sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*
   4  * Copyright 2001 Wasabi Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed for the NetBSD Project by
  20  *      Wasabi Systems, Inc.
  21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  22  *    or promote products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 /*
  39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  40  * All rights reserved.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  *
  51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  52  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  53  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  54  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  55  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  56  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  57  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  59  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  60  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  61  * POSSIBILITY OF SUCH DAMAGE.
  62  *
  63  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  64  */
  65
  66 /*
  67  * Network interface bridge support.
  68  *
  69  * TODO:
  70  *
  71  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  72  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  73  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  74  *        consider heterogenous bridges).
  75  */
  76
  77 #include <sys/cdefs.h>
  78 __FBSDID("$FreeBSD$");
  79
  80 #include "opt_inet.h"
  81 #include "opt_inet6.h"
  82
  83 #include <sys/param.h>
  84 #include <sys/eventhandler.h>
  85 #include <sys/mbuf.h>
  86 #include <sys/malloc.h>
  87 #include <sys/protosw.h>
  88 #include <sys/systm.h>
  89 #include <sys/jail.h>
  90 #include <sys/time.h>
  91 #include <sys/socket.h> /* for net/if.h */
  92 #include <sys/sockio.h>
  93 #include <sys/ctype.h>  /* string functions */
  94 #include <sys/kernel.h>
  95 #include <sys/random.h>
  96 #include <sys/syslog.h>
  97 #include <sys/sysctl.h>
  98 #include <vm/uma.h>
  99 #include <sys/module.h>
 100 #include <sys/priv.h>
 101 #include <sys/proc.h>
 102 #include <sys/lock.h>
 103 #include <sys/mutex.h>
 104
 105 #include <net/bpf.h>
 106 #include <net/if.h>
 107 #include <net/if_clone.h>
 108 #include <net/if_dl.h>
 109 #include <net/if_types.h>
 110 #include <net/if_var.h>
 111 #include <net/pfil.h>
 112 #include <net/vnet.h>
 113
 114 #include <netinet/in.h> /* for struct arpcom */
 115 #include <netinet/in_systm.h>
 116 #include <netinet/in_var.h>
 117 #include <netinet/ip.h>
 118 #include <netinet/ip_var.h>
 119 #ifdef INET6
 120 #include <netinet/ip6.h>
 121 #include <netinet6/ip6_var.h>
 122 #include <netinet6/in6_ifattach.h>
 123 #endif
 124 #if defined(INET) || defined(INET6)
 125 #include <netinet/ip_carp.h>
 126 #endif
 127 #include <machine/in_cksum.h>
 128 #include <netinet/if_ether.h> /* for struct arpcom */
 129 #include <net/bridgestp.h>
 130 #include <net/if_bridgevar.h>
 131 #include <net/if_llc.h>
 132 #include <net/if_vlan_var.h>
 133
 134 #include <net/route.h>
 135
 136 /*
 137  * Size of the route hash table.  Must be a power of two.
 138  */
 139 #ifndef BRIDGE_RTHASH_SIZE
 140 #define BRIDGE_RTHASH_SIZE              1024
 141 #endif
 142
 143 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 144
 145 /*
 146  * Default maximum number of addresses to cache.
 147  */
 148 #ifndef BRIDGE_RTABLE_MAX
 149 #define BRIDGE_RTABLE_MAX               2000
 150 #endif
 151
 152 /*
 153  * Timeout (in seconds) for entries learned dynamically.
 154  */
 155 #ifndef BRIDGE_RTABLE_TIMEOUT
 156 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 157 #endif
 158
 159 /*
 160  * Number of seconds between walks of the route list.
 161  */
 162 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 163 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 164 #endif
 165
 166 /*
 167  * List of capabilities to possibly mask on the member interface.
 168  */
 169 #define BRIDGE_IFCAPS_MASK              (IFCAP_TOE|IFCAP_TSO|IFCAP_TXCSUM)
 170
 171 /*
 172  * List of capabilities to strip
 173  */
 174 #define BRIDGE_IFCAPS_STRIP             IFCAP_LRO
 175
 176 /*
 177  * Bridge interface list entry.
 178  */
 179 struct bridge_iflist {
 180         LIST_ENTRY(bridge_iflist) bif_next;
 181         struct ifnet            *bif_ifp;       /* member if */
 182         struct bstp_port        bif_stp;        /* STP state */
 183         uint32_t                bif_flags;      /* member if flags */
 184         int                     bif_savedcaps;  /* saved capabilities */
 185         uint32_t                bif_addrmax;    /* max # of addresses */
 186         uint32_t                bif_addrcnt;    /* cur. # of addresses */
 187         uint32_t                bif_addrexceeded;/* # of address violations */
 188 };
 189
 190 /*
 191  * Bridge route node.
 192  */
 193 struct bridge_rtnode {
 194         LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
 195         LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
 196         struct bridge_iflist    *brt_dst;       /* destination if */
 197         unsigned long           brt_expire;     /* expiration time */
 198         uint8_t                 brt_flags;      /* address flags */
 199         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 200         uint16_t                brt_vlan;       /* vlan id */
 201 };
 202 #define brt_ifp                 brt_dst->bif_ifp
 203
 204 /*
 205  * Software state for each bridge.
 206  */
 207 struct bridge_softc {
 208         struct ifnet            *sc_ifp;        /* make this an interface */
 209         LIST_ENTRY(bridge_softc) sc_list;
 210         struct mtx              sc_mtx;
 211         struct cv               sc_cv;
 212         uint32_t                sc_brtmax;      /* max # of addresses */
 213         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 214         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 215         struct callout          sc_brcallout;   /* bridge callout */
 216         uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
 217         uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
 218         LIST_HEAD(, bridge_iflist) sc_iflist;   /* member interface list */
 219         LIST_HEAD(, bridge_rtnode) *sc_rthash;  /* our forwarding table */
 220         LIST_HEAD(, bridge_rtnode) sc_rtlist;   /* list version of above */
 221         uint32_t                sc_rthash_key;  /* key for hash */
 222         LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */
 223         struct bstp_state       sc_stp;         /* STP state */
 224         uint32_t                sc_brtexceeded; /* # of cache drops */
 225         struct ifnet            *sc_ifaddr;     /* member mac copied from */
 226         u_char                  sc_defaddr[6];  /* Default MAC address */
 227 };
 228
 229 static struct mtx       bridge_list_mtx;
 230 eventhandler_tag        bridge_detach_cookie = NULL;
 231
 232 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 233
 234 uma_zone_t bridge_rtnode_zone;
 235
 236 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
 237 static void     bridge_clone_destroy(struct ifnet *);
 238
 239 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 240 static void     bridge_mutecaps(struct bridge_softc *);
 241 static void     bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
 242                     int);
 243 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 244 static void     bridge_init(void *);
 245 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 246 static void     bridge_stop(struct ifnet *, int);
 247 static int      bridge_transmit(struct ifnet *, struct mbuf *);
 248 static void     bridge_qflush(struct ifnet *);
 249 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 250 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 251                     struct rtentry *);
 252 static int      bridge_enqueue(struct bridge_softc *, struct ifnet *,
 253                     struct mbuf *);
 254 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 255
 256 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
 257                     struct mbuf *m);
 258
 259 static void     bridge_timer(void *);
 260
 261 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 262                     struct mbuf *, int);
 263 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 264
 265 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 266                     uint16_t, struct bridge_iflist *, int, uint8_t);
 267 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *,
 268                     uint16_t);
 269 static void     bridge_rttrim(struct bridge_softc *);
 270 static void     bridge_rtage(struct bridge_softc *);
 271 static void     bridge_rtflush(struct bridge_softc *, int);
 272 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *,
 273                     uint16_t);
 274
 275 static void     bridge_rtable_init(struct bridge_softc *);
 276 static void     bridge_rtable_fini(struct bridge_softc *);
 277
 278 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 279 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 280                     const uint8_t *, uint16_t);
 281 static int      bridge_rtnode_insert(struct bridge_softc *,
 282                     struct bridge_rtnode *);
 283 static void     bridge_rtnode_destroy(struct bridge_softc *,
 284                     struct bridge_rtnode *);
 285 static void     bridge_rtable_expire(struct ifnet *, int);
 286 static void     bridge_state_change(struct ifnet *, int);
 287
 288 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 289                     const char *name);
 290 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 291                     struct ifnet *ifp);
 292 static void     bridge_delete_member(struct bridge_softc *,
 293                     struct bridge_iflist *, int);
 294 static void     bridge_delete_span(struct bridge_softc *,
 295                     struct bridge_iflist *);
 296
 297 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 298 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 299 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 300 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 301 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 302 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 303 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 304 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 305 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 306 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 307 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 308 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 309 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 310 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 311 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 312 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 313 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 314 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 315 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 316 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 317 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 318 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 319 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 320 static int      bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *);
 321 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 322 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 323 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 324 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 325 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 326 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
 327 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
 328 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 329                     int);
 330 static int      bridge_ip_checkbasic(struct mbuf **mp);
 331 #ifdef INET6
 332 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 333 #endif /* INET6 */
 334 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 335                     struct ether_header *, int, struct llc *);
 336 static void     bridge_linkstate(struct ifnet *ifp);
 337 static void     bridge_linkcheck(struct bridge_softc *sc);
 338
 339 extern void (*bridge_linkstate_p)(struct ifnet *ifp);
 340
 341 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
 342 #define VLANTAGOF(_m)   \
 343     (_m->m_flags & M_VLANTAG) ? EVL_VLANOFTAG(_m->m_pkthdr.ether_vtag) : 1
 344
 345 static struct bstp_cb_ops bridge_ops = {
 346         .bcb_state = bridge_state_change,
 347         .bcb_rtage = bridge_rtable_expire
 348 };
 349
 350 SYSCTL_DECL(_net_link);
 351 static SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 352
 353 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 354 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 355 static int pfil_member = 1; /* run pfil hooks on the member interface */
 356 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
 357 static int pfil_ipfw_arp = 0;   /* layer2 filter with ipfw */
 358 static int pfil_local_phys = 0; /* run pfil hooks on the physical interface for
 359                                    locally destined packets */
 360 static int log_stp   = 0;   /* log STP state changes */
 361 static int bridge_inherit_mac = 0;   /* share MAC with first bridge member */
 362 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RWTUN,
 363     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 364 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp, CTLFLAG_RWTUN,
 365     &pfil_ipfw_arp, 0, "Filter ARP packets through IPFW layer2");
 366 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RWTUN,
 367     &pfil_bridge, 0, "Packet filter on the bridge interface");
 368 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RWTUN,
 369     &pfil_member, 0, "Packet filter on the member interface");
 370 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys, CTLFLAG_RWTUN,
 371     &pfil_local_phys, 0,
 372     "Packet filter on the physical interface for locally destined packets");
 373 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RWTUN,
 374     &log_stp, 0, "Log STP state changes");
 375 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac, CTLFLAG_RWTUN,
 376     &bridge_inherit_mac, 0,
 377     "Inherit MAC address from the first bridge member");
 378
 379 static VNET_DEFINE(int, allow_llz_overlap) = 0;
 380 #define V_allow_llz_overlap     VNET(allow_llz_overlap)
 381 SYSCTL_VNET_INT(_net_link_bridge, OID_AUTO, allow_llz_overlap, CTLFLAG_RW,
 382     &VNET_NAME(allow_llz_overlap), 0, "Allow overlap of link-local scope "
 383     "zones of a bridge interface and the member interfaces");
 384
 385 struct bridge_control {
 386         int     (*bc_func)(struct bridge_softc *, void *);
 387         int     bc_argsize;
 388         int     bc_flags;
 389 };
 390
 391 #define BC_F_COPYIN             0x01    /* copy arguments in */
 392 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 393 #define BC_F_SUSER              0x04    /* do super-user check */
 394
 395 const struct bridge_control bridge_control_table[] = {
 396         { bridge_ioctl_add,             sizeof(struct ifbreq),
 397           BC_F_COPYIN|BC_F_SUSER },
 398         { bridge_ioctl_del,             sizeof(struct ifbreq),
 399           BC_F_COPYIN|BC_F_SUSER },
 400
 401         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 402           BC_F_COPYIN|BC_F_COPYOUT },
 403         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 404           BC_F_COPYIN|BC_F_SUSER },
 405
 406         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 407           BC_F_COPYIN|BC_F_SUSER },
 408         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 409           BC_F_COPYOUT },
 410
 411         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 412           BC_F_COPYIN|BC_F_COPYOUT },
 413         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 414           BC_F_COPYIN|BC_F_COPYOUT },
 415
 416         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 417           BC_F_COPYIN|BC_F_SUSER },
 418
 419         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 420           BC_F_COPYIN|BC_F_SUSER },
 421         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 422           BC_F_COPYOUT },
 423
 424         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 425           BC_F_COPYIN|BC_F_SUSER },
 426
 427         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 428           BC_F_COPYIN|BC_F_SUSER },
 429
 430         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 431           BC_F_COPYOUT },
 432         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 433           BC_F_COPYIN|BC_F_SUSER },
 434
 435         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 436           BC_F_COPYOUT },
 437         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 438           BC_F_COPYIN|BC_F_SUSER },
 439
 440         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 441           BC_F_COPYOUT },
 442         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 443           BC_F_COPYIN|BC_F_SUSER },
 444
 445         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 446           BC_F_COPYOUT },
 447         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 448           BC_F_COPYIN|BC_F_SUSER },
 449
 450         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 451           BC_F_COPYIN|BC_F_SUSER },
 452
 453         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 454           BC_F_COPYIN|BC_F_SUSER },
 455
 456         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 457           BC_F_COPYIN|BC_F_SUSER },
 458         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 459           BC_F_COPYIN|BC_F_SUSER },
 460
 461         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 462           BC_F_COPYOUT },
 463
 464         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 465           BC_F_COPYOUT },
 466
 467         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 468           BC_F_COPYIN|BC_F_COPYOUT },
 469
 470         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
 471           BC_F_COPYIN|BC_F_SUSER },
 472
 473         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
 474           BC_F_COPYIN|BC_F_SUSER },
 475
 476         { bridge_ioctl_sifmaxaddr,      sizeof(struct ifbreq),
 477           BC_F_COPYIN|BC_F_SUSER },
 478
 479 };
 480 const int bridge_control_table_size =
 481     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 482
 483 LIST_HEAD(, bridge_softc) bridge_list;
 484
 485 static struct if_clone *bridge_cloner;
 486 static const char bridge_name[] = "bridge";
 487
 488 static int
 489 bridge_modevent(module_t mod, int type, void *data)
 490 {
 491
 492         switch (type) {
 493         case MOD_LOAD:
 494                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
 495                 bridge_cloner = if_clone_simple(bridge_name,
 496                     bridge_clone_create, bridge_clone_destroy, 0);
 497                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 498                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 499                     UMA_ALIGN_PTR, 0);
 500                 LIST_INIT(&bridge_list);
 501                 bridge_input_p = bridge_input;
 502                 bridge_output_p = bridge_output;
 503                 bridge_dn_p = bridge_dummynet;
 504                 bridge_linkstate_p = bridge_linkstate;
 505                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 506                     ifnet_departure_event, bridge_ifdetach, NULL,
 507                     EVENTHANDLER_PRI_ANY);
 508                 break;
 509         case MOD_UNLOAD:
 510                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 511                     bridge_detach_cookie);
 512                 if_clone_detach(bridge_cloner);
 513                 uma_zdestroy(bridge_rtnode_zone);
 514                 bridge_input_p = NULL;
 515                 bridge_output_p = NULL;
 516                 bridge_dn_p = NULL;
 517                 bridge_linkstate_p = NULL;
 518                 mtx_destroy(&bridge_list_mtx);
 519                 break;
 520         default:
 521                 return (EOPNOTSUPP);
 522         }
 523         return (0);
 524 }
 525
 526 static moduledata_t bridge_mod = {
 527         "if_bridge",
 528         bridge_modevent,
 529         0
 530 };
 531
 532 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 533 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 534
 535 /*
 536  * handler for net.link.bridge.ipfw
 537  */
 538 static int
 539 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 540 {
 541         int enable = pfil_ipfw;
 542         int error;
 543
 544         error = sysctl_handle_int(oidp, &enable, 0, req);
 545         enable = (enable) ? 1 : 0;
 546
 547         if (enable != pfil_ipfw) {
 548                 pfil_ipfw = enable;
 549
 550                 /*
 551                  * Disable pfil so that ipfw doesnt run twice, if the user
 552                  * really wants both then they can re-enable pfil_bridge and/or
 553                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 554                  * layer2 type.
 555                  */
 556                 if (pfil_ipfw) {
 557                         pfil_onlyip = 0;
 558                         pfil_bridge = 0;
 559                         pfil_member = 0;
 560                 }
 561         }
 562
 563         return (error);
 564 }
 565 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
 566             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
 567
 568 /*
 569  * bridge_clone_create:
 570  *
 571  *      Create a new bridge instance.
 572  */
 573 static int
 574 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 575 {
 576         struct bridge_softc *sc, *sc2;
 577         struct ifnet *bifp, *ifp;
 578         int fb, retry;
 579         unsigned long hostid;
 580
 581         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 582         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 583         if (ifp == NULL) {
 584                 free(sc, M_DEVBUF);
 585                 return (ENOSPC);
 586         }
 587
 588         BRIDGE_LOCK_INIT(sc);
 589         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 590         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 591
 592         /* Initialize our routing table. */
 593         bridge_rtable_init(sc);
 594
 595         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
 596
 597         LIST_INIT(&sc->sc_iflist);
 598         LIST_INIT(&sc->sc_spanlist);
 599
 600         ifp->if_softc = sc;
 601         if_initname(ifp, bridge_name, unit);
 602         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 603         ifp->if_ioctl = bridge_ioctl;
 604         ifp->if_transmit = bridge_transmit;
 605         ifp->if_qflush = bridge_qflush;
 606         ifp->if_init = bridge_init;
 607         ifp->if_type = IFT_BRIDGE;
 608
 609         /*
 610          * Generate an ethernet address with a locally administered address.
 611          *
 612          * Since we are using random ethernet addresses for the bridge, it is
 613          * possible that we might have address collisions, so make sure that
 614          * this hardware address isn't already in use on another bridge.
 615          * The first try uses the hostid and falls back to arc4rand().
 616          */
 617         fb = 0;
 618         getcredhostid(curthread->td_ucred, &hostid);
 619         do {
 620                 if (fb || hostid == 0) {
 621                         arc4rand(sc->sc_defaddr, ETHER_ADDR_LEN, 1);
 622                         sc->sc_defaddr[0] &= ~1;/* clear multicast bit */
 623                         sc->sc_defaddr[0] |= 2; /* set the LAA bit */
 624                 } else {
 625                         sc->sc_defaddr[0] = 0x2;
 626                         sc->sc_defaddr[1] = (hostid >> 24) & 0xff;
 627                         sc->sc_defaddr[2] = (hostid >> 16) & 0xff;
 628                         sc->sc_defaddr[3] = (hostid >> 8 ) & 0xff;
 629                         sc->sc_defaddr[4] =  hostid        & 0xff;
 630                         sc->sc_defaddr[5] = ifp->if_dunit & 0xff;
 631                 }
 632
 633                 fb = 1;
 634                 retry = 0;
 635                 mtx_lock(&bridge_list_mtx);
 636                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
 637                         bifp = sc2->sc_ifp;
 638                         if (memcmp(sc->sc_defaddr,
 639                             IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
 640                                 retry = 1;
 641                                 break;
 642                         }
 643                 }
 644                 mtx_unlock(&bridge_list_mtx);
 645         } while (retry == 1);
 646
 647         bstp_attach(&sc->sc_stp, &bridge_ops);
 648         ether_ifattach(ifp, sc->sc_defaddr);
 649         /* Now undo some of the damage... */
 650         ifp->if_baudrate = 0;
 651         ifp->if_type = IFT_BRIDGE;
 652
 653         mtx_lock(&bridge_list_mtx);
 654         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 655         mtx_unlock(&bridge_list_mtx);
 656
 657         return (0);
 658 }
 659
 660 /*
 661  * bridge_clone_destroy:
 662  *
 663  *      Destroy a bridge instance.
 664  */
 665 static void
 666 bridge_clone_destroy(struct ifnet *ifp)
 667 {
 668         struct bridge_softc *sc = ifp->if_softc;
 669         struct bridge_iflist *bif;
 670
 671         BRIDGE_LOCK(sc);
 672
 673         bridge_stop(ifp, 1);
 674         ifp->if_flags &= ~IFF_UP;
 675
 676         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 677                 bridge_delete_member(sc, bif, 0);
 678
 679         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 680                 bridge_delete_span(sc, bif);
 681         }
 682
 683         BRIDGE_UNLOCK(sc);
 684
 685         callout_drain(&sc->sc_brcallout);
 686
 687         mtx_lock(&bridge_list_mtx);
 688         LIST_REMOVE(sc, sc_list);
 689         mtx_unlock(&bridge_list_mtx);
 690
 691         bstp_detach(&sc->sc_stp);
 692         ether_ifdetach(ifp);
 693         if_free(ifp);
 694
 695         /* Tear down the routing table. */
 696         bridge_rtable_fini(sc);
 697
 698         BRIDGE_LOCK_DESTROY(sc);
 699         free(sc, M_DEVBUF);
 700 }
 701
 702 /*
 703  * bridge_ioctl:
 704  *
 705  *      Handle a control request from the operator.
 706  */
 707 static int
 708 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 709 {
 710         struct bridge_softc *sc = ifp->if_softc;
 711         struct ifreq *ifr = (struct ifreq *)data;
 712         struct bridge_iflist *bif;
 713         struct thread *td = curthread;
 714         union {
 715                 struct ifbreq ifbreq;
 716                 struct ifbifconf ifbifconf;
 717                 struct ifbareq ifbareq;
 718                 struct ifbaconf ifbaconf;
 719                 struct ifbrparam ifbrparam;
 720                 struct ifbropreq ifbropreq;
 721         } args;
 722         struct ifdrv *ifd = (struct ifdrv *) data;
 723         const struct bridge_control *bc;
 724         int error = 0;
 725
 726         switch (cmd) {
 727
 728         case SIOCADDMULTI:
 729         case SIOCDELMULTI:
 730                 break;
 731
 732         case SIOCGDRVSPEC:
 733         case SIOCSDRVSPEC:
 734                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 735                         error = EINVAL;
 736                         break;
 737                 }
 738                 bc = &bridge_control_table[ifd->ifd_cmd];
 739
 740                 if (cmd == SIOCGDRVSPEC &&
 741                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 742                         error = EINVAL;
 743                         break;
 744                 }
 745                 else if (cmd == SIOCSDRVSPEC &&
 746                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 747                         error = EINVAL;
 748                         break;
 749                 }
 750
 751                 if (bc->bc_flags & BC_F_SUSER) {
 752                         error = priv_check(td, PRIV_NET_BRIDGE);
 753                         if (error)
 754                                 break;
 755                 }
 756
 757                 if (ifd->ifd_len != bc->bc_argsize ||
 758                     ifd->ifd_len > sizeof(args)) {
 759                         error = EINVAL;
 760                         break;
 761                 }
 762
 763                 bzero(&args, sizeof(args));
 764                 if (bc->bc_flags & BC_F_COPYIN) {
 765                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 766                         if (error)
 767                                 break;
 768                 }
 769
 770                 BRIDGE_LOCK(sc);
 771                 error = (*bc->bc_func)(sc, &args);
 772                 BRIDGE_UNLOCK(sc);
 773                 if (error)
 774                         break;
 775
 776                 if (bc->bc_flags & BC_F_COPYOUT)
 777                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 778
 779                 break;
 780
 781         case SIOCSIFFLAGS:
 782                 if (!(ifp->if_flags & IFF_UP) &&
 783                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 784                         /*
 785                          * If interface is marked down and it is running,
 786                          * then stop and disable it.
 787                          */
 788                         BRIDGE_LOCK(sc);
 789                         bridge_stop(ifp, 1);
 790                         BRIDGE_UNLOCK(sc);
 791                 } else if ((ifp->if_flags & IFF_UP) &&
 792                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 793                         /*
 794                          * If interface is marked up and it is stopped, then
 795                          * start it.
 796                          */
 797                         (*ifp->if_init)(sc);
 798                 }
 799                 break;
 800
 801         case SIOCSIFMTU:
 802                 if (ifr->ifr_mtu < 576) {
 803                         error = EINVAL;
 804                         break;
 805                 }
 806                 if (LIST_EMPTY(&sc->sc_iflist)) {
 807                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 808                         break;
 809                 }
 810                 BRIDGE_LOCK(sc);
 811                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 812                         if (bif->bif_ifp->if_mtu != ifr->ifr_mtu) {
 813                                 log(LOG_NOTICE, "%s: invalid MTU: %u(%s)"
 814                                     " != %d\n", sc->sc_ifp->if_xname,
 815                                     bif->bif_ifp->if_mtu,
 816                                     bif->bif_ifp->if_xname, ifr->ifr_mtu);
 817                                 error = EINVAL;
 818                                 break;
 819                         }
 820                 }
 821                 if (!error)
 822                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 823                 BRIDGE_UNLOCK(sc);
 824                 break;
 825         default:
 826                 /*
 827                  * drop the lock as ether_ioctl() will call bridge_start() and
 828                  * cause the lock to be recursed.
 829                  */
 830                 error = ether_ioctl(ifp, cmd, data);
 831                 break;
 832         }
 833
 834         return (error);
 835 }
 836
 837 /*
 838  * bridge_mutecaps:
 839  *
 840  *      Clear or restore unwanted capabilities on the member interface
 841  */
 842 static void
 843 bridge_mutecaps(struct bridge_softc *sc)
 844 {
 845         struct bridge_iflist *bif;
 846         int enabled, mask;
 847
 848         /* Initial bitmask of capabilities to test */
 849         mask = BRIDGE_IFCAPS_MASK;
 850
 851         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 852                 /* Every member must support it or its disabled */
 853                 mask &= bif->bif_savedcaps;
 854         }
 855
 856         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 857                 enabled = bif->bif_ifp->if_capenable;
 858                 enabled &= ~BRIDGE_IFCAPS_STRIP;
 859                 /* strip off mask bits and enable them again if allowed */
 860                 enabled &= ~BRIDGE_IFCAPS_MASK;
 861                 enabled |= mask;
 862                 bridge_set_ifcap(sc, bif, enabled);
 863         }
 864
 865 }
 866
 867 static void
 868 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
 869 {
 870         struct ifnet *ifp = bif->bif_ifp;
 871         struct ifreq ifr;
 872         int error;
 873
 874         bzero(&ifr, sizeof(ifr));
 875         ifr.ifr_reqcap = set;
 876
 877         if (ifp->if_capenable != set) {
 878                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
 879                 if (error)
 880                         if_printf(sc->sc_ifp,
 881                             "error setting interface capabilities on %s\n",
 882                             ifp->if_xname);
 883         }
 884 }
 885
 886 /*
 887  * bridge_lookup_member:
 888  *
 889  *      Lookup a bridge member interface.
 890  */
 891 static struct bridge_iflist *
 892 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 893 {
 894         struct bridge_iflist *bif;
 895         struct ifnet *ifp;
 896
 897         BRIDGE_LOCK_ASSERT(sc);
 898
 899         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 900                 ifp = bif->bif_ifp;
 901                 if (strcmp(ifp->if_xname, name) == 0)
 902                         return (bif);
 903         }
 904
 905         return (NULL);
 906 }
 907
 908 /*
 909  * bridge_lookup_member_if:
 910  *
 911  *      Lookup a bridge member interface by ifnet*.
 912  */
 913 static struct bridge_iflist *
 914 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 915 {
 916         struct bridge_iflist *bif;
 917
 918         BRIDGE_LOCK_ASSERT(sc);
 919
 920         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 921                 if (bif->bif_ifp == member_ifp)
 922                         return (bif);
 923         }
 924
 925         return (NULL);
 926 }
 927
 928 /*
 929  * bridge_delete_member:
 930  *
 931  *      Delete the specified member interface.
 932  */
 933 static void
 934 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 935     int gone)
 936 {
 937         struct ifnet *ifs = bif->bif_ifp;
 938         struct ifnet *fif = NULL;
 939
 940         BRIDGE_LOCK_ASSERT(sc);
 941
 942         if (bif->bif_flags & IFBIF_STP)
 943                 bstp_disable(&bif->bif_stp);
 944
 945         ifs->if_bridge = NULL;
 946         BRIDGE_XLOCK(sc);
 947         LIST_REMOVE(bif, bif_next);
 948         BRIDGE_XDROP(sc);
 949
 950         /*
 951          * If removing the interface that gave the bridge its mac address, set
 952          * the mac address of the bridge to the address of the next member, or
 953          * to its default address if no members are left.
 954          */
 955         if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
 956                 if (LIST_EMPTY(&sc->sc_iflist)) {
 957                         bcopy(sc->sc_defaddr,
 958                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
 959                         sc->sc_ifaddr = NULL;
 960                 } else {
 961                         fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp;
 962                         bcopy(IF_LLADDR(fif),
 963                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
 964                         sc->sc_ifaddr = fif;
 965                 }
 966                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
 967         }
 968
 969         bridge_linkcheck(sc);
 970         bridge_mutecaps(sc);    /* recalcuate now this interface is removed */
 971         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 972         KASSERT(bif->bif_addrcnt == 0,
 973             ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
 974
 975         BRIDGE_UNLOCK(sc);
 976         if (!gone) {
 977                 switch (ifs->if_type) {
 978                 case IFT_ETHER:
 979                 case IFT_L2VLAN:
 980                         /*
 981                          * Take the interface out of promiscuous mode.
 982                          */
 983                         (void) ifpromisc(ifs, 0);
 984                         break;
 985
 986                 case IFT_GIF:
 987                         break;
 988
 989                 default:
 990 #ifdef DIAGNOSTIC
 991                         panic("bridge_delete_member: impossible");
 992 #endif
 993                         break;
 994                 }
 995                 /* reneable any interface capabilities */
 996                 bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
 997         }
 998         bstp_destroy(&bif->bif_stp);    /* prepare to free */
 999         BRIDGE_LOCK(sc);
1000         free(bif, M_DEVBUF);
1001 }
1002
1003 /*
1004  * bridge_delete_span:
1005  *
1006  *      Delete the specified span interface.
1007  */
1008 static void
1009 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
1010 {
1011         BRIDGE_LOCK_ASSERT(sc);
1012
1013         KASSERT(bif->bif_ifp->if_bridge == NULL,
1014             ("%s: not a span interface", __func__));
1015
1016         LIST_REMOVE(bif, bif_next);
1017         free(bif, M_DEVBUF);
1018 }
1019
1020 static int
1021 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
1022 {
1023         struct ifbreq *req = arg;
1024         struct bridge_iflist *bif = NULL;
1025         struct ifnet *ifs;
1026         int error = 0;
1027
1028         ifs = ifunit(req->ifbr_ifsname);
1029         if (ifs == NULL)
1030                 return (ENOENT);
1031         if (ifs->if_ioctl == NULL)      /* must be supported */
1032                 return (EINVAL);
1033
1034         /* If it's in the span list, it can't be a member. */
1035         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1036                 if (ifs == bif->bif_ifp)
1037                         return (EBUSY);
1038
1039         if (ifs->if_bridge == sc)
1040                 return (EEXIST);
1041
1042         if (ifs->if_bridge != NULL)
1043                 return (EBUSY);
1044
1045         switch (ifs->if_type) {
1046         case IFT_ETHER:
1047         case IFT_L2VLAN:
1048         case IFT_GIF:
1049                 /* permitted interface types */
1050                 break;
1051         default:
1052                 return (EINVAL);
1053         }
1054
1055 #ifdef INET6
1056         /*
1057          * Two valid inet6 addresses with link-local scope must not be
1058          * on the parent interface and the member interfaces at the
1059          * same time.  This restriction is needed to prevent violation
1060          * of link-local scope zone.  Attempts to add a member
1061          * interface which has inet6 addresses when the parent has
1062          * inet6 triggers removal of all inet6 addresses on the member
1063          * interface.
1064          */
1065
1066         /* Check if the parent interface has a link-local scope addr. */
1067         if (V_allow_llz_overlap == 0 &&
1068             in6ifa_llaonifp(sc->sc_ifp) != NULL) {
1069                 /*
1070                  * If any, remove all inet6 addresses from the member
1071                  * interfaces.
1072                  */
1073                 BRIDGE_XLOCK(sc);
1074                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1075                         if (in6ifa_llaonifp(bif->bif_ifp)) {
1076                                 BRIDGE_UNLOCK(sc);
1077                                 in6_ifdetach(bif->bif_ifp);
1078                                 BRIDGE_LOCK(sc);
1079                                 if_printf(sc->sc_ifp,
1080                                     "IPv6 addresses on %s have been removed "
1081                                     "before adding it as a member to prevent "
1082                                     "IPv6 address scope violation.\n",
1083                                     bif->bif_ifp->if_xname);
1084                         }
1085                 }
1086                 BRIDGE_XDROP(sc);
1087                 if (in6ifa_llaonifp(ifs)) {
1088                         BRIDGE_UNLOCK(sc);
1089                         in6_ifdetach(ifs);
1090                         BRIDGE_LOCK(sc);
1091                         if_printf(sc->sc_ifp,
1092                             "IPv6 addresses on %s have been removed "
1093                             "before adding it as a member to prevent "
1094                             "IPv6 address scope violation.\n",
1095                             ifs->if_xname);
1096                 }
1097         }
1098 #endif
1099         /* Allow the first Ethernet member to define the MTU */
1100         if (LIST_EMPTY(&sc->sc_iflist))
1101                 sc->sc_ifp->if_mtu = ifs->if_mtu;
1102         else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
1103                 if_printf(sc->sc_ifp, "invalid MTU: %u(%s) != %u\n",
1104                     ifs->if_mtu, ifs->if_xname, sc->sc_ifp->if_mtu);
1105                 return (EINVAL);
1106         }
1107
1108         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1109         if (bif == NULL)
1110                 return (ENOMEM);
1111
1112         bif->bif_ifp = ifs;
1113         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
1114         bif->bif_savedcaps = ifs->if_capenable;
1115
1116         /*
1117          * Assign the interface's MAC address to the bridge if it's the first
1118          * member and the MAC address of the bridge has not been changed from
1119          * the default randomly generated one.
1120          */
1121         if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) &&
1122             !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) {
1123                 bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1124                 sc->sc_ifaddr = ifs;
1125                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1126         }
1127
1128         ifs->if_bridge = sc;
1129         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
1130         /*
1131          * XXX: XLOCK HERE!?!
1132          *
1133          * NOTE: insert_***HEAD*** should be safe for the traversals.
1134          */
1135         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
1136
1137         /* Set interface capabilities to the intersection set of all members */
1138         bridge_mutecaps(sc);
1139         bridge_linkcheck(sc);
1140
1141         /* Place the interface into promiscuous mode */
1142         switch (ifs->if_type) {
1143                 case IFT_ETHER:
1144                 case IFT_L2VLAN:
1145                         BRIDGE_UNLOCK(sc);
1146                         error = ifpromisc(ifs, 1);
1147                         BRIDGE_LOCK(sc);
1148                         break;
1149         }
1150
1151         if (error) {
1152                 bridge_delete_member(sc, bif, 0);
1153                 free(bif, M_DEVBUF);
1154         }
1155         return (error);
1156 }
1157
1158 static int
1159 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1160 {
1161         struct ifbreq *req = arg;
1162         struct bridge_iflist *bif;
1163
1164         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1165         if (bif == NULL)
1166                 return (ENOENT);
1167
1168         bridge_delete_member(sc, bif, 0);
1169
1170         return (0);
1171 }
1172
1173 static int
1174 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1175 {
1176         struct ifbreq *req = arg;
1177         struct bridge_iflist *bif;
1178         struct bstp_port *bp;
1179
1180         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1181         if (bif == NULL)
1182                 return (ENOENT);
1183
1184         bp = &bif->bif_stp;
1185         req->ifbr_ifsflags = bif->bif_flags;
1186         req->ifbr_state = bp->bp_state;
1187         req->ifbr_priority = bp->bp_priority;
1188         req->ifbr_path_cost = bp->bp_path_cost;
1189         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1190         req->ifbr_proto = bp->bp_protover;
1191         req->ifbr_role = bp->bp_role;
1192         req->ifbr_stpflags = bp->bp_flags;
1193         req->ifbr_addrcnt = bif->bif_addrcnt;
1194         req->ifbr_addrmax = bif->bif_addrmax;
1195         req->ifbr_addrexceeded = bif->bif_addrexceeded;
1196
1197         /* Copy STP state options as flags */
1198         if (bp->bp_operedge)
1199                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1200         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1201                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1202         if (bp->bp_ptp_link)
1203                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1204         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1205                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1206         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1207                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1208         if (bp->bp_flags & BSTP_PORT_ADMCOST)
1209                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1210         return (0);
1211 }
1212
1213 static int
1214 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1215 {
1216         struct ifbreq *req = arg;
1217         struct bridge_iflist *bif;
1218         struct bstp_port *bp;
1219         int error;
1220
1221         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1222         if (bif == NULL)
1223                 return (ENOENT);
1224         bp = &bif->bif_stp;
1225
1226         if (req->ifbr_ifsflags & IFBIF_SPAN)
1227                 /* SPAN is readonly */
1228                 return (EINVAL);
1229
1230         if (req->ifbr_ifsflags & IFBIF_STP) {
1231                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1232                         error = bstp_enable(&bif->bif_stp);
1233                         if (error)
1234                                 return (error);
1235                 }
1236         } else {
1237                 if ((bif->bif_flags & IFBIF_STP) != 0)
1238                         bstp_disable(&bif->bif_stp);
1239         }
1240
1241         /* Pass on STP flags */
1242         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1243         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1244         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1245         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1246
1247         /* Save the bits relating to the bridge */
1248         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1249
1250         return (0);
1251 }
1252
1253 static int
1254 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1255 {
1256         struct ifbrparam *param = arg;
1257
1258         sc->sc_brtmax = param->ifbrp_csize;
1259         bridge_rttrim(sc);
1260
1261         return (0);
1262 }
1263
1264 static int
1265 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1266 {
1267         struct ifbrparam *param = arg;
1268
1269         param->ifbrp_csize = sc->sc_brtmax;
1270
1271         return (0);
1272 }
1273
1274 static int
1275 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1276 {
1277         struct ifbifconf *bifc = arg;
1278         struct bridge_iflist *bif;
1279         struct ifbreq breq;
1280         char *buf, *outbuf;
1281         int count, buflen, len, error = 0;
1282
1283         count = 0;
1284         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1285                 count++;
1286         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1287                 count++;
1288
1289         buflen = sizeof(breq) * count;
1290         if (bifc->ifbic_len == 0) {
1291                 bifc->ifbic_len = buflen;
1292                 return (0);
1293         }
1294         BRIDGE_UNLOCK(sc);
1295         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1296         BRIDGE_LOCK(sc);
1297
1298         count = 0;
1299         buf = outbuf;
1300         len = min(bifc->ifbic_len, buflen);
1301         bzero(&breq, sizeof(breq));
1302         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1303                 if (len < sizeof(breq))
1304                         break;
1305
1306                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1307                     sizeof(breq.ifbr_ifsname));
1308                 /* Fill in the ifbreq structure */
1309                 error = bridge_ioctl_gifflags(sc, &breq);
1310                 if (error)
1311                         break;
1312                 memcpy(buf, &breq, sizeof(breq));
1313                 count++;
1314                 buf += sizeof(breq);
1315                 len -= sizeof(breq);
1316         }
1317         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1318                 if (len < sizeof(breq))
1319                         break;
1320
1321                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1322                     sizeof(breq.ifbr_ifsname));
1323                 breq.ifbr_ifsflags = bif->bif_flags;
1324                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1325                 memcpy(buf, &breq, sizeof(breq));
1326                 count++;
1327                 buf += sizeof(breq);
1328                 len -= sizeof(breq);
1329         }
1330
1331         BRIDGE_UNLOCK(sc);
1332         bifc->ifbic_len = sizeof(breq) * count;
1333         error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
1334         BRIDGE_LOCK(sc);
1335         free(outbuf, M_TEMP);
1336         return (error);
1337 }
1338
1339 static int
1340 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1341 {
1342         struct ifbaconf *bac = arg;
1343         struct bridge_rtnode *brt;
1344         struct ifbareq bareq;
1345         char *buf, *outbuf;
1346         int count, buflen, len, error = 0;
1347
1348         if (bac->ifbac_len == 0)
1349                 return (0);
1350
1351         count = 0;
1352         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
1353                 count++;
1354         buflen = sizeof(bareq) * count;
1355
1356         BRIDGE_UNLOCK(sc);
1357         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1358         BRIDGE_LOCK(sc);
1359
1360         count = 0;
1361         buf = outbuf;
1362         len = min(bac->ifbac_len, buflen);
1363         bzero(&bareq, sizeof(bareq));
1364         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1365                 if (len < sizeof(bareq))
1366                         goto out;
1367                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1368                     sizeof(bareq.ifba_ifsname));
1369                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1370                 bareq.ifba_vlan = brt->brt_vlan;
1371                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1372                                 time_uptime < brt->brt_expire)
1373                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1374                 else
1375                         bareq.ifba_expire = 0;
1376                 bareq.ifba_flags = brt->brt_flags;
1377
1378                 memcpy(buf, &bareq, sizeof(bareq));
1379                 count++;
1380                 buf += sizeof(bareq);
1381                 len -= sizeof(bareq);
1382         }
1383 out:
1384         BRIDGE_UNLOCK(sc);
1385         bac->ifbac_len = sizeof(bareq) * count;
1386         error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
1387         BRIDGE_LOCK(sc);
1388         free(outbuf, M_TEMP);
1389         return (error);
1390 }
1391
1392 static int
1393 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1394 {
1395         struct ifbareq *req = arg;
1396         struct bridge_iflist *bif;
1397         int error;
1398
1399         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1400         if (bif == NULL)
1401                 return (ENOENT);
1402
1403         error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
1404             req->ifba_flags);
1405
1406         return (error);
1407 }
1408
1409 static int
1410 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1411 {
1412         struct ifbrparam *param = arg;
1413
1414         sc->sc_brttimeout = param->ifbrp_ctime;
1415         return (0);
1416 }
1417
1418 static int
1419 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1420 {
1421         struct ifbrparam *param = arg;
1422
1423         param->ifbrp_ctime = sc->sc_brttimeout;
1424         return (0);
1425 }
1426
1427 static int
1428 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1429 {
1430         struct ifbareq *req = arg;
1431
1432         return (bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan));
1433 }
1434
1435 static int
1436 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1437 {
1438         struct ifbreq *req = arg;
1439
1440         bridge_rtflush(sc, req->ifbr_ifsflags);
1441         return (0);
1442 }
1443
1444 static int
1445 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1446 {
1447         struct ifbrparam *param = arg;
1448         struct bstp_state *bs = &sc->sc_stp;
1449
1450         param->ifbrp_prio = bs->bs_bridge_priority;
1451         return (0);
1452 }
1453
1454 static int
1455 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1456 {
1457         struct ifbrparam *param = arg;
1458
1459         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1460 }
1461
1462 static int
1463 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1464 {
1465         struct ifbrparam *param = arg;
1466         struct bstp_state *bs = &sc->sc_stp;
1467
1468         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1469         return (0);
1470 }
1471
1472 static int
1473 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1474 {
1475         struct ifbrparam *param = arg;
1476
1477         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1478 }
1479
1480 static int
1481 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1482 {
1483         struct ifbrparam *param = arg;
1484         struct bstp_state *bs = &sc->sc_stp;
1485
1486         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1487         return (0);
1488 }
1489
1490 static int
1491 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1492 {
1493         struct ifbrparam *param = arg;
1494
1495         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1496 }
1497
1498 static int
1499 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1500 {
1501         struct ifbrparam *param = arg;
1502         struct bstp_state *bs = &sc->sc_stp;
1503
1504         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1505         return (0);
1506 }
1507
1508 static int
1509 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1510 {
1511         struct ifbrparam *param = arg;
1512
1513         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1514 }
1515
1516 static int
1517 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1518 {
1519         struct ifbreq *req = arg;
1520         struct bridge_iflist *bif;
1521
1522         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1523         if (bif == NULL)
1524                 return (ENOENT);
1525
1526         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1527 }
1528
1529 static int
1530 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1531 {
1532         struct ifbreq *req = arg;
1533         struct bridge_iflist *bif;
1534
1535         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1536         if (bif == NULL)
1537                 return (ENOENT);
1538
1539         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1540 }
1541
1542 static int
1543 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *arg)
1544 {
1545         struct ifbreq *req = arg;
1546         struct bridge_iflist *bif;
1547
1548         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1549         if (bif == NULL)
1550                 return (ENOENT);
1551
1552         bif->bif_addrmax = req->ifbr_addrmax;
1553         return (0);
1554 }
1555
1556 static int
1557 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1558 {
1559         struct ifbreq *req = arg;
1560         struct bridge_iflist *bif = NULL;
1561         struct ifnet *ifs;
1562
1563         ifs = ifunit(req->ifbr_ifsname);
1564         if (ifs == NULL)
1565                 return (ENOENT);
1566
1567         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1568                 if (ifs == bif->bif_ifp)
1569                         return (EBUSY);
1570
1571         if (ifs->if_bridge != NULL)
1572                 return (EBUSY);
1573
1574         switch (ifs->if_type) {
1575                 case IFT_ETHER:
1576                 case IFT_GIF:
1577                 case IFT_L2VLAN:
1578                         break;
1579                 default:
1580                         return (EINVAL);
1581         }
1582
1583         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1584         if (bif == NULL)
1585                 return (ENOMEM);
1586
1587         bif->bif_ifp = ifs;
1588         bif->bif_flags = IFBIF_SPAN;
1589
1590         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1591
1592         return (0);
1593 }
1594
1595 static int
1596 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1597 {
1598         struct ifbreq *req = arg;
1599         struct bridge_iflist *bif;
1600         struct ifnet *ifs;
1601
1602         ifs = ifunit(req->ifbr_ifsname);
1603         if (ifs == NULL)
1604                 return (ENOENT);
1605
1606         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1607                 if (ifs == bif->bif_ifp)
1608                         break;
1609
1610         if (bif == NULL)
1611                 return (ENOENT);
1612
1613         bridge_delete_span(sc, bif);
1614
1615         return (0);
1616 }
1617
1618 static int
1619 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1620 {
1621         struct ifbropreq *req = arg;
1622         struct bstp_state *bs = &sc->sc_stp;
1623         struct bstp_port *root_port;
1624
1625         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1626         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1627         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1628
1629         root_port = bs->bs_root_port;
1630         if (root_port == NULL)
1631                 req->ifbop_root_port = 0;
1632         else
1633                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1634
1635         req->ifbop_holdcount = bs->bs_txholdcount;
1636         req->ifbop_priority = bs->bs_bridge_priority;
1637         req->ifbop_protocol = bs->bs_protover;
1638         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1639         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1640         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1641         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1642         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1643         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1644
1645         return (0);
1646 }
1647
1648 static int
1649 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1650 {
1651         struct ifbrparam *param = arg;
1652
1653         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1654         return (0);
1655 }
1656
1657 static int
1658 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1659 {
1660         struct ifbpstpconf *bifstp = arg;
1661         struct bridge_iflist *bif;
1662         struct bstp_port *bp;
1663         struct ifbpstpreq bpreq;
1664         char *buf, *outbuf;
1665         int count, buflen, len, error = 0;
1666
1667         count = 0;
1668         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1669                 if ((bif->bif_flags & IFBIF_STP) != 0)
1670                         count++;
1671         }
1672
1673         buflen = sizeof(bpreq) * count;
1674         if (bifstp->ifbpstp_len == 0) {
1675                 bifstp->ifbpstp_len = buflen;
1676                 return (0);
1677         }
1678
1679         BRIDGE_UNLOCK(sc);
1680         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1681         BRIDGE_LOCK(sc);
1682
1683         count = 0;
1684         buf = outbuf;
1685         len = min(bifstp->ifbpstp_len, buflen);
1686         bzero(&bpreq, sizeof(bpreq));
1687         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1688                 if (len < sizeof(bpreq))
1689                         break;
1690
1691                 if ((bif->bif_flags & IFBIF_STP) == 0)
1692                         continue;
1693
1694                 bp = &bif->bif_stp;
1695                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1696                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1697                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1698                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1699                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1700                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1701
1702                 memcpy(buf, &bpreq, sizeof(bpreq));
1703                 count++;
1704                 buf += sizeof(bpreq);
1705                 len -= sizeof(bpreq);
1706         }
1707
1708         BRIDGE_UNLOCK(sc);
1709         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1710         error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
1711         BRIDGE_LOCK(sc);
1712         free(outbuf, M_TEMP);
1713         return (error);
1714 }
1715
1716 static int
1717 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1718 {
1719         struct ifbrparam *param = arg;
1720
1721         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1722 }
1723
1724 static int
1725 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1726 {
1727         struct ifbrparam *param = arg;
1728
1729         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1730 }
1731
1732 /*
1733  * bridge_ifdetach:
1734  *
1735  *      Detach an interface from a bridge.  Called when a member
1736  *      interface is detaching.
1737  */
1738 static void
1739 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1740 {
1741         struct bridge_softc *sc = ifp->if_bridge;
1742         struct bridge_iflist *bif;
1743
1744         if (ifp->if_flags & IFF_RENAMING)
1745                 return;
1746
1747         /* Check if the interface is a bridge member */
1748         if (sc != NULL) {
1749                 BRIDGE_LOCK(sc);
1750
1751                 bif = bridge_lookup_member_if(sc, ifp);
1752                 if (bif != NULL)
1753                         bridge_delete_member(sc, bif, 1);
1754
1755                 BRIDGE_UNLOCK(sc);
1756                 return;
1757         }
1758
1759         /* Check if the interface is a span port */
1760         mtx_lock(&bridge_list_mtx);
1761         LIST_FOREACH(sc, &bridge_list, sc_list) {
1762                 BRIDGE_LOCK(sc);
1763                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1764                         if (ifp == bif->bif_ifp) {
1765                                 bridge_delete_span(sc, bif);
1766                                 break;
1767                         }
1768
1769                 BRIDGE_UNLOCK(sc);
1770         }
1771         mtx_unlock(&bridge_list_mtx);
1772 }
1773
1774 /*
1775  * bridge_init:
1776  *
1777  *      Initialize a bridge interface.
1778  */
1779 static void
1780 bridge_init(void *xsc)
1781 {
1782         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1783         struct ifnet *ifp = sc->sc_ifp;
1784
1785         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1786                 return;
1787
1788         BRIDGE_LOCK(sc);
1789         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1790             bridge_timer, sc);
1791
1792         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1793         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1794
1795         BRIDGE_UNLOCK(sc);
1796 }
1797
1798 /*
1799  * bridge_stop:
1800  *
1801  *      Stop the bridge interface.
1802  */
1803 static void
1804 bridge_stop(struct ifnet *ifp, int disable)
1805 {
1806         struct bridge_softc *sc = ifp->if_softc;
1807
1808         BRIDGE_LOCK_ASSERT(sc);
1809
1810         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1811                 return;
1812
1813         callout_stop(&sc->sc_brcallout);
1814         bstp_stop(&sc->sc_stp);
1815
1816         bridge_rtflush(sc, IFBF_FLUSHDYN);
1817
1818         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1819 }
1820
1821 /*
1822  * bridge_enqueue:
1823  *
1824  *      Enqueue a packet on a bridge member interface.
1825  *
1826  */
1827 static int
1828 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1829 {
1830         int len, err = 0;
1831         short mflags;
1832         struct mbuf *m0;
1833
1834         /* We may be sending a fragment so traverse the mbuf */
1835         for (; m; m = m0) {
1836                 m0 = m->m_nextpkt;
1837                 m->m_nextpkt = NULL;
1838                 len = m->m_pkthdr.len;
1839                 mflags = m->m_flags;
1840
1841                 /*
1842                  * If underlying interface can not do VLAN tag insertion itself
1843                  * then attach a packet tag that holds it.
1844                  */
1845                 if ((m->m_flags & M_VLANTAG) &&
1846                     (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
1847                         m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
1848                         if (m == NULL) {
1849                                 if_printf(dst_ifp,
1850                                     "unable to prepend VLAN header\n");
1851                                 if_inc_counter(dst_ifp, IFCOUNTER_OERRORS, 1);
1852                                 continue;
1853                         }
1854                         m->m_flags &= ~M_VLANTAG;
1855                 }
1856
1857                 if ((err = dst_ifp->if_transmit(dst_ifp, m))) {
1858                         m_freem(m0);
1859                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
1860                         break;
1861                 }
1862
1863                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OPACKETS, 1);
1864                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OBYTES, len);
1865                 if (mflags & M_MCAST)
1866                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OMCASTS, 1);
1867         }
1868
1869         return (err);
1870 }
1871
1872 /*
1873  * bridge_dummynet:
1874  *
1875  *      Receive a queued packet from dummynet and pass it on to the output
1876  *      interface.
1877  *
1878  *      The mbuf has the Ethernet header already attached.
1879  */
1880 static void
1881 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1882 {
1883         struct bridge_softc *sc;
1884
1885         sc = ifp->if_bridge;
1886
1887         /*
1888          * The packet didnt originate from a member interface. This should only
1889          * ever happen if a member interface is removed while packets are
1890          * queued for it.
1891          */
1892         if (sc == NULL) {
1893                 m_freem(m);
1894                 return;
1895         }
1896
1897         if (PFIL_HOOKED(&V_inet_pfil_hook)
1898 #ifdef INET6
1899             || PFIL_HOOKED(&V_inet6_pfil_hook)
1900 #endif
1901             ) {
1902                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1903                         return;
1904                 if (m == NULL)
1905                         return;
1906         }
1907
1908         bridge_enqueue(sc, ifp, m);
1909 }
1910
1911 /*
1912  * bridge_output:
1913  *
1914  *      Send output from a bridge member interface.  This
1915  *      performs the bridging function for locally originated
1916  *      packets.
1917  *
1918  *      The mbuf has the Ethernet header already attached.  We must
1919  *      enqueue or free the mbuf before returning.
1920  */
1921 static int
1922 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1923     struct rtentry *rt)
1924 {
1925         struct ether_header *eh;
1926         struct ifnet *dst_if;
1927         struct bridge_softc *sc;
1928         uint16_t vlan;
1929
1930         if (m->m_len < ETHER_HDR_LEN) {
1931                 m = m_pullup(m, ETHER_HDR_LEN);
1932                 if (m == NULL)
1933                         return (0);
1934         }
1935
1936         eh = mtod(m, struct ether_header *);
1937         sc = ifp->if_bridge;
1938         vlan = VLANTAGOF(m);
1939
1940         BRIDGE_LOCK(sc);
1941
1942         /*
1943          * If bridge is down, but the original output interface is up,
1944          * go ahead and send out that interface.  Otherwise, the packet
1945          * is dropped below.
1946          */
1947         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1948                 dst_if = ifp;
1949                 goto sendunicast;
1950         }
1951
1952         /*
1953          * If the packet is a multicast, or we don't know a better way to
1954          * get there, send to all interfaces.
1955          */
1956         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1957                 dst_if = NULL;
1958         else
1959                 dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
1960         if (dst_if == NULL) {
1961                 struct bridge_iflist *bif;
1962                 struct mbuf *mc;
1963                 int error = 0, used = 0;
1964
1965                 bridge_span(sc, m);
1966
1967                 BRIDGE_LOCK2REF(sc, error);
1968                 if (error) {
1969                         m_freem(m);
1970                         return (0);
1971                 }
1972
1973                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1974                         dst_if = bif->bif_ifp;
1975
1976                         if (dst_if->if_type == IFT_GIF)
1977                                 continue;
1978                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1979                                 continue;
1980
1981                         /*
1982                          * If this is not the original output interface,
1983                          * and the interface is participating in spanning
1984                          * tree, make sure the port is in a state that
1985                          * allows forwarding.
1986                          */
1987                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
1988                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
1989                                 continue;
1990
1991                         if (LIST_NEXT(bif, bif_next) == NULL) {
1992                                 used = 1;
1993                                 mc = m;
1994                         } else {
1995                                 mc = m_copypacket(m, M_NOWAIT);
1996                                 if (mc == NULL) {
1997                                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
1998                                         continue;
1999                                 }
2000                         }
2001
2002                         bridge_enqueue(sc, dst_if, mc);
2003                 }
2004                 if (used == 0)
2005                         m_freem(m);
2006                 BRIDGE_UNREF(sc);
2007                 return (0);
2008         }
2009
2010 sendunicast:
2011         /*
2012          * XXX Spanning tree consideration here?
2013          */
2014
2015         bridge_span(sc, m);
2016         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2017                 m_freem(m);
2018                 BRIDGE_UNLOCK(sc);
2019                 return (0);
2020         }
2021
2022         BRIDGE_UNLOCK(sc);
2023         bridge_enqueue(sc, dst_if, m);
2024         return (0);
2025 }
2026
2027 /*
2028  * bridge_transmit:
2029  *
2030  *      Do output on a bridge.
2031  *
2032  */
2033 static int
2034 bridge_transmit(struct ifnet *ifp, struct mbuf *m)
2035 {
2036         struct bridge_softc *sc;
2037         struct ether_header *eh;
2038         struct ifnet *dst_if;
2039         int error = 0;
2040
2041         sc = ifp->if_softc;
2042
2043         ETHER_BPF_MTAP(ifp, m);
2044
2045         eh = mtod(m, struct ether_header *);
2046
2047         BRIDGE_LOCK(sc);
2048         if (((m->m_flags & (M_BCAST|M_MCAST)) == 0) &&
2049             (dst_if = bridge_rtlookup(sc, eh->ether_dhost, 1)) != NULL) {
2050                 BRIDGE_UNLOCK(sc);
2051                 error = bridge_enqueue(sc, dst_if, m);
2052         } else
2053                 bridge_broadcast(sc, ifp, m, 0);
2054
2055         return (error);
2056 }
2057
2058 /*
2059  * The ifp->if_qflush entry point for if_bridge(4) is no-op.
2060  */
2061 static void
2062 bridge_qflush(struct ifnet *ifp __unused)
2063 {
2064 }
2065
2066 /*
2067  * bridge_forward:
2068  *
2069  *      The forwarding function of the bridge.
2070  *
2071  *      NOTE: Releases the lock on return.
2072  */
2073 static void
2074 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
2075     struct mbuf *m)
2076 {
2077         struct bridge_iflist *dbif;
2078         struct ifnet *src_if, *dst_if, *ifp;
2079         struct ether_header *eh;
2080         uint16_t vlan;
2081         uint8_t *dst;
2082         int error;
2083
2084         src_if = m->m_pkthdr.rcvif;
2085         ifp = sc->sc_ifp;
2086
2087         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
2088         if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2089         vlan = VLANTAGOF(m);
2090
2091         if ((sbif->bif_flags & IFBIF_STP) &&
2092             sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2093                 goto drop;
2094
2095         eh = mtod(m, struct ether_header *);
2096         dst = eh->ether_dhost;
2097
2098         /* If the interface is learning, record the address. */
2099         if (sbif->bif_flags & IFBIF_LEARNING) {
2100                 error = bridge_rtupdate(sc, eh->ether_shost, vlan,
2101                     sbif, 0, IFBAF_DYNAMIC);
2102                 /*
2103                  * If the interface has addresses limits then deny any source
2104                  * that is not in the cache.
2105                  */
2106                 if (error && sbif->bif_addrmax)
2107                         goto drop;
2108         }
2109
2110         if ((sbif->bif_flags & IFBIF_STP) != 0 &&
2111             sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING)
2112                 goto drop;
2113
2114         /*
2115          * At this point, the port either doesn't participate
2116          * in spanning tree or it is in the forwarding state.
2117          */
2118
2119         /*
2120          * If the packet is unicast, destined for someone on
2121          * "this" side of the bridge, drop it.
2122          */
2123         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2124                 dst_if = bridge_rtlookup(sc, dst, vlan);
2125                 if (src_if == dst_if)
2126                         goto drop;
2127         } else {
2128                 /*
2129                  * Check if its a reserved multicast address, any address
2130                  * listed in 802.1D section 7.12.6 may not be forwarded by the
2131                  * bridge.
2132                  * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
2133                  */
2134                 if (dst[0] == 0x01 && dst[1] == 0x80 &&
2135                     dst[2] == 0xc2 && dst[3] == 0x00 &&
2136                     dst[4] == 0x00 && dst[5] <= 0x0f)
2137                         goto drop;
2138
2139                 /* ...forward it to all interfaces. */
2140                 if_inc_counter(ifp, IFCOUNTER_IMCASTS, 1);
2141                 dst_if = NULL;
2142         }
2143
2144         /*
2145          * If we have a destination interface which is a member of our bridge,
2146          * OR this is a unicast packet, push it through the bpf(4) machinery.
2147          * For broadcast or multicast packets, don't bother because it will
2148          * be reinjected into ether_input. We do this before we pass the packets
2149          * through the pfil(9) framework, as it is possible that pfil(9) will
2150          * drop the packet, or possibly modify it, making it difficult to debug
2151          * firewall issues on the bridge.
2152          */
2153         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
2154                 ETHER_BPF_MTAP(ifp, m);
2155
2156         /* run the packet filter */
2157         if (PFIL_HOOKED(&V_inet_pfil_hook)
2158 #ifdef INET6
2159             || PFIL_HOOKED(&V_inet6_pfil_hook)
2160 #endif
2161             ) {
2162                 BRIDGE_UNLOCK(sc);
2163                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2164                         return;
2165                 if (m == NULL)
2166                         return;
2167                 BRIDGE_LOCK(sc);
2168         }
2169
2170         if (dst_if == NULL) {
2171                 bridge_broadcast(sc, src_if, m, 1);
2172                 return;
2173         }
2174
2175         /*
2176          * At this point, we're dealing with a unicast frame
2177          * going to a different interface.
2178          */
2179         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2180                 goto drop;
2181
2182         dbif = bridge_lookup_member_if(sc, dst_if);
2183         if (dbif == NULL)
2184                 /* Not a member of the bridge (anymore?) */
2185                 goto drop;
2186
2187         /* Private segments can not talk to each other */
2188         if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE)
2189                 goto drop;
2190
2191         if ((dbif->bif_flags & IFBIF_STP) &&
2192             dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2193                 goto drop;
2194
2195         BRIDGE_UNLOCK(sc);
2196
2197         if (PFIL_HOOKED(&V_inet_pfil_hook)
2198 #ifdef INET6
2199             || PFIL_HOOKED(&V_inet6_pfil_hook)
2200 #endif
2201             ) {
2202                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2203                         return;
2204                 if (m == NULL)
2205                         return;
2206         }
2207
2208         bridge_enqueue(sc, dst_if, m);
2209         return;
2210
2211 drop:
2212         BRIDGE_UNLOCK(sc);
2213         m_freem(m);
2214 }
2215
2216 /*
2217  * bridge_input:
2218  *
2219  *      Receive input from a member interface.  Queue the packet for
2220  *      bridging if it is not for us.
2221  */
2222 static struct mbuf *
2223 bridge_input(struct ifnet *ifp, struct mbuf *m)
2224 {
2225         struct bridge_softc *sc = ifp->if_bridge;
2226         struct bridge_iflist *bif, *bif2;
2227         struct ifnet *bifp;
2228         struct ether_header *eh;
2229         struct mbuf *mc, *mc2;
2230         uint16_t vlan;
2231         int error;
2232
2233         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2234                 return (m);
2235
2236         bifp = sc->sc_ifp;
2237         vlan = VLANTAGOF(m);
2238
2239         /*
2240          * Implement support for bridge monitoring. If this flag has been
2241          * set on this interface, discard the packet once we push it through
2242          * the bpf(4) machinery, but before we do, increment the byte and
2243          * packet counters associated with this interface.
2244          */
2245         if ((bifp->if_flags & IFF_MONITOR) != 0) {
2246                 m->m_pkthdr.rcvif  = bifp;
2247                 ETHER_BPF_MTAP(bifp, m);
2248                 if_inc_counter(bifp, IFCOUNTER_IPACKETS, 1);
2249                 if_inc_counter(bifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2250                 m_freem(m);
2251                 return (NULL);
2252         }
2253         BRIDGE_LOCK(sc);
2254         bif = bridge_lookup_member_if(sc, ifp);
2255         if (bif == NULL) {
2256                 BRIDGE_UNLOCK(sc);
2257                 return (m);
2258         }
2259
2260         eh = mtod(m, struct ether_header *);
2261
2262         bridge_span(sc, m);
2263
2264         if (m->m_flags & (M_BCAST|M_MCAST)) {
2265                 /* Tap off 802.1D packets; they do not get forwarded. */
2266                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2267                     ETHER_ADDR_LEN) == 0) {
2268                         bstp_input(&bif->bif_stp, ifp, m); /* consumes mbuf */
2269                         BRIDGE_UNLOCK(sc);
2270                         return (NULL);
2271                 }
2272
2273                 if ((bif->bif_flags & IFBIF_STP) &&
2274                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2275                         BRIDGE_UNLOCK(sc);
2276                         return (m);
2277                 }
2278
2279                 /*
2280                  * Make a deep copy of the packet and enqueue the copy
2281                  * for bridge processing; return the original packet for
2282                  * local processing.
2283                  */
2284                 mc = m_dup(m, M_NOWAIT);
2285                 if (mc == NULL) {
2286                         BRIDGE_UNLOCK(sc);
2287                         return (m);
2288                 }
2289
2290                 /* Perform the bridge forwarding function with the copy. */
2291                 bridge_forward(sc, bif, mc);
2292
2293                 /*
2294                  * Reinject the mbuf as arriving on the bridge so we have a
2295                  * chance at claiming multicast packets. We can not loop back
2296                  * here from ether_input as a bridge is never a member of a
2297                  * bridge.
2298                  */
2299                 KASSERT(bifp->if_bridge == NULL,
2300                     ("loop created in bridge_input"));
2301                 mc2 = m_dup(m, M_NOWAIT);
2302                 if (mc2 != NULL) {
2303                         /* Keep the layer3 header aligned */
2304                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2305                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2306                 }
2307                 if (mc2 != NULL) {
2308                         mc2->m_pkthdr.rcvif = bifp;
2309                         (*bifp->if_input)(bifp, mc2);
2310                 }
2311
2312                 /* Return the original packet for local processing. */
2313                 return (m);
2314         }
2315
2316         if ((bif->bif_flags & IFBIF_STP) &&
2317             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2318                 BRIDGE_UNLOCK(sc);
2319                 return (m);
2320         }
2321
2322 #if (defined(INET) || defined(INET6))
2323 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2324         || ((iface)->if_carp \
2325             && (*carp_forus_p)((iface), eh->ether_dhost))
2326 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2327         || ((iface)->if_carp \
2328             && (*carp_forus_p)((iface), eh->ether_shost))
2329 #else
2330 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2331 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2332 #endif
2333
2334 #ifdef INET6
2335 #   define OR_PFIL_HOOKED_INET6 \
2336         || PFIL_HOOKED(&V_inet6_pfil_hook)
2337 #else
2338 #   define OR_PFIL_HOOKED_INET6
2339 #endif
2340
2341 #define GRAB_OUR_PACKETS(iface) \
2342         if ((iface)->if_type == IFT_GIF) \
2343                 continue; \
2344         /* It is destined for us. */ \
2345         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2346             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
2347             ) {                                                         \
2348                 if ((iface)->if_type == IFT_BRIDGE) {                   \
2349                         ETHER_BPF_MTAP(iface, m);                       \
2350                         if_inc_counter(iface, IFCOUNTER_IPACKETS, 1);                           \
2351                         if_inc_counter(iface, IFCOUNTER_IBYTES, m->m_pkthdr.len);               \
2352                         /* Filter on the physical interface. */         \
2353                         if (pfil_local_phys &&                          \
2354                             (PFIL_HOOKED(&V_inet_pfil_hook)             \
2355                              OR_PFIL_HOOKED_INET6)) {                   \
2356                                 if (bridge_pfil(&m, NULL, ifp,          \
2357                                     PFIL_IN) != 0 || m == NULL) {       \
2358                                         BRIDGE_UNLOCK(sc);              \
2359                                         return (NULL);                  \
2360                                 }                                       \
2361                                 eh = mtod(m, struct ether_header *);    \
2362                         }                                               \
2363                 }                                                       \
2364                 if (bif->bif_flags & IFBIF_LEARNING) {                  \
2365                         error = bridge_rtupdate(sc, eh->ether_shost,    \
2366                             vlan, bif, 0, IFBAF_DYNAMIC);               \
2367                         if (error && bif->bif_addrmax) {                \
2368                                 BRIDGE_UNLOCK(sc);                      \
2369                                 m_freem(m);                             \
2370                                 return (NULL);                          \
2371                         }                                               \
2372                 }                                                       \
2373                 m->m_pkthdr.rcvif = iface;                              \
2374                 BRIDGE_UNLOCK(sc);                                      \
2375                 return (m);                                             \
2376         }                                                               \
2377                                                                         \
2378         /* We just received a packet that we sent out. */               \
2379         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2380             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
2381             ) {                                                         \
2382                 BRIDGE_UNLOCK(sc);                                      \
2383                 m_freem(m);                                             \
2384                 return (NULL);                                          \
2385         }
2386
2387         /*
2388          * Unicast.  Make sure it's not for the bridge.
2389          */
2390         do { GRAB_OUR_PACKETS(bifp) } while (0);
2391
2392         /*
2393          * Give a chance for ifp at first priority. This will help when the
2394          * packet comes through the interface like VLAN's with the same MACs
2395          * on several interfaces from the same bridge. This also will save
2396          * some CPU cycles in case the destination interface and the input
2397          * interface (eq ifp) are the same.
2398          */
2399         do { GRAB_OUR_PACKETS(ifp) } while (0);
2400
2401         /* Now check the all bridge members. */
2402         LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2403                 GRAB_OUR_PACKETS(bif2->bif_ifp)
2404         }
2405
2406 #undef OR_CARP_CHECK_WE_ARE_DST
2407 #undef OR_CARP_CHECK_WE_ARE_SRC
2408 #undef OR_PFIL_HOOKED_INET6
2409 #undef GRAB_OUR_PACKETS
2410
2411         /* Perform the bridge forwarding function. */
2412         bridge_forward(sc, bif, m);
2413
2414         return (NULL);
2415 }
2416
2417 /*
2418  * bridge_broadcast:
2419  *
2420  *      Send a frame to all interfaces that are members of
2421  *      the bridge, except for the one on which the packet
2422  *      arrived.
2423  *
2424  *      NOTE: Releases the lock on return.
2425  */
2426 static void
2427 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2428     struct mbuf *m, int runfilt)
2429 {
2430         struct bridge_iflist *dbif, *sbif;
2431         struct mbuf *mc;
2432         struct ifnet *dst_if;
2433         int error = 0, used = 0, i;
2434
2435         sbif = bridge_lookup_member_if(sc, src_if);
2436
2437         BRIDGE_LOCK2REF(sc, error);
2438         if (error) {
2439                 m_freem(m);
2440                 return;
2441         }
2442
2443         /* Filter on the bridge interface before broadcasting */
2444         if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2445 #ifdef INET6
2446             || PFIL_HOOKED(&V_inet6_pfil_hook)
2447 #endif
2448             )) {
2449                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2450                         goto out;
2451                 if (m == NULL)
2452                         goto out;
2453         }
2454
2455         LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
2456                 dst_if = dbif->bif_ifp;
2457                 if (dst_if == src_if)
2458                         continue;
2459
2460                 /* Private segments can not talk to each other */
2461                 if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
2462                         continue;
2463
2464                 if ((dbif->bif_flags & IFBIF_STP) &&
2465                     dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2466                         continue;
2467
2468                 if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
2469                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2470                         continue;
2471
2472                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2473                         continue;
2474
2475                 if (LIST_NEXT(dbif, bif_next) == NULL) {
2476                         mc = m;
2477                         used = 1;
2478                 } else {
2479                         mc = m_dup(m, M_NOWAIT);
2480                         if (mc == NULL) {
2481                                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2482                                 continue;
2483                         }
2484                 }
2485
2486                 /*
2487                  * Filter on the output interface. Pass a NULL bridge interface
2488                  * pointer so we do not redundantly filter on the bridge for
2489                  * each interface we broadcast on.
2490                  */
2491                 if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2492 #ifdef INET6
2493                     || PFIL_HOOKED(&V_inet6_pfil_hook)
2494 #endif
2495                     )) {
2496                         if (used == 0) {
2497                                 /* Keep the layer3 header aligned */
2498                                 i = min(mc->m_pkthdr.len, max_protohdr);
2499                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2500                                 if (mc == NULL) {
2501                                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2502                                         continue;
2503                                 }
2504                         }
2505                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2506                                 continue;
2507                         if (mc == NULL)
2508                                 continue;
2509                 }
2510
2511                 bridge_enqueue(sc, dst_if, mc);
2512         }
2513         if (used == 0)
2514                 m_freem(m);
2515
2516 out:
2517         BRIDGE_UNREF(sc);
2518 }
2519
2520 /*
2521  * bridge_span:
2522  *
2523  *      Duplicate a packet out one or more interfaces that are in span mode,
2524  *      the original mbuf is unmodified.
2525  */
2526 static void
2527 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2528 {
2529         struct bridge_iflist *bif;
2530         struct ifnet *dst_if;
2531         struct mbuf *mc;
2532
2533         if (LIST_EMPTY(&sc->sc_spanlist))
2534                 return;
2535
2536         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2537                 dst_if = bif->bif_ifp;
2538
2539                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2540                         continue;
2541
2542                 mc = m_copypacket(m, M_NOWAIT);
2543                 if (mc == NULL) {
2544                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2545                         continue;
2546                 }
2547
2548                 bridge_enqueue(sc, dst_if, mc);
2549         }
2550 }
2551
2552 /*
2553  * bridge_rtupdate:
2554  *
2555  *      Add a bridge routing entry.
2556  */
2557 static int
2558 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan,
2559     struct bridge_iflist *bif, int setflags, uint8_t flags)
2560 {
2561         struct bridge_rtnode *brt;
2562         int error;
2563
2564         BRIDGE_LOCK_ASSERT(sc);
2565
2566         /* Check the source address is valid and not multicast. */
2567         if (ETHER_IS_MULTICAST(dst) ||
2568             (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
2569              dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0)
2570                 return (EINVAL);
2571
2572         /* 802.1p frames map to vlan 1 */
2573         if (vlan == 0)
2574                 vlan = 1;
2575
2576         /*
2577          * A route for this destination might already exist.  If so,
2578          * update it, otherwise create a new one.
2579          */
2580         if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
2581                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2582                         sc->sc_brtexceeded++;
2583                         return (ENOSPC);
2584                 }
2585                 /* Check per interface address limits (if enabled) */
2586                 if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
2587                         bif->bif_addrexceeded++;
2588                         return (ENOSPC);
2589                 }
2590
2591                 /*
2592                  * Allocate a new bridge forwarding node, and
2593                  * initialize the expiration time and Ethernet
2594                  * address.
2595                  */
2596                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2597                 if (brt == NULL)
2598                         return (ENOMEM);
2599
2600                 if (bif->bif_flags & IFBIF_STICKY)
2601                         brt->brt_flags = IFBAF_STICKY;
2602                 else
2603                         brt->brt_flags = IFBAF_DYNAMIC;
2604
2605                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2606                 brt->brt_vlan = vlan;
2607
2608                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2609                         uma_zfree(bridge_rtnode_zone, brt);
2610                         return (error);
2611                 }
2612                 brt->brt_dst = bif;
2613                 bif->bif_addrcnt++;
2614         }
2615
2616         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
2617             brt->brt_dst != bif) {
2618                 brt->brt_dst->bif_addrcnt--;
2619                 brt->brt_dst = bif;
2620                 brt->brt_dst->bif_addrcnt++;
2621         }
2622
2623         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2624                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2625         if (setflags)
2626                 brt->brt_flags = flags;
2627
2628         return (0);
2629 }
2630
2631 /*
2632  * bridge_rtlookup:
2633  *
2634  *      Lookup the destination interface for an address.
2635  */
2636 static struct ifnet *
2637 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2638 {
2639         struct bridge_rtnode *brt;
2640
2641         BRIDGE_LOCK_ASSERT(sc);
2642
2643         if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL)
2644                 return (NULL);
2645
2646         return (brt->brt_ifp);
2647 }
2648
2649 /*
2650  * bridge_rttrim:
2651  *
2652  *      Trim the routine table so that we have a number
2653  *      of routing entries less than or equal to the
2654  *      maximum number.
2655  */
2656 static void
2657 bridge_rttrim(struct bridge_softc *sc)
2658 {
2659         struct bridge_rtnode *brt, *nbrt;
2660
2661         BRIDGE_LOCK_ASSERT(sc);
2662
2663         /* Make sure we actually need to do this. */
2664         if (sc->sc_brtcnt <= sc->sc_brtmax)
2665                 return;
2666
2667         /* Force an aging cycle; this might trim enough addresses. */
2668         bridge_rtage(sc);
2669         if (sc->sc_brtcnt <= sc->sc_brtmax)
2670                 return;
2671
2672         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2673                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2674                         bridge_rtnode_destroy(sc, brt);
2675                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2676                                 return;
2677                 }
2678         }
2679 }
2680
2681 /*
2682  * bridge_timer:
2683  *
2684  *      Aging timer for the bridge.
2685  */
2686 static void
2687 bridge_timer(void *arg)
2688 {
2689         struct bridge_softc *sc = arg;
2690
2691         BRIDGE_LOCK_ASSERT(sc);
2692
2693         bridge_rtage(sc);
2694
2695         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2696                 callout_reset(&sc->sc_brcallout,
2697                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2698 }
2699
2700 /*
2701  * bridge_rtage:
2702  *
2703  *      Perform an aging cycle.
2704  */
2705 static void
2706 bridge_rtage(struct bridge_softc *sc)
2707 {
2708         struct bridge_rtnode *brt, *nbrt;
2709
2710         BRIDGE_LOCK_ASSERT(sc);
2711
2712         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2713                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2714                         if (time_uptime >= brt->brt_expire)
2715                                 bridge_rtnode_destroy(sc, brt);
2716                 }
2717         }
2718 }
2719
2720 /*
2721  * bridge_rtflush:
2722  *
2723  *      Remove all dynamic addresses from the bridge.
2724  */
2725 static void
2726 bridge_rtflush(struct bridge_softc *sc, int full)
2727 {
2728         struct bridge_rtnode *brt, *nbrt;
2729
2730         BRIDGE_LOCK_ASSERT(sc);
2731
2732         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2733                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2734                         bridge_rtnode_destroy(sc, brt);
2735         }
2736 }
2737
2738 /*
2739  * bridge_rtdaddr:
2740  *
2741  *      Remove an address from the table.
2742  */
2743 static int
2744 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2745 {
2746         struct bridge_rtnode *brt;
2747         int found = 0;
2748
2749         BRIDGE_LOCK_ASSERT(sc);
2750
2751         /*
2752          * If vlan is zero then we want to delete for all vlans so the lookup
2753          * may return more than one.
2754          */
2755         while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
2756                 bridge_rtnode_destroy(sc, brt);
2757                 found = 1;
2758         }
2759
2760         return (found ? 0 : ENOENT);
2761 }
2762
2763 /*
2764  * bridge_rtdelete:
2765  *
2766  *      Delete routes to a speicifc member interface.
2767  */
2768 static void
2769 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2770 {
2771         struct bridge_rtnode *brt, *nbrt;
2772
2773         BRIDGE_LOCK_ASSERT(sc);
2774
2775         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2776                 if (brt->brt_ifp == ifp && (full ||
2777                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2778                         bridge_rtnode_destroy(sc, brt);
2779         }
2780 }
2781
2782 /*
2783  * bridge_rtable_init:
2784  *
2785  *      Initialize the route table for this bridge.
2786  */
2787 static void
2788 bridge_rtable_init(struct bridge_softc *sc)
2789 {
2790         int i;
2791
2792         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2793             M_DEVBUF, M_WAITOK);
2794
2795         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2796                 LIST_INIT(&sc->sc_rthash[i]);
2797
2798         sc->sc_rthash_key = arc4random();
2799         LIST_INIT(&sc->sc_rtlist);
2800 }
2801
2802 /*
2803  * bridge_rtable_fini:
2804  *
2805  *      Deconstruct the route table for this bridge.
2806  */
2807 static void
2808 bridge_rtable_fini(struct bridge_softc *sc)
2809 {
2810
2811         KASSERT(sc->sc_brtcnt == 0,
2812             ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
2813         free(sc->sc_rthash, M_DEVBUF);
2814 }
2815
2816 /*
2817  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2818  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2819  */
2820 #define mix(a, b, c)                                                    \
2821 do {                                                                    \
2822         a -= b; a -= c; a ^= (c >> 13);                                 \
2823         b -= c; b -= a; b ^= (a << 8);                                  \
2824         c -= a; c -= b; c ^= (b >> 13);                                 \
2825         a -= b; a -= c; a ^= (c >> 12);                                 \
2826         b -= c; b -= a; b ^= (a << 16);                                 \
2827         c -= a; c -= b; c ^= (b >> 5);                                  \
2828         a -= b; a -= c; a ^= (c >> 3);                                  \
2829         b -= c; b -= a; b ^= (a << 10);                                 \
2830         c -= a; c -= b; c ^= (b >> 15);                                 \
2831 } while (/*CONSTCOND*/0)
2832
2833 static __inline uint32_t
2834 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2835 {
2836         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2837
2838         b += addr[5] << 8;
2839         b += addr[4];
2840         a += addr[3] << 24;
2841         a += addr[2] << 16;
2842         a += addr[1] << 8;
2843         a += addr[0];
2844
2845         mix(a, b, c);
2846
2847         return (c & BRIDGE_RTHASH_MASK);
2848 }
2849
2850 #undef mix
2851
2852 static int
2853 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2854 {
2855         int i, d;
2856
2857         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2858                 d = ((int)a[i]) - ((int)b[i]);
2859         }
2860
2861         return (d);
2862 }
2863
2864 /*
2865  * bridge_rtnode_lookup:
2866  *
2867  *      Look up a bridge route node for the specified destination. Compare the
2868  *      vlan id or if zero then just return the first match.
2869  */
2870 static struct bridge_rtnode *
2871 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2872 {
2873         struct bridge_rtnode *brt;
2874         uint32_t hash;
2875         int dir;
2876
2877         BRIDGE_LOCK_ASSERT(sc);
2878
2879         hash = bridge_rthash(sc, addr);
2880         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2881                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2882                 if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0))
2883                         return (brt);
2884                 if (dir > 0)
2885                         return (NULL);
2886         }
2887
2888         return (NULL);
2889 }
2890
2891 /*
2892  * bridge_rtnode_insert:
2893  *
2894  *      Insert the specified bridge node into the route table.  We
2895  *      assume the entry is not already in the table.
2896  */
2897 static int
2898 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2899 {
2900         struct bridge_rtnode *lbrt;
2901         uint32_t hash;
2902         int dir;
2903
2904         BRIDGE_LOCK_ASSERT(sc);
2905
2906         hash = bridge_rthash(sc, brt->brt_addr);
2907
2908         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2909         if (lbrt == NULL) {
2910                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2911                 goto out;
2912         }
2913
2914         do {
2915                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2916                 if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan)
2917                         return (EEXIST);
2918                 if (dir > 0) {
2919                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2920                         goto out;
2921                 }
2922                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2923                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2924                         goto out;
2925                 }
2926                 lbrt = LIST_NEXT(lbrt, brt_hash);
2927         } while (lbrt != NULL);
2928
2929 #ifdef DIAGNOSTIC
2930         panic("bridge_rtnode_insert: impossible");
2931 #endif
2932
2933 out:
2934         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2935         sc->sc_brtcnt++;
2936
2937         return (0);
2938 }
2939
2940 /*
2941  * bridge_rtnode_destroy:
2942  *
2943  *      Destroy a bridge rtnode.
2944  */
2945 static void
2946 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2947 {
2948         BRIDGE_LOCK_ASSERT(sc);
2949
2950         LIST_REMOVE(brt, brt_hash);
2951
2952         LIST_REMOVE(brt, brt_list);
2953         sc->sc_brtcnt--;
2954         brt->brt_dst->bif_addrcnt--;
2955         uma_zfree(bridge_rtnode_zone, brt);
2956 }
2957
2958 /*
2959  * bridge_rtable_expire:
2960  *
2961  *      Set the expiry time for all routes on an interface.
2962  */
2963 static void
2964 bridge_rtable_expire(struct ifnet *ifp, int age)
2965 {
2966         struct bridge_softc *sc = ifp->if_bridge;
2967         struct bridge_rtnode *brt;
2968
2969         BRIDGE_LOCK(sc);
2970
2971         /*
2972          * If the age is zero then flush, otherwise set all the expiry times to
2973          * age for the interface
2974          */
2975         if (age == 0)
2976                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
2977         else {
2978                 LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
2979                         /* Cap the expiry time to 'age' */
2980                         if (brt->brt_ifp == ifp &&
2981                             brt->brt_expire > time_uptime + age &&
2982                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2983                                 brt->brt_expire = time_uptime + age;
2984                 }
2985         }
2986         BRIDGE_UNLOCK(sc);
2987 }
2988
2989 /*
2990  * bridge_state_change:
2991  *
2992  *      Callback from the bridgestp code when a port changes states.
2993  */
2994 static void
2995 bridge_state_change(struct ifnet *ifp, int state)
2996 {
2997         struct bridge_softc *sc = ifp->if_bridge;
2998         static const char *stpstates[] = {
2999                 "disabled",
3000                 "listening",
3001                 "learning",
3002                 "forwarding",
3003                 "blocking",
3004                 "discarding"
3005         };
3006
3007         if (log_stp)
3008                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
3009                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
3010 }
3011
3012 /*
3013  * Send bridge packets through pfil if they are one of the types pfil can deal
3014  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
3015  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
3016  * that interface.
3017  */
3018 static int
3019 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
3020 {
3021         int snap, error, i, hlen;
3022         struct ether_header *eh1, eh2;
3023         struct ip *ip;
3024         struct llc llc1;
3025         u_int16_t ether_type;
3026
3027         snap = 0;
3028         error = -1;     /* Default error if not error == 0 */
3029
3030 #if 0
3031         /* we may return with the IP fields swapped, ensure its not shared */
3032         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
3033 #endif
3034
3035         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
3036                 return (0); /* filtering is disabled */
3037
3038         i = min((*mp)->m_pkthdr.len, max_protohdr);
3039         if ((*mp)->m_len < i) {
3040             *mp = m_pullup(*mp, i);
3041             if (*mp == NULL) {
3042                 printf("%s: m_pullup failed\n", __func__);
3043                 return (-1);
3044             }
3045         }
3046
3047         eh1 = mtod(*mp, struct ether_header *);
3048         ether_type = ntohs(eh1->ether_type);
3049
3050         /*
3051          * Check for SNAP/LLC.
3052          */
3053         if (ether_type < ETHERMTU) {
3054                 struct llc *llc2 = (struct llc *)(eh1 + 1);
3055
3056                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
3057                     llc2->llc_dsap == LLC_SNAP_LSAP &&
3058                     llc2->llc_ssap == LLC_SNAP_LSAP &&
3059                     llc2->llc_control == LLC_UI) {
3060                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
3061                         snap = 1;
3062                 }
3063         }
3064
3065         /*
3066          * If we're trying to filter bridge traffic, don't look at anything
3067          * other than IP and ARP traffic.  If the filter doesn't understand
3068          * IPv6, don't allow IPv6 through the bridge either.  This is lame
3069          * since if we really wanted, say, an AppleTalk filter, we are hosed,
3070          * but of course we don't have an AppleTalk filter to begin with.
3071          * (Note that since pfil doesn't understand ARP it will pass *ALL*
3072          * ARP traffic.)
3073          */
3074         switch (ether_type) {
3075                 case ETHERTYPE_ARP:
3076                 case ETHERTYPE_REVARP:
3077                         if (pfil_ipfw_arp == 0)
3078                                 return (0); /* Automatically pass */
3079                         break;
3080
3081                 case ETHERTYPE_IP:
3082 #ifdef INET6
3083                 case ETHERTYPE_IPV6:
3084 #endif /* INET6 */
3085                         break;
3086                 default:
3087                         /*
3088                          * Check to see if the user wants to pass non-ip
3089                          * packets, these will not be checked by pfil(9) and
3090                          * passed unconditionally so the default is to drop.
3091                          */
3092                         if (pfil_onlyip)
3093                                 goto bad;
3094         }
3095
3096         /* Run the packet through pfil before stripping link headers */
3097         if (PFIL_HOOKED(&V_link_pfil_hook) && pfil_ipfw != 0 &&
3098                         dir == PFIL_OUT && ifp != NULL) {
3099
3100                 error = pfil_run_hooks(&V_link_pfil_hook, mp, ifp, dir, NULL);
3101
3102                 if (*mp == NULL || error != 0) /* packet consumed by filter */
3103                         return (error);
3104         }
3105
3106         /* Strip off the Ethernet header and keep a copy. */
3107         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3108         m_adj(*mp, ETHER_HDR_LEN);
3109
3110         /* Strip off snap header, if present */
3111         if (snap) {
3112                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3113                 m_adj(*mp, sizeof(struct llc));
3114         }
3115
3116         /*
3117          * Check the IP header for alignment and errors
3118          */
3119         if (dir == PFIL_IN) {
3120                 switch (ether_type) {
3121                         case ETHERTYPE_IP:
3122                                 error = bridge_ip_checkbasic(mp);
3123                                 break;
3124 #ifdef INET6
3125                         case ETHERTYPE_IPV6:
3126                                 error = bridge_ip6_checkbasic(mp);
3127                                 break;
3128 #endif /* INET6 */
3129                         default:
3130                                 error = 0;
3131                 }
3132                 if (error)
3133                         goto bad;
3134         }
3135
3136         error = 0;
3137
3138         /*
3139          * Run the packet through pfil
3140          */
3141         switch (ether_type) {
3142         case ETHERTYPE_IP:
3143                 /*
3144                  * Run pfil on the member interface and the bridge, both can
3145                  * be skipped by clearing pfil_member or pfil_bridge.
3146                  *
3147                  * Keep the order:
3148                  *   in_if -> bridge_if -> out_if
3149                  */
3150                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3151                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3152                                         dir, NULL);
3153
3154                 if (*mp == NULL || error != 0) /* filter may consume */
3155                         break;
3156
3157                 if (pfil_member && ifp != NULL)
3158                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, ifp,
3159                                         dir, NULL);
3160
3161                 if (*mp == NULL || error != 0) /* filter may consume */
3162                         break;
3163
3164                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
3165                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3166                                         dir, NULL);
3167
3168                 if (*mp == NULL || error != 0) /* filter may consume */
3169                         break;
3170
3171                 /* check if we need to fragment the packet */
3172                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
3173                         i = (*mp)->m_pkthdr.len;
3174                         if (i > ifp->if_mtu) {
3175                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
3176                                             &llc1);
3177                                 return (error);
3178                         }
3179                 }
3180
3181                 /* Recalculate the ip checksum. */
3182                 ip = mtod(*mp, struct ip *);
3183                 hlen = ip->ip_hl << 2;
3184                 if (hlen < sizeof(struct ip))
3185                         goto bad;
3186                 if (hlen > (*mp)->m_len) {
3187                         if ((*mp = m_pullup(*mp, hlen)) == 0)
3188                                 goto bad;
3189                         ip = mtod(*mp, struct ip *);
3190                         if (ip == NULL)
3191                                 goto bad;
3192                 }
3193                 ip->ip_sum = 0;
3194                 if (hlen == sizeof(struct ip))
3195                         ip->ip_sum = in_cksum_hdr(ip);
3196                 else
3197                         ip->ip_sum = in_cksum(*mp, hlen);
3198
3199                 break;
3200 #ifdef INET6
3201         case ETHERTYPE_IPV6:
3202                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3203                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3204                                         dir, NULL);
3205
3206                 if (*mp == NULL || error != 0) /* filter may consume */
3207                         break;
3208
3209                 if (pfil_member && ifp != NULL)
3210                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, ifp,
3211                                         dir, NULL);
3212
3213                 if (*mp == NULL || error != 0) /* filter may consume */
3214                         break;
3215
3216                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
3217                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3218                                         dir, NULL);
3219                 break;
3220 #endif
3221         default:
3222                 error = 0;
3223                 break;
3224         }
3225
3226         if (*mp == NULL)
3227                 return (error);
3228         if (error != 0)
3229                 goto bad;
3230
3231         error = -1;
3232
3233         /*
3234          * Finally, put everything back the way it was and return
3235          */
3236         if (snap) {
3237                 M_PREPEND(*mp, sizeof(struct llc), M_NOWAIT);
3238                 if (*mp == NULL)
3239                         return (error);
3240                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3241         }
3242
3243         M_PREPEND(*mp, ETHER_HDR_LEN, M_NOWAIT);
3244         if (*mp == NULL)
3245                 return (error);
3246         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3247
3248         return (0);
3249
3250 bad:
3251         m_freem(*mp);
3252         *mp = NULL;
3253         return (error);
3254 }
3255
3256 /*
3257  * Perform basic checks on header size since
3258  * pfil assumes ip_input has already processed
3259  * it for it.  Cut-and-pasted from ip_input.c.
3260  * Given how simple the IPv6 version is,
3261  * does the IPv4 version really need to be
3262  * this complicated?
3263  *
3264  * XXX Should we update ipstat here, or not?
3265  * XXX Right now we update ipstat but not
3266  * XXX csum_counter.
3267  */
3268 static int
3269 bridge_ip_checkbasic(struct mbuf **mp)
3270 {
3271         struct mbuf *m = *mp;
3272         struct ip *ip;
3273         int len, hlen;
3274         u_short sum;
3275
3276         if (*mp == NULL)
3277                 return (-1);
3278
3279         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3280                 if ((m = m_copyup(m, sizeof(struct ip),
3281                         (max_linkhdr + 3) & ~3)) == NULL) {
3282                         /* XXXJRT new stat, please */
3283                         KMOD_IPSTAT_INC(ips_toosmall);
3284                         goto bad;
3285                 }
3286         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
3287                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3288                         KMOD_IPSTAT_INC(ips_toosmall);
3289                         goto bad;
3290                 }
3291         }
3292         ip = mtod(m, struct ip *);
3293         if (ip == NULL) goto bad;
3294
3295         if (ip->ip_v != IPVERSION) {
3296                 KMOD_IPSTAT_INC(ips_badvers);
3297                 goto bad;
3298         }
3299         hlen = ip->ip_hl << 2;
3300         if (hlen < sizeof(struct ip)) { /* minimum header length */
3301                 KMOD_IPSTAT_INC(ips_badhlen);
3302                 goto bad;
3303         }
3304         if (hlen > m->m_len) {
3305                 if ((m = m_pullup(m, hlen)) == 0) {
3306                         KMOD_IPSTAT_INC(ips_badhlen);
3307                         goto bad;
3308                 }
3309                 ip = mtod(m, struct ip *);
3310                 if (ip == NULL) goto bad;
3311         }
3312
3313         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3314                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3315         } else {
3316                 if (hlen == sizeof(struct ip)) {
3317                         sum = in_cksum_hdr(ip);
3318                 } else {
3319                         sum = in_cksum(m, hlen);
3320                 }
3321         }
3322         if (sum) {
3323                 KMOD_IPSTAT_INC(ips_badsum);
3324                 goto bad;
3325         }
3326
3327         /* Retrieve the packet length. */
3328         len = ntohs(ip->ip_len);
3329
3330         /*
3331          * Check for additional length bogosity
3332          */
3333         if (len < hlen) {
3334                 KMOD_IPSTAT_INC(ips_badlen);
3335                 goto bad;
3336         }
3337
3338         /*
3339          * Check that the amount of data in the buffers
3340          * is as at least much as the IP header would have us expect.
3341          * Drop packet if shorter than we expect.
3342          */
3343         if (m->m_pkthdr.len < len) {
3344                 KMOD_IPSTAT_INC(ips_tooshort);
3345                 goto bad;
3346         }
3347
3348         /* Checks out, proceed */
3349         *mp = m;
3350         return (0);
3351
3352 bad:
3353         *mp = m;
3354         return (-1);
3355 }
3356
3357 #ifdef INET6
3358 /*
3359  * Same as above, but for IPv6.
3360  * Cut-and-pasted from ip6_input.c.
3361  * XXX Should we update ip6stat, or not?
3362  */
3363 static int
3364 bridge_ip6_checkbasic(struct mbuf **mp)
3365 {
3366         struct mbuf *m = *mp;
3367         struct ip6_hdr *ip6;
3368
3369         /*
3370          * If the IPv6 header is not aligned, slurp it up into a new
3371          * mbuf with space for link headers, in the event we forward
3372          * it.  Otherwise, if it is aligned, make sure the entire base
3373          * IPv6 header is in the first mbuf of the chain.
3374          */
3375         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3376                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3377                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3378                             (max_linkhdr + 3) & ~3)) == NULL) {
3379                         /* XXXJRT new stat, please */
3380                         IP6STAT_INC(ip6s_toosmall);
3381                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3382                         goto bad;
3383                 }
3384         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3385                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3386                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3387                         IP6STAT_INC(ip6s_toosmall);
3388                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3389                         goto bad;
3390                 }
3391         }
3392
3393         ip6 = mtod(m, struct ip6_hdr *);
3394
3395         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3396                 IP6STAT_INC(ip6s_badvers);
3397                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3398                 goto bad;
3399         }
3400
3401         /* Checks out, proceed */
3402         *mp = m;
3403         return (0);
3404
3405 bad:
3406         *mp = m;
3407         return (-1);
3408 }
3409 #endif /* INET6 */
3410
3411 /*
3412  * bridge_fragment:
3413  *
3414  *      Return a fragmented mbuf chain.
3415  */
3416 static int
3417 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3418     int snap, struct llc *llc)
3419 {
3420         struct mbuf *m0;
3421         struct ip *ip;
3422         int error = -1;
3423
3424         if (m->m_len < sizeof(struct ip) &&
3425             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3426                 goto out;
3427         ip = mtod(m, struct ip *);
3428
3429         m->m_pkthdr.csum_flags |= CSUM_IP;
3430         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist);
3431         if (error)
3432                 goto out;
3433
3434         /* walk the chain and re-add the Ethernet header */
3435         for (m0 = m; m0; m0 = m0->m_nextpkt) {
3436                 if (error == 0) {
3437                         if (snap) {
3438                                 M_PREPEND(m0, sizeof(struct llc), M_NOWAIT);
3439                                 if (m0 == NULL) {
3440                                         error = ENOBUFS;
3441                                         continue;
3442                                 }
3443                                 bcopy(llc, mtod(m0, caddr_t),
3444                                     sizeof(struct llc));
3445                         }
3446                         M_PREPEND(m0, ETHER_HDR_LEN, M_NOWAIT);
3447                         if (m0 == NULL) {
3448                                 error = ENOBUFS;
3449                                 continue;
3450                         }
3451                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3452                 } else
3453                         m_freem(m);
3454         }
3455
3456         if (error == 0)
3457                 KMOD_IPSTAT_INC(ips_fragmented);
3458
3459         return (error);
3460
3461 out:
3462         if (m != NULL)
3463                 m_freem(m);
3464         return (error);
3465 }
3466
3467 static void
3468 bridge_linkstate(struct ifnet *ifp)
3469 {
3470         struct bridge_softc *sc = ifp->if_bridge;
3471         struct bridge_iflist *bif;
3472
3473         BRIDGE_LOCK(sc);
3474         bif = bridge_lookup_member_if(sc, ifp);
3475         if (bif == NULL) {
3476                 BRIDGE_UNLOCK(sc);
3477                 return;
3478         }
3479         bridge_linkcheck(sc);
3480         BRIDGE_UNLOCK(sc);
3481
3482         bstp_linkstate(&bif->bif_stp);
3483 }
3484
3485 static void
3486 bridge_linkcheck(struct bridge_softc *sc)
3487 {
3488         struct bridge_iflist *bif;
3489         int new_link, hasls;
3490
3491         BRIDGE_LOCK_ASSERT(sc);
3492         new_link = LINK_STATE_DOWN;
3493         hasls = 0;
3494         /* Our link is considered up if at least one of our ports is active */
3495         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
3496                 if (bif->bif_ifp->if_capabilities & IFCAP_LINKSTATE)
3497                         hasls++;
3498                 if (bif->bif_ifp->if_link_state == LINK_STATE_UP) {
3499                         new_link = LINK_STATE_UP;
3500                         break;
3501                 }
3502         }
3503         if (!LIST_EMPTY(&sc->sc_iflist) && !hasls) {
3504                 /* If no interfaces support link-state then we default to up */
3505                 new_link = LINK_STATE_UP;
3506         }
3507         if_link_state_change(sc->sc_ifp, new_link);
3508 }