From nobody Fri Apr 21 10:11:34 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Q2r0Q4bdTz46CMY; Fri, 21 Apr 2023 10:11:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Q2r0Q35HDz3NRC; Fri, 21 Apr 2023 10:11:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682071894; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SrndkCv5XNJMNoPBbEbxGm64GvWtC9kUJ7V8L4woeM8=; b=oBSkkKN/j6CXUK5s4K4ur/BLehlkzXR3f95nhqnWQtege8jTkETlGspPSif8B3dgdbc/gp rZpPPS/HRRb7tB3vI8RxX/XdVBec2JYQ9WlQSuA6/nSYMeqn+XDW0QNH4lN0sAwMKyDZLN eTCBepyvxW/lYlJ14BWA7k386vYL4eOXN+1eBhNqEqUBKQ6uMGIJYbpJEAehZmQXQHv7L9 JdoRbUR0iFwo17aK36yLdYiqIy6oelUZfGZ7deYzv8HlN+j3wwXEghcQ1qlzsfnJBgBH4o 9Ns9XweWHfeNkrVIZxrvlCcSBWSZXmM7VtGEXAmwiZhUR5/Ptc0ObrTXHjgT8g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1682071894; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SrndkCv5XNJMNoPBbEbxGm64GvWtC9kUJ7V8L4woeM8=; b=E1XzHJHt59G2To7rsyG/FtN4g1QDASsgDv+WaaKl0Kl26JQsUSUVP5im7yPj9qENSZsTET 8NXXWfwmstvlT/QtbIdVAG3y3Ai2B/ze2rfqWnY3Q+PqR7ZBJDqZB9xTHideGL7HO+N7Yv O8l9eJXuYXWNY9imkEyYfo3k8nt2GScHCPEda+i35CsNNpF6fyCWDJFOlBxFz2Y4F8dM6X M9c7sUJbGtGZ/A4mkTlMXHFX+ZR6wXqfwablt2RGxiZZEwAbIcjVfM+fbk50wNn0nEZXnT NAXVjHIVro+JUgW4VlRB28R3/df99l1Ha3QWyFsIwbYK1A51nkuQ70sYkicO1g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1682071894; a=rsa-sha256; cv=none; b=KT7UTthOL09z9arZ/pFgS5U4gOMa+goXZTgJ7Sslr5F6FkYYoeKXFO48vOd4iswGH24vps D4NVcP6lv1tVd02bKbwmgvwhMTHwMeNjleWmm0JVnP4JPhHfK1AyHYk2t1s2oNeRTYOwxQ 2lv3vTMH7bxmRKVc2f5tHd9qHK7HsAsFcZKEjHS2v+TlTWRyrD1IRjRMnMRkkvInINBNVP HZdUIpEkFOKmvl2oUiUg/h5QPsSo0gsLnskS1Icp16mel4ERvdd0/COhqIHzmhVDldfash e33MmVCqRWq6CjLRN4Se7I9o+xDrkBhyUWRQsMFBo1VzMKkP8vdBiADqe6prYw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Q2r0Q26B7zGlP; Fri, 21 Apr 2023 10:11:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33LABYNJ020436; Fri, 21 Apr 2023 10:11:34 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33LABYDr020435; Fri, 21 Apr 2023 10:11:34 GMT (envelope-from git) Date: Fri, 21 Apr 2023 10:11:34 GMT Message-Id: <202304211011.33LABYDr020435@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Zhenlei Huang Subject: git: de53ebb0f20e - stable/13 - bridge: Log MAC address port flapping List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: zlei X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: de53ebb0f20e9735a6167230eb38fd4695aa9c51 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by zlei: URL: https://cgit.FreeBSD.org/src/commit/?id=de53ebb0f20e9735a6167230eb38fd4695aa9c51 commit de53ebb0f20e9735a6167230eb38fd4695aa9c51 Author: Zhenlei Huang AuthorDate: 2023-04-07 14:25:41 +0000 Commit: Zhenlei Huang CommitDate: 2023-04-21 10:10:12 +0000 bridge: Log MAC address port flapping MAC flapping occurs when a bridge receives packets with the same source MAC address on different member interfaces. The common reasons are: - user roams from one bridge port to another - user has wrong network setup, bridge loops e.g. - someone set duplicated ethernet address on his/her nic - some bad guy / virus / trojan send spoofed packets if_bridge currently updates the bridge routing entry silently hence it is hard to diagnose. Emit logs when MAC address port flapping occurs to make it easier to diagnose. Reviewed by: kp MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D39375 Differential Revision: https://reviews.freebsd.org/D39542 (cherry picked from commit 2d3614fb132b1cb8efd1e0accdd0c98ce6893efa) (cherry picked from commit 9af6f4268ac3cc8203f34c746d955b4405279099) --- sys/net/if_bridge.c | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index ef01be9c5b49..cd2fbff3a85c 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -466,6 +466,21 @@ SYSCTL_INT(_net_link_bridge, OID_AUTO, allow_llz_overlap, "Allow overlap of link-local scope " "zones of a bridge interface and the member interfaces"); +/* log MAC address port flapping */ +VNET_DEFINE_STATIC(bool, log_mac_flap) = true; +#define V_log_mac_flap VNET(log_mac_flap) +SYSCTL_BOOL(_net_link_bridge, OID_AUTO, log_mac_flap, + CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(log_mac_flap), true, + "Log MAC address port flapping"); + +VNET_DEFINE_STATIC(int, log_interval) = 5; +VNET_DEFINE_STATIC(int, log_count) = 0; +VNET_DEFINE_STATIC(struct timeval, log_last) = { 0 }; + +#define V_log_interval VNET(log_interval) +#define V_log_count VNET(log_count) +#define V_log_last VNET(log_last) + struct bridge_control { int (*bc_func)(struct bridge_softc *, void *); int bc_argsize; @@ -2745,6 +2760,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, struct bridge_iflist *bif, int setflags, uint8_t flags) { struct bridge_rtnode *brt; + struct bridge_iflist *obif; int error; BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc); @@ -2768,7 +2784,7 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, /* Check again, now that we have the lock. There could have * been a race and we only want to insert this once. */ - if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) != NULL) { + if (bridge_rtnode_lookup(sc, dst, vlan) != NULL) { BRIDGE_RT_UNLOCK(sc); return (0); } @@ -2817,12 +2833,23 @@ bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan, } if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC && - brt->brt_dst != bif) { + (obif = brt->brt_dst) != bif) { BRIDGE_RT_LOCK(sc); brt->brt_dst->bif_addrcnt--; brt->brt_dst = bif; brt->brt_dst->bif_addrcnt++; BRIDGE_RT_UNLOCK(sc); + + if (V_log_mac_flap && + ppsratecheck(&V_log_last, &V_log_count, V_log_interval)) { + log(LOG_NOTICE, + "%s: mac address %6D vlan %d moved from %s to %s\n", + sc->sc_ifp->if_xname, + &brt->brt_addr[0], ":", + brt->brt_vlan, + obif->bif_ifp->if_xname, + bif->bif_ifp->if_xname); + } } if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)