netdev - Re: [PATCH net-next] bridge: Make the FDB consider inner tag for Q-in-Q

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241204084817.g7tort3v3gwdzeic@skbuf>
Date: Wed, 4 Dec 2024 10:48:17 +0200
From: Vladimir Oltean <vladimir.oltean@....com>
To: Andrew Strohman <andrew@...rewstrohman.com>
Cc: Nikolay Aleksandrov <razor@...ckwall.org>,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Ido Schimmel <idosch@...dia.com>, Petr Machata <petrm@...dia.com>,
	Claudiu Manoil <claudiu.manoil@....com>,
	Alexandre Belloni <alexandre.belloni@...tlin.com>,
	UNGLinuxDriver@...rochip.com, Shahed Shaikh <shshaikh@...vell.com>,
	Manish Chopra <manishc@...vell.com>, GR-Linux-NIC-Dev@...vell.com,
	Simon Horman <horms@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
	Roopa Prabhu <roopa@...dia.com>, intel-wired-lan@...ts.osuosl.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org, bridge@...ts.linux.dev
Subject: Re: [PATCH net-next] bridge: Make the FDB consider inner tag for
 Q-in-Q

On Wed, Dec 04, 2024 at 12:37:24AM -0800, Andrew Strohman wrote:
> > What stops you from changing the 802.1ad bridge port pvids to unique
> > values, like 3, 4, 5... instead of 3, 3, 3, and making each other
> > j != i bridge port be a non-pvid member of port i's pvid?
> 
> I'm not sure if I understand this suggestion.
> 
> I tried to draw out what you described here:
> https://docs.google.com/drawings/d/1UcOpENFgr-s6p8Ypwo-l4yTvtUZFM6vSLxLiX2FOMLU
> 
> I'm not sure how host A can communicate with B with this configuration.
> 
> Consider host A transmitting towards host B. When the frame leaves
> ".1q bridge 3",
> it will be tagged with .1q tag vid 7. When the frame leaves the .1ad bridge
> heading toward ".1q bridge 2", it will be tagged again with an outer
> .1ad tag vid 3.
> 
> So ".1q bridge 2" will see the frame as having an outer tag of .1ad vid 3 and
> inner tag of .1q vid 7.
> 
> Is that what you are thinking, or something else?

I didn't say "tagged". I just said "not PVID". There are 2 independent
bridge VLAN attributes: "pvid" and [egress-]"untagged". I am suggesting
that packets in VID 3, 4, 5 all exit the 802.1ad bridge untagged, but
every bridge port has a unique PVID from this range.

bridge vlan add dev port1 vid 3 pvid untagged
bridge vlan add dev port1 vid 4 untagged
bridge vlan add dev port1 vid 5 untagged

bridge vlan add dev port1 vid 3 untagged
bridge vlan add dev port1 vid 4 pvid untagged
bridge vlan add dev port1 vid 5 untagged

bridge vlan add dev port1 vid 3 untagged
bridge vlan add dev port1 vid 4 untagged
bridge vlan add dev port1 vid 5 pvid untagged