bridge: add root port blocking

This is Linux bridge implementation of root port guard.
If BPDU is received from a leaf (edge) port, it should not
be elected as root port.

Why would you want to do this?
If using STP on a bridge and the downstream bridges are not fully
trusted; this prevents a hostile guest for rerouting traffic.

Why not just use netfilter?
Netfilter does not track of follow spanning tree decisions.
It would be difficult and error prone to try and mirror STP
resolution in netfilter module.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 5e871e4d923f8a4d9c4b19542907d999cfffc191..7aae0179ae446e5bd8aa25cfbae6e23bb955735f 100644 (file)
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -217,6 +217,7 @@ enum {
        IFLA_BRPORT_COST,       /* "             cost      */
        IFLA_BRPORT_MODE,       /* mode (hairpin)          */
        IFLA_BRPORT_GUARD,      /* bpdu guard              */
+       IFLA_BRPORT_PROTECT,    /* root port protection    */
        __IFLA_BRPORT_MAX
 };
 #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index c331e28c788009d87326e004dbc94e6bbf07bbf5..65429b99a2a30313c13eed856b565415f5b95333 100644 (file)
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -27,6 +27,7 @@ static inline size_t br_port_info_size(void)
                + nla_total_size(4)     /* IFLA_BRPORT_COST */
                + nla_total_size(1)     /* IFLA_BRPORT_MODE */
                + nla_total_size(1)     /* IFLA_BRPORT_GUARD */
+               + nla_total_size(1)     /* IFLA_BRPORT_PROTECT */
                + 0;
 }
 
@@ -51,7 +52,8 @@ static int br_port_fill_attrs(struct sk_buff *skb,
            nla_put_u16(skb, IFLA_BRPORT_PRIORITY, p->priority) ||
            nla_put_u32(skb, IFLA_BRPORT_COST, p->path_cost) ||
            nla_put_u8(skb, IFLA_BRPORT_MODE, mode) ||
-           nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)))
+           nla_put_u8(skb, IFLA_BRPORT_GUARD, !!(p->flags & BR_BPDU_GUARD)) ||
+           nla_put_u8(skb, IFLA_BRPORT_PROTECT, !!(p->flags & BR_ROOT_BLOCK)))
                return -EMSGSIZE;
 
        return 0;
@@ -165,6 +167,7 @@ static const struct nla_policy ifla_brport_policy[IFLA_BRPORT_MAX + 1] = {
        [IFLA_BRPORT_PRIORITY]  = { .type = NLA_U16 },
        [IFLA_BRPORT_MODE]      = { .type = NLA_U8 },
        [IFLA_BRPORT_GUARD]     = { .type = NLA_U8 },
+       [IFLA_BRPORT_PROTECT]   = { .type = NLA_U8 },
 };
 
 /* Change the state of the port and notify spanning tree */

diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c92b0804ff2d0574d212d0f09aadd3db584a0c20..eb9cd42146a5c29cd206e4336436e98598a3e761 100644 (file)
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -136,6 +136,7 @@ struct net_bridge_port
        unsigned long                   flags;
 #define BR_HAIRPIN_MODE                0x00000001
 #define BR_BPDU_GUARD           0x00000002
+#define BR_ROOT_BLOCK          0x00000004
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
        u32                             multicast_startup_queries_sent;

diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index af9a12099ba4add30e66055fd1a356e16e6813fa..b01849a743101a16e99eebb3a0ef653242c98330 100644 (file)
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -100,6 +100,21 @@ static int br_should_become_root_port(const struct net_bridge_port *p,
        return 0;
 }
 
+static void br_root_port_block(const struct net_bridge *br,
+                              struct net_bridge_port *p)
+{
+
+       br_notice(br, "port %u(%s) tried to become root port (blocked)",
+                 (unsigned int) p->port_no, p->dev->name);
+
+       p->state = BR_STATE_LISTENING;
+       br_log_state(p);
+       br_ifinfo_notify(RTM_NEWLINK, p);
+
+       if (br->forward_delay > 0)
+               mod_timer(&p->forward_delay_timer, jiffies + br->forward_delay);
+}
+
 /* called under bridge lock */
 static void br_root_selection(struct net_bridge *br)
 {
@@ -107,7 +122,12 @@ static void br_root_selection(struct net_bridge *br)
        u16 root_port = 0;
 
        list_for_each_entry(p, &br->port_list, list) {
-               if (br_should_become_root_port(p, root_port))
+               if (!br_should_become_root_port(p, root_port))
+                       continue;
+
+               if (p->flags & BR_ROOT_BLOCK)
+                       br_root_port_block(br, p);
+               else
                        root_port = p->port_no;
        }
 

diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index d1dfa40261858f20d14432726bb58f0e207ab327..80a4fc5d96ab7cf409435a0235489c84f4ab8fac 100644 (file)
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -157,6 +157,7 @@ static BRPORT_ATTR(flush, S_IWUSR, NULL, store_flush);
 
 BRPORT_ATTR_FLAG(hairpin_mode, BR_HAIRPIN_MODE);
 BRPORT_ATTR_FLAG(bpdu_guard, BR_BPDU_GUARD);
+BRPORT_ATTR_FLAG(root_block, BR_ROOT_BLOCK);
 
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
 static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
@@ -191,6 +192,7 @@ static const struct brport_attribute *brport_attrs[] = {
        &brport_attr_flush,
        &brport_attr_hairpin_mode,
        &brport_attr_bpdu_guard,
+       &brport_attr_root_block,
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
        &brport_attr_multicast_router,
 #endif