[PATCH] prevent bad forwarding table updates

Avoid poisoning of the bridge forwarding table by frames that have been
dropped by filtering. This prevents spoofed source addresses on hostile
side of bridge from causing packet leakage, a small but possible security
risk.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 943d5ddc5f26e626031b0ab0a0865b9685474fe2..0c4a8aa0375f46e38cf8c4c60faabbb906ac7a2b 100644 (file)
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -54,6 +54,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
        struct net_bridge_fdb_entry *dst;
        int passedup = 0;
 
+       /* insert into forwarding database after filtering to avoid spoofing */
+       br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
+
        if (br->dev->flags & IFF_PROMISC) {
                struct sk_buff *skb2;
 
@@ -108,8 +111,7 @@ int br_handle_frame(struct net_bridge_port *p, struct sk_buff **pskb)
        if (eth_hdr(skb)->h_source[0] & 1)
                goto err;
 
-       if (p->state == BR_STATE_LEARNING ||
-           p->state == BR_STATE_FORWARDING)
+       if (p->state == BR_STATE_LEARNING)
                br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
 
        if (p->br->stp_enabled &&

diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index b91a875aca01c23f0b37b7916cad225e0c5f9fe5..f62e08d68658348dbd66f7df2ed3eb67dbd76630 100644 (file)
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -140,6 +140,9 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
        struct net_bridge *br = p->br;
        unsigned char *buf;
 
+       /* insert into forwarding database after filtering to avoid spoofing */
+       br_fdb_insert(p->br, p, eth_hdr(skb)->h_source, 0);
+
        /* need at least the 802 and STP headers */
        if (!pskb_may_pull(skb, sizeof(header)+1) ||
            memcmp(skb->data, header, sizeof(header)))