Linux Ethernet Bridging - Aug 2008 - [Bridge] frame destinated to individual port MAC address

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi there,

I'm working on very strange stuff using linux kernel bridge. Anyway, I
have a quick question.

Let's say I have 2 linux machines. Each has one bridge with several
interfaces. One interface of the first bridge (say eth0) is connected to
one interface of the other bridge (say eth0 again) using an Ethernet cable.

I have not configured an IP address on the bridge itself (on purpose)
but on each individual interface in the bridge. In order to be able to
communicate with those interfaces, I use ebtable broute rules in order
for the frame entering the bridge and with destination address being the
individual interface to be routed (-j DROP). Examples:

ebtables -t broute -L
Bridge table: broute

Bridge chain: BROUTING, entries: 4, policy: ACCEPT
- -d 0:ff:7f:dc:d3:4d -j DROP
- -d 0:ff:5e:7e:a5:ac -j DROP
- -d 0:ff:22:84:70:19 -j DROP
- -d 0:ff:2:fb:4:6d -j DROP

This is working as expected. So far, so good.

Now, using rtnetlink, I changed the port state (alternating between
learning and forwarding). In the learning state, ping is no longer
working between the 2 nodes. I would expect for the ping to be still
working (since IMHO bridge itself and its port should not be subject to
the bridge filtering rules).

Disclaimer : I'm not saying that the current linux implementation is
wrong, nor 802.1d is wrong.

Questions are :
- - according to 802.1d, what should happen to a frame with a destination
address being the MAC addr of a bridge port when it enters this bridge
port? Maybe this is outside of the scope of 802.1d since this frame is
not going to be "forwarded" in any way.

- - according to the current linux implementation, would it be a problem
to accept such frame? I tried a quick patch and it seems to be working.
However, it probably broke lots of other things.

Regards,
Benoit
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIoLStOR6EySwP7oIRArf/AJ9fsLgJDQIVZTxHxug7aY1tOVq1kgCcC8Df
YX6mkkkvhBx43tho8V1cWaI=dztT
-----END PGP SIGNATURE-----

On Mon, 11 Aug 2008 23:52:45 +0200
Benoit PAPILLAULT <benoit.papillault at free.fr> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi there,
> 
> I'm working on very strange stuff using linux kernel bridge. Anyway, I
> have a quick question.
> 
> Let's say I have 2 linux machines. Each has one bridge with several
> interfaces. One interface of the first bridge (say eth0) is connected to
> one interface of the other bridge (say eth0 again) using an Ethernet cable.
> 
> I have not configured an IP address on the bridge itself (on purpose)
> but on each individual interface in the bridge. In order to be able to
> communicate with those interfaces, I use ebtable broute rules in order
> for the frame entering the bridge and with destination address being the
> individual interface to be routed (-j DROP). Examples:
> 
> ebtables -t broute -L
> Bridge table: broute
> 
> Bridge chain: BROUTING, entries: 4, policy: ACCEPT
> - -d 0:ff:7f:dc:d3:4d -j DROP
> - -d 0:ff:5e:7e:a5:ac -j DROP
> - -d 0:ff:22:84:70:19 -j DROP
> - -d 0:ff:2:fb:4:6d -j DROP
> 
> This is working as expected. So far, so good.
> 
> Now, using rtnetlink, I changed the port state (alternating between
> learning and forwarding). In the learning state, ping is no longer
> working between the 2 nodes. I would expect for the ping to be still
> working (since IMHO bridge itself and its port should not be subject to
> the bridge filtering rules).
> 
> Disclaimer : I'm not saying that the current linux implementation is
> wrong, nor 802.1d is wrong.
> 
> Questions are :
> - - according to 802.1d, what should happen to a frame with a destination
> address being the MAC addr of a bridge port when it enters this bridge
> port? Maybe this is outside of the scope of 802.1d since this frame is
> not going to be "forwarded" in any way.
> 
> - - according to the current linux implementation, would it be a problem
> to accept such frame? I tried a quick patch and it seems to be working.
> However, it probably broke lots of other things.
>
You are doing things in a very non-standard way by putting IP addresses
on each interface. This then leads to problems.  Don't do it.

If port is not forwarding, it needs to ignore the frame to prevent routing
loops. 

Rather than an ask a detailed question like "what will happen if I
misconfigure
the system, then change the behaviour", instead start a discussion about
your requirements. Like "I need to forward only frames from some MAC
addresses
in a firewall".  The answer might not involve bridging at all...