Commit 1007dd1a authored by stephen hemminger's avatar stephen hemminger Committed by David S. Miller
Browse files

bridge: add root port blocking 



This is Linux bridge implementation of root port guard.
If BPDU is received from a leaf (edge) port, it should not
be elected as root port.

Why would you want to do this?
If using STP on a bridge and the downstream bridges are not fully
trusted; this prevents a hostile guest for rerouting traffic.

Why not just use netfilter?
Netfilter does not track of follow spanning tree decisions.
It would be difficult and error prone to try and mirror STP
resolution in netfilter module.

Signed-off-by: default avatarStephen Hemminger <shemminger@vyatta.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a2e01a65

include/uapi/linux/if_link.h

+1 −0
Original line number Diff line number Diff line
@@ -217,6 +217,7 @@ enum { 
	IFLA_BRPORT_COST,	/* "             cost      */

	IFLA_BRPORT_MODE,	/* mode (hairpin)          */

	IFLA_BRPORT_GUARD,	/* bpdu guard              */

	IFLA_BRPORT_PROTECT,	/* root port protection    */

	__IFLA_BRPORT_MAX

};

#define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)

net/bridge/br_netlink.c

+4 −1
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ static inline size_t br_port_info_size(void) 
		+ nla_total_size(4)	/* IFLA_BRPORT_COST */

		+ nla_total_size(1)	/* IFLA_BRPORT_MODE */

		+ nla_total_size(1)	/* IFLA_BRPORT_GUARD */

		+ nla_total_size(1)	/* IFLA_BRPORT_PROTECT */

		+ 0;

}
@@ -51,7 +52,8 @@ static int br_port_fill_attrs(struct sk_buff *skb, 
	    nla_put_u16(skb, IFLA_BRPORT_PRIORITY, p->priority) ||

	    nla_put_u32(skb, IFLA_BRPORT_COST, p->path_cost) ||

	    nla_put_u8(skb, IFLA_BRPORT_MODE, mode) ||

	    nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)))

	    nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)) ||

	    nla_put_u8(skb, IFLA_BRPORT_PROTECT, !!(p->flags & BR_ROOT_BLOCK)))

		return -EMSGSIZE;



	return 0;
@@ -165,6 +167,7 @@ static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = { 
	[IFLA_BRPORT_PRIORITY]	= { .type = NLA_U16 },

	[IFLA_BRPORT_MODE]	= { .type = NLA_U8 },

	[IFLA_BRPORT_GUARD]	= { .type = NLA_U8 },

	[IFLA_BRPORT_PROTECT]	= { .type = NLA_U8 },

};



/* Change the state of the port and notify spanning tree */

net/bridge/br_private.h

+1 −0
Original line number Diff line number Diff line
@@ -136,6 +136,7 @@ struct net_bridge_port 
	unsigned long 			flags;

#define BR_HAIRPIN_MODE		0x00000001

#define BR_BPDU_GUARD           0x00000002

#define BR_ROOT_BLOCK		0x00000004



#ifdef CONFIG_BRIDGE_IGMP_SNOOPING

	u32				multicast_startup_queries_sent;

net/bridge/br_stp.c

+21 −1
Original line number Diff line number Diff line
@@ -100,6 +100,21 @@ static int br_should_become_root_port(const struct net_bridge_port *p, 
	return 0;

}



static void br_root_port_block(const struct net_bridge *br,

			       struct net_bridge_port *p)

{



	br_notice(br, "port %u(%s) tried to become root port (blocked)",

		  (unsigned int) p->port_no, p->dev->name);



	p->state = BR_STATE_LISTENING;

	br_log_state(p);

	br_ifinfo_notify(RTM_NEWLINK, p);



	if (br->forward_delay > 0)

		mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);

}



/* called under bridge lock */

static void br_root_selection(struct net_bridge *br)

{
@@ -107,7 +122,12 @@ static void br_root_selection(struct net_bridge *br) 
	u16 root_port = 0;



	list_for_each_entry(p, &br->port_list, list) {

		if (br_should_become_root_port(p, root_port))

		if (!br_should_become_root_port(p, root_port))

			continue;



		if (p->flags & BR_ROOT_BLOCK)

			br_root_port_block(br, p);

		else

			root_port = p->port_no;

	}

net/bridge/br_sysfs_if.c

+2 −0
Original line number Diff line number Diff line
@@ -157,6 +157,7 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush); 


BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);

BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);

BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);



#ifdef CONFIG_BRIDGE_IGMP_SNOOPING

static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
@@ -191,6 +192,7 @@ static const struct brport_attribute *brport_attrs[] = { 
	&brport_attr_flush,

	&brport_attr_hairpin_mode,

	&brport_attr_bpdu_guard,

	&brport_attr_root_block,

#ifdef CONFIG_BRIDGE_IGMP_SNOOPING

	&brport_attr_multicast_router,

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE