Subject: Re: [PATCH 2/2] bridge: allow forwarding some link local frames

From: Benjamin Poirier <[email-masked]>
Date: Tue, 4 Oct 2011 15:11:01 -0400

On 11-10-03 21:14, Stephen Hemminger wrote:
> This is based on an earlier patch by Nick Carter with comments
> by David Lamparter but with some refinements. Thanks for their patience
> this is a confusing area with overlap of standards, user requirements,
> and compatibility with earlier releases.
> 
> It adds a new sysfs attribute 
>    /sys/class/net/brX/bridge/group_fwd_mask
> that controls forwarding of frames with address of: 01-80-C2-00-00-0X
> The default setting has no forwarding to retain compatibility.
> 
> One change from earlier releases is that forwarding of group
> addresses is not dependent on STP being enabled or disabled. This
> choice was made based on interpretation of tie 802.1 standards.
> I expect complaints will arise because of this, but better to follow
> the standard than continue acting incorrectly by default.
> 
> The filtering mask is writeable, but only values that don't forward
> known control frames are allowed. It intentionally blocks attempts
> to filter control protocols. For example: writing a 8 allows
> forwarding 802.1X PAE addresses which is the most common request.
> 

Indeed, I have tested this patch with kvm + tap + bridge to
authenticate/authorize a virtual machine connected to a 802.1X enabled
switch. It works swell.

Tested-by: Benjamin Poirier <[email-masked]>