bridge vlan_filtering don't work with tap devices (qemu guests)

bridge vlan_filtering don't work with tap devices (qemu guests)

[Alexandre DERUMIER]

Hello,

I'm trying to use vlan_filtering on bridge.

setup is : 2 qemu virtual machines (tap0 and tap1), plugged in a bridge br0.
           virtual machines don't tag packets.


qemuvm1 eth0 --tap0----->br0<-------tap1---qemuvm2 eth0.


with vlan_filtering disable, both vms can ping together.


If I enabled filtering

#echo 1 > /sys/class/net/br0/bridge/vlan_filtering

Both vms cannot ping together anymore.

So, I have tried to put vlan on tap interfaces with

#bridge vlan add dev tap0 vid 10
#bridge vlan add dev tap1 vid 10
#bridge vlan show
port	vlan ids
br0	None
tap0	10
tap1    10



But, it doesn't work.

tcpdump on bridge (tcpdump -i br0 -e -n) or in destination qemu (tcpdump -i eth0 -e -n) , don't see any packet

any idea ? 

Regards,

Alexandre Derumier

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Toshiaki Makita]

On Mon, 2013-12-23 at 17:02 +0100, Alexandre DERUMIER wrote:
> Hello,
> 
> I'm trying to use vlan_filtering on bridge.
> 
> setup is : 2 qemu virtual machines (tap0 and tap1), plugged in a bridge br0.
>            virtual machines don't tag packets.
> 
> 
> qemuvm1 eth0 --tap0----->br0<-------tap1---qemuvm2 eth0.
> 
> 
> with vlan_filtering disable, both vms can ping together.
> 
> 
> If I enabled filtering
> 
> #echo 1 > /sys/class/net/br0/bridge/vlan_filtering
> 
> Both vms cannot ping together anymore.
> 
> So, I have tried to put vlan on tap interfaces with
> 
> #bridge vlan add dev tap0 vid 10
> #bridge vlan add dev tap1 vid 10

If you want to send untagged frames, please try to make configuration
like this:
# bridge vlan add dev tap0 vid 10 pvid untagged
# bridge vlan add dev tap1 vid 10 pvid untagged

Thanks,
Toshiaki Makita

> #bridge vlan show
> port	vlan ids
> br0	None
> tap0	10
> tap1    10
> 
> 
> 
> But, it doesn't work.
> 
> tcpdump on bridge (tcpdump -i br0 -e -n) or in destination qemu (tcpdump -i eth0 -e -n) , don't see any packet
> 
> any idea ? 
> 
> Regards,
> 
> Alexandre Derumier
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Alexandre DERUMIER]

>>If you want to send untagged frames, please try to make configuration 
>>like this: 
>># bridge vlan add dev tap0 vid 10 pvid untagged 
>># bridge vlan add dev tap1 vid 10 pvid untagged 
>>
>>Thanks, 
>>Toshiaki Makita 

Thank you ! It's working now.
I thinked that "untagged" was for not tagging from the bridge, I understand now.

Thanks again and merry Xmas !


----- Mail original ----- 

De: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
À: "Alexandre DERUMIER" <aderumier@odiso.com> 
Cc: netdev@vger.kernel.org 
Envoyé: Mardi 24 Décembre 2013 13:45:05 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

On Mon, 2013-12-23 at 17:02 +0100, Alexandre DERUMIER wrote: 
> Hello, 
> 
> I'm trying to use vlan_filtering on bridge. 
> 
> setup is : 2 qemu virtual machines (tap0 and tap1), plugged in a bridge br0. 
> virtual machines don't tag packets. 
> 
> 
> qemuvm1 eth0 --tap0----->br0<-------tap1---qemuvm2 eth0. 
> 
> 
> with vlan_filtering disable, both vms can ping together. 
> 
> 
> If I enabled filtering 
> 
> #echo 1 > /sys/class/net/br0/bridge/vlan_filtering 
> 
> Both vms cannot ping together anymore. 
> 
> So, I have tried to put vlan on tap interfaces with 
> 
> #bridge vlan add dev tap0 vid 10 
> #bridge vlan add dev tap1 vid 10 

If you want to send untagged frames, please try to make configuration 
like this: 
# bridge vlan add dev tap0 vid 10 pvid untagged 
# bridge vlan add dev tap1 vid 10 pvid untagged 

Thanks, 
Toshiaki Makita 

> #bridge vlan show 
> port vlan ids 
> br0 None 
> tap0 10 
> tap1 10 
> 
> 
> 
> But, it doesn't work. 
> 
> tcpdump on bridge (tcpdump -i br0 -e -n) or in destination qemu (tcpdump -i eth0 -e -n) , don't see any packet 
> 
> any idea ? 
> 
> Regards, 
> 
> Alexandre Derumier 
> -- 
> To unsubscribe from this list: send the line "unsubscribe netdev" in 
> the body of a message to majordomo@vger.kernel.org 
> More majordomo info at http://vger.kernel.org/majordomo-info.html 

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Alexandre DERUMIER]

Hello Again,

One more question :

If I use tcpdump on br0, I don't see any tagged vlan10 packets on the bridge.
with 
# bridge vlan add dev tap0 vid 10 pvid untagged 
# bridge vlan add dev tap1 vid 10 pvid untagged 


What I would like to do, is tagging vlan10, incoming (untagged) packets from tap0 and tap1.

Is it possible ?

With openvswitch, I can do it simply with "ovs-vsctl set port tap0 tag=10"

----- Mail original ----- 

De: "Alexandre DERUMIER" <aderumier@odiso.com> 
À: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
Cc: netdev@vger.kernel.org 
Envoyé: Mardi 24 Décembre 2013 20:28:55 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

>>If you want to send untagged frames, please try to make configuration 
>>like this: 
>># bridge vlan add dev tap0 vid 10 pvid untagged 
>># bridge vlan add dev tap1 vid 10 pvid untagged 
>> 
>>Thanks, 
>>Toshiaki Makita 

Thank you ! It's working now. 
I thinked that "untagged" was for not tagging from the bridge, I understand now. 

Thanks again and merry Xmas ! 


----- Mail original ----- 

De: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
À: "Alexandre DERUMIER" <aderumier@odiso.com> 
Cc: netdev@vger.kernel.org 
Envoyé: Mardi 24 Décembre 2013 13:45:05 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

On Mon, 2013-12-23 at 17:02 +0100, Alexandre DERUMIER wrote: 
> Hello, 
> 
> I'm trying to use vlan_filtering on bridge. 
> 
> setup is : 2 qemu virtual machines (tap0 and tap1), plugged in a bridge br0. 
> virtual machines don't tag packets. 
> 
> 
> qemuvm1 eth0 --tap0----->br0<-------tap1---qemuvm2 eth0. 
> 
> 
> with vlan_filtering disable, both vms can ping together. 
> 
> 
> If I enabled filtering 
> 
> #echo 1 > /sys/class/net/br0/bridge/vlan_filtering 
> 
> Both vms cannot ping together anymore. 
> 
> So, I have tried to put vlan on tap interfaces with 
> 
> #bridge vlan add dev tap0 vid 10 
> #bridge vlan add dev tap1 vid 10 

If you want to send untagged frames, please try to make configuration 
like this: 
# bridge vlan add dev tap0 vid 10 pvid untagged 
# bridge vlan add dev tap1 vid 10 pvid untagged 

Thanks, 
Toshiaki Makita 

> #bridge vlan show 
> port vlan ids 
> br0 None 
> tap0 10 
> tap1 10 
> 
> 
> 
> But, it doesn't work. 
> 
> tcpdump on bridge (tcpdump -i br0 -e -n) or in destination qemu (tcpdump -i eth0 -e -n) , don't see any packet 
> 
> any idea ? 
> 
> Regards, 
> 
> Alexandre Derumier 
> -- 
> To unsubscribe from this list: send the line "unsubscribe netdev" in 
> the body of a message to majordomo@vger.kernel.org 
> More majordomo info at http://vger.kernel.org/majordomo-info.html 
-- 
To unsubscribe from this list: send the line "unsubscribe netdev" in 
the body of a message to majordomo@vger.kernel.org 
More majordomo info at http://vger.kernel.org/majordomo-info.html 

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Toshiaki Makita]

2013-12-26 (木) の 14:57 +0100 に Alexandre DERUMIER さんは書きました:
> Hello Again,
> 
> One more question :
> 
> If I use tcpdump on br0, I don't see any tagged vlan10 packets on the bridge.
> with 
> # bridge vlan add dev tap0 vid 10 pvid untagged 
> # bridge vlan add dev tap1 vid 10 pvid untagged 

With these settings, you should be able to see tagged frames on bridge
device with promisc mode.
Are you sure you enabled vlan_filtering by sysfs?
Or didn't you set br0 in the same way as other ports like below?
# bridge vlan add dev br0 vid 10 pvid untagged self

> 
> 
> What I would like to do, is tagging vlan10, incoming (untagged) packets from tap0 and tap1.
> 
> Is it possible ?

If you set pvid, incoming frames from the port will be tagged with the
vlan.
If you set untagged, outgoing frames with the vlan from the port will be
untagged.

So, if you want to send frames tagged with vlan 10, please don't set vid
10 untagged on outgoing ports you want.


BTW:
(CC: Vlad)
I tested to execute tcpdump on br0 with vlan_filtering enabled, but
kernel panic occurred with upstream net-tree kernel. br_handle_vlan()
seems to have a bug that it doesn't check pv is NULL or not.
br_pass_frame_up() calls br_handle_vlan() even if br->vlan_info is NULL
when bridge device is promisc mode.
This will occur if we don't add any vlan on the bridge device.
I'm going to make a patch to fix it.

Thanks,
Toshiaki Makita

> 
> With openvswitch, I can do it simply with "ovs-vsctl set port tap0 tag=10"
> 

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Alexandre DERUMIER]

>>With these settings, you should be able to see tagged frames on bridge 
>>device with promisc mode. 
>>Are you sure you enabled vlan_filtering by sysfs? 
Yes,It's enabled.

>>Or didn't you set br0 in the same way as other ports like below? 
>># bridge vlan add dev br0 vid 10 pvid untagged self 

Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example).
Or do we need to define all vlans allowed to pass through the bridge ?

about tcdpump:

I'm just using tcpdump -i br0 -e -n , and don't see any vlan tag.
But maybe it's related to tcpdump bug, I have also had some random kernel panic.


>>If you set pvid, incoming frames from the port will be tagged with the 
>>vlan. 
>>If you set untagged, outgoing frames with the vlan from the port will be 
>>untagged. 

>>So, if you want to send frames tagged with vlan 10, please don't set vid 
>>10 untagged on outgoing ports you want. 

Oh, ok, it's clear now.



----- Mail original ----- 

De: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
À: "Alexandre DERUMIER" <aderumier@odiso.com> 
Cc: netdev@vger.kernel.org, "Vlad Yasevich" <vyasevic@redhat.com> 
Envoyé: Vendredi 27 Décembre 2013 09:28:37 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

2013-12-26 (木) の 14:57 +0100 に Alexandre DERUMIER さんは書きました: 
> Hello Again, 
> 
> One more question : 
> 
> If I use tcpdump on br0, I don't see any tagged vlan10 packets on the bridge. 
> with 
> # bridge vlan add dev tap0 vid 10 pvid untagged 
> # bridge vlan add dev tap1 vid 10 pvid untagged 

With these settings, you should be able to see tagged frames on bridge 
device with promisc mode. 
Are you sure you enabled vlan_filtering by sysfs? 
Or didn't you set br0 in the same way as other ports like below? 
# bridge vlan add dev br0 vid 10 pvid untagged self 

> 
> 
> What I would like to do, is tagging vlan10, incoming (untagged) packets from tap0 and tap1. 
> 
> Is it possible ? 

If you set pvid, incoming frames from the port will be tagged with the 
vlan. 
If you set untagged, outgoing frames with the vlan from the port will be 
untagged. 

So, if you want to send frames tagged with vlan 10, please don't set vid 
10 untagged on outgoing ports you want. 


BTW: 
(CC: Vlad) 
I tested to execute tcpdump on br0 with vlan_filtering enabled, but 
kernel panic occurred with upstream net-tree kernel. br_handle_vlan() 
seems to have a bug that it doesn't check pv is NULL or not. 
br_pass_frame_up() calls br_handle_vlan() even if br->vlan_info is NULL 
when bridge device is promisc mode. 
This will occur if we don't add any vlan on the bridge device. 
I'm going to make a patch to fix it. 

Thanks, 
Toshiaki Makita 

> 
> With openvswitch, I can do it simply with "ovs-vsctl set port tap0 tag=10" 
> 

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Alexandre DERUMIER]

Little update: 

I can see now tagged packet on br0 with tcpdump, if I have

#bridge vlan add dev br0 vid 10 self.

All is working fine now.

I have a last question : 

Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?

If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
"bridge vlan add dev xxx vid 1-4096"
or
"bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"

----- Mail original ----- 

De: "Alexandre DERUMIER" <aderumier@odiso.com> 
À: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
Cc: netdev@vger.kernel.org, "Vlad Yasevich" <vyasevic@redhat.com> 
Envoyé: Vendredi 27 Décembre 2013 10:46:38 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

>>With these settings, you should be able to see tagged frames on bridge 
>>device with promisc mode. 
>>Are you sure you enabled vlan_filtering by sysfs? 
Yes,It's enabled. 

>>Or didn't you set br0 in the same way as other ports like below? 
>># bridge vlan add dev br0 vid 10 pvid untagged self 

Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
Or do we need to define all vlans allowed to pass through the bridge ? 

about tcdpump: 

I'm just using tcpdump -i br0 -e -n , and don't see any vlan tag. 
But maybe it's related to tcpdump bug, I have also had some random kernel panic. 


>>If you set pvid, incoming frames from the port will be tagged with the 
>>vlan. 
>>If you set untagged, outgoing frames with the vlan from the port will be 
>>untagged. 

>>So, if you want to send frames tagged with vlan 10, please don't set vid 
>>10 untagged on outgoing ports you want. 

Oh, ok, it's clear now. 



----- Mail original ----- 

De: "Toshiaki Makita" <makita.toshiaki@lab.ntt.co.jp> 
À: "Alexandre DERUMIER" <aderumier@odiso.com> 
Cc: netdev@vger.kernel.org, "Vlad Yasevich" <vyasevic@redhat.com> 
Envoyé: Vendredi 27 Décembre 2013 09:28:37 
Objet: Re: bridge vlan_filtering don't work with tap devices (qemu guests) 

2013-12-26 (木) の 14:57 +0100 に Alexandre DERUMIER さんは書きました: 
> Hello Again, 
> 
> One more question : 
> 
> If I use tcpdump on br0, I don't see any tagged vlan10 packets on the bridge. 
> with 
> # bridge vlan add dev tap0 vid 10 pvid untagged 
> # bridge vlan add dev tap1 vid 10 pvid untagged 

With these settings, you should be able to see tagged frames on bridge 
device with promisc mode. 
Are you sure you enabled vlan_filtering by sysfs? 
Or didn't you set br0 in the same way as other ports like below? 
# bridge vlan add dev br0 vid 10 pvid untagged self 

> 
> 
> What I would like to do, is tagging vlan10, incoming (untagged) packets from tap0 and tap1. 
> 
> Is it possible ? 

If you set pvid, incoming frames from the port will be tagged with the 
vlan. 
If you set untagged, outgoing frames with the vlan from the port will be 
untagged. 

So, if you want to send frames tagged with vlan 10, please don't set vid 
10 untagged on outgoing ports you want. 


BTW: 
(CC: Vlad) 
I tested to execute tcpdump on br0 with vlan_filtering enabled, but 
kernel panic occurred with upstream net-tree kernel. br_handle_vlan() 
seems to have a bug that it doesn't check pv is NULL or not. 
br_pass_frame_up() calls br_handle_vlan() even if br->vlan_info is NULL 
when bridge device is promisc mode. 
This will occur if we don't add any vlan on the bridge device. 
I'm going to make a patch to fix it. 

Thanks, 
Toshiaki Makita 

> 
> With openvswitch, I can do it simply with "ovs-vsctl set port tap0 tag=10" 
> 
-- 
To unsubscribe from this list: send the line "unsubscribe netdev" in 
the body of a message to majordomo@vger.kernel.org 
More majordomo info at http://vger.kernel.org/majordomo-info.html 

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Toshiaki Makita]

On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
> Little update: 
> 
> I can see now tagged packet on br0 with tcpdump, if I have
> 
> #bridge vlan add dev br0 vid 10 self.
> 
> All is working fine now.
> 
> I have a last question : 
> 
> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?

AFAIK, it is impossible.

> 
> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
> "bridge vlan add dev xxx vid 1-4096"
> or
> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"

Such commands seem to be not supported yet.

> 
[...]
> >>Or didn't you set br0 in the same way as other ports like below? 
> >># bridge vlan add dev br0 vid 10 pvid untagged self 
> 
> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
> Or do we need to define all vlans allowed to pass through the bridge ? 

If br0 is promiscuous mode, you should be able to see all frames going
through the bridge.
But if vid 10 untagged is set on br0, incoming frames with vid 10 will
be seen after untagged.

If br0 is not promisc mode, you can see only packets delivered to or
transmitted from br0.

tcpdump normally puts a device into promisc mode, without -p option.

You don't need to add all vids to pass through the bridge.
Settings on br0 will affect only frames coming from or going to br0.

Thanks,
Toshiaki Makita

Re: bridge vlan_filtering don't work with tap devices (qemu guests)

[Vlad Yasevich]

On 12/28/2013 08:00 AM, Toshiaki Makita wrote:
> On Fri, 2013-12-27 at 17:17 +0100, Alexandre DERUMIER wrote:
>> Little update: 
>>
>> I can see now tagged packet on br0 with tcpdump, if I have
>>
>> #bridge vlan add dev br0 vid 10 self.
>>
>> All is working fine now.
>>
>> I have a last question : 
>>
>> Is it possible to allow all vlans to go through a port. (or disable filtering for 1 specific port) ?
> 
> AFAIK, it is impossible.
> 
>>
>> If not, maybe could be it great to be able to add multiple vlans with bridge command,like 
>> "bridge vlan add dev xxx vid 1-4096"
>> or
>> "bridge vlan add dev xxx vid 1,2,3-10,12,13-4096"
> 
> Such commands seem to be not supported yet.

Patches welcome.

-vlad

> 
>>
> [...]
>>>> Or didn't you set br0 in the same way as other ports like below? 
>>>> # bridge vlan add dev br0 vid 10 pvid untagged self 
>>
>> Indeed I didn't set vlan on br0. Isn't it only to tag packets coming from the bridge itself? (like a bridge management ip for example). 
>> Or do we need to define all vlans allowed to pass through the bridge ? 
> 
> If br0 is promiscuous mode, you should be able to see all frames going
> through the bridge.
> But if vid 10 untagged is set on br0, incoming frames with vid 10 will
> be seen after untagged.
> 
> If br0 is not promisc mode, you can see only packets delivered to or
> transmitted from br0.
> 
> tcpdump normally puts a device into promisc mode, without -p option.
> 
> You don't need to add all vids to pass through the bridge.
> Settings on br0 will affect only frames coming from or going to br0.
> 
> Thanks,
> Toshiaki Makita
> 
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>