wireless: always enable bpdu filter for AP interfaces and VLANs

Regular AP/VLAN interfaces using 3-address modes should transmit any
STP packets, since devices behind them can not be part of any working bridge
topology. Enable a feature that drops any incoming or outgoing STP packets.
This does not apply to WDS AP VLAN or client mode interfaces, since they
could act as a proper bridge link

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/device.h b/device.h
index 4f80caa870ffe767b9633157d0d1ac7cd68d975a..88cce9ad6552a5d43cc18c4788a207f4e2fef761 100644 (file)
--- a/device.h
+++ b/device.h
@@ -244,6 +244,7 @@ struct device {
        bool wireless;
        bool wireless_ap;
        bool wireless_isolate;
+       bool bpdu_filter;
 
        struct interface *config_iface;
 

diff --git a/system-linux.c b/system-linux.c
index 85942a546d3e75e88fe66a5bc9e7fc21e9b8ae81..355bf6936d421bbfd520fa9ecd1609307ca75861 100644 (file)
--- a/system-linux.c
+++ b/system-linux.c
@@ -404,6 +404,11 @@ static void system_bridge_set_hairpin_mode(struct device *dev, const char *val)
        system_set_dev_sysctl("/sys/class/net/%s/brport/hairpin_mode", dev->ifname, val);
 }
 
+static void system_bridge_set_bpdu_filter(struct device *dev, const char *val)
+{
+       system_set_dev_sysctl("/sys/class/net/%s/brport/bpdu_filter", dev->ifname, val);
+}
+
 static void system_bridge_set_isolated(struct device *dev, const char *val)
 {
        system_set_dev_sysctl("/sys/class/net/%s/brport/isolated", dev->ifname, val);
@@ -893,6 +898,9 @@ retry:
            dev->settings.isolate)
                system_bridge_set_isolated(dev, "1");
 
+       if (dev->bpdu_filter)
+               system_bridge_set_bpdu_filter(dev, dev->bpdu_filter ? "1" : "0");
+
        return ret;
 }
 

diff --git a/wireless.c b/wireless.c
index a8fd9dd09295fc5d4315ac6ba1922be05e82e3db..61125a489259a99309dbce9c2e1c101c2797bef0 100644 (file)
--- a/wireless.c
+++ b/wireless.c
@@ -332,6 +332,7 @@ static void wireless_interface_handle_link(struct wireless_interface *vif, const
                        dev->wireless_isolate = vif->isolate;
                        dev->wireless = true;
                        dev->wireless_ap = vif->ap_mode;
+                       dev->bpdu_filter = dev->wireless_ap && ifname == vif->ifname;
                }
        }
 
@@ -362,6 +363,7 @@ static void wireless_vlan_handle_link(struct wireless_vlan *vlan, bool up)
                        dev->wireless_isolate = vlan->isolate;
                        dev->wireless = true;
                        dev->wireless_ap = true;
+                       dev->bpdu_filter = true;
                }
        }