From: Andre Heider <a.heider@gmail.com>
To: u-boot@lists.denx.de
Subject: [PATCH] arm: mvebu: Espressobin: Disallow forwarding packets between wan and lan ports
Date: Thu, 27 Aug 2020 18:24:12 +0200 [thread overview]
Message-ID: <6f1dd388-9f05-4957-d16e-fb7ec4e4e7fb@gmail.com> (raw)
In-Reply-To: <20200817143638.5565-1-pali@kernel.org>
On 17/08/2020 16:36, Pali Roh?r wrote:
> By default Topaz switch on Espressobin board forwards packets between all
> ethernet ports, including CPU (port 0), wan (port 1) and lan (ports 2,3).
>
> This default U-Boot setup is unsuitable for using Espressobin as router as
> it opens security hole in forwarding all packets between wan and lan ports.
> E.g. dhcp packets from wan network leaks to lan network during small time
> window until U-Boot boots Linux kernel which loads network drivers which
> disallows forwarding between wan and lan.
>
> This patch fixes above problem. For Espressobin board prior putting Topaz
> switch into forwarding mode, Topaz switch is reconfigured to allow
> forwarding packets from wan and lan ports only to CPU port. This ensures
> that packets from wan port are not forwarded to lan ports and vice-versa.
> Packets from CPU port are still forwarded to all other ports, so U-Boot
> network boot works with any ethernet port as before.
>
> This problem was already discussed on Espressobin forum [1] and on
> Marvell's github issue tracker [2]. As a workaround people on Espressobin
> forum patched U-Boot to completely disable lan ports on Topaz switch which
> prevented forwarding packets. That workaround had an issue that U-Boot was
> unable to netboot via lan ports anymore. Change in this patch does not have
> such issue.
>
> [1] - https://web.archive.org/web/20191231164238/http://espressobin.net/forums/topic/boot-behavior-of-the-switch-and-security/
> [2] - https://github.com/MarvellEmbeddedProcessors/u-boot-marvell/issues/18
>
> Signed-off-by: Pali Roh?r <pali@kernel.org>
Tested-by: Andre Heider <a.heider@gmail.com>
next prev parent reply other threads:[~2020-08-27 16:24 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-17 14:36 [PATCH] arm: mvebu: Espressobin: Disallow forwarding packets between wan and lan ports Pali Rohár
2020-08-18 5:26 ` Stefan Roese
2020-08-18 7:33 ` Pali Rohár
2020-08-18 11:21 ` Stefan Roese
2020-08-27 16:24 ` Andre Heider [this message]
2020-08-31 13:01 ` Stefan Roese
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6f1dd388-9f05-4957-d16e-fb7ec4e4e7fb@gmail.com \
--to=a.heider@gmail.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox