netdev - Re: Problem with GVRP on eth while having a bridge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 07 Feb 2013 12:58:01 +0100
From:	Stefan Priebe - Profihost AG <s.priebe@...fihost.ag>
To:	Patrick McHardy <kaber@...sh.net>
CC:	Linux Netdev List <netdev@...r.kernel.org>,
	David Miller <davem@...emloft.net>,
	LKML <linux-kernel@...r.kernel.org>,
	Alexandre DERUMIER <aderumier@...so.com>
Subject: Re: Problem with GVRP on eth while having a bridge

Hi Patrick,

thanks for your fast response.

> So please describe the entire GVRP message exchange that's going
> on.
I've attached two small pcap files.

has_bridge.pcap: is where eth1 has a bridge and the dynamic vlan
disappears after a few seconds.

no_bridge.pcap: no bridge is assigned to eth1 - the dynamic vlan stays
as long as i remove it

> Also you probably want to add the VLAN device on top of the bridge
> device, otherwise it will get passed to the bridge after untagging,
> which might not work, depending on the MAC addresses used.

That's working fine in vanilla kernel 3.7.6 but it does not with RHEL 6.
Also i looks more complicated as i need another bridge on top of the
vlan to assign the needed tap devices. I looked at ovirt for the network
setup:
http://www.ovirt.org/Vdsm_Network

and they also add the vlan directly on top of the nic and then the
bridge on top of the VLANs.

Greets,
Stefan

Am 07.02.2013 12:22, schrieb Patrick McHardy:
> On Thu, Feb 07, 2013 at 11:56:38AM +0100, Stefan Priebe - Profihost AG wrote:
>> Hello list,
>>
>> this was tested using vanilla 3.7.6 kernel.
>>
>> When i add a vlan to an ethernet device supporting gvrp everything is
>> fine until this ethernet device also had a bridge.
>>
>> This works fine as long as eth1 is not attached to a bridge.
>>
>> # ip link add link eth1 name eth1.99 type vlan id 99 gvrp on
>> # ip link set eth1.99 up
>>
>> The dynamic VLAN stays up at the switch - no problems.
>>
>> If eth1 has a bridge the dynamic vlan is created at the switch so the
>> initial packet was send but it disappears after a few seconds.
>>
>> Wireshark shows that the kernel has stopped sending GVRP packets. After
>> adding a bridge to eth1.
> 
> Well, there's no reason why it should continue sending packets after
> the switch has been updated unless it receives a message indicating
> that the switch is about to remove it from it's tables again. So
> please describe the entire GVRP message exchange that's going on.
> 
> Also you probably want to add the VLAN device on top of the bridge
> device, otherwise it will get passed to the bridge after untagging,
> which might not work, depending on the MAC addresses used.
> 

Download attachment "no_bridge.pcap" of type "application/vnd.tcpdump.pcap" (2838 bytes)

Download attachment "has_bridge.pcap" of type "application/vnd.tcpdump.pcap" (2730 bytes)