xref: /freebsd/sys/net/if_bridge.c (revision 7aa383846770374466b1dcb2cefd71bde9acf463)
1 /*	$NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  *
51  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
53  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
54  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
55  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
56  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
57  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
58  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
59  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
60  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
61  * POSSIBILITY OF SUCH DAMAGE.
62  *
63  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
64  */
65 
66 /*
67  * Network interface bridge support.
68  *
69  * TODO:
70  *
71  *	- Currently only supports Ethernet-like interfaces (Ethernet,
72  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
73  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
74  *	  consider heterogenous bridges).
75  */
76 
77 #include <sys/cdefs.h>
78 __FBSDID("$FreeBSD$");
79 
80 #include "opt_inet.h"
81 #include "opt_inet6.h"
82 #include "opt_carp.h"
83 
84 #include <sys/param.h>
85 #include <sys/mbuf.h>
86 #include <sys/malloc.h>
87 #include <sys/protosw.h>
88 #include <sys/systm.h>
89 #include <sys/time.h>
90 #include <sys/socket.h> /* for net/if.h */
91 #include <sys/sockio.h>
92 #include <sys/ctype.h>  /* string functions */
93 #include <sys/kernel.h>
94 #include <sys/random.h>
95 #include <sys/syslog.h>
96 #include <sys/sysctl.h>
97 #include <vm/uma.h>
98 #include <sys/module.h>
99 #include <sys/priv.h>
100 #include <sys/proc.h>
101 #include <sys/lock.h>
102 #include <sys/mutex.h>
103 #include <sys/rwlock.h>
104 
105 #include <net/bpf.h>
106 #include <net/if.h>
107 #include <net/if_clone.h>
108 #include <net/if_dl.h>
109 #include <net/if_types.h>
110 #include <net/if_var.h>
111 #include <net/pfil.h>
112 #include <net/vnet.h>
113 
114 #include <netinet/in.h> /* for struct arpcom */
115 #include <netinet/in_systm.h>
116 #include <netinet/in_var.h>
117 #include <netinet/ip.h>
118 #include <netinet/ip_var.h>
119 #ifdef INET6
120 #include <netinet/ip6.h>
121 #include <netinet6/ip6_var.h>
122 #endif
123 #if defined(INET) || defined(INET6)
124 #ifdef DEV_CARP
125 #include <netinet/ip_carp.h>
126 #endif
127 #endif
128 #include <machine/in_cksum.h>
129 #include <netinet/if_ether.h> /* for struct arpcom */
130 #include <net/bridgestp.h>
131 #include <net/if_bridgevar.h>
132 #include <net/if_llc.h>
133 #include <net/if_vlan_var.h>
134 
135 #include <net/route.h>
136 #include <netinet/ip_fw.h>
137 #include <netinet/ipfw/ip_fw_private.h>
138 
139 /*
140  * Size of the route hash table.  Must be a power of two.
141  */
142 #ifndef BRIDGE_RTHASH_SIZE
143 #define	BRIDGE_RTHASH_SIZE		1024
144 #endif
145 
146 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
147 
148 /*
149  * Maximum number of addresses to cache.
150  */
151 #ifndef BRIDGE_RTABLE_MAX
152 #define	BRIDGE_RTABLE_MAX		100
153 #endif
154 
155 /*
156  * Timeout (in seconds) for entries learned dynamically.
157  */
158 #ifndef BRIDGE_RTABLE_TIMEOUT
159 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
160 #endif
161 
162 /*
163  * Number of seconds between walks of the route list.
164  */
165 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
166 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
167 #endif
168 
169 /*
170  * List of capabilities to possibly mask on the member interface.
171  */
172 #define	BRIDGE_IFCAPS_MASK		(IFCAP_TOE|IFCAP_TSO|IFCAP_TXCSUM)
173 
174 /*
175  * List of capabilities to strip
176  */
177 #define	BRIDGE_IFCAPS_STRIP		IFCAP_LRO
178 
179 /*
180  * Bridge interface list entry.
181  */
182 struct bridge_iflist {
183 	LIST_ENTRY(bridge_iflist) bif_next;
184 	struct ifnet		*bif_ifp;	/* member if */
185 	struct bstp_port	bif_stp;	/* STP state */
186 	uint32_t		bif_flags;	/* member if flags */
187 	int			bif_savedcaps;	/* saved capabilities */
188 	uint32_t		bif_addrmax;	/* max # of addresses */
189 	uint32_t		bif_addrcnt;	/* cur. # of addresses */
190 	uint32_t		bif_addrexceeded;/* # of address violations */
191 };
192 
193 /*
194  * Bridge route node.
195  */
196 struct bridge_rtnode {
197 	LIST_ENTRY(bridge_rtnode) brt_hash;	/* hash table linkage */
198 	LIST_ENTRY(bridge_rtnode) brt_list;	/* list linkage */
199 	struct bridge_iflist	*brt_dst;	/* destination if */
200 	unsigned long		brt_expire;	/* expiration time */
201 	uint8_t			brt_flags;	/* address flags */
202 	uint8_t			brt_addr[ETHER_ADDR_LEN];
203 	uint16_t		brt_vlan;	/* vlan id */
204 };
205 #define	brt_ifp			brt_dst->bif_ifp
206 
207 /*
208  * Software state for each bridge.
209  */
210 struct bridge_softc {
211 	struct ifnet		*sc_ifp;	/* make this an interface */
212 	LIST_ENTRY(bridge_softc) sc_list;
213 	struct mtx		sc_mtx;
214 	struct cv		sc_cv;
215 	uint32_t		sc_brtmax;	/* max # of addresses */
216 	uint32_t		sc_brtcnt;	/* cur. # of addresses */
217 	uint32_t		sc_brttimeout;	/* rt timeout in seconds */
218 	struct callout		sc_brcallout;	/* bridge callout */
219 	uint32_t		sc_iflist_ref;	/* refcount for sc_iflist */
220 	uint32_t		sc_iflist_xcnt;	/* refcount for sc_iflist */
221 	LIST_HEAD(, bridge_iflist) sc_iflist;	/* member interface list */
222 	LIST_HEAD(, bridge_rtnode) *sc_rthash;	/* our forwarding table */
223 	LIST_HEAD(, bridge_rtnode) sc_rtlist;	/* list version of above */
224 	uint32_t		sc_rthash_key;	/* key for hash */
225 	LIST_HEAD(, bridge_iflist) sc_spanlist;	/* span ports list */
226 	struct bstp_state	sc_stp;		/* STP state */
227 	uint32_t		sc_brtexceeded;	/* # of cache drops */
228 	struct ifnet		*sc_ifaddr;	/* member mac copied from */
229 	u_char			sc_defaddr[6];	/* Default MAC address */
230 };
231 
232 static struct mtx 	bridge_list_mtx;
233 eventhandler_tag	bridge_detach_cookie = NULL;
234 
235 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
236 
237 uma_zone_t bridge_rtnode_zone;
238 
239 static int	bridge_clone_create(struct if_clone *, int, caddr_t);
240 static void	bridge_clone_destroy(struct ifnet *);
241 
242 static int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
243 static void	bridge_mutecaps(struct bridge_softc *);
244 static void	bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
245 		    int);
246 static void	bridge_ifdetach(void *arg __unused, struct ifnet *);
247 static void	bridge_init(void *);
248 static void	bridge_dummynet(struct mbuf *, struct ifnet *);
249 static void	bridge_stop(struct ifnet *, int);
250 static void	bridge_start(struct ifnet *);
251 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
252 static int	bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
253 		    struct rtentry *);
254 static void	bridge_enqueue(struct bridge_softc *, struct ifnet *,
255 		    struct mbuf *);
256 static void	bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
257 
258 static void	bridge_forward(struct bridge_softc *, struct bridge_iflist *,
259 		    struct mbuf *m);
260 
261 static void	bridge_timer(void *);
262 
263 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
264 		    struct mbuf *, int);
265 static void	bridge_span(struct bridge_softc *, struct mbuf *);
266 
267 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
268 		    uint16_t, struct bridge_iflist *, int, uint8_t);
269 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *,
270 		    uint16_t);
271 static void	bridge_rttrim(struct bridge_softc *);
272 static void	bridge_rtage(struct bridge_softc *);
273 static void	bridge_rtflush(struct bridge_softc *, int);
274 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *,
275 		    uint16_t);
276 
277 static int	bridge_rtable_init(struct bridge_softc *);
278 static void	bridge_rtable_fini(struct bridge_softc *);
279 
280 static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
281 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
282 		    const uint8_t *, uint16_t);
283 static int	bridge_rtnode_insert(struct bridge_softc *,
284 		    struct bridge_rtnode *);
285 static void	bridge_rtnode_destroy(struct bridge_softc *,
286 		    struct bridge_rtnode *);
287 static void	bridge_rtable_expire(struct ifnet *, int);
288 static void	bridge_state_change(struct ifnet *, int);
289 
290 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
291 		    const char *name);
292 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
293 		    struct ifnet *ifp);
294 static void	bridge_delete_member(struct bridge_softc *,
295 		    struct bridge_iflist *, int);
296 static void	bridge_delete_span(struct bridge_softc *,
297 		    struct bridge_iflist *);
298 
299 static int	bridge_ioctl_add(struct bridge_softc *, void *);
300 static int	bridge_ioctl_del(struct bridge_softc *, void *);
301 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
302 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
303 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
304 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
305 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
306 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
307 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
308 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
309 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
310 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
311 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
312 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
313 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
314 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
315 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
316 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
317 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
318 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
319 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
320 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
321 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
322 static int	bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *);
323 static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
324 static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
325 static int	bridge_ioctl_gbparam(struct bridge_softc *, void *);
326 static int	bridge_ioctl_grte(struct bridge_softc *, void *);
327 static int	bridge_ioctl_gifsstp(struct bridge_softc *, void *);
328 static int	bridge_ioctl_sproto(struct bridge_softc *, void *);
329 static int	bridge_ioctl_stxhc(struct bridge_softc *, void *);
330 static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
331 		    int);
332 static int	bridge_ip_checkbasic(struct mbuf **mp);
333 #ifdef INET6
334 static int	bridge_ip6_checkbasic(struct mbuf **mp);
335 #endif /* INET6 */
336 static int	bridge_fragment(struct ifnet *, struct mbuf *,
337 		    struct ether_header *, int, struct llc *);
338 
339 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
340 #define	VLANTAGOF(_m)	\
341     (_m->m_flags & M_VLANTAG) ? EVL_VLANOFTAG(_m->m_pkthdr.ether_vtag) : 1
342 
343 static struct bstp_cb_ops bridge_ops = {
344 	.bcb_state = bridge_state_change,
345 	.bcb_rtage = bridge_rtable_expire
346 };
347 
348 SYSCTL_DECL(_net_link);
349 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
350 
351 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
352 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
353 static int pfil_member = 1; /* run pfil hooks on the member interface */
354 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
355 static int pfil_ipfw_arp = 0;   /* layer2 filter with ipfw */
356 static int pfil_local_phys = 0; /* run pfil hooks on the physical interface for
357                                    locally destined packets */
358 static int log_stp   = 0;   /* log STP state changes */
359 static int bridge_inherit_mac = 0;   /* share MAC with first bridge member */
360 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
361     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
362 SYSCTL_INT(_net_link_bridge, OID_AUTO, ipfw_arp, CTLFLAG_RW,
363     &pfil_ipfw_arp, 0, "Filter ARP packets through IPFW layer2");
364 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
365     &pfil_bridge, 0, "Packet filter on the bridge interface");
366 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
367     &pfil_member, 0, "Packet filter on the member interface");
368 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_local_phys, CTLFLAG_RW,
369     &pfil_local_phys, 0,
370     "Packet filter on the physical interface for locally destined packets");
371 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
372     &log_stp, 0, "Log STP state changes");
373 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac, CTLFLAG_RW,
374     &bridge_inherit_mac, 0,
375     "Inherit MAC address from the first bridge member");
376 
377 struct bridge_control {
378 	int	(*bc_func)(struct bridge_softc *, void *);
379 	int	bc_argsize;
380 	int	bc_flags;
381 };
382 
383 #define	BC_F_COPYIN		0x01	/* copy arguments in */
384 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
385 #define	BC_F_SUSER		0x04	/* do super-user check */
386 
387 const struct bridge_control bridge_control_table[] = {
388 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
389 	  BC_F_COPYIN|BC_F_SUSER },
390 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
391 	  BC_F_COPYIN|BC_F_SUSER },
392 
393 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
394 	  BC_F_COPYIN|BC_F_COPYOUT },
395 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
396 	  BC_F_COPYIN|BC_F_SUSER },
397 
398 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
399 	  BC_F_COPYIN|BC_F_SUSER },
400 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
401 	  BC_F_COPYOUT },
402 
403 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
404 	  BC_F_COPYIN|BC_F_COPYOUT },
405 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
406 	  BC_F_COPYIN|BC_F_COPYOUT },
407 
408 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
409 	  BC_F_COPYIN|BC_F_SUSER },
410 
411 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
412 	  BC_F_COPYIN|BC_F_SUSER },
413 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
414 	  BC_F_COPYOUT },
415 
416 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
417 	  BC_F_COPYIN|BC_F_SUSER },
418 
419 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
420 	  BC_F_COPYIN|BC_F_SUSER },
421 
422 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
423 	  BC_F_COPYOUT },
424 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
425 	  BC_F_COPYIN|BC_F_SUSER },
426 
427 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
428 	  BC_F_COPYOUT },
429 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
430 	  BC_F_COPYIN|BC_F_SUSER },
431 
432 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
433 	  BC_F_COPYOUT },
434 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
435 	  BC_F_COPYIN|BC_F_SUSER },
436 
437 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
438 	  BC_F_COPYOUT },
439 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
440 	  BC_F_COPYIN|BC_F_SUSER },
441 
442 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
443 	  BC_F_COPYIN|BC_F_SUSER },
444 
445 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
446 	  BC_F_COPYIN|BC_F_SUSER },
447 
448 	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
449 	  BC_F_COPYIN|BC_F_SUSER },
450 	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
451 	  BC_F_COPYIN|BC_F_SUSER },
452 
453 	{ bridge_ioctl_gbparam,		sizeof(struct ifbropreq),
454 	  BC_F_COPYOUT },
455 
456 	{ bridge_ioctl_grte,		sizeof(struct ifbrparam),
457 	  BC_F_COPYOUT },
458 
459 	{ bridge_ioctl_gifsstp,		sizeof(struct ifbpstpconf),
460 	  BC_F_COPYIN|BC_F_COPYOUT },
461 
462 	{ bridge_ioctl_sproto,		sizeof(struct ifbrparam),
463 	  BC_F_COPYIN|BC_F_SUSER },
464 
465 	{ bridge_ioctl_stxhc,		sizeof(struct ifbrparam),
466 	  BC_F_COPYIN|BC_F_SUSER },
467 
468 	{ bridge_ioctl_sifmaxaddr,	sizeof(struct ifbreq),
469 	  BC_F_COPYIN|BC_F_SUSER },
470 
471 };
472 const int bridge_control_table_size =
473     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
474 
475 LIST_HEAD(, bridge_softc) bridge_list;
476 
477 IFC_SIMPLE_DECLARE(bridge, 0);
478 
479 static int
480 bridge_modevent(module_t mod, int type, void *data)
481 {
482 
483 	switch (type) {
484 	case MOD_LOAD:
485 		mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
486 		if_clone_attach(&bridge_cloner);
487 		bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
488 		    sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
489 		    UMA_ALIGN_PTR, 0);
490 		LIST_INIT(&bridge_list);
491 		bridge_input_p = bridge_input;
492 		bridge_output_p = bridge_output;
493 		bridge_dn_p = bridge_dummynet;
494 		bridge_detach_cookie = EVENTHANDLER_REGISTER(
495 		    ifnet_departure_event, bridge_ifdetach, NULL,
496 		    EVENTHANDLER_PRI_ANY);
497 		break;
498 	case MOD_UNLOAD:
499 		EVENTHANDLER_DEREGISTER(ifnet_departure_event,
500 		    bridge_detach_cookie);
501 		if_clone_detach(&bridge_cloner);
502 		uma_zdestroy(bridge_rtnode_zone);
503 		bridge_input_p = NULL;
504 		bridge_output_p = NULL;
505 		bridge_dn_p = NULL;
506 		mtx_destroy(&bridge_list_mtx);
507 		break;
508 	default:
509 		return (EOPNOTSUPP);
510 	}
511 	return (0);
512 }
513 
514 static moduledata_t bridge_mod = {
515 	"if_bridge",
516 	bridge_modevent,
517 	0
518 };
519 
520 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
521 MODULE_DEPEND(if_bridge, bridgestp, 1, 1, 1);
522 
523 /*
524  * handler for net.link.bridge.pfil_ipfw
525  */
526 static int
527 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
528 {
529 	int enable = pfil_ipfw;
530 	int error;
531 
532 	error = sysctl_handle_int(oidp, &enable, 0, req);
533 	enable = (enable) ? 1 : 0;
534 
535 	if (enable != pfil_ipfw) {
536 		pfil_ipfw = enable;
537 
538 		/*
539 		 * Disable pfil so that ipfw doesnt run twice, if the user
540 		 * really wants both then they can re-enable pfil_bridge and/or
541 		 * pfil_member. Also allow non-ip packets as ipfw can filter by
542 		 * layer2 type.
543 		 */
544 		if (pfil_ipfw) {
545 			pfil_onlyip = 0;
546 			pfil_bridge = 0;
547 			pfil_member = 0;
548 		}
549 	}
550 
551 	return (error);
552 }
553 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
554 	    &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
555 
556 /*
557  * bridge_clone_create:
558  *
559  *	Create a new bridge instance.
560  */
561 static int
562 bridge_clone_create(struct if_clone *ifc, int unit, caddr_t params)
563 {
564 	struct bridge_softc *sc, *sc2;
565 	struct ifnet *bifp, *ifp;
566 	int retry;
567 
568 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
569 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
570 	if (ifp == NULL) {
571 		free(sc, M_DEVBUF);
572 		return (ENOSPC);
573 	}
574 
575 	BRIDGE_LOCK_INIT(sc);
576 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
577 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
578 
579 	/* Initialize our routing table. */
580 	bridge_rtable_init(sc);
581 
582 	callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
583 
584 	LIST_INIT(&sc->sc_iflist);
585 	LIST_INIT(&sc->sc_spanlist);
586 
587 	ifp->if_softc = sc;
588 	if_initname(ifp, ifc->ifc_name, unit);
589 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
590 	ifp->if_ioctl = bridge_ioctl;
591 	ifp->if_start = bridge_start;
592 	ifp->if_init = bridge_init;
593 	ifp->if_type = IFT_BRIDGE;
594 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
595 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
596 	IFQ_SET_READY(&ifp->if_snd);
597 
598 	/*
599 	 * Generate a random ethernet address with a locally administered
600 	 * address.
601 	 *
602 	 * Since we are using random ethernet addresses for the bridge, it is
603 	 * possible that we might have address collisions, so make sure that
604 	 * this hardware address isn't already in use on another bridge.
605 	 */
606 	for (retry = 1; retry != 0;) {
607 		arc4rand(sc->sc_defaddr, ETHER_ADDR_LEN, 1);
608 		sc->sc_defaddr[0] &= ~1;	/* clear multicast bit */
609 		sc->sc_defaddr[0] |= 2;		/* set the LAA bit */
610 		retry = 0;
611 		mtx_lock(&bridge_list_mtx);
612 		LIST_FOREACH(sc2, &bridge_list, sc_list) {
613 			bifp = sc2->sc_ifp;
614 			if (memcmp(sc->sc_defaddr,
615 			    IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
616 				retry = 1;
617 		}
618 		mtx_unlock(&bridge_list_mtx);
619 	}
620 
621 	bstp_attach(&sc->sc_stp, &bridge_ops);
622 	ether_ifattach(ifp, sc->sc_defaddr);
623 	/* Now undo some of the damage... */
624 	ifp->if_baudrate = 0;
625 	ifp->if_type = IFT_BRIDGE;
626 
627 	mtx_lock(&bridge_list_mtx);
628 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
629 	mtx_unlock(&bridge_list_mtx);
630 
631 	return (0);
632 }
633 
634 /*
635  * bridge_clone_destroy:
636  *
637  *	Destroy a bridge instance.
638  */
639 static void
640 bridge_clone_destroy(struct ifnet *ifp)
641 {
642 	struct bridge_softc *sc = ifp->if_softc;
643 	struct bridge_iflist *bif;
644 
645 	BRIDGE_LOCK(sc);
646 
647 	bridge_stop(ifp, 1);
648 	ifp->if_flags &= ~IFF_UP;
649 
650 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
651 		bridge_delete_member(sc, bif, 0);
652 
653 	while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
654 		bridge_delete_span(sc, bif);
655 	}
656 
657 	BRIDGE_UNLOCK(sc);
658 
659 	callout_drain(&sc->sc_brcallout);
660 
661 	mtx_lock(&bridge_list_mtx);
662 	LIST_REMOVE(sc, sc_list);
663 	mtx_unlock(&bridge_list_mtx);
664 
665 	bstp_detach(&sc->sc_stp);
666 	ether_ifdetach(ifp);
667 	if_free_type(ifp, IFT_ETHER);
668 
669 	/* Tear down the routing table. */
670 	bridge_rtable_fini(sc);
671 
672 	BRIDGE_LOCK_DESTROY(sc);
673 	free(sc, M_DEVBUF);
674 }
675 
676 /*
677  * bridge_ioctl:
678  *
679  *	Handle a control request from the operator.
680  */
681 static int
682 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
683 {
684 	struct bridge_softc *sc = ifp->if_softc;
685 	struct ifreq *ifr = (struct ifreq *)data;
686 	struct bridge_iflist *bif;
687 	struct thread *td = curthread;
688 	union {
689 		struct ifbreq ifbreq;
690 		struct ifbifconf ifbifconf;
691 		struct ifbareq ifbareq;
692 		struct ifbaconf ifbaconf;
693 		struct ifbrparam ifbrparam;
694 		struct ifbropreq ifbropreq;
695 	} args;
696 	struct ifdrv *ifd = (struct ifdrv *) data;
697 	const struct bridge_control *bc;
698 	int error = 0;
699 
700 	switch (cmd) {
701 
702 	case SIOCADDMULTI:
703 	case SIOCDELMULTI:
704 		break;
705 
706 	case SIOCGDRVSPEC:
707 	case SIOCSDRVSPEC:
708 		if (ifd->ifd_cmd >= bridge_control_table_size) {
709 			error = EINVAL;
710 			break;
711 		}
712 		bc = &bridge_control_table[ifd->ifd_cmd];
713 
714 		if (cmd == SIOCGDRVSPEC &&
715 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
716 			error = EINVAL;
717 			break;
718 		}
719 		else if (cmd == SIOCSDRVSPEC &&
720 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
721 			error = EINVAL;
722 			break;
723 		}
724 
725 		if (bc->bc_flags & BC_F_SUSER) {
726 			error = priv_check(td, PRIV_NET_BRIDGE);
727 			if (error)
728 				break;
729 		}
730 
731 		if (ifd->ifd_len != bc->bc_argsize ||
732 		    ifd->ifd_len > sizeof(args)) {
733 			error = EINVAL;
734 			break;
735 		}
736 
737 		bzero(&args, sizeof(args));
738 		if (bc->bc_flags & BC_F_COPYIN) {
739 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
740 			if (error)
741 				break;
742 		}
743 
744 		BRIDGE_LOCK(sc);
745 		error = (*bc->bc_func)(sc, &args);
746 		BRIDGE_UNLOCK(sc);
747 		if (error)
748 			break;
749 
750 		if (bc->bc_flags & BC_F_COPYOUT)
751 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
752 
753 		break;
754 
755 	case SIOCSIFFLAGS:
756 		if (!(ifp->if_flags & IFF_UP) &&
757 		    (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
758 			/*
759 			 * If interface is marked down and it is running,
760 			 * then stop and disable it.
761 			 */
762 			BRIDGE_LOCK(sc);
763 			bridge_stop(ifp, 1);
764 			BRIDGE_UNLOCK(sc);
765 		} else if ((ifp->if_flags & IFF_UP) &&
766 		    !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
767 			/*
768 			 * If interface is marked up and it is stopped, then
769 			 * start it.
770 			 */
771 			(*ifp->if_init)(sc);
772 		}
773 		break;
774 
775 	case SIOCSIFMTU:
776 		if (ifr->ifr_mtu < 576) {
777 			error = EINVAL;
778 			break;
779 		}
780 		if (LIST_EMPTY(&sc->sc_iflist)) {
781 			sc->sc_ifp->if_mtu = ifr->ifr_mtu;
782 			break;
783 		}
784 		BRIDGE_LOCK(sc);
785 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
786 			if (bif->bif_ifp->if_mtu != ifr->ifr_mtu) {
787 				log(LOG_NOTICE, "%s: invalid MTU: %lu(%s)"
788 				    " != %d\n", sc->sc_ifp->if_xname,
789 				    bif->bif_ifp->if_mtu,
790 				    bif->bif_ifp->if_xname, ifr->ifr_mtu);
791 				error = EINVAL;
792 				break;
793 			}
794 		}
795 		if (!error)
796 			sc->sc_ifp->if_mtu = ifr->ifr_mtu;
797 		BRIDGE_UNLOCK(sc);
798 		break;
799 	default:
800 		/*
801 		 * drop the lock as ether_ioctl() will call bridge_start() and
802 		 * cause the lock to be recursed.
803 		 */
804 		error = ether_ioctl(ifp, cmd, data);
805 		break;
806 	}
807 
808 	return (error);
809 }
810 
811 /*
812  * bridge_mutecaps:
813  *
814  *	Clear or restore unwanted capabilities on the member interface
815  */
816 static void
817 bridge_mutecaps(struct bridge_softc *sc)
818 {
819 	struct bridge_iflist *bif;
820 	int enabled, mask;
821 
822 	/* Initial bitmask of capabilities to test */
823 	mask = BRIDGE_IFCAPS_MASK;
824 
825 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
826 		/* Every member must support it or its disabled */
827 		mask &= bif->bif_savedcaps;
828 	}
829 
830 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
831 		enabled = bif->bif_ifp->if_capenable;
832 		enabled &= ~BRIDGE_IFCAPS_STRIP;
833 		/* strip off mask bits and enable them again if allowed */
834 		enabled &= ~BRIDGE_IFCAPS_MASK;
835 		enabled |= mask;
836 		bridge_set_ifcap(sc, bif, enabled);
837 	}
838 
839 }
840 
841 static void
842 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
843 {
844 	struct ifnet *ifp = bif->bif_ifp;
845 	struct ifreq ifr;
846 	int error;
847 
848 	bzero(&ifr, sizeof(ifr));
849 	ifr.ifr_reqcap = set;
850 
851 	if (ifp->if_capenable != set) {
852 		error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
853 		if (error)
854 			if_printf(sc->sc_ifp,
855 			    "error setting interface capabilities on %s\n",
856 			    ifp->if_xname);
857 	}
858 }
859 
860 /*
861  * bridge_lookup_member:
862  *
863  *	Lookup a bridge member interface.
864  */
865 static struct bridge_iflist *
866 bridge_lookup_member(struct bridge_softc *sc, const char *name)
867 {
868 	struct bridge_iflist *bif;
869 	struct ifnet *ifp;
870 
871 	BRIDGE_LOCK_ASSERT(sc);
872 
873 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
874 		ifp = bif->bif_ifp;
875 		if (strcmp(ifp->if_xname, name) == 0)
876 			return (bif);
877 	}
878 
879 	return (NULL);
880 }
881 
882 /*
883  * bridge_lookup_member_if:
884  *
885  *	Lookup a bridge member interface by ifnet*.
886  */
887 static struct bridge_iflist *
888 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
889 {
890 	struct bridge_iflist *bif;
891 
892 	BRIDGE_LOCK_ASSERT(sc);
893 
894 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
895 		if (bif->bif_ifp == member_ifp)
896 			return (bif);
897 	}
898 
899 	return (NULL);
900 }
901 
902 /*
903  * bridge_delete_member:
904  *
905  *	Delete the specified member interface.
906  */
907 static void
908 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
909     int gone)
910 {
911 	struct ifnet *ifs = bif->bif_ifp;
912 	struct ifnet *fif = NULL;
913 
914 	BRIDGE_LOCK_ASSERT(sc);
915 
916 	if (bif->bif_flags & IFBIF_STP)
917 		bstp_disable(&bif->bif_stp);
918 
919 	ifs->if_bridge = NULL;
920 	BRIDGE_XLOCK(sc);
921 	LIST_REMOVE(bif, bif_next);
922 	BRIDGE_XDROP(sc);
923 
924 	/*
925 	 * If removing the interface that gave the bridge its mac address, set
926 	 * the mac address of the bridge to the address of the next member, or
927 	 * to its default address if no members are left.
928 	 */
929 	if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
930 		if (LIST_EMPTY(&sc->sc_iflist)) {
931 			bcopy(sc->sc_defaddr,
932 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
933 			sc->sc_ifaddr = NULL;
934 		} else {
935 			fif = LIST_FIRST(&sc->sc_iflist)->bif_ifp;
936 			bcopy(IF_LLADDR(fif),
937 			    IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
938 			sc->sc_ifaddr = fif;
939 		}
940 		EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
941 	}
942 
943 	bridge_mutecaps(sc);	/* recalcuate now this interface is removed */
944 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
945 	KASSERT(bif->bif_addrcnt == 0,
946 	    ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
947 
948 	BRIDGE_UNLOCK(sc);
949 	if (!gone) {
950 		switch (ifs->if_type) {
951 		case IFT_ETHER:
952 		case IFT_L2VLAN:
953 			/*
954 			 * Take the interface out of promiscuous mode.
955 			 */
956 			(void) ifpromisc(ifs, 0);
957 			break;
958 
959 		case IFT_GIF:
960 			break;
961 
962 		default:
963 #ifdef DIAGNOSTIC
964 			panic("bridge_delete_member: impossible");
965 #endif
966 			break;
967 		}
968 		/* reneable any interface capabilities */
969 		bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
970 	}
971 	bstp_destroy(&bif->bif_stp);	/* prepare to free */
972 	BRIDGE_LOCK(sc);
973 	free(bif, M_DEVBUF);
974 }
975 
976 /*
977  * bridge_delete_span:
978  *
979  *	Delete the specified span interface.
980  */
981 static void
982 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
983 {
984 	BRIDGE_LOCK_ASSERT(sc);
985 
986 	KASSERT(bif->bif_ifp->if_bridge == NULL,
987 	    ("%s: not a span interface", __func__));
988 
989 	LIST_REMOVE(bif, bif_next);
990 	free(bif, M_DEVBUF);
991 }
992 
993 static int
994 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
995 {
996 	struct ifbreq *req = arg;
997 	struct bridge_iflist *bif = NULL;
998 	struct ifnet *ifs;
999 	int error = 0;
1000 
1001 	ifs = ifunit(req->ifbr_ifsname);
1002 	if (ifs == NULL)
1003 		return (ENOENT);
1004 	if (ifs->if_ioctl == NULL)	/* must be supported */
1005 		return (EINVAL);
1006 
1007 	/* If it's in the span list, it can't be a member. */
1008 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1009 		if (ifs == bif->bif_ifp)
1010 			return (EBUSY);
1011 
1012 	if (ifs->if_bridge == sc)
1013 		return (EEXIST);
1014 
1015 	if (ifs->if_bridge != NULL)
1016 		return (EBUSY);
1017 
1018 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1019 	if (bif == NULL)
1020 		return (ENOMEM);
1021 
1022 	bif->bif_ifp = ifs;
1023 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
1024 	bif->bif_savedcaps = ifs->if_capenable;
1025 
1026 	switch (ifs->if_type) {
1027 	case IFT_ETHER:
1028 	case IFT_L2VLAN:
1029 	case IFT_GIF:
1030 		/* permitted interface types */
1031 		break;
1032 	default:
1033 		error = EINVAL;
1034 		goto out;
1035 	}
1036 
1037 	/* Allow the first Ethernet member to define the MTU */
1038 	if (LIST_EMPTY(&sc->sc_iflist))
1039 		sc->sc_ifp->if_mtu = ifs->if_mtu;
1040 	else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
1041 		if_printf(sc->sc_ifp, "invalid MTU: %lu(%s) != %lu\n",
1042 		    ifs->if_mtu, ifs->if_xname, sc->sc_ifp->if_mtu);
1043 		error = EINVAL;
1044 		goto out;
1045 	}
1046 
1047 	/*
1048 	 * Assign the interface's MAC address to the bridge if it's the first
1049 	 * member and the MAC address of the bridge has not been changed from
1050 	 * the default randomly generated one.
1051 	 */
1052 	if (bridge_inherit_mac && LIST_EMPTY(&sc->sc_iflist) &&
1053 	    !memcmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr, ETHER_ADDR_LEN)) {
1054 		bcopy(IF_LLADDR(ifs), IF_LLADDR(sc->sc_ifp), ETHER_ADDR_LEN);
1055 		sc->sc_ifaddr = ifs;
1056 		EVENTHANDLER_INVOKE(iflladdr_event, sc->sc_ifp);
1057 	}
1058 
1059 	ifs->if_bridge = sc;
1060 	bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
1061 	/*
1062 	 * XXX: XLOCK HERE!?!
1063 	 *
1064 	 * NOTE: insert_***HEAD*** should be safe for the traversals.
1065 	 */
1066 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
1067 
1068 	/* Set interface capabilities to the intersection set of all members */
1069 	bridge_mutecaps(sc);
1070 
1071 	switch (ifs->if_type) {
1072 	case IFT_ETHER:
1073 	case IFT_L2VLAN:
1074 		/*
1075 		 * Place the interface into promiscuous mode.
1076 		 */
1077 		BRIDGE_UNLOCK(sc);
1078 		error = ifpromisc(ifs, 1);
1079 		BRIDGE_LOCK(sc);
1080 		break;
1081 	}
1082 	if (error)
1083 		bridge_delete_member(sc, bif, 0);
1084 out:
1085 	if (error) {
1086 		if (bif != NULL)
1087 			free(bif, M_DEVBUF);
1088 	}
1089 	return (error);
1090 }
1091 
1092 static int
1093 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
1094 {
1095 	struct ifbreq *req = arg;
1096 	struct bridge_iflist *bif;
1097 
1098 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1099 	if (bif == NULL)
1100 		return (ENOENT);
1101 
1102 	bridge_delete_member(sc, bif, 0);
1103 
1104 	return (0);
1105 }
1106 
1107 static int
1108 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
1109 {
1110 	struct ifbreq *req = arg;
1111 	struct bridge_iflist *bif;
1112 	struct bstp_port *bp;
1113 
1114 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1115 	if (bif == NULL)
1116 		return (ENOENT);
1117 
1118 	bp = &bif->bif_stp;
1119 	req->ifbr_ifsflags = bif->bif_flags;
1120 	req->ifbr_state = bp->bp_state;
1121 	req->ifbr_priority = bp->bp_priority;
1122 	req->ifbr_path_cost = bp->bp_path_cost;
1123 	req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1124 	req->ifbr_proto = bp->bp_protover;
1125 	req->ifbr_role = bp->bp_role;
1126 	req->ifbr_stpflags = bp->bp_flags;
1127 	req->ifbr_addrcnt = bif->bif_addrcnt;
1128 	req->ifbr_addrmax = bif->bif_addrmax;
1129 	req->ifbr_addrexceeded = bif->bif_addrexceeded;
1130 
1131 	/* Copy STP state options as flags */
1132 	if (bp->bp_operedge)
1133 		req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
1134 	if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
1135 		req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
1136 	if (bp->bp_ptp_link)
1137 		req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
1138 	if (bp->bp_flags & BSTP_PORT_AUTOPTP)
1139 		req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
1140 	if (bp->bp_flags & BSTP_PORT_ADMEDGE)
1141 		req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
1142 	if (bp->bp_flags & BSTP_PORT_ADMCOST)
1143 		req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
1144 	return (0);
1145 }
1146 
1147 static int
1148 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
1149 {
1150 	struct ifbreq *req = arg;
1151 	struct bridge_iflist *bif;
1152 	struct bstp_port *bp;
1153 	int error;
1154 
1155 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1156 	if (bif == NULL)
1157 		return (ENOENT);
1158 	bp = &bif->bif_stp;
1159 
1160 	if (req->ifbr_ifsflags & IFBIF_SPAN)
1161 		/* SPAN is readonly */
1162 		return (EINVAL);
1163 
1164 	if (req->ifbr_ifsflags & IFBIF_STP) {
1165 		if ((bif->bif_flags & IFBIF_STP) == 0) {
1166 			error = bstp_enable(&bif->bif_stp);
1167 			if (error)
1168 				return (error);
1169 		}
1170 	} else {
1171 		if ((bif->bif_flags & IFBIF_STP) != 0)
1172 			bstp_disable(&bif->bif_stp);
1173 	}
1174 
1175 	/* Pass on STP flags */
1176 	bstp_set_edge(bp, req->ifbr_ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
1177 	bstp_set_autoedge(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
1178 	bstp_set_ptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
1179 	bstp_set_autoptp(bp, req->ifbr_ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
1180 
1181 	/* Save the bits relating to the bridge */
1182 	bif->bif_flags = req->ifbr_ifsflags & IFBIFMASK;
1183 
1184 	return (0);
1185 }
1186 
1187 static int
1188 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1189 {
1190 	struct ifbrparam *param = arg;
1191 
1192 	sc->sc_brtmax = param->ifbrp_csize;
1193 	bridge_rttrim(sc);
1194 
1195 	return (0);
1196 }
1197 
1198 static int
1199 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1200 {
1201 	struct ifbrparam *param = arg;
1202 
1203 	param->ifbrp_csize = sc->sc_brtmax;
1204 
1205 	return (0);
1206 }
1207 
1208 static int
1209 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1210 {
1211 	struct ifbifconf *bifc = arg;
1212 	struct bridge_iflist *bif;
1213 	struct ifbreq breq;
1214 	char *buf, *outbuf;
1215 	int count, buflen, len, error = 0;
1216 
1217 	count = 0;
1218 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1219 		count++;
1220 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1221 		count++;
1222 
1223 	buflen = sizeof(breq) * count;
1224 	if (bifc->ifbic_len == 0) {
1225 		bifc->ifbic_len = buflen;
1226 		return (0);
1227 	}
1228 	BRIDGE_UNLOCK(sc);
1229 	outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1230 	BRIDGE_LOCK(sc);
1231 
1232 	count = 0;
1233 	buf = outbuf;
1234 	len = min(bifc->ifbic_len, buflen);
1235 	bzero(&breq, sizeof(breq));
1236 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1237 		if (len < sizeof(breq))
1238 			break;
1239 
1240 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1241 		    sizeof(breq.ifbr_ifsname));
1242 		/* Fill in the ifbreq structure */
1243 		error = bridge_ioctl_gifflags(sc, &breq);
1244 		if (error)
1245 			break;
1246 		memcpy(buf, &breq, sizeof(breq));
1247 		count++;
1248 		buf += sizeof(breq);
1249 		len -= sizeof(breq);
1250 	}
1251 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1252 		if (len < sizeof(breq))
1253 			break;
1254 
1255 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1256 		    sizeof(breq.ifbr_ifsname));
1257 		breq.ifbr_ifsflags = bif->bif_flags;
1258 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xfff;
1259 		memcpy(buf, &breq, sizeof(breq));
1260 		count++;
1261 		buf += sizeof(breq);
1262 		len -= sizeof(breq);
1263 	}
1264 
1265 	BRIDGE_UNLOCK(sc);
1266 	bifc->ifbic_len = sizeof(breq) * count;
1267 	error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);
1268 	BRIDGE_LOCK(sc);
1269 	free(outbuf, M_TEMP);
1270 	return (error);
1271 }
1272 
1273 static int
1274 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1275 {
1276 	struct ifbaconf *bac = arg;
1277 	struct bridge_rtnode *brt;
1278 	struct ifbareq bareq;
1279 	char *buf, *outbuf;
1280 	int count, buflen, len, error = 0;
1281 
1282 	if (bac->ifbac_len == 0)
1283 		return (0);
1284 
1285 	count = 0;
1286 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)
1287 		count++;
1288 	buflen = sizeof(bareq) * count;
1289 
1290 	BRIDGE_UNLOCK(sc);
1291 	outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1292 	BRIDGE_LOCK(sc);
1293 
1294 	count = 0;
1295 	buf = outbuf;
1296 	len = min(bac->ifbac_len, buflen);
1297 	bzero(&bareq, sizeof(bareq));
1298 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1299 		if (len < sizeof(bareq))
1300 			goto out;
1301 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1302 		    sizeof(bareq.ifba_ifsname));
1303 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1304 		bareq.ifba_vlan = brt->brt_vlan;
1305 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1306 				time_uptime < brt->brt_expire)
1307 			bareq.ifba_expire = brt->brt_expire - time_uptime;
1308 		else
1309 			bareq.ifba_expire = 0;
1310 		bareq.ifba_flags = brt->brt_flags;
1311 
1312 		memcpy(buf, &bareq, sizeof(bareq));
1313 		count++;
1314 		buf += sizeof(bareq);
1315 		len -= sizeof(bareq);
1316 	}
1317 out:
1318 	BRIDGE_UNLOCK(sc);
1319 	bac->ifbac_len = sizeof(bareq) * count;
1320 	error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);
1321 	BRIDGE_LOCK(sc);
1322 	free(outbuf, M_TEMP);
1323 	return (error);
1324 }
1325 
1326 static int
1327 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1328 {
1329 	struct ifbareq *req = arg;
1330 	struct bridge_iflist *bif;
1331 	int error;
1332 
1333 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1334 	if (bif == NULL)
1335 		return (ENOENT);
1336 
1337 	error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
1338 	    req->ifba_flags);
1339 
1340 	return (error);
1341 }
1342 
1343 static int
1344 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1345 {
1346 	struct ifbrparam *param = arg;
1347 
1348 	sc->sc_brttimeout = param->ifbrp_ctime;
1349 	return (0);
1350 }
1351 
1352 static int
1353 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1354 {
1355 	struct ifbrparam *param = arg;
1356 
1357 	param->ifbrp_ctime = sc->sc_brttimeout;
1358 	return (0);
1359 }
1360 
1361 static int
1362 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1363 {
1364 	struct ifbareq *req = arg;
1365 
1366 	return (bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan));
1367 }
1368 
1369 static int
1370 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1371 {
1372 	struct ifbreq *req = arg;
1373 
1374 	bridge_rtflush(sc, req->ifbr_ifsflags);
1375 	return (0);
1376 }
1377 
1378 static int
1379 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1380 {
1381 	struct ifbrparam *param = arg;
1382 	struct bstp_state *bs = &sc->sc_stp;
1383 
1384 	param->ifbrp_prio = bs->bs_bridge_priority;
1385 	return (0);
1386 }
1387 
1388 static int
1389 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1390 {
1391 	struct ifbrparam *param = arg;
1392 
1393 	return (bstp_set_priority(&sc->sc_stp, param->ifbrp_prio));
1394 }
1395 
1396 static int
1397 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1398 {
1399 	struct ifbrparam *param = arg;
1400 	struct bstp_state *bs = &sc->sc_stp;
1401 
1402 	param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
1403 	return (0);
1404 }
1405 
1406 static int
1407 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1408 {
1409 	struct ifbrparam *param = arg;
1410 
1411 	return (bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime));
1412 }
1413 
1414 static int
1415 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1416 {
1417 	struct ifbrparam *param = arg;
1418 	struct bstp_state *bs = &sc->sc_stp;
1419 
1420 	param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
1421 	return (0);
1422 }
1423 
1424 static int
1425 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1426 {
1427 	struct ifbrparam *param = arg;
1428 
1429 	return (bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay));
1430 }
1431 
1432 static int
1433 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1434 {
1435 	struct ifbrparam *param = arg;
1436 	struct bstp_state *bs = &sc->sc_stp;
1437 
1438 	param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
1439 	return (0);
1440 }
1441 
1442 static int
1443 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1444 {
1445 	struct ifbrparam *param = arg;
1446 
1447 	return (bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage));
1448 }
1449 
1450 static int
1451 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1452 {
1453 	struct ifbreq *req = arg;
1454 	struct bridge_iflist *bif;
1455 
1456 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1457 	if (bif == NULL)
1458 		return (ENOENT);
1459 
1460 	return (bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority));
1461 }
1462 
1463 static int
1464 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1465 {
1466 	struct ifbreq *req = arg;
1467 	struct bridge_iflist *bif;
1468 
1469 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1470 	if (bif == NULL)
1471 		return (ENOENT);
1472 
1473 	return (bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost));
1474 }
1475 
1476 static int
1477 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *arg)
1478 {
1479 	struct ifbreq *req = arg;
1480 	struct bridge_iflist *bif;
1481 
1482 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1483 	if (bif == NULL)
1484 		return (ENOENT);
1485 
1486 	bif->bif_addrmax = req->ifbr_addrmax;
1487 	return (0);
1488 }
1489 
1490 static int
1491 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1492 {
1493 	struct ifbreq *req = arg;
1494 	struct bridge_iflist *bif = NULL;
1495 	struct ifnet *ifs;
1496 
1497 	ifs = ifunit(req->ifbr_ifsname);
1498 	if (ifs == NULL)
1499 		return (ENOENT);
1500 
1501 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1502 		if (ifs == bif->bif_ifp)
1503 			return (EBUSY);
1504 
1505 	if (ifs->if_bridge != NULL)
1506 		return (EBUSY);
1507 
1508 	switch (ifs->if_type) {
1509 		case IFT_ETHER:
1510 		case IFT_GIF:
1511 		case IFT_L2VLAN:
1512 			break;
1513 		default:
1514 			return (EINVAL);
1515 	}
1516 
1517 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1518 	if (bif == NULL)
1519 		return (ENOMEM);
1520 
1521 	bif->bif_ifp = ifs;
1522 	bif->bif_flags = IFBIF_SPAN;
1523 
1524 	LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1525 
1526 	return (0);
1527 }
1528 
1529 static int
1530 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1531 {
1532 	struct ifbreq *req = arg;
1533 	struct bridge_iflist *bif;
1534 	struct ifnet *ifs;
1535 
1536 	ifs = ifunit(req->ifbr_ifsname);
1537 	if (ifs == NULL)
1538 		return (ENOENT);
1539 
1540 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1541 		if (ifs == bif->bif_ifp)
1542 			break;
1543 
1544 	if (bif == NULL)
1545 		return (ENOENT);
1546 
1547 	bridge_delete_span(sc, bif);
1548 
1549 	return (0);
1550 }
1551 
1552 static int
1553 bridge_ioctl_gbparam(struct bridge_softc *sc, void *arg)
1554 {
1555 	struct ifbropreq *req = arg;
1556 	struct bstp_state *bs = &sc->sc_stp;
1557 	struct bstp_port *root_port;
1558 
1559 	req->ifbop_maxage = bs->bs_bridge_max_age >> 8;
1560 	req->ifbop_hellotime = bs->bs_bridge_htime >> 8;
1561 	req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
1562 
1563 	root_port = bs->bs_root_port;
1564 	if (root_port == NULL)
1565 		req->ifbop_root_port = 0;
1566 	else
1567 		req->ifbop_root_port = root_port->bp_ifp->if_index;
1568 
1569 	req->ifbop_holdcount = bs->bs_txholdcount;
1570 	req->ifbop_priority = bs->bs_bridge_priority;
1571 	req->ifbop_protocol = bs->bs_protover;
1572 	req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
1573 	req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;
1574 	req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;
1575 	req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;
1576 	req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
1577 	req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
1578 
1579 	return (0);
1580 }
1581 
1582 static int
1583 bridge_ioctl_grte(struct bridge_softc *sc, void *arg)
1584 {
1585 	struct ifbrparam *param = arg;
1586 
1587 	param->ifbrp_cexceeded = sc->sc_brtexceeded;
1588 	return (0);
1589 }
1590 
1591 static int
1592 bridge_ioctl_gifsstp(struct bridge_softc *sc, void *arg)
1593 {
1594 	struct ifbpstpconf *bifstp = arg;
1595 	struct bridge_iflist *bif;
1596 	struct bstp_port *bp;
1597 	struct ifbpstpreq bpreq;
1598 	char *buf, *outbuf;
1599 	int count, buflen, len, error = 0;
1600 
1601 	count = 0;
1602 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1603 		if ((bif->bif_flags & IFBIF_STP) != 0)
1604 			count++;
1605 	}
1606 
1607 	buflen = sizeof(bpreq) * count;
1608 	if (bifstp->ifbpstp_len == 0) {
1609 		bifstp->ifbpstp_len = buflen;
1610 		return (0);
1611 	}
1612 
1613 	BRIDGE_UNLOCK(sc);
1614 	outbuf = malloc(buflen, M_TEMP, M_WAITOK | M_ZERO);
1615 	BRIDGE_LOCK(sc);
1616 
1617 	count = 0;
1618 	buf = outbuf;
1619 	len = min(bifstp->ifbpstp_len, buflen);
1620 	bzero(&bpreq, sizeof(bpreq));
1621 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1622 		if (len < sizeof(bpreq))
1623 			break;
1624 
1625 		if ((bif->bif_flags & IFBIF_STP) == 0)
1626 			continue;
1627 
1628 		bp = &bif->bif_stp;
1629 		bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;
1630 		bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;
1631 		bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;
1632 		bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;
1633 		bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id;
1634 		bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;
1635 
1636 		memcpy(buf, &bpreq, sizeof(bpreq));
1637 		count++;
1638 		buf += sizeof(bpreq);
1639 		len -= sizeof(bpreq);
1640 	}
1641 
1642 	BRIDGE_UNLOCK(sc);
1643 	bifstp->ifbpstp_len = sizeof(bpreq) * count;
1644 	error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);
1645 	BRIDGE_LOCK(sc);
1646 	free(outbuf, M_TEMP);
1647 	return (error);
1648 }
1649 
1650 static int
1651 bridge_ioctl_sproto(struct bridge_softc *sc, void *arg)
1652 {
1653 	struct ifbrparam *param = arg;
1654 
1655 	return (bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto));
1656 }
1657 
1658 static int
1659 bridge_ioctl_stxhc(struct bridge_softc *sc, void *arg)
1660 {
1661 	struct ifbrparam *param = arg;
1662 
1663 	return (bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc));
1664 }
1665 
1666 /*
1667  * bridge_ifdetach:
1668  *
1669  *	Detach an interface from a bridge.  Called when a member
1670  *	interface is detaching.
1671  */
1672 static void
1673 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1674 {
1675 	struct bridge_softc *sc = ifp->if_bridge;
1676 	struct bridge_iflist *bif;
1677 
1678 	/* Check if the interface is a bridge member */
1679 	if (sc != NULL) {
1680 		BRIDGE_LOCK(sc);
1681 
1682 		bif = bridge_lookup_member_if(sc, ifp);
1683 		if (bif != NULL)
1684 			bridge_delete_member(sc, bif, 1);
1685 
1686 		BRIDGE_UNLOCK(sc);
1687 		return;
1688 	}
1689 
1690 	/* Check if the interface is a span port */
1691 	mtx_lock(&bridge_list_mtx);
1692 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1693 		BRIDGE_LOCK(sc);
1694 		LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1695 			if (ifp == bif->bif_ifp) {
1696 				bridge_delete_span(sc, bif);
1697 				break;
1698 			}
1699 
1700 		BRIDGE_UNLOCK(sc);
1701 	}
1702 	mtx_unlock(&bridge_list_mtx);
1703 }
1704 
1705 /*
1706  * bridge_init:
1707  *
1708  *	Initialize a bridge interface.
1709  */
1710 static void
1711 bridge_init(void *xsc)
1712 {
1713 	struct bridge_softc *sc = (struct bridge_softc *)xsc;
1714 	struct ifnet *ifp = sc->sc_ifp;
1715 
1716 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1717 		return;
1718 
1719 	BRIDGE_LOCK(sc);
1720 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1721 	    bridge_timer, sc);
1722 
1723 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1724 	bstp_init(&sc->sc_stp);		/* Initialize Spanning Tree */
1725 
1726 	BRIDGE_UNLOCK(sc);
1727 }
1728 
1729 /*
1730  * bridge_stop:
1731  *
1732  *	Stop the bridge interface.
1733  */
1734 static void
1735 bridge_stop(struct ifnet *ifp, int disable)
1736 {
1737 	struct bridge_softc *sc = ifp->if_softc;
1738 
1739 	BRIDGE_LOCK_ASSERT(sc);
1740 
1741 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1742 		return;
1743 
1744 	callout_stop(&sc->sc_brcallout);
1745 	bstp_stop(&sc->sc_stp);
1746 
1747 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1748 
1749 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1750 }
1751 
1752 /*
1753  * bridge_enqueue:
1754  *
1755  *	Enqueue a packet on a bridge member interface.
1756  *
1757  */
1758 static void
1759 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1760 {
1761 	int len, err = 0;
1762 	short mflags;
1763 	struct mbuf *m0;
1764 
1765 	len = m->m_pkthdr.len;
1766 	mflags = m->m_flags;
1767 
1768 	/* We may be sending a fragment so traverse the mbuf */
1769 	for (; m; m = m0) {
1770 		m0 = m->m_nextpkt;
1771 		m->m_nextpkt = NULL;
1772 
1773 		/*
1774 		 * If underlying interface can not do VLAN tag insertion itself
1775 		 * then attach a packet tag that holds it.
1776 		 */
1777 		if ((m->m_flags & M_VLANTAG) &&
1778 		    (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
1779 			m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
1780 			if (m == NULL) {
1781 				if_printf(dst_ifp,
1782 				    "unable to prepend VLAN header\n");
1783 				dst_ifp->if_oerrors++;
1784 				continue;
1785 			}
1786 			m->m_flags &= ~M_VLANTAG;
1787 		}
1788 
1789 		if (err == 0)
1790 			dst_ifp->if_transmit(dst_ifp, m);
1791 	}
1792 
1793 	if (err == 0) {
1794 		sc->sc_ifp->if_opackets++;
1795 		sc->sc_ifp->if_obytes += len;
1796 		if (mflags & M_MCAST)
1797 			sc->sc_ifp->if_omcasts++;
1798 	}
1799 }
1800 
1801 /*
1802  * bridge_dummynet:
1803  *
1804  * 	Receive a queued packet from dummynet and pass it on to the output
1805  * 	interface.
1806  *
1807  *	The mbuf has the Ethernet header already attached.
1808  */
1809 static void
1810 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1811 {
1812 	struct bridge_softc *sc;
1813 
1814 	sc = ifp->if_bridge;
1815 
1816 	/*
1817 	 * The packet didnt originate from a member interface. This should only
1818 	 * ever happen if a member interface is removed while packets are
1819 	 * queued for it.
1820 	 */
1821 	if (sc == NULL) {
1822 		m_freem(m);
1823 		return;
1824 	}
1825 
1826 	if (PFIL_HOOKED(&V_inet_pfil_hook)
1827 #ifdef INET6
1828 	    || PFIL_HOOKED(&V_inet6_pfil_hook)
1829 #endif
1830 	    ) {
1831 		if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1832 			return;
1833 		if (m == NULL)
1834 			return;
1835 	}
1836 
1837 	bridge_enqueue(sc, ifp, m);
1838 }
1839 
1840 /*
1841  * bridge_output:
1842  *
1843  *	Send output from a bridge member interface.  This
1844  *	performs the bridging function for locally originated
1845  *	packets.
1846  *
1847  *	The mbuf has the Ethernet header already attached.  We must
1848  *	enqueue or free the mbuf before returning.
1849  */
1850 static int
1851 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1852     struct rtentry *rt)
1853 {
1854 	struct ether_header *eh;
1855 	struct ifnet *dst_if;
1856 	struct bridge_softc *sc;
1857 	uint16_t vlan;
1858 
1859 	if (m->m_len < ETHER_HDR_LEN) {
1860 		m = m_pullup(m, ETHER_HDR_LEN);
1861 		if (m == NULL)
1862 			return (0);
1863 	}
1864 
1865 	eh = mtod(m, struct ether_header *);
1866 	sc = ifp->if_bridge;
1867 	vlan = VLANTAGOF(m);
1868 
1869 	BRIDGE_LOCK(sc);
1870 
1871 	/*
1872 	 * If bridge is down, but the original output interface is up,
1873 	 * go ahead and send out that interface.  Otherwise, the packet
1874 	 * is dropped below.
1875 	 */
1876 	if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1877 		dst_if = ifp;
1878 		goto sendunicast;
1879 	}
1880 
1881 	/*
1882 	 * If the packet is a multicast, or we don't know a better way to
1883 	 * get there, send to all interfaces.
1884 	 */
1885 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1886 		dst_if = NULL;
1887 	else
1888 		dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
1889 	if (dst_if == NULL) {
1890 		struct bridge_iflist *bif;
1891 		struct mbuf *mc;
1892 		int error = 0, used = 0;
1893 
1894 		bridge_span(sc, m);
1895 
1896 		BRIDGE_LOCK2REF(sc, error);
1897 		if (error) {
1898 			m_freem(m);
1899 			return (0);
1900 		}
1901 
1902 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1903 			dst_if = bif->bif_ifp;
1904 
1905 			if (dst_if->if_type == IFT_GIF)
1906 				continue;
1907 			if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1908 				continue;
1909 
1910 			/*
1911 			 * If this is not the original output interface,
1912 			 * and the interface is participating in spanning
1913 			 * tree, make sure the port is in a state that
1914 			 * allows forwarding.
1915 			 */
1916 			if (dst_if != ifp && (bif->bif_flags & IFBIF_STP) &&
1917 			    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
1918 				continue;
1919 
1920 			if (LIST_NEXT(bif, bif_next) == NULL) {
1921 				used = 1;
1922 				mc = m;
1923 			} else {
1924 				mc = m_copypacket(m, M_DONTWAIT);
1925 				if (mc == NULL) {
1926 					sc->sc_ifp->if_oerrors++;
1927 					continue;
1928 				}
1929 			}
1930 
1931 			bridge_enqueue(sc, dst_if, mc);
1932 		}
1933 		if (used == 0)
1934 			m_freem(m);
1935 		BRIDGE_UNREF(sc);
1936 		return (0);
1937 	}
1938 
1939 sendunicast:
1940 	/*
1941 	 * XXX Spanning tree consideration here?
1942 	 */
1943 
1944 	bridge_span(sc, m);
1945 	if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1946 		m_freem(m);
1947 		BRIDGE_UNLOCK(sc);
1948 		return (0);
1949 	}
1950 
1951 	BRIDGE_UNLOCK(sc);
1952 	bridge_enqueue(sc, dst_if, m);
1953 	return (0);
1954 }
1955 
1956 /*
1957  * bridge_start:
1958  *
1959  *	Start output on a bridge.
1960  *
1961  */
1962 static void
1963 bridge_start(struct ifnet *ifp)
1964 {
1965 	struct bridge_softc *sc;
1966 	struct mbuf *m;
1967 	struct ether_header *eh;
1968 	struct ifnet *dst_if;
1969 
1970 	sc = ifp->if_softc;
1971 
1972 	ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1973 	for (;;) {
1974 		IFQ_DEQUEUE(&ifp->if_snd, m);
1975 		if (m == 0)
1976 			break;
1977 		ETHER_BPF_MTAP(ifp, m);
1978 
1979 		eh = mtod(m, struct ether_header *);
1980 		dst_if = NULL;
1981 
1982 		BRIDGE_LOCK(sc);
1983 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1984 			dst_if = bridge_rtlookup(sc, eh->ether_dhost, 1);
1985 		}
1986 
1987 		if (dst_if == NULL)
1988 			bridge_broadcast(sc, ifp, m, 0);
1989 		else {
1990 			BRIDGE_UNLOCK(sc);
1991 			bridge_enqueue(sc, dst_if, m);
1992 		}
1993 	}
1994 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1995 }
1996 
1997 /*
1998  * bridge_forward:
1999  *
2000  *	The forwarding function of the bridge.
2001  *
2002  *	NOTE: Releases the lock on return.
2003  */
2004 static void
2005 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
2006     struct mbuf *m)
2007 {
2008 	struct bridge_iflist *dbif;
2009 	struct ifnet *src_if, *dst_if, *ifp;
2010 	struct ether_header *eh;
2011 	uint16_t vlan;
2012 	uint8_t *dst;
2013 	int error;
2014 
2015 	src_if = m->m_pkthdr.rcvif;
2016 	ifp = sc->sc_ifp;
2017 
2018 	ifp->if_ipackets++;
2019 	ifp->if_ibytes += m->m_pkthdr.len;
2020 	vlan = VLANTAGOF(m);
2021 
2022 	if ((sbif->bif_flags & IFBIF_STP) &&
2023 	    sbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2024 		goto drop;
2025 
2026 	eh = mtod(m, struct ether_header *);
2027 	dst = eh->ether_dhost;
2028 
2029 	/* If the interface is learning, record the address. */
2030 	if (sbif->bif_flags & IFBIF_LEARNING) {
2031 		error = bridge_rtupdate(sc, eh->ether_shost, vlan,
2032 		    sbif, 0, IFBAF_DYNAMIC);
2033 		/*
2034 		 * If the interface has addresses limits then deny any source
2035 		 * that is not in the cache.
2036 		 */
2037 		if (error && sbif->bif_addrmax)
2038 			goto drop;
2039 	}
2040 
2041 	if ((sbif->bif_flags & IFBIF_STP) != 0 &&
2042 	    sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING)
2043 		goto drop;
2044 
2045 	/*
2046 	 * At this point, the port either doesn't participate
2047 	 * in spanning tree or it is in the forwarding state.
2048 	 */
2049 
2050 	/*
2051 	 * If the packet is unicast, destined for someone on
2052 	 * "this" side of the bridge, drop it.
2053 	 */
2054 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
2055 		dst_if = bridge_rtlookup(sc, dst, vlan);
2056 		if (src_if == dst_if)
2057 			goto drop;
2058 	} else {
2059 		/*
2060 		 * Check if its a reserved multicast address, any address
2061 		 * listed in 802.1D section 7.12.6 may not be forwarded by the
2062 		 * bridge.
2063 		 * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
2064 		 */
2065 		if (dst[0] == 0x01 && dst[1] == 0x80 &&
2066 		    dst[2] == 0xc2 && dst[3] == 0x00 &&
2067 		    dst[4] == 0x00 && dst[5] <= 0x0f)
2068 			goto drop;
2069 
2070 		/* ...forward it to all interfaces. */
2071 		ifp->if_imcasts++;
2072 		dst_if = NULL;
2073 	}
2074 
2075 	/*
2076 	 * If we have a destination interface which is a member of our bridge,
2077 	 * OR this is a unicast packet, push it through the bpf(4) machinery.
2078 	 * For broadcast or multicast packets, don't bother because it will
2079 	 * be reinjected into ether_input. We do this before we pass the packets
2080 	 * through the pfil(9) framework, as it is possible that pfil(9) will
2081 	 * drop the packet, or possibly modify it, making it difficult to debug
2082 	 * firewall issues on the bridge.
2083 	 */
2084 	if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
2085 		ETHER_BPF_MTAP(ifp, m);
2086 
2087 	/* run the packet filter */
2088 	if (PFIL_HOOKED(&V_inet_pfil_hook)
2089 #ifdef INET6
2090 	    || PFIL_HOOKED(&V_inet6_pfil_hook)
2091 #endif
2092 	    ) {
2093 		BRIDGE_UNLOCK(sc);
2094 		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
2095 			return;
2096 		if (m == NULL)
2097 			return;
2098 		BRIDGE_LOCK(sc);
2099 	}
2100 
2101 	if (dst_if == NULL) {
2102 		bridge_broadcast(sc, src_if, m, 1);
2103 		return;
2104 	}
2105 
2106 	/*
2107 	 * At this point, we're dealing with a unicast frame
2108 	 * going to a different interface.
2109 	 */
2110 	if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2111 		goto drop;
2112 
2113 	dbif = bridge_lookup_member_if(sc, dst_if);
2114 	if (dbif == NULL)
2115 		/* Not a member of the bridge (anymore?) */
2116 		goto drop;
2117 
2118 	/* Private segments can not talk to each other */
2119 	if (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE)
2120 		goto drop;
2121 
2122 	if ((dbif->bif_flags & IFBIF_STP) &&
2123 	    dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2124 		goto drop;
2125 
2126 	BRIDGE_UNLOCK(sc);
2127 
2128 	if (PFIL_HOOKED(&V_inet_pfil_hook)
2129 #ifdef INET6
2130 	    || PFIL_HOOKED(&V_inet6_pfil_hook)
2131 #endif
2132 	    ) {
2133 		if (bridge_pfil(&m, ifp, dst_if, PFIL_OUT) != 0)
2134 			return;
2135 		if (m == NULL)
2136 			return;
2137 	}
2138 
2139 	bridge_enqueue(sc, dst_if, m);
2140 	return;
2141 
2142 drop:
2143 	BRIDGE_UNLOCK(sc);
2144 	m_freem(m);
2145 }
2146 
2147 /*
2148  * bridge_input:
2149  *
2150  *	Receive input from a member interface.  Queue the packet for
2151  *	bridging if it is not for us.
2152  */
2153 static struct mbuf *
2154 bridge_input(struct ifnet *ifp, struct mbuf *m)
2155 {
2156 	struct bridge_softc *sc = ifp->if_bridge;
2157 	struct bridge_iflist *bif, *bif2;
2158 	struct ifnet *bifp;
2159 	struct ether_header *eh;
2160 	struct mbuf *mc, *mc2;
2161 	uint16_t vlan;
2162 	int error;
2163 
2164 	if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2165 		return (m);
2166 
2167 	bifp = sc->sc_ifp;
2168 	vlan = VLANTAGOF(m);
2169 
2170 	/*
2171 	 * Implement support for bridge monitoring. If this flag has been
2172 	 * set on this interface, discard the packet once we push it through
2173 	 * the bpf(4) machinery, but before we do, increment the byte and
2174 	 * packet counters associated with this interface.
2175 	 */
2176 	if ((bifp->if_flags & IFF_MONITOR) != 0) {
2177 		m->m_pkthdr.rcvif  = bifp;
2178 		ETHER_BPF_MTAP(bifp, m);
2179 		bifp->if_ipackets++;
2180 		bifp->if_ibytes += m->m_pkthdr.len;
2181 		m_freem(m);
2182 		return (NULL);
2183 	}
2184 	BRIDGE_LOCK(sc);
2185 	bif = bridge_lookup_member_if(sc, ifp);
2186 	if (bif == NULL) {
2187 		BRIDGE_UNLOCK(sc);
2188 		return (m);
2189 	}
2190 
2191 	eh = mtod(m, struct ether_header *);
2192 
2193 	bridge_span(sc, m);
2194 
2195 	if (m->m_flags & (M_BCAST|M_MCAST)) {
2196 		/* Tap off 802.1D packets; they do not get forwarded. */
2197 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
2198 		    ETHER_ADDR_LEN) == 0) {
2199 			m = bstp_input(&bif->bif_stp, ifp, m);
2200 			if (m == NULL) {
2201 				BRIDGE_UNLOCK(sc);
2202 				return (NULL);
2203 			}
2204 		}
2205 
2206 		if ((bif->bif_flags & IFBIF_STP) &&
2207 		    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2208 			BRIDGE_UNLOCK(sc);
2209 			return (m);
2210 		}
2211 
2212 		/*
2213 		 * Make a deep copy of the packet and enqueue the copy
2214 		 * for bridge processing; return the original packet for
2215 		 * local processing.
2216 		 */
2217 		mc = m_dup(m, M_DONTWAIT);
2218 		if (mc == NULL) {
2219 			BRIDGE_UNLOCK(sc);
2220 			return (m);
2221 		}
2222 
2223 		/* Perform the bridge forwarding function with the copy. */
2224 		bridge_forward(sc, bif, mc);
2225 
2226 		/*
2227 		 * Reinject the mbuf as arriving on the bridge so we have a
2228 		 * chance at claiming multicast packets. We can not loop back
2229 		 * here from ether_input as a bridge is never a member of a
2230 		 * bridge.
2231 		 */
2232 		KASSERT(bifp->if_bridge == NULL,
2233 		    ("loop created in bridge_input"));
2234 		mc2 = m_dup(m, M_DONTWAIT);
2235 		if (mc2 != NULL) {
2236 			/* Keep the layer3 header aligned */
2237 			int i = min(mc2->m_pkthdr.len, max_protohdr);
2238 			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2239 		}
2240 		if (mc2 != NULL) {
2241 			mc2->m_pkthdr.rcvif = bifp;
2242 			(*bifp->if_input)(bifp, mc2);
2243 		}
2244 
2245 		/* Return the original packet for local processing. */
2246 		return (m);
2247 	}
2248 
2249 	if ((bif->bif_flags & IFBIF_STP) &&
2250 	    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
2251 		BRIDGE_UNLOCK(sc);
2252 		return (m);
2253 	}
2254 
2255 #if (defined(INET) || defined(INET6)) && defined(DEV_CARP)
2256 #   define OR_CARP_CHECK_WE_ARE_DST(iface) \
2257 	|| ((iface)->if_carp \
2258 	    && carp_forus((iface)->if_carp, eh->ether_dhost))
2259 #   define OR_CARP_CHECK_WE_ARE_SRC(iface) \
2260 	|| ((iface)->if_carp \
2261 	    && carp_forus((iface)->if_carp, eh->ether_shost))
2262 #else
2263 #   define OR_CARP_CHECK_WE_ARE_DST(iface)
2264 #   define OR_CARP_CHECK_WE_ARE_SRC(iface)
2265 #endif
2266 
2267 #ifdef INET6
2268 #   define OR_PFIL_HOOKED_INET6 \
2269 	|| PFIL_HOOKED(&V_inet6_pfil_hook)
2270 #else
2271 #   define OR_PFIL_HOOKED_INET6
2272 #endif
2273 
2274 #define GRAB_OUR_PACKETS(iface) \
2275 	if ((iface)->if_type == IFT_GIF) \
2276 		continue; \
2277 	/* It is destined for us. */ \
2278 	if (memcmp(IF_LLADDR((iface)), eh->ether_dhost,  ETHER_ADDR_LEN) == 0 \
2279 	    OR_CARP_CHECK_WE_ARE_DST((iface))				\
2280 	    ) {								\
2281 		if ((iface)->if_type == IFT_BRIDGE) {			\
2282 			ETHER_BPF_MTAP(iface, m);			\
2283 			iface->if_ipackets++;				\
2284 			/* Filter on the physical interface. */		\
2285 			if (pfil_local_phys &&				\
2286 			    (PFIL_HOOKED(&V_inet_pfil_hook)		\
2287 			     OR_PFIL_HOOKED_INET6)) {			\
2288 				if (bridge_pfil(&m, NULL, ifp,		\
2289 				    PFIL_IN) != 0 || m == NULL) {	\
2290 					BRIDGE_UNLOCK(sc);		\
2291 					return (NULL);			\
2292 				}					\
2293 			}						\
2294 		}							\
2295 		if (bif->bif_flags & IFBIF_LEARNING) {			\
2296 			error = bridge_rtupdate(sc, eh->ether_shost,	\
2297 			    vlan, bif, 0, IFBAF_DYNAMIC);		\
2298 			if (error && bif->bif_addrmax) {		\
2299 				BRIDGE_UNLOCK(sc);			\
2300 				m_freem(m);				\
2301 				return (NULL);				\
2302 			}						\
2303 		}							\
2304 		m->m_pkthdr.rcvif = iface;				\
2305 		BRIDGE_UNLOCK(sc);					\
2306 		return (m);						\
2307 	}								\
2308 									\
2309 	/* We just received a packet that we sent out. */		\
2310 	if (memcmp(IF_LLADDR((iface)), eh->ether_shost, ETHER_ADDR_LEN) == 0 \
2311 	    OR_CARP_CHECK_WE_ARE_SRC((iface))			\
2312 	    ) {								\
2313 		BRIDGE_UNLOCK(sc);					\
2314 		m_freem(m);						\
2315 		return (NULL);						\
2316 	}
2317 
2318 	/*
2319 	 * Unicast.  Make sure it's not for the bridge.
2320 	 */
2321 	do { GRAB_OUR_PACKETS(bifp) } while (0);
2322 
2323 	/*
2324 	 * Give a chance for ifp at first priority. This will help when	the
2325 	 * packet comes through the interface like VLAN's with the same MACs
2326 	 * on several interfaces from the same bridge. This also will save
2327 	 * some CPU cycles in case the destination interface and the input
2328 	 * interface (eq ifp) are the same.
2329 	 */
2330 	do { GRAB_OUR_PACKETS(ifp) } while (0);
2331 
2332 	/* Now check the all bridge members. */
2333 	LIST_FOREACH(bif2, &sc->sc_iflist, bif_next) {
2334 		GRAB_OUR_PACKETS(bif2->bif_ifp)
2335 	}
2336 
2337 #undef OR_CARP_CHECK_WE_ARE_DST
2338 #undef OR_CARP_CHECK_WE_ARE_SRC
2339 #undef OR_PFIL_HOOKED_INET6
2340 #undef GRAB_OUR_PACKETS
2341 
2342 	/* Perform the bridge forwarding function. */
2343 	bridge_forward(sc, bif, m);
2344 
2345 	return (NULL);
2346 }
2347 
2348 /*
2349  * bridge_broadcast:
2350  *
2351  *	Send a frame to all interfaces that are members of
2352  *	the bridge, except for the one on which the packet
2353  *	arrived.
2354  *
2355  *	NOTE: Releases the lock on return.
2356  */
2357 static void
2358 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2359     struct mbuf *m, int runfilt)
2360 {
2361 	struct bridge_iflist *dbif, *sbif;
2362 	struct mbuf *mc;
2363 	struct ifnet *dst_if;
2364 	int error = 0, used = 0, i;
2365 
2366 	sbif = bridge_lookup_member_if(sc, src_if);
2367 
2368 	BRIDGE_LOCK2REF(sc, error);
2369 	if (error) {
2370 		m_freem(m);
2371 		return;
2372 	}
2373 
2374 	/* Filter on the bridge interface before broadcasting */
2375 	if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2376 #ifdef INET6
2377 	    || PFIL_HOOKED(&V_inet6_pfil_hook)
2378 #endif
2379 	    )) {
2380 		if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2381 			goto out;
2382 		if (m == NULL)
2383 			goto out;
2384 	}
2385 
2386 	LIST_FOREACH(dbif, &sc->sc_iflist, bif_next) {
2387 		dst_if = dbif->bif_ifp;
2388 		if (dst_if == src_if)
2389 			continue;
2390 
2391 		/* Private segments can not talk to each other */
2392 		if (sbif && (sbif->bif_flags & dbif->bif_flags & IFBIF_PRIVATE))
2393 			continue;
2394 
2395 		if ((dbif->bif_flags & IFBIF_STP) &&
2396 		    dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING)
2397 			continue;
2398 
2399 		if ((dbif->bif_flags & IFBIF_DISCOVER) == 0 &&
2400 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2401 			continue;
2402 
2403 		if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2404 			continue;
2405 
2406 		if (LIST_NEXT(dbif, bif_next) == NULL) {
2407 			mc = m;
2408 			used = 1;
2409 		} else {
2410 			mc = m_dup(m, M_DONTWAIT);
2411 			if (mc == NULL) {
2412 				sc->sc_ifp->if_oerrors++;
2413 				continue;
2414 			}
2415 		}
2416 
2417 		/*
2418 		 * Filter on the output interface. Pass a NULL bridge interface
2419 		 * pointer so we do not redundantly filter on the bridge for
2420 		 * each interface we broadcast on.
2421 		 */
2422 		if (runfilt && (PFIL_HOOKED(&V_inet_pfil_hook)
2423 #ifdef INET6
2424 		    || PFIL_HOOKED(&V_inet6_pfil_hook)
2425 #endif
2426 		    )) {
2427 			if (used == 0) {
2428 				/* Keep the layer3 header aligned */
2429 				i = min(mc->m_pkthdr.len, max_protohdr);
2430 				mc = m_copyup(mc, i, ETHER_ALIGN);
2431 				if (mc == NULL) {
2432 					sc->sc_ifp->if_oerrors++;
2433 					continue;
2434 				}
2435 			}
2436 			if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2437 				continue;
2438 			if (mc == NULL)
2439 				continue;
2440 		}
2441 
2442 		bridge_enqueue(sc, dst_if, mc);
2443 	}
2444 	if (used == 0)
2445 		m_freem(m);
2446 
2447 out:
2448 	BRIDGE_UNREF(sc);
2449 }
2450 
2451 /*
2452  * bridge_span:
2453  *
2454  *	Duplicate a packet out one or more interfaces that are in span mode,
2455  *	the original mbuf is unmodified.
2456  */
2457 static void
2458 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2459 {
2460 	struct bridge_iflist *bif;
2461 	struct ifnet *dst_if;
2462 	struct mbuf *mc;
2463 
2464 	if (LIST_EMPTY(&sc->sc_spanlist))
2465 		return;
2466 
2467 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2468 		dst_if = bif->bif_ifp;
2469 
2470 		if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2471 			continue;
2472 
2473 		mc = m_copypacket(m, M_DONTWAIT);
2474 		if (mc == NULL) {
2475 			sc->sc_ifp->if_oerrors++;
2476 			continue;
2477 		}
2478 
2479 		bridge_enqueue(sc, dst_if, mc);
2480 	}
2481 }
2482 
2483 /*
2484  * bridge_rtupdate:
2485  *
2486  *	Add a bridge routing entry.
2487  */
2488 static int
2489 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst, uint16_t vlan,
2490     struct bridge_iflist *bif, int setflags, uint8_t flags)
2491 {
2492 	struct bridge_rtnode *brt;
2493 	int error;
2494 
2495 	BRIDGE_LOCK_ASSERT(sc);
2496 
2497 	/* Check the source address is valid and not multicast. */
2498 	if (ETHER_IS_MULTICAST(dst) ||
2499 	    (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
2500 	     dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0)
2501 		return (EINVAL);
2502 
2503 	/* 802.1p frames map to vlan 1 */
2504 	if (vlan == 0)
2505 		vlan = 1;
2506 
2507 	/*
2508 	 * A route for this destination might already exist.  If so,
2509 	 * update it, otherwise create a new one.
2510 	 */
2511 	if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
2512 		if (sc->sc_brtcnt >= sc->sc_brtmax) {
2513 			sc->sc_brtexceeded++;
2514 			return (ENOSPC);
2515 		}
2516 		/* Check per interface address limits (if enabled) */
2517 		if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
2518 			bif->bif_addrexceeded++;
2519 			return (ENOSPC);
2520 		}
2521 
2522 		/*
2523 		 * Allocate a new bridge forwarding node, and
2524 		 * initialize the expiration time and Ethernet
2525 		 * address.
2526 		 */
2527 		brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2528 		if (brt == NULL)
2529 			return (ENOMEM);
2530 
2531 		if (bif->bif_flags & IFBIF_STICKY)
2532 			brt->brt_flags = IFBAF_STICKY;
2533 		else
2534 			brt->brt_flags = IFBAF_DYNAMIC;
2535 
2536 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2537 		brt->brt_vlan = vlan;
2538 
2539 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2540 			uma_zfree(bridge_rtnode_zone, brt);
2541 			return (error);
2542 		}
2543 		brt->brt_dst = bif;
2544 		bif->bif_addrcnt++;
2545 	}
2546 
2547 	if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
2548 	    brt->brt_dst != bif) {
2549 		brt->brt_dst->bif_addrcnt--;
2550 		brt->brt_dst = bif;
2551 		brt->brt_dst->bif_addrcnt++;
2552 	}
2553 
2554 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2555 		brt->brt_expire = time_uptime + sc->sc_brttimeout;
2556 	if (setflags)
2557 		brt->brt_flags = flags;
2558 
2559 	return (0);
2560 }
2561 
2562 /*
2563  * bridge_rtlookup:
2564  *
2565  *	Lookup the destination interface for an address.
2566  */
2567 static struct ifnet *
2568 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2569 {
2570 	struct bridge_rtnode *brt;
2571 
2572 	BRIDGE_LOCK_ASSERT(sc);
2573 
2574 	if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL)
2575 		return (NULL);
2576 
2577 	return (brt->brt_ifp);
2578 }
2579 
2580 /*
2581  * bridge_rttrim:
2582  *
2583  *	Trim the routine table so that we have a number
2584  *	of routing entries less than or equal to the
2585  *	maximum number.
2586  */
2587 static void
2588 bridge_rttrim(struct bridge_softc *sc)
2589 {
2590 	struct bridge_rtnode *brt, *nbrt;
2591 
2592 	BRIDGE_LOCK_ASSERT(sc);
2593 
2594 	/* Make sure we actually need to do this. */
2595 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2596 		return;
2597 
2598 	/* Force an aging cycle; this might trim enough addresses. */
2599 	bridge_rtage(sc);
2600 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2601 		return;
2602 
2603 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2604 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2605 			bridge_rtnode_destroy(sc, brt);
2606 			if (sc->sc_brtcnt <= sc->sc_brtmax)
2607 				return;
2608 		}
2609 	}
2610 }
2611 
2612 /*
2613  * bridge_timer:
2614  *
2615  *	Aging timer for the bridge.
2616  */
2617 static void
2618 bridge_timer(void *arg)
2619 {
2620 	struct bridge_softc *sc = arg;
2621 
2622 	BRIDGE_LOCK_ASSERT(sc);
2623 
2624 	bridge_rtage(sc);
2625 
2626 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2627 		callout_reset(&sc->sc_brcallout,
2628 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
2629 }
2630 
2631 /*
2632  * bridge_rtage:
2633  *
2634  *	Perform an aging cycle.
2635  */
2636 static void
2637 bridge_rtage(struct bridge_softc *sc)
2638 {
2639 	struct bridge_rtnode *brt, *nbrt;
2640 
2641 	BRIDGE_LOCK_ASSERT(sc);
2642 
2643 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2644 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2645 			if (time_uptime >= brt->brt_expire)
2646 				bridge_rtnode_destroy(sc, brt);
2647 		}
2648 	}
2649 }
2650 
2651 /*
2652  * bridge_rtflush:
2653  *
2654  *	Remove all dynamic addresses from the bridge.
2655  */
2656 static void
2657 bridge_rtflush(struct bridge_softc *sc, int full)
2658 {
2659 	struct bridge_rtnode *brt, *nbrt;
2660 
2661 	BRIDGE_LOCK_ASSERT(sc);
2662 
2663 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2664 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2665 			bridge_rtnode_destroy(sc, brt);
2666 	}
2667 }
2668 
2669 /*
2670  * bridge_rtdaddr:
2671  *
2672  *	Remove an address from the table.
2673  */
2674 static int
2675 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2676 {
2677 	struct bridge_rtnode *brt;
2678 	int found = 0;
2679 
2680 	BRIDGE_LOCK_ASSERT(sc);
2681 
2682 	/*
2683 	 * If vlan is zero then we want to delete for all vlans so the lookup
2684 	 * may return more than one.
2685 	 */
2686 	while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
2687 		bridge_rtnode_destroy(sc, brt);
2688 		found = 1;
2689 	}
2690 
2691 	return (found ? 0 : ENOENT);
2692 }
2693 
2694 /*
2695  * bridge_rtdelete:
2696  *
2697  *	Delete routes to a speicifc member interface.
2698  */
2699 static void
2700 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2701 {
2702 	struct bridge_rtnode *brt, *nbrt;
2703 
2704 	BRIDGE_LOCK_ASSERT(sc);
2705 
2706 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
2707 		if (brt->brt_ifp == ifp && (full ||
2708 			    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2709 			bridge_rtnode_destroy(sc, brt);
2710 	}
2711 }
2712 
2713 /*
2714  * bridge_rtable_init:
2715  *
2716  *	Initialize the route table for this bridge.
2717  */
2718 static int
2719 bridge_rtable_init(struct bridge_softc *sc)
2720 {
2721 	int i;
2722 
2723 	sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2724 	    M_DEVBUF, M_NOWAIT);
2725 	if (sc->sc_rthash == NULL)
2726 		return (ENOMEM);
2727 
2728 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2729 		LIST_INIT(&sc->sc_rthash[i]);
2730 
2731 	sc->sc_rthash_key = arc4random();
2732 
2733 	LIST_INIT(&sc->sc_rtlist);
2734 
2735 	return (0);
2736 }
2737 
2738 /*
2739  * bridge_rtable_fini:
2740  *
2741  *	Deconstruct the route table for this bridge.
2742  */
2743 static void
2744 bridge_rtable_fini(struct bridge_softc *sc)
2745 {
2746 
2747 	KASSERT(sc->sc_brtcnt == 0,
2748 	    ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
2749 	free(sc->sc_rthash, M_DEVBUF);
2750 }
2751 
2752 /*
2753  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2754  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2755  */
2756 #define	mix(a, b, c)							\
2757 do {									\
2758 	a -= b; a -= c; a ^= (c >> 13);					\
2759 	b -= c; b -= a; b ^= (a << 8);					\
2760 	c -= a; c -= b; c ^= (b >> 13);					\
2761 	a -= b; a -= c; a ^= (c >> 12);					\
2762 	b -= c; b -= a; b ^= (a << 16);					\
2763 	c -= a; c -= b; c ^= (b >> 5);					\
2764 	a -= b; a -= c; a ^= (c >> 3);					\
2765 	b -= c; b -= a; b ^= (a << 10);					\
2766 	c -= a; c -= b; c ^= (b >> 15);					\
2767 } while (/*CONSTCOND*/0)
2768 
2769 static __inline uint32_t
2770 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2771 {
2772 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2773 
2774 	b += addr[5] << 8;
2775 	b += addr[4];
2776 	a += addr[3] << 24;
2777 	a += addr[2] << 16;
2778 	a += addr[1] << 8;
2779 	a += addr[0];
2780 
2781 	mix(a, b, c);
2782 
2783 	return (c & BRIDGE_RTHASH_MASK);
2784 }
2785 
2786 #undef mix
2787 
2788 static int
2789 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2790 {
2791 	int i, d;
2792 
2793 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2794 		d = ((int)a[i]) - ((int)b[i]);
2795 	}
2796 
2797 	return (d);
2798 }
2799 
2800 /*
2801  * bridge_rtnode_lookup:
2802  *
2803  *	Look up a bridge route node for the specified destination. Compare the
2804  *	vlan id or if zero then just return the first match.
2805  */
2806 static struct bridge_rtnode *
2807 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr, uint16_t vlan)
2808 {
2809 	struct bridge_rtnode *brt;
2810 	uint32_t hash;
2811 	int dir;
2812 
2813 	BRIDGE_LOCK_ASSERT(sc);
2814 
2815 	hash = bridge_rthash(sc, addr);
2816 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2817 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2818 		if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0))
2819 			return (brt);
2820 		if (dir > 0)
2821 			return (NULL);
2822 	}
2823 
2824 	return (NULL);
2825 }
2826 
2827 /*
2828  * bridge_rtnode_insert:
2829  *
2830  *	Insert the specified bridge node into the route table.  We
2831  *	assume the entry is not already in the table.
2832  */
2833 static int
2834 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2835 {
2836 	struct bridge_rtnode *lbrt;
2837 	uint32_t hash;
2838 	int dir;
2839 
2840 	BRIDGE_LOCK_ASSERT(sc);
2841 
2842 	hash = bridge_rthash(sc, brt->brt_addr);
2843 
2844 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2845 	if (lbrt == NULL) {
2846 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2847 		goto out;
2848 	}
2849 
2850 	do {
2851 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2852 		if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan)
2853 			return (EEXIST);
2854 		if (dir > 0) {
2855 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2856 			goto out;
2857 		}
2858 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2859 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2860 			goto out;
2861 		}
2862 		lbrt = LIST_NEXT(lbrt, brt_hash);
2863 	} while (lbrt != NULL);
2864 
2865 #ifdef DIAGNOSTIC
2866 	panic("bridge_rtnode_insert: impossible");
2867 #endif
2868 
2869 out:
2870 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2871 	sc->sc_brtcnt++;
2872 
2873 	return (0);
2874 }
2875 
2876 /*
2877  * bridge_rtnode_destroy:
2878  *
2879  *	Destroy a bridge rtnode.
2880  */
2881 static void
2882 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2883 {
2884 	BRIDGE_LOCK_ASSERT(sc);
2885 
2886 	LIST_REMOVE(brt, brt_hash);
2887 
2888 	LIST_REMOVE(brt, brt_list);
2889 	sc->sc_brtcnt--;
2890 	brt->brt_dst->bif_addrcnt--;
2891 	uma_zfree(bridge_rtnode_zone, brt);
2892 }
2893 
2894 /*
2895  * bridge_rtable_expire:
2896  *
2897  *	Set the expiry time for all routes on an interface.
2898  */
2899 static void
2900 bridge_rtable_expire(struct ifnet *ifp, int age)
2901 {
2902 	struct bridge_softc *sc = ifp->if_bridge;
2903 	struct bridge_rtnode *brt;
2904 
2905 	BRIDGE_LOCK(sc);
2906 
2907 	/*
2908 	 * If the age is zero then flush, otherwise set all the expiry times to
2909 	 * age for the interface
2910 	 */
2911 	if (age == 0)
2912 		bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
2913 	else {
2914 		LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
2915 			/* Cap the expiry time to 'age' */
2916 			if (brt->brt_ifp == ifp &&
2917 			    brt->brt_expire > time_uptime + age &&
2918 			    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2919 				brt->brt_expire = time_uptime + age;
2920 		}
2921 	}
2922 	BRIDGE_UNLOCK(sc);
2923 }
2924 
2925 /*
2926  * bridge_state_change:
2927  *
2928  *	Callback from the bridgestp code when a port changes states.
2929  */
2930 static void
2931 bridge_state_change(struct ifnet *ifp, int state)
2932 {
2933 	struct bridge_softc *sc = ifp->if_bridge;
2934 	static const char *stpstates[] = {
2935 		"disabled",
2936 		"listening",
2937 		"learning",
2938 		"forwarding",
2939 		"blocking",
2940 		"discarding"
2941 	};
2942 
2943 	if (log_stp)
2944 		log(LOG_NOTICE, "%s: state changed to %s on %s\n",
2945 		    sc->sc_ifp->if_xname, stpstates[state], ifp->if_xname);
2946 }
2947 
2948 /*
2949  * Send bridge packets through pfil if they are one of the types pfil can deal
2950  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2951  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2952  * that interface.
2953  */
2954 static int
2955 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2956 {
2957 	int snap, error, i, hlen;
2958 	struct ether_header *eh1, eh2;
2959 	struct ip_fw_args args;
2960 	struct ip *ip;
2961 	struct llc llc1;
2962 	u_int16_t ether_type;
2963 
2964 	snap = 0;
2965 	error = -1;	/* Default error if not error == 0 */
2966 
2967 #if 0
2968 	/* we may return with the IP fields swapped, ensure its not shared */
2969 	KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2970 #endif
2971 
2972 	if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2973 		return (0); /* filtering is disabled */
2974 
2975 	i = min((*mp)->m_pkthdr.len, max_protohdr);
2976 	if ((*mp)->m_len < i) {
2977 	    *mp = m_pullup(*mp, i);
2978 	    if (*mp == NULL) {
2979 		printf("%s: m_pullup failed\n", __func__);
2980 		return (-1);
2981 	    }
2982 	}
2983 
2984 	eh1 = mtod(*mp, struct ether_header *);
2985 	ether_type = ntohs(eh1->ether_type);
2986 
2987 	/*
2988 	 * Check for SNAP/LLC.
2989 	 */
2990 	if (ether_type < ETHERMTU) {
2991 		struct llc *llc2 = (struct llc *)(eh1 + 1);
2992 
2993 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2994 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
2995 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
2996 		    llc2->llc_control == LLC_UI) {
2997 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
2998 			snap = 1;
2999 		}
3000 	}
3001 
3002 	/*
3003 	 * If we're trying to filter bridge traffic, don't look at anything
3004 	 * other than IP and ARP traffic.  If the filter doesn't understand
3005 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
3006 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
3007 	 * but of course we don't have an AppleTalk filter to begin with.
3008 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
3009 	 * ARP traffic.)
3010 	 */
3011 	switch (ether_type) {
3012 		case ETHERTYPE_ARP:
3013 		case ETHERTYPE_REVARP:
3014 			if (pfil_ipfw_arp == 0)
3015 				return (0); /* Automatically pass */
3016 			break;
3017 
3018 		case ETHERTYPE_IP:
3019 #ifdef INET6
3020 		case ETHERTYPE_IPV6:
3021 #endif /* INET6 */
3022 			break;
3023 		default:
3024 			/*
3025 			 * Check to see if the user wants to pass non-ip
3026 			 * packets, these will not be checked by pfil(9) and
3027 			 * passed unconditionally so the default is to drop.
3028 			 */
3029 			if (pfil_onlyip)
3030 				goto bad;
3031 	}
3032 
3033 	/* Strip off the Ethernet header and keep a copy. */
3034 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
3035 	m_adj(*mp, ETHER_HDR_LEN);
3036 
3037 	/* Strip off snap header, if present */
3038 	if (snap) {
3039 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
3040 		m_adj(*mp, sizeof(struct llc));
3041 	}
3042 
3043 	/*
3044 	 * Check the IP header for alignment and errors
3045 	 */
3046 	if (dir == PFIL_IN) {
3047 		switch (ether_type) {
3048 			case ETHERTYPE_IP:
3049 				error = bridge_ip_checkbasic(mp);
3050 				break;
3051 #ifdef INET6
3052 			case ETHERTYPE_IPV6:
3053 				error = bridge_ip6_checkbasic(mp);
3054 				break;
3055 #endif /* INET6 */
3056 			default:
3057 				error = 0;
3058 		}
3059 		if (error)
3060 			goto bad;
3061 	}
3062 
3063 	/* XXX this section is also in if_ethersubr.c */
3064 	// XXX PFIL_OUT or DIR_OUT ?
3065 	if (V_ip_fw_chk_ptr && pfil_ipfw != 0 &&
3066 			dir == PFIL_OUT && ifp != NULL) {
3067 		struct m_tag *mtag;
3068 
3069 		error = -1;
3070 		/* fetch the start point from existing tags, if any */
3071 		mtag = m_tag_locate(*mp, MTAG_IPFW_RULE, 0, NULL);
3072 		if (mtag == NULL) {
3073 			args.rule.slot = 0;
3074 		} else {
3075 			struct ipfw_rule_ref *r;
3076 
3077 			/* XXX can we free the tag after use ? */
3078 			mtag->m_tag_id = PACKET_TAG_NONE;
3079 			r = (struct ipfw_rule_ref *)(mtag + 1);
3080 			/* packet already partially processed ? */
3081 			if (r->info & IPFW_ONEPASS)
3082 				goto ipfwpass;
3083 			args.rule = *r;
3084 		}
3085 
3086 		args.m = *mp;
3087 		args.oif = ifp;
3088 		args.next_hop = NULL;
3089 		args.eh = &eh2;
3090 		args.inp = NULL;	/* used by ipfw uid/gid/jail rules */
3091 		i = V_ip_fw_chk_ptr(&args);
3092 		*mp = args.m;
3093 
3094 		if (*mp == NULL)
3095 			return (error);
3096 
3097 		if (ip_dn_io_ptr && (i == IP_FW_DUMMYNET)) {
3098 
3099 			/* put the Ethernet header back on */
3100 			M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
3101 			if (*mp == NULL)
3102 				return (error);
3103 			bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3104 
3105 			/*
3106 			 * Pass the pkt to dummynet, which consumes it. The
3107 			 * packet will return to us via bridge_dummynet().
3108 			 */
3109 			args.oif = ifp;
3110 			ip_dn_io_ptr(mp, DIR_FWD | PROTO_IFB, &args);
3111 			return (error);
3112 		}
3113 
3114 		if (i != IP_FW_PASS) /* drop */
3115 			goto bad;
3116 	}
3117 
3118 ipfwpass:
3119 	error = 0;
3120 
3121 	/*
3122 	 * Run the packet through pfil
3123 	 */
3124 	switch (ether_type) {
3125 	case ETHERTYPE_IP:
3126 		/*
3127 		 * before calling the firewall, swap fields the same as
3128 		 * IP does. here we assume the header is contiguous
3129 		 */
3130 		ip = mtod(*mp, struct ip *);
3131 
3132 		ip->ip_len = ntohs(ip->ip_len);
3133 		ip->ip_off = ntohs(ip->ip_off);
3134 
3135 		/*
3136 		 * Run pfil on the member interface and the bridge, both can
3137 		 * be skipped by clearing pfil_member or pfil_bridge.
3138 		 *
3139 		 * Keep the order:
3140 		 *   in_if -> bridge_if -> out_if
3141 		 */
3142 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3143 			error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3144 					dir, NULL);
3145 
3146 		if (*mp == NULL || error != 0) /* filter may consume */
3147 			break;
3148 
3149 		if (pfil_member && ifp != NULL)
3150 			error = pfil_run_hooks(&V_inet_pfil_hook, mp, ifp,
3151 					dir, NULL);
3152 
3153 		if (*mp == NULL || error != 0) /* filter may consume */
3154 			break;
3155 
3156 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
3157 			error = pfil_run_hooks(&V_inet_pfil_hook, mp, bifp,
3158 					dir, NULL);
3159 
3160 		if (*mp == NULL || error != 0) /* filter may consume */
3161 			break;
3162 
3163 		/* check if we need to fragment the packet */
3164 		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
3165 			i = (*mp)->m_pkthdr.len;
3166 			if (i > ifp->if_mtu) {
3167 				error = bridge_fragment(ifp, *mp, &eh2, snap,
3168 					    &llc1);
3169 				return (error);
3170 			}
3171 		}
3172 
3173 		/* Recalculate the ip checksum and restore byte ordering */
3174 		ip = mtod(*mp, struct ip *);
3175 		hlen = ip->ip_hl << 2;
3176 		if (hlen < sizeof(struct ip))
3177 			goto bad;
3178 		if (hlen > (*mp)->m_len) {
3179 			if ((*mp = m_pullup(*mp, hlen)) == 0)
3180 				goto bad;
3181 			ip = mtod(*mp, struct ip *);
3182 			if (ip == NULL)
3183 				goto bad;
3184 		}
3185 		ip->ip_len = htons(ip->ip_len);
3186 		ip->ip_off = htons(ip->ip_off);
3187 		ip->ip_sum = 0;
3188 		if (hlen == sizeof(struct ip))
3189 			ip->ip_sum = in_cksum_hdr(ip);
3190 		else
3191 			ip->ip_sum = in_cksum(*mp, hlen);
3192 
3193 		break;
3194 #ifdef INET6
3195 	case ETHERTYPE_IPV6:
3196 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
3197 			error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3198 					dir, NULL);
3199 
3200 		if (*mp == NULL || error != 0) /* filter may consume */
3201 			break;
3202 
3203 		if (pfil_member && ifp != NULL)
3204 			error = pfil_run_hooks(&V_inet6_pfil_hook, mp, ifp,
3205 					dir, NULL);
3206 
3207 		if (*mp == NULL || error != 0) /* filter may consume */
3208 			break;
3209 
3210 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
3211 			error = pfil_run_hooks(&V_inet6_pfil_hook, mp, bifp,
3212 					dir, NULL);
3213 		break;
3214 #endif
3215 	default:
3216 		error = 0;
3217 		break;
3218 	}
3219 
3220 	if (*mp == NULL)
3221 		return (error);
3222 	if (error != 0)
3223 		goto bad;
3224 
3225 	error = -1;
3226 
3227 	/*
3228 	 * Finally, put everything back the way it was and return
3229 	 */
3230 	if (snap) {
3231 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
3232 		if (*mp == NULL)
3233 			return (error);
3234 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
3235 	}
3236 
3237 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
3238 	if (*mp == NULL)
3239 		return (error);
3240 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
3241 
3242 	return (0);
3243 
3244 bad:
3245 	m_freem(*mp);
3246 	*mp = NULL;
3247 	return (error);
3248 }
3249 
3250 /*
3251  * Perform basic checks on header size since
3252  * pfil assumes ip_input has already processed
3253  * it for it.  Cut-and-pasted from ip_input.c.
3254  * Given how simple the IPv6 version is,
3255  * does the IPv4 version really need to be
3256  * this complicated?
3257  *
3258  * XXX Should we update ipstat here, or not?
3259  * XXX Right now we update ipstat but not
3260  * XXX csum_counter.
3261  */
3262 static int
3263 bridge_ip_checkbasic(struct mbuf **mp)
3264 {
3265 	struct mbuf *m = *mp;
3266 	struct ip *ip;
3267 	int len, hlen;
3268 	u_short sum;
3269 
3270 	if (*mp == NULL)
3271 		return (-1);
3272 
3273 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3274 		if ((m = m_copyup(m, sizeof(struct ip),
3275 			(max_linkhdr + 3) & ~3)) == NULL) {
3276 			/* XXXJRT new stat, please */
3277 			KMOD_IPSTAT_INC(ips_toosmall);
3278 			goto bad;
3279 		}
3280 	} else if (__predict_false(m->m_len < sizeof (struct ip))) {
3281 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
3282 			KMOD_IPSTAT_INC(ips_toosmall);
3283 			goto bad;
3284 		}
3285 	}
3286 	ip = mtod(m, struct ip *);
3287 	if (ip == NULL) goto bad;
3288 
3289 	if (ip->ip_v != IPVERSION) {
3290 		KMOD_IPSTAT_INC(ips_badvers);
3291 		goto bad;
3292 	}
3293 	hlen = ip->ip_hl << 2;
3294 	if (hlen < sizeof(struct ip)) { /* minimum header length */
3295 		KMOD_IPSTAT_INC(ips_badhlen);
3296 		goto bad;
3297 	}
3298 	if (hlen > m->m_len) {
3299 		if ((m = m_pullup(m, hlen)) == 0) {
3300 			KMOD_IPSTAT_INC(ips_badhlen);
3301 			goto bad;
3302 		}
3303 		ip = mtod(m, struct ip *);
3304 		if (ip == NULL) goto bad;
3305 	}
3306 
3307 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
3308 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
3309 	} else {
3310 		if (hlen == sizeof(struct ip)) {
3311 			sum = in_cksum_hdr(ip);
3312 		} else {
3313 			sum = in_cksum(m, hlen);
3314 		}
3315 	}
3316 	if (sum) {
3317 		KMOD_IPSTAT_INC(ips_badsum);
3318 		goto bad;
3319 	}
3320 
3321 	/* Retrieve the packet length. */
3322 	len = ntohs(ip->ip_len);
3323 
3324 	/*
3325 	 * Check for additional length bogosity
3326 	 */
3327 	if (len < hlen) {
3328 		KMOD_IPSTAT_INC(ips_badlen);
3329 		goto bad;
3330 	}
3331 
3332 	/*
3333 	 * Check that the amount of data in the buffers
3334 	 * is as at least much as the IP header would have us expect.
3335 	 * Drop packet if shorter than we expect.
3336 	 */
3337 	if (m->m_pkthdr.len < len) {
3338 		KMOD_IPSTAT_INC(ips_tooshort);
3339 		goto bad;
3340 	}
3341 
3342 	/* Checks out, proceed */
3343 	*mp = m;
3344 	return (0);
3345 
3346 bad:
3347 	*mp = m;
3348 	return (-1);
3349 }
3350 
3351 #ifdef INET6
3352 /*
3353  * Same as above, but for IPv6.
3354  * Cut-and-pasted from ip6_input.c.
3355  * XXX Should we update ip6stat, or not?
3356  */
3357 static int
3358 bridge_ip6_checkbasic(struct mbuf **mp)
3359 {
3360 	struct mbuf *m = *mp;
3361 	struct ip6_hdr *ip6;
3362 
3363 	/*
3364 	 * If the IPv6 header is not aligned, slurp it up into a new
3365 	 * mbuf with space for link headers, in the event we forward
3366 	 * it.  Otherwise, if it is aligned, make sure the entire base
3367 	 * IPv6 header is in the first mbuf of the chain.
3368 	 */
3369 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
3370 		struct ifnet *inifp = m->m_pkthdr.rcvif;
3371 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
3372 			    (max_linkhdr + 3) & ~3)) == NULL) {
3373 			/* XXXJRT new stat, please */
3374 			V_ip6stat.ip6s_toosmall++;
3375 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3376 			goto bad;
3377 		}
3378 	} else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
3379 		struct ifnet *inifp = m->m_pkthdr.rcvif;
3380 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3381 			V_ip6stat.ip6s_toosmall++;
3382 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3383 			goto bad;
3384 		}
3385 	}
3386 
3387 	ip6 = mtod(m, struct ip6_hdr *);
3388 
3389 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3390 		V_ip6stat.ip6s_badvers++;
3391 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3392 		goto bad;
3393 	}
3394 
3395 	/* Checks out, proceed */
3396 	*mp = m;
3397 	return (0);
3398 
3399 bad:
3400 	*mp = m;
3401 	return (-1);
3402 }
3403 #endif /* INET6 */
3404 
3405 /*
3406  * bridge_fragment:
3407  *
3408  *	Return a fragmented mbuf chain.
3409  */
3410 static int
3411 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3412     int snap, struct llc *llc)
3413 {
3414 	struct mbuf *m0;
3415 	struct ip *ip;
3416 	int error = -1;
3417 
3418 	if (m->m_len < sizeof(struct ip) &&
3419 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
3420 		goto out;
3421 	ip = mtod(m, struct ip *);
3422 
3423 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3424 		    CSUM_DELAY_IP);
3425 	if (error)
3426 		goto out;
3427 
3428 	/* walk the chain and re-add the Ethernet header */
3429 	for (m0 = m; m0; m0 = m0->m_nextpkt) {
3430 		if (error == 0) {
3431 			if (snap) {
3432 				M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3433 				if (m0 == NULL) {
3434 					error = ENOBUFS;
3435 					continue;
3436 				}
3437 				bcopy(llc, mtod(m0, caddr_t),
3438 				    sizeof(struct llc));
3439 			}
3440 			M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3441 			if (m0 == NULL) {
3442 				error = ENOBUFS;
3443 				continue;
3444 			}
3445 			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3446 		} else
3447 			m_freem(m);
3448 	}
3449 
3450 	if (error == 0)
3451 		KMOD_IPSTAT_INC(ips_fragmented);
3452 
3453 	return (error);
3454 
3455 out:
3456 	if (m != NULL)
3457 		m_freem(m);
3458 	return (error);
3459 }
3460