2 * Copyright (c) 1998 Luigi Rizzo
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
14 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
16 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
17 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
18 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
19 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
20 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
21 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
22 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * This code implements bridging in FreeBSD. It only acts on ethernet
29 * type of interfaces (others are still usable for routing).
30 * A bridging table holds the source MAC address/dest. interface for each
31 * known node. The table is indexed using an hash of the source address.
33 * Input packets are tapped near the end of the input routine in each
34 * driver (near the call to bpf_mtap, or before the call to ether_input)
35 * and analysed calling bridge_in(). Depending on the result, the packet
36 * can be forwarded to one or more output interfaces using bdg_forward(),
37 * and/or sent to the upper layer (e.g. in case of multicast).
39 * Output packets are intercepted near the end of ether_output(),
40 * the correct destination is selected calling bdg_dst_lookup(),
41 * and then forwarding is done using bdg_forward().
42 * Bridging is controlled by the sysctl variable net.link.ether.bridge
44 * The arp code is also modified to let a machine answer to requests
45 * irrespective of the port the request came from.
47 * In case of loops in the bridging topology, the bridge detects this
48 * event and temporarily mutes output bridging on one of the ports.
49 * Periodically, interfaces are unmuted by bdg_timeout(). (For the
50 * mute flag i am temporarily using IFF_LINK2 but this has to
51 * change.) Muting is only implemented as a safety measure, and also as
52 * a mechanism to support a user-space implementation of the spanning
53 * tree algorithm. In the final release, unmuting will only occur
54 * because of explicit action of the user-level daemon.
56 * To build a bridging kernel, use the following option
58 * and then at runtime set the sysctl variable to enable bridging.
60 * Only one interface is supposed to have addresses set (but
61 * there are no problems in practice if you set addresses for more
62 * than one interface).
63 * Bridging will act before routing, but nothing prevents a machine
64 * from doing both (modulo bugs in the implementation...).
67 * - bridging requires some (small) modifications to the interface
68 * driver. Currently (980911) the "ed", "de", "tx", "lnc" drivers
69 * have been modified and tested. "fxp", "ep" have been modified
70 * but not tested. See the "ed" and "de" drivers as examples on
72 * - bridging is incompatible with multicast routing on the same
73 * machine. There is not an easy fix to this.
74 * - loop detection is still not very robust.
75 * - the interface of bdg_forward() could be improved.
78 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/socket.h> /* for net/if.h */
82 #include <sys/kernel.h>
83 #include <sys/sysctl.h>
86 #include <net/if_types.h>
88 #include <netinet/in.h> /* for struct arpcom */
89 #include <netinet/if_ether.h> /* for struct arpcom */
93 #if defined(IPFIREWALL) && defined(DUMMYNET)
94 #include <net/route.h>
95 #include <netinet/ip_dummynet.h>
98 #include <net/bridge.h>
101 * For debugging, you can use the following macros.
102 * remember, rdtsc() only works on Pentium-class machines
105 DDB(ticks = rdtsc();)
106 ... interesting code ...
107 DDB(bdg_fw_ticks += (u_long)(rdtsc() - ticks) ; bdg_fw_count++ ;)
116 * System initialization
119 static void bdginit(void *);
120 static void flush_table(void);
122 SYSINIT(interfaces, SI_SUB_PROTO_IF, SI_ORDER_FIRST, bdginit, NULL)
124 static int bdg_ipfw = 0 ;
126 bdg_hash_table *bdg_table = NULL ;
129 * we need additional info for the bridge. The bdg_ifp2sc[] array
130 * provides a pointer to this struct using the if_index.
131 * bdg_softc has a backpointer to the struct ifnet, the bridge
132 * flags, and a group (bridging occurs only between port of the
137 /* ((struct arpcom *)ifp)->ac_enaddr is the eth. addr */
142 static struct bdg_softc **ifp2sc = NULL ;
144 #if 0 /* new code using ifp2sc */
145 #define SAMEGROUP(ifp,src) (src == NULL || \
146 ifp2sc[ifp->if_index]->group == ifp2sc[src->if_index]->group )
147 #define MUTED(ifp) (ifp2sc[ifp->if_index]->flags & IFF_MUTE)
148 #define MUTE(ifp) ifp2sc[ifp->if_index]->flags |= IFF_MUTE
149 #define UNMUTE(ifp) ifp2sc[ifp->if_index]->flags &= ~IFF_MUTE
151 #define SAMEGROUP(a,b) 1
152 #define MUTED(ifp) (ifp->if_flags & IFF_MUTE)
153 #define MUTE(ifp) ifp->if_flags |= IFF_MUTE
154 #define UNMUTE(ifp) ifp->if_flags &= ~IFF_MUTE
158 sysctl_bdg SYSCTL_HANDLER_ARGS
160 int error, oldval = do_bridge ;
162 error = sysctl_handle_int(oidp,
163 oidp->oid_arg1, oidp->oid_arg2, req);
164 printf("called sysctl for bridge name %s arg2 %d val %d->%d\n",
165 oidp->oid_name, oidp->oid_arg2,
167 if (bdg_table == NULL)
169 if (oldval != do_bridge) {
175 SYSCTL_PROC(_net_link_ether, OID_AUTO, bridge, CTLTYPE_INT|CTLFLAG_RW,
176 &do_bridge, 0, &sysctl_bdg, "I", "Bridging");
178 SYSCTL_INT(_net_link_ether, OID_AUTO, bridge_ipfw, CTLFLAG_RW, &bdg_ipfw,0,"");
179 #if 1 /* diagnostic vars */
180 int bdg_in_count = 0 , bdg_in_ticks = 0 , bdg_fw_count = 0, bdg_fw_ticks = 0 ;
181 SYSCTL_INT(_net_link_ether, OID_AUTO, bdginc, CTLFLAG_RW, &bdg_in_count,0,"");
182 SYSCTL_INT(_net_link_ether, OID_AUTO, bdgint, CTLFLAG_RW, &bdg_in_ticks,0,"");
183 SYSCTL_INT(_net_link_ether, OID_AUTO, bdgfwc, CTLFLAG_RW, &bdg_fw_count,0,"");
184 SYSCTL_INT(_net_link_ether, OID_AUTO, bdgfwt, CTLFLAG_RW, &bdg_fw_ticks,0,"");
186 static struct bdg_stats bdg_stats ;
187 SYSCTL_STRUCT(_net_link_ether, PF_BDG, bdgstats,
188 CTLFLAG_RD, &bdg_stats , bdg_stats, "bridge statistics");
190 static int bdg_loops ;
193 * completely flush the bridge table.
200 if (bdg_table == NULL)
203 for (i=0; i< HASH_SIZE; i++)
204 bdg_table[i].name= NULL; /* clear table */
209 * called periodically to flush entries etc.
212 bdg_timeout(void *dummy)
216 static int slowtimer = 0 ;
219 static int age_index = 0 ; /* index of table position to age */
220 int l = age_index + HASH_SIZE/4 ;
222 * age entries in the forwarding table.
226 for (; age_index < l ; age_index++)
227 if (bdg_table[age_index].used)
228 bdg_table[age_index].used = 0 ;
229 else if (bdg_table[age_index].name) {
230 /* printf("xx flushing stale entry %d\n", age_index); */
231 bdg_table[age_index].name = NULL ;
233 if (age_index >= HASH_SIZE)
236 if (--slowtimer <= 0 ) {
239 for (ifp = ifnet; ifp; ifp = ifp->if_next) {
240 if (ifp->if_type != IFT_ETHER)
242 if ( 0 == ( ifp->if_flags & IFF_UP) ) {
248 if ( 0 == ( ifp->if_flags & IFF_PROMISC) ) {
251 ret = ifpromisc(ifp, 1);
253 printf(">> now %s%d flags 0x%x promisc %d\n",
254 ifp->if_name, ifp->if_unit,
258 printf(">> unmuting %s%d\n", ifp->if_name, ifp->if_unit);
265 timeout(bdg_timeout, (void *)0, 2*hz );
269 * local MAC addresses are held in a small array. This makes comparisons
272 unsigned char bdg_addresses[6*BDG_MAX_PORTS];
276 * initialization of bridge code.
287 * initialization of bridge code
289 if (bdg_table == NULL)
290 bdg_table = (struct hash_table *)
291 malloc(HASH_SIZE * sizeof(struct hash_table),
295 ifp2sc = malloc(if_index * sizeof(struct bdg_softc *), M_IFADDR, M_WAITOK );
296 bzero(ifp2sc, if_index * sizeof(struct bdg_softc *) );
298 bzero(&bdg_stats, sizeof(bdg_stats) );
300 eth_addr = bdg_addresses ;
302 printf("BRIDGE 980911, have %d interfaces\n", if_index);
303 for (i = 0 , ifp = ifnet ; i < if_index ; i++, ifp = ifp->if_next)
304 if (ifp->if_type == IFT_ETHER) { /* ethernet ? */
305 ac = (struct arpcom *)ifp;
306 sprintf(bdg_stats.s[ifp->if_index].name,
307 "%s%d", ifp->if_name, ifp->if_unit);
308 printf("-- index %d %s type %d phy %d addrl %d addr %6D\n",
310 bdg_stats.s[ifp->if_index].name,
311 (int)ifp->if_type, (int) ifp->if_physical,
312 (int)ifp->if_addrlen,
313 ac->ac_enaddr, "." );
314 bcopy(ac->ac_enaddr, eth_addr, 6);
317 ifp2sc[bdg_ports] = malloc(sizeof(struct bdg_softc),
318 M_IFADDR, M_WAITOK );
319 ifp2sc[bdg_ports]->ifp = ifp ;
320 ifp2sc[bdg_ports]->flags = 0 ;
321 ifp2sc[bdg_ports]->group = 0 ;
329 * bridge_in() is invoked to perform bridging decision on input packets.
331 * m packet to be bridged. The mbuf need not to hold the
332 * whole packet, only the first 14 bytes suffice. We
333 * assume them to be contiguous. No alignment assumptions
334 * because they are not a problem on i386 class machines.
336 * On Return: destination of packet, one of
337 * BDG_BCAST broadcast
338 * BDG_MCAST multicast
339 * BDG_LOCAL is only for a local address (do not forward)
340 * BDG_DROP drop the packet
341 * ifp ifp of the destination interface.
343 * Forwarding is not done directly to give a chance to some drivers
344 * to fetch more of the packet, or simply drop it completely.
349 bridge_in(struct mbuf *m)
352 struct ifnet *ifp = m->m_pkthdr.rcvif, *dst , *old ;
353 int dropit = MUTED(ifp) ;
354 struct ether_header *eh;
356 eh = mtod(m, struct ether_header *);
359 * hash the source address
361 index= HASH_FN(eh->ether_shost);
362 bdg_table[index].used = 1 ;
363 old = bdg_table[index].name ;
364 if ( old ) { /* the entry is valid. */
365 if (!BDG_MATCH( eh->ether_shost, bdg_table[index].etheraddr) ) {
366 printf("collision at %d\n", index);
367 bdg_table[index].name = NULL ;
368 } else if (old != ifp) {
370 * found a loop. Either a machine has moved, or there
371 * is a misconfiguration/reconfiguration of the network.
372 * First, do not forward this packet!
373 * Record the relocation anyways; then, if loops persist,
374 * suspect a reconfiguration and disable forwarding
375 * from the old interface.
377 bdg_table[index].name = ifp ; /* relocate address */
378 printf("-- loop (%d) %6D to %s%d from %s%d (%s)\n",
379 bdg_loops, eh->ether_shost, ".",
380 ifp->if_name, ifp->if_unit,
381 old->if_name, old->if_unit,
382 old->if_flags & IFF_MUTE ? "muted":"ignore");
385 if (++bdg_loops > 10)
392 * now write the source address into the table
394 if (bdg_table[index].name == NULL) {
395 DEB(printf("new addr %6D at %d for %s%d\n",
396 eh->ether_shost, ".", index, ifp->if_name, ifp->if_unit);)
397 bcopy(eh->ether_shost, bdg_table[index].etheraddr, 6);
398 bdg_table[index].name = ifp ;
400 dst = bridge_dst_lookup(m);
402 * BDG_BCAST, BDG_MCAST, BDG_LOCAL, BDG_UNKNOWN, BDG_DROP, ifp.
403 * For muted interfaces, the first 3 are changed in BDG_LOCAL,
404 * and others to BDG_DROP. Also, for incoming packets, ifp is changed
405 * to BDG_DROP in case ifp == src . These mods are not necessary
406 * for outgoing packets from ether_output().
408 BDG_STAT(ifp, BDG_IN);
413 case (int)BDG_UNKNOWN:
418 if (dst == ifp || dropit )
419 BDG_STAT(ifp, BDG_DROP);
421 BDG_STAT(ifp, BDG_FORWARD);
426 if (dst == BDG_BCAST || dst == BDG_MCAST || dst == BDG_LOCAL)
431 return (dst == ifp ? BDG_DROP : dst ) ;
436 * Forward to dst, excluding src port and (if not a single interface)
437 * muted interfaces. The packet is freed if marked as such
438 * and not for a local destination.
439 * A cleaner implementation would be to make bdg_forward()
440 * always consume the packet, leaving to the caller the task
441 * to make a copy if it needs it. As it is now, bdg_forward()
442 * can keep a copy alive in some cases.
445 bdg_forward (struct mbuf **m0, struct ifnet *dst)
447 struct ifnet *src = (*m0)->m_pkthdr.rcvif; /* could be NULL in output */
450 int once = 0; /* execute the loop only once */
451 int canfree = 1 ; /* can free the buf at the end */
454 struct ether_header *eh = mtod(*m0, struct ether_header *); /* XXX */
456 if (dst == BDG_DROP) { /* this should not happen */
457 printf("xx bdg_forward for BDG_DROP)\n");
462 if (dst == BDG_LOCAL) { /* this should not happen as well */
463 printf("xx ouch, bdg_forward for local pkt\n");
466 if (dst == BDG_BCAST || dst == BDG_MCAST || dst == BDG_UNKNOWN) {
469 if (dst != BDG_UNKNOWN)
473 once = 1 ; /* and also canfree */
477 * do filtering in a very similar way to what is done
478 * in ip_output. Only for IP packets, and only pass/fail/dummynet
479 * is supported. The tricky thing is to make sure that enough of
480 * the packet (basically, Eth+IP+TCP/UDP headers) is contiguous
481 * so that calls to m_pullup in ip_fw_chk will not kill the
486 struct ip_fw_chain *rule;
490 if (m->m_type == MT_DUMMYNET) {
492 * the packet was already tagged, so part of the
493 * processing was already done, and we need to go down.
495 rule = (struct ip_fw_chain *)(m->m_data) ;
500 src = m->m_pkthdr.rcvif; /* could be NULL in output */
501 eh = mtod(m, struct ether_header *); /* XXX */
502 canfree = 1 ; /* for sure, a copy is not needed later. */
503 goto forward; /* HACK! */
509 goto forward ; /* do not apply to packets from ether_output */
510 if (canfree == 0 ) /* need to make a copy */
511 m = m_copypacket(*m0, M_DONTWAIT);
518 off=(*ip_fw_chk_ptr)(NULL, 0, src, &dummy, &m, &rule) ;
519 if (m == NULL) { /* pkt discarded by firewall */
520 printf("-- bdg: firewall discarded pkt\n");
533 * pass the pkt to dummynet. Need to include m, dst, rule.
534 * Dummynet consumes the packet in all cases.
536 dummynet_io((off & 0xffff), DN_TO_BDG_FWD, m, dst, NULL, 0, rule);
537 if (canfree) /* dummynet has consumed the original one */
542 /* if none of the above matches, we have to drop the pkt */
543 printf("-- bdg: fw: drop\n");
546 if (canfree && m != *m0) {
553 #endif /* COMPAT_IPFW */
559 for ( ; ifp ; ifp = ifp->if_next ) {
560 if (ifp != src && ifp->if_type == IFT_ETHER &&
561 (ifp->if_flags & (IFF_UP|IFF_RUNNING)) == (IFF_UP|IFF_RUNNING) &&
562 SAMEGROUP(ifp, src) && !MUTED(ifp) ) {
563 if (m == NULL) { /* do i need to make a copy ? */
564 if (canfree && ifp->if_next == NULL) /* last one! */
566 else /* on a P5-90, m_packetcopy takes 540 ticks */
567 m = m_copypacket(*m0, M_DONTWAIT);
569 printf("bdg_forward: sorry, m_copy failed!\n");
574 * execute last part of ether_output.
578 * Queue message on interface, and start output if interface
581 if (IF_QFULL(&ifp->if_snd)) {
582 IF_DROP(&ifp->if_snd);
583 MUTE(ifp); /* good measure... */
587 ifp->if_obytes += m->m_pkthdr.len ;
588 if (m->m_flags & M_MCAST)
590 IF_ENQUEUE(&ifp->if_snd, m);
591 if ((ifp->if_flags & IFF_OACTIVE) == 0)
592 (*ifp->if_start)(ifp);
595 *m0 = NULL ; /* the packet is gone... */
598 BDG_STAT(ifp, BDG_OUT);
604 /* cleanup any mbuf leftover. */
609 if (canfree && *m0) {