Re: [RFC 1/2] net: bridge: add knob for filtering rx/tx BPDU packets on a port

[Stephen Hemminger <stephen@networkplumber.org>]

On Thu, 10 Feb 2022 16:55:40 +0200
Nikolay Aleksandrov <nikolay@nvidia.com> wrote:

> On 10/02/2022 16:24, Felix Fietkau wrote:
> > Some devices (e.g. wireless APs) can't have devices behind them be part of
> > a bridge topology with redundant links, due to address limitations.
> > Additionally, broadcast traffic on these devices is somewhat expensive, due to
> > the low data rate and wakeups of clients in powersave mode.
> > This knob can be used to ensure that BPDU packets are never sent or forwarded
> > to/from these devices
> > 
> > Signed-off-by: Felix Fietkau <nbd@nbd.name>
> > ---
> >  include/linux/if_bridge.h    | 1 +
> >  include/uapi/linux/if_link.h | 1 +
> >  net/bridge/br_forward.c      | 5 +++++
> >  net/bridge/br_input.c        | 2 ++
> >  net/bridge/br_netlink.c      | 6 +++++-
> >  net/bridge/br_stp_bpdu.c     | 9 +++++++--
> >  net/core/rtnetlink.c         | 4 +++-
> >  7 files changed, 24 insertions(+), 4 deletions(-)
> >   
> 
> Why can't netfilter or tc be used to filter these frames?
> 
> 

It could but this looks better.
BPDU filter matches what other hardware switch vendors offer and
has the benefit of not adding another layer of complexity into
user configurations.

Adding one rule into a complex firewall or starting to have to
configure tc is a mess.