sys/net/bridge/if_bridge.c

   1 /*
   2  * Copyright 2001 Wasabi Systems, Inc.
   3  * All rights reserved.
   4  *
   5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed for the NetBSD Project by
  18  *      Wasabi Systems, Inc.
  19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  20  *    or promote products derived from this software without specific prior
  21  *    written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /*
  37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  * 3. All advertising materials mentioning features or use of this software
  49  *    must display the following acknowledgement:
  50  *      This product includes software developed by Jason L. Wright
  51  * 4. The name of the author may not be used to endorse or promote products
  52  *    derived from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  64  * POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
  67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
  68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
  69  * $DragonFly: src/sys/net/bridge/if_bridge.c,v 1.44 2008/09/18 11:55:20 sephe Exp $
  70  */
  71
  72 /*
  73  * Network interface bridge support.
  74  *
  75  * TODO:
  76  *
  77  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  78  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  79  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  80  *        consider heterogenous bridges).
  81  */
  82
  83 #include <sys/cdefs.h>
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87
  88 #include <sys/param.h>
  89 #include <sys/mbuf.h>
  90 #include <sys/malloc.h>
  91 #include <sys/protosw.h>
  92 #include <sys/systm.h>
  93 #include <sys/time.h>
  94 #include <sys/socket.h> /* for net/if.h */
  95 #include <sys/sockio.h>
  96 #include <sys/ctype.h>  /* string functions */
  97 #include <sys/kernel.h>
  98 #include <sys/random.h>
  99 #include <sys/sysctl.h>
 100 #include <sys/module.h>
 101 #include <sys/proc.h>
 102 #include <sys/lock.h>
 103 #include <sys/thread.h>
 104 #include <sys/thread2.h>
 105 #include <sys/mpipe.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_dl.h>
 110 #include <net/if_types.h>
 111 #include <net/if_var.h>
 112 #include <net/pfil.h>
 113 #include <net/ifq_var.h>
 114 #include <net/if_clone.h>
 115
 116 #include <netinet/in.h> /* for struct arpcom */
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #endif
 125 #include <netinet/if_ether.h> /* for struct arpcom */
 126 #include <net/bridge/if_bridgevar.h>
 127 #include <net/if_llc.h>
 128 #include <net/netmsg2.h>
 129
 130 #include <net/route.h>
 131 #include <sys/in_cksum.h>
 132
 133 /*
 134  * Size of the route hash table.  Must be a power of two.
 135  */
 136 #ifndef BRIDGE_RTHASH_SIZE
 137 #define BRIDGE_RTHASH_SIZE              1024
 138 #endif
 139
 140 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 141
 142 /*
 143  * Maximum number of addresses to cache.
 144  */
 145 #ifndef BRIDGE_RTABLE_MAX
 146 #define BRIDGE_RTABLE_MAX               100
 147 #endif
 148
 149 /*
 150  * Spanning tree defaults.
 151  */
 152 #define BSTP_DEFAULT_MAX_AGE            (20 * 256)
 153 #define BSTP_DEFAULT_HELLO_TIME         (2 * 256)
 154 #define BSTP_DEFAULT_FORWARD_DELAY      (15 * 256)
 155 #define BSTP_DEFAULT_HOLD_TIME          (1 * 256)
 156 #define BSTP_DEFAULT_BRIDGE_PRIORITY    0x8000
 157 #define BSTP_DEFAULT_PORT_PRIORITY      0x80
 158 #define BSTP_DEFAULT_PATH_COST          55
 159
 160 /*
 161  * Timeout (in seconds) for entries learned dynamically.
 162  */
 163 #ifndef BRIDGE_RTABLE_TIMEOUT
 164 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 165 #endif
 166
 167 /*
 168  * Number of seconds between walks of the route list.
 169  */
 170 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 171 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 172 #endif
 173
 174 /*
 175  * List of capabilities to mask on the member interface.
 176  */
 177 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 178
 179 eventhandler_tag        bridge_detach_cookie = NULL;
 180
 181 extern  struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
 182 extern  int (*bridge_output_p)(struct ifnet *, struct mbuf *);
 183 extern  void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
 184
 185 typedef int     (*bridge_ctl_t)(struct bridge_softc *, void *);
 186
 187 static int      bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 188
 189 static int      bridge_clone_create(struct if_clone *, int);
 190 static void     bridge_clone_destroy(struct ifnet *);
 191
 192 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 193 static void     bridge_mutecaps(struct bridge_iflist *, int);
 194 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 195 static void     bridge_init(void *);
 196 static void     bridge_stop(struct ifnet *);
 197 static void     bridge_start(struct ifnet *);
 198 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 199 static int      bridge_output(struct ifnet *, struct mbuf *);
 200
 201 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 202
 203 static void     bridge_timer(void *);
 204
 205 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 206                     struct mbuf *, int);
 207 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 208
 209 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 210                     struct ifnet *, int, uint8_t);
 211 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 212 static void     bridge_rttrim(struct bridge_softc *);
 213 static void     bridge_rtage(struct bridge_softc *);
 214 static void     bridge_rtflush(struct bridge_softc *, int);
 215 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 216
 217 static int      bridge_rtable_init(struct bridge_softc *);
 218 static void     bridge_rtable_fini(struct bridge_softc *);
 219
 220 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 221 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 222                     const uint8_t *);
 223 static int      bridge_rtnode_insert(struct bridge_softc *,
 224                     struct bridge_rtnode *);
 225 static void     bridge_rtnode_destroy(struct bridge_softc *,
 226                     struct bridge_rtnode *);
 227
 228 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 229                     const char *name);
 230 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 231                     struct ifnet *ifp);
 232 static void     bridge_delete_member(struct bridge_softc *,
 233                     struct bridge_iflist *, int);
 234 static void     bridge_delete_span(struct bridge_softc *,
 235                     struct bridge_iflist *);
 236
 237 static int      bridge_control(struct bridge_softc *, u_long,
 238                                bridge_ctl_t, void *);
 239 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 240 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 241 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 242 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 243 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 244 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 245 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 246 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 247 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 248 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 249 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 250 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 251 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 252 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 253 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 254 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 255 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 256 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 257 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 258 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 259 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 260 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 261 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 262 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 263 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 264 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 265                     int);
 266 static int      bridge_ip_checkbasic(struct mbuf **mp);
 267 #ifdef INET6
 268 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 269 #endif /* INET6 */
 270 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 271                     struct ether_header *, int, struct llc *);
 272 static void     bridge_enqueue_internal(struct ifnet *, struct mbuf *m,
 273                                         netisr_fn_t);
 274 static void     bridge_enqueue_handler(struct netmsg *);
 275 static void     bridge_pfil_enqueue_handler(struct netmsg *);
 276 static void     bridge_pfil_enqueue(struct ifnet *, struct mbuf *, int);
 277 static void     bridge_handoff_notags(struct ifnet *, struct mbuf *);
 278 static void     bridge_handoff(struct ifnet *, struct mbuf *);
 279
 280 SYSCTL_DECL(_net_link);
 281 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 282
 283 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 284 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 285 static int pfil_member = 1; /* run pfil hooks on the member interface */
 286 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 287     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 288 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 289     &pfil_bridge, 0, "Packet filter on the bridge interface");
 290 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 291     &pfil_member, 0, "Packet filter on the member interface");
 292
 293 struct bridge_control {
 294         bridge_ctl_t    bc_func;
 295         int             bc_argsize;
 296         int             bc_flags;
 297 };
 298
 299 #define BC_F_COPYIN             0x01    /* copy arguments in */
 300 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 301 #define BC_F_SUSER              0x04    /* do super-user check */
 302
 303 const struct bridge_control bridge_control_table[] = {
 304         { bridge_ioctl_add,             sizeof(struct ifbreq),
 305           BC_F_COPYIN|BC_F_SUSER },
 306         { bridge_ioctl_del,             sizeof(struct ifbreq),
 307           BC_F_COPYIN|BC_F_SUSER },
 308
 309         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 310           BC_F_COPYIN|BC_F_COPYOUT },
 311         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 312           BC_F_COPYIN|BC_F_SUSER },
 313
 314         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 315           BC_F_COPYIN|BC_F_SUSER },
 316         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 317           BC_F_COPYOUT },
 318
 319         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 320           BC_F_COPYIN|BC_F_COPYOUT },
 321         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 322           BC_F_COPYIN|BC_F_COPYOUT },
 323
 324         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 325           BC_F_COPYIN|BC_F_SUSER },
 326
 327         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 328           BC_F_COPYIN|BC_F_SUSER },
 329         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 330           BC_F_COPYOUT },
 331
 332         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 333           BC_F_COPYIN|BC_F_SUSER },
 334
 335         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 336           BC_F_COPYIN|BC_F_SUSER },
 337
 338         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 339           BC_F_COPYOUT },
 340         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 341           BC_F_COPYIN|BC_F_SUSER },
 342
 343         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 344           BC_F_COPYOUT },
 345         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 346           BC_F_COPYIN|BC_F_SUSER },
 347
 348         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 349           BC_F_COPYOUT },
 350         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 351           BC_F_COPYIN|BC_F_SUSER },
 352
 353         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 354           BC_F_COPYOUT },
 355         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 356           BC_F_COPYIN|BC_F_SUSER },
 357
 358         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 359           BC_F_COPYIN|BC_F_SUSER },
 360
 361         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 362           BC_F_COPYIN|BC_F_SUSER },
 363
 364         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 365           BC_F_COPYIN|BC_F_SUSER },
 366         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 367           BC_F_COPYIN|BC_F_SUSER },
 368 };
 369 const int bridge_control_table_size =
 370     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 371
 372 LIST_HEAD(, bridge_softc) bridge_list;
 373
 374 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
 375                                 bridge_clone_create,
 376                                 bridge_clone_destroy, 0, IF_MAXUNIT);
 377
 378 static int
 379 bridge_modevent(module_t mod, int type, void *data)
 380 {
 381         switch (type) {
 382         case MOD_LOAD:
 383                 LIST_INIT(&bridge_list);
 384                 if_clone_attach(&bridge_cloner);
 385                 bridge_input_p = bridge_input;
 386                 bridge_output_p = bridge_output;
 387                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 388                     ifnet_detach_event, bridge_ifdetach, NULL,
 389                     EVENTHANDLER_PRI_ANY);
 390 #if notyet
 391                 bstp_linkstate_p = bstp_linkstate;
 392 #endif
 393                 break;
 394         case MOD_UNLOAD:
 395                 if (!LIST_EMPTY(&bridge_list))
 396                         return (EBUSY);
 397                 EVENTHANDLER_DEREGISTER(ifnet_detach_event,
 398                     bridge_detach_cookie);
 399                 if_clone_detach(&bridge_cloner);
 400                 bridge_input_p = NULL;
 401                 bridge_output_p = NULL;
 402 #if notyet
 403                 bstp_linkstate_p = NULL;
 404 #endif
 405                 break;
 406         default:
 407                 return (EOPNOTSUPP);
 408         }
 409         return (0);
 410 }
 411
 412 static moduledata_t bridge_mod = {
 413         "if_bridge",
 414         bridge_modevent,
 415         0
 416 };
 417
 418 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 419
 420
 421 /*
 422  * bridge_clone_create:
 423  *
 424  *      Create a new bridge instance.
 425  */
 426 static int
 427 bridge_clone_create(struct if_clone *ifc, int unit)
 428 {
 429         struct bridge_softc *sc;
 430         struct ifnet *ifp;
 431         u_char eaddr[6];
 432
 433         sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 434         ifp = sc->sc_ifp = &sc->sc_if;
 435
 436         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 437         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 438         sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
 439         sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
 440         sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
 441         sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
 442         sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
 443
 444         /* Initialize our routing table. */
 445         bridge_rtable_init(sc);
 446
 447         callout_init(&sc->sc_brcallout);
 448         callout_init(&sc->sc_bstpcallout);
 449
 450         LIST_INIT(&sc->sc_iflist);
 451         LIST_INIT(&sc->sc_spanlist);
 452
 453         ifp->if_softc = sc;
 454         if_initname(ifp, ifc->ifc_name, unit);
 455         ifp->if_mtu = ETHERMTU;
 456         ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
 457         ifp->if_ioctl = bridge_ioctl;
 458         ifp->if_start = bridge_start;
 459         ifp->if_init = bridge_init;
 460         ifp->if_type = IFT_BRIDGE;
 461         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 462         ifp->if_snd.ifq_maxlen = ifqmaxlen;
 463         ifq_set_ready(&ifp->if_snd);
 464         ifp->if_hdrlen = ETHER_HDR_LEN;
 465
 466         /*
 467          * Generate a random ethernet address and use the private AC:DE:48
 468          * OUI code.
 469          */
 470         {
 471                 int rnd = karc4random();
 472                 bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
 473                 rnd = karc4random();
 474                 bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
 475         }
 476         eaddr[0] &= ~1;         /* clear multicast bit */
 477         eaddr[0] |= 2;          /* set the LAA bit */
 478
 479         ether_ifattach(ifp, eaddr, NULL);
 480         /* Now undo some of the damage... */
 481         ifp->if_baudrate = 0;
 482         ifp->if_type = IFT_BRIDGE;
 483
 484         crit_enter();   /* XXX MP */
 485         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 486         crit_exit();
 487
 488         return (0);
 489 }
 490
 491 static void
 492 bridge_delete_dispatch(struct netmsg *nmsg)
 493 {
 494         struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
 495         struct bridge_softc *sc = lmsg->u.ms_resultp;
 496         struct ifnet *bifp = sc->sc_ifp;
 497         struct bridge_iflist *bif;
 498
 499         lwkt_serialize_enter(bifp->if_serializer);
 500
 501         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 502                 bridge_delete_member(sc, bif, 0);
 503
 504         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL)
 505                 bridge_delete_span(sc, bif);
 506
 507         lwkt_serialize_exit(bifp->if_serializer);
 508
 509         lwkt_replymsg(lmsg, 0);
 510 }
 511
 512 /*
 513  * bridge_clone_destroy:
 514  *
 515  *      Destroy a bridge instance.
 516  */
 517 static void
 518 bridge_clone_destroy(struct ifnet *ifp)
 519 {
 520         struct bridge_softc *sc = ifp->if_softc;
 521         struct lwkt_msg *lmsg;
 522         struct netmsg nmsg;
 523
 524         lwkt_serialize_enter(ifp->if_serializer);
 525
 526         bridge_stop(ifp);
 527         ifp->if_flags &= ~IFF_UP;
 528
 529         callout_stop(&sc->sc_brcallout);
 530         callout_stop(&sc->sc_bstpcallout);
 531
 532         lwkt_serialize_exit(ifp->if_serializer);
 533
 534         netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_delete_dispatch);
 535         lmsg = &nmsg.nm_lmsg;
 536         lmsg->u.ms_resultp = sc;
 537         lwkt_domsg(cpu_portfn(0), lmsg, 0);
 538
 539         crit_enter();   /* XXX MP */
 540         LIST_REMOVE(sc, sc_list);
 541         crit_exit();
 542
 543         ether_ifdetach(ifp);
 544
 545         /* Tear down the routing table. */
 546         bridge_rtable_fini(sc);
 547
 548         kfree(sc, M_DEVBUF);
 549 }
 550
 551 /*
 552  * bridge_ioctl:
 553  *
 554  *      Handle a control request from the operator.
 555  */
 556 static int
 557 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 558 {
 559         struct bridge_softc *sc = ifp->if_softc;
 560         union {
 561                 struct ifbreq ifbreq;
 562                 struct ifbifconf ifbifconf;
 563                 struct ifbareq ifbareq;
 564                 struct ifbaconf ifbaconf;
 565                 struct ifbrparam ifbrparam;
 566         } args;
 567         struct ifdrv *ifd = (struct ifdrv *) data;
 568         const struct bridge_control *bc;
 569         int error = 0;
 570
 571         ASSERT_SERIALIZED(ifp->if_serializer);
 572
 573         switch (cmd) {
 574         case SIOCADDMULTI:
 575         case SIOCDELMULTI:
 576                 break;
 577
 578         case SIOCGDRVSPEC:
 579         case SIOCSDRVSPEC:
 580                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 581                         error = EINVAL;
 582                         break;
 583                 }
 584                 bc = &bridge_control_table[ifd->ifd_cmd];
 585
 586                 if (cmd == SIOCGDRVSPEC &&
 587                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 588                         error = EINVAL;
 589                         break;
 590                 } else if (cmd == SIOCSDRVSPEC &&
 591                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 592                         error = EINVAL;
 593                         break;
 594                 }
 595
 596                 if (bc->bc_flags & BC_F_SUSER) {
 597                         error = suser_cred(cr, NULL_CRED_OKAY);
 598                         if (error)
 599                                 break;
 600                 }
 601
 602                 if (ifd->ifd_len != bc->bc_argsize ||
 603                     ifd->ifd_len > sizeof(args)) {
 604                         error = EINVAL;
 605                         break;
 606                 }
 607
 608                 memset(&args, 0, sizeof(args));
 609                 if (bc->bc_flags & BC_F_COPYIN) {
 610                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 611                         if (error)
 612                                 break;
 613                 }
 614
 615                 error = bridge_control(sc, cmd, bc->bc_func, &args);
 616                 if (error)
 617                         break;
 618
 619                 if (bc->bc_flags & BC_F_COPYOUT)
 620                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 621                 break;
 622
 623         case SIOCSIFFLAGS:
 624                 if (!(ifp->if_flags & IFF_UP) &&
 625                     (ifp->if_flags & IFF_RUNNING)) {
 626                         /*
 627                          * If interface is marked down and it is running,
 628                          * then stop it.
 629                          */
 630                         bridge_stop(ifp);
 631                 } else if ((ifp->if_flags & IFF_UP) &&
 632                     !(ifp->if_flags & IFF_RUNNING)) {
 633                         /*
 634                          * If interface is marked up and it is stopped, then
 635                          * start it.
 636                          */
 637                         ifp->if_init(sc);
 638                 }
 639                 break;
 640
 641         case SIOCSIFMTU:
 642                 /* Do not allow the MTU to be changed on the bridge */
 643                 error = EINVAL;
 644                 break;
 645
 646         default:
 647                 error = ether_ioctl(ifp, cmd, data);
 648                 break;
 649         }
 650         return (error);
 651 }
 652
 653 /*
 654  * bridge_mutecaps:
 655  *
 656  *      Clear or restore unwanted capabilities on the member interface
 657  */
 658 static void
 659 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 660 {
 661         struct ifnet *ifp = bif->bif_ifp;
 662         struct ifreq ifr;
 663         int error;
 664
 665         if (ifp->if_ioctl == NULL)
 666                 return;
 667
 668         bzero(&ifr, sizeof(ifr));
 669         ifr.ifr_reqcap = ifp->if_capenable;
 670
 671         if (mute) {
 672                 /* mask off and save capabilities */
 673                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 674                 if (bif->bif_mutecap != 0)
 675                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 676         } else {
 677                 /* restore muted capabilities */
 678                 ifr.ifr_reqcap |= bif->bif_mutecap;
 679         }
 680
 681         if (bif->bif_mutecap != 0) {
 682                 lwkt_serialize_enter(ifp->if_serializer);
 683                 error = ifp->if_ioctl(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
 684                 lwkt_serialize_exit(ifp->if_serializer);
 685         }
 686 }
 687
 688 /*
 689  * bridge_lookup_member:
 690  *
 691  *      Lookup a bridge member interface.
 692  */
 693 static struct bridge_iflist *
 694 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 695 {
 696         struct bridge_iflist *bif;
 697         struct ifnet *ifp;
 698
 699         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 700                 ifp = bif->bif_ifp;
 701                 if (strcmp(ifp->if_xname, name) == 0)
 702                         return (bif);
 703         }
 704
 705         return (NULL);
 706 }
 707
 708 /*
 709  * bridge_lookup_member_if:
 710  *
 711  *      Lookup a bridge member interface by ifnet*.
 712  */
 713 static struct bridge_iflist *
 714 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 715 {
 716         struct bridge_iflist *bif;
 717
 718         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 719                 if (bif->bif_ifp == member_ifp)
 720                         return (bif);
 721         }
 722
 723         return (NULL);
 724 }
 725
 726 /*
 727  * bridge_delete_member:
 728  *
 729  *      Delete the specified member interface.
 730  */
 731 static void
 732 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 733     int gone)
 734 {
 735         struct ifnet *ifs = bif->bif_ifp;
 736         struct ifnet *bifp = sc->sc_ifp;
 737
 738         ASSERT_SERIALIZED(bifp->if_serializer);
 739
 740         ifs->if_bridge = NULL;
 741
 742         /*
 743          * Release bridge interface's serializer:
 744          * - To avoid possible dead lock.
 745          * - netmsg_service_sync will block current thread.
 746          */
 747         lwkt_serialize_exit(bifp->if_serializer);
 748
 749         /*
 750          * Make sure that all protocol threads see 'ifs' if_bridge change.
 751          */
 752         netmsg_service_sync();
 753
 754         if (!gone) {
 755                 switch (ifs->if_type) {
 756                 case IFT_ETHER:
 757                 case IFT_L2VLAN:
 758                         /*
 759                          * Take the interface out of promiscuous mode.
 760                          */
 761                         ifpromisc(ifs, 0);
 762                         bridge_mutecaps(bif, 0);
 763                         break;
 764
 765                 case IFT_GIF:
 766                         break;
 767
 768                 default:
 769                         panic("bridge_delete_member: impossible");
 770                         break;
 771                 }
 772         }
 773
 774         lwkt_serialize_enter(bifp->if_serializer);
 775
 776         LIST_REMOVE(bif, bif_next);
 777
 778         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 779
 780         kfree(bif, M_DEVBUF);
 781
 782         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 783                 bstp_initialization(sc);
 784 }
 785
 786 /*
 787  * bridge_delete_span:
 788  *
 789  *      Delete the specified span interface.
 790  */
 791 static void
 792 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 793 {
 794         KASSERT(bif->bif_ifp->if_bridge == NULL,
 795             ("%s: not a span interface", __func__));
 796
 797         LIST_REMOVE(bif, bif_next);
 798         kfree(bif, M_DEVBUF);
 799 }
 800
 801 static int
 802 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 803 {
 804         struct ifbreq *req = arg;
 805         struct bridge_iflist *bif = NULL;
 806         struct ifnet *ifs, *bifp;
 807         int error = 0;
 808
 809         bifp = sc->sc_ifp;
 810         ASSERT_SERIALIZED(bifp->if_serializer);
 811
 812         ifs = ifunit(req->ifbr_ifsname);
 813         if (ifs == NULL)
 814                 return (ENOENT);
 815
 816         /* If it's in the span list, it can't be a member. */
 817         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 818                 if (ifs == bif->bif_ifp)
 819                         return (EBUSY);
 820
 821         /* Allow the first Ethernet member to define the MTU */
 822         if (ifs->if_type != IFT_GIF) {
 823                 if (LIST_EMPTY(&sc->sc_iflist)) {
 824                         bifp->if_mtu = ifs->if_mtu;
 825                 } else if (bifp->if_mtu != ifs->if_mtu) {
 826                         if_printf(bifp, "invalid MTU for %s\n", ifs->if_xname);
 827                         return (EINVAL);
 828                 }
 829         }
 830
 831         if (ifs->if_bridge == sc)
 832                 return (EEXIST);
 833
 834         if (ifs->if_bridge != NULL)
 835                 return (EBUSY);
 836
 837         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
 838         bif->bif_ifp = ifs;
 839         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 840         bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
 841         bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
 842
 843         switch (ifs->if_type) {
 844         case IFT_ETHER:
 845         case IFT_L2VLAN:
 846                 /*
 847                  * Release bridge interface's serializer to
 848                  * avoid possible dead lock.
 849                  */
 850                 lwkt_serialize_exit(bifp->if_serializer);
 851
 852                 /*
 853                  * Place the interface into promiscuous mode.
 854                  */
 855                 error = ifpromisc(ifs, 1);
 856                 if (error) {
 857                         lwkt_serialize_enter(bifp->if_serializer);
 858                         goto out;
 859                 }
 860
 861                 bridge_mutecaps(bif, 1);
 862
 863                 lwkt_serialize_enter(bifp->if_serializer);
 864                 break;
 865
 866         case IFT_GIF: /* :^) */
 867                 break;
 868
 869         default:
 870                 error = EINVAL;
 871                 goto out;
 872         }
 873
 874         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 875
 876         if (bifp->if_flags & IFF_RUNNING)
 877                 bstp_initialization(sc);
 878         else
 879                 bstp_stop(sc);
 880
 881         /*
 882          * Everything has been setup, so let the member interface
 883          * deliver packets to this bridge on its input/output path.
 884          */
 885         ifs->if_bridge = sc;
 886 out:
 887         if (error) {
 888                 if (bif != NULL)
 889                         kfree(bif, M_DEVBUF);
 890         }
 891         return (error);
 892 }
 893
 894 static int
 895 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 896 {
 897         struct ifbreq *req = arg;
 898         struct bridge_iflist *bif;
 899
 900         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 901         if (bif == NULL)
 902                 return (ENOENT);
 903
 904         bridge_delete_member(sc, bif, 0);
 905
 906         return (0);
 907 }
 908
 909 static int
 910 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 911 {
 912         struct ifbreq *req = arg;
 913         struct bridge_iflist *bif;
 914
 915         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 916         if (bif == NULL)
 917                 return (ENOENT);
 918
 919         req->ifbr_ifsflags = bif->bif_flags;
 920         req->ifbr_state = bif->bif_state;
 921         req->ifbr_priority = bif->bif_priority;
 922         req->ifbr_path_cost = bif->bif_path_cost;
 923         req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
 924
 925         return (0);
 926 }
 927
 928 static int
 929 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
 930 {
 931         struct ifbreq *req = arg;
 932         struct bridge_iflist *bif;
 933
 934         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 935         if (bif == NULL)
 936                 return (ENOENT);
 937
 938         if (req->ifbr_ifsflags & IFBIF_SPAN)
 939                 /* SPAN is readonly */
 940                 return (EINVAL);
 941
 942         if (req->ifbr_ifsflags & IFBIF_STP) {
 943                 switch (bif->bif_ifp->if_type) {
 944                 case IFT_ETHER:
 945                         /* These can do spanning tree. */
 946                         break;
 947
 948                 default:
 949                         /* Nothing else can. */
 950                         return (EINVAL);
 951                 }
 952         }
 953
 954         bif->bif_flags = req->ifbr_ifsflags;
 955
 956         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 957                 bstp_initialization(sc);
 958
 959         return (0);
 960 }
 961
 962 static int
 963 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
 964 {
 965         struct ifbrparam *param = arg;
 966
 967         sc->sc_brtmax = param->ifbrp_csize;
 968         bridge_rttrim(sc);
 969
 970         return (0);
 971 }
 972
 973 static int
 974 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
 975 {
 976         struct ifbrparam *param = arg;
 977
 978         param->ifbrp_csize = sc->sc_brtmax;
 979
 980         return (0);
 981 }
 982
 983 static int
 984 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
 985 {
 986         struct ifbifconf *bifc = arg;
 987         struct bridge_iflist *bif;
 988         struct ifbreq breq;
 989         int count, len, error = 0;
 990
 991         count = 0;
 992         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
 993                 count++;
 994         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 995                 count++;
 996
 997         if (bifc->ifbic_len == 0) {
 998                 bifc->ifbic_len = sizeof(breq) * count;
 999                 return (0);
1000         }
1001
1002         count = 0;
1003         len = bifc->ifbic_len;
1004         memset(&breq, 0, sizeof breq);
1005         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1006                 if (len < sizeof(breq))
1007                         break;
1008
1009                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1010                     sizeof(breq.ifbr_ifsname));
1011                 breq.ifbr_ifsflags = bif->bif_flags;
1012                 breq.ifbr_state = bif->bif_state;
1013                 breq.ifbr_priority = bif->bif_priority;
1014                 breq.ifbr_path_cost = bif->bif_path_cost;
1015                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1016                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1017                 if (error)
1018                         break;
1019                 count++;
1020                 len -= sizeof(breq);
1021         }
1022         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1023                 if (len < sizeof(breq))
1024                         break;
1025
1026                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1027                     sizeof(breq.ifbr_ifsname));
1028                 breq.ifbr_ifsflags = bif->bif_flags;
1029                 breq.ifbr_state = bif->bif_state;
1030                 breq.ifbr_priority = bif->bif_priority;
1031                 breq.ifbr_path_cost = bif->bif_path_cost;
1032                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1033                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1034                 if (error)
1035                         break;
1036                 count++;
1037                 len -= sizeof(breq);
1038         }
1039
1040         bifc->ifbic_len = sizeof(breq) * count;
1041         return (error);
1042 }
1043
1044 static int
1045 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1046 {
1047         struct ifbaconf *bac = arg;
1048         struct bridge_rtnode *brt;
1049         struct ifbareq bareq;
1050         int count = 0, error = 0, len;
1051
1052         if (bac->ifbac_len == 0)
1053                 return (0);
1054
1055         len = bac->ifbac_len;
1056         memset(&bareq, 0, sizeof(bareq));
1057         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1058                 if (len < sizeof(bareq))
1059                         goto out;
1060                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1061                     sizeof(bareq.ifba_ifsname));
1062                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1063                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1064                                 time_second < brt->brt_expire)
1065                         bareq.ifba_expire = brt->brt_expire - time_second;
1066                 else
1067                         bareq.ifba_expire = 0;
1068                 bareq.ifba_flags = brt->brt_flags;
1069
1070                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1071                 if (error)
1072                         goto out;
1073                 count++;
1074                 len -= sizeof(bareq);
1075         }
1076 out:
1077         bac->ifbac_len = sizeof(bareq) * count;
1078         return (error);
1079 }
1080
1081 static int
1082 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1083 {
1084         struct ifbareq *req = arg;
1085         struct bridge_iflist *bif;
1086         int error;
1087
1088         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1089         if (bif == NULL)
1090                 return (ENOENT);
1091
1092         error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1093             req->ifba_flags);
1094
1095         return (error);
1096 }
1097
1098 static int
1099 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1100 {
1101         struct ifbrparam *param = arg;
1102
1103         sc->sc_brttimeout = param->ifbrp_ctime;
1104
1105         return (0);
1106 }
1107
1108 static int
1109 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1110 {
1111         struct ifbrparam *param = arg;
1112
1113         param->ifbrp_ctime = sc->sc_brttimeout;
1114
1115         return (0);
1116 }
1117
1118 static int
1119 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1120 {
1121         struct ifbareq *req = arg;
1122
1123         return (bridge_rtdaddr(sc, req->ifba_dst));
1124 }
1125
1126 static int
1127 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1128 {
1129         struct ifbreq *req = arg;
1130
1131         bridge_rtflush(sc, req->ifbr_ifsflags);
1132
1133         return (0);
1134 }
1135
1136 static int
1137 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1138 {
1139         struct ifbrparam *param = arg;
1140
1141         param->ifbrp_prio = sc->sc_bridge_priority;
1142
1143         return (0);
1144 }
1145
1146 static int
1147 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1148 {
1149         struct ifbrparam *param = arg;
1150
1151         sc->sc_bridge_priority = param->ifbrp_prio;
1152
1153         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1154                 bstp_initialization(sc);
1155
1156         return (0);
1157 }
1158
1159 static int
1160 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1161 {
1162         struct ifbrparam *param = arg;
1163
1164         param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1165
1166         return (0);
1167 }
1168
1169 static int
1170 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1171 {
1172         struct ifbrparam *param = arg;
1173
1174         if (param->ifbrp_hellotime == 0)
1175                 return (EINVAL);
1176         sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1177
1178         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1179                 bstp_initialization(sc);
1180
1181         return (0);
1182 }
1183
1184 static int
1185 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1186 {
1187         struct ifbrparam *param = arg;
1188
1189         param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1190
1191         return (0);
1192 }
1193
1194 static int
1195 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1196 {
1197         struct ifbrparam *param = arg;
1198
1199         if (param->ifbrp_fwddelay == 0)
1200                 return (EINVAL);
1201         sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1202
1203         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1204                 bstp_initialization(sc);
1205
1206         return (0);
1207 }
1208
1209 static int
1210 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1211 {
1212         struct ifbrparam *param = arg;
1213
1214         param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1215
1216         return (0);
1217 }
1218
1219 static int
1220 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1221 {
1222         struct ifbrparam *param = arg;
1223
1224         if (param->ifbrp_maxage == 0)
1225                 return (EINVAL);
1226         sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1227
1228         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1229                 bstp_initialization(sc);
1230
1231         return (0);
1232 }
1233
1234 static int
1235 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1236 {
1237         struct ifbreq *req = arg;
1238         struct bridge_iflist *bif;
1239
1240         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1241         if (bif == NULL)
1242                 return (ENOENT);
1243
1244         bif->bif_priority = req->ifbr_priority;
1245
1246         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1247                 bstp_initialization(sc);
1248
1249         return (0);
1250 }
1251
1252 static int
1253 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1254 {
1255         struct ifbreq *req = arg;
1256         struct bridge_iflist *bif;
1257
1258         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1259         if (bif == NULL)
1260                 return (ENOENT);
1261
1262         bif->bif_path_cost = req->ifbr_path_cost;
1263
1264         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1265                 bstp_initialization(sc);
1266
1267         return (0);
1268 }
1269
1270 static int
1271 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1272 {
1273         struct ifbreq *req = arg;
1274         struct bridge_iflist *bif = NULL;
1275         struct ifnet *ifs;
1276
1277         ifs = ifunit(req->ifbr_ifsname);
1278         if (ifs == NULL)
1279                 return (ENOENT);
1280
1281         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1282                 if (ifs == bif->bif_ifp)
1283                         return (EBUSY);
1284
1285         if (ifs->if_bridge != NULL)
1286                 return (EBUSY);
1287
1288         switch (ifs->if_type) {
1289                 case IFT_ETHER:
1290                 case IFT_GIF:
1291                 case IFT_L2VLAN:
1292                         break;
1293                 default:
1294                         return (EINVAL);
1295         }
1296
1297         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
1298
1299         bif->bif_ifp = ifs;
1300         bif->bif_flags = IFBIF_SPAN;
1301
1302         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1303
1304         return (0);
1305 }
1306
1307 static int
1308 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1309 {
1310         struct ifbreq *req = arg;
1311         struct bridge_iflist *bif;
1312         struct ifnet *ifs;
1313
1314         ifs = ifunit(req->ifbr_ifsname);
1315         if (ifs == NULL)
1316                 return (ENOENT);
1317
1318         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1319                 if (ifs == bif->bif_ifp)
1320                         break;
1321
1322         if (bif == NULL)
1323                 return (ENOENT);
1324
1325         bridge_delete_span(sc, bif);
1326
1327         return (0);
1328 }
1329
1330 static void
1331 bridge_ifdetach_dispatch(struct netmsg *nmsg)
1332 {
1333         struct lwkt_msg *lmsg = &nmsg->nm_lmsg;
1334         struct ifnet *ifp, *bifp;
1335         struct bridge_softc *sc;
1336         struct bridge_iflist *bif;
1337
1338         ifp = lmsg->u.ms_resultp;
1339         sc = ifp->if_bridge;
1340
1341         /* Check if the interface is a bridge member */
1342         if (sc != NULL) {
1343                 bifp = sc->sc_ifp;
1344
1345                 lwkt_serialize_enter(bifp->if_serializer);
1346
1347                 bif = bridge_lookup_member_if(sc, ifp);
1348                 if (bif != NULL) {
1349                         bridge_delete_member(sc, bif, 1);
1350                 } else {
1351                         /* XXX Why bif will be NULL? */
1352                 }
1353
1354                 lwkt_serialize_exit(bifp->if_serializer);
1355                 goto reply;
1356         }
1357
1358         crit_enter();   /* XXX MP */
1359
1360         /* Check if the interface is a span port */
1361         LIST_FOREACH(sc, &bridge_list, sc_list) {
1362                 bifp = sc->sc_ifp;
1363
1364                 lwkt_serialize_enter(bifp->if_serializer);
1365
1366                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1367                         if (ifp == bif->bif_ifp) {
1368                                 bridge_delete_span(sc, bif);
1369                                 break;
1370                         }
1371
1372                 lwkt_serialize_exit(bifp->if_serializer);
1373         }
1374
1375         crit_exit();
1376
1377 reply:
1378         lwkt_replymsg(lmsg, 0);
1379 }
1380
1381 /*
1382  * bridge_ifdetach:
1383  *
1384  *      Detach an interface from a bridge.  Called when a member
1385  *      interface is detaching.
1386  */
1387 static void
1388 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1389 {
1390         struct lwkt_msg *lmsg;
1391         struct netmsg nmsg;
1392
1393         netmsg_init(&nmsg, &curthread->td_msgport, 0, bridge_ifdetach_dispatch);
1394         lmsg = &nmsg.nm_lmsg;
1395         lmsg->u.ms_resultp = ifp;
1396
1397         lwkt_domsg(cpu_portfn(0), lmsg, 0);
1398 }
1399
1400 /*
1401  * bridge_init:
1402  *
1403  *      Initialize a bridge interface.
1404  */
1405 static void
1406 bridge_init(void *xsc)
1407 {
1408         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1409         struct ifnet *ifp = sc->sc_ifp;
1410
1411         ASSERT_SERIALIZED(ifp->if_serializer);
1412
1413         if (ifp->if_flags & IFF_RUNNING)
1414                 return;
1415
1416         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1417             bridge_timer, sc);
1418
1419         ifp->if_flags |= IFF_RUNNING;
1420         bstp_initialization(sc);
1421         return;
1422 }
1423
1424 /*
1425  * bridge_stop:
1426  *
1427  *      Stop the bridge interface.
1428  */
1429 static void
1430 bridge_stop(struct ifnet *ifp)
1431 {
1432         struct bridge_softc *sc = ifp->if_softc;
1433
1434         ASSERT_SERIALIZED(ifp->if_serializer);
1435
1436         if ((ifp->if_flags & IFF_RUNNING) == 0)
1437                 return;
1438
1439         callout_stop(&sc->sc_brcallout);
1440         bstp_stop(sc);
1441
1442         bridge_rtflush(sc, IFBF_FLUSHDYN);
1443
1444         ifp->if_flags &= ~IFF_RUNNING;
1445 }
1446
1447 static void
1448 bridge_enqueue_internal(struct ifnet *dst_ifp, struct mbuf *m,
1449                         netisr_fn_t handler)
1450 {
1451         struct netmsg_packet *nmp;
1452         lwkt_port_t port;
1453         int cpu = mycpu->gd_cpuid;
1454
1455         nmp = &m->m_hdr.mh_netmsg;
1456         netmsg_init(&nmp->nm_netmsg, &netisr_apanic_rport, 0, handler);
1457         nmp->nm_packet = m;
1458         nmp->nm_netmsg.nm_lmsg.u.ms_resultp = dst_ifp;
1459
1460         port = cpu_portfn(cpu);
1461         lwkt_sendmsg(port, &nmp->nm_netmsg.nm_lmsg);
1462 }
1463
1464 static void
1465 bridge_pfil_enqueue(struct ifnet *dst_ifp, struct mbuf *m,
1466                     int runfilt)
1467 {
1468         netisr_fn_t handler;
1469
1470         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
1471 #ifdef INET6
1472             || inet6_pfil_hook.ph_hashooks > 0
1473 #endif
1474             )) {
1475                 handler = bridge_pfil_enqueue_handler;
1476         } else {
1477                 handler = bridge_enqueue_handler;
1478         }
1479         bridge_enqueue_internal(dst_ifp, m, handler);
1480 }
1481
1482 /*
1483  * bridge_enqueue:
1484  *
1485  *      Enqueue a packet on a bridge member interface.
1486  *
1487  */
1488 void
1489 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1490 {
1491         bridge_enqueue_internal(dst_ifp, m, bridge_enqueue_handler);
1492 }
1493
1494 /*
1495  * bridge_output:
1496  *
1497  *      Send output from a bridge member interface.  This
1498  *      performs the bridging function for locally originated
1499  *      packets.
1500  *
1501  *      The mbuf has the Ethernet header already attached.  We must
1502  *      enqueue or free the mbuf before returning.
1503  */
1504 static int
1505 bridge_output(struct ifnet *ifp, struct mbuf *m)
1506 {
1507         struct bridge_softc *sc = ifp->if_bridge;
1508         struct ether_header *eh;
1509         struct ifnet *dst_if;
1510
1511         ASSERT_NOT_SERIALIZED(ifp->if_serializer);
1512
1513         /*
1514          * Make sure that we are still a member of a bridge interface.
1515          */
1516         if (sc == NULL) {
1517                 m_freem(m);
1518                 return (0);
1519         }
1520
1521         if (m->m_len < ETHER_HDR_LEN) {
1522                 m = m_pullup(m, ETHER_HDR_LEN);
1523                 if (m == NULL)
1524                         return (0);
1525         }
1526
1527         /* Serialize our bridge interface. */
1528         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
1529
1530         eh = mtod(m, struct ether_header *);
1531
1532         /*
1533          * If bridge is down, but the original output interface is up,
1534          * go ahead and send out that interface.  Otherwise, the packet
1535          * is dropped below.
1536          */
1537         if ((sc->sc_ifp->if_flags & IFF_RUNNING) == 0) {
1538                 dst_if = ifp;
1539                 goto sendunicast;
1540         }
1541
1542         /*
1543          * If the packet is a multicast, or we don't know a better way to
1544          * get there, send to all interfaces.
1545          */
1546         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1547                 dst_if = NULL;
1548         else
1549                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1550         if (dst_if == NULL) {
1551                 struct bridge_iflist *bif;
1552                 struct mbuf *mc;
1553                 int used = 0;
1554
1555                 bridge_span(sc, m);
1556
1557                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1558                         dst_if = bif->bif_ifp;
1559                         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1560                                 continue;
1561
1562                         /*
1563                          * If this is not the original output interface,
1564                          * and the interface is participating in spanning
1565                          * tree, make sure the port is in a state that
1566                          * allows forwarding.
1567                          */
1568                         if (dst_if != ifp &&
1569                             (bif->bif_flags & IFBIF_STP) != 0) {
1570                                 switch (bif->bif_state) {
1571                                 case BSTP_IFSTATE_BLOCKING:
1572                                 case BSTP_IFSTATE_LISTENING:
1573                                 case BSTP_IFSTATE_DISABLED:
1574                                         continue;
1575                                 }
1576                         }
1577
1578                         if (LIST_NEXT(bif, bif_next) == NULL) {
1579                                 used = 1;
1580                                 mc = m;
1581                         } else {
1582                                 mc = m_copypacket(m, MB_DONTWAIT);
1583                                 if (mc == NULL) {
1584                                         sc->sc_ifp->if_oerrors++;
1585                                         continue;
1586                                 }
1587                         }
1588                         bridge_enqueue(dst_if, mc);
1589                 }
1590                 if (used == 0)
1591                         m_freem(m);
1592                 lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1593                 return (0);
1594         }
1595
1596 sendunicast:
1597         /*
1598          * XXX Spanning tree consideration here?
1599          */
1600
1601         bridge_span(sc, m);
1602         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1603         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1604                 m_freem(m);
1605         else
1606                 bridge_enqueue(dst_if, m);
1607         return (0);
1608 }
1609
1610 /*
1611  * bridge_start:
1612  *
1613  *      Start output on a bridge.
1614  *
1615  */
1616 static void
1617 bridge_start(struct ifnet *ifp)
1618 {
1619         struct bridge_softc *sc = ifp->if_softc;
1620
1621         ASSERT_SERIALIZED(ifp->if_serializer);
1622
1623         ifp->if_flags |= IFF_OACTIVE;
1624         for (;;) {
1625                 struct ifnet *dst_if = NULL;
1626                 struct ether_header *eh;
1627                 struct mbuf *m;
1628
1629                 m = ifq_dequeue(&ifp->if_snd, NULL);
1630                 if (m == NULL)
1631                         break;
1632
1633                 if (m->m_len < sizeof(*eh)) {
1634                         m = m_pullup(m, sizeof(*eh));
1635                         if (m == NULL) {
1636                                 ifp->if_oerrors++;
1637                                 continue;
1638                         }
1639                 }
1640                 eh = mtod(m, struct ether_header *);
1641
1642                 BPF_MTAP(ifp, m);
1643                 ifp->if_opackets++;
1644
1645                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
1646                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1647
1648                 if (dst_if == NULL)
1649                         bridge_broadcast(sc, ifp, m, 0);
1650                 else
1651                         bridge_enqueue(dst_if, m);
1652         }
1653         ifp->if_flags &= ~IFF_OACTIVE;
1654 }
1655
1656 /*
1657  * bridge_forward:
1658  *
1659  *      The forwarding function of the bridge.
1660  */
1661 static void
1662 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1663 {
1664         struct bridge_iflist *bif;
1665         struct ifnet *src_if, *dst_if, *ifp;
1666         struct ether_header *eh;
1667
1668         src_if = m->m_pkthdr.rcvif;
1669         ifp = sc->sc_ifp;
1670
1671         ASSERT_SERIALIZED(ifp->if_serializer);
1672
1673         ifp->if_ipackets++;
1674         ifp->if_ibytes += m->m_pkthdr.len;
1675
1676         /*
1677          * Look up the bridge_iflist.
1678          */
1679         bif = bridge_lookup_member_if(sc, src_if);
1680         if (bif == NULL) {
1681                 /* Interface is not a bridge member (anymore?) */
1682                 m_freem(m);
1683                 return;
1684         }
1685
1686         if (bif->bif_flags & IFBIF_STP) {
1687                 switch (bif->bif_state) {
1688                 case BSTP_IFSTATE_BLOCKING:
1689                 case BSTP_IFSTATE_LISTENING:
1690                 case BSTP_IFSTATE_DISABLED:
1691                         m_freem(m);
1692                         return;
1693                 }
1694         }
1695
1696         eh = mtod(m, struct ether_header *);
1697
1698         /*
1699          * If the interface is learning, and the source
1700          * address is valid and not multicast, record
1701          * the address.
1702          */
1703         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1704             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1705             (eh->ether_shost[0] == 0 &&
1706              eh->ether_shost[1] == 0 &&
1707              eh->ether_shost[2] == 0 &&
1708              eh->ether_shost[3] == 0 &&
1709              eh->ether_shost[4] == 0 &&
1710              eh->ether_shost[5] == 0) == 0) {
1711                 bridge_rtupdate(sc, eh->ether_shost, src_if, 0, IFBAF_DYNAMIC);
1712         }
1713
1714         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1715             bif->bif_state == BSTP_IFSTATE_LEARNING) {
1716                 m_freem(m);
1717                 return;
1718         }
1719
1720         /*
1721          * At this point, the port either doesn't participate
1722          * in spanning tree or it is in the forwarding state.
1723          */
1724
1725         /*
1726          * If the packet is unicast, destined for someone on
1727          * "this" side of the bridge, drop it.
1728          */
1729         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1730                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1731                 if (src_if == dst_if) {
1732                         m_freem(m);
1733                         return;
1734                 }
1735         } else {
1736                 /* ...forward it to all interfaces. */
1737                 sc->sc_ifp->if_imcasts++;
1738                 dst_if = NULL;
1739         }
1740
1741         if (dst_if == NULL) {
1742                 bridge_broadcast(sc, src_if, m, 1);
1743                 return;
1744         }
1745
1746         /*
1747          * At this point, we're dealing with a unicast frame
1748          * going to a different interface.
1749          */
1750         if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1751                 m_freem(m);
1752                 return;
1753         }
1754         bif = bridge_lookup_member_if(sc, dst_if);
1755         if (bif == NULL) {
1756                 /* Not a member of the bridge (anymore?) */
1757                 m_freem(m);
1758                 return;
1759         }
1760
1761         if (bif->bif_flags & IFBIF_STP) {
1762                 switch (bif->bif_state) {
1763                 case BSTP_IFSTATE_DISABLED:
1764                 case BSTP_IFSTATE_BLOCKING:
1765                         m_freem(m);
1766                         return;
1767                 }
1768         }
1769
1770         lwkt_serialize_exit(ifp->if_serializer);
1771
1772         /* run the packet filter */
1773         if (inet_pfil_hook.ph_hashooks > 0
1774 #ifdef INET6
1775             || inet6_pfil_hook.ph_hashooks > 0
1776 #endif
1777             ) {
1778                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1779                         goto done;
1780                 if (m == NULL)
1781                         goto done;
1782
1783                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
1784                         goto done;
1785                 if (m == NULL)
1786                         goto done;
1787         }
1788         bridge_handoff(dst_if, m);
1789
1790         /*
1791          * ifp's serializer was held on entry and is expected to be held
1792          * on return.
1793          */
1794 done:
1795         lwkt_serialize_enter(ifp->if_serializer);
1796 }
1797
1798 /*
1799  * bridge_input:
1800  *
1801  *      Receive input from a member interface.  Queue the packet for
1802  *      bridging if it is not for us.
1803  */
1804 static struct mbuf *
1805 bridge_input(struct ifnet *ifp, struct mbuf *m)
1806 {
1807         struct bridge_softc *sc = ifp->if_bridge;
1808         struct bridge_iflist *bif;
1809         struct ifnet *bifp, *new_ifp;
1810         struct ether_header *eh;
1811         struct mbuf *mc, *mc2;
1812
1813         /*
1814          * Make sure that we are still a member of a bridge interface.
1815          */
1816         if (sc == NULL)
1817                 return m;
1818
1819         new_ifp = NULL;
1820         bifp = sc->sc_ifp;
1821
1822         lwkt_serialize_enter(bifp->if_serializer);
1823
1824         if ((bifp->if_flags & IFF_RUNNING) == 0)
1825                 goto out;
1826
1827         /*
1828          * Implement support for bridge monitoring. If this flag has been
1829          * set on this interface, discard the packet once we push it through
1830          * the bpf(4) machinery, but before we do, increment the byte and
1831          * packet counters associated with this interface.
1832          */
1833          if ((bifp->if_flags & IFF_MONITOR) != 0) {
1834                 m->m_pkthdr.rcvif = bifp;
1835                 BPF_MTAP(bifp, m);
1836                 bifp->if_ipackets++;
1837                 bifp->if_ibytes += m->m_pkthdr.len;
1838                 m_freem(m);
1839                 m = NULL;
1840                 goto out;
1841         }
1842
1843         eh = mtod(m, struct ether_header *);
1844
1845         m->m_flags &= ~M_PROTO1; /* XXX Hack - loop prevention */
1846
1847         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
1848                 /*
1849                  * If the packet is for us, set the packets source as the
1850                  * bridge, and return the packet back to ifnet.if_input for
1851                  * local processing.
1852                  */
1853                 KASSERT(bifp->if_bridge == NULL,
1854                         ("loop created in bridge_input"));
1855                 new_ifp = bifp;
1856                 goto out;
1857         }
1858
1859         /*
1860          * Tap all packets arriving on the bridge, no matter if
1861          * they are local destinations or not.  In is in.
1862          */
1863         BPF_MTAP(bifp, m);
1864
1865         bif = bridge_lookup_member_if(sc, ifp);
1866         if (bif == NULL)
1867                 goto out;
1868
1869         bridge_span(sc, m);
1870
1871         if (m->m_flags & (M_BCAST | M_MCAST)) {
1872                 /* Tap off 802.1D packets; they do not get forwarded. */
1873                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
1874                     ETHER_ADDR_LEN) == 0) {
1875                         m = bstp_input(sc, bif, m);
1876                         KASSERT(m == NULL,
1877                                 ("attempt to deliver 802.1D packet\n"));
1878                         goto out;
1879                 }
1880
1881                 if (bif->bif_flags & IFBIF_STP) {
1882                         switch (bif->bif_state) {
1883                         case BSTP_IFSTATE_BLOCKING:
1884                         case BSTP_IFSTATE_LISTENING:
1885                         case BSTP_IFSTATE_DISABLED:
1886                                 goto out;
1887                         }
1888                 }
1889
1890                 /*
1891                  * Make a deep copy of the packet and enqueue the copy
1892                  * for bridge processing; return the original packet for
1893                  * local processing.
1894                  */
1895                 mc = m_dup(m, MB_DONTWAIT);
1896                 if (mc == NULL)
1897                         goto out;
1898
1899                 bridge_forward(sc, mc);
1900
1901                 /*
1902                  * Reinject the mbuf as arriving on the bridge so we have a
1903                  * chance at claiming multicast packets. We can not loop back
1904                  * here from ether_input as a bridge is never a member of a
1905                  * bridge.
1906                  */
1907                 KASSERT(bifp->if_bridge == NULL,
1908                         ("loop created in bridge_input"));
1909                 mc2 = m_dup(m, MB_DONTWAIT);
1910 #ifdef notyet
1911                 if (mc2 != NULL) {
1912                         /* Keep the layer3 header aligned */
1913                         int i = min(mc2->m_pkthdr.len, max_protohdr);
1914                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
1915                 }
1916 #endif
1917                 if (mc2 != NULL) {
1918                         mc2->m_pkthdr.rcvif = bifp;
1919                         bifp->if_ipackets++;
1920                         bifp->if_input(bifp, mc2);
1921                 }
1922
1923                 /* Return the original packet for local processing. */
1924                 goto out;
1925         }
1926
1927         if (bif->bif_flags & IFBIF_STP) {
1928                 switch (bif->bif_state) {
1929                 case BSTP_IFSTATE_BLOCKING:
1930                 case BSTP_IFSTATE_LISTENING:
1931                 case BSTP_IFSTATE_DISABLED:
1932                         goto out;
1933                 }
1934         }
1935
1936         /*
1937          * Unicast.  Make sure it's not for us.
1938          */
1939         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1940                 if (bif->bif_ifp->if_type != IFT_ETHER)
1941                         continue;
1942
1943                 /* It is destined for us. */
1944                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
1945                     ETHER_ADDR_LEN) == 0) {
1946                         if (bif->bif_flags & IFBIF_LEARNING) {
1947                                 bridge_rtupdate(sc,
1948                                     eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1949                         }
1950
1951                         if (bif->bif_ifp != ifp) {
1952                                 /* XXX loop prevention */
1953                                 m->m_flags |= M_PROTO1;
1954                                 new_ifp = bif->bif_ifp;
1955                         }
1956                         goto out;
1957                 }
1958
1959                 /* We just received a packet that we sent out. */
1960                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
1961                     ETHER_ADDR_LEN) == 0) {
1962                         m_freem(m);
1963                         m = NULL;
1964                         goto out;
1965                 }
1966         }
1967
1968         /* Perform the bridge forwarding function. */
1969         bridge_forward(sc, m);
1970         m = NULL;
1971 out:
1972         lwkt_serialize_exit(bifp->if_serializer);
1973
1974         if (new_ifp != NULL) {
1975                 lwkt_serialize_enter(new_ifp->if_serializer);
1976
1977                 m->m_pkthdr.rcvif = new_ifp;
1978                 new_ifp->if_ipackets++;
1979                 new_ifp->if_input(new_ifp, m);
1980                 m = NULL;
1981
1982                 lwkt_serialize_exit(new_ifp->if_serializer);
1983         }
1984         return (m);
1985 }
1986
1987 /*
1988  * bridge_broadcast:
1989  *
1990  *      Send a frame to all interfaces that are members of
1991  *      the bridge, except for the one on which the packet
1992  *      arrived.
1993  */
1994 static void
1995 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
1996     struct mbuf *m, int runfilt)
1997 {
1998         struct bridge_iflist *bif;
1999         struct mbuf *mc;
2000         struct ifnet *dst_if, *bifp;
2001         int used = 0;
2002
2003         bifp = sc->sc_ifp;
2004
2005         ASSERT_SERIALIZED(bifp->if_serializer);
2006
2007         /* run the packet filter */
2008         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
2009 #ifdef INET6
2010             || inet6_pfil_hook.ph_hashooks > 0
2011 #endif
2012             )) {
2013                 lwkt_serialize_exit(bifp->if_serializer);
2014
2015                 /* Filter on the bridge interface before broadcasting */
2016
2017                 if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
2018                         goto filt;
2019                 if (m == NULL)
2020                         goto filt;
2021
2022                 if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
2023                         m = NULL;
2024 filt:
2025                 lwkt_serialize_enter(bifp->if_serializer);
2026                 if (m == NULL)
2027                         return;
2028         }
2029
2030         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2031                 dst_if = bif->bif_ifp;
2032                 if (dst_if == src_if)
2033                         continue;
2034
2035                 if (bif->bif_flags & IFBIF_STP) {
2036                         switch (bif->bif_state) {
2037                         case BSTP_IFSTATE_BLOCKING:
2038                         case BSTP_IFSTATE_DISABLED:
2039                                 continue;
2040                         }
2041                 }
2042
2043                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2044                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2045                         continue;
2046
2047                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
2048                         continue;
2049
2050                 if (LIST_NEXT(bif, bif_next) == NULL) {
2051                         mc = m;
2052                         used = 1;
2053                 } else {
2054                         mc = m_copypacket(m, MB_DONTWAIT);
2055                         if (mc == NULL) {
2056                                 sc->sc_ifp->if_oerrors++;
2057                                 continue;
2058                         }
2059                 }
2060                 bridge_pfil_enqueue(dst_if, mc, runfilt);
2061         }
2062         if (used == 0)
2063                 m_freem(m);
2064 }
2065
2066 /*
2067  * bridge_span:
2068  *
2069  *      Duplicate a packet out one or more interfaces that are in span mode,
2070  *      the original mbuf is unmodified.
2071  */
2072 static void
2073 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2074 {
2075         struct bridge_iflist *bif;
2076         struct ifnet *dst_if;
2077         struct mbuf *mc;
2078
2079         if (LIST_EMPTY(&sc->sc_spanlist))
2080                 return;
2081
2082         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2083                 dst_if = bif->bif_ifp;
2084
2085                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
2086                         continue;
2087
2088                 mc = m_copypacket(m, MB_DONTWAIT);
2089                 if (mc == NULL) {
2090                         sc->sc_ifp->if_oerrors++;
2091                         continue;
2092                 }
2093
2094                 bridge_enqueue(dst_if, mc);
2095         }
2096 }
2097
2098 /*
2099  * bridge_rtupdate:
2100  *
2101  *      Add a bridge routing entry.
2102  *      Can be called from interrupt context.
2103  */
2104 static int
2105 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2106     struct ifnet *dst_if, int setflags, uint8_t flags)
2107 {
2108         struct bridge_rtnode *brt;
2109         int error;
2110
2111         /*
2112          * A route for this destination might already exist.  If so,
2113          * update it, otherwise create a new one.
2114          */
2115         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2116                 if (sc->sc_brtcnt >= sc->sc_brtmax)
2117                         return (ENOSPC);
2118
2119                 /*
2120                  * Allocate a new bridge forwarding node, and
2121                  * initialize the expiration time and Ethernet
2122                  * address.
2123                  */
2124                 brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
2125                               M_INTNOWAIT|M_ZERO);
2126                 if (brt == NULL)
2127                         return (ENOMEM);
2128
2129                 brt->brt_flags = IFBAF_DYNAMIC;
2130                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2131
2132                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2133                         kfree(brt, M_DEVBUF);
2134                         return (error);
2135                 }
2136         }
2137
2138         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2139                 brt->brt_ifp = dst_if;
2140         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2141                 brt->brt_expire = time_second + sc->sc_brttimeout;
2142         if (setflags)
2143                 brt->brt_flags = flags;
2144
2145         return (0);
2146 }
2147
2148 /*
2149  * bridge_rtlookup:
2150  *
2151  *      Lookup the destination interface for an address.
2152  */
2153 static struct ifnet *
2154 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2155 {
2156         struct bridge_rtnode *brt;
2157
2158         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2159                 return (NULL);
2160
2161         return (brt->brt_ifp);
2162 }
2163
2164 /*
2165  * bridge_rttrim:
2166  *
2167  *      Trim the routine table so that we have a number
2168  *      of routing entries less than or equal to the
2169  *      maximum number.
2170  */
2171 static void
2172 bridge_rttrim(struct bridge_softc *sc)
2173 {
2174         struct bridge_rtnode *brt, *nbrt;
2175
2176         /* Make sure we actually need to do this. */
2177         if (sc->sc_brtcnt <= sc->sc_brtmax)
2178                 return;
2179
2180         /* Force an aging cycle; this might trim enough addresses. */
2181         bridge_rtage(sc);
2182         if (sc->sc_brtcnt <= sc->sc_brtmax)
2183                 return;
2184
2185         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2186                 nbrt = LIST_NEXT(brt, brt_list);
2187                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2188                         bridge_rtnode_destroy(sc, brt);
2189                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2190                                 return;
2191                 }
2192         }
2193 }
2194
2195 /*
2196  * bridge_timer:
2197  *
2198  *      Aging timer for the bridge.
2199  */
2200 static void
2201 bridge_timer(void *arg)
2202 {
2203         struct bridge_softc *sc = arg;
2204
2205         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
2206
2207         bridge_rtage(sc);
2208
2209         if (sc->sc_ifp->if_flags & IFF_RUNNING)
2210                 callout_reset(&sc->sc_brcallout,
2211                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2212
2213         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
2214 }
2215
2216 /*
2217  * bridge_rtage:
2218  *
2219  *      Perform an aging cycle.
2220  */
2221 static void
2222 bridge_rtage(struct bridge_softc *sc)
2223 {
2224         struct bridge_rtnode *brt, *nbrt;
2225
2226         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2227                 nbrt = LIST_NEXT(brt, brt_list);
2228                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2229                         if (time_second >= brt->brt_expire)
2230                                 bridge_rtnode_destroy(sc, brt);
2231                 }
2232         }
2233 }
2234
2235 /*
2236  * bridge_rtflush:
2237  *
2238  *      Remove all dynamic addresses from the bridge.
2239  */
2240 static void
2241 bridge_rtflush(struct bridge_softc *sc, int full)
2242 {
2243         struct bridge_rtnode *brt, *nbrt;
2244
2245         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2246                 nbrt = LIST_NEXT(brt, brt_list);
2247                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2248                         bridge_rtnode_destroy(sc, brt);
2249         }
2250 }
2251
2252 /*
2253  * bridge_rtdaddr:
2254  *
2255  *      Remove an address from the table.
2256  */
2257 static int
2258 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2259 {
2260         struct bridge_rtnode *brt;
2261
2262         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2263                 return (ENOENT);
2264
2265         bridge_rtnode_destroy(sc, brt);
2266         return (0);
2267 }
2268
2269 /*
2270  * bridge_rtdelete:
2271  *
2272  *      Delete routes to a speicifc member interface.
2273  */
2274 void
2275 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2276 {
2277         struct bridge_rtnode *brt, *nbrt;
2278
2279         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2280                 nbrt = LIST_NEXT(brt, brt_list);
2281                 if (brt->brt_ifp == ifp && (full ||
2282                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2283                         bridge_rtnode_destroy(sc, brt);
2284         }
2285 }
2286
2287 /*
2288  * bridge_rtable_init:
2289  *
2290  *      Initialize the route table for this bridge.
2291  */
2292 static int
2293 bridge_rtable_init(struct bridge_softc *sc)
2294 {
2295         int i;
2296
2297         sc->sc_rthash = kmalloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2298             M_DEVBUF, M_WAITOK);
2299
2300         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2301                 LIST_INIT(&sc->sc_rthash[i]);
2302
2303         sc->sc_rthash_key = karc4random();
2304
2305         LIST_INIT(&sc->sc_rtlist);
2306
2307         return (0);
2308 }
2309
2310 /*
2311  * bridge_rtable_fini:
2312  *
2313  *      Deconstruct the route table for this bridge.
2314  */
2315 static void
2316 bridge_rtable_fini(struct bridge_softc *sc)
2317 {
2318
2319         kfree(sc->sc_rthash, M_DEVBUF);
2320 }
2321
2322 /*
2323  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2324  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2325  */
2326 #define mix(a, b, c)                                                    \
2327 do {                                                                    \
2328         a -= b; a -= c; a ^= (c >> 13);                                 \
2329         b -= c; b -= a; b ^= (a << 8);                                  \
2330         c -= a; c -= b; c ^= (b >> 13);                                 \
2331         a -= b; a -= c; a ^= (c >> 12);                                 \
2332         b -= c; b -= a; b ^= (a << 16);                                 \
2333         c -= a; c -= b; c ^= (b >> 5);                                  \
2334         a -= b; a -= c; a ^= (c >> 3);                                  \
2335         b -= c; b -= a; b ^= (a << 10);                                 \
2336         c -= a; c -= b; c ^= (b >> 15);                                 \
2337 } while (/*CONSTCOND*/0)
2338
2339 static __inline uint32_t
2340 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2341 {
2342         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2343
2344         b += addr[5] << 8;
2345         b += addr[4];
2346         a += addr[3] << 24;
2347         a += addr[2] << 16;
2348         a += addr[1] << 8;
2349         a += addr[0];
2350
2351         mix(a, b, c);
2352
2353         return (c & BRIDGE_RTHASH_MASK);
2354 }
2355
2356 #undef mix
2357
2358 static int
2359 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2360 {
2361         int i, d;
2362
2363         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2364                 d = ((int)a[i]) - ((int)b[i]);
2365         }
2366
2367         return (d);
2368 }
2369
2370 /*
2371  * bridge_rtnode_lookup:
2372  *
2373  *      Look up a bridge route node for the specified destination.
2374  */
2375 static struct bridge_rtnode *
2376 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2377 {
2378         struct bridge_rtnode *brt;
2379         uint32_t hash;
2380         int dir;
2381
2382         hash = bridge_rthash(sc, addr);
2383         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2384                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2385                 if (dir == 0)
2386                         return (brt);
2387                 if (dir > 0)
2388                         return (NULL);
2389         }
2390
2391         return (NULL);
2392 }
2393
2394 /*
2395  * bridge_rtnode_insert:
2396  *
2397  *      Insert the specified bridge node into the route table.  We
2398  *      assume the entry is not already in the table.
2399  */
2400 static int
2401 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2402 {
2403         struct bridge_rtnode *lbrt;
2404         uint32_t hash;
2405         int dir;
2406
2407         hash = bridge_rthash(sc, brt->brt_addr);
2408
2409         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2410         if (lbrt == NULL) {
2411                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2412                 goto out;
2413         }
2414
2415         do {
2416                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2417                 if (dir == 0)
2418                         return (EEXIST);
2419                 if (dir > 0) {
2420                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2421                         goto out;
2422                 }
2423                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2424                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2425                         goto out;
2426                 }
2427                 lbrt = LIST_NEXT(lbrt, brt_hash);
2428         } while (lbrt != NULL);
2429
2430 #ifdef DIAGNOSTIC
2431         panic("bridge_rtnode_insert: impossible");
2432 #endif
2433
2434 out:
2435         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2436         sc->sc_brtcnt++;
2437
2438         return (0);
2439 }
2440
2441 /*
2442  * bridge_rtnode_destroy:
2443  *
2444  *      Destroy a bridge rtnode.
2445  */
2446 static void
2447 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2448 {
2449
2450         LIST_REMOVE(brt, brt_hash);
2451
2452         LIST_REMOVE(brt, brt_list);
2453         sc->sc_brtcnt--;
2454         kfree(brt, M_DEVBUF);
2455 }
2456
2457 static __inline int
2458 bridge_post_pfil(struct mbuf *m)
2459 {
2460         if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED)
2461                 return EOPNOTSUPP;
2462
2463         /* Not yet */
2464         if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED)
2465                 return EOPNOTSUPP;
2466
2467         return 0;
2468 }
2469
2470 /*
2471  * Send bridge packets through pfil if they are one of the types pfil can deal
2472  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2473  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2474  * that interface.
2475  */
2476 static int
2477 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2478 {
2479         int snap, error, i, hlen;
2480         struct ether_header *eh1, eh2;
2481         struct ip *ip;
2482         struct llc llc1;
2483         u_int16_t ether_type;
2484
2485         snap = 0;
2486         error = -1;     /* Default error if not error == 0 */
2487
2488         if (pfil_bridge == 0 && pfil_member == 0)
2489                 return (0); /* filtering is disabled */
2490
2491         i = min((*mp)->m_pkthdr.len, max_protohdr);
2492         if ((*mp)->m_len < i) {
2493             *mp = m_pullup(*mp, i);
2494             if (*mp == NULL) {
2495                 kprintf("%s: m_pullup failed\n", __func__);
2496                 return (-1);
2497             }
2498         }
2499
2500         eh1 = mtod(*mp, struct ether_header *);
2501         ether_type = ntohs(eh1->ether_type);
2502
2503         /*
2504          * Check for SNAP/LLC.
2505          */
2506         if (ether_type < ETHERMTU) {
2507                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2508
2509                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2510                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2511                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2512                     llc2->llc_control == LLC_UI) {
2513                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2514                         snap = 1;
2515                 }
2516         }
2517
2518         /*
2519          * If we're trying to filter bridge traffic, don't look at anything
2520          * other than IP and ARP traffic.  If the filter doesn't understand
2521          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2522          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2523          * but of course we don't have an AppleTalk filter to begin with.
2524          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2525          * ARP traffic.)
2526          */
2527         switch (ether_type) {
2528                 case ETHERTYPE_ARP:
2529                 case ETHERTYPE_REVARP:
2530                         return (0); /* Automatically pass */
2531                 case ETHERTYPE_IP:
2532 #ifdef INET6
2533                 case ETHERTYPE_IPV6:
2534 #endif /* INET6 */
2535                         break;
2536                 default:
2537                         /*
2538                          * Check to see if the user wants to pass non-ip
2539                          * packets, these will not be checked by pfil(9) and
2540                          * passed unconditionally so the default is to drop.
2541                          */
2542                         if (pfil_onlyip)
2543                                 goto bad;
2544         }
2545
2546         /* Strip off the Ethernet header and keep a copy. */
2547         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2548         m_adj(*mp, ETHER_HDR_LEN);
2549
2550         /* Strip off snap header, if present */
2551         if (snap) {
2552                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2553                 m_adj(*mp, sizeof(struct llc));
2554         }
2555
2556         /*
2557          * Check the IP header for alignment and errors
2558          */
2559         if (dir == PFIL_IN) {
2560                 switch (ether_type) {
2561                         case ETHERTYPE_IP:
2562                                 error = bridge_ip_checkbasic(mp);
2563                                 break;
2564 #ifdef INET6
2565                         case ETHERTYPE_IPV6:
2566                                 error = bridge_ip6_checkbasic(mp);
2567                                 break;
2568 #endif /* INET6 */
2569                         default:
2570                                 error = 0;
2571                 }
2572                 if (error)
2573                         goto bad;
2574         }
2575
2576         error = 0;
2577
2578         /*
2579          * Run the packet through pfil
2580          */
2581         switch (ether_type)
2582         {
2583         case ETHERTYPE_IP :
2584                 /*
2585                  * before calling the firewall, swap fields the same as
2586                  * IP does. here we assume the header is contiguous
2587                  */
2588                 ip = mtod(*mp, struct ip *);
2589
2590                 ip->ip_len = ntohs(ip->ip_len);
2591                 ip->ip_off = ntohs(ip->ip_off);
2592
2593                 /*
2594                  * Run pfil on the member interface and the bridge, both can
2595                  * be skipped by clearing pfil_member or pfil_bridge.
2596                  *
2597                  * Keep the order:
2598                  *   in_if -> bridge_if -> out_if
2599                  */
2600                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL) {
2601                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
2602                         if (*mp == NULL || error != 0) /* filter may consume */
2603                                 break;
2604                         error = bridge_post_pfil(*mp);
2605                         if (error)
2606                                 break;
2607                 }
2608
2609                 if (pfil_member && ifp != NULL) {
2610                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
2611                         if (*mp == NULL || error != 0) /* filter may consume */
2612                                 break;
2613                         error = bridge_post_pfil(*mp);
2614                         if (error)
2615                                 break;
2616                 }
2617
2618                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL) {
2619                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp, dir);
2620                         if (*mp == NULL || error != 0) /* filter may consume */
2621                                 break;
2622                         error = bridge_post_pfil(*mp);
2623                         if (error)
2624                                 break;
2625                 }
2626
2627                 /* check if we need to fragment the packet */
2628                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2629                         i = (*mp)->m_pkthdr.len;
2630                         if (i > ifp->if_mtu) {
2631                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2632                                             &llc1);
2633                                 return (error);
2634                         }
2635                 }
2636
2637                 /* Recalculate the ip checksum and restore byte ordering */
2638                 ip = mtod(*mp, struct ip *);
2639                 hlen = ip->ip_hl << 2;
2640                 if (hlen < sizeof(struct ip))
2641                         goto bad;
2642                 if (hlen > (*mp)->m_len) {
2643                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2644                                 goto bad;
2645                         ip = mtod(*mp, struct ip *);
2646                         if (ip == NULL)
2647                                 goto bad;
2648                 }
2649                 ip->ip_len = htons(ip->ip_len);
2650                 ip->ip_off = htons(ip->ip_off);
2651                 ip->ip_sum = 0;
2652                 if (hlen == sizeof(struct ip))
2653                         ip->ip_sum = in_cksum_hdr(ip);
2654                 else
2655                         ip->ip_sum = in_cksum(*mp, hlen);
2656
2657                 break;
2658 #ifdef INET6
2659         case ETHERTYPE_IPV6 :
2660                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2661                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2662                                         dir);
2663
2664                 if (*mp == NULL || error != 0) /* filter may consume */
2665                         break;
2666
2667                 if (pfil_member && ifp != NULL)
2668                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2669                                         dir);
2670
2671                 if (*mp == NULL || error != 0) /* filter may consume */
2672                         break;
2673
2674                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2675                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2676                                         dir);
2677                 break;
2678 #endif
2679         default :
2680                 error = 0;
2681                 break;
2682         }
2683
2684         if (*mp == NULL)
2685                 return (error);
2686         if (error != 0)
2687                 goto bad;
2688
2689         error = -1;
2690
2691         /*
2692          * Finally, put everything back the way it was and return
2693          */
2694         if (snap) {
2695                 M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
2696                 if (*mp == NULL)
2697                         return (error);
2698                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2699         }
2700
2701         M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
2702         if (*mp == NULL)
2703                 return (error);
2704         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2705
2706         return (0);
2707
2708 bad:
2709         m_freem(*mp);
2710         *mp = NULL;
2711         return (error);
2712 }
2713
2714 /*
2715  * Perform basic checks on header size since
2716  * pfil assumes ip_input has already processed
2717  * it for it.  Cut-and-pasted from ip_input.c.
2718  * Given how simple the IPv6 version is,
2719  * does the IPv4 version really need to be
2720  * this complicated?
2721  *
2722  * XXX Should we update ipstat here, or not?
2723  * XXX Right now we update ipstat but not
2724  * XXX csum_counter.
2725  */
2726 static int
2727 bridge_ip_checkbasic(struct mbuf **mp)
2728 {
2729         struct mbuf *m = *mp;
2730         struct ip *ip;
2731         int len, hlen;
2732         u_short sum;
2733
2734         if (*mp == NULL)
2735                 return (-1);
2736 #if notyet
2737         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2738                 if ((m = m_copyup(m, sizeof(struct ip),
2739                         (max_linkhdr + 3) & ~3)) == NULL) {
2740                         /* XXXJRT new stat, please */
2741                         ipstat.ips_toosmall++;
2742                         goto bad;
2743                 }
2744         } else
2745 #endif
2746 #ifndef __predict_false
2747 #define __predict_false(x) x
2748 #endif
2749          if (__predict_false(m->m_len < sizeof (struct ip))) {
2750                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2751                         ipstat.ips_toosmall++;
2752                         goto bad;
2753                 }
2754         }
2755         ip = mtod(m, struct ip *);
2756         if (ip == NULL) goto bad;
2757
2758         if (ip->ip_v != IPVERSION) {
2759                 ipstat.ips_badvers++;
2760                 goto bad;
2761         }
2762         hlen = ip->ip_hl << 2;
2763         if (hlen < sizeof(struct ip)) { /* minimum header length */
2764                 ipstat.ips_badhlen++;
2765                 goto bad;
2766         }
2767         if (hlen > m->m_len) {
2768                 if ((m = m_pullup(m, hlen)) == 0) {
2769                         ipstat.ips_badhlen++;
2770                         goto bad;
2771                 }
2772                 ip = mtod(m, struct ip *);
2773                 if (ip == NULL) goto bad;
2774         }
2775
2776         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2777                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2778         } else {
2779                 if (hlen == sizeof(struct ip)) {
2780                         sum = in_cksum_hdr(ip);
2781                 } else {
2782                         sum = in_cksum(m, hlen);
2783                 }
2784         }
2785         if (sum) {
2786                 ipstat.ips_badsum++;
2787                 goto bad;
2788         }
2789
2790         /* Retrieve the packet length. */
2791         len = ntohs(ip->ip_len);
2792
2793         /*
2794          * Check for additional length bogosity
2795          */
2796         if (len < hlen) {
2797                 ipstat.ips_badlen++;
2798                 goto bad;
2799         }
2800
2801         /*
2802          * Check that the amount of data in the buffers
2803          * is as at least much as the IP header would have us expect.
2804          * Drop packet if shorter than we expect.
2805          */
2806         if (m->m_pkthdr.len < len) {
2807                 ipstat.ips_tooshort++;
2808                 goto bad;
2809         }
2810
2811         /* Checks out, proceed */
2812         *mp = m;
2813         return (0);
2814
2815 bad:
2816         *mp = m;
2817         return (-1);
2818 }
2819
2820 #ifdef INET6
2821 /*
2822  * Same as above, but for IPv6.
2823  * Cut-and-pasted from ip6_input.c.
2824  * XXX Should we update ip6stat, or not?
2825  */
2826 static int
2827 bridge_ip6_checkbasic(struct mbuf **mp)
2828 {
2829         struct mbuf *m = *mp;
2830         struct ip6_hdr *ip6;
2831
2832         /*
2833          * If the IPv6 header is not aligned, slurp it up into a new
2834          * mbuf with space for link headers, in the event we forward
2835          * it.  Otherwise, if it is aligned, make sure the entire base
2836          * IPv6 header is in the first mbuf of the chain.
2837          */
2838 #if notyet
2839         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2840                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2841                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2842                             (max_linkhdr + 3) & ~3)) == NULL) {
2843                         /* XXXJRT new stat, please */
2844                         ip6stat.ip6s_toosmall++;
2845                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2846                         goto bad;
2847                 }
2848         } else
2849 #endif
2850         if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2851                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2852                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2853                         ip6stat.ip6s_toosmall++;
2854                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2855                         goto bad;
2856                 }
2857         }
2858
2859         ip6 = mtod(m, struct ip6_hdr *);
2860
2861         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2862                 ip6stat.ip6s_badvers++;
2863                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2864                 goto bad;
2865         }
2866
2867         /* Checks out, proceed */
2868         *mp = m;
2869         return (0);
2870
2871 bad:
2872         *mp = m;
2873         return (-1);
2874 }
2875 #endif /* INET6 */
2876
2877 /*
2878  * bridge_fragment:
2879  *
2880  *      Return a fragmented mbuf chain.
2881  */
2882 static int
2883 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
2884     int snap, struct llc *llc)
2885 {
2886         struct mbuf *m0;
2887         struct ip *ip;
2888         int error = -1;
2889
2890         if (m->m_len < sizeof(struct ip) &&
2891             (m = m_pullup(m, sizeof(struct ip))) == NULL)
2892                 goto out;
2893         ip = mtod(m, struct ip *);
2894
2895         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
2896                     CSUM_DELAY_IP);
2897         if (error)
2898                 goto out;
2899
2900         /* walk the chain and re-add the Ethernet header */
2901         for (m0 = m; m0; m0 = m0->m_nextpkt) {
2902                 if (error == 0) {
2903                         if (snap) {
2904                                 M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
2905                                 if (m0 == NULL) {
2906                                         error = ENOBUFS;
2907                                         continue;
2908                                 }
2909                                 bcopy(llc, mtod(m0, caddr_t),
2910                                     sizeof(struct llc));
2911                         }
2912                         M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
2913                         if (m0 == NULL) {
2914                                 error = ENOBUFS;
2915                                 continue;
2916                         }
2917                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
2918                 } else
2919                         m_freem(m);
2920         }
2921
2922         if (error == 0)
2923                 ipstat.ips_fragmented++;
2924
2925         return (error);
2926
2927 out:
2928         if (m != NULL)
2929                 m_freem(m);
2930         return (error);
2931 }
2932
2933 static void
2934 bridge_enqueue_handler(struct netmsg *nmsg)
2935 {
2936         struct netmsg_packet *nmp;
2937         struct ifnet *dst_ifp;
2938         struct mbuf *m;
2939
2940         nmp = (struct netmsg_packet *)nmsg;
2941         m = nmp->nm_packet;
2942         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2943
2944         bridge_handoff_notags(dst_ifp, m);
2945 }
2946
2947 static void
2948 bridge_pfil_enqueue_handler(struct netmsg *nmsg)
2949 {
2950         struct netmsg_packet *nmp;
2951         struct ifnet *dst_ifp;
2952         struct mbuf *m;
2953
2954         nmp = (struct netmsg_packet *)nmsg;
2955         m = nmp->nm_packet;
2956         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2957
2958         /*
2959          * Filter on the output interface. Pass a NULL bridge interface
2960          * pointer so we do not redundantly filter on the bridge for
2961          * each interface we broadcast on.
2962          */
2963         if (inet_pfil_hook.ph_hashooks > 0
2964 #ifdef INET6
2965             || inet6_pfil_hook.ph_hashooks > 0
2966 #endif
2967             ) {
2968                 if (bridge_pfil(&m, NULL, dst_ifp, PFIL_OUT) != 0)
2969                         return;
2970                 if (m == NULL)
2971                         return;
2972         }
2973         bridge_handoff_notags(dst_ifp, m);
2974 }
2975
2976 static void
2977 bridge_handoff(struct ifnet *dst_ifp, struct mbuf *m)
2978 {
2979         bridge_handoff_notags(dst_ifp, m);
2980 }
2981
2982 static void
2983 bridge_handoff_notags(struct ifnet *dst_ifp, struct mbuf *m)
2984 {
2985         struct mbuf *m0;
2986
2987         lwkt_serialize_enter(dst_ifp->if_serializer);
2988
2989         /* We may be sending a fragment so traverse the mbuf */
2990         for (; m; m = m0) {
2991                 struct altq_pktattr pktattr;
2992
2993                 m0 = m->m_nextpkt;
2994                 m->m_nextpkt = NULL;
2995
2996                 if (ifq_is_enabled(&dst_ifp->if_snd))
2997                         altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
2998
2999                 ifq_handoff(dst_ifp, m, &pktattr);
3000         }
3001
3002         lwkt_serialize_exit(dst_ifp->if_serializer);
3003 }
3004
3005 struct netmsg_brgctl {
3006         struct netmsg           bc_nmsg;
3007         bridge_ctl_t            bc_func;
3008         struct bridge_softc     *bc_sc;
3009         void                    *bc_arg;
3010 };
3011
3012 static void
3013 bridge_control_dispatch(struct netmsg *nmsg)
3014 {
3015         struct netmsg_brgctl *bc_msg = (struct netmsg_brgctl *)nmsg;
3016         struct ifnet *bifp = bc_msg->bc_sc->sc_ifp;
3017         int error;
3018
3019         lwkt_serialize_enter(bifp->if_serializer);
3020         error = bc_msg->bc_func(bc_msg->bc_sc, bc_msg->bc_arg);
3021         lwkt_serialize_exit(bifp->if_serializer);
3022
3023         lwkt_replymsg(&nmsg->nm_lmsg, error);
3024 }
3025
3026 static int
3027 bridge_control(struct bridge_softc *sc, u_long cmd,
3028                bridge_ctl_t bc_func, void *bc_arg)
3029 {
3030         struct ifnet *bifp = sc->sc_ifp;
3031         struct netmsg_brgctl bc_msg;
3032         struct netmsg *nmsg;
3033         int error;
3034
3035         ASSERT_SERIALIZED(bifp->if_serializer);
3036
3037         if (cmd == SIOCGDRVSPEC) {
3038                 /*
3039                  * Don't dispatch 'get' ioctl to netisr0;
3040                  * there are copyouts down deep inside
3041                  * specific bridge ioctl functions.
3042                  */
3043                 return bc_func(sc, bc_arg);
3044         }
3045
3046         bzero(&bc_msg, sizeof(bc_msg));
3047         nmsg = &bc_msg.bc_nmsg;
3048
3049         netmsg_init(nmsg, &curthread->td_msgport, 0, bridge_control_dispatch);
3050         bc_msg.bc_func = bc_func;
3051         bc_msg.bc_sc = sc;
3052         bc_msg.bc_arg = bc_arg;
3053
3054         lwkt_serialize_exit(bifp->if_serializer);
3055         error = lwkt_domsg(cpu_portfn(0), &nmsg->nm_lmsg, 0);
3056         lwkt_serialize_enter(bifp->if_serializer);
3057         return error;
3058 }