linux.git/net/bridge/br_input.c, branch v4.19

net: bridge: add support for port isolation

2018-05-25T18:37:20+00:00

This patch adds support for a new port flag - BR_ISOLATED. If it is set
then isolated ports cannot communicate between each other, but they can
still communicate with non-isolated ports. The same can be achieved via
ACLs but they can't scale with large number of ports and also the
complexity of the rules grows. This feature can be used to achieve
isolated vlan functionality (similar to pvlan) as well, though currently
it will be port-wide (for all vlans on the port). The new test in
should_deliver uses data that is already cache hot and the new boolean
is used to avoid an additional source port test in should_deliver.

Signed-off-by: Nikolay Aleksandrov 
Reviewed-by: Toshiaki Makita 
Signed-off-by: David S. Miller

net: bridge: Rename mglist to host_joined

2017-11-10T04:41:40+00:00

The boolean mglist indicates the host has joined a particular
multicast group on the bridge interface. It is badly named, obscuring
what is means. Rename it.

Signed-off-by: Andrew Lunn 
Acked-by: Nikolay Aleksandrov 
Acked-by: Florian Fainelli 
Signed-off-by: David S. Miller

bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports

2017-10-09T04:12:04+00:00

This patch avoids flooding and proxies ndisc packets
for BR_NEIGH_SUPPRESS ports.

Signed-off-by: Roopa Prabhu 
Signed-off-by: David S. Miller

bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports

2017-10-09T04:12:04+00:00

This patch avoids flooding and proxies arp packets
for BR_NEIGH_SUPPRESS ports.

Moves existing br_do_proxy_arp to br_do_proxy_suppress_arp
to support both proxy arp and neigh suppress.

Signed-off-by: Roopa Prabhu 
Signed-off-by: David S. Miller

net: bridge: add per-port group_fwd_mask with less restrictions

2017-09-29T05:02:55+00:00

We need to be able to transparently forward most link-local frames via
tunnels (e.g. vxlan, qinq). Currently the bridge's group_fwd_mask has a
mask which restricts the forwarding of STP and LACP, but we need to be able
to forward these over tunnels and control that forwarding on a per-port
basis thus add a new per-port group_fwd_mask option which only disallows
mac pause frames to be forwarded (they're always dropped anyway).
The patch does not change the current default situation - all of the others
are still restricted unless configured for forwarding.
We have successfully tested this patch with LACP and STP forwarding over
VxLAN and qinq tunnels.

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

net: bridge: fix dest lookup when vlan proto doesn't match

2017-07-14T15:19:23+00:00

With 802.1ad support the vlan_ingress code started checking for vlan
protocol mismatch which causes the current tag to be inserted and the
bridge vlan protocol & pvid to be set. The vlan tag insertion changes
the skb mac_header and thus the lookup mac dest pointer which was loaded
prior to calling br_allowed_ingress in br_handle_frame_finish is VLAN_HLEN
bytes off now, pointing to the last two bytes of the destination mac and
the first four of the source mac causing lookups to always fail and
broadcasting all such packets to all ports. Same thing happens for locally
originated packets when passing via br_dev_xmit. So load the dest pointer
after the vlan checks and possible skb change.

Fixes: 8580e2117c06 ("bridge: Prepare for 802.1ad vlan filtering support")
Reported-by: Anitha Narasimha Murthy 
Signed-off-by: Nikolay Aleksandrov 
Acked-by: Toshiaki Makita 
Signed-off-by: David S. Miller

bridge: drop netfilter fake rtable unconditionally

2017-03-13T20:01:10+00:00

Andreas reports kernel oops during rmmod of the br_netfilter module.
Hannes debugged the oops down to a NULL rt6info->rt6i_indev.

Problem is that br_netfilter has the nasty concept of adding a fake
rtable to skb->dst; this happens in a br_netfilter prerouting hook.

A second hook (in bridge LOCAL_IN) is supposed to remove these again
before the skb is handed up the stack.

However, on module unload hooks get unregistered which means an
skb could traverse the prerouting hook that attaches the fake_rtable,
while the 'fake rtable remove' hook gets removed from the hooklist
immediately after.

Fixes: 34666d467cbf1e2e3c7 ("netfilter: bridge: move br_netfilter out of the core")
Reported-by: Andreas Karis 
Debugged-by: Hannes Frederic Sowa 
Signed-off-by: Florian Westphal 
Acked-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

bridge: fdb: converge fdb searching functions into one

2017-02-14T17:41:02+00:00

Before this patch we had 3 different fdb searching functions which was
confusing. This patch reduces all of them to one - fdb_find_rcu(), and
two flavors: br_fdb_find() which requires hash_lock and br_fdb_find_rcu
which requires RCU. This makes it clear what needs to be used, we also
remove two abusers of __br_fdb_get which called it under hash_lock and
replace them with br_fdb_find().

Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bridge: avoid unnecessary read of jiffies

2017-02-07T19:16:05+00:00

Jiffies is volatile so read it once.

Signed-off-by: Stephen Hemminger 
Acked-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller

bridge: fdb: write to used and updated at most once per jiffy

2017-02-07T03:53:13+00:00

Writing once per jiffy is enough to limit the bridge's false sharing.
After this change the bridge doesn't show up in the local load HitM stats.

Suggested-by: David S. Miller 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: David S. Miller