From: Johannes Berg <johannes@sipsolutions.net>
To: Stephen Hemminger <shemminger@linux-foundation.org>
Cc: netdev <netdev@vger.kernel.org>, bridge <bridge@linux-foundation.org>
Subject: [RFC] bridging: don't forward EAPOL frames
Date: Thu, 22 Nov 2007 14:23:28 +0100 [thread overview]
Message-ID: <1195737808.6323.102.camel@johannes.berg> (raw)
This patch makes the bridging code drop EAPOL frames as recommended by
802.1X-2004 in C.3.3.
Is this really the right place to put it?
---
include/linux/if_ether.h | 1 +
include/net/ieee80211.h | 6 ------
net/bridge/br_input.c | 3 +++
3 files changed, 4 insertions(+), 6 deletions(-)
--- everything.orig/include/linux/if_ether.h 2007-11-22 11:47:14.178686360 +0100
+++ everything/include/linux/if_ether.h 2007-11-22 11:48:21.438679036 +0100
@@ -74,6 +74,7 @@
#define ETH_P_ATMFATE 0x8884 /* Frame-based ATM Transport
* over Ethernet
*/
+#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
#define ETH_P_AOE 0x88A2 /* ATA over Ethernet */
#define ETH_P_TIPC 0x88CA /* TIPC */
--- everything.orig/include/net/ieee80211.h 2007-11-22 11:46:29.908682888 +0100
+++ everything/include/net/ieee80211.h 2007-11-22 11:48:51.908679037 +0100
@@ -183,12 +183,6 @@ const char *escape_essid(const char *ess
#endif
#include <net/iw_handler.h> /* new driver API */
-#ifndef ETH_P_PAE
-#define ETH_P_PAE 0x888E /* Port Access Entity (IEEE 802.1X) */
-#endif /* ETH_P_PAE */
-
-#define ETH_P_PREAUTH 0x88C7 /* IEEE 802.11i pre-authentication */
-
#ifndef ETH_P_80211_RAW
#define ETH_P_80211_RAW (ETH_P_ECONET + 1)
#endif
--- everything.orig/net/bridge/br_input.c 2007-11-22 11:54:44.798683106 +0100
+++ everything/net/bridge/br_input.c 2007-11-22 11:57:23.248680285 +0100
@@ -145,6 +145,9 @@ struct sk_buff *br_handle_frame(struct n
}
}
+ if (unlikely(skb->protocol = htons(ETH_P_PAE)))
+ goto drop;
+
switch (p->state) {
case BR_STATE_FORWARDING:
next reply other threads:[~2007-11-22 13:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-11-22 13:23 Johannes Berg [this message]
2007-11-26 17:36 ` [RFC] bridging: don't forward EAPOL frames Stephen Hemminger
2007-11-27 13:24 ` Johannes Berg
2007-11-27 15:24 ` [Bridge] " Andy Gospodarek
2007-11-27 15:28 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1195737808.6323.102.camel@johannes.berg \
--to=johannes@sipsolutions.net \
--cc=bridge@linux-foundation.org \
--cc=netdev@vger.kernel.org \
--cc=shemminger@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox