[linux-2.6-block.git] / net / bridge / br_input.c

// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *	Handle incoming frames
 *	Linux ethernet bridge
 *
 *	Authors:
 *	Lennert Buytenhek		<buytenh@gnu.org>
 */

#include <linux/slab.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/netfilter_bridge.h>
#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
#include <net/netfilter/nf_queue.h>
#endif
#include <linux/neighbour.h>
#include <net/arp.h>
#include <net/dsa.h>
#include <linux/export.h>
#include <linux/rculist.h>
#include "br_private.h"
#include "br_private_tunnel.h"

static int
br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb)
{
	br_drop_fake_rtable(skb);
	return netif_receive_skb(skb);
}

static int br_pass_frame_up(struct sk_buff *skb, bool promisc)
{
	struct net_device *indev, *brdev = BR_INPUT_SKB_CB(skb)->brdev;
	struct net_bridge *br = netdev_priv(brdev);
	struct net_bridge_vlan_group *vg;

	dev_sw_netstats_rx_add(brdev, skb->len);

	vg = br_vlan_group_rcu(br);

	/* Reset the offload_fwd_mark because there could be a stacked
	 * bridge above, and it should not think this bridge it doing
	 * that bridge's work forwarding out its ports.
	 */
	br_switchdev_frame_unmark(skb);

	/* Bridge is just like any other port.  Make sure the
	 * packet is allowed except in promisc mode when someone
	 * may be running packet capture.
	 */
	if (!(brdev->flags & IFF_PROMISC) &&
	    !br_allowed_egress(vg, skb)) {
		kfree_skb(skb);
		return NET_RX_DROP;
	}

	indev = skb->dev;
	skb->dev = brdev;
	skb = br_handle_vlan(br, NULL, vg, skb);
	if (!skb)
		return NET_RX_DROP;
	/* update the multicast stats if the packet is IGMP/MLD */
	br_multicast_count(br, NULL, skb, br_multicast_igmp_type(skb),
			   BR_MCAST_DIR_TX);

	BR_INPUT_SKB_CB(skb)->promisc = promisc;

	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
		       dev_net(indev), NULL, skb, indev, NULL,
		       br_netif_receive_skb);
}

/* note: already called with rcu_read_lock */
int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
{
	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
	enum br_pkt_type pkt_type = BR_PKT_UNICAST;
	struct net_bridge_fdb_entry *dst = NULL;
	struct net_bridge_mcast_port *pmctx;
	struct net_bridge_mdb_entry *mdst;
	bool local_rcv, mcast_hit = false;
	struct net_bridge_mcast *brmctx;
	struct net_bridge_vlan *vlan;
	struct net_bridge *br;
	bool promisc;
	u16 vid = 0;
	u8 state;

	if (!p)
		goto drop;

	br = p->br;

	if (br_mst_is_enabled(br)) {
		state = BR_STATE_FORWARDING;
	} else {
		if (p->state == BR_STATE_DISABLED) {
			reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
			goto drop;
		}

		state = p->state;
	}

	brmctx = &p->br->multicast_ctx;
	pmctx = &p->multicast_ctx;
	if (!br_allowed_ingress(p->br, nbp_vlan_group_rcu(p), skb, &vid,
				&state, &vlan))
		goto out;

	if (p->flags & BR_PORT_LOCKED) {
		struct net_bridge_fdb_entry *fdb_src =
			br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid);

		if (!fdb_src) {
			/* FDB miss. Create locked FDB entry if MAB is enabled
			 * and drop the packet.
			 */
			if (p->flags & BR_PORT_MAB)
				br_fdb_update(br, p, eth_hdr(skb)->h_source,
					      vid, BIT(BR_FDB_LOCKED));
			goto drop;
		} else if (READ_ONCE(fdb_src->dst) != p ||
			   test_bit(BR_FDB_LOCAL, &fdb_src->flags)) {
			/* FDB mismatch. Drop the packet without roaming. */
			goto drop;
		} else if (test_bit(BR_FDB_LOCKED, &fdb_src->flags)) {
			/* FDB match, but entry is locked. Refresh it and drop
			 * the packet.
			 */
			br_fdb_update(br, p, eth_hdr(skb)->h_source, vid,
				      BIT(BR_FDB_LOCKED));
			goto drop;
		}
	}

	nbp_switchdev_frame_mark(p, skb);

	/* insert into forwarding database after filtering to avoid spoofing */
	if (p->flags & BR_LEARNING)
		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);

	promisc = !!(br->dev->flags & IFF_PROMISC);
	local_rcv = promisc;

	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
		/* by definition the broadcast is also a multicast address */
		if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
			pkt_type = BR_PKT_BROADCAST;
			local_rcv = true;
		} else {
			pkt_type = BR_PKT_MULTICAST;
			if (br_multicast_rcv(&brmctx, &pmctx, vlan, skb, vid))
				goto drop;
		}
	}

	if (state == BR_STATE_LEARNING) {
		reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
		goto drop;
	}

	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
	BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED);

	if (IS_ENABLED(CONFIG_INET) &&
	    (skb->protocol == htons(ETH_P_ARP) ||
	     skb->protocol == htons(ETH_P_RARP))) {
		br_do_proxy_suppress_arp(skb, br, vid, p);
	} else if (IS_ENABLED(CONFIG_IPV6) &&
		   skb->protocol == htons(ETH_P_IPV6) &&
		   br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
		   pskb_may_pull(skb, sizeof(struct ipv6hdr) +
				 sizeof(struct nd_msg)) &&
		   ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
			struct nd_msg *msg, _msg;

			msg = br_is_nd_neigh_msg(skb, &_msg);
			if (msg)
				br_do_suppress_nd(skb, br, vid, p, msg);
	}

	switch (pkt_type) {
	case BR_PKT_MULTICAST:
		mdst = br_mdb_entry_skb_get(brmctx, skb, vid);
		if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst)) {
			if ((mdst && mdst->host_joined) ||
			    br_multicast_is_router(brmctx, skb) ||
			    br->dev->flags & IFF_ALLMULTI) {
				local_rcv = true;
				DEV_STATS_INC(br->dev, multicast);
			}
			mcast_hit = true;
		} else {
			local_rcv = true;
			DEV_STATS_INC(br->dev, multicast);
		}
		break;
	case BR_PKT_UNICAST:
		dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
		break;
	default:
		break;
	}

	if (dst) {
		unsigned long now = jiffies;

		if (test_bit(BR_FDB_LOCAL, &dst->flags))
			return br_pass_frame_up(skb, false);

		if (now != dst->used)
			dst->used = now;
		br_forward(dst->dst, skb, local_rcv, false);
	} else {
		if (!mcast_hit)
			br_flood(br, skb, pkt_type, local_rcv, false, vid);
		else
			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
	}

	if (local_rcv)
		return br_pass_frame_up(skb, promisc);

out:
	return 0;
drop:
	kfree_skb_reason(skb, reason);
	goto out;
}
EXPORT_SYMBOL_GPL(br_handle_frame_finish);

static void __br_handle_local_finish(struct sk_buff *skb)
{
	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
	u16 vid = 0;

	/* check if vlan is allowed, to avoid spoofing */
	if ((p->flags & BR_LEARNING) &&
	    nbp_state_should_learn(p) &&
	    !br_opt_get(p->br, BROPT_NO_LL_LEARN) &&
	    br_should_learn(p, skb, &vid))
		br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, 0);
}

/* note: already called with rcu_read_lock */
static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
{
	__br_handle_local_finish(skb);

	/* return 1 to signal the okfn() was called so it's ok to use the skb */
	return 1;
}

static int nf_hook_bridge_pre(struct sk_buff *skb, struct sk_buff **pskb)
{
#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
	struct nf_hook_entries *e = NULL;
	struct nf_hook_state state;
	unsigned int verdict, i;
	struct net *net;
	int ret;

	net = dev_net(skb->dev);
#ifdef HAVE_JUMP_LABEL
	if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))
		goto frame_finish;
#endif

	e = rcu_dereference(net->nf.hooks_bridge[NF_BR_PRE_ROUTING]);
	if (!e)
		goto frame_finish;

	nf_hook_state_init(&state, NF_BR_PRE_ROUTING,
			   NFPROTO_BRIDGE, skb->dev, NULL, NULL,
			   net, br_handle_frame_finish);

	for (i = 0; i < e->num_hook_entries; i++) {
		verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state);
		switch (verdict & NF_VERDICT_MASK) {
		case NF_ACCEPT:
			if (BR_INPUT_SKB_CB(skb)->br_netfilter_broute) {
				*pskb = skb;
				return RX_HANDLER_PASS;
			}
			break;
		case NF_DROP:
			kfree_skb(skb);
			return RX_HANDLER_CONSUMED;
		case NF_QUEUE:
			ret = nf_queue(skb, &state, i, verdict);
			if (ret == 1)
				continue;
			return RX_HANDLER_CONSUMED;
		default: /* STOLEN */
			return RX_HANDLER_CONSUMED;
		}
	}
frame_finish:
	net = dev_net(skb->dev);
	br_handle_frame_finish(net, NULL, skb);
#else
	br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
#endif
	return RX_HANDLER_CONSUMED;
}

/* Return 0 if the frame was not processed otherwise 1
 * note: already called with rcu_read_lock
 */
static int br_process_frame_type(struct net_bridge_port *p,
				 struct sk_buff *skb)
{
	struct br_frame_type *tmp;

	hlist_for_each_entry_rcu(tmp, &p->br->frame_type_list, list)
		if (unlikely(tmp->type == skb->protocol))
			return tmp->frame_handler(p, skb);

	return 0;
}

/*
 * Return NULL if skb is handled
 * note: already called with rcu_read_lock
 */
static rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
{
	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
	struct net_bridge_port *p;
	struct sk_buff *skb = *pskb;
	const unsigned char *dest = eth_hdr(skb)->h_dest;

	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
		return RX_HANDLER_PASS;

	if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) {
		reason = SKB_DROP_REASON_MAC_INVALID_SOURCE;
		goto drop;
	}

	skb = skb_share_check(skb, GFP_ATOMIC);
	if (!skb)
		return RX_HANDLER_CONSUMED;

	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
	br_tc_skb_miss_set(skb, false);

	p = br_port_get_rcu(skb->dev);
	if (p->flags & BR_VLAN_TUNNEL)
		br_handle_ingress_vlan_tunnel(skb, p, nbp_vlan_group_rcu(p));

	if (unlikely(is_link_local_ether_addr(dest))) {
		u16 fwd_mask = p->br->group_fwd_mask_required;

		/*
		 * See IEEE 802.1D Table 7-10 Reserved addresses
		 *
		 * Assignment		 		Value
		 * Bridge Group Address		01-80-C2-00-00-00
		 * (MAC Control) 802.3		01-80-C2-00-00-01
		 * (Link Aggregation) 802.3	01-80-C2-00-00-02
		 * 802.1X PAE address		01-80-C2-00-00-03
		 *
		 * 802.1AB LLDP 		01-80-C2-00-00-0E
		 *
		 * Others reserved for future standardization
		 */
		fwd_mask |= p->group_fwd_mask;
		switch (dest[5]) {
		case 0x00:	/* Bridge Group Address */
			/* If STP is turned off,
			   then must forward to keep loop detection */
			if (p->br->stp_enabled == BR_NO_STP ||
			    fwd_mask & (1u << dest[5]))
				goto forward;
			*pskb = skb;
			__br_handle_local_finish(skb);
			return RX_HANDLER_PASS;

		case 0x01:	/* IEEE MAC (Pause) */
			reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL;
			goto drop;

		case 0x0E:	/* 802.1AB LLDP */
			fwd_mask |= p->br->group_fwd_mask;
			if (fwd_mask & (1u << dest[5]))
				goto forward;
			*pskb = skb;
			__br_handle_local_finish(skb);
			return RX_HANDLER_PASS;

		default:
			/* Allow selective forwarding for most other protocols */
			fwd_mask |= p->br->group_fwd_mask;
			if (fwd_mask & (1u << dest[5]))
				goto forward;
		}

		BR_INPUT_SKB_CB(skb)->promisc = false;

		/* The else clause should be hit when nf_hook():
		 *   - returns < 0 (drop/error)
		 *   - returns = 0 (stolen/nf_queue)
		 * Thus return 1 from the okfn() to signal the skb is ok to pass
		 */
		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
			    dev_net(skb->dev), NULL, skb, skb->dev, NULL,
			    br_handle_local_finish) == 1) {
			return RX_HANDLER_PASS;
		} else {
			return RX_HANDLER_CONSUMED;
		}
	}

	if (unlikely(br_process_frame_type(p, skb)))
		return RX_HANDLER_PASS;

forward:
	if (br_mst_is_enabled(p->br))
		goto defer_stp_filtering;

	switch (p->state) {
	case BR_STATE_FORWARDING:
	case BR_STATE_LEARNING:
defer_stp_filtering:
		if (ether_addr_equal(p->br->dev->dev_addr, dest))
			skb->pkt_type = PACKET_HOST;

		return nf_hook_bridge_pre(skb, pskb);
	default:
		reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
drop:
		kfree_skb_reason(skb, reason);
	}
	return RX_HANDLER_CONSUMED;
}

/* This function has no purpose other than to appease the br_port_get_rcu/rtnl
 * helpers which identify bridged ports according to the rx_handler installed
 * on them (so there _needs_ to be a bridge rx_handler even if we don't need it
 * to do anything useful). This bridge won't support traffic to/from the stack,
 * but only hardware bridging. So return RX_HANDLER_PASS so we don't steal
 * frames from the ETH_P_XDSA packet_type handler.
 */
static rx_handler_result_t br_handle_frame_dummy(struct sk_buff **pskb)
{
	return RX_HANDLER_PASS;
}

rx_handler_func_t *br_get_rx_handler(const struct net_device *dev)
{
	if (netdev_uses_dsa(dev))
		return br_handle_frame_dummy;

	return br_handle_frame;
}

void br_add_frame(struct net_bridge *br, struct br_frame_type *ft)
{
	hlist_add_head_rcu(&ft->list, &br->frame_type_list);
}

void br_del_frame(struct net_bridge *br, struct br_frame_type *ft)
{
	struct br_frame_type *tmp;

	hlist_for_each_entry(tmp, &br->frame_type_list, list)
		if (ft == tmp) {
			hlist_del_rcu(&ft->list);
			return;
		}
}
Commit	Line	Data
2874c5fd	1	// SPDX-License-Identifier: GPL-2.0-or-later
1da177e4 LT	2	/*
	3	* Handle incoming frames
	4	* Linux ethernet bridge
	5	*
	6	* Authors:
	7	* Lennert Buytenhek <buytenh@gnu.org>
1da177e4 LT	8	*/
1da177e4 LT	9
5a0e3ad6	10	#include <linux/slab.h>
1da177e4 LT	11	#include <linux/kernel.h>
	12	#include <linux/netdevice.h>
	13	#include <linux/etherdevice.h>
	14	#include <linux/netfilter_bridge.h>
dc2f4189	15	#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
971502d7	16	#include <net/netfilter/nf_queue.h>
dc2f4189	17	#endif
95850116 KP	18	#include <linux/neighbour.h>
95850116 KP	19	#include <net/arp.h>
9eb8eff0	20	#include <net/dsa.h>
bc3b2d7f	21	#include <linux/export.h>
a37b85c9	22	#include <linux/rculist.h>
1da177e4	23	#include "br_private.h"
11538d03	24	#include "br_private_tunnel.h"
1da177e4	25
0c4b51f0 EB	26	static int
0c4b51f0 EB	27	br_netif_receive_skb(struct net net, struct sock sk, struct sk_buff *skb)
04eb4489	28	{
a13b2082	29	br_drop_fake_rtable(skb);
04eb4489 EB	30	return netif_receive_skb(skb);
	31	}
	32
751de201	33	static int br_pass_frame_up(struct sk_buff *skb, bool promisc)
1da177e4	34	{
68b7c895	35	struct net_device indev, brdev = BR_INPUT_SKB_CB(skb)->brdev;
14bb4789	36	struct net_bridge *br = netdev_priv(brdev);
2594e906	37	struct net_bridge_vlan_group *vg;
1da177e4	38
7609ecb2	39	dev_sw_netstats_rx_add(brdev, skb->len);
1da177e4	40
907b1e6e	41	vg = br_vlan_group_rcu(br);
fbb3abdf AL	42
	43	/* Reset the offload_fwd_mark because there could be a stacked
	44	* bridge above, and it should not think this bridge it doing
	45	* that bridge's work forwarding out its ports.
	46	*/
	47	br_switchdev_frame_unmark(skb);
	48
85f46c6b	49	/* Bridge is just like any other port. Make sure the
efb5b338	50	* packet is allowed except in promisc mode when someone
85f46c6b VY	51	* may be running packet capture.
	52	*/
	53	if (!(brdev->flags & IFF_PROMISC) &&
2594e906	54	!br_allowed_egress(vg, skb)) {
85f46c6b VY	55	kfree_skb(skb);
	56	return NET_RX_DROP;
	57	}
	58
1da177e4	59	indev = skb->dev;
a339f1c8	60	skb->dev = brdev;
11538d03	61	skb = br_handle_vlan(br, NULL, vg, skb);
fc92f745 VY	62	if (!skb)
fc92f745 VY	63	return NET_RX_DROP;
1080ab95	64	/* update the multicast stats if the packet is IGMP/MLD */
a65056ec	65	br_multicast_count(br, NULL, skb, br_multicast_igmp_type(skb),
1080ab95	66	BR_MCAST_DIR_TX);
1da177e4	67
751de201 PNA	68	BR_INPUT_SKB_CB(skb)->promisc = promisc;
751de201 PNA	69
29a26a56 EB	70	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
29a26a56 EB	71	dev_net(indev), NULL, skb, indev, NULL,
04eb4489	72	br_netif_receive_skb);
1da177e4 LT	73	}
1da177e4 LT	74
eeaf61d8	75	/* note: already called with rcu_read_lock */
0c4b51f0	76	int br_handle_frame_finish(struct net net, struct sock sk, struct sk_buff *skb)
1da177e4	77	{
623e43c2	78	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
f350a0a8	79	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
8addd5e7	80	enum br_pkt_type pkt_type = BR_PKT_UNICAST;
46c0772d	81	struct net_bridge_fdb_entry *dst = NULL;
adc47037	82	struct net_bridge_mcast_port *pmctx;
c4fcb78c	83	struct net_bridge_mdb_entry *mdst;
8addd5e7	84	bool local_rcv, mcast_hit = false;
adc47037	85	struct net_bridge_mcast *brmctx;
f4b7002a	86	struct net_bridge_vlan *vlan;
46c0772d	87	struct net_bridge *br;
751de201	88	bool promisc;
78851988	89	u16 vid = 0;
a580c76d	90	u8 state;
1da177e4	91
ec7328b5	92	if (!p)
b3f1be4b SH	93	goto drop;
b3f1be4b SH	94
a21d9a67	95	br = p->br;
ec7328b5 TW	96
	97	if (br_mst_is_enabled(br)) {
	98	state = BR_STATE_FORWARDING;
	99	} else {
623e43c2 RR	100	if (p->state == BR_STATE_DISABLED) {
623e43c2 RR	101	reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
ec7328b5	102	goto drop;
623e43c2	103	}
ec7328b5 TW	104
	105	state = p->state;
	106	}
	107
adc47037 NA	108	brmctx = &p->br->multicast_ctx;
adc47037 NA	109	pmctx = &p->multicast_ctx;
a580c76d	110	if (!br_allowed_ingress(p->br, nbp_vlan_group_rcu(p), skb, &vid,
f4b7002a	111	&state, &vlan))
eb707618	112	goto out;
a37b85c9	113
a21d9a67 HS	114	if (p->flags & BR_PORT_LOCKED) {
	115	struct net_bridge_fdb_entry *fdb_src =
	116	br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid);
	117
a35ec8e3 HS	118	if (!fdb_src) {
	119	/* FDB miss. Create locked FDB entry if MAB is enabled
	120	* and drop the packet.
	121	*/
	122	if (p->flags & BR_PORT_MAB)
	123	br_fdb_update(br, p, eth_hdr(skb)->h_source,
	124	vid, BIT(BR_FDB_LOCKED));
a21d9a67	125	goto drop;
a35ec8e3 HS	126	} else if (READ_ONCE(fdb_src->dst) != p \|\|
	127	test_bit(BR_FDB_LOCAL, &fdb_src->flags)) {
	128	/* FDB mismatch. Drop the packet without roaming. */
	129	goto drop;
3e35f26d	130	} else if (test_bit(BR_FDB_LOCKED, &fdb_src->flags)) {
a35ec8e3 HS	131	/* FDB match, but entry is locked. Refresh it and drop
	132	* the packet.
	133	*/
	134	br_fdb_update(br, p, eth_hdr(skb)->h_source, vid,
	135	BIT(BR_FDB_LOCKED));
	136	goto drop;
	137	}
a21d9a67 HS	138	}
a21d9a67 HS	139
6bc506b4 IS	140	nbp_switchdev_frame_mark(p, skb);
6bc506b4 IS	141
85967bb4	142	/* insert into forwarding database after filtering to avoid spoofing */
9ba18891	143	if (p->flags & BR_LEARNING)
be0c5677	144	br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);
85967bb4	145
751de201 PNA	146	promisc = !!(br->dev->flags & IFF_PROMISC);
	147	local_rcv = promisc;
	148
3d26eb8a	149	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) {
8addd5e7	150	/* by definition the broadcast is also a multicast address */
3d26eb8a	151	if (is_broadcast_ether_addr(eth_hdr(skb)->h_dest)) {
8addd5e7 NA	152	pkt_type = BR_PKT_BROADCAST;
	153	local_rcv = true;
	154	} else {
	155	pkt_type = BR_PKT_MULTICAST;
f4b7002a	156	if (br_multicast_rcv(&brmctx, &pmctx, vlan, skb, vid))
8addd5e7 NA	157	goto drop;
	158	}
	159	}
c4fcb78c	160
623e43c2 RR	161	if (state == BR_STATE_LEARNING) {
623e43c2 RR	162	reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
b3f1be4b	163	goto drop;
623e43c2	164	}
0e5eabac	165
68b7c895	166	BR_INPUT_SKB_CB(skb)->brdev = br->dev;
7d850abd	167	BR_INPUT_SKB_CB(skb)->src_port_isolated = !!(p->flags & BR_ISOLATED);
68b7c895	168
057658cb RP	169	if (IS_ENABLED(CONFIG_INET) &&
	170	(skb->protocol == htons(ETH_P_ARP) \|\|
	171	skb->protocol == htons(ETH_P_RARP))) {
	172	br_do_proxy_suppress_arp(skb, br, vid, p);
ed842fae RP	173	} else if (IS_ENABLED(CONFIG_IPV6) &&
ed842fae RP	174	skb->protocol == htons(ETH_P_IPV6) &&
c69c2cd4	175	br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED) &&
ed842fae RP	176	pskb_may_pull(skb, sizeof(struct ipv6hdr) +
	177	sizeof(struct nd_msg)) &&
	178	ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
	179	struct nd_msg *msg, _msg;
	180
	181	msg = br_is_nd_neigh_msg(skb, &_msg);
	182	if (msg)
	183	br_do_suppress_nd(skb, br, vid, p, msg);
057658cb	184	}
95850116	185
8addd5e7 NA	186	switch (pkt_type) {
8addd5e7 NA	187	case BR_PKT_MULTICAST:
6d0259dd	188	mdst = br_mdb_entry_skb_get(brmctx, skb, vid);
b00589af	189	if ((mdst \|\| BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
adc47037	190	br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst)) {
ff0fd34e	191	if ((mdst && mdst->host_joined) \|\|
a496d2f0 SQ	192	br_multicast_is_router(brmctx, skb) \|\|
a496d2f0 SQ	193	br->dev->flags & IFF_ALLMULTI) {
b35c5f63	194	local_rcv = true;
44bdb313	195	DEV_STATS_INC(br->dev, multicast);
e151aab9 NA	196	}
e151aab9 NA	197	mcast_hit = true;
46c0772d	198	} else {
b35c5f63	199	local_rcv = true;
44bdb313	200	DEV_STATS_INC(br->dev, multicast);
46c0772d	201	}
8addd5e7 NA	202	break;
8addd5e7 NA	203	case BR_PKT_UNICAST:
3d26eb8a	204	dst = br_fdb_find_rcu(br, eth_hdr(skb)->h_dest, vid);
ecd1c6a5	205	break;
8addd5e7 NA	206	default:
8addd5e7 NA	207	break;
1da177e4 LT	208	}
1da177e4 LT	209
e151aab9	210	if (dst) {
ca6d4480	211	unsigned long now = jiffies;
ca6d4480	212
6869c3b0	213	if (test_bit(BR_FDB_LOCAL, &dst->flags))
751de201	214	return br_pass_frame_up(skb, false);
8addd5e7	215
ca6d4480	216	if (now != dst->used)
ca6d4480	217	dst->used = now;
37b090e6	218	br_forward(dst->dst, skb, local_rcv, false);
e151aab9 NA	219	} else {
e151aab9 NA	220	if (!mcast_hit)
e408336a	221	br_flood(br, skb, pkt_type, local_rcv, false, vid);
e151aab9	222	else
adc47037	223	br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
e081e1e3	224	}
1da177e4	225
b35c5f63	226	if (local_rcv)
751de201	227	return br_pass_frame_up(skb, promisc);
87557c18	228
1da177e4 LT	229	out:
1da177e4 LT	230	return 0;
b3f1be4b	231	drop:
623e43c2	232	kfree_skb_reason(skb, reason);
b3f1be4b	233	goto out;
1da177e4	234	}
34666d46	235	EXPORT_SYMBOL_GPL(br_handle_frame_finish);
1da177e4	236
56fae404	237	static void __br_handle_local_finish(struct sk_buff *skb)
cf0f02d0	238	{
f350a0a8	239	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
2ba071ec	240	u16 vid = 0;
cf0f02d0	241
e0d7968a	242	/* check if vlan is allowed, to avoid spoofing */
70e4272b	243	if ((p->flags & BR_LEARNING) &&
5d1fcaf3	244	nbp_state_should_learn(p) &&
70e4272b NA	245	!br_opt_get(p->br, BROPT_NO_LL_LEARN) &&
70e4272b NA	246	br_should_learn(p, skb, &vid))
be0c5677	247	br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, 0);
56fae404 IS	248	}
	249
	250	/* note: already called with rcu_read_lock */
	251	static int br_handle_local_finish(struct net net, struct sock sk, struct sk_buff *skb)
	252	{
56fae404	253	__br_handle_local_finish(skb);
8626c56c	254
3b2e2904 NA	255	/* return 1 to signal the okfn() was called so it's ok to use the skb */
3b2e2904 NA	256	return 1;
cf0f02d0 SH	257	}
cf0f02d0 SH	258
971502d7 FW	259	static int nf_hook_bridge_pre(struct sk_buff skb, struct sk_buff *pskb)
	260	{
	261	#ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
	262	struct nf_hook_entries *e = NULL;
	263	struct nf_hook_state state;
	264	unsigned int verdict, i;
	265	struct net *net;
	266	int ret;
	267
	268	net = dev_net(skb->dev);
	269	#ifdef HAVE_JUMP_LABEL
	270	if (!static_key_false(&nf_hooks_needed[NFPROTO_BRIDGE][NF_BR_PRE_ROUTING]))
	271	goto frame_finish;
	272	#endif
	273
	274	e = rcu_dereference(net->nf.hooks_bridge[NF_BR_PRE_ROUTING]);
	275	if (!e)
	276	goto frame_finish;
	277
	278	nf_hook_state_init(&state, NF_BR_PRE_ROUTING,
	279	NFPROTO_BRIDGE, skb->dev, NULL, NULL,
	280	net, br_handle_frame_finish);
	281
	282	for (i = 0; i < e->num_hook_entries; i++) {
	283	verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state);
	284	switch (verdict & NF_VERDICT_MASK) {
	285	case NF_ACCEPT:
223fd0ad FW	286	if (BR_INPUT_SKB_CB(skb)->br_netfilter_broute) {
	287	*pskb = skb;
	288	return RX_HANDLER_PASS;
	289	}
971502d7 FW	290	break;
	291	case NF_DROP:
	292	kfree_skb(skb);
	293	return RX_HANDLER_CONSUMED;
	294	case NF_QUEUE:
0d9cb300	295	ret = nf_queue(skb, &state, i, verdict);
971502d7 FW	296	if (ret == 1)
	297	continue;
	298	return RX_HANDLER_CONSUMED;
	299	default: /* STOLEN */
	300	return RX_HANDLER_CONSUMED;
	301	}
	302	}
	303	frame_finish:
	304	net = dev_net(skb->dev);
	305	br_handle_frame_finish(net, NULL, skb);
	306	#else
	307	br_handle_frame_finish(dev_net(skb->dev), NULL, skb);
	308	#endif
	309	return RX_HANDLER_CONSUMED;
	310	}
	311
90c628dd HB	312	/* Return 0 if the frame was not processed otherwise 1
	313	* note: already called with rcu_read_lock
	314	*/
	315	static int br_process_frame_type(struct net_bridge_port *p,
	316	struct sk_buff *skb)
	317	{
	318	struct br_frame_type *tmp;
	319
	320	hlist_for_each_entry_rcu(tmp, &p->br->frame_type_list, list)
	321	if (unlikely(tmp->type == skb->protocol))
	322	return tmp->frame_handler(p, skb);
	323
	324	return 0;
	325	}
	326
1da177e4	327	/*
6229e362	328	* Return NULL if skb is handled
eeaf61d8	329	* note: already called with rcu_read_lock
1da177e4	330	*/
9eb8eff0	331	static rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
1da177e4	332	{
623e43c2	333	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
ab95bfe0	334	struct net_bridge_port *p;
8a4eb573	335	struct sk_buff skb = pskb;
1da177e4 LT	336	const unsigned char *dest = eth_hdr(skb)->h_dest;
1da177e4 LT	337
c2368e79	338	if (unlikely(skb->pkt_type == PACKET_LOOPBACK))
8a4eb573	339	return RX_HANDLER_PASS;
ab95bfe0	340
623e43c2 RR	341	if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) {
623e43c2 RR	342	reason = SKB_DROP_REASON_MAC_INVALID_SOURCE;
467aea0d	343	goto drop;
623e43c2	344	}
1da177e4	345
7b995651 HX	346	skb = skb_share_check(skb, GFP_ATOMIC);
7b995651 HX	347	if (!skb)
8a4eb573	348	return RX_HANDLER_CONSUMED;
7b995651	349
f12064d1	350	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
7b4858df	351	br_tc_skb_miss_set(skb, false);
f12064d1	352
f350a0a8	353	p = br_port_get_rcu(skb->dev);
a37c5c26 KP	354	if (p->flags & BR_VLAN_TUNNEL)
a37c5c26 KP	355	br_handle_ingress_vlan_tunnel(skb, p, nbp_vlan_group_rcu(p));
ab95bfe0	356
46acc460	357	if (unlikely(is_link_local_ether_addr(dest))) {
f2808d22 TM	358	u16 fwd_mask = p->br->group_fwd_mask_required;
f2808d22 TM	359
515853cc	360	/*
	361	* See IEEE 802.1D Table 7-10 Reserved addresses
	362	*
	363	* Assignment Value
	364	* Bridge Group Address 01-80-C2-00-00-00
	365	* (MAC Control) 802.3 01-80-C2-00-00-01
	366	* (Link Aggregation) 802.3 01-80-C2-00-00-02
	367	* 802.1X PAE address 01-80-C2-00-00-03
	368	*
	369	* 802.1AB LLDP 01-80-C2-00-00-0E
	370	*
	371	* Others reserved for future standardization
	372	*/
5af48b59	373	fwd_mask \|= p->group_fwd_mask;
515853cc	374	switch (dest[5]) {
	375	case 0x00: /* Bridge Group Address */
	376	/* If STP is turned off,
	377	then must forward to keep loop detection */
f2808d22 TM	378	if (p->br->stp_enabled == BR_NO_STP \|\|
f2808d22 TM	379	fwd_mask & (1u << dest[5]))
515853cc	380	goto forward;
56fae404 IS	381	*pskb = skb;
	382	__br_handle_local_finish(skb);
	383	return RX_HANDLER_PASS;
515853cc	384
515853cc	385	case 0x01: /* IEEE MAC (Pause) */
623e43c2	386	reason = SKB_DROP_REASON_MAC_IEEE_MAC_CONTROL;
2111f8b9 SH	387	goto drop;
2111f8b9 SH	388
baedbe55 IS	389	case 0x0E: /* 802.1AB LLDP */
	390	fwd_mask \|= p->br->group_fwd_mask;
	391	if (fwd_mask & (1u << dest[5]))
	392	goto forward;
	393	*pskb = skb;
	394	__br_handle_local_finish(skb);
	395	return RX_HANDLER_PASS;
	396
515853cc	397	default:
515853cc	398	/* Allow selective forwarding for most other protocols */
f2808d22 TM	399	fwd_mask \|= p->br->group_fwd_mask;
f2808d22 TM	400	if (fwd_mask & (1u << dest[5]))
515853cc	401	goto forward;
515853cc	402	}
a598f6ae	403
751de201 PNA	404	BR_INPUT_SKB_CB(skb)->promisc = false;
751de201 PNA	405
3b2e2904 NA	406	/* The else clause should be hit when nf_hook():
	407	* - returns < 0 (drop/error)
	408	* - returns = 0 (stolen/nf_queue)
	409	* Thus return 1 from the okfn() to signal the skb is ok to pass
	410	*/
	411	if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
	412	dev_net(skb->dev), NULL, skb, skb->dev, NULL,
	413	br_handle_local_finish) == 1) {
	414	return RX_HANDLER_PASS;
	415	} else {
	416	return RX_HANDLER_CONSUMED;
	417	}
2111f8b9	418	}
1da177e4	419
90c628dd	420	if (unlikely(br_process_frame_type(p, skb)))
65369933 HV	421	return RX_HANDLER_PASS;
65369933 HV	422
a598f6ae	423	forward:
ec7328b5 TW	424	if (br_mst_is_enabled(p->br))
	425	goto defer_stp_filtering;
	426
467aea0d SH	427	switch (p->state) {
467aea0d SH	428	case BR_STATE_FORWARDING:
467aea0d	429	case BR_STATE_LEARNING:
ec7328b5	430	defer_stp_filtering:
9a7b6ef9	431	if (ether_addr_equal(p->br->dev->dev_addr, dest))
1da177e4 LT	432	skb->pkt_type = PACKET_HOST;
1da177e4 LT	433
971502d7	434	return nf_hook_bridge_pre(skb, pskb);
467aea0d	435	default:
623e43c2	436	reason = SKB_DROP_REASON_BRIDGE_INGRESS_STP_STATE;
467aea0d	437	drop:
623e43c2	438	kfree_skb_reason(skb, reason);
1da177e4	439	}
8a4eb573	440	return RX_HANDLER_CONSUMED;
1da177e4	441	}
9eb8eff0 VO	442
	443	/* This function has no purpose other than to appease the br_port_get_rcu/rtnl
	444	* helpers which identify bridged ports according to the rx_handler installed
	445	* on them (so there _needs_ to be a bridge rx_handler even if we don't need it
	446	* to do anything useful). This bridge won't support traffic to/from the stack,
	447	* but only hardware bridging. So return RX_HANDLER_PASS so we don't steal
	448	* frames from the ETH_P_XDSA packet_type handler.
	449	*/
	450	static rx_handler_result_t br_handle_frame_dummy(struct sk_buff **pskb)
	451	{
	452	return RX_HANDLER_PASS;
	453	}
	454
	455	rx_handler_func_t br_get_rx_handler(const struct net_device dev)
	456	{
	457	if (netdev_uses_dsa(dev))
	458	return br_handle_frame_dummy;
	459
	460	return br_handle_frame;
	461	}
90c628dd HB	462
	463	void br_add_frame(struct net_bridge br, struct br_frame_type ft)
	464	{
	465	hlist_add_head_rcu(&ft->list, &br->frame_type_list);
	466	}
	467
	468	void br_del_frame(struct net_bridge br, struct br_frame_type ft)
	469	{
	470	struct br_frame_type *tmp;
	471
	472	hlist_for_each_entry(tmp, &br->frame_type_list, list)
	473	if (ft == tmp) {
	474	hlist_del_rcu(&ft->list);
	475	return;
	476	}
	477	}