netdev - [RFC] bridge: if no STP then forward all BPDU's

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070424161226.0372f5e8@dxpl.pdx.osdl.net>
Date:	Tue, 24 Apr 2007 16:12:26 -0700
From:	Stephen Hemminger <shemminger@...ux-foundation.org>
To:	netdev@...r.kernel.org
Subject: [RFC] bridge: if no STP then forward all BPDU's

The bridge code by default captures all spanning tree packets and
doesn't forward them. I propose that this might not be a good idea.

If a bridge is not running STP, then it has no way to detect a cycle
in the network (by itself). But if some other machine is running STP,
then if STP BPDU's get forwarded to the STP can detect the cycle
(and turn off that link).  

              +------------+ <-BPDU-  +--------+
              | transparent|==========| STP    |
              |  bridge    |==========| bridge |=== ...
              +------------+ -BPDU->  +--------+

Signed-off-by: Stephen Hemminger <shemminger@...ux-foundation.org>
---
 net/bridge/br_input.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- bridge-2.6.22.orig/net/bridge/br_input.c
+++ bridge-2.6.22/net/bridge/br_input.c
@@ -131,8 +131,16 @@ struct sk_buff *br_handle_frame(struct n
 	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
 		goto drop;

-	if (unlikely(is_link_local(dest))) {
-		skb->pkt_type = PACKET_HOST;
+	/*
+	 * If STP is running, then trap all link-local (802.1x) frames
+	 * process through normal receive path.
+	 *
+	 * For safety, if not running STP then act as a completely transparent
+	 * device. This means that if STP is running on another machine, it
+	 * can still detect cycles.
+	 */
+	if (p->br->stp_enabled != BR_NO_STP && is_link_local(dest)) {
+		/* skb->pkt_type should already be PACKET_MULTICAST */

 		return (NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
 				NULL, br_handle_local_finish) == 0) ? skb : NULL;
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html