netdev - Re: bridge vlan_filtering don't work with tap devices (qemu guests)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1388235631.1754.23.camel@localhost.localdomain>
Date:	Sat, 28 Dec 2013 22:00:31 +0900
From:	Toshiaki Makita <toshiaki.makita1@...il.com>
To:	Alexandre DERUMIER <aderumier@...so.com>
Cc:	Toshiaki Makita <makita.toshiaki@....ntt.co.jp>,
	netdev@...r.kernel.org, Vlad Yasevich <vyasevic@...hat.com>
Subject: Re: bridge vlan_filtering don't work with tap devices (qemu guests)

On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
> Little update: 
> 
> I can see now tagged packet on br0 with tcpdump, if I have
> 
> #bridge vlan add dev br0 vid 10 self.
> 
> All is working fine now.
> 
> I have a last question : 
> 
> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?

AFAIK, it is impossible.

> 
> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
> "bridge vlan add dev xxx vid 1-4096"
> or
> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"

Such commands seem to be not supported yet.

> 
[...]
> >>Or didn't you set br0 in the same way as other ports like below? 
> >># bridge vlan add dev br0 vid 10 pvid untagged self 
> 
> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
> Or do we need to define all vlans allowed to pass through the bridge ? 

If br0 is promiscuous mode, you should be able to see all frames going
through the bridge.
But if vid 10 untagged is set on br0, incoming frames with vid 10 will
be seen after untagged.

If br0 is not promisc mode, you can see only packets delivered to or
transmitted from br0.

tcpdump normally puts a device into promisc mode, without -p option.

You don't need to add all vids to pass through the bridge.
Settings on br0 will affect only frames coming from or going to br0.

Thanks,
Toshiaki Makita

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html