~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/bridge/br_arp_nd_proxy.c

Version: ~ [ linux-5.5-rc6 ] ~ [ linux-5.4.11 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.95 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.164 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.209 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.209 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *  Handle bridge arp/nd proxy/suppress
  3  *
  4  *  Copyright (C) 2017 Cumulus Networks
  5  *  Copyright (c) 2017 Roopa Prabhu <roopa@cumulusnetworks.com>
  6  *
  7  *  Authors:
  8  *      Roopa Prabhu <roopa@cumulusnetworks.com>
  9  *
 10  *  This program is free software; you can redistribute it and/or
 11  *  modify it under the terms of the GNU General Public License
 12  *  as published by the Free Software Foundation; either version
 13  *  2 of the License, or (at your option) any later version.
 14  */
 15 
 16 #include <linux/kernel.h>
 17 #include <linux/netdevice.h>
 18 #include <linux/etherdevice.h>
 19 #include <linux/neighbour.h>
 20 #include <net/arp.h>
 21 #include <linux/if_vlan.h>
 22 #include <linux/inetdevice.h>
 23 #include <net/addrconf.h>
 24 #if IS_ENABLED(CONFIG_IPV6)
 25 #include <net/ip6_checksum.h>
 26 #endif
 27 
 28 #include "br_private.h"
 29 
 30 void br_recalculate_neigh_suppress_enabled(struct net_bridge *br)
 31 {
 32         struct net_bridge_port *p;
 33         bool neigh_suppress = false;
 34 
 35         list_for_each_entry(p, &br->port_list, list) {
 36                 if (p->flags & BR_NEIGH_SUPPRESS) {
 37                         neigh_suppress = true;
 38                         break;
 39                 }
 40         }
 41 
 42         br_opt_toggle(br, BROPT_NEIGH_SUPPRESS_ENABLED, neigh_suppress);
 43 }
 44 
 45 #if IS_ENABLED(CONFIG_INET)
 46 static void br_arp_send(struct net_bridge *br, struct net_bridge_port *p,
 47                         struct net_device *dev, __be32 dest_ip, __be32 src_ip,
 48                         const unsigned char *dest_hw,
 49                         const unsigned char *src_hw,
 50                         const unsigned char *target_hw,
 51                         __be16 vlan_proto, u16 vlan_tci)
 52 {
 53         struct net_bridge_vlan_group *vg;
 54         struct sk_buff *skb;
 55         u16 pvid;
 56 
 57         netdev_dbg(dev, "arp send dev %s dst %pI4 dst_hw %pM src %pI4 src_hw %pM\n",
 58                    dev->name, &dest_ip, dest_hw, &src_ip, src_hw);
 59 
 60         if (!vlan_tci) {
 61                 arp_send(ARPOP_REPLY, ETH_P_ARP, dest_ip, dev, src_ip,
 62                          dest_hw, src_hw, target_hw);
 63                 return;
 64         }
 65 
 66         skb = arp_create(ARPOP_REPLY, ETH_P_ARP, dest_ip, dev, src_ip,
 67                          dest_hw, src_hw, target_hw);
 68         if (!skb)
 69                 return;
 70 
 71         if (p)
 72                 vg = nbp_vlan_group_rcu(p);
 73         else
 74                 vg = br_vlan_group_rcu(br);
 75         pvid = br_get_pvid(vg);
 76         if (pvid == (vlan_tci & VLAN_VID_MASK))
 77                 vlan_tci = 0;
 78 
 79         if (vlan_tci)
 80                 __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
 81 
 82         if (p) {
 83                 arp_xmit(skb);
 84         } else {
 85                 skb_reset_mac_header(skb);
 86                 __skb_pull(skb, skb_network_offset(skb));
 87                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 88                 skb->pkt_type = PACKET_HOST;
 89 
 90                 netif_rx_ni(skb);
 91         }
 92 }
 93 
 94 static int br_chk_addr_ip(struct net_device *dev, void *data)
 95 {
 96         __be32 ip = *(__be32 *)data;
 97         struct in_device *in_dev;
 98         __be32 addr = 0;
 99 
100         in_dev = __in_dev_get_rcu(dev);
101         if (in_dev)
102                 addr = inet_confirm_addr(dev_net(dev), in_dev, 0, ip,
103                                          RT_SCOPE_HOST);
104 
105         if (addr == ip)
106                 return 1;
107 
108         return 0;
109 }
110 
111 static bool br_is_local_ip(struct net_device *dev, __be32 ip)
112 {
113         if (br_chk_addr_ip(dev, &ip))
114                 return true;
115 
116         /* check if ip is configured on upper dev */
117         if (netdev_walk_all_upper_dev_rcu(dev, br_chk_addr_ip, &ip))
118                 return true;
119 
120         return false;
121 }
122 
123 void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br,
124                               u16 vid, struct net_bridge_port *p)
125 {
126         struct net_device *dev = br->dev;
127         struct net_device *vlandev = dev;
128         struct neighbour *n;
129         struct arphdr *parp;
130         u8 *arpptr, *sha;
131         __be32 sip, tip;
132 
133         BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
134 
135         if ((dev->flags & IFF_NOARP) ||
136             !pskb_may_pull(skb, arp_hdr_len(dev)))
137                 return;
138 
139         parp = arp_hdr(skb);
140 
141         if (parp->ar_pro != htons(ETH_P_IP) ||
142             parp->ar_hln != dev->addr_len ||
143             parp->ar_pln != 4)
144                 return;
145 
146         arpptr = (u8 *)parp + sizeof(struct arphdr);
147         sha = arpptr;
148         arpptr += dev->addr_len;        /* sha */
149         memcpy(&sip, arpptr, sizeof(sip));
150         arpptr += sizeof(sip);
151         arpptr += dev->addr_len;        /* tha */
152         memcpy(&tip, arpptr, sizeof(tip));
153 
154         if (ipv4_is_loopback(tip) ||
155             ipv4_is_multicast(tip))
156                 return;
157 
158         if (br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) {
159                 if (p && (p->flags & BR_NEIGH_SUPPRESS))
160                         return;
161                 if (ipv4_is_zeronet(sip) || sip == tip) {
162                         /* prevent flooding to neigh suppress ports */
163                         BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
164                         return;
165                 }
166         }
167 
168         if (parp->ar_op != htons(ARPOP_REQUEST))
169                 return;
170 
171         if (vid != 0) {
172                 vlandev = __vlan_find_dev_deep_rcu(br->dev, skb->vlan_proto,
173                                                    vid);
174                 if (!vlandev)
175                         return;
176         }
177 
178         if (br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
179             br_is_local_ip(vlandev, tip)) {
180                 /* its our local ip, so don't proxy reply
181                  * and don't forward to neigh suppress ports
182                  */
183                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
184                 return;
185         }
186 
187         n = neigh_lookup(&arp_tbl, &tip, vlandev);
188         if (n) {
189                 struct net_bridge_fdb_entry *f;
190 
191                 if (!(n->nud_state & NUD_VALID)) {
192                         neigh_release(n);
193                         return;
194                 }
195 
196                 f = br_fdb_find_rcu(br, n->ha, vid);
197                 if (f) {
198                         bool replied = false;
199 
200                         if ((p && (p->flags & BR_PROXYARP)) ||
201                             (f->dst && (f->dst->flags & (BR_PROXYARP_WIFI |
202                                                          BR_NEIGH_SUPPRESS)))) {
203                                 if (!vid)
204                                         br_arp_send(br, p, skb->dev, sip, tip,
205                                                     sha, n->ha, sha, 0, 0);
206                                 else
207                                         br_arp_send(br, p, skb->dev, sip, tip,
208                                                     sha, n->ha, sha,
209                                                     skb->vlan_proto,
210                                                     skb_vlan_tag_get(skb));
211                                 replied = true;
212                         }
213 
214                         /* If we have replied or as long as we know the
215                          * mac, indicate to arp replied
216                          */
217                         if (replied ||
218                             br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED))
219                                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
220                 }
221 
222                 neigh_release(n);
223         }
224 }
225 #endif
226 
227 #if IS_ENABLED(CONFIG_IPV6)
228 struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *msg)
229 {
230         struct nd_msg *m;
231 
232         m = skb_header_pointer(skb, skb_network_offset(skb) +
233                                sizeof(struct ipv6hdr), sizeof(*msg), msg);
234         if (!m)
235                 return NULL;
236 
237         if (m->icmph.icmp6_code != 0 ||
238             (m->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION &&
239              m->icmph.icmp6_type != NDISC_NEIGHBOUR_ADVERTISEMENT))
240                 return NULL;
241 
242         return m;
243 }
244 
245 static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p,
246                        struct sk_buff *request, struct neighbour *n,
247                        __be16 vlan_proto, u16 vlan_tci, struct nd_msg *ns)
248 {
249         struct net_device *dev = request->dev;
250         struct net_bridge_vlan_group *vg;
251         struct sk_buff *reply;
252         struct nd_msg *na;
253         struct ipv6hdr *pip6;
254         int na_olen = 8; /* opt hdr + ETH_ALEN for target */
255         int ns_olen;
256         int i, len;
257         u8 *daddr;
258         u16 pvid;
259 
260         if (!dev)
261                 return;
262 
263         len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
264                 sizeof(*na) + na_olen + dev->needed_tailroom;
265 
266         reply = alloc_skb(len, GFP_ATOMIC);
267         if (!reply)
268                 return;
269 
270         reply->protocol = htons(ETH_P_IPV6);
271         reply->dev = dev;
272         skb_reserve(reply, LL_RESERVED_SPACE(dev));
273         skb_push(reply, sizeof(struct ethhdr));
274         skb_set_mac_header(reply, 0);
275 
276         daddr = eth_hdr(request)->h_source;
277 
278         /* Do we need option processing ? */
279         ns_olen = request->len - (skb_network_offset(request) +
280                                   sizeof(struct ipv6hdr)) - sizeof(*ns);
281         for (i = 0; i < ns_olen - 1; i += (ns->opt[i + 1] << 3)) {
282                 if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
283                         daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
284                         break;
285                 }
286         }
287 
288         /* Ethernet header */
289         ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
290         ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
291         eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
292         reply->protocol = htons(ETH_P_IPV6);
293 
294         skb_pull(reply, sizeof(struct ethhdr));
295         skb_set_network_header(reply, 0);
296         skb_put(reply, sizeof(struct ipv6hdr));
297 
298         /* IPv6 header */
299         pip6 = ipv6_hdr(reply);
300         memset(pip6, 0, sizeof(struct ipv6hdr));
301         pip6->version = 6;
302         pip6->priority = ipv6_hdr(request)->priority;
303         pip6->nexthdr = IPPROTO_ICMPV6;
304         pip6->hop_limit = 255;
305         pip6->daddr = ipv6_hdr(request)->saddr;
306         pip6->saddr = *(struct in6_addr *)n->primary_key;
307 
308         skb_pull(reply, sizeof(struct ipv6hdr));
309         skb_set_transport_header(reply, 0);
310 
311         na = (struct nd_msg *)skb_put(reply, sizeof(*na) + na_olen);
312 
313         /* Neighbor Advertisement */
314         memset(na, 0, sizeof(*na) + na_olen);
315         na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
316         na->icmph.icmp6_router = (n->flags & NTF_ROUTER) ? 1 : 0;
317         na->icmph.icmp6_override = 1;
318         na->icmph.icmp6_solicited = 1;
319         na->target = ns->target;
320         ether_addr_copy(&na->opt[2], n->ha);
321         na->opt[0] = ND_OPT_TARGET_LL_ADDR;
322         na->opt[1] = na_olen >> 3;
323 
324         na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
325                                                 &pip6->daddr,
326                                                 sizeof(*na) + na_olen,
327                                                 IPPROTO_ICMPV6,
328                                                 csum_partial(na, sizeof(*na) + na_olen, 0));
329 
330         pip6->payload_len = htons(sizeof(*na) + na_olen);
331 
332         skb_push(reply, sizeof(struct ipv6hdr));
333         skb_push(reply, sizeof(struct ethhdr));
334 
335         reply->ip_summed = CHECKSUM_UNNECESSARY;
336 
337         if (p)
338                 vg = nbp_vlan_group_rcu(p);
339         else
340                 vg = br_vlan_group_rcu(br);
341         pvid = br_get_pvid(vg);
342         if (pvid == (vlan_tci & VLAN_VID_MASK))
343                 vlan_tci = 0;
344 
345         if (vlan_tci)
346                 __vlan_hwaccel_put_tag(reply, vlan_proto, vlan_tci);
347 
348         netdev_dbg(dev, "nd send dev %s dst %pI6 dst_hw %pM src %pI6 src_hw %pM\n",
349                    dev->name, &pip6->daddr, daddr, &pip6->saddr, n->ha);
350 
351         if (p) {
352                 dev_queue_xmit(reply);
353         } else {
354                 skb_reset_mac_header(reply);
355                 __skb_pull(reply, skb_network_offset(reply));
356                 reply->ip_summed = CHECKSUM_UNNECESSARY;
357                 reply->pkt_type = PACKET_HOST;
358 
359                 netif_rx_ni(reply);
360         }
361 }
362 
363 static int br_chk_addr_ip6(struct net_device *dev, void *data)
364 {
365         struct in6_addr *addr = (struct in6_addr *)data;
366 
367         if (ipv6_chk_addr(dev_net(dev), addr, dev, 0))
368                 return 1;
369 
370         return 0;
371 }
372 
373 static bool br_is_local_ip6(struct net_device *dev, struct in6_addr *addr)
374 
375 {
376         if (br_chk_addr_ip6(dev, addr))
377                 return true;
378 
379         /* check if ip is configured on upper dev */
380         if (netdev_walk_all_upper_dev_rcu(dev, br_chk_addr_ip6, addr))
381                 return true;
382 
383         return false;
384 }
385 
386 void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br,
387                        u16 vid, struct net_bridge_port *p, struct nd_msg *msg)
388 {
389         struct net_device *dev = br->dev;
390         struct net_device *vlandev = NULL;
391         struct in6_addr *saddr, *daddr;
392         struct ipv6hdr *iphdr;
393         struct neighbour *n;
394 
395         BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
396 
397         if (p && (p->flags & BR_NEIGH_SUPPRESS))
398                 return;
399 
400         if (msg->icmph.icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT &&
401             !msg->icmph.icmp6_solicited) {
402                 /* prevent flooding to neigh suppress ports */
403                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
404                 return;
405         }
406 
407         if (msg->icmph.icmp6_type != NDISC_NEIGHBOUR_SOLICITATION)
408                 return;
409 
410         iphdr = ipv6_hdr(skb);
411         saddr = &iphdr->saddr;
412         daddr = &iphdr->daddr;
413 
414         if (ipv6_addr_any(saddr) || !ipv6_addr_cmp(saddr, daddr)) {
415                 /* prevent flooding to neigh suppress ports */
416                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
417                 return;
418         }
419 
420         if (vid != 0) {
421                 /* build neigh table lookup on the vlan device */
422                 vlandev = __vlan_find_dev_deep_rcu(br->dev, skb->vlan_proto,
423                                                    vid);
424                 if (!vlandev)
425                         return;
426         } else {
427                 vlandev = dev;
428         }
429 
430         if (br_is_local_ip6(vlandev, &msg->target)) {
431                 /* its our own ip, so don't proxy reply
432                  * and don't forward to arp suppress ports
433                  */
434                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
435                 return;
436         }
437 
438         n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev);
439         if (n) {
440                 struct net_bridge_fdb_entry *f;
441 
442                 if (!(n->nud_state & NUD_VALID)) {
443                         neigh_release(n);
444                         return;
445                 }
446 
447                 f = br_fdb_find_rcu(br, n->ha, vid);
448                 if (f) {
449                         bool replied = false;
450 
451                         if (f->dst && (f->dst->flags & BR_NEIGH_SUPPRESS)) {
452                                 if (vid != 0)
453                                         br_nd_send(br, p, skb, n,
454                                                    skb->vlan_proto,
455                                                    skb_vlan_tag_get(skb), msg);
456                                 else
457                                         br_nd_send(br, p, skb, n, 0, 0, msg);
458                                 replied = true;
459                         }
460 
461                         /* If we have replied or as long as we know the
462                          * mac, indicate to NEIGH_SUPPRESS ports that we
463                          * have replied
464                          */
465                         if (replied ||
466                             br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED))
467                                 BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
468                 }
469                 neigh_release(n);
470         }
471 }
472 #endif
473 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp