sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-4-Clause
   5  *
   6  * Copyright 2001 Wasabi Systems, Inc.
   7  * All rights reserved.
   8  *
   9  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. All advertising materials mentioning features or use of this software
  20  *    must display the following acknowledgement:
  21  *      This product includes software developed for the NetBSD Project by
  22  *      Wasabi Systems, Inc.
  23  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  24  *    or promote products derived from this software without specific prior
  25  *    written permission.
  26  *
  27  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  37  * POSSIBILITY OF SUCH DAMAGE.
  38  */
  39
  40 /*
  41  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  42  * All rights reserved.
  43  *
  44  * Redistribution and use in source and binary forms, with or without
  45  * modification, are permitted provided that the following conditions
  46  * are met:
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  * 2. Redistributions in binary form must reproduce the above copyright
  50  *    notice, this list of conditions and the following disclaimer in the
  51  *    documentation and/or other materials provided with the distribution.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  54  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  55  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  56  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  57  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  58  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  59  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  61  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  62  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  63  * POSSIBILITY OF SUCH DAMAGE.
  64  *
  65  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  66  */
  67
  68 /*
  69  * Network interface bridge support.
  70  *
  71  * TODO:
  72  *
  73  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  74  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  75  *        to bridge other types of interfaces (maybe consider
  76  *        heterogeneous bridges).
  77  */
  78
  79 #include <sys/cdefs.h>
  80 __FBSDID("$FreeBSD$");
  81
  82 #include "opt_inet.h"
  83 #include "opt_inet6.h"
  84
  85 #include <sys/param.h>
  86 #include <sys/eventhandler.h>
  87 #include <sys/mbuf.h>
  88 #include <sys/malloc.h>
  89 #include <sys/protosw.h>
  90 #include <sys/systm.h>
  91 #include <sys/jail.h>
  92 #include <sys/time.h>
  93 #include <sys/socket.h> /* for net/if.h */
  94 #include <sys/sockio.h>
  95 #include <sys/ctype.h>  /* string functions */
  96 #include <sys/kernel.h>
  97 #include <sys/random.h>
  98 #include <sys/syslog.h>
  99 #include <sys/sysctl.h>
 100 #include <vm/uma.h>
 101 #include <sys/module.h>
 102 #include <sys/priv.h>
 103 #include <sys/proc.h>
 104 #include <sys/lock.h>
 105 #include <sys/mutex.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_clone.h>
 110 #include <net/if_dl.h>
 111 #include <net/if_types.h>
 112 #include <net/if_var.h>
 113 #include <net/pfil.h>
 114 #include <net/vnet.h>
 115
 116 #include <netinet/in.h>
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #include <netinet6/in6_ifattach.h>
 125 #endif
 126 #if defined(INET) || defined(INET6)
 127 #include <netinet/ip_carp.h>
 128 #endif
 129 #include <machine/in_cksum.h>
 130 #include <netinet/if_ether.h>
 131 #include <net/bridgestp.h>
 132 #include <net/if_bridgevar.h>
 133 #include <net/if_llc.h>
 134 #include <net/if_vlan_var.h>
 135
 136 #include <net/route.h>
 137
 138 #ifdef INET6
 139 /*
 140  * XXX: declare here to avoid to include many inet6 related files..
 141  * should be more generalized?
 142  */
 143 extern void     nd6_setmtu(struct ifnet *);
 144 #endif
 145
 146 /*
 147  * Size of the route hash table.  Must be a power of two.
 148  */
 149 #ifndef BRIDGE_RTHASH_SIZE
 150 #define BRIDGE_RTHASH_SIZE              1024
 151 #endif
 152
 153 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 154
 155 /*
 156  * Default maximum number of addresses to cache.
 157  */
 158 #ifndef BRIDGE_RTABLE_MAX
 159 #define BRIDGE_RTABLE_MAX               2000
 160 #endif
 161
 162 /*
 163  * Timeout (in seconds) for entries learned dynamically.
 164  */
 165 #ifndef BRIDGE_RTABLE_TIMEOUT
 166 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 167 #endif
 168
 169 /*
 170  * Number of seconds between walks of the route list.
 171  */
 172 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 173 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 174 #endif
 175
 176 /*
 177  * List of capabilities to possibly mask on the member interface.
 178  */
 179 #define BRIDGE_IFCAPS_MASK              (IFCAP_TOE|IFCAP_TSO|IFCAP_TXCSUM|\
 180                                          IFCAP_TXCSUM_IPV6)
 181
 182 /*
 183  * List of capabilities to strip
 184  */
 185 #define BRIDGE_IFCAPS_STRIP             IFCAP_LRO
 186
 187 /*
 188  * Bridge locking
 189  *
 190  * The bridge relies heavily on the epoch(9) system to protect its data
 191  * structures. This means we can safely use CK_LISTs while in NET_EPOCH, but we
 192  * must ensure there is only one writer at a time.
 193  *
 194  * That is: for read accesses we only need to be in NET_EPOCH, but for write
 195  * accesses we must hold:
 196  *
 197  *  - BRIDGE_RT_LOCK, for any change to bridge_rtnodes
 198  *  - BRIDGE_LOCK, for any other change
 199  *
 200  * The BRIDGE_LOCK is a sleepable lock, because it is held accross ioctl()
 201  * calls to bridge member interfaces and these ioctl()s can sleep.
 202  * The BRIDGE_RT_LOCK is a non-sleepable mutex, because it is sometimes
 203  * required while we're in NET_EPOCH and then we're not allowed to sleep.
 204  */
 205 #define BRIDGE_LOCK_INIT(_sc)           do {                    \
 206         sx_init(&(_sc)->sc_sx, "if_bridge");                    \
 207         mtx_init(&(_sc)->sc_rt_mtx, "if_bridge rt", NULL, MTX_DEF);     \
 208 } while (0)
 209 #define BRIDGE_LOCK_DESTROY(_sc)        do {    \
 210         sx_destroy(&(_sc)->sc_sx);              \
 211         mtx_destroy(&(_sc)->sc_rt_mtx);         \
 212 } while (0)
 213 #define BRIDGE_LOCK(_sc)                sx_xlock(&(_sc)->sc_sx)
 214 #define BRIDGE_UNLOCK(_sc)              sx_xunlock(&(_sc)->sc_sx)
 215 #define BRIDGE_LOCK_ASSERT(_sc)         sx_assert(&(_sc)->sc_sx, SX_XLOCKED)
 216 #define BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(_sc)    \
 217             MPASS(in_epoch(net_epoch_preempt) || sx_xlocked(&(_sc)->sc_sx))
 218 #define BRIDGE_UNLOCK_ASSERT(_sc)       sx_assert(&(_sc)->sc_sx, SX_UNLOCKED)
 219 #define BRIDGE_RT_LOCK(_sc)             mtx_lock(&(_sc)->sc_rt_mtx)
 220 #define BRIDGE_RT_UNLOCK(_sc)           mtx_unlock(&(_sc)->sc_rt_mtx)
 221 #define BRIDGE_RT_LOCK_ASSERT(_sc)      mtx_assert(&(_sc)->sc_rt_mtx, MA_OWNED)
 222 #define BRIDGE_RT_LOCK_OR_NET_EPOCH_ASSERT(_sc) \
 223             MPASS(in_epoch(net_epoch_preempt) || mtx_owned(&(_sc)->sc_rt_mtx))
 224
 225 /*
 226  * Bridge interface list entry.
 227  */
 228 struct bridge_iflist {
 229         CK_LIST_ENTRY(bridge_iflist) bif_next;
 230         struct ifnet            *bif_ifp;       /* member if */
 231         struct bstp_port        bif_stp;        /* STP state */
 232         uint32_t                bif_flags;      /* member if flags */
 233         int                     bif_savedcaps;  /* saved capabilities */
 234         uint32_t                bif_addrmax;    /* max # of addresses */
 235         uint32_t                bif_addrcnt;    /* cur. # of addresses */
 236         uint32_t                bif_addrexceeded;/* # of address violations */
 237
 238         struct epoch_context    bif_epoch_ctx;
 239 };
 240
 241 /*
 242  * Bridge route node.
 243  */
 244 struct bridge_rtnode {
 245         CK_LIST_ENTRY(bridge_rtnode) brt_hash;  /* hash table linkage */
 246         CK_LIST_ENTRY(bridge_rtnode) brt_list;  /* list linkage */
 247         struct bridge_iflist    *brt_dst;       /* destination if */
 248         unsigned long           brt_expire;     /* expiration time */
 249         uint8_t                 brt_flags;      /* address flags */
 250         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 251         uint16_t                brt_vlan;       /* vlan id */
 252
 253         struct  vnet            *brt_vnet;
 254         struct  epoch_context   brt_epoch_ctx;
 255 };
 256 #define brt_ifp                 brt_dst->bif_ifp
 257
 258 /*
 259  * Software state for each bridge.
 260  */
 261 struct bridge_softc {
 262         struct ifnet            *sc_ifp;        /* make this an interface */
 263         LIST_ENTRY(bridge_softc) sc_list;
 264         struct sx               sc_sx;
 265         struct mtx              sc_rt_mtx;
 266         uint32_t                sc_brtmax;      /* max # of addresses */
 267         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 268         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 269         struct callout          sc_brcallout;   /* bridge callout */
 270         CK_LIST_HEAD(, bridge_iflist) sc_iflist;        /* member interface list */
 271         CK_LIST_HEAD(, bridge_rtnode) *sc_rthash;       /* our forwarding table */
 272         CK_LIST_HEAD(, bridge_rtnode) sc_rtlist;        /* list version of above */
 273         uint32_t                sc_rthash_key;  /* key for hash */
 274         CK_LIST_HEAD(, bridge_iflist) sc_spanlist;      /* span ports list */
 275         struct bstp_state       sc_stp;         /* STP state */
 276         uint32_t                sc_brtexceeded; /* # of cache drops */
 277         struct ifnet            *sc_ifaddr;     /* member mac copied from */
 278         struct ether_addr       sc_defaddr;     /* Default MAC address */
 279
 280         struct epoch_context    sc_epoch_ctx;
 281 };
 282
 283 VNET_DEFINE_STATIC(struct sx, bridge_list_sx);
 284 #define V_bridge_list_sx        VNET(bridge_list_sx)
 285 static eventhandler_tag bridge_detach_cookie;
 286
 287 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 288
 289 VNET_DEFINE_STATIC(uma_zone_t, bridge_rtnode_zone);
 290 #define V_bridge_rtnode_zone    VNET(bridge_rtnode_zone)
 291
 292 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
 293 static void     bridge_clone_destroy(struct ifnet *);
 294
 295 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 296 static void     bridge_mutecaps(struct bridge_softc *);
 297 static void     bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
 298                     int);
 299 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 300 static void     bridge_init(void *);
 301 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 302 static void     bridge_stop(struct ifnet *, int);
 303 static int      bridge_transmit(struct ifnet *, struct mbuf *);
 304 static void     bridge_qflush(struct ifnet *);
 305 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 306 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 307                     struct rtentry *);
 308 static int      bridge_enqueue(struct bridge_softc *, struct ifnet *,
 309                     struct mbuf *);
 310 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 311
 312 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
 313                     struct mbuf *m);
 314
 315 static void     bridge_timer(void *);
 316
 317 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 318                     struct mbuf *, int);
 319 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 320
 321 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 322                     uint16_t, struct bridge_iflist *, int, uint8_t);
 323 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *,
 324                     uint16_t);
 325 static void     bridge_rttrim(struct bridge_softc *);
 326 static void     bridge_rtage(struct bridge_softc *);
 327 static void     bridge_rtflush(struct bridge_softc *, int);
 328 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *,
 329                     uint16_t);
 330
 331 static void     bridge_rtable_init(struct bridge_softc *);
 332 static void     bridge_rtable_fini(struct bridge_softc *);
 333
 334 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 335 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 336                     const uint8_t *, uint16_t);
 337 static int      bridge_rtnode_insert(struct bridge_softc *,
 338                     struct bridge_rtnode *);
 339 static void     bridge_rtnode_destroy(struct bridge_softc *,
 340                     struct bridge_rtnode *);
 341 static void     bridge_rtable_expire(struct ifnet *, int);
 342 static void     bridge_state_change(struct ifnet *, int);
 343
 344 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 345                     const char *name);
 346 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 347                     struct ifnet *ifp);
 348 static void     bridge_delete_member(struct bridge_softc *,
 349                     struct bridge_iflist *, int);
 350 static void     bridge_delete_span(struct bridge_softc *,
 351                     struct bridge_iflist *);
 352
 353 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 354 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 355 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 356 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 357 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 358 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 359 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 360 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 361 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 362 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 363 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 364 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 365 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 366 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 367 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 368 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 369 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 370 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 371 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 372 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 373 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 374 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 375 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 376 static int      bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *);
 377 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 378 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 379 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 380 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 381 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 382 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
 383 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
 384 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 385                     int);
 386 static int      bridge_ip_checkbasic(struct mbuf **mp);
 387 #ifdef INET6
 388 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 389 #endif /* INET6 */
 390 static int      bridge_fragment(struct ifnet *, struct mbuf **mp,
 391                     struct ether_header *, int, struct llc *);
 392 static void     bridge_linkstate(struct ifnet *ifp);
 393 static void     bridge_linkcheck(struct bridge_softc *sc);
 394
 395
 396 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
 397 #define VLANTAGOF(_m)   \
 398     (_m->m_flags & M_VLANTAG) ? EVL_VLANOFTAG(_m->m_pkthdr.ether_vtag) : 1
 399
 400 static struct bstp_cb_ops bridge_ops = {
 401         .bcb_state = bridge_state_change,
 402         .bcb_rtage = bridge_rtable_expire
 403 };
 404
 405 SYSCTL_DECL(_net_link);
 406 static SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 407
 408 /* only pass IP[46] packets when pfil is enabled */
 409 VNET_DEFINE_STATIC(int, pfil_onlyip) = 1;
 410 #define V_pfil_onlyip   VNET(pfil_onlyip)
 411 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip,
 412     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_onlyip), 0,
 413     "Only pass IP packets when pfil is enabled");
 414
 415 /* run pfil hooks on the bridge interface */
 416 VNET_DEFINE_STATIC(int, pfil_bridge) = 1;
 417 #define V_pfil_bridge   VNET(pfil_bridge)
 418 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge,
 419     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_bridge), 0,
 420     "Packet filter on the bridge interface");
 421
 422 /* layer2 filter with ipfw */
 423 VNET_DEFINE_STATIC(int, pfil_ipfw);
 424 #define V_pfil_ipfw     VNET(pfil_ipfw)
 425
 426 /* layer2 ARP filter with ipfw */
 427 VNET_DEFINE_STATIC(int, pfil_ipfw_arp);
 428 #define V_pfil_ipfw_arp VNET(pfil_ipfw_arp)
 429 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp,
 430     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_ipfw_arp), 0,
 431     "Filter ARP packets through IPFW layer2");
 432
 433 /* run pfil hooks on the member interface */
 434 VNET_DEFINE_STATIC(int, pfil_member) = 1;
 435 #define V_pfil_member   VNET(pfil_member)
 436 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member,
 437     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_member), 0,
 438     "Packet filter on the member interface");
 439
 440 /* run pfil hooks on the physical interface for locally destined packets */
 441 VNET_DEFINE_STATIC(int, pfil_local_phys);
 442 #define V_pfil_local_phys       VNET(pfil_local_phys)
 443 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys,
 444     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_local_phys), 0,
 445     "Packet filter on the physical interface for locally destined packets");
 446
 447 /* log STP state changes */
 448 VNET_DEFINE_STATIC(int, log_stp);
 449 #define V_log_stp       VNET(log_stp)
 450 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp,
 451     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(log_stp), 0,
 452     "Log STP state changes");
 453
 454 /* share MAC with first bridge member */
 455 VNET_DEFINE_STATIC(int, bridge_inherit_mac);
 456 #define V_bridge_inherit_mac    VNET(bridge_inherit_mac)
 457 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac,
 458     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(bridge_inherit_mac), 0,
 459     "Inherit MAC address from the first bridge member");
 460
 461 VNET_DEFINE_STATIC(int, allow_llz_overlap) = 0;
 462 #define V_allow_llz_overlap     VNET(allow_llz_overlap)
 463 SYSCTL_INT(_net_link_bridge, OID_AUTO, allow_llz_overlap,
 464     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(allow_llz_overlap), 0,
 465     "Allow overlap of link-local scope "
 466     "zones of a bridge interface and the member interfaces");
 467
 468 struct bridge_control {
 469         int     (*bc_func)(struct bridge_softc *, void *);
 470         int     bc_argsize;
 471         int     bc_flags;
 472 };
 473
 474 #define BC_F_COPYIN             0x01    /* copy arguments in */
 475 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 476 #define BC_F_SUSER              0x04    /* do super-user check */
 477
 478 const struct bridge_control bridge_control_table[] = {
 479         { bridge_ioctl_add,             sizeof(struct ifbreq),
 480           BC_F_COPYIN|BC_F_SUSER },
 481         { bridge_ioctl_del,             sizeof(struct ifbreq),
 482           BC_F_COPYIN|BC_F_SUSER },
 483
 484         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 485           BC_F_COPYIN|BC_F_COPYOUT },
 486         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 487           BC_F_COPYIN|BC_F_SUSER },
 488
 489         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 490           BC_F_COPYIN|BC_F_SUSER },
 491         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 492           BC_F_COPYOUT },
 493
 494         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 495           BC_F_COPYIN|BC_F_COPYOUT },
 496         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 497           BC_F_COPYIN|BC_F_COPYOUT },
 498
 499         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 500           BC_F_COPYIN|BC_F_SUSER },
 501
 502         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 503           BC_F_COPYIN|BC_F_SUSER },
 504         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 505           BC_F_COPYOUT },
 506
 507         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 508           BC_F_COPYIN|BC_F_SUSER },
 509
 510         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 511           BC_F_COPYIN|BC_F_SUSER },
 512
 513         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 514           BC_F_COPYOUT },
 515         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 516           BC_F_COPYIN|BC_F_SUSER },
 517
 518         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 519           BC_F_COPYOUT },
 520         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 521           BC_F_COPYIN|BC_F_SUSER },
 522
 523         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 524           BC_F_COPYOUT },
 525         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 526           BC_F_COPYIN|BC_F_SUSER },
 527
 528         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 529           BC_F_COPYOUT },
 530         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 531           BC_F_COPYIN|BC_F_SUSER },
 532
 533         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 534           BC_F_COPYIN|BC_F_SUSER },
 535
 536         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 537           BC_F_COPYIN|BC_F_SUSER },
 538
 539         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 540           BC_F_COPYIN|BC_F_SUSER },
 541         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 542           BC_F_COPYIN|BC_F_SUSER },
 543
 544         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 545           BC_F_COPYOUT },
 546
 547         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 548           BC_F_COPYOUT },
 549
 550         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 551           BC_F_COPYIN|BC_F_COPYOUT },
 552
 553         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
 554           BC_F_COPYIN|BC_F_SUSER },
 555
 556         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
 557           BC_F_COPYIN|BC_F_SUSER },
 558
 559         { bridge_ioctl_sifmaxaddr,      sizeof(struct ifbreq),
 560           BC_F_COPYIN|BC_F_SUSER },
 561
 562 };
 563 const int bridge_control_table_size = nitems(bridge_control_table);
 564
 565 VNET_DEFINE_STATIC(LIST_HEAD(, bridge_softc), bridge_list);
 566 #define V_bridge_list   VNET(bridge_list)
 567 #define BRIDGE_LIST_LOCK_INIT(x)        sx_init(&V_bridge_list_sx,      \
 568                                             "if_bridge list")
 569 #define BRIDGE_LIST_LOCK_DESTROY(x)     sx_destroy(&V_bridge_list_sx)
 570 #define BRIDGE_LIST_LOCK(x)             sx_xlock(&V_bridge_list_sx)
 571 #define BRIDGE_LIST_UNLOCK(x)           sx_xunlock(&V_bridge_list_sx)
 572
 573 VNET_DEFINE_STATIC(struct if_clone *, bridge_cloner);
 574 #define V_bridge_cloner VNET(bridge_cloner)
 575
 576 static const char bridge_name[] = "bridge";
 577
 578 static void
 579 vnet_bridge_init(const void *unused __unused)
 580 {
 581
 582         V_bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 583             sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 584             UMA_ALIGN_PTR, 0);
 585         BRIDGE_LIST_LOCK_INIT();
 586         LIST_INIT(&V_bridge_list);
 587         V_bridge_cloner = if_clone_simple(bridge_name,
 588             bridge_clone_create, bridge_clone_destroy, 0);
 589 }
 590 VNET_SYSINIT(vnet_bridge_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
 591     vnet_bridge_init, NULL);
 592
 593 static void
 594 vnet_bridge_uninit(const void *unused __unused)
 595 {
 596
 597         if_clone_detach(V_bridge_cloner);
 598         V_bridge_cloner = NULL;
 599         BRIDGE_LIST_LOCK_DESTROY();
 600
 601         /* Before we can destroy the uma zone, because there are callbacks that
 602          * use it. */
 603         epoch_drain_callbacks(net_epoch_preempt);
 604
 605         uma_zdestroy(V_bridge_rtnode_zone);
 606 }
 607 VNET_SYSUNINIT(vnet_bridge_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY,
 608     vnet_bridge_uninit, NULL);
 609
 610 static int
 611 bridge_modevent(module_t mod, int type, void *data)
 612 {
 613
 614         switch (type) {
 615         case MOD_LOAD:
 616                 bridge_dn_p = bridge_dummynet;
 617                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 618                     ifnet_departure_event, bridge_ifdetach, NULL,
 619                     EVENTHANDLER_PRI_ANY);
 620                 break;
 621         case MOD_UNLOAD:
 622                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 623                     bridge_detach_cookie);
 624                 bridge_dn_p = NULL;
 625                 break;
 626         default:
 627                 return (EOPNOTSUPP);
 628         }
 629         return (0);
 630 }
 631
 632 static moduledata_t bridge_mod = {
 633         "if_bridge",
 634         bridge_modevent,
 635         0
 636 };
 637
 638 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 639 MODULE_VERSION(if_bridge, 1);
 640 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 641
 642 /*
 643  * handler for net.link.bridge.ipfw
 644  */
 645 static int
 646 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 647 {
 648         int enable = V_pfil_ipfw;
 649         int error;
 650
 651         error = sysctl_handle_int(oidp, &enable, 0, req);
 652         enable &= 1;
 653
 654         if (enable != V_pfil_ipfw) {
 655                 V_pfil_ipfw = enable;
 656
 657                 /*
 658                  * Disable pfil so that ipfw doesnt run twice, if the user
 659                  * really wants both then they can re-enable pfil_bridge and/or
 660                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 661                  * layer2 type.
 662                  */
 663                 if (V_pfil_ipfw) {
 664                         V_pfil_onlyip = 0;
 665                         V_pfil_bridge = 0;
 666                         V_pfil_member = 0;
 667                 }
 668         }
 669
 670         return (error);
 671 }
 672 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw,
 673     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_VNET,
 674     &VNET_NAME(pfil_ipfw), 0, &sysctl_pfil_ipfw, "I",
 675     "Layer2 filter with IPFW");
 676
 677 /*
 678  * bridge_clone_create:
 679  *
 680  *      Create a new bridge instance.
 681  */
 682 static int
 683 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 684 {
 685         struct bridge_softc *sc, *sc2;
 686         struct ifnet *bifp, *ifp;
 687         int fb, retry;
 688         unsigned long hostid;
 689
 690         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 691         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 692         if (ifp == NULL) {
 693                 free(sc, M_DEVBUF);
 694                 return (ENOSPC);
 695         }
 696
 697         BRIDGE_LOCK_INIT(sc);
 698         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 699         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 700
 701         /* Initialize our routing table. */
 702         bridge_rtable_init(sc);
 703
 704         callout_init_mtx(&sc->sc_brcallout, &sc->sc_rt_mtx, 0);
 705
 706         CK_LIST_INIT(&sc->sc_iflist);
 707         CK_LIST_INIT(&sc->sc_spanlist);
 708
 709         ifp->if_softc = sc;
 710         if_initname(ifp, bridge_name, unit);
 711         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 712         ifp->if_ioctl = bridge_ioctl;
 713         ifp->if_transmit = bridge_transmit;
 714         ifp->if_qflush = bridge_qflush;
 715         ifp->if_init = bridge_init;
 716         ifp->if_type = IFT_BRIDGE;
 717
 718         /*
 719          * Generate an ethernet address with a locally administered address.
 720          *
 721          * Since we are using random ethernet addresses for the bridge, it is
 722          * possible that we might have address collisions, so make sure that
 723          * this hardware address isn't already in use on another bridge.
 724          * The first try uses the hostid and falls back to arc4rand().
 725          */
 726         fb = 0;
 727         getcredhostid(curthread->td_ucred, &hostid);
 728         do {
 729                 if (fb || hostid == 0) {
 730                         ether_gen_addr(ifp, &sc->sc_defaddr);
 731                 } else {
 732                         sc->sc_defaddr.octet[0] = 0x2;
 733                         sc->sc_defaddr.octet[1] = (hostid >> 24) & 0xff;
 734                         sc->sc_defaddr.octet[2] = (hostid >> 16) & 0xff;
 735                         sc->sc_defaddr.octet[3] = (hostid >> 8 ) & 0xff;
 736                         sc->sc_defaddr.octet[4] =  hostid        & 0xff;
 737                         sc->sc_defaddr.octet[5] = ifp->if_dunit & 0xff;
 738                 }
 739
 740                 fb = 1;
 741                 retry = 0;
 742                 BRIDGE_LIST_LOCK();
 743                 LIST_FOREACH(sc2, &V_bridge_list, sc_list) {
 744                         bifp = sc2->sc_ifp;
 745                         if (memcmp(sc->sc_defaddr.octet,
 746                             IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
 747                                 retry = 1;
 748                                 break;
 749                         }
 750                 }
 751                 BRIDGE_LIST_UNLOCK();
 752         } while (retry == 1);
 753
 754         bstp_attach(&sc->sc_stp, &bridge_ops);
 755         ether_ifattach(ifp, sc->sc_defaddr.octet);
 756         /* Now undo some of the damage... */
 757         ifp->if_baudrate = 0;
 758         ifp->if_type = IFT_BRIDGE;
 759
 760         BRIDGE_LIST_LOCK();
 761         LIST_INSERT_HEAD(&V_bridge_list, sc, sc_list);
 762         BRIDGE_LIST_UNLOCK();
 763
 764         return (0);
 765 }
 766
 767 static void
 768 bridge_clone_destroy_cb(struct epoch_context *ctx)
 769 {
 770         struct bridge_softc *sc;
 771
 772         sc = __containerof(ctx, struct bridge_softc, sc_epoch_ctx);
 773
 774         BRIDGE_LOCK_DESTROY(sc);
 775         free(sc, M_DEVBUF);
 776 }
 777
 778 /*
 779  * bridge_clone_destroy:
 780  *
 781  *      Destroy a bridge instance.
 782  */
 783 static void
 784 bridge_clone_destroy(struct ifnet *ifp)
 785 {
 786         struct bridge_softc *sc = ifp->if_softc;
 787         struct bridge_iflist *bif;
 788         struct epoch_tracker et;
 789
 790         BRIDGE_LOCK(sc);
 791
 792         bridge_stop(ifp, 1);
 793         ifp->if_flags &= ~IFF_UP;
 794
 795         while ((bif = CK_LIST_FIRST(&sc->sc_iflist)) != NULL)
 796                 bridge_delete_member(sc, bif, 0);
 797
 798         while ((bif = CK_LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 799                 bridge_delete_span(sc, bif);
 800         }
 801
 802         /* Tear down the routing table. */
 803         bridge_rtable_fini(sc);
 804
 805         BRIDGE_UNLOCK(sc);
 806
 807         NET_EPOCH_ENTER_ET(et);
 808
 809         callout_drain(&sc->sc_brcallout);
 810
 811         BRIDGE_LIST_LOCK();
 812         LIST_REMOVE(sc, sc_list);
 813         BRIDGE_LIST_UNLOCK();
 814
 815         bstp_detach(&sc->sc_stp);
 816         NET_EPOCH_EXIT_ET(et);
 817
 818         ether_ifdetach(ifp);
 819         if_free(ifp);
 820
 821         epoch_call(net_epoch_preempt, &sc->sc_epoch_ctx, bridge_clone_destroy_cb);
 822 }
 823
 824 /*
 825  * bridge_ioctl:
 826  *
 827  *      Handle a control request from the operator.
 828  */
 829 static int
 830 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 831 {
 832         struct bridge_softc *sc = ifp->if_softc;
 833         struct ifreq *ifr = (struct ifreq *)data;
 834         struct bridge_iflist *bif;
 835         struct thread *td = curthread;
 836         union {
 837                 struct ifbreq ifbreq;
 838                 struct ifbifconf ifbifconf;
 839                 struct ifbareq ifbareq;
 840                 struct ifbaconf ifbaconf;
 841                 struct ifbrparam ifbrparam;
 842                 struct ifbropreq ifbropreq;
 843         } args;
 844         struct ifdrv *ifd = (struct ifdrv *) data;
 845         const struct bridge_control *bc;
 846         int error = 0, oldmtu;
 847
 848         BRIDGE_LOCK(sc);
 849
 850         switch (cmd) {
 851
 852         case SIOCADDMULTI:
 853         case SIOCDELMULTI:
 854                 break;
 855
 856         case SIOCGDRVSPEC:
 857         case SIOCSDRVSPEC:
 858                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 859                         error = EINVAL;
 860                         break;
 861                 }
 862                 bc = &bridge_control_table[ifd->ifd_cmd];
 863
 864                 if (cmd == SIOCGDRVSPEC &&
 865                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 866                         error = EINVAL;
 867                         break;
 868                 }
 869                 else if (cmd == SIOCSDRVSPEC &&
 870                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 871                         error = EINVAL;
 872                         break;
 873                 }
 874
 875                 if (bc->bc_flags & BC_F_SUSER) {
 876                         error = priv_check(td, PRIV_NET_BRIDGE);
 877                         if (error)
 878                                 break;
 879                 }
 880
 881                 if (ifd->ifd_len != bc->bc_argsize ||
 882                     ifd->ifd_len > sizeof(args)) {
 883                         error = EINVAL;
 884                         break;
 885                 }
 886
 887                 bzero(&args, sizeof(args));
 888                 if (bc->bc_flags & BC_F_COPYIN) {
 889                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 890                         if (error)
 891                                 break;
 892                 }
 893
 894                 oldmtu = ifp->if_mtu;
 895                 error = (*bc->bc_func)(sc, &args);
 896                 if (error)
 897                         break;
 898
 899                 /*
 900                  * Bridge MTU may change during addition of the first port.
 901                  * If it did, do network layer specific procedure.
 902                  */
 903                 if (ifp->if_mtu != oldmtu) {
 904 #ifdef INET6
 905                         nd6_setmtu(ifp);
 906 #endif
 907                         rt_updatemtu(ifp);
 908                 }
 909
 910                 if (bc->bc_flags & BC_F_COPYOUT)
 911                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 912
 913                 break;
 914
 915         case SIOCSIFFLAGS:
 916                 if (!(ifp->if_flags & IFF_UP) &&
 917                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 918                         /*
 919                          * If interface is marked down and it is running,
 920                          * then stop and disable it.
 921                          */
 922                         bridge_stop(ifp, 1);
 923                 } else if ((ifp->if_flags & IFF_UP) &&
 924                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 925                         /*
 926                          * If interface is marked up and it is stopped, then
 927                          * start it.
 928                          */
 929                         BRIDGE_UNLOCK(sc);
 930                         (*ifp->if_init)(sc);
 931                         BRIDGE_LOCK(sc);
 932                 }
 933                 break;
 934
 935         case SIOCSIFMTU:
 936                 if (ifr->ifr_mtu < 576) {
 937                         error = EINVAL;
 938                         break;
 939                 }
 940                 if (CK_LIST_EMPTY(&sc->sc_iflist)) {
 941                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 942                         break;
 943                 }
 944                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 945                         if (bif->bif_ifp->if_mtu != ifr->ifr_mtu) {
 946                                 log(LOG_NOTICE, "%s: invalid MTU: %u(%s)"
 947                                     " != %d\n", sc->sc_ifp->if_xname,
 948                                     bif->bif_ifp->if_mtu,
 949                                     bif->bif_ifp->if_xname, ifr->ifr_mtu);
 950                                 error = EINVAL;
 951                                 break;
 952                         }
 953                 }
 954                 if (!error)
 955                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 956                 break;
 957         default:
 958                 /*
 959                  * drop the lock as ether_ioctl() will call bridge_start() and
 960                  * cause the lock to be recursed.
 961                  */
 962                 BRIDGE_UNLOCK(sc);
 963                 error = ether_ioctl(ifp, cmd, data);
 964                 BRIDGE_LOCK(sc);
 965                 break;
 966         }
 967
 968         BRIDGE_UNLOCK(sc);
 969
 970         return (error);
 971 }
 972
 973 /*
 974  * bridge_mutecaps:
 975  *
 976  *      Clear or restore unwanted capabilities on the member interface
 977  */
 978 static void
 979 bridge_mutecaps(struct bridge_softc *sc)
 980 {
 981         struct bridge_iflist *bif;
 982         int enabled, mask;
 983
 984         BRIDGE_LOCK_ASSERT(sc);
 985
 986         /* Initial bitmask of capabilities to test */
 987         mask = BRIDGE_IFCAPS_MASK;
 988
 989         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 990                 /* Every member must support it or its disabled */
 991                 mask &= bif->bif_savedcaps;
 992         }
 993
 994         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 995                 enabled = bif->bif_ifp->if_capenable;
 996                 enabled &= ~BRIDGE_IFCAPS_STRIP;
 997                 /* strip off mask bits and enable them again if allowed */
 998                 enabled &= ~BRIDGE_IFCAPS_MASK;
 999                 enabled |= mask;
1000                 bridge_set_ifcap(sc, bif, enabled);
1001         }
1002 }
1003
1004 static void
1005 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
1006 {
1007         struct ifnet *ifp = bif->bif_ifp;
1008         struct ifreq ifr;
1009         int error, mask, stuck;
1010
1011         bzero(&ifr, sizeof(ifr));
1012         ifr.ifr_reqcap = set;
1013
1014         if (ifp->if_capenable != set) {
1015                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
1016                 if (error)
1017                         if_printf(sc->sc_ifp,
1018                             "error setting capabilities on %s: %d\n",
1019                             ifp->if_xname, error);
1020                 mask = BRIDGE_IFCAPS_MASK | BRIDGE_IFCAPS_STRIP;
1021                 stuck = ifp->if_capenable & mask & ~set;
1022                 if (stuck != 0)
1023                         if_printf(sc->sc_ifp,
1024                             "can't disable some capabilities on %s: 0x%x\n",
1025                             ifp->if_xname, stuck);
1026         }
1027 }
1028
1029 /*
1030  * bridge_lookup_member:
1031  *
1032  *      Lookup a bridge member interface.
1033  */
1034 static struct bridge_iflist *
1035 bridge_lookup_member(struct bridge_softc *sc, const char *name)
1036 {
1037         struct bridge_iflist *bif;
1038         struct ifnet *ifp;
1039
1040         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
1041
1042         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1043                 ifp = bif->bif_ifp;
1044                 if (strcmp(ifp->if_xname, name) == 0)
1045                         return (bif);
1046         }
1047
1048         return (NULL);
1049 }
1050
1051 /*
1052  * bridge_lookup_member_if:
1053  *
1054  *      Lookup a bridge member interface by ifnet*.
1055  */
1056 static struct bridge_iflist *
1057 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
1058 {
1059         struct bridge_iflist *bif;
1060
1061         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
1062
1063         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1064                 if (bif->bif_ifp == member_ifp)
1065                         return (bif);
1066         }
1067
1068         return (NULL);
1069 }
1070
1071 static void
1072 bridge_delete_member_cb(struct epoch_context *ctx)
1073 {
1074         struct bridge_iflist *bif;
1075
1076         bif = __containerof(ctx, struct bridge_iflist, bif_epoch_ctx);
1077
1078         free(bif, M_DEVBUF);
1079 }
1080
1081 /*
1082  * bridge_delete_member:
1083  *
1084  *      Delete the specified member interface.
1085  */
1086 static void
1087 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
1088     int gone)
1089 {
1090         struct ifnet *ifs = bif->bif_ifp;
1091         struct ifnet *fif = NULL;
1092         struct bridge_iflist *bifl;
1093
1094         BRIDGE_LOCK_ASSERT(sc);
1095
1096         if (bif->bif_flags & IFBIF_STP)
1097                 bstp_disable(&bif->bif_stp);
1098
1099         ifs->if_bridge = NULL;
1100         CK_LIST_REMOVE(bif, bif_next);
1101
1102         /*
1103          * If removing the interface that gave the bridge its mac address, set
1104          * the mac address of the bridge to the address of the next member, or
1105          * to its default address if no members are left.
1106          */
1107         if (V_bridge_inherit_mac && sc->sc_ifaddr == ifs) {
1108                 if (CK_LIST_EMPTY(&sc->sc_iflist)) {
1109                         bcopy(&sc->sc_defaddr,
1110                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1111                         sc->sc_ifaddr = NULL;
1112                 } else {
1113                         bifl = CK_LIST_FIRST(&sc->sc_iflist);
1114                         fif = bifl->bif_ifp;
1115                         bcopy(IF_LLADDR(fif),
1116                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1117                         sc->sc_ifaddr = fif;
1118                 }
1119                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1120         }
1121
1122         bridge_linkcheck(sc);
1123         bridge_mutecaps(sc);    /* recalcuate now this interface is removed */
1124         BRIDGE_RT_LOCK(sc);
1125         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
1126         BRIDGE_RT_UNLOCK(sc);
1127         KASSERT(bif->bif_addrcnt == 0,
1128             ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
1129
1130         ifs->if_bridge_output = NULL;
1131         ifs->if_bridge_input = NULL;
1132         ifs->if_bridge_linkstate = NULL;
1133         if (!gone) {
1134                 switch (ifs->if_type) {
1135                 case IFT_ETHER:
1136                 case IFT_L2VLAN:
1137                         /*
1138                          * Take the interface out of promiscuous mode, but only
1139                          * if it was promiscuous in the first place. It might
1140                          * not be if we're in the bridge_ioctl_add() error path.
1141                          */
1142                         if (ifs->if_flags & IFF_PROMISC)
1143                                 (void) ifpromisc(ifs, 0);
1144                         break;
1145
1146                 case IFT_GIF:
1147                         break;
1148
1149                 default:
1150 #ifdef DIAGNOSTIC
1151                         panic("bridge_delete_member: impossible");
1152 #endif
1153                         break;
1154                 }
1155                 /* reneable any interface capabilities */
1156                 bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
1157         }
1158         bstp_destroy(&bif->bif_stp);    /* prepare to free */
1159
1160         epoch_call(net_epoch_preempt, &bif->bif_epoch_ctx,
1161             bridge_delete_member_cb);
1162 }
1163
1164 /*
1165  * bridge_delete_span:
1166  *
1167  *      Delete the specified span interface.
1168  */
1169 static void
1170 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
1171 {
1172         BRIDGE_LOCK_ASSERT(sc);
1173
1174         KASSERT(bif->bif_ifp->if_bridge == NULL,
1175             ("%s: not a span interface", __func__));
1176
1177         CK_LIST_REMOVE(bif, bif_next);
1178
1179         epoch_call(net_epoch_preempt, &bif->bif_epoch_ctx,
1180             bridge_delete_member_cb);
1181 }
1182
1183 static int
1184 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
1185 {
1186         struct ifbreq *req = arg;
1187         struct bridge_iflist *bif = NULL;
1188         struct ifnet *ifs;
1189         int error = 0;
1190
1191         ifs = ifunit(req->ifbr_ifsname);
1192         if (ifs == NULL)
1193                 return (ENOENT);
1194         if (ifs->if_ioctl == NULL)      /* must be supported */
1195                 return (EINVAL);
1196
1197         /* If it's in the span list, it can't be a member. */
1198         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1199                 if (ifs == bif->bif_ifp)
1200                         return (EBUSY);
1201
1202         if (ifs->if_bridge == sc)
1203                 return (EEXIST);
1204
1205         if (ifs->if_bridge != NULL)
1206                 return (EBUSY);
1207
1208         switch (ifs->if_type) {
1209         case IFT_ETHER:
1210         case IFT_L2VLAN:
1211         case IFT_GIF:
1212                 /* permitted interface types */
1213                 break;
1214         default:
1215                 return (EINVAL);
1216         }
1217
1218 #ifdef INET6
1219         /*
1220          * Two valid inet6 addresses with link-local scope must not be
1221          * on the parent interface and the member interfaces at the
1222          * same time.  This restriction is needed to prevent violation
1223          * of link-local scope zone.  Attempts to add a member
1224          * interface which has inet6 addresses when the parent has
1225          * inet6 triggers removal of all inet6 addresses on the member
1226          * interface.
1227          */
1228
1229         /* Check if the parent interface has a link-local scope addr. */
1230         if (V_allow_llz_overlap == 0 &&
1231             in6ifa_llaonifp(sc->sc_ifp) != NULL) {
1232                 /*
1233                  * If any, remove all inet6 addresses from the member
1234                  * interfaces.
1235                  */
1236                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1237                         if (in6ifa_llaonifp(bif->bif_ifp)) {
1238                                 in6_ifdetach(bif->bif_ifp);
1239                                 if_printf(sc->sc_ifp,
1240                                     "IPv6 addresses on %s have been removed "
1241                                     "before adding it as a member to prevent "
1242                                     "IPv6 address scope violation.\n",
1243                                     bif->bif_ifp->if_xname);
1244                         }
1245                 }
1246                 if (in6ifa_llaonifp(ifs)) {
1247                         in6_ifdetach(ifs);
1248                         if_printf(sc->sc_ifp,
1249                             "IPv6 addresses on %s have been removed "
1250                             "before adding it as a member to prevent "
1251                             "IPv6 address scope violation.\n",
1252                             ifs->if_xname);
1253                 }
1254         }
1255 #endif
1256         /* Allow the first Ethernet member to define the MTU */
1257         if (CK_LIST_EMPTY(&sc->sc_iflist))
1258                 sc->sc_ifp->if_mtu = ifs->if_mtu;
1259         else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
1260                 if_printf(sc->sc_ifp, "invalid MTU: %u(%s) != %u\n",
1261                     ifs->if_mtu, ifs->if_xname, sc->sc_ifp->if_mtu);
1262                 return (EINVAL);
1263         }
1264
1265         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1266         if (bif == NULL)
1267                 return (ENOMEM);
1268
1269         bif->bif_ifp = ifs;
1270         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
1271         bif->bif_savedcaps = ifs->if_capenable;
1272
1273         /*
1274          * Assign the interface's MAC address to the bridge if it's the first
1275          * member and the MAC address of the bridge has not been changed from
1276          * the default randomly generated one.
1277          */
1278         if (V_bridge_inherit_mac && CK_LIST_EMPTY(&sc->sc_iflist) &&
1279             !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr.octet, ETHER_ADDR_LEN)) {
1280                 bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1281                 sc->sc_ifaddr = ifs;
1282                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1283         }
1284
1285         ifs->if_bridge = sc;
1286         ifs->if_bridge_output = bridge_output;
1287         ifs->if_bridge_input = bridge_input;
1288         ifs->if_bridge_linkstate = bridge_linkstate;
1289         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
1290         /*
1291          * XXX: XLOCK HERE!?!
1292          *
1293          * NOTE: insert_***HEAD*** should be safe for the traversals.
1294          */
1295         CK_LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
1296
1297         /* Set interface capabilities to the intersection set of all members */
1298         bridge_mutecaps(sc);
1299         bridge_linkcheck(sc);
1300
1301         /* Place the interface into promiscuous mode */
1302         switch (ifs->if_type) {
1303                 case IFT_ETHER:
1304                 case IFT_L2VLAN:
1305                         error = ifpromisc(ifs, 1);
1306                         break;
1307         }
1308
1309         if (error)
1310                 bridge_delete_member(sc, bif, 0);
1311         return (error);
1312 }
1313
1314 static int
1315 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1316 {
1317         struct ifbreq *req = arg;
1318         struct bridge_iflist *bif;
1319
1320         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1321         if (bif == NULL)
1322                 return (ENOENT);
1323
1324         bridge_delete_member(sc, bif, 0);
1325
1326         return (0);
1327 }
1328
1329 static int
1330 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1331 {
1332         struct ifbreq *req = arg;
1333         struct bridge_iflist *bif;
1334         struct bstp_port *bp;
1335
1336         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1337         if (bif == NULL)
1338                 return (ENOENT);
1339
1340         bp = &bif->bif_stp;
1341         req->ifbr_ifsflags = bif->bif_flags;
1342         req->ifbr_state = bp->bp_state;
1343         req->ifbr_priority = bp->bp_priority;
1344         req->ifbr_path_cost = bp->bp_path_cost;
1345         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1346         req->ifbr_proto = bp->bp_protover;
1347         req->ifbr_role = bp->bp_role;
1348         req->ifbr_stpflags = bp->bp_flags;
1349         req->ifbr_addrcnt = bif->bif_addrcnt;
1350         req->ifbr_addrmax = bif->bif_addrmax;
1351         req->ifbr_addrexceeded = bif->bif_addrexceeded;
1352
1353         /* Copy STP state options as flags */
1354         if (bp->bp_operedge)
1355                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1356         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1357                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1358         if (bp->bp_ptp_link)
1359                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1360         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1361                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1362         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1363                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1364         if (bp->bp_flags & BSTP_PORT_ADMCOST)
1365                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1366         return (0);
1367 }
1368
1369 static int
1370 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1371 {
1372         struct ifbreq *req = arg;
1373         struct bridge_iflist *bif;
1374         struct bstp_port *bp;
1375         int error;
1376
1377         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1378         if (bif == NULL)
1379                 return (ENOENT);
1380         bp = &bif->bif_stp;
1381
1382         if (req->ifbr_ifsflags & IFBIF_SPAN)
1383                 /* SPAN is readonly */
1384                 return (EINVAL);
1385
1386         if (req->ifbr_ifsflags & IFBIF_STP) {
1387                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1388                         error = bstp_enable(&bif->bif_stp);
1389                         if (error)
1390                                 return (error);
1391                 }
1392         } else {
1393                 if ((bif->bif_flags & IFBIF_STP) != 0)
1394                         bstp_disable(&bif->bif_stp);
1395         }
1396
1397         /* Pass on STP flags */
1398         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1399         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1400         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1401         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1402
1403         /* Save the bits relating to the bridge */
1404         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1405
1406         return (0);
1407 }
1408
1409 static int
1410 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1411 {
1412         struct ifbrparam *param = arg;
1413
1414         sc->sc_brtmax = param->ifbrp_csize;
1415         bridge_rttrim(sc);
1416
1417         return (0);
1418 }
1419
1420 static int
1421 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1422 {
1423         struct ifbrparam *param = arg;
1424
1425         param->ifbrp_csize = sc->sc_brtmax;
1426
1427         return (0);
1428 }
1429
1430 static int
1431 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1432 {
1433         struct ifbifconf *bifc = arg;
1434         struct bridge_iflist *bif;
1435         struct ifbreq breq;
1436         char *buf, *outbuf;
1437         int count, buflen, len, error = 0;
1438
1439         count = 0;
1440         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1441                 count++;
1442         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1443                 count++;
1444
1445         buflen = sizeof(breq) * count;
1446         if (bifc->ifbic_len == 0) {
1447                 bifc->ifbic_len = buflen;
1448                 return (0);
1449         }
1450         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1451         if (outbuf == NULL)
1452                 return (ENOMEM);
1453
1454         count = 0;
1455         buf = outbuf;
1456         len = min(bifc->ifbic_len, buflen);
1457         bzero(&breq, sizeof(breq));
1458         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1459                 if (len < sizeof(breq))
1460                         break;
1461
1462                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1463                     sizeof(breq.ifbr_ifsname));
1464                 /* Fill in the ifbreq structure */
1465                 error = bridge_ioctl_gifflags(sc, &breq);
1466                 if (error)
1467                         break;
1468                 memcpy(buf, &breq, sizeof(breq));
1469                 count++;
1470                 buf += sizeof(breq);
1471                 len -= sizeof(breq);
1472         }
1473         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1474                 if (len < sizeof(breq))
1475                         break;
1476
1477                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1478                     sizeof(breq.ifbr_ifsname));
1479                 breq.ifbr_ifsflags = bif->bif_flags;
1480                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1481                 memcpy(buf, &breq, sizeof(breq));
1482                 count++;
1483                 buf += sizeof(breq);
1484                 len -= sizeof(breq);
1485         }
1486
1487         bifc->ifbic_len = sizeof(breq) * count;
1488         error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
1489         free(outbuf, M_TEMP);
1490         return (error);
1491 }
1492
1493 static int
1494 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1495 {
1496         struct ifbaconf *bac = arg;
1497         struct bridge_rtnode *brt;
1498         struct ifbareq bareq;
1499         char *buf, *outbuf;
1500         int count, buflen, len, error = 0;
1501
1502         if (bac->ifbac_len == 0)
1503                 return (0);
1504
1505         count = 0;
1506         CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
1507                 count++;
1508         buflen = sizeof(bareq) * count;
1509
1510         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1511         if (outbuf == NULL)
1512                 return (ENOMEM);
1513
1514         count = 0;
1515         buf = outbuf;
1516         len = min(bac->ifbac_len, buflen);
1517         bzero(&bareq, sizeof(bareq));
1518         CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1519                 if (len < sizeof(bareq))
1520                         goto out;
1521                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1522                     sizeof(bareq.ifba_ifsname));
1523                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1524                 bareq.ifba_vlan = brt->brt_vlan;
1525                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1526                                 time_uptime < brt->brt_expire)
1527                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1528                 else
1529                         bareq.ifba_expire = 0;
1530                 bareq.ifba_flags = brt->brt_flags;
1531
1532                 memcpy(buf, &bareq, sizeof(bareq));
1533                 count++;
1534                 buf += sizeof(bareq);
1535                 len -= sizeof(bareq);
1536         }
1537 out:
1538         bac->ifbac_len = sizeof(bareq) * count;
1539         error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
1540         free(outbuf, M_TEMP);
1541         return (error);
1542 }
1543
1544 static int
1545 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1546 {
1547         struct ifbareq *req = arg;
1548         struct bridge_iflist *bif;
1549         struct epoch_tracker et;
1550         int error;
1551
1552         NET_EPOCH_ENTER_ET(et);
1553
1554         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1555         if (bif == NULL) {
1556                 NET_EPOCH_EXIT_ET(et);
1557                 return (ENOENT);
1558         }
1559
1560         /* bridge_rtupdate() may acquire the lock. */
1561         error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
1562             req->ifba_flags);
1563         NET_EPOCH_EXIT_ET(et);
1564
1565         return (error);
1566 }
1567
1568 static int
1569 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1570 {
1571         struct ifbrparam *param = arg;
1572
1573         sc->sc_brttimeout = param->ifbrp_ctime;
1574         return (0);
1575 }
1576
1577 static int
1578 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1579 {
1580         struct ifbrparam *param = arg;
1581
1582         param->ifbrp_ctime = sc->sc_brttimeout;
1583         return (0);
1584 }
1585
1586 static int
1587 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1588 {
1589         struct ifbareq *req = arg;
1590
1591         return (bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan));
1592 }
1593
1594 static int
1595 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1596 {
1597         struct ifbreq *req = arg;
1598
1599         BRIDGE_RT_LOCK(sc);
1600         bridge_rtflush(sc, req->ifbr_ifsflags);
1601         BRIDGE_RT_UNLOCK(sc);
1602
1603         return (0);
1604 }
1605
1606 static int
1607 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1608 {
1609         struct ifbrparam *param = arg;
1610         struct bstp_state *bs = &sc->sc_stp;
1611
1612         param->ifbrp_prio = bs->bs_bridge_priority;
1613         return (0);
1614 }
1615
1616 static int
1617 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1618 {
1619         struct ifbrparam *param = arg;
1620
1621         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1622 }
1623
1624 static int
1625 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1626 {
1627         struct ifbrparam *param = arg;
1628         struct bstp_state *bs = &sc->sc_stp;
1629
1630         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1631         return (0);
1632 }
1633
1634 static int
1635 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1636 {
1637         struct ifbrparam *param = arg;
1638
1639         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1640 }
1641
1642 static int
1643 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1644 {
1645         struct ifbrparam *param = arg;
1646         struct bstp_state *bs = &sc->sc_stp;
1647
1648         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1649         return (0);
1650 }
1651
1652 static int
1653 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1654 {
1655         struct ifbrparam *param = arg;
1656
1657         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1658 }
1659
1660 static int
1661 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1662 {
1663         struct ifbrparam *param = arg;
1664         struct bstp_state *bs = &sc->sc_stp;
1665
1666         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1667         return (0);
1668 }
1669
1670 static int
1671 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1672 {
1673         struct ifbrparam *param = arg;
1674
1675         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1676 }
1677
1678 static int
1679 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1680 {
1681         struct ifbreq *req = arg;
1682         struct bridge_iflist *bif;
1683
1684         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1685         if (bif == NULL)
1686                 return (ENOENT);
1687
1688         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1689 }
1690
1691 static int
1692 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1693 {
1694         struct ifbreq *req = arg;
1695         struct bridge_iflist *bif;
1696
1697         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1698         if (bif == NULL)
1699                 return (ENOENT);
1700
1701         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1702 }
1703
1704 static int
1705 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *arg)
1706 {
1707         struct ifbreq *req = arg;
1708         struct bridge_iflist *bif;
1709
1710         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1711         if (bif == NULL)
1712                 return (ENOENT);
1713
1714         bif->bif_addrmax = req->ifbr_addrmax;
1715         return (0);
1716 }
1717
1718 static int
1719 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1720 {
1721         struct ifbreq *req = arg;
1722         struct bridge_iflist *bif = NULL;
1723         struct ifnet *ifs;
1724
1725         ifs = ifunit(req->ifbr_ifsname);
1726         if (ifs == NULL)
1727                 return (ENOENT);
1728
1729         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1730                 if (ifs == bif->bif_ifp)
1731                         return (EBUSY);
1732
1733         if (ifs->if_bridge != NULL)
1734                 return (EBUSY);
1735
1736         switch (ifs->if_type) {
1737                 case IFT_ETHER:
1738                 case IFT_GIF:
1739                 case IFT_L2VLAN:
1740                         break;
1741                 default:
1742                         return (EINVAL);
1743         }
1744
1745         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1746         if (bif == NULL)
1747                 return (ENOMEM);
1748
1749         bif->bif_ifp = ifs;
1750         bif->bif_flags = IFBIF_SPAN;
1751
1752         CK_LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1753
1754         return (0);
1755 }
1756
1757 static int
1758 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1759 {
1760         struct ifbreq *req = arg;
1761         struct bridge_iflist *bif;
1762         struct ifnet *ifs;
1763
1764         ifs = ifunit(req->ifbr_ifsname);
1765         if (ifs == NULL)
1766                 return (ENOENT);
1767
1768         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1769                 if (ifs == bif->bif_ifp)
1770                         break;
1771
1772         if (bif == NULL)
1773                 return (ENOENT);
1774
1775         bridge_delete_span(sc, bif);
1776
1777         return (0);
1778 }
1779
1780 static int
1781 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1782 {
1783         struct ifbropreq *req = arg;
1784         struct bstp_state *bs = &sc->sc_stp;
1785         struct bstp_port *root_port;
1786
1787         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1788         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1789         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1790
1791         root_port = bs->bs_root_port;
1792         if (root_port == NULL)
1793                 req->ifbop_root_port = 0;
1794         else
1795                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1796
1797         req->ifbop_holdcount = bs->bs_txholdcount;
1798         req->ifbop_priority = bs->bs_bridge_priority;
1799         req->ifbop_protocol = bs->bs_protover;
1800         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1801         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1802         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1803         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1804         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1805         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1806
1807         return (0);
1808 }
1809
1810 static int
1811 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1812 {
1813         struct ifbrparam *param = arg;
1814
1815         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1816         return (0);
1817 }
1818
1819 static int
1820 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1821 {
1822         struct ifbpstpconf *bifstp = arg;
1823         struct bridge_iflist *bif;
1824         struct bstp_port *bp;
1825         struct ifbpstpreq bpreq;
1826         char *buf, *outbuf;
1827         int count, buflen, len, error = 0;
1828
1829         count = 0;
1830         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1831                 if ((bif->bif_flags & IFBIF_STP) != 0)
1832                         count++;
1833         }
1834
1835         buflen = sizeof(bpreq) * count;
1836         if (bifstp->ifbpstp_len == 0) {
1837                 bifstp->ifbpstp_len = buflen;
1838                 return (0);
1839         }
1840
1841         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1842         if (outbuf == NULL)
1843                 return (ENOMEM);
1844
1845         count = 0;
1846         buf = outbuf;
1847         len = min(bifstp->ifbpstp_len, buflen);
1848         bzero(&bpreq, sizeof(bpreq));
1849         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1850                 if (len < sizeof(bpreq))
1851                         break;
1852
1853                 if ((bif->bif_flags & IFBIF_STP) == 0)
1854                         continue;
1855
1856                 bp = &bif->bif_stp;
1857                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1858                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1859                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1860                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1861                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1862                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1863
1864                 memcpy(buf, &bpreq, sizeof(bpreq));
1865                 count++;
1866                 buf += sizeof(bpreq);
1867                 len -= sizeof(bpreq);
1868         }
1869
1870         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1871         error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
1872         free(outbuf, M_TEMP);
1873         return (error);
1874 }
1875
1876 static int
1877 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1878 {
1879         struct ifbrparam *param = arg;
1880
1881         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1882 }
1883
1884 static int
1885 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1886 {
1887         struct ifbrparam *param = arg;
1888
1889         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1890 }
1891
1892 /*
1893  * bridge_ifdetach:
1894  *
1895  *      Detach an interface from a bridge.  Called when a member
1896  *      interface is detaching.
1897  */
1898 static void
1899 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1900 {
1901         struct bridge_softc *sc = ifp->if_bridge;
1902         struct bridge_iflist *bif;
1903
1904         if (ifp->if_flags & IFF_RENAMING)
1905                 return;
1906         if (V_bridge_cloner == NULL) {
1907                 /*
1908                  * This detach handler can be called after
1909                  * vnet_bridge_uninit().  Just return in that case.
1910                  */
1911                 return;
1912         }
1913         /* Check if the interface is a bridge member */
1914         if (sc != NULL) {
1915                 BRIDGE_LOCK(sc);
1916
1917                 bif = bridge_lookup_member_if(sc, ifp);
1918                 if (bif != NULL)
1919                         bridge_delete_member(sc, bif, 1);
1920
1921                 BRIDGE_UNLOCK(sc);
1922                 return;
1923         }
1924
1925         /* Check if the interface is a span port */
1926         BRIDGE_LIST_LOCK();
1927         LIST_FOREACH(sc, &V_bridge_list, sc_list) {
1928                 BRIDGE_LOCK(sc);
1929                 CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1930                         if (ifp == bif->bif_ifp) {
1931                                 bridge_delete_span(sc, bif);
1932                                 break;
1933                         }
1934
1935                 BRIDGE_UNLOCK(sc);
1936         }
1937         BRIDGE_LIST_UNLOCK();
1938 }
1939
1940 /*
1941  * bridge_init:
1942  *
1943  *      Initialize a bridge interface.
1944  */
1945 static void
1946 bridge_init(void *xsc)
1947 {
1948         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1949         struct ifnet *ifp = sc->sc_ifp;
1950
1951         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1952                 return;
1953
1954         BRIDGE_LOCK(sc);
1955         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1956             bridge_timer, sc);
1957
1958         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1959         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1960
1961         BRIDGE_UNLOCK(sc);
1962 }
1963
1964 /*
1965  * bridge_stop:
1966  *
1967  *      Stop the bridge interface.
1968  */
1969 static void
1970 bridge_stop(struct ifnet *ifp, int disable)
1971 {
1972         struct bridge_softc *sc = ifp->if_softc;
1973
1974         BRIDGE_LOCK_ASSERT(sc);
1975
1976         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1977                 return;
1978
1979         BRIDGE_RT_LOCK(sc);
1980         callout_stop(&sc->sc_brcallout);
1981
1982         bstp_stop(&sc->sc_stp);
1983
1984         bridge_rtflush(sc, IFBF_FLUSHDYN);
1985         BRIDGE_RT_UNLOCK(sc);
1986
1987         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1988 }
1989
1990 /*
1991  * bridge_enqueue:
1992  *
1993  *      Enqueue a packet on a bridge member interface.
1994  *
1995  */
1996 static int
1997 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1998 {
1999         int len, err = 0;
2000         short mflags;
2001         struct mbuf *m0;
2002
2003         /* We may be sending a fragment so traverse the mbuf */
2004         for (; m; m = m0) {
2005                 m0 = m->m_nextpkt;
2006                 m->m_nextpkt = NULL;
2007                 len = m->m_pkthdr.len;
2008                 mflags = m->m_flags;
2009
2010                 /*
2011                  * If underlying interface can not do VLAN tag insertion itself
2012                  * then attach a packet tag that holds it.
2013                  */
2014                 if ((m->m_flags & M_VLANTAG) &&
2015                     (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
2016                         m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
2017                         if (m == NULL) {
2018                                 if_printf(dst_ifp,
2019                                     "unable to prepend VLAN header\n");
2020                                 if_inc_counter(dst_ifp, IFCOUNTER_OERRORS, 1);
2021                                 continue;
2022                         }
2023                         m->m_flags &= ~M_VLANTAG;
2024                 }
2025
2026                 M_ASSERTPKTHDR(m); /* We shouldn't transmit mbuf without pkthdr */
2027                 if ((err = dst_ifp->if_transmit(dst_ifp, m))) {
2028                         m_freem(m0);
2029                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2030                         break;
2031                 }
2032
2033                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OPACKETS, 1);
2034                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OBYTES, len);
2035                 if (mflags & M_MCAST)
2036                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OMCASTS, 1);
2037         }
2038
2039         return (err);
2040 }
2041
2042 /*
2043  * bridge_dummynet:
2044  *
2045  *      Receive a queued packet from dummynet and pass it on to the output
2046  *      interface.
2047  *
2048  *      The mbuf has the Ethernet header already attached.
2049  */
2050 static void
2051 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
2052 {
2053         struct bridge_softc *sc;
2054
2055         sc = ifp->if_bridge;
2056
2057         /*
2058          * The packet didnt originate from a member interface. This should only
2059          * ever happen if a member interface is removed while packets are
2060          * queued for it.
2061          */
2062         if (sc == NULL) {
2063                 m_freem(m);
2064                 return;
2065         }
2066
2067         if (PFIL_HOOKED(&V_inet_pfil_hook)
2068 #ifdef INET6
2069             || PFIL_HOOKED(&V_inet6_pfil_hook)
2070 #endif
2071             ) {
2072                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
2073                         return;
2074                 if (m == NULL)
2075                         return;
2076         }
2077
2078         bridge_enqueue(sc, ifp, m);
2079 }
2080
2081 /*
2082  * bridge_output:
2083  *
2084  *      Send output from a bridge member interface.  This
2085  *      performs the bridging function for locally originated
2086  *      packets.
2087  *
2088  *      The mbuf has the Ethernet header already attached.  We must
2089  *      enqueue or free the mbuf before returning.
2090  */
2091 static int
2092 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
2093     struct rtentry *rt)
2094 {
2095         struct epoch_tracker et;
2096         struct ether_header *eh;
2097         struct ifnet *dst_if;
2098         struct bridge_softc *sc;
2099         uint16_t vlan;
2100
2101         NET_EPOCH_ENTER_ET(et);
2102
2103         if (m->m_len < ETHER_HDR_LEN) {
2104                 m = m_pullup(m, ETHER_HDR_LEN);
2105                 if (m == NULL) {
2106                         NET_EPOCH_EXIT_ET(et);
2107                         return (0);
2108                 }
2109         }
2110
2111         eh = mtod(m, struct ether_header *);
2112         sc = ifp->if_bridge;
2113         vlan = VLANTAGOF(m);
2114
2115         /*
2116          * If bridge is down, but the original output interface is up,
2117          * go ahead and send out that interface.  Otherwise, the packet
2118          * is dropped below.
2119          */
2120         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2121                 dst_if = ifp;
2122                 goto sendunicast;
2123         }
2124
2125         /*
2126          * If the packet is a multicast, or we don't know a better way to
2127          * get there, send to all interfaces.
2128          */
2129         if (ETHER_IS_MULTICAST(eh->ether_dhost))
2130                 dst_if = NULL;
2131         else
2132                 dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
2133         if (dst_if == NULL) {
2134                 struct bridge_iflist *bif;
2135                 struct mbuf *mc;
2136                 int used = 0;
2137
2138                 bridge_span(sc, m);
2139
2140                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2141                         dst_if = bif->bif_ifp;
2142
2143                         if (dst_if->if_type == IFT_GIF)
2144                                 continue;
2145                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2146                                 continue;
2147
2148                         /*
2149                          * If this is not the original output interface,
2150                          * and the interface is participating in spanning
2151                          * tree, make sure the port is in a state that
2152                          * allows forwarding.
2153                          */
2154                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
2155                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2156                                 continue;
2157
2158                         if (CK_LIST_NEXT(bif, bif_next) == NULL) {
2159                                 used = 1;
2160                                 mc = m;
2161                         } else {
2162                                 mc = m_copypacket(m, M_NOWAIT);
2163                                 if (mc == NULL) {
2164                                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2165                                         continue;
2166                                 }
2167                         }
2168
2169                         bridge_enqueue(sc, dst_if, mc);
2170                 }
2171                 if (used == 0)
2172                         m_freem(m);
2173                 NET_EPOCH_EXIT_ET(et);
2174                 return (0);
2175         }
2176
2177 sendunicast:
2178         /*
2179          * XXX Spanning tree consideration here?
2180          */
2181
2182         bridge_span(sc, m);
2183         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2184                 m_freem(m);
2185                 NET_EPOCH_EXIT_ET(et);
2186                 return (0);
2187         }
2188
2189         bridge_enqueue(sc, dst_if, m);
2190         NET_EPOCH_EXIT_ET(et);
2191         return (0);
2192 }
2193
2194 /*
2195  * bridge_transmit:
2196  *
2197  *      Do output on a bridge.
2198  *
2199  */
2200 static int
2201 bridge_transmit(struct ifnet *ifp, struct mbuf *m)
2202 {
2203         struct epoch_tracker et;
2204         struct bridge_softc *sc;
2205         struct ether_header *eh;
2206         struct ifnet *dst_if;
2207         int error = 0;
2208
2209         NET_EPOCH_ENTER_ET(et);
2210
2211         sc = ifp->if_softc;
2212
2213         ETHER_BPF_MTAP(ifp, m);
2214
2215         eh = mtod(m, struct ether_header *);
2216
2217         if (((m->m_flags & (M_BCAST|M_MCAST)) == 0) &&
2218             (dst_if = bridge_rtlookup(sc, eh->ether_dhost, 1)) != NULL) {
2219                 error = bridge_enqueue(sc, dst_if, m);
2220         } else
2221                 bridge_broadcast(sc, ifp, m, 0);
2222
2223         NET_EPOCH_EXIT_ET(et);
2224
2225         return (error);
2226 }
2227
2228 /*
2229  * The ifp->if_qflush entry point for if_bridge(4) is no-op.
2230  */
2231 static void
2232 bridge_qflush(struct ifnet *ifp __unused)
2233 {
2234 }
2235
2236 /*
2237  * bridge_forward:
2238  *
2239  *      The forwarding function of the bridge.
2240  *
2241  *      NOTE: Releases the lock on return.
2242  */
2243 static void
2244 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
2245     struct mbuf *m)
2246 {
2247         struct bridge_iflist *dbif;
2248         struct ifnet *src_if, *dst_if, *ifp;
2249         struct ether_header *eh;
2250         uint16_t vlan;
2251         uint8_t *dst;
2252         int error;
2253
2254         MPASS(in_epoch(net_epoch_preempt));
2255
2256         src_if = m->m_pkthdr.rcvif;
2257         ifp = sc->sc_ifp;
2258
2259         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
2260         if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2261         vlan = VLANTAGOF(m);
2262
2263         if ((sbif->bif_flags & IFBIF_STP) &&
2264             sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2265                 goto drop;
2266
2267         eh = mtod(m, struct ether_header *);
2268         dst = eh->ether_dhost;
2269
2270         /* If the interface is learning, record the address. */
2271         if (sbif->bif_flags & IFBIF_LEARNING) {
2272                 error = bridge_rtupdate(sc, eh->ether_shost, vlan,
2273                     sbif, 0, IFBAF_DYNAMIC);
2274                 /*
2275                  * If the interface has addresses limits then deny any source
2276                  * that is not in the cache.
2277                  */
2278                 if (error && sbif->bif_addrmax)
2279                         goto drop;
2280         }
2281
2282         if ((sbif->bif_flags & IFBIF_STP) != 0 &&
2283             sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING)
2284                 goto drop;
2285
2286         /*
2287          * At this point, the port either doesn't participate
2288          * in spanning tree or it is in the forwarding state.
2289          */
2290
2291         /*
2292          * If the packet is unicast, destined for someone on
2293          * "this" side of the bridge, drop it.
2294          */
2295         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2296                 dst_if = bridge_rtlookup(sc, dst, vlan);
2297                 if (src_if == dst_if)
2298                         goto drop;
2299         } else {
2300                 /*
2301                  * Check if its a reserved multicast address, any address
2302                  * listed in 802.1D section 7.12.6 may not be forwarded by the
2303                  * bridge.
2304                  * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
2305                  */
2306                 if (dst[0] == 0x01 && dst[1] == 0x80 &&
2307                     dst[2] == 0xc2 && dst[3] == 0x00 &&
2308                     dst[4] == 0x00 && dst[5] <= 0x0f)
2309                         goto drop;
2310
2311                 /* ...forward it to all interfaces. */
2312                 if_inc_counter(ifp, IFCOUNTER_IMCASTS, 1);
2313                 dst_if = NULL;
2314         }
2315
2316         /*
2317          * If we have a destination interface which is a member of our bridge,
2318          * OR this is a unicast packet, push it through the bpf(4) machinery.
2319          * For broadcast or multicast packets, don't bother because it will
2320          * be reinjected into ether_input. We do this before we pass the packets
2321          * through the pfil(9) framework, as it is possible that pfil(9) will
2322          * drop the packet, or possibly modify it, making it difficult to debug
2323          * firewall issues on the bridge.
2324          */
2325         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
2326                 ETHER_BPF_MTAP(ifp, m);
2327
2328         /* run the packet filter */
2329         if (PFIL_HOOKED(&V_inet_pfil_hook)
2330 #ifdef INET6
2331             || PFIL_HOOKED(&V_inet6_pfil_hook)
2332 #endif
2333             ) {
2334                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2335                         return;
2336                 if (m == NULL)
2337                         return;
2338         }
2339
2340         if (dst_if == NULL) {
2341                 bridge_broadcast(sc, src_if, m, 1);
2342                 return;
2343         }
2344
2345         /*
2346          * At this point, we're dealing with a unicast frame
2347          * going to a different interface.
2348          */
2349         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2350                 goto drop;
2351
2352         dbif = bridge_lookup_member_if(sc, dst_if);
2353         if (dbif == NULL)
2354                 /* Not a member of the bridge (anymore?) */
2355                 goto drop;
2356
2357         /* Private segments can not talk to each other */
2358         if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE)
2359                 goto drop;
2360
2361         if ((dbif->bif_flags & IFBIF_STP) &&
2362             dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2363                 goto drop;
2364
2365         if (PFIL_HOOKED(&V_inet_pfil_hook)
2366 #ifdef INET6
2367             || PFIL_HOOKED(&V_inet6_pfil_hook)
2368 #endif
2369             ) {
2370                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2371                         return;
2372                 if (m == NULL)
2373                         return;
2374         }
2375
2376         bridge_enqueue(sc, dst_if, m);
2377         return;
2378
2379 drop:
2380         m_freem(m);
2381 }
2382
2383 /*
2384  * bridge_input:
2385  *
2386  *      Receive input from a member interface.  Queue the packet for
2387  *      bridging if it is not for us.
2388  */
2389 static struct mbuf *
2390 bridge_input(struct ifnet *ifp, struct mbuf *m)
2391 {
2392         struct epoch_tracker et;
2393         struct bridge_softc *sc = ifp->if_bridge;
2394         struct bridge_iflist *bif, *bif2;
2395         struct ifnet *bifp;
2396         struct ether_header *eh;
2397         struct mbuf *mc, *mc2;
2398         uint16_t vlan;
2399         int error;
2400
2401         NET_EPOCH_ENTER_ET(et);
2402
2403         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2404                 NET_EPOCH_EXIT_ET(et);
2405                 return (m);
2406         }
2407
2408         bifp = sc->sc_ifp;
2409         vlan = VLANTAGOF(m);
2410
2411         /*
2412          * Implement support for bridge monitoring. If this flag has been
2413          * set on this interface, discard the packet once we push it through
2414          * the bpf(4) machinery, but before we do, increment the byte and
2415          * packet counters associated with this interface.
2416          */
2417         if ((bifp->if_flags & IFF_MONITOR) != 0) {
2418                 m->m_pkthdr.rcvif  = bifp;
2419                 ETHER_BPF_MTAP(bifp, m);
2420                 if_inc_counter(bifp, IFCOUNTER_IPACKETS, 1);
2421                 if_inc_counter(bifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2422                 m_freem(m);
2423                 NET_EPOCH_EXIT_ET(et);
2424                 return (NULL);
2425         }
2426         bif = bridge_lookup_member_if(sc, ifp);
2427         if (bif == NULL) {
2428                 NET_EPOCH_EXIT_ET(et);
2429                 return (m);
2430         }
2431
2432         eh = mtod(m, struct ether_header *);
2433
2434         bridge_span(sc, m);
2435
2436         if (m->m_flags & (M_BCAST|M_MCAST)) {
2437                 /* Tap off 802.1D packets; they do not get forwarded. */
2438                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2439                     ETHER_ADDR_LEN) == 0) {
2440                         bstp_input(&bif->bif_stp, ifp, m); /* consumes mbuf */
2441                         NET_EPOCH_EXIT_ET(et);
2442                         return (NULL);
2443                 }
2444
2445                 if ((bif->bif_flags & IFBIF_STP) &&
2446                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2447                         NET_EPOCH_EXIT_ET(et);
2448                         return (m);
2449                 }
2450
2451                 /*
2452                  * Make a deep copy of the packet and enqueue the copy
2453                  * for bridge processing; return the original packet for
2454                  * local processing.
2455                  */
2456                 mc = m_dup(m, M_NOWAIT);
2457                 if (mc == NULL) {
2458                         NET_EPOCH_EXIT_ET(et);
2459                         return (m);
2460                 }
2461
2462                 /* Perform the bridge forwarding function with the copy. */
2463                 bridge_forward(sc, bif, mc);
2464
2465                 /*
2466                  * Reinject the mbuf as arriving on the bridge so we have a
2467                  * chance at claiming multicast packets. We can not loop back
2468                  * here from ether_input as a bridge is never a member of a
2469                  * bridge.
2470                  */
2471                 KASSERT(bifp->if_bridge == NULL,
2472                     ("loop created in bridge_input"));
2473                 mc2 = m_dup(m, M_NOWAIT);
2474                 if (mc2 != NULL) {
2475                         /* Keep the layer3 header aligned */
2476                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2477                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2478                 }
2479                 if (mc2 != NULL) {
2480                         mc2->m_pkthdr.rcvif = bifp;
2481                         (*bifp->if_input)(bifp, mc2);
2482                 }
2483
2484                 /* Return the original packet for local processing. */
2485                 NET_EPOCH_EXIT_ET(et);
2486                 return (m);
2487         }
2488
2489         if ((bif->bif_flags & IFBIF_STP) &&
2490             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2491                 NET_EPOCH_EXIT_ET(et);
2492                 return (m);
2493         }
2494
2495 #if (defined(INET) || defined(INET6))
2496 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2497         || ((iface)->if_carp \
2498             && (*carp_forus_p)((iface), eh->ether_dhost))
2499 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2500         || ((iface)->if_carp \
2501             && (*carp_forus_p)((iface), eh->ether_shost))
2502 #else
2503 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2504 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2505 #endif
2506
2507 #ifdef INET6
2508 #   define OR_PFIL_HOOKED_INET6 \
2509         || PFIL_HOOKED(&V_inet6_pfil_hook)
2510 #else
2511 #   define OR_PFIL_HOOKED_INET6
2512 #endif
2513
2514 #define GRAB_OUR_PACKETS(iface) \
2515         if ((iface)->if_type == IFT_GIF) \
2516                 continue; \
2517         /* It is destined for us. */ \
2518         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2519             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
2520             ) {                                                         \
2521                 if ((iface)->if_type == IFT_BRIDGE) {                   \
2522                         ETHER_BPF_MTAP(iface, m);                       \
2523                         if_inc_counter(iface, IFCOUNTER_IPACKETS, 1);                           \
2524                         if_inc_counter(iface, IFCOUNTER_IBYTES, m->m_pkthdr.len);               \
2525                         /* Filter on the physical interface. */         \
2526                         if (V_pfil_local_phys &&                        \
2527                             (PFIL_HOOKED(&V_inet_pfil_hook)             \
2528                              OR_PFIL_HOOKED_INET6)) {                   \
2529                                 if (bridge_pfil(&m, NULL, ifp,          \
2530                                     PFIL_IN) != 0 || m == NULL) {       \
2531                                         NET_EPOCH_EXIT_ET(et);  \
2532                                         return (NULL);                  \
2533                                 }                                       \
2534                                 eh = mtod(m, struct ether_header *);    \
2535                         }                                               \
2536                 }                                                       \
2537                 if (bif->bif_flags & IFBIF_LEARNING) {                  \
2538                         error = bridge_rtupdate(sc, eh->ether_shost,    \
2539                             vlan, bif, 0, IFBAF_DYNAMIC);               \
2540                         if (error && bif->bif_addrmax) {                \
2541                                 m_freem(m);                             \
2542                                 NET_EPOCH_EXIT_ET(et);                  \
2543                                 return (NULL);                          \
2544                         }                                               \
2545                 }                                                       \
2546                 m->m_pkthdr.rcvif = iface;                              \
2547                 NET_EPOCH_EXIT_ET(et);                                  \
2548                 return (m);                                             \
2549         }                                                               \
2550                                                                         \
2551         /* We just received a packet that we sent out. */               \
2552         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2553             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
2554             ) {                                                         \
2555                 m_freem(m);                                             \
2556                 NET_EPOCH_EXIT_ET(et);                                  \
2557                 return (NULL);                                          \
2558         }
2559
2560         /*
2561          * Unicast.  Make sure it's not for the bridge.
2562          */
2563         do { GRAB_OUR_PACKETS(bifp) } while (0);
2564
2565         /*
2566          * Give a chance for ifp at first priority. This will help when the
2567          * packet comes through the interface like VLAN's with the same MACs
2568          * on several interfaces from the same bridge. This also will save
2569          * some CPU cycles in case the destination interface and the input
2570          * interface (eq ifp) are the same.
2571          */
2572         do { GRAB_OUR_PACKETS(ifp) } while (0);
2573
2574         /* Now check the all bridge members. */
2575         CK_LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2576                 GRAB_OUR_PACKETS(bif2->bif_ifp)
2577         }
2578
2579 #undef OR_CARP_CHECK_WE_ARE_DST
2580 #undef OR_CARP_CHECK_WE_ARE_SRC
2581 #undef OR_PFIL_HOOKED_INET6
2582 #undef GRAB_OUR_PACKETS
2583
2584         /* Perform the bridge forwarding function. */
2585         bridge_forward(sc, bif, m);
2586
2587         NET_EPOCH_EXIT_ET(et);
2588         return (NULL);
2589 }
2590
2591 /*
2592  * bridge_broadcast:
2593  *
2594  *      Send a frame to all interfaces that are members of
2595  *      the bridge, except for the one on which the packet
2596  *      arrived.
2597  *
2598  *      NOTE: Releases the lock on return.
2599  */
2600 static void
2601 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2602     struct mbuf *m, int runfilt)
2603 {
2604         struct bridge_iflist *dbif, *sbif;
2605         struct mbuf *mc;
2606         struct ifnet *dst_if;
2607         int used = 0, i;
2608
2609         MPASS(in_epoch(net_epoch_preempt));
2610
2611         sbif = bridge_lookup_member_if(sc, src_if);
2612
2613         /* Filter on the bridge interface before broadcasting */
2614         if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2615 #ifdef INET6
2616             || PFIL_HOOKED(&V_inet6_pfil_hook)
2617 #endif
2618             )) {
2619                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2620                         return;
2621                 if (m == NULL)
2622                         return;
2623         }
2624
2625         CK_LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
2626                 dst_if = dbif->bif_ifp;
2627                 if (dst_if == src_if)
2628                         continue;
2629
2630                 /* Private segments can not talk to each other */
2631                 if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
2632                         continue;
2633
2634                 if ((dbif->bif_flags & IFBIF_STP) &&
2635                     dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2636                         continue;
2637
2638                 if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
2639                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2640                         continue;
2641
2642                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2643                         continue;
2644
2645                 if (CK_LIST_NEXT(dbif, bif_next) == NULL) {
2646                         mc = m;
2647                         used = 1;
2648                 } else {
2649                         mc = m_dup(m, M_NOWAIT);
2650                         if (mc == NULL) {
2651                                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2652                                 continue;
2653                         }
2654                 }
2655
2656                 /*
2657                  * Filter on the output interface. Pass a NULL bridge interface
2658                  * pointer so we do not redundantly filter on the bridge for
2659                  * each interface we broadcast on.
2660                  */
2661                 if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2662 #ifdef INET6
2663                     || PFIL_HOOKED(&V_inet6_pfil_hook)
2664 #endif
2665                     )) {
2666                         if (used == 0) {
2667                                 /* Keep the layer3 header aligned */
2668                                 i = min(mc->m_pkthdr.len, max_protohdr);
2669                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2670                                 if (mc == NULL) {
2671                                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2672                                         continue;
2673                                 }
2674                         }
2675                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2676                                 continue;
2677                         if (mc == NULL)
2678                                 continue;
2679                 }
2680
2681                 bridge_enqueue(sc, dst_if, mc);
2682         }
2683         if (used == 0)
2684                 m_freem(m);
2685 }
2686
2687 /*
2688  * bridge_span:
2689  *
2690  *      Duplicate a packet out one or more interfaces that are in span mode,
2691  *      the original mbuf is unmodified.
2692  */
2693 static void
2694 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2695 {
2696         struct bridge_iflist *bif;
2697         struct ifnet *dst_if;
2698         struct mbuf *mc;
2699
2700         MPASS(in_epoch(net_epoch_preempt));
2701
2702         if (CK_LIST_EMPTY(&sc->sc_spanlist))
2703                 return;
2704
2705         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2706                 dst_if = bif->bif_ifp;
2707
2708                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2709                         continue;
2710
2711                 mc = m_copypacket(m, M_NOWAIT);
2712                 if (mc == NULL) {
2713                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2714                         continue;
2715                 }
2716
2717                 bridge_enqueue(sc, dst_if, mc);
2718         }
2719 }
2720
2721 /*
2722  * bridge_rtupdate:
2723  *
2724  *      Add a bridge routing entry.
2725  */
2726 static int
2727 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan,
2728     struct bridge_iflist *bif, int setflags, uint8_t flags)
2729 {
2730         struct bridge_rtnode *brt;
2731         int error;
2732
2733         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
2734
2735         /* Check the source address is valid and not multicast. */
2736         if (ETHER_IS_MULTICAST(dst) ||
2737             (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
2738              dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0)
2739                 return (EINVAL);
2740
2741         /* 802.1p frames map to vlan 1 */
2742         if (vlan == 0)
2743                 vlan = 1;
2744
2745         /*
2746          * A route for this destination might already exist.  If so,
2747          * update it, otherwise create a new one.
2748          */
2749         if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
2750                 BRIDGE_RT_LOCK(sc);
2751
2752                 /* Check again, now that we have the lock. There could have
2753                  * been a race and we only want to insert this once. */
2754                 if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) != NULL) {
2755                         BRIDGE_RT_UNLOCK(sc);
2756                         return (0);
2757                 }
2758
2759                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2760                         sc->sc_brtexceeded++;
2761                         BRIDGE_RT_UNLOCK(sc);
2762                         return (ENOSPC);
2763                 }
2764                 /* Check per interface address limits (if enabled) */
2765                 if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
2766                         bif->bif_addrexceeded++;
2767                         BRIDGE_RT_UNLOCK(sc);
2768                         return (ENOSPC);
2769                 }
2770
2771                 /*
2772                  * Allocate a new bridge forwarding node, and
2773                  * initialize the expiration time and Ethernet
2774                  * address.
2775                  */
2776                 brt = uma_zalloc(V_bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2777                 if (brt == NULL) {
2778                         BRIDGE_RT_UNLOCK(sc);
2779                         return (ENOMEM);
2780                 }
2781                 brt->brt_vnet = curvnet;
2782
2783                 if (bif->bif_flags & IFBIF_STICKY)
2784                         brt->brt_flags = IFBAF_STICKY;
2785                 else
2786                         brt->brt_flags = IFBAF_DYNAMIC;
2787
2788                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2789                 brt->brt_vlan = vlan;
2790
2791                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2792                         uma_zfree(V_bridge_rtnode_zone, brt);
2793                         BRIDGE_RT_UNLOCK(sc);
2794                         return (error);
2795                 }
2796                 brt->brt_dst = bif;
2797                 bif->bif_addrcnt++;
2798
2799                 BRIDGE_RT_UNLOCK(sc);
2800         }
2801
2802         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
2803             brt->brt_dst != bif) {
2804                 BRIDGE_RT_LOCK(sc);
2805                 brt->brt_dst->bif_addrcnt--;
2806                 brt->brt_dst = bif;
2807                 brt->brt_dst->bif_addrcnt++;
2808                 BRIDGE_RT_UNLOCK(sc);
2809         }
2810
2811         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2812                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2813         if (setflags)
2814                 brt->brt_flags = flags;
2815
2816         return (0);
2817 }
2818
2819 /*
2820  * bridge_rtlookup:
2821  *
2822  *      Lookup the destination interface for an address.
2823  */
2824 static struct ifnet *
2825 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2826 {
2827         struct bridge_rtnode *brt;
2828
2829         MPASS(in_epoch(net_epoch_preempt));
2830
2831         if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL)
2832                 return (NULL);
2833
2834         return (brt->brt_ifp);
2835 }
2836
2837 /*
2838  * bridge_rttrim:
2839  *
2840  *      Trim the routine table so that we have a number
2841  *      of routing entries less than or equal to the
2842  *      maximum number.
2843  */
2844 static void
2845 bridge_rttrim(struct bridge_softc *sc)
2846 {
2847         struct bridge_rtnode *brt, *nbrt;
2848
2849         MPASS(in_epoch(net_epoch_preempt));
2850         BRIDGE_RT_LOCK_ASSERT(sc);
2851
2852         /* Make sure we actually need to do this. */
2853         if (sc->sc_brtcnt <= sc->sc_brtmax)
2854                 return;
2855
2856         /* Force an aging cycle; this might trim enough addresses. */
2857         bridge_rtage(sc);
2858         if (sc->sc_brtcnt <= sc->sc_brtmax)
2859                 return;
2860
2861         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2862                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2863                         bridge_rtnode_destroy(sc, brt);
2864                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2865                                 return;
2866                 }
2867         }
2868 }
2869
2870 /*
2871  * bridge_timer:
2872  *
2873  *      Aging timer for the bridge.
2874  */
2875 static void
2876 bridge_timer(void *arg)
2877 {
2878         struct bridge_softc *sc = arg;
2879
2880         BRIDGE_RT_LOCK_ASSERT(sc);
2881
2882         /* Destruction of rtnodes requires a proper vnet context */
2883         CURVNET_SET(sc->sc_ifp->if_vnet);
2884         bridge_rtage(sc);
2885
2886         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2887                 callout_reset(&sc->sc_brcallout,
2888                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2889         CURVNET_RESTORE();
2890 }
2891
2892 /*
2893  * bridge_rtage:
2894  *
2895  *      Perform an aging cycle.
2896  */
2897 static void
2898 bridge_rtage(struct bridge_softc *sc)
2899 {
2900         struct bridge_rtnode *brt, *nbrt;
2901
2902         BRIDGE_RT_LOCK_ASSERT(sc);
2903
2904         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2905                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2906                         if (time_uptime >= brt->brt_expire)
2907                                 bridge_rtnode_destroy(sc, brt);
2908                 }
2909         }
2910 }
2911
2912 /*
2913  * bridge_rtflush:
2914  *
2915  *      Remove all dynamic addresses from the bridge.
2916  */
2917 static void
2918 bridge_rtflush(struct bridge_softc *sc, int full)
2919 {
2920         struct bridge_rtnode *brt, *nbrt;
2921
2922         BRIDGE_RT_LOCK_ASSERT(sc);
2923
2924         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2925                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2926                         bridge_rtnode_destroy(sc, brt);
2927         }
2928 }
2929
2930 /*
2931  * bridge_rtdaddr:
2932  *
2933  *      Remove an address from the table.
2934  */
2935 static int
2936 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2937 {
2938         struct bridge_rtnode *brt;
2939         int found = 0;
2940
2941         BRIDGE_RT_LOCK(sc);
2942
2943         /*
2944          * If vlan is zero then we want to delete for all vlans so the lookup
2945          * may return more than one.
2946          */
2947         while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
2948                 bridge_rtnode_destroy(sc, brt);
2949                 found = 1;
2950         }
2951
2952         BRIDGE_RT_UNLOCK(sc);
2953
2954         return (found ? 0 : ENOENT);
2955 }
2956
2957 /*
2958  * bridge_rtdelete:
2959  *
2960  *      Delete routes to a speicifc member interface.
2961  */
2962 static void
2963 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2964 {
2965         struct bridge_rtnode *brt, *nbrt;
2966
2967         BRIDGE_RT_LOCK_ASSERT(sc);
2968
2969         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2970                 if (brt->brt_ifp == ifp && (full ||
2971                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2972                         bridge_rtnode_destroy(sc, brt);
2973         }
2974 }
2975
2976 /*
2977  * bridge_rtable_init:
2978  *
2979  *      Initialize the route table for this bridge.
2980  */
2981 static void
2982 bridge_rtable_init(struct bridge_softc *sc)
2983 {
2984         int i;
2985
2986         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2987             M_DEVBUF, M_WAITOK);
2988
2989         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2990                 CK_LIST_INIT(&sc->sc_rthash[i]);
2991
2992         sc->sc_rthash_key = arc4random();
2993         CK_LIST_INIT(&sc->sc_rtlist);
2994 }
2995
2996 /*
2997  * bridge_rtable_fini:
2998  *
2999  *      Deconstruct the route table for this bridge.
3000  */
3001 static void
3002 bridge_rtable_fini(struct bridge_softc *sc)
3003 {
3004
3005         KASSERT(sc->sc_brtcnt == 0,
3006             ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
3007         free(sc->sc_rthash, M_DEVBUF);
3008 }
3009
3010 /*
3011  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
3012  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
3013  */
3014 #define mix(a, b, c)                                                    \
3015 do {                                                                    \
3016         a -= b; a -= c; a ^= (c >> 13);                                 \
3017         b -= c; b -= a; b ^= (a << 8);                                  \
3018         c -= a; c -= b; c ^= (b >> 13);                                 \
3019         a -= b; a -= c; a ^= (c >> 12);                                 \
3020         b -= c; b -= a; b ^= (a << 16);                                 \
3021         c -= a; c -= b; c ^= (b >> 5);                                  \
3022         a -= b; a -= c; a ^= (c >> 3);                                  \
3023         b -= c; b -= a; b ^= (a << 10);                                 \
3024         c -= a; c -= b; c ^= (b >> 15);                                 \
3025 } while (/*CONSTCOND*/0)
3026
3027 static __inline uint32_t
3028 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
3029 {
3030         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
3031
3032         b += addr[5] << 8;
3033         b += addr[4];
3034         a += addr[3] << 24;
3035         a += addr[2] << 16;
3036         a += addr[1] << 8;
3037         a += addr[0];
3038
3039         mix(a, b, c);
3040
3041         return (c & BRIDGE_RTHASH_MASK);
3042 }
3043
3044 #undef mix
3045
3046 static int
3047 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
3048 {
3049         int i, d;
3050
3051         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
3052                 d = ((int)a[i]) - ((int)b[i]);
3053         }
3054
3055         return (d);
3056 }
3057
3058 /*
3059  * bridge_rtnode_lookup:
3060  *
3061  *      Look up a bridge route node for the specified destination. Compare the
3062  *      vlan id or if zero then just return the first match.
3063  */
3064 static struct bridge_rtnode *
3065 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
3066 {
3067         struct bridge_rtnode *brt;
3068         uint32_t hash;
3069         int dir;
3070
3071         BRIDGE_RT_LOCK_OR_NET_EPOCH_ASSERT(sc);
3072
3073         hash = bridge_rthash(sc, addr);
3074         CK_LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
3075                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
3076                 if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0))
3077                         return (brt);
3078                 if (dir > 0)
3079                         return (NULL);
3080         }
3081
3082         return (NULL);
3083 }
3084
3085 /*
3086  * bridge_rtnode_insert:
3087  *
3088  *      Insert the specified bridge node into the route table.  We
3089  *      assume the entry is not already in the table.
3090  */
3091 static int
3092 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
3093 {
3094         struct bridge_rtnode *lbrt;
3095         uint32_t hash;
3096         int dir;
3097
3098         BRIDGE_RT_LOCK_ASSERT(sc);
3099
3100         hash = bridge_rthash(sc, brt->brt_addr);
3101
3102         lbrt = CK_LIST_FIRST(&sc->sc_rthash[hash]);
3103         if (lbrt == NULL) {
3104                 CK_LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
3105                 goto out;
3106         }
3107
3108         do {
3109                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
3110                 if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan)
3111                         return (EEXIST);
3112                 if (dir > 0) {
3113                         CK_LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
3114                         goto out;
3115                 }
3116                 if (CK_LIST_NEXT(lbrt, brt_hash) == NULL) {
3117                         CK_LIST_INSERT_AFTER(lbrt, brt, brt_hash);
3118                         goto out;
3119                 }
3120                 lbrt = CK_LIST_NEXT(lbrt, brt_hash);
3121         } while (lbrt != NULL);
3122
3123 #ifdef DIAGNOSTIC
3124         panic("bridge_rtnode_insert: impossible");
3125 #endif
3126
3127 out:
3128         CK_LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
3129         sc->sc_brtcnt++;
3130
3131         return (0);
3132 }
3133
3134 static void
3135 bridge_rtnode_destroy_cb(struct epoch_context *ctx)
3136 {
3137         struct bridge_rtnode *brt;
3138
3139         brt = __containerof(ctx, struct bridge_rtnode, brt_epoch_ctx);
3140
3141         CURVNET_SET(brt->brt_vnet);
3142         uma_zfree(V_bridge_rtnode_zone, brt);
3143         CURVNET_RESTORE();
3144 }
3145
3146 /*
3147  * bridge_rtnode_destroy:
3148  *
3149  *      Destroy a bridge rtnode.
3150  */
3151 static void
3152 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
3153 {
3154
3155         BRIDGE_RT_LOCK_ASSERT(sc);
3156
3157         CK_LIST_REMOVE(brt, brt_hash);
3158
3159         CK_LIST_REMOVE(brt, brt_list);
3160         sc->sc_brtcnt--;
3161         brt->brt_dst->bif_addrcnt--;
3162
3163         epoch_call(net_epoch_preempt, &brt->brt_epoch_ctx,
3164             bridge_rtnode_destroy_cb);
3165 }
3166
3167 /*
3168  * bridge_rtable_expire:
3169  *
3170  *      Set the expiry time for all routes on an interface.
3171  */
3172 static void
3173 bridge_rtable_expire(struct ifnet *ifp, int age)
3174 {
3175         struct bridge_softc *sc = ifp->if_bridge;
3176         struct bridge_rtnode *brt;
3177
3178         CURVNET_SET(ifp->if_vnet);
3179         BRIDGE_RT_LOCK(sc);
3180
3181         /*
3182          * If the age is zero then flush, otherwise set all the expiry times to
3183          * age for the interface
3184          */
3185         if (age == 0)
3186                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
3187         else {
3188                 CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
3189                         /* Cap the expiry time to 'age' */
3190                         if (brt->brt_ifp == ifp &&
3191                             brt->brt_expire > time_uptime + age &&
3192                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
3193                                 brt->brt_expire = time_uptime + age;
3194                 }
3195         }
3196         BRIDGE_RT_UNLOCK(sc);
3197         CURVNET_RESTORE();
3198 }
3199
3200 /*
3201  * bridge_state_change:
3202  *
3203  *      Callback from the bridgestp code when a port changes states.
3204  */
3205 static void
3206 bridge_state_change(struct ifnet *ifp, int state)
3207 {
3208         struct bridge_softc *sc = ifp->if_bridge;
3209         static const char *stpstates[] = {
3210                 "disabled",
3211                 "listening",
3212                 "learning",
3213                 "forwarding",
3214                 "blocking",
3215                 "discarding"
3216         };
3217
3218         CURVNET_SET(ifp->if_vnet);
3219         if (V_log_stp)
3220                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
3221                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
3222         CURVNET_RESTORE();
3223 }
3224
3225 /*
3226  * Send bridge packets through pfil if they are one of the types pfil can deal
3227  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
3228  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
3229  * that interface.
3230  */
3231 static int
3232 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
3233 {
3234         int snap, error, i, hlen;
3235         struct ether_header *eh1, eh2;
3236         struct ip *ip;
3237         struct llc llc1;
3238         u_int16_t ether_type;
3239
3240         snap = 0;
3241         error = -1;     /* Default error if not error == 0 */
3242
3243 #if 0
3244         /* we may return with the IP fields swapped, ensure its not shared */
3245         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
3246 #endif
3247
3248         if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0)
3249                 return (0); /* filtering is disabled */
3250
3251         i = min((*mp)->m_pkthdr.len, max_protohdr);
3252         if ((*mp)->m_len < i) {
3253             *mp = m_pullup(*mp, i);
3254             if (*mp == NULL) {
3255                 printf("%s: m_pullup failed\n", __func__);
3256                 return (-1);
3257             }
3258         }
3259
3260         eh1 = mtod(*mp, struct ether_header *);
3261         ether_type = ntohs(eh1->ether_type);
3262
3263         /*
3264          * Check for SNAP/LLC.
3265          */
3266         if (ether_type < ETHERMTU) {
3267                 struct llc *llc2 = (struct llc *)(eh1 + 1);
3268
3269                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
3270                     llc2->llc_dsap == LLC_SNAP_LSAP &&
3271                     llc2->llc_ssap == LLC_SNAP_LSAP &&
3272                     llc2->llc_control == LLC_UI) {
3273                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
3274                         snap = 1;
3275                 }
3276         }
3277
3278         /*
3279          * If we're trying to filter bridge traffic, don't look at anything
3280          * other than IP and ARP traffic.  If the filter doesn't understand
3281          * IPv6, don't allow IPv6 through the bridge either.  This is lame
3282          * since if we really wanted, say, an AppleTalk filter, we are hosed,
3283          * but of course we don't have an AppleTalk filter to begin with.
3284          * (Note that since pfil doesn't understand ARP it will pass *ALL*
3285          * ARP traffic.)
3286          */
3287         switch (ether_type) {
3288                 case ETHERTYPE_ARP:
3289                 case ETHERTYPE_REVARP:
3290                         if (V_pfil_ipfw_arp == 0)
3291                                 return (0); /* Automatically pass */
3292                         break;
3293
3294                 case ETHERTYPE_IP:
3295 #ifdef INET6
3296                 case ETHERTYPE_IPV6:
3297 #endif /* INET6 */
3298                         break;
3299                 default:
3300                         /*
3301                          * Check to see if the user wants to pass non-ip
3302                          * packets, these will not be checked by pfil(9) and
3303                          * passed unconditionally so the default is to drop.
3304                          */
3305                         if (V_pfil_onlyip)
3306                                 goto bad;
3307         }
3308
3309         /* Run the packet through pfil before stripping link headers */
3310         if (PFIL_HOOKED(&V_link_pfil_hook) && V_pfil_ipfw != 0 &&
3311                         dir == PFIL_OUT && ifp != NULL) {
3312
3313                 error = pfil_run_hooks(&V_link_pfil_hook, mp, ifp, dir, 0,
3314                     NULL);
3315
3316                 if (*mp == NULL || error != 0) /* packet consumed by filter */
3317                         return (error);
3318         }
3319
3320         /* Strip off the Ethernet header and keep a copy. */
3321         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3322         m_adj(*mp, ETHER_HDR_LEN);
3323
3324         /* Strip off snap header, if present */
3325         if (snap) {
3326                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3327                 m_adj(*mp, sizeof(struct llc));
3328         }
3329
3330         /*
3331          * Check the IP header for alignment and errors
3332          */
3333         if (dir == PFIL_IN) {
3334                 switch (ether_type) {
3335                         case ETHERTYPE_IP:
3336                                 error = bridge_ip_checkbasic(mp);
3337                                 break;
3338 #ifdef INET6
3339                         case ETHERTYPE_IPV6:
3340                                 error = bridge_ip6_checkbasic(mp);
3341                                 break;
3342 #endif /* INET6 */
3343                         default:
3344                                 error = 0;
3345                 }
3346                 if (error)
3347                         goto bad;
3348         }
3349
3350         error = 0;
3351
3352         /*
3353          * Run the packet through pfil
3354          */
3355         switch (ether_type) {
3356         case ETHERTYPE_IP:
3357                 /*
3358                  * Run pfil on the member interface and the bridge, both can
3359                  * be skipped by clearing pfil_member or pfil_bridge.
3360                  *
3361                  * Keep the order:
3362                  *   in_if -> bridge_if -> out_if
3363                  */
3364                 if (V_pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3365                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3366                                         dir, 0, NULL);
3367
3368                 if (*mp == NULL || error != 0) /* filter may consume */
3369                         break;
3370
3371                 if (V_pfil_member && ifp != NULL)
3372                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, ifp,
3373                                         dir, 0, NULL);
3374
3375                 if (*mp == NULL || error != 0) /* filter may consume */
3376                         break;
3377
3378                 if (V_pfil_bridge && dir == PFIL_IN && bifp != NULL)
3379                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3380                                         dir, 0, NULL);
3381
3382                 if (*mp == NULL || error != 0) /* filter may consume */
3383                         break;
3384
3385                 /* check if we need to fragment the packet */
3386                 /* bridge_fragment generates a mbuf chain of packets */
3387                 /* that already include eth headers */
3388                 if (V_pfil_member && ifp != NULL && dir == PFIL_OUT) {
3389                         i = (*mp)->m_pkthdr.len;
3390                         if (i > ifp->if_mtu) {
3391                                 error = bridge_fragment(ifp, mp, &eh2, snap,
3392                                             &llc1);
3393                                 return (error);
3394                         }
3395                 }
3396
3397                 /* Recalculate the ip checksum. */
3398                 ip = mtod(*mp, struct ip *);
3399                 hlen = ip->ip_hl << 2;
3400                 if (hlen < sizeof(struct ip))
3401                         goto bad;
3402                 if (hlen > (*mp)->m_len) {
3403                         if ((*mp = m_pullup(*mp, hlen)) == NULL)
3404                                 goto bad;
3405                         ip = mtod(*mp, struct ip *);
3406                         if (ip == NULL)
3407                                 goto bad;
3408                 }
3409                 ip->ip_sum = 0;
3410                 if (hlen == sizeof(struct ip))
3411                         ip->ip_sum = in_cksum_hdr(ip);
3412                 else
3413                         ip->ip_sum = in_cksum(*mp, hlen);
3414
3415                 break;
3416 #ifdef INET6
3417         case ETHERTYPE_IPV6:
3418                 if (V_pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3419                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3420                                         dir, 0, NULL);
3421
3422                 if (*mp == NULL || error != 0) /* filter may consume */
3423                         break;
3424
3425                 if (V_pfil_member && ifp != NULL)
3426                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, ifp,
3427                                         dir, 0, NULL);
3428
3429                 if (*mp == NULL || error != 0) /* filter may consume */
3430                         break;
3431
3432                 if (V_pfil_bridge && dir == PFIL_IN && bifp != NULL)
3433                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3434                                         dir, 0, NULL);
3435                 break;
3436 #endif
3437         default:
3438                 error = 0;
3439                 break;
3440         }
3441
3442         if (*mp == NULL)
3443                 return (error);
3444         if (error != 0)
3445                 goto bad;
3446
3447         error = -1;
3448
3449         /*
3450          * Finally, put everything back the way it was and return
3451          */
3452         if (snap) {
3453                 M_PREPEND(*mp, sizeof(struct llc), M_NOWAIT);
3454                 if (*mp == NULL)
3455                         return (error);
3456                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3457         }
3458
3459         M_PREPEND(*mp, ETHER_HDR_LEN, M_NOWAIT);
3460         if (*mp == NULL)
3461                 return (error);
3462         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3463
3464         return (0);
3465
3466 bad:
3467         m_freem(*mp);
3468         *mp = NULL;
3469         return (error);
3470 }
3471
3472 /*
3473  * Perform basic checks on header size since
3474  * pfil assumes ip_input has already processed
3475  * it for it.  Cut-and-pasted from ip_input.c.
3476  * Given how simple the IPv6 version is,
3477  * does the IPv4 version really need to be
3478  * this complicated?
3479  *
3480  * XXX Should we update ipstat here, or not?
3481  * XXX Right now we update ipstat but not
3482  * XXX csum_counter.
3483  */
3484 static int
3485 bridge_ip_checkbasic(struct mbuf **mp)
3486 {
3487         struct mbuf *m = *mp;
3488         struct ip *ip;
3489         int len, hlen;
3490         u_short sum;
3491
3492         if (*mp == NULL)
3493                 return (-1);
3494
3495         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3496                 if ((m = m_copyup(m, sizeof(struct ip),
3497                         (max_linkhdr + 3) & ~3)) == NULL) {
3498                         /* XXXJRT new stat, please */
3499                         KMOD_IPSTAT_INC(ips_toosmall);
3500                         goto bad;
3501                 }
3502         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
3503                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3504                         KMOD_IPSTAT_INC(ips_toosmall);
3505                         goto bad;
3506                 }
3507         }
3508         ip = mtod(m, struct ip *);
3509         if (ip == NULL) goto bad;
3510
3511         if (ip->ip_v != IPVERSION) {
3512                 KMOD_IPSTAT_INC(ips_badvers);
3513                 goto bad;
3514         }
3515         hlen = ip->ip_hl << 2;
3516         if (hlen < sizeof(struct ip)) { /* minimum header length */
3517                 KMOD_IPSTAT_INC(ips_badhlen);
3518                 goto bad;
3519         }
3520         if (hlen > m->m_len) {
3521                 if ((m = m_pullup(m, hlen)) == NULL) {
3522                         KMOD_IPSTAT_INC(ips_badhlen);
3523                         goto bad;
3524                 }
3525                 ip = mtod(m, struct ip *);
3526                 if (ip == NULL) goto bad;
3527         }
3528
3529         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3530                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3531         } else {
3532                 if (hlen == sizeof(struct ip)) {
3533                         sum = in_cksum_hdr(ip);
3534                 } else {
3535                         sum = in_cksum(m, hlen);
3536                 }
3537         }
3538         if (sum) {
3539                 KMOD_IPSTAT_INC(ips_badsum);
3540                 goto bad;
3541         }
3542
3543         /* Retrieve the packet length. */
3544         len = ntohs(ip->ip_len);
3545
3546         /*
3547          * Check for additional length bogosity
3548          */
3549         if (len < hlen) {
3550                 KMOD_IPSTAT_INC(ips_badlen);
3551                 goto bad;
3552         }
3553
3554         /*
3555          * Check that the amount of data in the buffers
3556          * is as at least much as the IP header would have us expect.
3557          * Drop packet if shorter than we expect.
3558          */
3559         if (m->m_pkthdr.len < len) {
3560                 KMOD_IPSTAT_INC(ips_tooshort);
3561                 goto bad;
3562         }
3563
3564         /* Checks out, proceed */
3565         *mp = m;
3566         return (0);
3567
3568 bad:
3569         *mp = m;
3570         return (-1);
3571 }
3572
3573 #ifdef INET6
3574 /*
3575  * Same as above, but for IPv6.
3576  * Cut-and-pasted from ip6_input.c.
3577  * XXX Should we update ip6stat, or not?
3578  */
3579 static int
3580 bridge_ip6_checkbasic(struct mbuf **mp)
3581 {
3582         struct mbuf *m = *mp;
3583         struct ip6_hdr *ip6;
3584
3585         /*
3586          * If the IPv6 header is not aligned, slurp it up into a new
3587          * mbuf with space for link headers, in the event we forward
3588          * it.  Otherwise, if it is aligned, make sure the entire base
3589          * IPv6 header is in the first mbuf of the chain.
3590          */
3591         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3592                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3593                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3594                             (max_linkhdr + 3) & ~3)) == NULL) {
3595                         /* XXXJRT new stat, please */
3596                         IP6STAT_INC(ip6s_toosmall);
3597                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3598                         goto bad;
3599                 }
3600         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3601                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3602                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3603                         IP6STAT_INC(ip6s_toosmall);
3604                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3605                         goto bad;
3606                 }
3607         }
3608
3609         ip6 = mtod(m, struct ip6_hdr *);
3610
3611         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3612                 IP6STAT_INC(ip6s_badvers);
3613                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3614                 goto bad;
3615         }
3616
3617         /* Checks out, proceed */
3618         *mp = m;
3619         return (0);
3620
3621 bad:
3622         *mp = m;
3623         return (-1);
3624 }
3625 #endif /* INET6 */
3626
3627 /*
3628  * bridge_fragment:
3629  *
3630  *      Fragment mbuf chain in multiple packets and prepend ethernet header.
3631  */
3632 static int
3633 bridge_fragment(struct ifnet *ifp, struct mbuf **mp, struct ether_header *eh,
3634     int snap, struct llc *llc)
3635 {
3636         struct mbuf *m = *mp, *nextpkt = NULL, *mprev = NULL, *mcur = NULL;
3637         struct ip *ip;
3638         int error = -1;
3639
3640         if (m->m_len < sizeof(struct ip) &&
3641             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3642                 goto dropit;
3643         ip = mtod(m, struct ip *);
3644
3645         m->m_pkthdr.csum_flags |= CSUM_IP;
3646         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist);
3647         if (error)
3648                 goto dropit;
3649
3650         /*
3651          * Walk the chain and re-add the Ethernet header for
3652          * each mbuf packet.
3653          */
3654         for (mcur = m; mcur; mcur = mcur->m_nextpkt) {
3655                 nextpkt = mcur->m_nextpkt;
3656                 mcur->m_nextpkt = NULL;
3657                 if (snap) {
3658                         M_PREPEND(mcur, sizeof(struct llc), M_NOWAIT);
3659                         if (mcur == NULL) {
3660                                 error = ENOBUFS;
3661                                 if (mprev != NULL)
3662                                         mprev->m_nextpkt = nextpkt;
3663                                 goto dropit;
3664                         }
3665                         bcopy(llc, mtod(mcur, caddr_t),sizeof(struct llc));
3666                 }
3667
3668                 M_PREPEND(mcur, ETHER_HDR_LEN, M_NOWAIT);
3669                 if (mcur == NULL) {
3670                         error = ENOBUFS;
3671                         if (mprev != NULL)
3672                                 mprev->m_nextpkt = nextpkt;
3673                         goto dropit;
3674                 }
3675                 bcopy(eh, mtod(mcur, caddr_t), ETHER_HDR_LEN);
3676
3677                 /*
3678                  * The previous two M_PREPEND could have inserted one or two
3679                  * mbufs in front so we have to update the previous packet's
3680                  * m_nextpkt.
3681                  */
3682                 mcur->m_nextpkt = nextpkt;
3683                 if (mprev != NULL)
3684                         mprev->m_nextpkt = mcur;
3685                 else {
3686                         /* The first mbuf in the original chain needs to be
3687                          * updated. */
3688                         *mp = mcur;
3689                 }
3690                 mprev = mcur;
3691         }
3692
3693         KMOD_IPSTAT_INC(ips_fragmented);
3694         return (error);
3695
3696 dropit:
3697         for (mcur = *mp; mcur; mcur = m) { /* droping the full packet chain */
3698                 m = mcur->m_nextpkt;
3699                 m_freem(mcur);
3700         }
3701         return (error);
3702 }
3703
3704 static void
3705 bridge_linkstate(struct ifnet *ifp)
3706 {
3707         struct bridge_softc *sc = ifp->if_bridge;
3708         struct bridge_iflist *bif;
3709         struct epoch_tracker et;
3710
3711         NET_EPOCH_ENTER_ET(et);
3712
3713         bif = bridge_lookup_member_if(sc, ifp);
3714         if (bif == NULL) {
3715                 NET_EPOCH_EXIT_ET(et);
3716                 return;
3717         }
3718         bridge_linkcheck(sc);
3719
3720         bstp_linkstate(&bif->bif_stp);
3721
3722         NET_EPOCH_EXIT_ET(et);
3723 }
3724
3725 static void
3726 bridge_linkcheck(struct bridge_softc *sc)
3727 {
3728         struct bridge_iflist *bif;
3729         int new_link, hasls;
3730
3731         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
3732
3733         new_link = LINK_STATE_DOWN;
3734         hasls = 0;
3735         /* Our link is considered up if at least one of our ports is active */
3736         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
3737                 if (bif->bif_ifp->if_capabilities & IFCAP_LINKSTATE)
3738                         hasls++;
3739                 if (bif->bif_ifp->if_link_state == LINK_STATE_UP) {
3740                         new_link = LINK_STATE_UP;
3741                         break;
3742                 }
3743         }
3744         if (!CK_LIST_EMPTY(&sc->sc_iflist) && !hasls) {
3745                 /* If no interfaces support link-state then we default to up */
3746                 new_link = LINK_STATE_UP;
3747         }
3748         if_link_state_change(sc->sc_ifp, new_link);
3749 }