From patchwork Tue Jun 28 18:34:57 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Nick Carter X-Patchwork-Id: 102443 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id AE9B1B6F62 for ; Wed, 29 Jun 2011 04:44:55 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757313Ab1F1SfW (ORCPT ); Tue, 28 Jun 2011 14:35:22 -0400 Received: from mail-pw0-f46.google.com ([209.85.160.46]:49050 "EHLO mail-pw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760801Ab1F1Se6 convert rfc822-to-8bit (ORCPT ); Tue, 28 Jun 2011 14:34:58 -0400 Received: by pwj7 with SMTP id 7so320084pwj.19 for ; Tue, 28 Jun 2011 11:34:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=AQVT/tZ8r0eP/V1joqwrTu7jTZjF+S2pQHXW97ELki4=; b=TGnfVjtGBBavbTZKoO5H7Ck3OyiO7VfxaOjThnanHdxMFOfhNrR3dZ9qBzU6xWE9nw 5v8F2H7jqBDRtmHRQzsoQrpIpDbGLRwQVgVai+QgEkEETc414vfe9B0SdOprIA95wyYq wQgwEvaW29Wxh3YCQXBPocCAiOKB902YLcp90= MIME-Version: 1.0 Received: by 10.68.64.8 with SMTP id k8mr970924pbs.148.1309286097245; Tue, 28 Jun 2011 11:34:57 -0700 (PDT) Received: by 10.68.47.161 with HTTP; Tue, 28 Jun 2011 11:34:57 -0700 (PDT) In-Reply-To: <20110628160018.GC126252@jupiter.n2.diac24.net> References: <20110623152929.3f94b3e7@nehalam.ftrdhcpuser.net> <20110624120859.3c43bbcb@nehalam.ftrdhcpuser.net> <20110628150257.GB126252@jupiter.n2.diac24.net> <20110628081015.1b06a3f0@nehalam.ftrdhcpuser.net> <20110628160018.GC126252@jupiter.n2.diac24.net> Date: Tue, 28 Jun 2011 19:34:57 +0100 Message-ID: Subject: Re: [PATCH] bridge: Forward EAPOL Kconfig option BRIDGE_PAE_FORWARD From: Nick Carter To: David Lamparter Cc: Stephen Hemminger , netdev@vger.kernel.org, davem@davemloft.net Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 28 June 2011 17:00, David Lamparter wrote: > On Tue, Jun 28, 2011 at 08:10:15AM -0700, Stephen Hemminger wrote: >> On Tue, 28 Jun 2011 17:02:57 +0200 >> David Lamparter wrote: >> > >   if (skb) { >> > > +         /* Prevent Crosstalk where a Supplicant on one Port attempts to >> > > +          * interfere with authentications occurring on another Port. >> > > +          * (IEEE Std 802.1X-2001 C.3.3) >> > > +          */ >> > > +         if (unlikely(!br->pae_forward && >> > > +             skb->protocol == htons(ETH_P_PAE))) >> > >> > No, please don't. >> > >> > Linux bridging has two "grand" modes: dumb and STP enabled. >> > >> > If we're running a dumb bridge, we behave like an ethernet hub without >> > any intelligence, and in that case we should absolutely forward 802.1X >> > frames. We may have (e.g. VM) client(s) that want to authenticate with a >> > physical switch. >> > (For the spec, this counts as "repeater", not "bridge"/"switch") >> > >> > If we're running with STP enabled, then 802.1X traffic should already be >> > caught by the general ethernet link-local multicast drop (which applies >> > to 01:80:c2:/24 and therefore catches 802.1X too.) >> >> The problem is that STP is not enabled by default, and most people don't >> know how to enable it. > > Yes, the default is a dumb hub (IMHO correctly so). And a dumb hub will > forward 802.1X packets (IMHO also correctly so). > > Why should we specifically add a knob for EAPOL? Next we're adding one > for STP itself, then one for LLDP, then one for Cisco's deprecated > crap (CDP, DTP, ...) etc. > > If you want a dumb hub that drops EAPOL, use ebtables. > > -David > > If we are not going to have an EAPOL knob, but we are going to act as a repeater when STP is off then we still need these diffs to forward the PAE group address. (In fact we cant just act as a repeater because of the recent ethernet bonding regression) the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index 90e985b..267f581 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -163,7 +163,8 @@ struct sk_buff *br_handle_frame(struct sk_buff *skb) goto drop; /* If STP is turned off, then forward */ - if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0) + if (p->br->stp_enabled == BR_NO_STP && + (dest[5] == 0 || skb->protocol == htons(ETH_P_PAE))) goto forward; Nick -- To unsubscribe from this list: send the line "unsubscribe netdev" in