1/*
2 *	Handle incoming frames
3 *	Linux ethernet bridge
4 *
5 *	Authors:
6 *	Lennert Buytenhek		<buytenh@gnu.org>
7 *
8 *	This program is free software; you can redistribute it and/or
9 *	modify it under the terms of the GNU General Public License
10 *	as published by the Free Software Foundation; either version
11 *	2 of the License, or (at your option) any later version.
12 */
13
14#include <linux/slab.h>
15#include <linux/kernel.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/netfilter_bridge.h>
19#include <linux/neighbour.h>
20#include <net/arp.h>
21#include <linux/export.h>
22#include <linux/rculist.h>
23#include "br_private.h"
24
25/* Hook for brouter */
26br_should_route_hook_t __rcu *br_should_route_hook __read_mostly;
27EXPORT_SYMBOL(br_should_route_hook);
28
29static int
30br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
31{
32	return netif_receive_skb(skb);
33}
34
35static int br_pass_frame_up(struct sk_buff *skb)
36{
37	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
38	struct net_bridge *br = netdev_priv(brdev);
39	struct net_bridge_vlan_group *vg;
40	struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
41
42	u64_stats_update_begin(&brstats->syncp);
43	brstats->rx_packets++;
44	brstats->rx_bytes += skb->len;
45	u64_stats_update_end(&brstats->syncp);
46
47	vg = br_vlan_group_rcu(br);
48	/* Bridge is just like any other port.  Make sure the
49	 * packet is allowed except in promisc modue when someone
50	 * may be running packet capture.
51	 */
52	if (!(brdev->flags & IFF_PROMISC) &&
53	    !br_allowed_egress(vg, skb)) {
54		kfree_skb(skb);
55		return NET_RX_DROP;
56	}
57
58	indev = skb->dev;
59	skb->dev = brdev;
60	skb = br_handle_vlan(br, vg, skb);
61	if (!skb)
62		return NET_RX_DROP;
63
64	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
65		       dev_net(indev), NULL, skb, indev, NULL,
66		       br_netif_receive_skb);
67}
68
69static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
70			    u16 vid, struct net_bridge_port *p)
71{
72	struct net_device *dev = br->dev;
73	struct neighbour *n;
74	struct arphdr *parp;
75	u8 *arpptr, *sha;
76	__be32 sip, tip;
77
78	BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
79
80	if (dev->flags & IFF_NOARP)
81		return;
82
83	if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
84		dev->stats.tx_dropped++;
85		return;
86	}
87	parp = arp_hdr(skb);
88
89	if (parp->ar_pro != htons(ETH_P_IP) ||
90	    parp->ar_op != htons(ARPOP_REQUEST) ||
91	    parp->ar_hln != dev->addr_len ||
92	    parp->ar_pln != 4)
93		return;
94
95	arpptr = (u8 *)parp + sizeof(struct arphdr);
96	sha = arpptr;
97	arpptr += dev->addr_len;	/* sha */
98	memcpy(&sip, arpptr, sizeof(sip));
99	arpptr += sizeof(sip);
100	arpptr += dev->addr_len;	/* tha */
101	memcpy(&tip, arpptr, sizeof(tip));
102
103	if (ipv4_is_loopback(tip) ||
104	    ipv4_is_multicast(tip))
105		return;
106
107	n = neigh_lookup(&arp_tbl, &tip, dev);
108	if (n) {
109		struct net_bridge_fdb_entry *f;
110
111		if (!(n->nud_state & NUD_VALID)) {
112			neigh_release(n);
113			return;
114		}
115
116		f = __br_fdb_get(br, n->ha, vid);
117		if (f && ((p->flags & BR_PROXYARP) ||
118			  (f->dst && (f->dst->flags & BR_PROXYARP_WIFI)))) {
119			arp_send(ARPOP_REPLY, ETH_P_ARP, sip, skb->dev, tip,
120				 sha, n->ha, sha);
121			BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
122		}
123
124		neigh_release(n);
125	}
126}
127
128/* note: already called with rcu_read_lock */
129int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
130{
131	const unsigned char *dest = eth_hdr(skb)->h_dest;
132	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
133	struct net_bridge *br;
134	struct net_bridge_fdb_entry *dst;
135	struct net_bridge_mdb_entry *mdst;
136	struct sk_buff *skb2;
137	bool unicast = true;
138	u16 vid = 0;
139
140	if (!p || p->state == BR_STATE_DISABLED)
141		goto drop;
142
143	if (!br_allowed_ingress(p->br, nbp_vlan_group_rcu(p), skb, &vid))
144		goto out;
145
146	/* insert into forwarding database after filtering to avoid spoofing */
147	br = p->br;
148	if (p->flags & BR_LEARNING)
149		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
150
151	if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
152	    br_multicast_rcv(br, p, skb, vid))
153		goto drop;
154
155	if (p->state == BR_STATE_LEARNING)
156		goto drop;
157
158	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
159
160	/* The packet skb2 goes to the local host (NULL to skip). */
161	skb2 = NULL;
162
163	if (br->dev->flags & IFF_PROMISC)
164		skb2 = skb;
165
166	dst = NULL;
167
168	if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP))
169		br_do_proxy_arp(skb, br, vid, p);
170
171	if (is_broadcast_ether_addr(dest)) {
172		skb2 = skb;
173		unicast = false;
174	} else if (is_multicast_ether_addr(dest)) {
175		mdst = br_mdb_get(br, skb, vid);
176		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
177		    br_multicast_querier_exists(br, eth_hdr(skb))) {
178			if ((mdst && mdst->mglist) ||
179			    br_multicast_is_router(br))
180				skb2 = skb;
181			br_multicast_forward(mdst, skb, skb2);
182			skb = NULL;
183			if (!skb2)
184				goto out;
185		} else
186			skb2 = skb;
187
188		unicast = false;
189		br->dev->stats.multicast++;
190	} else if ((dst = __br_fdb_get(br, dest, vid)) &&
191			dst->is_local) {
192		skb2 = skb;
193		/* Do not forward the packet since it's local. */
194		skb = NULL;
195	}
196
197	if (skb) {
198		if (dst) {
199			dst->used = jiffies;
200			br_forward(dst->dst, skb, skb2);
201		} else
202			br_flood_forward(br, skb, skb2, unicast);
203	}
204
205	if (skb2)
206		return br_pass_frame_up(skb2);
207
208out:
209	return 0;
210drop:
211	kfree_skb(skb);
212	goto out;
213}
214EXPORT_SYMBOL_GPL(br_handle_frame_finish);
215
216/* note: already called with rcu_read_lock */
217static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
218{
219	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
220	u16 vid = 0;
221
222	/* check if vlan is allowed, to avoid spoofing */
223	if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
224		br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
225	return 0;	 /* process further */
226}
227
228/*
229 * Return NULL if skb is handled
230 * note: already called with rcu_read_lock
231 */
232rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
233{
234	struct net_bridge_port *p;
235	struct sk_buff *skb = *pskb;
236	const unsigned char *dest = eth_hdr(skb)->h_dest;
237	br_should_route_hook_t *rhook;
238
239	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
240		return RX_HANDLER_PASS;
241
242	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
243		goto drop;
244
245	skb = skb_share_check(skb, GFP_ATOMIC);
246	if (!skb)
247		return RX_HANDLER_CONSUMED;
248
249	p = br_port_get_rcu(skb->dev);
250
251	if (unlikely(is_link_local_ether_addr(dest))) {
252		u16 fwd_mask = p->br->group_fwd_mask_required;
253
254		/*
255		 * See IEEE 802.1D Table 7-10 Reserved addresses
256		 *
257		 * Assignment		 		Value
258		 * Bridge Group Address		01-80-C2-00-00-00
259		 * (MAC Control) 802.3		01-80-C2-00-00-01
260		 * (Link Aggregation) 802.3	01-80-C2-00-00-02
261		 * 802.1X PAE address		01-80-C2-00-00-03
262		 *
263		 * 802.1AB LLDP 		01-80-C2-00-00-0E
264		 *
265		 * Others reserved for future standardization
266		 */
267		switch (dest[5]) {
268		case 0x00:	/* Bridge Group Address */
269			/* If STP is turned off,
270			   then must forward to keep loop detection */
271			if (p->br->stp_enabled == BR_NO_STP ||
272			    fwd_mask & (1u << dest[5]))
273				goto forward;
274			break;
275
276		case 0x01:	/* IEEE MAC (Pause) */
277			goto drop;
278
279		default:
280			/* Allow selective forwarding for most other protocols */
281			fwd_mask |= p->br->group_fwd_mask;
282			if (fwd_mask & (1u << dest[5]))
283				goto forward;
284		}
285
286		/* Deliver packet to local host only */
287		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
288			    dev_net(skb->dev), NULL, skb, skb->dev, NULL,
289			    br_handle_local_finish)) {
290			return RX_HANDLER_CONSUMED; /* consumed by filter */
291		} else {
292			*pskb = skb;
293			return RX_HANDLER_PASS;	/* continue processing */
294		}
295	}
296
297forward:
298	switch (p->state) {
299	case BR_STATE_FORWARDING:
300		rhook = rcu_dereference(br_should_route_hook);
301		if (rhook) {
302			if ((*rhook)(skb)) {
303				*pskb = skb;
304				return RX_HANDLER_PASS;
305			}
306			dest = eth_hdr(skb)->h_dest;
307		}
308		/* fall through */
309	case BR_STATE_LEARNING:
310		if (ether_addr_equal(p->br->dev->dev_addr, dest))
311			skb->pkt_type = PACKET_HOST;
312
313		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING,
314			dev_net(skb->dev), NULL, skb, skb->dev, NULL,
315			br_handle_frame_finish);
316		break;
317	default:
318drop:
319		kfree_skb(skb);
320	}
321	return RX_HANDLER_CONSUMED;
322}
323