1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Spanning tree protocol; BPDU handling 4 * Linux ethernet bridge 5 * 6 * Authors: 7 * Lennert Buytenhek <buytenh@gnu.org> 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/netfilter_bridge.h> 12 #include <linux/etherdevice.h> 13 #include <linux/llc.h> 14 #include <linux/slab.h> 15 #include <linux/pkt_sched.h> 16 #include <net/net_namespace.h> 17 #include <net/llc.h> 18 #include <net/llc_pdu.h> 19 #include <net/stp.h> 20 #include <asm/unaligned.h> 21 22 #include "br_private.h" 23 #include "br_private_stp.h" 24 25 #define STP_HZ 256 26 27 #define LLC_RESERVE sizeof(struct llc_pdu_un) 28 29 static int br_send_bpdu_finish(struct net *net, struct sock *sk, 30 struct sk_buff *skb) 31 { 32 return dev_queue_xmit(skb); 33 } 34 35 static void br_send_bpdu(struct net_bridge_port *p, 36 const unsigned char *data, int length) 37 { 38 struct sk_buff *skb; 39 40 skb = dev_alloc_skb(length+LLC_RESERVE); 41 if (!skb) 42 return; 43 44 skb->dev = p->dev; 45 skb->protocol = htons(ETH_P_802_2); 46 skb->priority = TC_PRIO_CONTROL; 47 48 skb_reserve(skb, LLC_RESERVE); 49 __skb_put_data(skb, data, length); 50 51 llc_pdu_header_init(skb, LLC_PDU_TYPE_U, LLC_SAP_BSPAN, 52 LLC_SAP_BSPAN, LLC_PDU_CMD); 53 llc_pdu_init_as_ui_cmd(skb); 54 55 llc_mac_hdr_init(skb, p->dev->dev_addr, p->br->group_addr); 56 57 skb_reset_mac_header(skb); 58 59 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, 60 dev_net(p->dev), NULL, skb, NULL, skb->dev, 61 br_send_bpdu_finish); 62 } 63 64 static inline void br_set_ticks(unsigned char *dest, int j) 65 { 66 unsigned long ticks = (STP_HZ * j)/ HZ; 67 68 put_unaligned_be16(ticks, dest); 69 } 70 71 static inline int br_get_ticks(const unsigned char *src) 72 { 73 unsigned long ticks = get_unaligned_be16(src); 74 75 return DIV_ROUND_UP(ticks * HZ, STP_HZ); 76 } 77 78 /* called under bridge lock */ 79 void br_send_config_bpdu(struct net_bridge_port *p, struct br_config_bpdu *bpdu) 80 { 81 unsigned char buf[35]; 82 83 if (p->br->stp_enabled != BR_KERNEL_STP) 84 return; 85 86 buf[0] = 0; 87 buf[1] = 0; 88 buf[2] = 0; 89 buf[3] = BPDU_TYPE_CONFIG; 90 buf[4] = (bpdu->topology_change ? 0x01 : 0) | 91 (bpdu->topology_change_ack ? 0x80 : 0); 92 buf[5] = bpdu->root.prio[0]; 93 buf[6] = bpdu->root.prio[1]; 94 buf[7] = bpdu->root.addr[0]; 95 buf[8] = bpdu->root.addr[1]; 96 buf[9] = bpdu->root.addr[2]; 97 buf[10] = bpdu->root.addr[3]; 98 buf[11] = bpdu->root.addr[4]; 99 buf[12] = bpdu->root.addr[5]; 100 buf[13] = (bpdu->root_path_cost >> 24) & 0xFF; 101 buf[14] = (bpdu->root_path_cost >> 16) & 0xFF; 102 buf[15] = (bpdu->root_path_cost >> 8) & 0xFF; 103 buf[16] = bpdu->root_path_cost & 0xFF; 104 buf[17] = bpdu->bridge_id.prio[0]; 105 buf[18] = bpdu->bridge_id.prio[1]; 106 buf[19] = bpdu->bridge_id.addr[0]; 107 buf[20] = bpdu->bridge_id.addr[1]; 108 buf[21] = bpdu->bridge_id.addr[2]; 109 buf[22] = bpdu->bridge_id.addr[3]; 110 buf[23] = bpdu->bridge_id.addr[4]; 111 buf[24] = bpdu->bridge_id.addr[5]; 112 buf[25] = (bpdu->port_id >> 8) & 0xFF; 113 buf[26] = bpdu->port_id & 0xFF; 114 115 br_set_ticks(buf+27, bpdu->message_age); 116 br_set_ticks(buf+29, bpdu->max_age); 117 br_set_ticks(buf+31, bpdu->hello_time); 118 br_set_ticks(buf+33, bpdu->forward_delay); 119 120 br_send_bpdu(p, buf, 35); 121 122 p->stp_xstats.tx_bpdu++; 123 } 124 125 /* called under bridge lock */ 126 void br_send_tcn_bpdu(struct net_bridge_port *p) 127 { 128 unsigned char buf[4]; 129 130 if (p->br->stp_enabled != BR_KERNEL_STP) 131 return; 132 133 buf[0] = 0; 134 buf[1] = 0; 135 buf[2] = 0; 136 buf[3] = BPDU_TYPE_TCN; 137 br_send_bpdu(p, buf, 4); 138 139 p->stp_xstats.tx_tcn++; 140 } 141 142 /* 143 * Called from llc. 144 * 145 * NO locks, but rcu_read_lock 146 */ 147 void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb, 148 struct net_device *dev) 149 { 150 struct net_bridge_port *p; 151 struct net_bridge *br; 152 const unsigned char *buf; 153 154 if (!pskb_may_pull(skb, 4)) 155 goto err; 156 157 /* compare of protocol id and version */ 158 buf = skb->data; 159 if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0) 160 goto err; 161 162 p = br_port_get_check_rcu(dev); 163 if (!p) 164 goto err; 165 166 br = p->br; 167 spin_lock(&br->lock); 168 169 if (br->stp_enabled != BR_KERNEL_STP) 170 goto out; 171 172 if (!(br->dev->flags & IFF_UP)) 173 goto out; 174 175 if (p->state == BR_STATE_DISABLED) 176 goto out; 177 178 if (!ether_addr_equal(eth_hdr(skb)->h_dest, br->group_addr)) 179 goto out; 180 181 if (p->flags & BR_BPDU_GUARD) { 182 br_notice(br, "BPDU received on blocked port %u(%s)\n", 183 (unsigned int) p->port_no, p->dev->name); 184 br_stp_disable_port(p); 185 goto out; 186 } 187 188 buf = skb_pull(skb, 3); 189 190 if (buf[0] == BPDU_TYPE_CONFIG) { 191 struct br_config_bpdu bpdu; 192 193 if (!pskb_may_pull(skb, 32)) 194 goto out; 195 196 buf = skb->data; 197 bpdu.topology_change = (buf[1] & 0x01) ? 1 : 0; 198 bpdu.topology_change_ack = (buf[1] & 0x80) ? 1 : 0; 199 200 bpdu.root.prio[0] = buf[2]; 201 bpdu.root.prio[1] = buf[3]; 202 bpdu.root.addr[0] = buf[4]; 203 bpdu.root.addr[1] = buf[5]; 204 bpdu.root.addr[2] = buf[6]; 205 bpdu.root.addr[3] = buf[7]; 206 bpdu.root.addr[4] = buf[8]; 207 bpdu.root.addr[5] = buf[9]; 208 bpdu.root_path_cost = 209 (buf[10] << 24) | 210 (buf[11] << 16) | 211 (buf[12] << 8) | 212 buf[13]; 213 bpdu.bridge_id.prio[0] = buf[14]; 214 bpdu.bridge_id.prio[1] = buf[15]; 215 bpdu.bridge_id.addr[0] = buf[16]; 216 bpdu.bridge_id.addr[1] = buf[17]; 217 bpdu.bridge_id.addr[2] = buf[18]; 218 bpdu.bridge_id.addr[3] = buf[19]; 219 bpdu.bridge_id.addr[4] = buf[20]; 220 bpdu.bridge_id.addr[5] = buf[21]; 221 bpdu.port_id = (buf[22] << 8) | buf[23]; 222 223 bpdu.message_age = br_get_ticks(buf+24); 224 bpdu.max_age = br_get_ticks(buf+26); 225 bpdu.hello_time = br_get_ticks(buf+28); 226 bpdu.forward_delay = br_get_ticks(buf+30); 227 228 if (bpdu.message_age > bpdu.max_age) { 229 if (net_ratelimit()) 230 br_notice(p->br, 231 "port %u config from %pM" 232 " (message_age %ul > max_age %ul)\n", 233 p->port_no, 234 eth_hdr(skb)->h_source, 235 bpdu.message_age, bpdu.max_age); 236 goto out; 237 } 238 239 br_received_config_bpdu(p, &bpdu); 240 } else if (buf[0] == BPDU_TYPE_TCN) { 241 br_received_tcn_bpdu(p); 242 } 243 out: 244 spin_unlock(&br->lock); 245 err: 246 kfree_skb(skb); 247 } 248