Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372// SPDX-License-Identifier: GPL-2.0-or-later/* * Forwarding decision * Linux ethernet bridge * * Authors: * Lennert Buytenhek <buytenh@gnu.org> */
#include <linux/err.h>#include <linux/slab.h>#include <linux/kernel.h>#include <linux/netdevice.h>#include <linux/netpoll.h>#include <linux/skbuff.h>#include <linux/if_vlan.h>#include <linux/netfilter_bridge.h>#include "br_private.h"
/* Don't forward packets to originating port or forwarding disabled */static inline int should_deliver(const struct net_bridge_port *p, const struct sk_buff *skb){ struct net_bridge_vlan_group *vg;
vg = nbp_vlan_group_rcu(p); return (test_bit(BR_HAIRPIN_MODE_BIT, &p->flags) || skb->dev != p->dev) && (br_mst_is_enabled(p) || p->state == BR_STATE_FORWARDING) && br_allowed_egress(vg, skb) && nbp_switchdev_allowed_egress(p, skb) && !br_skb_isolated(p, skb);}
int br_dev_queue_push_xmit(struct net *net, struct sock *sk, struct sk_buff *skb){ skb_push(skb, ETH_HLEN); if (!is_skb_forwardable(skb->dev, skb)) goto drop;
br_drop_fake_rtable(skb);
if (skb->ip_summed == CHECKSUM_PARTIAL && eth_type_vlan(skb->protocol)) { int depth;
if (!vlan_get_protocol_and_depth(skb, skb->protocol, &depth)) goto drop;
skb_set_network_header(skb, depth); }
br_switchdev_frame_set_offload_fwd_mark(skb);
dev_queue_xmit(skb);
return 0;
drop: kfree_skb(skb); return 0;}EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb){ skb_clear_tstamp(skb); return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, net, sk, skb, NULL, skb->dev, br_dev_queue_push_xmit);
}EXPORT_SYMBOL_GPL(br_forward_finish);
static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb, bool local_orig){ struct net_bridge_vlan_group *vg; struct net_device *indev; struct net *net; int br_hook;
/* Mark the skb for forwarding offload early so that br_handle_vlan() * can know whether to pop the VLAN header on egress or keep it. */ nbp_switchdev_frame_mark_tx_fwd_offload(to, skb);
vg = nbp_vlan_group_rcu(to); skb = br_handle_vlan(to->br, to, vg, skb); if (!skb) return;
indev = skb->dev; skb->dev = to->dev; if (!local_orig) { if (skb_warn_if_lro(skb)) { kfree_skb(skb); return; } br_hook = NF_BR_FORWARD; skb_forward_csum(skb); net = dev_net(indev); } else { if (unlikely(netpoll_tx_running(to->br->dev))) { skb_push(skb, ETH_HLEN); if (!is_skb_forwardable(skb->dev, skb)) kfree_skb(skb); else br_netpoll_send_skb(to, skb); return; } br_hook = NF_BR_LOCAL_OUT; net = dev_net(skb->dev); indev = NULL; }
NF_HOOK(NFPROTO_BRIDGE, br_hook, net, NULL, skb, indev, skb->dev, br_forward_finish);}
static int deliver_clone(const struct net_bridge_port *prev, struct sk_buff *skb, bool local_orig){ struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
skb = skb_clone(skb, GFP_ATOMIC); if (!skb) { DEV_STATS_INC(dev, tx_dropped); return -ENOMEM; }
__br_forward(prev, skb, local_orig); return 0;}
/** * br_forward - forward a packet to a specific port * @to: destination port * @skb: packet being forwarded * @local_rcv: packet will be received locally after forwarding * @local_orig: packet is locally originated * * Should be called with rcu_read_lock. */void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, bool local_rcv, bool local_orig){ if (unlikely(!to)) goto out;
/* redirect to backup link if the destination port is down */ if (rcu_access_pointer(to->backup_port) && (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) { struct net_bridge_port *backup_port;
backup_port = rcu_dereference(to->backup_port); if (unlikely(!backup_port)) goto out; BR_INPUT_SKB_CB(skb)->backup_nhid = READ_ONCE(to->backup_nhid); to = backup_port; }
if (should_deliver(to, skb)) { if (local_rcv) deliver_clone(to, skb, local_orig); else __br_forward(to, skb, local_orig); return; }
out: if (!local_rcv) kfree_skb(skb);}EXPORT_SYMBOL_GPL(br_forward);
static struct net_bridge_port *maybe_deliver( struct net_bridge_port *prev, struct net_bridge_port *p, struct sk_buff *skb, bool local_orig){ u8 igmp_type = br_multicast_igmp_type(skb); int err;
if (!should_deliver(p, skb)) return prev;
nbp_switchdev_frame_mark_tx_fwd_to_hwdom(p, skb);
if (!prev) goto out;
err = deliver_clone(prev, skb, local_orig); if (err) return ERR_PTR(err);out: br_multicast_count(p->br, p, skb, igmp_type, BR_MCAST_DIR_TX);
return p;}
/* called under rcu_read_lock */void br_flood(struct net_bridge *br, struct sk_buff *skb, enum br_pkt_type pkt_type, bool local_rcv, bool local_orig, u16 vid){ enum skb_drop_reason reason = SKB_DROP_REASON_NO_TX_TARGET; struct net_bridge_port *prev = NULL; struct net_bridge_port *p;
br_tc_skb_miss_set(skb, pkt_type != BR_PKT_BROADCAST);
list_for_each_entry_rcu(p, &br->port_list, list) { /* Do not flood unicast traffic to ports that turn it off, nor * other traffic if flood off, except for traffic we originate */ switch (pkt_type) { case BR_PKT_UNICAST: if (!test_bit(BR_FLOOD_BIT, &p->flags)) continue; break; case BR_PKT_MULTICAST: if (!test_bit(BR_MCAST_FLOOD_BIT, &p->flags) && skb->dev != br->dev) continue; break; case BR_PKT_BROADCAST: if (!test_bit(BR_BCAST_FLOOD_BIT, &p->flags) && skb->dev != br->dev) continue; break; }
/* Do not flood to ports that enable proxy ARP */ if (test_bit(BR_PROXYARP_BIT, &p->flags)) continue; if (BR_INPUT_SKB_CB(skb)->proxyarp_replied) { if (test_bit(BR_PROXYARP_WIFI_BIT, &p->flags)) continue; /* For gratuitous ARPs/NAs, check neigh_forward_grat. * For regular ARPs/NDs, check only neigh_suppress. */ if (br_is_neigh_suppress_enabled(p, vid) && (!BR_INPUT_SKB_CB(skb)->grat_arp || !br_is_neigh_forward_grat_enabled(p, vid))) continue; }
prev = maybe_deliver(prev, p, skb, local_orig); if (IS_ERR(prev)) { reason = PTR_ERR(prev) == -ENOMEM ? SKB_DROP_REASON_NOMEM : SKB_DROP_REASON_NOT_SPECIFIED; goto out; } }
if (!prev) goto out;
if (local_rcv) deliver_clone(prev, skb, local_orig); else __br_forward(prev, skb, local_orig); return;
out: if (!local_rcv) kfree_skb_reason(skb, reason);}
#ifdef CONFIG_BRIDGE_IGMP_SNOOPINGstatic void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb, const unsigned char *addr, bool local_orig){ struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev; const unsigned char *src = eth_hdr(skb)->h_source; struct sk_buff *nskb;
if (!should_deliver(p, skb)) return;
/* Even with hairpin, no soliloquies - prevent breaking IPv6 DAD */ if (skb->dev == p->dev && ether_addr_equal(src, addr)) return;
__skb_push(skb, ETH_HLEN); nskb = pskb_copy(skb, GFP_ATOMIC); __skb_pull(skb, ETH_HLEN); if (!nskb) { DEV_STATS_INC(dev, tx_dropped); return; }
skb = nskb; __skb_pull(skb, ETH_HLEN); if (!is_broadcast_ether_addr(addr)) memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN);
__br_forward(p, skb, local_orig);}
/* called with rcu_read_lock */void br_multicast_flood(struct net_bridge_mdb_entry *mdst, struct sk_buff *skb, struct net_bridge_mcast *brmctx, bool local_rcv, bool local_orig){ enum skb_drop_reason reason = SKB_DROP_REASON_NO_TX_TARGET; struct net_bridge_port *prev = NULL; struct net_bridge_port_group *p; bool allow_mode_include = true; struct hlist_node *rp;
rp = br_multicast_get_first_rport_node(brmctx, skb);
if (mdst) { p = rcu_dereference(mdst->ports); if (br_multicast_should_handle_mode(brmctx, mdst->addr.proto) && br_multicast_is_star_g(&mdst->addr)) allow_mode_include = false; } else { p = NULL; br_tc_skb_miss_set(skb, true); }
while (p || rp) { struct net_bridge_port *port, *lport, *rport;
lport = p ? p->key.port : NULL; rport = br_multicast_rport_from_node_skb(rp, skb);
if ((unsigned long)lport > (unsigned long)rport) { port = lport;
if (test_bit(BR_MULTICAST_TO_UNICAST_BIT, &port->flags)) { maybe_deliver_addr(lport, skb, p->eth_addr, local_orig); goto delivered; } if ((!allow_mode_include && p->filter_mode == MCAST_INCLUDE) || (p->flags & MDB_PG_FLAGS_BLOCKED)) goto delivered; } else { port = rport; }
prev = maybe_deliver(prev, port, skb, local_orig); if (IS_ERR(prev)) { reason = PTR_ERR(prev) == -ENOMEM ? SKB_DROP_REASON_NOMEM : SKB_DROP_REASON_NOT_SPECIFIED; goto out; }delivered: if ((unsigned long)lport >= (unsigned long)port) p = rcu_dereference(p->next); if ((unsigned long)rport >= (unsigned long)port) rp = rcu_dereference(hlist_next_rcu(rp)); }
if (!prev) goto out;
if (local_rcv) deliver_clone(prev, skb, local_orig); else __br_forward(prev, skb, local_orig); return;
out: if (!local_rcv) kfree_skb_reason(skb, reason);}#endif