sys/net/bridge/if_bridge.c

   1 /*
   2  * Copyright 2001 Wasabi Systems, Inc.
   3  * All rights reserved.
   4  *
   5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed for the NetBSD Project by
  18  *      Wasabi Systems, Inc.
  19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  20  *    or promote products derived from this software without specific prior
  21  *    written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /*
  37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  * 3. All advertising materials mentioning features or use of this software
  49  *    must display the following acknowledgement:
  50  *      This product includes software developed by Jason L. Wright
  51  * 4. The name of the author may not be used to endorse or promote products
  52  *    derived from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  64  * POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
  67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
  68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
  69  * $DragonFly: src/sys/net/bridge/if_bridge.c,v 1.42 2008/07/27 10:06:57 sephe Exp $
  70  */
  71
  72 /*
  73  * Network interface bridge support.
  74  *
  75  * TODO:
  76  *
  77  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  78  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  79  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  80  *        consider heterogenous bridges).
  81  */
  82
  83 #include <sys/cdefs.h>
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87
  88 #include <sys/param.h>
  89 #include <sys/mbuf.h>
  90 #include <sys/malloc.h>
  91 #include <sys/protosw.h>
  92 #include <sys/systm.h>
  93 #include <sys/time.h>
  94 #include <sys/socket.h> /* for net/if.h */
  95 #include <sys/sockio.h>
  96 #include <sys/ctype.h>  /* string functions */
  97 #include <sys/kernel.h>
  98 #include <sys/random.h>
  99 #include <sys/sysctl.h>
 100 #include <sys/module.h>
 101 #include <sys/proc.h>
 102 #include <sys/lock.h>
 103 #include <sys/thread.h>
 104 #include <sys/thread2.h>
 105 #include <sys/mpipe.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_dl.h>
 110 #include <net/if_types.h>
 111 #include <net/if_var.h>
 112 #include <net/pfil.h>
 113 #include <net/ifq_var.h>
 114 #include <net/if_clone.h>
 115
 116 #include <netinet/in.h> /* for struct arpcom */
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #endif
 125 #include <netinet/if_ether.h> /* for struct arpcom */
 126 #include <net/bridge/if_bridgevar.h>
 127 #include <net/if_llc.h>
 128 #include <net/netmsg2.h>
 129
 130 #include <net/route.h>
 131 #include <sys/in_cksum.h>
 132
 133 /*
 134  * Size of the route hash table.  Must be a power of two.
 135  */
 136 #ifndef BRIDGE_RTHASH_SIZE
 137 #define BRIDGE_RTHASH_SIZE              1024
 138 #endif
 139
 140 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 141
 142 /*
 143  * Maximum number of addresses to cache.
 144  */
 145 #ifndef BRIDGE_RTABLE_MAX
 146 #define BRIDGE_RTABLE_MAX               100
 147 #endif
 148
 149 /*
 150  * Spanning tree defaults.
 151  */
 152 #define BSTP_DEFAULT_MAX_AGE            (20 * 256)
 153 #define BSTP_DEFAULT_HELLO_TIME         (2 * 256)
 154 #define BSTP_DEFAULT_FORWARD_DELAY      (15 * 256)
 155 #define BSTP_DEFAULT_HOLD_TIME          (1 * 256)
 156 #define BSTP_DEFAULT_BRIDGE_PRIORITY    0x8000
 157 #define BSTP_DEFAULT_PORT_PRIORITY      0x80
 158 #define BSTP_DEFAULT_PATH_COST          55
 159
 160 /*
 161  * Timeout (in seconds) for entries learned dynamically.
 162  */
 163 #ifndef BRIDGE_RTABLE_TIMEOUT
 164 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 165 #endif
 166
 167 /*
 168  * Number of seconds between walks of the route list.
 169  */
 170 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 171 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 172 #endif
 173
 174 /*
 175  * List of capabilities to mask on the member interface.
 176  */
 177 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 178
 179 eventhandler_tag        bridge_detach_cookie = NULL;
 180
 181 extern  struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
 182 extern  int (*bridge_output_p)(struct ifnet *, struct mbuf *);
 183 extern  void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
 184
 185 typedef int     (*bridge_ctl_t)(struct bridge_softc *, void *);
 186
 187 static int      bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 188
 189 static int      bridge_clone_create(struct if_clone *, int);
 190 static void     bridge_clone_destroy(struct ifnet *);
 191
 192 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 193 static void     bridge_mutecaps(struct bridge_iflist *, int);
 194 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 195 static void     bridge_init(void *);
 196 static void     bridge_stop(struct ifnet *);
 197 static void     bridge_start(struct ifnet *);
 198 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 199 static int      bridge_output(struct ifnet *, struct mbuf *);
 200
 201 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 202
 203 static void     bridge_timer(void *);
 204
 205 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 206                     struct mbuf *, int);
 207 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 208
 209 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 210                     struct ifnet *, int, uint8_t);
 211 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 212 static void     bridge_rttrim(struct bridge_softc *);
 213 static void     bridge_rtage(struct bridge_softc *);
 214 static void     bridge_rtflush(struct bridge_softc *, int);
 215 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 216
 217 static int      bridge_rtable_init(struct bridge_softc *);
 218 static void     bridge_rtable_fini(struct bridge_softc *);
 219
 220 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 221 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 222                     const uint8_t *);
 223 static int      bridge_rtnode_insert(struct bridge_softc *,
 224                     struct bridge_rtnode *);
 225 static void     bridge_rtnode_destroy(struct bridge_softc *,
 226                     struct bridge_rtnode *);
 227
 228 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 229                     const char *name);
 230 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 231                     struct ifnet *ifp);
 232 static void     bridge_delete_member(struct bridge_softc *,
 233                     struct bridge_iflist *, int);
 234 static void     bridge_delete_span(struct bridge_softc *,
 235                     struct bridge_iflist *);
 236
 237 static int      bridge_control(struct bridge_softc *, u_long,
 238                                bridge_ctl_t, void *);
 239 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 240 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 241 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 242 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 243 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 244 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 245 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 246 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 247 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 248 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 249 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 250 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 251 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 252 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 253 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 254 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 255 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 256 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 257 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 258 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 259 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 260 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 261 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 262 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 263 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 264 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 265                     int);
 266 static int      bridge_ip_checkbasic(struct mbuf **mp);
 267 #ifdef INET6
 268 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 269 #endif /* INET6 */
 270 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 271                     struct ether_header *, int, struct llc *);
 272 static void     bridge_enqueue_internal(struct ifnet *, struct mbuf *m,
 273                                         netisr_fn_t);
 274 static void     bridge_enqueue_handler(struct netmsg *);
 275 static void     bridge_pfil_enqueue_handler(struct netmsg *);
 276 static void     bridge_pfil_enqueue(struct ifnet *, struct mbuf *, int);
 277 static void     bridge_handoff_notags(struct ifnet *, struct mbuf *);
 278 static void     bridge_handoff(struct ifnet *, struct mbuf *);
 279
 280 SYSCTL_DECL(_net_link);
 281 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 282
 283 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 284 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 285 static int pfil_member = 1; /* run pfil hooks on the member interface */
 286 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 287     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 288 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 289     &pfil_bridge, 0, "Packet filter on the bridge interface");
 290 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 291     &pfil_member, 0, "Packet filter on the member interface");
 292
 293 struct bridge_control {
 294         bridge_ctl_t    bc_func;
 295         int             bc_argsize;
 296         int             bc_flags;
 297 };
 298
 299 #define BC_F_COPYIN             0x01    /* copy arguments in */
 300 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 301 #define BC_F_SUSER              0x04    /* do super-user check */
 302
 303 const struct bridge_control bridge_control_table[] = {
 304         { bridge_ioctl_add,             sizeof(struct ifbreq),
 305           BC_F_COPYIN|BC_F_SUSER },
 306         { bridge_ioctl_del,             sizeof(struct ifbreq),
 307           BC_F_COPYIN|BC_F_SUSER },
 308
 309         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 310           BC_F_COPYIN|BC_F_COPYOUT },
 311         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 312           BC_F_COPYIN|BC_F_SUSER },
 313
 314         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 315           BC_F_COPYIN|BC_F_SUSER },
 316         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 317           BC_F_COPYOUT },
 318
 319         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 320           BC_F_COPYIN|BC_F_COPYOUT },
 321         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 322           BC_F_COPYIN|BC_F_COPYOUT },
 323
 324         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 325           BC_F_COPYIN|BC_F_SUSER },
 326
 327         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 328           BC_F_COPYIN|BC_F_SUSER },
 329         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 330           BC_F_COPYOUT },
 331
 332         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 333           BC_F_COPYIN|BC_F_SUSER },
 334
 335         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 336           BC_F_COPYIN|BC_F_SUSER },
 337
 338         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 339           BC_F_COPYOUT },
 340         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 341           BC_F_COPYIN|BC_F_SUSER },
 342
 343         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 344           BC_F_COPYOUT },
 345         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 346           BC_F_COPYIN|BC_F_SUSER },
 347
 348         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 349           BC_F_COPYOUT },
 350         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 351           BC_F_COPYIN|BC_F_SUSER },
 352
 353         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 354           BC_F_COPYOUT },
 355         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 356           BC_F_COPYIN|BC_F_SUSER },
 357
 358         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 359           BC_F_COPYIN|BC_F_SUSER },
 360
 361         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 362           BC_F_COPYIN|BC_F_SUSER },
 363
 364         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 365           BC_F_COPYIN|BC_F_SUSER },
 366         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 367           BC_F_COPYIN|BC_F_SUSER },
 368 };
 369 const int bridge_control_table_size =
 370     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 371
 372 LIST_HEAD(, bridge_softc) bridge_list;
 373
 374 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
 375                                 bridge_clone_create,
 376                                 bridge_clone_destroy, 0, IF_MAXUNIT);
 377
 378 static int
 379 bridge_modevent(module_t mod, int type, void *data)
 380 {
 381         switch (type) {
 382         case MOD_LOAD:
 383                 LIST_INIT(&bridge_list);
 384                 if_clone_attach(&bridge_cloner);
 385                 bridge_input_p = bridge_input;
 386                 bridge_output_p = bridge_output;
 387                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 388                     ifnet_detach_event, bridge_ifdetach, NULL,
 389                     EVENTHANDLER_PRI_ANY);
 390 #if notyet
 391                 bstp_linkstate_p = bstp_linkstate;
 392 #endif
 393                 break;
 394         case MOD_UNLOAD:
 395                 if (!LIST_EMPTY(&bridge_list))
 396                         return (EBUSY);
 397                 EVENTHANDLER_DEREGISTER(ifnet_detach_event,
 398                     bridge_detach_cookie);
 399                 if_clone_detach(&bridge_cloner);
 400                 bridge_input_p = NULL;
 401                 bridge_output_p = NULL;
 402 #if notyet
 403                 bstp_linkstate_p = NULL;
 404 #endif
 405                 break;
 406         default:
 407                 return (EOPNOTSUPP);
 408         }
 409         return (0);
 410 }
 411
 412 static moduledata_t bridge_mod = {
 413         "if_bridge",
 414         bridge_modevent,
 415         0
 416 };
 417
 418 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 419
 420
 421 /*
 422  * bridge_clone_create:
 423  *
 424  *      Create a new bridge instance.
 425  */
 426 static int
 427 bridge_clone_create(struct if_clone *ifc, int unit)
 428 {
 429         struct bridge_softc *sc;
 430         struct ifnet *ifp;
 431         u_char eaddr[6];
 432
 433         sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 434         ifp = sc->sc_ifp = &sc->sc_if;
 435
 436         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 437         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 438         sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
 439         sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
 440         sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
 441         sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
 442         sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
 443
 444         /* Initialize our routing table. */
 445         bridge_rtable_init(sc);
 446
 447         callout_init(&sc->sc_brcallout);
 448         callout_init(&sc->sc_bstpcallout);
 449
 450         LIST_INIT(&sc->sc_iflist);
 451         LIST_INIT(&sc->sc_spanlist);
 452
 453         ifp->if_softc = sc;
 454         if_initname(ifp, ifc->ifc_name, unit);
 455         ifp->if_mtu = ETHERMTU;
 456         ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
 457         ifp->if_ioctl = bridge_ioctl;
 458         ifp->if_start = bridge_start;
 459         ifp->if_init = bridge_init;
 460         ifp->if_type = IFT_BRIDGE;
 461         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 462         ifp->if_snd.ifq_maxlen = ifqmaxlen;
 463         ifq_set_ready(&ifp->if_snd);
 464         ifp->if_hdrlen = ETHER_HDR_LEN;
 465
 466         /*
 467          * Generate a random ethernet address and use the private AC:DE:48
 468          * OUI code.
 469          */
 470         {
 471                 int rnd = karc4random();
 472                 bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
 473                 rnd = karc4random();
 474                 bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
 475         }
 476         eaddr[0] &= ~1;         /* clear multicast bit */
 477         eaddr[0] |= 2;          /* set the LAA bit */
 478
 479         ether_ifattach(ifp, eaddr, NULL);
 480         /* Now undo some of the damage... */
 481         ifp->if_baudrate = 0;
 482         ifp->if_type = IFT_BRIDGE;
 483
 484         crit_enter();   /* XXX MP */
 485         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 486         crit_exit();
 487
 488         return (0);
 489 }
 490
 491 static void
 492 bridge_delete_dispatch(struct netmsg *nmsg)
 493 {
 494         struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
 495         struct bridge_softc *sc = lmsg->u.ms_resultp;
 496         struct ifnet *bifp = sc->sc_ifp;
 497         struct bridge_iflist *bif;
 498
 499         lwkt_serialize_enter(bifp->if_serializer);
 500
 501         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 502                 bridge_delete_member(sc, bif, 0);
 503
 504         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL)
 505                 bridge_delete_span(sc, bif);
 506
 507         lwkt_serialize_exit(bifp->if_serializer);
 508
 509         lwkt_replymsg(lmsg, 0);
 510 }
 511
 512 /*
 513  * bridge_clone_destroy:
 514  *
 515  *      Destroy a bridge instance.
 516  */
 517 static void
 518 bridge_clone_destroy(struct ifnet *ifp)
 519 {
 520         struct bridge_softc *sc = ifp->if_softc;
 521         struct lwkt_msg *lmsg;
 522         struct netmsg nmsg;
 523
 524         lwkt_serialize_enter(ifp->if_serializer);
 525
 526         bridge_stop(ifp);
 527         ifp->if_flags &= ~IFF_UP;
 528
 529         callout_stop(&sc->sc_brcallout);
 530         callout_stop(&sc->sc_bstpcallout);
 531
 532         lwkt_serialize_exit(ifp->if_serializer);
 533
 534         netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_delete_dispatch);
 535         lmsg = &nmsg.nm_lmsg;
 536         lmsg->u.ms_resultp = sc;
 537         lwkt_domsg(cpu_portfn(0), lmsg, 0);
 538
 539         crit_enter();   /* XXX MP */
 540         LIST_REMOVE(sc, sc_list);
 541         crit_exit();
 542
 543         ether_ifdetach(ifp);
 544
 545         /* Tear down the routing table. */
 546         bridge_rtable_fini(sc);
 547
 548         kfree(sc, M_DEVBUF);
 549 }
 550
 551 /*
 552  * bridge_ioctl:
 553  *
 554  *      Handle a control request from the operator.
 555  */
 556 static int
 557 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 558 {
 559         struct bridge_softc *sc = ifp->if_softc;
 560         union {
 561                 struct ifbreq ifbreq;
 562                 struct ifbifconf ifbifconf;
 563                 struct ifbareq ifbareq;
 564                 struct ifbaconf ifbaconf;
 565                 struct ifbrparam ifbrparam;
 566         } args;
 567         struct ifdrv *ifd = (struct ifdrv *) data;
 568         const struct bridge_control *bc;
 569         int error = 0;
 570
 571         ASSERT_SERIALIZED(ifp->if_serializer);
 572
 573         switch (cmd) {
 574         case SIOCADDMULTI:
 575         case SIOCDELMULTI:
 576                 break;
 577
 578         case SIOCGDRVSPEC:
 579         case SIOCSDRVSPEC:
 580                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 581                         error = EINVAL;
 582                         break;
 583                 }
 584                 bc = &bridge_control_table[ifd->ifd_cmd];
 585
 586                 if (cmd == SIOCGDRVSPEC &&
 587                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 588                         error = EINVAL;
 589                         break;
 590                 } else if (cmd == SIOCSDRVSPEC &&
 591                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 592                         error = EINVAL;
 593                         break;
 594                 }
 595
 596                 if (bc->bc_flags & BC_F_SUSER) {
 597                         error = suser_cred(cr, NULL_CRED_OKAY);
 598                         if (error)
 599                                 break;
 600                 }
 601
 602                 if (ifd->ifd_len != bc->bc_argsize ||
 603                     ifd->ifd_len > sizeof(args)) {
 604                         error = EINVAL;
 605                         break;
 606                 }
 607
 608                 memset(&args, 0, sizeof(args));
 609                 if (bc->bc_flags & BC_F_COPYIN) {
 610                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 611                         if (error)
 612                                 break;
 613                 }
 614
 615                 error = bridge_control(sc, cmd, bc->bc_func, &args);
 616                 if (error)
 617                         break;
 618
 619                 if (bc->bc_flags & BC_F_COPYOUT)
 620                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 621                 break;
 622
 623         case SIOCSIFFLAGS:
 624                 if (!(ifp->if_flags & IFF_UP) &&
 625                     (ifp->if_flags & IFF_RUNNING)) {
 626                         /*
 627                          * If interface is marked down and it is running,
 628                          * then stop it.
 629                          */
 630                         bridge_stop(ifp);
 631                 } else if ((ifp->if_flags & IFF_UP) &&
 632                     !(ifp->if_flags & IFF_RUNNING)) {
 633                         /*
 634                          * If interface is marked up and it is stopped, then
 635                          * start it.
 636                          */
 637                         ifp->if_init(sc);
 638                 }
 639                 break;
 640
 641         case SIOCSIFMTU:
 642                 /* Do not allow the MTU to be changed on the bridge */
 643                 error = EINVAL;
 644                 break;
 645
 646         default:
 647                 error = ether_ioctl(ifp, cmd, data);
 648                 break;
 649         }
 650         return (error);
 651 }
 652
 653 /*
 654  * bridge_mutecaps:
 655  *
 656  *      Clear or restore unwanted capabilities on the member interface
 657  */
 658 static void
 659 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 660 {
 661         struct ifnet *ifp = bif->bif_ifp;
 662         struct ifreq ifr;
 663         int error;
 664
 665         if (ifp->if_ioctl == NULL)
 666                 return;
 667
 668         bzero(&ifr, sizeof(ifr));
 669         ifr.ifr_reqcap = ifp->if_capenable;
 670
 671         if (mute) {
 672                 /* mask off and save capabilities */
 673                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 674                 if (bif->bif_mutecap != 0)
 675                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 676         } else {
 677                 /* restore muted capabilities */
 678                 ifr.ifr_reqcap |= bif->bif_mutecap;
 679         }
 680
 681         if (bif->bif_mutecap != 0) {
 682                 lwkt_serialize_enter(ifp->if_serializer);
 683                 error = ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
 684                 lwkt_serialize_exit(ifp->if_serializer);
 685         }
 686 }
 687
 688 /*
 689  * bridge_lookup_member:
 690  *
 691  *      Lookup a bridge member interface.
 692  */
 693 static struct bridge_iflist *
 694 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 695 {
 696         struct bridge_iflist *bif;
 697         struct ifnet *ifp;
 698
 699         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 700                 ifp = bif->bif_ifp;
 701                 if (strcmp(ifp->if_xname, name) == 0)
 702                         return (bif);
 703         }
 704
 705         return (NULL);
 706 }
 707
 708 /*
 709  * bridge_lookup_member_if:
 710  *
 711  *      Lookup a bridge member interface by ifnet*.
 712  */
 713 static struct bridge_iflist *
 714 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 715 {
 716         struct bridge_iflist *bif;
 717
 718         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 719                 if (bif->bif_ifp == member_ifp)
 720                         return (bif);
 721         }
 722
 723         return (NULL);
 724 }
 725
 726 /*
 727  * bridge_delete_member:
 728  *
 729  *      Delete the specified member interface.
 730  */
 731 static void
 732 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 733     int gone)
 734 {
 735         struct ifnet *ifs = bif->bif_ifp;
 736         struct ifnet *bifp = sc->sc_ifp;
 737
 738         ASSERT_SERIALIZED(bifp->if_serializer);
 739
 740         ifs->if_bridge = NULL;
 741
 742         /*
 743          * Release bridge interface's serializer:
 744          * - To avoid possible dead lock.
 745          * - netmsg_service_sync will block current thread.
 746          */
 747         lwkt_serialize_exit(bifp->if_serializer);
 748
 749         /*
 750          * Make sure that all protocol threads see 'ifs' if_bridge change.
 751          */
 752         netmsg_service_sync();
 753
 754         if (!gone) {
 755                 switch (ifs->if_type) {
 756                 case IFT_ETHER:
 757                 case IFT_L2VLAN:
 758                         /*
 759                          * Take the interface out of promiscuous mode.
 760                          */
 761                         ifpromisc(ifs, 0);
 762                         bridge_mutecaps(bif, 0);
 763                         break;
 764
 765                 case IFT_GIF:
 766                         break;
 767
 768                 default:
 769                         panic("bridge_delete_member: impossible");
 770                         break;
 771                 }
 772         }
 773
 774         lwkt_serialize_enter(bifp->if_serializer);
 775
 776         LIST_REMOVE(bif, bif_next);
 777
 778         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 779
 780         kfree(bif, M_DEVBUF);
 781
 782         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 783                 bstp_initialization(sc);
 784 }
 785
 786 /*
 787  * bridge_delete_span:
 788  *
 789  *      Delete the specified span interface.
 790  */
 791 static void
 792 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 793 {
 794         KASSERT(bif->bif_ifp->if_bridge == NULL,
 795             ("%s: not a span interface", __func__));
 796
 797         LIST_REMOVE(bif, bif_next);
 798         kfree(bif, M_DEVBUF);
 799 }
 800
 801 static int
 802 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 803 {
 804         struct ifbreq *req = arg;
 805         struct bridge_iflist *bif = NULL;
 806         struct ifnet *ifs, *bifp;
 807         int error = 0;
 808
 809         bifp = sc->sc_ifp;
 810         ASSERT_SERIALIZED(bifp->if_serializer);
 811
 812         ifs = ifunit(req->ifbr_ifsname);
 813         if (ifs == NULL)
 814                 return (ENOENT);
 815
 816         /* If it's in the span list, it can't be a member. */
 817         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 818                 if (ifs == bif->bif_ifp)
 819                         return (EBUSY);
 820
 821         /* Allow the first Ethernet member to define the MTU */
 822         if (ifs->if_type != IFT_GIF) {
 823                 if (LIST_EMPTY(&sc->sc_iflist)) {
 824                         bifp->if_mtu = ifs->if_mtu;
 825                 } else if (bifp->if_mtu != ifs->if_mtu) {
 826                         if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
 827                         return (EINVAL);
 828                 }
 829         }
 830
 831         if (ifs->if_bridge == sc)
 832                 return (EEXIST);
 833
 834         if (ifs->if_bridge != NULL)
 835                 return (EBUSY);
 836
 837         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
 838         bif->bif_ifp = ifs;
 839         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 840         bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
 841         bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
 842
 843         switch (ifs->if_type) {
 844         case IFT_ETHER:
 845         case IFT_L2VLAN:
 846                 /*
 847                  * Release bridge interface's serializer to
 848                  * avoid possible dead lock.
 849                  */
 850                 lwkt_serialize_exit(bifp->if_serializer);
 851
 852                 /*
 853                  * Place the interface into promiscuous mode.
 854                  */
 855                 error = ifpromisc(ifs, 1);
 856                 if (error) {
 857                         lwkt_serialize_enter(bifp->if_serializer);
 858                         goto out;
 859                 }
 860
 861                 bridge_mutecaps(bif, 1);
 862
 863                 lwkt_serialize_enter(bifp->if_serializer);
 864                 break;
 865
 866         case IFT_GIF: /* :^) */
 867                 break;
 868
 869         default:
 870                 error = EINVAL;
 871                 goto out;
 872         }
 873
 874         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 875
 876         if (bifp->if_flags & IFF_RUNNING)
 877                 bstp_initialization(sc);
 878         else
 879                 bstp_stop(sc);
 880
 881         /*
 882          * Everything has been setup, so let the member interface
 883          * deliver packets to this bridge on its input/output path.
 884          */
 885         ifs->if_bridge = sc;
 886 out:
 887         if (error) {
 888                 if (bif != NULL)
 889                         kfree(bif, M_DEVBUF);
 890         }
 891         return (error);
 892 }
 893
 894 static int
 895 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 896 {
 897         struct ifbreq *req = arg;
 898         struct bridge_iflist *bif;
 899
 900         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 901         if (bif == NULL)
 902                 return (ENOENT);
 903
 904         bridge_delete_member(sc, bif, 0);
 905
 906         return (0);
 907 }
 908
 909 static int
 910 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 911 {
 912         struct ifbreq *req = arg;
 913         struct bridge_iflist *bif;
 914
 915         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 916         if (bif == NULL)
 917                 return (ENOENT);
 918
 919         req->ifbr_ifsflags = bif->bif_flags;
 920         req->ifbr_state = bif->bif_state;
 921         req->ifbr_priority = bif->bif_priority;
 922         req->ifbr_path_cost = bif->bif_path_cost;
 923         req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
 924
 925         return (0);
 926 }
 927
 928 static int
 929 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
 930 {
 931         struct ifbreq *req = arg;
 932         struct bridge_iflist *bif;
 933
 934         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 935         if (bif == NULL)
 936                 return (ENOENT);
 937
 938         if (req->ifbr_ifsflags & IFBIF_SPAN)
 939                 /* SPAN is readonly */
 940                 return (EINVAL);
 941
 942         if (req->ifbr_ifsflags & IFBIF_STP) {
 943                 switch (bif->bif_ifp->if_type) {
 944                 case IFT_ETHER:
 945                         /* These can do spanning tree. */
 946                         break;
 947
 948                 default:
 949                         /* Nothing else can. */
 950                         return (EINVAL);
 951                 }
 952         }
 953
 954         bif->bif_flags = req->ifbr_ifsflags;
 955
 956         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 957                 bstp_initialization(sc);
 958
 959         return (0);
 960 }
 961
 962 static int
 963 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
 964 {
 965         struct ifbrparam *param = arg;
 966
 967         sc->sc_brtmax = param->ifbrp_csize;
 968         bridge_rttrim(sc);
 969
 970         return (0);
 971 }
 972
 973 static int
 974 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
 975 {
 976         struct ifbrparam *param = arg;
 977
 978         param->ifbrp_csize = sc->sc_brtmax;
 979
 980         return (0);
 981 }
 982
 983 static int
 984 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
 985 {
 986         struct ifbifconf *bifc = arg;
 987         struct bridge_iflist *bif;
 988         struct ifbreq breq;
 989         int count, len, error = 0;
 990
 991         count = 0;
 992         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
 993                 count++;
 994         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 995                 count++;
 996
 997         if (bifc->ifbic_len == 0) {
 998                 bifc->ifbic_len = sizeof(breq) * count;
 999                 return (0);
1000         }
1001
1002         count = 0;
1003         len = bifc->ifbic_len;
1004         memset(&breq, 0, sizeof breq);
1005         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1006                 if (len < sizeof(breq))
1007                         break;
1008
1009                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1010                     sizeof(breq.ifbr_ifsname));
1011                 breq.ifbr_ifsflags = bif->bif_flags;
1012                 breq.ifbr_state = bif->bif_state;
1013                 breq.ifbr_priority = bif->bif_priority;
1014                 breq.ifbr_path_cost = bif->bif_path_cost;
1015                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1016                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1017                 if (error)
1018                         break;
1019                 count++;
1020                 len -= sizeof(breq);
1021         }
1022         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1023                 if (len < sizeof(breq))
1024                         break;
1025
1026                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1027                     sizeof(breq.ifbr_ifsname));
1028                 breq.ifbr_ifsflags = bif->bif_flags;
1029                 breq.ifbr_state = bif->bif_state;
1030                 breq.ifbr_priority = bif->bif_priority;
1031                 breq.ifbr_path_cost = bif->bif_path_cost;
1032                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1033                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1034                 if (error)
1035                         break;
1036                 count++;
1037                 len -= sizeof(breq);
1038         }
1039
1040         bifc->ifbic_len = sizeof(breq) * count;
1041         return (error);
1042 }
1043
1044 static int
1045 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1046 {
1047         struct ifbaconf *bac = arg;
1048         struct bridge_rtnode *brt;
1049         struct ifbareq bareq;
1050         int count = 0, error = 0, len;
1051
1052         if (bac->ifbac_len == 0)
1053                 return (0);
1054
1055         len = bac->ifbac_len;
1056         memset(&bareq, 0, sizeof(bareq));
1057         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1058                 if (len < sizeof(bareq))
1059                         goto out;
1060                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1061                     sizeof(bareq.ifba_ifsname));
1062                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1063                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1064                                 time_second < brt->brt_expire)
1065                         bareq.ifba_expire = brt->brt_expire - time_second;
1066                 else
1067                         bareq.ifba_expire = 0;
1068                 bareq.ifba_flags = brt->brt_flags;
1069
1070                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1071                 if (error)
1072                         goto out;
1073                 count++;
1074                 len -= sizeof(bareq);
1075         }
1076 out:
1077         bac->ifbac_len = sizeof(bareq) * count;
1078         return (error);
1079 }
1080
1081 static int
1082 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1083 {
1084         struct ifbareq *req = arg;
1085         struct bridge_iflist *bif;
1086         int error;
1087
1088         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1089         if (bif == NULL)
1090                 return (ENOENT);
1091
1092         error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1093             req->ifba_flags);
1094
1095         return (error);
1096 }
1097
1098 static int
1099 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1100 {
1101         struct ifbrparam *param = arg;
1102
1103         sc->sc_brttimeout = param->ifbrp_ctime;
1104
1105         return (0);
1106 }
1107
1108 static int
1109 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1110 {
1111         struct ifbrparam *param = arg;
1112
1113         param->ifbrp_ctime = sc->sc_brttimeout;
1114
1115         return (0);
1116 }
1117
1118 static int
1119 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1120 {
1121         struct ifbareq *req = arg;
1122
1123         return (bridge_rtdaddr(sc, req->ifba_dst));
1124 }
1125
1126 static int
1127 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1128 {
1129         struct ifbreq *req = arg;
1130
1131         bridge_rtflush(sc, req->ifbr_ifsflags);
1132
1133         return (0);
1134 }
1135
1136 static int
1137 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1138 {
1139         struct ifbrparam *param = arg;
1140
1141         param->ifbrp_prio = sc->sc_bridge_priority;
1142
1143         return (0);
1144 }
1145
1146 static int
1147 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1148 {
1149         struct ifbrparam *param = arg;
1150
1151         sc->sc_bridge_priority = param->ifbrp_prio;
1152
1153         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1154                 bstp_initialization(sc);
1155
1156         return (0);
1157 }
1158
1159 static int
1160 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1161 {
1162         struct ifbrparam *param = arg;
1163
1164         param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1165
1166         return (0);
1167 }
1168
1169 static int
1170 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1171 {
1172         struct ifbrparam *param = arg;
1173
1174         if (param->ifbrp_hellotime == 0)
1175                 return (EINVAL);
1176         sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1177
1178         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1179                 bstp_initialization(sc);
1180
1181         return (0);
1182 }
1183
1184 static int
1185 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1186 {
1187         struct ifbrparam *param = arg;
1188
1189         param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1190
1191         return (0);
1192 }
1193
1194 static int
1195 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1196 {
1197         struct ifbrparam *param = arg;
1198
1199         if (param->ifbrp_fwddelay == 0)
1200                 return (EINVAL);
1201         sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1202
1203         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1204                 bstp_initialization(sc);
1205
1206         return (0);
1207 }
1208
1209 static int
1210 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1211 {
1212         struct ifbrparam *param = arg;
1213
1214         param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1215
1216         return (0);
1217 }
1218
1219 static int
1220 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1221 {
1222         struct ifbrparam *param = arg;
1223
1224         if (param->ifbrp_maxage == 0)
1225                 return (EINVAL);
1226         sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1227
1228         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1229                 bstp_initialization(sc);
1230
1231         return (0);
1232 }
1233
1234 static int
1235 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1236 {
1237         struct ifbreq *req = arg;
1238         struct bridge_iflist *bif;
1239
1240         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1241         if (bif == NULL)
1242                 return (ENOENT);
1243
1244         bif->bif_priority = req->ifbr_priority;
1245
1246         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1247                 bstp_initialization(sc);
1248
1249         return (0);
1250 }
1251
1252 static int
1253 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1254 {
1255         struct ifbreq *req = arg;
1256         struct bridge_iflist *bif;
1257
1258         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1259         if (bif == NULL)
1260                 return (ENOENT);
1261
1262         bif->bif_path_cost = req->ifbr_path_cost;
1263
1264         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1265                 bstp_initialization(sc);
1266
1267         return (0);
1268 }
1269
1270 static int
1271 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1272 {
1273         struct ifbreq *req = arg;
1274         struct bridge_iflist *bif = NULL;
1275         struct ifnet *ifs;
1276
1277         ifs = ifunit(req->ifbr_ifsname);
1278         if (ifs == NULL)
1279                 return (ENOENT);
1280
1281         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1282                 if (ifs == bif->bif_ifp)
1283                         return (EBUSY);
1284
1285         if (ifs->if_bridge != NULL)
1286                 return (EBUSY);
1287
1288         switch (ifs->if_type) {
1289                 case IFT_ETHER:
1290                 case IFT_GIF:
1291                 case IFT_L2VLAN:
1292                         break;
1293                 default:
1294                         return (EINVAL);
1295         }
1296
1297         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
1298
1299         bif->bif_ifp = ifs;
1300         bif->bif_flags = IFBIF_SPAN;
1301
1302         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1303
1304         return (0);
1305 }
1306
1307 static int
1308 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1309 {
1310         struct ifbreq *req = arg;
1311         struct bridge_iflist *bif;
1312         struct ifnet *ifs;
1313
1314         ifs = ifunit(req->ifbr_ifsname);
1315         if (ifs == NULL)
1316                 return (ENOENT);
1317
1318         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1319                 if (ifs == bif->bif_ifp)
1320                         break;
1321
1322         if (bif == NULL)
1323                 return (ENOENT);
1324
1325         bridge_delete_span(sc, bif);
1326
1327         return (0);
1328 }
1329
1330 static void
1331 bridge_ifdetach_dispatch(struct netmsg *nmsg)
1332 {
1333         struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
1334         struct ifnet *ifp, *bifp;
1335         struct bridge_softc *sc;
1336         struct bridge_iflist *bif;
1337
1338         ifp = lmsg->u.ms_resultp;
1339         sc = ifp->if_bridge;
1340
1341         /* Check if the interface is a bridge member */
1342         if (sc != NULL) {
1343                 bifp = sc->sc_ifp;
1344
1345                 lwkt_serialize_enter(bifp->if_serializer);
1346
1347                 bif = bridge_lookup_member_if(sc, ifp);
1348                 if (bif != NULL) {
1349                         bridge_delete_member(sc, bif, 1);
1350                 } else {
1351                         /* XXX Why bif will be NULL? */
1352                 }
1353
1354                 lwkt_serialize_exit(bifp->if_serializer);
1355                 goto reply;
1356         }
1357
1358         crit_enter();   /* XXX MP */
1359
1360         /* Check if the interface is a span port */
1361         LIST_FOREACH(sc, &bridge_list, sc_list) {
1362                 bifp = sc->sc_ifp;
1363
1364                 lwkt_serialize_enter(bifp->if_serializer);
1365
1366                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1367                         if (ifp == bif->bif_ifp) {
1368                                 bridge_delete_span(sc, bif);
1369                                 break;
1370                         }
1371
1372                 lwkt_serialize_exit(bifp->if_serializer);
1373         }
1374
1375         crit_exit();
1376
1377 reply:
1378         lwkt_replymsg(lmsg, 0);
1379 }
1380
1381 /*
1382  * bridge_ifdetach:
1383  *
1384  *      Detach an interface from a bridge.  Called when a member
1385  *      interface is detaching.
1386  */
1387 static void
1388 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1389 {
1390         struct lwkt_msg *lmsg;
1391         struct netmsg nmsg;
1392
1393         netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_ifdetach_dispatch);
1394         lmsg = &nmsg.nm_lmsg;
1395         lmsg->u.ms_resultp = ifp;
1396
1397         lwkt_domsg(cpu_portfn(0), lmsg, 0);
1398 }
1399
1400 /*
1401  * bridge_init:
1402  *
1403  *      Initialize a bridge interface.
1404  */
1405 static void
1406 bridge_init(void *xsc)
1407 {
1408         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1409         struct ifnet *ifp = sc->sc_ifp;
1410
1411         ASSERT_SERIALIZED(ifp->if_serializer);
1412
1413         if (ifp->if_flags & IFF_RUNNING)
1414                 return;
1415
1416         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1417             bridge_timer, sc);
1418
1419         ifp->if_flags |= IFF_RUNNING;
1420         bstp_initialization(sc);
1421         return;
1422 }
1423
1424 /*
1425  * bridge_stop:
1426  *
1427  *      Stop the bridge interface.
1428  */
1429 static void
1430 bridge_stop(struct ifnet *ifp)
1431 {
1432         struct bridge_softc *sc = ifp->if_softc;
1433
1434         ASSERT_SERIALIZED(ifp->if_serializer);
1435
1436         if ((ifp->if_flags & IFF_RUNNING) == 0)
1437                 return;
1438
1439         callout_stop(&sc->sc_brcallout);
1440         bstp_stop(sc);
1441
1442         bridge_rtflush(sc, IFBF_FLUSHDYN);
1443
1444         ifp->if_flags &= ~IFF_RUNNING;
1445 }
1446
1447 static void
1448 bridge_enqueue_internal(struct ifnet *dst_ifp, struct mbuf *m,
1449                         netisr_fn_t handler)
1450 {
1451         struct netmsg_packet *nmp;
1452         lwkt_port_t port;
1453         int cpu = mycpu->gd_cpuid;
1454
1455         while (m->m_type == MT_TAG) {
1456                 /* XXX see ether_output_frame for full rules check */
1457                 m = m->m_next;
1458         }
1459
1460         nmp = &m->m_hdr.mh_netmsg;
1461         netmsg_init(&nmp->nm_netmsg, &netisr_apanic_rport, 0, handler);
1462         nmp->nm_packet = m;
1463         nmp->nm_netmsg.nm_lmsg.u.ms_resultp = dst_ifp;
1464
1465         port = cpu_portfn(cpu);
1466         lwkt_sendmsg(port, &nmp->nm_netmsg.nm_lmsg);
1467 }
1468
1469 static void
1470 bridge_pfil_enqueue(struct ifnet *dst_ifp, struct mbuf *m,
1471                     int runfilt)
1472 {
1473         netisr_fn_t handler;
1474
1475         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
1476 #ifdef INET6
1477             || inet6_pfil_hook.ph_hashooks > 0
1478 #endif
1479             )) {
1480                 handler = bridge_pfil_enqueue_handler;
1481         } else {
1482                 handler = bridge_enqueue_handler;
1483         }
1484         bridge_enqueue_internal(dst_ifp, m, handler);
1485 }
1486
1487 /*
1488  * bridge_enqueue:
1489  *
1490  *      Enqueue a packet on a bridge member interface.
1491  *
1492  */
1493 void
1494 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1495 {
1496         bridge_enqueue_internal(dst_ifp, m, bridge_enqueue_handler);
1497 }
1498
1499 /*
1500  * bridge_output:
1501  *
1502  *      Send output from a bridge member interface.  This
1503  *      performs the bridging function for locally originated
1504  *      packets.
1505  *
1506  *      The mbuf has the Ethernet header already attached.  We must
1507  *      enqueue or free the mbuf before returning.
1508  */
1509 static int
1510 bridge_output(struct ifnet *ifp, struct mbuf *m)
1511 {
1512         struct bridge_softc *sc = ifp->if_bridge;
1513         struct ether_header *eh;
1514         struct ifnet *dst_if;
1515
1516         ASSERT_NOT_SERIALIZED(ifp->if_serializer);
1517
1518         /*
1519          * Make sure that we are still a member of a bridge interface.
1520          */
1521         if (sc == NULL) {
1522                 m_freem(m);
1523                 return (0);
1524         }
1525
1526         if (m->m_len < ETHER_HDR_LEN) {
1527                 m = m_pullup(m, ETHER_HDR_LEN);
1528                 if (m == NULL)
1529                         return (0);
1530         }
1531
1532         /* Serialize our bridge interface. */
1533         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
1534
1535         eh = mtod(m, struct ether_header *);
1536
1537         /*
1538          * If bridge is down, but the original output interface is up,
1539          * go ahead and send out that interface.  Otherwise, the packet
1540          * is dropped below.
1541          */
1542         if ((sc->sc_ifp->if_flags & IFF_RUNNING) == 0) {
1543                 dst_if = ifp;
1544                 goto sendunicast;
1545         }
1546
1547         /*
1548          * If the packet is a multicast, or we don't know a better way to
1549          * get there, send to all interfaces.
1550          */
1551         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1552                 dst_if = NULL;
1553         else
1554                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1555         if (dst_if == NULL) {
1556                 struct bridge_iflist *bif;
1557                 struct mbuf *mc;
1558                 int used = 0;
1559
1560                 bridge_span(sc, m);
1561
1562                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1563                         dst_if = bif->bif_ifp;
1564                         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1565                                 continue;
1566
1567                         /*
1568                          * If this is not the original output interface,
1569                          * and the interface is participating in spanning
1570                          * tree, make sure the port is in a state that
1571                          * allows forwarding.
1572                          */
1573                         if (dst_if != ifp &&
1574                             (bif->bif_flags & IFBIF_STP) != 0) {
1575                                 switch (bif->bif_state) {
1576                                 case BSTP_IFSTATE_BLOCKING:
1577                                 case BSTP_IFSTATE_LISTENING:
1578                                 case BSTP_IFSTATE_DISABLED:
1579                                         continue;
1580                                 }
1581                         }
1582
1583                         if (LIST_NEXT(bif, bif_next) == NULL) {
1584                                 used = 1;
1585                                 mc = m;
1586                         } else {
1587                                 mc = m_copypacket(m, MB_DONTWAIT);
1588                                 if (mc == NULL) {
1589                                         sc->sc_ifp->if_oerrors++;
1590                                         continue;
1591                                 }
1592                         }
1593                         bridge_enqueue(dst_if, mc);
1594                 }
1595                 if (used == 0)
1596                         m_freem(m);
1597                 lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1598                 return (0);
1599         }
1600
1601 sendunicast:
1602         /*
1603          * XXX Spanning tree consideration here?
1604          */
1605
1606         bridge_span(sc, m);
1607         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1608         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1609                 m_freem(m);
1610         else
1611                 bridge_enqueue(dst_if, m);
1612         return (0);
1613 }
1614
1615 /*
1616  * bridge_start:
1617  *
1618  *      Start output on a bridge.
1619  *
1620  */
1621 static void
1622 bridge_start(struct ifnet *ifp)
1623 {
1624         struct bridge_softc *sc = ifp->if_softc;
1625
1626         ASSERT_SERIALIZED(ifp->if_serializer);
1627
1628         ifp->if_flags |= IFF_OACTIVE;
1629         for (;;) {
1630                 struct ifnet *dst_if = NULL;
1631                 struct ether_header *eh;
1632                 struct mbuf *m;
1633
1634                 m = ifq_dequeue(&ifp->if_snd, NULL);
1635                 if (m == NULL)
1636                         break;
1637
1638                 if (m->m_len < sizeof(*eh)) {
1639                         m = m_pullup(m, sizeof(*eh));
1640                         if (m == NULL) {
1641                                 ifp->if_oerrors++;
1642                                 continue;
1643                         }
1644                 }
1645                 eh = mtod(m, struct ether_header *);
1646
1647                 BPF_MTAP(ifp, m);
1648                 ifp->if_opackets++;
1649
1650                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
1651                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1652
1653                 if (dst_if == NULL)
1654                         bridge_broadcast(sc, ifp, m, 0);
1655                 else
1656                         bridge_enqueue(dst_if, m);
1657         }
1658         ifp->if_flags &= ~IFF_OACTIVE;
1659 }
1660
1661 /*
1662  * bridge_forward:
1663  *
1664  *      The forwarding function of the bridge.
1665  */
1666 static void
1667 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1668 {
1669         struct bridge_iflist *bif;
1670         struct ifnet *src_if, *dst_if, *ifp;
1671         struct ether_header *eh;
1672
1673         src_if = m->m_pkthdr.rcvif;
1674         ifp = sc->sc_ifp;
1675
1676         ASSERT_SERIALIZED(ifp->if_serializer);
1677
1678         ifp->if_ipackets++;
1679         ifp->if_ibytes += m->m_pkthdr.len;
1680
1681         /*
1682          * Look up the bridge_iflist.
1683          */
1684         bif = bridge_lookup_member_if(sc, src_if);
1685         if (bif == NULL) {
1686                 /* Interface is not a bridge member (anymore?) */
1687                 m_freem(m);
1688                 return;
1689         }
1690
1691         if (bif->bif_flags & IFBIF_STP) {
1692                 switch (bif->bif_state) {
1693                 case BSTP_IFSTATE_BLOCKING:
1694                 case BSTP_IFSTATE_LISTENING:
1695                 case BSTP_IFSTATE_DISABLED:
1696                         m_freem(m);
1697                         return;
1698                 }
1699         }
1700
1701         eh = mtod(m, struct ether_header *);
1702
1703         /*
1704          * If the interface is learning, and the source
1705          * address is valid and not multicast, record
1706          * the address.
1707          */
1708         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1709             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1710             (eh->ether_shost[0] == 0 &&
1711              eh->ether_shost[1] == 0 &&
1712              eh->ether_shost[2] == 0 &&
1713              eh->ether_shost[3] == 0 &&
1714              eh->ether_shost[4] == 0 &&
1715              eh->ether_shost[5] == 0) == 0) {
1716                 bridge_rtupdate(sc, eh->ether_shost, src_if, 0, IFBAF_DYNAMIC);
1717         }
1718
1719         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1720             bif->bif_state == BSTP_IFSTATE_LEARNING) {
1721                 m_freem(m);
1722                 return;
1723         }
1724
1725         /*
1726          * At this point, the port either doesn't participate
1727          * in spanning tree or it is in the forwarding state.
1728          */
1729
1730         /*
1731          * If the packet is unicast, destined for someone on
1732          * "this" side of the bridge, drop it.
1733          */
1734         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1735                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1736                 if (src_if == dst_if) {
1737                         m_freem(m);
1738                         return;
1739                 }
1740         } else {
1741                 /* ...forward it to all interfaces. */
1742                 sc->sc_ifp->if_imcasts++;
1743                 dst_if = NULL;
1744         }
1745
1746         if (dst_if == NULL) {
1747                 bridge_broadcast(sc, src_if, m, 1);
1748                 return;
1749         }
1750
1751         /*
1752          * At this point, we're dealing with a unicast frame
1753          * going to a different interface.
1754          */
1755         if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1756                 m_freem(m);
1757                 return;
1758         }
1759         bif = bridge_lookup_member_if(sc, dst_if);
1760         if (bif == NULL) {
1761                 /* Not a member of the bridge (anymore?) */
1762                 m_freem(m);
1763                 return;
1764         }
1765
1766         if (bif->bif_flags & IFBIF_STP) {
1767                 switch (bif->bif_state) {
1768                 case BSTP_IFSTATE_DISABLED:
1769                 case BSTP_IFSTATE_BLOCKING:
1770                         m_freem(m);
1771                         return;
1772                 }
1773         }
1774
1775         lwkt_serialize_exit(ifp->if_serializer);
1776
1777         /* run the packet filter */
1778         if (inet_pfil_hook.ph_hashooks > 0
1779 #ifdef INET6
1780             || inet6_pfil_hook.ph_hashooks > 0
1781 #endif
1782             ) {
1783                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1784                         goto done;
1785                 if (m == NULL)
1786                         goto done;
1787
1788                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
1789                         goto done;
1790                 if (m == NULL)
1791                         goto done;
1792         }
1793         bridge_handoff(dst_if, m);
1794
1795         /*
1796          * ifp's serializer was held on entry and is expected to be held
1797          * on return.
1798          */
1799 done:
1800         lwkt_serialize_enter(ifp->if_serializer);
1801 }
1802
1803 /*
1804  * bridge_input:
1805  *
1806  *      Receive input from a member interface.  Queue the packet for
1807  *      bridging if it is not for us.
1808  */
1809 static struct mbuf *
1810 bridge_input(struct ifnet *ifp, struct mbuf *m)
1811 {
1812         struct bridge_softc *sc = ifp->if_bridge;
1813         struct bridge_iflist *bif;
1814         struct ifnet *bifp, *new_ifp;
1815         struct ether_header *eh;
1816         struct mbuf *mc, *mc2;
1817
1818         /*
1819          * Make sure that we are still a member of a bridge interface.
1820          */
1821         if (sc == NULL)
1822                 return m;
1823
1824         new_ifp = NULL;
1825         bifp = sc->sc_ifp;
1826
1827         lwkt_serialize_enter(bifp->if_serializer);
1828
1829         if ((bifp->if_flags & IFF_RUNNING) == 0)
1830                 goto out;
1831
1832         /*
1833          * Implement support for bridge monitoring. If this flag has been
1834          * set on this interface, discard the packet once we push it through
1835          * the bpf(4) machinery, but before we do, increment the byte and
1836          * packet counters associated with this interface.
1837          */
1838          if ((bifp->if_flags & IFF_MONITOR) != 0) {
1839                 m->m_pkthdr.rcvif = bifp;
1840                 BPF_MTAP(bifp, m);
1841                 bifp->if_ipackets++;
1842                 bifp->if_ibytes += m->m_pkthdr.len;
1843                 m_freem(m);
1844                 m = NULL;
1845                 goto out;
1846         }
1847
1848         eh = mtod(m, struct ether_header *);
1849
1850         m->m_flags &= ~M_PROTO1; /* XXX Hack - loop prevention */
1851
1852         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
1853                 /*
1854                  * If the packet is for us, set the packets source as the
1855                  * bridge, and return the packet back to ifnet.if_input for
1856                  * local processing.
1857                  */
1858                 KASSERT(bifp->if_bridge == NULL,
1859                         ("loop created in bridge_input"));
1860                 new_ifp = bifp;
1861                 goto out;
1862         }
1863
1864         /*
1865          * Tap all packets arriving on the bridge, no matter if
1866          * they are local destinations or not.  In is in.
1867          */
1868         BPF_MTAP(bifp, m);
1869
1870         bif = bridge_lookup_member_if(sc, ifp);
1871         if (bif == NULL)
1872                 goto out;
1873
1874         bridge_span(sc, m);
1875
1876         if (m->m_flags & (M_BCAST | M_MCAST)) {
1877                 /* Tap off 802.1D packets; they do not get forwarded. */
1878                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
1879                     ETHER_ADDR_LEN) == 0) {
1880                         m = bstp_input(sc, bif, m);
1881                         KASSERT(m == NULL,
1882                                 ("attempt to deliver 802.1D packet\n"));
1883                         goto out;
1884                 }
1885
1886                 if (bif->bif_flags & IFBIF_STP) {
1887                         switch (bif->bif_state) {
1888                         case BSTP_IFSTATE_BLOCKING:
1889                         case BSTP_IFSTATE_LISTENING:
1890                         case BSTP_IFSTATE_DISABLED:
1891                                 goto out;
1892                         }
1893                 }
1894
1895                 /*
1896                  * Make a deep copy of the packet and enqueue the copy
1897                  * for bridge processing; return the original packet for
1898                  * local processing.
1899                  */
1900                 mc = m_dup(m, MB_DONTWAIT);
1901                 if (mc == NULL)
1902                         goto out;
1903
1904                 bridge_forward(sc, mc);
1905
1906                 /*
1907                  * Reinject the mbuf as arriving on the bridge so we have a
1908                  * chance at claiming multicast packets. We can not loop back
1909                  * here from ether_input as a bridge is never a member of a
1910                  * bridge.
1911                  */
1912                 KASSERT(bifp->if_bridge == NULL,
1913                         ("loop created in bridge_input"));
1914                 mc2 = m_dup(m, MB_DONTWAIT);
1915 #ifdef notyet
1916                 if (mc2 != NULL) {
1917                         /* Keep the layer3 header aligned */
1918                         int i = min(mc2->m_pkthdr.len, max_protohdr);
1919                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
1920                 }
1921 #endif
1922                 if (mc2 != NULL) {
1923                         mc2->m_pkthdr.rcvif = bifp;
1924                         bifp->if_ipackets++;
1925                         bifp->if_input(bifp, mc2);
1926                 }
1927
1928                 /* Return the original packet for local processing. */
1929                 goto out;
1930         }
1931
1932         if (bif->bif_flags & IFBIF_STP) {
1933                 switch (bif->bif_state) {
1934                 case BSTP_IFSTATE_BLOCKING:
1935                 case BSTP_IFSTATE_LISTENING:
1936                 case BSTP_IFSTATE_DISABLED:
1937                         goto out;
1938                 }
1939         }
1940
1941         /*
1942          * Unicast.  Make sure it's not for us.
1943          */
1944         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1945                 if (bif->bif_ifp->if_type != IFT_ETHER)
1946                         continue;
1947
1948                 /* It is destined for us. */
1949                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
1950                     ETHER_ADDR_LEN) == 0) {
1951                         if (bif->bif_flags & IFBIF_LEARNING) {
1952                                 bridge_rtupdate(sc,
1953                                     eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1954                         }
1955
1956                         if (bif->bif_ifp != ifp) {
1957                                 /* XXX loop prevention */
1958                                 m->m_flags |= M_PROTO1;
1959                                 new_ifp = bif->bif_ifp;
1960                         }
1961                         goto out;
1962                 }
1963
1964                 /* We just received a packet that we sent out. */
1965                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
1966                     ETHER_ADDR_LEN) == 0) {
1967                         m_freem(m);
1968                         m = NULL;
1969                         goto out;
1970                 }
1971         }
1972
1973         /* Perform the bridge forwarding function. */
1974         bridge_forward(sc, m);
1975         m = NULL;
1976 out:
1977         lwkt_serialize_exit(bifp->if_serializer);
1978
1979         if (new_ifp != NULL) {
1980                 lwkt_serialize_enter(new_ifp->if_serializer);
1981
1982                 m->m_pkthdr.rcvif = new_ifp;
1983                 new_ifp->if_ipackets++;
1984                 new_ifp->if_input(new_ifp, m);
1985                 m = NULL;
1986
1987                 lwkt_serialize_exit(new_ifp->if_serializer);
1988         }
1989         return (m);
1990 }
1991
1992 /*
1993  * bridge_broadcast:
1994  *
1995  *      Send a frame to all interfaces that are members of
1996  *      the bridge, except for the one on which the packet
1997  *      arrived.
1998  */
1999 static void
2000 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2001     struct mbuf *m, int runfilt)
2002 {
2003         struct bridge_iflist *bif;
2004         struct mbuf *mc;
2005         struct ifnet *dst_if, *bifp;
2006         int used = 0;
2007
2008         bifp = sc->sc_ifp;
2009
2010         ASSERT_SERIALIZED(bifp->if_serializer);
2011
2012         /* run the packet filter */
2013         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
2014 #ifdef INET6
2015             || inet6_pfil_hook.ph_hashooks > 0
2016 #endif
2017             )) {
2018                 lwkt_serialize_exit(bifp->if_serializer);
2019
2020                 /* Filter on the bridge interface before broadcasting */
2021
2022                 if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
2023                         goto filt;
2024                 if (m == NULL)
2025                         goto filt;
2026
2027                 if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
2028                         m = NULL;
2029 filt:
2030                 lwkt_serialize_enter(bifp->if_serializer);
2031                 if (m == NULL)
2032                         return;
2033         }
2034
2035         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2036                 dst_if = bif->bif_ifp;
2037                 if (dst_if == src_if)
2038                         continue;
2039
2040                 if (bif->bif_flags & IFBIF_STP) {
2041                         switch (bif->bif_state) {
2042                         case BSTP_IFSTATE_BLOCKING:
2043                         case BSTP_IFSTATE_DISABLED:
2044                                 continue;
2045                         }
2046                 }
2047
2048                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2049                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2050                         continue;
2051
2052                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
2053                         continue;
2054
2055                 if (LIST_NEXT(bif, bif_next) == NULL) {
2056                         mc = m;
2057                         used = 1;
2058                 } else {
2059                         mc = m_copypacket(m, MB_DONTWAIT);
2060                         if (mc == NULL) {
2061                                 sc->sc_ifp->if_oerrors++;
2062                                 continue;
2063                         }
2064                 }
2065                 bridge_pfil_enqueue(dst_if, mc, runfilt);
2066         }
2067         if (used == 0)
2068                 m_freem(m);
2069 }
2070
2071 /*
2072  * bridge_span:
2073  *
2074  *      Duplicate a packet out one or more interfaces that are in span mode,
2075  *      the original mbuf is unmodified.
2076  */
2077 static void
2078 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2079 {
2080         struct bridge_iflist *bif;
2081         struct ifnet *dst_if;
2082         struct mbuf *mc;
2083
2084         if (LIST_EMPTY(&sc->sc_spanlist))
2085                 return;
2086
2087         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2088                 dst_if = bif->bif_ifp;
2089
2090                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
2091                         continue;
2092
2093                 mc = m_copypacket(m, MB_DONTWAIT);
2094                 if (mc == NULL) {
2095                         sc->sc_ifp->if_oerrors++;
2096                         continue;
2097                 }
2098
2099                 bridge_enqueue(dst_if, mc);
2100         }
2101 }
2102
2103 /*
2104  * bridge_rtupdate:
2105  *
2106  *      Add a bridge routing entry.
2107  *      Can be called from interrupt context.
2108  */
2109 static int
2110 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2111     struct ifnet *dst_if, int setflags, uint8_t flags)
2112 {
2113         struct bridge_rtnode *brt;
2114         int error;
2115
2116         /*
2117          * A route for this destination might already exist.  If so,
2118          * update it, otherwise create a new one.
2119          */
2120         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2121                 if (sc->sc_brtcnt >= sc->sc_brtmax)
2122                         return (ENOSPC);
2123
2124                 /*
2125                  * Allocate a new bridge forwarding node, and
2126                  * initialize the expiration time and Ethernet
2127                  * address.
2128                  */
2129                 brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
2130                               M_INTNOWAIT|M_ZERO);
2131                 if (brt == NULL)
2132                         return (ENOMEM);
2133
2134                 brt->brt_flags = IFBAF_DYNAMIC;
2135                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2136
2137                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2138                         kfree(brt, M_DEVBUF);
2139                         return (error);
2140                 }
2141         }
2142
2143         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2144                 brt->brt_ifp = dst_if;
2145         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2146                 brt->brt_expire = time_second + sc->sc_brttimeout;
2147         if (setflags)
2148                 brt->brt_flags = flags;
2149
2150         return (0);
2151 }
2152
2153 /*
2154  * bridge_rtlookup:
2155  *
2156  *      Lookup the destination interface for an address.
2157  */
2158 static struct ifnet *
2159 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2160 {
2161         struct bridge_rtnode *brt;
2162
2163         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2164                 return (NULL);
2165
2166         return (brt->brt_ifp);
2167 }
2168
2169 /*
2170  * bridge_rttrim:
2171  *
2172  *      Trim the routine table so that we have a number
2173  *      of routing entries less than or equal to the
2174  *      maximum number.
2175  */
2176 static void
2177 bridge_rttrim(struct bridge_softc *sc)
2178 {
2179         struct bridge_rtnode *brt, *nbrt;
2180
2181         /* Make sure we actually need to do this. */
2182         if (sc->sc_brtcnt <= sc->sc_brtmax)
2183                 return;
2184
2185         /* Force an aging cycle; this might trim enough addresses. */
2186         bridge_rtage(sc);
2187         if (sc->sc_brtcnt <= sc->sc_brtmax)
2188                 return;
2189
2190         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2191                 nbrt = LIST_NEXT(brt, brt_list);
2192                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2193                         bridge_rtnode_destroy(sc, brt);
2194                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2195                                 return;
2196                 }
2197         }
2198 }
2199
2200 /*
2201  * bridge_timer:
2202  *
2203  *      Aging timer for the bridge.
2204  */
2205 static void
2206 bridge_timer(void *arg)
2207 {
2208         struct bridge_softc *sc = arg;
2209
2210         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
2211
2212         bridge_rtage(sc);
2213
2214         if (sc->sc_ifp->if_flags & IFF_RUNNING)
2215                 callout_reset(&sc->sc_brcallout,
2216                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2217
2218         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
2219 }
2220
2221 /*
2222  * bridge_rtage:
2223  *
2224  *      Perform an aging cycle.
2225  */
2226 static void
2227 bridge_rtage(struct bridge_softc *sc)
2228 {
2229         struct bridge_rtnode *brt, *nbrt;
2230
2231         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2232                 nbrt = LIST_NEXT(brt, brt_list);
2233                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2234                         if (time_second >= brt->brt_expire)
2235                                 bridge_rtnode_destroy(sc, brt);
2236                 }
2237         }
2238 }
2239
2240 /*
2241  * bridge_rtflush:
2242  *
2243  *      Remove all dynamic addresses from the bridge.
2244  */
2245 static void
2246 bridge_rtflush(struct bridge_softc *sc, int full)
2247 {
2248         struct bridge_rtnode *brt, *nbrt;
2249
2250         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2251                 nbrt = LIST_NEXT(brt, brt_list);
2252                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2253                         bridge_rtnode_destroy(sc, brt);
2254         }
2255 }
2256
2257 /*
2258  * bridge_rtdaddr:
2259  *
2260  *      Remove an address from the table.
2261  */
2262 static int
2263 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2264 {
2265         struct bridge_rtnode *brt;
2266
2267         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2268                 return (ENOENT);
2269
2270         bridge_rtnode_destroy(sc, brt);
2271         return (0);
2272 }
2273
2274 /*
2275  * bridge_rtdelete:
2276  *
2277  *      Delete routes to a speicifc member interface.
2278  */
2279 void
2280 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2281 {
2282         struct bridge_rtnode *brt, *nbrt;
2283
2284         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2285                 nbrt = LIST_NEXT(brt, brt_list);
2286                 if (brt->brt_ifp == ifp && (full ||
2287                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2288                         bridge_rtnode_destroy(sc, brt);
2289         }
2290 }
2291
2292 /*
2293  * bridge_rtable_init:
2294  *
2295  *      Initialize the route table for this bridge.
2296  */
2297 static int
2298 bridge_rtable_init(struct bridge_softc *sc)
2299 {
2300         int i;
2301
2302         sc->sc_rthash = kmalloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2303             M_DEVBUF, M_WAITOK);
2304
2305         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2306                 LIST_INIT(&sc->sc_rthash[i]);
2307
2308         sc->sc_rthash_key = karc4random();
2309
2310         LIST_INIT(&sc->sc_rtlist);
2311
2312         return (0);
2313 }
2314
2315 /*
2316  * bridge_rtable_fini:
2317  *
2318  *      Deconstruct the route table for this bridge.
2319  */
2320 static void
2321 bridge_rtable_fini(struct bridge_softc *sc)
2322 {
2323
2324         kfree(sc->sc_rthash, M_DEVBUF);
2325 }
2326
2327 /*
2328  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2329  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2330  */
2331 #define mix(a, b, c)                                                    \
2332 do {                                                                    \
2333         a -= b; a -= c; a ^= (c >> 13);                                 \
2334         b -= c; b -= a; b ^= (a << 8);                                  \
2335         c -= a; c -= b; c ^= (b >> 13);                                 \
2336         a -= b; a -= c; a ^= (c >> 12);                                 \
2337         b -= c; b -= a; b ^= (a << 16);                                 \
2338         c -= a; c -= b; c ^= (b >> 5);                                  \
2339         a -= b; a -= c; a ^= (c >> 3);                                  \
2340         b -= c; b -= a; b ^= (a << 10);                                 \
2341         c -= a; c -= b; c ^= (b >> 15);                                 \
2342 } while (/*CONSTCOND*/0)
2343
2344 static __inline uint32_t
2345 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2346 {
2347         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2348
2349         b += addr[5] << 8;
2350         b += addr[4];
2351         a += addr[3] << 24;
2352         a += addr[2] << 16;
2353         a += addr[1] << 8;
2354         a += addr[0];
2355
2356         mix(a, b, c);
2357
2358         return (c & BRIDGE_RTHASH_MASK);
2359 }
2360
2361 #undef mix
2362
2363 static int
2364 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2365 {
2366         int i, d;
2367
2368         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2369                 d = ((int)a[i]) - ((int)b[i]);
2370         }
2371
2372         return (d);
2373 }
2374
2375 /*
2376  * bridge_rtnode_lookup:
2377  *
2378  *      Look up a bridge route node for the specified destination.
2379  */
2380 static struct bridge_rtnode *
2381 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2382 {
2383         struct bridge_rtnode *brt;
2384         uint32_t hash;
2385         int dir;
2386
2387         hash = bridge_rthash(sc, addr);
2388         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2389                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2390                 if (dir == 0)
2391                         return (brt);
2392                 if (dir > 0)
2393                         return (NULL);
2394         }
2395
2396         return (NULL);
2397 }
2398
2399 /*
2400  * bridge_rtnode_insert:
2401  *
2402  *      Insert the specified bridge node into the route table.  We
2403  *      assume the entry is not already in the table.
2404  */
2405 static int
2406 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2407 {
2408         struct bridge_rtnode *lbrt;
2409         uint32_t hash;
2410         int dir;
2411
2412         hash = bridge_rthash(sc, brt->brt_addr);
2413
2414         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2415         if (lbrt == NULL) {
2416                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2417                 goto out;
2418         }
2419
2420         do {
2421                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2422                 if (dir == 0)
2423                         return (EEXIST);
2424                 if (dir > 0) {
2425                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2426                         goto out;
2427                 }
2428                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2429                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2430                         goto out;
2431                 }
2432                 lbrt = LIST_NEXT(lbrt, brt_hash);
2433         } while (lbrt != NULL);
2434
2435 #ifdef DIAGNOSTIC
2436         panic("bridge_rtnode_insert: impossible");
2437 #endif
2438
2439 out:
2440         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2441         sc->sc_brtcnt++;
2442
2443         return (0);
2444 }
2445
2446 /*
2447  * bridge_rtnode_destroy:
2448  *
2449  *      Destroy a bridge rtnode.
2450  */
2451 static void
2452 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2453 {
2454
2455         LIST_REMOVE(brt, brt_hash);
2456
2457         LIST_REMOVE(brt, brt_list);
2458         sc->sc_brtcnt--;
2459         kfree(brt, M_DEVBUF);
2460 }
2461
2462 /*
2463  * Send bridge packets through pfil if they are one of the types pfil can deal
2464  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2465  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2466  * that interface.
2467  */
2468 static int
2469 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2470 {
2471         int snap, error, i, hlen;
2472         struct ether_header *eh1, eh2;
2473         struct ip *ip;
2474         struct llc llc1;
2475         u_int16_t ether_type;
2476
2477         snap = 0;
2478         error = -1;     /* Default error if not error == 0 */
2479
2480         if (pfil_bridge == 0 && pfil_member == 0)
2481                 return (0); /* filtering is disabled */
2482
2483         i = min((*mp)->m_pkthdr.len, max_protohdr);
2484         if ((*mp)->m_len < i) {
2485             *mp = m_pullup(*mp, i);
2486             if (*mp == NULL) {
2487                 kprintf("%s: m_pullup failed\n", __func__);
2488                 return (-1);
2489             }
2490         }
2491
2492         eh1 = mtod(*mp, struct ether_header *);
2493         ether_type = ntohs(eh1->ether_type);
2494
2495         /*
2496          * Check for SNAP/LLC.
2497          */
2498         if (ether_type < ETHERMTU) {
2499                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2500
2501                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2502                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2503                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2504                     llc2->llc_control == LLC_UI) {
2505                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2506                         snap = 1;
2507                 }
2508         }
2509
2510         /*
2511          * If we're trying to filter bridge traffic, don't look at anything
2512          * other than IP and ARP traffic.  If the filter doesn't understand
2513          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2514          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2515          * but of course we don't have an AppleTalk filter to begin with.
2516          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2517          * ARP traffic.)
2518          */
2519         switch (ether_type) {
2520                 case ETHERTYPE_ARP:
2521                 case ETHERTYPE_REVARP:
2522                         return (0); /* Automatically pass */
2523                 case ETHERTYPE_IP:
2524 #ifdef INET6
2525                 case ETHERTYPE_IPV6:
2526 #endif /* INET6 */
2527                         break;
2528                 default:
2529                         /*
2530                          * Check to see if the user wants to pass non-ip
2531                          * packets, these will not be checked by pfil(9) and
2532                          * passed unconditionally so the default is to drop.
2533                          */
2534                         if (pfil_onlyip)
2535                                 goto bad;
2536         }
2537
2538         /* Strip off the Ethernet header and keep a copy. */
2539         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2540         m_adj(*mp, ETHER_HDR_LEN);
2541
2542         /* Strip off snap header, if present */
2543         if (snap) {
2544                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2545                 m_adj(*mp, sizeof(struct llc));
2546         }
2547
2548         /*
2549          * Check the IP header for alignment and errors
2550          */
2551         if (dir == PFIL_IN) {
2552                 switch (ether_type) {
2553                         case ETHERTYPE_IP:
2554                                 error = bridge_ip_checkbasic(mp);
2555                                 break;
2556 #ifdef INET6
2557                         case ETHERTYPE_IPV6:
2558                                 error = bridge_ip6_checkbasic(mp);
2559                                 break;
2560 #endif /* INET6 */
2561                         default:
2562                                 error = 0;
2563                 }
2564                 if (error)
2565                         goto bad;
2566         }
2567
2568         error = 0;
2569
2570         /*
2571          * Run the packet through pfil
2572          */
2573         switch (ether_type)
2574         {
2575         case ETHERTYPE_IP :
2576                 /*
2577                  * before calling the firewall, swap fields the same as
2578                  * IP does. here we assume the header is contiguous
2579                  */
2580                 ip = mtod(*mp, struct ip *);
2581
2582                 ip->ip_len = ntohs(ip->ip_len);
2583                 ip->ip_off = ntohs(ip->ip_off);
2584
2585                 /*
2586                  * Run pfil on the member interface and the bridge, both can
2587                  * be skipped by clearing pfil_member or pfil_bridge.
2588                  *
2589                  * Keep the order:
2590                  *   in_if -> bridge_if -> out_if
2591                  */
2592                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2593                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2594                                         dir);
2595
2596                 if (*mp == NULL || error != 0) /* filter may consume */
2597                         break;
2598
2599                 if (pfil_member && ifp != NULL)
2600                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2601                                         dir);
2602
2603                 if (*mp == NULL || error != 0) /* filter may consume */
2604                         break;
2605
2606                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2607                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2608                                         dir);
2609
2610                 if (*mp == NULL || error != 0) /* filter may consume */
2611                         break;
2612
2613                 /* check if we need to fragment the packet */
2614                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2615                         i = (*mp)->m_pkthdr.len;
2616                         if (i > ifp->if_mtu) {
2617                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2618                                             &llc1);
2619                                 return (error);
2620                         }
2621                 }
2622
2623                 /* Recalculate the ip checksum and restore byte ordering */
2624                 ip = mtod(*mp, struct ip *);
2625                 hlen = ip->ip_hl << 2;
2626                 if (hlen < sizeof(struct ip))
2627                         goto bad;
2628                 if (hlen > (*mp)->m_len) {
2629                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2630                                 goto bad;
2631                         ip = mtod(*mp, struct ip *);
2632                         if (ip == NULL)
2633                                 goto bad;
2634                 }
2635                 ip->ip_len = htons(ip->ip_len);
2636                 ip->ip_off = htons(ip->ip_off);
2637                 ip->ip_sum = 0;
2638                 if (hlen == sizeof(struct ip))
2639                         ip->ip_sum = in_cksum_hdr(ip);
2640                 else
2641                         ip->ip_sum = in_cksum(*mp, hlen);
2642
2643                 break;
2644 #ifdef INET6
2645         case ETHERTYPE_IPV6 :
2646                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2647                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2648                                         dir);
2649
2650                 if (*mp == NULL || error != 0) /* filter may consume */
2651                         break;
2652
2653                 if (pfil_member && ifp != NULL)
2654                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2655                                         dir);
2656
2657                 if (*mp == NULL || error != 0) /* filter may consume */
2658                         break;
2659
2660                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2661                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2662                                         dir);
2663                 break;
2664 #endif
2665         default :
2666                 error = 0;
2667                 break;
2668         }
2669
2670         if (*mp == NULL)
2671                 return (error);
2672         if (error != 0)
2673                 goto bad;
2674
2675         error = -1;
2676
2677         /*
2678          * Finally, put everything back the way it was and return
2679          */
2680         if (snap) {
2681                 M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
2682                 if (*mp == NULL)
2683                         return (error);
2684                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2685         }
2686
2687         M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
2688         if (*mp == NULL)
2689                 return (error);
2690         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2691
2692         return (0);
2693
2694 bad:
2695         m_freem(*mp);
2696         *mp = NULL;
2697         return (error);
2698 }
2699
2700 /*
2701  * Perform basic checks on header size since
2702  * pfil assumes ip_input has already processed
2703  * it for it.  Cut-and-pasted from ip_input.c.
2704  * Given how simple the IPv6 version is,
2705  * does the IPv4 version really need to be
2706  * this complicated?
2707  *
2708  * XXX Should we update ipstat here, or not?
2709  * XXX Right now we update ipstat but not
2710  * XXX csum_counter.
2711  */
2712 static int
2713 bridge_ip_checkbasic(struct mbuf **mp)
2714 {
2715         struct mbuf *m = *mp;
2716         struct ip *ip;
2717         int len, hlen;
2718         u_short sum;
2719
2720         if (*mp == NULL)
2721                 return (-1);
2722 #if notyet
2723         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2724                 if ((m = m_copyup(m, sizeof(struct ip),
2725                         (max_linkhdr + 3) & ~3)) == NULL) {
2726                         /* XXXJRT new stat, please */
2727                         ipstat.ips_toosmall++;
2728                         goto bad;
2729                 }
2730         } else
2731 #endif
2732 #ifndef __predict_false
2733 #define __predict_false(x) x
2734 #endif
2735          if (__predict_false(m->m_len < sizeof (struct ip))) {
2736                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2737                         ipstat.ips_toosmall++;
2738                         goto bad;
2739                 }
2740         }
2741         ip = mtod(m, struct ip *);
2742         if (ip == NULL) goto bad;
2743
2744         if (ip->ip_v != IPVERSION) {
2745                 ipstat.ips_badvers++;
2746                 goto bad;
2747         }
2748         hlen = ip->ip_hl << 2;
2749         if (hlen < sizeof(struct ip)) { /* minimum header length */
2750                 ipstat.ips_badhlen++;
2751                 goto bad;
2752         }
2753         if (hlen > m->m_len) {
2754                 if ((m = m_pullup(m, hlen)) == 0) {
2755                         ipstat.ips_badhlen++;
2756                         goto bad;
2757                 }
2758                 ip = mtod(m, struct ip *);
2759                 if (ip == NULL) goto bad;
2760         }
2761
2762         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2763                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2764         } else {
2765                 if (hlen == sizeof(struct ip)) {
2766                         sum = in_cksum_hdr(ip);
2767                 } else {
2768                         sum = in_cksum(m, hlen);
2769                 }
2770         }
2771         if (sum) {
2772                 ipstat.ips_badsum++;
2773                 goto bad;
2774         }
2775
2776         /* Retrieve the packet length. */
2777         len = ntohs(ip->ip_len);
2778
2779         /*
2780          * Check for additional length bogosity
2781          */
2782         if (len < hlen) {
2783                 ipstat.ips_badlen++;
2784                 goto bad;
2785         }
2786
2787         /*
2788          * Check that the amount of data in the buffers
2789          * is as at least much as the IP header would have us expect.
2790          * Drop packet if shorter than we expect.
2791          */
2792         if (m->m_pkthdr.len < len) {
2793                 ipstat.ips_tooshort++;
2794                 goto bad;
2795         }
2796
2797         /* Checks out, proceed */
2798         *mp = m;
2799         return (0);
2800
2801 bad:
2802         *mp = m;
2803         return (-1);
2804 }
2805
2806 #ifdef INET6
2807 /*
2808  * Same as above, but for IPv6.
2809  * Cut-and-pasted from ip6_input.c.
2810  * XXX Should we update ip6stat, or not?
2811  */
2812 static int
2813 bridge_ip6_checkbasic(struct mbuf **mp)
2814 {
2815         struct mbuf *m = *mp;
2816         struct ip6_hdr *ip6;
2817
2818         /*
2819          * If the IPv6 header is not aligned, slurp it up into a new
2820          * mbuf with space for link headers, in the event we forward
2821          * it.  Otherwise, if it is aligned, make sure the entire base
2822          * IPv6 header is in the first mbuf of the chain.
2823          */
2824 #if notyet
2825         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2826                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2827                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2828                             (max_linkhdr + 3) & ~3)) == NULL) {
2829                         /* XXXJRT new stat, please */
2830                         ip6stat.ip6s_toosmall++;
2831                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2832                         goto bad;
2833                 }
2834         } else
2835 #endif
2836         if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2837                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2838                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2839                         ip6stat.ip6s_toosmall++;
2840                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2841                         goto bad;
2842                 }
2843         }
2844
2845         ip6 = mtod(m, struct ip6_hdr *);
2846
2847         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2848                 ip6stat.ip6s_badvers++;
2849                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2850                 goto bad;
2851         }
2852
2853         /* Checks out, proceed */
2854         *mp = m;
2855         return (0);
2856
2857 bad:
2858         *mp = m;
2859         return (-1);
2860 }
2861 #endif /* INET6 */
2862
2863 /*
2864  * bridge_fragment:
2865  *
2866  *      Return a fragmented mbuf chain.
2867  */
2868 static int
2869 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
2870     int snap, struct llc *llc)
2871 {
2872         struct mbuf *m0;
2873         struct ip *ip;
2874         int error = -1;
2875
2876         if (m->m_len < sizeof(struct ip) &&
2877             (m = m_pullup(m, sizeof(struct ip))) == NULL)
2878                 goto out;
2879         ip = mtod(m, struct ip *);
2880
2881         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
2882                     CSUM_DELAY_IP);
2883         if (error)
2884                 goto out;
2885
2886         /* walk the chain and re-add the Ethernet header */
2887         for (m0 = m; m0; m0 = m0->m_nextpkt) {
2888                 if (error == 0) {
2889                         if (snap) {
2890                                 M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
2891                                 if (m0 == NULL) {
2892                                         error = ENOBUFS;
2893                                         continue;
2894                                 }
2895                                 bcopy(llc, mtod(m0, caddr_t),
2896                                     sizeof(struct llc));
2897                         }
2898                         M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
2899                         if (m0 == NULL) {
2900                                 error = ENOBUFS;
2901                                 continue;
2902                         }
2903                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
2904                 } else
2905                         m_freem(m);
2906         }
2907
2908         if (error == 0)
2909                 ipstat.ips_fragmented++;
2910
2911         return (error);
2912
2913 out:
2914         if (m != NULL)
2915                 m_freem(m);
2916         return (error);
2917 }
2918
2919 static void
2920 bridge_enqueue_handler(struct netmsg *nmsg)
2921 {
2922         struct netmsg_packet *nmp;
2923         struct ifnet *dst_ifp;
2924         struct mbuf *m;
2925
2926         nmp = (struct netmsg_packet *)nmsg;
2927         m = nmp->nm_packet;
2928         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2929
2930         bridge_handoff_notags(dst_ifp, m);
2931 }
2932
2933 static void
2934 bridge_pfil_enqueue_handler(struct netmsg *nmsg)
2935 {
2936         struct netmsg_packet *nmp;
2937         struct ifnet *dst_ifp;
2938         struct mbuf *m;
2939
2940         nmp = (struct netmsg_packet *)nmsg;
2941         m = nmp->nm_packet;
2942         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2943
2944         /*
2945          * Filter on the output interface. Pass a NULL bridge interface
2946          * pointer so we do not redundantly filter on the bridge for
2947          * each interface we broadcast on.
2948          */
2949         if (inet_pfil_hook.ph_hashooks > 0
2950 #ifdef INET6
2951             || inet6_pfil_hook.ph_hashooks > 0
2952 #endif
2953             ) {
2954                 if (bridge_pfil(&m, NULL, dst_ifp, PFIL_OUT) != 0)
2955                         return;
2956                 if (m == NULL)
2957                         return;
2958         }
2959         bridge_handoff_notags(dst_ifp, m);
2960 }
2961
2962 static void
2963 bridge_handoff(struct ifnet *dst_ifp, struct mbuf *m)
2964 {
2965         while (m->m_type == MT_TAG) {
2966                 /* XXX see ether_output_frame for full rules check */
2967                 m = m->m_next;
2968         }
2969         bridge_handoff_notags(dst_ifp, m);
2970 }
2971
2972 static void
2973 bridge_handoff_notags(struct ifnet *dst_ifp, struct mbuf *m)
2974 {
2975         struct mbuf *m0;
2976
2977         KKASSERT(m->m_type != MT_TAG);
2978
2979         lwkt_serialize_enter(dst_ifp->if_serializer);
2980
2981         /* We may be sending a fragment so traverse the mbuf */
2982         for (; m; m = m0) {
2983                 struct altq_pktattr pktattr;
2984
2985                 m0 = m->m_nextpkt;
2986                 m->m_nextpkt = NULL;
2987
2988                 if (ifq_is_enabled(&dst_ifp->if_snd))
2989                         altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
2990
2991                 ifq_handoff(dst_ifp, m, &pktattr);
2992         }
2993
2994         lwkt_serialize_exit(dst_ifp->if_serializer);
2995 }
2996
2997 struct netmsg_brgctl {
2998         struct netmsg           bc_nmsg;
2999         bridge_ctl_t            bc_func;
3000         struct bridge_softc     *bc_sc;
3001         void                    *bc_arg;
3002 };
3003
3004 static void
3005 bridge_control_dispatch(struct netmsg *nmsg)
3006 {
3007         struct netmsg_brgctl *bc_msg = (struct netmsg_brgctl *)nmsg;
3008         struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
3009         int error;
3010
3011         lwkt_serialize_enter(bifp->if_serializer);
3012         error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
3013         lwkt_serialize_exit(bifp->if_serializer);
3014
3015         lwkt_replymsg(&nmsg->nm_lmsg, error);
3016 }
3017
3018 static int
3019 bridge_control(struct bridge_softc *sc, u_long cmd,
3020                bridge_ctl_t bc_func, void *bc_arg)
3021 {
3022         struct ifnet *bifp = sc->sc_ifp;
3023         struct netmsg_brgctl bc_msg;
3024         struct netmsg *nmsg;
3025         int error;
3026
3027         ASSERT_SERIALIZED(bifp->if_serializer);
3028
3029         if (cmd == SIOCGDRVSPEC) {
3030                 /*
3031                  * Don't dispatch 'get' ioctl to netisr0;
3032                  * there are copyouts down deep inside
3033                  * specific bridge ioctl functions.
3034                  */
3035                 return bc_func(sc, bc_arg);
3036         }
3037
3038         bzero(&bc_msg, sizeof(bc_msg));
3039         nmsg = &bc_msg.bc_nmsg;
3040
3041         netmsg_init(nmsg, &curthread->td_msgport, 0, bridge_control_dispatch);
3042         bc_msg.bc_func = bc_func;
3043         bc_msg.bc_sc = sc;
3044         bc_msg.bc_arg = bc_arg;
3045
3046         lwkt_serialize_exit(bifp->if_serializer);
3047         error = lwkt_domsg(cpu_portfn(0), &nmsg->nm_lmsg, 0);
3048         lwkt_serialize_enter(bifp->if_serializer);
3049         return error;
3050 }