bridge: Log MAC address port flapping

[zlei]

Summary

MAC flapping occurs when a bridge receives packets from different member member interfaces. The common reasons are:

• user roams from one bridge port to another
• user has wrong network setup, bridge loops e.g.
• someone set duplicated ethernet address on his/her nic
• some bad guy / virus / trojan send spoofed packets

The current implementation updates bridge routing entry silently hence it is hard to diagnose when any of them happen.

Emit logs when MAC address port flapping occurs so that it will be easy to diagnose.

MFC after: 2 weeks

[zlei]

sys/net/if_bridge.c

2868

TODO: need rate limit ?? In case of DoS, system will have huge amount of logs.

[kp]

sys/net/if_bridge.c

2868

The usual approach is to use ppsratecheck(9).

[kp]

Overall that seems like a good idea.

Perhaps phrase it as "bridge0: MAC address A vlan 42 moved from em0 to em2"?

[zlei]

In D39375#896269, @kp wrote:

Overall that seems like a good idea.

Perhaps phrase it as "bridge0: MAC address A vlan 42 moved from em0 to em2"?

Agreed.
"flap from .. to .." sounds bad grammar. But only "is flapping" is less useful.

sys/net/if_bridge.c

2868

I'll try ppsratecheck(9) and test.

[zlei]

Added ppsratecheck() to suppress logs

[kp]

sys/net/if_bridge.c

470

They're static, so this is probably fine.

[zlei]

sys/net/if_bridge.c

2875

I'll re-check obif. It is not lock protected when referenced by log().

[kp]

sys/net/if_bridge.c

2875

It's safe to dereference obif here. It's managed by epoch, so will remain valid while we're in NET_EPOCH. It will only get deleted by bridge_rtnode_destroy_cb() once it can no longer be in use.

[zlei]

sys/net/if_bridge.c

470

That's OK.

2875

I checked all callers, bridge_rtupdate() is indeed in NET_EPOCH. The assert BRIDGE_LOCK_OR_NET_EPOCH_ASSERT in bridge_rtupdate() is misleading.

[zlei]

sys/net/if_bridge.c

464

log_mac_flap is actually boolean.

[zlei]

sys/net/if_bridge.c

467

No need for CTLFLAG_TUN .

[zlei]

I updated the SUMMARY to have a better explaining.

Do you have any suggestions ? @kp

[kp]

In D39375#898104, @zlei wrote:

Do you have any suggestions ? @kp

I might rephrase "MAC flapping occurs when a bridge receives packets from different member member interfaces. " as "MAC flapping occurs when a bridge receives packets with the same source MAC address on different member member interfaces.", but it's ready to land as-is too.

[zlei]

In D39375#898123, @kp wrote:

In D39375#898104, @zlei wrote:

Do you have any suggestions ? @kp

I might rephrase "MAC flapping occurs when a bridge receives packets from different member member interfaces. " as "MAC flapping occurs when a bridge receives packets with the same source MAC address on different member member interfaces.", but it's ready to land as-is too.

Good catch!