Page MenuHomeFreeBSD

bridge: make 802.1ad (Q-in-Q) configurable
ClosedPublic

Authored by ivy on Jul 9 2025, 6:41 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Oct 11, 3:16 AM
Unknown Object (File)
Sat, Oct 11, 3:16 AM
Unknown Object (File)
Sat, Oct 11, 3:16 AM
Unknown Object (File)
Sat, Oct 11, 3:16 AM
Unknown Object (File)
Fri, Oct 10, 8:25 PM
Unknown Object (File)
Fri, Oct 10, 2:48 AM
Unknown Object (File)
Mon, Sep 22, 12:58 AM
Unknown Object (File)
Sep 12 2025, 7:01 AM

Details

Summary

Allowing tag stacking by default can permit VLAN-hopping attacks in
certain configurations. To mitigate this, disallow sending Q-in-Q
frames by default unless the new "qinq" option is enabled on the
interface. The bridge flag "defqinq" can be used to restore the
previous behaviour of allowing Q-in-Q on all interfaces.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

ivy requested review of this revision.Jul 9 2025, 6:41 PM

With this typo fixed (either way) the manual page change appears consistent with the change summary.

share/man/man4/bridge.4
555 ↗(On Diff #158232)

or maybe "not the interface receiving..."

This revision is now accepted and ready to land.Jul 10 2025, 12:42 AM
This revision now requires review to proceed.Jul 11 2025, 3:03 AM
share/man/man4/bridge.4
555 ↗(On Diff #158232)

to keep plural agreement i changed this to "the interface", which i think is what i meant to write originally.

This revision is now accepted and ready to land.Jul 31 2025, 2:34 PM
This revision was automatically updated to reflect the committed changes.