The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/if_bridge.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $       */
    2 
    3 /*
    4  * Copyright 2001 Wasabi Systems, Inc.
    5  * All rights reserved.
    6  *
    7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  * 3. All advertising materials mentioning features or use of this software
   18  *    must display the following acknowledgement:
   19  *      This product includes software developed for the NetBSD Project by
   20  *      Wasabi Systems, Inc.
   21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
   22  *    or promote products derived from this software without specific prior
   23  *    written permission.
   24  *
   25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
   26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
   29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
   33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   35  * POSSIBILITY OF SUCH DAMAGE.
   36  */
   37 
   38 /*
   39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
   40  * All rights reserved.
   41  *
   42  * Redistribution and use in source and binary forms, with or without
   43  * modification, are permitted provided that the following conditions
   44  * are met:
   45  * 1. Redistributions of source code must retain the above copyright
   46  *    notice, this list of conditions and the following disclaimer.
   47  * 2. Redistributions in binary form must reproduce the above copyright
   48  *    notice, this list of conditions and the following disclaimer in the
   49  *    documentation and/or other materials provided with the distribution.
   50  *
   51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   52  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
   53  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
   54  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
   55  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
   56  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
   57  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
   59  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
   60  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   61  * POSSIBILITY OF SUCH DAMAGE.
   62  *
   63  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
   64  */
   65 
   66 /*
   67  * Network interface bridge support.
   68  *
   69  * TODO:
   70  *
   71  *      - Currently only supports Ethernet-like interfaces (Ethernet,
   72  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
   73  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
   74  *        consider heterogenous bridges).
   75  */
   76 
   77 #include <sys/cdefs.h>
   78 __FBSDID("$FreeBSD: releng/9.0/sys/net/if_bridge.c 225380 2011-09-04 22:06:32Z thompsa $");
   79 
   80 #include "opt_inet.h"
   81 #include "opt_inet6.h"
   82 
   83 #include <sys/param.h>
   84 #include <sys/mbuf.h>
   85 #include <sys/malloc.h>
   86 #include <sys/protosw.h>
   87 #include <sys/systm.h>
   88 #include <sys/jail.h>
   89 #include <sys/time.h>
   90 #include <sys/socket.h> /* for net/if.h */
   91 #include <sys/sockio.h>
   92 #include <sys/ctype.h>  /* string functions */
   93 #include <sys/kernel.h>
   94 #include <sys/random.h>
   95 #include <sys/syslog.h>
   96 #include <sys/sysctl.h>
   97 #include <vm/uma.h>
   98 #include <sys/module.h>
   99 #include <sys/priv.h>
  100 #include <sys/proc.h>
  101 #include <sys/lock.h>
  102 #include <sys/mutex.h>
  103 #include <sys/rwlock.h>
  104 
  105 #include <net/bpf.h>
  106 #include <net/if.h>
  107 #include <net/if_clone.h>
  108 #include <net/if_dl.h>
  109 #include <net/if_types.h>
  110 #include <net/if_var.h>
  111 #include <net/pfil.h>
  112 #include <net/vnet.h>
  113 
  114 #include <netinet/in.h> /* for struct arpcom */
  115 #include <netinet/in_systm.h>
  116 #include <netinet/in_var.h>
  117 #include <netinet/ip.h>
  118 #include <netinet/ip_var.h>
  119 #ifdef INET6
  120 #include <netinet/ip6.h>
  121 #include <netinet6/ip6_var.h>
  122 #endif
  123 #if defined(INET) || defined(INET6)
  124 #include <netinet/ip_carp.h>
  125 #endif
  126 #include <machine/in_cksum.h>
  127 #include <netinet/if_ether.h> /* for struct arpcom */
  128 #include <net/bridgestp.h>
  129 #include <net/if_bridgevar.h>
  130 #include <net/if_llc.h>
  131 #include <net/if_vlan_var.h>
  132 
  133 #include <net/route.h>
  134 #include <netinet/ip_fw.h>
  135 #include <netinet/ipfw/ip_fw_private.h>
  136 
  137 /*
  138  * Size of the route hash table.  Must be a power of two.
  139  */
  140 #ifndef BRIDGE_RTHASH_SIZE
  141 #define BRIDGE_RTHASH_SIZE              1024
  142 #endif
  143 
  144 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
  145 
  146 /*
  147  * Maximum number of addresses to cache.
  148  */
  149 #ifndef BRIDGE_RTABLE_MAX
  150 #define BRIDGE_RTABLE_MAX               100
  151 #endif
  152 
  153 /*
  154  * Timeout (in seconds) for entries learned dynamically.
  155  */
  156 #ifndef BRIDGE_RTABLE_TIMEOUT
  157 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
  158 #endif
  159 
  160 /*
  161  * Number of seconds between walks of the route list.
  162  */
  163 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
  164 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
  165 #endif
  166 
  167 /*
  168  * List of capabilities to possibly mask on the member interface.
  169  */
  170 #define BRIDGE_IFCAPS_MASK              (IFCAP_TOE|IFCAP_TSO|IFCAP_TXCSUM)
  171 
  172 /*
  173  * List of capabilities to strip
  174  */
  175 #define BRIDGE_IFCAPS_STRIP             IFCAP_LRO
  176 
  177 /*
  178  * Bridge interface list entry.
  179  */
  180 struct bridge_iflist {
  181         LIST_ENTRY(bridge_iflist) bif_next;
  182         struct ifnet            *bif_ifp;       /* member if */
  183         struct bstp_port        bif_stp;        /* STP state */
  184         uint32_t                bif_flags;      /* member if flags */
  185         int                     bif_savedcaps;  /* saved capabilities */
  186         uint32_t                bif_addrmax;    /* max # of addresses */
  187         uint32_t                bif_addrcnt;    /* cur. # of addresses */
  188         uint32_t                bif_addrexceeded;/* # of address violations */
  189 };
  190 
  191 /*
  192  * Bridge route node.
  193  */
  194 struct bridge_rtnode {
  195         LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
  196         LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
  197         struct bridge_iflist    *brt_dst;       /* destination if */
  198         unsigned long           brt_expire;     /* expiration time */
  199         uint8_t                 brt_flags;      /* address flags */
  200         uint8_t                 brt_addr[ETHER_ADDR_LEN];
  201         uint16_t                brt_vlan;       /* vlan id */
  202 };
  203 #define brt_ifp                 brt_dst->bif_ifp
  204 
  205 /*
  206  * Software state for each bridge.
  207  */
  208 struct bridge_softc {
  209         struct ifnet            *sc_ifp;        /* make this an interface */
  210         LIST_ENTRY(bridge_softc) sc_list;
  211         struct mtx              sc_mtx;
  212         struct cv               sc_cv;
  213         uint32_t                sc_brtmax;      /* max # of addresses */
  214         uint32_t                sc_brtcnt;      /* cur. # of addresses */
  215         uint32_t                sc_brttimeout;  /* rt timeout in seconds */
  216         struct callout          sc_brcallout;   /* bridge callout */
  217         uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
  218         uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
  219         LIST_HEAD(, bridge_iflist) sc_iflist;   /* member interface list */
  220         LIST_HEAD(, bridge_rtnode) *sc_rthash;  /* our forwarding table */
  221         LIST_HEAD(, bridge_rtnode) sc_rtlist;   /* list version of above */
  222         uint32_t                sc_rthash_key;  /* key for hash */
  223         LIST_HEAD(, bridge_iflist) sc_spanlist; /* span ports list */
  224         struct bstp_state       sc_stp;         /* STP state */
  225         uint32_t                sc_brtexceeded; /* # of cache drops */
  226         struct ifnet            *sc_ifaddr;     /* member mac copied from */
  227         u_char                  sc_defaddr[6];  /* Default MAC address */
  228 };
  229 
  230 static struct mtx       bridge_list_mtx;
  231 eventhandler_tag        bridge_detach_cookie = NULL;
  232 
  233 int     bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
  234 
  235 uma_zone_t bridge_rtnode_zone;
  236 
  237 static int      bridge_clone_create(struct if_clone *, int, caddr_t);
  238 static void     bridge_clone_destroy(struct ifnet *);
  239 
  240 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t);
  241 static void     bridge_mutecaps(struct bridge_softc *);
  242 static void     bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
  243                     int);
  244 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
  245 static void     bridge_init(void *);
  246 static void     bridge_dummynet(struct mbuf *, struct ifnet *);
  247 static void     bridge_stop(struct ifnet *, int);
  248 static void     bridge_start(struct ifnet *);
  249 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
  250 static int      bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
  251                     struct rtentry *);
  252 static void     bridge_enqueue(struct bridge_softc *, struct ifnet *,
  253                     struct mbuf *);
  254 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
  255 
  256 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
  257                     struct mbuf *m);
  258 
  259 static void     bridge_timer(void *);
  260 
  261 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
  262                     struct mbuf *, int);
  263 static void     bridge_span(struct bridge_softc *, struct mbuf *);
  264 
  265 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
  266                     uint16_t, struct bridge_iflist *, int, uint8_t);
  267 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *,
  268                     uint16_t);
  269 static void     bridge_rttrim(struct bridge_softc *);
  270 static void     bridge_rtage(struct bridge_softc *);
  271 static void     bridge_rtflush(struct bridge_softc *, int);
  272 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *,
  273                     uint16_t);
  274 
  275 static int      bridge_rtable_init(struct bridge_softc *);
  276 static void     bridge_rtable_fini(struct bridge_softc *);
  277 
  278 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
  279 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
  280                     const uint8_t *, uint16_t);
  281 static int      bridge_rtnode_insert(struct bridge_softc *,
  282                     struct bridge_rtnode *);
  283 static void     bridge_rtnode_destroy(struct bridge_softc *,
  284                     struct bridge_rtnode *);
  285 static void     bridge_rtable_expire(struct ifnet *, int);
  286 static void     bridge_state_change(struct ifnet *, int);
  287 
  288 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
  289                     const char *name);
  290 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
  291                     struct ifnet *ifp);
  292 static void     bridge_delete_member(struct bridge_softc *,
  293                     struct bridge_iflist *, int);
  294 static void     bridge_delete_span(struct bridge_softc *,
  295                     struct bridge_iflist *);
  296 
  297 static int      bridge_ioctl_add(struct bridge_softc *, void *);
  298 static int      bridge_ioctl_del(struct bridge_softc *, void *);
  299 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
  300 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
  301 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
  302 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
  303 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
  304 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
  305 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
  306 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
  307 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
  308 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
  309 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
  310 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
  311 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
  312 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
  313 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
  314 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
  315 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
  316 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
  317 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
  318 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
  319 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
  320 static int      bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *);
  321 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
  322 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
  323 static int      bridge_ioctl_gbparam(struct bridge_softc *, void *);
  324 static int      bridge_ioctl_grte(struct bridge_softc *, void *);
  325 static int      bridge_ioctl_gifsstp(struct bridge_softc *, void *);
  326 static int      bridge_ioctl_sproto(struct bridge_softc *, void *);
  327 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *);
  328 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
  329                     int);
  330 static int      bridge_ip_checkbasic(struct mbuf **mp);
  331 #ifdef INET6
  332 static int      bridge_ip6_checkbasic(struct mbuf **mp);
  333 #endif /* INET6 */
  334 static int      bridge_fragment(struct ifnet *, struct mbuf *,
  335                     struct ether_header *, int, struct llc *);
  336 
  337 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
  338 #define VLANTAGOF(_m)   \
  339     (_m->m_flags & M_VLANTAG) ? EVL_VLANOFTAG(_m->m_pkthdr.ether_vtag) : 1
  340 
  341 static struct bstp_cb_ops bridge_ops = {
  342         .bcb_state = bridge_state_change,
  343         .bcb_rtage = bridge_rtable_expire
  344 };
  345 
  346 SYSCTL_DECL(_net_link);
  347 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
  348 
  349 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
  350 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
  351 static int pfil_member = 1; /* run pfil hooks on the member interface */
  352 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
  353 static int pfil_ipfw_arp = 0;   /* layer2 filter with ipfw */
  354 static int pfil_local_phys = 0; /* run pfil hooks on the physical interface for
  355                                    locally destined packets */
  356 static int log_stp   = 0;   /* log STP state changes */
  357 static int bridge_inherit_mac = 0;   /* share MAC with first bridge member */
  358 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
  359     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
  360 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp, CTLFLAG_RW,
  361     &pfil_ipfw_arp, 0, "Filter ARP packets through IPFW layer2");
  362 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
  363     &pfil_bridge, 0, "Packet filter on the bridge interface");
  364 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
  365     &pfil_member, 0, "Packet filter on the member interface");
  366 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys, CTLFLAG_RW,
  367     &pfil_local_phys, 0,
  368     "Packet filter on the physical interface for locally destined packets");
  369 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
  370     &log_stp, 0, "Log STP state changes");
  371 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac, CTLFLAG_RW,
  372     &bridge_inherit_mac, 0,
  373     "Inherit MAC address from the first bridge member");
  374 
  375 struct bridge_control {
  376         int     (*bc_func)(struct bridge_softc *, void *);
  377         int     bc_argsize;
  378         int     bc_flags;
  379 };
  380 
  381 #define BC_F_COPYIN             0x01    /* copy arguments in */
  382 #define BC_F_COPYOUT            0x02    /* copy arguments out */
  383 #define BC_F_SUSER              0x04    /* do super-user check */
  384 
  385 const struct bridge_control bridge_control_table[] = {
  386         { bridge_ioctl_add,             sizeof(struct ifbreq),
  387           BC_F_COPYIN|BC_F_SUSER },
  388         { bridge_ioctl_del,             sizeof(struct ifbreq),
  389           BC_F_COPYIN|BC_F_SUSER },
  390 
  391         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
  392           BC_F_COPYIN|BC_F_COPYOUT },
  393         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
  394           BC_F_COPYIN|BC_F_SUSER },
  395 
  396         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
  397           BC_F_COPYIN|BC_F_SUSER },
  398         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
  399           BC_F_COPYOUT },
  400 
  401         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
  402           BC_F_COPYIN|BC_F_COPYOUT },
  403         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
  404           BC_F_COPYIN|BC_F_COPYOUT },
  405 
  406         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
  407           BC_F_COPYIN|BC_F_SUSER },
  408 
  409         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
  410           BC_F_COPYIN|BC_F_SUSER },
  411         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
  412           BC_F_COPYOUT },
  413 
  414         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
  415           BC_F_COPYIN|BC_F_SUSER },
  416 
  417         { bridge_ioctl_flush,           sizeof(struct ifbreq),
  418           BC_F_COPYIN|BC_F_SUSER },
  419 
  420         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
  421           BC_F_COPYOUT },
  422         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
  423           BC_F_COPYIN|BC_F_SUSER },
  424 
  425         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
  426           BC_F_COPYOUT },
  427         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
  428           BC_F_COPYIN|BC_F_SUSER },
  429 
  430         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
  431           BC_F_COPYOUT },
  432         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
  433           BC_F_COPYIN|BC_F_SUSER },
  434 
  435         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
  436           BC_F_COPYOUT },
  437         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
  438           BC_F_COPYIN|BC_F_SUSER },
  439 
  440         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
  441           BC_F_COPYIN|BC_F_SUSER },
  442 
  443         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
  444           BC_F_COPYIN|BC_F_SUSER },
  445 
  446         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
  447           BC_F_COPYIN|BC_F_SUSER },
  448         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
  449           BC_F_COPYIN|BC_F_SUSER },
  450 
  451         { bridge_ioctl_gbparam,         sizeof(struct ifbropreq),
  452           BC_F_COPYOUT },
  453 
  454         { bridge_ioctl_grte,            sizeof(struct ifbrparam),
  455           BC_F_COPYOUT },
  456 
  457         { bridge_ioctl_gifsstp,         sizeof(struct ifbpstpconf),
  458           BC_F_COPYIN|BC_F_COPYOUT },
  459 
  460         { bridge_ioctl_sproto,          sizeof(struct ifbrparam),
  461           BC_F_COPYIN|BC_F_SUSER },
  462 
  463         { bridge_ioctl_stxhc,           sizeof(struct ifbrparam),
  464           BC_F_COPYIN|BC_F_SUSER },
  465 
  466         { bridge_ioctl_sifmaxaddr,      sizeof(struct ifbreq),
  467           BC_F_COPYIN|BC_F_SUSER },
  468 
  469 };
  470 const int bridge_control_table_size =
  471     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
  472 
  473 LIST_HEAD(, bridge_softc) bridge_list;
  474 
  475 IFC_SIMPLE_DECLARE(bridge, 0);
  476 
  477 static int
  478 bridge_modevent(module_t mod, int type, void *data)
  479 {
  480 
  481         switch (type) {
  482         case MOD_LOAD:
  483                 mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
  484                 if_clone_attach(&bridge_cloner);
  485                 bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
  486                     sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
  487                     UMA_ALIGN_PTR, 0);
  488                 LIST_INIT(&bridge_list);
  489                 bridge_input_p = bridge_input;
  490                 bridge_output_p = bridge_output;
  491                 bridge_dn_p = bridge_dummynet;
  492                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
  493                     ifnet_departure_event, bridge_ifdetach, NULL,
  494                     EVENTHANDLER_PRI_ANY);
  495                 break;
  496         case MOD_UNLOAD:
  497                 EVENTHANDLER_DEREGISTER(ifnet_departure_event,
  498                     bridge_detach_cookie);
  499                 if_clone_detach(&bridge_cloner);
  500                 uma_zdestroy(bridge_rtnode_zone);
  501                 bridge_input_p = NULL;
  502                 bridge_output_p = NULL;
  503                 bridge_dn_p = NULL;
  504                 mtx_destroy(&bridge_list_mtx);
  505                 break;
  506         default:
  507                 return (EOPNOTSUPP);
  508         }
  509         return (0);
  510 }
  511 
  512 static moduledata_t bridge_mod = {
  513         "if_bridge",
  514         bridge_modevent,
  515         0
  516 };
  517 
  518 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
  519 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
  520 
  521 /*
  522  * handler for net.link.bridge.pfil_ipfw
  523  */
  524 static int
  525 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
  526 {
  527         int enable = pfil_ipfw;
  528         int error;
  529 
  530         error = sysctl_handle_int(oidp, &enable, 0, req);
  531         enable = (enable) ? 1 : 0;
  532 
  533         if (enable != pfil_ipfw) {
  534                 pfil_ipfw = enable;
  535 
  536                 /*
  537                  * Disable pfil so that ipfw doesnt run twice, if the user
  538                  * really wants both then they can re-enable pfil_bridge and/or
  539                  * pfil_member. Also allow non-ip packets as ipfw can filter by
  540                  * layer2 type.
  541                  */
  542                 if (pfil_ipfw) {
  543                         pfil_onlyip = 0;
  544                         pfil_bridge = 0;
  545                         pfil_member = 0;
  546                 }
  547         }
  548 
  549         return (error);
  550 }
  551 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
  552             &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
  553 
  554 /*
  555  * bridge_clone_create:
  556  *
  557  *      Create a new bridge instance.
  558  */
  559 static int
  560 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
  561 {
  562         struct bridge_softc *sc, *sc2;
  563         struct ifnet *bifp, *ifp;
  564         int fb, retry;
  565         unsigned long hostid;
  566 
  567         sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
  568         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
  569         if (ifp == NULL) {
  570                 free(sc, M_DEVBUF);
  571                 return (ENOSPC);
  572         }
  573 
  574         BRIDGE_LOCK_INIT(sc);
  575         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
  576         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
  577 
  578         /* Initialize our routing table. */
  579         bridge_rtable_init(sc);
  580 
  581         callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
  582 
  583         LIST_INIT(&sc->sc_iflist);
  584         LIST_INIT(&sc->sc_spanlist);
  585 
  586         ifp->if_softc = sc;
  587         if_initname(ifp, ifc->ifc_name, unit);
  588         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
  589         ifp->if_ioctl = bridge_ioctl;
  590         ifp->if_start = bridge_start;
  591         ifp->if_init = bridge_init;
  592         ifp->if_type = IFT_BRIDGE;
  593         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
  594         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
  595         IFQ_SET_READY(&ifp->if_snd);
  596 
  597         /*
  598          * Generate an ethernet address with a locally administered address.
  599          *
  600          * Since we are using random ethernet addresses for the bridge, it is
  601          * possible that we might have address collisions, so make sure that
  602          * this hardware address isn't already in use on another bridge.
  603          * The first try uses the hostid and falls back to arc4rand().
  604          */
  605         fb = 0;
  606         getcredhostid(curthread->td_ucred, &hostid);
  607         for (retry = 1; retry != 0;) {
  608                 if (fb || hostid == 0) {
  609                         arc4rand(sc->sc_defaddr, ETHER_ADDR_LEN, 1);
  610                         sc->sc_defaddr[0] &= ~1;/* clear multicast bit */
  611                         sc->sc_defaddr[0] |= 2; /* set the LAA bit */
  612                 } else {
  613                         sc->sc_defaddr[0] = 0x2;
  614                         sc->sc_defaddr[1] = (hostid >> 24) & 0xff;
  615                         sc->sc_defaddr[2] = (hostid >> 16) & 0xff;
  616                         sc->sc_defaddr[3] = (hostid >> 8 ) & 0xff;
  617                         sc->sc_defaddr[4] =  hostid        & 0xff;
  618                         sc->sc_defaddr[5] = ifp->if_dunit & 0xff;
  619                 }
  620 
  621                 fb = 1;
  622                 retry = 0;
  623                 mtx_lock(&bridge_list_mtx);
  624                 LIST_FOREACH(sc2, &bridge_list, sc_list) {
  625                         bifp = sc2->sc_ifp;
  626                         if (memcmp(sc->sc_defaddr,
  627                             IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
  628                                 retry = 1;
  629                 }
  630                 mtx_unlock(&bridge_list_mtx);
  631         }
  632 
  633         bstp_attach(&sc->sc_stp, &bridge_ops);
  634         ether_ifattach(ifp, sc->sc_defaddr);
  635         /* Now undo some of the damage... */
  636         ifp->if_baudrate = 0;
  637         ifp->if_type = IFT_BRIDGE;
  638 
  639         mtx_lock(&bridge_list_mtx);
  640         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
  641         mtx_unlock(&bridge_list_mtx);
  642 
  643         return (0);
  644 }
  645 
  646 /*
  647  * bridge_clone_destroy:
  648  *
  649  *      Destroy a bridge instance.
  650  */
  651 static void
  652 bridge_clone_destroy(struct ifnet *ifp)
  653 {
  654         struct bridge_softc *sc = ifp->if_softc;
  655         struct bridge_iflist *bif;
  656 
  657         BRIDGE_LOCK(sc);
  658 
  659         bridge_stop(ifp, 1);
  660         ifp->if_flags &= ~IFF_UP;
  661 
  662         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
  663                 bridge_delete_member(sc, bif, 0);
  664 
  665         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
  666                 bridge_delete_span(sc, bif);
  667         }
  668 
  669         BRIDGE_UNLOCK(sc);
  670 
  671         callout_drain(&sc->sc_brcallout);
  672 
  673         mtx_lock(&bridge_list_mtx);
  674         LIST_REMOVE(sc, sc_list);
  675         mtx_unlock(&bridge_list_mtx);
  676 
  677         bstp_detach(&sc->sc_stp);
  678         ether_ifdetach(ifp);
  679         if_free_type(ifp, IFT_ETHER);
  680 
  681         /* Tear down the routing table. */
  682         bridge_rtable_fini(sc);
  683 
  684         BRIDGE_LOCK_DESTROY(sc);
  685         free(sc, M_DEVBUF);
  686 }
  687 
  688 /*
  689  * bridge_ioctl:
  690  *
  691  *      Handle a control request from the operator.
  692  */
  693 static int
  694 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
  695 {
  696         struct bridge_softc *sc = ifp->if_softc;
  697         struct ifreq *ifr = (struct ifreq *)data;
  698         struct bridge_iflist *bif;
  699         struct thread *td = curthread;
  700         union {
  701                 struct ifbreq ifbreq;
  702                 struct ifbifconf ifbifconf;
  703                 struct ifbareq ifbareq;
  704                 struct ifbaconf ifbaconf;
  705                 struct ifbrparam ifbrparam;
  706                 struct ifbropreq ifbropreq;
  707         } args;
  708         struct ifdrv *ifd = (struct ifdrv *) data;
  709         const struct bridge_control *bc;
  710         int error = 0;
  711 
  712         switch (cmd) {
  713 
  714         case SIOCADDMULTI:
  715         case SIOCDELMULTI:
  716                 break;
  717 
  718         case SIOCGDRVSPEC:
  719         case SIOCSDRVSPEC:
  720                 if (ifd->ifd_cmd >= bridge_control_table_size) {
  721                         error = EINVAL;
  722                         break;
  723                 }
  724                 bc = &bridge_control_table[ifd->ifd_cmd];
  725 
  726                 if (cmd == SIOCGDRVSPEC &&
  727                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
  728                         error = EINVAL;
  729                         break;
  730                 }
  731                 else if (cmd == SIOCSDRVSPEC &&
  732                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
  733                         error = EINVAL;
  734                         break;
  735                 }
  736 
  737                 if (bc->bc_flags & BC_F_SUSER) {
  738                         error = priv_check(td, PRIV_NET_BRIDGE);
  739                         if (error)
  740                                 break;
  741                 }
  742 
  743                 if (ifd->ifd_len != bc->bc_argsize ||
  744                     ifd->ifd_len > sizeof(args)) {
  745                         error = EINVAL;
  746                         break;
  747                 }
  748 
  749                 bzero(&args, sizeof(args));
  750                 if (bc->bc_flags & BC_F_COPYIN) {
  751                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
  752                         if (error)
  753                                 break;
  754                 }
  755 
  756                 BRIDGE_LOCK(sc);
  757                 error = (*bc->bc_func)(sc, &args);
  758                 BRIDGE_UNLOCK(sc);
  759                 if (error)
  760                         break;
  761 
  762                 if (bc->bc_flags & BC_F_COPYOUT)
  763                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
  764 
  765                 break;
  766 
  767         case SIOCSIFFLAGS:
  768                 if (!(ifp->if_flags & IFF_UP) &&
  769                     (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
  770                         /*
  771                          * If interface is marked down and it is running,
  772                          * then stop and disable it.
  773                          */
  774                         BRIDGE_LOCK(sc);
  775                         bridge_stop(ifp, 1);
  776                         BRIDGE_UNLOCK(sc);
  777                 } else if ((ifp->if_flags & IFF_UP) &&
  778                     !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
  779                         /*
  780                          * If interface is marked up and it is stopped, then
  781                          * start it.
  782                          */
  783                         (*ifp->if_init)(sc);
  784                 }
  785                 break;
  786 
  787         case SIOCSIFMTU:
  788                 if (ifr->ifr_mtu < 576) {
  789                         error = EINVAL;
  790                         break;
  791                 }
  792                 if (LIST_EMPTY(&sc->sc_iflist)) {
  793                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
  794                         break;
  795                 }
  796                 BRIDGE_LOCK(sc);
  797                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
  798                         if (bif->bif_ifp->if_mtu != ifr->ifr_mtu) {
  799                                 log(LOG_NOTICE, "%s: invalid MTU: %lu(%s)"
  800                                     " != %d\n", sc->sc_ifp->if_xname,
  801                                     bif->bif_ifp->if_mtu,
  802                                     bif->bif_ifp->if_xname, ifr->ifr_mtu);
  803                                 error = EINVAL;
  804                                 break;
  805                         }
  806                 }
  807                 if (!error)
  808                         sc->sc_ifp->if_mtu = ifr->ifr_mtu;
  809                 BRIDGE_UNLOCK(sc);
  810                 break;
  811         default:
  812                 /*
  813                  * drop the lock as ether_ioctl() will call bridge_start() and
  814                  * cause the lock to be recursed.
  815                  */
  816                 error = ether_ioctl(ifp, cmd, data);
  817                 break;
  818         }
  819 
  820         return (error);
  821 }
  822 
  823 /*
  824  * bridge_mutecaps:
  825  *
  826  *      Clear or restore unwanted capabilities on the member interface
  827  */
  828 static void
  829 bridge_mutecaps(struct bridge_softc *sc)
  830 {
  831         struct bridge_iflist *bif;
  832         int enabled, mask;
  833 
  834         /* Initial bitmask of capabilities to test */
  835         mask = BRIDGE_IFCAPS_MASK;
  836 
  837         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
  838                 /* Every member must support it or its disabled */
  839                 mask &= bif->bif_savedcaps;
  840         }
  841 
  842         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
  843                 enabled = bif->bif_ifp->if_capenable;
  844                 enabled &= ~BRIDGE_IFCAPS_STRIP;
  845                 /* strip off mask bits and enable them again if allowed */
  846                 enabled &= ~BRIDGE_IFCAPS_MASK;
  847                 enabled |= mask;
  848                 bridge_set_ifcap(sc, bif, enabled);
  849         }
  850 
  851 }
  852 
  853 static void
  854 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
  855 {
  856         struct ifnet *ifp = bif->bif_ifp;
  857         struct ifreq ifr;
  858         int error;
  859 
  860         bzero(&ifr, sizeof(ifr));
  861         ifr.ifr_reqcap = set;
  862 
  863         if (ifp->if_capenable != set) {
  864                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
  865                 if (error)
  866                         if_printf(sc->sc_ifp,
  867                             "error setting interface capabilities on %s\n",
  868                             ifp->if_xname);
  869         }
  870 }
  871 
  872 /*
  873  * bridge_lookup_member:
  874  *
  875  *      Lookup a bridge member interface.
  876  */
  877 static struct bridge_iflist *
  878 bridge_lookup_member(struct bridge_softc *sc, const char *name)
  879 {
  880         struct bridge_iflist *bif;
  881         struct ifnet *ifp;
  882 
  883         BRIDGE_LOCK_ASSERT(sc);
  884 
  885         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
  886                 ifp = bif->bif_ifp;
  887                 if (strcmp(ifp->if_xname, name) == 0)
  888                         return (bif);
  889         }
  890 
  891         return (NULL);
  892 }
  893 
  894 /*
  895  * bridge_lookup_member_if:
  896  *
  897  *      Lookup a bridge member interface by ifnet*.
  898  */
  899 static struct bridge_iflist *
  900 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
  901 {
  902         struct bridge_iflist *bif;
  903 
  904         BRIDGE_LOCK_ASSERT(sc);
  905 
  906         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
  907                 if (bif->bif_ifp == member_ifp)
  908                         return (bif);
  909         }
  910 
  911         return (NULL);
  912 }
  913 
  914 /*
  915  * bridge_delete_member:
  916  *
  917  *      Delete the specified member interface.
  918  */
  919 static void
  920 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
  921     int gone)
  922 {
  923         struct ifnet *ifs = bif->bif_ifp;
  924         struct ifnet *fif = NULL;
  925 
  926         BRIDGE_LOCK_ASSERT(sc);
  927 
  928         if (bif->bif_flags & IFBIF_STP)
  929                 bstp_disable(&bif->bif_stp);
  930 
  931         ifs->if_bridge = NULL;
  932         BRIDGE_XLOCK(sc);
  933         LIST_REMOVE(bif, bif_next);
  934         BRIDGE_XDROP(sc);
  935 
  936         /*
  937          * If removing the interface that gave the bridge its mac address, set
  938          * the mac address of the bridge to the address of the next member, or
  939          * to its default address if no members are left.
  940          */
  941         if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
  942                 if (LIST_EMPTY(&sc->sc_iflist)) {
  943                         bcopy(sc->sc_defaddr,
  944                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
  945                         sc->sc_ifaddr = NULL;
  946                 } else {
  947                         fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp;
  948                         bcopy(IF_LLADDR(fif),
  949                             IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
  950                         sc->sc_ifaddr = fif;
  951                 }
  952                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
  953         }
  954 
  955         bridge_mutecaps(sc);    /* recalcuate now this interface is removed */
  956         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
  957         KASSERT(bif->bif_addrcnt == 0,
  958             ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
  959 
  960         BRIDGE_UNLOCK(sc);
  961         if (!gone) {
  962                 switch (ifs->if_type) {
  963                 case IFT_ETHER:
  964                 case IFT_L2VLAN:
  965                         /*
  966                          * Take the interface out of promiscuous mode.
  967                          */
  968                         (void) ifpromisc(ifs, 0);
  969                         break;
  970 
  971                 case IFT_GIF:
  972                         break;
  973 
  974                 default:
  975 #ifdef DIAGNOSTIC
  976                         panic("bridge_delete_member: impossible");
  977 #endif
  978                         break;
  979                 }
  980                 /* reneable any interface capabilities */
  981                 bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
  982         }
  983         bstp_destroy(&bif->bif_stp);    /* prepare to free */
  984         BRIDGE_LOCK(sc);
  985         free(bif, M_DEVBUF);
  986 }
  987 
  988 /*
  989  * bridge_delete_span:
  990  *
  991  *      Delete the specified span interface.
  992  */
  993 static void
  994 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
  995 {
  996         BRIDGE_LOCK_ASSERT(sc);
  997 
  998         KASSERT(bif->bif_ifp->if_bridge == NULL,
  999             ("%s: not a span interface", __func__));
 1000 
 1001         LIST_REMOVE(bif, bif_next);
 1002         free(bif, M_DEVBUF);
 1003 }
 1004 
 1005 static int
 1006 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 1007 {
 1008         struct ifbreq *req = arg;
 1009         struct bridge_iflist *bif = NULL;
 1010         struct ifnet *ifs;
 1011         int error = 0;
 1012 
 1013         ifs = ifunit(req->ifbr_ifsname);
 1014         if (ifs == NULL)
 1015                 return (ENOENT);
 1016         if (ifs->if_ioctl == NULL)      /* must be supported */
 1017                 return (EINVAL);
 1018 
 1019         /* If it's in the span list, it can't be a member. */
 1020         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 1021                 if (ifs == bif->bif_ifp)
 1022                         return (EBUSY);
 1023 
 1024         if (ifs->if_bridge == sc)
 1025                 return (EEXIST);
 1026 
 1027         if (ifs->if_bridge != NULL)
 1028                 return (EBUSY);
 1029 
 1030         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 1031         if (bif == NULL)
 1032                 return (ENOMEM);
 1033 
 1034         bif->bif_ifp = ifs;
 1035         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 1036         bif->bif_savedcaps = ifs->if_capenable;
 1037 
 1038         switch (ifs->if_type) {
 1039         case IFT_ETHER:
 1040         case IFT_L2VLAN:
 1041         case IFT_GIF:
 1042                 /* permitted interface types */
 1043                 break;
 1044         default:
 1045                 error = EINVAL;
 1046                 goto out;
 1047         }
 1048 
 1049         /* Allow the first Ethernet member to define the MTU */
 1050         if (LIST_EMPTY(&sc->sc_iflist))
 1051                 sc->sc_ifp->if_mtu = ifs->if_mtu;
 1052         else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 1053                 if_printf(sc->sc_ifp, "invalid MTU: %lu(%s) != %lu\n",
 1054                     ifs->if_mtu, ifs->if_xname, sc->sc_ifp->if_mtu);
 1055                 error = EINVAL;
 1056                 goto out;
 1057         }
 1058 
 1059         /*
 1060          * Assign the interface's MAC address to the bridge if it's the first
 1061          * member and the MAC address of the bridge has not been changed from
 1062          * the default randomly generated one.
 1063          */
 1064         if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) &&
 1065             !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) {
 1066                 bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
 1067                 sc->sc_ifaddr = ifs;
 1068                 EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
 1069         }
 1070 
 1071         ifs->if_bridge = sc;
 1072         bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
 1073         /*
 1074          * XXX: XLOCK HERE!?!
 1075          *
 1076          * NOTE: insert_***HEAD*** should be safe for the traversals.
 1077          */
 1078         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 1079 
 1080         /* Set interface capabilities to the intersection set of all members */
 1081         bridge_mutecaps(sc);
 1082 
 1083         switch (ifs->if_type) {
 1084         case IFT_ETHER:
 1085         case IFT_L2VLAN:
 1086                 /*
 1087                  * Place the interface into promiscuous mode.
 1088                  */
 1089                 BRIDGE_UNLOCK(sc);
 1090                 error = ifpromisc(ifs, 1);
 1091                 BRIDGE_LOCK(sc);
 1092                 break;
 1093         }
 1094         if (error)
 1095                 bridge_delete_member(sc, bif, 0);
 1096 out:
 1097         if (error) {
 1098                 if (bif != NULL)
 1099                         free(bif, M_DEVBUF);
 1100         }
 1101         return (error);
 1102 }
 1103 
 1104 static int
 1105 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 1106 {
 1107         struct ifbreq *req = arg;
 1108         struct bridge_iflist *bif;
 1109 
 1110         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1111         if (bif == NULL)
 1112                 return (ENOENT);
 1113 
 1114         bridge_delete_member(sc, bif, 0);
 1115 
 1116         return (0);
 1117 }
 1118 
 1119 static int
 1120 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 1121 {
 1122         struct ifbreq *req = arg;
 1123         struct bridge_iflist *bif;
 1124         struct bstp_port *bp;
 1125 
 1126         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1127         if (bif == NULL)
 1128                 return (ENOENT);
 1129 
 1130         bp = &bif->bif_stp;
 1131         req->ifbr_ifsflags = bif->bif_flags;
 1132         req->ifbr_state = bp->bp_state;
 1133         req->ifbr_priority = bp->bp_priority;
 1134         req->ifbr_path_cost = bp->bp_path_cost;
 1135         req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
 1136         req->ifbr_proto = bp->bp_protover;
 1137         req->ifbr_role = bp->bp_role;
 1138         req->ifbr_stpflags = bp->bp_flags;
 1139         req->ifbr_addrcnt = bif->bif_addrcnt;
 1140         req->ifbr_addrmax = bif->bif_addrmax;
 1141         req->ifbr_addrexceeded = bif->bif_addrexceeded;
 1142 
 1143         /* Copy STP state options as flags */
 1144         if (bp->bp_operedge)
 1145                 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
 1146         if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
 1147                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
 1148         if (bp->bp_ptp_link)
 1149                 req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
 1150         if (bp->bp_flags & BSTP_PORT_AUTOPTP)
 1151                 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
 1152         if (bp->bp_flags & BSTP_PORT_ADMEDGE)
 1153                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
 1154         if (bp->bp_flags & BSTP_PORT_ADMCOST)
 1155                 req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
 1156         return (0);
 1157 }
 1158 
 1159 static int
 1160 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
 1161 {
 1162         struct ifbreq *req = arg;
 1163         struct bridge_iflist *bif;
 1164         struct bstp_port *bp;
 1165         int error;
 1166 
 1167         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1168         if (bif == NULL)
 1169                 return (ENOENT);
 1170         bp = &bif->bif_stp;
 1171 
 1172         if (req->ifbr_ifsflags & IFBIF_SPAN)
 1173                 /* SPAN is readonly */
 1174                 return (EINVAL);
 1175 
 1176         if (req->ifbr_ifsflags & IFBIF_STP) {
 1177                 if ((bif->bif_flags & IFBIF_STP) == 0) {
 1178                         error = bstp_enable(&bif->bif_stp);
 1179                         if (error)
 1180                                 return (error);
 1181                 }
 1182         } else {
 1183                 if ((bif->bif_flags & IFBIF_STP) != 0)
 1184                         bstp_disable(&bif->bif_stp);
 1185         }
 1186 
 1187         /* Pass on STP flags */
 1188         bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
 1189         bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
 1190         bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
 1191         bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
 1192 
 1193         /* Save the bits relating to the bridge */
 1194         bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
 1195 
 1196         return (0);
 1197 }
 1198 
 1199 static int
 1200 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
 1201 {
 1202         struct ifbrparam *param = arg;
 1203 
 1204         sc->sc_brtmax = param->ifbrp_csize;
 1205         bridge_rttrim(sc);
 1206 
 1207         return (0);
 1208 }
 1209 
 1210 static int
 1211 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
 1212 {
 1213         struct ifbrparam *param = arg;
 1214 
 1215         param->ifbrp_csize = sc->sc_brtmax;
 1216 
 1217         return (0);
 1218 }
 1219 
 1220 static int
 1221 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
 1222 {
 1223         struct ifbifconf *bifc = arg;
 1224         struct bridge_iflist *bif;
 1225         struct ifbreq breq;
 1226         char *buf, *outbuf;
 1227         int count, buflen, len, error = 0;
 1228 
 1229         count = 0;
 1230         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
 1231                 count++;
 1232         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 1233                 count++;
 1234 
 1235         buflen = sizeof(breq) * count;
 1236         if (bifc->ifbic_len == 0) {
 1237                 bifc->ifbic_len = buflen;
 1238                 return (0);
 1239         }
 1240         BRIDGE_UNLOCK(sc);
 1241         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
 1242         BRIDGE_LOCK(sc);
 1243 
 1244         count = 0;
 1245         buf = outbuf;
 1246         len = min(bifc->ifbic_len, buflen);
 1247         bzero(&breq, sizeof(breq));
 1248         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 1249                 if (len < sizeof(breq))
 1250                         break;
 1251 
 1252                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
 1253                     sizeof(breq.ifbr_ifsname));
 1254                 /* Fill in the ifbreq structure */
 1255                 error = bridge_ioctl_gifflags(sc, &breq);
 1256                 if (error)
 1257                         break;
 1258                 memcpy(buf, &breq, sizeof(breq));
 1259                 count++;
 1260                 buf += sizeof(breq);
 1261                 len -= sizeof(breq);
 1262         }
 1263         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
 1264                 if (len < sizeof(breq))
 1265                         break;
 1266 
 1267                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
 1268                     sizeof(breq.ifbr_ifsname));
 1269                 breq.ifbr_ifsflags = bif->bif_flags;
 1270                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
 1271                 memcpy(buf, &breq, sizeof(breq));
 1272                 count++;
 1273                 buf += sizeof(breq);
 1274                 len -= sizeof(breq);
 1275         }
 1276 
 1277         BRIDGE_UNLOCK(sc);
 1278         bifc->ifbic_len = sizeof(breq) * count;
 1279         error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
 1280         BRIDGE_LOCK(sc);
 1281         free(outbuf, M_TEMP);
 1282         return (error);
 1283 }
 1284 
 1285 static int
 1286 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
 1287 {
 1288         struct ifbaconf *bac = arg;
 1289         struct bridge_rtnode *brt;
 1290         struct ifbareq bareq;
 1291         char *buf, *outbuf;
 1292         int count, buflen, len, error = 0;
 1293 
 1294         if (bac->ifbac_len == 0)
 1295                 return (0);
 1296 
 1297         count = 0;
 1298         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
 1299                 count++;
 1300         buflen = sizeof(bareq) * count;
 1301 
 1302         BRIDGE_UNLOCK(sc);
 1303         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
 1304         BRIDGE_LOCK(sc);
 1305 
 1306         count = 0;
 1307         buf = outbuf;
 1308         len = min(bac->ifbac_len, buflen);
 1309         bzero(&bareq, sizeof(bareq));
 1310         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
 1311                 if (len < sizeof(bareq))
 1312                         goto out;
 1313                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
 1314                     sizeof(bareq.ifba_ifsname));
 1315                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
 1316                 bareq.ifba_vlan = brt->brt_vlan;
 1317                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
 1318                                 time_uptime < brt->brt_expire)
 1319                         bareq.ifba_expire = brt->brt_expire - time_uptime;
 1320                 else
 1321                         bareq.ifba_expire = 0;
 1322                 bareq.ifba_flags = brt->brt_flags;
 1323 
 1324                 memcpy(buf, &bareq, sizeof(bareq));
 1325                 count++;
 1326                 buf += sizeof(bareq);
 1327                 len -= sizeof(bareq);
 1328         }
 1329 out:
 1330         BRIDGE_UNLOCK(sc);
 1331         bac->ifbac_len = sizeof(bareq) * count;
 1332         error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
 1333         BRIDGE_LOCK(sc);
 1334         free(outbuf, M_TEMP);
 1335         return (error);
 1336 }
 1337 
 1338 static int
 1339 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
 1340 {
 1341         struct ifbareq *req = arg;
 1342         struct bridge_iflist *bif;
 1343         int error;
 1344 
 1345         bif = bridge_lookup_member(sc, req->ifba_ifsname);
 1346         if (bif == NULL)
 1347                 return (ENOENT);
 1348 
 1349         error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
 1350             req->ifba_flags);
 1351 
 1352         return (error);
 1353 }
 1354 
 1355 static int
 1356 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
 1357 {
 1358         struct ifbrparam *param = arg;
 1359 
 1360         sc->sc_brttimeout = param->ifbrp_ctime;
 1361         return (0);
 1362 }
 1363 
 1364 static int
 1365 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
 1366 {
 1367         struct ifbrparam *param = arg;
 1368 
 1369         param->ifbrp_ctime = sc->sc_brttimeout;
 1370         return (0);
 1371 }
 1372 
 1373 static int
 1374 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
 1375 {
 1376         struct ifbareq *req = arg;
 1377 
 1378         return (bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan));
 1379 }
 1380 
 1381 static int
 1382 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
 1383 {
 1384         struct ifbreq *req = arg;
 1385 
 1386         bridge_rtflush(sc, req->ifbr_ifsflags);
 1387         return (0);
 1388 }
 1389 
 1390 static int
 1391 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
 1392 {
 1393         struct ifbrparam *param = arg;
 1394         struct bstp_state *bs = &sc->sc_stp;
 1395 
 1396         param->ifbrp_prio = bs->bs_bridge_priority;
 1397         return (0);
 1398 }
 1399 
 1400 static int
 1401 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
 1402 {
 1403         struct ifbrparam *param = arg;
 1404 
 1405         return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
 1406 }
 1407 
 1408 static int
 1409 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
 1410 {
 1411         struct ifbrparam *param = arg;
 1412         struct bstp_state *bs = &sc->sc_stp;
 1413 
 1414         param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
 1415         return (0);
 1416 }
 1417 
 1418 static int
 1419 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
 1420 {
 1421         struct ifbrparam *param = arg;
 1422 
 1423         return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
 1424 }
 1425 
 1426 static int
 1427 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
 1428 {
 1429         struct ifbrparam *param = arg;
 1430         struct bstp_state *bs = &sc->sc_stp;
 1431 
 1432         param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
 1433         return (0);
 1434 }
 1435 
 1436 static int
 1437 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
 1438 {
 1439         struct ifbrparam *param = arg;
 1440 
 1441         return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
 1442 }
 1443 
 1444 static int
 1445 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
 1446 {
 1447         struct ifbrparam *param = arg;
 1448         struct bstp_state *bs = &sc->sc_stp;
 1449 
 1450         param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
 1451         return (0);
 1452 }
 1453 
 1454 static int
 1455 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
 1456 {
 1457         struct ifbrparam *param = arg;
 1458 
 1459         return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
 1460 }
 1461 
 1462 static int
 1463 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
 1464 {
 1465         struct ifbreq *req = arg;
 1466         struct bridge_iflist *bif;
 1467 
 1468         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1469         if (bif == NULL)
 1470                 return (ENOENT);
 1471 
 1472         return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
 1473 }
 1474 
 1475 static int
 1476 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
 1477 {
 1478         struct ifbreq *req = arg;
 1479         struct bridge_iflist *bif;
 1480 
 1481         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1482         if (bif == NULL)
 1483                 return (ENOENT);
 1484 
 1485         return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
 1486 }
 1487 
 1488 static int
 1489 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *arg)
 1490 {
 1491         struct ifbreq *req = arg;
 1492         struct bridge_iflist *bif;
 1493 
 1494         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 1495         if (bif == NULL)
 1496                 return (ENOENT);
 1497 
 1498         bif->bif_addrmax = req->ifbr_addrmax;
 1499         return (0);
 1500 }
 1501 
 1502 static int
 1503 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
 1504 {
 1505         struct ifbreq *req = arg;
 1506         struct bridge_iflist *bif = NULL;
 1507         struct ifnet *ifs;
 1508 
 1509         ifs = ifunit(req->ifbr_ifsname);
 1510         if (ifs == NULL)
 1511                 return (ENOENT);
 1512 
 1513         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 1514                 if (ifs == bif->bif_ifp)
 1515                         return (EBUSY);
 1516 
 1517         if (ifs->if_bridge != NULL)
 1518                 return (EBUSY);
 1519 
 1520         switch (ifs->if_type) {
 1521                 case IFT_ETHER:
 1522                 case IFT_GIF:
 1523                 case IFT_L2VLAN:
 1524                         break;
 1525                 default:
 1526                         return (EINVAL);
 1527         }
 1528 
 1529         bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
 1530         if (bif == NULL)
 1531                 return (ENOMEM);
 1532 
 1533         bif->bif_ifp = ifs;
 1534         bif->bif_flags = IFBIF_SPAN;
 1535 
 1536         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
 1537 
 1538         return (0);
 1539 }
 1540 
 1541 static int
 1542 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
 1543 {
 1544         struct ifbreq *req = arg;
 1545         struct bridge_iflist *bif;
 1546         struct ifnet *ifs;
 1547 
 1548         ifs = ifunit(req->ifbr_ifsname);
 1549         if (ifs == NULL)
 1550                 return (ENOENT);
 1551 
 1552         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 1553                 if (ifs == bif->bif_ifp)
 1554                         break;
 1555 
 1556         if (bif == NULL)
 1557                 return (ENOENT);
 1558 
 1559         bridge_delete_span(sc, bif);
 1560 
 1561         return (0);
 1562 }
 1563 
 1564 static int
 1565 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
 1566 {
 1567         struct ifbropreq *req = arg;
 1568         struct bstp_state *bs = &sc->sc_stp;
 1569         struct bstp_port *root_port;
 1570 
 1571         req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
 1572         req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
 1573         req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
 1574 
 1575         root_port = bs->bs_root_port;
 1576         if (root_port == NULL)
 1577                 req->ifbop_root_port = 0;
 1578         else
 1579                 req->ifbop_root_port = root_port->bp_ifp->if_index;
 1580 
 1581         req->ifbop_holdcount = bs->bs_txholdcount;
 1582         req->ifbop_priority = bs->bs_bridge_priority;
 1583         req->ifbop_protocol = bs->bs_protover;
 1584         req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
 1585         req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
 1586         req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
 1587         req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
 1588         req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
 1589         req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
 1590 
 1591         return (0);
 1592 }
 1593 
 1594 static int
 1595 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
 1596 {
 1597         struct ifbrparam *param = arg;
 1598 
 1599         param->ifbrp_cexceeded = sc->sc_brtexceeded;
 1600         return (0);
 1601 }
 1602 
 1603 static int
 1604 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
 1605 {
 1606         struct ifbpstpconf *bifstp = arg;
 1607         struct bridge_iflist *bif;
 1608         struct bstp_port *bp;
 1609         struct ifbpstpreq bpreq;
 1610         char *buf, *outbuf;
 1611         int count, buflen, len, error = 0;
 1612 
 1613         count = 0;
 1614         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 1615                 if ((bif->bif_flags & IFBIF_STP) != 0)
 1616                         count++;
 1617         }
 1618 
 1619         buflen = sizeof(bpreq) * count;
 1620         if (bifstp->ifbpstp_len == 0) {
 1621                 bifstp->ifbpstp_len = buflen;
 1622                 return (0);
 1623         }
 1624 
 1625         BRIDGE_UNLOCK(sc);
 1626         outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
 1627         BRIDGE_LOCK(sc);
 1628 
 1629         count = 0;
 1630         buf = outbuf;
 1631         len = min(bifstp->ifbpstp_len, buflen);
 1632         bzero(&bpreq, sizeof(bpreq));
 1633         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 1634                 if (len < sizeof(bpreq))
 1635                         break;
 1636 
 1637                 if ((bif->bif_flags & IFBIF_STP) == 0)
 1638                         continue;
 1639 
 1640                 bp = &bif->bif_stp;
 1641                 bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
 1642                 bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
 1643                 bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
 1644                 bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
 1645                 bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
 1646                 bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
 1647 
 1648                 memcpy(buf, &bpreq, sizeof(bpreq));
 1649                 count++;
 1650                 buf += sizeof(bpreq);
 1651                 len -= sizeof(bpreq);
 1652         }
 1653 
 1654         BRIDGE_UNLOCK(sc);
 1655         bifstp->ifbpstp_len = sizeof(bpreq) * count;
 1656         error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
 1657         BRIDGE_LOCK(sc);
 1658         free(outbuf, M_TEMP);
 1659         return (error);
 1660 }
 1661 
 1662 static int
 1663 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
 1664 {
 1665         struct ifbrparam *param = arg;
 1666 
 1667         return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
 1668 }
 1669 
 1670 static int
 1671 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
 1672 {
 1673         struct ifbrparam *param = arg;
 1674 
 1675         return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
 1676 }
 1677 
 1678 /*
 1679  * bridge_ifdetach:
 1680  *
 1681  *      Detach an interface from a bridge.  Called when a member
 1682  *      interface is detaching.
 1683  */
 1684 static void
 1685 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
 1686 {
 1687         struct bridge_softc *sc = ifp->if_bridge;
 1688         struct bridge_iflist *bif;
 1689 
 1690         /* Check if the interface is a bridge member */
 1691         if (sc != NULL) {
 1692                 BRIDGE_LOCK(sc);
 1693 
 1694                 bif = bridge_lookup_member_if(sc, ifp);
 1695                 if (bif != NULL)
 1696                         bridge_delete_member(sc, bif, 1);
 1697 
 1698                 BRIDGE_UNLOCK(sc);
 1699                 return;
 1700         }
 1701 
 1702         /* Check if the interface is a span port */
 1703         mtx_lock(&bridge_list_mtx);
 1704         LIST_FOREACH(sc, &bridge_list, sc_list) {
 1705                 BRIDGE_LOCK(sc);
 1706                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 1707                         if (ifp == bif->bif_ifp) {
 1708                                 bridge_delete_span(sc, bif);
 1709                                 break;
 1710                         }
 1711 
 1712                 BRIDGE_UNLOCK(sc);
 1713         }
 1714         mtx_unlock(&bridge_list_mtx);
 1715 }
 1716 
 1717 /*
 1718  * bridge_init:
 1719  *
 1720  *      Initialize a bridge interface.
 1721  */
 1722 static void
 1723 bridge_init(void *xsc)
 1724 {
 1725         struct bridge_softc *sc = (struct bridge_softc *)xsc;
 1726         struct ifnet *ifp = sc->sc_ifp;
 1727 
 1728         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
 1729                 return;
 1730 
 1731         BRIDGE_LOCK(sc);
 1732         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
 1733             bridge_timer, sc);
 1734 
 1735         ifp->if_drv_flags |= IFF_DRV_RUNNING;
 1736         bstp_init(&sc->sc_stp);         /* Initialize Spanning Tree */
 1737 
 1738         BRIDGE_UNLOCK(sc);
 1739 }
 1740 
 1741 /*
 1742  * bridge_stop:
 1743  *
 1744  *      Stop the bridge interface.
 1745  */
 1746 static void
 1747 bridge_stop(struct ifnet *ifp, int disable)
 1748 {
 1749         struct bridge_softc *sc = ifp->if_softc;
 1750 
 1751         BRIDGE_LOCK_ASSERT(sc);
 1752 
 1753         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
 1754                 return;
 1755 
 1756         callout_stop(&sc->sc_brcallout);
 1757         bstp_stop(&sc->sc_stp);
 1758 
 1759         bridge_rtflush(sc, IFBF_FLUSHDYN);
 1760 
 1761         ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 1762 }
 1763 
 1764 /*
 1765  * bridge_enqueue:
 1766  *
 1767  *      Enqueue a packet on a bridge member interface.
 1768  *
 1769  */
 1770 static void
 1771 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
 1772 {
 1773         int len, err = 0;
 1774         short mflags;
 1775         struct mbuf *m0;
 1776 
 1777         len = m->m_pkthdr.len;
 1778         mflags = m->m_flags;
 1779 
 1780         /* We may be sending a fragment so traverse the mbuf */
 1781         for (; m; m = m0) {
 1782                 m0 = m->m_nextpkt;
 1783                 m->m_nextpkt = NULL;
 1784 
 1785                 /*
 1786                  * If underlying interface can not do VLAN tag insertion itself
 1787                  * then attach a packet tag that holds it.
 1788                  */
 1789                 if ((m->m_flags & M_VLANTAG) &&
 1790                     (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
 1791                         m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
 1792                         if (m == NULL) {
 1793                                 if_printf(dst_ifp,
 1794                                     "unable to prepend VLAN header\n");
 1795                                 dst_ifp->if_oerrors++;
 1796                                 continue;
 1797                         }
 1798                         m->m_flags &= ~M_VLANTAG;
 1799                 }
 1800 
 1801                 if (err == 0)
 1802                         dst_ifp->if_transmit(dst_ifp, m);
 1803         }
 1804 
 1805         if (err == 0) {
 1806                 sc->sc_ifp->if_opackets++;
 1807                 sc->sc_ifp->if_obytes += len;
 1808                 if (mflags & M_MCAST)
 1809                         sc->sc_ifp->if_omcasts++;
 1810         }
 1811 }
 1812 
 1813 /*
 1814  * bridge_dummynet:
 1815  *
 1816  *      Receive a queued packet from dummynet and pass it on to the output
 1817  *      interface.
 1818  *
 1819  *      The mbuf has the Ethernet header already attached.
 1820  */
 1821 static void
 1822 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
 1823 {
 1824         struct bridge_softc *sc;
 1825 
 1826         sc = ifp->if_bridge;
 1827 
 1828         /*
 1829          * The packet didnt originate from a member interface. This should only
 1830          * ever happen if a member interface is removed while packets are
 1831          * queued for it.
 1832          */
 1833         if (sc == NULL) {
 1834                 m_freem(m);
 1835                 return;
 1836         }
 1837 
 1838         if (PFIL_HOOKED(&V_inet_pfil_hook)
 1839 #ifdef INET6
 1840             || PFIL_HOOKED(&V_inet6_pfil_hook)
 1841 #endif
 1842             ) {
 1843                 if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
 1844                         return;
 1845                 if (m == NULL)
 1846                         return;
 1847         }
 1848 
 1849         bridge_enqueue(sc, ifp, m);
 1850 }
 1851 
 1852 /*
 1853  * bridge_output:
 1854  *
 1855  *      Send output from a bridge member interface.  This
 1856  *      performs the bridging function for locally originated
 1857  *      packets.
 1858  *
 1859  *      The mbuf has the Ethernet header already attached.  We must
 1860  *      enqueue or free the mbuf before returning.
 1861  */
 1862 static int
 1863 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
 1864     struct rtentry *rt)
 1865 {
 1866         struct ether_header *eh;
 1867         struct ifnet *dst_if;
 1868         struct bridge_softc *sc;
 1869         uint16_t vlan;
 1870 
 1871         if (m->m_len < ETHER_HDR_LEN) {
 1872                 m = m_pullup(m, ETHER_HDR_LEN);
 1873                 if (m == NULL)
 1874                         return (0);
 1875         }
 1876 
 1877         eh = mtod(m, struct ether_header *);
 1878         sc = ifp->if_bridge;
 1879         vlan = VLANTAGOF(m);
 1880 
 1881         BRIDGE_LOCK(sc);
 1882 
 1883         /*
 1884          * If bridge is down, but the original output interface is up,
 1885          * go ahead and send out that interface.  Otherwise, the packet
 1886          * is dropped below.
 1887          */
 1888         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
 1889                 dst_if = ifp;
 1890                 goto sendunicast;
 1891         }
 1892 
 1893         /*
 1894          * If the packet is a multicast, or we don't know a better way to
 1895          * get there, send to all interfaces.
 1896          */
 1897         if (ETHER_IS_MULTICAST(eh->ether_dhost))
 1898                 dst_if = NULL;
 1899         else
 1900                 dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
 1901         if (dst_if == NULL) {
 1902                 struct bridge_iflist *bif;
 1903                 struct mbuf *mc;
 1904                 int error = 0, used = 0;
 1905 
 1906                 bridge_span(sc, m);
 1907 
 1908                 BRIDGE_LOCK2REF(sc, error);
 1909                 if (error) {
 1910                         m_freem(m);
 1911                         return (0);
 1912                 }
 1913 
 1914                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 1915                         dst_if = bif->bif_ifp;
 1916 
 1917                         if (dst_if->if_type == IFT_GIF)
 1918                                 continue;
 1919                         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
 1920                                 continue;
 1921 
 1922                         /*
 1923                          * If this is not the original output interface,
 1924                          * and the interface is participating in spanning
 1925                          * tree, make sure the port is in a state that
 1926                          * allows forwarding.
 1927                          */
 1928                         if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
 1929                             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
 1930                                 continue;
 1931 
 1932                         if (LIST_NEXT(bif, bif_next) == NULL) {
 1933                                 used = 1;
 1934                                 mc = m;
 1935                         } else {
 1936                                 mc = m_copypacket(m, M_DONTWAIT);
 1937                                 if (mc == NULL) {
 1938                                         sc->sc_ifp->if_oerrors++;
 1939                                         continue;
 1940                                 }
 1941                         }
 1942 
 1943                         bridge_enqueue(sc, dst_if, mc);
 1944                 }
 1945                 if (used == 0)
 1946                         m_freem(m);
 1947                 BRIDGE_UNREF(sc);
 1948                 return (0);
 1949         }
 1950 
 1951 sendunicast:
 1952         /*
 1953          * XXX Spanning tree consideration here?
 1954          */
 1955 
 1956         bridge_span(sc, m);
 1957         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
 1958                 m_freem(m);
 1959                 BRIDGE_UNLOCK(sc);
 1960                 return (0);
 1961         }
 1962 
 1963         BRIDGE_UNLOCK(sc);
 1964         bridge_enqueue(sc, dst_if, m);
 1965         return (0);
 1966 }
 1967 
 1968 /*
 1969  * bridge_start:
 1970  *
 1971  *      Start output on a bridge.
 1972  *
 1973  */
 1974 static void
 1975 bridge_start(struct ifnet *ifp)
 1976 {
 1977         struct bridge_softc *sc;
 1978         struct mbuf *m;
 1979         struct ether_header *eh;
 1980         struct ifnet *dst_if;
 1981 
 1982         sc = ifp->if_softc;
 1983 
 1984         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 1985         for (;;) {
 1986                 IFQ_DEQUEUE(&ifp->if_snd, m);
 1987                 if (m == 0)
 1988                         break;
 1989                 ETHER_BPF_MTAP(ifp, m);
 1990 
 1991                 eh = mtod(m, struct ether_header *);
 1992                 dst_if = NULL;
 1993 
 1994                 BRIDGE_LOCK(sc);
 1995                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
 1996                         dst_if = bridge_rtlookup(sc, eh->ether_dhost, 1);
 1997                 }
 1998 
 1999                 if (dst_if == NULL)
 2000                         bridge_broadcast(sc, ifp, m, 0);
 2001                 else {
 2002                         BRIDGE_UNLOCK(sc);
 2003                         bridge_enqueue(sc, dst_if, m);
 2004                 }
 2005         }
 2006         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 2007 }
 2008 
 2009 /*
 2010  * bridge_forward:
 2011  *
 2012  *      The forwarding function of the bridge.
 2013  *
 2014  *      NOTE: Releases the lock on return.
 2015  */
 2016 static void
 2017 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
 2018     struct mbuf *m)
 2019 {
 2020         struct bridge_iflist *dbif;
 2021         struct ifnet *src_if, *dst_if, *ifp;
 2022         struct ether_header *eh;
 2023         uint16_t vlan;
 2024         uint8_t *dst;
 2025         int error;
 2026 
 2027         src_if = m->m_pkthdr.rcvif;
 2028         ifp = sc->sc_ifp;
 2029 
 2030         ifp->if_ipackets++;
 2031         ifp->if_ibytes += m->m_pkthdr.len;
 2032         vlan = VLANTAGOF(m);
 2033 
 2034         if ((sbif->bif_flags & IFBIF_STP) &&
 2035             sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
 2036                 goto drop;
 2037 
 2038         eh = mtod(m, struct ether_header *);
 2039         dst = eh->ether_dhost;
 2040 
 2041         /* If the interface is learning, record the address. */
 2042         if (sbif->bif_flags & IFBIF_LEARNING) {
 2043                 error = bridge_rtupdate(sc, eh->ether_shost, vlan,
 2044                     sbif, 0, IFBAF_DYNAMIC);
 2045                 /*
 2046                  * If the interface has addresses limits then deny any source
 2047                  * that is not in the cache.
 2048                  */
 2049                 if (error && sbif->bif_addrmax)
 2050                         goto drop;
 2051         }
 2052 
 2053         if ((sbif->bif_flags & IFBIF_STP) != 0 &&
 2054             sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING)
 2055                 goto drop;
 2056 
 2057         /*
 2058          * At this point, the port either doesn't participate
 2059          * in spanning tree or it is in the forwarding state.
 2060          */
 2061 
 2062         /*
 2063          * If the packet is unicast, destined for someone on
 2064          * "this" side of the bridge, drop it.
 2065          */
 2066         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
 2067                 dst_if = bridge_rtlookup(sc, dst, vlan);
 2068                 if (src_if == dst_if)
 2069                         goto drop;
 2070         } else {
 2071                 /*
 2072                  * Check if its a reserved multicast address, any address
 2073                  * listed in 802.1D section 7.12.6 may not be forwarded by the
 2074                  * bridge.
 2075                  * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
 2076                  */
 2077                 if (dst[0] == 0x01 && dst[1] == 0x80 &&
 2078                     dst[2] == 0xc2 && dst[3] == 0x00 &&
 2079                     dst[4] == 0x00 && dst[5] <= 0x0f)
 2080                         goto drop;
 2081 
 2082                 /* ...forward it to all interfaces. */
 2083                 ifp->if_imcasts++;
 2084                 dst_if = NULL;
 2085         }
 2086 
 2087         /*
 2088          * If we have a destination interface which is a member of our bridge,
 2089          * OR this is a unicast packet, push it through the bpf(4) machinery.
 2090          * For broadcast or multicast packets, don't bother because it will
 2091          * be reinjected into ether_input. We do this before we pass the packets
 2092          * through the pfil(9) framework, as it is possible that pfil(9) will
 2093          * drop the packet, or possibly modify it, making it difficult to debug
 2094          * firewall issues on the bridge.
 2095          */
 2096         if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
 2097                 ETHER_BPF_MTAP(ifp, m);
 2098 
 2099         /* run the packet filter */
 2100         if (PFIL_HOOKED(&V_inet_pfil_hook)
 2101 #ifdef INET6
 2102             || PFIL_HOOKED(&V_inet6_pfil_hook)
 2103 #endif
 2104             ) {
 2105                 BRIDGE_UNLOCK(sc);
 2106                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
 2107                         return;
 2108                 if (m == NULL)
 2109                         return;
 2110                 BRIDGE_LOCK(sc);
 2111         }
 2112 
 2113         if (dst_if == NULL) {
 2114                 bridge_broadcast(sc, src_if, m, 1);
 2115                 return;
 2116         }
 2117 
 2118         /*
 2119          * At this point, we're dealing with a unicast frame
 2120          * going to a different interface.
 2121          */
 2122         if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
 2123                 goto drop;
 2124 
 2125         dbif = bridge_lookup_member_if(sc, dst_if);
 2126         if (dbif == NULL)
 2127                 /* Not a member of the bridge (anymore?) */
 2128                 goto drop;
 2129 
 2130         /* Private segments can not talk to each other */
 2131         if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE)
 2132                 goto drop;
 2133 
 2134         if ((dbif->bif_flags & IFBIF_STP) &&
 2135             dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
 2136                 goto drop;
 2137 
 2138         BRIDGE_UNLOCK(sc);
 2139 
 2140         if (PFIL_HOOKED(&V_inet_pfil_hook)
 2141 #ifdef INET6
 2142             || PFIL_HOOKED(&V_inet6_pfil_hook)
 2143 #endif
 2144             ) {
 2145                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
 2146                         return;
 2147                 if (m == NULL)
 2148                         return;
 2149         }
 2150 
 2151         bridge_enqueue(sc, dst_if, m);
 2152         return;
 2153 
 2154 drop:
 2155         BRIDGE_UNLOCK(sc);
 2156         m_freem(m);
 2157 }
 2158 
 2159 /*
 2160  * bridge_input:
 2161  *
 2162  *      Receive input from a member interface.  Queue the packet for
 2163  *      bridging if it is not for us.
 2164  */
 2165 static struct mbuf *
 2166 bridge_input(struct ifnet *ifp, struct mbuf *m)
 2167 {
 2168         struct bridge_softc *sc = ifp->if_bridge;
 2169         struct bridge_iflist *bif, *bif2;
 2170         struct ifnet *bifp;
 2171         struct ether_header *eh;
 2172         struct mbuf *mc, *mc2;
 2173         uint16_t vlan;
 2174         int error;
 2175 
 2176         if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
 2177                 return (m);
 2178 
 2179         bifp = sc->sc_ifp;
 2180         vlan = VLANTAGOF(m);
 2181 
 2182         /*
 2183          * Implement support for bridge monitoring. If this flag has been
 2184          * set on this interface, discard the packet once we push it through
 2185          * the bpf(4) machinery, but before we do, increment the byte and
 2186          * packet counters associated with this interface.
 2187          */
 2188         if ((bifp->if_flags & IFF_MONITOR) != 0) {
 2189                 m->m_pkthdr.rcvif  = bifp;
 2190                 ETHER_BPF_MTAP(bifp, m);
 2191                 bifp->if_ipackets++;
 2192                 bifp->if_ibytes += m->m_pkthdr.len;
 2193                 m_freem(m);
 2194                 return (NULL);
 2195         }
 2196         BRIDGE_LOCK(sc);
 2197         bif = bridge_lookup_member_if(sc, ifp);
 2198         if (bif == NULL) {
 2199                 BRIDGE_UNLOCK(sc);
 2200                 return (m);
 2201         }
 2202 
 2203         eh = mtod(m, struct ether_header *);
 2204 
 2205         bridge_span(sc, m);
 2206 
 2207         if (m->m_flags & (M_BCAST|M_MCAST)) {
 2208                 /* Tap off 802.1D packets; they do not get forwarded. */
 2209                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
 2210                     ETHER_ADDR_LEN) == 0) {
 2211                         m = bstp_input(&bif->bif_stp, ifp, m);
 2212                         if (m == NULL) {
 2213                                 BRIDGE_UNLOCK(sc);
 2214                                 return (NULL);
 2215                         }
 2216                 }
 2217 
 2218                 if ((bif->bif_flags & IFBIF_STP) &&
 2219                     bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
 2220                         BRIDGE_UNLOCK(sc);
 2221                         return (m);
 2222                 }
 2223 
 2224                 /*
 2225                  * Make a deep copy of the packet and enqueue the copy
 2226                  * for bridge processing; return the original packet for
 2227                  * local processing.
 2228                  */
 2229                 mc = m_dup(m, M_DONTWAIT);
 2230                 if (mc == NULL) {
 2231                         BRIDGE_UNLOCK(sc);
 2232                         return (m);
 2233                 }
 2234 
 2235                 /* Perform the bridge forwarding function with the copy. */
 2236                 bridge_forward(sc, bif, mc);
 2237 
 2238                 /*
 2239                  * Reinject the mbuf as arriving on the bridge so we have a
 2240                  * chance at claiming multicast packets. We can not loop back
 2241                  * here from ether_input as a bridge is never a member of a
 2242                  * bridge.
 2243                  */
 2244                 KASSERT(bifp->if_bridge == NULL,
 2245                     ("loop created in bridge_input"));
 2246                 mc2 = m_dup(m, M_DONTWAIT);
 2247                 if (mc2 != NULL) {
 2248                         /* Keep the layer3 header aligned */
 2249                         int i = min(mc2->m_pkthdr.len, max_protohdr);
 2250                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
 2251                 }
 2252                 if (mc2 != NULL) {
 2253                         mc2->m_pkthdr.rcvif = bifp;
 2254                         (*bifp->if_input)(bifp, mc2);
 2255                 }
 2256 
 2257                 /* Return the original packet for local processing. */
 2258                 return (m);
 2259         }
 2260 
 2261         if ((bif->bif_flags & IFBIF_STP) &&
 2262             bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
 2263                 BRIDGE_UNLOCK(sc);
 2264                 return (m);
 2265         }
 2266 
 2267 #if (defined(INET) || defined(INET6))
 2268 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
 2269         || ((iface)->if_carp \
 2270             && (*carp_forus_p)((iface), eh->ether_dhost))
 2271 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
 2272         || ((iface)->if_carp \
 2273             && (*carp_forus_p)((iface), eh->ether_shost))
 2274 #else
 2275 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
 2276 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
 2277 #endif
 2278 
 2279 #ifdef INET6
 2280 #   define OR_PFIL_HOOKED_INET6 \
 2281         || PFIL_HOOKED(&V_inet6_pfil_hook)
 2282 #else
 2283 #   define OR_PFIL_HOOKED_INET6
 2284 #endif
 2285 
 2286 #define GRAB_OUR_PACKETS(iface) \
 2287         if ((iface)->if_type == IFT_GIF) \
 2288                 continue; \
 2289         /* It is destined for us. */ \
 2290         if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
 2291             OR_CARP_CHECK_WE_ARE_DST((iface))                           \
 2292             ) {                                                         \
 2293                 if ((iface)->if_type == IFT_BRIDGE) {                   \
 2294                         ETHER_BPF_MTAP(iface, m);                       \
 2295                         iface->if_ipackets++;                           \
 2296                         /* Filter on the physical interface. */         \
 2297                         if (pfil_local_phys &&                          \
 2298                             (PFIL_HOOKED(&V_inet_pfil_hook)             \
 2299                              OR_PFIL_HOOKED_INET6)) {                   \
 2300                                 if (bridge_pfil(&m, NULL, ifp,          \
 2301                                     PFIL_IN) != 0 || m == NULL) {       \
 2302                                         BRIDGE_UNLOCK(sc);              \
 2303                                         return (NULL);                  \
 2304                                 }                                       \
 2305                         }                                               \
 2306                 }                                                       \
 2307                 if (bif->bif_flags & IFBIF_LEARNING) {                  \
 2308                         error = bridge_rtupdate(sc, eh->ether_shost,    \
 2309                             vlan, bif, 0, IFBAF_DYNAMIC);               \
 2310                         if (error && bif->bif_addrmax) {                \
 2311                                 BRIDGE_UNLOCK(sc);                      \
 2312                                 m_freem(m);                             \
 2313                                 return (NULL);                          \
 2314                         }                                               \
 2315                 }                                                       \
 2316                 m->m_pkthdr.rcvif = iface;                              \
 2317                 BRIDGE_UNLOCK(sc);                                      \
 2318                 return (m);                                             \
 2319         }                                                               \
 2320                                                                         \
 2321         /* We just received a packet that we sent out. */               \
 2322         if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
 2323             OR_CARP_CHECK_WE_ARE_SRC((iface))                   \
 2324             ) {                                                         \
 2325                 BRIDGE_UNLOCK(sc);                                      \
 2326                 m_freem(m);                                             \
 2327                 return (NULL);                                          \
 2328         }
 2329 
 2330         /*
 2331          * Unicast.  Make sure it's not for the bridge.
 2332          */
 2333         do { GRAB_OUR_PACKETS(bifp) } while (0);
 2334 
 2335         /*
 2336          * Give a chance for ifp at first priority. This will help when the
 2337          * packet comes through the interface like VLAN's with the same MACs
 2338          * on several interfaces from the same bridge. This also will save
 2339          * some CPU cycles in case the destination interface and the input
 2340          * interface (eq ifp) are the same.
 2341          */
 2342         do { GRAB_OUR_PACKETS(ifp) } while (0);
 2343 
 2344         /* Now check the all bridge members. */
 2345         LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
 2346                 GRAB_OUR_PACKETS(bif2->bif_ifp)
 2347         }
 2348 
 2349 #undef OR_CARP_CHECK_WE_ARE_DST
 2350 #undef OR_CARP_CHECK_WE_ARE_SRC
 2351 #undef OR_PFIL_HOOKED_INET6
 2352 #undef GRAB_OUR_PACKETS
 2353 
 2354         /* Perform the bridge forwarding function. */
 2355         bridge_forward(sc, bif, m);
 2356 
 2357         return (NULL);
 2358 }
 2359 
 2360 /*
 2361  * bridge_broadcast:
 2362  *
 2363  *      Send a frame to all interfaces that are members of
 2364  *      the bridge, except for the one on which the packet
 2365  *      arrived.
 2366  *
 2367  *      NOTE: Releases the lock on return.
 2368  */
 2369 static void
 2370 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
 2371     struct mbuf *m, int runfilt)
 2372 {
 2373         struct bridge_iflist *dbif, *sbif;
 2374         struct mbuf *mc;
 2375         struct ifnet *dst_if;
 2376         int error = 0, used = 0, i;
 2377 
 2378         sbif = bridge_lookup_member_if(sc, src_if);
 2379 
 2380         BRIDGE_LOCK2REF(sc, error);
 2381         if (error) {
 2382                 m_freem(m);
 2383                 return;
 2384         }
 2385 
 2386         /* Filter on the bridge interface before broadcasting */
 2387         if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
 2388 #ifdef INET6
 2389             || PFIL_HOOKED(&V_inet6_pfil_hook)
 2390 #endif
 2391             )) {
 2392                 if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
 2393                         goto out;
 2394                 if (m == NULL)
 2395                         goto out;
 2396         }
 2397 
 2398         LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
 2399                 dst_if = dbif->bif_ifp;
 2400                 if (dst_if == src_if)
 2401                         continue;
 2402 
 2403                 /* Private segments can not talk to each other */
 2404                 if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
 2405                         continue;
 2406 
 2407                 if ((dbif->bif_flags & IFBIF_STP) &&
 2408                     dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
 2409                         continue;
 2410 
 2411                 if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
 2412                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
 2413                         continue;
 2414 
 2415                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
 2416                         continue;
 2417 
 2418                 if (LIST_NEXT(dbif, bif_next) == NULL) {
 2419                         mc = m;
 2420                         used = 1;
 2421                 } else {
 2422                         mc = m_dup(m, M_DONTWAIT);
 2423                         if (mc == NULL) {
 2424                                 sc->sc_ifp->if_oerrors++;
 2425                                 continue;
 2426                         }
 2427                 }
 2428 
 2429                 /*
 2430                  * Filter on the output interface. Pass a NULL bridge interface
 2431                  * pointer so we do not redundantly filter on the bridge for
 2432                  * each interface we broadcast on.
 2433                  */
 2434                 if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
 2435 #ifdef INET6
 2436                     || PFIL_HOOKED(&V_inet6_pfil_hook)
 2437 #endif
 2438                     )) {
 2439                         if (used == 0) {
 2440                                 /* Keep the layer3 header aligned */
 2441                                 i = min(mc->m_pkthdr.len, max_protohdr);
 2442                                 mc = m_copyup(mc, i, ETHER_ALIGN);
 2443                                 if (mc == NULL) {
 2444                                         sc->sc_ifp->if_oerrors++;
 2445                                         continue;
 2446                                 }
 2447                         }
 2448                         if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
 2449                                 continue;
 2450                         if (mc == NULL)
 2451                                 continue;
 2452                 }
 2453 
 2454                 bridge_enqueue(sc, dst_if, mc);
 2455         }
 2456         if (used == 0)
 2457                 m_freem(m);
 2458 
 2459 out:
 2460         BRIDGE_UNREF(sc);
 2461 }
 2462 
 2463 /*
 2464  * bridge_span:
 2465  *
 2466  *      Duplicate a packet out one or more interfaces that are in span mode,
 2467  *      the original mbuf is unmodified.
 2468  */
 2469 static void
 2470 bridge_span(struct bridge_softc *sc, struct mbuf *m)
 2471 {
 2472         struct bridge_iflist *bif;
 2473         struct ifnet *dst_if;
 2474         struct mbuf *mc;
 2475 
 2476         if (LIST_EMPTY(&sc->sc_spanlist))
 2477                 return;
 2478 
 2479         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
 2480                 dst_if = bif->bif_ifp;
 2481 
 2482                 if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
 2483                         continue;
 2484 
 2485                 mc = m_copypacket(m, M_DONTWAIT);
 2486                 if (mc == NULL) {
 2487                         sc->sc_ifp->if_oerrors++;
 2488                         continue;
 2489                 }
 2490 
 2491                 bridge_enqueue(sc, dst_if, mc);
 2492         }
 2493 }
 2494 
 2495 /*
 2496  * bridge_rtupdate:
 2497  *
 2498  *      Add a bridge routing entry.
 2499  */
 2500 static int
 2501 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan,
 2502     struct bridge_iflist *bif, int setflags, uint8_t flags)
 2503 {
 2504         struct bridge_rtnode *brt;
 2505         int error;
 2506 
 2507         BRIDGE_LOCK_ASSERT(sc);
 2508 
 2509         /* Check the source address is valid and not multicast. */
 2510         if (ETHER_IS_MULTICAST(dst) ||
 2511             (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
 2512              dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0)
 2513                 return (EINVAL);
 2514 
 2515         /* 802.1p frames map to vlan 1 */
 2516         if (vlan == 0)
 2517                 vlan = 1;
 2518 
 2519         /*
 2520          * A route for this destination might already exist.  If so,
 2521          * update it, otherwise create a new one.
 2522          */
 2523         if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
 2524                 if (sc->sc_brtcnt >= sc->sc_brtmax) {
 2525                         sc->sc_brtexceeded++;
 2526                         return (ENOSPC);
 2527                 }
 2528                 /* Check per interface address limits (if enabled) */
 2529                 if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
 2530                         bif->bif_addrexceeded++;
 2531                         return (ENOSPC);
 2532                 }
 2533 
 2534                 /*
 2535                  * Allocate a new bridge forwarding node, and
 2536                  * initialize the expiration time and Ethernet
 2537                  * address.
 2538                  */
 2539                 brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
 2540                 if (brt == NULL)
 2541                         return (ENOMEM);
 2542 
 2543                 if (bif->bif_flags & IFBIF_STICKY)
 2544                         brt->brt_flags = IFBAF_STICKY;
 2545                 else
 2546                         brt->brt_flags = IFBAF_DYNAMIC;
 2547 
 2548                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
 2549                 brt->brt_vlan = vlan;
 2550 
 2551                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
 2552                         uma_zfree(bridge_rtnode_zone, brt);
 2553                         return (error);
 2554                 }
 2555                 brt->brt_dst = bif;
 2556                 bif->bif_addrcnt++;
 2557         }
 2558 
 2559         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
 2560             brt->brt_dst != bif) {
 2561                 brt->brt_dst->bif_addrcnt--;
 2562                 brt->brt_dst = bif;
 2563                 brt->brt_dst->bif_addrcnt++;
 2564         }
 2565 
 2566         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
 2567                 brt->brt_expire = time_uptime + sc->sc_brttimeout;
 2568         if (setflags)
 2569                 brt->brt_flags = flags;
 2570 
 2571         return (0);
 2572 }
 2573 
 2574 /*
 2575  * bridge_rtlookup:
 2576  *
 2577  *      Lookup the destination interface for an address.
 2578  */
 2579 static struct ifnet *
 2580 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
 2581 {
 2582         struct bridge_rtnode *brt;
 2583 
 2584         BRIDGE_LOCK_ASSERT(sc);
 2585 
 2586         if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL)
 2587                 return (NULL);
 2588 
 2589         return (brt->brt_ifp);
 2590 }
 2591 
 2592 /*
 2593  * bridge_rttrim:
 2594  *
 2595  *      Trim the routine table so that we have a number
 2596  *      of routing entries less than or equal to the
 2597  *      maximum number.
 2598  */
 2599 static void
 2600 bridge_rttrim(struct bridge_softc *sc)
 2601 {
 2602         struct bridge_rtnode *brt, *nbrt;
 2603 
 2604         BRIDGE_LOCK_ASSERT(sc);
 2605 
 2606         /* Make sure we actually need to do this. */
 2607         if (sc->sc_brtcnt <= sc->sc_brtmax)
 2608                 return;
 2609 
 2610         /* Force an aging cycle; this might trim enough addresses. */
 2611         bridge_rtage(sc);
 2612         if (sc->sc_brtcnt <= sc->sc_brtmax)
 2613                 return;
 2614 
 2615         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
 2616                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
 2617                         bridge_rtnode_destroy(sc, brt);
 2618                         if (sc->sc_brtcnt <= sc->sc_brtmax)
 2619                                 return;
 2620                 }
 2621         }
 2622 }
 2623 
 2624 /*
 2625  * bridge_timer:
 2626  *
 2627  *      Aging timer for the bridge.
 2628  */
 2629 static void
 2630 bridge_timer(void *arg)
 2631 {
 2632         struct bridge_softc *sc = arg;
 2633 
 2634         BRIDGE_LOCK_ASSERT(sc);
 2635 
 2636         bridge_rtage(sc);
 2637 
 2638         if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
 2639                 callout_reset(&sc->sc_brcallout,
 2640                     bridge_rtable_prune_period * hz, bridge_timer, sc);
 2641 }
 2642 
 2643 /*
 2644  * bridge_rtage:
 2645  *
 2646  *      Perform an aging cycle.
 2647  */
 2648 static void
 2649 bridge_rtage(struct bridge_softc *sc)
 2650 {
 2651         struct bridge_rtnode *brt, *nbrt;
 2652 
 2653         BRIDGE_LOCK_ASSERT(sc);
 2654 
 2655         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
 2656                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
 2657                         if (time_uptime >= brt->brt_expire)
 2658                                 bridge_rtnode_destroy(sc, brt);
 2659                 }
 2660         }
 2661 }
 2662 
 2663 /*
 2664  * bridge_rtflush:
 2665  *
 2666  *      Remove all dynamic addresses from the bridge.
 2667  */
 2668 static void
 2669 bridge_rtflush(struct bridge_softc *sc, int full)
 2670 {
 2671         struct bridge_rtnode *brt, *nbrt;
 2672 
 2673         BRIDGE_LOCK_ASSERT(sc);
 2674 
 2675         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
 2676                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
 2677                         bridge_rtnode_destroy(sc, brt);
 2678         }
 2679 }
 2680 
 2681 /*
 2682  * bridge_rtdaddr:
 2683  *
 2684  *      Remove an address from the table.
 2685  */
 2686 static int
 2687 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
 2688 {
 2689         struct bridge_rtnode *brt;
 2690         int found = 0;
 2691 
 2692         BRIDGE_LOCK_ASSERT(sc);
 2693 
 2694         /*
 2695          * If vlan is zero then we want to delete for all vlans so the lookup
 2696          * may return more than one.
 2697          */
 2698         while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
 2699                 bridge_rtnode_destroy(sc, brt);
 2700                 found = 1;
 2701         }
 2702 
 2703         return (found ? 0 : ENOENT);
 2704 }
 2705 
 2706 /*
 2707  * bridge_rtdelete:
 2708  *
 2709  *      Delete routes to a speicifc member interface.
 2710  */
 2711 static void
 2712 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
 2713 {
 2714         struct bridge_rtnode *brt, *nbrt;
 2715 
 2716         BRIDGE_LOCK_ASSERT(sc);
 2717 
 2718         LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
 2719                 if (brt->brt_ifp == ifp && (full ||
 2720                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
 2721                         bridge_rtnode_destroy(sc, brt);
 2722         }
 2723 }
 2724 
 2725 /*
 2726  * bridge_rtable_init:
 2727  *
 2728  *      Initialize the route table for this bridge.
 2729  */
 2730 static int
 2731 bridge_rtable_init(struct bridge_softc *sc)
 2732 {
 2733         int i;
 2734 
 2735         sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
 2736             M_DEVBUF, M_NOWAIT);
 2737         if (sc->sc_rthash == NULL)
 2738                 return (ENOMEM);
 2739 
 2740         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
 2741                 LIST_INIT(&sc->sc_rthash[i]);
 2742 
 2743         sc->sc_rthash_key = arc4random();
 2744 
 2745         LIST_INIT(&sc->sc_rtlist);
 2746 
 2747         return (0);
 2748 }
 2749 
 2750 /*
 2751  * bridge_rtable_fini:
 2752  *
 2753  *      Deconstruct the route table for this bridge.
 2754  */
 2755 static void
 2756 bridge_rtable_fini(struct bridge_softc *sc)
 2757 {
 2758 
 2759         KASSERT(sc->sc_brtcnt == 0,
 2760             ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
 2761         free(sc->sc_rthash, M_DEVBUF);
 2762 }
 2763 
 2764 /*
 2765  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
 2766  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
 2767  */
 2768 #define mix(a, b, c)                                                    \
 2769 do {                                                                    \
 2770         a -= b; a -= c; a ^= (c >> 13);                                 \
 2771         b -= c; b -= a; b ^= (a << 8);                                  \
 2772         c -= a; c -= b; c ^= (b >> 13);                                 \
 2773         a -= b; a -= c; a ^= (c >> 12);                                 \
 2774         b -= c; b -= a; b ^= (a << 16);                                 \
 2775         c -= a; c -= b; c ^= (b >> 5);                                  \
 2776         a -= b; a -= c; a ^= (c >> 3);                                  \
 2777         b -= c; b -= a; b ^= (a << 10);                                 \
 2778         c -= a; c -= b; c ^= (b >> 15);                                 \
 2779 } while (/*CONSTCOND*/0)
 2780 
 2781 static __inline uint32_t
 2782 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
 2783 {
 2784         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
 2785 
 2786         b += addr[5] << 8;
 2787         b += addr[4];
 2788         a += addr[3] << 24;
 2789         a += addr[2] << 16;
 2790         a += addr[1] << 8;
 2791         a += addr[0];
 2792 
 2793         mix(a, b, c);
 2794 
 2795         return (c & BRIDGE_RTHASH_MASK);
 2796 }
 2797 
 2798 #undef mix
 2799 
 2800 static int
 2801 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
 2802 {
 2803         int i, d;
 2804 
 2805         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
 2806                 d = ((int)a[i]) - ((int)b[i]);
 2807         }
 2808 
 2809         return (d);
 2810 }
 2811 
 2812 /*
 2813  * bridge_rtnode_lookup:
 2814  *
 2815  *      Look up a bridge route node for the specified destination. Compare the
 2816  *      vlan id or if zero then just return the first match.
 2817  */
 2818 static struct bridge_rtnode *
 2819 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
 2820 {
 2821         struct bridge_rtnode *brt;
 2822         uint32_t hash;
 2823         int dir;
 2824 
 2825         BRIDGE_LOCK_ASSERT(sc);
 2826 
 2827         hash = bridge_rthash(sc, addr);
 2828         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
 2829                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
 2830                 if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0))
 2831                         return (brt);
 2832                 if (dir > 0)
 2833                         return (NULL);
 2834         }
 2835 
 2836         return (NULL);
 2837 }
 2838 
 2839 /*
 2840  * bridge_rtnode_insert:
 2841  *
 2842  *      Insert the specified bridge node into the route table.  We
 2843  *      assume the entry is not already in the table.
 2844  */
 2845 static int
 2846 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
 2847 {
 2848         struct bridge_rtnode *lbrt;
 2849         uint32_t hash;
 2850         int dir;
 2851 
 2852         BRIDGE_LOCK_ASSERT(sc);
 2853 
 2854         hash = bridge_rthash(sc, brt->brt_addr);
 2855 
 2856         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
 2857         if (lbrt == NULL) {
 2858                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
 2859                 goto out;
 2860         }
 2861 
 2862         do {
 2863                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
 2864                 if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan)
 2865                         return (EEXIST);
 2866                 if (dir > 0) {
 2867                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
 2868                         goto out;
 2869                 }
 2870                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
 2871                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
 2872                         goto out;
 2873                 }
 2874                 lbrt = LIST_NEXT(lbrt, brt_hash);
 2875         } while (lbrt != NULL);
 2876 
 2877 #ifdef DIAGNOSTIC
 2878         panic("bridge_rtnode_insert: impossible");
 2879 #endif
 2880 
 2881 out:
 2882         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
 2883         sc->sc_brtcnt++;
 2884 
 2885         return (0);
 2886 }
 2887 
 2888 /*
 2889  * bridge_rtnode_destroy:
 2890  *
 2891  *      Destroy a bridge rtnode.
 2892  */
 2893 static void
 2894 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
 2895 {
 2896         BRIDGE_LOCK_ASSERT(sc);
 2897 
 2898         LIST_REMOVE(brt, brt_hash);
 2899 
 2900         LIST_REMOVE(brt, brt_list);
 2901         sc->sc_brtcnt--;
 2902         brt->brt_dst->bif_addrcnt--;
 2903         uma_zfree(bridge_rtnode_zone, brt);
 2904 }
 2905 
 2906 /*
 2907  * bridge_rtable_expire:
 2908  *
 2909  *      Set the expiry time for all routes on an interface.
 2910  */
 2911 static void
 2912 bridge_rtable_expire(struct ifnet *ifp, int age)
 2913 {
 2914         struct bridge_softc *sc = ifp->if_bridge;
 2915         struct bridge_rtnode *brt;
 2916 
 2917         BRIDGE_LOCK(sc);
 2918 
 2919         /*
 2920          * If the age is zero then flush, otherwise set all the expiry times to
 2921          * age for the interface
 2922          */
 2923         if (age == 0)
 2924                 bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
 2925         else {
 2926                 LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
 2927                         /* Cap the expiry time to 'age' */
 2928                         if (brt->brt_ifp == ifp &&
 2929                             brt->brt_expire > time_uptime + age &&
 2930                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
 2931                                 brt->brt_expire = time_uptime + age;
 2932                 }
 2933         }
 2934         BRIDGE_UNLOCK(sc);
 2935 }
 2936 
 2937 /*
 2938  * bridge_state_change:
 2939  *
 2940  *      Callback from the bridgestp code when a port changes states.
 2941  */
 2942 static void
 2943 bridge_state_change(struct ifnet *ifp, int state)
 2944 {
 2945         struct bridge_softc *sc = ifp->if_bridge;
 2946         static const char *stpstates[] = {
 2947                 "disabled",
 2948                 "listening",
 2949                 "learning",
 2950                 "forwarding",
 2951                 "blocking",
 2952                 "discarding"
 2953         };
 2954 
 2955         if (log_stp)
 2956                 log(LOG_NOTICE, "%s: state changed to %s on %s\n",
 2957                     sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
 2958 }
 2959 
 2960 /*
 2961  * Send bridge packets through pfil if they are one of the types pfil can deal
 2962  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
 2963  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
 2964  * that interface.
 2965  */
 2966 static int
 2967 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
 2968 {
 2969         int snap, error, i, hlen;
 2970         struct ether_header *eh1, eh2;
 2971         struct ip_fw_args args;
 2972         struct ip *ip;
 2973         struct llc llc1;
 2974         u_int16_t ether_type;
 2975 
 2976         snap = 0;
 2977         error = -1;     /* Default error if not error == 0 */
 2978 
 2979 #if 0
 2980         /* we may return with the IP fields swapped, ensure its not shared */
 2981         KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
 2982 #endif
 2983 
 2984         if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
 2985                 return (0); /* filtering is disabled */
 2986 
 2987         i = min((*mp)->m_pkthdr.len, max_protohdr);
 2988         if ((*mp)->m_len < i) {
 2989             *mp = m_pullup(*mp, i);
 2990             if (*mp == NULL) {
 2991                 printf("%s: m_pullup failed\n", __func__);
 2992                 return (-1);
 2993             }
 2994         }
 2995 
 2996         eh1 = mtod(*mp, struct ether_header *);
 2997         ether_type = ntohs(eh1->ether_type);
 2998 
 2999         /*
 3000          * Check for SNAP/LLC.
 3001          */
 3002         if (ether_type < ETHERMTU) {
 3003                 struct llc *llc2 = (struct llc *)(eh1 + 1);
 3004 
 3005                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
 3006                     llc2->llc_dsap == LLC_SNAP_LSAP &&
 3007                     llc2->llc_ssap == LLC_SNAP_LSAP &&
 3008                     llc2->llc_control == LLC_UI) {
 3009                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
 3010                         snap = 1;
 3011                 }
 3012         }
 3013 
 3014         /*
 3015          * If we're trying to filter bridge traffic, don't look at anything
 3016          * other than IP and ARP traffic.  If the filter doesn't understand
 3017          * IPv6, don't allow IPv6 through the bridge either.  This is lame
 3018          * since if we really wanted, say, an AppleTalk filter, we are hosed,
 3019          * but of course we don't have an AppleTalk filter to begin with.
 3020          * (Note that since pfil doesn't understand ARP it will pass *ALL*
 3021          * ARP traffic.)
 3022          */
 3023         switch (ether_type) {
 3024                 case ETHERTYPE_ARP:
 3025                 case ETHERTYPE_REVARP:
 3026                         if (pfil_ipfw_arp == 0)
 3027                                 return (0); /* Automatically pass */
 3028                         break;
 3029 
 3030                 case ETHERTYPE_IP:
 3031 #ifdef INET6
 3032                 case ETHERTYPE_IPV6:
 3033 #endif /* INET6 */
 3034                         break;
 3035                 default:
 3036                         /*
 3037                          * Check to see if the user wants to pass non-ip
 3038                          * packets, these will not be checked by pfil(9) and
 3039                          * passed unconditionally so the default is to drop.
 3040                          */
 3041                         if (pfil_onlyip)
 3042                                 goto bad;
 3043         }
 3044 
 3045         /* Strip off the Ethernet header and keep a copy. */
 3046         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
 3047         m_adj(*mp, ETHER_HDR_LEN);
 3048 
 3049         /* Strip off snap header, if present */
 3050         if (snap) {
 3051                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
 3052                 m_adj(*mp, sizeof(struct llc));
 3053         }
 3054 
 3055         /*
 3056          * Check the IP header for alignment and errors
 3057          */
 3058         if (dir == PFIL_IN) {
 3059                 switch (ether_type) {
 3060                         case ETHERTYPE_IP:
 3061                                 error = bridge_ip_checkbasic(mp);
 3062                                 break;
 3063 #ifdef INET6
 3064                         case ETHERTYPE_IPV6:
 3065                                 error = bridge_ip6_checkbasic(mp);
 3066                                 break;
 3067 #endif /* INET6 */
 3068                         default:
 3069                                 error = 0;
 3070                 }
 3071                 if (error)
 3072                         goto bad;
 3073         }
 3074 
 3075         /* XXX this section is also in if_ethersubr.c */
 3076         // XXX PFIL_OUT or DIR_OUT ?
 3077         if (V_ip_fw_chk_ptr && pfil_ipfw != 0 &&
 3078                         dir == PFIL_OUT && ifp != NULL) {
 3079                 struct m_tag *mtag;
 3080 
 3081                 error = -1;
 3082                 /* fetch the start point from existing tags, if any */
 3083                 mtag = m_tag_locate(*mp, MTAG_IPFW_RULE, 0, NULL);
 3084                 if (mtag == NULL) {
 3085                         args.rule.slot = 0;
 3086                 } else {
 3087                         struct ipfw_rule_ref *r;
 3088 
 3089                         /* XXX can we free the tag after use ? */
 3090                         mtag->m_tag_id = PACKET_TAG_NONE;
 3091                         r = (struct ipfw_rule_ref *)(mtag + 1);
 3092                         /* packet already partially processed ? */
 3093                         if (r->info & IPFW_ONEPASS)
 3094                                 goto ipfwpass;
 3095                         args.rule = *r;
 3096                 }
 3097 
 3098                 args.m = *mp;
 3099                 args.oif = ifp;
 3100                 args.next_hop = NULL;
 3101                 args.next_hop6 = NULL;
 3102                 args.eh = &eh2;
 3103                 args.inp = NULL;        /* used by ipfw uid/gid/jail rules */
 3104                 i = V_ip_fw_chk_ptr(&args);
 3105                 *mp = args.m;
 3106 
 3107                 if (*mp == NULL)
 3108                         return (error);
 3109 
 3110                 if (ip_dn_io_ptr && (i == IP_FW_DUMMYNET)) {
 3111 
 3112                         /* put the Ethernet header back on */
 3113                         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
 3114                         if (*mp == NULL)
 3115                                 return (error);
 3116                         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
 3117 
 3118                         /*
 3119                          * Pass the pkt to dummynet, which consumes it. The
 3120                          * packet will return to us via bridge_dummynet().
 3121                          */
 3122                         args.oif = ifp;
 3123                         ip_dn_io_ptr(mp, DIR_FWD | PROTO_IFB, &args);
 3124                         return (error);
 3125                 }
 3126 
 3127                 if (i != IP_FW_PASS) /* drop */
 3128                         goto bad;
 3129         }
 3130 
 3131 ipfwpass:
 3132         error = 0;
 3133 
 3134         /*
 3135          * Run the packet through pfil
 3136          */
 3137         switch (ether_type) {
 3138         case ETHERTYPE_IP:
 3139                 /*
 3140                  * before calling the firewall, swap fields the same as
 3141                  * IP does. here we assume the header is contiguous
 3142                  */
 3143                 ip = mtod(*mp, struct ip *);
 3144 
 3145                 ip->ip_len = ntohs(ip->ip_len);
 3146                 ip->ip_off = ntohs(ip->ip_off);
 3147 
 3148                 /*
 3149                  * Run pfil on the member interface and the bridge, both can
 3150                  * be skipped by clearing pfil_member or pfil_bridge.
 3151                  *
 3152                  * Keep the order:
 3153                  *   in_if -> bridge_if -> out_if
 3154                  */
 3155                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
 3156                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
 3157                                         dir, NULL);
 3158 
 3159                 if (*mp == NULL || error != 0) /* filter may consume */
 3160                         break;
 3161 
 3162                 if (pfil_member && ifp != NULL)
 3163                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, ifp,
 3164                                         dir, NULL);
 3165 
 3166                 if (*mp == NULL || error != 0) /* filter may consume */
 3167                         break;
 3168 
 3169                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
 3170                         error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
 3171                                         dir, NULL);
 3172 
 3173                 if (*mp == NULL || error != 0) /* filter may consume */
 3174                         break;
 3175 
 3176                 /* check if we need to fragment the packet */
 3177                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
 3178                         i = (*mp)->m_pkthdr.len;
 3179                         if (i > ifp->if_mtu) {
 3180                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
 3181                                             &llc1);
 3182                                 return (error);
 3183                         }
 3184                 }
 3185 
 3186                 /* Recalculate the ip checksum and restore byte ordering */
 3187                 ip = mtod(*mp, struct ip *);
 3188                 hlen = ip->ip_hl << 2;
 3189                 if (hlen < sizeof(struct ip))
 3190                         goto bad;
 3191                 if (hlen > (*mp)->m_len) {
 3192                         if ((*mp = m_pullup(*mp, hlen)) == 0)
 3193                                 goto bad;
 3194                         ip = mtod(*mp, struct ip *);
 3195                         if (ip == NULL)
 3196                                 goto bad;
 3197                 }
 3198                 ip->ip_len = htons(ip->ip_len);
 3199                 ip->ip_off = htons(ip->ip_off);
 3200                 ip->ip_sum = 0;
 3201                 if (hlen == sizeof(struct ip))
 3202                         ip->ip_sum = in_cksum_hdr(ip);
 3203                 else
 3204                         ip->ip_sum = in_cksum(*mp, hlen);
 3205 
 3206                 break;
 3207 #ifdef INET6
 3208         case ETHERTYPE_IPV6:
 3209                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
 3210                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
 3211                                         dir, NULL);
 3212 
 3213                 if (*mp == NULL || error != 0) /* filter may consume */
 3214                         break;
 3215 
 3216                 if (pfil_member && ifp != NULL)
 3217                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, ifp,
 3218                                         dir, NULL);
 3219 
 3220                 if (*mp == NULL || error != 0) /* filter may consume */
 3221                         break;
 3222 
 3223                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
 3224                         error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
 3225                                         dir, NULL);
 3226                 break;
 3227 #endif
 3228         default:
 3229                 error = 0;
 3230                 break;
 3231         }
 3232 
 3233         if (*mp == NULL)
 3234                 return (error);
 3235         if (error != 0)
 3236                 goto bad;
 3237 
 3238         error = -1;
 3239 
 3240         /*
 3241          * Finally, put everything back the way it was and return
 3242          */
 3243         if (snap) {
 3244                 M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
 3245                 if (*mp == NULL)
 3246                         return (error);
 3247                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
 3248         }
 3249 
 3250         M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
 3251         if (*mp == NULL)
 3252                 return (error);
 3253         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
 3254 
 3255         return (0);
 3256 
 3257 bad:
 3258         m_freem(*mp);
 3259         *mp = NULL;
 3260         return (error);
 3261 }
 3262 
 3263 /*
 3264  * Perform basic checks on header size since
 3265  * pfil assumes ip_input has already processed
 3266  * it for it.  Cut-and-pasted from ip_input.c.
 3267  * Given how simple the IPv6 version is,
 3268  * does the IPv4 version really need to be
 3269  * this complicated?
 3270  *
 3271  * XXX Should we update ipstat here, or not?
 3272  * XXX Right now we update ipstat but not
 3273  * XXX csum_counter.
 3274  */
 3275 static int
 3276 bridge_ip_checkbasic(struct mbuf **mp)
 3277 {
 3278         struct mbuf *m = *mp;
 3279         struct ip *ip;
 3280         int len, hlen;
 3281         u_short sum;
 3282 
 3283         if (*mp == NULL)
 3284                 return (-1);
 3285 
 3286         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
 3287                 if ((m = m_copyup(m, sizeof(struct ip),
 3288                         (max_linkhdr + 3) & ~3)) == NULL) {
 3289                         /* XXXJRT new stat, please */
 3290                         KMOD_IPSTAT_INC(ips_toosmall);
 3291                         goto bad;
 3292                 }
 3293         } else if (__predict_false(m->m_len < sizeof (struct ip))) {
 3294                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
 3295                         KMOD_IPSTAT_INC(ips_toosmall);
 3296                         goto bad;
 3297                 }
 3298         }
 3299         ip = mtod(m, struct ip *);
 3300         if (ip == NULL) goto bad;
 3301 
 3302         if (ip->ip_v != IPVERSION) {
 3303                 KMOD_IPSTAT_INC(ips_badvers);
 3304                 goto bad;
 3305         }
 3306         hlen = ip->ip_hl << 2;
 3307         if (hlen < sizeof(struct ip)) { /* minimum header length */
 3308                 KMOD_IPSTAT_INC(ips_badhlen);
 3309                 goto bad;
 3310         }
 3311         if (hlen > m->m_len) {
 3312                 if ((m = m_pullup(m, hlen)) == 0) {
 3313                         KMOD_IPSTAT_INC(ips_badhlen);
 3314                         goto bad;
 3315                 }
 3316                 ip = mtod(m, struct ip *);
 3317                 if (ip == NULL) goto bad;
 3318         }
 3319 
 3320         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
 3321                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
 3322         } else {
 3323                 if (hlen == sizeof(struct ip)) {
 3324                         sum = in_cksum_hdr(ip);
 3325                 } else {
 3326                         sum = in_cksum(m, hlen);
 3327                 }
 3328         }
 3329         if (sum) {
 3330                 KMOD_IPSTAT_INC(ips_badsum);
 3331                 goto bad;
 3332         }
 3333 
 3334         /* Retrieve the packet length. */
 3335         len = ntohs(ip->ip_len);
 3336 
 3337         /*
 3338          * Check for additional length bogosity
 3339          */
 3340         if (len < hlen) {
 3341                 KMOD_IPSTAT_INC(ips_badlen);
 3342                 goto bad;
 3343         }
 3344 
 3345         /*
 3346          * Check that the amount of data in the buffers
 3347          * is as at least much as the IP header would have us expect.
 3348          * Drop packet if shorter than we expect.
 3349          */
 3350         if (m->m_pkthdr.len < len) {
 3351                 KMOD_IPSTAT_INC(ips_tooshort);
 3352                 goto bad;
 3353         }
 3354 
 3355         /* Checks out, proceed */
 3356         *mp = m;
 3357         return (0);
 3358 
 3359 bad:
 3360         *mp = m;
 3361         return (-1);
 3362 }
 3363 
 3364 #ifdef INET6
 3365 /*
 3366  * Same as above, but for IPv6.
 3367  * Cut-and-pasted from ip6_input.c.
 3368  * XXX Should we update ip6stat, or not?
 3369  */
 3370 static int
 3371 bridge_ip6_checkbasic(struct mbuf **mp)
 3372 {
 3373         struct mbuf *m = *mp;
 3374         struct ip6_hdr *ip6;
 3375 
 3376         /*
 3377          * If the IPv6 header is not aligned, slurp it up into a new
 3378          * mbuf with space for link headers, in the event we forward
 3379          * it.  Otherwise, if it is aligned, make sure the entire base
 3380          * IPv6 header is in the first mbuf of the chain.
 3381          */
 3382         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
 3383                 struct ifnet *inifp = m->m_pkthdr.rcvif;
 3384                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
 3385                             (max_linkhdr + 3) & ~3)) == NULL) {
 3386                         /* XXXJRT new stat, please */
 3387                         V_ip6stat.ip6s_toosmall++;
 3388                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
 3389                         goto bad;
 3390                 }
 3391         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
 3392                 struct ifnet *inifp = m->m_pkthdr.rcvif;
 3393                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 3394                         V_ip6stat.ip6s_toosmall++;
 3395                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
 3396                         goto bad;
 3397                 }
 3398         }
 3399 
 3400         ip6 = mtod(m, struct ip6_hdr *);
 3401 
 3402         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
 3403                 V_ip6stat.ip6s_badvers++;
 3404                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
 3405                 goto bad;
 3406         }
 3407 
 3408         /* Checks out, proceed */
 3409         *mp = m;
 3410         return (0);
 3411 
 3412 bad:
 3413         *mp = m;
 3414         return (-1);
 3415 }
 3416 #endif /* INET6 */
 3417 
 3418 /*
 3419  * bridge_fragment:
 3420  *
 3421  *      Return a fragmented mbuf chain.
 3422  */
 3423 static int
 3424 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
 3425     int snap, struct llc *llc)
 3426 {
 3427         struct mbuf *m0;
 3428         struct ip *ip;
 3429         int error = -1;
 3430 
 3431         if (m->m_len < sizeof(struct ip) &&
 3432             (m = m_pullup(m, sizeof(struct ip))) == NULL)
 3433                 goto out;
 3434         ip = mtod(m, struct ip *);
 3435 
 3436         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
 3437                     CSUM_DELAY_IP);
 3438         if (error)
 3439                 goto out;
 3440 
 3441         /* walk the chain and re-add the Ethernet header */
 3442         for (m0 = m; m0; m0 = m0->m_nextpkt) {
 3443                 if (error == 0) {
 3444                         if (snap) {
 3445                                 M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
 3446                                 if (m0 == NULL) {
 3447                                         error = ENOBUFS;
 3448                                         continue;
 3449                                 }
 3450                                 bcopy(llc, mtod(m0, caddr_t),
 3451                                     sizeof(struct llc));
 3452                         }
 3453                         M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
 3454                         if (m0 == NULL) {
 3455                                 error = ENOBUFS;
 3456                                 continue;
 3457                         }
 3458                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
 3459                 } else 
 3460                         m_freem(m);
 3461         }
 3462 
 3463         if (error == 0)
 3464                 KMOD_IPSTAT_INC(ips_fragmented);
 3465 
 3466         return (error);
 3467 
 3468 out:
 3469         if (m != NULL)
 3470                 m_freem(m);
 3471         return (error);
 3472 }

Cache object: 23b4402f0231589771e16361b460c934


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.