macvlan: add source mode

This patch adds a new mode of operation to macvlan, called "source".
It allows one to set a list of allowed mac address, which is used
to match against source mac address from received frames on underlying
interface.
This enables creating mac based VLAN associations, instead of standard
port or tag based. The feature is useful to deploy 802.1x mac based
behavior, where drivers of underlying interfaces doesn't allows that.

Configuration is done through the netlink interface using e.g.:
 ip link add link eth0 name macvlan0 type macvlan mode source
 ip link add link eth0 name macvlan1 type macvlan mode source
 ip link set link dev macvlan0 type macvlan macaddr add 00:11:11:11:11:11
 ip link set link dev macvlan0 type macvlan macaddr add 00:22:22:22:22:22
 ip link set link dev macvlan0 type macvlan macaddr add 00:33:33:33:33:33
 ip link set link dev macvlan1 type macvlan macaddr add 00:33:33:33:33:33
 ip link set link dev macvlan1 type macvlan macaddr add 00:44:44:44:44:44

This allows clients with MAC addresses 00:11:11:11:11:11,
00:22:22:22:22:22 to be part of only VLAN associated with macvlan0
interface. Clients with MAC addresses 00:44:44:44:44:44 with only VLAN
associated with macvlan1 interface. And client with MAC address
00:33:33:33:33:33 to be associated with both VLANs.

Based on work of Stefan Gula <steweg@gmail.com>

v8: last version of Stefan Gula for Kernel 3.2.1
v9: rework onto linux-next 2014-03-12 by Michael Braun
    add MACADDR_SET command, enable to configure mac for source mode
    while creating interface
v10:
  - reduce indention level
  - rename source_list to source_entry
  - use aligned 64bit ether address
  - use hash_64 instead of addr[5]
v11:
  - rebase for 3.14 / linux-next 20.04.2014
v12
  - rebase for linux-next 2014-09-25

Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 314 insertions, 3 deletions

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 726edabff26b..e8a453f1b458 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -35,7 +35,8 @@
 #include <net/xfrm.h>
 #include <linux/netpoll.h>
 
-#define MACVLAN_HASH_SIZE       (1 << BITS_PER_BYTE)
+#define MACVLAN_HASH_BITS       8
+#define MACVLAN_HASH_SIZE       (1<<MACVLAN_HASH_BITS)
 #define MACVLAN_BC_QUEUE_LEN    1000
 
 struct macvlan_port {
@@ -47,6 +48,14 @@ struct macvlan_port {
         struct work_struct      bc_work;
         bool                    passthru;
         int                     count;
+        struct hlist_head       vlan_source_hash[MACVLAN_HASH_SIZE];
+};
+
+struct macvlan_source_entry {
+        struct hlist_node       hlist;
+        struct macvlan_dev      *vlan;
+        unsigned char           addr[6+2] __aligned(sizeof(u16));
+        struct rcu_head         rcu;
 };
 
 struct macvlan_skb_cb {
@@ -57,6 +66,20 @@ struct macvlan_skb_cb {
 
 static void macvlan_port_destroy(struct net_device *dev);
 
+/* Hash Ethernet address */
+static u32 macvlan_eth_hash(const unsigned char *addr)
+{
+        u64 value = get_unaligned((u64 *)addr);
+
+        /* only want 6 bytes */
+#ifdef __BIG_ENDIAN
+        value >>= 16;
+#else
+        value <<= 16;
+#endif
+        return hash_64(value, MACVLAN_HASH_BITS);
+}
+
 static struct macvlan_port *macvlan_port_get_rcu(const struct net_device *dev)
 {
         return rcu_dereference(dev->rx_handler_data);
@@ -73,20 +96,68 @@ static struct macvlan_dev *macvlan_hash_lookup(const struct macvlan_port *port,
                                                const unsigned char *addr)
 {
         struct macvlan_dev *vlan;
+        u32 idx = macvlan_eth_hash(addr);
 
-        hlist_for_each_entry_rcu(vlan, &port->vlan_hash[addr[5]], hlist) {
+        hlist_for_each_entry_rcu(vlan, &port->vlan_hash[idx], hlist) {
                 if (ether_addr_equal_64bits(vlan->dev->dev_addr, addr))
                         return vlan;
         }
         return NULL;
 }
 
+static struct macvlan_source_entry *macvlan_hash_lookup_source(
+        const struct macvlan_dev *vlan,
+        const unsigned char *addr)
+{
+        struct macvlan_source_entry *entry;
+        u32 idx = macvlan_eth_hash(addr);
+        struct hlist_head *h = &vlan->port->vlan_source_hash[idx];
+
+        hlist_for_each_entry_rcu(entry, h, hlist) {
+                if (ether_addr_equal_64bits(entry->addr, addr) &&
+                    entry->vlan == vlan)
+                        return entry;
+        }
+        return NULL;
+}
+
+static int macvlan_hash_add_source(struct macvlan_dev *vlan,
+                                   const unsigned char *addr)
+{
+        struct macvlan_port *port = vlan->port;
+        struct macvlan_source_entry *entry;
+        struct hlist_head *h;
+
+        entry = macvlan_hash_lookup_source(vlan, addr);
+        if (entry)
+                return 0;
+
+        entry = kmalloc(sizeof(*entry), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+
+        ether_addr_copy(entry->addr, addr);
+        entry->vlan = vlan;
+        h = &port->vlan_source_hash[macvlan_eth_hash(addr)];
+        hlist_add_head_rcu(&entry->hlist, h);
+        vlan->macaddr_count++;
+
+        return 0;
+}
+
 static void macvlan_hash_add(struct macvlan_dev *vlan)
 {
         struct macvlan_port *port = vlan->port;
         const unsigned char *addr = vlan->dev->dev_addr;
+        u32 idx = macvlan_eth_hash(addr);
 
-        hlist_add_head_rcu(&vlan->hlist, &port->vlan_hash[addr[5]]);
+        hlist_add_head_rcu(&vlan->hlist, &port->vlan_hash[idx]);
+}
+
+static void macvlan_hash_del_source(struct macvlan_source_entry *entry)
+{
+        hlist_del_rcu(&entry->hlist);
+        kfree_rcu(entry, rcu);
 }
 
 static void macvlan_hash_del(struct macvlan_dev *vlan, bool sync)
@@ -267,6 +338,65 @@ err:
         atomic_long_inc(&skb->dev->rx_dropped);
 }
 
+static void macvlan_flush_sources(struct macvlan_port *port,
+                                  struct macvlan_dev *vlan)
+{
+        int i;
+
+        for (i = 0; i < MACVLAN_HASH_SIZE; i++) {
+                struct hlist_node *h, *n;
+
+                hlist_for_each_safe(h, n, &port->vlan_source_hash[i]) {
+                        struct macvlan_source_entry *entry;
+
+                        entry = hlist_entry(h, struct macvlan_source_entry,
+                                            hlist);
+                        if (entry->vlan == vlan)
+                                macvlan_hash_del_source(entry);
+                }
+        }
+        vlan->macaddr_count = 0;
+}
+
+static void macvlan_forward_source_one(struct sk_buff *skb,
+                                       struct macvlan_dev *vlan)
+{
+        struct sk_buff *nskb;
+        struct net_device *dev;
+        int len;
+        int ret;
+
+        dev = vlan->dev;
+        if (unlikely(!(dev->flags & IFF_UP)))
+                return;
+
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        len = nskb->len + ETH_HLEN;
+        nskb->dev = dev;
+        nskb->pkt_type = PACKET_HOST;
+
+        ret = netif_rx(nskb);
+        macvlan_count_rx(vlan, len, ret == NET_RX_SUCCESS, 0);
+}
+
+static void macvlan_forward_source(struct sk_buff *skb,
+                                   struct macvlan_port *port,
+                                   const unsigned char *addr)
+{
+        struct macvlan_source_entry *entry;
+        u32 idx = macvlan_eth_hash(addr);
+        struct hlist_head *h = &port->vlan_source_hash[idx];
+
+        hlist_for_each_entry_rcu(entry, h, hlist) {
+                if (ether_addr_equal_64bits(entry->addr, addr))
+                        if (entry->vlan->dev->flags & IFF_UP)