From owner-freebsd-net@freebsd.org Wed May 29 15:37:58 2019 Return-Path: Delivered-To: freebsd-net@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7440515A517D for ; Wed, 29 May 2019 15:37:58 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 1392F71878 for ; Wed, 29 May 2019 15:37:58 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: from mail-lj1-f174.google.com (mail-lj1-f174.google.com [209.85.208.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) (Authenticated sender: kevans) by smtp.freebsd.org (Postfix) with ESMTPSA id A716D1E731 for ; Wed, 29 May 2019 15:37:57 +0000 (UTC) (envelope-from kevans@freebsd.org) Received: by mail-lj1-f174.google.com with SMTP id m15so2896138ljg.13 for ; Wed, 29 May 2019 08:37:57 -0700 (PDT) X-Gm-Message-State: APjAAAUEQG8KDkKX3hn7mSJA0igZHdSWwqtWNH1vXrmhD0dV5my+TfMy srl0DCLt7RK3Cb8vcDNkBnuRl4nGk3cIzKwG+h4= X-Google-Smtp-Source: APXvYqy8gIbHE5YBOvsJ19fRaib8XoTGIxe6nMt2UE58+INqHsvgNy42Jb8WvTNdfjfOPQlgKzSyY5fWkpB09cOuPc4= X-Received: by 2002:a2e:2b8f:: with SMTP id r15mr36618353ljr.196.1559144276218; Wed, 29 May 2019 08:37:56 -0700 (PDT) MIME-Version: 1.0 References: <201905291413.x4TEDhOT021170@gndrsh.dnsmgr.net> In-Reply-To: <201905291413.x4TEDhOT021170@gndrsh.dnsmgr.net> From: Kyle Evans Date: Wed, 29 May 2019 10:37:25 -0500 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: Bridges on VLAN-tagged interfaces. To: "Rodney W. Grimes" Cc: Eric Bautsch , "Patrick M. Hausen" , FreeBSD Net Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 1392F71878 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.98 / 15.00]; local_wl_from(0.00)[freebsd.org]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_SHORT(-0.98)[-0.975,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; ASN(0.00)[asn:11403, ipnet:2610:1c1:1::/48, country:US] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 May 2019 15:37:58 -0000 On Wed, May 29, 2019 at 9:13 AM Rodney W. Grimes wrote: > > > [I cast level 3 necromancy and revive this thread from the dead] > > But this is all layer 2 stuff :-) > > > > > On Tue, Mar 19, 2019 at 4:02 AM Eric Bautsch wrote: > > > > > > Hi Patrick. > > > > > > > > > I get that point, but then I have two options only: I somehow convince the BIOS > > > to do a network boot over a VLAN for installation - not a capability this BIOS > > > appears to have, or I end up creating a whole new VLAN that's either routed or > > > has YP, DNS, time and installation servers on it. That's a massive headache.... > > > > > > It'd be much neater if FreeBSD could handle the tagged/untagged traffic. It just > > > works (TM) on Solaris and Linux, so I expected it to do the same on FreeBSD... :-( > > > > > > Surely, there must be a way.... > > > > > > > This is a product of how vlans and bridges work on FreeBSD, but I > > think it doesn't have to be this way. Let's break it down: re0.33 is a > > vlan(4) attached to re0. Ordinary traffic coming in on vlan 33 does > > this little dance number: > > > > incoming -> re0:ether_input -> ether_demux -> vlan_input -> re0.33:ether_input > > > > Let's mix it up: add re0.33 to a bridge0. Traffic is passed to > > potential bridge for processing in ether_input_internal prior to > > ether_demux, so you end up with this setup: > > > > incoming -> re0:ether_input -> ether_demux -> vlan_input -> > > re0.33:ether_input -> bridge0:bridge_input -> ether_demux > > > > Now let's evolve into our final form. add re0 to bridge1; this is what > > I'm most certain is happening > > > > incoming -> re0:ether_input -> bridge1:bridge_input -> bridge_forward > > > > oops. bridge1 grabs the re0 packet before we have a chance to do any > > vlan processing. Traffic isn't bound for *this* bridge or any of the > > other interfaces, so it will perform the bridge forwarding function > > and everything goes off the rails. > > That makes sense as to what I saw happening last time I had > issues with this. > > > > > This is not an unsolvable problem, though, from a developer > > perspective. I think if_bridge(4) simply needs to be taught a little > > about if_vlan(4) (needs more hooks...) so that traffic coming in on > > re0 with a vlan that matches an if_vlan(4) interface doesn't get > > snagged in the wrong bridge too early. > > Sounds reasonable, both vlan and bridge/switch are layer 2 > functionality and should fully co-operate. One thing to > note if you are going to dig around in this code it is known > to have poor performance and is one of the bottleneck areas > for getting packets in and out of a bhyve vm via the tap to bridge > path. > > I defanitly would enjoying having the configuration and performance > of the ESXi vswitch paradigm in FreeBSD if we can implement it with > this code in a reasonable fasion. > > I can provide some sample config files if desired. > I think something like [0] would do the trick, but this is only compile-tested and probably not quite correct. Patch bypasses all bridge checking if we have an if_vlan(4) interface that this mbuf will be getting demuxed to. After bypassing the bridge re0 is in, it'll hit ether_demux and peel off any 802.1q headers and reinject it to ether_input. This time it'll hit the re0.33 bridge sans vlan tag and theoretically do the right thing. If mbuf is tagged for vlan != 33 and we don't have an re0. for it, it'll still hit the re0 bridge and maintain current behavior. Thanks, Kyle Evans [0] https://people.freebsd.org/~kevans/bridge-vlan.diff