[Bridge] Re: [RFC] bridging: don't forward EAPOL frames

Johannes Berg johannes at sipsolutions.net
Tue Nov 27 05:24:13 PST 2007


> > +	if (unlikely(skb->protocol = htons(ETH_P_PAE)))
> > +		goto drop;
> > +
> >  	switch (p->state) {
> >  	case BR_STATE_FORWARDING:
> 
> Not needed because the bridge is already handling it:
> 
> 1) If running STP (ie true bridge), then all link local multicast is only received by
> the bridge and never forwarded.

Well, typical access point setups bridge the wireless AP interface with
wired, EAPOL frames can be unicast (and 802.11 specifies to do so) and
we want to avoid having them unicast to another host.

Also, 802.1X in C.3.3 recommends not bridging the *ethertype* rather
than depending on the link-local multicast address because otherwise
eapol frames can be unicast into the network behind the (authorized)
port which is undesirable.

johannes
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 828 bytes
Desc: This is a digitally signed message part
Url : http://lists.linux-foundation.org/pipermail/bridge/attachments/20071127/07ecdc32/attachment.pgp


More information about the Bridge mailing list