linux/net/bridge/br_ioctl.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *      Ioctl handler
   4 *      Linux ethernet bridge
   5 *
   6 *      Authors:
   7 *      Lennert Buytenhek               <buytenh@gnu.org>
   8 */
   9
  10#include <linux/capability.h>
  11#include <linux/kernel.h>
  12#include <linux/if_bridge.h>
  13#include <linux/netdevice.h>
  14#include <linux/slab.h>
  15#include <linux/times.h>
  16#include <net/net_namespace.h>
  17#include <linux/uaccess.h>
  18#include "br_private.h"
  19
  20static int get_bridge_ifindices(struct net *net, int *indices, int num)
  21{
  22        struct net_device *dev;
  23        int i = 0;
  24
  25        rcu_read_lock();
  26        for_each_netdev_rcu(net, dev) {
  27                if (i >= num)
  28                        break;
  29                if (dev->priv_flags & IFF_EBRIDGE)
  30                        indices[i++] = dev->ifindex;
  31        }
  32        rcu_read_unlock();
  33
  34        return i;
  35}
  36
  37/* called with RTNL */
  38static void get_port_ifindices(struct net_bridge *br, int *ifindices, int num)
  39{
  40        struct net_bridge_port *p;
  41
  42        list_for_each_entry(p, &br->port_list, list) {
  43                if (p->port_no < num)
  44                        ifindices[p->port_no] = p->dev->ifindex;
  45        }
  46}
  47
  48/*
  49 * Format up to a page worth of forwarding table entries
  50 * userbuf -- where to copy result
  51 * maxnum  -- maximum number of entries desired
  52 *            (limited to a page for sanity)
  53 * offset  -- number of records to skip
  54 */
  55static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
  56                           unsigned long maxnum, unsigned long offset)
  57{
  58        int num;
  59        void *buf;
  60        size_t size;
  61
  62        /* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
  63        if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
  64                maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
  65
  66        size = maxnum * sizeof(struct __fdb_entry);
  67
  68        buf = kmalloc(size, GFP_USER);
  69        if (!buf)
  70                return -ENOMEM;
  71
  72        num = br_fdb_fillbuf(br, buf, maxnum, offset);
  73        if (num > 0) {
  74                if (copy_to_user(userbuf, buf, num*sizeof(struct __fdb_entry)))
  75                        num = -EFAULT;
  76        }
  77        kfree(buf);
  78
  79        return num;
  80}
  81
  82/* called with RTNL */
  83static int add_del_if(struct net_bridge *br, int ifindex, int isadd)
  84{
  85        struct net *net = dev_net(br->dev);
  86        struct net_device *dev;
  87        int ret;
  88
  89        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
  90                return -EPERM;
  91
  92        dev = __dev_get_by_index(net, ifindex);
  93        if (dev == NULL)
  94                return -EINVAL;
  95
  96        if (isadd)
  97                ret = br_add_if(br, dev, NULL);
  98        else
  99                ret = br_del_if(br, dev);
 100
 101        return ret;
 102}
 103
 104/*
 105 * Legacy ioctl's through SIOCDEVPRIVATE
 106 * This interface is deprecated because it was too difficult
 107 * to do the translation for 32/64bit ioctl compatibility.
 108 */
 109static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 110{
 111        struct net_bridge *br = netdev_priv(dev);
 112        struct net_bridge_port *p = NULL;
 113        unsigned long args[4];
 114        int ret = -EOPNOTSUPP;
 115
 116        if (copy_from_user(args, rq->ifr_data, sizeof(args)))
 117                return -EFAULT;
 118
 119        switch (args[0]) {
 120        case BRCTL_ADD_IF:
 121        case BRCTL_DEL_IF:
 122                return add_del_if(br, args[1], args[0] == BRCTL_ADD_IF);
 123
 124        case BRCTL_GET_BRIDGE_INFO:
 125        {
 126                struct __bridge_info b;
 127
 128                memset(&b, 0, sizeof(struct __bridge_info));
 129                rcu_read_lock();
 130                memcpy(&b.designated_root, &br->designated_root, 8);
 131                memcpy(&b.bridge_id, &br->bridge_id, 8);
 132                b.root_path_cost = br->root_path_cost;
 133                b.max_age = jiffies_to_clock_t(br->max_age);
 134                b.hello_time = jiffies_to_clock_t(br->hello_time);
 135                b.forward_delay = br->forward_delay;
 136                b.bridge_max_age = br->bridge_max_age;
 137                b.bridge_hello_time = br->bridge_hello_time;
 138                b.bridge_forward_delay = jiffies_to_clock_t(br->bridge_forward_delay);
 139                b.topology_change = br->topology_change;
 140                b.topology_change_detected = br->topology_change_detected;
 141                b.root_port = br->root_port;
 142
 143                b.stp_enabled = (br->stp_enabled != BR_NO_STP);
 144                b.ageing_time = jiffies_to_clock_t(br->ageing_time);
 145                b.hello_timer_value = br_timer_value(&br->hello_timer);
 146                b.tcn_timer_value = br_timer_value(&br->tcn_timer);
 147                b.topology_change_timer_value = br_timer_value(&br->topology_change_timer);
 148                b.gc_timer_value = br_timer_value(&br->gc_work.timer);
 149                rcu_read_unlock();
 150
 151                if (copy_to_user((void __user *)args[1], &b, sizeof(b)))
 152                        return -EFAULT;
 153
 154                return 0;
 155        }
 156
 157        case BRCTL_GET_PORT_LIST:
 158        {
 159                int num, *indices;
 160
 161                num = args[2];
 162                if (num < 0)
 163                        return -EINVAL;
 164                if (num == 0)
 165                        num = 256;
 166                if (num > BR_MAX_PORTS)
 167                        num = BR_MAX_PORTS;
 168
 169                indices = kcalloc(num, sizeof(int), GFP_KERNEL);
 170                if (indices == NULL)
 171                        return -ENOMEM;
 172
 173                get_port_ifindices(br, indices, num);
 174                if (copy_to_user((void __user *)args[1], indices, num*sizeof(int)))
 175                        num =  -EFAULT;
 176                kfree(indices);
 177                return num;
 178        }
 179
 180        case BRCTL_SET_BRIDGE_FORWARD_DELAY:
 181                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 182                        return -EPERM;
 183
 184                ret = br_set_forward_delay(br, args[1]);
 185                break;
 186
 187        case BRCTL_SET_BRIDGE_HELLO_TIME:
 188                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 189                        return -EPERM;
 190
 191                ret = br_set_hello_time(br, args[1]);
 192                break;
 193
 194        case BRCTL_SET_BRIDGE_MAX_AGE:
 195                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 196                        return -EPERM;
 197
 198                ret = br_set_max_age(br, args[1]);
 199                break;
 200
 201        case BRCTL_SET_AGEING_TIME:
 202                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 203                        return -EPERM;
 204
 205                ret = br_set_ageing_time(br, args[1]);
 206                break;
 207
 208        case BRCTL_GET_PORT_INFO:
 209        {
 210                struct __port_info p;
 211                struct net_bridge_port *pt;
 212
 213                rcu_read_lock();
 214                if ((pt = br_get_port(br, args[2])) == NULL) {
 215                        rcu_read_unlock();
 216                        return -EINVAL;
 217                }
 218
 219                memset(&p, 0, sizeof(struct __port_info));
 220                memcpy(&p.designated_root, &pt->designated_root, 8);
 221                memcpy(&p.designated_bridge, &pt->designated_bridge, 8);
 222                p.port_id = pt->port_id;
 223                p.designated_port = pt->designated_port;
 224                p.path_cost = pt->path_cost;
 225                p.designated_cost = pt->designated_cost;
 226                p.state = pt->state;
 227                p.top_change_ack = pt->topology_change_ack;
 228                p.config_pending = pt->config_pending;
 229                p.message_age_timer_value = br_timer_value(&pt->message_age_timer);
 230                p.forward_delay_timer_value = br_timer_value(&pt->forward_delay_timer);
 231                p.hold_timer_value = br_timer_value(&pt->hold_timer);
 232
 233                rcu_read_unlock();
 234
 235                if (copy_to_user((void __user *)args[1], &p, sizeof(p)))
 236                        return -EFAULT;
 237
 238                return 0;
 239        }
 240
 241        case BRCTL_SET_BRIDGE_STP_STATE:
 242                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 243                        return -EPERM;
 244
 245                ret = br_stp_set_enabled(br, args[1], NULL);
 246                break;
 247
 248        case BRCTL_SET_BRIDGE_PRIORITY:
 249                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 250                        return -EPERM;
 251
 252                br_stp_set_bridge_priority(br, args[1]);
 253                ret = 0;
 254                break;
 255
 256        case BRCTL_SET_PORT_PRIORITY:
 257        {
 258                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 259                        return -EPERM;
 260
 261                spin_lock_bh(&br->lock);
 262                if ((p = br_get_port(br, args[1])) == NULL)
 263                        ret = -EINVAL;
 264                else
 265                        ret = br_stp_set_port_priority(p, args[2]);
 266                spin_unlock_bh(&br->lock);
 267                break;
 268        }
 269
 270        case BRCTL_SET_PATH_COST:
 271        {
 272                if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
 273                        return -EPERM;
 274
 275                spin_lock_bh(&br->lock);
 276                if ((p = br_get_port(br, args[1])) == NULL)
 277                        ret = -EINVAL;
 278                else
 279                        ret = br_stp_set_path_cost(p, args[2]);
 280                spin_unlock_bh(&br->lock);
 281                break;
 282        }
 283
 284        case BRCTL_GET_FDB_ENTRIES:
 285                return get_fdb_entries(br, (void __user *)args[1],
 286                                       args[2], args[3]);
 287        }
 288
 289        if (!ret) {
 290                if (p)
 291                        br_ifinfo_notify(RTM_NEWLINK, NULL, p);
 292                else
 293                        netdev_state_change(br->dev);
 294        }
 295
 296        return ret;
 297}
 298
 299static int old_deviceless(struct net *net, void __user *uarg)
 300{
 301        unsigned long args[3];
 302
 303        if (copy_from_user(args, uarg, sizeof(args)))
 304                return -EFAULT;
 305
 306        switch (args[0]) {
 307        case BRCTL_GET_VERSION:
 308                return BRCTL_VERSION;
 309
 310        case BRCTL_GET_BRIDGES:
 311        {
 312                int *indices;
 313                int ret = 0;
 314
 315                if (args[2] >= 2048)
 316                        return -ENOMEM;
 317                indices = kcalloc(args[2], sizeof(int), GFP_KERNEL);
 318                if (indices == NULL)
 319                        return -ENOMEM;
 320
 321                args[2] = get_bridge_ifindices(net, indices, args[2]);
 322
 323                ret = copy_to_user((void __user *)args[1], indices, args[2]*sizeof(int))
 324                        ? -EFAULT : args[2];
 325
 326                kfree(indices);
 327                return ret;
 328        }
 329
 330        case BRCTL_ADD_BRIDGE:
 331        case BRCTL_DEL_BRIDGE:
 332        {
 333                char buf[IFNAMSIZ];
 334
 335                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
 336                        return -EPERM;
 337
 338                if (copy_from_user(buf, (void __user *)args[1], IFNAMSIZ))
 339                        return -EFAULT;
 340
 341                buf[IFNAMSIZ-1] = 0;
 342
 343                if (args[0] == BRCTL_ADD_BRIDGE)
 344                        return br_add_bridge(net, buf);
 345
 346                return br_del_bridge(net, buf);
 347        }
 348        }
 349
 350        return -EOPNOTSUPP;
 351}
 352
 353int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __user *uarg)
 354{
 355        switch (cmd) {
 356        case SIOCGIFBR:
 357        case SIOCSIFBR:
 358                return old_deviceless(net, uarg);
 359
 360        case SIOCBRADDBR:
 361        case SIOCBRDELBR:
 362        {
 363                char buf[IFNAMSIZ];
 364
 365                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
 366                        return -EPERM;
 367
 368                if (copy_from_user(buf, uarg, IFNAMSIZ))
 369                        return -EFAULT;
 370
 371                buf[IFNAMSIZ-1] = 0;
 372                if (cmd == SIOCBRADDBR)
 373                        return br_add_bridge(net, buf);
 374
 375                return br_del_bridge(net, buf);
 376        }
 377        }
 378        return -EOPNOTSUPP;
 379}
 380
 381int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 382{
 383        struct net_bridge *br = netdev_priv(dev);
 384
 385        switch (cmd) {
 386        case SIOCDEVPRIVATE:
 387                return old_dev_ioctl(dev, rq, cmd);
 388
 389        case SIOCBRADDIF:
 390        case SIOCBRDELIF:
 391                return add_del_if(br, rq->ifr_ifindex, cmd == SIOCBRADDIF);
 392
 393        }
 394
 395        br_debug(br, "Bridge does not support ioctl 0x%x\n", cmd);
 396        return -EOPNOTSUPP;
 397}
 398