br_input.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 *	Handle incoming frames
  4 *	Linux ethernet bridge
  5 *
  6 *	Authors:
  7 *	Lennert Buytenhek		<buytenh@gnu.org>
  8 */
  9
 10#include <linux/slab.h>
 11#include <linux/kernel.h>
 12#include <linux/netdevice.h>
 13#include <linux/etherdevice.h>
 14#include <linux/netfilter_bridge.h>
 15#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
 16#include <net/netfilter/nf_queue.h>
 17#endif
 18#include <linux/neighbour.h>
 19#include <net/arp.h>
 20#include <net/dsa.h>
 21#include <linux/export.h>
 22#include <linux/rculist.h>
 23#include "br_private.h"
 24#include "br_private_tunnel.h"
 25
 26static int
 27br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
 28{
 29	br_drop_fake_rtable(skb);
 30	return netif_receive_skb(skb);
 31}
 32
 33static int br_pass_frame_up(struct sk_buff *skb, bool promisc)
 34{
 35	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
 36	struct net_bridge *br = netdev_priv(brdev);
 37	struct net_bridge_vlan_group *vg;
 38
 39	dev_sw_netstats_rx_add(brdev, skb->len);
 40
 41	vg = br_vlan_group_rcu(br);
 42
 43	/* Reset the offload_fwd_mark because there could be a stacked
 44	 * bridge above, and it should not think this bridge it doing
 45	 * that bridge's work forwarding out its ports.
 46	 */
 47	br_switchdev_frame_unmark(skb);
 48
 49	/* Bridge is just like any other port.  Make sure the
 50	 * packet is allowed except in promisc mode when someone
 51	 * may be running packet capture.
 52	 */
 53	if (!(brdev->flags & IFF_PROMISC) &&
 54	    !br_allowed_egress(vg, skb)) {
 55		kfree_skb(skb);
 56		return NET_RX_DROP;
 57	}
 58
 59	indev = skb->dev;
 60	skb->dev = brdev;
 61	skb = br_handle_vlan(br, NULL, vg, skb);
 62	if (!skb)
 63		return NET_RX_DROP;
 64	/* update the multicast stats if the packet is IGMP/MLD */
 65	br_multicast_count(br, NULL, skb, br_multicast_igmp_type(skb),
 66			   BR_MCAST_DIR_TX);
 67
 68	BR_INPUT_SKB_CB(skb)->promisc = promisc;
 69
 70	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
 71		       dev_net(indev), NULL, skb, indev, NULL,
 72		       br_netif_receive_skb);
 73}
 74
 75/* note: already called with rcu_read_lock */
 76int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 77{
 78	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
 79	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
 80	enum br_pkt_type pkt_type = BR_PKT_UNICAST;
 81	struct net_bridge_fdb_entry *dst = NULL;
 82	struct net_bridge_mcast_port *pmctx;
 83	struct net_bridge_mdb_entry *mdst;
 84	bool local_rcv, mcast_hit = false;
 85	struct net_bridge_mcast *brmctx;
 86	struct net_bridge_vlan *vlan;
 87	struct net_bridge *br;
 88	bool promisc;
 89	u16 vid = 0;
 90	u8 state;
 91
 92	if (!p)
 93		goto drop;
 94
 95	br = p->br;
 96
 97	if (br_mst_is_enabled(p)) {
 98		state = BR_STATE_FORWARDING;
 99	} else {
100		if (p->state == BR_STATE_DISABLED) {
101			reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
102			goto drop;
103		}
104
105		state = p->state;
106	}
107
108	brmctx = &p->br->multicast_ctx;
109	pmctx = &p->multicast_ctx;
110	if (!br_allowed_ingress(p->br, nbp_vlan_group_rcu(p), skb, &vid,
111				&state, &vlan))
112		goto out;
113
114	if (p->flags & BR_PORT_LOCKED) {
115		struct net_bridge_fdb_entry *fdb_src =
116			br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid);
117
118		if (!fdb_src) {
119			/* FDB miss. Create locked FDB entry if MAB is enabled
120			 * and drop the packet.
121			 */
122			if (p->flags & BR_PORT_MAB)
123				br_fdb_update(br, p, eth_hdr(skb)->h_source,
124					      vid, BIT(BR_FDB_LOCKED));
125			goto drop;
126		} else if (READ_ONCE(fdb_src->dst) != p ||
127			   test_bit(BR_FDB_LOCAL, &fdb_src->flags)) {
128			/* FDB mismatch. Drop the packet without roaming. */
129			goto drop;
130		} else if (test_bit(BR_FDB_LOCKED, &fdb_src->flags)) {
131			/* FDB match, but entry is locked. Refresh it and drop
132			 * the packet.
133			 */
134			br_fdb_update(br, p, eth_hdr(skb)->h_source, vid,
135				      BIT(BR_FDB_LOCKED));
136			goto drop;
137		}
138	}
139
140	nbp_switchdev_frame_mark(p, skb);
141
142	/* insert into forwarding database after filtering to avoid spoofing */
143	if (p->flags & BR_LEARNING)
144		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);
145
146	promisc = !!(br->dev->flags & IFF_PROMISC);
147	local_rcv = promisc;
148
149	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
150		/* by definition the broadcast is also a multicast address */
151		if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
152			pkt_type = BR_PKT_BROADCAST;
153			local_rcv = true;
154		} else {
155			pkt_type = BR_PKT_MULTICAST;
156			if (br_multicast_rcv(&brmctx, &pmctx, vlan, skb, vid))
157				goto drop;
158		}
159	}
160
161	if (state == BR_STATE_LEARNING) {
162		reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
163		goto drop;
164	}
165
166	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
167	BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED);
168
169	if (IS_ENABLED(CONFIG_INET) &&
170	    (skb->protocol == htons(ETH_P_ARP) ||
171	     skb->protocol == htons(ETH_P_RARP))) {
172		br_do_proxy_suppress_arp(skb, br, vid, p);
173	} else if (ipv6_mod_enabled() &&
174		   skb->protocol == htons(ETH_P_IPV6) &&
175		   br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
176		   pskb_may_pull(skb, sizeof(struct ipv6hdr) +
177				 sizeof(struct nd_msg)) &&
178		   ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
179			struct nd_msg *msg, _msg;
180
181			msg = br_is_nd_neigh_msg(skb, &_msg);
182			if (msg)
183				br_do_suppress_nd(skb, br, vid, p, msg);
184	}
185
186	switch (pkt_type) {
187	case BR_PKT_MULTICAST:
188		mdst = br_mdb_entry_skb_get(brmctx, skb, vid);
189		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
190		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst)) {
191			if ((mdst && mdst->host_joined) ||
192			    br_multicast_is_router(brmctx, skb) ||
193			    br->dev->flags & IFF_ALLMULTI) {
194				local_rcv = true;
195				DEV_STATS_INC(br->dev, multicast);
196			}
197			mcast_hit = true;
198		} else {
199			local_rcv = true;
200			DEV_STATS_INC(br->dev, multicast);
201		}
202		break;
203	case BR_PKT_UNICAST:
204		dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
205		if (unlikely(!dst && vid &&
206			     br_opt_get(br, BROPT_FDB_LOCAL_VLAN_0))) {
207			dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, 0);
208			if (dst &&
209			    (!test_bit(BR_FDB_LOCAL, &dst->flags) ||
210			     test_bit(BR_FDB_ADDED_BY_USER, &dst->flags)))
211				dst = NULL;
212		}
213		break;
214	default:
215		break;
216	}
217
218	if (dst) {
219		unsigned long now = jiffies;
220
221		if (test_bit(BR_FDB_LOCAL, &dst->flags))
222			return br_pass_frame_up(skb, false);
223
224		if (now != READ_ONCE(dst->used))
225			WRITE_ONCE(dst->used, now);
226		br_forward(dst->dst, skb, local_rcv, false);
227	} else {
228		if (!mcast_hit)
229			br_flood(br, skb, pkt_type, local_rcv, false, vid);
230		else
231			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
232	}
233
234	if (local_rcv)
235		return br_pass_frame_up(skb, promisc);
236
237out:
238	return 0;
239drop:
240	kfree_skb_reason(skb, reason);
241	goto out;
242}
243EXPORT_SYMBOL_GPL(br_handle_frame_finish);
244
245static void __br_handle_local_finish(struct sk_buff *skb)
246{
247	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
248	u16 vid = 0;
249
250	/* check if vlan is allowed, to avoid spoofing */
251	if ((p->flags & BR_LEARNING) &&
252	    nbp_state_should_learn(p) &&
253	    !br_opt_get(p->br, BROPT_NO_LL_LEARN) &&
254	    br_should_learn(p, skb, &vid))
255		br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, 0);
256}
257
258/* note: already called with rcu_read_lock */
259static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
260{
261	__br_handle_local_finish(skb);
262
263	/* return 1 to signal the okfn() was called so it's ok to use the skb */
264	return 1;
265}
266
267static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)
268{
269#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
270	struct nf_hook_entries *e = NULL;
271	struct nf_hook_state state;
272	unsigned int verdict, i;
273	struct net *net;
274	int ret;
275
276	net = dev_net(skb->dev);
277#ifdef CONFIG_JUMP_LABEL
278	if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))
279		goto frame_finish;
280#endif
281
282	e = rcu_dereference(net->nf.hooks_bridge[NF_BR_PRE_ROUTING]);
283	if (!e)
284		goto frame_finish;
285
286	nf_hook_state_init(&state, NF_BR_PRE_ROUTING,
287			   NFPROTO_BRIDGE, skb->dev, NULL, NULL,
288			   net, br_handle_frame_finish);
289
290	for (i = 0; i < e->num_hook_entries; i++) {
291		verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state);
292		switch (verdict & NF_VERDICT_MASK) {
293		case NF_ACCEPT:
294			if (BR_INPUT_SKB_CB(skb)->br_netfilter_broute) {
295				*pskb = skb;
296				return RX_HANDLER_PASS;
297			}
298			break;
299		case NF_DROP:
300			kfree_skb(skb);
301			return RX_HANDLER_CONSUMED;
302		case NF_QUEUE:
303			ret = nf_queue(skb, &state, i, verdict);
304			if (ret == 1)
305				continue;
306			return RX_HANDLER_CONSUMED;
307		default: /* STOLEN */
308			return RX_HANDLER_CONSUMED;
309		}
310	}
311frame_finish:
312	net = dev_net(skb->dev);
313	br_handle_frame_finish(net, NULL, skb);
314#else
315	br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
316#endif
317	return RX_HANDLER_CONSUMED;
318}
319
320/* Return 0 if the frame was not processed otherwise 1
321 * note: already called with rcu_read_lock
322 */
323static int br_process_frame_type(struct net_bridge_port *p,
324				 struct sk_buff *skb)
325{
326	struct br_frame_type *tmp;
327
328	hlist_for_each_entry_rcu(tmp, &p->br->frame_type_list, list)
329		if (unlikely(tmp->type == skb->protocol))
330			return tmp->frame_handler(p, skb);
331
332	return 0;
333}
334
335/*
336 * Return NULL if skb is handled
337 * note: already called with rcu_read_lock
338 */
339static rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
340{
341	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
342	struct net_bridge_port *p;
343	struct sk_buff *skb = *pskb;
344	const unsigned char *dest = eth_hdr(skb)->h_dest;
345
346	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
347		return RX_HANDLER_PASS;
348
349	if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) {
350		reason = SKB_DROP_REASON_MAC_INVALID_SOURCE;
351		goto drop;
352	}
353
354	skb = skb_share_check(skb, GFP_ATOMIC);
355	if (!skb)
356		return RX_HANDLER_CONSUMED;
357
358	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
359	br_tc_skb_miss_set(skb, false);
360
361	p = br_port_get_rcu(skb->dev);
362	if (p->flags & BR_VLAN_TUNNEL)
363		br_handle_ingress_vlan_tunnel(skb, p, nbp_vlan_group_rcu(p));
364
365	if (unlikely(is_link_local_ether_addr(dest))) {
366		u16 fwd_mask = p->br->group_fwd_mask_required;
367
368		/*
369		 * See IEEE 802.1D Table 7-10 Reserved addresses
370		 *
371		 * Assignment		 		Value
372		 * Bridge Group Address		01-80-C2-00-00-00
373		 * (MAC Control) 802.3		01-80-C2-00-00-01
374		 * (Link Aggregation) 802.3	01-80-C2-00-00-02
375		 * 802.1X PAE address		01-80-C2-00-00-03
376		 *
377		 * 802.1AB LLDP 		01-80-C2-00-00-0E
378		 *
379		 * Others reserved for future standardization
380		 */
381		fwd_mask |= p->group_fwd_mask;
382		switch (dest[5]) {
383		case 0x00:	/* Bridge Group Address */
384			/* If STP is turned off,
385			   then must forward to keep loop detection */
386			if (p->br->stp_enabled == BR_NO_STP ||
387			    fwd_mask & (1u << dest[5]))
388				goto forward;
389			*pskb = skb;
390			__br_handle_local_finish(skb);
391			return RX_HANDLER_PASS;
392
393		case 0x01:	/* IEEE MAC (Pause) */
394			reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL;
395			goto drop;
396
397		case 0x0E:	/* 802.1AB LLDP */
398			fwd_mask |= p->br->group_fwd_mask;
399			if (fwd_mask & (1u << dest[5]))
400				goto forward;
401			*pskb = skb;
402			__br_handle_local_finish(skb);
403			return RX_HANDLER_PASS;
404
405		default:
406			/* Allow selective forwarding for most other protocols */
407			fwd_mask |= p->br->group_fwd_mask;
408			if (fwd_mask & (1u << dest[5]))
409				goto forward;
410		}
411
412		BR_INPUT_SKB_CB(skb)->promisc = false;
413
414		/* The else clause should be hit when nf_hook():
415		 *   - returns < 0 (drop/error)
416		 *   - returns = 0 (stolen/nf_queue)
417		 * Thus return 1 from the okfn() to signal the skb is ok to pass
418		 */
419		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
420			    dev_net(skb->dev), NULL, skb, skb->dev, NULL,
421			    br_handle_local_finish) == 1) {
422			return RX_HANDLER_PASS;
423		} else {
424			return RX_HANDLER_CONSUMED;
425		}
426	}
427
428	if (unlikely(br_process_frame_type(p, skb)))
429		return RX_HANDLER_PASS;
430
431forward:
432	if (br_mst_is_enabled(p))
433		goto defer_stp_filtering;
434
435	switch (p->state) {
436	case BR_STATE_FORWARDING:
437	case BR_STATE_LEARNING:
438defer_stp_filtering:
439		if (ether_addr_equal(p->br->dev->dev_addr, dest))
440			skb->pkt_type = PACKET_HOST;
441
442		return nf_hook_bridge_pre(skb, pskb);
443	default:
444		reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
445drop:
446		kfree_skb_reason(skb, reason);
447	}
448	return RX_HANDLER_CONSUMED;
449}
450
451/* This function has no purpose other than to appease the br_port_get_rcu/rtnl
452 * helpers which identify bridged ports according to the rx_handler installed
453 * on them (so there _needs_ to be a bridge rx_handler even if we don't need it
454 * to do anything useful). This bridge won't support traffic to/from the stack,
455 * but only hardware bridging. So return RX_HANDLER_PASS so we don't steal
456 * frames from the ETH_P_XDSA packet_type handler.
457 */
458static rx_handler_result_t br_handle_frame_dummy(struct sk_buff **pskb)
459{
460	return RX_HANDLER_PASS;
461}
462
463rx_handler_func_t *br_get_rx_handler(const struct net_device *dev)
464{
465	if (netdev_uses_dsa(dev))
466		return br_handle_frame_dummy;
467
468	return br_handle_frame;
469}
470
471void br_add_frame(struct net_bridge *br, struct br_frame_type *ft)
472{
473	hlist_add_head_rcu(&ft->list, &br->frame_type_list);
474}
475
476void br_del_frame(struct net_bridge *br, struct br_frame_type *ft)
477{
478	struct br_frame_type *tmp;
479
480	hlist_for_each_entry(tmp, &br->frame_type_list, list)
481		if (ft == tmp) {
482			hlist_del_rcu(&ft->list);
483			return;
484		}
485}