Prevent traffic assigned to locally terminated VLANs from being forwarded #837
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wkz
force-pushed
the
vlan-iface-termination
branch
from
abaf539 to
7f51148
Compare
This patch drops a needless restriction of IP addresses on VLAN filtering bridges from 2024-03-06. The obvious use-case is when the bridge is an untagged member of a VLAN and only ony management VLAN is required. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
troglobit
force-pushed
the
vlan-iface-termination
branch
2 times, most recently
from
728bfbb to
9ea4d9f
Compare
mattiaswal
reviewed
Nov 28, 2024
Contributor
|
I've had my fingers in this, but the parts by @wkz look good to me to merge. So we only need input from @mattiaswal on the total set, and the late |
troglobit
approved these changes
Nov 28, 2024
Now that PVID can be configured on bridges, make sure that we reflect that in the operational database.
This will fail on a system running a vanilla kernel, where the dut's ports are backed by mv88e6xxx, because: 1. The ports are attached to the same bridge, and are thus in the same PVT group. 2. Creation of the VLAN uppers causes the DSA layer to add both ports to the same VTU entry. As a result, hardware behaves as if both ports had been configured as tagged members of VLAN 10, instead of just terminating incoming traffic locally. Add this test to catch hardware which behaves in this way.
As it turns out, the setup with a 802.1D bridge in combination with VLAN uppers stacked on the bridge ports is not possible to support on mv88e6xxx ports. Enable VLAN filtering to ensure proper isolation of the locally terminated VLANs.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
wkz
force-pushed
the
vlan-iface-termination
branch
from
9ea4d9f to
f4557ff
Compare
- Use standard topology - Include test case specification in parent README
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Before this change, in a setup like the following, packets assigned to
VLAN 10 were forwarded between the switch ports, even though the
configuration dictates that they should only be locally terminated.
Therefore, make sure that VLANs that are added to the VTU to terminate
a VLAN upper interface, rather than to offload bridge VLANs, are
marked as policy entries. As the VTU policy of user ports is already
set to TRAP (to ensure proper standalone port operation), this will
cause all packets assigned to these VLANs to properly terminated.
Checklist
Tick relevant boxes, this PR is-a or has-a: