Bug 139268 - [if_bridge] [patch] allow if_bridge to forward just VLAN-tagged (or untagged) packets
Summary: [if_bridge] [patch] allow if_bridge to forward just VLAN-tagged (or untagged)...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 7.2-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-10-01 01:00 UTC by P Kern
Modified: 2017-12-31 22:34 UTC (History)
0 users

See Also:


Attachments
file.txt (1.18 KB, text/plain)
2009-10-01 01:00 UTC, P Kern
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description P Kern 2009-10-01 01:00:08 UTC
This patch to if_bridge(4) allows the use of the 'link0' or 'link1' interface options to control whether the bridge forwards all packets or just packets with VLAN tags or just packets without VLAN tags (vlan 0?).
Use 'ifconfig bridge0 link0' to make a bridge forward only untagged packets, leaving the tagged packets to be forwarded or processed separately, by other bridges or cloned interfaces.

Fix: Patch attached with submission follows:
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2009-10-01 07:36:57 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Over to maintainer(s).
Comment 2 Martin Olsson 2011-02-23 13:57:46 UTC
I'm attaching my semi-related feature request to P Kern's request from 
2009.

Allow if_bridge to "normalise" frames before sending them to bpf, to 
simplify (and sometimes correctify) traffic sniffing and network 
debugging.



Question:
How do I get in touch with a developer that can make this feature find 
its way into FreeBSD base? What would it cost me and how soon could it be 
added?




Scenario:
I create a bridge0 interface using (one or) multiple parent NICs. Then I
sniff the traffic on this cloned NIC, 'tcpdump -nli bridge0 port 80'.

Benefit:
Multiple NICs are bonded together and can easily be sniffed on ONE
interface with ONE sniffer process.

Drawback:
If the sniffer use a bpf filter like "port 80", and the incoming mirrored 
traffic consist of a mix of untagged and vlan tagged (802.1q) packets, 
only the untagged packets will match. To see if there are any www-traffic 
in the mirrored vlans, one need to change the filter to "vlan and port 
80", but then you loose the untagged lan.   ...a catch 22. :-(



The file sys/net/if_bridge.c prior to revision 186365 
(http://svn.freebsd.org/viewvc/base?view=revision&revision=186365) used 
the function call BPF_MTAP to send a copy of a packet to bpf. Since this 
gave a stripped packet to the sniffer rather than the full and correct frame, 
this bug was corrected in revision 186365 using ETHER_BPF_MTAP.

My request is simply to have the possibility to override the defaults 
and do it the "buggy" way again, since this proved to be a great feature 
rather than a bug. :-)



Having a function that simply strips off any vlan tag from tagged packets
is wonderful when it comes to sniffing. Especially since switches from all
brands behave differently when it comes to SPAN and vlan tags (a SYN 
packet could be mirrorred untagged while the corresponding SYN+ACK is 
mirrored with a vlan tag set). It is also quite common that net admins 
configure uplink ports with multiple vlans AND an untagged lan. When you 
SPAN this uplink you get both tagged and untagged traffic in a mix, making 
it hard to work with one bpf filter on the full scope of the received 
traffic.

By normalising the mirrored traffic sent to bpf, a network technician can
more easily perform his network debugging. Also, there are less risk of
human mistakes due to the lack of insight that he need to use the
'vlan' keyword in his tcpdump/tshark/ngrep/whatever to match the traffic. 
Also state-keeping tools like snort and argus benefit from normalised 
traffic since they fail to build a correct state table if the SYN and 
SYN+ACK belong to two different vlans.


My request is that if a sysctl variable (like
net.link.bridge.bpf.strip_header) is true, then if_bridge will pass
stripped packets to bpf. By default it should naturally pass
the full frame.



PS. There are only four places in if_bridge.c that need to be updated to
something like this, so the actual work to do is pretty simple:
   if (net.link.bridge.bpf.strip_header == 1)
     BPF_MTAP(bifp, m);
   else
     ETHER_BPF_MTAP(bifp, m);

/Elof
Comment 3 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:44 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped