From patchwork Mon May 25 13:39:31 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 476211 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E92C51402B7 for ; Mon, 25 May 2015 23:39:49 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b=TYPKkzgi; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751234AbbEYNjp (ORCPT ); Mon, 25 May 2015 09:39:45 -0400 Received: from mail-pd0-f172.google.com ([209.85.192.172]:35841 "EHLO mail-pd0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751207AbbEYNjo (ORCPT ); Mon, 25 May 2015 09:39:44 -0400 Received: by pdfh10 with SMTP id h10so70107763pdf.3 for ; Mon, 25 May 2015 06:39:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=NXWnB7wR8EQJlb42+sfhtrTv2B9cRnsCJNbQAeNnN20=; b=TYPKkzgiKdoxTQ7PkX0gIeoZC05sgzXQmftEgSXeElrtsqyzHXUZtrKwz3JS++8sL7 +1XQxnaAbGMuFZiu5w9+gbNGazpLQaXjKBUPEt2xCE8z/wAeg2DV3PqHOKA+PzCAOozg 8VQ7R1fqJR5g39J7Hy8mmivXU9BSThpbtvcbA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=NXWnB7wR8EQJlb42+sfhtrTv2B9cRnsCJNbQAeNnN20=; b=ldbK1EDE1YqbUAOPaujw5XggF8E4gVD63q/RL06ymRD1wBxvOPqY7ZBJ/jbjWK8x6T ifbQshscP/C2+KepJ3GGE1MyXH8uKdYs0JFLnowzfaynJmAnIonUsQ7HkFhydheXIrA8 4F/KyHRyfmub2gN/+dcSmaWUj/4fYHFGUdRgQHEjEaOpeoBMXn4q3v81KutT63gHiIij B3ObB0gBW8a+LvhCFdWvyF0+hmSwoIqOHLF1hOuWNK0uOpOX7eO2fouxMvCkOYtBARAV 4tgaE3BgbBE6ziN/2/uKaHFi08XRofs6ZW9Sql1I5NstjJEnVwWrjmE0z9hSmwpkTTpx SXNA== X-Gm-Message-State: ALoCoQllE/OU2V8vfh9WM9Bf3GGXpxz53E7ON9HghadIK41dF/gWKKxNwnfHA/liXM6o3suuhpJk X-Received: by 10.70.101.200 with SMTP id fi8mr39588304pdb.161.1432561183781; Mon, 25 May 2015 06:39:43 -0700 (PDT) Received: from monster-01.cumulusnetworks.com ([216.129.126.126]) by mx.google.com with ESMTPSA id i6sm4059908pde.3.2015.05.25.06.39.42 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 May 2015 06:39:43 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: wkok@cumulusnetworks.com, davem@davemloft.net, stephen@networkplumber.org, bridge@lists.linux-foundation.org, Nikolay Aleksandrov Subject: [PATCH net-next v2] bridge: skip fdb add if the port shouldn't learn Date: Mon, 25 May 2015 06:39:31 -0700 Message-Id: <1432561171-4965-1-git-send-email-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <1432204977-4293-1-git-send-email-nikolay@cumulusnetworks.com> References: <1432204977-4293-1-git-send-email-nikolay@cumulusnetworks.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Wilson Kok Check in fdb_add_entry() if the source port should learn, similar check is used in br_fdb_update. Note that new fdb entries which are added manually or as local ones are still permitted. This patch has been tested by running traffic via a bridge port and switching the port's state, also by manually adding/removing entries from the bridge's fdb. Signed-off-by: Wilson Kok Signed-off-by: Nikolay Aleksandrov --- v2: return an error instead of silently failing. net/bridge/br_fdb.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c index e0670d7054f9..7896cf143045 100644 --- a/net/bridge/br_fdb.c +++ b/net/bridge/br_fdb.c @@ -736,6 +736,12 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr, struct net_bridge_fdb_entry *fdb; bool modified = false; + /* If the port cannot learn allow only local and static entries */ + if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) && + !(source->state == BR_STATE_LEARNING || + source->state == BR_STATE_FORWARDING)) + return -EPERM; + fdb = fdb_find(head, addr, vid); if (fdb == NULL) { if (!(flags & NLM_F_CREATE))