bridge: transparently add and remove VLAN tags
ClosedPublic
Actions

Authored by ivy on May 23 2025, 9:40 PM.

Details

Reviewers

des
kevans
kp

Group Reviewers

network
manpages

Commits

rG877a7a325b98: bridge: transparently add and remove VLAN tags

Summary

When an untagged frame is received on a port with a pvid configured,
set the frame's tag to the pvid.

When a tagged frame is transmitted on a port with a pvid configured,
and the pvid matches the frame's tag, strip the tag.

This allows ports on the same vlan to communicate when one port is
expecting tagged frames and the other is expecting untagged frames,
e.g. when bridging an access port to a trunk port.

Since we now set the VLAN ID in the mbuf, remove the vlan argument to
bridge_forward() and bridge_broadcast() and take it from VLANTAGOF
instead.

Remove the existing pvid_tagged tests, which no longer make sense
because a port can't receive tagged frames on its pvid anymore.
Replace them with a test for the new (de)tagging functionality.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 64492
Build 61376: arc lint + arc unit

Event Timeline

ivy created this revision.May 23 2025, 9:40 PM

Herald added subscribers: ziaee, glebius, melifaro and 2 others. · View Herald TranscriptMay 23 2025, 9:40 PM

ivy requested review of this revision.May 23 2025, 9:40 PM

Harbormaster completed remote builds in B64395: Diff 155947.May 23 2025, 9:40 PM

ivy added a parent revision: D49993: bridge(4): allow member interface vlan to be configured.May 23 2025, 9:40 PM

ivy added a child revision: D50503: bridge: add vlan filtering support.May 23 2025, 11:56 PM

I didn't see this review, and I think what I asked in D49993 belongs here.
So I would write my note here again:

I don't have access to the recent revisions of IEEE-802.1Q. However, based on observations in newer network devices, we should not accept received tagged packets on access ports, even if they have the same VLAN ID as our interface. All packets received on those interfaces should be untagged.

Even if we want to accept those, we should tag the packet on top of the existing packet. Why? 802.1Q tunneling (Q-in-Q) scenarios.

For consistency with other network devices, there should be an option to drop tagged packets on an access port or only tag on top of it.

pouria mentioned this in D49993: bridge(4): allow member interface vlan to be configured.May 24 2025, 9:26 AM

This looks good, but I'd like us to land the entire series at once, so we don't keep tweaking the bridge/vlan behaviour.

share/man/man4/bridge.4
277	'learned'. I had to look it up too, but apparently 'learnt' is the British variant, 'learned' the American one. We default to American English for better or worse.

In D50500#1153457, @kp wrote:

This looks good, but I'd like us to land the entire series at once, so we don't keep tweaking the bridge/vlan behaviour.

yep, i was intending to do that anyway since the changes don't really make sense individually.

patmaddox added a subscriber: patmaddox.May 27 2025, 3:51 PM

update for new vlan filtering behaviour

Harbormaster completed remote builds in B64492: Diff 156156.May 28 2025, 9:30 AM

ivy marked an inline comment as done.May 28 2025, 9:37 AM

ivy added inline comments.