Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1614172

Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging

Show all headers | View raw

On Fri, Mar 31, 2017 at 12:55:03PM -0400, Vivien Didelot wrote:
> Hi Andrew,
> 
> Andrew Lunn <andrew@lunn.ch> writes:
> 
> > On Thu, Mar 30, 2017 at 05:37:15PM -0400, Vivien Didelot wrote:
> >> Implement the DSA cross-chip bridging operations by remapping the local
> >> ports an external source port can egress frames to, when this cross-chip
> >> port joins or leaves a bridge.
> >> 
> >> The PVT is no longer configured with all ones allowing any external
> >> frame to egress any local port. Only DSA and CPU ports, as well as
> >> bridge group members, can egress frames on local ports.
> >
> > With the ZII devel B, we have two switches with PVT, and one
> > without. What happens in this setup? Can the non-PVT switch leak
> > frames out user ports which should otherwise be blocked?
> 
> If CONFIG_BRIDGE_VLAN_FILTERING isn't enabled in the kernel, the non-PVT
> switch would indeed have no mean to restrict arbitrary external
> frames. So in that setup, yes the switch can theorically leak frames.

I don't like the idea of leaking frames. It has security implications,
and hard to debug weird networking problems, like some other machine
is using my IP address, maybe spanning tree is broken if BPDUs leak,
even broadcast storms?

So we need to consider the complexity of detecting we have a non-PVT
destination switch, and forward it frames via the software bridge.

What about the case the non-PVT switch is in the middle of a chain of
PVT switches?

Maybe to start with, to keep it simple, we check all switches are PVT
capable. If they are not, we refuse to use PVT and all inter-switch
frames need to go via the Linux software bridge?

       Andrew

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH net-next v2 0/9] net: dsa: mv88e6xxx: program cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 2/9] net: dsa: mv88e6xxx: use 4-bit port for PVT data Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
    Re: [PATCH net-next v2 2/9] net: dsa: mv88e6xxx: use 4-bit port for  PVT data Andrew Lunn <andrew@lunn.ch> - 2017-03-31 18:40 +0200
  [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
    Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip  bridging Andrew Lunn <andrew@lunn.ch> - 2017-03-31 18:50 +0200
      Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-31 19:00 +0200
        Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip  bridging Andrew Lunn <andrew@lunn.ch> - 2017-03-31 19:20 +0200
          Re: [PATCH net-next v2 9/9] net: dsa: mv88e6xxx: add cross-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-31 19:30 +0200
  [PATCH net-next v2 5/9] net: dsa: mv88e6xxx: rework in-chip bridging Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 6/9] net: dsa: mv88e6xxx: factorize in-chip bridge map Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  [PATCH net-next v2 8/9] net: dsa: add cross-chip bridging operations Vivien Didelot <vivien.didelot@savoirfairelinux.com> - 2017-03-30 23:50 +0200
  Re: [PATCH net-next v2 0/9] net: dsa: mv88e6xxx: program  cross-chip bridging David Miller <davem@davemloft.net> - 2017-04-01 21:30 +0200

csiph-web