Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1614156

Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging

Show all headers | View raw

Hi Andrew,

Andrew Lunn <andrew@lunn.ch> writes:

> On Thu, Mar 30, 2017 at 05:37:15PM -0400, Vivien Didelot wrote:
>> Implement the DSA cross-chip bridging operations by remapping the local
>> ports an external source port can egress frames to, when this cross-chip
>> port joins or leaves a bridge.
>> 
>> The PVT is no longer configured with all ones allowing any external
>> frame to egress any local port. Only DSA and CPU ports, as well as
>> bridge group members, can egress frames on local ports.
>
> With the ZII devel B, we have two switches with PVT, and one
> without. What happens in this setup? Can the non-PVT switch leak
> frames out user ports which should otherwise be blocked?

If CONFIG_BRIDGE_VLAN_FILTERING isn't enabled in the kernel, the non-PVT
switch would indeed have no mean to restrict arbitrary external
frames. So in that setup, yes the switch can theorically leak frames.

With a VLAN-filtering aware system, the VTU policy and 802.1Q Secure
port mode should guard against that.

Thanks,

        Vivien

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH net-next v2 0/9] net: dsa: mv88e6xxx: program cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 2/9] net: dsa: mv88e6xxx: use 4-bit port for PVT data Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
    Re: [PATCH net-next v2 2/9] net: dsa: mv88e6xxx: use 4-bit port for  PVT data Andrew Lunn <andrew@lunn.ch> - 2017-03-31 18:40 +0200
  [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
    Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip  bridging Andrew Lunn <andrew@lunn.ch> - 2017-03-31 18:50 +0200
      Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-31 19:00 +0200
        Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip  bridging Andrew Lunn <andrew@lunn.ch> - 2017-03-31 19:20 +0200
          Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-31 19:30 +0200
  [PATCH net-next v2 5/9] net: dsa: mv88e6xxx: rework in-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 6/9] net: dsa: mv88e6xxx: factorize in-chip bridge map Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 8/9] net: dsa: add cross-chip bridging operations Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  Re: [PATCH net-next v2 0/9] net: dsa: mv88e6xxx: program  cross-chip bridging David Miller <davem@davemloft.net> - 2017-04-01 21:30 +0200

csiph-web