From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <arend.vanspriel@broadcom.com>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google;
	h=subject:to:references:cc:from:message-id:date:user-agent
	:mime-version:in-reply-to:content-transfer-encoding;
	bh=OQYW7Qk1loe4VxmjvqmBXEt43jhNwME2GZGM1SgtlWU=;
	b=bOjLPCP8yBR37YaauCVkndWGVAWunS+bI2U9MhQnjNMymYL14GsOrvJyQ0PfG0a7zy
	KXI5Swhw1GA5NAHmQTYDe/kCTc1XtxUyj9rvNiQ6mUEi8C4Iwv9JeotifB71t4ffi70Q
	XoVr/b1t/OUWMcAqDryD8WoUQgCgJnPppLE+k=
References: <20180314110119.13631-1-zajec5@gmail.com>
	<878tau7n23.fsf@codeaurora.org>
From: Arend van Spriel <arend.vanspriel@broadcom.com>
Message-ID: <5AA93530.5040001@broadcom.com>
MIME-Version: 1.0
In-Reply-To: <878tau7n23.fsf@codeaurora.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Bridge] [PATCH] brcmfmac: drop Inter-Access Point Protocol
 packets by default
List-Id: Linux Ethernet Bridging <bridge.lists.linux-foundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bridge>, 
	<mailto:bridge-request@lists.linux-foundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bridge/>
List-Post: <mailto:bridge@lists.linux-foundation.org>
List-Help: <mailto:bridge-request@lists.linux-foundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bridge>,
	<mailto:bridge-request@lists.linux-foundation.org?subject=subscribe>
Date: Wed, 14 Mar 2018 14:44:04 -0000
To: Kalle Valo <kvalo@codeaurora.org>, =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= <zajec5@gmail.com>
Cc: James Hughes <james.hughes@raspberrypi.org>, brcm80211-dev-list.pdl@broadcom.com, netdev@vger.kernel.org, Chi-Hsien Lin <chi-hsien.lin@cypress.com>, bridge@lists.linux-foundation.org, linux-wireless@vger.kernel.org, Hante Meuleman <hante.meuleman@broadcom.com>, Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>, Wright Feng <wright.feng@cypress.com>, =?UTF-8?B?UmFmYcWCIE1pxYJlY2tp?= <rafal@milecki.pl>, Felix Fietkau <nbd@nbd.name>, brcm80211-dev-list@cypress.com, Franky Lin <franky.lin@broadcom.com>

On 3/14/2018 3:24 PM, Kalle Valo wrote:
>> +config BRCMFMAC_IAPP
>> >+	bool "Partial support for obsoleted Inter-Access Point Protocol"
>> >+	depends on BRCMFMAC
>> >+	---help---
>> >+	  Most of Broadcom's firmwares can send 802.11f ADD frame every
>> >+	  time new STA connects to the AP interface. Some recent ones
>> >+	  can also disassociate STA when they receive such a frame.
>> >+
>> >+	  It's important to understand this behavior can lead to a local
>> >+	  DoS security issue. Attacker may trigger disassociation of any
>> >+	  STA by sending a proper Ethernet frame to the wireless
>> >+	  interface.
>> >+
>> >+	  Moreover this feature may break AP interfaces in some specific
>> >+	  setups. This applies e.g. to the bridge with hairpin mode
>> >+	  enabled and IFLA_BRPORT_MCAST_TO_UCAST set. IAPP packet
>> >+	  generated by a firmware will get passed back to the wireless
>> >+	  interface and cause immediate disassociation of just-connected
>> >+	  STA.
> Sorry for jumping late, but does it really make sense to have a Kconfig
> option for this? I don't think we should add a Kconfig option for every
> strange feature, there should be stronger reasons (size savings etc)
> before adding a Kconfig option.
>
> And in this case the size savings can't be much. Wouldn't a module
> parameter be simpler for a functionality change like this?

Hi Kalle,

Good to be wary about Kconfig option. So my reason for asking a Kconfig 
option is that this is directly in the datapaths (tx and rx) so I prefer 
to disable/enable it compile time rather then runtime.

Regards,
Arend