sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*
   4  * Copyright 2001 Wasabi Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed for the NetBSD Project by
  20  *      Wasabi Systems, Inc.
  21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  22  *    or promote products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 /*
  39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  40  * All rights reserved.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  * 3. All advertising materials mentioning features or use of this software
  51  *    must display the following acknowledgement:
  52  *      This product includes software developed by Jason L. Wright
  53  * 4. The name of the author may not be used to endorse or promote products
  54  *    derived from this software without specific prior written permission.
  55  *
  56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  66  * POSSIBILITY OF SUCH DAMAGE.
  67  *
  68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  69  */
  70
  71 /*
  72  * Network interface bridge support.
  73  *
  74  * TODO:
  75  *
  76  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  77  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  78  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  79  *        consider heterogenous bridges).
  80  */
  81
  82 #include <sys/cdefs.h>
  83 __FBSDID("$FreeBSD$");
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87 #include "opt_carp.h"
  88
  89 #include <sys/param.h>
  90 #include <sys/mbuf.h>
  91 #include <sys/malloc.h>
  92 #include <sys/protosw.h>
  93 #include <sys/systm.h>
  94 #include <sys/time.h>
  95 #include <sys/socket.h> /* for net/if.h */
  96 #include <sys/sockio.h>
  97 #include <sys/ctype.h>  /* string functions */
  98 #include <sys/kernel.h>
  99 #include <sys/random.h>
 100 #include <sys/sysctl.h>
 101 #include <vm/uma.h>
 102 #include <sys/module.h>
 103 #include <sys/proc.h>
 104 #include <sys/lock.h>
 105 #include <sys/mutex.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_clone.h>
 110 #include <net/if_dl.h>
 111 #include <net/if_types.h>
 112 #include <net/if_var.h>
 113 #include <net/pfil.h>
 114
 115 #include <netinet/in.h> /* for struct arpcom */
 116 #include <netinet/in_systm.h>
 117 #include <netinet/in_var.h>
 118 #include <netinet/ip.h>
 119 #include <netinet/ip_var.h>
 120 #ifdef INET6
 121 #include <netinet/ip6.h>
 122 #include <netinet6/ip6_var.h>
 123 #endif
 124 #ifdef DEV_CARP
 125 #include <netinet/ip_carp.h>
 126 #endif
 127 #include <machine/in_cksum.h>
 128 #include <netinet/if_ether.h> /* for struct arpcom */
 129 #include <net/bridgestp.h>
 130 #include <net/if_bridgevar.h>
 131 #include <net/if_llc.h>
 132
 133 #include <net/route.h>
 134 #include <netinet/ip_fw.h>
 135 #include <netinet/ip_dummynet.h>
 136
 137 /*
 138  * Size of the route hash table.  Must be a power of two.
 139  */
 140 #ifndef BRIDGE_RTHASH_SIZE
 141 #define BRIDGE_RTHASH_SIZE              1024
 142 #endif
 143
 144 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 145
 146 /*
 147  * Maximum number of addresses to cache.
 148  */
 149 #ifndef BRIDGE_RTABLE_MAX
 150 #define BRIDGE_RTABLE_MAX               100
 151 #endif
 152
 153 /*
 154  * Timeout (in seconds) for entries learned dynamically.
 155  */
 156 #ifndef BRIDGE_RTABLE_TIMEOUT
 157 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 158 #endif
 159
 160 /*
 161  * Number of seconds between walks of the route list.
 162  */
 163 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 164 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 165 #endif
 166
 167 /*
 168  * List of capabilities to mask on the member interface.
 169  */
 170 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 171
 172 static struct mtx       bridge_list_mtx;
 173 eventhandler_tag        bridge_detach_cookie = NULL;
 174
 175 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 176
 177 uma_zone_t bridge_rtnode_zone;
 178
 179 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
 180 static void     bridge_clone_destroy(struct ifnet *);
 181
 182 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 183 static void     bridge_mutecaps(struct bridge_iflist *, int);
 184 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 185 static void     bridge_init(void *);
 186 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 187 static void     bridge_stop(struct ifnet *, int);
 188 static void     bridge_start(struct ifnet *);
 189 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 190 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 191                     struct rtentry *);
 192
 193 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 194
 195 static void     bridge_timer(void *);
 196
 197 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 198                     struct mbuf *, int);
 199 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 200
 201 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 202                     struct ifnet *, int, uint8_t);
 203 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 204 static void     bridge_rttrim(struct bridge_softc *);
 205 static void     bridge_rtage(struct bridge_softc *);
 206 static void     bridge_rtflush(struct bridge_softc *, int);
 207 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 208
 209 static int      bridge_rtable_init(struct bridge_softc *);
 210 static void     bridge_rtable_fini(struct bridge_softc *);
 211
 212 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 213 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 214                     const uint8_t *);
 215 static int      bridge_rtnode_insert(struct bridge_softc *,
 216                     struct bridge_rtnode *);
 217 static void     bridge_rtnode_destroy(struct bridge_softc *,
 218                     struct bridge_rtnode *);
 219
 220 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 221                     const char *name);
 222 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 223                     struct ifnet *ifp);
 224 static void     bridge_delete_member(struct bridge_softc *,
 225                     struct bridge_iflist *, int);
 226 static void     bridge_delete_span(struct bridge_softc *,
 227                     struct bridge_iflist *);
 228
 229 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 230 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 231 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 232 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 233 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 234 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 235 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 236 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 237 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 238 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 239 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 240 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 241 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 242 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 243 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 244 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 245 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 246 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 247 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 248 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 249 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 250 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 251 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 252 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 253 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 254 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 255                     int);
 256 static int      bridge_ip_checkbasic(struct mbuf **mp);
 257 #ifdef INET6
 258 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 259 #endif /* INET6 */
 260 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 261                     struct ether_header *, int, struct llc *);
 262
 263 SYSCTL_DECL(_net_link);
 264 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 265
 266 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 267 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 268 static int pfil_member = 1; /* run pfil hooks on the member interface */
 269 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
 270 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 271     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 272 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 273     &pfil_bridge, 0, "Packet filter on the bridge interface");
 274 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 275     &pfil_member, 0, "Packet filter on the member interface");
 276
 277 struct bridge_control {
 278         int     (*bc_func)(struct bridge_softc *, void *);
 279         int     bc_argsize;
 280         int     bc_flags;
 281 };
 282
 283 #define BC_F_COPYIN             0x01    /* copy arguments in */
 284 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 285 #define BC_F_SUSER              0x04    /* do super-user check */
 286
 287 const struct bridge_control bridge_control_table[] = {
 288         { bridge_ioctl_add,             sizeof(struct ifbreq),
 289           BC_F_COPYIN|BC_F_SUSER },
 290         { bridge_ioctl_del,             sizeof(struct ifbreq),
 291           BC_F_COPYIN|BC_F_SUSER },
 292
 293         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 294           BC_F_COPYIN|BC_F_COPYOUT },
 295         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 296           BC_F_COPYIN|BC_F_SUSER },
 297
 298         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 299           BC_F_COPYIN|BC_F_SUSER },
 300         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 301           BC_F_COPYOUT },
 302
 303         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 304           BC_F_COPYIN|BC_F_COPYOUT },
 305         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 306           BC_F_COPYIN|BC_F_COPYOUT },
 307
 308         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 309           BC_F_COPYIN|BC_F_SUSER },
 310
 311         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 312           BC_F_COPYIN|BC_F_SUSER },
 313         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 314           BC_F_COPYOUT },
 315
 316         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 317           BC_F_COPYIN|BC_F_SUSER },
 318
 319         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 320           BC_F_COPYIN|BC_F_SUSER },
 321
 322         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 323           BC_F_COPYOUT },
 324         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 325           BC_F_COPYIN|BC_F_SUSER },
 326
 327         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 328           BC_F_COPYOUT },
 329         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 330           BC_F_COPYIN|BC_F_SUSER },
 331
 332         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 333           BC_F_COPYOUT },
 334         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 335           BC_F_COPYIN|BC_F_SUSER },
 336
 337         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 338           BC_F_COPYOUT },
 339         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 340           BC_F_COPYIN|BC_F_SUSER },
 341
 342         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 343           BC_F_COPYIN|BC_F_SUSER },
 344
 345         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 346           BC_F_COPYIN|BC_F_SUSER },
 347
 348         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 349           BC_F_COPYIN|BC_F_SUSER },
 350         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 351           BC_F_COPYIN|BC_F_SUSER },
 352 };
 353 const int bridge_control_table_size =
 354     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 355
 356 static const u_char etherbroadcastaddr[ETHER_ADDR_LEN] =
 357                         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 358
 359 LIST_HEAD(, bridge_softc) bridge_list;
 360
 361 IFC_SIMPLE_DECLARE(bridge, 0);
 362
 363 static int
 364 bridge_modevent(module_t mod, int type, void *data)
 365 {
 366
 367         switch (type) {
 368         case MOD_LOAD:
 369                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
 370                 if_clone_attach(&bridge_cloner);
 371                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 372                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 373                     UMA_ALIGN_PTR, 0);
 374                 LIST_INIT(&bridge_list);
 375                 bridge_input_p = bridge_input;
 376                 bridge_output_p = bridge_output;
 377                 bridge_dn_p = bridge_dummynet;
 378                 bstp_linkstate_p = bstp_linkstate;
 379                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 380                     ifnet_departure_event, bridge_ifdetach, NULL,
 381                     EVENTHANDLER_PRI_ANY);
 382                 break;
 383         case MOD_UNLOAD:
 384                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 385                     bridge_detach_cookie);
 386                 if_clone_detach(&bridge_cloner);
 387                 uma_zdestroy(bridge_rtnode_zone);
 388                 bridge_input_p = NULL;
 389                 bridge_output_p = NULL;
 390                 bridge_dn_p = NULL;
 391                 bstp_linkstate_p = NULL;
 392                 mtx_destroy(&bridge_list_mtx);
 393                 break;
 394         default:
 395                 return (EOPNOTSUPP);
 396         }
 397         return (0);
 398 }
 399
 400 static moduledata_t bridge_mod = {
 401         "if_bridge",
 402         bridge_modevent,
 403         0
 404 };
 405
 406 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 407 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 408
 409 /*
 410  * handler for net.link.bridge.pfil_ipfw
 411  */
 412 static int
 413 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 414 {
 415         int enable = pfil_ipfw;
 416         int error;
 417
 418         error = sysctl_handle_int(oidp, &enable, 0, req);
 419         enable = (enable) ? 1 : 0;
 420
 421         if (enable != pfil_ipfw) {
 422                 pfil_ipfw = enable;
 423
 424                 /*
 425                  * Disable pfil so that ipfw doesnt run twice, if the user
 426                  * really wants both then they can re-enable pfil_bridge and/or
 427                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 428                  * layer2 type.
 429                  */
 430                 if (pfil_ipfw) {
 431                         pfil_onlyip = 0;
 432                         pfil_bridge = 0;
 433                         pfil_member = 0;
 434                 }
 435         }
 436
 437         return (error);
 438 }
 439 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
 440             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
 441
 442 /*
 443  * bridge_clone_create:
 444  *
 445  *      Create a new bridge instance.
 446  */
 447 static int
 448 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 449 {
 450         struct bridge_softc *sc, *sc2;
 451         struct ifnet *bifp, *ifp;
 452         u_char eaddr[6];
 453         int retry;
 454
 455         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 456         BRIDGE_LOCK_INIT(sc);
 457         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 458         if (ifp == NULL) {
 459                 free(sc, M_DEVBUF);
 460                 return (ENOSPC);
 461         }
 462
 463         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 464         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 465
 466         /* Initialize our routing table. */
 467         bridge_rtable_init(sc);
 468
 469         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
 470
 471         LIST_INIT(&sc->sc_iflist);
 472         LIST_INIT(&sc->sc_spanlist);
 473
 474         ifp->if_softc = sc;
 475         if_initname(ifp, ifc->ifc_name, unit);
 476         ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
 477         ifp->if_ioctl = bridge_ioctl;
 478         ifp->if_start = bridge_start;
 479         ifp->if_init = bridge_init;
 480         ifp->if_type = IFT_BRIDGE;
 481         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 482         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 483         IFQ_SET_READY(&ifp->if_snd);
 484
 485         /*
 486          * Generate a random ethernet address with a locally administered
 487          * address.
 488          *
 489          * Since we are using random ethernet addresses for the bridge, it is
 490          * possible that we might have address collisions, so make sure that
 491          * this hardware address isn't already in use on another bridge.
 492          */
 493         for (retry = 1; retry != 0;) {
 494                 arc4rand(eaddr, ETHER_ADDR_LEN, 1);
 495                 eaddr[0] &= ~1;         /* clear multicast bit */
 496                 eaddr[0] |= 2;          /* set the LAA bit */
 497                 retry = 0;
 498                 mtx_lock(&bridge_list_mtx);
 499                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
 500                         bifp = sc2->sc_ifp;
 501                         if (memcmp(eaddr, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
 502                                 retry = 1;
 503                 }
 504                 mtx_unlock(&bridge_list_mtx);
 505         }
 506
 507         bstp_attach(&sc->sc_stp);
 508         ether_ifattach(ifp, eaddr);
 509         /* Now undo some of the damage... */
 510         ifp->if_baudrate = 0;
 511         ifp->if_type = IFT_BRIDGE;
 512
 513         mtx_lock(&bridge_list_mtx);
 514         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 515         mtx_unlock(&bridge_list_mtx);
 516
 517         return (0);
 518 }
 519
 520 /*
 521  * bridge_clone_destroy:
 522  *
 523  *      Destroy a bridge instance.
 524  */
 525 static void
 526 bridge_clone_destroy(struct ifnet *ifp)
 527 {
 528         struct bridge_softc *sc = ifp->if_softc;
 529         struct bridge_iflist *bif;
 530
 531         BRIDGE_LOCK(sc);
 532
 533         bridge_stop(ifp, 1);
 534         ifp->if_flags &= ~IFF_UP;
 535
 536         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 537                 bridge_delete_member(sc, bif, 0);
 538
 539         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 540                 bridge_delete_span(sc, bif);
 541         }
 542
 543         BRIDGE_UNLOCK(sc);
 544
 545         callout_drain(&sc->sc_brcallout);
 546
 547         mtx_lock(&bridge_list_mtx);
 548         LIST_REMOVE(sc, sc_list);
 549         mtx_unlock(&bridge_list_mtx);
 550
 551         bstp_detach(&sc->sc_stp);
 552         ether_ifdetach(ifp);
 553         if_free_type(ifp, IFT_ETHER);
 554
 555         /* Tear down the routing table. */
 556         bridge_rtable_fini(sc);
 557
 558         BRIDGE_LOCK_DESTROY(sc);
 559         free(sc, M_DEVBUF);
 560 }
 561
 562 /*
 563  * bridge_ioctl:
 564  *
 565  *      Handle a control request from the operator.
 566  */
 567 static int
 568 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 569 {
 570         struct bridge_softc *sc = ifp->if_softc;
 571         struct thread *td = curthread;
 572         union {
 573                 struct ifbreq ifbreq;
 574                 struct ifbifconf ifbifconf;
 575                 struct ifbareq ifbareq;
 576                 struct ifbaconf ifbaconf;
 577                 struct ifbrparam ifbrparam;
 578         } args;
 579         struct ifdrv *ifd = (struct ifdrv *) data;
 580         const struct bridge_control *bc;
 581         int error = 0;
 582
 583         BRIDGE_LOCK(sc);
 584
 585         switch (cmd) {
 586
 587         case SIOCADDMULTI:
 588         case SIOCDELMULTI:
 589                 break;
 590
 591         case SIOCGDRVSPEC:
 592         case SIOCSDRVSPEC:
 593                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 594                         error = EINVAL;
 595                         break;
 596                 }
 597                 bc = &bridge_control_table[ifd->ifd_cmd];
 598
 599                 if (cmd == SIOCGDRVSPEC &&
 600                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 601                         error = EINVAL;
 602                         break;
 603                 }
 604                 else if (cmd == SIOCSDRVSPEC &&
 605                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 606                         error = EINVAL;
 607                         break;
 608                 }
 609
 610                 if (bc->bc_flags & BC_F_SUSER) {
 611                         error = suser(td);
 612                         if (error)
 613                                 break;
 614                 }
 615
 616                 if (ifd->ifd_len != bc->bc_argsize ||
 617                     ifd->ifd_len > sizeof(args)) {
 618                         error = EINVAL;
 619                         break;
 620                 }
 621
 622                 bzero(&args, sizeof(args));
 623                 if (bc->bc_flags & BC_F_COPYIN) {
 624                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 625                         if (error)
 626                                 break;
 627                 }
 628
 629                 error = (*bc->bc_func)(sc, &args);
 630                 if (error)
 631                         break;
 632
 633                 if (bc->bc_flags & BC_F_COPYOUT)
 634                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 635
 636                 break;
 637
 638         case SIOCSIFFLAGS:
 639                 if (!(ifp->if_flags & IFF_UP) &&
 640                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 641                         /*
 642                          * If interface is marked down and it is running,
 643                          * then stop and disable it.
 644                          */
 645                         bridge_stop(ifp, 1);
 646                 } else if ((ifp->if_flags & IFF_UP) &&
 647                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 648                         /*
 649                          * If interface is marked up and it is stopped, then
 650                          * start it.
 651                          */
 652                         BRIDGE_UNLOCK(sc);
 653                         (*ifp->if_init)(sc);
 654                 }
 655                 break;
 656
 657         case SIOCSIFMTU:
 658                 /* Do not allow the MTU to be changed on the bridge */
 659                 error = EINVAL;
 660                 break;
 661
 662         default:
 663                 /*
 664                  * drop the lock as ether_ioctl() will call bridge_start() and
 665                  * cause the lock to be recursed.
 666                  */
 667                 BRIDGE_UNLOCK(sc);
 668                 error = ether_ioctl(ifp, cmd, data);
 669                 break;
 670         }
 671
 672         if (BRIDGE_LOCKED(sc))
 673                 BRIDGE_UNLOCK(sc);
 674
 675         return (error);
 676 }
 677
 678 /*
 679  * bridge_mutecaps:
 680  *
 681  *      Clear or restore unwanted capabilities on the member interface
 682  */
 683 static void
 684 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 685 {
 686         struct ifnet *ifp = bif->bif_ifp;
 687         struct ifreq ifr;
 688         int error;
 689
 690         if (ifp->if_ioctl == NULL)
 691                 return;
 692
 693         bzero(&ifr, sizeof(ifr));
 694         ifr.ifr_reqcap = ifp->if_capenable;
 695
 696         if (mute) {
 697                 /* mask off and save capabilities */
 698                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 699                 if (bif->bif_mutecap != 0)
 700                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 701         } else
 702                 /* restore muted capabilities */
 703                 ifr.ifr_reqcap |= bif->bif_mutecap;
 704
 705
 706         if (bif->bif_mutecap != 0) {
 707                 IFF_LOCKGIANT(ifp);
 708                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
 709                 IFF_UNLOCKGIANT(ifp);
 710         }
 711 }
 712
 713 /*
 714  * bridge_lookup_member:
 715  *
 716  *      Lookup a bridge member interface.
 717  */
 718 static struct bridge_iflist *
 719 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 720 {
 721         struct bridge_iflist *bif;
 722         struct ifnet *ifp;
 723
 724         BRIDGE_LOCK_ASSERT(sc);
 725
 726         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 727                 ifp = bif->bif_ifp;
 728                 if (strcmp(ifp->if_xname, name) == 0)
 729                         return (bif);
 730         }
 731
 732         return (NULL);
 733 }
 734
 735 /*
 736  * bridge_lookup_member_if:
 737  *
 738  *      Lookup a bridge member interface by ifnet*.
 739  */
 740 static struct bridge_iflist *
 741 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 742 {
 743         struct bridge_iflist *bif;
 744
 745         BRIDGE_LOCK_ASSERT(sc);
 746
 747         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 748                 if (bif->bif_ifp == member_ifp)
 749                         return (bif);
 750         }
 751
 752         return (NULL);
 753 }
 754
 755 /*
 756  * bridge_delete_member:
 757  *
 758  *      Delete the specified member interface.
 759  */
 760 static void
 761 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 762     int gone)
 763 {
 764         struct ifnet *ifs = bif->bif_ifp;
 765
 766         BRIDGE_LOCK_ASSERT(sc);
 767
 768         if (!gone) {
 769                 switch (ifs->if_type) {
 770                 case IFT_ETHER:
 771                 case IFT_L2VLAN:
 772                         /*
 773                          * Take the interface out of promiscuous mode.
 774                          */
 775                         (void) ifpromisc(ifs, 0);
 776                         bridge_mutecaps(bif, 0);
 777                         break;
 778
 779                 case IFT_GIF:
 780                         break;
 781
 782                 default:
 783 #ifdef DIAGNOSTIC
 784                         panic("bridge_delete_member: impossible");
 785 #endif
 786                         break;
 787                 }
 788         }
 789
 790         if (bif->bif_flags & IFBIF_STP)
 791                 bstp_delete(&bif->bif_stp);
 792
 793         ifs->if_bridge = NULL;
 794         BRIDGE_XLOCK(sc);
 795         LIST_REMOVE(bif, bif_next);
 796         BRIDGE_XDROP(sc);
 797
 798         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 799
 800         free(bif, M_DEVBUF);
 801 }
 802
 803 /*
 804  * bridge_delete_span:
 805  *
 806  *      Delete the specified span interface.
 807  */
 808 static void
 809 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 810 {
 811         BRIDGE_LOCK_ASSERT(sc);
 812
 813         KASSERT(bif->bif_ifp->if_bridge == NULL,
 814             ("%s: not a span interface", __func__));
 815
 816         LIST_REMOVE(bif, bif_next);
 817         free(bif, M_DEVBUF);
 818 }
 819
 820 static int
 821 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 822 {
 823         struct ifbreq *req = arg;
 824         struct bridge_iflist *bif = NULL;
 825         struct ifnet *ifs;
 826         int error = 0;
 827
 828         BRIDGE_LOCK_ASSERT(sc);
 829
 830         ifs = ifunit(req->ifbr_ifsname);
 831         if (ifs == NULL)
 832                 return (ENOENT);
 833
 834         /* If it's in the span list, it can't be a member. */
 835         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 836                 if (ifs == bif->bif_ifp)
 837                         return (EBUSY);
 838
 839         /* Allow the first Ethernet member to define the MTU */
 840         if (ifs->if_type != IFT_GIF) {
 841                 if (LIST_EMPTY(&sc->sc_iflist))
 842                         sc->sc_ifp->if_mtu = ifs->if_mtu;
 843                 else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 844                         if_printf(sc->sc_ifp, "invalid MTU for %s\n",
 845                             ifs->if_xname);
 846                         return (EINVAL);
 847                 }
 848         }
 849
 850         if (ifs->if_bridge == sc)
 851                 return (EEXIST);
 852
 853         if (ifs->if_bridge != NULL)
 854                 return (EBUSY);
 855
 856         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 857         if (bif == NULL)
 858                 return (ENOMEM);
 859
 860         bif->bif_ifp = ifs;
 861         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 862
 863         switch (ifs->if_type) {
 864         case IFT_ETHER:
 865         case IFT_L2VLAN:
 866                 /*
 867                  * Place the interface into promiscuous mode.
 868                  */
 869                 error = ifpromisc(ifs, 1);
 870                 if (error)
 871                         goto out;
 872
 873                 bridge_mutecaps(bif, 1);
 874                 break;
 875
 876         case IFT_GIF:
 877                 break;
 878
 879         default:
 880                 error = EINVAL;
 881                 goto out;
 882         }
 883
 884         ifs->if_bridge = sc;
 885         /*
 886          * XXX: XLOCK HERE!?!
 887          *
 888          * NOTE: insert_***HEAD*** should be safe for the traversals.
 889          */
 890         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 891
 892 out:
 893         if (error) {
 894                 if (bif != NULL)
 895                         free(bif, M_DEVBUF);
 896         }
 897         return (error);
 898 }
 899
 900 static int
 901 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 902 {
 903         struct ifbreq *req = arg;
 904         struct bridge_iflist *bif;
 905
 906         BRIDGE_LOCK_ASSERT(sc);
 907
 908         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 909         if (bif == NULL)
 910                 return (ENOENT);
 911
 912         bridge_delete_member(sc, bif, 0);
 913
 914         return (0);
 915 }
 916
 917 static int
 918 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 919 {
 920         struct ifbreq *req = arg;
 921         struct bridge_iflist *bif;
 922
 923         BRIDGE_LOCK_ASSERT(sc);
 924
 925         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 926         if (bif == NULL)
 927                 return (ENOENT);
 928
 929         req->ifbr_ifsflags = bif->bif_flags;
 930         req->ifbr_state = bif->bif_stp.bp_state;
 931         req->ifbr_priority = bif->bif_stp.bp_priority;
 932         req->ifbr_path_cost = bif->bif_stp.bp_path_cost;
 933         req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
 934
 935         return (0);
 936 }
 937
 938 static int
 939 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
 940 {
 941         struct ifbreq *req = arg;
 942         struct bridge_iflist *bif;
 943         int error;
 944
 945         BRIDGE_LOCK_ASSERT(sc);
 946
 947         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 948         if (bif == NULL)
 949                 return (ENOENT);
 950
 951         if (req->ifbr_ifsflags & IFBIF_SPAN)
 952                 /* SPAN is readonly */
 953                 return (EINVAL);
 954
 955         if (req->ifbr_ifsflags & IFBIF_STP) {
 956                 if ((bif->bif_flags & IFBIF_STP) == 0) {
 957                         error = bstp_add(&sc->sc_stp, &bif->bif_stp,
 958                                     bif->bif_ifp);
 959                         if (error)
 960                                 return (error);
 961                 }
 962         } else {
 963                 if ((bif->bif_flags & IFBIF_STP) != 0)
 964                         bstp_delete(&bif->bif_stp);
 965         }
 966
 967         bif->bif_flags = req->ifbr_ifsflags;
 968
 969         return (0);
 970 }
 971
 972 static int
 973 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
 974 {
 975         struct ifbrparam *param = arg;
 976
 977         BRIDGE_LOCK_ASSERT(sc);
 978
 979         sc->sc_brtmax = param->ifbrp_csize;
 980         bridge_rttrim(sc);
 981
 982         return (0);
 983 }
 984
 985 static int
 986 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
 987 {
 988         struct ifbrparam *param = arg;
 989
 990         BRIDGE_LOCK_ASSERT(sc);
 991
 992         param->ifbrp_csize = sc->sc_brtmax;
 993
 994         return (0);
 995 }
 996
 997 static int
 998 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
 999 {
1000         struct ifbifconf *bifc = arg;
1001         struct bridge_iflist *bif;
1002         struct ifbreq breq;
1003         int count, len, error = 0;
1004
1005         BRIDGE_LOCK_ASSERT(sc);
1006
1007         count = 0;
1008         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1009                 count++;
1010         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1011                 count++;
1012
1013         if (bifc->ifbic_len == 0) {
1014                 bifc->ifbic_len = sizeof(breq) * count;
1015                 return (0);
1016         }
1017
1018         count = 0;
1019         len = bifc->ifbic_len;
1020         bzero(&breq, sizeof(breq));
1021         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1022                 if (len < sizeof(breq))
1023                         break;
1024
1025                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1026                     sizeof(breq.ifbr_ifsname));
1027                 breq.ifbr_ifsflags = bif->bif_flags;
1028                 breq.ifbr_state = bif->bif_stp.bp_state;
1029                 breq.ifbr_priority = bif->bif_stp.bp_priority;
1030                 breq.ifbr_path_cost = bif->bif_stp.bp_path_cost;
1031                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1032                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1033                 if (error)
1034                         break;
1035                 count++;
1036                 len -= sizeof(breq);
1037         }
1038         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1039                 if (len < sizeof(breq))
1040                         break;
1041
1042                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1043                     sizeof(breq.ifbr_ifsname));
1044                 breq.ifbr_ifsflags = bif->bif_flags;
1045                 breq.ifbr_state = bif->bif_stp.bp_state;
1046                 breq.ifbr_priority = bif->bif_stp.bp_priority;
1047                 breq.ifbr_path_cost = bif->bif_stp.bp_path_cost;
1048                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1049                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1050                 if (error)
1051                         break;
1052                 count++;
1053                 len -= sizeof(breq);
1054         }
1055
1056         bifc->ifbic_len = sizeof(breq) * count;
1057         return (error);
1058 }
1059
1060 static int
1061 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1062 {
1063         struct ifbaconf *bac = arg;
1064         struct bridge_rtnode *brt;
1065         struct ifbareq bareq;
1066         int count = 0, error = 0, len;
1067
1068         BRIDGE_LOCK_ASSERT(sc);
1069
1070         if (bac->ifbac_len == 0)
1071                 return (0);
1072
1073         len = bac->ifbac_len;
1074         bzero(&bareq, sizeof(bareq));
1075         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1076                 if (len < sizeof(bareq))
1077                         goto out;
1078                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1079                     sizeof(bareq.ifba_ifsname));
1080                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1081                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1082                                 time_uptime < brt->brt_expire)
1083                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1084                 else
1085                         bareq.ifba_expire = 0;
1086                 bareq.ifba_flags = brt->brt_flags;
1087
1088                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1089                 if (error)
1090                         goto out;
1091                 count++;
1092                 len -= sizeof(bareq);
1093         }
1094 out:
1095         bac->ifbac_len = sizeof(bareq) * count;
1096         return (error);
1097 }
1098
1099 static int
1100 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1101 {
1102         struct ifbareq *req = arg;
1103         struct bridge_iflist *bif;
1104         int error;
1105
1106         BRIDGE_LOCK_ASSERT(sc);
1107
1108         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1109         if (bif == NULL)
1110                 return (ENOENT);
1111
1112         error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1113             req->ifba_flags);
1114
1115         return (error);
1116 }
1117
1118 static int
1119 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1120 {
1121         struct ifbrparam *param = arg;
1122
1123         BRIDGE_LOCK_ASSERT(sc);
1124
1125         sc->sc_brttimeout = param->ifbrp_ctime;
1126
1127         return (0);
1128 }
1129
1130 static int
1131 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1132 {
1133         struct ifbrparam *param = arg;
1134
1135         BRIDGE_LOCK_ASSERT(sc);
1136
1137         param->ifbrp_ctime = sc->sc_brttimeout;
1138
1139         return (0);
1140 }
1141
1142 static int
1143 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1144 {
1145         struct ifbareq *req = arg;
1146
1147         BRIDGE_LOCK_ASSERT(sc);
1148
1149         return (bridge_rtdaddr(sc, req->ifba_dst));
1150 }
1151
1152 static int
1153 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1154 {
1155         struct ifbreq *req = arg;
1156
1157         BRIDGE_LOCK_ASSERT(sc);
1158
1159         bridge_rtflush(sc, req->ifbr_ifsflags);
1160
1161         return (0);
1162 }
1163
1164 static int
1165 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1166 {
1167         struct ifbrparam *param = arg;
1168         struct bstp_state *bs = &sc->sc_stp;
1169
1170         BRIDGE_LOCK_ASSERT(sc);
1171
1172         param->ifbrp_prio = bs->bs_bridge_priority;
1173
1174         return (0);
1175 }
1176
1177 static int
1178 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1179 {
1180         struct ifbrparam *param = arg;
1181         struct bstp_state *bs = &sc->sc_stp;
1182
1183         BRIDGE_LOCK_ASSERT(sc);
1184
1185         bs->bs_bridge_priority = param->ifbrp_prio;
1186         bstp_reinit(bs);
1187
1188         return (0);
1189 }
1190
1191 static int
1192 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1193 {
1194         struct ifbrparam *param = arg;
1195         struct bstp_state *bs = &sc->sc_stp;
1196
1197         BRIDGE_LOCK_ASSERT(sc);
1198
1199         param->ifbrp_hellotime = bs->bs_bridge_hello_time >> 8;
1200
1201         return (0);
1202 }
1203
1204 static int
1205 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1206 {
1207         struct ifbrparam *param = arg;
1208         struct bstp_state *bs = &sc->sc_stp;
1209
1210         BRIDGE_LOCK_ASSERT(sc);
1211
1212         if (param->ifbrp_hellotime == 0)
1213                 return (EINVAL);
1214         bs->bs_bridge_hello_time = param->ifbrp_hellotime << 8;
1215         bstp_reinit(bs);
1216
1217         return (0);
1218 }
1219
1220 static int
1221 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1222 {
1223         struct ifbrparam *param = arg;
1224         struct bstp_state *bs = &sc->sc_stp;
1225
1226         BRIDGE_LOCK_ASSERT(sc);
1227
1228         param->ifbrp_fwddelay = bs->bs_bridge_forward_delay >> 8;
1229
1230         return (0);
1231 }
1232
1233 static int
1234 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1235 {
1236         struct ifbrparam *param = arg;
1237         struct bstp_state *bs = &sc->sc_stp;
1238
1239         BRIDGE_LOCK_ASSERT(sc);
1240
1241         if (param->ifbrp_fwddelay == 0)
1242                 return (EINVAL);
1243         bs->bs_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1244         bstp_reinit(bs);
1245
1246         return (0);
1247 }
1248
1249 static int
1250 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1251 {
1252         struct ifbrparam *param = arg;
1253         struct bstp_state *bs = &sc->sc_stp;
1254
1255         BRIDGE_LOCK_ASSERT(sc);
1256
1257         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1258
1259         return (0);
1260 }
1261
1262 static int
1263 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1264 {
1265         struct ifbrparam *param = arg;
1266         struct bstp_state *bs = &sc->sc_stp;
1267
1268         BRIDGE_LOCK_ASSERT(sc);
1269
1270         if (param->ifbrp_maxage == 0)
1271                 return (EINVAL);
1272         bs->bs_bridge_max_age = param->ifbrp_maxage << 8;
1273         bstp_reinit(bs);
1274
1275         return (0);
1276 }
1277
1278 static int
1279 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1280 {
1281         struct ifbreq *req = arg;
1282         struct bridge_iflist *bif;
1283
1284         BRIDGE_LOCK_ASSERT(sc);
1285
1286         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1287         if (bif == NULL)
1288                 return (ENOENT);
1289
1290         bif->bif_stp.bp_priority = req->ifbr_priority;
1291         bstp_reinit(&sc->sc_stp);
1292
1293         return (0);
1294 }
1295
1296 static int
1297 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1298 {
1299         struct ifbreq *req = arg;
1300         struct bridge_iflist *bif;
1301
1302         BRIDGE_LOCK_ASSERT(sc);
1303
1304         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1305         if (bif == NULL)
1306                 return (ENOENT);
1307
1308         bif->bif_stp.bp_path_cost = req->ifbr_path_cost;
1309         bstp_reinit(&sc->sc_stp);
1310
1311         return (0);
1312 }
1313
1314 static int
1315 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1316 {
1317         struct ifbreq *req = arg;
1318         struct bridge_iflist *bif = NULL;
1319         struct ifnet *ifs;
1320
1321         BRIDGE_LOCK_ASSERT(sc);
1322
1323         ifs = ifunit(req->ifbr_ifsname);
1324         if (ifs == NULL)
1325                 return (ENOENT);
1326
1327         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1328                 if (ifs == bif->bif_ifp)
1329                         return (EBUSY);
1330
1331         if (ifs->if_bridge != NULL)
1332                 return (EBUSY);
1333
1334         switch (ifs->if_type) {
1335                 case IFT_ETHER:
1336                 case IFT_GIF:
1337                 case IFT_L2VLAN:
1338                         break;
1339                 default:
1340                         return (EINVAL);
1341         }
1342
1343         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1344         if (bif == NULL)
1345                 return (ENOMEM);
1346
1347         bif->bif_ifp = ifs;
1348         bif->bif_flags = IFBIF_SPAN;
1349
1350         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1351
1352         return (0);
1353 }
1354
1355 static int
1356 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1357 {
1358         struct ifbreq *req = arg;
1359         struct bridge_iflist *bif;
1360         struct ifnet *ifs;
1361
1362         BRIDGE_LOCK_ASSERT(sc);
1363
1364         ifs = ifunit(req->ifbr_ifsname);
1365         if (ifs == NULL)
1366                 return (ENOENT);
1367
1368         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1369                 if (ifs == bif->bif_ifp)
1370                         break;
1371
1372         if (bif == NULL)
1373                 return (ENOENT);
1374
1375         bridge_delete_span(sc, bif);
1376
1377         return (0);
1378 }
1379
1380 /*
1381  * bridge_ifdetach:
1382  *
1383  *      Detach an interface from a bridge.  Called when a member
1384  *      interface is detaching.
1385  */
1386 static void
1387 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1388 {
1389         struct bridge_softc *sc = ifp->if_bridge;
1390         struct bridge_iflist *bif;
1391
1392         /* Check if the interface is a bridge member */
1393         if (sc != NULL) {
1394                 BRIDGE_LOCK(sc);
1395
1396                 bif = bridge_lookup_member_if(sc, ifp);
1397                 if (bif != NULL)
1398                         bridge_delete_member(sc, bif, 1);
1399
1400                 BRIDGE_UNLOCK(sc);
1401                 return;
1402         }
1403
1404         /* Check if the interface is a span port */
1405         mtx_lock(&bridge_list_mtx);
1406         LIST_FOREACH(sc, &bridge_list, sc_list) {
1407                 BRIDGE_LOCK(sc);
1408                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1409                         if (ifp == bif->bif_ifp) {
1410                                 bridge_delete_span(sc, bif);
1411                                 break;
1412                         }
1413
1414                 BRIDGE_UNLOCK(sc);
1415         }
1416         mtx_unlock(&bridge_list_mtx);
1417 }
1418
1419 /*
1420  * bridge_init:
1421  *
1422  *      Initialize a bridge interface.
1423  */
1424 static void
1425 bridge_init(void *xsc)
1426 {
1427         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1428         struct ifnet *ifp = sc->sc_ifp;
1429
1430         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1431                 return;
1432
1433         BRIDGE_LOCK(sc);
1434         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1435             bridge_timer, sc);
1436
1437         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1438         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1439
1440         BRIDGE_UNLOCK(sc);
1441 }
1442
1443 /*
1444  * bridge_stop:
1445  *
1446  *      Stop the bridge interface.
1447  */
1448 static void
1449 bridge_stop(struct ifnet *ifp, int disable)
1450 {
1451         struct bridge_softc *sc = ifp->if_softc;
1452
1453         BRIDGE_LOCK_ASSERT(sc);
1454
1455         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1456                 return;
1457
1458         callout_stop(&sc->sc_brcallout);
1459         bstp_stop(&sc->sc_stp);
1460
1461         bridge_rtflush(sc, IFBF_FLUSHDYN);
1462
1463         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1464 }
1465
1466 /*
1467  * bridge_enqueue:
1468  *
1469  *      Enqueue a packet on a bridge member interface.
1470  *
1471  */
1472 __inline void
1473 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1474 {
1475         int len, err = 0;
1476         short mflags;
1477         struct mbuf *m0;
1478
1479         len = m->m_pkthdr.len;
1480         mflags = m->m_flags;
1481
1482         /* We may be sending a fragment so traverse the mbuf */
1483         for (; m; m = m0) {
1484                 m0 = m->m_nextpkt;
1485                 m->m_nextpkt = NULL;
1486
1487                 if (err == 0)
1488                         IFQ_ENQUEUE(&dst_ifp->if_snd, m, err);
1489         }
1490
1491         if (err == 0) {
1492
1493                 sc->sc_ifp->if_opackets++;
1494                 sc->sc_ifp->if_obytes += len;
1495
1496                 dst_ifp->if_obytes += len;
1497
1498                 if (mflags & M_MCAST) {
1499                         sc->sc_ifp->if_omcasts++;
1500                         dst_ifp->if_omcasts++;
1501                 }
1502         }
1503
1504         if ((dst_ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1505                 (*dst_ifp->if_start)(dst_ifp);
1506 }
1507
1508 /*
1509  * bridge_dummynet:
1510  *
1511  *      Receive a queued packet from dummynet and pass it on to the output
1512  *      interface.
1513  *
1514  *      The mbuf has the Ethernet header already attached.
1515  */
1516 static void
1517 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1518 {
1519         struct bridge_softc *sc;
1520
1521         sc = ifp->if_bridge;
1522
1523         /*
1524          * The packet didnt originate from a member interface. This should only
1525          * ever happen if a member interface is removed while packets are
1526          * queued for it.
1527          */
1528         if (sc == NULL) {
1529                 m_freem(m);
1530                 return;
1531         }
1532
1533         if (PFIL_HOOKED(&inet_pfil_hook)
1534 #ifdef INET6
1535             || PFIL_HOOKED(&inet6_pfil_hook)
1536 #endif
1537             ) {
1538                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1539                         return;
1540                 if (m == NULL)
1541                         return;
1542         }
1543
1544         bridge_enqueue(sc, ifp, m);
1545 }
1546
1547 /*
1548  * bridge_output:
1549  *
1550  *      Send output from a bridge member interface.  This
1551  *      performs the bridging function for locally originated
1552  *      packets.
1553  *
1554  *      The mbuf has the Ethernet header already attached.  We must
1555  *      enqueue or free the mbuf before returning.
1556  */
1557 static int
1558 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1559     struct rtentry *rt)
1560 {
1561         struct ether_header *eh;
1562         struct ifnet *dst_if;
1563         struct bridge_softc *sc;
1564
1565         if (m->m_len < ETHER_HDR_LEN) {
1566                 m = m_pullup(m, ETHER_HDR_LEN);
1567                 if (m == NULL)
1568                         return (0);
1569         }
1570
1571         eh = mtod(m, struct ether_header *);
1572         sc = ifp->if_bridge;
1573
1574         BRIDGE_LOCK(sc);
1575
1576         /*
1577          * If bridge is down, but the original output interface is up,
1578          * go ahead and send out that interface.  Otherwise, the packet
1579          * is dropped below.
1580          */
1581         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1582                 dst_if = ifp;
1583                 goto sendunicast;
1584         }
1585
1586         /*
1587          * If the packet is a multicast, or we don't know a better way to
1588          * get there, send to all interfaces.
1589          */
1590         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1591                 dst_if = NULL;
1592         else
1593                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1594         if (dst_if == NULL) {
1595                 struct bridge_iflist *bif;
1596                 struct mbuf *mc;
1597                 int error = 0, used = 0;
1598
1599                 BRIDGE_LOCK2REF(sc, error);
1600                 if (error) {
1601                         m_freem(m);
1602                         return (0);
1603                 }
1604
1605                 bridge_span(sc, m);
1606
1607                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1608                         dst_if = bif->bif_ifp;
1609
1610                         if (dst_if->if_type == IFT_GIF)
1611                                 continue;
1612                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1613                                 continue;
1614
1615                         /*
1616                          * If this is not the original output interface,
1617                          * and the interface is participating in spanning
1618                          * tree, make sure the port is in a state that
1619                          * allows forwarding.
1620                          */
1621                         if (dst_if != ifp &&
1622                             (bif->bif_flags & IFBIF_STP) != 0) {
1623                                 switch (bif->bif_stp.bp_state) {
1624                                 case BSTP_IFSTATE_BLOCKING:
1625                                 case BSTP_IFSTATE_LISTENING:
1626                                 case BSTP_IFSTATE_DISABLED:
1627                                         continue;
1628                                 }
1629                         }
1630
1631                         if (LIST_NEXT(bif, bif_next) == NULL) {
1632                                 used = 1;
1633                                 mc = m;
1634                         } else {
1635                                 mc = m_copypacket(m, M_DONTWAIT);
1636                                 if (mc == NULL) {
1637                                         sc->sc_ifp->if_oerrors++;
1638                                         continue;
1639                                 }
1640                         }
1641
1642                         bridge_enqueue(sc, dst_if, mc);
1643                 }
1644                 if (used == 0)
1645                         m_freem(m);
1646                 BRIDGE_UNREF(sc);
1647                 return (0);
1648         }
1649
1650 sendunicast:
1651         /*
1652          * XXX Spanning tree consideration here?
1653          */
1654
1655         bridge_span(sc, m);
1656         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1657                 m_freem(m);
1658                 BRIDGE_UNLOCK(sc);
1659                 return (0);
1660         }
1661
1662         BRIDGE_UNLOCK(sc);
1663         bridge_enqueue(sc, dst_if, m);
1664         return (0);
1665 }
1666
1667 /*
1668  * bridge_start:
1669  *
1670  *      Start output on a bridge.
1671  *
1672  */
1673 static void
1674 bridge_start(struct ifnet *ifp)
1675 {
1676         struct bridge_softc *sc;
1677         struct mbuf *m;
1678         struct ether_header *eh;
1679         struct ifnet *dst_if;
1680
1681         sc = ifp->if_softc;
1682
1683         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1684         for (;;) {
1685                 IFQ_DEQUEUE(&ifp->if_snd, m);
1686                 if (m == 0)
1687                         break;
1688                 BPF_MTAP(ifp, m);
1689
1690                 eh = mtod(m, struct ether_header *);
1691                 dst_if = NULL;
1692
1693                 BRIDGE_LOCK(sc);
1694                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1695                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1696                 }
1697
1698                 if (dst_if == NULL)
1699                         bridge_broadcast(sc, ifp, m, 0);
1700                 else {
1701                         BRIDGE_UNLOCK(sc);
1702                         bridge_enqueue(sc, dst_if, m);
1703                 }
1704         }
1705         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1706 }
1707
1708 /*
1709  * bridge_forward:
1710  *
1711  *      The forwarding function of the bridge.
1712  *
1713  *      NOTE: Releases the lock on return.
1714  */
1715 static void
1716 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1717 {
1718         struct bridge_iflist *bif;
1719         struct ifnet *src_if, *dst_if, *ifp;
1720         struct ether_header *eh;
1721
1722         src_if = m->m_pkthdr.rcvif;
1723         BRIDGE_LOCK_ASSERT(sc);
1724         ifp = sc->sc_ifp;
1725
1726         sc->sc_ifp->if_ipackets++;
1727         sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
1728
1729         /*
1730          * Look up the bridge_iflist.
1731          */
1732         bif = bridge_lookup_member_if(sc, src_if);
1733         if (bif == NULL) {
1734                 /* Interface is not a bridge member (anymore?) */
1735                 BRIDGE_UNLOCK(sc);
1736                 m_freem(m);
1737                 return;
1738         }
1739
1740         if (bif->bif_flags & IFBIF_STP) {
1741                 switch (bif->bif_stp.bp_state) {
1742                 case BSTP_IFSTATE_BLOCKING:
1743                 case BSTP_IFSTATE_LISTENING:
1744                 case BSTP_IFSTATE_DISABLED:
1745                         BRIDGE_UNLOCK(sc);
1746                         m_freem(m);
1747                         return;
1748                 }
1749         }
1750
1751         eh = mtod(m, struct ether_header *);
1752
1753         /*
1754          * If the interface is learning, and the source
1755          * address is valid and not multicast, record
1756          * the address.
1757          */
1758         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1759             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1760             (eh->ether_shost[0] == 0 &&
1761              eh->ether_shost[1] == 0 &&
1762              eh->ether_shost[2] == 0 &&
1763              eh->ether_shost[3] == 0 &&
1764              eh->ether_shost[4] == 0 &&
1765              eh->ether_shost[5] == 0) == 0) {
1766                 (void) bridge_rtupdate(sc, eh->ether_shost,
1767                     src_if, 0, IFBAF_DYNAMIC);
1768         }
1769
1770         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1771             bif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
1772                 m_freem(m);
1773                 BRIDGE_UNLOCK(sc);
1774                 return;
1775         }
1776
1777         /*
1778          * At this point, the port either doesn't participate
1779          * in spanning tree or it is in the forwarding state.
1780          */
1781
1782         /*
1783          * If the packet is unicast, destined for someone on
1784          * "this" side of the bridge, drop it.
1785          */
1786         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1787                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1788                 if (src_if == dst_if) {
1789                         BRIDGE_UNLOCK(sc);
1790                         m_freem(m);
1791                         return;
1792                 }
1793         } else {
1794                 /* ...forward it to all interfaces. */
1795                 sc->sc_ifp->if_imcasts++;
1796                 dst_if = NULL;
1797         }
1798
1799         /*
1800          * If we have a destination interface which is a member of our bridge,
1801          * OR this is a unicast packet, push it through the bpf(4) machinery.
1802          * For broadcast or multicast packets, don't bother because it will
1803          * be reinjected into ether_input. We do this before we pass the packets
1804          * through the pfil(9) framework, as it is possible that pfil(9) will
1805          * drop the packet, or possibly modify it, making it difficult to debug
1806          * firewall issues on the bridge.
1807          */
1808         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1809                 BPF_MTAP(ifp, m);
1810
1811         /* run the packet filter */
1812         if (PFIL_HOOKED(&inet_pfil_hook)
1813 #ifdef INET6
1814             || PFIL_HOOKED(&inet6_pfil_hook)
1815 #endif
1816             ) {
1817                 BRIDGE_UNLOCK(sc);
1818                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1819                         return;
1820                 if (m == NULL)
1821                         return;
1822                 BRIDGE_LOCK(sc);
1823         }
1824
1825         if (dst_if == NULL) {
1826                 bridge_broadcast(sc, src_if, m, 1);
1827                 return;
1828         }
1829
1830         /*
1831          * At this point, we're dealing with a unicast frame
1832          * going to a different interface.
1833          */
1834         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1835                 BRIDGE_UNLOCK(sc);
1836                 m_freem(m);
1837                 return;
1838         }
1839         bif = bridge_lookup_member_if(sc, dst_if);
1840         if (bif == NULL) {
1841                 /* Not a member of the bridge (anymore?) */
1842                 BRIDGE_UNLOCK(sc);
1843                 m_freem(m);
1844                 return;
1845         }
1846
1847         if (bif->bif_flags & IFBIF_STP) {
1848                 switch (bif->bif_stp.bp_state) {
1849                 case BSTP_IFSTATE_DISABLED:
1850                 case BSTP_IFSTATE_BLOCKING:
1851                         BRIDGE_UNLOCK(sc);
1852                         m_freem(m);
1853                         return;
1854                 }
1855         }
1856
1857         BRIDGE_UNLOCK(sc);
1858
1859         if (PFIL_HOOKED(&inet_pfil_hook)
1860 #ifdef INET6
1861             || PFIL_HOOKED(&inet6_pfil_hook)
1862 #endif
1863             ) {
1864                 if (bridge_pfil(&m, sc->sc_ifp, dst_if, PFIL_OUT) != 0)
1865                         return;
1866                 if (m == NULL)
1867                         return;
1868         }
1869
1870         bridge_enqueue(sc, dst_if, m);
1871 }
1872
1873 /*
1874  * bridge_input:
1875  *
1876  *      Receive input from a member interface.  Queue the packet for
1877  *      bridging if it is not for us.
1878  */
1879 static struct mbuf *
1880 bridge_input(struct ifnet *ifp, struct mbuf *m)
1881 {
1882         struct bridge_softc *sc = ifp->if_bridge;
1883         struct bridge_iflist *bif;
1884         struct ifnet *bifp;
1885         struct ether_header *eh;
1886         struct mbuf *mc, *mc2;
1887
1888         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1889                 return (m);
1890
1891         bifp = sc->sc_ifp;
1892
1893         /*
1894          * Implement support for bridge monitoring. If this flag has been
1895          * set on this interface, discard the packet once we push it through
1896          * the bpf(4) machinery, but before we do, increment the byte and
1897          * packet counters associated with this interface.
1898          */
1899         if ((bifp->if_flags & IFF_MONITOR) != 0) {
1900                 m->m_pkthdr.rcvif  = bifp;
1901                 BPF_MTAP(bifp, m);
1902                 bifp->if_ipackets++;
1903                 bifp->if_ibytes += m->m_pkthdr.len;
1904                 m_free(m);
1905                 return (NULL);
1906         }
1907         BRIDGE_LOCK(sc);
1908         bif = bridge_lookup_member_if(sc, ifp);
1909         if (bif == NULL) {
1910                 BRIDGE_UNLOCK(sc);
1911                 return (m);
1912         }
1913
1914         eh = mtod(m, struct ether_header *);
1915
1916         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp),
1917             ETHER_ADDR_LEN) == 0) {
1918                 /*
1919                  * If the packet is for us, set the packets source as the
1920                  * bridge, and return the packet back to ether_input for
1921                  * local processing.
1922                  */
1923
1924                 /* Mark the packet as arriving on the bridge interface */
1925                 m->m_pkthdr.rcvif = bifp;
1926                 BPF_MTAP(bifp, m);
1927                 bifp->if_ipackets++;
1928
1929                 BRIDGE_UNLOCK(sc);
1930                 return (m);
1931         }
1932
1933         bridge_span(sc, m);
1934
1935         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1936                 /* Tap off 802.1D packets; they do not get forwarded. */
1937                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
1938                     ETHER_ADDR_LEN) == 0) {
1939                         m = bstp_input(&bif->bif_stp, ifp, m);
1940                         if (m == NULL) {
1941                                 BRIDGE_UNLOCK(sc);
1942                                 return (NULL);
1943                         }
1944                 }
1945
1946                 if (bif->bif_flags & IFBIF_STP) {
1947                         switch (bif->bif_stp.bp_state) {
1948                         case BSTP_IFSTATE_BLOCKING:
1949                         case BSTP_IFSTATE_LISTENING:
1950                         case BSTP_IFSTATE_DISABLED:
1951                                 BRIDGE_UNLOCK(sc);
1952                                 return (m);
1953                         }
1954                 }
1955
1956                 if (bcmp(etherbroadcastaddr, eh->ether_dhost,
1957                     sizeof(etherbroadcastaddr)) == 0)
1958                         m->m_flags |= M_BCAST;
1959                 else
1960                         m->m_flags |= M_MCAST;
1961
1962                 /*
1963                  * Make a deep copy of the packet and enqueue the copy
1964                  * for bridge processing; return the original packet for
1965                  * local processing.
1966                  */
1967                 mc = m_dup(m, M_DONTWAIT);
1968                 if (mc == NULL) {
1969                         BRIDGE_UNLOCK(sc);
1970                         return (m);
1971                 }
1972
1973                 /* Perform the bridge forwarding function with the copy. */
1974                 bridge_forward(sc, mc);
1975
1976                 /*
1977                  * Reinject the mbuf as arriving on the bridge so we have a
1978                  * chance at claiming multicast packets. We can not loop back
1979                  * here from ether_input as a bridge is never a member of a
1980                  * bridge.
1981                  */
1982                 KASSERT(bifp->if_bridge == NULL,
1983                     ("loop created in bridge_input"));
1984                 mc2 = m_dup(m, M_DONTWAIT);
1985                 if (mc2 != NULL) {
1986                         /* Keep the layer3 header aligned */
1987                         int i = min(mc2->m_pkthdr.len, max_protohdr);
1988                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
1989                 }
1990                 if (mc2 != NULL) {
1991                         mc2->m_pkthdr.rcvif = bifp;
1992                         (*bifp->if_input)(bifp, mc2);
1993                 }
1994
1995                 /* Return the original packet for local processing. */
1996                 return (m);
1997         }
1998
1999         if (bif->bif_flags & IFBIF_STP) {
2000                 switch (bif->bif_stp.bp_state) {
2001                 case BSTP_IFSTATE_BLOCKING:
2002                 case BSTP_IFSTATE_LISTENING:
2003                 case BSTP_IFSTATE_DISABLED:
2004                         BRIDGE_UNLOCK(sc);
2005                         return (m);
2006                 }
2007         }
2008
2009         /*
2010          * Unicast.  Make sure it's not for us.
2011          */
2012         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2013                 if (bif->bif_ifp->if_type == IFT_GIF)
2014                         continue;
2015                 /* It is destined for us. */
2016                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
2017                     ETHER_ADDR_LEN) == 0
2018 #ifdef DEV_CARP
2019                     || (bif->bif_ifp->if_carp
2020                         && carp_forus(bif->bif_ifp->if_carp, eh->ether_dhost))
2021 #endif
2022                     ) {
2023                         if (bif->bif_flags & IFBIF_LEARNING)
2024                                 (void) bridge_rtupdate(sc,
2025                                     eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
2026                         m->m_pkthdr.rcvif = bif->bif_ifp;
2027                         BRIDGE_UNLOCK(sc);
2028                         return (m);
2029                 }
2030
2031                 /* We just received a packet that we sent out. */
2032                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
2033                     ETHER_ADDR_LEN) == 0
2034 #ifdef DEV_CARP
2035                     || (bif->bif_ifp->if_carp
2036                         && carp_forus(bif->bif_ifp->if_carp, eh->ether_shost))
2037 #endif
2038                     ) {
2039                         BRIDGE_UNLOCK(sc);
2040                         m_freem(m);
2041                         return (NULL);
2042                 }
2043         }
2044
2045         /* Perform the bridge forwarding function. */
2046         bridge_forward(sc, m);
2047
2048         return (NULL);
2049 }
2050
2051 /*
2052  * bridge_broadcast:
2053  *
2054  *      Send a frame to all interfaces that are members of
2055  *      the bridge, except for the one on which the packet
2056  *      arrived.
2057  *
2058  *      NOTE: Releases the lock on return.
2059  */
2060 static void
2061 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2062     struct mbuf *m, int runfilt)
2063 {
2064         struct bridge_iflist *bif;
2065         struct mbuf *mc;
2066         struct ifnet *dst_if;
2067         int error = 0, used = 0, i;
2068
2069         BRIDGE_LOCK_ASSERT(sc);
2070         BRIDGE_LOCK2REF(sc, error);
2071         if (error) {
2072                 m_freem(m);
2073                 return;
2074         }
2075
2076         /* Filter on the bridge interface before broadcasting */
2077         if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2078 #ifdef INET6
2079             || PFIL_HOOKED(&inet6_pfil_hook)
2080 #endif
2081             )) {
2082                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2083                         goto out;
2084                 if (m == NULL)
2085                         goto out;
2086         }
2087
2088         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2089                 dst_if = bif->bif_ifp;
2090                 if (dst_if == src_if)
2091                         continue;
2092
2093                 if (bif->bif_flags & IFBIF_STP) {
2094                         switch (bif->bif_stp.bp_state) {
2095                         case BSTP_IFSTATE_BLOCKING:
2096                         case BSTP_IFSTATE_DISABLED:
2097                                 continue;
2098                         }
2099                 }
2100
2101                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2102                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2103                         continue;
2104
2105                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2106                         continue;
2107
2108                 if (LIST_NEXT(bif, bif_next) == NULL) {
2109                         mc = m;
2110                         used = 1;
2111                 } else {
2112                         mc = m_dup(m, M_DONTWAIT);
2113                         if (mc == NULL) {
2114                                 sc->sc_ifp->if_oerrors++;
2115                                 continue;
2116                         }
2117                 }
2118
2119                 /*
2120                  * Filter on the output interface. Pass a NULL bridge interface
2121                  * pointer so we do not redundantly filter on the bridge for
2122                  * each interface we broadcast on.
2123                  */
2124                 if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2125 #ifdef INET6
2126                     || PFIL_HOOKED(&inet6_pfil_hook)
2127 #endif
2128                     )) {
2129                         if (used == 0) {
2130                                 /* Keep the layer3 header aligned */
2131                                 i = min(mc->m_pkthdr.len, max_protohdr);
2132                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2133                                 if (mc == NULL) {
2134                                         sc->sc_ifp->if_oerrors++;
2135                                         continue;
2136                                 }
2137                         }
2138                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2139                                 continue;
2140                         if (mc == NULL)
2141                                 continue;
2142                 }
2143
2144                 bridge_enqueue(sc, dst_if, mc);
2145         }
2146         if (used == 0)
2147                 m_freem(m);
2148
2149 out:
2150         BRIDGE_UNREF(sc);
2151 }
2152
2153 /*
2154  * bridge_span:
2155  *
2156  *      Duplicate a packet out one or more interfaces that are in span mode,
2157  *      the original mbuf is unmodified.
2158  */
2159 static void
2160 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2161 {
2162         struct bridge_iflist *bif;
2163         struct ifnet *dst_if;
2164         struct mbuf *mc;
2165
2166         if (LIST_EMPTY(&sc->sc_spanlist))
2167                 return;
2168
2169         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2170                 dst_if = bif->bif_ifp;
2171
2172                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2173                         continue;
2174
2175                 mc = m_copypacket(m, M_DONTWAIT);
2176                 if (mc == NULL) {
2177                         sc->sc_ifp->if_oerrors++;
2178                         continue;
2179                 }
2180
2181                 bridge_enqueue(sc, dst_if, mc);
2182         }
2183 }
2184
2185 /*
2186  * bridge_rtupdate:
2187  *
2188  *      Add a bridge routing entry.
2189  */
2190 static int
2191 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2192     struct ifnet *dst_if, int setflags, uint8_t flags)
2193 {
2194         struct bridge_rtnode *brt;
2195         int error;
2196
2197         BRIDGE_LOCK_ASSERT(sc);
2198
2199         /*
2200          * A route for this destination might already exist.  If so,
2201          * update it, otherwise create a new one.
2202          */
2203         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2204                 if (sc->sc_brtcnt >= sc->sc_brtmax)
2205                         return (ENOSPC);
2206
2207                 /*
2208                  * Allocate a new bridge forwarding node, and
2209                  * initialize the expiration time and Ethernet
2210                  * address.
2211                  */
2212                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2213                 if (brt == NULL)
2214                         return (ENOMEM);
2215
2216                 brt->brt_flags = IFBAF_DYNAMIC;
2217                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2218
2219                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2220                         uma_zfree(bridge_rtnode_zone, brt);
2221                         return (error);
2222                 }
2223         }
2224
2225         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2226                 brt->brt_ifp = dst_if;
2227         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2228                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2229         if (setflags)
2230                 brt->brt_flags = flags;
2231
2232         return (0);
2233 }
2234
2235 /*
2236  * bridge_rtlookup:
2237  *
2238  *      Lookup the destination interface for an address.
2239  */
2240 static struct ifnet *
2241 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2242 {
2243         struct bridge_rtnode *brt;
2244
2245         BRIDGE_LOCK_ASSERT(sc);
2246
2247         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2248                 return (NULL);
2249
2250         return (brt->brt_ifp);
2251 }
2252
2253 /*
2254  * bridge_rttrim:
2255  *
2256  *      Trim the routine table so that we have a number
2257  *      of routing entries less than or equal to the
2258  *      maximum number.
2259  */
2260 static void
2261 bridge_rttrim(struct bridge_softc *sc)
2262 {
2263         struct bridge_rtnode *brt, *nbrt;
2264
2265         BRIDGE_LOCK_ASSERT(sc);
2266
2267         /* Make sure we actually need to do this. */
2268         if (sc->sc_brtcnt <= sc->sc_brtmax)
2269                 return;
2270
2271         /* Force an aging cycle; this might trim enough addresses. */
2272         bridge_rtage(sc);
2273         if (sc->sc_brtcnt <= sc->sc_brtmax)
2274                 return;
2275
2276         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2277                 nbrt = LIST_NEXT(brt, brt_list);
2278                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2279                         bridge_rtnode_destroy(sc, brt);
2280                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2281                                 return;
2282                 }
2283         }
2284 }
2285
2286 /*
2287  * bridge_timer:
2288  *
2289  *      Aging timer for the bridge.
2290  */
2291 static void
2292 bridge_timer(void *arg)
2293 {
2294         struct bridge_softc *sc = arg;
2295
2296         BRIDGE_LOCK_ASSERT(sc);
2297
2298         bridge_rtage(sc);
2299
2300         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2301                 callout_reset(&sc->sc_brcallout,
2302                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2303 }
2304
2305 /*
2306  * bridge_rtage:
2307  *
2308  *      Perform an aging cycle.
2309  */
2310 static void
2311 bridge_rtage(struct bridge_softc *sc)
2312 {
2313         struct bridge_rtnode *brt, *nbrt;
2314
2315         BRIDGE_LOCK_ASSERT(sc);
2316
2317         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2318                 nbrt = LIST_NEXT(brt, brt_list);
2319                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2320                         if (time_uptime >= brt->brt_expire)
2321                                 bridge_rtnode_destroy(sc, brt);
2322                 }
2323         }
2324 }
2325
2326 /*
2327  * bridge_rtflush:
2328  *
2329  *      Remove all dynamic addresses from the bridge.
2330  */
2331 static void
2332 bridge_rtflush(struct bridge_softc *sc, int full)
2333 {
2334         struct bridge_rtnode *brt, *nbrt;
2335
2336         BRIDGE_LOCK_ASSERT(sc);
2337
2338         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2339                 nbrt = LIST_NEXT(brt, brt_list);
2340                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2341                         bridge_rtnode_destroy(sc, brt);
2342         }
2343 }
2344
2345 /*
2346  * bridge_rtdaddr:
2347  *
2348  *      Remove an address from the table.
2349  */
2350 static int
2351 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2352 {
2353         struct bridge_rtnode *brt;
2354
2355         BRIDGE_LOCK_ASSERT(sc);
2356
2357         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2358                 return (ENOENT);
2359
2360         bridge_rtnode_destroy(sc, brt);
2361         return (0);
2362 }
2363
2364 /*
2365  * bridge_rtdelete:
2366  *
2367  *      Delete routes to a speicifc member interface.
2368  */
2369 void
2370 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2371 {
2372         struct bridge_rtnode *brt, *nbrt;
2373
2374         BRIDGE_LOCK_ASSERT(sc);
2375
2376         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2377                 nbrt = LIST_NEXT(brt, brt_list);
2378                 if (brt->brt_ifp == ifp && (full ||
2379                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2380                         bridge_rtnode_destroy(sc, brt);
2381         }
2382 }
2383
2384 /*
2385  * bridge_rtable_init:
2386  *
2387  *      Initialize the route table for this bridge.
2388  */
2389 static int
2390 bridge_rtable_init(struct bridge_softc *sc)
2391 {
2392         int i;
2393
2394         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2395             M_DEVBUF, M_NOWAIT);
2396         if (sc->sc_rthash == NULL)
2397                 return (ENOMEM);
2398
2399         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2400                 LIST_INIT(&sc->sc_rthash[i]);
2401
2402         sc->sc_rthash_key = arc4random();
2403
2404         LIST_INIT(&sc->sc_rtlist);
2405
2406         return (0);
2407 }
2408
2409 /*
2410  * bridge_rtable_fini:
2411  *
2412  *      Deconstruct the route table for this bridge.
2413  */
2414 static void
2415 bridge_rtable_fini(struct bridge_softc *sc)
2416 {
2417
2418         free(sc->sc_rthash, M_DEVBUF);
2419 }
2420
2421 /*
2422  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2423  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2424  */
2425 #define mix(a, b, c)                                                    \
2426 do {                                                                    \
2427         a -= b; a -= c; a ^= (c >> 13);                                 \
2428         b -= c; b -= a; b ^= (a << 8);                                  \
2429         c -= a; c -= b; c ^= (b >> 13);                                 \
2430         a -= b; a -= c; a ^= (c >> 12);                                 \
2431         b -= c; b -= a; b ^= (a << 16);                                 \
2432         c -= a; c -= b; c ^= (b >> 5);                                  \
2433         a -= b; a -= c; a ^= (c >> 3);                                  \
2434         b -= c; b -= a; b ^= (a << 10);                                 \
2435         c -= a; c -= b; c ^= (b >> 15);                                 \
2436 } while (/*CONSTCOND*/0)
2437
2438 static __inline uint32_t
2439 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2440 {
2441         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2442
2443         b += addr[5] << 8;
2444         b += addr[4];
2445         a += addr[3] << 24;
2446         a += addr[2] << 16;
2447         a += addr[1] << 8;
2448         a += addr[0];
2449
2450         mix(a, b, c);
2451
2452         return (c & BRIDGE_RTHASH_MASK);
2453 }
2454
2455 #undef mix
2456
2457 static int
2458 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2459 {
2460         int i, d;
2461
2462         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2463                 d = ((int)a[i]) - ((int)b[i]);
2464         }
2465
2466         return (d);
2467 }
2468
2469 /*
2470  * bridge_rtnode_lookup:
2471  *
2472  *      Look up a bridge route node for the specified destination.
2473  */
2474 static struct bridge_rtnode *
2475 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2476 {
2477         struct bridge_rtnode *brt;
2478         uint32_t hash;
2479         int dir;
2480
2481         BRIDGE_LOCK_ASSERT(sc);
2482
2483         hash = bridge_rthash(sc, addr);
2484         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2485                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2486                 if (dir == 0)
2487                         return (brt);
2488                 if (dir > 0)
2489                         return (NULL);
2490         }
2491
2492         return (NULL);
2493 }
2494
2495 /*
2496  * bridge_rtnode_insert:
2497  *
2498  *      Insert the specified bridge node into the route table.  We
2499  *      assume the entry is not already in the table.
2500  */
2501 static int
2502 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2503 {
2504         struct bridge_rtnode *lbrt;
2505         uint32_t hash;
2506         int dir;
2507
2508         BRIDGE_LOCK_ASSERT(sc);
2509
2510         hash = bridge_rthash(sc, brt->brt_addr);
2511
2512         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2513         if (lbrt == NULL) {
2514                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2515                 goto out;
2516         }
2517
2518         do {
2519                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2520                 if (dir == 0)
2521                         return (EEXIST);
2522                 if (dir > 0) {
2523                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2524                         goto out;
2525                 }
2526                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2527                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2528                         goto out;
2529                 }
2530                 lbrt = LIST_NEXT(lbrt, brt_hash);
2531         } while (lbrt != NULL);
2532
2533 #ifdef DIAGNOSTIC
2534         panic("bridge_rtnode_insert: impossible");
2535 #endif
2536
2537 out:
2538         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2539         sc->sc_brtcnt++;
2540
2541         return (0);
2542 }
2543
2544 /*
2545  * bridge_rtnode_destroy:
2546  *
2547  *      Destroy a bridge rtnode.
2548  */
2549 static void
2550 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2551 {
2552         BRIDGE_LOCK_ASSERT(sc);
2553
2554         LIST_REMOVE(brt, brt_hash);
2555
2556         LIST_REMOVE(brt, brt_list);
2557         sc->sc_brtcnt--;
2558         uma_zfree(bridge_rtnode_zone, brt);
2559 }
2560
2561 /*
2562  * Send bridge packets through pfil if they are one of the types pfil can deal
2563  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2564  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2565  * that interface.
2566  */
2567 static int
2568 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2569 {
2570         int snap, error, i, hlen;
2571         struct ether_header *eh1, eh2;
2572         struct ip_fw_args args;
2573         struct ip *ip;
2574         struct llc llc1;
2575         u_int16_t ether_type;
2576
2577         snap = 0;
2578         error = -1;     /* Default error if not error == 0 */
2579
2580         /* we may return with the IP fields swapped, ensure its not shared */
2581         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2582
2583         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2584                 return (0); /* filtering is disabled */
2585
2586         i = min((*mp)->m_pkthdr.len, max_protohdr);
2587         if ((*mp)->m_len < i) {
2588             *mp = m_pullup(*mp, i);
2589             if (*mp == NULL) {
2590                 printf("%s: m_pullup failed\n", __func__);
2591                 return (-1);
2592             }
2593         }
2594
2595         eh1 = mtod(*mp, struct ether_header *);
2596         ether_type = ntohs(eh1->ether_type);
2597
2598         /*
2599          * Check for SNAP/LLC.
2600          */
2601         if (ether_type < ETHERMTU) {
2602                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2603
2604                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2605                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2606                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2607                     llc2->llc_control == LLC_UI) {
2608                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2609                         snap = 1;
2610                 }
2611         }
2612
2613         /*
2614          * If we're trying to filter bridge traffic, don't look at anything
2615          * other than IP and ARP traffic.  If the filter doesn't understand
2616          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2617          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2618          * but of course we don't have an AppleTalk filter to begin with.
2619          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2620          * ARP traffic.)
2621          */
2622         switch (ether_type) {
2623                 case ETHERTYPE_ARP:
2624                 case ETHERTYPE_REVARP:
2625                         return (0); /* Automatically pass */
2626                 case ETHERTYPE_IP:
2627 #ifdef INET6
2628                 case ETHERTYPE_IPV6:
2629 #endif /* INET6 */
2630                         break;
2631                 default:
2632                         /*
2633                          * Check to see if the user wants to pass non-ip
2634                          * packets, these will not be checked by pfil(9) and
2635                          * passed unconditionally so the default is to drop.
2636                          */
2637                         if (pfil_onlyip)
2638                                 goto bad;
2639         }
2640
2641         /* Strip off the Ethernet header and keep a copy. */
2642         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2643         m_adj(*mp, ETHER_HDR_LEN);
2644
2645         /* Strip off snap header, if present */
2646         if (snap) {
2647                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2648                 m_adj(*mp, sizeof(struct llc));
2649         }
2650
2651         /*
2652          * Check the IP header for alignment and errors
2653          */
2654         if (dir == PFIL_IN) {
2655                 switch (ether_type) {
2656                         case ETHERTYPE_IP:
2657                                 error = bridge_ip_checkbasic(mp);
2658                                 break;
2659 #ifdef INET6
2660                         case ETHERTYPE_IPV6:
2661                                 error = bridge_ip6_checkbasic(mp);
2662                                 break;
2663 #endif /* INET6 */
2664                         default:
2665                                 error = 0;
2666                 }
2667                 if (error)
2668                         goto bad;
2669         }
2670
2671         if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
2672                 error = -1;
2673                 args.rule = ip_dn_claim_rule(*mp);
2674                 if (args.rule != NULL && fw_one_pass)
2675                         goto ipfwpass; /* packet already partially processed */
2676
2677                 args.m = *mp;
2678                 args.oif = ifp;
2679                 args.next_hop = NULL;
2680                 args.eh = &eh2;
2681                 args.inp = NULL;        /* used by ipfw uid/gid/jail rules */
2682                 i = ip_fw_chk_ptr(&args);
2683                 *mp = args.m;
2684
2685                 if (*mp == NULL)
2686                         return (error);
2687
2688                 if (DUMMYNET_LOADED && (i == IP_FW_DUMMYNET)) {
2689
2690                         /* put the Ethernet header back on */
2691                         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2692                         if (*mp == NULL)
2693                                 return (error);
2694                         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2695
2696                         /*
2697                          * Pass the pkt to dummynet, which consumes it. The
2698                          * packet will return to us via bridge_dummynet().
2699                          */
2700                         args.oif = ifp;
2701                         ip_dn_io_ptr(*mp, DN_TO_IFB_FWD, &args);
2702                         return (error);
2703                 }
2704
2705                 if (i != IP_FW_PASS) /* drop */
2706                         goto bad;
2707         }
2708
2709 ipfwpass:
2710         error = 0;
2711
2712         /*
2713          * Run the packet through pfil
2714          */
2715         switch (ether_type) {
2716         case ETHERTYPE_IP:
2717                 /*
2718                  * before calling the firewall, swap fields the same as
2719                  * IP does. here we assume the header is contiguous
2720                  */
2721                 ip = mtod(*mp, struct ip *);
2722
2723                 ip->ip_len = ntohs(ip->ip_len);
2724                 ip->ip_off = ntohs(ip->ip_off);
2725
2726                 /*
2727                  * Run pfil on the member interface and the bridge, both can
2728                  * be skipped by clearing pfil_member or pfil_bridge.
2729                  *
2730                  * Keep the order:
2731                  *   in_if -> bridge_if -> out_if
2732                  */
2733                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2734                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2735                                         dir, NULL);
2736
2737                 if (*mp == NULL || error != 0) /* filter may consume */
2738                         break;
2739
2740                 if (pfil_member && ifp != NULL)
2741                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2742                                         dir, NULL);
2743
2744                 if (*mp == NULL || error != 0) /* filter may consume */
2745                         break;
2746
2747                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2748                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2749                                         dir, NULL);
2750
2751                 if (*mp == NULL || error != 0) /* filter may consume */
2752                         break;
2753
2754                 /* check if we need to fragment the packet */
2755                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2756                         i = (*mp)->m_pkthdr.len;
2757                         if (i > ifp->if_mtu) {
2758                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2759                                             &llc1);
2760                                 return (error);
2761                         }
2762                 }
2763
2764                 /* Recalculate the ip checksum and restore byte ordering */
2765                 ip = mtod(*mp, struct ip *);
2766                 hlen = ip->ip_hl << 2;
2767                 if (hlen < sizeof(struct ip))
2768                         goto bad;
2769                 if (hlen > (*mp)->m_len) {
2770                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2771                                 goto bad;
2772                         ip = mtod(*mp, struct ip *);
2773                         if (ip == NULL)
2774                                 goto bad;
2775                 }
2776                 ip->ip_len = htons(ip->ip_len);
2777                 ip->ip_off = htons(ip->ip_off);
2778                 ip->ip_sum = 0;
2779                 if (hlen == sizeof(struct ip))
2780                         ip->ip_sum = in_cksum_hdr(ip);
2781                 else
2782                         ip->ip_sum = in_cksum(*mp, hlen);
2783
2784                 break;
2785 #ifdef INET6
2786         case ETHERTYPE_IPV6:
2787                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2788                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2789                                         dir, NULL);
2790
2791                 if (*mp == NULL || error != 0) /* filter may consume */
2792                         break;
2793
2794                 if (pfil_member && ifp != NULL)
2795                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2796                                         dir, NULL);
2797
2798                 if (*mp == NULL || error != 0) /* filter may consume */
2799                         break;
2800
2801                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2802                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2803                                         dir, NULL);
2804                 break;
2805 #endif
2806         default:
2807                 error = 0;
2808                 break;
2809         }
2810
2811         if (*mp == NULL)
2812                 return (error);
2813         if (error != 0)
2814                 goto bad;
2815
2816         error = -1;
2817
2818         /*
2819          * Finally, put everything back the way it was and return
2820          */
2821         if (snap) {
2822                 M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2823                 if (*mp == NULL)
2824                         return (error);
2825                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2826         }
2827
2828         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2829         if (*mp == NULL)
2830                 return (error);
2831         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2832
2833         return (0);
2834
2835 bad:
2836         m_freem(*mp);
2837         *mp = NULL;
2838         return (error);
2839 }
2840
2841 /*
2842  * Perform basic checks on header size since
2843  * pfil assumes ip_input has already processed
2844  * it for it.  Cut-and-pasted from ip_input.c.
2845  * Given how simple the IPv6 version is,
2846  * does the IPv4 version really need to be
2847  * this complicated?
2848  *
2849  * XXX Should we update ipstat here, or not?
2850  * XXX Right now we update ipstat but not
2851  * XXX csum_counter.
2852  */
2853 static int
2854 bridge_ip_checkbasic(struct mbuf **mp)
2855 {
2856         struct mbuf *m = *mp;
2857         struct ip *ip;
2858         int len, hlen;
2859         u_short sum;
2860
2861         if (*mp == NULL)
2862                 return (-1);
2863
2864         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2865                 if ((m = m_copyup(m, sizeof(struct ip),
2866                         (max_linkhdr + 3) & ~3)) == NULL) {
2867                         /* XXXJRT new stat, please */
2868                         ipstat.ips_toosmall++;
2869                         goto bad;
2870                 }
2871         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
2872                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2873                         ipstat.ips_toosmall++;
2874                         goto bad;
2875                 }
2876         }
2877         ip = mtod(m, struct ip *);
2878         if (ip == NULL) goto bad;
2879
2880         if (ip->ip_v != IPVERSION) {
2881                 ipstat.ips_badvers++;
2882                 goto bad;
2883         }
2884         hlen = ip->ip_hl << 2;
2885         if (hlen < sizeof(struct ip)) { /* minimum header length */
2886                 ipstat.ips_badhlen++;
2887                 goto bad;
2888         }
2889         if (hlen > m->m_len) {
2890                 if ((m = m_pullup(m, hlen)) == 0) {
2891                         ipstat.ips_badhlen++;
2892                         goto bad;
2893                 }
2894                 ip = mtod(m, struct ip *);
2895                 if (ip == NULL) goto bad;
2896         }
2897
2898         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2899                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2900         } else {
2901                 if (hlen == sizeof(struct ip)) {
2902                         sum = in_cksum_hdr(ip);
2903                 } else {
2904                         sum = in_cksum(m, hlen);
2905                 }
2906         }
2907         if (sum) {
2908                 ipstat.ips_badsum++;
2909                 goto bad;
2910         }
2911
2912         /* Retrieve the packet length. */
2913         len = ntohs(ip->ip_len);
2914
2915         /*
2916          * Check for additional length bogosity
2917          */
2918         if (len < hlen) {
2919                 ipstat.ips_badlen++;
2920                 goto bad;
2921         }
2922
2923         /*
2924          * Check that the amount of data in the buffers
2925          * is as at least much as the IP header would have us expect.
2926          * Drop packet if shorter than we expect.
2927          */
2928         if (m->m_pkthdr.len < len) {
2929                 ipstat.ips_tooshort++;
2930                 goto bad;
2931         }
2932
2933         /* Checks out, proceed */
2934         *mp = m;
2935         return (0);
2936
2937 bad:
2938         *mp = m;
2939         return (-1);
2940 }
2941
2942 #ifdef INET6
2943 /*
2944  * Same as above, but for IPv6.
2945  * Cut-and-pasted from ip6_input.c.
2946  * XXX Should we update ip6stat, or not?
2947  */
2948 static int
2949 bridge_ip6_checkbasic(struct mbuf **mp)
2950 {
2951         struct mbuf *m = *mp;
2952         struct ip6_hdr *ip6;
2953
2954         /*
2955          * If the IPv6 header is not aligned, slurp it up into a new
2956          * mbuf with space for link headers, in the event we forward
2957          * it.  Otherwise, if it is aligned, make sure the entire base
2958          * IPv6 header is in the first mbuf of the chain.
2959          */
2960         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2961                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2962                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2963                             (max_linkhdr + 3) & ~3)) == NULL) {
2964                         /* XXXJRT new stat, please */
2965                         ip6stat.ip6s_toosmall++;
2966                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2967                         goto bad;
2968                 }
2969         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2970                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2971                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2972                         ip6stat.ip6s_toosmall++;
2973                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2974                         goto bad;
2975                 }
2976         }
2977
2978         ip6 = mtod(m, struct ip6_hdr *);
2979
2980         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2981                 ip6stat.ip6s_badvers++;
2982                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2983                 goto bad;
2984         }
2985
2986         /* Checks out, proceed */
2987         *mp = m;
2988         return (0);
2989
2990 bad:
2991         *mp = m;
2992         return (-1);
2993 }
2994 #endif /* INET6 */
2995
2996 /*
2997  * bridge_fragment:
2998  *
2999  *      Return a fragmented mbuf chain.
3000  */
3001 static int
3002 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3003     int snap, struct llc *llc)
3004 {
3005         struct mbuf *m0;
3006         struct ip *ip;
3007         int error = -1;
3008
3009         if (m->m_len < sizeof(struct ip) &&
3010             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3011                 goto out;
3012         ip = mtod(m, struct ip *);
3013
3014         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3015                     CSUM_DELAY_IP);
3016         if (error)
3017                 goto out;
3018
3019         /* walk the chain and re-add the Ethernet header */
3020         for (m0 = m; m0; m0 = m0->m_nextpkt) {
3021                 if (error == 0) {
3022                         if (snap) {
3023                                 M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3024                                 if (m0 == NULL) {
3025                                         error = ENOBUFS;
3026                                         continue;
3027                                 }
3028                                 bcopy(llc, mtod(m0, caddr_t),
3029                                     sizeof(struct llc));
3030                         }
3031                         M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3032                         if (m0 == NULL) {
3033                                 error = ENOBUFS;
3034                                 continue;
3035                         }
3036                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3037                 } else
3038                         m_freem(m);
3039         }
3040
3041         if (error == 0)
3042                 ipstat.ips_fragmented++;
3043
3044         return (error);
3045
3046 out:
3047         if (m != NULL)
3048                 m_freem(m);
3049         return (error);
3050 }