netdev - Correct tc-vlan usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 15 Apr 2020 20:59:06 +0300
From:   Vladimir Oltean <olteanv@...il.com>
To:     Jiri Pirko <jiri@...nulli.us>, netdev <netdev@...r.kernel.org>
Subject: Correct tc-vlan usage

Hi,

I am trying to use tc-vlan to create a set of asymmetric tagging
rules: push VID X on egress, and pop VID Y on ingress. I am using
tc-vlan specifically because regular VLAN interfaces are unfit for
this purpose - the VID that gets pushed by the 8021q driver is the
same as the one that gets popped.
The rules look like this:

# tc filter show dev eno2 ingress
filter protocol 802.1Q pref 49150 flower chain 0
filter protocol 802.1Q pref 49150 flower chain 0 handle 0x1
  vlan_id 103
  dst_mac 00:04:9f:63:35:eb
  not_in_hw
        action order 1: vlan  pop pipe
         index 6 ref 1 bind 1

filter protocol 802.1Q pref 49151 flower chain 0
filter protocol 802.1Q pref 49151 flower chain 0 handle 0x1
  vlan_id 102
  dst_mac 00:04:9f:63:35:eb
  not_in_hw
        action order 1: vlan  pop pipe
         index 5 ref 1 bind 1

filter protocol 802.1Q pref 49152 flower chain 0
filter protocol 802.1Q pref 49152 flower chain 0 handle 0x1
  vlan_id 101
  dst_mac 00:04:9f:63:35:eb
  not_in_hw
        action order 1: vlan  pop pipe
         index 4 ref 1 bind 1

# tc filter show dev eno2 egress
filter protocol all pref 49150 flower chain 0
filter protocol all pref 49150 flower chain 0 handle 0x1
  dst_mac 00:04:9f:63:35:ec
  not_in_hw
        action order 1: vlan  push id 102 protocol 802.1Q priority 0 pipe
         index 3 ref 1 bind 1

filter protocol all pref 49151 flower chain 0
filter protocol all pref 49151 flower chain 0 handle 0x1
  dst_mac 00:04:9f:63:35:eb
  not_in_hw
        action order 1: vlan  push id 102 protocol 802.1Q priority 0 pipe
         index 2 ref 1 bind 1

filter protocol all pref 49152 flower chain 0
filter protocol all pref 49152 flower chain 0 handle 0x1
  dst_mac 00:04:9f:63:35:ea
  not_in_hw
        action order 1: vlan  push id 102 protocol 802.1Q priority 0 pipe
         index 1 ref 1 bind 1

My problem is that the VLAN tags are discarded by the network
interface's RX filter:

# ethtool -S eno2
     SI VLAN nomatch u-cast discards: 1280

and this is because nobody calls .ndo_vlan_rx_add_vid for these VLANs
(only the 8021q driver does). This makes me think that I am using the
tc-vlan driver incorrectly. What step am I missing?

Thanks,
-Vladimir