History

bridge: add root port blocking

This is Linux bridge implementation of root port guard. If BPDU is received from a leaf (edge) port, it should not be elected as root port. Why would you want to do this? If using STP on a bridge and the downstream bridges are not fully trusted; this prevents a hostile guest for rerouting traffic. Why not just use netfilter? Netfilter does not track of follow spanning tree decisions. It would be difficult and error prone to try and mirror STP resolution in netfilter module.

stephen hemminger committed 14 years ago

Commit 1007dd11 parent a2e01a65 files · +29 −2Browse files

Unified · Split

5 files
  1. include/uapi/linux/if_link.h +1 −0
  2. net/bridge/br_netlink.c +4 −1
  3. net/bridge/br_private.h +1 −0
  4. net/bridge/br_stp.c +21 −1
  5. net/bridge/br_sysfs_if.c +2 −0
include/uapi/linux/if_link.h+1−0
@@ -217,6 +217,7 @@ enum { · 216 unmodified lines
217 IFLA_BRPORT_COST, /* " cost */217 IFLA_BRPORT_COST, /* " cost */
218 IFLA_BRPORT_MODE, /* mode (hairpin) */218 IFLA_BRPORT_MODE, /* mode (hairpin) */
219 IFLA_BRPORT_GUARD, /* bpdu guard */219 IFLA_BRPORT_GUARD, /* bpdu guard */
220 IFLA_BRPORT_PROTECT, /* root port protection */
220 __IFLA_BRPORT_MAX221 __IFLA_BRPORT_MAX
221};222};
222#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)223#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
net/bridge/br_netlink.c+4−1
@@ -27,6 +27,7 @@ static inline size_t br_port_info_size(void) · 26 unmodified lines
27 + nla_total_size(4) /* IFLA_BRPORT_COST */27 + nla_total_size(4) /* IFLA_BRPORT_COST */
28 + nla_total_size(1) /* IFLA_BRPORT_MODE */28 + nla_total_size(1) /* IFLA_BRPORT_MODE */
29 + nla_total_size(1) /* IFLA_BRPORT_GUARD */29 + nla_total_size(1) /* IFLA_BRPORT_GUARD */
30 + nla_total_size(1) /* IFLA_BRPORT_PROTECT */
30 + 0;31 + 0;
31}32}
32 33
@@ -51,7 +52,8 @@ static int br_port_fill_attrs(struct sk_buff *skb, · 18 unmodified lines
51 nla_put_u16(skb, IFLA_BRPORT_PRIORITY, p->priority) ||52 nla_put_u16(skb, IFLA_BRPORT_PRIORITY, p->priority) ||
52 nla_put_u32(skb, IFLA_BRPORT_COST, p->path_cost) ||53 nla_put_u32(skb, IFLA_BRPORT_COST, p->path_cost) ||
53 nla_put_u8(skb, IFLA_BRPORT_MODE, mode) ||54 nla_put_u8(skb, IFLA_BRPORT_MODE, mode) ||
54 nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)))55 nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)) ||
56 nla_put_u8(skb, IFLA_BRPORT_PROTECT, !!(p->flags & BR_ROOT_BLOCK)))
55 return -EMSGSIZE;57 return -EMSGSIZE;
56 58
57 return 0;59 return 0;
@@ -165,6 +167,7 @@ static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = { · 107 unmodified lines
165 [IFLA_BRPORT_PRIORITY] = { .type = NLA_U16 },167 [IFLA_BRPORT_PRIORITY] = { .type = NLA_U16 },
166 [IFLA_BRPORT_MODE] = { .type = NLA_U8 },168 [IFLA_BRPORT_MODE] = { .type = NLA_U8 },
167 [IFLA_BRPORT_GUARD] = { .type = NLA_U8 },169 [IFLA_BRPORT_GUARD] = { .type = NLA_U8 },
170 [IFLA_BRPORT_PROTECT] = { .type = NLA_U8 },
168};171};
169 172
170/* Change the state of the port and notify spanning tree */173/* Change the state of the port and notify spanning tree */
net/bridge/br_private.h+1−0
@@ -136,6 +136,7 @@ struct net_bridge_port · 135 unmodified lines
136 unsigned long flags;136 unsigned long flags;
137#define BR_HAIRPIN_MODE 0x00000001137#define BR_HAIRPIN_MODE 0x00000001
138#define BR_BPDU_GUARD 0x00000002138#define BR_BPDU_GUARD 0x00000002
139#define BR_ROOT_BLOCK 0x00000004
139 140
140#ifdef CONFIG_BRIDGE_IGMP_SNOOPING141#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
141 u32 multicast_startup_queries_sent;142 u32 multicast_startup_queries_sent;
net/bridge/br_stp.c+21−1
@@ -100,6 +100,21 @@ static int br_should_become_root_port(const struct net_bridge_port *p, · 99 unmodified lines
100 return 0;100 return 0;
101}101}
102 102
103static void br_root_port_block(const struct net_bridge *br,
104 struct net_bridge_port *p)
105{
106
107 br_notice(br, "port %u(%s) tried to become root port (blocked)",
108 (unsigned int) p->port_no, p->dev->name);
109
110 p->state = BR_STATE_LISTENING;
111 br_log_state(p);
112 br_ifinfo_notify(RTM_NEWLINK, p);
113
114 if (br->forward_delay > 0)
115 mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
116}
117
103/* called under bridge lock */118/* called under bridge lock */
104static void br_root_selection(struct net_bridge *br)119static void br_root_selection(struct net_bridge *br)
105{120{
@@ -107,7 +122,12 @@ static void br_root_selection(struct net_bridge *br) · 1 unmodified line
107 u16 root_port = 0;122 u16 root_port = 0;
108 123
109 list_for_each_entry(p, &br->port_list, list) {124 list_for_each_entry(p, &br->port_list, list) {
110 if (br_should_become_root_port(p, root_port))125 if (!br_should_become_root_port(p, root_port))
126 continue;
127
128 if (p->flags & BR_ROOT_BLOCK)
129 br_root_port_block(br, p);
130 else
111 root_port = p->port_no;131 root_port = p->port_no;
112 }132 }
113 133
net/bridge/br_sysfs_if.c+2−0
@@ -157,6 +157,7 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush); · 156 unmodified lines
157 157
158BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);158BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);
159BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);159BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);
160BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);
160 161
161#ifdef CONFIG_BRIDGE_IGMP_SNOOPING162#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
162static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)163static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
@@ -191,6 +192,7 @@ static const struct brport_attribute *brport_attrs[] = { · 28 unmodified lines
191 &brport_attr_flush,192 &brport_attr_flush,
192 &brport_attr_hairpin_mode,193 &brport_attr_hairpin_mode,
193 &brport_attr_bpdu_guard,194 &brport_attr_bpdu_guard,
195 &brport_attr_root_block,
194#ifdef CONFIG_BRIDGE_IGMP_SNOOPING196#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
195 &brport_attr_multicast_router,197 &brport_attr_multicast_router,
196#endif198#endif