aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorGravatar David Bauer <mail@david-bauer.net> 2024-04-18 15:29:08 +0200
committerGravatar David S. Miller <davem@davemloft.net> 2024-04-19 12:54:33 +0100
commitf58f45c1e5b92975e91754f5407250085a6ae7cf (patch)
treedcbdc060f1c381656b24f5a68941b4aee940b7a9 /net
parentnet: libwx: fix alloc msix vectors failed (diff)
downloadlinux-f58f45c1e5b92975e91754f5407250085a6ae7cf.tar.gz
linux-f58f45c1e5b92975e91754f5407250085a6ae7cf.tar.bz2
linux-f58f45c1e5b92975e91754f5407250085a6ae7cf.zip
vxlan: drop packets from invalid src-address
The VXLAN driver currently does not check if the inner layer2 source-address is valid. In case source-address snooping/learning is enabled, a entry in the FDB for the invalid address is created with the layer3 address of the tunnel endpoint. If the frame happens to have a non-unicast address set, all this non-unicast traffic is subsequently not flooded to the tunnel network but sent to the learnt host in the FDB. To make matters worse, this FDB entry does not expire. Apply the same filtering for packets as it is done for bridges. This not only drops these invalid packets but avoids them from being learnt into the FDB. Fixes: d342894c5d2f ("vxlan: virtual extensible lan") Suggested-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: David Bauer <mail@david-bauer.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions