Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-11 Thread Fabian Knittel
Hi, Gert Doering schrieb: > On Thu, Apr 01, 2010 at 10:59:05AM +0200, Jan Just Keijser wrote: >>> Hm, nice idea. I'll implement it in my next round of patches. >>> >> FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 >> are *by definition* not encapsulated (according to my

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-11 Thread Fabian Knittel
Hi Gert, Gert Doering wrote: > Something else I need to check: the "standard" mroute code hashes based > on ethernet address (in tap mode). What happens if the same MAC address > shows up for two different VLAN IDs? (Not very likely for virtual > ethernet devices, though, but this can happen in

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-11 Thread Fabian Knittel
[ I just noticed that I accidentally sent this only to David and not to the list. It was written and sent on Thu, 01 Apr 2010 15:46:21 +0200 ] David Sommerseth wrote: > But what kind traffic does hit the OpenVPN clients? Does the OpenVPN > server send only traffic to the corresponding VLAN the

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-11 Thread Gert Doering
Hi, On Thu, Apr 01, 2010 at 01:49:02PM +0200, David Sommerseth wrote: > >From a security and not the least from a performance perspective, the > OpenVPN clients should only receive traffic which hits it's own VLAN > (ie. the server does the "filtering" before sending data to the client). > I'm no

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-11 Thread Gert Doering
Hi, On Thu, Apr 01, 2010 at 10:59:05AM +0200, Jan Just Keijser wrote: > > Hm, nice idea. I'll implement it in my next round of patches. > > > FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 > are *by definition* not encapsulated (according to my CCNA guide ;-)) > VID 0 m

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread David Sommerseth
On 01/04/10 13:28, Fabian Knittel wrote: > Peter Stuge schrieb: >> Jan Just Keijser wrote: >>> FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 >>> are *by definition* not encapsulated (according to my CCNA guide ;-)) > [...] >>> Perhaps we need to make sure that VID 1 means u

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Fabian Knittel
Jan Just Keijser schrieb: > Peter Stuge wrote: >> Look at the spec, Table 9-2 on page 86. (100 in PDF) >> >> VID Use >> 0 "no VLAN identifier is present in the frame" >> 1 "The default PVID value used for classifying frames on ingress .. >> The PVID value of a Port can be changed by manage

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Fabian Knittel
Peter Stuge schrieb: > Jan Just Keijser wrote: >> FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 >> are *by definition* not encapsulated (according to my CCNA guide ;-)) [...] >> Perhaps we need to make sure that VID 1 means untagged ... > > Any VID can be untagged. While 1

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Jan Just Keijser
Peter Stuge wrote: Jan Just Keijser wrote: FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 are *by definition* not encapsulated (according to my CCNA guide ;-)) 802.1Q != CCNA.. Look at the spec, Table 9-2 on page 86. (100 in PDF) VID Use 0 "no VLAN identifier

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Peter Stuge
Jan Just Keijser wrote: > FYI: 802.1Q defines VLAN 1 as the 'native' LAN: all packets on VLAN 1 > are *by definition* not encapsulated (according to my CCNA guide ;-)) 802.1Q != CCNA.. Look at the spec, Table 9-2 on page 86. (100 in PDF) VID Use 0 "no VLAN identifier is present in the frame"

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Jan Just Keijser
Fabian Knittel wrote: Peter Stuge schrieb: Fabian Knittel wrote: + if (ntohs (vlanhdr.tpid) != OPENVPN_ETH_P_8021Q) +{ + /* Drop untagged frames */ + goto err; +} It would be nice to be able to use VID 0 to mean untagged packets. Hm, nice idea. I'll im

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Fabian Knittel
Fabian Knittel schrieb: > Peter Stuge schrieb: >> It would be nice to be able to use VID 0 to mean untagged packets. > > Hm, nice idea. I'll implement it in my next round of patches. I've just noticed a detail that might warrant discussion. To make sure we're talking about the same thing, this

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-04-01 Thread Fabian Knittel
Peter Stuge schrieb: > Fabian Knittel wrote: >> + if (ntohs (vlanhdr.tpid) != OPENVPN_ETH_P_8021Q) >> +{ >> + /* Drop untagged frames */ >> + goto err; >> +} > > It would be nice to be able to use VID 0 to mean untagged packets. Hm, nice idea. I'll implement it in my next roun

Re: [Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-03-31 Thread Peter Stuge
Fabian Knittel wrote: > + if (ntohs (vlanhdr.tpid) != OPENVPN_ETH_P_8021Q) > +{ > + /* Drop untagged frames */ > + goto err; > +} It would be nice to be able to use VID 0 to mean untagged packets. //Peter

[Openvpn-devel] [PATCH 4/9] vlan: Prepend and remove VLAN identifiers on outgoing and incoming frames

2010-03-31 Thread Fabian Knittel
This patch adds parsing of the IEEE 802.1Q headers for incoming and outgoing ethernet frames. For frames coming in from the tap interface, the 802.1Q header is parsed and translated into a regular Ethernet II header. Note that the Priority Code Point (PCP) and Canonical Format Indicator (CFI) fie