sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*
   4  * Copyright 2001 Wasabi Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. All advertising materials mentioning features or use of this software
  18  *    must display the following acknowledgement:
  19  *      This product includes software developed for the NetBSD Project by
  20  *      Wasabi Systems, Inc.
  21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  22  *    or promote products derived from this software without specific prior
  23  *    written permission.
  24  *
  25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  35  * POSSIBILITY OF SUCH DAMAGE.
  36  */
  37
  38 /*
  39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  40  * All rights reserved.
  41  *
  42  * Redistribution and use in source and binary forms, with or without
  43  * modification, are permitted provided that the following conditions
  44  * are met:
  45  * 1. Redistributions of source code must retain the above copyright
  46  *    notice, this list of conditions and the following disclaimer.
  47  * 2. Redistributions in binary form must reproduce the above copyright
  48  *    notice, this list of conditions and the following disclaimer in the
  49  *    documentation and/or other materials provided with the distribution.
  50  * 3. All advertising materials mentioning features or use of this software
  51  *    must display the following acknowledgement:
  52  *      This product includes software developed by Jason L. Wright
  53  * 4. The name of the author may not be used to endorse or promote products
  54  *    derived from this software without specific prior written permission.
  55  *
  56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  66  * POSSIBILITY OF SUCH DAMAGE.
  67  *
  68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  69  */
  70
  71 /*
  72  * Network interface bridge support.
  73  *
  74  * TODO:
  75  *
  76  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  77  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  78  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  79  *        consider heterogenous bridges).
  80  */
  81
  82 #include <sys/cdefs.h>
  83 __FBSDID("$FreeBSD$");
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87 #include "opt_carp.h"
  88
  89 #include <sys/param.h>
  90 #include <sys/mbuf.h>
  91 #include <sys/malloc.h>
  92 #include <sys/protosw.h>
  93 #include <sys/systm.h>
  94 #include <sys/time.h>
  95 #include <sys/socket.h> /* for net/if.h */
  96 #include <sys/sockio.h>
  97 #include <sys/ctype.h>  /* string functions */
  98 #include <sys/kernel.h>
  99 #include <sys/random.h>
 100 #include <sys/syslog.h>
 101 #include <sys/sysctl.h>
 102 #include <vm/uma.h>
 103 #include <sys/module.h>
 104 #include <sys/proc.h>
 105 #include <sys/lock.h>
 106 #include <sys/mutex.h>
 107
 108 #include <net/bpf.h>
 109 #include <net/if.h>
 110 #include <net/if_clone.h>
 111 #include <net/if_dl.h>
 112 #include <net/if_types.h>
 113 #include <net/if_var.h>
 114 #include <net/pfil.h>
 115
 116 #include <netinet/in.h> /* for struct arpcom */
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #endif
 125 #ifdef DEV_CARP
 126 #include <netinet/ip_carp.h>
 127 #endif
 128 #include <machine/in_cksum.h>
 129 #include <netinet/if_ether.h> /* for struct arpcom */
 130 #include <net/bridgestp.h>
 131 #include <net/if_bridgevar.h>
 132 #include <net/if_llc.h>
 133
 134 #include <net/route.h>
 135 #include <netinet/ip_fw.h>
 136 #include <netinet/ip_dummynet.h>
 137
 138 /*
 139  * Size of the route hash table.  Must be a power of two.
 140  */
 141 #ifndef BRIDGE_RTHASH_SIZE
 142 #define BRIDGE_RTHASH_SIZE              1024
 143 #endif
 144
 145 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 146
 147 /*
 148  * Maximum number of addresses to cache.
 149  */
 150 #ifndef BRIDGE_RTABLE_MAX
 151 #define BRIDGE_RTABLE_MAX               100
 152 #endif
 153
 154 /*
 155  * Timeout (in seconds) for entries learned dynamically.
 156  */
 157 #ifndef BRIDGE_RTABLE_TIMEOUT
 158 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 159 #endif
 160
 161 /*
 162  * Number of seconds between walks of the route list.
 163  */
 164 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 165 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 166 #endif
 167
 168 /*
 169  * List of capabilities to mask on the member interface.
 170  */
 171 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 172
 173 /*
 174  * Bridge interface list entry.
 175  */
 176 struct bridge_iflist {
 177         LIST_ENTRY(bridge_iflist) bif_next;
 178         struct ifnet            *bif_ifp;       /* member if */
 179         struct bstp_port        bif_stp;        /* STP state */
 180         uint32_t                bif_flags;      /* member if flags */
 181         int                     bif_mutecap;    /* member muted caps */
 182 };
 183
 184 /*
 185  * Bridge route node.
 186  */
 187 struct bridge_rtnode {
 188         LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
 189         LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
 190         struct ifnet            *brt_ifp;       /* destination if */
 191         unsigned long           brt_expire;     /* expiration time */
 192         uint8_t                 brt_flags;      /* address flags */
 193         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 194 };
 195
 196 /*
 197  * Software state for each bridge.
 198  */
 199 struct bridge_softc {
 200         struct ifnet            *sc_ifp;        /* make this an interface */
 201         LIST_ENTRY(bridge_softc) sc_list;
 202         struct mtx              sc_mtx;
 203         struct cv               sc_cv;
 204         uint32_t                sc_brtmax;      /* max # of addresses */
 205         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 206         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 207         struct callout          sc_brcallout;   /* bridge callout */
 208         uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
 209         uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
 210         LIST_HEAD(, bridge_iflist) sc_iflist;   /* member interface list */
 211         LIST_HEAD(, bridge_rtnode) *sc_rthash;  /* our forwarding table */
 212         LIST_HEAD(, bridge_rtnode) sc_rtlist;   /* list version of above */
 213         uint32_t                sc_rthash_key;  /* key for hash */
 214         LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */
 215         struct bstp_state       sc_stp;         /* STP state */
 216         uint32_t                sc_brtexceeded; /* # of cache drops */
 217 };
 218
 219 static struct mtx       bridge_list_mtx;
 220 eventhandler_tag        bridge_detach_cookie = NULL;
 221
 222 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 223
 224 uma_zone_t bridge_rtnode_zone;
 225
 226 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
 227 static void     bridge_clone_destroy(struct ifnet *);
 228
 229 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 230 static void     bridge_mutecaps(struct bridge_iflist *, int);
 231 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 232 static void     bridge_init(void *);
 233 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 234 static void     bridge_stop(struct ifnet *, int);
 235 static void     bridge_start(struct ifnet *);
 236 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 237 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 238                     struct rtentry *);
 239 static void     bridge_enqueue(struct bridge_softc *, struct ifnet *,
 240                     struct mbuf *);
 241 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 242
 243 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 244
 245 static void     bridge_timer(void *);
 246
 247 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 248                     struct mbuf *, int);
 249 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 250
 251 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 252                     struct ifnet *, int, uint8_t);
 253 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 254 static void     bridge_rttrim(struct bridge_softc *);
 255 static void     bridge_rtage(struct bridge_softc *);
 256 static void     bridge_rtflush(struct bridge_softc *, int);
 257 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 258
 259 static int      bridge_rtable_init(struct bridge_softc *);
 260 static void     bridge_rtable_fini(struct bridge_softc *);
 261
 262 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 263 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 264                     const uint8_t *);
 265 static int      bridge_rtnode_insert(struct bridge_softc *,
 266                     struct bridge_rtnode *);
 267 static void     bridge_rtnode_destroy(struct bridge_softc *,
 268                     struct bridge_rtnode *);
 269 static void     bridge_state_change(struct ifnet *, int);
 270
 271 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 272                     const char *name);
 273 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 274                     struct ifnet *ifp);
 275 static void     bridge_delete_member(struct bridge_softc *,
 276                     struct bridge_iflist *, int);
 277 static void     bridge_delete_span(struct bridge_softc *,
 278                     struct bridge_iflist *);
 279
 280 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 281 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 282 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 283 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 284 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 285 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 286 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 287 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 288 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 289 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 290 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 291 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 292 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 293 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 294 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 295 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 296 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 297 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 298 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 299 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 300 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 301 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 302 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 303 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 304 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 305 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 306 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 307 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 308 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 309                     int);
 310 static int      bridge_ip_checkbasic(struct mbuf **mp);
 311 #ifdef INET6
 312 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 313 #endif /* INET6 */
 314 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 315                     struct ether_header *, int, struct llc *);
 316
 317 SYSCTL_DECL(_net_link);
 318 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 319
 320 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 321 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 322 static int pfil_member = 1; /* run pfil hooks on the member interface */
 323 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
 324 static int log_stp   = 0;   /* log STP state changes */
 325 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 326     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 327 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 328     &pfil_bridge, 0, "Packet filter on the bridge interface");
 329 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 330     &pfil_member, 0, "Packet filter on the member interface");
 331 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
 332     &log_stp, 0, "Log STP state changes");
 333
 334 struct bridge_control {
 335         int     (*bc_func)(struct bridge_softc *, void *);
 336         int     bc_argsize;
 337         int     bc_flags;
 338 };
 339
 340 #define BC_F_COPYIN             0x01    /* copy arguments in */
 341 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 342 #define BC_F_SUSER              0x04    /* do super-user check */
 343
 344 const struct bridge_control bridge_control_table[] = {
 345         { bridge_ioctl_add,             sizeof(struct ifbreq),
 346           BC_F_COPYIN|BC_F_SUSER },
 347         { bridge_ioctl_del,             sizeof(struct ifbreq),
 348           BC_F_COPYIN|BC_F_SUSER },
 349
 350         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 351           BC_F_COPYIN|BC_F_COPYOUT },
 352         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 353           BC_F_COPYIN|BC_F_SUSER },
 354
 355         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 356           BC_F_COPYIN|BC_F_SUSER },
 357         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 358           BC_F_COPYOUT },
 359
 360         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 361           BC_F_COPYIN|BC_F_COPYOUT },
 362         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 363           BC_F_COPYIN|BC_F_COPYOUT },
 364
 365         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 366           BC_F_COPYIN|BC_F_SUSER },
 367
 368         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 369           BC_F_COPYIN|BC_F_SUSER },
 370         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 371           BC_F_COPYOUT },
 372
 373         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 374           BC_F_COPYIN|BC_F_SUSER },
 375
 376         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 377           BC_F_COPYIN|BC_F_SUSER },
 378
 379         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 380           BC_F_COPYOUT },
 381         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 382           BC_F_COPYIN|BC_F_SUSER },
 383
 384         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 385           BC_F_COPYOUT },
 386         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 387           BC_F_COPYIN|BC_F_SUSER },
 388
 389         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 390           BC_F_COPYOUT },
 391         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 392           BC_F_COPYIN|BC_F_SUSER },
 393
 394         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 395           BC_F_COPYOUT },
 396         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 397           BC_F_COPYIN|BC_F_SUSER },
 398
 399         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 400           BC_F_COPYIN|BC_F_SUSER },
 401
 402         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 403           BC_F_COPYIN|BC_F_SUSER },
 404
 405         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 406           BC_F_COPYIN|BC_F_SUSER },
 407         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 408           BC_F_COPYIN|BC_F_SUSER },
 409
 410         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 411           BC_F_COPYOUT },
 412
 413         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 414           BC_F_COPYOUT },
 415
 416         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 417           BC_F_COPYOUT },
 418 };
 419 const int bridge_control_table_size =
 420     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 421
 422 static const u_char etherbroadcastaddr[ETHER_ADDR_LEN] =
 423                         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 424
 425 LIST_HEAD(, bridge_softc) bridge_list;
 426
 427 IFC_SIMPLE_DECLARE(bridge, 0);
 428
 429 static int
 430 bridge_modevent(module_t mod, int type, void *data)
 431 {
 432
 433         switch (type) {
 434         case MOD_LOAD:
 435                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
 436                 if_clone_attach(&bridge_cloner);
 437                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 438                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 439                     UMA_ALIGN_PTR, 0);
 440                 LIST_INIT(&bridge_list);
 441                 bridge_input_p = bridge_input;
 442                 bridge_output_p = bridge_output;
 443                 bridge_dn_p = bridge_dummynet;
 444                 bstp_linkstate_p = bstp_linkstate;
 445                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 446                     ifnet_departure_event, bridge_ifdetach, NULL,
 447                     EVENTHANDLER_PRI_ANY);
 448                 break;
 449         case MOD_UNLOAD:
 450                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 451                     bridge_detach_cookie);
 452                 if_clone_detach(&bridge_cloner);
 453                 uma_zdestroy(bridge_rtnode_zone);
 454                 bridge_input_p = NULL;
 455                 bridge_output_p = NULL;
 456                 bridge_dn_p = NULL;
 457                 bstp_linkstate_p = NULL;
 458                 mtx_destroy(&bridge_list_mtx);
 459                 break;
 460         default:
 461                 return (EOPNOTSUPP);
 462         }
 463         return (0);
 464 }
 465
 466 static moduledata_t bridge_mod = {
 467         "if_bridge",
 468         bridge_modevent,
 469         0
 470 };
 471
 472 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 473 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 474
 475 /*
 476  * handler for net.link.bridge.pfil_ipfw
 477  */
 478 static int
 479 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 480 {
 481         int enable = pfil_ipfw;
 482         int error;
 483
 484         error = sysctl_handle_int(oidp, &enable, 0, req);
 485         enable = (enable) ? 1 : 0;
 486
 487         if (enable != pfil_ipfw) {
 488                 pfil_ipfw = enable;
 489
 490                 /*
 491                  * Disable pfil so that ipfw doesnt run twice, if the user
 492                  * really wants both then they can re-enable pfil_bridge and/or
 493                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 494                  * layer2 type.
 495                  */
 496                 if (pfil_ipfw) {
 497                         pfil_onlyip = 0;
 498                         pfil_bridge = 0;
 499                         pfil_member = 0;
 500                 }
 501         }
 502
 503         return (error);
 504 }
 505 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
 506             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
 507
 508 /*
 509  * bridge_clone_create:
 510  *
 511  *      Create a new bridge instance.
 512  */
 513 static int
 514 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 515 {
 516         struct bridge_softc *sc, *sc2;
 517         struct ifnet *bifp, *ifp;
 518         u_char eaddr[6];
 519         int retry;
 520
 521         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 522         BRIDGE_LOCK_INIT(sc);
 523         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 524         if (ifp == NULL) {
 525                 free(sc, M_DEVBUF);
 526                 return (ENOSPC);
 527         }
 528
 529         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 530         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 531         getmicrotime(&(sc->sc_stp.bs_last_tc_time));
 532
 533         /* Initialize our routing table. */
 534         bridge_rtable_init(sc);
 535
 536         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
 537
 538         LIST_INIT(&sc->sc_iflist);
 539         LIST_INIT(&sc->sc_spanlist);
 540
 541         ifp->if_softc = sc;
 542         if_initname(ifp, ifc->ifc_name, unit);
 543         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 544         ifp->if_ioctl = bridge_ioctl;
 545         ifp->if_start = bridge_start;
 546         ifp->if_init = bridge_init;
 547         ifp->if_type = IFT_BRIDGE;
 548         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 549         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 550         IFQ_SET_READY(&ifp->if_snd);
 551
 552         /*
 553          * Generate a random ethernet address with a locally administered
 554          * address.
 555          *
 556          * Since we are using random ethernet addresses for the bridge, it is
 557          * possible that we might have address collisions, so make sure that
 558          * this hardware address isn't already in use on another bridge.
 559          */
 560         for (retry = 1; retry != 0;) {
 561                 arc4rand(eaddr, ETHER_ADDR_LEN, 1);
 562                 eaddr[0] &= ~1;         /* clear multicast bit */
 563                 eaddr[0] |= 2;          /* set the LAA bit */
 564                 retry = 0;
 565                 mtx_lock(&bridge_list_mtx);
 566                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
 567                         bifp = sc2->sc_ifp;
 568                         if (memcmp(eaddr, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
 569                                 retry = 1;
 570                 }
 571                 mtx_unlock(&bridge_list_mtx);
 572         }
 573
 574         bstp_attach(&sc->sc_stp, bridge_state_change);
 575         ether_ifattach(ifp, eaddr);
 576         /* Now undo some of the damage... */
 577         ifp->if_baudrate = 0;
 578         ifp->if_type = IFT_BRIDGE;
 579
 580         mtx_lock(&bridge_list_mtx);
 581         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 582         mtx_unlock(&bridge_list_mtx);
 583
 584         return (0);
 585 }
 586
 587 /*
 588  * bridge_clone_destroy:
 589  *
 590  *      Destroy a bridge instance.
 591  */
 592 static void
 593 bridge_clone_destroy(struct ifnet *ifp)
 594 {
 595         struct bridge_softc *sc = ifp->if_softc;
 596         struct bridge_iflist *bif;
 597
 598         BRIDGE_LOCK(sc);
 599
 600         bridge_stop(ifp, 1);
 601         ifp->if_flags &= ~IFF_UP;
 602
 603         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 604                 bridge_delete_member(sc, bif, 0);
 605
 606         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 607                 bridge_delete_span(sc, bif);
 608         }
 609
 610         BRIDGE_UNLOCK(sc);
 611
 612         callout_drain(&sc->sc_brcallout);
 613
 614         mtx_lock(&bridge_list_mtx);
 615         LIST_REMOVE(sc, sc_list);
 616         mtx_unlock(&bridge_list_mtx);
 617
 618         bstp_detach(&sc->sc_stp);
 619         ether_ifdetach(ifp);
 620         if_free_type(ifp, IFT_ETHER);
 621
 622         /* Tear down the routing table. */
 623         bridge_rtable_fini(sc);
 624
 625         BRIDGE_LOCK_DESTROY(sc);
 626         free(sc, M_DEVBUF);
 627 }
 628
 629 /*
 630  * bridge_ioctl:
 631  *
 632  *      Handle a control request from the operator.
 633  */
 634 static int
 635 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 636 {
 637         struct bridge_softc *sc = ifp->if_softc;
 638         struct thread *td = curthread;
 639         union {
 640                 struct ifbreq ifbreq;
 641                 struct ifbifconf ifbifconf;
 642                 struct ifbareq ifbareq;
 643                 struct ifbaconf ifbaconf;
 644                 struct ifbrparam ifbrparam;
 645         } args;
 646         struct ifdrv *ifd = (struct ifdrv *) data;
 647         const struct bridge_control *bc;
 648         int error = 0;
 649
 650         BRIDGE_LOCK(sc);
 651
 652         switch (cmd) {
 653
 654         case SIOCADDMULTI:
 655         case SIOCDELMULTI:
 656                 break;
 657
 658         case SIOCGDRVSPEC:
 659         case SIOCSDRVSPEC:
 660                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 661                         error = EINVAL;
 662                         break;
 663                 }
 664                 bc = &bridge_control_table[ifd->ifd_cmd];
 665
 666                 if (cmd == SIOCGDRVSPEC &&
 667                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 668                         error = EINVAL;
 669                         break;
 670                 }
 671                 else if (cmd == SIOCSDRVSPEC &&
 672                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 673                         error = EINVAL;
 674                         break;
 675                 }
 676
 677                 if (bc->bc_flags & BC_F_SUSER) {
 678                         error = suser(td);
 679                         if (error)
 680                                 break;
 681                 }
 682
 683                 if (ifd->ifd_len != bc->bc_argsize ||
 684                     ifd->ifd_len > sizeof(args)) {
 685                         error = EINVAL;
 686                         break;
 687                 }
 688
 689                 bzero(&args, sizeof(args));
 690                 if (bc->bc_flags & BC_F_COPYIN) {
 691                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 692                         if (error)
 693                                 break;
 694                 }
 695
 696                 error = (*bc->bc_func)(sc, &args);
 697                 if (error)
 698                         break;
 699
 700                 if (bc->bc_flags & BC_F_COPYOUT)
 701                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 702
 703                 break;
 704
 705         case SIOCSIFFLAGS:
 706                 if (!(ifp->if_flags & IFF_UP) &&
 707                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 708                         /*
 709                          * If interface is marked down and it is running,
 710                          * then stop and disable it.
 711                          */
 712                         bridge_stop(ifp, 1);
 713                 } else if ((ifp->if_flags & IFF_UP) &&
 714                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 715                         /*
 716                          * If interface is marked up and it is stopped, then
 717                          * start it.
 718                          */
 719                         BRIDGE_UNLOCK(sc);
 720                         (*ifp->if_init)(sc);
 721                 }
 722                 break;
 723
 724         case SIOCSIFMTU:
 725                 /* Do not allow the MTU to be changed on the bridge */
 726                 error = EINVAL;
 727                 break;
 728
 729         default:
 730                 /*
 731                  * drop the lock as ether_ioctl() will call bridge_start() and
 732                  * cause the lock to be recursed.
 733                  */
 734                 BRIDGE_UNLOCK(sc);
 735                 error = ether_ioctl(ifp, cmd, data);
 736                 break;
 737         }
 738
 739         if (BRIDGE_LOCKED(sc))
 740                 BRIDGE_UNLOCK(sc);
 741
 742         return (error);
 743 }
 744
 745 /*
 746  * bridge_mutecaps:
 747  *
 748  *      Clear or restore unwanted capabilities on the member interface
 749  */
 750 static void
 751 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 752 {
 753         struct ifnet *ifp = bif->bif_ifp;
 754         struct ifreq ifr;
 755         int error;
 756
 757         if (ifp->if_ioctl == NULL)
 758                 return;
 759
 760         bzero(&ifr, sizeof(ifr));
 761         ifr.ifr_reqcap = ifp->if_capenable;
 762
 763         if (mute) {
 764                 /* mask off and save capabilities */
 765                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 766                 if (bif->bif_mutecap != 0)
 767                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 768         } else
 769                 /* restore muted capabilities */
 770                 ifr.ifr_reqcap |= bif->bif_mutecap;
 771
 772
 773         if (bif->bif_mutecap != 0) {
 774                 IFF_LOCKGIANT(ifp);
 775                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
 776                 IFF_UNLOCKGIANT(ifp);
 777         }
 778 }
 779
 780 /*
 781  * bridge_lookup_member:
 782  *
 783  *      Lookup a bridge member interface.
 784  */
 785 static struct bridge_iflist *
 786 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 787 {
 788         struct bridge_iflist *bif;
 789         struct ifnet *ifp;
 790
 791         BRIDGE_LOCK_ASSERT(sc);
 792
 793         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 794                 ifp = bif->bif_ifp;
 795                 if (strcmp(ifp->if_xname, name) == 0)
 796                         return (bif);
 797         }
 798
 799         return (NULL);
 800 }
 801
 802 /*
 803  * bridge_lookup_member_if:
 804  *
 805  *      Lookup a bridge member interface by ifnet*.
 806  */
 807 static struct bridge_iflist *
 808 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 809 {
 810         struct bridge_iflist *bif;
 811
 812         BRIDGE_LOCK_ASSERT(sc);
 813
 814         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 815                 if (bif->bif_ifp == member_ifp)
 816                         return (bif);
 817         }
 818
 819         return (NULL);
 820 }
 821
 822 /*
 823  * bridge_delete_member:
 824  *
 825  *      Delete the specified member interface.
 826  */
 827 static void
 828 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 829     int gone)
 830 {
 831         struct ifnet *ifs = bif->bif_ifp;
 832
 833         BRIDGE_LOCK_ASSERT(sc);
 834
 835         if (!gone) {
 836                 switch (ifs->if_type) {
 837                 case IFT_ETHER:
 838                 case IFT_L2VLAN:
 839                         /*
 840                          * Take the interface out of promiscuous mode.
 841                          */
 842                         (void) ifpromisc(ifs, 0);
 843                         bridge_mutecaps(bif, 0);
 844                         break;
 845
 846                 case IFT_GIF:
 847                         break;
 848
 849                 default:
 850 #ifdef DIAGNOSTIC
 851                         panic("bridge_delete_member: impossible");
 852 #endif
 853                         break;
 854                 }
 855         }
 856
 857         if (bif->bif_flags & IFBIF_STP)
 858                 bstp_delete(&bif->bif_stp);
 859
 860         ifs->if_bridge = NULL;
 861         BRIDGE_XLOCK(sc);
 862         LIST_REMOVE(bif, bif_next);
 863         BRIDGE_XDROP(sc);
 864
 865         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 866
 867         BRIDGE_UNLOCK(sc);
 868         bstp_drain(&bif->bif_stp);      /* prepare to free */
 869         BRIDGE_LOCK(sc);
 870         free(bif, M_DEVBUF);
 871 }
 872
 873 /*
 874  * bridge_delete_span:
 875  *
 876  *      Delete the specified span interface.
 877  */
 878 static void
 879 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 880 {
 881         BRIDGE_LOCK_ASSERT(sc);
 882
 883         KASSERT(bif->bif_ifp->if_bridge == NULL,
 884             ("%s: not a span interface", __func__));
 885
 886         LIST_REMOVE(bif, bif_next);
 887         free(bif, M_DEVBUF);
 888 }
 889
 890 static int
 891 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 892 {
 893         struct ifbreq *req = arg;
 894         struct bridge_iflist *bif = NULL;
 895         struct ifnet *ifs;
 896         int error = 0;
 897
 898         ifs = ifunit(req->ifbr_ifsname);
 899         if (ifs == NULL)
 900                 return (ENOENT);
 901
 902         /* If it's in the span list, it can't be a member. */
 903         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 904                 if (ifs == bif->bif_ifp)
 905                         return (EBUSY);
 906
 907         /* Allow the first Ethernet member to define the MTU */
 908         if (ifs->if_type != IFT_GIF) {
 909                 if (LIST_EMPTY(&sc->sc_iflist))
 910                         sc->sc_ifp->if_mtu = ifs->if_mtu;
 911                 else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 912                         if_printf(sc->sc_ifp, "invalid MTU for %s\n",
 913                             ifs->if_xname);
 914                         return (EINVAL);
 915                 }
 916         }
 917
 918         if (ifs->if_bridge == sc)
 919                 return (EEXIST);
 920
 921         if (ifs->if_bridge != NULL)
 922                 return (EBUSY);
 923
 924         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 925         if (bif == NULL)
 926                 return (ENOMEM);
 927
 928         bif->bif_ifp = ifs;
 929         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 930
 931         switch (ifs->if_type) {
 932         case IFT_ETHER:
 933         case IFT_L2VLAN:
 934                 /*
 935                  * Place the interface into promiscuous mode.
 936                  */
 937                 error = ifpromisc(ifs, 1);
 938                 if (error)
 939                         goto out;
 940
 941                 bridge_mutecaps(bif, 1);
 942                 break;
 943
 944         case IFT_GIF:
 945                 break;
 946
 947         default:
 948                 error = EINVAL;
 949                 goto out;
 950         }
 951
 952         ifs->if_bridge = sc;
 953         /*
 954          * XXX: XLOCK HERE!?!
 955          *
 956          * NOTE: insert_***HEAD*** should be safe for the traversals.
 957          */
 958         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 959
 960 out:
 961         if (error) {
 962                 if (bif != NULL)
 963                         free(bif, M_DEVBUF);
 964         }
 965         return (error);
 966 }
 967
 968 static int
 969 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 970 {
 971         struct ifbreq *req = arg;
 972         struct bridge_iflist *bif;
 973
 974         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 975         if (bif == NULL)
 976                 return (ENOENT);
 977
 978         bridge_delete_member(sc, bif, 0);
 979
 980         return (0);
 981 }
 982
 983 static int
 984 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 985 {
 986         struct ifbreq *req = arg;
 987         struct bridge_iflist *bif;
 988
 989         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 990         if (bif == NULL)
 991                 return (ENOENT);
 992
 993         req->ifbr_ifsflags = bif->bif_flags;
 994         req->ifbr_state = bif->bif_stp.bp_state;
 995         req->ifbr_priority = bif->bif_stp.bp_priority;
 996         req->ifbr_path_cost = bif->bif_stp.bp_path_cost;
 997         req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
 998
 999         return (0);
1000 }
1001
1002 static int
1003 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1004 {
1005         struct ifbreq *req = arg;
1006         struct bridge_iflist *bif;
1007         int error;
1008
1009         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1010         if (bif == NULL)
1011                 return (ENOENT);
1012
1013         if (req->ifbr_ifsflags & IFBIF_SPAN)
1014                 /* SPAN is readonly */
1015                 return (EINVAL);
1016
1017         if (req->ifbr_ifsflags & IFBIF_STP) {
1018                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1019                         error = bstp_add(&sc->sc_stp, &bif->bif_stp,
1020                                     bif->bif_ifp);
1021                         if (error)
1022                                 return (error);
1023                 }
1024         } else {
1025                 if ((bif->bif_flags & IFBIF_STP) != 0)
1026                         bstp_delete(&bif->bif_stp);
1027         }
1028
1029         bif->bif_flags = req->ifbr_ifsflags;
1030
1031         return (0);
1032 }
1033
1034 static int
1035 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1036 {
1037         struct ifbrparam *param = arg;
1038
1039         sc->sc_brtmax = param->ifbrp_csize;
1040         bridge_rttrim(sc);
1041
1042         return (0);
1043 }
1044
1045 static int
1046 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1047 {
1048         struct ifbrparam *param = arg;
1049
1050         param->ifbrp_csize = sc->sc_brtmax;
1051
1052         return (0);
1053 }
1054
1055 static int
1056 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1057 {
1058         struct ifbifconf *bifc = arg;
1059         struct bridge_iflist *bif;
1060         struct ifbreq breq;
1061         int count, len, error = 0;
1062
1063         count = 0;
1064         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1065                 count++;
1066         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1067                 count++;
1068
1069         if (bifc->ifbic_len == 0) {
1070                 bifc->ifbic_len = sizeof(breq) * count;
1071                 return (0);
1072         }
1073
1074         count = 0;
1075         len = bifc->ifbic_len;
1076         bzero(&breq, sizeof(breq));
1077         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1078                 if (len < sizeof(breq))
1079                         break;
1080
1081                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1082                     sizeof(breq.ifbr_ifsname));
1083                 breq.ifbr_ifsflags = bif->bif_flags;
1084                 breq.ifbr_state = bif->bif_stp.bp_state;
1085                 breq.ifbr_priority = bif->bif_stp.bp_priority;
1086                 breq.ifbr_path_cost = bif->bif_stp.bp_path_cost;
1087                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1088                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1089                 if (error)
1090                         break;
1091                 count++;
1092                 len -= sizeof(breq);
1093         }
1094         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1095                 if (len < sizeof(breq))
1096                         break;
1097
1098                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1099                     sizeof(breq.ifbr_ifsname));
1100                 breq.ifbr_ifsflags = bif->bif_flags;
1101                 breq.ifbr_state = bif->bif_stp.bp_state;
1102                 breq.ifbr_priority = bif->bif_stp.bp_priority;
1103                 breq.ifbr_path_cost = bif->bif_stp.bp_path_cost;
1104                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1105                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1106                 if (error)
1107                         break;
1108                 count++;
1109                 len -= sizeof(breq);
1110         }
1111
1112         bifc->ifbic_len = sizeof(breq) * count;
1113         return (error);
1114 }
1115
1116 static int
1117 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1118 {
1119         struct ifbaconf *bac = arg;
1120         struct bridge_rtnode *brt;
1121         struct ifbareq bareq;
1122         int count = 0, error = 0, len;
1123
1124         if (bac->ifbac_len == 0)
1125                 return (0);
1126
1127         len = bac->ifbac_len;
1128         bzero(&bareq, sizeof(bareq));
1129         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1130                 if (len < sizeof(bareq))
1131                         goto out;
1132                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1133                     sizeof(bareq.ifba_ifsname));
1134                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1135                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1136                                 time_uptime < brt->brt_expire)
1137                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1138                 else
1139                         bareq.ifba_expire = 0;
1140                 bareq.ifba_flags = brt->brt_flags;
1141
1142                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1143                 if (error)
1144                         goto out;
1145                 count++;
1146                 len -= sizeof(bareq);
1147         }
1148 out:
1149         bac->ifbac_len = sizeof(bareq) * count;
1150         return (error);
1151 }
1152
1153 static int
1154 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1155 {
1156         struct ifbareq *req = arg;
1157         struct bridge_iflist *bif;
1158         int error;
1159
1160         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1161         if (bif == NULL)
1162                 return (ENOENT);
1163
1164         error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1165             req->ifba_flags);
1166
1167         return (error);
1168 }
1169
1170 static int
1171 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1172 {
1173         struct ifbrparam *param = arg;
1174
1175         sc->sc_brttimeout = param->ifbrp_ctime;
1176         return (0);
1177 }
1178
1179 static int
1180 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1181 {
1182         struct ifbrparam *param = arg;
1183
1184         param->ifbrp_ctime = sc->sc_brttimeout;
1185         return (0);
1186 }
1187
1188 static int
1189 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1190 {
1191         struct ifbareq *req = arg;
1192
1193         return (bridge_rtdaddr(sc, req->ifba_dst));
1194 }
1195
1196 static int
1197 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1198 {
1199         struct ifbreq *req = arg;
1200
1201         bridge_rtflush(sc, req->ifbr_ifsflags);
1202         return (0);
1203 }
1204
1205 static int
1206 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1207 {
1208         struct ifbrparam *param = arg;
1209         struct bstp_state *bs = &sc->sc_stp;
1210
1211         param->ifbrp_prio = bs->bs_bridge_priority;
1212         return (0);
1213 }
1214
1215 static int
1216 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1217 {
1218         struct ifbrparam *param = arg;
1219         struct bstp_state *bs = &sc->sc_stp;
1220
1221         bs->bs_bridge_priority = param->ifbrp_prio;
1222         bstp_reinit(bs);
1223
1224         return (0);
1225 }
1226
1227 static int
1228 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1229 {
1230         struct ifbrparam *param = arg;
1231         struct bstp_state *bs = &sc->sc_stp;
1232
1233         param->ifbrp_hellotime = bs->bs_bridge_hello_time >> 8;
1234         return (0);
1235 }
1236
1237 static int
1238 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1239 {
1240         struct ifbrparam *param = arg;
1241         struct bstp_state *bs = &sc->sc_stp;
1242
1243         if (param->ifbrp_hellotime == 0)
1244                 return (EINVAL);
1245         bs->bs_bridge_hello_time = param->ifbrp_hellotime << 8;
1246         bstp_reinit(bs);
1247
1248         return (0);
1249 }
1250
1251 static int
1252 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1253 {
1254         struct ifbrparam *param = arg;
1255         struct bstp_state *bs = &sc->sc_stp;
1256
1257         param->ifbrp_fwddelay = bs->bs_bridge_forward_delay >> 8;
1258         return (0);
1259 }
1260
1261 static int
1262 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1263 {
1264         struct ifbrparam *param = arg;
1265         struct bstp_state *bs = &sc->sc_stp;
1266
1267         if (param->ifbrp_fwddelay == 0)
1268                 return (EINVAL);
1269         bs->bs_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1270         bstp_reinit(bs);
1271
1272         return (0);
1273 }
1274
1275 static int
1276 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1277 {
1278         struct ifbrparam *param = arg;
1279         struct bstp_state *bs = &sc->sc_stp;
1280
1281         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1282         return (0);
1283 }
1284
1285 static int
1286 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1287 {
1288         struct ifbrparam *param = arg;
1289         struct bstp_state *bs = &sc->sc_stp;
1290
1291         if (param->ifbrp_maxage == 0)
1292                 return (EINVAL);
1293         bs->bs_bridge_max_age = param->ifbrp_maxage << 8;
1294         bstp_reinit(bs);
1295
1296         return (0);
1297 }
1298
1299 static int
1300 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1301 {
1302         struct ifbreq *req = arg;
1303         struct bridge_iflist *bif;
1304
1305         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1306         if (bif == NULL)
1307                 return (ENOENT);
1308
1309         bif->bif_stp.bp_priority = req->ifbr_priority;
1310         bstp_reinit(&sc->sc_stp);
1311
1312         return (0);
1313 }
1314
1315 static int
1316 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1317 {
1318         struct ifbreq *req = arg;
1319         struct bridge_iflist *bif;
1320
1321         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1322         if (bif == NULL)
1323                 return (ENOENT);
1324
1325         bif->bif_stp.bp_path_cost = req->ifbr_path_cost;
1326         bstp_reinit(&sc->sc_stp);
1327
1328         return (0);
1329 }
1330
1331 static int
1332 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1333 {
1334         struct ifbreq *req = arg;
1335         struct bridge_iflist *bif = NULL;
1336         struct ifnet *ifs;
1337
1338         ifs = ifunit(req->ifbr_ifsname);
1339         if (ifs == NULL)
1340                 return (ENOENT);
1341
1342         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1343                 if (ifs == bif->bif_ifp)
1344                         return (EBUSY);
1345
1346         if (ifs->if_bridge != NULL)
1347                 return (EBUSY);
1348
1349         switch (ifs->if_type) {
1350                 case IFT_ETHER:
1351                 case IFT_GIF:
1352                 case IFT_L2VLAN:
1353                         break;
1354                 default:
1355                         return (EINVAL);
1356         }
1357
1358         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1359         if (bif == NULL)
1360                 return (ENOMEM);
1361
1362         bif->bif_ifp = ifs;
1363         bif->bif_flags = IFBIF_SPAN;
1364
1365         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1366
1367         return (0);
1368 }
1369
1370 static int
1371 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1372 {
1373         struct ifbreq *req = arg;
1374         struct bridge_iflist *bif;
1375         struct ifnet *ifs;
1376
1377         ifs = ifunit(req->ifbr_ifsname);
1378         if (ifs == NULL)
1379                 return (ENOENT);
1380
1381         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1382                 if (ifs == bif->bif_ifp)
1383                         break;
1384
1385         if (bif == NULL)
1386                 return (ENOENT);
1387
1388         bridge_delete_span(sc, bif);
1389
1390         return (0);
1391 }
1392
1393 static int
1394 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1395 {
1396         struct ifbropreq *req = arg;
1397         struct bstp_port *root_port;
1398
1399         req->ifbop_maxage = sc->sc_stp.bs_max_age;
1400         req->ifbop_hellotime = sc->sc_stp.bs_hello_time;
1401         req->ifbop_fwddelay = sc->sc_stp.bs_forward_delay;
1402
1403         root_port = sc->sc_stp.bs_root_port;
1404         if (root_port == NULL)
1405                 req->ifbop_root_port = 0;
1406         else
1407                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1408
1409         req->ifbop_root_path_cost = sc->sc_stp.bs_root_path_cost;
1410         req->ifbop_designated_root = sc->sc_stp.bs_designated_root;
1411         req->ifbop_last_tc_time.tv_sec = sc->sc_stp.bs_last_tc_time.tv_sec;
1412         req->ifbop_last_tc_time.tv_usec = sc->sc_stp.bs_last_tc_time.tv_usec;
1413
1414         return (0);
1415 }
1416
1417 static int
1418 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1419 {
1420         struct ifbrparam *param = arg;
1421
1422         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1423         return (0);
1424 }
1425
1426 static int
1427 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1428 {
1429         struct ifbpstpconf *bifstp = arg;
1430         struct bridge_iflist *bif;
1431         struct ifbpstpreq bpreq;
1432         int count, len, error = 0;
1433
1434         count = 0;
1435         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1436                 if ((bif->bif_flags & IFBIF_STP) != 0)
1437                         count++;
1438         }
1439
1440         if (bifstp->ifbpstp_len == 0) {
1441                 bifstp->ifbpstp_len = sizeof(bpreq) * count;
1442                 return (0);
1443         }
1444
1445         count = 0;
1446         len = bifstp->ifbpstp_len;
1447         bzero(&bpreq, sizeof(bpreq));
1448         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1449                 if (len < sizeof(bpreq))
1450                         break;
1451
1452                 if ((bif->bif_flags & IFBIF_STP) == 0)
1453                         continue;
1454
1455                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xff;
1456                 bpreq.ifbp_fwd_trans = bif->bif_stp.bp_forward_transitions;
1457                 bpreq.ifbp_design_cost = bif->bif_stp.bp_designated_cost;
1458                 bpreq.ifbp_design_port = bif->bif_stp.bp_designated_port;
1459                 bpreq.ifbp_design_bridge = bif->bif_stp.bp_designated_bridge;
1460                 bpreq.ifbp_design_root = bif->bif_stp.bp_designated_root;
1461
1462                 error = copyout(&bpreq, bifstp->ifbpstp_req + count,
1463                                 sizeof(bpreq));
1464                 if (error != 0)
1465                         break;
1466
1467                 count++;
1468                 len -= sizeof(bpreq);
1469         }
1470
1471         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1472         return (error);
1473 }
1474
1475 /*
1476  * bridge_ifdetach:
1477  *
1478  *      Detach an interface from a bridge.  Called when a member
1479  *      interface is detaching.
1480  */
1481 static void
1482 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1483 {
1484         struct bridge_softc *sc = ifp->if_bridge;
1485         struct bridge_iflist *bif;
1486
1487         /* Check if the interface is a bridge member */
1488         if (sc != NULL) {
1489                 BRIDGE_LOCK(sc);
1490
1491                 bif = bridge_lookup_member_if(sc, ifp);
1492                 if (bif != NULL)
1493                         bridge_delete_member(sc, bif, 1);
1494
1495                 BRIDGE_UNLOCK(sc);
1496                 return;
1497         }
1498
1499         /* Check if the interface is a span port */
1500         mtx_lock(&bridge_list_mtx);
1501         LIST_FOREACH(sc, &bridge_list, sc_list) {
1502                 BRIDGE_LOCK(sc);
1503                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1504                         if (ifp == bif->bif_ifp) {
1505                                 bridge_delete_span(sc, bif);
1506                                 break;
1507                         }
1508
1509                 BRIDGE_UNLOCK(sc);
1510         }
1511         mtx_unlock(&bridge_list_mtx);
1512 }
1513
1514 /*
1515  * bridge_init:
1516  *
1517  *      Initialize a bridge interface.
1518  */
1519 static void
1520 bridge_init(void *xsc)
1521 {
1522         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1523         struct ifnet *ifp = sc->sc_ifp;
1524
1525         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1526                 return;
1527
1528         BRIDGE_LOCK(sc);
1529         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1530             bridge_timer, sc);
1531
1532         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1533         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1534
1535         BRIDGE_UNLOCK(sc);
1536 }
1537
1538 /*
1539  * bridge_stop:
1540  *
1541  *      Stop the bridge interface.
1542  */
1543 static void
1544 bridge_stop(struct ifnet *ifp, int disable)
1545 {
1546         struct bridge_softc *sc = ifp->if_softc;
1547
1548         BRIDGE_LOCK_ASSERT(sc);
1549
1550         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1551                 return;
1552
1553         callout_stop(&sc->sc_brcallout);
1554         bstp_stop(&sc->sc_stp);
1555
1556         bridge_rtflush(sc, IFBF_FLUSHDYN);
1557
1558         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1559 }
1560
1561 /*
1562  * bridge_enqueue:
1563  *
1564  *      Enqueue a packet on a bridge member interface.
1565  *
1566  */
1567 static void
1568 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1569 {
1570         int len, err = 0;
1571         short mflags;
1572         struct mbuf *m0;
1573
1574         len = m->m_pkthdr.len;
1575         mflags = m->m_flags;
1576
1577         /* We may be sending a fragment so traverse the mbuf */
1578         for (; m; m = m0) {
1579                 m0 = m->m_nextpkt;
1580                 m->m_nextpkt = NULL;
1581
1582                 if (err == 0)
1583                         IFQ_ENQUEUE(&dst_ifp->if_snd, m, err);
1584         }
1585
1586         if (err == 0) {
1587
1588                 sc->sc_ifp->if_opackets++;
1589                 sc->sc_ifp->if_obytes += len;
1590
1591                 dst_ifp->if_obytes += len;
1592
1593                 if (mflags & M_MCAST) {
1594                         sc->sc_ifp->if_omcasts++;
1595                         dst_ifp->if_omcasts++;
1596                 }
1597         }
1598
1599         if ((dst_ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1600                 (*dst_ifp->if_start)(dst_ifp);
1601 }
1602
1603 /*
1604  * bridge_dummynet:
1605  *
1606  *      Receive a queued packet from dummynet and pass it on to the output
1607  *      interface.
1608  *
1609  *      The mbuf has the Ethernet header already attached.
1610  */
1611 static void
1612 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1613 {
1614         struct bridge_softc *sc;
1615
1616         sc = ifp->if_bridge;
1617
1618         /*
1619          * The packet didnt originate from a member interface. This should only
1620          * ever happen if a member interface is removed while packets are
1621          * queued for it.
1622          */
1623         if (sc == NULL) {
1624                 m_freem(m);
1625                 return;
1626         }
1627
1628         if (PFIL_HOOKED(&inet_pfil_hook)
1629 #ifdef INET6
1630             || PFIL_HOOKED(&inet6_pfil_hook)
1631 #endif
1632             ) {
1633                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1634                         return;
1635                 if (m == NULL)
1636                         return;
1637         }
1638
1639         bridge_enqueue(sc, ifp, m);
1640 }
1641
1642 /*
1643  * bridge_output:
1644  *
1645  *      Send output from a bridge member interface.  This
1646  *      performs the bridging function for locally originated
1647  *      packets.
1648  *
1649  *      The mbuf has the Ethernet header already attached.  We must
1650  *      enqueue or free the mbuf before returning.
1651  */
1652 static int
1653 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1654     struct rtentry *rt)
1655 {
1656         struct ether_header *eh;
1657         struct ifnet *dst_if;
1658         struct bridge_softc *sc;
1659
1660         if (m->m_len < ETHER_HDR_LEN) {
1661                 m = m_pullup(m, ETHER_HDR_LEN);
1662                 if (m == NULL)
1663                         return (0);
1664         }
1665
1666         eh = mtod(m, struct ether_header *);
1667         sc = ifp->if_bridge;
1668
1669         BRIDGE_LOCK(sc);
1670
1671         /*
1672          * If bridge is down, but the original output interface is up,
1673          * go ahead and send out that interface.  Otherwise, the packet
1674          * is dropped below.
1675          */
1676         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1677                 dst_if = ifp;
1678                 goto sendunicast;
1679         }
1680
1681         /*
1682          * If the packet is a multicast, or we don't know a better way to
1683          * get there, send to all interfaces.
1684          */
1685         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1686                 dst_if = NULL;
1687         else
1688                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1689         if (dst_if == NULL) {
1690                 struct bridge_iflist *bif;
1691                 struct mbuf *mc;
1692                 int error = 0, used = 0;
1693
1694                 bridge_span(sc, m);
1695
1696                 BRIDGE_LOCK2REF(sc, error);
1697                 if (error) {
1698                         m_freem(m);
1699                         return (0);
1700                 }
1701
1702                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1703                         dst_if = bif->bif_ifp;
1704
1705                         if (dst_if->if_type == IFT_GIF)
1706                                 continue;
1707                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1708                                 continue;
1709
1710                         /*
1711                          * If this is not the original output interface,
1712                          * and the interface is participating in spanning
1713                          * tree, make sure the port is in a state that
1714                          * allows forwarding.
1715                          */
1716                         if (dst_if != ifp &&
1717                             (bif->bif_flags & IFBIF_STP) != 0) {
1718                                 switch (bif->bif_stp.bp_state) {
1719                                 case BSTP_IFSTATE_BLOCKING:
1720                                 case BSTP_IFSTATE_LISTENING:
1721                                 case BSTP_IFSTATE_DISABLED:
1722                                         continue;
1723                                 }
1724                         }
1725
1726                         if (LIST_NEXT(bif, bif_next) == NULL) {
1727                                 used = 1;
1728                                 mc = m;
1729                         } else {
1730                                 mc = m_copypacket(m, M_DONTWAIT);
1731                                 if (mc == NULL) {
1732                                         sc->sc_ifp->if_oerrors++;
1733                                         continue;
1734                                 }
1735                         }
1736
1737                         bridge_enqueue(sc, dst_if, mc);
1738                 }
1739                 if (used == 0)
1740                         m_freem(m);
1741                 BRIDGE_UNREF(sc);
1742                 return (0);
1743         }
1744
1745 sendunicast:
1746         /*
1747          * XXX Spanning tree consideration here?
1748          */
1749
1750         bridge_span(sc, m);
1751         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1752                 m_freem(m);
1753                 BRIDGE_UNLOCK(sc);
1754                 return (0);
1755         }
1756
1757         BRIDGE_UNLOCK(sc);
1758         bridge_enqueue(sc, dst_if, m);
1759         return (0);
1760 }
1761
1762 /*
1763  * bridge_start:
1764  *
1765  *      Start output on a bridge.
1766  *
1767  */
1768 static void
1769 bridge_start(struct ifnet *ifp)
1770 {
1771         struct bridge_softc *sc;
1772         struct mbuf *m;
1773         struct ether_header *eh;
1774         struct ifnet *dst_if;
1775
1776         sc = ifp->if_softc;
1777
1778         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1779         for (;;) {
1780                 IFQ_DEQUEUE(&ifp->if_snd, m);
1781                 if (m == 0)
1782                         break;
1783                 BPF_MTAP(ifp, m);
1784
1785                 eh = mtod(m, struct ether_header *);
1786                 dst_if = NULL;
1787
1788                 BRIDGE_LOCK(sc);
1789                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1790                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1791                 }
1792
1793                 if (dst_if == NULL)
1794                         bridge_broadcast(sc, ifp, m, 0);
1795                 else {
1796                         BRIDGE_UNLOCK(sc);
1797                         bridge_enqueue(sc, dst_if, m);
1798                 }
1799         }
1800         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1801 }
1802
1803 /*
1804  * bridge_forward:
1805  *
1806  *      The forwarding function of the bridge.
1807  *
1808  *      NOTE: Releases the lock on return.
1809  */
1810 static void
1811 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1812 {
1813         struct bridge_iflist *bif;
1814         struct ifnet *src_if, *dst_if, *ifp;
1815         struct ether_header *eh;
1816
1817         src_if = m->m_pkthdr.rcvif;
1818         ifp = sc->sc_ifp;
1819
1820         sc->sc_ifp->if_ipackets++;
1821         sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
1822
1823         /*
1824          * Look up the bridge_iflist.
1825          */
1826         bif = bridge_lookup_member_if(sc, src_if);
1827         if (bif == NULL) {
1828                 /* Interface is not a bridge member (anymore?) */
1829                 BRIDGE_UNLOCK(sc);
1830                 m_freem(m);
1831                 return;
1832         }
1833
1834         if (bif->bif_flags & IFBIF_STP) {
1835                 switch (bif->bif_stp.bp_state) {
1836                 case BSTP_IFSTATE_BLOCKING:
1837                 case BSTP_IFSTATE_LISTENING:
1838                 case BSTP_IFSTATE_DISABLED:
1839                         BRIDGE_UNLOCK(sc);
1840                         m_freem(m);
1841                         return;
1842                 }
1843         }
1844
1845         eh = mtod(m, struct ether_header *);
1846
1847         /*
1848          * If the interface is learning, and the source
1849          * address is valid and not multicast, record
1850          * the address.
1851          */
1852         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1853             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1854             (eh->ether_shost[0] == 0 &&
1855              eh->ether_shost[1] == 0 &&
1856              eh->ether_shost[2] == 0 &&
1857              eh->ether_shost[3] == 0 &&
1858              eh->ether_shost[4] == 0 &&
1859              eh->ether_shost[5] == 0) == 0) {
1860                 (void) bridge_rtupdate(sc, eh->ether_shost,
1861                     src_if, 0, IFBAF_DYNAMIC);
1862         }
1863
1864         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1865             bif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
1866                 m_freem(m);
1867                 BRIDGE_UNLOCK(sc);
1868                 return;
1869         }
1870
1871         /*
1872          * At this point, the port either doesn't participate
1873          * in spanning tree or it is in the forwarding state.
1874          */
1875
1876         /*
1877          * If the packet is unicast, destined for someone on
1878          * "this" side of the bridge, drop it.
1879          */
1880         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1881                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1882                 if (src_if == dst_if) {
1883                         BRIDGE_UNLOCK(sc);
1884                         m_freem(m);
1885                         return;
1886                 }
1887         } else {
1888                 /* ...forward it to all interfaces. */
1889                 sc->sc_ifp->if_imcasts++;
1890                 dst_if = NULL;
1891         }
1892
1893         /*
1894          * If we have a destination interface which is a member of our bridge,
1895          * OR this is a unicast packet, push it through the bpf(4) machinery.
1896          * For broadcast or multicast packets, don't bother because it will
1897          * be reinjected into ether_input. We do this before we pass the packets
1898          * through the pfil(9) framework, as it is possible that pfil(9) will
1899          * drop the packet, or possibly modify it, making it difficult to debug
1900          * firewall issues on the bridge.
1901          */
1902         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1903                 BPF_MTAP(ifp, m);
1904
1905         /* run the packet filter */
1906         if (PFIL_HOOKED(&inet_pfil_hook)
1907 #ifdef INET6
1908             || PFIL_HOOKED(&inet6_pfil_hook)
1909 #endif
1910             ) {
1911                 BRIDGE_UNLOCK(sc);
1912                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1913                         return;
1914                 if (m == NULL)
1915                         return;
1916                 BRIDGE_LOCK(sc);
1917         }
1918
1919         if (dst_if == NULL) {
1920                 bridge_broadcast(sc, src_if, m, 1);
1921                 return;
1922         }
1923
1924         /*
1925          * At this point, we're dealing with a unicast frame
1926          * going to a different interface.
1927          */
1928         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1929                 BRIDGE_UNLOCK(sc);
1930                 m_freem(m);
1931                 return;
1932         }
1933         bif = bridge_lookup_member_if(sc, dst_if);
1934         if (bif == NULL) {
1935                 /* Not a member of the bridge (anymore?) */
1936                 BRIDGE_UNLOCK(sc);
1937                 m_freem(m);
1938                 return;
1939         }
1940
1941         if (bif->bif_flags & IFBIF_STP) {
1942                 switch (bif->bif_stp.bp_state) {
1943                 case BSTP_IFSTATE_DISABLED:
1944                 case BSTP_IFSTATE_BLOCKING:
1945                         BRIDGE_UNLOCK(sc);
1946                         m_freem(m);
1947                         return;
1948                 }
1949         }
1950
1951         BRIDGE_UNLOCK(sc);
1952
1953         if (PFIL_HOOKED(&inet_pfil_hook)
1954 #ifdef INET6
1955             || PFIL_HOOKED(&inet6_pfil_hook)
1956 #endif
1957             ) {
1958                 if (bridge_pfil(&m, sc->sc_ifp, dst_if, PFIL_OUT) != 0)
1959                         return;
1960                 if (m == NULL)
1961                         return;
1962         }
1963
1964         bridge_enqueue(sc, dst_if, m);
1965 }
1966
1967 /*
1968  * bridge_input:
1969  *
1970  *      Receive input from a member interface.  Queue the packet for
1971  *      bridging if it is not for us.
1972  */
1973 static struct mbuf *
1974 bridge_input(struct ifnet *ifp, struct mbuf *m)
1975 {
1976         struct bridge_softc *sc = ifp->if_bridge;
1977         struct bridge_iflist *bif;
1978         struct ifnet *bifp;
1979         struct ether_header *eh;
1980         struct mbuf *mc, *mc2;
1981
1982         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1983                 return (m);
1984
1985         bifp = sc->sc_ifp;
1986
1987         /*
1988          * Implement support for bridge monitoring. If this flag has been
1989          * set on this interface, discard the packet once we push it through
1990          * the bpf(4) machinery, but before we do, increment the byte and
1991          * packet counters associated with this interface.
1992          */
1993         if ((bifp->if_flags & IFF_MONITOR) != 0) {
1994                 m->m_pkthdr.rcvif  = bifp;
1995                 BPF_MTAP(bifp, m);
1996                 bifp->if_ipackets++;
1997                 bifp->if_ibytes += m->m_pkthdr.len;
1998                 m_free(m);
1999                 return (NULL);
2000         }
2001         BRIDGE_LOCK(sc);
2002         bif = bridge_lookup_member_if(sc, ifp);
2003         if (bif == NULL) {
2004                 BRIDGE_UNLOCK(sc);
2005                 return (m);
2006         }
2007
2008         eh = mtod(m, struct ether_header *);
2009
2010         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp),
2011             ETHER_ADDR_LEN) == 0) {
2012                 /*
2013                  * If the packet is for us, set the packets source as the
2014                  * bridge, and return the packet back to ether_input for
2015                  * local processing.
2016                  */
2017
2018                 /* Mark the packet as arriving on the bridge interface */
2019                 m->m_pkthdr.rcvif = bifp;
2020                 BPF_MTAP(bifp, m);
2021                 bifp->if_ipackets++;
2022
2023                 BRIDGE_UNLOCK(sc);
2024                 return (m);
2025         }
2026
2027         bridge_span(sc, m);
2028
2029         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
2030                 /* Tap off 802.1D packets; they do not get forwarded. */
2031                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2032                     ETHER_ADDR_LEN) == 0) {
2033                         m = bstp_input(&bif->bif_stp, ifp, m);
2034                         if (m == NULL) {
2035                                 BRIDGE_UNLOCK(sc);
2036                                 return (NULL);
2037                         }
2038                 }
2039
2040                 if (bif->bif_flags & IFBIF_STP) {
2041                         switch (bif->bif_stp.bp_state) {
2042                         case BSTP_IFSTATE_BLOCKING:
2043                         case BSTP_IFSTATE_LISTENING:
2044                         case BSTP_IFSTATE_DISABLED:
2045                                 BRIDGE_UNLOCK(sc);
2046                                 return (m);
2047                         }
2048                 }
2049
2050                 if (bcmp(etherbroadcastaddr, eh->ether_dhost,
2051                     sizeof(etherbroadcastaddr)) == 0)
2052                         m->m_flags |= M_BCAST;
2053                 else
2054                         m->m_flags |= M_MCAST;
2055
2056                 /*
2057                  * Make a deep copy of the packet and enqueue the copy
2058                  * for bridge processing; return the original packet for
2059                  * local processing.
2060                  */
2061                 mc = m_dup(m, M_DONTWAIT);
2062                 if (mc == NULL) {
2063                         BRIDGE_UNLOCK(sc);
2064                         return (m);
2065                 }
2066
2067                 /* Perform the bridge forwarding function with the copy. */
2068                 bridge_forward(sc, mc);
2069
2070                 /*
2071                  * Reinject the mbuf as arriving on the bridge so we have a
2072                  * chance at claiming multicast packets. We can not loop back
2073                  * here from ether_input as a bridge is never a member of a
2074                  * bridge.
2075                  */
2076                 KASSERT(bifp->if_bridge == NULL,
2077                     ("loop created in bridge_input"));
2078                 mc2 = m_dup(m, M_DONTWAIT);
2079                 if (mc2 != NULL) {
2080                         /* Keep the layer3 header aligned */
2081                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2082                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2083                 }
2084                 if (mc2 != NULL) {
2085                         mc2->m_pkthdr.rcvif = bifp;
2086                         (*bifp->if_input)(bifp, mc2);
2087                 }
2088
2089                 /* Return the original packet for local processing. */
2090                 return (m);
2091         }
2092
2093         if (bif->bif_flags & IFBIF_STP) {
2094                 switch (bif->bif_stp.bp_state) {
2095                 case BSTP_IFSTATE_BLOCKING:
2096                 case BSTP_IFSTATE_LISTENING:
2097                 case BSTP_IFSTATE_DISABLED:
2098                         BRIDGE_UNLOCK(sc);
2099                         return (m);
2100                 }
2101         }
2102
2103         /*
2104          * Unicast.  Make sure it's not for us.
2105          */
2106         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2107                 if (bif->bif_ifp->if_type == IFT_GIF)
2108                         continue;
2109                 /* It is destined for us. */
2110                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
2111                     ETHER_ADDR_LEN) == 0
2112 #ifdef DEV_CARP
2113                     || (bif->bif_ifp->if_carp
2114                         && carp_forus(bif->bif_ifp->if_carp, eh->ether_dhost))
2115 #endif
2116                     ) {
2117                         if (bif->bif_flags & IFBIF_LEARNING)
2118                                 (void) bridge_rtupdate(sc,
2119                                     eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
2120                         m->m_pkthdr.rcvif = bif->bif_ifp;
2121                         BRIDGE_UNLOCK(sc);
2122                         return (m);
2123                 }
2124
2125                 /* We just received a packet that we sent out. */
2126                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
2127                     ETHER_ADDR_LEN) == 0
2128 #ifdef DEV_CARP
2129                     || (bif->bif_ifp->if_carp
2130                         && carp_forus(bif->bif_ifp->if_carp, eh->ether_shost))
2131 #endif
2132                     ) {
2133                         BRIDGE_UNLOCK(sc);
2134                         m_freem(m);
2135                         return (NULL);
2136                 }
2137         }
2138
2139         /* Perform the bridge forwarding function. */
2140         bridge_forward(sc, m);
2141
2142         return (NULL);
2143 }
2144
2145 /*
2146  * bridge_broadcast:
2147  *
2148  *      Send a frame to all interfaces that are members of
2149  *      the bridge, except for the one on which the packet
2150  *      arrived.
2151  *
2152  *      NOTE: Releases the lock on return.
2153  */
2154 static void
2155 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2156     struct mbuf *m, int runfilt)
2157 {
2158         struct bridge_iflist *bif;
2159         struct mbuf *mc;
2160         struct ifnet *dst_if;
2161         int error = 0, used = 0, i;
2162
2163         BRIDGE_LOCK2REF(sc, error);
2164         if (error) {
2165                 m_freem(m);
2166                 return;
2167         }
2168
2169         /* Filter on the bridge interface before broadcasting */
2170         if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2171 #ifdef INET6
2172             || PFIL_HOOKED(&inet6_pfil_hook)
2173 #endif
2174             )) {
2175                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2176                         goto out;
2177                 if (m == NULL)
2178                         goto out;
2179         }
2180
2181         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2182                 dst_if = bif->bif_ifp;
2183                 if (dst_if == src_if)
2184                         continue;
2185
2186                 if (bif->bif_flags & IFBIF_STP) {
2187                         switch (bif->bif_stp.bp_state) {
2188                         case BSTP_IFSTATE_BLOCKING:
2189                         case BSTP_IFSTATE_DISABLED:
2190                                 continue;
2191                         }
2192                 }
2193
2194                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2195                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2196                         continue;
2197
2198                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2199                         continue;
2200
2201                 if (LIST_NEXT(bif, bif_next) == NULL) {
2202                         mc = m;
2203                         used = 1;
2204                 } else {
2205                         mc = m_dup(m, M_DONTWAIT);
2206                         if (mc == NULL) {
2207                                 sc->sc_ifp->if_oerrors++;
2208                                 continue;
2209                         }
2210                 }
2211
2212                 /*
2213                  * Filter on the output interface. Pass a NULL bridge interface
2214                  * pointer so we do not redundantly filter on the bridge for
2215                  * each interface we broadcast on.
2216                  */
2217                 if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2218 #ifdef INET6
2219                     || PFIL_HOOKED(&inet6_pfil_hook)
2220 #endif
2221                     )) {
2222                         if (used == 0) {
2223                                 /* Keep the layer3 header aligned */
2224                                 i = min(mc->m_pkthdr.len, max_protohdr);
2225                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2226                                 if (mc == NULL) {
2227                                         sc->sc_ifp->if_oerrors++;
2228                                         continue;
2229                                 }
2230                         }
2231                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2232                                 continue;
2233                         if (mc == NULL)
2234                                 continue;
2235                 }
2236
2237                 bridge_enqueue(sc, dst_if, mc);
2238         }
2239         if (used == 0)
2240                 m_freem(m);
2241
2242 out:
2243         BRIDGE_UNREF(sc);
2244 }
2245
2246 /*
2247  * bridge_span:
2248  *
2249  *      Duplicate a packet out one or more interfaces that are in span mode,
2250  *      the original mbuf is unmodified.
2251  */
2252 static void
2253 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2254 {
2255         struct bridge_iflist *bif;
2256         struct ifnet *dst_if;
2257         struct mbuf *mc;
2258
2259         if (LIST_EMPTY(&sc->sc_spanlist))
2260                 return;
2261
2262         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2263                 dst_if = bif->bif_ifp;
2264
2265                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2266                         continue;
2267
2268                 mc = m_copypacket(m, M_DONTWAIT);
2269                 if (mc == NULL) {
2270                         sc->sc_ifp->if_oerrors++;
2271                         continue;
2272                 }
2273
2274                 bridge_enqueue(sc, dst_if, mc);
2275         }
2276 }
2277
2278 /*
2279  * bridge_rtupdate:
2280  *
2281  *      Add a bridge routing entry.
2282  */
2283 static int
2284 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2285     struct ifnet *dst_if, int setflags, uint8_t flags)
2286 {
2287         struct bridge_rtnode *brt;
2288         int error;
2289
2290         BRIDGE_LOCK_ASSERT(sc);
2291
2292         /*
2293          * A route for this destination might already exist.  If so,
2294          * update it, otherwise create a new one.
2295          */
2296         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2297                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2298                         sc->sc_brtexceeded++;
2299                         return (ENOSPC);
2300                 }
2301
2302                 /*
2303                  * Allocate a new bridge forwarding node, and
2304                  * initialize the expiration time and Ethernet
2305                  * address.
2306                  */
2307                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2308                 if (brt == NULL)
2309                         return (ENOMEM);
2310
2311                 brt->brt_flags = IFBAF_DYNAMIC;
2312                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2313
2314                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2315                         uma_zfree(bridge_rtnode_zone, brt);
2316                         return (error);
2317                 }
2318         }
2319
2320         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2321                 brt->brt_ifp = dst_if;
2322         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2323                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2324         if (setflags)
2325                 brt->brt_flags = flags;
2326
2327         return (0);
2328 }
2329
2330 /*
2331  * bridge_rtlookup:
2332  *
2333  *      Lookup the destination interface for an address.
2334  */
2335 static struct ifnet *
2336 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2337 {
2338         struct bridge_rtnode *brt;
2339
2340         BRIDGE_LOCK_ASSERT(sc);
2341
2342         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2343                 return (NULL);
2344
2345         return (brt->brt_ifp);
2346 }
2347
2348 /*
2349  * bridge_rttrim:
2350  *
2351  *      Trim the routine table so that we have a number
2352  *      of routing entries less than or equal to the
2353  *      maximum number.
2354  */
2355 static void
2356 bridge_rttrim(struct bridge_softc *sc)
2357 {
2358         struct bridge_rtnode *brt, *nbrt;
2359
2360         BRIDGE_LOCK_ASSERT(sc);
2361
2362         /* Make sure we actually need to do this. */
2363         if (sc->sc_brtcnt <= sc->sc_brtmax)
2364                 return;
2365
2366         /* Force an aging cycle; this might trim enough addresses. */
2367         bridge_rtage(sc);
2368         if (sc->sc_brtcnt <= sc->sc_brtmax)
2369                 return;
2370
2371         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2372                 nbrt = LIST_NEXT(brt, brt_list);
2373                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2374                         bridge_rtnode_destroy(sc, brt);
2375                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2376                                 return;
2377                 }
2378         }
2379 }
2380
2381 /*
2382  * bridge_timer:
2383  *
2384  *      Aging timer for the bridge.
2385  */
2386 static void
2387 bridge_timer(void *arg)
2388 {
2389         struct bridge_softc *sc = arg;
2390
2391         BRIDGE_LOCK_ASSERT(sc);
2392
2393         bridge_rtage(sc);
2394
2395         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2396                 callout_reset(&sc->sc_brcallout,
2397                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2398 }
2399
2400 /*
2401  * bridge_rtage:
2402  *
2403  *      Perform an aging cycle.
2404  */
2405 static void
2406 bridge_rtage(struct bridge_softc *sc)
2407 {
2408         struct bridge_rtnode *brt, *nbrt;
2409
2410         BRIDGE_LOCK_ASSERT(sc);
2411
2412         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2413                 nbrt = LIST_NEXT(brt, brt_list);
2414                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2415                         if (time_uptime >= brt->brt_expire)
2416                                 bridge_rtnode_destroy(sc, brt);
2417                 }
2418         }
2419 }
2420
2421 /*
2422  * bridge_rtflush:
2423  *
2424  *      Remove all dynamic addresses from the bridge.
2425  */
2426 static void
2427 bridge_rtflush(struct bridge_softc *sc, int full)
2428 {
2429         struct bridge_rtnode *brt, *nbrt;
2430
2431         BRIDGE_LOCK_ASSERT(sc);
2432
2433         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2434                 nbrt = LIST_NEXT(brt, brt_list);
2435                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2436                         bridge_rtnode_destroy(sc, brt);
2437         }
2438 }
2439
2440 /*
2441  * bridge_rtdaddr:
2442  *
2443  *      Remove an address from the table.
2444  */
2445 static int
2446 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2447 {
2448         struct bridge_rtnode *brt;
2449
2450         BRIDGE_LOCK_ASSERT(sc);
2451
2452         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2453                 return (ENOENT);
2454
2455         bridge_rtnode_destroy(sc, brt);
2456         return (0);
2457 }
2458
2459 /*
2460  * bridge_rtdelete:
2461  *
2462  *      Delete routes to a speicifc member interface.
2463  */
2464 static void
2465 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2466 {
2467         struct bridge_rtnode *brt, *nbrt;
2468
2469         BRIDGE_LOCK_ASSERT(sc);
2470
2471         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2472                 nbrt = LIST_NEXT(brt, brt_list);
2473                 if (brt->brt_ifp == ifp && (full ||
2474                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2475                         bridge_rtnode_destroy(sc, brt);
2476         }
2477 }
2478
2479 /*
2480  * bridge_rtable_init:
2481  *
2482  *      Initialize the route table for this bridge.
2483  */
2484 static int
2485 bridge_rtable_init(struct bridge_softc *sc)
2486 {
2487         int i;
2488
2489         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2490             M_DEVBUF, M_NOWAIT);
2491         if (sc->sc_rthash == NULL)
2492                 return (ENOMEM);
2493
2494         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2495                 LIST_INIT(&sc->sc_rthash[i]);
2496
2497         sc->sc_rthash_key = arc4random();
2498
2499         LIST_INIT(&sc->sc_rtlist);
2500
2501         return (0);
2502 }
2503
2504 /*
2505  * bridge_rtable_fini:
2506  *
2507  *      Deconstruct the route table for this bridge.
2508  */
2509 static void
2510 bridge_rtable_fini(struct bridge_softc *sc)
2511 {
2512
2513         free(sc->sc_rthash, M_DEVBUF);
2514 }
2515
2516 /*
2517  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2518  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2519  */
2520 #define mix(a, b, c)                                                    \
2521 do {                                                                    \
2522         a -= b; a -= c; a ^= (c >> 13);                                 \
2523         b -= c; b -= a; b ^= (a << 8);                                  \
2524         c -= a; c -= b; c ^= (b >> 13);                                 \
2525         a -= b; a -= c; a ^= (c >> 12);                                 \
2526         b -= c; b -= a; b ^= (a << 16);                                 \
2527         c -= a; c -= b; c ^= (b >> 5);                                  \
2528         a -= b; a -= c; a ^= (c >> 3);                                  \
2529         b -= c; b -= a; b ^= (a << 10);                                 \
2530         c -= a; c -= b; c ^= (b >> 15);                                 \
2531 } while (/*CONSTCOND*/0)
2532
2533 static __inline uint32_t
2534 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2535 {
2536         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2537
2538         b += addr[5] << 8;
2539         b += addr[4];
2540         a += addr[3] << 24;
2541         a += addr[2] << 16;
2542         a += addr[1] << 8;
2543         a += addr[0];
2544
2545         mix(a, b, c);
2546
2547         return (c & BRIDGE_RTHASH_MASK);
2548 }
2549
2550 #undef mix
2551
2552 static int
2553 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2554 {
2555         int i, d;
2556
2557         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2558                 d = ((int)a[i]) - ((int)b[i]);
2559         }
2560
2561         return (d);
2562 }
2563
2564 /*
2565  * bridge_rtnode_lookup:
2566  *
2567  *      Look up a bridge route node for the specified destination.
2568  */
2569 static struct bridge_rtnode *
2570 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2571 {
2572         struct bridge_rtnode *brt;
2573         uint32_t hash;
2574         int dir;
2575
2576         BRIDGE_LOCK_ASSERT(sc);
2577
2578         hash = bridge_rthash(sc, addr);
2579         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2580                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2581                 if (dir == 0)
2582                         return (brt);
2583                 if (dir > 0)
2584                         return (NULL);
2585         }
2586
2587         return (NULL);
2588 }
2589
2590 /*
2591  * bridge_rtnode_insert:
2592  *
2593  *      Insert the specified bridge node into the route table.  We
2594  *      assume the entry is not already in the table.
2595  */
2596 static int
2597 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2598 {
2599         struct bridge_rtnode *lbrt;
2600         uint32_t hash;
2601         int dir;
2602
2603         BRIDGE_LOCK_ASSERT(sc);
2604
2605         hash = bridge_rthash(sc, brt->brt_addr);
2606
2607         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2608         if (lbrt == NULL) {
2609                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2610                 goto out;
2611         }
2612
2613         do {
2614                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2615                 if (dir == 0)
2616                         return (EEXIST);
2617                 if (dir > 0) {
2618                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2619                         goto out;
2620                 }
2621                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2622                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2623                         goto out;
2624                 }
2625                 lbrt = LIST_NEXT(lbrt, brt_hash);
2626         } while (lbrt != NULL);
2627
2628 #ifdef DIAGNOSTIC
2629         panic("bridge_rtnode_insert: impossible");
2630 #endif
2631
2632 out:
2633         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2634         sc->sc_brtcnt++;
2635
2636         return (0);
2637 }
2638
2639 /*
2640  * bridge_rtnode_destroy:
2641  *
2642  *      Destroy a bridge rtnode.
2643  */
2644 static void
2645 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2646 {
2647         BRIDGE_LOCK_ASSERT(sc);
2648
2649         LIST_REMOVE(brt, brt_hash);
2650
2651         LIST_REMOVE(brt, brt_list);
2652         sc->sc_brtcnt--;
2653         uma_zfree(bridge_rtnode_zone, brt);
2654 }
2655
2656 /*
2657  * bridge_state_change:
2658  *
2659  *      Callback from the bridgestp code when a port changes states.
2660  */
2661 static void
2662 bridge_state_change(struct ifnet *ifp, int state)
2663 {
2664         struct bridge_softc *sc = ifp->if_bridge;
2665         static const char *stpstates[] = {
2666                 "disabled",
2667                 "listening",
2668                 "learning",
2669                 "forwarding",
2670                 "blocking",
2671         };
2672
2673         if (log_stp)
2674                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
2675                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
2676
2677         /* if the port is blocking then remove any routes to it */
2678         switch (state) {
2679                 case BSTP_IFSTATE_DISABLED:
2680                 case BSTP_IFSTATE_BLOCKING:
2681                         BRIDGE_LOCK(sc);
2682                         bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
2683                         BRIDGE_UNLOCK(sc);
2684         }
2685 }
2686
2687 /*
2688  * Send bridge packets through pfil if they are one of the types pfil can deal
2689  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2690  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2691  * that interface.
2692  */
2693 static int
2694 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2695 {
2696         int snap, error, i, hlen;
2697         struct ether_header *eh1, eh2;
2698         struct ip_fw_args args;
2699         struct ip *ip;
2700         struct llc llc1;
2701         u_int16_t ether_type;
2702
2703         snap = 0;
2704         error = -1;     /* Default error if not error == 0 */
2705
2706         /* we may return with the IP fields swapped, ensure its not shared */
2707         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2708
2709         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2710                 return (0); /* filtering is disabled */
2711
2712         i = min((*mp)->m_pkthdr.len, max_protohdr);
2713         if ((*mp)->m_len < i) {
2714             *mp = m_pullup(*mp, i);
2715             if (*mp == NULL) {
2716                 printf("%s: m_pullup failed\n", __func__);
2717                 return (-1);
2718             }
2719         }
2720
2721         eh1 = mtod(*mp, struct ether_header *);
2722         ether_type = ntohs(eh1->ether_type);
2723
2724         /*
2725          * Check for SNAP/LLC.
2726          */
2727         if (ether_type < ETHERMTU) {
2728                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2729
2730                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2731                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2732                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2733                     llc2->llc_control == LLC_UI) {
2734                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2735                         snap = 1;
2736                 }
2737         }
2738
2739         /*
2740          * If we're trying to filter bridge traffic, don't look at anything
2741          * other than IP and ARP traffic.  If the filter doesn't understand
2742          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2743          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2744          * but of course we don't have an AppleTalk filter to begin with.
2745          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2746          * ARP traffic.)
2747          */
2748         switch (ether_type) {
2749                 case ETHERTYPE_ARP:
2750                 case ETHERTYPE_REVARP:
2751                         return (0); /* Automatically pass */
2752                 case ETHERTYPE_IP:
2753 #ifdef INET6
2754                 case ETHERTYPE_IPV6:
2755 #endif /* INET6 */
2756                         break;
2757                 default:
2758                         /*
2759                          * Check to see if the user wants to pass non-ip
2760                          * packets, these will not be checked by pfil(9) and
2761                          * passed unconditionally so the default is to drop.
2762                          */
2763                         if (pfil_onlyip)
2764                                 goto bad;
2765         }
2766
2767         /* Strip off the Ethernet header and keep a copy. */
2768         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2769         m_adj(*mp, ETHER_HDR_LEN);
2770
2771         /* Strip off snap header, if present */
2772         if (snap) {
2773                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2774                 m_adj(*mp, sizeof(struct llc));
2775         }
2776
2777         /*
2778          * Check the IP header for alignment and errors
2779          */
2780         if (dir == PFIL_IN) {
2781                 switch (ether_type) {
2782                         case ETHERTYPE_IP:
2783                                 error = bridge_ip_checkbasic(mp);
2784                                 break;
2785 #ifdef INET6
2786                         case ETHERTYPE_IPV6:
2787                                 error = bridge_ip6_checkbasic(mp);
2788                                 break;
2789 #endif /* INET6 */
2790                         default:
2791                                 error = 0;
2792                 }
2793                 if (error)
2794                         goto bad;
2795         }
2796
2797         if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
2798                 error = -1;
2799                 args.rule = ip_dn_claim_rule(*mp);
2800                 if (args.rule != NULL && fw_one_pass)
2801                         goto ipfwpass; /* packet already partially processed */
2802
2803                 args.m = *mp;
2804                 args.oif = ifp;
2805                 args.next_hop = NULL;
2806                 args.eh = &eh2;
2807                 args.inp = NULL;        /* used by ipfw uid/gid/jail rules */
2808                 i = ip_fw_chk_ptr(&args);
2809                 *mp = args.m;
2810
2811                 if (*mp == NULL)
2812                         return (error);
2813
2814                 if (DUMMYNET_LOADED && (i == IP_FW_DUMMYNET)) {
2815
2816                         /* put the Ethernet header back on */
2817                         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2818                         if (*mp == NULL)
2819                                 return (error);
2820                         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2821
2822                         /*
2823                          * Pass the pkt to dummynet, which consumes it. The
2824                          * packet will return to us via bridge_dummynet().
2825                          */
2826                         args.oif = ifp;
2827                         ip_dn_io_ptr(*mp, DN_TO_IFB_FWD, &args);
2828                         return (error);
2829                 }
2830
2831                 if (i != IP_FW_PASS) /* drop */
2832                         goto bad;
2833         }
2834
2835 ipfwpass:
2836         error = 0;
2837
2838         /*
2839          * Run the packet through pfil
2840          */
2841         switch (ether_type) {
2842         case ETHERTYPE_IP:
2843                 /*
2844                  * before calling the firewall, swap fields the same as
2845                  * IP does. here we assume the header is contiguous
2846                  */
2847                 ip = mtod(*mp, struct ip *);
2848
2849                 ip->ip_len = ntohs(ip->ip_len);
2850                 ip->ip_off = ntohs(ip->ip_off);
2851
2852                 /*
2853                  * Run pfil on the member interface and the bridge, both can
2854                  * be skipped by clearing pfil_member or pfil_bridge.
2855                  *
2856                  * Keep the order:
2857                  *   in_if -> bridge_if -> out_if
2858                  */
2859                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2860                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2861                                         dir, NULL);
2862
2863                 if (*mp == NULL || error != 0) /* filter may consume */
2864                         break;
2865
2866                 if (pfil_member && ifp != NULL)
2867                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2868                                         dir, NULL);
2869
2870                 if (*mp == NULL || error != 0) /* filter may consume */
2871                         break;
2872
2873                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2874                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2875                                         dir, NULL);
2876
2877                 if (*mp == NULL || error != 0) /* filter may consume */
2878                         break;
2879
2880                 /* check if we need to fragment the packet */
2881                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2882                         i = (*mp)->m_pkthdr.len;
2883                         if (i > ifp->if_mtu) {
2884                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2885                                             &llc1);
2886                                 return (error);
2887                         }
2888                 }
2889
2890                 /* Recalculate the ip checksum and restore byte ordering */
2891                 ip = mtod(*mp, struct ip *);
2892                 hlen = ip->ip_hl << 2;
2893                 if (hlen < sizeof(struct ip))
2894                         goto bad;
2895                 if (hlen > (*mp)->m_len) {
2896                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2897                                 goto bad;
2898                         ip = mtod(*mp, struct ip *);
2899                         if (ip == NULL)
2900                                 goto bad;
2901                 }
2902                 ip->ip_len = htons(ip->ip_len);
2903                 ip->ip_off = htons(ip->ip_off);
2904                 ip->ip_sum = 0;
2905                 if (hlen == sizeof(struct ip))
2906                         ip->ip_sum = in_cksum_hdr(ip);
2907                 else
2908                         ip->ip_sum = in_cksum(*mp, hlen);
2909
2910                 break;
2911 #ifdef INET6
2912         case ETHERTYPE_IPV6:
2913                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2914                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2915                                         dir, NULL);
2916
2917                 if (*mp == NULL || error != 0) /* filter may consume */
2918                         break;
2919
2920                 if (pfil_member && ifp != NULL)
2921                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2922                                         dir, NULL);
2923
2924                 if (*mp == NULL || error != 0) /* filter may consume */
2925                         break;
2926
2927                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2928                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2929                                         dir, NULL);
2930                 break;
2931 #endif
2932         default:
2933                 error = 0;
2934                 break;
2935         }
2936
2937         if (*mp == NULL)
2938                 return (error);
2939         if (error != 0)
2940                 goto bad;
2941
2942         error = -1;
2943
2944         /*
2945          * Finally, put everything back the way it was and return
2946          */
2947         if (snap) {
2948                 M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2949                 if (*mp == NULL)
2950                         return (error);
2951                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2952         }
2953
2954         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2955         if (*mp == NULL)
2956                 return (error);
2957         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2958
2959         return (0);
2960
2961 bad:
2962         m_freem(*mp);
2963         *mp = NULL;
2964         return (error);
2965 }
2966
2967 /*
2968  * Perform basic checks on header size since
2969  * pfil assumes ip_input has already processed
2970  * it for it.  Cut-and-pasted from ip_input.c.
2971  * Given how simple the IPv6 version is,
2972  * does the IPv4 version really need to be
2973  * this complicated?
2974  *
2975  * XXX Should we update ipstat here, or not?
2976  * XXX Right now we update ipstat but not
2977  * XXX csum_counter.
2978  */
2979 static int
2980 bridge_ip_checkbasic(struct mbuf **mp)
2981 {
2982         struct mbuf *m = *mp;
2983         struct ip *ip;
2984         int len, hlen;
2985         u_short sum;
2986
2987         if (*mp == NULL)
2988                 return (-1);
2989
2990         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2991                 if ((m = m_copyup(m, sizeof(struct ip),
2992                         (max_linkhdr + 3) & ~3)) == NULL) {
2993                         /* XXXJRT new stat, please */
2994                         ipstat.ips_toosmall++;
2995                         goto bad;
2996                 }
2997         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
2998                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2999                         ipstat.ips_toosmall++;
3000                         goto bad;
3001                 }
3002         }
3003         ip = mtod(m, struct ip *);
3004         if (ip == NULL) goto bad;
3005
3006         if (ip->ip_v != IPVERSION) {
3007                 ipstat.ips_badvers++;
3008                 goto bad;
3009         }
3010         hlen = ip->ip_hl << 2;
3011         if (hlen < sizeof(struct ip)) { /* minimum header length */
3012                 ipstat.ips_badhlen++;
3013                 goto bad;
3014         }
3015         if (hlen > m->m_len) {
3016                 if ((m = m_pullup(m, hlen)) == 0) {
3017                         ipstat.ips_badhlen++;
3018                         goto bad;
3019                 }
3020                 ip = mtod(m, struct ip *);
3021                 if (ip == NULL) goto bad;
3022         }
3023
3024         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3025                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3026         } else {
3027                 if (hlen == sizeof(struct ip)) {
3028                         sum = in_cksum_hdr(ip);
3029                 } else {
3030                         sum = in_cksum(m, hlen);
3031                 }
3032         }
3033         if (sum) {
3034                 ipstat.ips_badsum++;
3035                 goto bad;
3036         }
3037
3038         /* Retrieve the packet length. */
3039         len = ntohs(ip->ip_len);
3040
3041         /*
3042          * Check for additional length bogosity
3043          */
3044         if (len < hlen) {
3045                 ipstat.ips_badlen++;
3046                 goto bad;
3047         }
3048
3049         /*
3050          * Check that the amount of data in the buffers
3051          * is as at least much as the IP header would have us expect.
3052          * Drop packet if shorter than we expect.
3053          */
3054         if (m->m_pkthdr.len < len) {
3055                 ipstat.ips_tooshort++;
3056                 goto bad;
3057         }
3058
3059         /* Checks out, proceed */
3060         *mp = m;
3061         return (0);
3062
3063 bad:
3064         *mp = m;
3065         return (-1);
3066 }
3067
3068 #ifdef INET6
3069 /*
3070  * Same as above, but for IPv6.
3071  * Cut-and-pasted from ip6_input.c.
3072  * XXX Should we update ip6stat, or not?
3073  */
3074 static int
3075 bridge_ip6_checkbasic(struct mbuf **mp)
3076 {
3077         struct mbuf *m = *mp;
3078         struct ip6_hdr *ip6;
3079
3080         /*
3081          * If the IPv6 header is not aligned, slurp it up into a new
3082          * mbuf with space for link headers, in the event we forward
3083          * it.  Otherwise, if it is aligned, make sure the entire base
3084          * IPv6 header is in the first mbuf of the chain.
3085          */
3086         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3087                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3088                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3089                             (max_linkhdr + 3) & ~3)) == NULL) {
3090                         /* XXXJRT new stat, please */
3091                         ip6stat.ip6s_toosmall++;
3092                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3093                         goto bad;
3094                 }
3095         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3096                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3097                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3098                         ip6stat.ip6s_toosmall++;
3099                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3100                         goto bad;
3101                 }
3102         }
3103
3104         ip6 = mtod(m, struct ip6_hdr *);
3105
3106         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3107                 ip6stat.ip6s_badvers++;
3108                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3109                 goto bad;
3110         }
3111
3112         /* Checks out, proceed */
3113         *mp = m;
3114         return (0);
3115
3116 bad:
3117         *mp = m;
3118         return (-1);
3119 }
3120 #endif /* INET6 */
3121
3122 /*
3123  * bridge_fragment:
3124  *
3125  *      Return a fragmented mbuf chain.
3126  */
3127 static int
3128 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3129     int snap, struct llc *llc)
3130 {
3131         struct mbuf *m0;
3132         struct ip *ip;
3133         int error = -1;
3134
3135         if (m->m_len < sizeof(struct ip) &&
3136             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3137                 goto out;
3138         ip = mtod(m, struct ip *);
3139
3140         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3141                     CSUM_DELAY_IP);
3142         if (error)
3143                 goto out;
3144
3145         /* walk the chain and re-add the Ethernet header */
3146         for (m0 = m; m0; m0 = m0->m_nextpkt) {
3147                 if (error == 0) {
3148                         if (snap) {
3149                                 M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3150                                 if (m0 == NULL) {
3151                                         error = ENOBUFS;
3152                                         continue;
3153                                 }
3154                                 bcopy(llc, mtod(m0, caddr_t),
3155                                     sizeof(struct llc));
3156                         }
3157                         M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3158                         if (m0 == NULL) {
3159                                 error = ENOBUFS;
3160                                 continue;
3161                         }
3162                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3163                 } else
3164                         m_freem(m);
3165         }
3166
3167         if (error == 0)
3168                 ipstat.ips_fragmented++;
3169
3170         return (error);
3171
3172 out:
3173         if (m != NULL)
3174                 m_freem(m);
3175         return (error);
3176 }