netdev - Re: [PATCH net-next 2/7] ice: Support untagged VLAN traffic in br offload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230803155852.glz4rqvrhx55ke3m@skbuf>
Date: Thu, 3 Aug 2023 18:58:52 +0300
From: Vladimir Oltean <vladimir.oltean@....com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: Jiri Pirko <jiri@...nulli.us>, Ido Schimmel <idosch@...sch.org>,
	Vlad Buslov <vladbu@...dia.com>,
	Tony Nguyen <anthony.l.nguyen@...el.com>, netdev@...r.kernel.org,
	Wojciech Drewek <wojciech.drewek@...el.com>,
	Simon Horman <horms@...nel.org>,
	Sujai Buvaneswaran <sujai.buvaneswaran@...el.com>
Subject: Re: [PATCH net-next 2/7] ice: Support untagged VLAN traffic in br
 offload

On Wed, Aug 02, 2023 at 07:31:42PM -0700, Jakub Kicinski wrote:
> On Tue,  1 Aug 2023 10:31:07 -0700 Tony Nguyen wrote:
> > From: Wojciech Drewek <wojciech.drewek@...el.com>
> > 
> > When driver receives SWITCHDEV_FDB_ADD_TO_DEVICE notification
> > with vid = 1, it means that we have to offload untagged traffic.
> > This is achieved by adding vlan metadata lookup.
> 
> Paul already asked about this behavior but it's unclear to me from the
> answer whether this is a local custom or legit switchdev behavior.
> Could someone with switchdev knowledge glance over this?

The only special vid is vid=0 (and that implies a VLAN-unaware FDB entry).
vid=1 is not special. Packets match on an FDB entry with vid=1 if they
are classified to VID 1 (obviously). That can happen if the bridge port
is VLAN-aware (bridge vlan_filtering=1) and:
- packet was untagged and pvid of the ingress port was 1, or
- packet was VLAN-tagged and the VID in the packet was 1
If the bridge has vlan_filtering=0, the rules are different, and packets
should only match FDB entries with vid=0. Both the (bridge) pvid of the
port and the VLAN header from the packet are to be ignored.