From: Andre Heider <a.heider@gmail.com>
To: u-boot@lists.denx.de
Subject: [PATCH] arm: mvebu: Espressobin: Disallow forwarding packets between wan and lan ports
Date: Thu, 27 Aug 2020 18:24:12 +0200 [thread overview]
Message-ID: <6f1dd388-9f05-4957-d16e-fb7ec4e4e7fb@gmail.com> (raw)
In-Reply-To: <20200817143638.5565-1-pali@kernel.org>
On 17/08/2020 16:36, Pali Roh?r wrote:
> By default Topaz switch on Espressobin board forwards packets between all
> ethernet ports, including CPU (port 0), wan (port 1) and lan (ports 2,3).
>
> This default U-Boot setup is unsuitable for using Espressobin as router as
> it opens security hole in forwarding all packets between wan and lan ports.
> E.g. dhcp packets from wan network leaks to lan network during small time
> window until U-Boot boots Linux kernel which loads network drivers which
> disallows forwarding between wan and lan.
>
> This patch fixes above problem. For Espressobin board prior putting Topaz
> switch into forwarding mode, Topaz switch is reconfigured to allow
> forwarding packets from wan and lan ports only to CPU port. This ensures
> that packets from wan port are not forwarded to lan ports and vice-versa.
> Packets from CPU port are still forwarded to all other ports, so U-Boot
> network boot works with any ethernet port as before.
>
> This problem was already discussed on Espressobin forum [1] and on
> Marvell's github issue tracker [2]. As a workaround people on Espressobin
> forum patched U-Boot to completely disable lan ports on Topaz switch which
> prevented forwarding packets. That workaround had an issue that U-Boot was
> unable to netboot via lan ports anymore. Change in this patch does not have
> such issue.
>
> [1] - https://web.archive.org/web/20191231164238/http://espressobin.net/forums/topic/boot-behavior-of-the-switch-and-security/
> [2] - https://github.com/MarvellEmbeddedProcessors/u-boot-marvell/issues/18
>
> Signed-off-by: Pali Roh?r <pali@kernel.org>
Tested-by: Andre Heider <a.heider@gmail.com>
next prev parent reply other threads:[~2020-08-27 16:24 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-17 14:36 [PATCH] arm: mvebu: Espressobin: Disallow forwarding packets between wan and lan ports Pali Rohár
2020-08-18 5:26 ` Stefan Roese
2020-08-18 7:33 ` Pali Rohár
2020-08-18 11:21 ` Stefan Roese
2020-08-27 16:24 ` Andre Heider [this message]
2020-08-31 13:01 ` Stefan Roese
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6f1dd388-9f05-4957-d16e-fb7ec4e4e7fb@gmail.com \
--to=a.heider@gmail.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.