net/bridge/br_device.c | 1 +
net/bridge/br_input.c | 4 ++++
net/bridge/br_private.h | 1 +
net/bridge/br_sysfs_br.c | 23 +++++++++++++++++++++++
4 files changed, 29 insertions(+), 0 deletions(-)
@@ -364,6 +364,7 @@ void br_dev_setup(struct net_device *dev)
br->bridge_hello_time = br->hello_time = 2 * HZ;
br->bridge_forward_delay = br->forward_delay = 15 * HZ;
br->ageing_time = 300 * HZ;
+ br->pae_forward = false;
br_netfilter_rtable_init(br);
br_stp_timer_init(br);
@@ -168,6 +168,10 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0)
goto forward;
+ /* Check if PAE frame should be forwarded */
+ if (p->br->pae_forward && dest[5] == 3)
+ goto forward;
+
if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
NULL, br_handle_local_finish)) {
return RX_HANDLER_CONSUMED; /* consumed by filter */
@@ -215,6 +215,7 @@ struct net_bridge
unsigned char topology_change;
unsigned char topology_change_detected;
+ bool pae_forward;
#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
unsigned char multicast_router;
@@ -646,6 +646,28 @@ static DEVICE_ATTR(nf_call_arptables, S_IRUGO | S_IWUSR,
show_nf_call_arptables, store_nf_call_arptables);
#endif
+static ssize_t show_pae_forward(struct device *d, struct
device_attribute *attr,
+ char *buf)
+{
+ struct net_bridge *br = to_bridge(d);
+ return sprintf(buf, "%d\n", br->pae_forward);
+}
+
+static int set_pae_forward(struct net_bridge *br, unsigned long val)
+{
+ br->pae_forward = val ? true : false;
+ return 0;
+}
+
+static ssize_t store_pae_forward(struct device *d,
+ struct device_attribute *attr, const char *buf,
+ size_t len)
+{
+ return store_bridge_parm(d, buf, len, set_pae_forward);
+}
+static DEVICE_ATTR(pae_forward, S_IRUGO | S_IWUSR, show_pae_forward,
+ store_pae_forward);
+
static struct attribute *bridge_attrs[] = {
&dev_attr_forward_delay.attr,
Control the forwarding of 802.1x EAPOL frames destined for the 802.1x PAE group mac address. These diffs do not change the current forwarding behaviour of bridge.ko. If the sysfs bridge/pae_forward attribute is set, then frames destined to the 802.1x PAE group address will be forwarded. This functionality is required so that virtual machines running an 802.1x Supplicant can authenticate to an external 802.1x Authenticator. Signed-off-by: Nick Carter <ncarter100@gmail.com> &dev_attr_hello_time.attr, @@ -665,6 +687,7 @@ static struct attribute *bridge_attrs[] = { &dev_attr_gc_timer.attr, &dev_attr_group_addr.attr, &dev_attr_flush.attr, + &dev_attr_pae_forward.attr, #ifdef CONFIG_BRIDGE_IGMP_SNOOPING &dev_attr_multicast_router.attr, &dev_attr_multicast_snooping.attr, -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html