Re: [PATCH net] net: dsa: Centralize validation of VLAN configuration

[Vladimir Oltean <olteanv@gmail.com>]

On Tue, Mar 16, 2021 at 11:40:13PM +0100, Tobias Waldekranz wrote:
> > Actually, I think there is a bigger issue.
> > Sadly, I only put 2 and 2 together now, and I believe we are still not
> > dealing correctly with 8021q uppers of bridge ports with vlan_filtering 0.
> > The network stack's expectation is described here:
> > https://patchwork.kernel.org/project/netdevbpf/patch/20210221213355.1241450-12-olteanv@gmail.com/
> 
> So this is the setup Ido is describing, right?
> 
> br1
>   \
>  .100  br0
>     \  / \
>     swp0 swp1
> 
> > Basically the problem is in the way DSA drives the configuration of the
> > hardware port. When VLAN filtering is disabled, VLAN awareness is disabled,
> > too, and we make no effort to classify packets according to the VLAN ID,
> > and take a different forwarding decision in hardware based on that. So
> > the traffic corresponding to the 8021q upper gets forwarded, flooded to
> > ports it shouldn't go to.
> 
> I will try to put this in my own words to see if I understand: the
> problem with the setup above is the discrepancy between how the switch
> and how Linux would handle VID 100 tagged frames.
> 
> In a s/swp/eth/-scenario, br0 would never see those frames since they
> would be snooped by swp0.100, whereas the switch will gleefully forward
> them to swp1.

Yes, pretty much, you can see with bridged veth pairs that this is
exactly what happens, you can ping through their 8021q uppers even
though you cannot ping through the veth interfaces themselves (and of
course, you can ping through the bridge, but that is beside the point).

> $PROFANITY

+2