kern/109815: wrong interface identifier at pfil_hooks for vlans + if_bridge

[Eygene Ryabinkin]

Good day.

Tue, Mar 13, 2007 at 08:50:29AM +0300, Eygene Ryabinkin wrote:

> Sure. And that is why all switches that can bear the IP on their
> interfaces have distinct MACs for each interface or/and the only
> one interface can have the IP. And that is why I am going to
> add the paragraph to the if_bridge(4) describing the current situation
> and giving advice on the setting IP for the bridge members and the
> bridge itself. Will provide the patch in a day or two.

OK, the patch to the if_bridge.4 is attached. It is rather lengthy,
but I don't know how to make it clear with less amount of words.
Comments are welcome.
-- 
Eygene
-------------- next part --------------
--- if_bridge.4.orig	Sun Mar  4 15:37:22 2007
+++ if_bridge.4	Sat Mar 17 22:18:52 2007
@@ -219,9 +219,67 @@
 so all packets are passed to
 the filter for processing.
 .Pp
-Note that packets to and from the bridging host will be seen by the
-filter on the interface with the appropriate address configured as well
-as on the interface on which the packet arrives or departs.
+The packets originating from the bridging host will be seen by
+the filter on the interface that is looked up in the routing
+table according to the packet destination address (not the MAC
+address).
+.Pp
+The packets destined to the bridging host will be seen by the filter
+on the interface with the MAC address equal to the packet's destination
+MAC. Be prepated to the situation when some of the bridge members are sharing
+the same MAC address (for example the
+.Xr if_vlan 4
+interfaces: they are currenly sharing the
+MAC address of the parent physical interface). It is not possible
+to distinguish between these interfaces using their MAC address,
+excluding the case when the packet's destination MAC address is
+equal to the MAC address of the interface on which the packet was
+entered to the system. In this case the filter will see the incoming
+packet on this interface. In all other cases the interface seen
+by the packet filter is almost randomly chosen from the list of
+bridge members with the same MAC address.
+.Pp
+The previous paragraph is best illustrated with the following
+pictures. Let the MAC address of the incoming packet's destination will be
+.Nm nn:nn:nn:nn:nn:nn ,
+the interface on which packet entered the system is
+.Nm vlanX
+with the MAC address
+.Nm xx:xx:xx:xx:xx:xx
+and the bridge has more than one interface that are sharing the
+same MAC address
+.Nm yy:yy:yy:yy:yy:yy ;
+we will call them
+.Nm vlanY1 ,
+.Nm vlanY2 ,
+etc. Then if MAC address
+.Nm nn:nn:nn:nn:nn:nn
+is equal to the
+.Nm xx:xx:xx:xx:xx:xx
+then the filter will see the packet on the interface
+.Nm vlanX
+no matter if there are some other bridge members carrying the same
+MAC address. But if the MAC address
+.Nm nn:nn:nn:nn:nn:nn
+is equal to the
+.Nm yy:yy:yy:yy:yy:yy
+then the interface that will be seen by the filter is some of the
+.Nm vlanYn ,
+but it is not possible to know the name of the actual interface
+without the knowledge of the system state and the
+.Nm if_bridge
+implementation details.
+.Pp
+This problem arises for any bridge members that are sharing the same
+MAC address, not only to the
+.Xr if_vlan 4
+ones: they we taken just as the example of such situation. So if one wants
+the filter the locally destined packets based on their interface name,
+he should be aware of this implication. Such situation will appear on the
+filtering bridges that are doing IP-forwarding; in this case it is better
+to assign the IP address only to the
+.Nm if_bridge
+interface and not to the bridge members. But your mileage may vary.
 .Sh EXAMPLES
 The following when placed in the file
 .Pa /etc/rc.conf