642-bridge_port_isolate.patch 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107
  1. From: Felix Fietkau <nbd@nbd.name>
  2. Subject: [PATCH] bridge: port isolate
  3. Isolating individual bridge ports
  4. ---
  5. --- a/include/linux/if_bridge.h
  6. +++ b/include/linux/if_bridge.h
  7. @@ -45,6 +45,7 @@ struct br_ip_list {
  8. #define BR_PROXYARP BIT(8)
  9. #define BR_LEARNING_SYNC BIT(9)
  10. #define BR_PROXYARP_WIFI BIT(10)
  11. +#define BR_ISOLATE_MODE BIT(11)
  12. #define BR_DEFAULT_AGEING_TIME (300 * HZ)
  13. --- a/net/bridge/br_sysfs_if.c
  14. +++ b/net/bridge/br_sysfs_if.c
  15. @@ -173,6 +173,22 @@ BRPORT_ATTR_FLAG(unicast_flood, BR_FLOOD
  16. BRPORT_ATTR_FLAG(proxyarp, BR_PROXYARP);
  17. BRPORT_ATTR_FLAG(proxyarp_wifi, BR_PROXYARP_WIFI);
  18. +static ssize_t show_isolate_mode(struct net_bridge_port *p, char *buf)
  19. +{
  20. + int isolate_mode = (p->flags & BR_ISOLATE_MODE) ? 1 : 0;
  21. + return sprintf(buf, "%d\n", isolate_mode);
  22. +}
  23. +static int store_isolate_mode(struct net_bridge_port *p, unsigned long v)
  24. +{
  25. + if (v)
  26. + p->flags |= BR_ISOLATE_MODE;
  27. + else
  28. + p->flags &= ~BR_ISOLATE_MODE;
  29. + return 0;
  30. +}
  31. +static BRPORT_ATTR(isolate_mode, S_IRUGO | S_IWUSR,
  32. + show_isolate_mode, store_isolate_mode);
  33. +
  34. #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
  35. static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
  36. {
  37. @@ -217,6 +233,7 @@ static const struct brport_attribute *br
  38. #endif
  39. &brport_attr_proxyarp,
  40. &brport_attr_proxyarp_wifi,
  41. + &brport_attr_isolate_mode,
  42. NULL
  43. };
  44. --- a/net/bridge/br_input.c
  45. +++ b/net/bridge/br_input.c
  46. @@ -192,8 +192,8 @@ int br_handle_frame_finish(struct net *n
  47. unicast = false;
  48. br->dev->stats.multicast++;
  49. - } else if ((dst = __br_fdb_get(br, dest, vid)) &&
  50. - dst->is_local) {
  51. + } else if ((p->flags & BR_ISOLATE_MODE) ||
  52. + ((dst = __br_fdb_get(br, dest, vid)) && dst->is_local)) {
  53. skb2 = skb;
  54. /* Do not forward the packet since it's local. */
  55. skb = NULL;
  56. --- a/net/bridge/br_forward.c
  57. +++ b/net/bridge/br_forward.c
  58. @@ -140,7 +140,7 @@ EXPORT_SYMBOL_GPL(br_deliver);
  59. /* called with rcu_read_lock */
  60. void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
  61. {
  62. - if (to && should_deliver(to, skb)) {
  63. + if (to && should_deliver(to, skb) && !(to->flags & BR_ISOLATE_MODE)) {
  64. if (skb0)
  65. deliver_clone(to, skb, __br_forward);
  66. else
  67. @@ -196,7 +196,7 @@ static void br_flood(struct net_bridge *
  68. struct sk_buff *skb0,
  69. void (*__packet_hook)(const struct net_bridge_port *p,
  70. struct sk_buff *skb),
  71. - bool unicast)
  72. + bool unicast, bool forward)
  73. {
  74. struct net_bridge_port *p;
  75. struct net_bridge_port *prev;
  76. @@ -204,6 +204,8 @@ static void br_flood(struct net_bridge *
  77. prev = NULL;
  78. list_for_each_entry_rcu(p, &br->port_list, list) {
  79. + if (forward && (p->flags & BR_ISOLATE_MODE))
  80. + continue;
  81. /* Do not flood unicast traffic to ports that turn it off */
  82. if (unicast && !(p->flags & BR_FLOOD))
  83. continue;
  84. @@ -238,14 +240,14 @@ out:
  85. /* called with rcu_read_lock */
  86. void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb, bool unicast)
  87. {
  88. - br_flood(br, skb, NULL, __br_deliver, unicast);
  89. + br_flood(br, skb, NULL, __br_deliver, unicast, false);
  90. }
  91. /* called under bridge lock */
  92. void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
  93. struct sk_buff *skb2, bool unicast)
  94. {
  95. - br_flood(br, skb, skb2, __br_forward, unicast);
  96. + br_flood(br, skb, skb2, __br_forward, unicast, true);
  97. }
  98. #ifdef CONFIG_BRIDGE_IGMP_SNOOPING