From patchwork Thu Jun 23 21:39:52 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nick Carter X-Patchwork-Id: 101693 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3DDBFB6F18 for ; Fri, 24 Jun 2011 07:39:59 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933002Ab1FWVjy (ORCPT ); Thu, 23 Jun 2011 17:39:54 -0400 Received: from mail-pv0-f174.google.com ([74.125.83.174]:39422 "EHLO mail-pv0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932717Ab1FWVjx (ORCPT ); Thu, 23 Jun 2011 17:39:53 -0400 Received: by pvg12 with SMTP id 12so1372648pvg.19 for ; Thu, 23 Jun 2011 14:39:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:date:message-id:subject:from:to:cc :content-type; bh=ytHMZfChGaxtCVgw6zF1KEAIwVvoCyU13rrpjWwnOSI=; b=gQ2OUVrMRWkQyJSQ0cb0NkrtXZVEp0FXvBRSHFCoxLqbC1nsnDcEatYXRyCKQecwCB 33pYh+DqXID60nUHmNxuPb+31m601xGp71skL/1/Lytbp4QBKc2HSSj9ZhqFVdEeOGgz EeIVH0QYf+K5QybCpPdaZVnTteu/KlBo3oowg= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=NKbPAWjx+neTFGSKSNhpr7t2XpTsPlfJiKcKd3hqm1oaZMlI11oAYr2sWbOcMqHIsr SBLLe3sttWgec5IgaHuw7y6H6rcyjLTnaTp+TM4+zS5r8N/D2SqU9MGUliSo/Astn5no CUTzBbdRyAkEq+7xUH17iCJ1gOkHk3TQPmNPI= MIME-Version: 1.0 Received: by 10.68.16.3 with SMTP id b3mr1363372pbd.483.1308865192726; Thu, 23 Jun 2011 14:39:52 -0700 (PDT) Received: by 10.68.47.161 with HTTP; Thu, 23 Jun 2011 14:39:52 -0700 (PDT) Date: Thu, 23 Jun 2011 22:39:52 +0100 Message-ID: Subject: [PATCH] bridge: Forward EAPOL Kconfig option BRIDGE_PAE_FORWARD From: Nick Carter To: netdev@vger.kernel.org Cc: shemminger@linux-foundation.org, davem@davemloft.net Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Signed-off-by: Nick Carter This Kconfig option is used to enable a bridge to forward 802.1x (EAPOL) Port Access Entity (PAE) frames. One use of this would be to enable 802.1x authentication between a PAE supplicant running inside a virtual machine, with the EAPOL frames bridged out to an external PAE authenticator. If BRIDGE_PAE_FORWARD is not set the behaviour of bridge.ko is unchanged. If BRIDGE_PAE_FORWARD is set then by default the only new behaviour is that unicast EAPOL frames attempting to traverse the bridge will be dropped. This makes the bridge standards compliant by preventing crosstalk (IEEE Std 802.1X-2001 C.3.3). Writing a 1 to the new sysfs attribute ../bridge/pae_forward will enable the forwarding of EAPOL frames, both unicast and link local multicast (01-80-C2-00-00-03). &dev_attr_hello_time.attr, @@ -717,6 +744,9 @@ static struct attribute *bridge_attrs[] = { &dev_attr_nf_call_ip6tables.attr, &dev_attr_nf_call_arptables.attr, #endif +#ifdef CONFIG_BRIDGE_PAE_FORWARD + &dev_attr_pae_forward.attr, +#endif NULL }; --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig index 6dee7bf..c47a49e 100644 --- a/net/bridge/Kconfig +++ b/net/bridge/Kconfig @@ -46,3 +46,22 @@ config BRIDGE_IGMP_SNOOPING Say N to exclude this support and reduce the binary size. If unsure, say Y. + +config BRIDGE_PAE_FORWARD + bool "PAE Forwarding" + depends on BRIDGE + default n + ---help--- + If you say Y here, then the Ethernet bridge will be able to forward + 802.1x (EAPOL) Port Access Entity (PAE) frames. One use of this would + be to enable 802.1x authentication between a PAE supplicant running + inside a virtual machine, with the EAPOL frames bridged out to an + external PAE authenticator. + + On a running kernel with this support, enable PAE forwarding by + writing a '1' to the bridge devices pae_forward attribute. + e.g. echo 1 > /sys/devices/virtual/net/br73/bridge/pae_forward + + Say N to exclude this support. + + If unsure, say N. diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c index d9d1e2b..b493474 100644 --- a/net/bridge/br_if.c +++ b/net/bridge/br_if.c @@ -214,6 +214,9 @@ static struct net_device *new_bridge_dev(struct net *net, const char *name) br->topology_change = 0; br->topology_change_detected = 0; br->ageing_time = 300 * HZ; +#ifdef CONFIG_BRIDGE_PAE_FORWARD + br->pae_forward = BR_PAE_DEFAULT; +#endif br_netfilter_rtable_init(br); diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index 90e985b..183c40f 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -43,6 +43,24 @@ static int br_pass_frame_up(struct sk_buff *skb) netif_receive_skb); } +static inline bool br_pae_forward(struct net_bridge *br, __be16 proto) +{ +#ifdef CONFIG_BRIDGE_PAE_FORWARD + return br->pae_forward == BR_PAE_FORWARD && proto == htons(ETH_P_PAE); +#else + return false; +#endif +} + +static inline bool br_pae_drop(struct net_bridge *br, __be16 proto) +{ +#ifdef CONFIG_BRIDGE_PAE_FORWARD + return br->pae_forward == BR_PAE_DEFAULT && proto == htons(ETH_P_PAE); +#else + return false; +#endif +} + /* note: already called with rcu_read_lock */ int br_handle_frame_finish(struct sk_buff *skb) { @@ -98,6 +116,10 @@ int br_handle_frame_finish(struct sk_buff *skb) } if (skb) { + /* Prevent Crosstalk (IEEE Std 802.1X-2001 C.3.3) */ + if (unlikely(br_pae_drop(br, skb->protocol))) + goto drop; + if (dst) br_forward(dst->dst, skb, skb2); else @@ -166,6 +188,10 @@ struct sk_buff *br_handle_frame(struct sk_buff *skb) if (p->br->stp_enabled == BR_NO_STP && dest[5] == 0) goto forward; + /* Check if PAE frame should be forwarded */ + if (br_pae_forward(p->br, skb->protocol)) + goto forward; + if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev, NULL, br_handle_local_finish)) return NULL; /* frame consumed by filter */ diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h index 4e1b620..a523032 100644 --- a/net/bridge/br_private.h +++ b/net/bridge/br_private.h @@ -244,6 +244,13 @@ struct net_bridge struct timer_list multicast_query_timer; #endif +#ifdef CONFIG_BRIDGE_PAE_FORWARD + enum { + BR_PAE_DEFAULT, /* 802.1x frames consumed by bridge */ + BR_PAE_FORWARD, /* 802.1x frames forwarded by bridge */ + } pae_forward; +#endif + struct timer_list hello_timer; struct timer_list tcn_timer; struct timer_list topology_change_timer; diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c index 5c1e555..c5ffd97 100644 --- a/net/bridge/br_sysfs_br.c +++ b/net/bridge/br_sysfs_br.c @@ -679,6 +679,33 @@ static DEVICE_ATTR(nf_call_arptables, S_IRUGO | S_IWUSR, show_nf_call_arptables, store_nf_call_arptables); #endif +#ifdef CONFIG_BRIDGE_PAE_FORWARD +static ssize_t show_pae_forward(struct device *d, struct device_attribute *attr, + char *buf) +{ + struct net_bridge *br = to_bridge(d); + return sprintf(buf, "%d\n", br->pae_forward); +} + +static int set_pae_forward(struct net_bridge *br, unsigned long val) +{ + if (val > BR_PAE_FORWARD) + return -EINVAL; + + br->pae_forward = val; + return 0; +} + +static ssize_t store_pae_forward(struct device *d, + struct device_attribute *attr, const char *buf, + size_t len) +{ + return store_bridge_parm(d, buf, len, set_pae_forward); +} +static DEVICE_ATTR(pae_forward, S_IRUGO | S_IWUSR, show_pae_forward, + store_pae_forward); +#endif + static struct attribute *bridge_attrs[] = { &dev_attr_forward_delay.attr,