Linux Ethernet Bridging - Jul 2022 - [Bridge] [PATCH v4 net-next 3/6] drivers: net: dsa: add locked fdb entry flag to drivers

On Sun, Jul 17, 2022 at 05:53:22PM +0200, netdev at kapio-technology.com
wrote:
> > 3. What happens to packets with a DA matching the zero-DPV entry, are
> > they also discarded in hardware? If so, here we differ from the bridge
> > driver implementation where such packets will be forwarded according
to
> > the locked entry and egress the locked port
> 
> I understand that egress will follow what is setup with regard to UC, MC
and
> BC, though I haven't tested that. But no replies will get through of
course
> as long as the port hasn't been opened for the iface behind the locked
port.
Here, should we be rather fixing the software bridge, if the current
behavior is to forward packets towards locked FDB entries?

On Thu, Jul 21, 2022 at 02:59:35PM +0300, Vladimir Oltean
wrote:
> On Sun, Jul 17, 2022 at 05:53:22PM +0200, netdev at kapio-technology.com
wrote:
> > > 3. What happens to packets with a DA matching the zero-DPV entry,
are
> > > they also discarded in hardware? If so, here we differ from the
bridge
> > > driver implementation where such packets will be forwarded
according to
> > > the locked entry and egress the locked port
> > 
> > I understand that egress will follow what is setup with regard to UC,
MC and
> > BC, though I haven't tested that. But no replies will get through
of course
> > as long as the port hasn't been opened for the iface behind the
locked port.
> 
> Here, should we be rather fixing the software bridge, if the current
> behavior is to forward packets towards locked FDB entries?
I think the bridge needs to be fixed, but not to discard packets. If I
decided to lock a port, it means I do not blindly trust whoever who
is behind the port, but instead want to authorize them first. Since an
unauthorized user is able to create locked FDB entries we need to
carefully define what they mean. I tried looking information about MAB
online, but couldn't find detailed material that answers my questions,
so my answers are based on what I believe is logical, which might be
wrong.

Currently, the bridge will forward packets to a locked entry which
effectively means that an unauthorized host can cause the bridge to
direct packets to it and sniff them. Yes, the host can't send any
packets through the port (while locked) and can't overtake an existing
(unlocked) FDB entry, but it still seems like an odd decision. IMO, the
situation in mv88e6xxx is even worse because there an unauthorized host
can cause packets to a certain DMAC to be blackholed via its zero-DPV
entry.

Another (minor?) issue is that locked entries cannot roam between locked
ports. Lets say that my user space MAB policy is to authorize MAC X if
it appears behind one of the locked ports swp1-swp4. An unauthorized
host behind locked port swp5 can generate packets with SMAC X,
preventing the true owner of this MAC behind swp1 from ever being
authorized.

It seems like the main purpose of these locked entries is to signal to
user space the presence of a certain MAC behind a locked port, but they
should not be able to affect packet forwarding in the bridge, unlike
regular entries.

Regarding a separate knob for MAB, I tend to agree we need it. Otherwise
we cannot control which locked ports are able to populate the FDB with
locked entries. I don't particularly like the fact that we overload an
existing flag ("learning") for that. Any reason not to add an explicit
flag ("mab")? At least with the current implementation, locked entries
cannot roam between locked ports and cannot be refreshed, which differs
from regular learning.