From nobody Fri Apr 07 14:26:50 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PtLKR2wzZz44hlV; Fri, 7 Apr 2023 14:26:51 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PtLKQ4QwHz3xNP; Fri, 7 Apr 2023 14:26:50 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680877610; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WUonBpIKN7R4W9L73fRWWM/rjaMJS4n2J2ePlaneCQw=; b=QQxl6btklBd8e6p5/DO6MRIPdKDhzwinsucMdeVf1V5wmK/3zhPAZpMroBm8fpcihF/frs Vp81Zkd1uzdk9DkkLZMzagbmjPAgShAhH7FFuudNVAnKhSPp5tMUMS4uYKPV4TikBbCk5G Wfdw7t3FNW4VoucjNUt9TQgWx00WLTwzku6WLOY8YKuz6G54XHgbc2N15YmCn96CBT1J+U uOtGkXCNMK+BGUPW8aHWP48Y3jKO0I//Yy0cLrlugCrdBU5yu5xHWjMSkKK2AZmsQFTDu7 7FoH1Ll/AUVwuuJAzFEAMRhv0jVSGSJl1Pji7CxYS5DlTOMiYsVEODmZvOw5Cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1680877610; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WUonBpIKN7R4W9L73fRWWM/rjaMJS4n2J2ePlaneCQw=; b=KsetsxCNd9s5TRGaaVhjSass0mcDVuItRFO9+3QY8hds4R9+/bSAM99nQPd8p8SJqaAz+z 458KPzHbXIR+NFjrlPkpQ4r04sUSwe9ZfJiOl+d+PlBx0oi7HDSbzYhuDPj5GWOGvaUnfd nwCntsUmAM5SQEXMI1OhL5xzJu0WWuwXw9uUdXONjibJyNgJZx/8VFzXVHteTHnyw6iNRk A2djERScqg/s5oU0/OX/hvg7uMCRZsPKDj08/hBMewfzV5XTxMjqja8HR9n5C6IiFDHhN7 JHfWTCkWj1Qf9u533sqpKdyXmPB4LjU1zWPEz6J+uX2IIHK7apAejTQZx+uHYA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1680877610; a=rsa-sha256; cv=none; b=RRmG+O6OZ+SPySd0Y5jYw+yfGBu8u+X7nMzgxTASHBtiFLp90vO6XR7FZI2w0ZadvRMT0X uYcbnkOPN3xFY0qd7cwMVT+lr/8yDEO3eVbT/GRjAQ2JhV/bhjhOE3FwHoZxex3wuMWoIa OqLtJJro1d/mQRxKgqQp6KcjmegzqaspThj9y/Wo/eCoP0Q64zlyMj4bSaUNw1eyweX5fl lAvCtuTjOl5xoqyY+1oWWArF1XKSIkVYg/LA7o6BRrDN1mAKucpKQ6cRGk86X92MOVDfiJ qSe2aqgyMEJSLfglF6pj1zlekaNCFvBURKfFqXCALAf9p1cEV0SO/ePYO4ijTw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PtLKQ2x9FzpKG; Fri, 7 Apr 2023 14:26:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 337EQoAO014584; Fri, 7 Apr 2023 14:26:50 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 337EQodm014583; Fri, 7 Apr 2023 14:26:50 GMT (envelope-from git) Date: Fri, 7 Apr 2023 14:26:50 GMT Message-Id: <202304071426.337EQodm014583@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Zhenlei Huang Subject: git: 2d3614fb132b - main - bridge: Log MAC address port flapping List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2d3614fb132b1cb8efd1e0accdd0c98ce6893efa Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=2d3614fb132b1cb8efd1e0accdd0c98ce6893efa commit 2d3614fb132b1cb8efd1e0accdd0c98ce6893efa Author: Zhenlei Huang AuthorDate: 2023-04-07 14:25:41 +0000 Commit: Zhenlei Huang CommitDate: 2023-04-07 14:25:41 +0000 bridge: Log MAC address port flapping MAC flapping occurs when a bridge receives packets with the same source MAC address on different member interfaces. The common reasons are: - user roams from one bridge port to another - user has wrong network setup, bridge loops e.g. - someone set duplicated ethernet address on his/her nic - some bad guy / virus / trojan send spoofed packets if_bridge currently updates the bridge routing entry silently hence it is hard to diagnose. Emit logs when MAC address port flapping occurs to make it easier to diagnose. Reviewed by: kp MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D39375 --- sys/net/if_bridge.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index 2855236e4013..78be987d681b 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -460,6 +460,21 @@ SYSCTL_INT(_net_link_bridge, OID_AUTO, allow_llz_overlap, "Allow overlap of link-local scope " "zones of a bridge interface and the member interfaces"); +/* log MAC address port flapping */ +VNET_DEFINE_STATIC(bool, log_mac_flap) = true; +#define V_log_mac_flap VNET(log_mac_flap) +SYSCTL_BOOL(_net_link_bridge, OID_AUTO, log_mac_flap, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(log_mac_flap), true, + "Log MAC address port flapping"); + +VNET_DEFINE_STATIC(int, log_interval) = 5; +VNET_DEFINE_STATIC(int, log_count) = 0; +VNET_DEFINE_STATIC(struct timeval, log_last) = { 0 }; + +#define V_log_interval VNET(log_interval) +#define V_log_count VNET(log_count) +#define V_log_last VNET(log_last) + struct bridge_control { int (*bc_func)(struct bridge_softc *, void *); int bc_argsize; @@ -2768,6 +2783,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, struct bridge_iflist *bif, int setflags, uint8_t flags) { struct bridge_rtnode *brt; + struct bridge_iflist *obif; int error; BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc); @@ -2791,7 +2807,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, /* Check again, now that we have the lock. There could have * been a race and we only want to insert this once. */ - if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) != NULL) { + if (bridge_rtnode_lookup(sc, dst, vlan) != NULL) { BRIDGE_RT_UNLOCK(sc); return (0); } @@ -2840,12 +2856,24 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, } if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC && - brt->brt_dst != bif) { + (obif = brt->brt_dst) != bif) { BRIDGE_RT_LOCK(sc); brt->brt_dst->bif_addrcnt--; brt->brt_dst = bif; brt->brt_dst->bif_addrcnt++; BRIDGE_RT_UNLOCK(sc); + + if (V_log_mac_flap && + ppsratecheck(&V_log_last, &V_log_count, V_log_interval)) { + uint8_t *addr = &brt->brt_addr[0]; + log(LOG_NOTICE, + "%s: mac address %02x:%02x:%02x:%02x:%02x:%02x vlan %d moved from %s to %s\n", + sc->sc_ifp->if_xname, + addr[0], addr[1], addr[2], addr[3], addr[4], addr[5], + brt->brt_vlan, + obif->bif_ifp->if_xname, + bif->bif_ifp->if_xname); + } } if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)