sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*
   4  * Copyright 2001 Wasabi Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed for the NetBSD Project by
  20  *      Wasabi Systems, Inc.
  21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  22  *    or promote products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 /*
  39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  40  * All rights reserved.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  * 3. All advertising materials mentioning features or use of this software
  51  *    must display the following acknowledgement:
  52  *      This product includes software developed by Jason L. Wright
  53  * 4. The name of the author may not be used to endorse or promote products
  54  *    derived from this software without specific prior written permission.
  55  *
  56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  66  * POSSIBILITY OF SUCH DAMAGE.
  67  *
  68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  69  */
  70
  71 /*
  72  * Network interface bridge support.
  73  *
  74  * TODO:
  75  *
  76  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  77  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  78  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  79  *        consider heterogenous bridges).
  80  */
  81
  82 #include <sys/cdefs.h>
  83 __FBSDID("$FreeBSD$");
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87 #include "opt_carp.h"
  88
  89 #include <sys/param.h>
  90 #include <sys/mbuf.h>
  91 #include <sys/malloc.h>
  92 #include <sys/protosw.h>
  93 #include <sys/systm.h>
  94 #include <sys/time.h>
  95 #include <sys/socket.h> /* for net/if.h */
  96 #include <sys/sockio.h>
  97 #include <sys/ctype.h>  /* string functions */
  98 #include <sys/kernel.h>
  99 #include <sys/random.h>
 100 #include <sys/syslog.h>
 101 #include <sys/sysctl.h>
 102 #include <vm/uma.h>
 103 #include <sys/module.h>
 104 #include <sys/proc.h>
 105 #include <sys/lock.h>
 106 #include <sys/mutex.h>
 107
 108 #include <net/bpf.h>
 109 #include <net/if.h>
 110 #include <net/if_clone.h>
 111 #include <net/if_dl.h>
 112 #include <net/if_types.h>
 113 #include <net/if_var.h>
 114 #include <net/pfil.h>
 115
 116 #include <netinet/in.h> /* for struct arpcom */
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #endif
 125 #ifdef DEV_CARP
 126 #include <netinet/ip_carp.h>
 127 #endif
 128 #include <machine/in_cksum.h>
 129 #include <netinet/if_ether.h> /* for struct arpcom */
 130 #include <net/bridgestp.h>
 131 #include <net/if_bridgevar.h>
 132 #include <net/if_llc.h>
 133
 134 #include <net/route.h>
 135 #include <netinet/ip_fw.h>
 136 #include <netinet/ip_dummynet.h>
 137
 138 /*
 139  * Size of the route hash table.  Must be a power of two.
 140  */
 141 #ifndef BRIDGE_RTHASH_SIZE
 142 #define BRIDGE_RTHASH_SIZE              1024
 143 #endif
 144
 145 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 146
 147 /*
 148  * Maximum number of addresses to cache.
 149  */
 150 #ifndef BRIDGE_RTABLE_MAX
 151 #define BRIDGE_RTABLE_MAX               100
 152 #endif
 153
 154 /*
 155  * Timeout (in seconds) for entries learned dynamically.
 156  */
 157 #ifndef BRIDGE_RTABLE_TIMEOUT
 158 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 159 #endif
 160
 161 /*
 162  * Number of seconds between walks of the route list.
 163  */
 164 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 165 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 166 #endif
 167
 168 /*
 169  * List of capabilities to mask on the member interface.
 170  */
 171 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 172
 173 /*
 174  * Bridge interface list entry.
 175  */
 176 struct bridge_iflist {
 177         LIST_ENTRY(bridge_iflist) bif_next;
 178         struct ifnet            *bif_ifp;       /* member if */
 179         struct bstp_port        bif_stp;        /* STP state */
 180         uint32_t                bif_flags;      /* member if flags */
 181         int                     bif_mutecap;    /* member muted caps */
 182 };
 183
 184 /*
 185  * Bridge route node.
 186  */
 187 struct bridge_rtnode {
 188         LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
 189         LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
 190         struct ifnet            *brt_ifp;       /* destination if */
 191         unsigned long           brt_expire;     /* expiration time */
 192         uint8_t                 brt_flags;      /* address flags */
 193         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 194 };
 195
 196 /*
 197  * Software state for each bridge.
 198  */
 199 struct bridge_softc {
 200         struct ifnet            *sc_ifp;        /* make this an interface */
 201         LIST_ENTRY(bridge_softc) sc_list;
 202         struct mtx              sc_mtx;
 203         struct cv               sc_cv;
 204         uint32_t                sc_brtmax;      /* max # of addresses */
 205         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 206         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 207         struct callout          sc_brcallout;   /* bridge callout */
 208         uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
 209         uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
 210         LIST_HEAD(, bridge_iflist) sc_iflist;   /* member interface list */
 211         LIST_HEAD(, bridge_rtnode) *sc_rthash;  /* our forwarding table */
 212         LIST_HEAD(, bridge_rtnode) sc_rtlist;   /* list version of above */
 213         uint32_t                sc_rthash_key;  /* key for hash */
 214         LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */
 215         struct bstp_state       sc_stp;         /* STP state */
 216         uint32_t                sc_brtexceeded; /* # of cache drops */
 217 };
 218
 219 static struct mtx       bridge_list_mtx;
 220 eventhandler_tag        bridge_detach_cookie = NULL;
 221
 222 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 223
 224 uma_zone_t bridge_rtnode_zone;
 225
 226 static int      bridge_clone_create(struct if_clone *, int);
 227 static void     bridge_clone_destroy(struct ifnet *);
 228
 229 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 230 static void     bridge_mutecaps(struct bridge_iflist *, int);
 231 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 232 static void     bridge_init(void *);
 233 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 234 static void     bridge_stop(struct ifnet *, int);
 235 static void     bridge_start(struct ifnet *);
 236 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 237 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 238                     struct rtentry *);
 239 static void     bridge_enqueue(struct bridge_softc *, struct ifnet *,
 240                     struct mbuf *);
 241 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 242
 243 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
 244                     struct mbuf *m);
 245
 246 static void     bridge_timer(void *);
 247
 248 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 249                     struct mbuf *, int);
 250 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 251
 252 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 253                     struct bridge_iflist *, int, uint8_t);
 254 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 255 static void     bridge_rttrim(struct bridge_softc *);
 256 static void     bridge_rtage(struct bridge_softc *);
 257 static void     bridge_rtflush(struct bridge_softc *, int);
 258 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 259
 260 static int      bridge_rtable_init(struct bridge_softc *);
 261 static void     bridge_rtable_fini(struct bridge_softc *);
 262
 263 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 264 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 265                     const uint8_t *);
 266 static int      bridge_rtnode_insert(struct bridge_softc *,
 267                     struct bridge_rtnode *);
 268 static void     bridge_rtnode_destroy(struct bridge_softc *,
 269                     struct bridge_rtnode *);
 270 static void     bridge_rtable_expire(struct ifnet *, int);
 271 static void     bridge_state_change(struct ifnet *, int);
 272
 273 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 274                     const char *name);
 275 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 276                     struct ifnet *ifp);
 277 static void     bridge_delete_member(struct bridge_softc *,
 278                     struct bridge_iflist *, int);
 279 static void     bridge_delete_span(struct bridge_softc *,
 280                     struct bridge_iflist *);
 281
 282 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 283 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 284 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 285 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 286 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 287 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 288 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 289 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 290 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 291 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 292 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 293 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 294 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 295 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 296 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 297 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 298 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 299 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 300 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 301 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 302 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 303 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 304 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 305 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 306 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 307 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 308 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 309 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 310 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
 311 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
 312 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 313                     int);
 314 static int      bridge_ip_checkbasic(struct mbuf **mp);
 315 #ifdef INET6
 316 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 317 #endif /* INET6 */
 318 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 319                     struct ether_header *, int, struct llc *);
 320
 321 static struct bstp_cb_ops bridge_ops = {
 322         .bcb_state = bridge_state_change,
 323         .bcb_rtage = bridge_rtable_expire
 324 };
 325
 326 SYSCTL_DECL(_net_link);
 327 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 328
 329 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 330 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 331 static int pfil_member = 1; /* run pfil hooks on the member interface */
 332 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
 333 static int pfil_ipfw_arp = 0;   /* layer2 filter with ipfw */
 334 static int pfil_local_phys = 0; /* run pfil hooks on the physical interface for
 335                                    locally destined packets */
 336 static int log_stp   = 0;   /* log STP state changes */
 337 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 338     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 339 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp, CTLFLAG_RW,
 340     &pfil_ipfw_arp, 0, "Filter ARP packets through IPFW layer2");
 341 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 342     &pfil_bridge, 0, "Packet filter on the bridge interface");
 343 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 344     &pfil_member, 0, "Packet filter on the member interface");
 345 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys, CTLFLAG_RW,
 346     &pfil_local_phys, 0,
 347     "Packet filter on the physical interface for locally destined packets");
 348 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
 349     &log_stp, 0, "Log STP state changes");
 350
 351 struct bridge_control {
 352         int     (*bc_func)(struct bridge_softc *, void *);
 353         int     bc_argsize;
 354         int     bc_flags;
 355 };
 356
 357 #define BC_F_COPYIN             0x01    /* copy arguments in */
 358 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 359 #define BC_F_SUSER              0x04    /* do super-user check */
 360
 361 const struct bridge_control bridge_control_table[] = {
 362         { bridge_ioctl_add,             sizeof(struct ifbreq),
 363           BC_F_COPYIN|BC_F_SUSER },
 364         { bridge_ioctl_del,             sizeof(struct ifbreq),
 365           BC_F_COPYIN|BC_F_SUSER },
 366
 367         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 368           BC_F_COPYIN|BC_F_COPYOUT },
 369         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 370           BC_F_COPYIN|BC_F_SUSER },
 371
 372         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 373           BC_F_COPYIN|BC_F_SUSER },
 374         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 375           BC_F_COPYOUT },
 376
 377         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 378           BC_F_COPYIN|BC_F_COPYOUT },
 379         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 380           BC_F_COPYIN|BC_F_COPYOUT },
 381
 382         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 383           BC_F_COPYIN|BC_F_SUSER },
 384
 385         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 386           BC_F_COPYIN|BC_F_SUSER },
 387         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 388           BC_F_COPYOUT },
 389
 390         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 391           BC_F_COPYIN|BC_F_SUSER },
 392
 393         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 394           BC_F_COPYIN|BC_F_SUSER },
 395
 396         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 397           BC_F_COPYOUT },
 398         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 399           BC_F_COPYIN|BC_F_SUSER },
 400
 401         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 402           BC_F_COPYOUT },
 403         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 404           BC_F_COPYIN|BC_F_SUSER },
 405
 406         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 407           BC_F_COPYOUT },
 408         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 409           BC_F_COPYIN|BC_F_SUSER },
 410
 411         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 412           BC_F_COPYOUT },
 413         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 414           BC_F_COPYIN|BC_F_SUSER },
 415
 416         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 417           BC_F_COPYIN|BC_F_SUSER },
 418
 419         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 420           BC_F_COPYIN|BC_F_SUSER },
 421
 422         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 423           BC_F_COPYIN|BC_F_SUSER },
 424         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 425           BC_F_COPYIN|BC_F_SUSER },
 426
 427         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 428           BC_F_COPYOUT },
 429
 430         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 431           BC_F_COPYOUT },
 432
 433         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 434           BC_F_COPYIN|BC_F_COPYOUT },
 435
 436         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
 437           BC_F_COPYIN|BC_F_SUSER },
 438
 439         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
 440           BC_F_COPYIN|BC_F_SUSER },
 441 };
 442 const int bridge_control_table_size =
 443     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 444
 445 static const u_char etherbroadcastaddr[ETHER_ADDR_LEN] =
 446                         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 447
 448 LIST_HEAD(, bridge_softc) bridge_list;
 449
 450 IFC_SIMPLE_DECLARE(bridge, 0);
 451
 452 static int
 453 bridge_modevent(module_t mod, int type, void *data)
 454 {
 455
 456         switch (type) {
 457         case MOD_LOAD:
 458                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
 459                 if_clone_attach(&bridge_cloner);
 460                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 461                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 462                     UMA_ALIGN_PTR, 0);
 463                 LIST_INIT(&bridge_list);
 464                 bridge_input_p = bridge_input;
 465                 bridge_output_p = bridge_output;
 466                 bridge_dn_p = bridge_dummynet;
 467                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 468                     ifnet_departure_event, bridge_ifdetach, NULL,
 469                     EVENTHANDLER_PRI_ANY);
 470                 break;
 471         case MOD_UNLOAD:
 472                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 473                     bridge_detach_cookie);
 474                 if_clone_detach(&bridge_cloner);
 475                 while (!LIST_EMPTY(&bridge_list))
 476                         bridge_clone_destroy(LIST_FIRST(&bridge_list)->sc_ifp);
 477                 uma_zdestroy(bridge_rtnode_zone);
 478                 bridge_input_p = NULL;
 479                 bridge_output_p = NULL;
 480                 bridge_dn_p = NULL;
 481                 mtx_destroy(&bridge_list_mtx);
 482                 break;
 483         default:
 484                 return (EOPNOTSUPP);
 485         }
 486         return (0);
 487 }
 488
 489 static moduledata_t bridge_mod = {
 490         "if_bridge",
 491         bridge_modevent,
 492         0
 493 };
 494
 495 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 496 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 497
 498 /*
 499  * handler for net.link.bridge.pfil_ipfw
 500  */
 501 static int
 502 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 503 {
 504         int enable = pfil_ipfw;
 505         int error;
 506
 507         error = sysctl_handle_int(oidp, &enable, 0, req);
 508         enable = (enable) ? 1 : 0;
 509
 510         if (enable != pfil_ipfw) {
 511                 pfil_ipfw = enable;
 512
 513                 /*
 514                  * Disable pfil so that ipfw doesnt run twice, if the user
 515                  * really wants both then they can re-enable pfil_bridge and/or
 516                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 517                  * layer2 type.
 518                  */
 519                 if (pfil_ipfw) {
 520                         pfil_onlyip = 0;
 521                         pfil_bridge = 0;
 522                         pfil_member = 0;
 523                 }
 524         }
 525
 526         return (error);
 527 }
 528 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
 529             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
 530
 531 /*
 532  * bridge_clone_create:
 533  *
 534  *      Create a new bridge instance.
 535  */
 536 static int
 537 bridge_clone_create(struct if_clone *ifc, int unit)
 538 {
 539         struct bridge_softc *sc, *sc2;
 540         struct ifnet *bifp, *ifp;
 541         u_char eaddr[6];
 542         int retry;
 543
 544         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 545         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 546         if (ifp == NULL) {
 547                 free(sc, M_DEVBUF);
 548                 return (ENOSPC);
 549         }
 550
 551         BRIDGE_LOCK_INIT(sc);
 552         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 553         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 554
 555         /* Initialize our routing table. */
 556         bridge_rtable_init(sc);
 557
 558         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
 559
 560         LIST_INIT(&sc->sc_iflist);
 561         LIST_INIT(&sc->sc_spanlist);
 562
 563         ifp->if_softc = sc;
 564         if_initname(ifp, ifc->ifc_name, unit);
 565         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 566         ifp->if_ioctl = bridge_ioctl;
 567         ifp->if_start = bridge_start;
 568         ifp->if_init = bridge_init;
 569         ifp->if_type = IFT_BRIDGE;
 570         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 571         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 572         IFQ_SET_READY(&ifp->if_snd);
 573
 574         /*
 575          * Generate a random ethernet address with a locally administered
 576          * address.
 577          *
 578          * Since we are using random ethernet addresses for the bridge, it is
 579          * possible that we might have address collisions, so make sure that
 580          * this hardware address isn't already in use on another bridge.
 581          */
 582         for (retry = 1; retry != 0;) {
 583                 arc4rand(eaddr, ETHER_ADDR_LEN, 1);
 584                 eaddr[0] &= ~1;         /* clear multicast bit */
 585                 eaddr[0] |= 2;          /* set the LAA bit */
 586                 retry = 0;
 587                 mtx_lock(&bridge_list_mtx);
 588                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
 589                         bifp = sc2->sc_ifp;
 590                         if (memcmp(eaddr, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
 591                                 retry = 1;
 592                 }
 593                 mtx_unlock(&bridge_list_mtx);
 594         }
 595
 596         bstp_attach(&sc->sc_stp, &bridge_ops);
 597         ether_ifattach(ifp, eaddr);
 598         /* Now undo some of the damage... */
 599         ifp->if_baudrate = 0;
 600         ifp->if_type = IFT_BRIDGE;
 601
 602         mtx_lock(&bridge_list_mtx);
 603         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 604         mtx_unlock(&bridge_list_mtx);
 605
 606         return (0);
 607 }
 608
 609 /*
 610  * bridge_clone_destroy:
 611  *
 612  *      Destroy a bridge instance.
 613  */
 614 static void
 615 bridge_clone_destroy(struct ifnet *ifp)
 616 {
 617         struct bridge_softc *sc = ifp->if_softc;
 618         struct bridge_iflist *bif;
 619
 620         BRIDGE_LOCK(sc);
 621
 622         bridge_stop(ifp, 1);
 623         ifp->if_flags &= ~IFF_UP;
 624
 625         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 626                 bridge_delete_member(sc, bif, 0);
 627
 628         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 629                 bridge_delete_span(sc, bif);
 630         }
 631
 632         BRIDGE_UNLOCK(sc);
 633
 634         callout_drain(&sc->sc_brcallout);
 635
 636         mtx_lock(&bridge_list_mtx);
 637         LIST_REMOVE(sc, sc_list);
 638         mtx_unlock(&bridge_list_mtx);
 639
 640         bstp_detach(&sc->sc_stp);
 641         ether_ifdetach(ifp);
 642         if_free_type(ifp, IFT_ETHER);
 643
 644         /* Tear down the routing table. */
 645         bridge_rtable_fini(sc);
 646
 647         BRIDGE_LOCK_DESTROY(sc);
 648         free(sc, M_DEVBUF);
 649 }
 650
 651 /*
 652  * bridge_ioctl:
 653  *
 654  *      Handle a control request from the operator.
 655  */
 656 static int
 657 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 658 {
 659         struct bridge_softc *sc = ifp->if_softc;
 660         struct thread *td = curthread;
 661         union {
 662                 struct ifbreq ifbreq;
 663                 struct ifbifconf ifbifconf;
 664                 struct ifbareq ifbareq;
 665                 struct ifbaconf ifbaconf;
 666                 struct ifbrparam ifbrparam;
 667                 struct ifbropreq ifbropreq;
 668         } args;
 669         struct ifdrv *ifd = (struct ifdrv *) data;
 670         const struct bridge_control *bc;
 671         int error = 0;
 672
 673         switch (cmd) {
 674
 675         case SIOCADDMULTI:
 676         case SIOCDELMULTI:
 677                 break;
 678
 679         case SIOCGDRVSPEC:
 680         case SIOCSDRVSPEC:
 681                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 682                         error = EINVAL;
 683                         break;
 684                 }
 685                 bc = &bridge_control_table[ifd->ifd_cmd];
 686
 687                 if (cmd == SIOCGDRVSPEC &&
 688                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 689                         error = EINVAL;
 690                         break;
 691                 }
 692                 else if (cmd == SIOCSDRVSPEC &&
 693                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 694                         error = EINVAL;
 695                         break;
 696                 }
 697
 698                 if (bc->bc_flags & BC_F_SUSER) {
 699                         error = suser(td);
 700                         if (error)
 701                                 break;
 702                 }
 703
 704                 if (ifd->ifd_len != bc->bc_argsize ||
 705                     ifd->ifd_len > sizeof(args)) {
 706                         error = EINVAL;
 707                         break;
 708                 }
 709
 710                 bzero(&args, sizeof(args));
 711                 if (bc->bc_flags & BC_F_COPYIN) {
 712                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 713                         if (error)
 714                                 break;
 715                 }
 716
 717                 BRIDGE_LOCK(sc);
 718                 error = (*bc->bc_func)(sc, &args);
 719                 BRIDGE_UNLOCK(sc);
 720                 if (error)
 721                         break;
 722
 723                 if (bc->bc_flags & BC_F_COPYOUT)
 724                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 725
 726                 break;
 727
 728         case SIOCSIFFLAGS:
 729                 if (!(ifp->if_flags & IFF_UP) &&
 730                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 731                         /*
 732                          * If interface is marked down and it is running,
 733                          * then stop and disable it.
 734                          */
 735                         BRIDGE_LOCK(sc);
 736                         bridge_stop(ifp, 1);
 737                         BRIDGE_UNLOCK(sc);
 738                 } else if ((ifp->if_flags & IFF_UP) &&
 739                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 740                         /*
 741                          * If interface is marked up and it is stopped, then
 742                          * start it.
 743                          */
 744                         (*ifp->if_init)(sc);
 745                 }
 746                 break;
 747
 748         case SIOCSIFMTU:
 749                 /* Do not allow the MTU to be changed on the bridge */
 750                 error = EINVAL;
 751                 break;
 752
 753         default:
 754                 /*
 755                  * drop the lock as ether_ioctl() will call bridge_start() and
 756                  * cause the lock to be recursed.
 757                  */
 758                 error = ether_ioctl(ifp, cmd, data);
 759                 break;
 760         }
 761
 762         return (error);
 763 }
 764
 765 /*
 766  * bridge_mutecaps:
 767  *
 768  *      Clear or restore unwanted capabilities on the member interface
 769  */
 770 static void
 771 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 772 {
 773         struct ifnet *ifp = bif->bif_ifp;
 774         struct ifreq ifr;
 775         int error;
 776
 777         if (ifp->if_ioctl == NULL)
 778                 return;
 779
 780         bzero(&ifr, sizeof(ifr));
 781         ifr.ifr_reqcap = ifp->if_capenable;
 782
 783         if (mute) {
 784                 /* mask off and save capabilities */
 785                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 786                 if (bif->bif_mutecap != 0)
 787                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 788         } else
 789                 /* restore muted capabilities */
 790                 ifr.ifr_reqcap |= bif->bif_mutecap;
 791
 792
 793         if (bif->bif_mutecap != 0) {
 794                 IFF_LOCKGIANT(ifp);
 795                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
 796                 IFF_UNLOCKGIANT(ifp);
 797         }
 798 }
 799
 800 /*
 801  * bridge_lookup_member:
 802  *
 803  *      Lookup a bridge member interface.
 804  */
 805 static struct bridge_iflist *
 806 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 807 {
 808         struct bridge_iflist *bif;
 809         struct ifnet *ifp;
 810
 811         BRIDGE_LOCK_ASSERT(sc);
 812
 813         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 814                 ifp = bif->bif_ifp;
 815                 if (strcmp(ifp->if_xname, name) == 0)
 816                         return (bif);
 817         }
 818
 819         return (NULL);
 820 }
 821
 822 /*
 823  * bridge_lookup_member_if:
 824  *
 825  *      Lookup a bridge member interface by ifnet*.
 826  */
 827 static struct bridge_iflist *
 828 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 829 {
 830         struct bridge_iflist *bif;
 831
 832         BRIDGE_LOCK_ASSERT(sc);
 833
 834         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 835                 if (bif->bif_ifp == member_ifp)
 836                         return (bif);
 837         }
 838
 839         return (NULL);
 840 }
 841
 842 /*
 843  * bridge_delete_member:
 844  *
 845  *      Delete the specified member interface.
 846  */
 847 static void
 848 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 849     int gone)
 850 {
 851         struct ifnet *ifs = bif->bif_ifp;
 852
 853         BRIDGE_LOCK_ASSERT(sc);
 854
 855         if (!gone) {
 856                 switch (ifs->if_type) {
 857                 case IFT_ETHER:
 858                 case IFT_L2VLAN:
 859                         /*
 860                          * Take the interface out of promiscuous mode.
 861                          */
 862                         (void) ifpromisc(ifs, 0);
 863                         bridge_mutecaps(bif, 0);
 864                         break;
 865
 866                 case IFT_GIF:
 867                         break;
 868
 869                 default:
 870 #ifdef DIAGNOSTIC
 871                         panic("bridge_delete_member: impossible");
 872 #endif
 873                         break;
 874                 }
 875         }
 876
 877         if (bif->bif_flags & IFBIF_STP)
 878                 bstp_disable(&bif->bif_stp);
 879
 880         ifs->if_bridge = NULL;
 881         BRIDGE_XLOCK(sc);
 882         LIST_REMOVE(bif, bif_next);
 883         BRIDGE_XDROP(sc);
 884
 885         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 886
 887         BRIDGE_UNLOCK(sc);
 888         bstp_destroy(&bif->bif_stp);    /* prepare to free */
 889         BRIDGE_LOCK(sc);
 890         free(bif, M_DEVBUF);
 891 }
 892
 893 /*
 894  * bridge_delete_span:
 895  *
 896  *      Delete the specified span interface.
 897  */
 898 static void
 899 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 900 {
 901         BRIDGE_LOCK_ASSERT(sc);
 902
 903         KASSERT(bif->bif_ifp->if_bridge == NULL,
 904             ("%s: not a span interface", __func__));
 905
 906         LIST_REMOVE(bif, bif_next);
 907         free(bif, M_DEVBUF);
 908 }
 909
 910 static int
 911 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 912 {
 913         struct ifbreq *req = arg;
 914         struct bridge_iflist *bif = NULL;
 915         struct ifnet *ifs;
 916         int error = 0;
 917
 918         ifs = ifunit(req->ifbr_ifsname);
 919         if (ifs == NULL)
 920                 return (ENOENT);
 921
 922         /* If it's in the span list, it can't be a member. */
 923         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 924                 if (ifs == bif->bif_ifp)
 925                         return (EBUSY);
 926
 927         /* Allow the first Ethernet member to define the MTU */
 928         if (ifs->if_type != IFT_GIF) {
 929                 if (LIST_EMPTY(&sc->sc_iflist))
 930                         sc->sc_ifp->if_mtu = ifs->if_mtu;
 931                 else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 932                         if_printf(sc->sc_ifp, "invalid MTU for %s\n",
 933                             ifs->if_xname);
 934                         return (EINVAL);
 935                 }
 936         }
 937
 938         if (ifs->if_bridge == sc)
 939                 return (EEXIST);
 940
 941         if (ifs->if_bridge != NULL)
 942                 return (EBUSY);
 943
 944         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 945         if (bif == NULL)
 946                 return (ENOMEM);
 947
 948         bif->bif_ifp = ifs;
 949         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 950
 951         switch (ifs->if_type) {
 952         case IFT_ETHER:
 953         case IFT_L2VLAN:
 954                 /*
 955                  * Place the interface into promiscuous mode.
 956                  */
 957                 error = ifpromisc(ifs, 1);
 958                 if (error)
 959                         goto out;
 960
 961                 bridge_mutecaps(bif, 1);
 962                 break;
 963
 964         case IFT_GIF:
 965                 break;
 966
 967         default:
 968                 error = EINVAL;
 969                 goto out;
 970         }
 971
 972         ifs->if_bridge = sc;
 973         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
 974         /*
 975          * XXX: XLOCK HERE!?!
 976          *
 977          * NOTE: insert_***HEAD*** should be safe for the traversals.
 978          */
 979         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 980
 981 out:
 982         if (error) {
 983                 if (bif != NULL)
 984                         free(bif, M_DEVBUF);
 985         }
 986         return (error);
 987 }
 988
 989 static int
 990 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 991 {
 992         struct ifbreq *req = arg;
 993         struct bridge_iflist *bif;
 994
 995         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 996         if (bif == NULL)
 997                 return (ENOENT);
 998
 999         bridge_delete_member(sc, bif, 0);
1000
1001         return (0);
1002 }
1003
1004 static int
1005 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1006 {
1007         struct ifbreq *req = arg;
1008         struct bridge_iflist *bif;
1009         struct bstp_port *bp;
1010
1011         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1012         if (bif == NULL)
1013                 return (ENOENT);
1014
1015         bp = &bif->bif_stp;
1016         req->ifbr_ifsflags = bif->bif_flags;
1017         req->ifbr_state = bp->bp_state;
1018         req->ifbr_priority = bp->bp_priority;
1019         req->ifbr_path_cost = bp->bp_path_cost;
1020         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1021         req->ifbr_proto = bp->bp_protover;
1022         req->ifbr_role = bp->bp_role;
1023         req->ifbr_stpflags = bp->bp_flags;
1024
1025         /* Copy STP state options as flags */
1026         if (bp->bp_operedge)
1027                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1028         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1029                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1030         if (bp->bp_ptp_link)
1031                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1032         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1033                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1034         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1035                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1036         if (bp->bp_flags & BSTP_PORT_ADMCOST)
1037                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1038         return (0);
1039 }
1040
1041 static int
1042 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1043 {
1044         struct ifbreq *req = arg;
1045         struct bridge_iflist *bif;
1046         struct bstp_port *bp;
1047         int error;
1048
1049         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1050         if (bif == NULL)
1051                 return (ENOENT);
1052         bp = &bif->bif_stp;
1053
1054         if (req->ifbr_ifsflags & IFBIF_SPAN)
1055                 /* SPAN is readonly */
1056                 return (EINVAL);
1057
1058         if (req->ifbr_ifsflags & IFBIF_STP) {
1059                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1060                         error = bstp_enable(&bif->bif_stp);
1061                         if (error)
1062                                 return (error);
1063                 }
1064         } else {
1065                 if ((bif->bif_flags & IFBIF_STP) != 0)
1066                         bstp_disable(&bif->bif_stp);
1067         }
1068
1069         /* Pass on STP flags */
1070         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1071         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1072         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1073         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1074
1075         /* Save the bits relating to the bridge */
1076         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1077
1078         return (0);
1079 }
1080
1081 static int
1082 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1083 {
1084         struct ifbrparam *param = arg;
1085
1086         sc->sc_brtmax = param->ifbrp_csize;
1087         bridge_rttrim(sc);
1088
1089         return (0);
1090 }
1091
1092 static int
1093 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1094 {
1095         struct ifbrparam *param = arg;
1096
1097         param->ifbrp_csize = sc->sc_brtmax;
1098
1099         return (0);
1100 }
1101
1102 static int
1103 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1104 {
1105         struct ifbifconf *bifc = arg;
1106         struct bridge_iflist *bif;
1107         struct ifbreq breq;
1108         char *buf, *outbuf;
1109         int count, buflen, len, error = 0;
1110
1111         count = 0;
1112         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1113                 count++;
1114         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1115                 count++;
1116
1117         buflen = sizeof(breq) * count;
1118         if (bifc->ifbic_len == 0) {
1119                 bifc->ifbic_len = buflen;
1120                 return (0);
1121         }
1122         BRIDGE_UNLOCK(sc);
1123         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1124         BRIDGE_LOCK(sc);
1125
1126         count = 0;
1127         buf = outbuf;
1128         len = min(bifc->ifbic_len, buflen);
1129         bzero(&breq, sizeof(breq));
1130         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1131                 if (len < sizeof(breq))
1132                         break;
1133
1134                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1135                     sizeof(breq.ifbr_ifsname));
1136                 /* Fill in the ifbreq structure */
1137                 error = bridge_ioctl_gifflags(sc, &breq);
1138                 if (error)
1139                         break;
1140                 memcpy(buf, &breq, sizeof(breq));
1141                 count++;
1142                 buf += sizeof(breq);
1143                 len -= sizeof(breq);
1144         }
1145         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1146                 if (len < sizeof(breq))
1147                         break;
1148
1149                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1150                     sizeof(breq.ifbr_ifsname));
1151                 breq.ifbr_ifsflags = bif->bif_flags;
1152                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1153                 memcpy(buf, &breq, sizeof(breq));
1154                 count++;
1155                 buf += sizeof(breq);
1156                 len -= sizeof(breq);
1157         }
1158
1159         BRIDGE_UNLOCK(sc);
1160         bifc->ifbic_len = sizeof(breq) * count;
1161         error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
1162         BRIDGE_LOCK(sc);
1163         free(outbuf, M_TEMP);
1164         return (error);
1165 }
1166
1167 static int
1168 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1169 {
1170         struct ifbaconf *bac = arg;
1171         struct bridge_rtnode *brt;
1172         struct ifbareq bareq;
1173         char *buf, *outbuf;
1174         int count, buflen, len, error = 0;
1175
1176         if (bac->ifbac_len == 0)
1177                 return (0);
1178
1179         count = 0;
1180         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
1181                 count++;
1182         buflen = sizeof(bareq) * count;
1183
1184         BRIDGE_UNLOCK(sc);
1185         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1186         BRIDGE_LOCK(sc);
1187
1188         count = 0;
1189         buf = outbuf;
1190         len = min(bac->ifbac_len, buflen);
1191         bzero(&bareq, sizeof(bareq));
1192         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1193                 if (len < sizeof(bareq))
1194                         goto out;
1195                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1196                     sizeof(bareq.ifba_ifsname));
1197                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1198                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1199                                 time_uptime < brt->brt_expire)
1200                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1201                 else
1202                         bareq.ifba_expire = 0;
1203                 bareq.ifba_flags = brt->brt_flags;
1204
1205                 memcpy(buf, &bareq, sizeof(bareq));
1206                 count++;
1207                 buf += sizeof(bareq);
1208                 len -= sizeof(bareq);
1209         }
1210 out:
1211         BRIDGE_UNLOCK(sc);
1212         bac->ifbac_len = sizeof(bareq) * count;
1213         error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
1214         BRIDGE_LOCK(sc);
1215         free(outbuf, M_TEMP);
1216         return (error);
1217 }
1218
1219 static int
1220 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1221 {
1222         struct ifbareq *req = arg;
1223         struct bridge_iflist *bif;
1224         int error;
1225
1226         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1227         if (bif == NULL)
1228                 return (ENOENT);
1229
1230         error = bridge_rtupdate(sc, req->ifba_dst, bif, 1,
1231             req->ifba_flags);
1232
1233         return (error);
1234 }
1235
1236 static int
1237 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1238 {
1239         struct ifbrparam *param = arg;
1240
1241         sc->sc_brttimeout = param->ifbrp_ctime;
1242         return (0);
1243 }
1244
1245 static int
1246 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1247 {
1248         struct ifbrparam *param = arg;
1249
1250         param->ifbrp_ctime = sc->sc_brttimeout;
1251         return (0);
1252 }
1253
1254 static int
1255 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1256 {
1257         struct ifbareq *req = arg;
1258
1259         return (bridge_rtdaddr(sc, req->ifba_dst));
1260 }
1261
1262 static int
1263 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1264 {
1265         struct ifbreq *req = arg;
1266
1267         bridge_rtflush(sc, req->ifbr_ifsflags);
1268         return (0);
1269 }
1270
1271 static int
1272 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1273 {
1274         struct ifbrparam *param = arg;
1275         struct bstp_state *bs = &sc->sc_stp;
1276
1277         param->ifbrp_prio = bs->bs_bridge_priority;
1278         return (0);
1279 }
1280
1281 static int
1282 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1283 {
1284         struct ifbrparam *param = arg;
1285
1286         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1287 }
1288
1289 static int
1290 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1291 {
1292         struct ifbrparam *param = arg;
1293         struct bstp_state *bs = &sc->sc_stp;
1294
1295         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1296         return (0);
1297 }
1298
1299 static int
1300 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1301 {
1302         struct ifbrparam *param = arg;
1303
1304         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1305 }
1306
1307 static int
1308 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1309 {
1310         struct ifbrparam *param = arg;
1311         struct bstp_state *bs = &sc->sc_stp;
1312
1313         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1314         return (0);
1315 }
1316
1317 static int
1318 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1319 {
1320         struct ifbrparam *param = arg;
1321
1322         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1323 }
1324
1325 static int
1326 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1327 {
1328         struct ifbrparam *param = arg;
1329         struct bstp_state *bs = &sc->sc_stp;
1330
1331         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1332         return (0);
1333 }
1334
1335 static int
1336 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1337 {
1338         struct ifbrparam *param = arg;
1339
1340         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1341 }
1342
1343 static int
1344 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1345 {
1346         struct ifbreq *req = arg;
1347         struct bridge_iflist *bif;
1348
1349         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1350         if (bif == NULL)
1351                 return (ENOENT);
1352
1353         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1354 }
1355
1356 static int
1357 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1358 {
1359         struct ifbreq *req = arg;
1360         struct bridge_iflist *bif;
1361
1362         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1363         if (bif == NULL)
1364                 return (ENOENT);
1365
1366         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1367 }
1368
1369 static int
1370 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1371 {
1372         struct ifbreq *req = arg;
1373         struct bridge_iflist *bif = NULL;
1374         struct ifnet *ifs;
1375
1376         ifs = ifunit(req->ifbr_ifsname);
1377         if (ifs == NULL)
1378                 return (ENOENT);
1379
1380         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1381                 if (ifs == bif->bif_ifp)
1382                         return (EBUSY);
1383
1384         if (ifs->if_bridge != NULL)
1385                 return (EBUSY);
1386
1387         switch (ifs->if_type) {
1388                 case IFT_ETHER:
1389                 case IFT_GIF:
1390                 case IFT_L2VLAN:
1391                         break;
1392                 default:
1393                         return (EINVAL);
1394         }
1395
1396         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1397         if (bif == NULL)
1398                 return (ENOMEM);
1399
1400         bif->bif_ifp = ifs;
1401         bif->bif_flags = IFBIF_SPAN;
1402
1403         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1404
1405         return (0);
1406 }
1407
1408 static int
1409 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1410 {
1411         struct ifbreq *req = arg;
1412         struct bridge_iflist *bif;
1413         struct ifnet *ifs;
1414
1415         ifs = ifunit(req->ifbr_ifsname);
1416         if (ifs == NULL)
1417                 return (ENOENT);
1418
1419         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1420                 if (ifs == bif->bif_ifp)
1421                         break;
1422
1423         if (bif == NULL)
1424                 return (ENOENT);
1425
1426         bridge_delete_span(sc, bif);
1427
1428         return (0);
1429 }
1430
1431 static int
1432 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1433 {
1434         struct ifbropreq *req = arg;
1435         struct bstp_state *bs = &sc->sc_stp;
1436         struct bstp_port *root_port;
1437
1438         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1439         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1440         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1441
1442         root_port = bs->bs_root_port;
1443         if (root_port == NULL)
1444                 req->ifbop_root_port = 0;
1445         else
1446                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1447
1448         req->ifbop_holdcount = bs->bs_txholdcount;
1449         req->ifbop_priority = bs->bs_bridge_priority;
1450         req->ifbop_protocol = bs->bs_protover;
1451         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1452         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1453         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1454         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1455         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1456         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1457
1458         return (0);
1459 }
1460
1461 static int
1462 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1463 {
1464         struct ifbrparam *param = arg;
1465
1466         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1467         return (0);
1468 }
1469
1470 static int
1471 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1472 {
1473         struct ifbpstpconf *bifstp = arg;
1474         struct bridge_iflist *bif;
1475         struct bstp_port *bp;
1476         struct ifbpstpreq bpreq;
1477         char *buf, *outbuf;
1478         int count, buflen, len, error = 0;
1479
1480         count = 0;
1481         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1482                 if ((bif->bif_flags & IFBIF_STP) != 0)
1483                         count++;
1484         }
1485
1486         buflen = sizeof(bpreq) * count;
1487         if (bifstp->ifbpstp_len == 0) {
1488                 bifstp->ifbpstp_len = buflen;
1489                 return (0);
1490         }
1491
1492         BRIDGE_UNLOCK(sc);
1493         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1494         BRIDGE_LOCK(sc);
1495
1496         count = 0;
1497         buf = outbuf;
1498         len = min(bifstp->ifbpstp_len, buflen);
1499         bzero(&bpreq, sizeof(bpreq));
1500         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1501                 if (len < sizeof(bpreq))
1502                         break;
1503
1504                 if ((bif->bif_flags & IFBIF_STP) == 0)
1505                         continue;
1506
1507                 bp = &bif->bif_stp;
1508                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1509                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1510                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1511                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1512                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1513                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1514
1515                 memcpy(buf, &bpreq, sizeof(bpreq));
1516                 count++;
1517                 buf += sizeof(bpreq);
1518                 len -= sizeof(bpreq);
1519         }
1520
1521         BRIDGE_UNLOCK(sc);
1522         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1523         error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
1524         BRIDGE_LOCK(sc);
1525         free(outbuf, M_TEMP);
1526         return (error);
1527 }
1528
1529 static int
1530 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1531 {
1532         struct ifbrparam *param = arg;
1533
1534         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1535 }
1536
1537 static int
1538 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1539 {
1540         struct ifbrparam *param = arg;
1541
1542         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1543 }
1544
1545 /*
1546  * bridge_ifdetach:
1547  *
1548  *      Detach an interface from a bridge.  Called when a member
1549  *      interface is detaching.
1550  */
1551 static void
1552 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1553 {
1554         struct bridge_softc *sc = ifp->if_bridge;
1555         struct bridge_iflist *bif;
1556
1557         /* Check if the interface is a bridge member */
1558         if (sc != NULL) {
1559                 BRIDGE_LOCK(sc);
1560
1561                 bif = bridge_lookup_member_if(sc, ifp);
1562                 if (bif != NULL)
1563                         bridge_delete_member(sc, bif, 1);
1564
1565                 BRIDGE_UNLOCK(sc);
1566                 return;
1567         }
1568
1569         /* Check if the interface is a span port */
1570         mtx_lock(&bridge_list_mtx);
1571         LIST_FOREACH(sc, &bridge_list, sc_list) {
1572                 BRIDGE_LOCK(sc);
1573                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1574                         if (ifp == bif->bif_ifp) {
1575                                 bridge_delete_span(sc, bif);
1576                                 break;
1577                         }
1578
1579                 BRIDGE_UNLOCK(sc);
1580         }
1581         mtx_unlock(&bridge_list_mtx);
1582 }
1583
1584 /*
1585  * bridge_init:
1586  *
1587  *      Initialize a bridge interface.
1588  */
1589 static void
1590 bridge_init(void *xsc)
1591 {
1592         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1593         struct ifnet *ifp = sc->sc_ifp;
1594
1595         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1596                 return;
1597
1598         BRIDGE_LOCK(sc);
1599         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1600             bridge_timer, sc);
1601
1602         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1603         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1604
1605         BRIDGE_UNLOCK(sc);
1606 }
1607
1608 /*
1609  * bridge_stop:
1610  *
1611  *      Stop the bridge interface.
1612  */
1613 static void
1614 bridge_stop(struct ifnet *ifp, int disable)
1615 {
1616         struct bridge_softc *sc = ifp->if_softc;
1617
1618         BRIDGE_LOCK_ASSERT(sc);
1619
1620         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1621                 return;
1622
1623         callout_stop(&sc->sc_brcallout);
1624         bstp_stop(&sc->sc_stp);
1625
1626         bridge_rtflush(sc, IFBF_FLUSHDYN);
1627
1628         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1629 }
1630
1631 /*
1632  * bridge_enqueue:
1633  *
1634  *      Enqueue a packet on a bridge member interface.
1635  *
1636  */
1637 static void
1638 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1639 {
1640         int len, err = 0;
1641         short mflags;
1642         struct mbuf *m0;
1643
1644         len = m->m_pkthdr.len;
1645         mflags = m->m_flags;
1646
1647         /* We may be sending a fragment so traverse the mbuf */
1648         for (; m; m = m0) {
1649                 m0 = m->m_nextpkt;
1650                 m->m_nextpkt = NULL;
1651
1652                 if (err == 0)
1653                         IFQ_ENQUEUE(&dst_ifp->if_snd, m, err);
1654         }
1655
1656         if (err == 0) {
1657
1658                 sc->sc_ifp->if_opackets++;
1659                 sc->sc_ifp->if_obytes += len;
1660
1661                 dst_ifp->if_obytes += len;
1662
1663                 if (mflags & M_MCAST) {
1664                         sc->sc_ifp->if_omcasts++;
1665                         dst_ifp->if_omcasts++;
1666                 }
1667         }
1668
1669         if ((dst_ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1670                 (*dst_ifp->if_start)(dst_ifp);
1671 }
1672
1673 /*
1674  * bridge_dummynet:
1675  *
1676  *      Receive a queued packet from dummynet and pass it on to the output
1677  *      interface.
1678  *
1679  *      The mbuf has the Ethernet header already attached.
1680  */
1681 static void
1682 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1683 {
1684         struct bridge_softc *sc;
1685
1686         sc = ifp->if_bridge;
1687
1688         /*
1689          * The packet didnt originate from a member interface. This should only
1690          * ever happen if a member interface is removed while packets are
1691          * queued for it.
1692          */
1693         if (sc == NULL) {
1694                 m_freem(m);
1695                 return;
1696         }
1697
1698         if (inet_pfil_hook.ph_busy_count >= 0
1699 #ifdef INET6
1700             || inet6_pfil_hook.ph_busy_count >= 0
1701 #endif
1702             ) {
1703                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1704                         return;
1705                 if (m == NULL)
1706                         return;
1707         }
1708
1709         bridge_enqueue(sc, ifp, m);
1710 }
1711
1712 /*
1713  * bridge_output:
1714  *
1715  *      Send output from a bridge member interface.  This
1716  *      performs the bridging function for locally originated
1717  *      packets.
1718  *
1719  *      The mbuf has the Ethernet header already attached.  We must
1720  *      enqueue or free the mbuf before returning.
1721  */
1722 static int
1723 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1724     struct rtentry *rt)
1725 {
1726         struct ether_header *eh;
1727         struct ifnet *dst_if;
1728         struct bridge_softc *sc;
1729
1730         if (m->m_len < ETHER_HDR_LEN) {
1731                 m = m_pullup(m, ETHER_HDR_LEN);
1732                 if (m == NULL)
1733                         return (0);
1734         }
1735
1736         eh = mtod(m, struct ether_header *);
1737         sc = ifp->if_bridge;
1738
1739         BRIDGE_LOCK(sc);
1740
1741         /*
1742          * If bridge is down, but the original output interface is up,
1743          * go ahead and send out that interface.  Otherwise, the packet
1744          * is dropped below.
1745          */
1746         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1747                 dst_if = ifp;
1748                 goto sendunicast;
1749         }
1750
1751         /*
1752          * If the packet is a multicast, or we don't know a better way to
1753          * get there, send to all interfaces.
1754          */
1755         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1756                 dst_if = NULL;
1757         else
1758                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1759         if (dst_if == NULL) {
1760                 struct bridge_iflist *bif;
1761                 struct mbuf *mc;
1762                 int error = 0, used = 0;
1763
1764                 bridge_span(sc, m);
1765
1766                 BRIDGE_LOCK2REF(sc, error);
1767                 if (error) {
1768                         m_freem(m);
1769                         return (0);
1770                 }
1771
1772                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1773                         dst_if = bif->bif_ifp;
1774
1775                         if (dst_if->if_type == IFT_GIF)
1776                                 continue;
1777                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1778                                 continue;
1779
1780                         /*
1781                          * If this is not the original output interface,
1782                          * and the interface is participating in spanning
1783                          * tree, make sure the port is in a state that
1784                          * allows forwarding.
1785                          */
1786                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
1787                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
1788                                 continue;
1789
1790                         if (LIST_NEXT(bif, bif_next) == NULL) {
1791                                 used = 1;
1792                                 mc = m;
1793                         } else {
1794                                 mc = m_copypacket(m, M_DONTWAIT);
1795                                 if (mc == NULL) {
1796                                         sc->sc_ifp->if_oerrors++;
1797                                         continue;
1798                                 }
1799                         }
1800
1801                         bridge_enqueue(sc, dst_if, mc);
1802                 }
1803                 if (used == 0)
1804                         m_freem(m);
1805                 BRIDGE_UNREF(sc);
1806                 return (0);
1807         }
1808
1809 sendunicast:
1810         /*
1811          * XXX Spanning tree consideration here?
1812          */
1813
1814         bridge_span(sc, m);
1815         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1816                 m_freem(m);
1817                 BRIDGE_UNLOCK(sc);
1818                 return (0);
1819         }
1820
1821         BRIDGE_UNLOCK(sc);
1822         bridge_enqueue(sc, dst_if, m);
1823         return (0);
1824 }
1825
1826 /*
1827  * bridge_start:
1828  *
1829  *      Start output on a bridge.
1830  *
1831  */
1832 static void
1833 bridge_start(struct ifnet *ifp)
1834 {
1835         struct bridge_softc *sc;
1836         struct mbuf *m;
1837         struct ether_header *eh;
1838         struct ifnet *dst_if;
1839
1840         sc = ifp->if_softc;
1841
1842         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1843         for (;;) {
1844                 IFQ_DEQUEUE(&ifp->if_snd, m);
1845                 if (m == 0)
1846                         break;
1847                 BPF_MTAP(ifp, m);
1848
1849                 eh = mtod(m, struct ether_header *);
1850                 dst_if = NULL;
1851
1852                 BRIDGE_LOCK(sc);
1853                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1854                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1855                 }
1856
1857                 if (dst_if == NULL)
1858                         bridge_broadcast(sc, ifp, m, 0);
1859                 else {
1860                         BRIDGE_UNLOCK(sc);
1861                         bridge_enqueue(sc, dst_if, m);
1862                 }
1863         }
1864         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1865 }
1866
1867 /*
1868  * bridge_forward:
1869  *
1870  *      The forwarding function of the bridge.
1871  *
1872  *      NOTE: Releases the lock on return.
1873  */
1874 static void
1875 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
1876     struct mbuf *m)
1877 {
1878         struct bridge_iflist *dbif;
1879         struct ifnet *src_if, *dst_if, *ifp;
1880         struct ether_header *eh;
1881
1882         src_if = m->m_pkthdr.rcvif;
1883         ifp = sc->sc_ifp;
1884
1885         sc->sc_ifp->if_ipackets++;
1886         sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
1887
1888         if ((sbif->bif_flags & IFBIF_STP) &&
1889             sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
1890                 BRIDGE_UNLOCK(sc);
1891                 m_freem(m);
1892                 return;
1893         }
1894
1895         eh = mtod(m, struct ether_header *);
1896
1897         /*
1898          * If the interface is learning, and the source
1899          * address is valid and not multicast, record
1900          * the address.
1901          */
1902         if ((sbif->bif_flags & IFBIF_LEARNING) != 0 &&
1903             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1904             (eh->ether_shost[0] == 0 &&
1905              eh->ether_shost[1] == 0 &&
1906              eh->ether_shost[2] == 0 &&
1907              eh->ether_shost[3] == 0 &&
1908              eh->ether_shost[4] == 0 &&
1909              eh->ether_shost[5] == 0) == 0) {
1910                 (void) bridge_rtupdate(sc, eh->ether_shost,
1911                     sbif, 0, IFBAF_DYNAMIC);
1912         }
1913
1914         if ((sbif->bif_flags & IFBIF_STP) != 0 &&
1915             sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
1916                 m_freem(m);
1917                 BRIDGE_UNLOCK(sc);
1918                 return;
1919         }
1920
1921         /*
1922          * At this point, the port either doesn't participate
1923          * in spanning tree or it is in the forwarding state.
1924          */
1925
1926         /*
1927          * If the packet is unicast, destined for someone on
1928          * "this" side of the bridge, drop it.
1929          */
1930         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1931                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1932                 if (src_if == dst_if) {
1933                         BRIDGE_UNLOCK(sc);
1934                         m_freem(m);
1935                         return;
1936                 }
1937         } else {
1938                 /* ...forward it to all interfaces. */
1939                 sc->sc_ifp->if_imcasts++;
1940                 dst_if = NULL;
1941         }
1942
1943         /*
1944          * If we have a destination interface which is a member of our bridge,
1945          * OR this is a unicast packet, push it through the bpf(4) machinery.
1946          * For broadcast or multicast packets, don't bother because it will
1947          * be reinjected into ether_input. We do this before we pass the packets
1948          * through the pfil(9) framework, as it is possible that pfil(9) will
1949          * drop the packet, or possibly modify it, making it difficult to debug
1950          * firewall issues on the bridge.
1951          */
1952         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1953                 BPF_MTAP(ifp, m);
1954
1955         /* run the packet filter */
1956         if (inet_pfil_hook.ph_busy_count >= 0
1957 #ifdef INET6
1958             || inet6_pfil_hook.ph_busy_count >= 0
1959 #endif
1960             ) {
1961                 BRIDGE_UNLOCK(sc);
1962                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1963                         return;
1964                 if (m == NULL)
1965                         return;
1966                 BRIDGE_LOCK(sc);
1967         }
1968
1969         if (dst_if == NULL) {
1970                 bridge_broadcast(sc, src_if, m, 1);
1971                 return;
1972         }
1973
1974         /*
1975          * At this point, we're dealing with a unicast frame
1976          * going to a different interface.
1977          */
1978         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1979                 BRIDGE_UNLOCK(sc);
1980                 m_freem(m);
1981                 return;
1982         }
1983         dbif = bridge_lookup_member_if(sc, dst_if);
1984         if (dbif == NULL) {
1985                 /* Not a member of the bridge (anymore?) */
1986                 BRIDGE_UNLOCK(sc);
1987                 m_freem(m);
1988                 return;
1989         }
1990
1991         /* Private segments can not talk to each other */
1992         if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE) {
1993                 BRIDGE_UNLOCK(sc);
1994                 m_freem(m);
1995                 return;
1996         }
1997
1998         if ((dbif->bif_flags & IFBIF_STP) &&
1999             dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2000                 BRIDGE_UNLOCK(sc);
2001                 m_freem(m);
2002                 return;
2003         }
2004
2005         BRIDGE_UNLOCK(sc);
2006
2007         if (inet_pfil_hook.ph_busy_count >= 0
2008 #ifdef INET6
2009             || inet6_pfil_hook.ph_busy_count >= 0
2010 #endif
2011             ) {
2012                 if (bridge_pfil(&m, sc->sc_ifp, dst_if, PFIL_OUT) != 0)
2013                         return;
2014                 if (m == NULL)
2015                         return;
2016         }
2017
2018         bridge_enqueue(sc, dst_if, m);
2019 }
2020
2021 /*
2022  * bridge_input:
2023  *
2024  *      Receive input from a member interface.  Queue the packet for
2025  *      bridging if it is not for us.
2026  */
2027 static struct mbuf *
2028 bridge_input(struct ifnet *ifp, struct mbuf *m)
2029 {
2030         struct bridge_softc *sc = ifp->if_bridge;
2031         struct bridge_iflist *bif, *bif2;
2032         struct ifnet *bifp;
2033         struct ether_header *eh;
2034         struct mbuf *mc, *mc2;
2035
2036         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2037                 return (m);
2038
2039         bifp = sc->sc_ifp;
2040
2041         /*
2042          * Implement support for bridge monitoring. If this flag has been
2043          * set on this interface, discard the packet once we push it through
2044          * the bpf(4) machinery, but before we do, increment the byte and
2045          * packet counters associated with this interface.
2046          */
2047         if ((bifp->if_flags & IFF_MONITOR) != 0) {
2048                 m->m_pkthdr.rcvif  = bifp;
2049                 BPF_MTAP(bifp, m);
2050                 bifp->if_ipackets++;
2051                 bifp->if_ibytes += m->m_pkthdr.len;
2052                 m_freem(m);
2053                 return (NULL);
2054         }
2055         BRIDGE_LOCK(sc);
2056         bif = bridge_lookup_member_if(sc, ifp);
2057         if (bif == NULL) {
2058                 BRIDGE_UNLOCK(sc);
2059                 return (m);
2060         }
2061
2062         eh = mtod(m, struct ether_header *);
2063
2064         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp),
2065             ETHER_ADDR_LEN) == 0) {
2066                 /* Block redundant paths to us */
2067                 if ((bif->bif_flags & IFBIF_STP) &&
2068                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2069                         BRIDGE_UNLOCK(sc);
2070                         return (m);
2071                 }
2072
2073                 /*
2074                  * Filter on the physical interface.
2075                  */
2076                 if (pfil_local_phys && (inet_pfil_hook.ph_busy_count >= 0
2077 #ifdef INET6
2078                     || inet6_pfil_hook.ph_busy_count >= 0
2079 #endif
2080                     )) {
2081                         if (bridge_pfil(&m, NULL, ifp, PFIL_IN) != 0 ||
2082                             m == NULL) {
2083                                 BRIDGE_UNLOCK(sc);
2084                                 return (NULL);
2085                         }
2086                 }
2087
2088                 /*
2089                  * If the packet is for us, set the packets source as the
2090                  * bridge, and return the packet back to ether_input for
2091                  * local processing.
2092                  */
2093
2094                 /* Note where to send the reply to */
2095                 if (bif->bif_flags & IFBIF_LEARNING)
2096                         (void) bridge_rtupdate(sc,
2097                             eh->ether_shost, bif, 0, IFBAF_DYNAMIC);
2098
2099                 /* Mark the packet as arriving on the bridge interface */
2100                 m->m_pkthdr.rcvif = bifp;
2101                 BPF_MTAP(bifp, m);
2102                 bifp->if_ipackets++;
2103
2104                 BRIDGE_UNLOCK(sc);
2105                 return (m);
2106         }
2107
2108         bridge_span(sc, m);
2109
2110         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
2111                 /* Tap off 802.1D packets; they do not get forwarded. */
2112                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2113                     ETHER_ADDR_LEN) == 0) {
2114                         m = bstp_input(&bif->bif_stp, ifp, m);
2115                         if (m == NULL) {
2116                                 BRIDGE_UNLOCK(sc);
2117                                 return (NULL);
2118                         }
2119                 }
2120
2121                 if ((bif->bif_flags & IFBIF_STP) &&
2122                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2123                         BRIDGE_UNLOCK(sc);
2124                         return (m);
2125                 }
2126
2127                 if (bcmp(etherbroadcastaddr, eh->ether_dhost,
2128                     sizeof(etherbroadcastaddr)) == 0)
2129                         m->m_flags |= M_BCAST;
2130                 else
2131                         m->m_flags |= M_MCAST;
2132
2133                 /*
2134                  * Make a deep copy of the packet and enqueue the copy
2135                  * for bridge processing; return the original packet for
2136                  * local processing.
2137                  */
2138                 mc = m_dup(m, M_DONTWAIT);
2139                 if (mc == NULL) {
2140                         BRIDGE_UNLOCK(sc);
2141                         return (m);
2142                 }
2143
2144                 /* Perform the bridge forwarding function with the copy. */
2145                 bridge_forward(sc, bif, mc);
2146
2147                 /*
2148                  * Reinject the mbuf as arriving on the bridge so we have a
2149                  * chance at claiming multicast packets. We can not loop back
2150                  * here from ether_input as a bridge is never a member of a
2151                  * bridge.
2152                  */
2153                 KASSERT(bifp->if_bridge == NULL,
2154                     ("loop created in bridge_input"));
2155                 mc2 = m_dup(m, M_DONTWAIT);
2156                 if (mc2 != NULL) {
2157                         /* Keep the layer3 header aligned */
2158                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2159                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2160                 }
2161                 if (mc2 != NULL) {
2162                         mc2->m_pkthdr.rcvif = bifp;
2163                         (*bifp->if_input)(bifp, mc2);
2164                 }
2165
2166                 /* Return the original packet for local processing. */
2167                 return (m);
2168         }
2169
2170         if ((bif->bif_flags & IFBIF_STP) &&
2171             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2172                 BRIDGE_UNLOCK(sc);
2173                 return (m);
2174         }
2175
2176 #ifdef DEV_CARP
2177 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2178         || ((iface)->if_carp \
2179             && carp_forus((iface)->if_carp, eh->ether_dhost))
2180 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2181         || ((iface)->if_carp \
2182             && carp_forus((iface)->if_carp, eh->ether_shost))
2183 #else
2184 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2185 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2186 #endif
2187
2188 #define GRAB_OUR_PACKETS(iface) \
2189         if ((iface)->if_type == IFT_GIF) \
2190                 continue; \
2191         /* It is destined for us. */ \
2192         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2193             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
2194             ) {                                                         \
2195                 if (bif->bif_flags & IFBIF_LEARNING)                    \
2196                         (void) bridge_rtupdate(sc,                      \
2197                             eh->ether_shost, bif, 0, IFBAF_DYNAMIC);    \
2198                 m->m_pkthdr.rcvif = iface;                              \
2199                 BRIDGE_UNLOCK(sc);                                      \
2200                 return (m);                                             \
2201         }                                                               \
2202                                                                         \
2203         /* We just received a packet that we sent out. */               \
2204         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2205             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
2206             ) {                                                         \
2207                 BRIDGE_UNLOCK(sc);                                      \
2208                 m_freem(m);                                             \
2209                 return (NULL);                                          \
2210         }
2211
2212         /*
2213          * Unicast.  Make sure it's not for us.
2214          *
2215          * Give a chance for ifp at first priority. This will help when the
2216          * packet comes through the interface like VLAN's with the same MACs
2217          * on several interfaces from the same bridge. This also will save
2218          * some CPU cycles in case the destination interface and the input
2219          * interface (eq ifp) are the same.
2220          */
2221         do { GRAB_OUR_PACKETS(ifp) } while (0);
2222
2223         /* Now check the all bridge members. */
2224         LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2225                 GRAB_OUR_PACKETS(bif2->bif_ifp)
2226         }
2227
2228 #undef OR_CARP_CHECK_WE_ARE_DST
2229 #undef OR_CARP_CHECK_WE_ARE_SRC
2230 #undef GRAB_OUR_PACKETS
2231
2232         /* Perform the bridge forwarding function. */
2233         bridge_forward(sc, bif, m);
2234
2235         return (NULL);
2236 }
2237
2238 /*
2239  * bridge_broadcast:
2240  *
2241  *      Send a frame to all interfaces that are members of
2242  *      the bridge, except for the one on which the packet
2243  *      arrived.
2244  *
2245  *      NOTE: Releases the lock on return.
2246  */
2247 static void
2248 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2249     struct mbuf *m, int runfilt)
2250 {
2251         struct bridge_iflist *dbif, *sbif;
2252         struct mbuf *mc;
2253         struct ifnet *dst_if;
2254         int error = 0, used = 0, i;
2255
2256         sbif = bridge_lookup_member_if(sc, src_if);
2257
2258         BRIDGE_LOCK2REF(sc, error);
2259         if (error) {
2260                 m_freem(m);
2261                 return;
2262         }
2263
2264         /* Filter on the bridge interface before broadcasting */
2265         if (runfilt && (inet_pfil_hook.ph_busy_count >= 0
2266 #ifdef INET6
2267             || inet6_pfil_hook.ph_busy_count >= 0
2268 #endif
2269             )) {
2270                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2271                         goto out;
2272                 if (m == NULL)
2273                         goto out;
2274         }
2275
2276         LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
2277                 dst_if = dbif->bif_ifp;
2278                 if (dst_if == src_if)
2279                         continue;
2280
2281                 /* Private segments can not talk to each other */
2282                 if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
2283                         continue;
2284
2285                 if ((dbif->bif_flags & IFBIF_STP) &&
2286                     dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2287                         continue;
2288
2289                 if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
2290                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2291                         continue;
2292
2293                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2294                         continue;
2295
2296                 if (LIST_NEXT(dbif, bif_next) == NULL) {
2297                         mc = m;
2298                         used = 1;
2299                 } else {
2300                         mc = m_dup(m, M_DONTWAIT);
2301                         if (mc == NULL) {
2302                                 sc->sc_ifp->if_oerrors++;
2303                                 continue;
2304                         }
2305                 }
2306
2307                 /*
2308                  * Filter on the output interface. Pass a NULL bridge interface
2309                  * pointer so we do not redundantly filter on the bridge for
2310                  * each interface we broadcast on.
2311                  */
2312                 if (runfilt && (inet_pfil_hook.ph_busy_count >= 0
2313 #ifdef INET6
2314                     || inet6_pfil_hook.ph_busy_count >= 0
2315 #endif
2316                     )) {
2317                         if (used == 0) {
2318                                 /* Keep the layer3 header aligned */
2319                                 i = min(mc->m_pkthdr.len, max_protohdr);
2320                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2321                                 if (mc == NULL) {
2322                                         sc->sc_ifp->if_oerrors++;
2323                                         continue;
2324                                 }
2325                         }
2326                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2327                                 continue;
2328                         if (mc == NULL)
2329                                 continue;
2330                 }
2331
2332                 bridge_enqueue(sc, dst_if, mc);
2333         }
2334         if (used == 0)
2335                 m_freem(m);
2336
2337 out:
2338         BRIDGE_UNREF(sc);
2339 }
2340
2341 /*
2342  * bridge_span:
2343  *
2344  *      Duplicate a packet out one or more interfaces that are in span mode,
2345  *      the original mbuf is unmodified.
2346  */
2347 static void
2348 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2349 {
2350         struct bridge_iflist *bif;
2351         struct ifnet *dst_if;
2352         struct mbuf *mc;
2353
2354         if (LIST_EMPTY(&sc->sc_spanlist))
2355                 return;
2356
2357         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2358                 dst_if = bif->bif_ifp;
2359
2360                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2361                         continue;
2362
2363                 mc = m_copypacket(m, M_DONTWAIT);
2364                 if (mc == NULL) {
2365                         sc->sc_ifp->if_oerrors++;
2366                         continue;
2367                 }
2368
2369                 bridge_enqueue(sc, dst_if, mc);
2370         }
2371 }
2372
2373 /*
2374  * bridge_rtupdate:
2375  *
2376  *      Add a bridge routing entry.
2377  */
2378 static int
2379 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2380     struct bridge_iflist *bif, int setflags, uint8_t flags)
2381 {
2382         struct bridge_rtnode *brt;
2383         struct ifnet *dst_if = bif->bif_ifp;
2384         int error;
2385
2386         BRIDGE_LOCK_ASSERT(sc);
2387
2388         /*
2389          * A route for this destination might already exist.  If so,
2390          * update it, otherwise create a new one.
2391          */
2392         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2393                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2394                         sc->sc_brtexceeded++;
2395                         return (ENOSPC);
2396                 }
2397
2398                 /*
2399                  * Allocate a new bridge forwarding node, and
2400                  * initialize the expiration time and Ethernet
2401                  * address.
2402                  */
2403                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2404                 if (brt == NULL)
2405                         return (ENOMEM);
2406
2407                 if (bif->bif_flags & IFBIF_STICKY)
2408                         brt->brt_flags = IFBAF_STICKY;
2409                 else
2410                         brt->brt_flags = IFBAF_DYNAMIC;
2411
2412                 brt->brt_ifp = dst_if;
2413                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2414
2415                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2416                         uma_zfree(bridge_rtnode_zone, brt);
2417                         return (error);
2418                 }
2419         }
2420
2421         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2422                 brt->brt_ifp = dst_if;
2423         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2424                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2425         if (setflags)
2426                 brt->brt_flags = flags;
2427
2428         return (0);
2429 }
2430
2431 /*
2432  * bridge_rtlookup:
2433  *
2434  *      Lookup the destination interface for an address.
2435  */
2436 static struct ifnet *
2437 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2438 {
2439         struct bridge_rtnode *brt;
2440
2441         BRIDGE_LOCK_ASSERT(sc);
2442
2443         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2444                 return (NULL);
2445
2446         return (brt->brt_ifp);
2447 }
2448
2449 /*
2450  * bridge_rttrim:
2451  *
2452  *      Trim the routine table so that we have a number
2453  *      of routing entries less than or equal to the
2454  *      maximum number.
2455  */
2456 static void
2457 bridge_rttrim(struct bridge_softc *sc)
2458 {
2459         struct bridge_rtnode *brt, *nbrt;
2460
2461         BRIDGE_LOCK_ASSERT(sc);
2462
2463         /* Make sure we actually need to do this. */
2464         if (sc->sc_brtcnt <= sc->sc_brtmax)
2465                 return;
2466
2467         /* Force an aging cycle; this might trim enough addresses. */
2468         bridge_rtage(sc);
2469         if (sc->sc_brtcnt <= sc->sc_brtmax)
2470                 return;
2471
2472         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2473                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2474                         bridge_rtnode_destroy(sc, brt);
2475                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2476                                 return;
2477                 }
2478         }
2479 }
2480
2481 /*
2482  * bridge_timer:
2483  *
2484  *      Aging timer for the bridge.
2485  */
2486 static void
2487 bridge_timer(void *arg)
2488 {
2489         struct bridge_softc *sc = arg;
2490
2491         BRIDGE_LOCK_ASSERT(sc);
2492
2493         bridge_rtage(sc);
2494
2495         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2496                 callout_reset(&sc->sc_brcallout,
2497                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2498 }
2499
2500 /*
2501  * bridge_rtage:
2502  *
2503  *      Perform an aging cycle.
2504  */
2505 static void
2506 bridge_rtage(struct bridge_softc *sc)
2507 {
2508         struct bridge_rtnode *brt, *nbrt;
2509
2510         BRIDGE_LOCK_ASSERT(sc);
2511
2512         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2513                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2514                         if (time_uptime >= brt->brt_expire)
2515                                 bridge_rtnode_destroy(sc, brt);
2516                 }
2517         }
2518 }
2519
2520 /*
2521  * bridge_rtflush:
2522  *
2523  *      Remove all dynamic addresses from the bridge.
2524  */
2525 static void
2526 bridge_rtflush(struct bridge_softc *sc, int full)
2527 {
2528         struct bridge_rtnode *brt, *nbrt;
2529
2530         BRIDGE_LOCK_ASSERT(sc);
2531
2532         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2533                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2534                         bridge_rtnode_destroy(sc, brt);
2535         }
2536 }
2537
2538 /*
2539  * bridge_rtdaddr:
2540  *
2541  *      Remove an address from the table.
2542  */
2543 static int
2544 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2545 {
2546         struct bridge_rtnode *brt;
2547
2548         BRIDGE_LOCK_ASSERT(sc);
2549
2550         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2551                 return (ENOENT);
2552
2553         bridge_rtnode_destroy(sc, brt);
2554         return (0);
2555 }
2556
2557 /*
2558  * bridge_rtdelete:
2559  *
2560  *      Delete routes to a speicifc member interface.
2561  */
2562 static void
2563 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2564 {
2565         struct bridge_rtnode *brt, *nbrt;
2566
2567         BRIDGE_LOCK_ASSERT(sc);
2568
2569         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2570                 if (brt->brt_ifp == ifp && (full ||
2571                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2572                         bridge_rtnode_destroy(sc, brt);
2573         }
2574 }
2575
2576 /*
2577  * bridge_rtable_init:
2578  *
2579  *      Initialize the route table for this bridge.
2580  */
2581 static int
2582 bridge_rtable_init(struct bridge_softc *sc)
2583 {
2584         int i;
2585
2586         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2587             M_DEVBUF, M_NOWAIT);
2588         if (sc->sc_rthash == NULL)
2589                 return (ENOMEM);
2590
2591         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2592                 LIST_INIT(&sc->sc_rthash[i]);
2593
2594         sc->sc_rthash_key = arc4random();
2595
2596         LIST_INIT(&sc->sc_rtlist);
2597
2598         return (0);
2599 }
2600
2601 /*
2602  * bridge_rtable_fini:
2603  *
2604  *      Deconstruct the route table for this bridge.
2605  */
2606 static void
2607 bridge_rtable_fini(struct bridge_softc *sc)
2608 {
2609
2610         free(sc->sc_rthash, M_DEVBUF);
2611 }
2612
2613 /*
2614  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2615  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2616  */
2617 #define mix(a, b, c)                                                    \
2618 do {                                                                    \
2619         a -= b; a -= c; a ^= (c >> 13);                                 \
2620         b -= c; b -= a; b ^= (a << 8);                                  \
2621         c -= a; c -= b; c ^= (b >> 13);                                 \
2622         a -= b; a -= c; a ^= (c >> 12);                                 \
2623         b -= c; b -= a; b ^= (a << 16);                                 \
2624         c -= a; c -= b; c ^= (b >> 5);                                  \
2625         a -= b; a -= c; a ^= (c >> 3);                                  \
2626         b -= c; b -= a; b ^= (a << 10);                                 \
2627         c -= a; c -= b; c ^= (b >> 15);                                 \
2628 } while (/*CONSTCOND*/0)
2629
2630 static __inline uint32_t
2631 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2632 {
2633         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2634
2635         b += addr[5] << 8;
2636         b += addr[4];
2637         a += addr[3] << 24;
2638         a += addr[2] << 16;
2639         a += addr[1] << 8;
2640         a += addr[0];
2641
2642         mix(a, b, c);
2643
2644         return (c & BRIDGE_RTHASH_MASK);
2645 }
2646
2647 #undef mix
2648
2649 static int
2650 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2651 {
2652         int i, d;
2653
2654         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2655                 d = ((int)a[i]) - ((int)b[i]);
2656         }
2657
2658         return (d);
2659 }
2660
2661 /*
2662  * bridge_rtnode_lookup:
2663  *
2664  *      Look up a bridge route node for the specified destination.
2665  */
2666 static struct bridge_rtnode *
2667 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2668 {
2669         struct bridge_rtnode *brt;
2670         uint32_t hash;
2671         int dir;
2672
2673         BRIDGE_LOCK_ASSERT(sc);
2674
2675         hash = bridge_rthash(sc, addr);
2676         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2677                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2678                 if (dir == 0)
2679                         return (brt);
2680                 if (dir > 0)
2681                         return (NULL);
2682         }
2683
2684         return (NULL);
2685 }
2686
2687 /*
2688  * bridge_rtnode_insert:
2689  *
2690  *      Insert the specified bridge node into the route table.  We
2691  *      assume the entry is not already in the table.
2692  */
2693 static int
2694 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2695 {
2696         struct bridge_rtnode *lbrt;
2697         uint32_t hash;
2698         int dir;
2699
2700         BRIDGE_LOCK_ASSERT(sc);
2701
2702         hash = bridge_rthash(sc, brt->brt_addr);
2703
2704         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2705         if (lbrt == NULL) {
2706                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2707                 goto out;
2708         }
2709
2710         do {
2711                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2712                 if (dir == 0)
2713                         return (EEXIST);
2714                 if (dir > 0) {
2715                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2716                         goto out;
2717                 }
2718                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2719                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2720                         goto out;
2721                 }
2722                 lbrt = LIST_NEXT(lbrt, brt_hash);
2723         } while (lbrt != NULL);
2724
2725 #ifdef DIAGNOSTIC
2726         panic("bridge_rtnode_insert: impossible");
2727 #endif
2728
2729 out:
2730         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2731         sc->sc_brtcnt++;
2732
2733         return (0);
2734 }
2735
2736 /*
2737  * bridge_rtnode_destroy:
2738  *
2739  *      Destroy a bridge rtnode.
2740  */
2741 static void
2742 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2743 {
2744         BRIDGE_LOCK_ASSERT(sc);
2745
2746         LIST_REMOVE(brt, brt_hash);
2747
2748         LIST_REMOVE(brt, brt_list);
2749         sc->sc_brtcnt--;
2750         uma_zfree(bridge_rtnode_zone, brt);
2751 }
2752
2753 /*
2754  * bridge_rtable_expire:
2755  *
2756  *      Set the expiry time for all routes on an interface.
2757  */
2758 static void
2759 bridge_rtable_expire(struct ifnet *ifp, int age)
2760 {
2761         struct bridge_softc *sc = ifp->if_bridge;
2762         struct bridge_rtnode *brt;
2763
2764         BRIDGE_LOCK(sc);
2765
2766         /*
2767          * If the age is zero then flush, otherwise set all the expiry times to
2768          * age for the interface
2769          */
2770         if (age == 0)
2771                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
2772         else {
2773                 LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
2774                         /* Cap the expiry time to 'age' */
2775                         if (brt->brt_ifp == ifp &&
2776                             brt->brt_expire > time_uptime + age &&
2777                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2778                                 brt->brt_expire = time_uptime + age;
2779                 }
2780         }
2781         BRIDGE_UNLOCK(sc);
2782 }
2783
2784 /*
2785  * bridge_state_change:
2786  *
2787  *      Callback from the bridgestp code when a port changes states.
2788  */
2789 static void
2790 bridge_state_change(struct ifnet *ifp, int state)
2791 {
2792         struct bridge_softc *sc = ifp->if_bridge;
2793         static const char *stpstates[] = {
2794                 "disabled",
2795                 "listening",
2796                 "learning",
2797                 "forwarding",
2798                 "blocking",
2799                 "discarding"
2800         };
2801
2802         if (log_stp)
2803                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
2804                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
2805 }
2806
2807 /*
2808  * Send bridge packets through pfil if they are one of the types pfil can deal
2809  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2810  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2811  * that interface.
2812  */
2813 static int
2814 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2815 {
2816         int snap, error, i, hlen;
2817         struct ether_header *eh1, eh2;
2818         struct ip_fw_args args;
2819         struct ip *ip;
2820         struct llc llc1;
2821         u_int16_t ether_type;
2822
2823         snap = 0;
2824         error = -1;     /* Default error if not error == 0 */
2825
2826 #if 0
2827         /* we may return with the IP fields swapped, ensure its not shared */
2828         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2829 #endif
2830
2831         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2832                 return (0); /* filtering is disabled */
2833
2834         i = min((*mp)->m_pkthdr.len, max_protohdr);
2835         if ((*mp)->m_len < i) {
2836             *mp = m_pullup(*mp, i);
2837             if (*mp == NULL) {
2838                 printf("%s: m_pullup failed\n", __func__);
2839                 return (-1);
2840             }
2841         }
2842
2843         eh1 = mtod(*mp, struct ether_header *);
2844         ether_type = ntohs(eh1->ether_type);
2845
2846         /*
2847          * Check for SNAP/LLC.
2848          */
2849         if (ether_type < ETHERMTU) {
2850                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2851
2852                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2853                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2854                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2855                     llc2->llc_control == LLC_UI) {
2856                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2857                         snap = 1;
2858                 }
2859         }
2860
2861         /*
2862          * If we're trying to filter bridge traffic, don't look at anything
2863          * other than IP and ARP traffic.  If the filter doesn't understand
2864          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2865          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2866          * but of course we don't have an AppleTalk filter to begin with.
2867          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2868          * ARP traffic.)
2869          */
2870         switch (ether_type) {
2871                 case ETHERTYPE_ARP:
2872                 case ETHERTYPE_REVARP:
2873                         if (pfil_ipfw_arp == 0)
2874                                 return (0); /* Automatically pass */
2875                         break;
2876
2877                 case ETHERTYPE_IP:
2878 #ifdef INET6
2879                 case ETHERTYPE_IPV6:
2880 #endif /* INET6 */
2881                         break;
2882                 default:
2883                         /*
2884                          * Check to see if the user wants to pass non-ip
2885                          * packets, these will not be checked by pfil(9) and
2886                          * passed unconditionally so the default is to drop.
2887                          */
2888                         if (pfil_onlyip)
2889                                 goto bad;
2890         }
2891
2892         /* Strip off the Ethernet header and keep a copy. */
2893         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2894         m_adj(*mp, ETHER_HDR_LEN);
2895
2896         /* Strip off snap header, if present */
2897         if (snap) {
2898                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2899                 m_adj(*mp, sizeof(struct llc));
2900         }
2901
2902         /*
2903          * Check the IP header for alignment and errors
2904          */
2905         if (dir == PFIL_IN) {
2906                 switch (ether_type) {
2907                         case ETHERTYPE_IP:
2908                                 error = bridge_ip_checkbasic(mp);
2909                                 break;
2910 #ifdef INET6
2911                         case ETHERTYPE_IPV6:
2912                                 error = bridge_ip6_checkbasic(mp);
2913                                 break;
2914 #endif /* INET6 */
2915                         default:
2916                                 error = 0;
2917                 }
2918                 if (error)
2919                         goto bad;
2920         }
2921
2922         if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
2923                 error = -1;
2924                 args.rule = ip_dn_claim_rule(*mp);
2925                 if (args.rule != NULL && fw_one_pass)
2926                         goto ipfwpass; /* packet already partially processed */
2927
2928                 args.m = *mp;
2929                 args.oif = ifp;
2930                 args.next_hop = NULL;
2931                 args.eh = &eh2;
2932                 args.inp = NULL;        /* used by ipfw uid/gid/jail rules */
2933                 i = ip_fw_chk_ptr(&args);
2934                 *mp = args.m;
2935
2936                 if (*mp == NULL)
2937                         return (error);
2938
2939                 if (DUMMYNET_LOADED && (i == IP_FW_DUMMYNET)) {
2940
2941                         /* put the Ethernet header back on */
2942                         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2943                         if (*mp == NULL)
2944                                 return (error);
2945                         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2946
2947                         /*
2948                          * Pass the pkt to dummynet, which consumes it. The
2949                          * packet will return to us via bridge_dummynet().
2950                          */
2951                         args.oif = ifp;
2952                         ip_dn_io_ptr(*mp, DN_TO_IFB_FWD, &args);
2953                         return (error);
2954                 }
2955
2956                 if (i != IP_FW_PASS) /* drop */
2957                         goto bad;
2958         }
2959
2960 ipfwpass:
2961         error = 0;
2962
2963         /*
2964          * Run the packet through pfil
2965          */
2966         switch (ether_type) {
2967         case ETHERTYPE_IP:
2968                 /*
2969                  * before calling the firewall, swap fields the same as
2970                  * IP does. here we assume the header is contiguous
2971                  */
2972                 ip = mtod(*mp, struct ip *);
2973
2974                 ip->ip_len = ntohs(ip->ip_len);
2975                 ip->ip_off = ntohs(ip->ip_off);
2976
2977                 /*
2978                  * Run pfil on the member interface and the bridge, both can
2979                  * be skipped by clearing pfil_member or pfil_bridge.
2980                  *
2981                  * Keep the order:
2982                  *   in_if -> bridge_if -> out_if
2983                  */
2984                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2985                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2986                                         dir, NULL);
2987
2988                 if (*mp == NULL || error != 0) /* filter may consume */
2989                         break;
2990
2991                 if (pfil_member && ifp != NULL)
2992                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2993                                         dir, NULL);
2994
2995                 if (*mp == NULL || error != 0) /* filter may consume */
2996                         break;
2997
2998                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2999                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
3000                                         dir, NULL);
3001
3002                 if (*mp == NULL || error != 0) /* filter may consume */
3003                         break;
3004
3005                 /* check if we need to fragment the packet */
3006                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
3007                         i = (*mp)->m_pkthdr.len;
3008                         if (i > ifp->if_mtu) {
3009                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
3010                                             &llc1);
3011                                 return (error);
3012                         }
3013                 }
3014
3015                 /* Recalculate the ip checksum and restore byte ordering */
3016                 ip = mtod(*mp, struct ip *);
3017                 hlen = ip->ip_hl << 2;
3018                 if (hlen < sizeof(struct ip))
3019                         goto bad;
3020                 if (hlen > (*mp)->m_len) {
3021                         if ((*mp = m_pullup(*mp, hlen)) == 0)
3022                                 goto bad;
3023                         ip = mtod(*mp, struct ip *);
3024                         if (ip == NULL)
3025                                 goto bad;
3026                 }
3027                 ip->ip_len = htons(ip->ip_len);
3028                 ip->ip_off = htons(ip->ip_off);
3029                 ip->ip_sum = 0;
3030                 if (hlen == sizeof(struct ip))
3031                         ip->ip_sum = in_cksum_hdr(ip);
3032                 else
3033                         ip->ip_sum = in_cksum(*mp, hlen);
3034
3035                 break;
3036 #ifdef INET6
3037         case ETHERTYPE_IPV6:
3038                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3039                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
3040                                         dir, NULL);
3041
3042                 if (*mp == NULL || error != 0) /* filter may consume */
3043                         break;
3044
3045                 if (pfil_member && ifp != NULL)
3046                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
3047                                         dir, NULL);
3048
3049                 if (*mp == NULL || error != 0) /* filter may consume */
3050                         break;
3051
3052                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
3053                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
3054                                         dir, NULL);
3055                 break;
3056 #endif
3057         default:
3058                 error = 0;
3059                 break;
3060         }
3061
3062         if (*mp == NULL)
3063                 return (error);
3064         if (error != 0)
3065                 goto bad;
3066
3067         error = -1;
3068
3069         /*
3070          * Finally, put everything back the way it was and return
3071          */
3072         if (snap) {
3073                 M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
3074                 if (*mp == NULL)
3075                         return (error);
3076                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3077         }
3078
3079         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
3080         if (*mp == NULL)
3081                 return (error);
3082         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3083
3084         return (0);
3085
3086 bad:
3087         m_freem(*mp);
3088         *mp = NULL;
3089         return (error);
3090 }
3091
3092 /*
3093  * Perform basic checks on header size since
3094  * pfil assumes ip_input has already processed
3095  * it for it.  Cut-and-pasted from ip_input.c.
3096  * Given how simple the IPv6 version is,
3097  * does the IPv4 version really need to be
3098  * this complicated?
3099  *
3100  * XXX Should we update ipstat here, or not?
3101  * XXX Right now we update ipstat but not
3102  * XXX csum_counter.
3103  */
3104 static int
3105 bridge_ip_checkbasic(struct mbuf **mp)
3106 {
3107         struct mbuf *m = *mp;
3108         struct ip *ip;
3109         int len, hlen;
3110         u_short sum;
3111
3112         if (*mp == NULL)
3113                 return (-1);
3114
3115         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3116                 if ((m = m_copyup(m, sizeof(struct ip),
3117                         (max_linkhdr + 3) & ~3)) == NULL) {
3118                         /* XXXJRT new stat, please */
3119                         ipstat.ips_toosmall++;
3120                         goto bad;
3121                 }
3122         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
3123                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3124                         ipstat.ips_toosmall++;
3125                         goto bad;
3126                 }
3127         }
3128         ip = mtod(m, struct ip *);
3129         if (ip == NULL) goto bad;
3130
3131         if (ip->ip_v != IPVERSION) {
3132                 ipstat.ips_badvers++;
3133                 goto bad;
3134         }
3135         hlen = ip->ip_hl << 2;
3136         if (hlen < sizeof(struct ip)) { /* minimum header length */
3137                 ipstat.ips_badhlen++;
3138                 goto bad;
3139         }
3140         if (hlen > m->m_len) {
3141                 if ((m = m_pullup(m, hlen)) == 0) {
3142                         ipstat.ips_badhlen++;
3143                         goto bad;
3144                 }
3145                 ip = mtod(m, struct ip *);
3146                 if (ip == NULL) goto bad;
3147         }
3148
3149         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3150                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3151         } else {
3152                 if (hlen == sizeof(struct ip)) {
3153                         sum = in_cksum_hdr(ip);
3154                 } else {
3155                         sum = in_cksum(m, hlen);
3156                 }
3157         }
3158         if (sum) {
3159                 ipstat.ips_badsum++;
3160                 goto bad;
3161         }
3162
3163         /* Retrieve the packet length. */
3164         len = ntohs(ip->ip_len);
3165
3166         /*
3167          * Check for additional length bogosity
3168          */
3169         if (len < hlen) {
3170                 ipstat.ips_badlen++;
3171                 goto bad;
3172         }
3173
3174         /*
3175          * Check that the amount of data in the buffers
3176          * is as at least much as the IP header would have us expect.
3177          * Drop packet if shorter than we expect.
3178          */
3179         if (m->m_pkthdr.len < len) {
3180                 ipstat.ips_tooshort++;
3181                 goto bad;
3182         }
3183
3184         /* Checks out, proceed */
3185         *mp = m;
3186         return (0);
3187
3188 bad:
3189         *mp = m;
3190         return (-1);
3191 }
3192
3193 #ifdef INET6
3194 /*
3195  * Same as above, but for IPv6.
3196  * Cut-and-pasted from ip6_input.c.
3197  * XXX Should we update ip6stat, or not?
3198  */
3199 static int
3200 bridge_ip6_checkbasic(struct mbuf **mp)
3201 {
3202         struct mbuf *m = *mp;
3203         struct ip6_hdr *ip6;
3204
3205         /*
3206          * If the IPv6 header is not aligned, slurp it up into a new
3207          * mbuf with space for link headers, in the event we forward
3208          * it.  Otherwise, if it is aligned, make sure the entire base
3209          * IPv6 header is in the first mbuf of the chain.
3210          */
3211         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3212                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3213                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3214                             (max_linkhdr + 3) & ~3)) == NULL) {
3215                         /* XXXJRT new stat, please */
3216                         ip6stat.ip6s_toosmall++;
3217                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3218                         goto bad;
3219                 }
3220         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3221                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3222                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3223                         ip6stat.ip6s_toosmall++;
3224                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3225                         goto bad;
3226                 }
3227         }
3228
3229         ip6 = mtod(m, struct ip6_hdr *);
3230
3231         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3232                 ip6stat.ip6s_badvers++;
3233                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3234                 goto bad;
3235         }
3236
3237         /* Checks out, proceed */
3238         *mp = m;
3239         return (0);
3240
3241 bad:
3242         *mp = m;
3243         return (-1);
3244 }
3245 #endif /* INET6 */
3246
3247 /*
3248  * bridge_fragment:
3249  *
3250  *      Return a fragmented mbuf chain.
3251  */
3252 static int
3253 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3254     int snap, struct llc *llc)
3255 {
3256         struct mbuf *m0;
3257         struct ip *ip;
3258         int error = -1;
3259
3260         if (m->m_len < sizeof(struct ip) &&
3261             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3262                 goto out;
3263         ip = mtod(m, struct ip *);
3264
3265         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3266                     CSUM_DELAY_IP);
3267         if (error)
3268                 goto out;
3269
3270         /* walk the chain and re-add the Ethernet header */
3271         for (m0 = m; m0; m0 = m0->m_nextpkt) {
3272                 if (error == 0) {
3273                         if (snap) {
3274                                 M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3275                                 if (m0 == NULL) {
3276                                         error = ENOBUFS;
3277                                         continue;
3278                                 }
3279                                 bcopy(llc, mtod(m0, caddr_t),
3280                                     sizeof(struct llc));
3281                         }
3282                         M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3283                         if (m0 == NULL) {
3284                                 error = ENOBUFS;
3285                                 continue;
3286                         }
3287                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3288                 } else
3289                         m_freem(m);
3290         }
3291
3292         if (error == 0)
3293                 ipstat.ips_fragmented++;
3294
3295         return (error);
3296
3297 out:
3298         if (m != NULL)
3299                 m_freem(m);
3300         return (error);
3301 }