From: Tobias Waldekranz <tobias@waldekranz•com>
To: Vladimir Oltean <olteanv@gmail•com>,
"David S . Miller" <davem@davemloft•net>,
Jakub Kicinski <kuba@kernel•org>,
netdev@vger•kernel.org
Cc: Florian Fainelli <f.fainelli@gmail•com>,
Andrew Lunn <andrew@lunn•ch>,
Vivien Didelot <vivien.didelot@gmail•com>,
Kurt Kanzenbach <kurt@linutronix•de>,
Vladimir Oltean <vladimir.oltean@nxp•com>
Subject: Re: [RFC PATCH net 2/4] net: dsa: prevent hardware forwarding between unbridged 8021q uppers
Date: Tue, 09 Mar 2021 19:56:11 +0100 [thread overview]
Message-ID: <87k0qgp35g.fsf@waldekranz.com> (raw)
In-Reply-To: <20210309021657.3639745-3-olteanv@gmail.com>
On Tue, Mar 09, 2021 at 04:16, Vladimir Oltean <olteanv@gmail•com> wrote:
> From: Vladimir Oltean <vladimir.oltean@nxp•com>
>
> Tobias reports that the following set of commands, which bridge two
> ports that have 8021q uppers with the same VID, is incorrectly accepted
> by DSA as valid:
>
> .100 br0 .100
> \ / \ /
> lan0 lan1
>
> ip link add dev br0 type bridge vlan_filtering 1
> ip link add dev lan0.100 link lan0 type vlan id 100
> ip link add dev lan1.100 link lan1 type vlan id 100
If I move this line...
> ip link set dev lan0 master br0
> ip link set dev lan1 master br0 # This should fail but doesn't
...down here, the config is (erroneously) accepted.
> Again, this is a variation of the same theme of 'all VLANs kinda smell
> the same in hardware, you can't tell if they came from 8021q or from the
> bridge'. When the base interfaces are bridged, the expectation of the
> Linux network stack is that traffic received by other upper interfaces
> except the bridge is not captured by the bridge rx_handler, therefore
> not subject to forwarding. So the above setup should not do forwarding
> for VLAN ID 100, but it does it nonetheless. So it should be denied.
>
> Reported-by: Tobias Waldekranz <tobias@waldekranz•com>
> Fixes: 061f6a505ac3 ("net: dsa: Add ndo_vlan_rx_{add, kill}_vid implementation")
> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp•com>
> ---
This is what I meant by having bits and pieces of this validation
scattered in multiple places, some things being checked for certain
events but not for others, etc.
I took an initial stab at this to show what I mean:
https://lore.kernel.org/netdev/20210309184244.1970173-1-tobias@waldekranz.com
I am sure there are holes in this as well, hence RFC, but I think it
will be much easier to make sure that we avoid ordering issues using a
structure like this.
What do you think?
next prev parent reply other threads:[~2021-03-09 18:57 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-09 2:16 [RFC PATCH net 0/4] Clear rx-vlan-filter feature in DSA when necessary Vladimir Oltean
2021-03-09 2:16 ` [RFC PATCH net 1/4] net: dsa: on 'bridge vlan add', check for 8021q uppers of all bridge ports Vladimir Oltean
2021-03-09 2:16 ` [RFC PATCH net 2/4] net: dsa: prevent hardware forwarding between unbridged 8021q uppers Vladimir Oltean
2021-03-09 18:56 ` Tobias Waldekranz [this message]
2021-03-09 2:16 ` [RFC PATCH net 3/4] net: dsa: don't advertise 'rx-vlan-filter' if VLAN filtering not global Vladimir Oltean
2021-03-09 2:16 ` [RFC PATCH net 4/4] net: dsa: let drivers state that they need VLAN filtering while standalone Vladimir Oltean
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87k0qgp35g.fsf@waldekranz.com \
--to=tobias@waldekranz$(echo .)com \
--cc=andrew@lunn$(echo .)ch \
--cc=davem@davemloft$(echo .)net \
--cc=f.fainelli@gmail$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kurt@linutronix$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=olteanv@gmail$(echo .)com \
--cc=vivien.didelot@gmail$(echo .)com \
--cc=vladimir.oltean@nxp$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox