Vladimir Oltean 73ceab8326 net: dsa: sja1105: prevent tag_8021q VLANs from being received on user ports ... Currently it is possible for an attacker to craft packets with a fake DSA tag and send them to us, and our user ports will accept them and preserve that VLAN when transmitting towards the CPU. Then the tagger will be misled into thinking that the packets came on a different port than they really came on. Up until recently there wasn't a good option to prevent this from happening. In SJA1105P and later, the MAC Configuration Table introduced two options called: - DRPSITAG: Drop Single Inner Tagged Frames - DRPSOTAG: Drop Single Outer Tagged Frames Because the sja1105 driver classifies all VLANs as "outer VLANs" (S-Tags), it would be in principle possible to enable the DRPSOTAG bit on ports using tag_8021q, and drop on ingress all packets which have a VLAN tag. When the switch is VLAN-unaware, this works, because it uses a custom TPID of 0xdadb, so any "tagged" packets received on a user port are probably a spoofing attempt. But when the switch overall is VLAN-aware, and some ports are standalone (therefore they use tag_8021q), the TPID is 0x8100, and the port can receive a mix of untagged and VLAN-tagged packets. The untagged ones will be classified to the tag_8021q pvid, and the tagged ones to the VLAN ID from the packet header. Yes, it is true that since commit 4fbc08bd36 ("net: dsa: sja1105: deny 8021q uppers on ports") we no longer support this mixed mode, but that is a temporary limitation which will eventually be lifted. It would be nice to not introduce one more restriction via DRPSOTAG, which would make the standalone ports of a VLAN-aware switch drop genuinely VLAN-tagged packets. Also, the DRPSOTAG bit is not available on the first generation of switches (SJA1105E, SJA1105T). So since one of the key features of this driver is compatibility across switch generations, this makes it an even less desirable approach. The breakthrough comes from commit bef0746cf4 ("net: dsa: sja1105: make sure untagged packets are dropped on ingress ports with no pvid"), where it became obvious that untagged packets are not dropped even if the ingress port is not in the VMEMB_PORT vector of that port's pvid. However, VLAN-tagged packets are subject to VLAN ingress checking/dropping. This means that instead of using the catch-all DRPSOTAG bit introduced in SJA1105P, we can drop tagged packets on a per-VLAN basis, and this is already compatible with SJA1105E/T. This patch adds an "allowed_ingress" argument to sja1105_vlan_add(), and we call it with "false" for tag_8021q VLANs on user ports. The tag_8021q VLANs still need to be allowed, of course, on ingress to DSA ports and CPU ports. We also need to refine the drop_untagged check in sja1105_commit_pvid to make it not freak out about this new configuration. Currently it will try to keep the configuration consistent between untagged and pvid-tagged packets, so if the pvid of a port is 1 but VLAN 1 is not in VMEMB_PORT, packets tagged with VID 1 will behave the same as untagged packets, and be dropped. This behavior is what we want for ports under a VLAN-aware bridge, but for the ports with a tag_8021q pvid, we want untagged packets to be accepted, but packets tagged with a header recognized by the switch as a tag_8021q VLAN to be dropped. So only restrict the drop_untagged check to apply to the bridge_pvid, not to the tag_8021q_pvid. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2021-08-25 11:14:33 +01:00
..
b53	net: dsa: don't disable multicast flooding to the CPU even without an IGMP querier	2021-08-06 11:11:13 +01:00
hirschmann	net: dsa: let drivers state that they need VLAN filtering while standalone	2021-08-24 09:30:58 +01:00
microchip	net: dsa: microchip: ksz8795: Don't use phy_port_cnt in VLAN table lookup	2021-08-10 09:58:15 +01:00
mv88e6xxx	ethernet: fix PTP_1588_CLOCK dependencies	2021-08-13 17:49:05 -07:00
ocelot	net: mscc: ocelot: transmit the VLAN filtering restrictions via extack	2021-08-20 14:39:52 +01:00
qca	net: dsa: qca: ar9331: make proper initial port defaults	2021-08-07 09:34:35 +01:00
sja1105	net: dsa: sja1105: prevent tag_8021q VLANs from being received on user ports	2021-08-25 11:14:33 +01:00
xrs700x	net: dsa: xrs700x: forward HSR supervision frames	2021-06-16 12:17:03 -07:00
bcm_sf2.c	net: dsa: don't disable multicast flooding to the CPU even without an IGMP querier	2021-08-06 11:11:13 +01:00
bcm_sf2.h
bcm_sf2_cfp.c
bcm_sf2_regs.h
dsa_loop.c
dsa_loop.h
dsa_loop_bdinfo.c
Kconfig
lan9303-core.c	net: dsa: lan9303: fix broken backpressure in .port_fdb_dump	2021-08-10 13:17:22 +01:00
lan9303.h
lan9303_i2c.c
lan9303_mdio.c
lantiq_gswip.c	net: dsa: lantiq: fix broken backpressure in .port_fdb_dump	2021-08-10 13:17:22 +01:00
lantiq_pce.h
Makefile
mt7530.c	net: dsa: mt7530: manually set up VLAN ID 0	2021-08-25 11:09:31 +01:00
mt7530.h	net: dsa: mt7530: manually set up VLAN ID 0	2021-08-25 11:09:31 +01:00
mv88e6060.c
mv88e6060.h
qca8k.c	net: dsa: qca8k: check the correct variable in qca8k_set_mac_eee()	2021-06-09 14:10:38 -07:00
qca8k.h	net: dsa: qca8k: add support for internal phy and internal mdio	2021-05-14 15:30:22 -07:00
realtek-smi-core.c
realtek-smi-core.h
rtl8366.c
rtl8366rb.c
vitesse-vsc73xx-core.c
vitesse-vsc73xx-platform.c
vitesse-vsc73xx-spi.c
vitesse-vsc73xx.h