1/*
2 *	Handle incoming frames
3 *	Linux ethernet bridge
4 *
5 *	Authors:
6 *	Lennert Buytenhek		<buytenh@gnu.org>
7 *
8 *	This program is free software; you can redistribute it and/or
9 *	modify it under the terms of the GNU General Public License
10 *	as published by the Free Software Foundation; either version
11 *	2 of the License, or (at your option) any later version.
12 */
13
14#include <linux/slab.h>
15#include <linux/kernel.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/netfilter_bridge.h>
19#include <linux/neighbour.h>
20#include <net/arp.h>
21#include <linux/export.h>
22#include <linux/rculist.h>
23#include "br_private.h"
24
25/* Hook for brouter */
26br_should_route_hook_t __rcu *br_should_route_hook __read_mostly;
27EXPORT_SYMBOL(br_should_route_hook);
28
29static int br_pass_frame_up(struct sk_buff *skb)
30{
31	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
32	struct net_bridge *br = netdev_priv(brdev);
33	struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
34	struct net_port_vlans *pv;
35
36	u64_stats_update_begin(&brstats->syncp);
37	brstats->rx_packets++;
38	brstats->rx_bytes += skb->len;
39	u64_stats_update_end(&brstats->syncp);
40
41	/* Bridge is just like any other port.  Make sure the
42	 * packet is allowed except in promisc modue when someone
43	 * may be running packet capture.
44	 */
45	pv = br_get_vlan_info(br);
46	if (!(brdev->flags & IFF_PROMISC) &&
47	    !br_allowed_egress(br, pv, skb)) {
48		kfree_skb(skb);
49		return NET_RX_DROP;
50	}
51
52	indev = skb->dev;
53	skb->dev = brdev;
54	skb = br_handle_vlan(br, pv, skb);
55	if (!skb)
56		return NET_RX_DROP;
57
58	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, NULL, skb,
59		       indev, NULL,
60		       netif_receive_skb_sk);
61}
62
63static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
64			    u16 vid, struct net_bridge_port *p)
65{
66	struct net_device *dev = br->dev;
67	struct neighbour *n;
68	struct arphdr *parp;
69	u8 *arpptr, *sha;
70	__be32 sip, tip;
71
72	BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
73
74	if (dev->flags & IFF_NOARP)
75		return;
76
77	if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
78		dev->stats.tx_dropped++;
79		return;
80	}
81	parp = arp_hdr(skb);
82
83	if (parp->ar_pro != htons(ETH_P_IP) ||
84	    parp->ar_op != htons(ARPOP_REQUEST) ||
85	    parp->ar_hln != dev->addr_len ||
86	    parp->ar_pln != 4)
87		return;
88
89	arpptr = (u8 *)parp + sizeof(struct arphdr);
90	sha = arpptr;
91	arpptr += dev->addr_len;	/* sha */
92	memcpy(&sip, arpptr, sizeof(sip));
93	arpptr += sizeof(sip);
94	arpptr += dev->addr_len;	/* tha */
95	memcpy(&tip, arpptr, sizeof(tip));
96
97	if (ipv4_is_loopback(tip) ||
98	    ipv4_is_multicast(tip))
99		return;
100
101	n = neigh_lookup(&arp_tbl, &tip, dev);
102	if (n) {
103		struct net_bridge_fdb_entry *f;
104
105		if (!(n->nud_state & NUD_VALID)) {
106			neigh_release(n);
107			return;
108		}
109
110		f = __br_fdb_get(br, n->ha, vid);
111		if (f && ((p->flags & BR_PROXYARP) ||
112			  (f->dst && (f->dst->flags & BR_PROXYARP_WIFI)))) {
113			arp_send(ARPOP_REPLY, ETH_P_ARP, sip, skb->dev, tip,
114				 sha, n->ha, sha);
115			BR_INPUT_SKB_CB(skb)->proxyarp_replied = true;
116		}
117
118		neigh_release(n);
119	}
120}
121
122/* note: already called with rcu_read_lock */
123int br_handle_frame_finish(struct sock *sk, struct sk_buff *skb)
124{
125	const unsigned char *dest = eth_hdr(skb)->h_dest;
126	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
127	struct net_bridge *br;
128	struct net_bridge_fdb_entry *dst;
129	struct net_bridge_mdb_entry *mdst;
130	struct sk_buff *skb2;
131	bool unicast = true;
132	u16 vid = 0;
133
134	if (!p || p->state == BR_STATE_DISABLED)
135		goto drop;
136
137	if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid))
138		goto out;
139
140	/* insert into forwarding database after filtering to avoid spoofing */
141	br = p->br;
142	if (p->flags & BR_LEARNING)
143		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
144
145	if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
146	    br_multicast_rcv(br, p, skb, vid))
147		goto drop;
148
149	if (p->state == BR_STATE_LEARNING)
150		goto drop;
151
152	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
153
154	/* The packet skb2 goes to the local host (NULL to skip). */
155	skb2 = NULL;
156
157	if (br->dev->flags & IFF_PROMISC)
158		skb2 = skb;
159
160	dst = NULL;
161
162	if (IS_ENABLED(CONFIG_INET) && skb->protocol == htons(ETH_P_ARP))
163		br_do_proxy_arp(skb, br, vid, p);
164
165	if (is_broadcast_ether_addr(dest)) {
166		skb2 = skb;
167		unicast = false;
168	} else if (is_multicast_ether_addr(dest)) {
169		mdst = br_mdb_get(br, skb, vid);
170		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
171		    br_multicast_querier_exists(br, eth_hdr(skb))) {
172			if ((mdst && mdst->mglist) ||
173			    br_multicast_is_router(br))
174				skb2 = skb;
175			br_multicast_forward(mdst, skb, skb2);
176			skb = NULL;
177			if (!skb2)
178				goto out;
179		} else
180			skb2 = skb;
181
182		unicast = false;
183		br->dev->stats.multicast++;
184	} else if ((dst = __br_fdb_get(br, dest, vid)) &&
185			dst->is_local) {
186		skb2 = skb;
187		/* Do not forward the packet since it's local. */
188		skb = NULL;
189	}
190
191	if (skb) {
192		if (dst) {
193			dst->used = jiffies;
194			br_forward(dst->dst, skb, skb2);
195		} else
196			br_flood_forward(br, skb, skb2, unicast);
197	}
198
199	if (skb2)
200		return br_pass_frame_up(skb2);
201
202out:
203	return 0;
204drop:
205	kfree_skb(skb);
206	goto out;
207}
208EXPORT_SYMBOL_GPL(br_handle_frame_finish);
209
210/* note: already called with rcu_read_lock */
211static int br_handle_local_finish(struct sock *sk, struct sk_buff *skb)
212{
213	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
214	u16 vid = 0;
215
216	/* check if vlan is allowed, to avoid spoofing */
217	if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
218		br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
219	return 0;	 /* process further */
220}
221
222/*
223 * Return NULL if skb is handled
224 * note: already called with rcu_read_lock
225 */
226rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
227{
228	struct net_bridge_port *p;
229	struct sk_buff *skb = *pskb;
230	const unsigned char *dest = eth_hdr(skb)->h_dest;
231	br_should_route_hook_t *rhook;
232
233	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
234		return RX_HANDLER_PASS;
235
236	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
237		goto drop;
238
239	skb = skb_share_check(skb, GFP_ATOMIC);
240	if (!skb)
241		return RX_HANDLER_CONSUMED;
242
243	p = br_port_get_rcu(skb->dev);
244
245	if (unlikely(is_link_local_ether_addr(dest))) {
246		u16 fwd_mask = p->br->group_fwd_mask_required;
247
248		/*
249		 * See IEEE 802.1D Table 7-10 Reserved addresses
250		 *
251		 * Assignment		 		Value
252		 * Bridge Group Address		01-80-C2-00-00-00
253		 * (MAC Control) 802.3		01-80-C2-00-00-01
254		 * (Link Aggregation) 802.3	01-80-C2-00-00-02
255		 * 802.1X PAE address		01-80-C2-00-00-03
256		 *
257		 * 802.1AB LLDP 		01-80-C2-00-00-0E
258		 *
259		 * Others reserved for future standardization
260		 */
261		switch (dest[5]) {
262		case 0x00:	/* Bridge Group Address */
263			/* If STP is turned off,
264			   then must forward to keep loop detection */
265			if (p->br->stp_enabled == BR_NO_STP ||
266			    fwd_mask & (1u << dest[5]))
267				goto forward;
268			break;
269
270		case 0x01:	/* IEEE MAC (Pause) */
271			goto drop;
272
273		default:
274			/* Allow selective forwarding for most other protocols */
275			fwd_mask |= p->br->group_fwd_mask;
276			if (fwd_mask & (1u << dest[5]))
277				goto forward;
278		}
279
280		/* Deliver packet to local host only */
281		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, NULL, skb,
282			    skb->dev, NULL, br_handle_local_finish)) {
283			return RX_HANDLER_CONSUMED; /* consumed by filter */
284		} else {
285			*pskb = skb;
286			return RX_HANDLER_PASS;	/* continue processing */
287		}
288	}
289
290forward:
291	switch (p->state) {
292	case BR_STATE_FORWARDING:
293		rhook = rcu_dereference(br_should_route_hook);
294		if (rhook) {
295			if ((*rhook)(skb)) {
296				*pskb = skb;
297				return RX_HANDLER_PASS;
298			}
299			dest = eth_hdr(skb)->h_dest;
300		}
301		/* fall through */
302	case BR_STATE_LEARNING:
303		if (ether_addr_equal(p->br->dev->dev_addr, dest))
304			skb->pkt_type = PACKET_HOST;
305
306		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, NULL, skb,
307			skb->dev, NULL,
308			br_handle_frame_finish);
309		break;
310	default:
311drop:
312		kfree_skb(skb);
313	}
314	return RX_HANDLER_CONSUMED;
315}
316