This is Linux bridge implementation of root port guard. If BPDU is received from a leaf (edge) port, it should not be elected as root port. Why would you want to do this? If using STP on a bridge and the downstream bridges are not fully trusted; this prevents a hostile guest for rerouting traffic. Why not just use netfilter? Netfilter does not track of follow spanning tree decisions. It would be difficult and error prone to try and mirror STP resolution in netfilter module.
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -217,6 +217,7 @@ enum { · 216 unmodified lines | ||
| 217 | 217 | IFLA_BRPORT_COST, /* " cost */ |
| 218 | 218 | IFLA_BRPORT_MODE, /* mode (hairpin) */ |
| 219 | 219 | IFLA_BRPORT_GUARD, /* bpdu guard */ |
| 220 | + IFLA_BRPORT_PROTECT, /* root port protection */ | |
| 220 | 221 | __IFLA_BRPORT_MAX |
| 221 | 222 | }; |
| 222 | 223 | #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1) |