1 files changed, 77 insertions, 37 deletions

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c95cd93acf29..96c1955b3e2f 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -70,6 +70,7 @@
  *                                      bonding can change the skb before
  *                                      sending (e.g. insert 8021q tag).
  *              Harald Welte    :       convert to make use of jenkins hash
+ *              Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  */
 
 #include <linux/module.h>
@@ -97,6 +98,7 @@
 #include <linux/net.h>
 #include <linux/rcupdate.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -114,6 +116,7 @@
 #if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
 #include <net/atmclip.h>
 struct neigh_table *clip_tbl_hook;
+EXPORT_SYMBOL(clip_tbl_hook);
 #endif
 
 #include <asm/system.h>
@@ -167,6 +170,7 @@ const struct neigh_ops arp_broken_ops = {
         .hh_output =            dev_queue_xmit,
         .queue_xmit =           dev_queue_xmit,
 };
+EXPORT_SYMBOL(arp_broken_ops);
 
 struct neigh_table arp_tbl = {
         .family =       AF_INET,
@@ -196,6 +200,7 @@ struct neigh_table arp_tbl = {
         .gc_thresh2 =   512,
         .gc_thresh3 =   1024,
 };
+EXPORT_SYMBOL(arp_tbl);
 
 int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
 {
@@ -331,11 +336,14 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         struct net_device *dev = neigh->dev;
         __be32 target = *(__be32*)neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
-        struct in_device *in_dev = in_dev_get(dev);
+        struct in_device *in_dev;
 
-        if (!in_dev)
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dev);
+        if (!in_dev) {
+                rcu_read_unlock();
                 return;
-
+        }
         switch (IN_DEV_ARP_ANNOUNCE(in_dev)) {
         default:
         case 0:         /* By default announce any local IP */
@@ -356,9 +364,8 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         case 2:         /* Avoid secondary IPs, get a primary/preferred one */
                 break;
         }
+        rcu_read_unlock();
 
-        if (in_dev)
-                in_dev_put(in_dev);
         if (!saddr)
                 saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
 
@@ -425,7 +432,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 
         if (ip_route_output_key(net, &rt, &fl) < 0)
                 return 1;
-        if (rt->u.dst.dev != dev) {
+        if (rt->dst.dev != dev) {
                 NET_INC_STATS_BH(net, LINUX_MIB_ARPFILTER);
                 flag = 1;
         }
@@ -495,6 +502,7 @@ int arp_find(unsigned char *haddr, struct sk_buff *skb)
                 kfree_skb(skb);
         return 1;
 }
+EXPORT_SYMBOL(arp_find);
 
 /* END OF OBSOLETE FUNCTIONS */
 
@@ -524,12 +532,15 @@ int arp_bind_neighbour(struct dst_entry *dst)
 /*
  * Check if we can use proxy ARP for this path
  */
-
-static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
+static inline int arp_fwd_proxy(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt)
 {
         struct in_device *out_dev;
         int imi, omi = -1;
 
+        if (rt->dst.dev == dev)
+                return 0;
+
         if (!IN_DEV_PROXY_ARP(in_dev))
                 return 0;
 
@@ -540,14 +551,51 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
 
         /* place to check for proxy_arp for routes */
 
-        if ((out_dev = in_dev_get(rt->u.dst.dev)) != NULL) {
+        out_dev = __in_dev_get_rcu(rt->dst.dev);
+        if (out_dev)
                 omi = IN_DEV_MEDIUM_ID(out_dev);
-                in_dev_put(out_dev);
-        }
+
         return (omi != imi && omi != -1);
 }
 
 /*
+ * Check for RFC3069 proxy arp private VLAN (allow to send back to same dev)
+ *
+ * RFC3069 supports proxy arp replies back to the same interface.  This
+ * is done to support (ethernet) switch features, like RFC 3069, where
+ * the individual ports are not allowed to communicate with each
+ * other, BUT they are allowed to talk to the upstream router.  As
+ * described in RFC 3069, it is possible to allow these hosts to
+ * communicate through the upstream router, by proxy_arp'ing.
+ *
+ * RFC 3069: "VLAN Aggregation for Efficient IP Address Allocation"
+ *
+ *  This technology is known by different names:
+ *    In RFC 3069 it is called VLAN Aggregation.
+ *    Cisco and Allied Telesyn call it Private VLAN.
+ *    Hewlett-Packard call it Source-Port filtering or port-isolation.
+ *    Ericsson call it MAC-Forced Forwarding (RFC Draft).
+ *
+ */
+static inline int arp_fwd_pvlan(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt,
+                                __be32 sip, __be32 tip)
+{
+        /* Private VLAN is only concerned about the same ethernet segment */
+        if (rt->dst.dev != dev)
+                return 0;
+
+        /* Don't reply on self probes (often done by windowz boxes)*/
+        if (sip == tip)
+                return 0;
+
+        if (IN_DEV_PROXY_ARP_PVLAN(in_dev))
+                return 1;
+        else
+                return 0;
+}
+
+/*
  *      Interface to link layer: send routine and receive handler.
  */
 
@@ -619,13 +667,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 arp->ar_hrd = htons(ARPHRD_ETHER);
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 arp->ar_hrd = htons(ARPHRD_IEEE802);
                 arp->ar_pro = htons(ETH_P_IP);
@@ -656,6 +704,7 @@ out:
         kfree_skb(skb);
         return NULL;
 }
+EXPORT_SYMBOL(arp_create);
 
 /*
  *      Send an arp packet.
@@ -665,6 +714,7 @@ void arp_xmit(struct sk_buff *skb)
         /* Send it off, maybe filter it using firewalling first.  */
         NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, skb, NULL, skb->dev, dev_queue_xmit);
 }
+EXPORT_SYMBOL(arp_xmit);
 
 /*
  *      Create and send an arp packet.
@@ -691,6 +741,7 @@ void arp_send(int type, int ptype, __be32 dest_ip,
 
         arp_xmit(skb);
 }
+EXPORT_SYMBOL(arp_send);
 
 /*
  *      Process an arp request.
@@ -699,7 +750,7 @@ void arp_send(int type, int ptype, __be32 dest_ip,
 static int arp_process(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
-        struct in_device *in_dev = in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
         struct arphdr *arp;
         unsigned char *arp_ptr;
         struct rtable *rt;
@@ -812,7 +863,7 @@ static int arp_process(struct sk_buff *skb)
         }
 
         if (arp->ar_op == htons(ARPOP_REQUEST) &&
-            ip_route_input(skb, tip, sip, 0, dev) == 0) {
+            ip_route_input_noref(skb, tip, sip, 0, dev) == 0) {
 
                 rt = skb_rtable(skb);
                 addr_type = rt->rt_type;
@@ -833,8 +884,11 @@ static int arp_process(struct sk_buff *skb)
                         }
                         goto out;
                 } else if (IN_DEV_FORWARD(in_dev)) {
-                            if (addr_type == RTN_UNICAST  && rt->u.dst.dev != dev &&
-                             (arp_fwd_proxy(in_dev, rt) || pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                        if (addr_type == RTN_UNICAST  &&
+                            (arp_fwd_proxy(in_dev, dev, rt) ||
+                             arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
+                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))
+                        {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
@@ -845,7 +899,6 @@ static int arp_process(struct sk_buff *skb)
                                         arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
                                 } else {
                                         pneigh_enqueue(&arp_tbl, in_dev->arp_parms, skb);
-                                        in_dev_put(in_dev);
                                         return 0;
                                 }
                                 goto out;
@@ -863,7 +916,8 @@ static int arp_process(struct sk_buff *skb)
                    devices (strip is candidate)
                  */
                 if (n == NULL &&
-                    arp->ar_op == htons(ARPOP_REPLY) &&
+                    (arp->ar_op == htons(ARPOP_REPLY) ||
+                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
                     inet_addr_type(net, sip) == RTN_UNICAST)
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
@@ -890,8 +944,6 @@ static int arp_process(struct sk_buff *skb)
         }
 
 out:
-        if (in_dev)
-                in_dev_put(in_dev);
         consume_skb(skb);
         return 0;
 }
@@ -999,13 +1051,13 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                 struct rtable * rt;
                 if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
                         return err;
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
                 if (!dev)
                         return -EINVAL;
         }
         switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 /*
                  * According to RFC 1390, FDDI devices should accept ARP
@@ -1106,7 +1158,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r,
                 struct rtable * rt;
                 if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
                         return err;
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
                 if (!dev)
                         return -EINVAL;
@@ -1239,8 +1291,7 @@ void __init arp_init(void)
         dev_add_pack(&arp_packet_type);
         arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, NET_IPV4,
-                              NET_IPV4_NEIGH, "ipv4", NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
 #endif
         register_netdevice_notifier(&arp_netdev_notifier);
 }
@@ -1408,14 +1459,3 @@ static int __init arp_proc_init(void)
 }
 
 #endif /* CONFIG_PROC_FS */
-
-EXPORT_SYMBOL(arp_broken_ops);
-EXPORT_SYMBOL(arp_find);
-EXPORT_SYMBOL(arp_create);
-EXPORT_SYMBOL(arp_xmit);
-EXPORT_SYMBOL(arp_send);
-EXPORT_SYMBOL(arp_tbl);
-
-#if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
-EXPORT_SYMBOL(clip_tbl_hook);
-#endif