netdev - Re: bridge vlan_filtering don't work with tap devices (qemu guests)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <52C6D857.2060309@gmail.com>
Date:	Fri, 03 Jan 2014 10:33:43 -0500
From:	Vlad Yasevich <vyasevich@...il.com>
To:	Toshiaki Makita <toshiaki.makita1@...il.com>,
	Alexandre DERUMIER <aderumier@...so.com>
CC:	Toshiaki Makita <makita.toshiaki@....ntt.co.jp>,
	netdev@...r.kernel.org, Vlad Yasevich <vyasevic@...hat.com>
Subject: Re: bridge vlan_filtering don't work with tap devices (qemu guests)

On 12/28/2013 08:00 AM, Toshiaki Makita wrote:
> On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
>> Little update: 
>>
>> I can see now tagged packet on br0 with tcpdump, if I have
>>
>> #bridge vlan add dev br0 vid 10 self.
>>
>> All is working fine now.
>>
>> I have a last question : 
>>
>> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?
> 
> AFAIK, it is impossible.
> 
>>
>> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
>> "bridge vlan add dev xxx vid 1-4096"
>> or
>> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"
> 
> Such commands seem to be not supported yet.

Patches welcome.

-vlad

> 
>>
> [...]
>>>> Or didn't you set br0 in the same way as other ports like below? 
>>>> # bridge vlan add dev br0 vid 10 pvid untagged self 
>>
>> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
>> Or do we need to define all vlans allowed to pass through the bridge ? 
> 
> If br0 is promiscuous mode, you should be able to see all frames going
> through the bridge.
> But if vid 10 untagged is set on br0, incoming frames with vid 10 will
> be seen after untagged.
> 
> If br0 is not promisc mode, you can see only packets delivered to or
> transmitted from br0.
> 
> tcpdump normally puts a device into promisc mode, without -p option.
> 
> You don't need to add all vids to pass through the bridge.
> Settings on br0 will affect only frames coming from or going to br0.
> 
> Thanks,
> Toshiaki Makita
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html