology.com>
>> ---
> 
> Please add Acked-by/Reviewed-by tags when posting new versions. 
> However,
> there's no need to repost patches *only* to add the tags. The upstream
> maintainer will do that for acks received on the version they apply.
> 
> If a tag was not added on purpose, please state why and what changed.
> 
> Missing tags:
> 
> Reviewed-by: Vladimir Oltean <olteanv@...il.com>
> 
> 
> Please allow at least 24 hours between patch submissions to give time
> for other review comments.

I presume that since I move the exit tag 'out' to this patch, it has 
changed and the review tag is reset?