br_forward.c 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Forwarding decision
  4. * Linux ethernet bridge
  5. *
  6. * Authors:
  7. * Lennert Buytenhek <buytenh@gnu.org>
  8. */
  9. #include <linux/err.h>
  10. #include <linux/slab.h>
  11. #include <linux/kernel.h>
  12. #include <linux/netdevice.h>
  13. #include <linux/netpoll.h>
  14. #include <linux/skbuff.h>
  15. #include <linux/if_vlan.h>
  16. #include <linux/netfilter_bridge.h>
  17. #include "br_private.h"
  18. /* Don't forward packets to originating port or forwarding disabled */
  19. static inline int should_deliver(const struct net_bridge_port *p,
  20. const struct sk_buff *skb)
  21. {
  22. struct net_bridge_vlan_group *vg;
  23. vg = nbp_vlan_group_rcu(p);
  24. return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
  25. p->state == BR_STATE_FORWARDING && br_allowed_egress(vg, skb) &&
  26. nbp_switchdev_allowed_egress(p, skb) &&
  27. !br_skb_isolated(p, skb);
  28. }
  29. int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
  30. {
  31. skb_push(skb, ETH_HLEN);
  32. if (!is_skb_forwardable(skb->dev, skb))
  33. goto drop;
  34. br_drop_fake_rtable(skb);
  35. if (skb->ip_summed == CHECKSUM_PARTIAL &&
  36. (skb->protocol == htons(ETH_P_8021Q) ||
  37. skb->protocol == htons(ETH_P_8021AD))) {
  38. int depth;
  39. if (!__vlan_get_protocol(skb, skb->protocol, &depth))
  40. goto drop;
  41. skb_set_network_header(skb, depth);
  42. }
  43. dev_queue_xmit(skb);
  44. return 0;
  45. drop:
  46. kfree_skb(skb);
  47. return 0;
  48. }
  49. EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
  50. int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  51. {
  52. skb->tstamp = 0;
  53. return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING,
  54. net, sk, skb, NULL, skb->dev,
  55. br_dev_queue_push_xmit);
  56. }
  57. EXPORT_SYMBOL_GPL(br_forward_finish);
  58. static void __br_forward(const struct net_bridge_port *to,
  59. struct sk_buff *skb, bool local_orig)
  60. {
  61. struct net_bridge_vlan_group *vg;
  62. struct net_device *indev;
  63. struct net *net;
  64. int br_hook;
  65. vg = nbp_vlan_group_rcu(to);
  66. skb = br_handle_vlan(to->br, to, vg, skb);
  67. if (!skb)
  68. return;
  69. indev = skb->dev;
  70. skb->dev = to->dev;
  71. if (!local_orig) {
  72. if (skb_warn_if_lro(skb)) {
  73. kfree_skb(skb);
  74. return;
  75. }
  76. br_hook = NF_BR_FORWARD;
  77. skb_forward_csum(skb);
  78. net = dev_net(indev);
  79. } else {
  80. if (unlikely(netpoll_tx_running(to->br->dev))) {
  81. skb_push(skb, ETH_HLEN);
  82. if (!is_skb_forwardable(skb->dev, skb))
  83. kfree_skb(skb);
  84. else
  85. br_netpoll_send_skb(to, skb);
  86. return;
  87. }
  88. br_hook = NF_BR_LOCAL_OUT;
  89. net = dev_net(skb->dev);
  90. indev = NULL;
  91. }
  92. NF_HOOK(NFPROTO_BRIDGE, br_hook,
  93. net, NULL, skb, indev, skb->dev,
  94. br_forward_finish);
  95. }
  96. static int deliver_clone(const struct net_bridge_port *prev,
  97. struct sk_buff *skb, bool local_orig)
  98. {
  99. struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
  100. skb = skb_clone(skb, GFP_ATOMIC);
  101. if (!skb) {
  102. dev->stats.tx_dropped++;
  103. return -ENOMEM;
  104. }
  105. __br_forward(prev, skb, local_orig);
  106. return 0;
  107. }
  108. /**
  109. * br_forward - forward a packet to a specific port
  110. * @to: destination port
  111. * @skb: packet being forwarded
  112. * @local_rcv: packet will be received locally after forwarding
  113. * @local_orig: packet is locally originated
  114. *
  115. * Should be called with rcu_read_lock.
  116. */
  117. void br_forward(const struct net_bridge_port *to,
  118. struct sk_buff *skb, bool local_rcv, bool local_orig)
  119. {
  120. if (unlikely(!to))
  121. goto out;
  122. /* redirect to backup link if the destination port is down */
  123. if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
  124. struct net_bridge_port *backup_port;
  125. backup_port = rcu_dereference(to->backup_port);
  126. if (unlikely(!backup_port))
  127. goto out;
  128. to = backup_port;
  129. }
  130. if (should_deliver(to, skb)) {
  131. if (local_rcv)
  132. deliver_clone(to, skb, local_orig);
  133. else
  134. __br_forward(to, skb, local_orig);
  135. return;
  136. }
  137. out:
  138. if (!local_rcv)
  139. kfree_skb(skb);
  140. }
  141. EXPORT_SYMBOL_GPL(br_forward);
  142. static struct net_bridge_port *maybe_deliver(
  143. struct net_bridge_port *prev, struct net_bridge_port *p,
  144. struct sk_buff *skb, bool local_orig)
  145. {
  146. u8 igmp_type = br_multicast_igmp_type(skb);
  147. int err;
  148. if (!should_deliver(p, skb))
  149. return prev;
  150. if (!prev)
  151. goto out;
  152. err = deliver_clone(prev, skb, local_orig);
  153. if (err)
  154. return ERR_PTR(err);
  155. out:
  156. br_multicast_count(p->br, p, skb, igmp_type, BR_MCAST_DIR_TX);
  157. return p;
  158. }
  159. /* called under rcu_read_lock */
  160. void br_flood(struct net_bridge *br, struct sk_buff *skb,
  161. enum br_pkt_type pkt_type, bool local_rcv, bool local_orig)
  162. {
  163. struct net_bridge_port *prev = NULL;
  164. struct net_bridge_port *p;
  165. list_for_each_entry_rcu(p, &br->port_list, list) {
  166. /* Do not flood unicast traffic to ports that turn it off, nor
  167. * other traffic if flood off, except for traffic we originate
  168. */
  169. switch (pkt_type) {
  170. case BR_PKT_UNICAST:
  171. if (!(p->flags & BR_FLOOD))
  172. continue;
  173. break;
  174. case BR_PKT_MULTICAST:
  175. if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
  176. continue;
  177. break;
  178. case BR_PKT_BROADCAST:
  179. if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
  180. continue;
  181. break;
  182. }
  183. /* Do not flood to ports that enable proxy ARP */
  184. if (p->flags & BR_PROXYARP)
  185. continue;
  186. if ((p->flags & (BR_PROXYARP_WIFI | BR_NEIGH_SUPPRESS)) &&
  187. BR_INPUT_SKB_CB(skb)->proxyarp_replied)
  188. continue;
  189. prev = maybe_deliver(prev, p, skb, local_orig);
  190. if (IS_ERR(prev))
  191. goto out;
  192. }
  193. if (!prev)
  194. goto out;
  195. if (local_rcv)
  196. deliver_clone(prev, skb, local_orig);
  197. else
  198. __br_forward(prev, skb, local_orig);
  199. return;
  200. out:
  201. if (!local_rcv)
  202. kfree_skb(skb);
  203. }
  204. #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
  205. static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb,
  206. const unsigned char *addr, bool local_orig)
  207. {
  208. struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
  209. const unsigned char *src = eth_hdr(skb)->h_source;
  210. if (!should_deliver(p, skb))
  211. return;
  212. /* Even with hairpin, no soliloquies - prevent breaking IPv6 DAD */
  213. if (skb->dev == p->dev && ether_addr_equal(src, addr))
  214. return;
  215. skb = skb_copy(skb, GFP_ATOMIC);
  216. if (!skb) {
  217. dev->stats.tx_dropped++;
  218. return;
  219. }
  220. if (!is_broadcast_ether_addr(addr))
  221. memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN);
  222. __br_forward(p, skb, local_orig);
  223. }
  224. /* called with rcu_read_lock */
  225. void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
  226. struct sk_buff *skb,
  227. bool local_rcv, bool local_orig)
  228. {
  229. struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
  230. struct net_bridge *br = netdev_priv(dev);
  231. struct net_bridge_port *prev = NULL;
  232. struct net_bridge_port_group *p;
  233. bool allow_mode_include = true;
  234. struct hlist_node *rp;
  235. rp = rcu_dereference(hlist_first_rcu(&br->router_list));
  236. if (mdst) {
  237. p = rcu_dereference(mdst->ports);
  238. if (br_multicast_should_handle_mode(br, mdst->addr.proto) &&
  239. br_multicast_is_star_g(&mdst->addr))
  240. allow_mode_include = false;
  241. } else {
  242. p = NULL;
  243. }
  244. while (p || rp) {
  245. struct net_bridge_port *port, *lport, *rport;
  246. lport = p ? p->key.port : NULL;
  247. rport = hlist_entry_safe(rp, struct net_bridge_port, rlist);
  248. if ((unsigned long)lport > (unsigned long)rport) {
  249. port = lport;
  250. if (port->flags & BR_MULTICAST_TO_UNICAST) {
  251. maybe_deliver_addr(lport, skb, p->eth_addr,
  252. local_orig);
  253. goto delivered;
  254. }
  255. if ((!allow_mode_include &&
  256. p->filter_mode == MCAST_INCLUDE) ||
  257. (p->flags & MDB_PG_FLAGS_BLOCKED))
  258. goto delivered;
  259. } else {
  260. port = rport;
  261. }
  262. prev = maybe_deliver(prev, port, skb, local_orig);
  263. if (IS_ERR(prev))
  264. goto out;
  265. delivered:
  266. if ((unsigned long)lport >= (unsigned long)port)
  267. p = rcu_dereference(p->next);
  268. if ((unsigned long)rport >= (unsigned long)port)
  269. rp = rcu_dereference(hlist_next_rcu(rp));
  270. }
  271. if (!prev)
  272. goto out;
  273. if (local_rcv)
  274. deliver_clone(prev, skb, local_orig);
  275. else
  276. __br_forward(prev, skb, local_orig);
  277. return;
  278. out:
  279. if (!local_rcv)
  280. kfree_skb(skb);
  281. }
  282. #endif