sys/net/if_bridge.c

   1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
   2
   3 /*-
   4  * SPDX-License-Identifier: BSD-4-Clause
   5  *
   6  * Copyright 2001 Wasabi Systems, Inc.
   7  * All rights reserved.
   8  *
   9  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. All advertising materials mentioning features or use of this software
  20  *    must display the following acknowledgement:
  21  *      This product includes software developed for the NetBSD Project by
  22  *      Wasabi Systems, Inc.
  23  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  24  *    or promote products derived from this software without specific prior
  25  *    written permission.
  26  *
  27  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  37  * POSSIBILITY OF SUCH DAMAGE.
  38  */
  39
  40 /*
  41  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  42  * All rights reserved.
  43  *
  44  * Redistribution and use in source and binary forms, with or without
  45  * modification, are permitted provided that the following conditions
  46  * are met:
  47  * 1. Redistributions of source code must retain the above copyright
  48  *    notice, this list of conditions and the following disclaimer.
  49  * 2. Redistributions in binary form must reproduce the above copyright
  50  *    notice, this list of conditions and the following disclaimer in the
  51  *    documentation and/or other materials provided with the distribution.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  54  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  55  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  56  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  57  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  58  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  59  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  61  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  62  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  63  * POSSIBILITY OF SUCH DAMAGE.
  64  *
  65  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
  66  */
  67
  68 /*
  69  * Network interface bridge support.
  70  *
  71  * TODO:
  72  *
  73  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  74  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  75  *        to bridge other types of interfaces (maybe consider
  76  *        heterogeneous bridges).
  77  */
  78
  79 #include <sys/cdefs.h>
  80 __FBSDID("$FreeBSD$");
  81
  82 #include "opt_inet.h"
  83 #include "opt_inet6.h"
  84
  85 #include <sys/param.h>
  86 #include <sys/eventhandler.h>
  87 #include <sys/mbuf.h>
  88 #include <sys/malloc.h>
  89 #include <sys/protosw.h>
  90 #include <sys/systm.h>
  91 #include <sys/jail.h>
  92 #include <sys/time.h>
  93 #include <sys/socket.h> /* for net/if.h */
  94 #include <sys/sockio.h>
  95 #include <sys/ctype.h>  /* string functions */
  96 #include <sys/kernel.h>
  97 #include <sys/random.h>
  98 #include <sys/syslog.h>
  99 #include <sys/sysctl.h>
 100 #include <vm/uma.h>
 101 #include <sys/module.h>
 102 #include <sys/priv.h>
 103 #include <sys/proc.h>
 104 #include <sys/lock.h>
 105 #include <sys/mutex.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_clone.h>
 110 #include <net/if_dl.h>
 111 #include <net/if_types.h>
 112 #include <net/if_var.h>
 113 #include <net/if_private.h>
 114 #include <net/pfil.h>
 115 #include <net/vnet.h>
 116
 117 #include <netinet/in.h>
 118 #include <netinet/in_systm.h>
 119 #include <netinet/in_var.h>
 120 #include <netinet/ip.h>
 121 #include <netinet/ip_var.h>
 122 #ifdef INET6
 123 #include <netinet/ip6.h>
 124 #include <netinet6/ip6_var.h>
 125 #include <netinet6/in6_ifattach.h>
 126 #endif
 127 #if defined(INET) || defined(INET6)
 128 #include <netinet/ip_carp.h>
 129 #endif
 130 #include <machine/in_cksum.h>
 131 #include <netinet/if_ether.h>
 132 #include <net/bridgestp.h>
 133 #include <net/if_bridgevar.h>
 134 #include <net/if_llc.h>
 135 #include <net/if_vlan_var.h>
 136
 137 #include <net/route.h>
 138
 139 /*
 140  * Size of the route hash table.  Must be a power of two.
 141  */
 142 #ifndef BRIDGE_RTHASH_SIZE
 143 #define BRIDGE_RTHASH_SIZE              1024
 144 #endif
 145
 146 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 147
 148 /*
 149  * Default maximum number of addresses to cache.
 150  */
 151 #ifndef BRIDGE_RTABLE_MAX
 152 #define BRIDGE_RTABLE_MAX               2000
 153 #endif
 154
 155 /*
 156  * Timeout (in seconds) for entries learned dynamically.
 157  */
 158 #ifndef BRIDGE_RTABLE_TIMEOUT
 159 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 160 #endif
 161
 162 /*
 163  * Number of seconds between walks of the route list.
 164  */
 165 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 166 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 167 #endif
 168
 169 /*
 170  * List of capabilities to possibly mask on the member interface.
 171  */
 172 #define BRIDGE_IFCAPS_MASK              (IFCAP_TOE|IFCAP_TSO|IFCAP_TXCSUM|\
 173                                          IFCAP_TXCSUM_IPV6)
 174
 175 /*
 176  * List of capabilities to strip
 177  */
 178 #define BRIDGE_IFCAPS_STRIP             IFCAP_LRO
 179
 180 /*
 181  * Bridge locking
 182  *
 183  * The bridge relies heavily on the epoch(9) system to protect its data
 184  * structures. This means we can safely use CK_LISTs while in NET_EPOCH, but we
 185  * must ensure there is only one writer at a time.
 186  *
 187  * That is: for read accesses we only need to be in NET_EPOCH, but for write
 188  * accesses we must hold:
 189  *
 190  *  - BRIDGE_RT_LOCK, for any change to bridge_rtnodes
 191  *  - BRIDGE_LOCK, for any other change
 192  *
 193  * The BRIDGE_LOCK is a sleepable lock, because it is held across ioctl()
 194  * calls to bridge member interfaces and these ioctl()s can sleep.
 195  * The BRIDGE_RT_LOCK is a non-sleepable mutex, because it is sometimes
 196  * required while we're in NET_EPOCH and then we're not allowed to sleep.
 197  */
 198 #define BRIDGE_LOCK_INIT(_sc)           do {                    \
 199         sx_init(&(_sc)->sc_sx, "if_bridge");                    \
 200         mtx_init(&(_sc)->sc_rt_mtx, "if_bridge rt", NULL, MTX_DEF);     \
 201 } while (0)
 202 #define BRIDGE_LOCK_DESTROY(_sc)        do {    \
 203         sx_destroy(&(_sc)->sc_sx);              \
 204         mtx_destroy(&(_sc)->sc_rt_mtx);         \
 205 } while (0)
 206 #define BRIDGE_LOCK(_sc)                sx_xlock(&(_sc)->sc_sx)
 207 #define BRIDGE_UNLOCK(_sc)              sx_xunlock(&(_sc)->sc_sx)
 208 #define BRIDGE_LOCK_ASSERT(_sc)         sx_assert(&(_sc)->sc_sx, SX_XLOCKED)
 209 #define BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(_sc)    \
 210             MPASS(in_epoch(net_epoch_preempt) || sx_xlocked(&(_sc)->sc_sx))
 211 #define BRIDGE_UNLOCK_ASSERT(_sc)       sx_assert(&(_sc)->sc_sx, SX_UNLOCKED)
 212 #define BRIDGE_RT_LOCK(_sc)             mtx_lock(&(_sc)->sc_rt_mtx)
 213 #define BRIDGE_RT_UNLOCK(_sc)           mtx_unlock(&(_sc)->sc_rt_mtx)
 214 #define BRIDGE_RT_LOCK_ASSERT(_sc)      mtx_assert(&(_sc)->sc_rt_mtx, MA_OWNED)
 215 #define BRIDGE_RT_LOCK_OR_NET_EPOCH_ASSERT(_sc) \
 216             MPASS(in_epoch(net_epoch_preempt) || mtx_owned(&(_sc)->sc_rt_mtx))
 217
 218 /*
 219  * Bridge interface list entry.
 220  */
 221 struct bridge_iflist {
 222         CK_LIST_ENTRY(bridge_iflist) bif_next;
 223         struct ifnet            *bif_ifp;       /* member if */
 224         struct bstp_port        bif_stp;        /* STP state */
 225         uint32_t                bif_flags;      /* member if flags */
 226         int                     bif_savedcaps;  /* saved capabilities */
 227         uint32_t                bif_addrmax;    /* max # of addresses */
 228         uint32_t                bif_addrcnt;    /* cur. # of addresses */
 229         uint32_t                bif_addrexceeded;/* # of address violations */
 230         struct epoch_context    bif_epoch_ctx;
 231 };
 232
 233 /*
 234  * Bridge route node.
 235  */
 236 struct bridge_rtnode {
 237         CK_LIST_ENTRY(bridge_rtnode) brt_hash;  /* hash table linkage */
 238         CK_LIST_ENTRY(bridge_rtnode) brt_list;  /* list linkage */
 239         struct bridge_iflist    *brt_dst;       /* destination if */
 240         unsigned long           brt_expire;     /* expiration time */
 241         uint8_t                 brt_flags;      /* address flags */
 242         uint8_t                 brt_addr[ETHER_ADDR_LEN];
 243         uint16_t                brt_vlan;       /* vlan id */
 244         struct  vnet            *brt_vnet;
 245         struct  epoch_context   brt_epoch_ctx;
 246 };
 247 #define brt_ifp                 brt_dst->bif_ifp
 248
 249 /*
 250  * Software state for each bridge.
 251  */
 252 struct bridge_softc {
 253         struct ifnet            *sc_ifp;        /* make this an interface */
 254         LIST_ENTRY(bridge_softc) sc_list;
 255         struct sx               sc_sx;
 256         struct mtx              sc_rt_mtx;
 257         uint32_t                sc_brtmax;      /* max # of addresses */
 258         uint32_t                sc_brtcnt;      /* cur. # of addresses */
 259         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
 260         struct callout          sc_brcallout;   /* bridge callout */
 261         CK_LIST_HEAD(, bridge_iflist) sc_iflist;        /* member interface list */
 262         CK_LIST_HEAD(, bridge_rtnode) *sc_rthash;       /* our forwarding table */
 263         CK_LIST_HEAD(, bridge_rtnode) sc_rtlist;        /* list version of above */
 264         uint32_t                sc_rthash_key;  /* key for hash */
 265         CK_LIST_HEAD(, bridge_iflist) sc_spanlist;      /* span ports list */
 266         struct bstp_state       sc_stp;         /* STP state */
 267         uint32_t                sc_brtexceeded; /* # of cache drops */
 268         struct ifnet            *sc_ifaddr;     /* member mac copied from */
 269         struct ether_addr       sc_defaddr;     /* Default MAC address */
 270         struct epoch_context    sc_epoch_ctx;
 271 };
 272
 273 VNET_DEFINE_STATIC(struct sx, bridge_list_sx);
 274 #define V_bridge_list_sx        VNET(bridge_list_sx)
 275 static eventhandler_tag bridge_detach_cookie;
 276
 277 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 278
 279 VNET_DEFINE_STATIC(uma_zone_t, bridge_rtnode_zone);
 280 #define V_bridge_rtnode_zone    VNET(bridge_rtnode_zone)
 281
 282 static int      bridge_clone_create(struct if_clone *, char *, size_t,
 283                     struct ifc_data *, struct ifnet **);
 284 static int      bridge_clone_destroy(struct if_clone *, struct ifnet *, uint32_t);
 285
 286 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
 287 static void     bridge_mutecaps(struct bridge_softc *);
 288 static void     bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
 289                     int);
 290 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 291 static void     bridge_init(void *);
 292 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
 293 static void     bridge_stop(struct ifnet *, int);
 294 static int      bridge_transmit(struct ifnet *, struct mbuf *);
 295 #ifdef ALTQ
 296 static void     bridge_altq_start(if_t);
 297 static int      bridge_altq_transmit(if_t, struct mbuf *);
 298 #endif
 299 static void     bridge_qflush(struct ifnet *);
 300 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 301 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 302                     struct rtentry *);
 303 static int      bridge_enqueue(struct bridge_softc *, struct ifnet *,
 304                     struct mbuf *);
 305 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
 306
 307 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
 308                     struct mbuf *m);
 309
 310 static void     bridge_timer(void *);
 311
 312 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 313                     struct mbuf *, int);
 314 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 315
 316 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 317                     uint16_t, struct bridge_iflist *, int, uint8_t);
 318 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *,
 319                     uint16_t);
 320 static void     bridge_rttrim(struct bridge_softc *);
 321 static void     bridge_rtage(struct bridge_softc *);
 322 static void     bridge_rtflush(struct bridge_softc *, int);
 323 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *,
 324                     uint16_t);
 325
 326 static void     bridge_rtable_init(struct bridge_softc *);
 327 static void     bridge_rtable_fini(struct bridge_softc *);
 328
 329 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 330 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 331                     const uint8_t *, uint16_t);
 332 static int      bridge_rtnode_insert(struct bridge_softc *,
 333                     struct bridge_rtnode *);
 334 static void     bridge_rtnode_destroy(struct bridge_softc *,
 335                     struct bridge_rtnode *);
 336 static void     bridge_rtable_expire(struct ifnet *, int);
 337 static void     bridge_state_change(struct ifnet *, int);
 338
 339 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 340                     const char *name);
 341 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 342                     struct ifnet *ifp);
 343 static void     bridge_delete_member(struct bridge_softc *,
 344                     struct bridge_iflist *, int);
 345 static void     bridge_delete_span(struct bridge_softc *,
 346                     struct bridge_iflist *);
 347
 348 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 349 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 350 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 351 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 352 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 353 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 354 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 355 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 356 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 357 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 358 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 359 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 360 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 361 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 362 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 363 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 364 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 365 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 366 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 367 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 368 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 369 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 370 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 371 static int      bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *);
 372 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 373 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 374 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
 375 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
 376 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
 377 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
 378 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
 379 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 380                     int);
 381 static int      bridge_ip_checkbasic(struct mbuf **mp);
 382 #ifdef INET6
 383 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 384 #endif /* INET6 */
 385 static int      bridge_fragment(struct ifnet *, struct mbuf **mp,
 386                     struct ether_header *, int, struct llc *);
 387 static void     bridge_linkstate(struct ifnet *ifp);
 388 static void     bridge_linkcheck(struct bridge_softc *sc);
 389
 390 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
 391 #define VLANTAGOF(_m)   \
 392     (_m->m_flags & M_VLANTAG) ? EVL_VLANOFTAG(_m->m_pkthdr.ether_vtag) : 1
 393
 394 static struct bstp_cb_ops bridge_ops = {
 395         .bcb_state = bridge_state_change,
 396         .bcb_rtage = bridge_rtable_expire
 397 };
 398
 399 SYSCTL_DECL(_net_link);
 400 static SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
 401     "Bridge");
 402
 403 /* only pass IP[46] packets when pfil is enabled */
 404 VNET_DEFINE_STATIC(int, pfil_onlyip) = 1;
 405 #define V_pfil_onlyip   VNET(pfil_onlyip)
 406 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip,
 407     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_onlyip), 0,
 408     "Only pass IP packets when pfil is enabled");
 409
 410 /* run pfil hooks on the bridge interface */
 411 VNET_DEFINE_STATIC(int, pfil_bridge) = 0;
 412 #define V_pfil_bridge   VNET(pfil_bridge)
 413 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge,
 414     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_bridge), 0,
 415     "Packet filter on the bridge interface");
 416
 417 /* layer2 filter with ipfw */
 418 VNET_DEFINE_STATIC(int, pfil_ipfw);
 419 #define V_pfil_ipfw     VNET(pfil_ipfw)
 420
 421 /* layer2 ARP filter with ipfw */
 422 VNET_DEFINE_STATIC(int, pfil_ipfw_arp);
 423 #define V_pfil_ipfw_arp VNET(pfil_ipfw_arp)
 424 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp,
 425     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_ipfw_arp), 0,
 426     "Filter ARP packets through IPFW layer2");
 427
 428 /* run pfil hooks on the member interface */
 429 VNET_DEFINE_STATIC(int, pfil_member) = 0;
 430 #define V_pfil_member   VNET(pfil_member)
 431 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member,
 432     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_member), 0,
 433     "Packet filter on the member interface");
 434
 435 /* run pfil hooks on the physical interface for locally destined packets */
 436 VNET_DEFINE_STATIC(int, pfil_local_phys);
 437 #define V_pfil_local_phys       VNET(pfil_local_phys)
 438 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys,
 439     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(pfil_local_phys), 0,
 440     "Packet filter on the physical interface for locally destined packets");
 441
 442 /* log STP state changes */
 443 VNET_DEFINE_STATIC(int, log_stp);
 444 #define V_log_stp       VNET(log_stp)
 445 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp,
 446     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(log_stp), 0,
 447     "Log STP state changes");
 448
 449 /* share MAC with first bridge member */
 450 VNET_DEFINE_STATIC(int, bridge_inherit_mac);
 451 #define V_bridge_inherit_mac    VNET(bridge_inherit_mac)
 452 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac,
 453     CTLFLAG_RWTUN | CTLFLAG_VNET, &VNET_NAME(bridge_inherit_mac), 0,
 454     "Inherit MAC address from the first bridge member");
 455
 456 VNET_DEFINE_STATIC(int, allow_llz_overlap) = 0;
 457 #define V_allow_llz_overlap     VNET(allow_llz_overlap)
 458 SYSCTL_INT(_net_link_bridge, OID_AUTO, allow_llz_overlap,
 459     CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(allow_llz_overlap), 0,
 460     "Allow overlap of link-local scope "
 461     "zones of a bridge interface and the member interfaces");
 462
 463 struct bridge_control {
 464         int     (*bc_func)(struct bridge_softc *, void *);
 465         int     bc_argsize;
 466         int     bc_flags;
 467 };
 468
 469 #define BC_F_COPYIN             0x01    /* copy arguments in */
 470 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 471 #define BC_F_SUSER              0x04    /* do super-user check */
 472
 473 static const struct bridge_control bridge_control_table[] = {
 474         { bridge_ioctl_add,             sizeof(struct ifbreq),
 475           BC_F_COPYIN|BC_F_SUSER },
 476         { bridge_ioctl_del,             sizeof(struct ifbreq),
 477           BC_F_COPYIN|BC_F_SUSER },
 478
 479         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 480           BC_F_COPYIN|BC_F_COPYOUT },
 481         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 482           BC_F_COPYIN|BC_F_SUSER },
 483
 484         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 485           BC_F_COPYIN|BC_F_SUSER },
 486         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 487           BC_F_COPYOUT },
 488
 489         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 490           BC_F_COPYIN|BC_F_COPYOUT },
 491         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 492           BC_F_COPYIN|BC_F_COPYOUT },
 493
 494         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 495           BC_F_COPYIN|BC_F_SUSER },
 496
 497         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 498           BC_F_COPYIN|BC_F_SUSER },
 499         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 500           BC_F_COPYOUT },
 501
 502         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 503           BC_F_COPYIN|BC_F_SUSER },
 504
 505         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 506           BC_F_COPYIN|BC_F_SUSER },
 507
 508         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 509           BC_F_COPYOUT },
 510         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 511           BC_F_COPYIN|BC_F_SUSER },
 512
 513         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 514           BC_F_COPYOUT },
 515         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 516           BC_F_COPYIN|BC_F_SUSER },
 517
 518         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 519           BC_F_COPYOUT },
 520         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 521           BC_F_COPYIN|BC_F_SUSER },
 522
 523         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 524           BC_F_COPYOUT },
 525         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 526           BC_F_COPYIN|BC_F_SUSER },
 527
 528         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 529           BC_F_COPYIN|BC_F_SUSER },
 530
 531         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 532           BC_F_COPYIN|BC_F_SUSER },
 533
 534         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 535           BC_F_COPYIN|BC_F_SUSER },
 536         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 537           BC_F_COPYIN|BC_F_SUSER },
 538
 539         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
 540           BC_F_COPYOUT },
 541
 542         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
 543           BC_F_COPYOUT },
 544
 545         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
 546           BC_F_COPYIN|BC_F_COPYOUT },
 547
 548         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
 549           BC_F_COPYIN|BC_F_SUSER },
 550
 551         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
 552           BC_F_COPYIN|BC_F_SUSER },
 553
 554         { bridge_ioctl_sifmaxaddr,      sizeof(struct ifbreq),
 555           BC_F_COPYIN|BC_F_SUSER },
 556
 557 };
 558 static const int bridge_control_table_size = nitems(bridge_control_table);
 559
 560 VNET_DEFINE_STATIC(LIST_HEAD(, bridge_softc), bridge_list);
 561 #define V_bridge_list   VNET(bridge_list)
 562 #define BRIDGE_LIST_LOCK_INIT(x)        sx_init(&V_bridge_list_sx,      \
 563                                             "if_bridge list")
 564 #define BRIDGE_LIST_LOCK_DESTROY(x)     sx_destroy(&V_bridge_list_sx)
 565 #define BRIDGE_LIST_LOCK(x)             sx_xlock(&V_bridge_list_sx)
 566 #define BRIDGE_LIST_UNLOCK(x)           sx_xunlock(&V_bridge_list_sx)
 567
 568 VNET_DEFINE_STATIC(struct if_clone *, bridge_cloner);
 569 #define V_bridge_cloner VNET(bridge_cloner)
 570
 571 static const char bridge_name[] = "bridge";
 572
 573 static void
 574 vnet_bridge_init(const void *unused __unused)
 575 {
 576
 577         V_bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
 578             sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
 579             UMA_ALIGN_PTR, 0);
 580         BRIDGE_LIST_LOCK_INIT();
 581         LIST_INIT(&V_bridge_list);
 582
 583         struct if_clone_addreq req = {
 584                 .create_f = bridge_clone_create,
 585                 .destroy_f = bridge_clone_destroy,
 586                 .flags = IFC_F_AUTOUNIT,
 587         };
 588         V_bridge_cloner = ifc_attach_cloner(bridge_name, &req);
 589 }
 590 VNET_SYSINIT(vnet_bridge_init, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
 591     vnet_bridge_init, NULL);
 592
 593 static void
 594 vnet_bridge_uninit(const void *unused __unused)
 595 {
 596
 597         ifc_detach_cloner(V_bridge_cloner);
 598         V_bridge_cloner = NULL;
 599         BRIDGE_LIST_LOCK_DESTROY();
 600
 601         /* Callbacks may use the UMA zone. */
 602         NET_EPOCH_DRAIN_CALLBACKS();
 603
 604         uma_zdestroy(V_bridge_rtnode_zone);
 605 }
 606 VNET_SYSUNINIT(vnet_bridge_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY,
 607     vnet_bridge_uninit, NULL);
 608
 609 static int
 610 bridge_modevent(module_t mod, int type, void *data)
 611 {
 612
 613         switch (type) {
 614         case MOD_LOAD:
 615                 bridge_dn_p = bridge_dummynet;
 616                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 617                     ifnet_departure_event, bridge_ifdetach, NULL,
 618                     EVENTHANDLER_PRI_ANY);
 619                 break;
 620         case MOD_UNLOAD:
 621                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
 622                     bridge_detach_cookie);
 623                 bridge_dn_p = NULL;
 624                 break;
 625         default:
 626                 return (EOPNOTSUPP);
 627         }
 628         return (0);
 629 }
 630
 631 static moduledata_t bridge_mod = {
 632         "if_bridge",
 633         bridge_modevent,
 634         0
 635 };
 636
 637 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 638 MODULE_VERSION(if_bridge, 1);
 639 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
 640
 641 /*
 642  * handler for net.link.bridge.ipfw
 643  */
 644 static int
 645 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
 646 {
 647         int enable = V_pfil_ipfw;
 648         int error;
 649
 650         error = sysctl_handle_int(oidp, &enable, 0, req);
 651         enable &= 1;
 652
 653         if (enable != V_pfil_ipfw) {
 654                 V_pfil_ipfw = enable;
 655
 656                 /*
 657                  * Disable pfil so that ipfw doesnt run twice, if the user
 658                  * really wants both then they can re-enable pfil_bridge and/or
 659                  * pfil_member. Also allow non-ip packets as ipfw can filter by
 660                  * layer2 type.
 661                  */
 662                 if (V_pfil_ipfw) {
 663                         V_pfil_onlyip = 0;
 664                         V_pfil_bridge = 0;
 665                         V_pfil_member = 0;
 666                 }
 667         }
 668
 669         return (error);
 670 }
 671 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw,
 672     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_VNET | CTLFLAG_NEEDGIANT,
 673     &VNET_NAME(pfil_ipfw), 0, &sysctl_pfil_ipfw, "I",
 674     "Layer2 filter with IPFW");
 675
 676 #ifdef VIMAGE
 677 static void
 678 bridge_reassign(struct ifnet *ifp, struct vnet *newvnet, char *arg)
 679 {
 680         struct bridge_softc *sc = ifp->if_softc;
 681         struct bridge_iflist *bif;
 682
 683         BRIDGE_LOCK(sc);
 684
 685         while ((bif = CK_LIST_FIRST(&sc->sc_iflist)) != NULL)
 686                 bridge_delete_member(sc, bif, 0);
 687
 688         while ((bif = CK_LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 689                 bridge_delete_span(sc, bif);
 690         }
 691
 692         BRIDGE_UNLOCK(sc);
 693
 694         ether_reassign(ifp, newvnet, arg);
 695 }
 696 #endif
 697
 698 /*
 699  * bridge_clone_create:
 700  *
 701  *      Create a new bridge instance.
 702  */
 703 static int
 704 bridge_clone_create(struct if_clone *ifc, char *name, size_t len,
 705     struct ifc_data *ifd, struct ifnet **ifpp)
 706 {
 707         struct bridge_softc *sc;
 708         struct ifnet *ifp;
 709
 710         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 711         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 712         if (ifp == NULL) {
 713                 free(sc, M_DEVBUF);
 714                 return (ENOSPC);
 715         }
 716
 717         BRIDGE_LOCK_INIT(sc);
 718         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 719         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 720
 721         /* Initialize our routing table. */
 722         bridge_rtable_init(sc);
 723
 724         callout_init_mtx(&sc->sc_brcallout, &sc->sc_rt_mtx, 0);
 725
 726         CK_LIST_INIT(&sc->sc_iflist);
 727         CK_LIST_INIT(&sc->sc_spanlist);
 728
 729         ifp->if_softc = sc;
 730         if_initname(ifp, bridge_name, ifd->unit);
 731         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 732         ifp->if_ioctl = bridge_ioctl;
 733 #ifdef ALTQ
 734         ifp->if_start = bridge_altq_start;
 735         ifp->if_transmit = bridge_altq_transmit;
 736         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 737         ifp->if_snd.ifq_drv_maxlen = 0;
 738         IFQ_SET_READY(&ifp->if_snd);
 739 #else
 740         ifp->if_transmit = bridge_transmit;
 741 #endif
 742         ifp->if_qflush = bridge_qflush;
 743         ifp->if_init = bridge_init;
 744         ifp->if_type = IFT_BRIDGE;
 745
 746         ether_gen_addr(ifp, &sc->sc_defaddr);
 747
 748         bstp_attach(&sc->sc_stp, &bridge_ops);
 749         ether_ifattach(ifp, sc->sc_defaddr.octet);
 750         /* Now undo some of the damage... */
 751         ifp->if_baudrate = 0;
 752         ifp->if_type = IFT_BRIDGE;
 753 #ifdef VIMAGE
 754         ifp->if_reassign = bridge_reassign;
 755 #endif
 756
 757         BRIDGE_LIST_LOCK();
 758         LIST_INSERT_HEAD(&V_bridge_list, sc, sc_list);
 759         BRIDGE_LIST_UNLOCK();
 760         *ifpp = ifp;
 761
 762         return (0);
 763 }
 764
 765 static void
 766 bridge_clone_destroy_cb(struct epoch_context *ctx)
 767 {
 768         struct bridge_softc *sc;
 769
 770         sc = __containerof(ctx, struct bridge_softc, sc_epoch_ctx);
 771
 772         BRIDGE_LOCK_DESTROY(sc);
 773         free(sc, M_DEVBUF);
 774 }
 775
 776 /*
 777  * bridge_clone_destroy:
 778  *
 779  *      Destroy a bridge instance.
 780  */
 781 static int
 782 bridge_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
 783 {
 784         struct bridge_softc *sc = ifp->if_softc;
 785         struct bridge_iflist *bif;
 786         struct epoch_tracker et;
 787
 788         BRIDGE_LOCK(sc);
 789
 790         bridge_stop(ifp, 1);
 791         ifp->if_flags &= ~IFF_UP;
 792
 793         while ((bif = CK_LIST_FIRST(&sc->sc_iflist)) != NULL)
 794                 bridge_delete_member(sc, bif, 0);
 795
 796         while ((bif = CK_LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 797                 bridge_delete_span(sc, bif);
 798         }
 799
 800         /* Tear down the routing table. */
 801         bridge_rtable_fini(sc);
 802
 803         BRIDGE_UNLOCK(sc);
 804
 805         NET_EPOCH_ENTER(et);
 806
 807         callout_drain(&sc->sc_brcallout);
 808
 809         BRIDGE_LIST_LOCK();
 810         LIST_REMOVE(sc, sc_list);
 811         BRIDGE_LIST_UNLOCK();
 812
 813         bstp_detach(&sc->sc_stp);
 814 #ifdef ALTQ
 815         IFQ_PURGE(&ifp->if_snd);
 816 #endif
 817         NET_EPOCH_EXIT(et);
 818
 819         ether_ifdetach(ifp);
 820         if_free(ifp);
 821
 822         NET_EPOCH_CALL(bridge_clone_destroy_cb, &sc->sc_epoch_ctx);
 823
 824         return (0);
 825 }
 826
 827 /*
 828  * bridge_ioctl:
 829  *
 830  *      Handle a control request from the operator.
 831  */
 832 static int
 833 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 834 {
 835         struct bridge_softc *sc = ifp->if_softc;
 836         struct ifreq *ifr = (struct ifreq *)data;
 837         struct bridge_iflist *bif;
 838         struct thread *td = curthread;
 839         union {
 840                 struct ifbreq ifbreq;
 841                 struct ifbifconf ifbifconf;
 842                 struct ifbareq ifbareq;
 843                 struct ifbaconf ifbaconf;
 844                 struct ifbrparam ifbrparam;
 845                 struct ifbropreq ifbropreq;
 846         } args;
 847         struct ifdrv *ifd = (struct ifdrv *) data;
 848         const struct bridge_control *bc;
 849         int error = 0, oldmtu;
 850
 851         BRIDGE_LOCK(sc);
 852
 853         switch (cmd) {
 854         case SIOCADDMULTI:
 855         case SIOCDELMULTI:
 856                 break;
 857
 858         case SIOCGDRVSPEC:
 859         case SIOCSDRVSPEC:
 860                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 861                         error = EINVAL;
 862                         break;
 863                 }
 864                 bc = &bridge_control_table[ifd->ifd_cmd];
 865
 866                 if (cmd == SIOCGDRVSPEC &&
 867                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 868                         error = EINVAL;
 869                         break;
 870                 }
 871                 else if (cmd == SIOCSDRVSPEC &&
 872                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 873                         error = EINVAL;
 874                         break;
 875                 }
 876
 877                 if (bc->bc_flags & BC_F_SUSER) {
 878                         error = priv_check(td, PRIV_NET_BRIDGE);
 879                         if (error)
 880                                 break;
 881                 }
 882
 883                 if (ifd->ifd_len != bc->bc_argsize ||
 884                     ifd->ifd_len > sizeof(args)) {
 885                         error = EINVAL;
 886                         break;
 887                 }
 888
 889                 bzero(&args, sizeof(args));
 890                 if (bc->bc_flags & BC_F_COPYIN) {
 891                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 892                         if (error)
 893                                 break;
 894                 }
 895
 896                 oldmtu = ifp->if_mtu;
 897                 error = (*bc->bc_func)(sc, &args);
 898                 if (error)
 899                         break;
 900
 901                 /*
 902                  * Bridge MTU may change during addition of the first port.
 903                  * If it did, do network layer specific procedure.
 904                  */
 905                 if (ifp->if_mtu != oldmtu)
 906                         if_notifymtu(ifp);
 907
 908                 if (bc->bc_flags & BC_F_COPYOUT)
 909                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 910
 911                 break;
 912
 913         case SIOCSIFFLAGS:
 914                 if (!(ifp->if_flags & IFF_UP) &&
 915                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 916                         /*
 917                          * If interface is marked down and it is running,
 918                          * then stop and disable it.
 919                          */
 920                         bridge_stop(ifp, 1);
 921                 } else if ((ifp->if_flags & IFF_UP) &&
 922                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
 923                         /*
 924                          * If interface is marked up and it is stopped, then
 925                          * start it.
 926                          */
 927                         BRIDGE_UNLOCK(sc);
 928                         (*ifp->if_init)(sc);
 929                         BRIDGE_LOCK(sc);
 930                 }
 931                 break;
 932
 933         case SIOCSIFMTU:
 934                 oldmtu = sc->sc_ifp->if_mtu;
 935
 936                 if (ifr->ifr_mtu < 576) {
 937                         error = EINVAL;
 938                         break;
 939                 }
 940                 if (CK_LIST_EMPTY(&sc->sc_iflist)) {
 941                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 942                         break;
 943                 }
 944                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 945                         error = (*bif->bif_ifp->if_ioctl)(bif->bif_ifp,
 946                             SIOCSIFMTU, (caddr_t)ifr);
 947                         if (error != 0) {
 948                                 log(LOG_NOTICE, "%s: invalid MTU: %u for"
 949                                     " member %s\n", sc->sc_ifp->if_xname,
 950                                     ifr->ifr_mtu,
 951                                     bif->bif_ifp->if_xname);
 952                                 error = EINVAL;
 953                                 break;
 954                         }
 955                 }
 956                 if (error) {
 957                         /* Restore the previous MTU on all member interfaces. */
 958                         ifr->ifr_mtu = oldmtu;
 959                         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 960                                 (*bif->bif_ifp->if_ioctl)(bif->bif_ifp,
 961                                     SIOCSIFMTU, (caddr_t)ifr);
 962                         }
 963                 } else {
 964                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
 965                 }
 966                 break;
 967         default:
 968                 /*
 969                  * drop the lock as ether_ioctl() will call bridge_start() and
 970                  * cause the lock to be recursed.
 971                  */
 972                 BRIDGE_UNLOCK(sc);
 973                 error = ether_ioctl(ifp, cmd, data);
 974                 BRIDGE_LOCK(sc);
 975                 break;
 976         }
 977
 978         BRIDGE_UNLOCK(sc);
 979
 980         return (error);
 981 }
 982
 983 /*
 984  * bridge_mutecaps:
 985  *
 986  *      Clear or restore unwanted capabilities on the member interface
 987  */
 988 static void
 989 bridge_mutecaps(struct bridge_softc *sc)
 990 {
 991         struct bridge_iflist *bif;
 992         int enabled, mask;
 993
 994         BRIDGE_LOCK_ASSERT(sc);
 995
 996         /* Initial bitmask of capabilities to test */
 997         mask = BRIDGE_IFCAPS_MASK;
 998
 999         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1000                 /* Every member must support it or its disabled */
1001                 mask &= bif->bif_savedcaps;
1002         }
1003
1004         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1005                 enabled = bif->bif_ifp->if_capenable;
1006                 enabled &= ~BRIDGE_IFCAPS_STRIP;
1007                 /* strip off mask bits and enable them again if allowed */
1008                 enabled &= ~BRIDGE_IFCAPS_MASK;
1009                 enabled |= mask;
1010                 bridge_set_ifcap(sc, bif, enabled);
1011         }
1012 }
1013
1014 static void
1015 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
1016 {
1017         struct ifnet *ifp = bif->bif_ifp;
1018         struct ifreq ifr;
1019         int error, mask, stuck;
1020
1021         bzero(&ifr, sizeof(ifr));
1022         ifr.ifr_reqcap = set;
1023
1024         if (ifp->if_capenable != set) {
1025                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
1026                 if (error)
1027                         if_printf(sc->sc_ifp,
1028                             "error setting capabilities on %s: %d\n",
1029                             ifp->if_xname, error);
1030                 mask = BRIDGE_IFCAPS_MASK | BRIDGE_IFCAPS_STRIP;
1031                 stuck = ifp->if_capenable & mask & ~set;
1032                 if (stuck != 0)
1033                         if_printf(sc->sc_ifp,
1034                             "can't disable some capabilities on %s: 0x%x\n",
1035                             ifp->if_xname, stuck);
1036         }
1037 }
1038
1039 /*
1040  * bridge_lookup_member:
1041  *
1042  *      Lookup a bridge member interface.
1043  */
1044 static struct bridge_iflist *
1045 bridge_lookup_member(struct bridge_softc *sc, const char *name)
1046 {
1047         struct bridge_iflist *bif;
1048         struct ifnet *ifp;
1049
1050         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
1051
1052         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1053                 ifp = bif->bif_ifp;
1054                 if (strcmp(ifp->if_xname, name) == 0)
1055                         return (bif);
1056         }
1057
1058         return (NULL);
1059 }
1060
1061 /*
1062  * bridge_lookup_member_if:
1063  *
1064  *      Lookup a bridge member interface by ifnet*.
1065  */
1066 static struct bridge_iflist *
1067 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
1068 {
1069         struct bridge_iflist *bif;
1070
1071         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
1072
1073         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1074                 if (bif->bif_ifp == member_ifp)
1075                         return (bif);
1076         }
1077
1078         return (NULL);
1079 }
1080
1081 static void
1082 bridge_delete_member_cb(struct epoch_context *ctx)
1083 {
1084         struct bridge_iflist *bif;
1085
1086         bif = __containerof(ctx, struct bridge_iflist, bif_epoch_ctx);
1087
1088         free(bif, M_DEVBUF);
1089 }
1090
1091 /*
1092  * bridge_delete_member:
1093  *
1094  *      Delete the specified member interface.
1095  */
1096 static void
1097 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
1098     int gone)
1099 {
1100         struct ifnet *ifs = bif->bif_ifp;
1101         struct ifnet *fif = NULL;
1102         struct bridge_iflist *bifl;
1103
1104         BRIDGE_LOCK_ASSERT(sc);
1105
1106         if (bif->bif_flags & IFBIF_STP)
1107                 bstp_disable(&bif->bif_stp);
1108
1109         ifs->if_bridge = NULL;
1110         CK_LIST_REMOVE(bif, bif_next);
1111
1112         /*
1113          * If removing the interface that gave the bridge its mac address, set
1114          * the mac address of the bridge to the address of the next member, or
1115          * to its default address if no members are left.
1116          */
1117         if (V_bridge_inherit_mac && sc->sc_ifaddr == ifs) {
1118                 if (CK_LIST_EMPTY(&sc->sc_iflist)) {
1119                         bcopy(&sc->sc_defaddr,
1120                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1121                         sc->sc_ifaddr = NULL;
1122                 } else {
1123                         bifl = CK_LIST_FIRST(&sc->sc_iflist);
1124                         fif = bifl->bif_ifp;
1125                         bcopy(IF_LLADDR(fif),
1126                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1127                         sc->sc_ifaddr = fif;
1128                 }
1129                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1130         }
1131
1132         bridge_linkcheck(sc);
1133         bridge_mutecaps(sc);    /* recalcuate now this interface is removed */
1134         BRIDGE_RT_LOCK(sc);
1135         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
1136         BRIDGE_RT_UNLOCK(sc);
1137         KASSERT(bif->bif_addrcnt == 0,
1138             ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
1139
1140         ifs->if_bridge_output = NULL;
1141         ifs->if_bridge_input = NULL;
1142         ifs->if_bridge_linkstate = NULL;
1143         if (!gone) {
1144                 switch (ifs->if_type) {
1145                 case IFT_ETHER:
1146                 case IFT_L2VLAN:
1147                         /*
1148                          * Take the interface out of promiscuous mode, but only
1149                          * if it was promiscuous in the first place. It might
1150                          * not be if we're in the bridge_ioctl_add() error path.
1151                          */
1152                         if (ifs->if_flags & IFF_PROMISC)
1153                                 (void) ifpromisc(ifs, 0);
1154                         break;
1155
1156                 case IFT_GIF:
1157                         break;
1158
1159                 default:
1160 #ifdef DIAGNOSTIC
1161                         panic("bridge_delete_member: impossible");
1162 #endif
1163                         break;
1164                 }
1165                 /* reneable any interface capabilities */
1166                 bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
1167         }
1168         bstp_destroy(&bif->bif_stp);    /* prepare to free */
1169
1170         NET_EPOCH_CALL(bridge_delete_member_cb, &bif->bif_epoch_ctx);
1171 }
1172
1173 /*
1174  * bridge_delete_span:
1175  *
1176  *      Delete the specified span interface.
1177  */
1178 static void
1179 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
1180 {
1181         BRIDGE_LOCK_ASSERT(sc);
1182
1183         KASSERT(bif->bif_ifp->if_bridge == NULL,
1184             ("%s: not a span interface", __func__));
1185
1186         CK_LIST_REMOVE(bif, bif_next);
1187
1188         NET_EPOCH_CALL(bridge_delete_member_cb, &bif->bif_epoch_ctx);
1189 }
1190
1191 static int
1192 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
1193 {
1194         struct ifbreq *req = arg;
1195         struct bridge_iflist *bif = NULL;
1196         struct ifnet *ifs;
1197         int error = 0;
1198
1199         ifs = ifunit(req->ifbr_ifsname);
1200         if (ifs == NULL)
1201                 return (ENOENT);
1202         if (ifs->if_ioctl == NULL)      /* must be supported */
1203                 return (EINVAL);
1204
1205         /* If it's in the span list, it can't be a member. */
1206         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1207                 if (ifs == bif->bif_ifp)
1208                         return (EBUSY);
1209
1210         if (ifs->if_bridge == sc)
1211                 return (EEXIST);
1212
1213         if (ifs->if_bridge != NULL)
1214                 return (EBUSY);
1215
1216         switch (ifs->if_type) {
1217         case IFT_ETHER:
1218         case IFT_L2VLAN:
1219         case IFT_GIF:
1220                 /* permitted interface types */
1221                 break;
1222         default:
1223                 return (EINVAL);
1224         }
1225
1226 #ifdef INET6
1227         /*
1228          * Two valid inet6 addresses with link-local scope must not be
1229          * on the parent interface and the member interfaces at the
1230          * same time.  This restriction is needed to prevent violation
1231          * of link-local scope zone.  Attempts to add a member
1232          * interface which has inet6 addresses when the parent has
1233          * inet6 triggers removal of all inet6 addresses on the member
1234          * interface.
1235          */
1236
1237         /* Check if the parent interface has a link-local scope addr. */
1238         if (V_allow_llz_overlap == 0 &&
1239             in6ifa_llaonifp(sc->sc_ifp) != NULL) {
1240                 /*
1241                  * If any, remove all inet6 addresses from the member
1242                  * interfaces.
1243                  */
1244                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1245                         if (in6ifa_llaonifp(bif->bif_ifp)) {
1246                                 in6_ifdetach(bif->bif_ifp);
1247                                 if_printf(sc->sc_ifp,
1248                                     "IPv6 addresses on %s have been removed "
1249                                     "before adding it as a member to prevent "
1250                                     "IPv6 address scope violation.\n",
1251                                     bif->bif_ifp->if_xname);
1252                         }
1253                 }
1254                 if (in6ifa_llaonifp(ifs)) {
1255                         in6_ifdetach(ifs);
1256                         if_printf(sc->sc_ifp,
1257                             "IPv6 addresses on %s have been removed "
1258                             "before adding it as a member to prevent "
1259                             "IPv6 address scope violation.\n",
1260                             ifs->if_xname);
1261                 }
1262         }
1263 #endif
1264         /* Allow the first Ethernet member to define the MTU */
1265         if (CK_LIST_EMPTY(&sc->sc_iflist))
1266                 sc->sc_ifp->if_mtu = ifs->if_mtu;
1267         else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
1268                 struct ifreq ifr;
1269
1270                 snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s",
1271                     ifs->if_xname);
1272                 ifr.ifr_mtu = sc->sc_ifp->if_mtu;
1273
1274                 error = (*ifs->if_ioctl)(ifs,
1275                     SIOCSIFMTU, (caddr_t)&ifr);
1276                 if (error != 0) {
1277                         log(LOG_NOTICE, "%s: invalid MTU: %u for"
1278                             " new member %s\n", sc->sc_ifp->if_xname,
1279                             ifr.ifr_mtu,
1280                             ifs->if_xname);
1281                         return (EINVAL);
1282                 }
1283         }
1284
1285         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1286         if (bif == NULL)
1287                 return (ENOMEM);
1288
1289         bif->bif_ifp = ifs;
1290         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
1291         bif->bif_savedcaps = ifs->if_capenable;
1292
1293         /*
1294          * Assign the interface's MAC address to the bridge if it's the first
1295          * member and the MAC address of the bridge has not been changed from
1296          * the default randomly generated one.
1297          */
1298         if (V_bridge_inherit_mac && CK_LIST_EMPTY(&sc->sc_iflist) &&
1299             !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr.octet, ETHER_ADDR_LEN)) {
1300                 bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1301                 sc->sc_ifaddr = ifs;
1302                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1303         }
1304
1305         ifs->if_bridge = sc;
1306         ifs->if_bridge_output = bridge_output;
1307         ifs->if_bridge_input = bridge_input;
1308         ifs->if_bridge_linkstate = bridge_linkstate;
1309         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
1310         /*
1311          * XXX: XLOCK HERE!?!
1312          *
1313          * NOTE: insert_***HEAD*** should be safe for the traversals.
1314          */
1315         CK_LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
1316
1317         /* Set interface capabilities to the intersection set of all members */
1318         bridge_mutecaps(sc);
1319         bridge_linkcheck(sc);
1320
1321         /* Place the interface into promiscuous mode */
1322         switch (ifs->if_type) {
1323                 case IFT_ETHER:
1324                 case IFT_L2VLAN:
1325                         error = ifpromisc(ifs, 1);
1326                         break;
1327         }
1328
1329         if (error)
1330                 bridge_delete_member(sc, bif, 0);
1331         return (error);
1332 }
1333
1334 static int
1335 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1336 {
1337         struct ifbreq *req = arg;
1338         struct bridge_iflist *bif;
1339
1340         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1341         if (bif == NULL)
1342                 return (ENOENT);
1343
1344         bridge_delete_member(sc, bif, 0);
1345
1346         return (0);
1347 }
1348
1349 static int
1350 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1351 {
1352         struct ifbreq *req = arg;
1353         struct bridge_iflist *bif;
1354         struct bstp_port *bp;
1355
1356         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1357         if (bif == NULL)
1358                 return (ENOENT);
1359
1360         bp = &bif->bif_stp;
1361         req->ifbr_ifsflags = bif->bif_flags;
1362         req->ifbr_state = bp->bp_state;
1363         req->ifbr_priority = bp->bp_priority;
1364         req->ifbr_path_cost = bp->bp_path_cost;
1365         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1366         req->ifbr_proto = bp->bp_protover;
1367         req->ifbr_role = bp->bp_role;
1368         req->ifbr_stpflags = bp->bp_flags;
1369         req->ifbr_addrcnt = bif->bif_addrcnt;
1370         req->ifbr_addrmax = bif->bif_addrmax;
1371         req->ifbr_addrexceeded = bif->bif_addrexceeded;
1372
1373         /* Copy STP state options as flags */
1374         if (bp->bp_operedge)
1375                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1376         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1377                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1378         if (bp->bp_ptp_link)
1379                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1380         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1381                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1382         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1383                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1384         if (bp->bp_flags & BSTP_PORT_ADMCOST)
1385                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1386         return (0);
1387 }
1388
1389 static int
1390 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1391 {
1392         struct epoch_tracker et;
1393         struct ifbreq *req = arg;
1394         struct bridge_iflist *bif;
1395         struct bstp_port *bp;
1396         int error;
1397
1398         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1399         if (bif == NULL)
1400                 return (ENOENT);
1401         bp = &bif->bif_stp;
1402
1403         if (req->ifbr_ifsflags & IFBIF_SPAN)
1404                 /* SPAN is readonly */
1405                 return (EINVAL);
1406
1407         NET_EPOCH_ENTER(et);
1408
1409         if (req->ifbr_ifsflags & IFBIF_STP) {
1410                 if ((bif->bif_flags & IFBIF_STP) == 0) {
1411                         error = bstp_enable(&bif->bif_stp);
1412                         if (error) {
1413                                 NET_EPOCH_EXIT(et);
1414                                 return (error);
1415                         }
1416                 }
1417         } else {
1418                 if ((bif->bif_flags & IFBIF_STP) != 0)
1419                         bstp_disable(&bif->bif_stp);
1420         }
1421
1422         /* Pass on STP flags */
1423         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1424         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1425         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1426         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1427
1428         /* Save the bits relating to the bridge */
1429         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1430
1431         NET_EPOCH_EXIT(et);
1432
1433         return (0);
1434 }
1435
1436 static int
1437 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1438 {
1439         struct ifbrparam *param = arg;
1440
1441         sc->sc_brtmax = param->ifbrp_csize;
1442         bridge_rttrim(sc);
1443
1444         return (0);
1445 }
1446
1447 static int
1448 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1449 {
1450         struct ifbrparam *param = arg;
1451
1452         param->ifbrp_csize = sc->sc_brtmax;
1453
1454         return (0);
1455 }
1456
1457 static int
1458 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1459 {
1460         struct ifbifconf *bifc = arg;
1461         struct bridge_iflist *bif;
1462         struct ifbreq breq;
1463         char *buf, *outbuf;
1464         int count, buflen, len, error = 0;
1465
1466         count = 0;
1467         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1468                 count++;
1469         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1470                 count++;
1471
1472         buflen = sizeof(breq) * count;
1473         if (bifc->ifbic_len == 0) {
1474                 bifc->ifbic_len = buflen;
1475                 return (0);
1476         }
1477         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1478         if (outbuf == NULL)
1479                 return (ENOMEM);
1480
1481         count = 0;
1482         buf = outbuf;
1483         len = min(bifc->ifbic_len, buflen);
1484         bzero(&breq, sizeof(breq));
1485         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1486                 if (len < sizeof(breq))
1487                         break;
1488
1489                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1490                     sizeof(breq.ifbr_ifsname));
1491                 /* Fill in the ifbreq structure */
1492                 error = bridge_ioctl_gifflags(sc, &breq);
1493                 if (error)
1494                         break;
1495                 memcpy(buf, &breq, sizeof(breq));
1496                 count++;
1497                 buf += sizeof(breq);
1498                 len -= sizeof(breq);
1499         }
1500         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1501                 if (len < sizeof(breq))
1502                         break;
1503
1504                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1505                     sizeof(breq.ifbr_ifsname));
1506                 breq.ifbr_ifsflags = bif->bif_flags;
1507                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1508                 memcpy(buf, &breq, sizeof(breq));
1509                 count++;
1510                 buf += sizeof(breq);
1511                 len -= sizeof(breq);
1512         }
1513
1514         bifc->ifbic_len = sizeof(breq) * count;
1515         error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
1516         free(outbuf, M_TEMP);
1517         return (error);
1518 }
1519
1520 static int
1521 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1522 {
1523         struct ifbaconf *bac = arg;
1524         struct bridge_rtnode *brt;
1525         struct ifbareq bareq;
1526         char *buf, *outbuf;
1527         int count, buflen, len, error = 0;
1528
1529         if (bac->ifbac_len == 0)
1530                 return (0);
1531
1532         count = 0;
1533         CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
1534                 count++;
1535         buflen = sizeof(bareq) * count;
1536
1537         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1538         if (outbuf == NULL)
1539                 return (ENOMEM);
1540
1541         count = 0;
1542         buf = outbuf;
1543         len = min(bac->ifbac_len, buflen);
1544         bzero(&bareq, sizeof(bareq));
1545         CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1546                 if (len < sizeof(bareq))
1547                         goto out;
1548                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1549                     sizeof(bareq.ifba_ifsname));
1550                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1551                 bareq.ifba_vlan = brt->brt_vlan;
1552                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1553                                 time_uptime < brt->brt_expire)
1554                         bareq.ifba_expire = brt->brt_expire - time_uptime;
1555                 else
1556                         bareq.ifba_expire = 0;
1557                 bareq.ifba_flags = brt->brt_flags;
1558
1559                 memcpy(buf, &bareq, sizeof(bareq));
1560                 count++;
1561                 buf += sizeof(bareq);
1562                 len -= sizeof(bareq);
1563         }
1564 out:
1565         bac->ifbac_len = sizeof(bareq) * count;
1566         error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
1567         free(outbuf, M_TEMP);
1568         return (error);
1569 }
1570
1571 static int
1572 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1573 {
1574         struct ifbareq *req = arg;
1575         struct bridge_iflist *bif;
1576         struct epoch_tracker et;
1577         int error;
1578
1579         NET_EPOCH_ENTER(et);
1580         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1581         if (bif == NULL) {
1582                 NET_EPOCH_EXIT(et);
1583                 return (ENOENT);
1584         }
1585
1586         /* bridge_rtupdate() may acquire the lock. */
1587         error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
1588             req->ifba_flags);
1589         NET_EPOCH_EXIT(et);
1590
1591         return (error);
1592 }
1593
1594 static int
1595 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1596 {
1597         struct ifbrparam *param = arg;
1598
1599         sc->sc_brttimeout = param->ifbrp_ctime;
1600         return (0);
1601 }
1602
1603 static int
1604 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1605 {
1606         struct ifbrparam *param = arg;
1607
1608         param->ifbrp_ctime = sc->sc_brttimeout;
1609         return (0);
1610 }
1611
1612 static int
1613 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1614 {
1615         struct ifbareq *req = arg;
1616
1617         return (bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan));
1618 }
1619
1620 static int
1621 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1622 {
1623         struct ifbreq *req = arg;
1624
1625         BRIDGE_RT_LOCK(sc);
1626         bridge_rtflush(sc, req->ifbr_ifsflags);
1627         BRIDGE_RT_UNLOCK(sc);
1628
1629         return (0);
1630 }
1631
1632 static int
1633 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1634 {
1635         struct ifbrparam *param = arg;
1636         struct bstp_state *bs = &sc->sc_stp;
1637
1638         param->ifbrp_prio = bs->bs_bridge_priority;
1639         return (0);
1640 }
1641
1642 static int
1643 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1644 {
1645         struct ifbrparam *param = arg;
1646
1647         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1648 }
1649
1650 static int
1651 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1652 {
1653         struct ifbrparam *param = arg;
1654         struct bstp_state *bs = &sc->sc_stp;
1655
1656         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1657         return (0);
1658 }
1659
1660 static int
1661 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1662 {
1663         struct ifbrparam *param = arg;
1664
1665         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1666 }
1667
1668 static int
1669 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1670 {
1671         struct ifbrparam *param = arg;
1672         struct bstp_state *bs = &sc->sc_stp;
1673
1674         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1675         return (0);
1676 }
1677
1678 static int
1679 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1680 {
1681         struct ifbrparam *param = arg;
1682
1683         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1684 }
1685
1686 static int
1687 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1688 {
1689         struct ifbrparam *param = arg;
1690         struct bstp_state *bs = &sc->sc_stp;
1691
1692         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1693         return (0);
1694 }
1695
1696 static int
1697 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1698 {
1699         struct ifbrparam *param = arg;
1700
1701         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1702 }
1703
1704 static int
1705 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1706 {
1707         struct ifbreq *req = arg;
1708         struct bridge_iflist *bif;
1709
1710         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1711         if (bif == NULL)
1712                 return (ENOENT);
1713
1714         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1715 }
1716
1717 static int
1718 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1719 {
1720         struct ifbreq *req = arg;
1721         struct bridge_iflist *bif;
1722
1723         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1724         if (bif == NULL)
1725                 return (ENOENT);
1726
1727         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1728 }
1729
1730 static int
1731 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *arg)
1732 {
1733         struct ifbreq *req = arg;
1734         struct bridge_iflist *bif;
1735
1736         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1737         if (bif == NULL)
1738                 return (ENOENT);
1739
1740         bif->bif_addrmax = req->ifbr_addrmax;
1741         return (0);
1742 }
1743
1744 static int
1745 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1746 {
1747         struct ifbreq *req = arg;
1748         struct bridge_iflist *bif = NULL;
1749         struct ifnet *ifs;
1750
1751         ifs = ifunit(req->ifbr_ifsname);
1752         if (ifs == NULL)
1753                 return (ENOENT);
1754
1755         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1756                 if (ifs == bif->bif_ifp)
1757                         return (EBUSY);
1758
1759         if (ifs->if_bridge != NULL)
1760                 return (EBUSY);
1761
1762         switch (ifs->if_type) {
1763                 case IFT_ETHER:
1764                 case IFT_GIF:
1765                 case IFT_L2VLAN:
1766                         break;
1767                 default:
1768                         return (EINVAL);
1769         }
1770
1771         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1772         if (bif == NULL)
1773                 return (ENOMEM);
1774
1775         bif->bif_ifp = ifs;
1776         bif->bif_flags = IFBIF_SPAN;
1777
1778         CK_LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1779
1780         return (0);
1781 }
1782
1783 static int
1784 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1785 {
1786         struct ifbreq *req = arg;
1787         struct bridge_iflist *bif;
1788         struct ifnet *ifs;
1789
1790         ifs = ifunit(req->ifbr_ifsname);
1791         if (ifs == NULL)
1792                 return (ENOENT);
1793
1794         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1795                 if (ifs == bif->bif_ifp)
1796                         break;
1797
1798         if (bif == NULL)
1799                 return (ENOENT);
1800
1801         bridge_delete_span(sc, bif);
1802
1803         return (0);
1804 }
1805
1806 static int
1807 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1808 {
1809         struct ifbropreq *req = arg;
1810         struct bstp_state *bs = &sc->sc_stp;
1811         struct bstp_port *root_port;
1812
1813         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1814         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1815         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1816
1817         root_port = bs->bs_root_port;
1818         if (root_port == NULL)
1819                 req->ifbop_root_port = 0;
1820         else
1821                 req->ifbop_root_port = root_port->bp_ifp->if_index;
1822
1823         req->ifbop_holdcount = bs->bs_txholdcount;
1824         req->ifbop_priority = bs->bs_bridge_priority;
1825         req->ifbop_protocol = bs->bs_protover;
1826         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1827         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1828         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1829         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1830         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1831         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1832
1833         return (0);
1834 }
1835
1836 static int
1837 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1838 {
1839         struct ifbrparam *param = arg;
1840
1841         param->ifbrp_cexceeded = sc->sc_brtexceeded;
1842         return (0);
1843 }
1844
1845 static int
1846 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1847 {
1848         struct ifbpstpconf *bifstp = arg;
1849         struct bridge_iflist *bif;
1850         struct bstp_port *bp;
1851         struct ifbpstpreq bpreq;
1852         char *buf, *outbuf;
1853         int count, buflen, len, error = 0;
1854
1855         count = 0;
1856         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1857                 if ((bif->bif_flags & IFBIF_STP) != 0)
1858                         count++;
1859         }
1860
1861         buflen = sizeof(bpreq) * count;
1862         if (bifstp->ifbpstp_len == 0) {
1863                 bifstp->ifbpstp_len = buflen;
1864                 return (0);
1865         }
1866
1867         outbuf = malloc(buflen, M_TEMP, M_NOWAIT | M_ZERO);
1868         if (outbuf == NULL)
1869                 return (ENOMEM);
1870
1871         count = 0;
1872         buf = outbuf;
1873         len = min(bifstp->ifbpstp_len, buflen);
1874         bzero(&bpreq, sizeof(bpreq));
1875         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1876                 if (len < sizeof(bpreq))
1877                         break;
1878
1879                 if ((bif->bif_flags & IFBIF_STP) == 0)
1880                         continue;
1881
1882                 bp = &bif->bif_stp;
1883                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1884                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1885                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1886                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1887                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1888                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1889
1890                 memcpy(buf, &bpreq, sizeof(bpreq));
1891                 count++;
1892                 buf += sizeof(bpreq);
1893                 len -= sizeof(bpreq);
1894         }
1895
1896         bifstp->ifbpstp_len = sizeof(bpreq) * count;
1897         error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
1898         free(outbuf, M_TEMP);
1899         return (error);
1900 }
1901
1902 static int
1903 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1904 {
1905         struct ifbrparam *param = arg;
1906
1907         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1908 }
1909
1910 static int
1911 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1912 {
1913         struct ifbrparam *param = arg;
1914
1915         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1916 }
1917
1918 /*
1919  * bridge_ifdetach:
1920  *
1921  *      Detach an interface from a bridge.  Called when a member
1922  *      interface is detaching.
1923  */
1924 static void
1925 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1926 {
1927         struct bridge_softc *sc = ifp->if_bridge;
1928         struct bridge_iflist *bif;
1929
1930         if (ifp->if_flags & IFF_RENAMING)
1931                 return;
1932         if (V_bridge_cloner == NULL) {
1933                 /*
1934                  * This detach handler can be called after
1935                  * vnet_bridge_uninit().  Just return in that case.
1936                  */
1937                 return;
1938         }
1939         /* Check if the interface is a bridge member */
1940         if (sc != NULL) {
1941                 BRIDGE_LOCK(sc);
1942
1943                 bif = bridge_lookup_member_if(sc, ifp);
1944                 if (bif != NULL)
1945                         bridge_delete_member(sc, bif, 1);
1946
1947                 BRIDGE_UNLOCK(sc);
1948                 return;
1949         }
1950
1951         /* Check if the interface is a span port */
1952         BRIDGE_LIST_LOCK();
1953         LIST_FOREACH(sc, &V_bridge_list, sc_list) {
1954                 BRIDGE_LOCK(sc);
1955                 CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1956                         if (ifp == bif->bif_ifp) {
1957                                 bridge_delete_span(sc, bif);
1958                                 break;
1959                         }
1960
1961                 BRIDGE_UNLOCK(sc);
1962         }
1963         BRIDGE_LIST_UNLOCK();
1964 }
1965
1966 /*
1967  * bridge_init:
1968  *
1969  *      Initialize a bridge interface.
1970  */
1971 static void
1972 bridge_init(void *xsc)
1973 {
1974         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1975         struct ifnet *ifp = sc->sc_ifp;
1976
1977         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1978                 return;
1979
1980         BRIDGE_LOCK(sc);
1981         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1982             bridge_timer, sc);
1983
1984         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1985         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
1986
1987         BRIDGE_UNLOCK(sc);
1988 }
1989
1990 /*
1991  * bridge_stop:
1992  *
1993  *      Stop the bridge interface.
1994  */
1995 static void
1996 bridge_stop(struct ifnet *ifp, int disable)
1997 {
1998         struct bridge_softc *sc = ifp->if_softc;
1999
2000         BRIDGE_LOCK_ASSERT(sc);
2001
2002         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2003                 return;
2004
2005         BRIDGE_RT_LOCK(sc);
2006         callout_stop(&sc->sc_brcallout);
2007
2008         bstp_stop(&sc->sc_stp);
2009
2010         bridge_rtflush(sc, IFBF_FLUSHDYN);
2011         BRIDGE_RT_UNLOCK(sc);
2012
2013         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2014 }
2015
2016 /*
2017  * bridge_enqueue:
2018  *
2019  *      Enqueue a packet on a bridge member interface.
2020  *
2021  */
2022 static int
2023 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
2024 {
2025         int len, err = 0;
2026         short mflags;
2027         struct mbuf *m0;
2028
2029         /* We may be sending a fragment so traverse the mbuf */
2030         for (; m; m = m0) {
2031                 m0 = m->m_nextpkt;
2032                 m->m_nextpkt = NULL;
2033                 len = m->m_pkthdr.len;
2034                 mflags = m->m_flags;
2035
2036                 /*
2037                  * If underlying interface can not do VLAN tag insertion itself
2038                  * then attach a packet tag that holds it.
2039                  */
2040                 if ((m->m_flags & M_VLANTAG) &&
2041                     (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
2042                         m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
2043                         if (m == NULL) {
2044                                 if_printf(dst_ifp,
2045                                     "unable to prepend VLAN header\n");
2046                                 if_inc_counter(dst_ifp, IFCOUNTER_OERRORS, 1);
2047                                 continue;
2048                         }
2049                         m->m_flags &= ~M_VLANTAG;
2050                 }
2051
2052                 M_ASSERTPKTHDR(m); /* We shouldn't transmit mbuf without pkthdr */
2053                 if ((err = dst_ifp->if_transmit(dst_ifp, m))) {
2054                         int n;
2055
2056                         for (m = m0, n = 1; m != NULL; m = m0, n++) {
2057                                 m0 = m->m_nextpkt;
2058                                 m_freem(m);
2059                         }
2060                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, n);
2061                         break;
2062                 }
2063
2064                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OPACKETS, 1);
2065                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OBYTES, len);
2066                 if (mflags & M_MCAST)
2067                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OMCASTS, 1);
2068         }
2069
2070         return (err);
2071 }
2072
2073 /*
2074  * bridge_dummynet:
2075  *
2076  *      Receive a queued packet from dummynet and pass it on to the output
2077  *      interface.
2078  *
2079  *      The mbuf has the Ethernet header already attached.
2080  */
2081 static void
2082 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
2083 {
2084         struct bridge_softc *sc;
2085
2086         sc = ifp->if_bridge;
2087
2088         /*
2089          * The packet didnt originate from a member interface. This should only
2090          * ever happen if a member interface is removed while packets are
2091          * queued for it.
2092          */
2093         if (sc == NULL) {
2094                 m_freem(m);
2095                 return;
2096         }
2097
2098         if (PFIL_HOOKED_OUT(V_inet_pfil_head)
2099 #ifdef INET6
2100             || PFIL_HOOKED_OUT(V_inet6_pfil_head)
2101 #endif
2102             ) {
2103                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
2104                         return;
2105                 if (m == NULL)
2106                         return;
2107         }
2108
2109         bridge_enqueue(sc, ifp, m);
2110 }
2111
2112 /*
2113  * bridge_output:
2114  *
2115  *      Send output from a bridge member interface.  This
2116  *      performs the bridging function for locally originated
2117  *      packets.
2118  *
2119  *      The mbuf has the Ethernet header already attached.  We must
2120  *      enqueue or free the mbuf before returning.
2121  */
2122 static int
2123 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
2124     struct rtentry *rt)
2125 {
2126         struct ether_header *eh;
2127         struct ifnet *bifp, *dst_if;
2128         struct bridge_softc *sc;
2129         uint16_t vlan;
2130
2131         NET_EPOCH_ASSERT();
2132
2133         if (m->m_len < ETHER_HDR_LEN) {
2134                 m = m_pullup(m, ETHER_HDR_LEN);
2135                 if (m == NULL)
2136                         return (0);
2137         }
2138
2139         eh = mtod(m, struct ether_header *);
2140         sc = ifp->if_bridge;
2141         vlan = VLANTAGOF(m);
2142
2143         bifp = sc->sc_ifp;
2144
2145         /*
2146          * If bridge is down, but the original output interface is up,
2147          * go ahead and send out that interface.  Otherwise, the packet
2148          * is dropped below.
2149          */
2150         if ((bifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2151                 dst_if = ifp;
2152                 goto sendunicast;
2153         }
2154
2155         /*
2156          * If the packet is a multicast, or we don't know a better way to
2157          * get there, send to all interfaces.
2158          */
2159         if (ETHER_IS_MULTICAST(eh->ether_dhost))
2160                 dst_if = NULL;
2161         else
2162                 dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
2163         /* Tap any traffic not passing back out the originating interface */
2164         if (dst_if != ifp)
2165                 ETHER_BPF_MTAP(bifp, m);
2166         if (dst_if == NULL) {
2167                 struct bridge_iflist *bif;
2168                 struct mbuf *mc;
2169                 int used = 0;
2170
2171                 bridge_span(sc, m);
2172
2173                 CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2174                         dst_if = bif->bif_ifp;
2175
2176                         if (dst_if->if_type == IFT_GIF)
2177                                 continue;
2178                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2179                                 continue;
2180
2181                         /*
2182                          * If this is not the original output interface,
2183                          * and the interface is participating in spanning
2184                          * tree, make sure the port is in a state that
2185                          * allows forwarding.
2186                          */
2187                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
2188                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2189                                 continue;
2190
2191                         if (CK_LIST_NEXT(bif, bif_next) == NULL) {
2192                                 used = 1;
2193                                 mc = m;
2194                         } else {
2195                                 mc = m_dup(m, M_NOWAIT);
2196                                 if (mc == NULL) {
2197                                         if_inc_counter(bifp, IFCOUNTER_OERRORS, 1);
2198                                         continue;
2199                                 }
2200                         }
2201
2202                         bridge_enqueue(sc, dst_if, mc);
2203                 }
2204                 if (used == 0)
2205                         m_freem(m);
2206                 return (0);
2207         }
2208
2209 sendunicast:
2210         /*
2211          * XXX Spanning tree consideration here?
2212          */
2213
2214         bridge_span(sc, m);
2215         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2216                 m_freem(m);
2217                 return (0);
2218         }
2219
2220         bridge_enqueue(sc, dst_if, m);
2221         return (0);
2222 }
2223
2224 /*
2225  * bridge_transmit:
2226  *
2227  *      Do output on a bridge.
2228  *
2229  */
2230 static int
2231 bridge_transmit(struct ifnet *ifp, struct mbuf *m)
2232 {
2233         struct bridge_softc *sc;
2234         struct ether_header *eh;
2235         struct ifnet *dst_if;
2236         int error = 0;
2237
2238         sc = ifp->if_softc;
2239
2240         ETHER_BPF_MTAP(ifp, m);
2241
2242         eh = mtod(m, struct ether_header *);
2243
2244         if (((m->m_flags & (M_BCAST|M_MCAST)) == 0) &&
2245             (dst_if = bridge_rtlookup(sc, eh->ether_dhost, 1)) != NULL) {
2246                 error = bridge_enqueue(sc, dst_if, m);
2247         } else
2248                 bridge_broadcast(sc, ifp, m, 0);
2249
2250         return (error);
2251 }
2252
2253 #ifdef ALTQ
2254 static void
2255 bridge_altq_start(if_t ifp)
2256 {
2257         struct ifaltq *ifq = &ifp->if_snd;
2258         struct mbuf *m;
2259
2260         IFQ_LOCK(ifq);
2261         IFQ_DEQUEUE_NOLOCK(ifq, m);
2262         while (m != NULL) {
2263                 bridge_transmit(ifp, m);
2264                 IFQ_DEQUEUE_NOLOCK(ifq, m);
2265         }
2266         IFQ_UNLOCK(ifq);
2267 }
2268
2269 static int
2270 bridge_altq_transmit(if_t ifp, struct mbuf *m)
2271 {
2272         int err;
2273
2274         if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
2275                 IFQ_ENQUEUE(&ifp->if_snd, m, err);
2276                 if (err == 0)
2277                         bridge_altq_start(ifp);
2278         } else
2279                 err = bridge_transmit(ifp, m);
2280
2281         return (err);
2282 }
2283 #endif  /* ALTQ */
2284
2285 /*
2286  * The ifp->if_qflush entry point for if_bridge(4) is no-op.
2287  */
2288 static void
2289 bridge_qflush(struct ifnet *ifp __unused)
2290 {
2291 }
2292
2293 /*
2294  * bridge_forward:
2295  *
2296  *      The forwarding function of the bridge.
2297  *
2298  *      NOTE: Releases the lock on return.
2299  */
2300 static void
2301 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
2302     struct mbuf *m)
2303 {
2304         struct bridge_iflist *dbif;
2305         struct ifnet *src_if, *dst_if, *ifp;
2306         struct ether_header *eh;
2307         uint16_t vlan;
2308         uint8_t *dst;
2309         int error;
2310
2311         NET_EPOCH_ASSERT();
2312
2313         src_if = m->m_pkthdr.rcvif;
2314         ifp = sc->sc_ifp;
2315
2316         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
2317         if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2318         vlan = VLANTAGOF(m);
2319
2320         if ((sbif->bif_flags & IFBIF_STP) &&
2321             sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2322                 goto drop;
2323
2324         eh = mtod(m, struct ether_header *);
2325         dst = eh->ether_dhost;
2326
2327         /* If the interface is learning, record the address. */
2328         if (sbif->bif_flags & IFBIF_LEARNING) {
2329                 error = bridge_rtupdate(sc, eh->ether_shost, vlan,
2330                     sbif, 0, IFBAF_DYNAMIC);
2331                 /*
2332                  * If the interface has addresses limits then deny any source
2333                  * that is not in the cache.
2334                  */
2335                 if (error && sbif->bif_addrmax)
2336                         goto drop;
2337         }
2338
2339         if ((sbif->bif_flags & IFBIF_STP) != 0 &&
2340             sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING)
2341                 goto drop;
2342
2343         /*
2344          * At this point, the port either doesn't participate
2345          * in spanning tree or it is in the forwarding state.
2346          */
2347
2348         /*
2349          * If the packet is unicast, destined for someone on
2350          * "this" side of the bridge, drop it.
2351          */
2352         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2353                 dst_if = bridge_rtlookup(sc, dst, vlan);
2354                 if (src_if == dst_if)
2355                         goto drop;
2356         } else {
2357                 /*
2358                  * Check if its a reserved multicast address, any address
2359                  * listed in 802.1D section 7.12.6 may not be forwarded by the
2360                  * bridge.
2361                  * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
2362                  */
2363                 if (dst[0] == 0x01 && dst[1] == 0x80 &&
2364                     dst[2] == 0xc2 && dst[3] == 0x00 &&
2365                     dst[4] == 0x00 && dst[5] <= 0x0f)
2366                         goto drop;
2367
2368                 /* ...forward it to all interfaces. */
2369                 if_inc_counter(ifp, IFCOUNTER_IMCASTS, 1);
2370                 dst_if = NULL;
2371         }
2372
2373         /*
2374          * If we have a destination interface which is a member of our bridge,
2375          * OR this is a unicast packet, push it through the bpf(4) machinery.
2376          * For broadcast or multicast packets, don't bother because it will
2377          * be reinjected into ether_input. We do this before we pass the packets
2378          * through the pfil(9) framework, as it is possible that pfil(9) will
2379          * drop the packet, or possibly modify it, making it difficult to debug
2380          * firewall issues on the bridge.
2381          */
2382         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
2383                 ETHER_BPF_MTAP(ifp, m);
2384
2385         /* run the packet filter */
2386         if (PFIL_HOOKED_IN(V_inet_pfil_head)
2387 #ifdef INET6
2388             || PFIL_HOOKED_IN(V_inet6_pfil_head)
2389 #endif
2390             ) {
2391                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2392                         return;
2393                 if (m == NULL)
2394                         return;
2395         }
2396
2397         if (dst_if == NULL) {
2398                 bridge_broadcast(sc, src_if, m, 1);
2399                 return;
2400         }
2401
2402         /*
2403          * At this point, we're dealing with a unicast frame
2404          * going to a different interface.
2405          */
2406         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2407                 goto drop;
2408
2409         dbif = bridge_lookup_member_if(sc, dst_if);
2410         if (dbif == NULL)
2411                 /* Not a member of the bridge (anymore?) */
2412                 goto drop;
2413
2414         /* Private segments can not talk to each other */
2415         if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE)
2416                 goto drop;
2417
2418         if ((dbif->bif_flags & IFBIF_STP) &&
2419             dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2420                 goto drop;
2421
2422         if (PFIL_HOOKED_OUT(V_inet_pfil_head)
2423 #ifdef INET6
2424             || PFIL_HOOKED_OUT(V_inet6_pfil_head)
2425 #endif
2426             ) {
2427                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2428                         return;
2429                 if (m == NULL)
2430                         return;
2431         }
2432
2433         bridge_enqueue(sc, dst_if, m);
2434         return;
2435
2436 drop:
2437         m_freem(m);
2438 }
2439
2440 /*
2441  * bridge_input:
2442  *
2443  *      Receive input from a member interface.  Queue the packet for
2444  *      bridging if it is not for us.
2445  */
2446 static struct mbuf *
2447 bridge_input(struct ifnet *ifp, struct mbuf *m)
2448 {
2449         struct bridge_softc *sc = ifp->if_bridge;
2450         struct bridge_iflist *bif, *bif2;
2451         struct ifnet *bifp;
2452         struct ether_header *eh;
2453         struct mbuf *mc, *mc2;
2454         uint16_t vlan;
2455         int error;
2456
2457         NET_EPOCH_ASSERT();
2458
2459         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2460                 return (m);
2461
2462         bifp = sc->sc_ifp;
2463         vlan = VLANTAGOF(m);
2464
2465         /*
2466          * Implement support for bridge monitoring. If this flag has been
2467          * set on this interface, discard the packet once we push it through
2468          * the bpf(4) machinery, but before we do, increment the byte and
2469          * packet counters associated with this interface.
2470          */
2471         if ((bifp->if_flags & IFF_MONITOR) != 0) {
2472                 m->m_pkthdr.rcvif  = bifp;
2473                 ETHER_BPF_MTAP(bifp, m);
2474                 if_inc_counter(bifp, IFCOUNTER_IPACKETS, 1);
2475                 if_inc_counter(bifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
2476                 m_freem(m);
2477                 return (NULL);
2478         }
2479         bif = bridge_lookup_member_if(sc, ifp);
2480         if (bif == NULL) {
2481                 return (m);
2482         }
2483
2484         eh = mtod(m, struct ether_header *);
2485
2486         bridge_span(sc, m);
2487
2488         if (m->m_flags & (M_BCAST|M_MCAST)) {
2489                 /* Tap off 802.1D packets; they do not get forwarded. */
2490                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
2491                     ETHER_ADDR_LEN) == 0) {
2492                         bstp_input(&bif->bif_stp, ifp, m); /* consumes mbuf */
2493                         return (NULL);
2494                 }
2495
2496                 if ((bif->bif_flags & IFBIF_STP) &&
2497                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2498                         return (m);
2499                 }
2500
2501                 /*
2502                  * Make a deep copy of the packet and enqueue the copy
2503                  * for bridge processing; return the original packet for
2504                  * local processing.
2505                  */
2506                 mc = m_dup(m, M_NOWAIT);
2507                 if (mc == NULL) {
2508                         return (m);
2509                 }
2510
2511                 /* Perform the bridge forwarding function with the copy. */
2512                 bridge_forward(sc, bif, mc);
2513
2514                 /*
2515                  * Reinject the mbuf as arriving on the bridge so we have a
2516                  * chance at claiming multicast packets. We can not loop back
2517                  * here from ether_input as a bridge is never a member of a
2518                  * bridge.
2519                  */
2520                 KASSERT(bifp->if_bridge == NULL,
2521                     ("loop created in bridge_input"));
2522                 mc2 = m_dup(m, M_NOWAIT);
2523                 if (mc2 != NULL) {
2524                         /* Keep the layer3 header aligned */
2525                         int i = min(mc2->m_pkthdr.len, max_protohdr);
2526                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2527                 }
2528                 if (mc2 != NULL) {
2529                         mc2->m_pkthdr.rcvif = bifp;
2530                         (*bifp->if_input)(bifp, mc2);
2531                 }
2532
2533                 /* Return the original packet for local processing. */
2534                 return (m);
2535         }
2536
2537         if ((bif->bif_flags & IFBIF_STP) &&
2538             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2539                 return (m);
2540         }
2541
2542 #if (defined(INET) || defined(INET6))
2543 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2544         || ((iface)->if_carp \
2545             && (*carp_forus_p)((iface), eh->ether_dhost))
2546 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2547         || ((iface)->if_carp \
2548             && (*carp_forus_p)((iface), eh->ether_shost))
2549 #else
2550 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2551 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2552 #endif
2553
2554 #ifdef INET6
2555 #   define OR_PFIL_HOOKED_INET6 \
2556         || PFIL_HOOKED_IN(V_inet6_pfil_head)
2557 #else
2558 #   define OR_PFIL_HOOKED_INET6
2559 #endif
2560
2561 #define GRAB_OUR_PACKETS(iface) \
2562         if ((iface)->if_type == IFT_GIF) \
2563                 continue; \
2564         /* It is destined for us. */ \
2565         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2566             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
2567             ) {                                                         \
2568                 if (bif->bif_flags & IFBIF_LEARNING) {                  \
2569                         error = bridge_rtupdate(sc, eh->ether_shost,    \
2570                             vlan, bif, 0, IFBAF_DYNAMIC);               \
2571                         if (error && bif->bif_addrmax) {                \
2572                                 m_freem(m);                             \
2573                                 return (NULL);                          \
2574                         }                                               \
2575                 }                                                       \
2576                 m->m_pkthdr.rcvif = iface;                              \
2577                 if ((iface) == ifp) {                                   \
2578                         /* Skip bridge processing... src == dest */     \
2579                         return (m);                                     \
2580                 }                                                       \
2581                 /* It's passing over or to the bridge, locally. */      \
2582                 ETHER_BPF_MTAP(bifp, m);                                \
2583                 if_inc_counter(bifp, IFCOUNTER_IPACKETS, 1);            \
2584                 if_inc_counter(bifp, IFCOUNTER_IBYTES, m->m_pkthdr.len); \
2585                 /* Filter on the physical interface. */                 \
2586                 if (V_pfil_local_phys && (PFIL_HOOKED_IN(V_inet_pfil_head) \
2587                      OR_PFIL_HOOKED_INET6)) {                           \
2588                         if (bridge_pfil(&m, NULL, ifp,                  \
2589                             PFIL_IN) != 0 || m == NULL) {               \
2590                                 return (NULL);                          \
2591                         }                                               \
2592                 }                                                       \
2593                 if ((iface) != bifp)                                    \
2594                         ETHER_BPF_MTAP(iface, m);                       \
2595                 return (m);                                             \
2596         }                                                               \
2597                                                                         \
2598         /* We just received a packet that we sent out. */               \
2599         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2600             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
2601             ) {                                                         \
2602                 m_freem(m);                                             \
2603                 return (NULL);                                          \
2604         }
2605
2606         /*
2607          * Unicast.  Make sure it's not for the bridge.
2608          */
2609         do { GRAB_OUR_PACKETS(bifp) } while (0);
2610
2611         /*
2612          * Give a chance for ifp at first priority. This will help when the
2613          * packet comes through the interface like VLAN's with the same MACs
2614          * on several interfaces from the same bridge. This also will save
2615          * some CPU cycles in case the destination interface and the input
2616          * interface (eq ifp) are the same.
2617          */
2618         do { GRAB_OUR_PACKETS(ifp) } while (0);
2619
2620         /* Now check the all bridge members. */
2621         CK_LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2622                 GRAB_OUR_PACKETS(bif2->bif_ifp)
2623         }
2624
2625 #undef OR_CARP_CHECK_WE_ARE_DST
2626 #undef OR_CARP_CHECK_WE_ARE_SRC
2627 #undef OR_PFIL_HOOKED_INET6
2628 #undef GRAB_OUR_PACKETS
2629
2630         /* Perform the bridge forwarding function. */
2631         bridge_forward(sc, bif, m);
2632
2633         return (NULL);
2634 }
2635
2636 /*
2637  * bridge_broadcast:
2638  *
2639  *      Send a frame to all interfaces that are members of
2640  *      the bridge, except for the one on which the packet
2641  *      arrived.
2642  *
2643  *      NOTE: Releases the lock on return.
2644  */
2645 static void
2646 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2647     struct mbuf *m, int runfilt)
2648 {
2649         struct bridge_iflist *dbif, *sbif;
2650         struct mbuf *mc;
2651         struct ifnet *dst_if;
2652         int used = 0, i;
2653
2654         NET_EPOCH_ASSERT();
2655
2656         sbif = bridge_lookup_member_if(sc, src_if);
2657
2658         /* Filter on the bridge interface before broadcasting */
2659         if (runfilt && (PFIL_HOOKED_OUT(V_inet_pfil_head)
2660 #ifdef INET6
2661             || PFIL_HOOKED_OUT(V_inet6_pfil_head)
2662 #endif
2663             )) {
2664                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2665                         return;
2666                 if (m == NULL)
2667                         return;
2668         }
2669
2670         CK_LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
2671                 dst_if = dbif->bif_ifp;
2672                 if (dst_if == src_if)
2673                         continue;
2674
2675                 /* Private segments can not talk to each other */
2676                 if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
2677                         continue;
2678
2679                 if ((dbif->bif_flags & IFBIF_STP) &&
2680                     dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2681                         continue;
2682
2683                 if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
2684                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2685                         continue;
2686
2687                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2688                         continue;
2689
2690                 if (CK_LIST_NEXT(dbif, bif_next) == NULL) {
2691                         mc = m;
2692                         used = 1;
2693                 } else {
2694                         mc = m_dup(m, M_NOWAIT);
2695                         if (mc == NULL) {
2696                                 if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2697                                 continue;
2698                         }
2699                 }
2700
2701                 /*
2702                  * Filter on the output interface. Pass a NULL bridge interface
2703                  * pointer so we do not redundantly filter on the bridge for
2704                  * each interface we broadcast on.
2705                  */
2706                 if (runfilt && (PFIL_HOOKED_OUT(V_inet_pfil_head)
2707 #ifdef INET6
2708                     || PFIL_HOOKED_OUT(V_inet6_pfil_head)
2709 #endif
2710                     )) {
2711                         if (used == 0) {
2712                                 /* Keep the layer3 header aligned */
2713                                 i = min(mc->m_pkthdr.len, max_protohdr);
2714                                 mc = m_copyup(mc, i, ETHER_ALIGN);
2715                                 if (mc == NULL) {
2716                                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2717                                         continue;
2718                                 }
2719                         }
2720                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2721                                 continue;
2722                         if (mc == NULL)
2723                                 continue;
2724                 }
2725
2726                 bridge_enqueue(sc, dst_if, mc);
2727         }
2728         if (used == 0)
2729                 m_freem(m);
2730 }
2731
2732 /*
2733  * bridge_span:
2734  *
2735  *      Duplicate a packet out one or more interfaces that are in span mode,
2736  *      the original mbuf is unmodified.
2737  */
2738 static void
2739 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2740 {
2741         struct bridge_iflist *bif;
2742         struct ifnet *dst_if;
2743         struct mbuf *mc;
2744
2745         NET_EPOCH_ASSERT();
2746
2747         if (CK_LIST_EMPTY(&sc->sc_spanlist))
2748                 return;
2749
2750         CK_LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2751                 dst_if = bif->bif_ifp;
2752
2753                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2754                         continue;
2755
2756                 mc = m_dup(m, M_NOWAIT);
2757                 if (mc == NULL) {
2758                         if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
2759                         continue;
2760                 }
2761
2762                 bridge_enqueue(sc, dst_if, mc);
2763         }
2764 }
2765
2766 /*
2767  * bridge_rtupdate:
2768  *
2769  *      Add a bridge routing entry.
2770  */
2771 static int
2772 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan,
2773     struct bridge_iflist *bif, int setflags, uint8_t flags)
2774 {
2775         struct bridge_rtnode *brt;
2776         int error;
2777
2778         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
2779
2780         /* Check the source address is valid and not multicast. */
2781         if (ETHER_IS_MULTICAST(dst) ||
2782             (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
2783              dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0)
2784                 return (EINVAL);
2785
2786         /* 802.1p frames map to vlan 1 */
2787         if (vlan == 0)
2788                 vlan = 1;
2789
2790         /*
2791          * A route for this destination might already exist.  If so,
2792          * update it, otherwise create a new one.
2793          */
2794         if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
2795                 BRIDGE_RT_LOCK(sc);
2796
2797                 /* Check again, now that we have the lock. There could have
2798                  * been a race and we only want to insert this once. */
2799                 if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) != NULL) {
2800                         BRIDGE_RT_UNLOCK(sc);
2801                         return (0);
2802                 }
2803
2804                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
2805                         sc->sc_brtexceeded++;
2806                         BRIDGE_RT_UNLOCK(sc);
2807                         return (ENOSPC);
2808                 }
2809                 /* Check per interface address limits (if enabled) */
2810                 if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
2811                         bif->bif_addrexceeded++;
2812                         BRIDGE_RT_UNLOCK(sc);
2813                         return (ENOSPC);
2814                 }
2815
2816                 /*
2817                  * Allocate a new bridge forwarding node, and
2818                  * initialize the expiration time and Ethernet
2819                  * address.
2820                  */
2821                 brt = uma_zalloc(V_bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2822                 if (brt == NULL) {
2823                         BRIDGE_RT_UNLOCK(sc);
2824                         return (ENOMEM);
2825                 }
2826                 brt->brt_vnet = curvnet;
2827
2828                 if (bif->bif_flags & IFBIF_STICKY)
2829                         brt->brt_flags = IFBAF_STICKY;
2830                 else
2831                         brt->brt_flags = IFBAF_DYNAMIC;
2832
2833                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2834                 brt->brt_vlan = vlan;
2835
2836                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2837                         uma_zfree(V_bridge_rtnode_zone, brt);
2838                         BRIDGE_RT_UNLOCK(sc);
2839                         return (error);
2840                 }
2841                 brt->brt_dst = bif;
2842                 bif->bif_addrcnt++;
2843
2844                 BRIDGE_RT_UNLOCK(sc);
2845         }
2846
2847         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
2848             brt->brt_dst != bif) {
2849                 BRIDGE_RT_LOCK(sc);
2850                 brt->brt_dst->bif_addrcnt--;
2851                 brt->brt_dst = bif;
2852                 brt->brt_dst->bif_addrcnt++;
2853                 BRIDGE_RT_UNLOCK(sc);
2854         }
2855
2856         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2857                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
2858         if (setflags)
2859                 brt->brt_flags = flags;
2860
2861         return (0);
2862 }
2863
2864 /*
2865  * bridge_rtlookup:
2866  *
2867  *      Lookup the destination interface for an address.
2868  */
2869 static struct ifnet *
2870 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2871 {
2872         struct bridge_rtnode *brt;
2873
2874         NET_EPOCH_ASSERT();
2875
2876         if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL)
2877                 return (NULL);
2878
2879         return (brt->brt_ifp);
2880 }
2881
2882 /*
2883  * bridge_rttrim:
2884  *
2885  *      Trim the routine table so that we have a number
2886  *      of routing entries less than or equal to the
2887  *      maximum number.
2888  */
2889 static void
2890 bridge_rttrim(struct bridge_softc *sc)
2891 {
2892         struct bridge_rtnode *brt, *nbrt;
2893
2894         NET_EPOCH_ASSERT();
2895         BRIDGE_RT_LOCK_ASSERT(sc);
2896
2897         /* Make sure we actually need to do this. */
2898         if (sc->sc_brtcnt <= sc->sc_brtmax)
2899                 return;
2900
2901         /* Force an aging cycle; this might trim enough addresses. */
2902         bridge_rtage(sc);
2903         if (sc->sc_brtcnt <= sc->sc_brtmax)
2904                 return;
2905
2906         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2907                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2908                         bridge_rtnode_destroy(sc, brt);
2909                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2910                                 return;
2911                 }
2912         }
2913 }
2914
2915 /*
2916  * bridge_timer:
2917  *
2918  *      Aging timer for the bridge.
2919  */
2920 static void
2921 bridge_timer(void *arg)
2922 {
2923         struct bridge_softc *sc = arg;
2924
2925         BRIDGE_RT_LOCK_ASSERT(sc);
2926
2927         /* Destruction of rtnodes requires a proper vnet context */
2928         CURVNET_SET(sc->sc_ifp->if_vnet);
2929         bridge_rtage(sc);
2930
2931         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2932                 callout_reset(&sc->sc_brcallout,
2933                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2934         CURVNET_RESTORE();
2935 }
2936
2937 /*
2938  * bridge_rtage:
2939  *
2940  *      Perform an aging cycle.
2941  */
2942 static void
2943 bridge_rtage(struct bridge_softc *sc)
2944 {
2945         struct bridge_rtnode *brt, *nbrt;
2946
2947         BRIDGE_RT_LOCK_ASSERT(sc);
2948
2949         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2950                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2951                         if (time_uptime >= brt->brt_expire)
2952                                 bridge_rtnode_destroy(sc, brt);
2953                 }
2954         }
2955 }
2956
2957 /*
2958  * bridge_rtflush:
2959  *
2960  *      Remove all dynamic addresses from the bridge.
2961  */
2962 static void
2963 bridge_rtflush(struct bridge_softc *sc, int full)
2964 {
2965         struct bridge_rtnode *brt, *nbrt;
2966
2967         BRIDGE_RT_LOCK_ASSERT(sc);
2968
2969         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2970                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2971                         bridge_rtnode_destroy(sc, brt);
2972         }
2973 }
2974
2975 /*
2976  * bridge_rtdaddr:
2977  *
2978  *      Remove an address from the table.
2979  */
2980 static int
2981 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2982 {
2983         struct bridge_rtnode *brt;
2984         int found = 0;
2985
2986         BRIDGE_RT_LOCK(sc);
2987
2988         /*
2989          * If vlan is zero then we want to delete for all vlans so the lookup
2990          * may return more than one.
2991          */
2992         while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
2993                 bridge_rtnode_destroy(sc, brt);
2994                 found = 1;
2995         }
2996
2997         BRIDGE_RT_UNLOCK(sc);
2998
2999         return (found ? 0 : ENOENT);
3000 }
3001
3002 /*
3003  * bridge_rtdelete:
3004  *
3005  *      Delete routes to a speicifc member interface.
3006  */
3007 static void
3008 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
3009 {
3010         struct bridge_rtnode *brt, *nbrt;
3011
3012         BRIDGE_RT_LOCK_ASSERT(sc);
3013
3014         CK_LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
3015                 if (brt->brt_ifp == ifp && (full ||
3016                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
3017                         bridge_rtnode_destroy(sc, brt);
3018         }
3019 }
3020
3021 /*
3022  * bridge_rtable_init:
3023  *
3024  *      Initialize the route table for this bridge.
3025  */
3026 static void
3027 bridge_rtable_init(struct bridge_softc *sc)
3028 {
3029         int i;
3030
3031         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
3032             M_DEVBUF, M_WAITOK);
3033
3034         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
3035                 CK_LIST_INIT(&sc->sc_rthash[i]);
3036
3037         sc->sc_rthash_key = arc4random();
3038         CK_LIST_INIT(&sc->sc_rtlist);
3039 }
3040
3041 /*
3042  * bridge_rtable_fini:
3043  *
3044  *      Deconstruct the route table for this bridge.
3045  */
3046 static void
3047 bridge_rtable_fini(struct bridge_softc *sc)
3048 {
3049
3050         KASSERT(sc->sc_brtcnt == 0,
3051             ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
3052         free(sc->sc_rthash, M_DEVBUF);
3053 }
3054
3055 /*
3056  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
3057  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
3058  */
3059 #define mix(a, b, c)                                                    \
3060 do {                                                                    \
3061         a -= b; a -= c; a ^= (c >> 13);                                 \
3062         b -= c; b -= a; b ^= (a << 8);                                  \
3063         c -= a; c -= b; c ^= (b >> 13);                                 \
3064         a -= b; a -= c; a ^= (c >> 12);                                 \
3065         b -= c; b -= a; b ^= (a << 16);                                 \
3066         c -= a; c -= b; c ^= (b >> 5);                                  \
3067         a -= b; a -= c; a ^= (c >> 3);                                  \
3068         b -= c; b -= a; b ^= (a << 10);                                 \
3069         c -= a; c -= b; c ^= (b >> 15);                                 \
3070 } while (/*CONSTCOND*/0)
3071
3072 static __inline uint32_t
3073 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
3074 {
3075         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
3076
3077         b += addr[5] << 8;
3078         b += addr[4];
3079         a += addr[3] << 24;
3080         a += addr[2] << 16;
3081         a += addr[1] << 8;
3082         a += addr[0];
3083
3084         mix(a, b, c);
3085
3086         return (c & BRIDGE_RTHASH_MASK);
3087 }
3088
3089 #undef mix
3090
3091 static int
3092 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
3093 {
3094         int i, d;
3095
3096         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
3097                 d = ((int)a[i]) - ((int)b[i]);
3098         }
3099
3100         return (d);
3101 }
3102
3103 /*
3104  * bridge_rtnode_lookup:
3105  *
3106  *      Look up a bridge route node for the specified destination. Compare the
3107  *      vlan id or if zero then just return the first match.
3108  */
3109 static struct bridge_rtnode *
3110 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
3111 {
3112         struct bridge_rtnode *brt;
3113         uint32_t hash;
3114         int dir;
3115
3116         BRIDGE_RT_LOCK_OR_NET_EPOCH_ASSERT(sc);
3117
3118         hash = bridge_rthash(sc, addr);
3119         CK_LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
3120                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
3121                 if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0))
3122                         return (brt);
3123                 if (dir > 0)
3124                         return (NULL);
3125         }
3126
3127         return (NULL);
3128 }
3129
3130 /*
3131  * bridge_rtnode_insert:
3132  *
3133  *      Insert the specified bridge node into the route table.  We
3134  *      assume the entry is not already in the table.
3135  */
3136 static int
3137 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
3138 {
3139         struct bridge_rtnode *lbrt;
3140         uint32_t hash;
3141         int dir;
3142
3143         BRIDGE_RT_LOCK_ASSERT(sc);
3144
3145         hash = bridge_rthash(sc, brt->brt_addr);
3146
3147         lbrt = CK_LIST_FIRST(&sc->sc_rthash[hash]);
3148         if (lbrt == NULL) {
3149                 CK_LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
3150                 goto out;
3151         }
3152
3153         do {
3154                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
3155                 if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan)
3156                         return (EEXIST);
3157                 if (dir > 0) {
3158                         CK_LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
3159                         goto out;
3160                 }
3161                 if (CK_LIST_NEXT(lbrt, brt_hash) == NULL) {
3162                         CK_LIST_INSERT_AFTER(lbrt, brt, brt_hash);
3163                         goto out;
3164                 }
3165                 lbrt = CK_LIST_NEXT(lbrt, brt_hash);
3166         } while (lbrt != NULL);
3167
3168 #ifdef DIAGNOSTIC
3169         panic("bridge_rtnode_insert: impossible");
3170 #endif
3171
3172 out:
3173         CK_LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
3174         sc->sc_brtcnt++;
3175
3176         return (0);
3177 }
3178
3179 static void
3180 bridge_rtnode_destroy_cb(struct epoch_context *ctx)
3181 {
3182         struct bridge_rtnode *brt;
3183
3184         brt = __containerof(ctx, struct bridge_rtnode, brt_epoch_ctx);
3185
3186         CURVNET_SET(brt->brt_vnet);
3187         uma_zfree(V_bridge_rtnode_zone, brt);
3188         CURVNET_RESTORE();
3189 }
3190
3191 /*
3192  * bridge_rtnode_destroy:
3193  *
3194  *      Destroy a bridge rtnode.
3195  */
3196 static void
3197 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
3198 {
3199         BRIDGE_RT_LOCK_ASSERT(sc);
3200
3201         CK_LIST_REMOVE(brt, brt_hash);
3202
3203         CK_LIST_REMOVE(brt, brt_list);
3204         sc->sc_brtcnt--;
3205         brt->brt_dst->bif_addrcnt--;
3206
3207         NET_EPOCH_CALL(bridge_rtnode_destroy_cb, &brt->brt_epoch_ctx);
3208 }
3209
3210 /*
3211  * bridge_rtable_expire:
3212  *
3213  *      Set the expiry time for all routes on an interface.
3214  */
3215 static void
3216 bridge_rtable_expire(struct ifnet *ifp, int age)
3217 {
3218         struct bridge_softc *sc = ifp->if_bridge;
3219         struct bridge_rtnode *brt;
3220
3221         CURVNET_SET(ifp->if_vnet);
3222         BRIDGE_RT_LOCK(sc);
3223
3224         /*
3225          * If the age is zero then flush, otherwise set all the expiry times to
3226          * age for the interface
3227          */
3228         if (age == 0)
3229                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
3230         else {
3231                 CK_LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
3232                         /* Cap the expiry time to 'age' */
3233                         if (brt->brt_ifp == ifp &&
3234                             brt->brt_expire > time_uptime + age &&
3235                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
3236                                 brt->brt_expire = time_uptime + age;
3237                 }
3238         }
3239         BRIDGE_RT_UNLOCK(sc);
3240         CURVNET_RESTORE();
3241 }
3242
3243 /*
3244  * bridge_state_change:
3245  *
3246  *      Callback from the bridgestp code when a port changes states.
3247  */
3248 static void
3249 bridge_state_change(struct ifnet *ifp, int state)
3250 {
3251         struct bridge_softc *sc = ifp->if_bridge;
3252         static const char *stpstates[] = {
3253                 "disabled",
3254                 "listening",
3255                 "learning",
3256                 "forwarding",
3257                 "blocking",
3258                 "discarding"
3259         };
3260
3261         CURVNET_SET(ifp->if_vnet);
3262         if (V_log_stp)
3263                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
3264                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
3265         CURVNET_RESTORE();
3266 }
3267
3268 /*
3269  * Send bridge packets through pfil if they are one of the types pfil can deal
3270  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
3271  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
3272  * that interface.
3273  */
3274 static int
3275 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
3276 {
3277         int snap, error, i, hlen;
3278         struct ether_header *eh1, eh2;
3279         struct ip *ip;
3280         struct llc llc1;
3281         u_int16_t ether_type;
3282         pfil_return_t rv;
3283
3284         snap = 0;
3285         error = -1;     /* Default error if not error == 0 */
3286
3287 #if 0
3288         /* we may return with the IP fields swapped, ensure its not shared */
3289         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
3290 #endif
3291
3292         if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0)
3293                 return (0); /* filtering is disabled */
3294
3295         i = min((*mp)->m_pkthdr.len, max_protohdr);
3296         if ((*mp)->m_len < i) {
3297             *mp = m_pullup(*mp, i);
3298             if (*mp == NULL) {
3299                 printf("%s: m_pullup failed\n", __func__);
3300                 return (-1);
3301             }
3302         }
3303
3304         eh1 = mtod(*mp, struct ether_header *);
3305         ether_type = ntohs(eh1->ether_type);
3306
3307         /*
3308          * Check for SNAP/LLC.
3309          */
3310         if (ether_type < ETHERMTU) {
3311                 struct llc *llc2 = (struct llc *)(eh1 + 1);
3312
3313                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
3314                     llc2->llc_dsap == LLC_SNAP_LSAP &&
3315                     llc2->llc_ssap == LLC_SNAP_LSAP &&
3316                     llc2->llc_control == LLC_UI) {
3317                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
3318                         snap = 1;
3319                 }
3320         }
3321
3322         /*
3323          * If we're trying to filter bridge traffic, don't look at anything
3324          * other than IP and ARP traffic.  If the filter doesn't understand
3325          * IPv6, don't allow IPv6 through the bridge either.  This is lame
3326          * since if we really wanted, say, an AppleTalk filter, we are hosed,
3327          * but of course we don't have an AppleTalk filter to begin with.
3328          * (Note that since pfil doesn't understand ARP it will pass *ALL*
3329          * ARP traffic.)
3330          */
3331         switch (ether_type) {
3332                 case ETHERTYPE_ARP:
3333                 case ETHERTYPE_REVARP:
3334                         if (V_pfil_ipfw_arp == 0)
3335                                 return (0); /* Automatically pass */
3336                         break;
3337
3338                 case ETHERTYPE_IP:
3339 #ifdef INET6
3340                 case ETHERTYPE_IPV6:
3341 #endif /* INET6 */
3342                         break;
3343                 default:
3344                         /*
3345                          * Check to see if the user wants to pass non-ip
3346                          * packets, these will not be checked by pfil(9) and
3347                          * passed unconditionally so the default is to drop.
3348                          */
3349                         if (V_pfil_onlyip)
3350                                 goto bad;
3351         }
3352
3353         /* Run the packet through pfil before stripping link headers */
3354         if (PFIL_HOOKED_OUT(V_link_pfil_head) && V_pfil_ipfw != 0 &&
3355             dir == PFIL_OUT && ifp != NULL) {
3356                 switch (pfil_mbuf_out(V_link_pfil_head, mp, ifp, NULL)) {
3357                 case PFIL_DROPPED:
3358                         return (EACCES);
3359                 case PFIL_CONSUMED:
3360                         return (0);
3361                 }
3362         }
3363
3364         /* Strip off the Ethernet header and keep a copy. */
3365         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3366         m_adj(*mp, ETHER_HDR_LEN);
3367
3368         /* Strip off snap header, if present */
3369         if (snap) {
3370                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3371                 m_adj(*mp, sizeof(struct llc));
3372         }
3373
3374         /*
3375          * Check the IP header for alignment and errors
3376          */
3377         if (dir == PFIL_IN) {
3378                 switch (ether_type) {
3379                         case ETHERTYPE_IP:
3380                                 error = bridge_ip_checkbasic(mp);
3381                                 break;
3382 #ifdef INET6
3383                         case ETHERTYPE_IPV6:
3384                                 error = bridge_ip6_checkbasic(mp);
3385                                 break;
3386 #endif /* INET6 */
3387                         default:
3388                                 error = 0;
3389                 }
3390                 if (error)
3391                         goto bad;
3392         }
3393
3394         error = 0;
3395
3396         /*
3397          * Run the packet through pfil
3398          */
3399         rv = PFIL_PASS;
3400         switch (ether_type) {
3401         case ETHERTYPE_IP:
3402                 /*
3403                  * Run pfil on the member interface and the bridge, both can
3404                  * be skipped by clearing pfil_member or pfil_bridge.
3405                  *
3406                  * Keep the order:
3407                  *   in_if -> bridge_if -> out_if
3408                  */
3409                 if (V_pfil_bridge && dir == PFIL_OUT && bifp != NULL && (rv =
3410                     pfil_mbuf_out(V_inet_pfil_head, mp, bifp, NULL)) !=
3411                     PFIL_PASS)
3412                         break;
3413
3414                 if (V_pfil_member && ifp != NULL) {
3415                         rv = (dir == PFIL_OUT) ?
3416                             pfil_mbuf_out(V_inet_pfil_head, mp, ifp, NULL) :
3417                             pfil_mbuf_in(V_inet_pfil_head, mp, ifp, NULL);
3418                         if (rv != PFIL_PASS)
3419                                 break;
3420                 }
3421
3422                 if (V_pfil_bridge && dir == PFIL_IN && bifp != NULL && (rv =
3423                     pfil_mbuf_in(V_inet_pfil_head, mp, bifp, NULL)) !=
3424                     PFIL_PASS)
3425                         break;
3426
3427                 /* check if we need to fragment the packet */
3428                 /* bridge_fragment generates a mbuf chain of packets */
3429                 /* that already include eth headers */
3430                 if (V_pfil_member && ifp != NULL && dir == PFIL_OUT) {
3431                         i = (*mp)->m_pkthdr.len;
3432                         if (i > ifp->if_mtu) {
3433                                 error = bridge_fragment(ifp, mp, &eh2, snap,
3434                                             &llc1);
3435                                 return (error);
3436                         }
3437                 }
3438
3439                 /* Recalculate the ip checksum. */
3440                 ip = mtod(*mp, struct ip *);
3441                 hlen = ip->ip_hl << 2;
3442                 if (hlen < sizeof(struct ip))
3443                         goto bad;
3444                 if (hlen > (*mp)->m_len) {
3445                         if ((*mp = m_pullup(*mp, hlen)) == NULL)
3446                                 goto bad;
3447                         ip = mtod(*mp, struct ip *);
3448                         if (ip == NULL)
3449                                 goto bad;
3450                 }
3451                 ip->ip_sum = 0;
3452                 if (hlen == sizeof(struct ip))
3453                         ip->ip_sum = in_cksum_hdr(ip);
3454                 else
3455                         ip->ip_sum = in_cksum(*mp, hlen);
3456
3457                 break;
3458 #ifdef INET6
3459         case ETHERTYPE_IPV6:
3460                 if (V_pfil_bridge && dir == PFIL_OUT && bifp != NULL && (rv =
3461                     pfil_mbuf_out(V_inet6_pfil_head, mp, bifp, NULL)) !=
3462                     PFIL_PASS)
3463                         break;
3464
3465                 if (V_pfil_member && ifp != NULL) {
3466                         rv = (dir == PFIL_OUT) ?
3467                             pfil_mbuf_out(V_inet6_pfil_head, mp, ifp, NULL) :
3468                             pfil_mbuf_in(V_inet6_pfil_head, mp, ifp, NULL);
3469                         if (rv != PFIL_PASS)
3470                                 break;
3471                 }
3472
3473                 if (V_pfil_bridge && dir == PFIL_IN && bifp != NULL && (rv =
3474                     pfil_mbuf_in(V_inet6_pfil_head, mp, bifp, NULL)) !=
3475                     PFIL_PASS)
3476                         break;
3477                 break;
3478 #endif
3479         }
3480
3481         switch (rv) {
3482         case PFIL_CONSUMED:
3483                 return (0);
3484         case PFIL_DROPPED:
3485                 return (EACCES);
3486         default:
3487                 break;
3488         }
3489
3490         error = -1;
3491
3492         /*
3493          * Finally, put everything back the way it was and return
3494          */
3495         if (snap) {
3496                 M_PREPEND(*mp, sizeof(struct llc), M_NOWAIT);
3497                 if (*mp == NULL)
3498                         return (error);
3499                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3500         }
3501
3502         M_PREPEND(*mp, ETHER_HDR_LEN, M_NOWAIT);
3503         if (*mp == NULL)
3504                 return (error);
3505         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3506
3507         return (0);
3508
3509 bad:
3510         m_freem(*mp);
3511         *mp = NULL;
3512         return (error);
3513 }
3514
3515 /*
3516  * Perform basic checks on header size since
3517  * pfil assumes ip_input has already processed
3518  * it for it.  Cut-and-pasted from ip_input.c.
3519  * Given how simple the IPv6 version is,
3520  * does the IPv4 version really need to be
3521  * this complicated?
3522  *
3523  * XXX Should we update ipstat here, or not?
3524  * XXX Right now we update ipstat but not
3525  * XXX csum_counter.
3526  */
3527 static int
3528 bridge_ip_checkbasic(struct mbuf **mp)
3529 {
3530         struct mbuf *m = *mp;
3531         struct ip *ip;
3532         int len, hlen;
3533         u_short sum;
3534
3535         if (*mp == NULL)
3536                 return (-1);
3537
3538         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3539                 if ((m = m_copyup(m, sizeof(struct ip),
3540                         (max_linkhdr + 3) & ~3)) == NULL) {
3541                         /* XXXJRT new stat, please */
3542                         KMOD_IPSTAT_INC(ips_toosmall);
3543                         goto bad;
3544                 }
3545         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
3546                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3547                         KMOD_IPSTAT_INC(ips_toosmall);
3548                         goto bad;
3549                 }
3550         }
3551         ip = mtod(m, struct ip *);
3552         if (ip == NULL) goto bad;
3553
3554         if (ip->ip_v != IPVERSION) {
3555                 KMOD_IPSTAT_INC(ips_badvers);
3556                 goto bad;
3557         }
3558         hlen = ip->ip_hl << 2;
3559         if (hlen < sizeof(struct ip)) { /* minimum header length */
3560                 KMOD_IPSTAT_INC(ips_badhlen);
3561                 goto bad;
3562         }
3563         if (hlen > m->m_len) {
3564                 if ((m = m_pullup(m, hlen)) == NULL) {
3565                         KMOD_IPSTAT_INC(ips_badhlen);
3566                         goto bad;
3567                 }
3568                 ip = mtod(m, struct ip *);
3569                 if (ip == NULL) goto bad;
3570         }
3571
3572         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3573                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3574         } else {
3575                 if (hlen == sizeof(struct ip)) {
3576                         sum = in_cksum_hdr(ip);
3577                 } else {
3578                         sum = in_cksum(m, hlen);
3579                 }
3580         }
3581         if (sum) {
3582                 KMOD_IPSTAT_INC(ips_badsum);
3583                 goto bad;
3584         }
3585
3586         /* Retrieve the packet length. */
3587         len = ntohs(ip->ip_len);
3588
3589         /*
3590          * Check for additional length bogosity
3591          */
3592         if (len < hlen) {
3593                 KMOD_IPSTAT_INC(ips_badlen);
3594                 goto bad;
3595         }
3596
3597         /*
3598          * Check that the amount of data in the buffers
3599          * is as at least much as the IP header would have us expect.
3600          * Drop packet if shorter than we expect.
3601          */
3602         if (m->m_pkthdr.len < len) {
3603                 KMOD_IPSTAT_INC(ips_tooshort);
3604                 goto bad;
3605         }
3606
3607         /* Checks out, proceed */
3608         *mp = m;
3609         return (0);
3610
3611 bad:
3612         *mp = m;
3613         return (-1);
3614 }
3615
3616 #ifdef INET6
3617 /*
3618  * Same as above, but for IPv6.
3619  * Cut-and-pasted from ip6_input.c.
3620  * XXX Should we update ip6stat, or not?
3621  */
3622 static int
3623 bridge_ip6_checkbasic(struct mbuf **mp)
3624 {
3625         struct mbuf *m = *mp;
3626         struct ip6_hdr *ip6;
3627
3628         /*
3629          * If the IPv6 header is not aligned, slurp it up into a new
3630          * mbuf with space for link headers, in the event we forward
3631          * it.  Otherwise, if it is aligned, make sure the entire base
3632          * IPv6 header is in the first mbuf of the chain.
3633          */
3634         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3635                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3636                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3637                             (max_linkhdr + 3) & ~3)) == NULL) {
3638                         /* XXXJRT new stat, please */
3639                         IP6STAT_INC(ip6s_toosmall);
3640                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3641                         goto bad;
3642                 }
3643         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3644                 struct ifnet *inifp = m->m_pkthdr.rcvif;
3645                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3646                         IP6STAT_INC(ip6s_toosmall);
3647                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3648                         goto bad;
3649                 }
3650         }
3651
3652         ip6 = mtod(m, struct ip6_hdr *);
3653
3654         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3655                 IP6STAT_INC(ip6s_badvers);
3656                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3657                 goto bad;
3658         }
3659
3660         /* Checks out, proceed */
3661         *mp = m;
3662         return (0);
3663
3664 bad:
3665         *mp = m;
3666         return (-1);
3667 }
3668 #endif /* INET6 */
3669
3670 /*
3671  * bridge_fragment:
3672  *
3673  *      Fragment mbuf chain in multiple packets and prepend ethernet header.
3674  */
3675 static int
3676 bridge_fragment(struct ifnet *ifp, struct mbuf **mp, struct ether_header *eh,
3677     int snap, struct llc *llc)
3678 {
3679         struct mbuf *m = *mp, *nextpkt = NULL, *mprev = NULL, *mcur = NULL;
3680         struct ip *ip;
3681         int error = -1;
3682
3683         if (m->m_len < sizeof(struct ip) &&
3684             (m = m_pullup(m, sizeof(struct ip))) == NULL)
3685                 goto dropit;
3686         ip = mtod(m, struct ip *);
3687
3688         m->m_pkthdr.csum_flags |= CSUM_IP;
3689         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist);
3690         if (error)
3691                 goto dropit;
3692
3693         /*
3694          * Walk the chain and re-add the Ethernet header for
3695          * each mbuf packet.
3696          */
3697         for (mcur = m; mcur; mcur = mcur->m_nextpkt) {
3698                 nextpkt = mcur->m_nextpkt;
3699                 mcur->m_nextpkt = NULL;
3700                 if (snap) {
3701                         M_PREPEND(mcur, sizeof(struct llc), M_NOWAIT);
3702                         if (mcur == NULL) {
3703                                 error = ENOBUFS;
3704                                 if (mprev != NULL)
3705                                         mprev->m_nextpkt = nextpkt;
3706                                 goto dropit;
3707                         }
3708                         bcopy(llc, mtod(mcur, caddr_t),sizeof(struct llc));
3709                 }
3710
3711                 M_PREPEND(mcur, ETHER_HDR_LEN, M_NOWAIT);
3712                 if (mcur == NULL) {
3713                         error = ENOBUFS;
3714                         if (mprev != NULL)
3715                                 mprev->m_nextpkt = nextpkt;
3716                         goto dropit;
3717                 }
3718                 bcopy(eh, mtod(mcur, caddr_t), ETHER_HDR_LEN);
3719
3720                 /*
3721                  * The previous two M_PREPEND could have inserted one or two
3722                  * mbufs in front so we have to update the previous packet's
3723                  * m_nextpkt.
3724                  */
3725                 mcur->m_nextpkt = nextpkt;
3726                 if (mprev != NULL)
3727                         mprev->m_nextpkt = mcur;
3728                 else {
3729                         /* The first mbuf in the original chain needs to be
3730                          * updated. */
3731                         *mp = mcur;
3732                 }
3733                 mprev = mcur;
3734         }
3735
3736         KMOD_IPSTAT_INC(ips_fragmented);
3737         return (error);
3738
3739 dropit:
3740         for (mcur = *mp; mcur; mcur = m) { /* droping the full packet chain */
3741                 m = mcur->m_nextpkt;
3742                 m_freem(mcur);
3743         }
3744         return (error);
3745 }
3746
3747 static void
3748 bridge_linkstate(struct ifnet *ifp)
3749 {
3750         struct bridge_softc *sc = ifp->if_bridge;
3751         struct bridge_iflist *bif;
3752         struct epoch_tracker et;
3753
3754         NET_EPOCH_ENTER(et);
3755
3756         bif = bridge_lookup_member_if(sc, ifp);
3757         if (bif == NULL) {
3758                 NET_EPOCH_EXIT(et);
3759                 return;
3760         }
3761         bridge_linkcheck(sc);
3762
3763         bstp_linkstate(&bif->bif_stp);
3764
3765         NET_EPOCH_EXIT(et);
3766 }
3767
3768 static void
3769 bridge_linkcheck(struct bridge_softc *sc)
3770 {
3771         struct bridge_iflist *bif;
3772         int new_link, hasls;
3773
3774         BRIDGE_LOCK_OR_NET_EPOCH_ASSERT(sc);
3775
3776         new_link = LINK_STATE_DOWN;
3777         hasls = 0;
3778         /* Our link is considered up if at least one of our ports is active */
3779         CK_LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
3780                 if (bif->bif_ifp->if_capabilities & IFCAP_LINKSTATE)
3781                         hasls++;
3782                 if (bif->bif_ifp->if_link_state == LINK_STATE_UP) {
3783                         new_link = LINK_STATE_UP;
3784                         break;
3785                 }
3786         }
3787         if (!CK_LIST_EMPTY(&sc->sc_iflist) && !hasls) {
3788                 /* If no interfaces support link-state then we default to up */
3789                 new_link = LINK_STATE_UP;
3790         }
3791         if_link_state_change(sc->sc_ifp, new_link);
3792 }