• stephen hemminger's avatar
    bridge: add root port blocking · 1007dd1a
    stephen hemminger authored
    This is Linux bridge implementation of root port guard.
    If BPDU is received from a leaf (edge) port, it should not
    be elected as root port.
    
    Why would you want to do this?
    If using STP on a bridge and the downstream bridges are not fully
    trusted; this prevents a hostile guest for rerouting traffic.
    
    Why not just use netfilter?
    Netfilter does not track of follow spanning tree decisions.
    It would be difficult and error prone to try and mirror STP
    resolution in netfilter module.
    Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    1007dd1a
br_netlink.c 7.7 KB