bridge: add root port blocking
authorstephen hemminger <shemminger@vyatta.com>
Tue, 13 Nov 2012 07:53:08 +0000 (07:53 +0000)
committerDavid S. Miller <davem@davemloft.net>
Thu, 15 Nov 2012 01:20:44 +0000 (20:20 -0500)
commit1007dd1aa50b0403df370834f647abef1722925c
treecd36018c9fa1ae353e7e27f1080950d19d44eaa5
parenta2e01a65cd7135dab26d27d4b589b2e5358bec99
bridge: add root port blocking

This is Linux bridge implementation of root port guard.
If BPDU is received from a leaf (edge) port, it should not
be elected as root port.

Why would you want to do this?
If using STP on a bridge and the downstream bridges are not fully
trusted; this prevents a hostile guest for rerouting traffic.

Why not just use netfilter?
Netfilter does not track of follow spanning tree decisions.
It would be difficult and error prone to try and mirror STP
resolution in netfilter module.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/uapi/linux/if_link.h
net/bridge/br_netlink.c
net/bridge/br_private.h
net/bridge/br_stp.c
net/bridge/br_sysfs_if.c