linux-stable.git/net/bridge/br_forward.c, branch linux-4.0.y

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-11-01T18:53:27+00:00

Conflicts:
	drivers/net/phy/marvell.c

Simple overlapping changes in drivers/net/phy/marvell.c

Signed-off-by: David S. Miller

netfilter: nft_reject_bridge: don't use IP stack to reject traffic

2014-10-31T11:50:08+00:00

If the packet is received via the bridge stack, this cannot reject
packets from the IP stack.

This adds functions to build the reject packet and send it from the
bridge stack. Comments and assumptions on this patch:

1) Validate the IPv4 and IPv6 headers before further processing,
   given that the packet comes from the bridge stack, we cannot assume
   they are clean. Truncated packets are dropped, we follow similar
   approach in the existing iptables match/target extensions that need
   to inspect layer 4 headers that is not available. This also includes
   packets that are directed to multicast and broadcast ethernet
   addresses.

2) br_deliver() is exported to inject the reject packet via
   bridge localout -> postrouting. So the approach is similar to what
   we already do in the iptables reject target. The reject packet is
   sent to the bridge port from which we have received the original
   packet.

3) The reject packet is forged based on the original packet. The TTL
   is set based on sysctl_ip_default_ttl for IPv4 and per-net
   ipv6.devconf_all hoplimit for IPv6.

Signed-off-by: Pablo Neira Ayuso

bridge: Add support for IEEE 802.11 Proxy ARP

2014-10-27T23:02:04+00:00

This feature is defined in IEEE Std 802.11-2012, 10.23.13. It allows
the AP devices to keep track of the hardware-address-to-IP-address
mapping of the mobile devices within the WLAN network.

The AP will learn this mapping via observing DHCP, ARP, and NS/NA
frames. When a request for such information is made (i.e. ARP request,
Neighbor Solicitation), the AP will respond on behalf of the
associated mobile device. In the process of doing so, the AP will drop
the multicast request frame that was intended to go out to the wireless
medium.

It was recommended at the LKS workshop to do this implementation in
the bridge layer. vxlan.c is already doing something very similar.
The DHCP snooping code will be added to the userspace application
(hostapd) per the recommendation.

This RFC commit is only for IPv4. A similar approach in the bridge
layer will be taken for IPv6 as well.

Signed-off-by: Kyeyoon Park 
Signed-off-by: David S. Miller

netfilter: bridge: move br_netfilter out of the core

2014-09-26T16:42:31+00:00

Jesper reported that br_netfilter always registers the hooks since
this is part of the bridge core. This harms performance for people that
don't need this.

This patch modularizes br_netfilter so it can be rmmod'ed, thus,
the hooks can be unregistered. I think the bridge netfilter should have
been a separated module since the beginning, Patrick agreed on that.

Note that this is breaking compatibility for users that expect that
bridge netfilter is going to be available after explicitly 'modprobe
bridge' or via automatic load through brctl.

However, the damage can be easily undone by modprobing br_netfilter.
The bridge core also spots a message to provide a clue to people that
didn't notice that this has been deprecated.

On top of that, the plan is that nftables will not rely on this software
layer, but integrate the connection tracking into the bridge layer to
enable stateful filtering and NAT, which is was bridge netfilter users
seem to require.

This patch still keeps the fake_dst_ops in the bridge core, since this
is required by when the bridge port is initialized. So we can safely
modprobe/rmmod br_netfilter anytime.

Signed-off-by: Pablo Neira Ayuso 
Acked-by: Florian Westphal

bridge: use is_skb_forwardable in forward path

2014-03-31T20:04:04+00:00

Use existing function instead of trying to use our own.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

bridge: remove unnecessary parentheses

2013-12-20T00:27:26+00:00

Return is not a function, parentheses are not required.

Signed-off-by: Tan Xiaojun 
Signed-off-by: David S. Miller

bridge: spelling fixes

2013-12-18T22:53:22+00:00

Fix spelling errors in bridge driver.

Signed-off-by: Tan Xiaojun 
Acked-by: Stephen Hemminger 
Signed-off-by: David S. Miller

bridge: Add a flag to control unicast packet flood.

2013-06-11T09:04:32+00:00

Add a flag to control flood of unicast traffic.  By default, flood is
on and the bridge will flood unicast traffic if it doesn't know
the destination.  When the flag is turned off, unicast traffic
without an FDB will not be forwarded to the specified port.

Signed-off-by: Vlad Yasevich 
Reviewed-by: Michael S. Tsirkin 
Signed-off-by: David S. Miller

bridge: Implement vlan ingress/egress policy with PVID.

2013-02-14T00:42:15+00:00

At ingress, any untagged traffic is assigned to the PVID.
Any tagged traffic is filtered according to membership bitmap.

At egress, if the vlan matches the PVID, the frame is sent
untagged.  Otherwise the frame is sent tagged.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller

bridge: Verify that a vlan is allowed to egress on given port

2013-02-14T00:41:46+00:00

When bridge forwards a frame, make sure that a frame is allowed
to egress on that port.

Signed-off-by: Vlad Yasevich 
Signed-off-by: David S. Miller