From owner-freebsd-net@FreeBSD.ORG Mon Mar 5 16:02:10 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 1B4E816A400; Mon, 5 Mar 2007 16:02:10 +0000 (UTC) (envelope-from bms@FreeBSD.org) Received: from out5.smtp.messagingengine.com (out5.smtp.messagingengine.com [66.111.4.29]) by mx1.freebsd.org (Postfix) with ESMTP id C78A913C48D; Mon, 5 Mar 2007 16:02:09 +0000 (UTC) (envelope-from bms@FreeBSD.org) Received: from out1.internal (unknown [10.202.2.149]) by out1.messagingengine.com (Postfix) with ESMTP id 6F8C81F5C83; Mon, 5 Mar 2007 11:02:09 -0500 (EST) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by out1.internal (MEProxy); Mon, 05 Mar 2007 11:02:09 -0500 X-Sasl-enc: eG49zWuCENynFxREc+lJL2xNVGvP9HcUwm4uGQ3cWwun 1173110529 Received: from [192.168.123.18] (82-35-112-254.cable.ubr07.dals.blueyonder.co.uk [82.35.112.254]) by mail.messagingengine.com (Postfix) with ESMTP id A99E023F80; Mon, 5 Mar 2007 11:02:07 -0500 (EST) Message-ID: <45EC3EFD.3000301@FreeBSD.org> Date: Mon, 05 Mar 2007 16:02:05 +0000 From: "Bruce M. Simpson" User-Agent: Thunderbird 1.5.0.9 (X11/20070125) MIME-Version: 1.0 To: Eygene Ryabinkin References: <45E9F1E8.2000802@inse.ru> <20070304062203.GL80319@codelabs.ru> <45E9F1E8.2000802@inse.ru> <20070304160613.GN80319@codelabs.ru> <45EB4915.1090703@FreeBSD.org> <20070305145647.GT80319@codelabs.ru> In-Reply-To: <20070305145647.GT80319@codelabs.ru> Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: 7bit Cc: rik@FreeBSD.org, freebsd-net@freebsd.org, glebius@FreeBSD.org, andre@FreeBSD.org, thompsa@FreeBSD.org Subject: Re: kern/109815: wrong interface identifier at pfil_hooks for vlans + if_bridge X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Mar 2007 16:02:10 -0000 Hi, Eygene Ryabinkin wrote: > Sure, I can test it, but then I need to know what problems are cured > by your patch, or I just should watch if it will not break something. > > My concern is that I want to make sure that all these changes to the ether_input path work OK together. The M_PROMISC flag is set further down when it's determined that a frame flowing into ether_input() was received promiscuously, and therefore Layer 3 protocols (e.g. IP) may not want to see it. >> In NetBSD, after if_bridge is given a chance to claim an input frame, the ifp >> may be changed if the bridge needs to forward locally. >> > > In my case if_bridge drops off the packet because firewall fails to > recognize the packet as good: the interface that is passed to a > pfil_hooks is bad (I mean not the one expected). > The ifp which your patch changes is that of the mbuf chain when bridge_input determines it is not for the bridge, but should be forwarded locally. The patch forces a locally forwarded frame to have the same ifp as it had when it came into bridge_input. I can foresee problems if the same Ethernet destination address exists on multiple bridge member interfaces. The latest version of p4 bms_netdev now updates the cached ifp in ether_input() if bridge_input() changed it in this way. NetBSD consistently uses pfil_hooks for the if_bridge *and* ether_input paths, FreeBSD currently calls ipfw directly for ether_input, which may make a difference to the behaviour which you are seeing with VLANs. Not understanding if_bridge fully, or the coupling of ipfw with if_ethersubr.c, I would hope that Andrew and others have more to say on this. > Will try to see if your patch makes any difference for the 7-CURRENT, > but I have no system at hand to test it, sorry. > The patch is extracted from p4 therefore it should apply against CURRENT. I haven't updated the patch yet, the latest code is in p4. We won't be able to eliminate the DEV_CARP checks in this spin. I did exchange an idea with Andrew late last night whereby a list of addresses other than ether_dhost is maintained for each ifnet. Input paths then check this in addition to or instead of ether_dhost. I've added this to the Wiki. I've been working particularly hard lately so I'm not 100% clear. Thanks, BMS