netdev - Re: [PATCH] bridge: Forward EAPOL Kconfig option BRIDGE_PAE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 1 Jul 2011 16:58:56 +0200
From:	Michał Mirosław <mirqus@...il.com>
To:	David Lamparter <equinox@...c24.net>
Cc:	Stephen Hemminger <shemminger@...ux-foundation.org>,
	Nick Carter <ncarter100@...il.com>, netdev@...r.kernel.org,
	davem@...emloft.net
Subject: Re: [PATCH] bridge: Forward EAPOL Kconfig option BRIDGE_PAE_FORWARD

2011/7/1 David Lamparter <equinox@...c24.net>:
> On Wed, Jun 29, 2011 at 04:34:23PM -0700, Stephen Hemminger wrote:
>> The problem is that the damn 802.1 committees keep loading up protocols
>> on the same multicast address range. Trying to solve a design committee
>> problem in the kernel is not going to make anybody happy.
>>
>> I am happy with the simple solution of:
>>   no STP == Hub
>>   STP    == Bridge
>> These are both well know configurations and are blessed by standards.
>
> I agree, that is how we should behave by default, and we'll match most
> admin's expectations.
>
> Regarding multicast groups, I would summarise like this:
> 1. any multicast gets forwarded by default,
>  2. unless it is 01:80:c2:00:00:01 or :02 (pause/bonding)
>    (this rule applies regardless of STP state)
>  3. if STP is on:
>  4. 01:80:c2:00:00:00 (STP) never gets forwarded
>  5. 01:80:c2:00:00:03-0f don't get forwarded by default
>
> What we can do is add a switch to disable the #5 rule. The way I see it
> is that that switch would remove an exception from the rule and turn it
> back to the default #1; that's acceptable for making a new knob in my
> eyes.
>
> (Adding an 802.1X knob would be an exception to the exception for me,
> which is why I'm against it.)
>
> I'll cook up a patch in a few minutes, we really need to get rule #2
> right anyway. We _MUST_NOT_ pass bonding frames in any case, but we
> currently do that if STP is off. (cf. my earlier patch 1/2)

If you use linux box as a (invisible) L2 network tap, then you want to
pass everything in the hub mode (including LACP/whatever).

Best Regards,
Michał Mirosław
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html