br_input.c 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Handle incoming frames
  4. * Linux ethernet bridge
  5. *
  6. * Authors:
  7. * Lennert Buytenhek <buytenh@gnu.org>
  8. */
  9. #include <linux/slab.h>
  10. #include <linux/kernel.h>
  11. #include <linux/netdevice.h>
  12. #include <linux/etherdevice.h>
  13. #include <linux/netfilter_bridge.h>
  14. #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
  15. #include <net/netfilter/nf_queue.h>
  16. #endif
  17. #include <linux/neighbour.h>
  18. #include <net/arp.h>
  19. #include <net/dsa.h>
  20. #include <linux/export.h>
  21. #include <linux/rculist.h>
  22. #include "br_private.h"
  23. #include "br_private_tunnel.h"
  24. static int
  25. br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
  26. {
  27. br_drop_fake_rtable(skb);
  28. return netif_receive_skb(skb);
  29. }
  30. static int br_pass_frame_up(struct sk_buff *skb)
  31. {
  32. struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
  33. struct net_bridge *br = netdev_priv(brdev);
  34. struct net_bridge_vlan_group *vg;
  35. struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
  36. u64_stats_update_begin(&brstats->syncp);
  37. brstats->rx_packets++;
  38. brstats->rx_bytes += skb->len;
  39. u64_stats_update_end(&brstats->syncp);
  40. vg = br_vlan_group_rcu(br);
  41. /* Bridge is just like any other port. Make sure the
  42. * packet is allowed except in promisc modue when someone
  43. * may be running packet capture.
  44. */
  45. if (!(brdev->flags & IFF_PROMISC) &&
  46. !br_allowed_egress(vg, skb)) {
  47. kfree_skb(skb);
  48. return NET_RX_DROP;
  49. }
  50. indev = skb->dev;
  51. skb->dev = brdev;
  52. skb = br_handle_vlan(br, NULL, vg, skb);
  53. if (!skb)
  54. return NET_RX_DROP;
  55. /* update the multicast stats if the packet is IGMP/MLD */
  56. br_multicast_count(br, NULL, skb, br_multicast_igmp_type(skb),
  57. BR_MCAST_DIR_TX);
  58. return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
  59. dev_net(indev), NULL, skb, indev, NULL,
  60. br_netif_receive_skb);
  61. }
  62. /* note: already called with rcu_read_lock */
  63. int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  64. {
  65. struct net_bridge_port *p = br_port_get_rcu(skb->dev);
  66. enum br_pkt_type pkt_type = BR_PKT_UNICAST;
  67. struct net_bridge_fdb_entry *dst = NULL;
  68. struct net_bridge_mdb_entry *mdst;
  69. bool local_rcv, mcast_hit = false;
  70. struct net_bridge *br;
  71. u16 vid = 0;
  72. u8 state;
  73. if (!p || p->state == BR_STATE_DISABLED)
  74. goto drop;
  75. state = p->state;
  76. if (!br_allowed_ingress(p->br, nbp_vlan_group_rcu(p), skb, &vid,
  77. &state))
  78. goto out;
  79. nbp_switchdev_frame_mark(p, skb);
  80. /* insert into forwarding database after filtering to avoid spoofing */
  81. br = p->br;
  82. if (p->flags & BR_LEARNING)
  83. br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);
  84. local_rcv = !!(br->dev->flags & IFF_PROMISC);
  85. if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
  86. /* by definition the broadcast is also a multicast address */
  87. if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
  88. pkt_type = BR_PKT_BROADCAST;
  89. local_rcv = true;
  90. } else {
  91. pkt_type = BR_PKT_MULTICAST;
  92. if (br_multicast_rcv(br, p, skb, vid))
  93. goto drop;
  94. }
  95. }
  96. if (state == BR_STATE_LEARNING)
  97. goto drop;
  98. BR_INPUT_SKB_CB(skb)->brdev = br->dev;
  99. BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED);
  100. if (IS_ENABLED(CONFIG_INET) &&
  101. (skb->protocol == htons(ETH_P_ARP) ||
  102. skb->protocol == htons(ETH_P_RARP))) {
  103. br_do_proxy_suppress_arp(skb, br, vid, p);
  104. } else if (IS_ENABLED(CONFIG_IPV6) &&
  105. skb->protocol == htons(ETH_P_IPV6) &&
  106. br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
  107. pskb_may_pull(skb, sizeof(struct ipv6hdr) +
  108. sizeof(struct nd_msg)) &&
  109. ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
  110. struct nd_msg *msg, _msg;
  111. msg = br_is_nd_neigh_msg(skb, &_msg);
  112. if (msg)
  113. br_do_suppress_nd(skb, br, vid, p, msg);
  114. }
  115. switch (pkt_type) {
  116. case BR_PKT_MULTICAST:
  117. mdst = br_mdb_get(br, skb, vid);
  118. if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
  119. br_multicast_querier_exists(br, eth_hdr(skb))) {
  120. if ((mdst && mdst->host_joined) ||
  121. br_multicast_is_router(br)) {
  122. local_rcv = true;
  123. br->dev->stats.multicast++;
  124. }
  125. mcast_hit = true;
  126. } else {
  127. local_rcv = true;
  128. br->dev->stats.multicast++;
  129. }
  130. break;
  131. case BR_PKT_UNICAST:
  132. dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
  133. default:
  134. break;
  135. }
  136. if (dst) {
  137. unsigned long now = jiffies;
  138. if (test_bit(BR_FDB_LOCAL, &dst->flags))
  139. return br_pass_frame_up(skb);
  140. if (now != dst->used)
  141. dst->used = now;
  142. br_forward(dst->dst, skb, local_rcv, false);
  143. } else {
  144. if (!mcast_hit)
  145. br_flood(br, skb, pkt_type, local_rcv, false);
  146. else
  147. br_multicast_flood(mdst, skb, local_rcv, false);
  148. }
  149. if (local_rcv)
  150. return br_pass_frame_up(skb);
  151. out:
  152. return 0;
  153. drop:
  154. kfree_skb(skb);
  155. goto out;
  156. }
  157. EXPORT_SYMBOL_GPL(br_handle_frame_finish);
  158. static void __br_handle_local_finish(struct sk_buff *skb)
  159. {
  160. struct net_bridge_port *p = br_port_get_rcu(skb->dev);
  161. u16 vid = 0;
  162. /* check if vlan is allowed, to avoid spoofing */
  163. if ((p->flags & BR_LEARNING) &&
  164. nbp_state_should_learn(p) &&
  165. !br_opt_get(p->br, BROPT_NO_LL_LEARN) &&
  166. br_should_learn(p, skb, &vid))
  167. br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, 0);
  168. }
  169. /* note: already called with rcu_read_lock */
  170. static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  171. {
  172. __br_handle_local_finish(skb);
  173. /* return 1 to signal the okfn() was called so it's ok to use the skb */
  174. return 1;
  175. }
  176. static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)
  177. {
  178. #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
  179. struct nf_hook_entries *e = NULL;
  180. struct nf_hook_state state;
  181. unsigned int verdict, i;
  182. struct net *net;
  183. int ret;
  184. net = dev_net(skb->dev);
  185. #ifdef HAVE_JUMP_LABEL
  186. if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))
  187. goto frame_finish;
  188. #endif
  189. e = rcu_dereference(net->nf.hooks_bridge[NF_BR_PRE_ROUTING]);
  190. if (!e)
  191. goto frame_finish;
  192. nf_hook_state_init(&state, NF_BR_PRE_ROUTING,
  193. NFPROTO_BRIDGE, skb->dev, NULL, NULL,
  194. net, br_handle_frame_finish);
  195. for (i = 0; i < e->num_hook_entries; i++) {
  196. verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state);
  197. switch (verdict & NF_VERDICT_MASK) {
  198. case NF_ACCEPT:
  199. if (BR_INPUT_SKB_CB(skb)->br_netfilter_broute) {
  200. *pskb = skb;
  201. return RX_HANDLER_PASS;
  202. }
  203. break;
  204. case NF_DROP:
  205. kfree_skb(skb);
  206. return RX_HANDLER_CONSUMED;
  207. case NF_QUEUE:
  208. ret = nf_queue(skb, &state, i, verdict);
  209. if (ret == 1)
  210. continue;
  211. return RX_HANDLER_CONSUMED;
  212. default: /* STOLEN */
  213. return RX_HANDLER_CONSUMED;
  214. }
  215. }
  216. frame_finish:
  217. net = dev_net(skb->dev);
  218. br_handle_frame_finish(net, NULL, skb);
  219. #else
  220. br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
  221. #endif
  222. return RX_HANDLER_CONSUMED;
  223. }
  224. /*
  225. * Return NULL if skb is handled
  226. * note: already called with rcu_read_lock
  227. */
  228. static rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
  229. {
  230. struct net_bridge_port *p;
  231. struct sk_buff *skb = *pskb;
  232. const unsigned char *dest = eth_hdr(skb)->h_dest;
  233. if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
  234. return RX_HANDLER_PASS;
  235. if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
  236. goto drop;
  237. skb = skb_share_check(skb, GFP_ATOMIC);
  238. if (!skb)
  239. return RX_HANDLER_CONSUMED;
  240. memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
  241. p = br_port_get_rcu(skb->dev);
  242. if (p->flags & BR_VLAN_TUNNEL) {
  243. if (br_handle_ingress_vlan_tunnel(skb, p,
  244. nbp_vlan_group_rcu(p)))
  245. goto drop;
  246. }
  247. if (unlikely(is_link_local_ether_addr(dest))) {
  248. u16 fwd_mask = p->br->group_fwd_mask_required;
  249. /*
  250. * See IEEE 802.1D Table 7-10 Reserved addresses
  251. *
  252. * Assignment Value
  253. * Bridge Group Address 01-80-C2-00-00-00
  254. * (MAC Control) 802.3 01-80-C2-00-00-01
  255. * (Link Aggregation) 802.3 01-80-C2-00-00-02
  256. * 802.1X PAE address 01-80-C2-00-00-03
  257. *
  258. * 802.1AB LLDP 01-80-C2-00-00-0E
  259. *
  260. * Others reserved for future standardization
  261. */
  262. fwd_mask |= p->group_fwd_mask;
  263. switch (dest[5]) {
  264. case 0x00: /* Bridge Group Address */
  265. /* If STP is turned off,
  266. then must forward to keep loop detection */
  267. if (p->br->stp_enabled == BR_NO_STP ||
  268. fwd_mask & (1u << dest[5]))
  269. goto forward;
  270. *pskb = skb;
  271. __br_handle_local_finish(skb);
  272. return RX_HANDLER_PASS;
  273. case 0x01: /* IEEE MAC (Pause) */
  274. goto drop;
  275. case 0x0E: /* 802.1AB LLDP */
  276. fwd_mask |= p->br->group_fwd_mask;
  277. if (fwd_mask & (1u << dest[5]))
  278. goto forward;
  279. *pskb = skb;
  280. __br_handle_local_finish(skb);
  281. return RX_HANDLER_PASS;
  282. default:
  283. /* Allow selective forwarding for most other protocols */
  284. fwd_mask |= p->br->group_fwd_mask;
  285. if (fwd_mask & (1u << dest[5]))
  286. goto forward;
  287. }
  288. /* The else clause should be hit when nf_hook():
  289. * - returns < 0 (drop/error)
  290. * - returns = 0 (stolen/nf_queue)
  291. * Thus return 1 from the okfn() to signal the skb is ok to pass
  292. */
  293. if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
  294. dev_net(skb->dev), NULL, skb, skb->dev, NULL,
  295. br_handle_local_finish) == 1) {
  296. return RX_HANDLER_PASS;
  297. } else {
  298. return RX_HANDLER_CONSUMED;
  299. }
  300. }
  301. if (unlikely(br_mrp_process(p, skb)))
  302. return RX_HANDLER_PASS;
  303. forward:
  304. switch (p->state) {
  305. case BR_STATE_FORWARDING:
  306. case BR_STATE_LEARNING:
  307. if (ether_addr_equal(p->br->dev->dev_addr, dest))
  308. skb->pkt_type = PACKET_HOST;
  309. return nf_hook_bridge_pre(skb, pskb);
  310. default:
  311. drop:
  312. kfree_skb(skb);
  313. }
  314. return RX_HANDLER_CONSUMED;
  315. }
  316. /* This function has no purpose other than to appease the br_port_get_rcu/rtnl
  317. * helpers which identify bridged ports according to the rx_handler installed
  318. * on them (so there _needs_ to be a bridge rx_handler even if we don't need it
  319. * to do anything useful). This bridge won't support traffic to/from the stack,
  320. * but only hardware bridging. So return RX_HANDLER_PASS so we don't steal
  321. * frames from the ETH_P_XDSA packet_type handler.
  322. */
  323. static rx_handler_result_t br_handle_frame_dummy(struct sk_buff **pskb)
  324. {
  325. return RX_HANDLER_PASS;
  326. }
  327. rx_handler_func_t *br_get_rx_handler(const struct net_device *dev)
  328. {
  329. if (netdev_uses_dsa(dev))
  330. return br_handle_frame_dummy;
  331. return br_handle_frame;
  332. }