target/linux/generic/hack-4.9/640-bridge-only-accept-EAP-locally.patch

   1 From c6905cfdeb31a5c049db3da434b10fa0d3e83569 Mon Sep 17 00:00:00 2001
   2 From: Felix Fietkau <nbd@nbd.name>
   3 Date: Fri, 7 Jul 2017 17:18:54 +0200
   4 Subject: bridge: only accept EAP locally
   5
   6 When bridging, do not forward EAP frames to other ports, only deliver
   7 them locally, regardless of the state.
   8
   9 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  10 ---
  11  net/bridge/br_input.c | 7 +++++--
  12  1 file changed, 5 insertions(+), 2 deletions(-)
  13
  14 diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
  15 index 267b46af407f..48fa08f32c2a 100644
  16 --- a/net/bridge/br_input.c
  17 +++ b/net/bridge/br_input.c
  18 @@ -164,11 +164,14 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
  19                 }
  20         }
  21
  22 +       BR_INPUT_SKB_CB(skb)->brdev = br->dev;
  23 +
  24 +       if (skb->protocol == htons(ETH_P_PAE))
  25 +               return br_pass_frame_up(skb);
  26 +
  27         if (p->state == BR_STATE_LEARNING)
  28                 goto drop;
  29
  30 -       BR_INPUT_SKB_CB(skb)->brdev = br->dev;
  31 -
  32         if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP))
  33                 br_do_proxy_arp(skb, br, vid, p);
  34
  35 --
  36 2.11.0
  37