From 1007dd1aa50b0403df370834f647abef1722925c Mon Sep 17 00:00:00 2001 From: stephen hemminger Date: Tue, 13 Nov 2012 07:53:08 +0000 Subject: bridge: add root port blocking This is Linux bridge implementation of root port guard. If BPDU is received from a leaf (edge) port, it should not be elected as root port. Why would you want to do this? If using STP on a bridge and the downstream bridges are not fully trusted; this prevents a hostile guest for rerouting traffic. Why not just use netfilter? Netfilter does not track of follow spanning tree decisions. It would be difficult and error prone to try and mirror STP resolution in netfilter module. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller --- net/bridge/br_sysfs_if.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'net/bridge/br_sysfs_if.c') diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c index d1dfa4026185..80a4fc5d96ab 100644 --- a/net/bridge/br_sysfs_if.c +++ b/net/bridge/br_sysfs_if.c @@ -157,6 +157,7 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush); BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE); BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD); +BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK); #ifdef CONFIG_BRIDGE_IGMP_SNOOPING static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf) @@ -191,6 +192,7 @@ static const struct brport_attribute *brport_attrs[] = { &brport_attr_flush, &brport_attr_hairpin_mode, &brport_attr_bpdu_guard, + &brport_attr_root_block, #ifdef CONFIG_BRIDGE_IGMP_SNOOPING &brport_attr_multicast_router, #endif -- cgit v1.2.3