bridge: add root port blocking

This is Linux bridge implementation of root port guard. If BPDU is received from a leaf (edge) port, it should not be elected as root port. Why would you want to do this? If using STP on a bridge and the downstream bridges are not fully trusted; this prevents a hostile guest for rerouting traffic. Why not just use netfilter? Netfilter does not track of follow spanning tree decisions. It would be difficult and error prone to try and mirror STP resolution in netfilter module.

stephen hemminger committed 14 years ago

Commit 1007dd11 parent a2e01a65 files · +29 −2Browse files

Unified · Split

5 files

include/uapi/linux/if_link.h +1 −0
net/bridge/br_netlink.c +4 −1
net/bridge/br_private.h +1 −0
net/bridge/br_stp.c +21 −1
net/bridge/br_sysfs_if.c +2 −0

include/uapi/linux/if_link.h+1−0

@@ -217,6 +217,7 @@ enum { · 216 unmodified lines
217	217	IFLA_BRPORT_COST, /* " cost */
218	218	IFLA_BRPORT_MODE, /* mode (hairpin) */
219	219	IFLA_BRPORT_GUARD, /* bpdu guard */
	220	+ IFLA_BRPORT_PROTECT, /* root port protection */
220	221	__IFLA_BRPORT_MAX
221	222	};
222	223	#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)

net/bridge/br_netlink.c+4−1

@@ -27,6 +27,7 @@ static inline size_t br_port_info_size(void) · 26 unmodified lines
27	27	+ nla_total_size(4) /* IFLA_BRPORT_COST */
28	28	+ nla_total_size(1) /* IFLA_BRPORT_MODE */
29	29	+ nla_total_size(1) /* IFLA_BRPORT_GUARD */
	30	+ + nla_total_size(1) /* IFLA_BRPORT_PROTECT */
30	31	+ 0;
31	32	}
32	33
@@ -51,7 +52,8 @@ static int br_port_fill_attrs(struct sk_buff *skb, · 18 unmodified lines
51	52	nla_put_u16(skb, IFLA_BRPORT_PRIORITY, p->priority) \|\|
52	53	nla_put_u32(skb, IFLA_BRPORT_COST, p->path_cost) \|\|
53	54	nla_put_u8(skb, IFLA_BRPORT_MODE, mode) \|\|
54		− nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)))
	55	+ nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)) \|\|
	56	+ nla_put_u8(skb, IFLA_BRPORT_PROTECT, !!(p->flags & BR_ROOT_BLOCK)))
55	57	return -EMSGSIZE;
56	58
57	59	return 0;
@@ -165,6 +167,7 @@ static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = { · 107 unmodified lines
165	167	[IFLA_BRPORT_PRIORITY] = { .type = NLA_U16 },
166	168	[IFLA_BRPORT_MODE] = { .type = NLA_U8 },
167	169	[IFLA_BRPORT_GUARD] = { .type = NLA_U8 },
	170	+ [IFLA_BRPORT_PROTECT] = { .type = NLA_U8 },
168	171	};
169	172
170	173	/* Change the state of the port and notify spanning tree */

net/bridge/br_private.h+1−0

@@ -136,6 +136,7 @@ struct net_bridge_port · 135 unmodified lines
136	136	unsigned long flags;
137	137	#define BR_HAIRPIN_MODE 0x00000001
138	138	#define BR_BPDU_GUARD 0x00000002
	139	+#define BR_ROOT_BLOCK 0x00000004
139	140
140	141	#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
141	142	u32 multicast_startup_queries_sent;

net/bridge/br_stp.c+21−1

@@ -100,6 +100,21 @@ static int br_should_become_root_port(const struct net_bridge_port *p, · 99 unmodified lines
100	100	return 0;
101	101	}
102	102
	103	+static void br_root_port_block(const struct net_bridge *br,
	104	+ struct net_bridge_port *p)
	105	+{
	106	+
	107	+ br_notice(br, "port %u(%s) tried to become root port (blocked)",
	108	+ (unsigned int) p->port_no, p->dev->name);
	109	+
	110	+ p->state = BR_STATE_LISTENING;
	111	+ br_log_state(p);
	112	+ br_ifinfo_notify(RTM_NEWLINK, p);
	113	+
	114	+ if (br->forward_delay > 0)
	115	+ mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
	116	+}
	117	+
103	118	/* called under bridge lock */
104	119	static void br_root_selection(struct net_bridge *br)
105	120	{
@@ -107,7 +122,12 @@ static void br_root_selection(struct net_bridge *br) · 1 unmodified line
107	122	u16 root_port = 0;
108	123
109	124	list_for_each_entry(p, &br->port_list, list) {
110		− if (br_should_become_root_port(p, root_port))
	125	+ if (!br_should_become_root_port(p, root_port))
	126	+ continue;
	127	+
	128	+ if (p->flags & BR_ROOT_BLOCK)
	129	+ br_root_port_block(br, p);
	130	+ else
111	131	root_port = p->port_no;
112	132	}
113	133

net/bridge/br_sysfs_if.c+2−0

@@ -157,6 +157,7 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush); · 156 unmodified lines
157	157
158	158	BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);
159	159	BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);
	160	+BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);
160	161
161	162	#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
162	163	static ssize_t show_multicast_router(struct net_bridge_port p, char buf)
@@ -191,6 +192,7 @@ static const struct brport_attribute *brport_attrs[] = { · 28 unmodified lines
191	192	&brport_attr_flush,
192	193	&brport_attr_hairpin_mode,
193	194	&brport_attr_bpdu_guard,
	195	+ &brport_attr_root_block,
194	196	#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
195	197	&brport_attr_multicast_router,
196	198	#endif