[BRIDGE]: prevent bad forwarding table updates

Avoid poisoning of the bridge forwarding table by frames that have been
dropped by filtering. This prevents spoofed source addresses on hostile
side of bridge from causing packet leakage, a small but possible security
risk.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 3 insertions, 0 deletions

diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index b91a875aca0..d071f1c9ad0 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -140,6 +140,9 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
         struct net_bridge *br = p->br;
         unsigned char *buf;
 
+        /* insert into forwarding database after filtering to avoid spoofing */
+        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+
         /* need at least the 802 and STP headers */
         if (!pskb_may_pull(skb, sizeof(header)+1) ||
             memcmp(skb->data, header, sizeof(header)))