From owner-freebsd-net@FreeBSD.ORG Fri Dec 17 12:41:38 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 989C116A4CE for ; Fri, 17 Dec 2004 12:41:38 +0000 (GMT) Received: from mail.star-sw.com (mail.star-sw.com [217.195.82.1]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6F22443D1D for ; Fri, 17 Dec 2004 12:41:37 +0000 (GMT) (envelope-from nkritsky@star-sw.com) Received: from ARGON.star-sw.com (argon.star-sw.com [217.195.82.10]) by mail.star-sw.com (8.12.11/8.12.11) with ESMTP id iBHCfVEQ078869; Fri, 17 Dec 2004 15:41:31 +0300 (MSK) Received: from ibmka.star-sw.com ([192.168.32.230]) by ARGON.star-sw.com with Microsoft SMTPSVC(5.0.2195.5329); Fri, 17 Dec 2004 15:41:30 +0300 Date: Fri, 17 Dec 2004 15:41:30 +0300 From: "Nickolay A. Kritsky" X-Mailer: The Bat! (v1.49) Personal X-Priority: 3 (Normal) Message-ID: <721371959296.20041217154130@star-sw.com> To: "Andrew Seguin" In-reply-To: <20041217094937.E4E6054C3@borgtech.ca> References: <20041217094937.E4E6054C3@borgtech.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-OriginalArrivalTime: 17 Dec 2004 12:41:30.0719 (UTC) FILETIME=[BBBAAEF0:01C4E435] cc: freebsd-net@freebsd.org Subject: Re: FW: Curiosity in IPFW/Freebsd bridge. [more] 802.1q VLAN at fault? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: "Nickolay A. Kritsky" List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Dec 2004 12:41:38 -0000 Hello Andrew, Friday, December 17, 2004, 12:47:46 PM, Andrew Seguin wrote: AS> Looking through the ethereal dumps, I have spotted one difference. AS> Packets for the console look like this: AS> Frame 1 (106 bytes on wire, 106 bytes captured) AS> Ethernet II, Src: MAC1, Dst: MAC2 AS> Internet Protocol, Src Addr: MyPC, Dst Addr: FIREWALL AS> SSH Protocol AS> Packets from the bridge look like this: AS> Frame 1 (64 bytes on wire, 64 bytes captured) AS> Ethernet II, Src: MAC1, Dst: MAC2 AS> 802.1q Virtual LAN AS> Internet Protocol, Src Addr: x, Dst Addr: y AS> Transmission Control Protocol, ... AS> So it would seem that the part "802.1q Virtual LAN" in the protocol is AS> stopping IPFW from investigating the traffic? (At times like this I wish I AS> would have not studied computer engineering but networking for 4 years!). AS> Question then: AS> What in IPFW is stopping it from reading into a VLAN tagged packet (if it AS> is such that it can be called). I cannot say for sure, because I do not have any 5.x filtering bridge right now. But after reading some sources I think I understand what is happening: bdg_forward in bridge.c is calling ipfw or another packet filter: /* * NetBSD-style generic packet filter, pfil(9), hooks. * Enables ipf(8) in bridging. */ if (!IPFW_LOADED) { /* XXX: Prevent ipfw from being run twice. */ if (inet_pfil_hook.ph_busy_count >= 0 && m0->m_pkthdr.len >= sizeof(struct ip) && ntohs(save_eh.ether_type) == ETHERTYPE_IP) { Note the last line: for VLAN tagged packet the field save_eh.ether_type would be ETHERTYPE_VLAN instead of ETHERTYPE_IP and no filtering will take place. That is what I think is going on. Who is the current maintainer of bridge code in FreeBSD? -- Best regards, ; Nickolay A. Kritsky ; SysAdmin STAR Software LLC ; mailto:nkritsky@star-sw.com