sys/net/bridge/if_bridge.c

   1 /*
   2  * Copyright 2001 Wasabi Systems, Inc.
   3  * All rights reserved.
   4  *
   5  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed for the NetBSD Project by
  18  *      Wasabi Systems, Inc.
  19  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
  20  *    or promote products derived from this software without specific prior
  21  *    written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
  27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /*
  37  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
  38  * All rights reserved.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  * 3. All advertising materials mentioning features or use of this software
  49  *    must display the following acknowledgement:
  50  *      This product includes software developed by Jason L. Wright
  51  * 4. The name of the author may not be used to endorse or promote products
  52  *    derived from this software without specific prior written permission.
  53  *
  54  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  55  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  56  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  57  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
  58  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  59  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  60  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  62  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  63  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  64  * POSSIBILITY OF SUCH DAMAGE.
  65  *
  66  * $OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp $
  67  * $NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $
  68  * $FreeBSD: src/sys/net/if_bridge.c,v 1.26 2005/10/13 23:05:55 thompsa Exp $
  69  * $DragonFly: src/sys/net/bridge/if_bridge.c,v 1.31 2008/06/14 04:35:32 sephe Exp $
  70  */
  71
  72 /*
  73  * Network interface bridge support.
  74  *
  75  * TODO:
  76  *
  77  *      - Currently only supports Ethernet-like interfaces (Ethernet,
  78  *        802.11, VLANs on Ethernet, etc.)  Figure out a nice way
  79  *        to bridge other types of interfaces (FDDI-FDDI, and maybe
  80  *        consider heterogenous bridges).
  81  */
  82
  83 #include <sys/cdefs.h>
  84
  85 #include "opt_inet.h"
  86 #include "opt_inet6.h"
  87
  88 #include <sys/param.h>
  89 #include <sys/mbuf.h>
  90 #include <sys/malloc.h>
  91 #include <sys/protosw.h>
  92 #include <sys/systm.h>
  93 #include <sys/time.h>
  94 #include <sys/socket.h> /* for net/if.h */
  95 #include <sys/sockio.h>
  96 #include <sys/ctype.h>  /* string functions */
  97 #include <sys/kernel.h>
  98 #include <sys/random.h>
  99 #include <sys/sysctl.h>
 100 #include <sys/module.h>
 101 #include <sys/proc.h>
 102 #include <sys/lock.h>
 103 #include <sys/thread.h>
 104 #include <sys/thread2.h>
 105 #include <sys/mpipe.h>
 106
 107 #include <net/bpf.h>
 108 #include <net/if.h>
 109 #include <net/if_dl.h>
 110 #include <net/if_types.h>
 111 #include <net/if_var.h>
 112 #include <net/pfil.h>
 113 #include <net/ifq_var.h>
 114 #include <net/if_clone.h>
 115
 116 #include <netinet/in.h> /* for struct arpcom */
 117 #include <netinet/in_systm.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/ip.h>
 120 #include <netinet/ip_var.h>
 121 #ifdef INET6
 122 #include <netinet/ip6.h>
 123 #include <netinet6/ip6_var.h>
 124 #endif
 125 #include <netinet/if_ether.h> /* for struct arpcom */
 126 #include <net/bridge/if_bridgevar.h>
 127 #include <net/if_llc.h>
 128 #include <net/netmsg2.h>
 129
 130 #include <net/route.h>
 131 #include <sys/in_cksum.h>
 132
 133 /*
 134  * Size of the route hash table.  Must be a power of two.
 135  */
 136 #ifndef BRIDGE_RTHASH_SIZE
 137 #define BRIDGE_RTHASH_SIZE              1024
 138 #endif
 139
 140 #define BRIDGE_RTHASH_MASK              (BRIDGE_RTHASH_SIZE - 1)
 141
 142 /*
 143  * Maximum number of addresses to cache.
 144  */
 145 #ifndef BRIDGE_RTABLE_MAX
 146 #define BRIDGE_RTABLE_MAX               100
 147 #endif
 148
 149 /*
 150  * Spanning tree defaults.
 151  */
 152 #define BSTP_DEFAULT_MAX_AGE            (20 * 256)
 153 #define BSTP_DEFAULT_HELLO_TIME         (2 * 256)
 154 #define BSTP_DEFAULT_FORWARD_DELAY      (15 * 256)
 155 #define BSTP_DEFAULT_HOLD_TIME          (1 * 256)
 156 #define BSTP_DEFAULT_BRIDGE_PRIORITY    0x8000
 157 #define BSTP_DEFAULT_PORT_PRIORITY      0x80
 158 #define BSTP_DEFAULT_PATH_COST          55
 159
 160 /*
 161  * Timeout (in seconds) for entries learned dynamically.
 162  */
 163 #ifndef BRIDGE_RTABLE_TIMEOUT
 164 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
 165 #endif
 166
 167 /*
 168  * Number of seconds between walks of the route list.
 169  */
 170 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
 171 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
 172 #endif
 173
 174 /*
 175  * List of capabilities to mask on the member interface.
 176  */
 177 #define BRIDGE_IFCAPS_MASK              IFCAP_TXCSUM
 178
 179 eventhandler_tag        bridge_detach_cookie = NULL;
 180
 181 extern  struct mbuf *(*bridge_input_p)(struct ifnet *, struct mbuf *);
 182 extern  int (*bridge_output_p)(struct ifnet *, struct mbuf *);
 183 extern  void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
 184
 185 static int      bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
 186
 187 static int      bridge_clone_create(struct if_clone *, int);
 188 static void     bridge_clone_destroy(struct ifnet *);
 189
 190 static int      bridge_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 191 static void     bridge_mutecaps(struct bridge_iflist *, int);
 192 static void     bridge_ifdetach(void *arg __unused, struct ifnet *);
 193 static void     bridge_init(void *);
 194 static void     bridge_stop(struct ifnet *);
 195 static void     bridge_start(struct ifnet *);
 196 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
 197 static int      bridge_output(struct ifnet *, struct mbuf *);
 198
 199 static void     bridge_forward(struct bridge_softc *, struct mbuf *m);
 200
 201 static void     bridge_timer(void *);
 202
 203 static void     bridge_broadcast(struct bridge_softc *, struct ifnet *,
 204                     struct mbuf *, int);
 205 static void     bridge_span(struct bridge_softc *, struct mbuf *);
 206
 207 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t *,
 208                     struct ifnet *, int, uint8_t);
 209 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
 210 static void     bridge_rttrim(struct bridge_softc *);
 211 static void     bridge_rtage(struct bridge_softc *);
 212 static void     bridge_rtflush(struct bridge_softc *, int);
 213 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
 214
 215 static int      bridge_rtable_init(struct bridge_softc *);
 216 static void     bridge_rtable_fini(struct bridge_softc *);
 217
 218 static int      bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
 219 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
 220                     const uint8_t *);
 221 static int      bridge_rtnode_insert(struct bridge_softc *,
 222                     struct bridge_rtnode *);
 223 static void     bridge_rtnode_destroy(struct bridge_softc *,
 224                     struct bridge_rtnode *);
 225
 226 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
 227                     const char *name);
 228 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
 229                     struct ifnet *ifp);
 230 static void     bridge_delete_member(struct bridge_softc *,
 231                     struct bridge_iflist *, int);
 232 static void     bridge_delete_span(struct bridge_softc *,
 233                     struct bridge_iflist *);
 234
 235 static int      bridge_ioctl_add(struct bridge_softc *, void *);
 236 static int      bridge_ioctl_del(struct bridge_softc *, void *);
 237 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *);
 238 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *);
 239 static int      bridge_ioctl_scache(struct bridge_softc *, void *);
 240 static int      bridge_ioctl_gcache(struct bridge_softc *, void *);
 241 static int      bridge_ioctl_gifs(struct bridge_softc *, void *);
 242 static int      bridge_ioctl_rts(struct bridge_softc *, void *);
 243 static int      bridge_ioctl_saddr(struct bridge_softc *, void *);
 244 static int      bridge_ioctl_sto(struct bridge_softc *, void *);
 245 static int      bridge_ioctl_gto(struct bridge_softc *, void *);
 246 static int      bridge_ioctl_daddr(struct bridge_softc *, void *);
 247 static int      bridge_ioctl_flush(struct bridge_softc *, void *);
 248 static int      bridge_ioctl_gpri(struct bridge_softc *, void *);
 249 static int      bridge_ioctl_spri(struct bridge_softc *, void *);
 250 static int      bridge_ioctl_ght(struct bridge_softc *, void *);
 251 static int      bridge_ioctl_sht(struct bridge_softc *, void *);
 252 static int      bridge_ioctl_gfd(struct bridge_softc *, void *);
 253 static int      bridge_ioctl_sfd(struct bridge_softc *, void *);
 254 static int      bridge_ioctl_gma(struct bridge_softc *, void *);
 255 static int      bridge_ioctl_sma(struct bridge_softc *, void *);
 256 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *);
 257 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *);
 258 static int      bridge_ioctl_addspan(struct bridge_softc *, void *);
 259 static int      bridge_ioctl_delspan(struct bridge_softc *, void *);
 260 static int      bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
 261                     int);
 262 static int      bridge_ip_checkbasic(struct mbuf **mp);
 263 #ifdef INET6
 264 static int      bridge_ip6_checkbasic(struct mbuf **mp);
 265 #endif /* INET6 */
 266 static int      bridge_fragment(struct ifnet *, struct mbuf *,
 267                     struct ether_header *, int, struct llc *);
 268 static void     bridge_enqueue_internal(struct ifnet *, struct mbuf *m,
 269                                         netisr_fn_t);
 270 static void     bridge_enqueue_handler(struct netmsg *);
 271 static void     bridge_pfil_enqueue_handler(struct netmsg *);
 272 static void     bridge_pfil_enqueue(struct ifnet *, struct mbuf *, int);
 273 static void     bridge_handoff_notags(struct ifnet *, struct mbuf *);
 274 static void     bridge_handoff(struct ifnet *, struct mbuf *);
 275
 276 SYSCTL_DECL(_net_link);
 277 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
 278
 279 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
 280 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
 281 static int pfil_member = 1; /* run pfil hooks on the member interface */
 282 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
 283     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
 284 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
 285     &pfil_bridge, 0, "Packet filter on the bridge interface");
 286 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
 287     &pfil_member, 0, "Packet filter on the member interface");
 288
 289 struct bridge_control {
 290         int     (*bc_func)(struct bridge_softc *, void *);
 291         int     bc_argsize;
 292         int     bc_flags;
 293 };
 294
 295 #define BC_F_COPYIN             0x01    /* copy arguments in */
 296 #define BC_F_COPYOUT            0x02    /* copy arguments out */
 297 #define BC_F_SUSER              0x04    /* do super-user check */
 298
 299 const struct bridge_control bridge_control_table[] = {
 300         { bridge_ioctl_add,             sizeof(struct ifbreq),
 301           BC_F_COPYIN|BC_F_SUSER },
 302         { bridge_ioctl_del,             sizeof(struct ifbreq),
 303           BC_F_COPYIN|BC_F_SUSER },
 304
 305         { bridge_ioctl_gifflags,        sizeof(struct ifbreq),
 306           BC_F_COPYIN|BC_F_COPYOUT },
 307         { bridge_ioctl_sifflags,        sizeof(struct ifbreq),
 308           BC_F_COPYIN|BC_F_SUSER },
 309
 310         { bridge_ioctl_scache,          sizeof(struct ifbrparam),
 311           BC_F_COPYIN|BC_F_SUSER },
 312         { bridge_ioctl_gcache,          sizeof(struct ifbrparam),
 313           BC_F_COPYOUT },
 314
 315         { bridge_ioctl_gifs,            sizeof(struct ifbifconf),
 316           BC_F_COPYIN|BC_F_COPYOUT },
 317         { bridge_ioctl_rts,             sizeof(struct ifbaconf),
 318           BC_F_COPYIN|BC_F_COPYOUT },
 319
 320         { bridge_ioctl_saddr,           sizeof(struct ifbareq),
 321           BC_F_COPYIN|BC_F_SUSER },
 322
 323         { bridge_ioctl_sto,             sizeof(struct ifbrparam),
 324           BC_F_COPYIN|BC_F_SUSER },
 325         { bridge_ioctl_gto,             sizeof(struct ifbrparam),
 326           BC_F_COPYOUT },
 327
 328         { bridge_ioctl_daddr,           sizeof(struct ifbareq),
 329           BC_F_COPYIN|BC_F_SUSER },
 330
 331         { bridge_ioctl_flush,           sizeof(struct ifbreq),
 332           BC_F_COPYIN|BC_F_SUSER },
 333
 334         { bridge_ioctl_gpri,            sizeof(struct ifbrparam),
 335           BC_F_COPYOUT },
 336         { bridge_ioctl_spri,            sizeof(struct ifbrparam),
 337           BC_F_COPYIN|BC_F_SUSER },
 338
 339         { bridge_ioctl_ght,             sizeof(struct ifbrparam),
 340           BC_F_COPYOUT },
 341         { bridge_ioctl_sht,             sizeof(struct ifbrparam),
 342           BC_F_COPYIN|BC_F_SUSER },
 343
 344         { bridge_ioctl_gfd,             sizeof(struct ifbrparam),
 345           BC_F_COPYOUT },
 346         { bridge_ioctl_sfd,             sizeof(struct ifbrparam),
 347           BC_F_COPYIN|BC_F_SUSER },
 348
 349         { bridge_ioctl_gma,             sizeof(struct ifbrparam),
 350           BC_F_COPYOUT },
 351         { bridge_ioctl_sma,             sizeof(struct ifbrparam),
 352           BC_F_COPYIN|BC_F_SUSER },
 353
 354         { bridge_ioctl_sifprio,         sizeof(struct ifbreq),
 355           BC_F_COPYIN|BC_F_SUSER },
 356
 357         { bridge_ioctl_sifcost,         sizeof(struct ifbreq),
 358           BC_F_COPYIN|BC_F_SUSER },
 359
 360         { bridge_ioctl_addspan,         sizeof(struct ifbreq),
 361           BC_F_COPYIN|BC_F_SUSER },
 362         { bridge_ioctl_delspan,         sizeof(struct ifbreq),
 363           BC_F_COPYIN|BC_F_SUSER },
 364 };
 365 const int bridge_control_table_size =
 366     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
 367
 368 LIST_HEAD(, bridge_softc) bridge_list;
 369
 370 struct if_clone bridge_cloner = IF_CLONE_INITIALIZER("bridge",
 371                                 bridge_clone_create,
 372                                 bridge_clone_destroy, 0, IF_MAXUNIT);
 373
 374 static int
 375 bridge_modevent(module_t mod, int type, void *data)
 376 {
 377         switch (type) {
 378         case MOD_LOAD:
 379                 LIST_INIT(&bridge_list);
 380                 if_clone_attach(&bridge_cloner);
 381                 bridge_input_p = bridge_input;
 382                 bridge_output_p = bridge_output;
 383                 bridge_detach_cookie = EVENTHANDLER_REGISTER(
 384                     ifnet_detach_event, bridge_ifdetach, NULL,
 385                     EVENTHANDLER_PRI_ANY);
 386 #if notyet
 387                 bstp_linkstate_p = bstp_linkstate;
 388 #endif
 389                 break;
 390         case MOD_UNLOAD:
 391                 if (!LIST_EMPTY(&bridge_list))
 392                         return (EBUSY);
 393                 EVENTHANDLER_DEREGISTER(ifnet_detach_event,
 394                     bridge_detach_cookie);
 395                 if_clone_detach(&bridge_cloner);
 396                 bridge_input_p = NULL;
 397                 bridge_output_p = NULL;
 398 #if notyet
 399                 bstp_linkstate_p = NULL;
 400 #endif
 401                 break;
 402         default:
 403                 return (EOPNOTSUPP);
 404         }
 405         return (0);
 406 }
 407
 408 static moduledata_t bridge_mod = {
 409         "if_bridge",
 410         bridge_modevent,
 411         0
 412 };
 413
 414 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
 415
 416
 417 /*
 418  * bridge_clone_create:
 419  *
 420  *      Create a new bridge instance.
 421  */
 422 static int
 423 bridge_clone_create(struct if_clone *ifc, int unit)
 424 {
 425         struct bridge_softc *sc;
 426         struct ifnet *ifp;
 427         u_char eaddr[6];
 428
 429         sc = kmalloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
 430         ifp = sc->sc_ifp = &sc->sc_if;
 431
 432         sc->sc_brtmax = BRIDGE_RTABLE_MAX;
 433         sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
 434         sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
 435         sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
 436         sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
 437         sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
 438         sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
 439
 440         /* Initialize our routing table. */
 441         bridge_rtable_init(sc);
 442
 443         callout_init(&sc->sc_brcallout);
 444         callout_init(&sc->sc_bstpcallout);
 445
 446         LIST_INIT(&sc->sc_iflist);
 447         LIST_INIT(&sc->sc_spanlist);
 448
 449         ifp->if_softc = sc;
 450         if_initname(ifp, ifc->ifc_name, unit);
 451         ifp->if_mtu = ETHERMTU;
 452         ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
 453         ifp->if_ioctl = bridge_ioctl;
 454         ifp->if_start = bridge_start;
 455         ifp->if_init = bridge_init;
 456         ifp->if_type = IFT_BRIDGE;
 457         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 458         ifp->if_snd.ifq_maxlen = ifqmaxlen;
 459         ifq_set_ready(&ifp->if_snd);
 460         ifp->if_hdrlen = ETHER_HDR_LEN;
 461
 462         /*
 463          * Generate a random ethernet address and use the private AC:DE:48
 464          * OUI code.
 465          */
 466         {
 467                 int rnd = karc4random();
 468                 bcopy(&rnd, &eaddr[0], 4); /* ETHER_ADDR_LEN == 6 */
 469                 rnd = karc4random();
 470                 bcopy(&rnd, &eaddr[2], 4); /* ETHER_ADDR_LEN == 6 */
 471         }
 472         eaddr[0] &= ~1;         /* clear multicast bit */
 473         eaddr[0] |= 2;          /* set the LAA bit */
 474
 475         ether_ifattach(ifp, eaddr, NULL);
 476         /* Now undo some of the damage... */
 477         ifp->if_baudrate = 0;
 478         ifp->if_type = IFT_BRIDGE;
 479
 480         crit_enter();
 481         LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
 482         crit_exit();
 483
 484         return (0);
 485 }
 486
 487 /*
 488  * bridge_clone_destroy:
 489  *
 490  *      Destroy a bridge instance.
 491  */
 492 static void
 493 bridge_clone_destroy(struct ifnet *ifp)
 494 {
 495         struct bridge_softc *sc = ifp->if_softc;
 496         struct bridge_iflist *bif;
 497
 498         lwkt_serialize_enter(ifp->if_serializer);
 499
 500         bridge_stop(ifp);
 501         ifp->if_flags &= ~IFF_UP;
 502
 503         while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
 504                 bridge_delete_member(sc, bif, 0);
 505
 506         while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
 507                 bridge_delete_span(sc, bif);
 508         }
 509
 510         callout_stop(&sc->sc_brcallout);
 511         callout_stop(&sc->sc_bstpcallout);
 512
 513         lwkt_serialize_exit(ifp->if_serializer);
 514
 515         crit_enter();
 516         LIST_REMOVE(sc, sc_list);
 517         crit_exit();
 518
 519         ether_ifdetach(ifp);
 520
 521         /* Tear down the routing table. */
 522         bridge_rtable_fini(sc);
 523
 524         kfree(sc, M_DEVBUF);
 525 }
 526
 527 /*
 528  * bridge_ioctl:
 529  *
 530  *      Handle a control request from the operator.
 531  */
 532 static int
 533 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 534 {
 535         struct bridge_softc *sc = ifp->if_softc;
 536         union {
 537                 struct ifbreq ifbreq;
 538                 struct ifbifconf ifbifconf;
 539                 struct ifbareq ifbareq;
 540                 struct ifbaconf ifbaconf;
 541                 struct ifbrparam ifbrparam;
 542         } args;
 543         struct ifdrv *ifd = (struct ifdrv *) data;
 544         const struct bridge_control *bc;
 545         int error = 0;
 546
 547         ASSERT_SERIALIZED(ifp->if_serializer);
 548
 549         switch (cmd) {
 550         case SIOCADDMULTI:
 551         case SIOCDELMULTI:
 552                 break;
 553
 554         case SIOCGDRVSPEC:
 555         case SIOCSDRVSPEC:
 556                 if (ifd->ifd_cmd >= bridge_control_table_size) {
 557                         error = EINVAL;
 558                         break;
 559                 }
 560                 bc = &bridge_control_table[ifd->ifd_cmd];
 561
 562                 if (cmd == SIOCGDRVSPEC &&
 563                     (bc->bc_flags & BC_F_COPYOUT) == 0) {
 564                         error = EINVAL;
 565                         break;
 566                 } else if (cmd == SIOCSDRVSPEC &&
 567                     (bc->bc_flags & BC_F_COPYOUT) != 0) {
 568                         error = EINVAL;
 569                         break;
 570                 }
 571
 572                 if (bc->bc_flags & BC_F_SUSER) {
 573                         error = suser_cred(cr, NULL_CRED_OKAY);
 574                         if (error)
 575                                 break;
 576                 }
 577
 578                 if (ifd->ifd_len != bc->bc_argsize ||
 579                     ifd->ifd_len > sizeof(args)) {
 580                         error = EINVAL;
 581                         break;
 582                 }
 583
 584                 memset(&args, 0, sizeof(args));
 585                 if (bc->bc_flags & BC_F_COPYIN) {
 586                         error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
 587                         if (error)
 588                                 break;
 589                 }
 590
 591                 error = bc->bc_func(sc, &args);
 592                 if (error)
 593                         break;
 594
 595                 if (bc->bc_flags & BC_F_COPYOUT)
 596                         error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
 597                 break;
 598
 599         case SIOCSIFFLAGS:
 600                 if (!(ifp->if_flags & IFF_UP) &&
 601                     (ifp->if_flags & IFF_RUNNING)) {
 602                         /*
 603                          * If interface is marked down and it is running,
 604                          * then stop it.
 605                          */
 606                         bridge_stop(ifp);
 607                 } else if ((ifp->if_flags & IFF_UP) &&
 608                     !(ifp->if_flags & IFF_RUNNING)) {
 609                         /*
 610                          * If interface is marked up and it is stopped, then
 611                          * start it.
 612                          */
 613                         ifp->if_init(sc);
 614                 }
 615                 break;
 616
 617         case SIOCSIFMTU:
 618                 /* Do not allow the MTU to be changed on the bridge */
 619                 error = EINVAL;
 620                 break;
 621
 622         default:
 623                 error = ether_ioctl(ifp, cmd, data);
 624                 break;
 625         }
 626         return (error);
 627 }
 628
 629 /*
 630  * bridge_mutecaps:
 631  *
 632  *      Clear or restore unwanted capabilities on the member interface
 633  */
 634 static void
 635 bridge_mutecaps(struct bridge_iflist *bif, int mute)
 636 {
 637         struct ifnet *ifp = bif->bif_ifp;
 638         struct ifreq ifr;
 639         int error;
 640
 641         if (ifp->if_ioctl == NULL)
 642                 return;
 643
 644         bzero(&ifr, sizeof(ifr));
 645         ifr.ifr_reqcap = ifp->if_capenable;
 646
 647         if (mute) {
 648                 /* mask off and save capabilities */
 649                 bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
 650                 if (bif->bif_mutecap != 0)
 651                         ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
 652         } else
 653                 /* restore muted capabilities */
 654                 ifr.ifr_reqcap |= bif->bif_mutecap;
 655
 656         if (bif->bif_mutecap != 0) {
 657                 lwkt_serialize_enter(ifp->if_serializer);
 658                 error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr, NULL);
 659                 lwkt_serialize_exit(ifp->if_serializer);
 660         }
 661 }
 662
 663 /*
 664  * bridge_lookup_member:
 665  *
 666  *      Lookup a bridge member interface.
 667  */
 668 static struct bridge_iflist *
 669 bridge_lookup_member(struct bridge_softc *sc, const char *name)
 670 {
 671         struct bridge_iflist *bif;
 672         struct ifnet *ifp;
 673
 674         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 675                 ifp = bif->bif_ifp;
 676                 if (strcmp(ifp->if_xname, name) == 0)
 677                         return (bif);
 678         }
 679
 680         return (NULL);
 681 }
 682
 683 /*
 684  * bridge_lookup_member_if:
 685  *
 686  *      Lookup a bridge member interface by ifnet*.
 687  */
 688 static struct bridge_iflist *
 689 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
 690 {
 691         struct bridge_iflist *bif;
 692
 693         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 694                 if (bif->bif_ifp == member_ifp)
 695                         return (bif);
 696         }
 697
 698         return (NULL);
 699 }
 700
 701 /*
 702  * bridge_delete_member:
 703  *
 704  *      Delete the specified member interface.
 705  */
 706 static void
 707 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
 708     int gone)
 709 {
 710         struct ifnet *ifs = bif->bif_ifp;
 711
 712         if (!gone) {
 713                 switch (ifs->if_type) {
 714                 case IFT_ETHER:
 715                 case IFT_L2VLAN:
 716                         /*
 717                          * Take the interface out of promiscuous mode.
 718                          */
 719                         (void) ifpromisc(ifs, 0);
 720                         bridge_mutecaps(bif, 0);
 721                         break;
 722
 723                 case IFT_GIF:
 724                         break;
 725
 726                 default:
 727 #ifdef DIAGNOSTIC
 728                         panic("bridge_delete_member: impossible");
 729 #endif
 730                         break;
 731                 }
 732         }
 733
 734         ifs->if_bridge = NULL;
 735         LIST_REMOVE(bif, bif_next);
 736
 737         bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
 738
 739         kfree(bif, M_DEVBUF);
 740
 741         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 742                 bstp_initialization(sc);
 743 }
 744
 745 /*
 746  * bridge_delete_span:
 747  *
 748  *      Delete the specified span interface.
 749  */
 750 static void
 751 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 752 {
 753         KASSERT(bif->bif_ifp->if_bridge == NULL,
 754             ("%s: not a span interface", __func__));
 755
 756         LIST_REMOVE(bif, bif_next);
 757         kfree(bif, M_DEVBUF);
 758 }
 759
 760 static int
 761 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
 762 {
 763         struct ifbreq *req = arg;
 764         struct bridge_iflist *bif = NULL;
 765         struct ifnet *ifs;
 766         int error = 0;
 767
 768         ifs = ifunit(req->ifbr_ifsname);
 769         if (ifs == NULL)
 770                 return (ENOENT);
 771
 772         /* If it's in the span list, it can't be a member. */
 773         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 774                 if (ifs == bif->bif_ifp)
 775                         return (EBUSY);
 776
 777         /* Allow the first Ethernet member to define the MTU */
 778         if (ifs->if_type != IFT_GIF) {
 779                 if (LIST_EMPTY(&sc->sc_iflist))
 780                         sc->sc_ifp->if_mtu = ifs->if_mtu;
 781                 else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
 782                         if_printf(sc->sc_ifp, "invalid MTU for %s\n",
 783                             ifs->if_xname);
 784                         return (EINVAL);
 785                 }
 786         }
 787
 788         if (ifs->if_bridge == sc)
 789                 return (EEXIST);
 790
 791         if (ifs->if_bridge != NULL)
 792                 return (EBUSY);
 793
 794         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
 795         bif->bif_ifp = ifs;
 796         bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
 797         bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
 798         bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
 799
 800         switch (ifs->if_type) {
 801         case IFT_ETHER:
 802         case IFT_L2VLAN:
 803                 /*
 804                  * Place the interface into promiscuous mode.
 805                  */
 806                 error = ifpromisc(ifs, 1);
 807                 if (error)
 808                         goto out;
 809
 810                 bridge_mutecaps(bif, 1);
 811                 break;
 812
 813         case IFT_GIF: /* :^) */
 814                 break;
 815
 816         default:
 817                 error = EINVAL;
 818                 goto out;
 819         }
 820
 821         ifs->if_bridge = sc;
 822
 823         LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
 824
 825         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 826                 bstp_initialization(sc);
 827         else
 828                 bstp_stop(sc);
 829
 830 out:
 831         if (error) {
 832                 if (bif != NULL)
 833                         kfree(bif, M_DEVBUF);
 834         }
 835         return (error);
 836 }
 837
 838 static int
 839 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
 840 {
 841         struct ifbreq *req = arg;
 842         struct bridge_iflist *bif;
 843
 844         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 845         if (bif == NULL)
 846                 return (ENOENT);
 847
 848         bridge_delete_member(sc, bif, 0);
 849
 850         return (0);
 851 }
 852
 853 static int
 854 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
 855 {
 856         struct ifbreq *req = arg;
 857         struct bridge_iflist *bif;
 858
 859         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 860         if (bif == NULL)
 861                 return (ENOENT);
 862
 863         req->ifbr_ifsflags = bif->bif_flags;
 864         req->ifbr_state = bif->bif_state;
 865         req->ifbr_priority = bif->bif_priority;
 866         req->ifbr_path_cost = bif->bif_path_cost;
 867         req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
 868
 869         return (0);
 870 }
 871
 872 static int
 873 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
 874 {
 875         struct ifbreq *req = arg;
 876         struct bridge_iflist *bif;
 877
 878         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
 879         if (bif == NULL)
 880                 return (ENOENT);
 881
 882         if (req->ifbr_ifsflags & IFBIF_SPAN)
 883                 /* SPAN is readonly */
 884                 return (EINVAL);
 885
 886         if (req->ifbr_ifsflags & IFBIF_STP) {
 887                 switch (bif->bif_ifp->if_type) {
 888                 case IFT_ETHER:
 889                         /* These can do spanning tree. */
 890                         break;
 891
 892                 default:
 893                         /* Nothing else can. */
 894                         return (EINVAL);
 895                 }
 896         }
 897
 898         bif->bif_flags = req->ifbr_ifsflags;
 899
 900         if (sc->sc_ifp->if_flags & IFF_RUNNING)
 901                 bstp_initialization(sc);
 902
 903         return (0);
 904 }
 905
 906 static int
 907 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
 908 {
 909         struct ifbrparam *param = arg;
 910
 911         sc->sc_brtmax = param->ifbrp_csize;
 912         bridge_rttrim(sc);
 913
 914         return (0);
 915 }
 916
 917 static int
 918 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
 919 {
 920         struct ifbrparam *param = arg;
 921
 922         param->ifbrp_csize = sc->sc_brtmax;
 923
 924         return (0);
 925 }
 926
 927 static int
 928 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
 929 {
 930         struct ifbifconf *bifc = arg;
 931         struct bridge_iflist *bif;
 932         struct ifbreq breq;
 933         int count, len, error = 0;
 934
 935         count = 0;
 936         LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
 937                 count++;
 938         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
 939                 count++;
 940
 941         if (bifc->ifbic_len == 0) {
 942                 bifc->ifbic_len = sizeof(breq) * count;
 943                 return (0);
 944         }
 945
 946         count = 0;
 947         len = bifc->ifbic_len;
 948         memset(&breq, 0, sizeof breq);
 949         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
 950                 if (len < sizeof(breq))
 951                         break;
 952
 953                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
 954                     sizeof(breq.ifbr_ifsname));
 955                 breq.ifbr_ifsflags = bif->bif_flags;
 956                 breq.ifbr_state = bif->bif_state;
 957                 breq.ifbr_priority = bif->bif_priority;
 958                 breq.ifbr_path_cost = bif->bif_path_cost;
 959                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
 960                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
 961                 if (error)
 962                         break;
 963                 count++;
 964                 len -= sizeof(breq);
 965         }
 966         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
 967                 if (len < sizeof(breq))
 968                         break;
 969
 970                 strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
 971                     sizeof(breq.ifbr_ifsname));
 972                 breq.ifbr_ifsflags = bif->bif_flags;
 973                 breq.ifbr_state = bif->bif_state;
 974                 breq.ifbr_priority = bif->bif_priority;
 975                 breq.ifbr_path_cost = bif->bif_path_cost;
 976                 breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
 977                 error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
 978                 if (error)
 979                         break;
 980                 count++;
 981                 len -= sizeof(breq);
 982         }
 983
 984         bifc->ifbic_len = sizeof(breq) * count;
 985         return (error);
 986 }
 987
 988 static int
 989 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
 990 {
 991         struct ifbaconf *bac = arg;
 992         struct bridge_rtnode *brt;
 993         struct ifbareq bareq;
 994         int count = 0, error = 0, len;
 995
 996         if (bac->ifbac_len == 0)
 997                 return (0);
 998
 999         len = bac->ifbac_len;
1000         memset(&bareq, 0, sizeof(bareq));
1001         LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1002                 if (len < sizeof(bareq))
1003                         goto out;
1004                 strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1005                     sizeof(bareq.ifba_ifsname));
1006                 memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1007                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1008                                 time_second < brt->brt_expire)
1009                         bareq.ifba_expire = brt->brt_expire - time_second;
1010                 else
1011                         bareq.ifba_expire = 0;
1012                 bareq.ifba_flags = brt->brt_flags;
1013
1014                 error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1015                 if (error)
1016                         goto out;
1017                 count++;
1018                 len -= sizeof(bareq);
1019         }
1020 out:
1021         bac->ifbac_len = sizeof(bareq) * count;
1022         return (error);
1023 }
1024
1025 static int
1026 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1027 {
1028         struct ifbareq *req = arg;
1029         struct bridge_iflist *bif;
1030         int error;
1031
1032         bif = bridge_lookup_member(sc, req->ifba_ifsname);
1033         if (bif == NULL)
1034                 return (ENOENT);
1035
1036         error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1037             req->ifba_flags);
1038
1039         return (error);
1040 }
1041
1042 static int
1043 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1044 {
1045         struct ifbrparam *param = arg;
1046
1047         sc->sc_brttimeout = param->ifbrp_ctime;
1048
1049         return (0);
1050 }
1051
1052 static int
1053 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1054 {
1055         struct ifbrparam *param = arg;
1056
1057         param->ifbrp_ctime = sc->sc_brttimeout;
1058
1059         return (0);
1060 }
1061
1062 static int
1063 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1064 {
1065         struct ifbareq *req = arg;
1066
1067         return (bridge_rtdaddr(sc, req->ifba_dst));
1068 }
1069
1070 static int
1071 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1072 {
1073         struct ifbreq *req = arg;
1074
1075         bridge_rtflush(sc, req->ifbr_ifsflags);
1076
1077         return (0);
1078 }
1079
1080 static int
1081 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1082 {
1083         struct ifbrparam *param = arg;
1084
1085         param->ifbrp_prio = sc->sc_bridge_priority;
1086
1087         return (0);
1088 }
1089
1090 static int
1091 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1092 {
1093         struct ifbrparam *param = arg;
1094
1095         sc->sc_bridge_priority = param->ifbrp_prio;
1096
1097         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1098                 bstp_initialization(sc);
1099
1100         return (0);
1101 }
1102
1103 static int
1104 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1105 {
1106         struct ifbrparam *param = arg;
1107
1108         param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1109
1110         return (0);
1111 }
1112
1113 static int
1114 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1115 {
1116         struct ifbrparam *param = arg;
1117
1118         if (param->ifbrp_hellotime == 0)
1119                 return (EINVAL);
1120         sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1121
1122         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1123                 bstp_initialization(sc);
1124
1125         return (0);
1126 }
1127
1128 static int
1129 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1130 {
1131         struct ifbrparam *param = arg;
1132
1133         param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1134
1135         return (0);
1136 }
1137
1138 static int
1139 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1140 {
1141         struct ifbrparam *param = arg;
1142
1143         if (param->ifbrp_fwddelay == 0)
1144                 return (EINVAL);
1145         sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1146
1147         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1148                 bstp_initialization(sc);
1149
1150         return (0);
1151 }
1152
1153 static int
1154 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1155 {
1156         struct ifbrparam *param = arg;
1157
1158         param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1159
1160         return (0);
1161 }
1162
1163 static int
1164 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1165 {
1166         struct ifbrparam *param = arg;
1167
1168         if (param->ifbrp_maxage == 0)
1169                 return (EINVAL);
1170         sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1171
1172         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1173                 bstp_initialization(sc);
1174
1175         return (0);
1176 }
1177
1178 static int
1179 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1180 {
1181         struct ifbreq *req = arg;
1182         struct bridge_iflist *bif;
1183
1184         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1185         if (bif == NULL)
1186                 return (ENOENT);
1187
1188         bif->bif_priority = req->ifbr_priority;
1189
1190         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1191                 bstp_initialization(sc);
1192
1193         return (0);
1194 }
1195
1196 static int
1197 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1198 {
1199         struct ifbreq *req = arg;
1200         struct bridge_iflist *bif;
1201
1202         bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1203         if (bif == NULL)
1204                 return (ENOENT);
1205
1206         bif->bif_path_cost = req->ifbr_path_cost;
1207
1208         if (sc->sc_ifp->if_flags & IFF_RUNNING)
1209                 bstp_initialization(sc);
1210
1211         return (0);
1212 }
1213
1214 static int
1215 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1216 {
1217         struct ifbreq *req = arg;
1218         struct bridge_iflist *bif = NULL;
1219         struct ifnet *ifs;
1220
1221         ifs = ifunit(req->ifbr_ifsname);
1222         if (ifs == NULL)
1223                 return (ENOENT);
1224
1225         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1226                 if (ifs == bif->bif_ifp)
1227                         return (EBUSY);
1228
1229         if (ifs->if_bridge != NULL)
1230                 return (EBUSY);
1231
1232         switch (ifs->if_type) {
1233                 case IFT_ETHER:
1234                 case IFT_GIF:
1235                 case IFT_L2VLAN:
1236                         break;
1237                 default:
1238                         return (EINVAL);
1239         }
1240
1241         bif = kmalloc(sizeof(*bif), M_DEVBUF, M_WAITOK|M_ZERO);
1242
1243         bif->bif_ifp = ifs;
1244         bif->bif_flags = IFBIF_SPAN;
1245
1246         LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1247
1248         return (0);
1249 }
1250
1251 static int
1252 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1253 {
1254         struct ifbreq *req = arg;
1255         struct bridge_iflist *bif;
1256         struct ifnet *ifs;
1257
1258         ifs = ifunit(req->ifbr_ifsname);
1259         if (ifs == NULL)
1260                 return (ENOENT);
1261
1262         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1263                 if (ifs == bif->bif_ifp)
1264                         break;
1265
1266         if (bif == NULL)
1267                 return (ENOENT);
1268
1269         bridge_delete_span(sc, bif);
1270
1271         return (0);
1272 }
1273
1274 /*
1275  * bridge_ifdetach:
1276  *
1277  *      Detach an interface from a bridge.  Called when a member
1278  *      interface is detaching.
1279  */
1280 static void
1281 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1282 {
1283         struct bridge_softc *sc = ifp->if_bridge;
1284         struct bridge_iflist *bif;
1285
1286         /* Check if the interface is a bridge member */
1287         if (sc != NULL) {
1288                 lwkt_serialize_enter(ifp->if_serializer);
1289
1290                 bif = bridge_lookup_member_if(sc, ifp);
1291                 if (bif != NULL)
1292                         bridge_delete_member(sc, bif, 1);
1293
1294                 lwkt_serialize_exit(ifp->if_serializer);
1295                 return;
1296         }
1297
1298         /* Check if the interface is a span port */
1299         LIST_FOREACH(sc, &bridge_list, sc_list) {
1300                 LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1301                         if (ifp == bif->bif_ifp) {
1302                                 bridge_delete_span(sc, bif);
1303                                 break;
1304                         }
1305         }
1306 }
1307
1308 /*
1309  * bridge_init:
1310  *
1311  *      Initialize a bridge interface.
1312  */
1313 static void
1314 bridge_init(void *xsc)
1315 {
1316         struct bridge_softc *sc = (struct bridge_softc *)xsc;
1317         struct ifnet *ifp = sc->sc_ifp;
1318
1319         ASSERT_SERIALIZED(ifp->if_serializer);
1320
1321         if (ifp->if_flags & IFF_RUNNING)
1322                 return;
1323
1324         callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1325             bridge_timer, sc);
1326
1327         ifp->if_flags |= IFF_RUNNING;
1328         bstp_initialization(sc);
1329         return;
1330 }
1331
1332 /*
1333  * bridge_stop:
1334  *
1335  *      Stop the bridge interface.
1336  */
1337 static void
1338 bridge_stop(struct ifnet *ifp)
1339 {
1340         struct bridge_softc *sc = ifp->if_softc;
1341
1342         ASSERT_SERIALIZED(ifp->if_serializer);
1343
1344         if ((ifp->if_flags & IFF_RUNNING) == 0)
1345                 return;
1346
1347         callout_stop(&sc->sc_brcallout);
1348         bstp_stop(sc);
1349
1350         bridge_rtflush(sc, IFBF_FLUSHDYN);
1351
1352         ifp->if_flags &= ~IFF_RUNNING;
1353 }
1354
1355 static void
1356 bridge_enqueue_internal(struct ifnet *dst_ifp, struct mbuf *m,
1357                         netisr_fn_t handler)
1358 {
1359         struct netmsg_packet *nmp;
1360         lwkt_port_t port;
1361         int cpu = mycpu->gd_cpuid;
1362
1363         while (m->m_type == MT_TAG) {
1364                 /* XXX see ether_output_frame for full rules check */
1365                 m = m->m_next;
1366         }
1367
1368         nmp = &m->m_hdr.mh_netmsg;
1369         netmsg_init(&nmp->nm_netmsg, &netisr_apanic_rport, 0, handler);
1370         nmp->nm_packet = m;
1371         nmp->nm_netmsg.nm_lmsg.u.ms_resultp = dst_ifp;
1372
1373         port = cpu_portfn(cpu);
1374         lwkt_sendmsg(port, &nmp->nm_netmsg.nm_lmsg);
1375 }
1376
1377 static void
1378 bridge_pfil_enqueue(struct ifnet *dst_ifp, struct mbuf *m,
1379                     int runfilt)
1380 {
1381         netisr_fn_t handler;
1382
1383         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
1384 #ifdef INET6
1385             || inet6_pfil_hook.ph_hashooks > 0
1386 #endif
1387             )) {
1388                 handler = bridge_pfil_enqueue_handler;
1389         } else {
1390                 handler = bridge_enqueue_handler;
1391         }
1392         bridge_enqueue_internal(dst_ifp, m, handler);
1393 }
1394
1395 /*
1396  * bridge_enqueue:
1397  *
1398  *      Enqueue a packet on a bridge member interface.
1399  *
1400  */
1401 void
1402 bridge_enqueue(struct ifnet *dst_ifp, struct mbuf *m)
1403 {
1404         bridge_enqueue_internal(dst_ifp, m, bridge_enqueue_handler);
1405 }
1406
1407 /*
1408  * bridge_output:
1409  *
1410  *      Send output from a bridge member interface.  This
1411  *      performs the bridging function for locally originated
1412  *      packets.
1413  *
1414  *      The mbuf has the Ethernet header already attached.  We must
1415  *      enqueue or free the mbuf before returning.
1416  */
1417 static int
1418 bridge_output(struct ifnet *ifp, struct mbuf *m)
1419 {
1420         struct ether_header *eh;
1421         struct ifnet *dst_if;
1422         struct bridge_softc *sc;
1423
1424         sc = ifp->if_bridge;
1425
1426         ASSERT_NOT_SERIALIZED(ifp->if_serializer);
1427
1428         if (m->m_len < ETHER_HDR_LEN) {
1429                 m = m_pullup(m, ETHER_HDR_LEN);
1430                 if (m == NULL)
1431                         return (0);
1432         }
1433
1434         /* Serialize our bridge interface. */
1435         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
1436
1437         eh = mtod(m, struct ether_header *);
1438
1439         /*
1440          * If bridge is down, but the original output interface is up,
1441          * go ahead and send out that interface.  Otherwise, the packet
1442          * is dropped below.
1443          */
1444         if ((sc->sc_ifp->if_flags & IFF_RUNNING) == 0) {
1445                 dst_if = ifp;
1446                 goto sendunicast;
1447         }
1448
1449         /*
1450          * If the packet is a multicast, or we don't know a better way to
1451          * get there, send to all interfaces.
1452          */
1453         if (ETHER_IS_MULTICAST(eh->ether_dhost))
1454                 dst_if = NULL;
1455         else
1456                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1457         if (dst_if == NULL) {
1458                 struct bridge_iflist *bif;
1459                 struct mbuf *mc;
1460                 int used = 0;
1461
1462                 bridge_span(sc, m);
1463
1464                 LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1465                         dst_if = bif->bif_ifp;
1466                         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1467                                 continue;
1468
1469                         /*
1470                          * If this is not the original output interface,
1471                          * and the interface is participating in spanning
1472                          * tree, make sure the port is in a state that
1473                          * allows forwarding.
1474                          */
1475                         if (dst_if != ifp &&
1476                             (bif->bif_flags & IFBIF_STP) != 0) {
1477                                 switch (bif->bif_state) {
1478                                 case BSTP_IFSTATE_BLOCKING:
1479                                 case BSTP_IFSTATE_LISTENING:
1480                                 case BSTP_IFSTATE_DISABLED:
1481                                         continue;
1482                                 }
1483                         }
1484
1485                         if (LIST_NEXT(bif, bif_next) == NULL) {
1486                                 used = 1;
1487                                 mc = m;
1488                         } else {
1489                                 mc = m_copypacket(m, MB_DONTWAIT);
1490                                 if (mc == NULL) {
1491                                         sc->sc_ifp->if_oerrors++;
1492                                         continue;
1493                                 }
1494                         }
1495                         bridge_enqueue(dst_if, mc);
1496                 }
1497                 if (used == 0)
1498                         m_freem(m);
1499                 lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1500                 return (0);
1501         }
1502
1503 sendunicast:
1504         /*
1505          * XXX Spanning tree consideration here?
1506          */
1507
1508         bridge_span(sc, m);
1509         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
1510         if ((dst_if->if_flags & IFF_RUNNING) == 0)
1511                 m_freem(m);
1512         else
1513                 bridge_enqueue(dst_if, m);
1514         return (0);
1515 }
1516
1517 /*
1518  * bridge_start:
1519  *
1520  *      Start output on a bridge.
1521  *
1522  */
1523 static void
1524 bridge_start(struct ifnet *ifp)
1525 {
1526         struct bridge_softc *sc = ifp->if_softc;
1527
1528         ASSERT_SERIALIZED(ifp->if_serializer);
1529
1530         ifp->if_flags |= IFF_OACTIVE;
1531         for (;;) {
1532                 struct ifnet *dst_if = NULL;
1533                 struct ether_header *eh;
1534                 struct mbuf *m;
1535
1536                 m = ifq_dequeue(&ifp->if_snd, NULL);
1537                 if (m == NULL)
1538                         break;
1539
1540                 if (m->m_len < sizeof(*eh)) {
1541                         m = m_pullup(m, sizeof(*eh));
1542                         if (m == NULL) {
1543                                 ifp->if_oerrors++;
1544                                 continue;
1545                         }
1546                 }
1547                 eh = mtod(m, struct ether_header *);
1548
1549                 BPF_MTAP(ifp, m);
1550                 ifp->if_opackets++;
1551
1552                 if ((m->m_flags & (M_BCAST|M_MCAST)) == 0)
1553                         dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1554
1555                 if (dst_if == NULL)
1556                         bridge_broadcast(sc, ifp, m, 0);
1557                 else
1558                         bridge_enqueue(dst_if, m);
1559         }
1560         ifp->if_flags &= ~IFF_OACTIVE;
1561 }
1562
1563 /*
1564  * bridge_forward:
1565  *
1566  *      The forwarding function of the bridge.
1567  */
1568 static void
1569 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1570 {
1571         struct bridge_iflist *bif;
1572         struct ifnet *src_if, *dst_if, *ifp;
1573         struct ether_header *eh;
1574
1575         src_if = m->m_pkthdr.rcvif;
1576         ifp = sc->sc_ifp;
1577
1578         ASSERT_SERIALIZED(ifp->if_serializer);
1579
1580         ifp->if_ipackets++;
1581         ifp->if_ibytes += m->m_pkthdr.len;
1582
1583         /*
1584          * Look up the bridge_iflist.
1585          */
1586         bif = bridge_lookup_member_if(sc, src_if);
1587         if (bif == NULL) {
1588                 /* Interface is not a bridge member (anymore?) */
1589                 m_freem(m);
1590                 return;
1591         }
1592
1593         if (bif->bif_flags & IFBIF_STP) {
1594                 switch (bif->bif_state) {
1595                 case BSTP_IFSTATE_BLOCKING:
1596                 case BSTP_IFSTATE_LISTENING:
1597                 case BSTP_IFSTATE_DISABLED:
1598                         m_freem(m);
1599                         return;
1600                 }
1601         }
1602
1603         eh = mtod(m, struct ether_header *);
1604
1605         /*
1606          * If the interface is learning, and the source
1607          * address is valid and not multicast, record
1608          * the address.
1609          */
1610         if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1611             ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1612             (eh->ether_shost[0] == 0 &&
1613              eh->ether_shost[1] == 0 &&
1614              eh->ether_shost[2] == 0 &&
1615              eh->ether_shost[3] == 0 &&
1616              eh->ether_shost[4] == 0 &&
1617              eh->ether_shost[5] == 0) == 0) {
1618                 bridge_rtupdate(sc, eh->ether_shost, src_if, 0, IFBAF_DYNAMIC);
1619         }
1620
1621         if ((bif->bif_flags & IFBIF_STP) != 0 &&
1622             bif->bif_state == BSTP_IFSTATE_LEARNING) {
1623                 m_freem(m);
1624                 return;
1625         }
1626
1627         /*
1628          * At this point, the port either doesn't participate
1629          * in spanning tree or it is in the forwarding state.
1630          */
1631
1632         /*
1633          * If the packet is unicast, destined for someone on
1634          * "this" side of the bridge, drop it.
1635          */
1636         if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1637                 dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1638                 if (src_if == dst_if) {
1639                         m_freem(m);
1640                         return;
1641                 }
1642         } else {
1643                 /* ...forward it to all interfaces. */
1644                 sc->sc_ifp->if_imcasts++;
1645                 dst_if = NULL;
1646         }
1647
1648         if (dst_if == NULL) {
1649                 bridge_broadcast(sc, src_if, m, 1);
1650                 return;
1651         }
1652
1653         /*
1654          * At this point, we're dealing with a unicast frame
1655          * going to a different interface.
1656          */
1657         if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1658                 m_freem(m);
1659                 return;
1660         }
1661         bif = bridge_lookup_member_if(sc, dst_if);
1662         if (bif == NULL) {
1663                 /* Not a member of the bridge (anymore?) */
1664                 m_freem(m);
1665                 return;
1666         }
1667
1668         if (bif->bif_flags & IFBIF_STP) {
1669                 switch (bif->bif_state) {
1670                 case BSTP_IFSTATE_DISABLED:
1671                 case BSTP_IFSTATE_BLOCKING:
1672                         m_freem(m);
1673                         return;
1674                 }
1675         }
1676
1677         lwkt_serialize_exit(ifp->if_serializer);
1678
1679         /* run the packet filter */
1680         if (inet_pfil_hook.ph_hashooks > 0
1681 #ifdef INET6
1682             || inet6_pfil_hook.ph_hashooks > 0
1683 #endif
1684             ) {
1685                 if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1686                         goto done;
1687                 if (m == NULL)
1688                         goto done;
1689
1690                 if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
1691                         goto done;
1692                 if (m == NULL)
1693                         goto done;
1694         }
1695         bridge_handoff(dst_if, m);
1696
1697         /*
1698          * ifp's serializer was held on entry and is expected to be held
1699          * on return.
1700          */
1701 done:
1702         lwkt_serialize_enter(ifp->if_serializer);
1703 }
1704
1705 /*
1706  * bridge_input:
1707  *
1708  *      Receive input from a member interface.  Queue the packet for
1709  *      bridging if it is not for us.
1710  */
1711 static struct mbuf *
1712 bridge_input(struct ifnet *ifp, struct mbuf *m)
1713 {
1714         struct bridge_softc *sc = ifp->if_bridge;
1715         struct bridge_iflist *bif;
1716         struct ifnet *bifp, *new_ifp;
1717         struct ether_header *eh;
1718         struct mbuf *mc, *mc2;
1719
1720         new_ifp = NULL;
1721         bifp = sc->sc_ifp;
1722
1723         lwkt_serialize_enter(bifp->if_serializer);
1724
1725         if ((bifp->if_flags & IFF_RUNNING) == 0)
1726                 goto out;
1727
1728         /*
1729          * Implement support for bridge monitoring. If this flag has been
1730          * set on this interface, discard the packet once we push it through
1731          * the bpf(4) machinery, but before we do, increment the byte and
1732          * packet counters associated with this interface.
1733          */
1734          if ((bifp->if_flags & IFF_MONITOR) != 0) {
1735                 m->m_pkthdr.rcvif = bifp;
1736                 BPF_MTAP(bifp, m);
1737                 bifp->if_ipackets++;
1738                 bifp->if_ibytes += m->m_pkthdr.len;
1739                 m_freem(m);
1740                 m = NULL;
1741                 goto out;
1742         }
1743
1744         eh = mtod(m, struct ether_header *);
1745
1746         m->m_flags &= ~M_PROTO1; /* XXX Hack - loop prevention */
1747
1748         if (memcmp(eh->ether_dhost, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0) {
1749                 /*
1750                  * If the packet is for us, set the packets source as the
1751                  * bridge, and return the packet back to ifnet.if_input for
1752                  * local processing.
1753                  */
1754                 KASSERT(bifp->if_bridge == NULL,
1755                         ("loop created in bridge_input"));
1756                 new_ifp = bifp;
1757                 goto out;
1758         }
1759
1760         /*
1761          * Tap all packets arriving on the bridge, no matter if
1762          * they are local destinations or not.  In is in.
1763          */
1764         BPF_MTAP(bifp, m);
1765
1766         bif = bridge_lookup_member_if(sc, ifp);
1767         if (bif == NULL)
1768                 goto out;
1769
1770         bridge_span(sc, m);
1771
1772         if (m->m_flags & (M_BCAST | M_MCAST)) {
1773                 /* Tap off 802.1D packets; they do not get forwarded. */
1774                 if (memcmp(eh->ether_dhost, bstp_etheraddr,
1775                     ETHER_ADDR_LEN) == 0) {
1776                         m = bstp_input(ifp, m);
1777                         KASSERT(m == NULL,
1778                                 ("attempt to deliver 802.1D packet\n"));
1779                         goto out;
1780                 }
1781
1782                 if (bif->bif_flags & IFBIF_STP) {
1783                         switch (bif->bif_state) {
1784                         case BSTP_IFSTATE_BLOCKING:
1785                         case BSTP_IFSTATE_LISTENING:
1786                         case BSTP_IFSTATE_DISABLED:
1787                                 goto out;
1788                         }
1789                 }
1790
1791                 /*
1792                  * Make a deep copy of the packet and enqueue the copy
1793                  * for bridge processing; return the original packet for
1794                  * local processing.
1795                  */
1796                 mc = m_dup(m, MB_DONTWAIT);
1797                 if (mc == NULL)
1798                         goto out;
1799
1800                 bridge_forward(sc, mc);
1801
1802                 /*
1803                  * Reinject the mbuf as arriving on the bridge so we have a
1804                  * chance at claiming multicast packets. We can not loop back
1805                  * here from ether_input as a bridge is never a member of a
1806                  * bridge.
1807                  */
1808                 KASSERT(bifp->if_bridge == NULL,
1809                         ("loop created in bridge_input"));
1810                 mc2 = m_dup(m, MB_DONTWAIT);
1811 #ifdef notyet
1812                 if (mc2 != NULL) {
1813                         /* Keep the layer3 header aligned */
1814                         int i = min(mc2->m_pkthdr.len, max_protohdr);
1815                         mc2 = m_copyup(mc2, i, ETHER_ALIGN);
1816                 }
1817 #endif
1818                 if (mc2 != NULL) {
1819                         mc2->m_pkthdr.rcvif = bifp;
1820                         bifp->if_ipackets++;
1821                         bifp->if_input(bifp, mc2);
1822                 }
1823
1824                 /* Return the original packet for local processing. */
1825                 goto out;
1826         }
1827
1828         if (bif->bif_flags & IFBIF_STP) {
1829                 switch (bif->bif_state) {
1830                 case BSTP_IFSTATE_BLOCKING:
1831                 case BSTP_IFSTATE_LISTENING:
1832                 case BSTP_IFSTATE_DISABLED:
1833                         goto out;
1834                 }
1835         }
1836
1837         /*
1838          * Unicast.  Make sure it's not for us.
1839          */
1840         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1841                 if (bif->bif_ifp->if_type != IFT_ETHER)
1842                         continue;
1843
1844                 /* It is destined for us. */
1845                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
1846                     ETHER_ADDR_LEN) == 0) {
1847                         if (bif->bif_flags & IFBIF_LEARNING) {
1848                                 bridge_rtupdate(sc,
1849                                     eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1850                         }
1851
1852                         if (bif->bif_ifp != ifp) {
1853                                 /* XXX loop prevention */
1854                                 m->m_flags |= M_PROTO1;
1855                                 new_ifp = bif->bif_ifp;
1856                         }
1857                         goto out;
1858                 }
1859
1860                 /* We just received a packet that we sent out. */
1861                 if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
1862                     ETHER_ADDR_LEN) == 0) {
1863                         m_freem(m);
1864                         m = NULL;
1865                         goto out;
1866                 }
1867         }
1868
1869         /* Perform the bridge forwarding function. */
1870         bridge_forward(sc, m);
1871         m = NULL;
1872 out:
1873         lwkt_serialize_exit(bifp->if_serializer);
1874
1875         if (new_ifp != NULL) {
1876                 lwkt_serialize_enter(new_ifp->if_serializer);
1877
1878                 m->m_pkthdr.rcvif = new_ifp;
1879                 new_ifp->if_ipackets++;
1880                 new_ifp->if_input(new_ifp, m);
1881                 m = NULL;
1882
1883                 lwkt_serialize_exit(new_ifp->if_serializer);
1884         }
1885         return (m);
1886 }
1887
1888 /*
1889  * bridge_broadcast:
1890  *
1891  *      Send a frame to all interfaces that are members of
1892  *      the bridge, except for the one on which the packet
1893  *      arrived.
1894  */
1895 static void
1896 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
1897     struct mbuf *m, int runfilt)
1898 {
1899         struct bridge_iflist *bif;
1900         struct mbuf *mc;
1901         struct ifnet *dst_if, *bifp;
1902         int used = 0;
1903
1904         bifp = sc->sc_ifp;
1905
1906         ASSERT_SERIALIZED(bifp->if_serializer);
1907
1908         /* run the packet filter */
1909         if (runfilt && (inet_pfil_hook.ph_hashooks > 0
1910 #ifdef INET6
1911             || inet6_pfil_hook.ph_hashooks > 0
1912 #endif
1913             )) {
1914                 lwkt_serialize_exit(bifp->if_serializer);
1915
1916                 /* Filter on the bridge interface before broadcasting */
1917
1918                 if (bridge_pfil(&m, bifp, src_if, PFIL_IN) != 0)
1919                         goto filt;
1920                 if (m == NULL)
1921                         goto filt;
1922
1923                 if (bridge_pfil(&m, bifp, NULL, PFIL_OUT) != 0)
1924                         m = NULL;
1925 filt:
1926                 lwkt_serialize_enter(bifp->if_serializer);
1927                 if (m == NULL)
1928                         return;
1929         }
1930
1931         LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1932                 dst_if = bif->bif_ifp;
1933                 if (dst_if == src_if)
1934                         continue;
1935
1936                 if (bif->bif_flags & IFBIF_STP) {
1937                         switch (bif->bif_state) {
1938                         case BSTP_IFSTATE_BLOCKING:
1939                         case BSTP_IFSTATE_DISABLED:
1940                                 continue;
1941                         }
1942                 }
1943
1944                 if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1945                     (m->m_flags & (M_BCAST|M_MCAST)) == 0)
1946                         continue;
1947
1948                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
1949                         continue;
1950
1951                 if (LIST_NEXT(bif, bif_next) == NULL) {
1952                         mc = m;
1953                         used = 1;
1954                 } else {
1955                         mc = m_copypacket(m, MB_DONTWAIT);
1956                         if (mc == NULL) {
1957                                 sc->sc_ifp->if_oerrors++;
1958                                 continue;
1959                         }
1960                 }
1961                 bridge_pfil_enqueue(dst_if, mc, runfilt);
1962         }
1963         if (used == 0)
1964                 m_freem(m);
1965 }
1966
1967 /*
1968  * bridge_span:
1969  *
1970  *      Duplicate a packet out one or more interfaces that are in span mode,
1971  *      the original mbuf is unmodified.
1972  */
1973 static void
1974 bridge_span(struct bridge_softc *sc, struct mbuf *m)
1975 {
1976         struct bridge_iflist *bif;
1977         struct ifnet *dst_if;
1978         struct mbuf *mc;
1979
1980         if (LIST_EMPTY(&sc->sc_spanlist))
1981                 return;
1982
1983         LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1984                 dst_if = bif->bif_ifp;
1985
1986                 if ((dst_if->if_flags & IFF_RUNNING) == 0)
1987                         continue;
1988
1989                 mc = m_copypacket(m, MB_DONTWAIT);
1990                 if (mc == NULL) {
1991                         sc->sc_ifp->if_oerrors++;
1992                         continue;
1993                 }
1994
1995                 bridge_enqueue(dst_if, mc);
1996         }
1997 }
1998
1999 /*
2000  * bridge_rtupdate:
2001  *
2002  *      Add a bridge routing entry.
2003  *      Can be called from interrupt context.
2004  */
2005 static int
2006 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2007     struct ifnet *dst_if, int setflags, uint8_t flags)
2008 {
2009         struct bridge_rtnode *brt;
2010         int error;
2011
2012         /*
2013          * A route for this destination might already exist.  If so,
2014          * update it, otherwise create a new one.
2015          */
2016         if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2017                 if (sc->sc_brtcnt >= sc->sc_brtmax)
2018                         return (ENOSPC);
2019
2020                 /*
2021                  * Allocate a new bridge forwarding node, and
2022                  * initialize the expiration time and Ethernet
2023                  * address.
2024                  */
2025                 brt = kmalloc(sizeof(struct bridge_rtnode), M_DEVBUF,
2026                               M_INTNOWAIT|M_ZERO);
2027                 if (brt == NULL)
2028                         return (ENOMEM);
2029
2030                 brt->brt_flags = IFBAF_DYNAMIC;
2031                 memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2032
2033                 if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2034                         kfree(brt, M_DEVBUF);
2035                         return (error);
2036                 }
2037         }
2038
2039         if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2040                 brt->brt_ifp = dst_if;
2041         if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2042                 brt->brt_expire = time_second + sc->sc_brttimeout;
2043         if (setflags)
2044                 brt->brt_flags = flags;
2045
2046         return (0);
2047 }
2048
2049 /*
2050  * bridge_rtlookup:
2051  *
2052  *      Lookup the destination interface for an address.
2053  */
2054 static struct ifnet *
2055 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2056 {
2057         struct bridge_rtnode *brt;
2058
2059         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2060                 return (NULL);
2061
2062         return (brt->brt_ifp);
2063 }
2064
2065 /*
2066  * bridge_rttrim:
2067  *
2068  *      Trim the routine table so that we have a number
2069  *      of routing entries less than or equal to the
2070  *      maximum number.
2071  */
2072 static void
2073 bridge_rttrim(struct bridge_softc *sc)
2074 {
2075         struct bridge_rtnode *brt, *nbrt;
2076
2077         /* Make sure we actually need to do this. */
2078         if (sc->sc_brtcnt <= sc->sc_brtmax)
2079                 return;
2080
2081         /* Force an aging cycle; this might trim enough addresses. */
2082         bridge_rtage(sc);
2083         if (sc->sc_brtcnt <= sc->sc_brtmax)
2084                 return;
2085
2086         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2087                 nbrt = LIST_NEXT(brt, brt_list);
2088                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2089                         bridge_rtnode_destroy(sc, brt);
2090                         if (sc->sc_brtcnt <= sc->sc_brtmax)
2091                                 return;
2092                 }
2093         }
2094 }
2095
2096 /*
2097  * bridge_timer:
2098  *
2099  *      Aging timer for the bridge.
2100  */
2101 static void
2102 bridge_timer(void *arg)
2103 {
2104         struct bridge_softc *sc = arg;
2105
2106         lwkt_serialize_enter(sc->sc_ifp->if_serializer);
2107
2108         bridge_rtage(sc);
2109
2110         if (sc->sc_ifp->if_flags & IFF_RUNNING)
2111                 callout_reset(&sc->sc_brcallout,
2112                     bridge_rtable_prune_period * hz, bridge_timer, sc);
2113
2114         lwkt_serialize_exit(sc->sc_ifp->if_serializer);
2115 }
2116
2117 /*
2118  * bridge_rtage:
2119  *
2120  *      Perform an aging cycle.
2121  */
2122 static void
2123 bridge_rtage(struct bridge_softc *sc)
2124 {
2125         struct bridge_rtnode *brt, *nbrt;
2126
2127         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2128                 nbrt = LIST_NEXT(brt, brt_list);
2129                 if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2130                         if (time_second >= brt->brt_expire)
2131                                 bridge_rtnode_destroy(sc, brt);
2132                 }
2133         }
2134 }
2135
2136 /*
2137  * bridge_rtflush:
2138  *
2139  *      Remove all dynamic addresses from the bridge.
2140  */
2141 static void
2142 bridge_rtflush(struct bridge_softc *sc, int full)
2143 {
2144         struct bridge_rtnode *brt, *nbrt;
2145
2146         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2147                 nbrt = LIST_NEXT(brt, brt_list);
2148                 if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2149                         bridge_rtnode_destroy(sc, brt);
2150         }
2151 }
2152
2153 /*
2154  * bridge_rtdaddr:
2155  *
2156  *      Remove an address from the table.
2157  */
2158 static int
2159 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2160 {
2161         struct bridge_rtnode *brt;
2162
2163         if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2164                 return (ENOENT);
2165
2166         bridge_rtnode_destroy(sc, brt);
2167         return (0);
2168 }
2169
2170 /*
2171  * bridge_rtdelete:
2172  *
2173  *      Delete routes to a speicifc member interface.
2174  */
2175 void
2176 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2177 {
2178         struct bridge_rtnode *brt, *nbrt;
2179
2180         for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2181                 nbrt = LIST_NEXT(brt, brt_list);
2182                 if (brt->brt_ifp == ifp && (full ||
2183                             (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2184                         bridge_rtnode_destroy(sc, brt);
2185         }
2186 }
2187
2188 /*
2189  * bridge_rtable_init:
2190  *
2191  *      Initialize the route table for this bridge.
2192  */
2193 static int
2194 bridge_rtable_init(struct bridge_softc *sc)
2195 {
2196         int i;
2197
2198         sc->sc_rthash = kmalloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2199             M_DEVBUF, M_WAITOK);
2200
2201         for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2202                 LIST_INIT(&sc->sc_rthash[i]);
2203
2204         sc->sc_rthash_key = karc4random();
2205
2206         LIST_INIT(&sc->sc_rtlist);
2207
2208         return (0);
2209 }
2210
2211 /*
2212  * bridge_rtable_fini:
2213  *
2214  *      Deconstruct the route table for this bridge.
2215  */
2216 static void
2217 bridge_rtable_fini(struct bridge_softc *sc)
2218 {
2219
2220         kfree(sc->sc_rthash, M_DEVBUF);
2221 }
2222
2223 /*
2224  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2225  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2226  */
2227 #define mix(a, b, c)                                                    \
2228 do {                                                                    \
2229         a -= b; a -= c; a ^= (c >> 13);                                 \
2230         b -= c; b -= a; b ^= (a << 8);                                  \
2231         c -= a; c -= b; c ^= (b >> 13);                                 \
2232         a -= b; a -= c; a ^= (c >> 12);                                 \
2233         b -= c; b -= a; b ^= (a << 16);                                 \
2234         c -= a; c -= b; c ^= (b >> 5);                                  \
2235         a -= b; a -= c; a ^= (c >> 3);                                  \
2236         b -= c; b -= a; b ^= (a << 10);                                 \
2237         c -= a; c -= b; c ^= (b >> 15);                                 \
2238 } while (/*CONSTCOND*/0)
2239
2240 static __inline uint32_t
2241 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2242 {
2243         uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2244
2245         b += addr[5] << 8;
2246         b += addr[4];
2247         a += addr[3] << 24;
2248         a += addr[2] << 16;
2249         a += addr[1] << 8;
2250         a += addr[0];
2251
2252         mix(a, b, c);
2253
2254         return (c & BRIDGE_RTHASH_MASK);
2255 }
2256
2257 #undef mix
2258
2259 static int
2260 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2261 {
2262         int i, d;
2263
2264         for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2265                 d = ((int)a[i]) - ((int)b[i]);
2266         }
2267
2268         return (d);
2269 }
2270
2271 /*
2272  * bridge_rtnode_lookup:
2273  *
2274  *      Look up a bridge route node for the specified destination.
2275  */
2276 static struct bridge_rtnode *
2277 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2278 {
2279         struct bridge_rtnode *brt;
2280         uint32_t hash;
2281         int dir;
2282
2283         hash = bridge_rthash(sc, addr);
2284         LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2285                 dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2286                 if (dir == 0)
2287                         return (brt);
2288                 if (dir > 0)
2289                         return (NULL);
2290         }
2291
2292         return (NULL);
2293 }
2294
2295 /*
2296  * bridge_rtnode_insert:
2297  *
2298  *      Insert the specified bridge node into the route table.  We
2299  *      assume the entry is not already in the table.
2300  */
2301 static int
2302 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2303 {
2304         struct bridge_rtnode *lbrt;
2305         uint32_t hash;
2306         int dir;
2307
2308         hash = bridge_rthash(sc, brt->brt_addr);
2309
2310         lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2311         if (lbrt == NULL) {
2312                 LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2313                 goto out;
2314         }
2315
2316         do {
2317                 dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2318                 if (dir == 0)
2319                         return (EEXIST);
2320                 if (dir > 0) {
2321                         LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2322                         goto out;
2323                 }
2324                 if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2325                         LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2326                         goto out;
2327                 }
2328                 lbrt = LIST_NEXT(lbrt, brt_hash);
2329         } while (lbrt != NULL);
2330
2331 #ifdef DIAGNOSTIC
2332         panic("bridge_rtnode_insert: impossible");
2333 #endif
2334
2335 out:
2336         LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2337         sc->sc_brtcnt++;
2338
2339         return (0);
2340 }
2341
2342 /*
2343  * bridge_rtnode_destroy:
2344  *
2345  *      Destroy a bridge rtnode.
2346  */
2347 static void
2348 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2349 {
2350
2351         LIST_REMOVE(brt, brt_hash);
2352
2353         LIST_REMOVE(brt, brt_list);
2354         sc->sc_brtcnt--;
2355         kfree(brt, M_DEVBUF);
2356 }
2357
2358 /*
2359  * Send bridge packets through pfil if they are one of the types pfil can deal
2360  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2361  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2362  * that interface.
2363  */
2364 static int
2365 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2366 {
2367         int snap, error, i, hlen;
2368         struct ether_header *eh1, eh2;
2369         struct ip *ip;
2370         struct llc llc1;
2371         u_int16_t ether_type;
2372
2373         snap = 0;
2374         error = -1;     /* Default error if not error == 0 */
2375
2376         if (pfil_bridge == 0 && pfil_member == 0)
2377                 return (0); /* filtering is disabled */
2378
2379         i = min((*mp)->m_pkthdr.len, max_protohdr);
2380         if ((*mp)->m_len < i) {
2381             *mp = m_pullup(*mp, i);
2382             if (*mp == NULL) {
2383                 kprintf("%s: m_pullup failed\n", __func__);
2384                 return (-1);
2385             }
2386         }
2387
2388         eh1 = mtod(*mp, struct ether_header *);
2389         ether_type = ntohs(eh1->ether_type);
2390
2391         /*
2392          * Check for SNAP/LLC.
2393          */
2394         if (ether_type < ETHERMTU) {
2395                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2396
2397                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2398                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2399                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2400                     llc2->llc_control == LLC_UI) {
2401                         ether_type = htons(llc2->llc_un.type_snap.ether_type);
2402                         snap = 1;
2403                 }
2404         }
2405
2406         /*
2407          * If we're trying to filter bridge traffic, don't look at anything
2408          * other than IP and ARP traffic.  If the filter doesn't understand
2409          * IPv6, don't allow IPv6 through the bridge either.  This is lame
2410          * since if we really wanted, say, an AppleTalk filter, we are hosed,
2411          * but of course we don't have an AppleTalk filter to begin with.
2412          * (Note that since pfil doesn't understand ARP it will pass *ALL*
2413          * ARP traffic.)
2414          */
2415         switch (ether_type) {
2416                 case ETHERTYPE_ARP:
2417                 case ETHERTYPE_REVARP:
2418                         return (0); /* Automatically pass */
2419                 case ETHERTYPE_IP:
2420 #ifdef INET6
2421                 case ETHERTYPE_IPV6:
2422 #endif /* INET6 */
2423                         break;
2424                 default:
2425                         /*
2426                          * Check to see if the user wants to pass non-ip
2427                          * packets, these will not be checked by pfil(9) and
2428                          * passed unconditionally so the default is to drop.
2429                          */
2430                         if (pfil_onlyip)
2431                                 goto bad;
2432         }
2433
2434         /* Strip off the Ethernet header and keep a copy. */
2435         m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2436         m_adj(*mp, ETHER_HDR_LEN);
2437
2438         /* Strip off snap header, if present */
2439         if (snap) {
2440                 m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2441                 m_adj(*mp, sizeof(struct llc));
2442         }
2443
2444         /*
2445          * Check the IP header for alignment and errors
2446          */
2447         if (dir == PFIL_IN) {
2448                 switch (ether_type) {
2449                         case ETHERTYPE_IP:
2450                                 error = bridge_ip_checkbasic(mp);
2451                                 break;
2452 #ifdef INET6
2453                         case ETHERTYPE_IPV6:
2454                                 error = bridge_ip6_checkbasic(mp);
2455                                 break;
2456 #endif /* INET6 */
2457                         default:
2458                                 error = 0;
2459                 }
2460                 if (error)
2461                         goto bad;
2462         }
2463
2464         error = 0;
2465
2466         /*
2467          * Run the packet through pfil
2468          */
2469         switch (ether_type)
2470         {
2471         case ETHERTYPE_IP :
2472                 /*
2473                  * before calling the firewall, swap fields the same as
2474                  * IP does. here we assume the header is contiguous
2475                  */
2476                 ip = mtod(*mp, struct ip *);
2477
2478                 ip->ip_len = ntohs(ip->ip_len);
2479                 ip->ip_off = ntohs(ip->ip_off);
2480
2481                 /*
2482                  * Run pfil on the member interface and the bridge, both can
2483                  * be skipped by clearing pfil_member or pfil_bridge.
2484                  *
2485                  * Keep the order:
2486                  *   in_if -> bridge_if -> out_if
2487                  */
2488                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2489                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2490                                         dir);
2491
2492                 if (*mp == NULL || error != 0) /* filter may consume */
2493                         break;
2494
2495                 if (pfil_member && ifp != NULL)
2496                         error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2497                                         dir);
2498
2499                 if (*mp == NULL || error != 0) /* filter may consume */
2500                         break;
2501
2502                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2503                         error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2504                                         dir);
2505
2506                 if (*mp == NULL || error != 0) /* filter may consume */
2507                         break;
2508
2509                 /* check if we need to fragment the packet */
2510                 if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2511                         i = (*mp)->m_pkthdr.len;
2512                         if (i > ifp->if_mtu) {
2513                                 error = bridge_fragment(ifp, *mp, &eh2, snap,
2514                                             &llc1);
2515                                 return (error);
2516                         }
2517                 }
2518
2519                 /* Recalculate the ip checksum and restore byte ordering */
2520                 ip = mtod(*mp, struct ip *);
2521                 hlen = ip->ip_hl << 2;
2522                 if (hlen < sizeof(struct ip))
2523                         goto bad;
2524                 if (hlen > (*mp)->m_len) {
2525                         if ((*mp = m_pullup(*mp, hlen)) == 0)
2526                                 goto bad;
2527                         ip = mtod(*mp, struct ip *);
2528                         if (ip == NULL)
2529                                 goto bad;
2530                 }
2531                 ip->ip_len = htons(ip->ip_len);
2532                 ip->ip_off = htons(ip->ip_off);
2533                 ip->ip_sum = 0;
2534                 if (hlen == sizeof(struct ip))
2535                         ip->ip_sum = in_cksum_hdr(ip);
2536                 else
2537                         ip->ip_sum = in_cksum(*mp, hlen);
2538
2539                 break;
2540 #ifdef INET6
2541         case ETHERTYPE_IPV6 :
2542                 if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2543                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2544                                         dir);
2545
2546                 if (*mp == NULL || error != 0) /* filter may consume */
2547                         break;
2548
2549                 if (pfil_member && ifp != NULL)
2550                         error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2551                                         dir);
2552
2553                 if (*mp == NULL || error != 0) /* filter may consume */
2554                         break;
2555
2556                 if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2557                         error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2558                                         dir);
2559                 break;
2560 #endif
2561         default :
2562                 error = 0;
2563                 break;
2564         }
2565
2566         if (*mp == NULL)
2567                 return (error);
2568         if (error != 0)
2569                 goto bad;
2570
2571         error = -1;
2572
2573         /*
2574          * Finally, put everything back the way it was and return
2575          */
2576         if (snap) {
2577                 M_PREPEND(*mp, sizeof(struct llc), MB_DONTWAIT);
2578                 if (*mp == NULL)
2579                         return (error);
2580                 bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2581         }
2582
2583         M_PREPEND(*mp, ETHER_HDR_LEN, MB_DONTWAIT);
2584         if (*mp == NULL)
2585                 return (error);
2586         bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2587
2588         return (0);
2589
2590 bad:
2591         m_freem(*mp);
2592         *mp = NULL;
2593         return (error);
2594 }
2595
2596 /*
2597  * Perform basic checks on header size since
2598  * pfil assumes ip_input has already processed
2599  * it for it.  Cut-and-pasted from ip_input.c.
2600  * Given how simple the IPv6 version is,
2601  * does the IPv4 version really need to be
2602  * this complicated?
2603  *
2604  * XXX Should we update ipstat here, or not?
2605  * XXX Right now we update ipstat but not
2606  * XXX csum_counter.
2607  */
2608 static int
2609 bridge_ip_checkbasic(struct mbuf **mp)
2610 {
2611         struct mbuf *m = *mp;
2612         struct ip *ip;
2613         int len, hlen;
2614         u_short sum;
2615
2616         if (*mp == NULL)
2617                 return (-1);
2618 #if notyet
2619         if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2620                 if ((m = m_copyup(m, sizeof(struct ip),
2621                         (max_linkhdr + 3) & ~3)) == NULL) {
2622                         /* XXXJRT new stat, please */
2623                         ipstat.ips_toosmall++;
2624                         goto bad;
2625                 }
2626         } else
2627 #endif
2628 #ifndef __predict_false
2629 #define __predict_false(x) x
2630 #endif
2631          if (__predict_false(m->m_len < sizeof (struct ip))) {
2632                 if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2633                         ipstat.ips_toosmall++;
2634                         goto bad;
2635                 }
2636         }
2637         ip = mtod(m, struct ip *);
2638         if (ip == NULL) goto bad;
2639
2640         if (ip->ip_v != IPVERSION) {
2641                 ipstat.ips_badvers++;
2642                 goto bad;
2643         }
2644         hlen = ip->ip_hl << 2;
2645         if (hlen < sizeof(struct ip)) { /* minimum header length */
2646                 ipstat.ips_badhlen++;
2647                 goto bad;
2648         }
2649         if (hlen > m->m_len) {
2650                 if ((m = m_pullup(m, hlen)) == 0) {
2651                         ipstat.ips_badhlen++;
2652                         goto bad;
2653                 }
2654                 ip = mtod(m, struct ip *);
2655                 if (ip == NULL) goto bad;
2656         }
2657
2658         if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2659                 sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2660         } else {
2661                 if (hlen == sizeof(struct ip)) {
2662                         sum = in_cksum_hdr(ip);
2663                 } else {
2664                         sum = in_cksum(m, hlen);
2665                 }
2666         }
2667         if (sum) {
2668                 ipstat.ips_badsum++;
2669                 goto bad;
2670         }
2671
2672         /* Retrieve the packet length. */
2673         len = ntohs(ip->ip_len);
2674
2675         /*
2676          * Check for additional length bogosity
2677          */
2678         if (len < hlen) {
2679                 ipstat.ips_badlen++;
2680                 goto bad;
2681         }
2682
2683         /*
2684          * Check that the amount of data in the buffers
2685          * is as at least much as the IP header would have us expect.
2686          * Drop packet if shorter than we expect.
2687          */
2688         if (m->m_pkthdr.len < len) {
2689                 ipstat.ips_tooshort++;
2690                 goto bad;
2691         }
2692
2693         /* Checks out, proceed */
2694         *mp = m;
2695         return (0);
2696
2697 bad:
2698         *mp = m;
2699         return (-1);
2700 }
2701
2702 #ifdef INET6
2703 /*
2704  * Same as above, but for IPv6.
2705  * Cut-and-pasted from ip6_input.c.
2706  * XXX Should we update ip6stat, or not?
2707  */
2708 static int
2709 bridge_ip6_checkbasic(struct mbuf **mp)
2710 {
2711         struct mbuf *m = *mp;
2712         struct ip6_hdr *ip6;
2713
2714         /*
2715          * If the IPv6 header is not aligned, slurp it up into a new
2716          * mbuf with space for link headers, in the event we forward
2717          * it.  Otherwise, if it is aligned, make sure the entire base
2718          * IPv6 header is in the first mbuf of the chain.
2719          */
2720 #if notyet
2721         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2722                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2723                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2724                             (max_linkhdr + 3) & ~3)) == NULL) {
2725                         /* XXXJRT new stat, please */
2726                         ip6stat.ip6s_toosmall++;
2727                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2728                         goto bad;
2729                 }
2730         } else
2731 #endif
2732         if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2733                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2734                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2735                         ip6stat.ip6s_toosmall++;
2736                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2737                         goto bad;
2738                 }
2739         }
2740
2741         ip6 = mtod(m, struct ip6_hdr *);
2742
2743         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2744                 ip6stat.ip6s_badvers++;
2745                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2746                 goto bad;
2747         }
2748
2749         /* Checks out, proceed */
2750         *mp = m;
2751         return (0);
2752
2753 bad:
2754         *mp = m;
2755         return (-1);
2756 }
2757 #endif /* INET6 */
2758
2759 /*
2760  * bridge_fragment:
2761  *
2762  *      Return a fragmented mbuf chain.
2763  */
2764 static int
2765 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
2766     int snap, struct llc *llc)
2767 {
2768         struct mbuf *m0;
2769         struct ip *ip;
2770         int error = -1;
2771
2772         if (m->m_len < sizeof(struct ip) &&
2773             (m = m_pullup(m, sizeof(struct ip))) == NULL)
2774                 goto out;
2775         ip = mtod(m, struct ip *);
2776
2777         error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
2778                     CSUM_DELAY_IP);
2779         if (error)
2780                 goto out;
2781
2782         /* walk the chain and re-add the Ethernet header */
2783         for (m0 = m; m0; m0 = m0->m_nextpkt) {
2784                 if (error == 0) {
2785                         if (snap) {
2786                                 M_PREPEND(m0, sizeof(struct llc), MB_DONTWAIT);
2787                                 if (m0 == NULL) {
2788                                         error = ENOBUFS;
2789                                         continue;
2790                                 }
2791                                 bcopy(llc, mtod(m0, caddr_t),
2792                                     sizeof(struct llc));
2793                         }
2794                         M_PREPEND(m0, ETHER_HDR_LEN, MB_DONTWAIT);
2795                         if (m0 == NULL) {
2796                                 error = ENOBUFS;
2797                                 continue;
2798                         }
2799                         bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
2800                 } else
2801                         m_freem(m);
2802         }
2803
2804         if (error == 0)
2805                 ipstat.ips_fragmented++;
2806
2807         return (error);
2808
2809 out:
2810         if (m != NULL)
2811                 m_freem(m);
2812         return (error);
2813 }
2814
2815 static void
2816 bridge_enqueue_handler(struct netmsg *nmsg)
2817 {
2818         struct netmsg_packet *nmp;
2819         struct ifnet *dst_ifp;
2820         struct mbuf *m;
2821
2822         nmp = (struct netmsg_packet *)nmsg;
2823         m = nmp->nm_packet;
2824         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2825
2826         bridge_handoff_notags(dst_ifp, m);
2827 }
2828
2829 static void
2830 bridge_pfil_enqueue_handler(struct netmsg *nmsg)
2831 {
2832         struct netmsg_packet *nmp;
2833         struct ifnet *dst_ifp;
2834         struct mbuf *m;
2835
2836         nmp = (struct netmsg_packet *)nmsg;
2837         m = nmp->nm_packet;
2838         dst_ifp = nmp->nm_netmsg.nm_lmsg.u.ms_resultp;
2839
2840         /*
2841          * Filter on the output interface. Pass a NULL bridge interface
2842          * pointer so we do not redundantly filter on the bridge for
2843          * each interface we broadcast on.
2844          */
2845         if (inet_pfil_hook.ph_hashooks > 0
2846 #ifdef INET6
2847             || inet6_pfil_hook.ph_hashooks > 0
2848 #endif
2849             ) {
2850                 if (bridge_pfil(&m, NULL, dst_ifp, PFIL_OUT) != 0)
2851                         return;
2852                 if (m == NULL)
2853                         return;
2854         }
2855         bridge_handoff_notags(dst_ifp, m);
2856 }
2857
2858 static void
2859 bridge_handoff(struct ifnet *dst_ifp, struct mbuf *m)
2860 {
2861         while (m->m_type == MT_TAG) {
2862                 /* XXX see ether_output_frame for full rules check */
2863                 m = m->m_next;
2864         }
2865         bridge_handoff_notags(dst_ifp, m);
2866 }
2867
2868 static void
2869 bridge_handoff_notags(struct ifnet *dst_ifp, struct mbuf *m)
2870 {
2871         struct mbuf *m0;
2872
2873         KKASSERT(m->m_type != MT_TAG);
2874
2875         lwkt_serialize_enter(dst_ifp->if_serializer);
2876
2877         /* We may be sending a fragment so traverse the mbuf */
2878         for (; m; m = m0) {
2879                 struct altq_pktattr pktattr;
2880
2881                 m0 = m->m_nextpkt;
2882                 m->m_nextpkt = NULL;
2883
2884                 if (ifq_is_enabled(&dst_ifp->if_snd))
2885                         altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
2886
2887                 ifq_handoff(dst_ifp, m, &pktattr);
2888         }
2889
2890         lwkt_serialize_exit(dst_ifp->if_serializer);
2891 }