lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 28 Dec 2013 22:00:31 +0900
From:	Toshiaki Makita <toshiaki.makita1@...il.com>
To:	Alexandre DERUMIER <aderumier@...so.com>
Cc:	Toshiaki Makita <makita.toshiaki@....ntt.co.jp>,
	netdev@...r.kernel.org, Vlad Yasevich <vyasevic@...hat.com>
Subject: Re: bridge vlan_filtering don't work with tap devices (qemu guests)

On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
> Little update: 
> 
> I can see now tagged packet on br0 with tcpdump, if I have
> 
> #bridge vlan add dev br0 vid 10 self.
> 
> All is working fine now.
> 
> I have a last question : 
> 
> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?

AFAIK, it is impossible.

> 
> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
> "bridge vlan add dev xxx vid 1-4096"
> or
> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"

Such commands seem to be not supported yet.

> 
[...]
> >>Or didn't you set br0 in the same way as other ports like below? 
> >># bridge vlan add dev br0 vid 10 pvid untagged self 
> 
> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
> Or do we need to define all vlans allowed to pass through the bridge ? 

If br0 is promiscuous mode, you should be able to see all frames going
through the bridge.
But if vid 10 untagged is set on br0, incoming frames with vid 10 will
be seen after untagged.

If br0 is not promisc mode, you can see only packets delivered to or
transmitted from br0.

tcpdump normally puts a device into promisc mode, without -p option.

You don't need to add all vids to pass through the bridge.
Settings on br0 will affect only frames coming from or going to br0.

Thanks,
Toshiaki Makita

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists