Commit a21d9a67 authored by Hans Schultz's avatar Hans Schultz Committed by David S. Miller
Browse files

net: bridge: Add support for bridge port in locked mode 



In a 802.1X scenario, clients connected to a bridge port shall not
be allowed to have traffic forwarded until fully authenticated.
A static fdb entry of the clients MAC address for the bridge port
unlocks the client and allows bidirectional communication.

This scenario is facilitated with setting the bridge port in locked
mode, which is also supported by various switchcore chipsets.

Signed-off-by: default avatarHans Schultz <schultz.hans+netdev@gmail.com>
Acked-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
Reviewed-by: default avatarIdo Schimmel <idosch@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b26ef81c

include/linux/if_bridge.h

+1 −0
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ struct br_ip_list { 
#define BR_MRP_LOST_CONT	BIT(18)

#define BR_MRP_LOST_IN_CONT	BIT(19)

#define BR_TX_FWD_OFFLOAD	BIT(20)

#define BR_PORT_LOCKED		BIT(21)



#define BR_DEFAULT_AGEING_TIME	(300 * HZ)

include/uapi/linux/if_link.h

+1 −0
Original line number Diff line number Diff line
@@ -537,6 +537,7 @@ enum { 
	IFLA_BRPORT_MRP_IN_OPEN,

	IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT,

	IFLA_BRPORT_MCAST_EHT_HOSTS_CNT,

	IFLA_BRPORT_LOCKED,

	__IFLA_BRPORT_MAX

};

#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)

net/bridge/br_input.c

+10 −1
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb 
	if (!p || p->state == BR_STATE_DISABLED)

		goto drop;



	br = p->br;

	brmctx = &p->br->multicast_ctx;

	pmctx = &p->multicast_ctx;

	state = p->state;
@@ -88,10 +89,18 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb 
				&state, &vlan))

		goto out;



	if (p->flags & BR_PORT_LOCKED) {

		struct net_bridge_fdb_entry *fdb_src =

			br_fdb_find_rcu(br, eth_hdr(skb)->h_source, vid);



		if (!fdb_src || READ_ONCE(fdb_src->dst) != p ||

		    test_bit(BR_FDB_LOCAL, &fdb_src->flags))

			goto drop;

	}



	nbp_switchdev_frame_mark(p, skb);



	/* insert into forwarding database after filtering to avoid spoofing */

	br = p->br;

	if (p->flags & BR_LEARNING)

		br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, 0);

net/bridge/br_netlink.c

+5 −1
Original line number Diff line number Diff line
@@ -184,6 +184,7 @@ static inline size_t br_port_info_size(void) 
		+ nla_total_size(1)	/* IFLA_BRPORT_VLAN_TUNNEL */

		+ nla_total_size(1)	/* IFLA_BRPORT_NEIGH_SUPPRESS */

		+ nla_total_size(1)	/* IFLA_BRPORT_ISOLATED */

		+ nla_total_size(1)	/* IFLA_BRPORT_LOCKED */

		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_ROOT_ID */

		+ nla_total_size(sizeof(struct ifla_bridge_id))	/* IFLA_BRPORT_BRIDGE_ID */

		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_DESIGNATED_PORT */
@@ -269,7 +270,8 @@ static int br_port_fill_attrs(struct sk_buff *skb, 
							  BR_MRP_LOST_CONT)) ||

	    nla_put_u8(skb, IFLA_BRPORT_MRP_IN_OPEN,

		       !!(p->flags & BR_MRP_LOST_IN_CONT)) ||

	    nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED)))

	    nla_put_u8(skb, IFLA_BRPORT_ISOLATED, !!(p->flags & BR_ISOLATED)) ||

	    nla_put_u8(skb, IFLA_BRPORT_LOCKED, !!(p->flags & BR_PORT_LOCKED)))

		return -EMSGSIZE;



	timerval = br_timer_value(&p->message_age_timer);
@@ -827,6 +829,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { 
	[IFLA_BRPORT_GROUP_FWD_MASK] = { .type = NLA_U16 },

	[IFLA_BRPORT_NEIGH_SUPPRESS] = { .type = NLA_U8 },

	[IFLA_BRPORT_ISOLATED]	= { .type = NLA_U8 },

	[IFLA_BRPORT_LOCKED] = { .type = NLA_U8 },

	[IFLA_BRPORT_BACKUP_PORT] = { .type = NLA_U32 },

	[IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT] = { .type = NLA_U32 },

};
@@ -893,6 +896,7 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[], 
	br_set_port_flag(p, tb, IFLA_BRPORT_VLAN_TUNNEL, BR_VLAN_TUNNEL);

	br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_SUPPRESS, BR_NEIGH_SUPPRESS);

	br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED);

	br_set_port_flag(p, tb, IFLA_BRPORT_LOCKED, BR_PORT_LOCKED);



	changed_mask = old_flags ^ p->flags;