bridge: Implement vlan ingress/egress policy with PVID.
[linux-3.10.git] / net / bridge / br_forward.c
1 /*
2  *      Forwarding decision
3  *      Linux ethernet bridge
4  *
5  *      Authors:
6  *      Lennert Buytenhek               <buytenh@gnu.org>
7  *
8  *      This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  */
13
14 #include <linux/err.h>
15 #include <linux/slab.h>
16 #include <linux/kernel.h>
17 #include <linux/netdevice.h>
18 #include <linux/netpoll.h>
19 #include <linux/skbuff.h>
20 #include <linux/if_vlan.h>
21 #include <linux/netfilter_bridge.h>
22 #include "br_private.h"
23
24 static int deliver_clone(const struct net_bridge_port *prev,
25                          struct sk_buff *skb,
26                          void (*__packet_hook)(const struct net_bridge_port *p,
27                                                struct sk_buff *skb));
28
29 /* Don't forward packets to originating port or forwarding diasabled */
30 static inline int should_deliver(const struct net_bridge_port *p,
31                                  const struct sk_buff *skb)
32 {
33         return (((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
34                 br_allowed_egress(p->br, nbp_get_vlan_info(p), skb) &&
35                 p->state == BR_STATE_FORWARDING);
36 }
37
38 static inline unsigned int packet_length(const struct sk_buff *skb)
39 {
40         return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
41 }
42
43 int br_dev_queue_push_xmit(struct sk_buff *skb)
44 {
45         /* ip_fragment doesn't copy the MAC header */
46         if (nf_bridge_maybe_copy_header(skb) ||
47             (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))) {
48                 kfree_skb(skb);
49         } else {
50                 skb_push(skb, ETH_HLEN);
51                 br_drop_fake_rtable(skb);
52                 dev_queue_xmit(skb);
53         }
54
55         return 0;
56 }
57
58 int br_forward_finish(struct sk_buff *skb)
59 {
60         return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
61                        br_dev_queue_push_xmit);
62
63 }
64
65 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
66 {
67         skb = br_handle_vlan(to->br, nbp_get_vlan_info(to), skb);
68         if (!skb)
69                 return;
70
71         skb->dev = to->dev;
72
73         if (unlikely(netpoll_tx_running(to->br->dev))) {
74                 if (packet_length(skb) > skb->dev->mtu && !skb_is_gso(skb))
75                         kfree_skb(skb);
76                 else {
77                         skb_push(skb, ETH_HLEN);
78                         br_netpoll_send_skb(to, skb);
79                 }
80                 return;
81         }
82
83         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
84                 br_forward_finish);
85 }
86
87 static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
88 {
89         struct net_device *indev;
90
91         if (skb_warn_if_lro(skb)) {
92                 kfree_skb(skb);
93                 return;
94         }
95
96         skb = br_handle_vlan(to->br, nbp_get_vlan_info(to), skb);
97         if (!skb)
98                 return;
99
100         indev = skb->dev;
101         skb->dev = to->dev;
102         skb_forward_csum(skb);
103
104         NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
105                 br_forward_finish);
106 }
107
108 /* called with rcu_read_lock */
109 void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
110 {
111         if (to && should_deliver(to, skb)) {
112                 __br_deliver(to, skb);
113                 return;
114         }
115
116         kfree_skb(skb);
117 }
118
119 /* called with rcu_read_lock */
120 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
121 {
122         if (should_deliver(to, skb)) {
123                 if (skb0)
124                         deliver_clone(to, skb, __br_forward);
125                 else
126                         __br_forward(to, skb);
127                 return;
128         }
129
130         if (!skb0)
131                 kfree_skb(skb);
132 }
133
134 static int deliver_clone(const struct net_bridge_port *prev,
135                          struct sk_buff *skb,
136                          void (*__packet_hook)(const struct net_bridge_port *p,
137                                                struct sk_buff *skb))
138 {
139         struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
140
141         skb = skb_clone(skb, GFP_ATOMIC);
142         if (!skb) {
143                 dev->stats.tx_dropped++;
144                 return -ENOMEM;
145         }
146
147         __packet_hook(prev, skb);
148         return 0;
149 }
150
151 static struct net_bridge_port *maybe_deliver(
152         struct net_bridge_port *prev, struct net_bridge_port *p,
153         struct sk_buff *skb,
154         void (*__packet_hook)(const struct net_bridge_port *p,
155                               struct sk_buff *skb))
156 {
157         int err;
158
159         if (!should_deliver(p, skb))
160                 return prev;
161
162         if (!prev)
163                 goto out;
164
165         err = deliver_clone(prev, skb, __packet_hook);
166         if (err)
167                 return ERR_PTR(err);
168
169 out:
170         return p;
171 }
172
173 /* called under bridge lock */
174 static void br_flood(struct net_bridge *br, struct sk_buff *skb,
175                      struct sk_buff *skb0,
176                      void (*__packet_hook)(const struct net_bridge_port *p,
177                                            struct sk_buff *skb))
178 {
179         struct net_bridge_port *p;
180         struct net_bridge_port *prev;
181
182         prev = NULL;
183
184         list_for_each_entry_rcu(p, &br->port_list, list) {
185                 prev = maybe_deliver(prev, p, skb, __packet_hook);
186                 if (IS_ERR(prev))
187                         goto out;
188         }
189
190         if (!prev)
191                 goto out;
192
193         if (skb0)
194                 deliver_clone(prev, skb, __packet_hook);
195         else
196                 __packet_hook(prev, skb);
197         return;
198
199 out:
200         if (!skb0)
201                 kfree_skb(skb);
202 }
203
204
205 /* called with rcu_read_lock */
206 void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb)
207 {
208         br_flood(br, skb, NULL, __br_deliver);
209 }
210
211 /* called under bridge lock */
212 void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
213                       struct sk_buff *skb2)
214 {
215         br_flood(br, skb, skb2, __br_forward);
216 }
217
218 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
219 /* called with rcu_read_lock */
220 static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
221                                struct sk_buff *skb, struct sk_buff *skb0,
222                                void (*__packet_hook)(
223                                         const struct net_bridge_port *p,
224                                         struct sk_buff *skb))
225 {
226         struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
227         struct net_bridge *br = netdev_priv(dev);
228         struct net_bridge_port *prev = NULL;
229         struct net_bridge_port_group *p;
230         struct hlist_node *rp;
231
232         rp = rcu_dereference(hlist_first_rcu(&br->router_list));
233         p = mdst ? rcu_dereference(mdst->ports) : NULL;
234         while (p || rp) {
235                 struct net_bridge_port *port, *lport, *rport;
236
237                 lport = p ? p->port : NULL;
238                 rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
239                              NULL;
240
241                 port = (unsigned long)lport > (unsigned long)rport ?
242                        lport : rport;
243
244                 prev = maybe_deliver(prev, port, skb, __packet_hook);
245                 if (IS_ERR(prev))
246                         goto out;
247
248                 if ((unsigned long)lport >= (unsigned long)port)
249                         p = rcu_dereference(p->next);
250                 if ((unsigned long)rport >= (unsigned long)port)
251                         rp = rcu_dereference(hlist_next_rcu(rp));
252         }
253
254         if (!prev)
255                 goto out;
256
257         if (skb0)
258                 deliver_clone(prev, skb, __packet_hook);
259         else
260                 __packet_hook(prev, skb);
261         return;
262
263 out:
264         if (!skb0)
265                 kfree_skb(skb);
266 }
267
268 /* called with rcu_read_lock */
269 void br_multicast_deliver(struct net_bridge_mdb_entry *mdst,
270                           struct sk_buff *skb)
271 {
272         br_multicast_flood(mdst, skb, NULL, __br_deliver);
273 }
274
275 /* called with rcu_read_lock */
276 void br_multicast_forward(struct net_bridge_mdb_entry *mdst,
277                           struct sk_buff *skb, struct sk_buff *skb2)
278 {
279         br_multicast_flood(mdst, skb, skb2, __br_forward);
280 }
281 #endif