diff options
| author | stephen hemminger <shemminger@vyatta.com> | 2012-11-13 07:53:08 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-11-14 20:20:44 -0500 |
| commit | 1007dd1aa50b0403df370834f647abef1722925c (patch) | |
| tree | cd36018c9fa1ae353e7e27f1080950d19d44eaa5 /net/bridge/br_private.h | |
| parent | a2e01a65cd7135dab26d27d4b589b2e5358bec99 (diff) | |
| download | lwn-1007dd1aa50b0403df370834f647abef1722925c.tar.gz lwn-1007dd1aa50b0403df370834f647abef1722925c.zip | |
bridge: add root port blocking
This is Linux bridge implementation of root port guard.
If BPDU is received from a leaf (edge) port, it should not
be elected as root port.
Why would you want to do this?
If using STP on a bridge and the downstream bridges are not fully
trusted; this prevents a hostile guest for rerouting traffic.
Why not just use netfilter?
Netfilter does not track of follow spanning tree decisions.
It would be difficult and error prone to try and mirror STP
resolution in netfilter module.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge/br_private.h')
| -rw-r--r-- | net/bridge/br_private.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index c92b0804ff2d..eb9cd42146a5 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -136,6 +136,7 @@ struct net_bridge_port unsigned long flags; #define BR_HAIRPIN_MODE 0x00000001 #define BR_BPDU_GUARD 0x00000002 +#define BR_ROOT_BLOCK 0x00000004 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING u32 multicast_startup_queries_sent; |