Re: [PATCH net-next 2/3] net: dsa: sja1105: make sure untagged packets are dropped on ingress ports with no pvid

[Florian Fainelli <f.fainelli@gmail.com>]

On 7/28/2021 2:54 PM, Vladimir Oltean wrote:
> Surprisingly, this configuration:
> 
> ip link add br0 type bridge vlan_filtering 1
> ip link set swp2 master br0
> bridge vlan del dev swp2 vid 1
> 
> still has the sja1105 switch sending untagged packets to the CPU (and
> failing to decode them, since dsa_find_designated_bridge_port_by_vid
> searches by VID 1 and rightfully finds no bridge VLAN 1 on a port).
> 
> Dumping the switch configuration, the VLANs are managed properly:
> - the pvid of swp2 is 1 in the MAC Configuration Table, but
> - only the CPU port is in the port membership of VLANID 1 in the VLAN
>    Lookup Table
> 
> When the ingress packets are tagged with VID 1, they are properly
> dropped. But when they are untagged, they are able to reach the CPU
> port. Also, when the pvid in the MAC Configuration Table is changed to
> e.g. 55 (an unused VLAN), the untagged packets are also dropped.
> 
> So it looks like:
> - the switch bypasses ingress VLAN membership checks for untagged traffic
> - the reason why the untagged traffic is dropped when I make the pvid 55
>    is due to the lack of valid destination ports in VLAN 55, rather than
>    an ingress membership violation
> - the ingress VLAN membership cheks are only done for VLAN-tagged traffic
> 
> Interesting. It looks like there is an explicit bit to drop untagged
> traffic, so we should probably be using that to preserve user expectations.
> 
> Note that only VLAN-aware ports should drop untagged packets due to no
> pvid - when VLAN-unaware, the software bridge doesn't do this even if
> there is no pvid on any bridge port and on the bridge itself. So the new
> sja1105_drop_untagged() function cannot simply be called with "false"
> from sja1105_bridge_vlan_add() and with "true" from sja1105_bridge_vlan_del.
> Instead, we need to also consider the VLAN awareness state. That means
> we need to hook the "drop untagged" setting in all the same places where
> the "commit pvid" logic is, and it needs to factor in all the state when
> flipping the "drop untagged" bit: is our current pvid in the VLAN Lookup
> Table, and is the current port in that VLAN's port membership list?
> VLAN-unaware ports will never drop untagged frames because these checks
> always succeed by construction, and the tag_8021q VLANs cannot be changed
> by the user.
> 
> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>

Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
-- 
Florian