Re: [PATCH] Getting tagged frames through NF when untagged bridges exist

On Sunday 28 September 2003 20:26, Bart De Schuymer wrote:
> What your patch does can also be done with ebtables, without any other
> patches. Since your patch is quite intrusive, I think it's better to use
> ebtables. Also, with the ebtables approach the user has the choice to give
> tagged frames to the vlan code or not (in the situation as described
> below).
It's possible now, but not a two years ago, f.e. ;)

> Let me first restate the problem, for convenience:
> Suppose we have this situation:
> The following devices exist: eth0, eth1, eth0.1000, eth1.1000, br0, br1
> br0 has ports eth0 and eth1
> br1 has ports eth0.1000 and eth1.1000
>
> In this scheme, br0 will deal with all bridged traffic. What some people
> want is that br1 deals with vlan-1000 tagged traffic and br0 with the rest.
Yes, it's so. But one year ago this was the problem, as I described in the 
bridge@ maillist.
Does You tried to run the tcpdump both on br0 and br1 in th same time?

> This is how to do it with ebtables:
> ebtables -t broute -A BROUTING -i eth0 --logical-in br0 -p 802_1q --vlan-id
> 1000 -j DROP
> ebtables -t broute -A BROUTING -i eth0.1000 --logical-in br1 -p ipv4 -j
> CONTINUE
>
> The second rule is just to show some counters. Also note that in the first
> rule --logical-in br0 isn't necessary.
> The first rule says to broute all vlan-1000 tagged traffic. In this
> specific case this means that the vlan code will receive the tagged frames
> on eth0 and from then on the frames entered on eth0.1000. 
> Then the packet is queued again and later the bridge code gets a hold of 
> it because br1 has port eth0.1000. 
> So the BROUTING chain will be traversed twice by the frame.
It should be immediately after the BROUTING chain?
(VID 1000 frame buf)-->[BROUTING {rule 1 matched}]----+-
|<-(vlan driver code cut off the TCI from the frame)<-|
|->(IPv4 frame buf)--->[BROUTING {rule 2 matched}]----->

> The first time it will match the first rule, the second time it will match
> the second rule. It's kinda complex inside, but the ebtables rule is quite
> simple :) Note that you can see here that the vlan code changed the
> Ethernet header: the protocol changed from 802_1q to IPv4.
> Also note that DROP inside the brouting table means the packet needs to be
> brouted.


-- 
Best Regards, Nick Fedchik
http://www.fedchik.org.ua/



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf