xref: /freebsd/sys/net/if_bridge.c (revision b3a1f9373a31b644f8a65de1ba35929af3f6a9fe)
1 /*	$NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. All advertising materials mentioning features or use of this software
51  *    must display the following acknowledgement:
52  *	This product includes software developed by Jason L. Wright
53  * 4. The name of the author may not be used to endorse or promote products
54  *    derived from this software without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
66  * POSSIBILITY OF SUCH DAMAGE.
67  *
68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  */
81 
82 #include <sys/cdefs.h>
83 __FBSDID("$FreeBSD$");
84 
85 #include "opt_inet.h"
86 #include "opt_inet6.h"
87 #include "opt_carp.h"
88 
89 #include <sys/param.h>
90 #include <sys/mbuf.h>
91 #include <sys/malloc.h>
92 #include <sys/protosw.h>
93 #include <sys/systm.h>
94 #include <sys/time.h>
95 #include <sys/socket.h> /* for net/if.h */
96 #include <sys/sockio.h>
97 #include <sys/ctype.h>  /* string functions */
98 #include <sys/kernel.h>
99 #include <sys/random.h>
100 #include <sys/sysctl.h>
101 #include <vm/uma.h>
102 #include <sys/module.h>
103 #include <sys/proc.h>
104 #include <sys/lock.h>
105 #include <sys/mutex.h>
106 
107 #include <net/bpf.h>
108 #include <net/if.h>
109 #include <net/if_clone.h>
110 #include <net/if_dl.h>
111 #include <net/if_types.h>
112 #include <net/if_var.h>
113 #include <net/pfil.h>
114 
115 #include <netinet/in.h> /* for struct arpcom */
116 #include <netinet/in_systm.h>
117 #include <netinet/in_var.h>
118 #include <netinet/ip.h>
119 #include <netinet/ip_var.h>
120 #ifdef INET6
121 #include <netinet/ip6.h>
122 #include <netinet6/ip6_var.h>
123 #endif
124 #ifdef DEV_CARP
125 #include <netinet/ip_carp.h>
126 #endif
127 #include <machine/in_cksum.h>
128 #include <netinet/if_ether.h> /* for struct arpcom */
129 #include <net/if_bridgevar.h>
130 #include <net/if_llc.h>
131 
132 #include <net/route.h>
133 #include <netinet/ip_fw.h>
134 #include <netinet/ip_dummynet.h>
135 
136 /*
137  * Size of the route hash table.  Must be a power of two.
138  */
139 #ifndef BRIDGE_RTHASH_SIZE
140 #define	BRIDGE_RTHASH_SIZE		1024
141 #endif
142 
143 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
144 
145 /*
146  * Maximum number of addresses to cache.
147  */
148 #ifndef BRIDGE_RTABLE_MAX
149 #define	BRIDGE_RTABLE_MAX		100
150 #endif
151 
152 /*
153  * Spanning tree defaults.
154  */
155 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
156 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
157 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
158 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
159 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
160 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
161 #define	BSTP_DEFAULT_PATH_COST		55
162 
163 /*
164  * Timeout (in seconds) for entries learned dynamically.
165  */
166 #ifndef BRIDGE_RTABLE_TIMEOUT
167 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
168 #endif
169 
170 /*
171  * Number of seconds between walks of the route list.
172  */
173 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
174 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
175 #endif
176 
177 /*
178  * List of capabilities to mask on the member interface.
179  */
180 #define	BRIDGE_IFCAPS_MASK		IFCAP_TXCSUM
181 
182 static struct mtx 	bridge_list_mtx;
183 eventhandler_tag	bridge_detach_cookie = NULL;
184 
185 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
186 
187 uma_zone_t bridge_rtnode_zone;
188 
189 static int	bridge_clone_create(struct if_clone *, int);
190 static void	bridge_clone_destroy(struct ifnet *);
191 
192 static int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
193 static void	bridge_mutecaps(struct bridge_iflist *, int);
194 static void	bridge_ifdetach(void *arg __unused, struct ifnet *);
195 static void	bridge_init(void *);
196 static void	bridge_dummynet(struct mbuf *, struct ifnet *);
197 static void	bridge_stop(struct ifnet *, int);
198 static void	bridge_start(struct ifnet *);
199 static struct mbuf *bridge_input(struct ifnet *, struct mbuf *);
200 static int	bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
201 		    struct rtentry *);
202 
203 static void	bridge_forward(struct bridge_softc *, struct mbuf *m);
204 
205 static void	bridge_timer(void *);
206 
207 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
208 		    struct mbuf *, int);
209 static void	bridge_span(struct bridge_softc *, struct mbuf *);
210 
211 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
212 		    struct ifnet *, int, uint8_t);
213 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
214 static void	bridge_rttrim(struct bridge_softc *);
215 static void	bridge_rtage(struct bridge_softc *);
216 static void	bridge_rtflush(struct bridge_softc *, int);
217 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
218 
219 static int	bridge_rtable_init(struct bridge_softc *);
220 static void	bridge_rtable_fini(struct bridge_softc *);
221 
222 static int	bridge_rtnode_addr_cmp(const uint8_t *, const uint8_t *);
223 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
224 		    const uint8_t *);
225 static int	bridge_rtnode_insert(struct bridge_softc *,
226 		    struct bridge_rtnode *);
227 static void	bridge_rtnode_destroy(struct bridge_softc *,
228 		    struct bridge_rtnode *);
229 
230 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
231 		    const char *name);
232 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
233 		    struct ifnet *ifp);
234 static void	bridge_delete_member(struct bridge_softc *,
235 		    struct bridge_iflist *, int);
236 static void	bridge_delete_span(struct bridge_softc *,
237 		    struct bridge_iflist *);
238 
239 static int	bridge_ioctl_add(struct bridge_softc *, void *);
240 static int	bridge_ioctl_del(struct bridge_softc *, void *);
241 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
242 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
243 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
244 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
245 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
246 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
247 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
248 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
249 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
250 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
251 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
252 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
253 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
254 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
255 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
256 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
257 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
258 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
259 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
260 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
261 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
262 static int	bridge_ioctl_addspan(struct bridge_softc *, void *);
263 static int	bridge_ioctl_delspan(struct bridge_softc *, void *);
264 static int	bridge_pfil(struct mbuf **, struct ifnet *, struct ifnet *,
265 		    int);
266 static int	bridge_ip_checkbasic(struct mbuf **mp);
267 #ifdef INET6
268 static int	bridge_ip6_checkbasic(struct mbuf **mp);
269 #endif /* INET6 */
270 static int	bridge_fragment(struct ifnet *, struct mbuf *,
271 		    struct ether_header *, int, struct llc *);
272 
273 SYSCTL_DECL(_net_link);
274 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW, 0, "Bridge");
275 
276 static int pfil_onlyip = 1; /* only pass IP[46] packets when pfil is enabled */
277 static int pfil_bridge = 1; /* run pfil hooks on the bridge interface */
278 static int pfil_member = 1; /* run pfil hooks on the member interface */
279 static int pfil_ipfw = 0;   /* layer2 filter with ipfw */
280 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_onlyip, CTLFLAG_RW,
281     &pfil_onlyip, 0, "Only pass IP packets when pfil is enabled");
282 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_bridge, CTLFLAG_RW,
283     &pfil_bridge, 0, "Packet filter on the bridge interface");
284 SYSCTL_INT(_net_link_bridge, OID_AUTO, pfil_member, CTLFLAG_RW,
285     &pfil_member, 0, "Packet filter on the member interface");
286 
287 struct bridge_control {
288 	int	(*bc_func)(struct bridge_softc *, void *);
289 	int	bc_argsize;
290 	int	bc_flags;
291 };
292 
293 #define	BC_F_COPYIN		0x01	/* copy arguments in */
294 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
295 #define	BC_F_SUSER		0x04	/* do super-user check */
296 
297 const struct bridge_control bridge_control_table[] = {
298 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
299 	  BC_F_COPYIN|BC_F_SUSER },
300 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
301 	  BC_F_COPYIN|BC_F_SUSER },
302 
303 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
304 	  BC_F_COPYIN|BC_F_COPYOUT },
305 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
306 	  BC_F_COPYIN|BC_F_SUSER },
307 
308 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
309 	  BC_F_COPYIN|BC_F_SUSER },
310 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
311 	  BC_F_COPYOUT },
312 
313 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
314 	  BC_F_COPYIN|BC_F_COPYOUT },
315 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
316 	  BC_F_COPYIN|BC_F_COPYOUT },
317 
318 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
319 	  BC_F_COPYIN|BC_F_SUSER },
320 
321 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
322 	  BC_F_COPYIN|BC_F_SUSER },
323 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
324 	  BC_F_COPYOUT },
325 
326 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
327 	  BC_F_COPYIN|BC_F_SUSER },
328 
329 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
330 	  BC_F_COPYIN|BC_F_SUSER },
331 
332 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
333 	  BC_F_COPYOUT },
334 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
335 	  BC_F_COPYIN|BC_F_SUSER },
336 
337 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
338 	  BC_F_COPYOUT },
339 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
340 	  BC_F_COPYIN|BC_F_SUSER },
341 
342 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
343 	  BC_F_COPYOUT },
344 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
345 	  BC_F_COPYIN|BC_F_SUSER },
346 
347 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
348 	  BC_F_COPYOUT },
349 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
350 	  BC_F_COPYIN|BC_F_SUSER },
351 
352 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
353 	  BC_F_COPYIN|BC_F_SUSER },
354 
355 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
356 	  BC_F_COPYIN|BC_F_SUSER },
357 
358 	{ bridge_ioctl_addspan,		sizeof(struct ifbreq),
359 	  BC_F_COPYIN|BC_F_SUSER },
360 	{ bridge_ioctl_delspan,		sizeof(struct ifbreq),
361 	  BC_F_COPYIN|BC_F_SUSER },
362 };
363 const int bridge_control_table_size =
364     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
365 
366 static const u_char etherbroadcastaddr[ETHER_ADDR_LEN] =
367 			{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
368 
369 LIST_HEAD(, bridge_softc) bridge_list;
370 
371 IFC_SIMPLE_DECLARE(bridge, 0);
372 
373 static int
374 bridge_modevent(module_t mod, int type, void *data)
375 {
376 
377 	switch (type) {
378 	case MOD_LOAD:
379 		mtx_init(&bridge_list_mtx, "if_bridge list", NULL, MTX_DEF);
380 		if_clone_attach(&bridge_cloner);
381 		bridge_rtnode_zone = uma_zcreate("bridge_rtnode",
382 		    sizeof(struct bridge_rtnode), NULL, NULL, NULL, NULL,
383 		    UMA_ALIGN_PTR, 0);
384 		LIST_INIT(&bridge_list);
385 		bridge_input_p = bridge_input;
386 		bridge_output_p = bridge_output;
387 		bridge_dn_p = bridge_dummynet;
388 		bstp_linkstate_p = bstp_linkstate;
389 		bridge_detach_cookie = EVENTHANDLER_REGISTER(
390 		    ifnet_departure_event, bridge_ifdetach, NULL,
391 		    EVENTHANDLER_PRI_ANY);
392 		break;
393 	case MOD_UNLOAD:
394 		EVENTHANDLER_DEREGISTER(ifnet_departure_event,
395 		    bridge_detach_cookie);
396 		if_clone_detach(&bridge_cloner);
397 		uma_zdestroy(bridge_rtnode_zone);
398 		bridge_input_p = NULL;
399 		bridge_output_p = NULL;
400 		bridge_dn_p = NULL;
401 		bstp_linkstate_p = NULL;
402 		mtx_destroy(&bridge_list_mtx);
403 		break;
404 	default:
405 		return (EOPNOTSUPP);
406 	}
407 	return (0);
408 }
409 
410 static moduledata_t bridge_mod = {
411 	"if_bridge",
412 	bridge_modevent,
413 	0
414 };
415 
416 DECLARE_MODULE(if_bridge, bridge_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
417 
418 /*
419  * handler for net.link.bridge.pfil_ipfw
420  */
421 static int
422 sysctl_pfil_ipfw(SYSCTL_HANDLER_ARGS)
423 {
424 	int enable = pfil_ipfw;
425 	int error;
426 
427 	error = sysctl_handle_int(oidp, &enable, 0, req);
428 	enable = (enable) ? 1 : 0;
429 
430 	if (enable != pfil_ipfw) {
431 		pfil_ipfw = enable;
432 
433 		/*
434 		 * Disable pfil so that ipfw doesnt run twice, if the user
435 		 * really wants both then they can re-enable pfil_bridge and/or
436 		 * pfil_member. Also allow non-ip packets as ipfw can filter by
437 		 * layer2 type.
438 		 */
439 		if (pfil_ipfw) {
440 			pfil_onlyip = 0;
441 			pfil_bridge = 0;
442 			pfil_member = 0;
443 		}
444 	}
445 
446 	return (error);
447 }
448 SYSCTL_PROC(_net_link_bridge, OID_AUTO, ipfw, CTLTYPE_INT|CTLFLAG_RW,
449 	    &pfil_ipfw, 0, &sysctl_pfil_ipfw, "I", "Layer2 filter with IPFW");
450 
451 /*
452  * bridge_clone_create:
453  *
454  *	Create a new bridge instance.
455  */
456 static int
457 bridge_clone_create(struct if_clone *ifc, int unit)
458 {
459 	struct bridge_softc *sc, *sc2;
460 	struct ifnet *bifp, *ifp;
461 	u_char eaddr[6];
462 	int retry;
463 
464 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
465 	BRIDGE_LOCK_INIT(sc);
466 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
467 	if (ifp == NULL) {
468 		free(sc, M_DEVBUF);
469 		return (ENOSPC);
470 	}
471 
472 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
473 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
474 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
475 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
476 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
477 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
478 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
479 
480 	/* Initialize our routing table. */
481 	bridge_rtable_init(sc);
482 
483 	callout_init_mtx(&sc->sc_brcallout, &sc->sc_mtx, 0);
484 	callout_init_mtx(&sc->sc_bstpcallout, &sc->sc_mtx, 0);
485 
486 	LIST_INIT(&sc->sc_iflist);
487 	LIST_INIT(&sc->sc_spanlist);
488 
489 	ifp->if_softc = sc;
490 	if_initname(ifp, ifc->ifc_name, unit);
491 	ifp->if_mtu = ETHERMTU;
492 	ifp->if_flags = IFF_BROADCAST | IFF_MULTICAST;
493 	ifp->if_ioctl = bridge_ioctl;
494 	ifp->if_output = bridge_output;
495 	ifp->if_start = bridge_start;
496 	ifp->if_init = bridge_init;
497 	ifp->if_type = IFT_BRIDGE;
498 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
499 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
500 	IFQ_SET_READY(&ifp->if_snd);
501 	ifp->if_hdrlen = ETHER_HDR_LEN;
502 
503 	/*
504 	 * Generate a random ethernet address and use the private AC:DE:48
505 	 * OUI code.
506 	 *
507 	 * Since we are using random ethernet addresses for the bridge, it is
508 	 * possible that we might have address collisions, so make sure that
509 	 * this hardware address isn't already in use on another bridge.
510 	 */
511 	for (retry = 1; retry != 0;) {
512 		arc4rand(eaddr, ETHER_ADDR_LEN, 1);
513 		eaddr[0] = 0xAC;
514 		eaddr[1] = 0xDE;
515 		eaddr[2] = 0x48;
516 		retry = 0;
517 		mtx_lock(&bridge_list_mtx);
518 		LIST_FOREACH(sc2, &bridge_list, sc_list) {
519 			bifp = sc2->sc_ifp;
520 			if (memcmp(eaddr, IF_LLADDR(bifp), ETHER_ADDR_LEN) == 0)
521 				retry = 1;
522 		}
523 		mtx_unlock(&bridge_list_mtx);
524 	}
525 
526 	ether_ifattach(ifp, eaddr);
527 	/* Now undo some of the damage... */
528 	ifp->if_baudrate = 0;
529 	ifp->if_type = IFT_BRIDGE;
530 
531 	mtx_lock(&bridge_list_mtx);
532 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
533 	mtx_unlock(&bridge_list_mtx);
534 
535 	return (0);
536 }
537 
538 /*
539  * bridge_clone_destroy:
540  *
541  *	Destroy a bridge instance.
542  */
543 static void
544 bridge_clone_destroy(struct ifnet *ifp)
545 {
546 	struct bridge_softc *sc = ifp->if_softc;
547 	struct bridge_iflist *bif;
548 
549 	BRIDGE_LOCK(sc);
550 
551 	bridge_stop(ifp, 1);
552 	ifp->if_flags &= ~IFF_UP;
553 
554 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
555 		bridge_delete_member(sc, bif, 0);
556 
557 	while ((bif = LIST_FIRST(&sc->sc_spanlist)) != NULL) {
558 		bridge_delete_span(sc, bif);
559 	}
560 
561 	BRIDGE_UNLOCK(sc);
562 
563 	callout_drain(&sc->sc_brcallout);
564 	callout_drain(&sc->sc_bstpcallout);
565 
566 	mtx_lock(&bridge_list_mtx);
567 	LIST_REMOVE(sc, sc_list);
568 	mtx_unlock(&bridge_list_mtx);
569 
570 	ether_ifdetach(ifp);
571 	if_free_type(ifp, IFT_ETHER);
572 
573 	/* Tear down the routing table. */
574 	bridge_rtable_fini(sc);
575 
576 	BRIDGE_LOCK_DESTROY(sc);
577 	free(sc, M_DEVBUF);
578 }
579 
580 /*
581  * bridge_ioctl:
582  *
583  *	Handle a control request from the operator.
584  */
585 static int
586 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
587 {
588 	struct bridge_softc *sc = ifp->if_softc;
589 	struct thread *td = curthread;
590 	union {
591 		struct ifbreq ifbreq;
592 		struct ifbifconf ifbifconf;
593 		struct ifbareq ifbareq;
594 		struct ifbaconf ifbaconf;
595 		struct ifbrparam ifbrparam;
596 	} args;
597 	struct ifdrv *ifd = (struct ifdrv *) data;
598 	const struct bridge_control *bc;
599 	int error = 0;
600 
601 	BRIDGE_LOCK(sc);
602 
603 	switch (cmd) {
604 
605 	case SIOCADDMULTI:
606 	case SIOCDELMULTI:
607 		break;
608 
609 	case SIOCGDRVSPEC:
610 	case SIOCSDRVSPEC:
611 		if (ifd->ifd_cmd >= bridge_control_table_size) {
612 			error = EINVAL;
613 			break;
614 		}
615 		bc = &bridge_control_table[ifd->ifd_cmd];
616 
617 		if (cmd == SIOCGDRVSPEC &&
618 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
619 			error = EINVAL;
620 			break;
621 		}
622 		else if (cmd == SIOCSDRVSPEC &&
623 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
624 			error = EINVAL;
625 			break;
626 		}
627 
628 		if (bc->bc_flags & BC_F_SUSER) {
629 			error = suser(td);
630 			if (error)
631 				break;
632 		}
633 
634 		if (ifd->ifd_len != bc->bc_argsize ||
635 		    ifd->ifd_len > sizeof(args)) {
636 			error = EINVAL;
637 			break;
638 		}
639 
640 		bzero(&args, sizeof(args));
641 		if (bc->bc_flags & BC_F_COPYIN) {
642 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
643 			if (error)
644 				break;
645 		}
646 
647 		error = (*bc->bc_func)(sc, &args);
648 		if (error)
649 			break;
650 
651 		if (bc->bc_flags & BC_F_COPYOUT)
652 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
653 
654 		break;
655 
656 	case SIOCSIFFLAGS:
657 		if (!(ifp->if_flags & IFF_UP) &&
658 		    (ifp->if_drv_flags & IFF_DRV_RUNNING)) {
659 			/*
660 			 * If interface is marked down and it is running,
661 			 * then stop and disable it.
662 			 */
663 			bridge_stop(ifp, 1);
664 		} else if ((ifp->if_flags & IFF_UP) &&
665 		    !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
666 			/*
667 			 * If interface is marked up and it is stopped, then
668 			 * start it.
669 			 */
670 			BRIDGE_UNLOCK(sc);
671 			(*ifp->if_init)(sc);
672 		}
673 		break;
674 
675 	case SIOCSIFMTU:
676 		/* Do not allow the MTU to be changed on the bridge */
677 		error = EINVAL;
678 		break;
679 
680 	default:
681 		/*
682 		 * drop the lock as ether_ioctl() will call bridge_start() and
683 		 * cause the lock to be recursed.
684 		 */
685 		BRIDGE_UNLOCK(sc);
686 		error = ether_ioctl(ifp, cmd, data);
687 		break;
688 	}
689 
690 	if (BRIDGE_LOCKED(sc))
691 		BRIDGE_UNLOCK(sc);
692 
693 	return (error);
694 }
695 
696 /*
697  * bridge_mutecaps:
698  *
699  *	Clear or restore unwanted capabilities on the member interface
700  */
701 static void
702 bridge_mutecaps(struct bridge_iflist *bif, int mute)
703 {
704 	struct ifnet *ifp = bif->bif_ifp;
705 	struct ifreq ifr;
706 	int error;
707 
708 	if (ifp->if_ioctl == NULL)
709 		return;
710 
711 	bzero(&ifr, sizeof(ifr));
712 	ifr.ifr_reqcap = ifp->if_capenable;
713 
714 	if (mute) {
715 		/* mask off and save capabilities */
716 		bif->bif_mutecap = ifr.ifr_reqcap & BRIDGE_IFCAPS_MASK;
717 		if (bif->bif_mutecap != 0)
718 			ifr.ifr_reqcap &= ~BRIDGE_IFCAPS_MASK;
719 	} else
720 		/* restore muted capabilities */
721 		ifr.ifr_reqcap |= bif->bif_mutecap;
722 
723 
724 	if (bif->bif_mutecap != 0) {
725 		IFF_LOCKGIANT(ifp);
726 		error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
727 		IFF_UNLOCKGIANT(ifp);
728 	}
729 }
730 
731 /*
732  * bridge_lookup_member:
733  *
734  *	Lookup a bridge member interface.
735  */
736 static struct bridge_iflist *
737 bridge_lookup_member(struct bridge_softc *sc, const char *name)
738 {
739 	struct bridge_iflist *bif;
740 	struct ifnet *ifp;
741 
742 	BRIDGE_LOCK_ASSERT(sc);
743 
744 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
745 		ifp = bif->bif_ifp;
746 		if (strcmp(ifp->if_xname, name) == 0)
747 			return (bif);
748 	}
749 
750 	return (NULL);
751 }
752 
753 /*
754  * bridge_lookup_member_if:
755  *
756  *	Lookup a bridge member interface by ifnet*.
757  */
758 static struct bridge_iflist *
759 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
760 {
761 	struct bridge_iflist *bif;
762 
763 	BRIDGE_LOCK_ASSERT(sc);
764 
765 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
766 		if (bif->bif_ifp == member_ifp)
767 			return (bif);
768 	}
769 
770 	return (NULL);
771 }
772 
773 /*
774  * bridge_delete_member:
775  *
776  *	Delete the specified member interface.
777  */
778 static void
779 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif,
780     int gone)
781 {
782 	struct ifnet *ifs = bif->bif_ifp;
783 
784 	BRIDGE_LOCK_ASSERT(sc);
785 
786 	if (!gone) {
787 		switch (ifs->if_type) {
788 		case IFT_ETHER:
789 		case IFT_L2VLAN:
790 			/*
791 			 * Take the interface out of promiscuous mode.
792 			 */
793 			(void) ifpromisc(ifs, 0);
794 			bridge_mutecaps(bif, 0);
795 			break;
796 
797 		case IFT_GIF:
798 			break;
799 
800 		default:
801 #ifdef DIAGNOSTIC
802 			panic("bridge_delete_member: impossible");
803 #endif
804 			break;
805 		}
806 	}
807 
808 	ifs->if_bridge = NULL;
809 	BRIDGE_XLOCK(sc);
810 	LIST_REMOVE(bif, bif_next);
811 	BRIDGE_XDROP(sc);
812 
813 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
814 
815 	free(bif, M_DEVBUF);
816 
817 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
818 		bstp_initialization(sc);
819 }
820 
821 /*
822  * bridge_delete_span:
823  *
824  *	Delete the specified span interface.
825  */
826 static void
827 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
828 {
829 	BRIDGE_LOCK_ASSERT(sc);
830 
831 	KASSERT(bif->bif_ifp->if_bridge == NULL,
832 	    ("%s: not a span interface", __func__));
833 
834 	LIST_REMOVE(bif, bif_next);
835 	free(bif, M_DEVBUF);
836 }
837 
838 static int
839 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
840 {
841 	struct ifbreq *req = arg;
842 	struct bridge_iflist *bif = NULL;
843 	struct ifnet *ifs;
844 	int error = 0;
845 
846 	BRIDGE_LOCK_ASSERT(sc);
847 
848 	ifs = ifunit(req->ifbr_ifsname);
849 	if (ifs == NULL)
850 		return (ENOENT);
851 
852 	/* If it's in the span list, it can't be a member. */
853 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
854 		if (ifs == bif->bif_ifp)
855 			return (EBUSY);
856 
857 	/* Allow the first Ethernet member to define the MTU */
858 	if (ifs->if_type != IFT_GIF) {
859 		if (LIST_EMPTY(&sc->sc_iflist))
860 			sc->sc_ifp->if_mtu = ifs->if_mtu;
861 		else if (sc->sc_ifp->if_mtu != ifs->if_mtu) {
862 			if_printf(sc->sc_ifp, "invalid MTU for %s\n",
863 			    ifs->if_xname);
864 			return (EINVAL);
865 		}
866 	}
867 
868 	if (ifs->if_bridge == sc)
869 		return (EEXIST);
870 
871 	if (ifs->if_bridge != NULL)
872 		return (EBUSY);
873 
874 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
875 	if (bif == NULL)
876 		return (ENOMEM);
877 
878 	bif->bif_ifp = ifs;
879 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
880 	bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
881 	bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
882 
883 	switch (ifs->if_type) {
884 	case IFT_ETHER:
885 	case IFT_L2VLAN:
886 		/*
887 		 * Place the interface into promiscuous mode.
888 		 */
889 		error = ifpromisc(ifs, 1);
890 		if (error)
891 			goto out;
892 
893 		bridge_mutecaps(bif, 1);
894 		break;
895 
896 	case IFT_GIF:
897 		break;
898 
899 	default:
900 		error = EINVAL;
901 		goto out;
902 	}
903 
904 	ifs->if_bridge = sc;
905 	/*
906 	 * XXX: XLOCK HERE!?!
907 	 *
908 	 * NOTE: insert_***HEAD*** should be safe for the traversals.
909 	 */
910 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
911 
912 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
913 		bstp_initialization(sc);
914 	else
915 		bstp_stop(sc);
916 
917 out:
918 	if (error) {
919 		if (bif != NULL)
920 			free(bif, M_DEVBUF);
921 	}
922 	return (error);
923 }
924 
925 static int
926 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
927 {
928 	struct ifbreq *req = arg;
929 	struct bridge_iflist *bif;
930 
931 	BRIDGE_LOCK_ASSERT(sc);
932 
933 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
934 	if (bif == NULL)
935 		return (ENOENT);
936 
937 	bridge_delete_member(sc, bif, 0);
938 
939 	return (0);
940 }
941 
942 static int
943 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
944 {
945 	struct ifbreq *req = arg;
946 	struct bridge_iflist *bif;
947 
948 	BRIDGE_LOCK_ASSERT(sc);
949 
950 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
951 	if (bif == NULL)
952 		return (ENOENT);
953 
954 	req->ifbr_ifsflags = bif->bif_flags;
955 	req->ifbr_state = bif->bif_state;
956 	req->ifbr_priority = bif->bif_priority;
957 	req->ifbr_path_cost = bif->bif_path_cost;
958 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
959 
960 	return (0);
961 }
962 
963 static int
964 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
965 {
966 	struct ifbreq *req = arg;
967 	struct bridge_iflist *bif;
968 
969 	BRIDGE_LOCK_ASSERT(sc);
970 
971 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
972 	if (bif == NULL)
973 		return (ENOENT);
974 
975 	if (req->ifbr_ifsflags & IFBIF_SPAN)
976 		/* SPAN is readonly */
977 		return (EINVAL);
978 
979 	if (req->ifbr_ifsflags & IFBIF_STP) {
980 		switch (bif->bif_ifp->if_type) {
981 		case IFT_ETHER:
982 			/* These can do spanning tree. */
983 			break;
984 
985 		default:
986 			/* Nothing else can. */
987 			return (EINVAL);
988 		}
989 	}
990 
991 	bif->bif_flags = req->ifbr_ifsflags;
992 
993 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
994 		bstp_initialization(sc);
995 
996 	return (0);
997 }
998 
999 static int
1000 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
1001 {
1002 	struct ifbrparam *param = arg;
1003 
1004 	BRIDGE_LOCK_ASSERT(sc);
1005 
1006 	sc->sc_brtmax = param->ifbrp_csize;
1007 	bridge_rttrim(sc);
1008 
1009 	return (0);
1010 }
1011 
1012 static int
1013 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
1014 {
1015 	struct ifbrparam *param = arg;
1016 
1017 	BRIDGE_LOCK_ASSERT(sc);
1018 
1019 	param->ifbrp_csize = sc->sc_brtmax;
1020 
1021 	return (0);
1022 }
1023 
1024 static int
1025 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
1026 {
1027 	struct ifbifconf *bifc = arg;
1028 	struct bridge_iflist *bif;
1029 	struct ifbreq breq;
1030 	int count, len, error = 0;
1031 
1032 	BRIDGE_LOCK_ASSERT(sc);
1033 
1034 	count = 0;
1035 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
1036 		count++;
1037 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1038 		count++;
1039 
1040 	if (bifc->ifbic_len == 0) {
1041 		bifc->ifbic_len = sizeof(breq) * count;
1042 		return (0);
1043 	}
1044 
1045 	count = 0;
1046 	len = bifc->ifbic_len;
1047 	bzero(&breq, sizeof(breq));
1048 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1049 		if (len < sizeof(breq))
1050 			break;
1051 
1052 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1053 		    sizeof(breq.ifbr_ifsname));
1054 		breq.ifbr_ifsflags = bif->bif_flags;
1055 		breq.ifbr_state = bif->bif_state;
1056 		breq.ifbr_priority = bif->bif_priority;
1057 		breq.ifbr_path_cost = bif->bif_path_cost;
1058 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1059 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1060 		if (error)
1061 			break;
1062 		count++;
1063 		len -= sizeof(breq);
1064 	}
1065 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1066 		if (len < sizeof(breq))
1067 			break;
1068 
1069 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
1070 		    sizeof(breq.ifbr_ifsname));
1071 		breq.ifbr_ifsflags = bif->bif_flags;
1072 		breq.ifbr_state = bif->bif_state;
1073 		breq.ifbr_priority = bif->bif_priority;
1074 		breq.ifbr_path_cost = bif->bif_path_cost;
1075 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
1076 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
1077 		if (error)
1078 			break;
1079 		count++;
1080 		len -= sizeof(breq);
1081 	}
1082 
1083 	bifc->ifbic_len = sizeof(breq) * count;
1084 	return (error);
1085 }
1086 
1087 static int
1088 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1089 {
1090 	struct ifbaconf *bac = arg;
1091 	struct bridge_rtnode *brt;
1092 	struct ifbareq bareq;
1093 	int count = 0, error = 0, len;
1094 
1095 	BRIDGE_LOCK_ASSERT(sc);
1096 
1097 	if (bac->ifbac_len == 0)
1098 		return (0);
1099 
1100 	len = bac->ifbac_len;
1101 	bzero(&bareq, sizeof(bareq));
1102 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1103 		if (len < sizeof(bareq))
1104 			goto out;
1105 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1106 		    sizeof(bareq.ifba_ifsname));
1107 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1108 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
1109 				time_uptime < brt->brt_expire)
1110 			bareq.ifba_expire = brt->brt_expire - time_uptime;
1111 		else
1112 			bareq.ifba_expire = 0;
1113 		bareq.ifba_flags = brt->brt_flags;
1114 
1115 		error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1116 		if (error)
1117 			goto out;
1118 		count++;
1119 		len -= sizeof(bareq);
1120 	}
1121 out:
1122 	bac->ifbac_len = sizeof(bareq) * count;
1123 	return (error);
1124 }
1125 
1126 static int
1127 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1128 {
1129 	struct ifbareq *req = arg;
1130 	struct bridge_iflist *bif;
1131 	int error;
1132 
1133 	BRIDGE_LOCK_ASSERT(sc);
1134 
1135 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1136 	if (bif == NULL)
1137 		return (ENOENT);
1138 
1139 	error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1140 	    req->ifba_flags);
1141 
1142 	return (error);
1143 }
1144 
1145 static int
1146 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1147 {
1148 	struct ifbrparam *param = arg;
1149 
1150 	BRIDGE_LOCK_ASSERT(sc);
1151 
1152 	sc->sc_brttimeout = param->ifbrp_ctime;
1153 
1154 	return (0);
1155 }
1156 
1157 static int
1158 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1159 {
1160 	struct ifbrparam *param = arg;
1161 
1162 	BRIDGE_LOCK_ASSERT(sc);
1163 
1164 	param->ifbrp_ctime = sc->sc_brttimeout;
1165 
1166 	return (0);
1167 }
1168 
1169 static int
1170 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1171 {
1172 	struct ifbareq *req = arg;
1173 
1174 	BRIDGE_LOCK_ASSERT(sc);
1175 
1176 	return (bridge_rtdaddr(sc, req->ifba_dst));
1177 }
1178 
1179 static int
1180 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1181 {
1182 	struct ifbreq *req = arg;
1183 
1184 	BRIDGE_LOCK_ASSERT(sc);
1185 
1186 	bridge_rtflush(sc, req->ifbr_ifsflags);
1187 
1188 	return (0);
1189 }
1190 
1191 static int
1192 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1193 {
1194 	struct ifbrparam *param = arg;
1195 
1196 	BRIDGE_LOCK_ASSERT(sc);
1197 
1198 	param->ifbrp_prio = sc->sc_bridge_priority;
1199 
1200 	return (0);
1201 }
1202 
1203 static int
1204 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1205 {
1206 	struct ifbrparam *param = arg;
1207 
1208 	BRIDGE_LOCK_ASSERT(sc);
1209 
1210 	sc->sc_bridge_priority = param->ifbrp_prio;
1211 
1212 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1213 		bstp_initialization(sc);
1214 
1215 	return (0);
1216 }
1217 
1218 static int
1219 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1220 {
1221 	struct ifbrparam *param = arg;
1222 
1223 	BRIDGE_LOCK_ASSERT(sc);
1224 
1225 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1226 
1227 	return (0);
1228 }
1229 
1230 static int
1231 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1232 {
1233 	struct ifbrparam *param = arg;
1234 
1235 	BRIDGE_LOCK_ASSERT(sc);
1236 
1237 	if (param->ifbrp_hellotime == 0)
1238 		return (EINVAL);
1239 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1240 
1241 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1242 		bstp_initialization(sc);
1243 
1244 	return (0);
1245 }
1246 
1247 static int
1248 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1249 {
1250 	struct ifbrparam *param = arg;
1251 
1252 	BRIDGE_LOCK_ASSERT(sc);
1253 
1254 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1255 
1256 	return (0);
1257 }
1258 
1259 static int
1260 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1261 {
1262 	struct ifbrparam *param = arg;
1263 
1264 	BRIDGE_LOCK_ASSERT(sc);
1265 
1266 	if (param->ifbrp_fwddelay == 0)
1267 		return (EINVAL);
1268 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1269 
1270 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1271 		bstp_initialization(sc);
1272 
1273 	return (0);
1274 }
1275 
1276 static int
1277 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1278 {
1279 	struct ifbrparam *param = arg;
1280 
1281 	BRIDGE_LOCK_ASSERT(sc);
1282 
1283 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1284 
1285 	return (0);
1286 }
1287 
1288 static int
1289 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1290 {
1291 	struct ifbrparam *param = arg;
1292 
1293 	BRIDGE_LOCK_ASSERT(sc);
1294 
1295 	if (param->ifbrp_maxage == 0)
1296 		return (EINVAL);
1297 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1298 
1299 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1300 		bstp_initialization(sc);
1301 
1302 	return (0);
1303 }
1304 
1305 static int
1306 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1307 {
1308 	struct ifbreq *req = arg;
1309 	struct bridge_iflist *bif;
1310 
1311 	BRIDGE_LOCK_ASSERT(sc);
1312 
1313 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1314 	if (bif == NULL)
1315 		return (ENOENT);
1316 
1317 	bif->bif_priority = req->ifbr_priority;
1318 
1319 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1320 		bstp_initialization(sc);
1321 
1322 	return (0);
1323 }
1324 
1325 static int
1326 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1327 {
1328 	struct ifbreq *req = arg;
1329 	struct bridge_iflist *bif;
1330 
1331 	BRIDGE_LOCK_ASSERT(sc);
1332 
1333 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1334 	if (bif == NULL)
1335 		return (ENOENT);
1336 
1337 	bif->bif_path_cost = req->ifbr_path_cost;
1338 
1339 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
1340 		bstp_initialization(sc);
1341 
1342 	return (0);
1343 }
1344 
1345 static int
1346 bridge_ioctl_addspan(struct bridge_softc *sc, void *arg)
1347 {
1348 	struct ifbreq *req = arg;
1349 	struct bridge_iflist *bif = NULL;
1350 	struct ifnet *ifs;
1351 
1352 	BRIDGE_LOCK_ASSERT(sc);
1353 
1354 	ifs = ifunit(req->ifbr_ifsname);
1355 	if (ifs == NULL)
1356 		return (ENOENT);
1357 
1358 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1359 		if (ifs == bif->bif_ifp)
1360 			return (EBUSY);
1361 
1362 	if (ifs->if_bridge != NULL)
1363 		return (EBUSY);
1364 
1365 	switch (ifs->if_type) {
1366 		case IFT_ETHER:
1367 		case IFT_L2VLAN:
1368 			break;
1369 		default:
1370 			return (EINVAL);
1371 	}
1372 
1373 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
1374 	if (bif == NULL)
1375 		return (ENOMEM);
1376 
1377 	bif->bif_ifp = ifs;
1378 	bif->bif_flags = IFBIF_SPAN;
1379 
1380 	LIST_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
1381 
1382 	return (0);
1383 }
1384 
1385 static int
1386 bridge_ioctl_delspan(struct bridge_softc *sc, void *arg)
1387 {
1388 	struct ifbreq *req = arg;
1389 	struct bridge_iflist *bif;
1390 	struct ifnet *ifs;
1391 
1392 	BRIDGE_LOCK_ASSERT(sc);
1393 
1394 	ifs = ifunit(req->ifbr_ifsname);
1395 	if (ifs == NULL)
1396 		return (ENOENT);
1397 
1398 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1399 		if (ifs == bif->bif_ifp)
1400 			break;
1401 
1402 	if (bif == NULL)
1403 		return (ENOENT);
1404 
1405 	bridge_delete_span(sc, bif);
1406 
1407 	return (0);
1408 }
1409 
1410 /*
1411  * bridge_ifdetach:
1412  *
1413  *	Detach an interface from a bridge.  Called when a member
1414  *	interface is detaching.
1415  */
1416 static void
1417 bridge_ifdetach(void *arg __unused, struct ifnet *ifp)
1418 {
1419 	struct bridge_softc *sc = ifp->if_bridge;
1420 	struct bridge_iflist *bif;
1421 
1422 	/* Check if the interface is a bridge member */
1423 	if (sc != NULL) {
1424 		BRIDGE_LOCK(sc);
1425 
1426 		bif = bridge_lookup_member_if(sc, ifp);
1427 		if (bif != NULL)
1428 			bridge_delete_member(sc, bif, 1);
1429 
1430 		BRIDGE_UNLOCK(sc);
1431 		return;
1432 	}
1433 
1434 	/* Check if the interface is a span port */
1435 	mtx_lock(&bridge_list_mtx);
1436 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1437 		BRIDGE_LOCK(sc);
1438 		LIST_FOREACH(bif, &sc->sc_spanlist, bif_next)
1439 			if (ifp == bif->bif_ifp) {
1440 				bridge_delete_span(sc, bif);
1441 				break;
1442 			}
1443 
1444 		BRIDGE_UNLOCK(sc);
1445 	}
1446 	mtx_unlock(&bridge_list_mtx);
1447 }
1448 
1449 /*
1450  * bridge_init:
1451  *
1452  *	Initialize a bridge interface.
1453  */
1454 static void
1455 bridge_init(void *xsc)
1456 {
1457 	struct bridge_softc *sc = (struct bridge_softc *)xsc;
1458 	struct ifnet *ifp = sc->sc_ifp;
1459 
1460 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1461 		return;
1462 
1463 	BRIDGE_LOCK(sc);
1464 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1465 	    bridge_timer, sc);
1466 
1467 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1468 	bstp_initialization(sc);
1469 	BRIDGE_UNLOCK(sc);
1470 }
1471 
1472 /*
1473  * bridge_stop:
1474  *
1475  *	Stop the bridge interface.
1476  */
1477 static void
1478 bridge_stop(struct ifnet *ifp, int disable)
1479 {
1480 	struct bridge_softc *sc = ifp->if_softc;
1481 
1482 	BRIDGE_LOCK_ASSERT(sc);
1483 
1484 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1485 		return;
1486 
1487 	callout_stop(&sc->sc_brcallout);
1488 	bstp_stop(sc);
1489 
1490 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1491 
1492 	ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
1493 }
1494 
1495 /*
1496  * bridge_enqueue:
1497  *
1498  *	Enqueue a packet on a bridge member interface.
1499  *
1500  */
1501 __inline void
1502 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m)
1503 {
1504 	int len, err = 0;
1505 	short mflags;
1506 	struct mbuf *m0;
1507 
1508 	len = m->m_pkthdr.len;
1509 	mflags = m->m_flags;
1510 
1511 	/* We may be sending a framgment so traverse the mbuf */
1512 	for (; m; m = m0) {
1513 		m0 = m->m_nextpkt;
1514 		m->m_nextpkt = NULL;
1515 
1516 		if (err == 0)
1517 			IFQ_ENQUEUE(&dst_ifp->if_snd, m, err);
1518 	}
1519 
1520 	if (err == 0) {
1521 
1522 		sc->sc_ifp->if_opackets++;
1523 		sc->sc_ifp->if_obytes += len;
1524 
1525 		dst_ifp->if_obytes += len;
1526 
1527 		if (mflags & M_MCAST) {
1528 			sc->sc_ifp->if_omcasts++;
1529 			dst_ifp->if_omcasts++;
1530 		}
1531 	}
1532 
1533 	if ((dst_ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
1534 		(*dst_ifp->if_start)(dst_ifp);
1535 }
1536 
1537 /*
1538  * bridge_dummynet:
1539  *
1540  * 	Receive a queued packet from dummynet and pass it on to the output
1541  * 	interface.
1542  *
1543  *	The mbuf has the Ethernet header already attached.
1544  */
1545 static void
1546 bridge_dummynet(struct mbuf *m, struct ifnet *ifp)
1547 {
1548 	struct bridge_softc *sc;
1549 
1550 	sc = ifp->if_bridge;
1551 
1552 	/*
1553 	 * The packet didnt originate from a member interface. This should only
1554 	 * ever happen if a member interface is removed while packets are
1555 	 * queued for it.
1556 	 */
1557 	if (sc == NULL) {
1558 		m_freem(m);
1559 		return;
1560 	}
1561 
1562 	if (PFIL_HOOKED(&inet_pfil_hook)
1563 #ifdef INET6
1564 	    || PFIL_HOOKED(&inet6_pfil_hook)
1565 #endif
1566 	    ) {
1567 		if (bridge_pfil(&m, sc->sc_ifp, ifp, PFIL_OUT) != 0)
1568 			return;
1569 		if (m == NULL)
1570 			return;
1571 	}
1572 
1573 	bridge_enqueue(sc, ifp, m);
1574 }
1575 
1576 /*
1577  * bridge_output:
1578  *
1579  *	Send output from a bridge member interface.  This
1580  *	performs the bridging function for locally originated
1581  *	packets.
1582  *
1583  *	The mbuf has the Ethernet header already attached.  We must
1584  *	enqueue or free the mbuf before returning.
1585  */
1586 static int
1587 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1588     struct rtentry *rt)
1589 {
1590 	struct ether_header *eh;
1591 	struct ifnet *dst_if;
1592 	struct bridge_softc *sc;
1593 
1594 	if (m->m_len < ETHER_HDR_LEN) {
1595 		m = m_pullup(m, ETHER_HDR_LEN);
1596 		if (m == NULL)
1597 			return (0);
1598 	}
1599 
1600 	eh = mtod(m, struct ether_header *);
1601 	sc = ifp->if_bridge;
1602 
1603 	BRIDGE_LOCK(sc);
1604 
1605 	/*
1606 	 * If bridge is down, but the original output interface is up,
1607 	 * go ahead and send out that interface.  Otherwise, the packet
1608 	 * is dropped below.
1609 	 */
1610 	if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1611 		dst_if = ifp;
1612 		goto sendunicast;
1613 	}
1614 
1615 	/*
1616 	 * If the packet is a multicast, or we don't know a better way to
1617 	 * get there, send to all interfaces.
1618 	 */
1619 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1620 		dst_if = NULL;
1621 	else
1622 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1623 	if (dst_if == NULL) {
1624 		struct bridge_iflist *bif;
1625 		struct mbuf *mc;
1626 		int error = 0, used = 0;
1627 
1628 		BRIDGE_LOCK2REF(sc, error);
1629 		if (error) {
1630 			m_freem(m);
1631 			return (0);
1632 		}
1633 
1634 		bridge_span(sc, m);
1635 
1636 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1637 			dst_if = bif->bif_ifp;
1638 
1639 			if (dst_if->if_type == IFT_GIF)
1640 				continue;
1641 			if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
1642 				continue;
1643 
1644 			/*
1645 			 * If this is not the original output interface,
1646 			 * and the interface is participating in spanning
1647 			 * tree, make sure the port is in a state that
1648 			 * allows forwarding.
1649 			 */
1650 			if (dst_if != ifp &&
1651 			    (bif->bif_flags & IFBIF_STP) != 0) {
1652 				switch (bif->bif_state) {
1653 				case BSTP_IFSTATE_BLOCKING:
1654 				case BSTP_IFSTATE_LISTENING:
1655 				case BSTP_IFSTATE_DISABLED:
1656 					continue;
1657 				}
1658 			}
1659 
1660 			if (LIST_NEXT(bif, bif_next) == NULL) {
1661 				used = 1;
1662 				mc = m;
1663 			} else {
1664 				mc = m_copypacket(m, M_DONTWAIT);
1665 				if (mc == NULL) {
1666 					sc->sc_ifp->if_oerrors++;
1667 					continue;
1668 				}
1669 			}
1670 
1671 			bridge_enqueue(sc, dst_if, mc);
1672 		}
1673 		if (used == 0)
1674 			m_freem(m);
1675 		BRIDGE_UNREF(sc);
1676 		return (0);
1677 	}
1678 
1679 sendunicast:
1680 	/*
1681 	 * XXX Spanning tree consideration here?
1682 	 */
1683 
1684 	bridge_span(sc, m);
1685 	if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1686 		m_freem(m);
1687 		BRIDGE_UNLOCK(sc);
1688 		return (0);
1689 	}
1690 
1691 	BRIDGE_UNLOCK(sc);
1692 	bridge_enqueue(sc, dst_if, m);
1693 	return (0);
1694 }
1695 
1696 /*
1697  * bridge_start:
1698  *
1699  *	Start output on a bridge.
1700  *
1701  */
1702 static void
1703 bridge_start(struct ifnet *ifp)
1704 {
1705 	struct bridge_softc *sc;
1706 	struct mbuf *m;
1707 	struct ether_header *eh;
1708 	struct ifnet *dst_if;
1709 
1710 	sc = ifp->if_softc;
1711 
1712 	ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1713 	for (;;) {
1714 		IFQ_DEQUEUE(&ifp->if_snd, m);
1715 		if (m == 0)
1716 			break;
1717 		BPF_MTAP(ifp, m);
1718 
1719 		eh = mtod(m, struct ether_header *);
1720 		dst_if = NULL;
1721 
1722 		BRIDGE_LOCK(sc);
1723 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1724 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1725 		}
1726 
1727 		if (dst_if == NULL)
1728 			bridge_broadcast(sc, ifp, m, 0);
1729 		else {
1730 			BRIDGE_UNLOCK(sc);
1731 			bridge_enqueue(sc, dst_if, m);
1732 		}
1733 	}
1734 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1735 }
1736 
1737 /*
1738  * bridge_forward:
1739  *
1740  *	The forwarding function of the bridge.
1741  *
1742  *	NOTE: Releases the lock on return.
1743  */
1744 static void
1745 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1746 {
1747 	struct bridge_iflist *bif;
1748 	struct ifnet *src_if, *dst_if, *ifp;
1749 	struct ether_header *eh;
1750 
1751 	src_if = m->m_pkthdr.rcvif;
1752 	BRIDGE_LOCK_ASSERT(sc);
1753 	ifp = sc->sc_ifp;
1754 
1755 	sc->sc_ifp->if_ipackets++;
1756 	sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
1757 
1758 	/*
1759 	 * Look up the bridge_iflist.
1760 	 */
1761 	bif = bridge_lookup_member_if(sc, src_if);
1762 	if (bif == NULL) {
1763 		/* Interface is not a bridge member (anymore?) */
1764 		BRIDGE_UNLOCK(sc);
1765 		m_freem(m);
1766 		return;
1767 	}
1768 
1769 	if (bif->bif_flags & IFBIF_STP) {
1770 		switch (bif->bif_state) {
1771 		case BSTP_IFSTATE_BLOCKING:
1772 		case BSTP_IFSTATE_LISTENING:
1773 		case BSTP_IFSTATE_DISABLED:
1774 			BRIDGE_UNLOCK(sc);
1775 			m_freem(m);
1776 			return;
1777 		}
1778 	}
1779 
1780 	eh = mtod(m, struct ether_header *);
1781 
1782 	/*
1783 	 * If the interface is learning, and the source
1784 	 * address is valid and not multicast, record
1785 	 * the address.
1786 	 */
1787 	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1788 	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1789 	    (eh->ether_shost[0] == 0 &&
1790 	     eh->ether_shost[1] == 0 &&
1791 	     eh->ether_shost[2] == 0 &&
1792 	     eh->ether_shost[3] == 0 &&
1793 	     eh->ether_shost[4] == 0 &&
1794 	     eh->ether_shost[5] == 0) == 0) {
1795 		(void) bridge_rtupdate(sc, eh->ether_shost,
1796 		    src_if, 0, IFBAF_DYNAMIC);
1797 	}
1798 
1799 	if ((bif->bif_flags & IFBIF_STP) != 0 &&
1800 	    bif->bif_state == BSTP_IFSTATE_LEARNING) {
1801 		m_freem(m);
1802 		BRIDGE_UNLOCK(sc);
1803 		return;
1804 	}
1805 
1806 	/*
1807 	 * At this point, the port either doesn't participate
1808 	 * in spanning tree or it is in the forwarding state.
1809 	 */
1810 
1811 	/*
1812 	 * If the packet is unicast, destined for someone on
1813 	 * "this" side of the bridge, drop it.
1814 	 */
1815 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1816 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1817 		if (src_if == dst_if) {
1818 			BRIDGE_UNLOCK(sc);
1819 			m_freem(m);
1820 			return;
1821 		}
1822 	} else {
1823 		/* ...forward it to all interfaces. */
1824 		sc->sc_ifp->if_imcasts++;
1825 		dst_if = NULL;
1826 	}
1827 
1828 	/*
1829 	 * If we have a destination interface which is a member of our bridge,
1830 	 * OR this is a unicast packet, push it through the bpf(4) machinery.
1831 	 * For broadcast or multicast packets, don't bother because it will
1832 	 * be reinjected into ether_input. We do this before we pass the packets
1833 	 * through the pfil(9) framework, as it is possible that pfil(9) will
1834 	 * drop the packet, or possibly modify it, making it difficult to debug
1835 	 * firewall issues on the bridge.
1836 	 */
1837 	if (dst_if != NULL || (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1838 		BPF_MTAP(ifp, m);
1839 
1840 	/* run the packet filter */
1841 	if (PFIL_HOOKED(&inet_pfil_hook)
1842 #ifdef INET6
1843 	    || PFIL_HOOKED(&inet6_pfil_hook)
1844 #endif
1845 	    ) {
1846 		BRIDGE_UNLOCK(sc);
1847 		if (bridge_pfil(&m, ifp, src_if, PFIL_IN) != 0)
1848 			return;
1849 		if (m == NULL)
1850 			return;
1851 		BRIDGE_LOCK(sc);
1852 	}
1853 
1854 	if (dst_if == NULL) {
1855 		bridge_broadcast(sc, src_if, m, 1);
1856 		return;
1857 	}
1858 
1859 	/*
1860 	 * At this point, we're dealing with a unicast frame
1861 	 * going to a different interface.
1862 	 */
1863 	if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1864 		BRIDGE_UNLOCK(sc);
1865 		m_freem(m);
1866 		return;
1867 	}
1868 	bif = bridge_lookup_member_if(sc, dst_if);
1869 	if (bif == NULL) {
1870 		/* Not a member of the bridge (anymore?) */
1871 		BRIDGE_UNLOCK(sc);
1872 		m_freem(m);
1873 		return;
1874 	}
1875 
1876 	if (bif->bif_flags & IFBIF_STP) {
1877 		switch (bif->bif_state) {
1878 		case BSTP_IFSTATE_DISABLED:
1879 		case BSTP_IFSTATE_BLOCKING:
1880 			BRIDGE_UNLOCK(sc);
1881 			m_freem(m);
1882 			return;
1883 		}
1884 	}
1885 
1886 	BRIDGE_UNLOCK(sc);
1887 
1888 	if (PFIL_HOOKED(&inet_pfil_hook)
1889 #ifdef INET6
1890 	    || PFIL_HOOKED(&inet6_pfil_hook)
1891 #endif
1892 	    ) {
1893 		if (bridge_pfil(&m, sc->sc_ifp, dst_if, PFIL_OUT) != 0)
1894 			return;
1895 		if (m == NULL)
1896 			return;
1897 	}
1898 
1899 	bridge_enqueue(sc, dst_if, m);
1900 }
1901 
1902 /*
1903  * bridge_input:
1904  *
1905  *	Receive input from a member interface.  Queue the packet for
1906  *	bridging if it is not for us.
1907  */
1908 static struct mbuf *
1909 bridge_input(struct ifnet *ifp, struct mbuf *m)
1910 {
1911 	struct bridge_softc *sc = ifp->if_bridge;
1912 	struct bridge_iflist *bif;
1913 	struct ifnet *bifp;
1914 	struct ether_header *eh;
1915 	struct mbuf *mc, *mc2;
1916 
1917 	if ((sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1918 		return (m);
1919 
1920 	bifp = sc->sc_ifp;
1921 
1922 	/*
1923 	 * Implement support for bridge monitoring. If this flag has been
1924 	 * set on this interface, discard the packet once we push it through
1925 	 * the bpf(4) machinery, but before we do, increment the byte and
1926 	 * packet counters associated with this interface.
1927 	 */
1928 	if ((bifp->if_flags & IFF_MONITOR) != 0) {
1929 		m->m_pkthdr.rcvif  = bifp;
1930 		BPF_MTAP(bifp, m);
1931 		bifp->if_ipackets++;
1932 		bifp->if_ibytes += m->m_pkthdr.len;
1933 		m_free(m);
1934 		return (NULL);
1935 	}
1936 	BRIDGE_LOCK(sc);
1937 	bif = bridge_lookup_member_if(sc, ifp);
1938 	if (bif == NULL) {
1939 		BRIDGE_UNLOCK(sc);
1940 		return (m);
1941 	}
1942 
1943 	eh = mtod(m, struct ether_header *);
1944 
1945 	if (memcmp(eh->ether_dhost, IF_LLADDR(bifp),
1946 	    ETHER_ADDR_LEN) == 0) {
1947 		/*
1948 		 * If the packet is for us, set the packets source as the
1949 		 * bridge, and return the packet back to ether_input for
1950 		 * local processing.
1951 		 */
1952 
1953 		/* Mark the packet as arriving on the bridge interface */
1954 		m->m_pkthdr.rcvif = bifp;
1955 		BPF_MTAP(bifp, m);
1956 		bifp->if_ipackets++;
1957 
1958 		BRIDGE_UNLOCK(sc);
1959 		return (m);
1960 	}
1961 
1962 	bridge_span(sc, m);
1963 
1964 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1965 		/* Tap off 802.1D packets; they do not get forwarded. */
1966 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1967 		    ETHER_ADDR_LEN) == 0) {
1968 			m = bstp_input(ifp, m);
1969 			if (m == NULL) {
1970 				BRIDGE_UNLOCK(sc);
1971 				return (NULL);
1972 			}
1973 		}
1974 
1975 		if (bif->bif_flags & IFBIF_STP) {
1976 			switch (bif->bif_state) {
1977 			case BSTP_IFSTATE_BLOCKING:
1978 			case BSTP_IFSTATE_LISTENING:
1979 			case BSTP_IFSTATE_DISABLED:
1980 				BRIDGE_UNLOCK(sc);
1981 				return (m);
1982 			}
1983 		}
1984 
1985 		if (bcmp(etherbroadcastaddr, eh->ether_dhost,
1986 		    sizeof(etherbroadcastaddr)) == 0)
1987 			m->m_flags |= M_BCAST;
1988 		else
1989 			m->m_flags |= M_MCAST;
1990 
1991 		/*
1992 		 * Make a deep copy of the packet and enqueue the copy
1993 		 * for bridge processing; return the original packet for
1994 		 * local processing.
1995 		 */
1996 		mc = m_dup(m, M_DONTWAIT);
1997 		if (mc == NULL) {
1998 			BRIDGE_UNLOCK(sc);
1999 			return (m);
2000 		}
2001 
2002 		/* Perform the bridge forwarding function with the copy. */
2003 		bridge_forward(sc, mc);
2004 
2005 		/*
2006 		 * Reinject the mbuf as arriving on the bridge so we have a
2007 		 * chance at claiming multicast packets. We can not loop back
2008 		 * here from ether_input as a bridge is never a member of a
2009 		 * bridge.
2010 		 */
2011 		KASSERT(bifp->if_bridge == NULL,
2012 		    ("loop created in bridge_input"));
2013 		mc2 = m_dup(m, M_DONTWAIT);
2014 		if (mc2 != NULL) {
2015 			/* Keep the layer3 header aligned */
2016 			int i = min(mc2->m_pkthdr.len, max_protohdr);
2017 			mc2 = m_copyup(mc2, i, ETHER_ALIGN);
2018 		}
2019 		if (mc2 != NULL) {
2020 			mc2->m_pkthdr.rcvif = bifp;
2021 			(*bifp->if_input)(bifp, mc2);
2022 		}
2023 
2024 		/* Return the original packet for local processing. */
2025 		return (m);
2026 	}
2027 
2028 	if (bif->bif_flags & IFBIF_STP) {
2029 		switch (bif->bif_state) {
2030 		case BSTP_IFSTATE_BLOCKING:
2031 		case BSTP_IFSTATE_LISTENING:
2032 		case BSTP_IFSTATE_DISABLED:
2033 			BRIDGE_UNLOCK(sc);
2034 			return (m);
2035 		}
2036 	}
2037 
2038 	/*
2039 	 * Unicast.  Make sure it's not for us.
2040 	 */
2041 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2042 		if (bif->bif_ifp->if_type == IFT_GIF)
2043 			continue;
2044 		/* It is destined for us. */
2045 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_dhost,
2046 		    ETHER_ADDR_LEN) == 0
2047 #ifdef DEV_CARP
2048 		    || (bif->bif_ifp->if_carp
2049 			&& carp_forus(bif->bif_ifp->if_carp, eh->ether_dhost))
2050 #endif
2051 		    ) {
2052 			if (bif->bif_flags & IFBIF_LEARNING)
2053 				(void) bridge_rtupdate(sc,
2054 				    eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
2055 			m->m_pkthdr.rcvif = bif->bif_ifp;
2056 			BRIDGE_UNLOCK(sc);
2057 			return (m);
2058 		}
2059 
2060 		/* We just received a packet that we sent out. */
2061 		if (memcmp(IF_LLADDR(bif->bif_ifp), eh->ether_shost,
2062 		    ETHER_ADDR_LEN) == 0
2063 #ifdef DEV_CARP
2064 		    || (bif->bif_ifp->if_carp
2065 			&& carp_forus(bif->bif_ifp->if_carp, eh->ether_shost))
2066 #endif
2067 		    ) {
2068 			BRIDGE_UNLOCK(sc);
2069 			m_freem(m);
2070 			return (NULL);
2071 		}
2072 	}
2073 
2074 	/* Perform the bridge forwarding function. */
2075 	bridge_forward(sc, m);
2076 
2077 	return (NULL);
2078 }
2079 
2080 /*
2081  * bridge_broadcast:
2082  *
2083  *	Send a frame to all interfaces that are members of
2084  *	the bridge, except for the one on which the packet
2085  *	arrived.
2086  *
2087  *	NOTE: Releases the lock on return.
2088  */
2089 static void
2090 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
2091     struct mbuf *m, int runfilt)
2092 {
2093 	struct bridge_iflist *bif;
2094 	struct mbuf *mc;
2095 	struct ifnet *dst_if;
2096 	int error = 0, used = 0, i;
2097 
2098 	BRIDGE_LOCK_ASSERT(sc);
2099 	BRIDGE_LOCK2REF(sc, error);
2100 	if (error) {
2101 		m_freem(m);
2102 		return;
2103 	}
2104 
2105 	/* Filter on the bridge interface before broadcasting */
2106 	if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2107 #ifdef INET6
2108 	    || PFIL_HOOKED(&inet6_pfil_hook)
2109 #endif
2110 	    )) {
2111 		if (bridge_pfil(&m, sc->sc_ifp, NULL, PFIL_OUT) != 0)
2112 			goto out;
2113 		if (m == NULL)
2114 			goto out;
2115 	}
2116 
2117 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
2118 		dst_if = bif->bif_ifp;
2119 		if (dst_if == src_if)
2120 			continue;
2121 
2122 		if (bif->bif_flags & IFBIF_STP) {
2123 			switch (bif->bif_state) {
2124 			case BSTP_IFSTATE_BLOCKING:
2125 			case BSTP_IFSTATE_DISABLED:
2126 				continue;
2127 			}
2128 		}
2129 
2130 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
2131 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
2132 			continue;
2133 
2134 		if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2135 			continue;
2136 
2137 		if (LIST_NEXT(bif, bif_next) == NULL) {
2138 			mc = m;
2139 			used = 1;
2140 		} else {
2141 			mc = m_dup(m, M_DONTWAIT);
2142 			if (mc == NULL) {
2143 				sc->sc_ifp->if_oerrors++;
2144 				continue;
2145 			}
2146 		}
2147 
2148 		/*
2149 		 * Filter on the output interface. Pass a NULL bridge interface
2150 		 * pointer so we do not redundantly filter on the bridge for
2151 		 * each interface we broadcast on.
2152 		 */
2153 		if (runfilt && (PFIL_HOOKED(&inet_pfil_hook)
2154 #ifdef INET6
2155 		    || PFIL_HOOKED(&inet6_pfil_hook)
2156 #endif
2157 		    )) {
2158 			if (used == 0) {
2159 				/* Keep the layer3 header aligned */
2160 				i = min(mc->m_pkthdr.len, max_protohdr);
2161 				mc = m_copyup(mc, i, ETHER_ALIGN);
2162 				if (mc == NULL) {
2163 					sc->sc_ifp->if_oerrors++;
2164 					continue;
2165 				}
2166 			}
2167 			if (bridge_pfil(&mc, NULL, dst_if, PFIL_OUT) != 0)
2168 				continue;
2169 			if (mc == NULL)
2170 				continue;
2171 		}
2172 
2173 		bridge_enqueue(sc, dst_if, mc);
2174 	}
2175 	if (used == 0)
2176 		m_freem(m);
2177 
2178 out:
2179 	BRIDGE_UNREF(sc);
2180 }
2181 
2182 /*
2183  * bridge_span:
2184  *
2185  *	Duplicate a packet out one or more interfaces that are in span mode,
2186  *	the original mbuf is unmodified.
2187  */
2188 static void
2189 bridge_span(struct bridge_softc *sc, struct mbuf *m)
2190 {
2191 	struct bridge_iflist *bif;
2192 	struct ifnet *dst_if;
2193 	struct mbuf *mc;
2194 
2195 	if (LIST_EMPTY(&sc->sc_spanlist))
2196 		return;
2197 
2198 	LIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2199 		dst_if = bif->bif_ifp;
2200 
2201 		if ((dst_if->if_drv_flags & IFF_DRV_RUNNING) == 0)
2202 			continue;
2203 
2204 		mc = m_copypacket(m, M_DONTWAIT);
2205 		if (mc == NULL) {
2206 			sc->sc_ifp->if_oerrors++;
2207 			continue;
2208 		}
2209 
2210 		bridge_enqueue(sc, dst_if, mc);
2211 	}
2212 }
2213 
2214 /*
2215  * bridge_rtupdate:
2216  *
2217  *	Add a bridge routing entry.
2218  */
2219 static int
2220 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
2221     struct ifnet *dst_if, int setflags, uint8_t flags)
2222 {
2223 	struct bridge_rtnode *brt;
2224 	int error;
2225 
2226 	BRIDGE_LOCK_ASSERT(sc);
2227 
2228 	/*
2229 	 * A route for this destination might already exist.  If so,
2230 	 * update it, otherwise create a new one.
2231 	 */
2232 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
2233 		if (sc->sc_brtcnt >= sc->sc_brtmax)
2234 			return (ENOSPC);
2235 
2236 		/*
2237 		 * Allocate a new bridge forwarding node, and
2238 		 * initialize the expiration time and Ethernet
2239 		 * address.
2240 		 */
2241 		brt = uma_zalloc(bridge_rtnode_zone, M_NOWAIT | M_ZERO);
2242 		if (brt == NULL)
2243 			return (ENOMEM);
2244 
2245 		brt->brt_flags = IFBAF_DYNAMIC;
2246 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
2247 
2248 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
2249 			uma_zfree(bridge_rtnode_zone, brt);
2250 			return (error);
2251 		}
2252 	}
2253 
2254 	if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2255 		brt->brt_ifp = dst_if;
2256 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2257 		brt->brt_expire = time_uptime + sc->sc_brttimeout;
2258 	if (setflags)
2259 		brt->brt_flags = flags;
2260 
2261 	return (0);
2262 }
2263 
2264 /*
2265  * bridge_rtlookup:
2266  *
2267  *	Lookup the destination interface for an address.
2268  */
2269 static struct ifnet *
2270 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
2271 {
2272 	struct bridge_rtnode *brt;
2273 
2274 	BRIDGE_LOCK_ASSERT(sc);
2275 
2276 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2277 		return (NULL);
2278 
2279 	return (brt->brt_ifp);
2280 }
2281 
2282 /*
2283  * bridge_rttrim:
2284  *
2285  *	Trim the routine table so that we have a number
2286  *	of routing entries less than or equal to the
2287  *	maximum number.
2288  */
2289 static void
2290 bridge_rttrim(struct bridge_softc *sc)
2291 {
2292 	struct bridge_rtnode *brt, *nbrt;
2293 
2294 	BRIDGE_LOCK_ASSERT(sc);
2295 
2296 	/* Make sure we actually need to do this. */
2297 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2298 		return;
2299 
2300 	/* Force an aging cycle; this might trim enough addresses. */
2301 	bridge_rtage(sc);
2302 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2303 		return;
2304 
2305 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2306 		nbrt = LIST_NEXT(brt, brt_list);
2307 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2308 			bridge_rtnode_destroy(sc, brt);
2309 			if (sc->sc_brtcnt <= sc->sc_brtmax)
2310 				return;
2311 		}
2312 	}
2313 }
2314 
2315 /*
2316  * bridge_timer:
2317  *
2318  *	Aging timer for the bridge.
2319  */
2320 static void
2321 bridge_timer(void *arg)
2322 {
2323 	struct bridge_softc *sc = arg;
2324 
2325 	BRIDGE_LOCK_ASSERT(sc);
2326 
2327 	bridge_rtage(sc);
2328 
2329 	if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
2330 		callout_reset(&sc->sc_brcallout,
2331 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
2332 }
2333 
2334 /*
2335  * bridge_rtage:
2336  *
2337  *	Perform an aging cycle.
2338  */
2339 static void
2340 bridge_rtage(struct bridge_softc *sc)
2341 {
2342 	struct bridge_rtnode *brt, *nbrt;
2343 
2344 	BRIDGE_LOCK_ASSERT(sc);
2345 
2346 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2347 		nbrt = LIST_NEXT(brt, brt_list);
2348 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2349 			if (time_uptime >= brt->brt_expire)
2350 				bridge_rtnode_destroy(sc, brt);
2351 		}
2352 	}
2353 }
2354 
2355 /*
2356  * bridge_rtflush:
2357  *
2358  *	Remove all dynamic addresses from the bridge.
2359  */
2360 static void
2361 bridge_rtflush(struct bridge_softc *sc, int full)
2362 {
2363 	struct bridge_rtnode *brt, *nbrt;
2364 
2365 	BRIDGE_LOCK_ASSERT(sc);
2366 
2367 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2368 		nbrt = LIST_NEXT(brt, brt_list);
2369 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2370 			bridge_rtnode_destroy(sc, brt);
2371 	}
2372 }
2373 
2374 /*
2375  * bridge_rtdaddr:
2376  *
2377  *	Remove an address from the table.
2378  */
2379 static int
2380 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2381 {
2382 	struct bridge_rtnode *brt;
2383 
2384 	BRIDGE_LOCK_ASSERT(sc);
2385 
2386 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
2387 		return (ENOENT);
2388 
2389 	bridge_rtnode_destroy(sc, brt);
2390 	return (0);
2391 }
2392 
2393 /*
2394  * bridge_rtdelete:
2395  *
2396  *	Delete routes to a speicifc member interface.
2397  */
2398 void
2399 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
2400 {
2401 	struct bridge_rtnode *brt, *nbrt;
2402 
2403 	BRIDGE_LOCK_ASSERT(sc);
2404 
2405 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2406 		nbrt = LIST_NEXT(brt, brt_list);
2407 		if (brt->brt_ifp == ifp && (full ||
2408 			    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC))
2409 			bridge_rtnode_destroy(sc, brt);
2410 	}
2411 }
2412 
2413 /*
2414  * bridge_rtable_init:
2415  *
2416  *	Initialize the route table for this bridge.
2417  */
2418 static int
2419 bridge_rtable_init(struct bridge_softc *sc)
2420 {
2421 	int i;
2422 
2423 	sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2424 	    M_DEVBUF, M_NOWAIT);
2425 	if (sc->sc_rthash == NULL)
2426 		return (ENOMEM);
2427 
2428 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2429 		LIST_INIT(&sc->sc_rthash[i]);
2430 
2431 	sc->sc_rthash_key = arc4random();
2432 
2433 	LIST_INIT(&sc->sc_rtlist);
2434 
2435 	return (0);
2436 }
2437 
2438 /*
2439  * bridge_rtable_fini:
2440  *
2441  *	Deconstruct the route table for this bridge.
2442  */
2443 static void
2444 bridge_rtable_fini(struct bridge_softc *sc)
2445 {
2446 
2447 	free(sc->sc_rthash, M_DEVBUF);
2448 }
2449 
2450 /*
2451  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2452  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2453  */
2454 #define	mix(a, b, c)							\
2455 do {									\
2456 	a -= b; a -= c; a ^= (c >> 13);					\
2457 	b -= c; b -= a; b ^= (a << 8);					\
2458 	c -= a; c -= b; c ^= (b >> 13);					\
2459 	a -= b; a -= c; a ^= (c >> 12);					\
2460 	b -= c; b -= a; b ^= (a << 16);					\
2461 	c -= a; c -= b; c ^= (b >> 5);					\
2462 	a -= b; a -= c; a ^= (c >> 3);					\
2463 	b -= c; b -= a; b ^= (a << 10);					\
2464 	c -= a; c -= b; c ^= (b >> 15);					\
2465 } while (/*CONSTCOND*/0)
2466 
2467 static __inline uint32_t
2468 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2469 {
2470 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2471 
2472 	b += addr[5] << 8;
2473 	b += addr[4];
2474 	a += addr[3] << 24;
2475 	a += addr[2] << 16;
2476 	a += addr[1] << 8;
2477 	a += addr[0];
2478 
2479 	mix(a, b, c);
2480 
2481 	return (c & BRIDGE_RTHASH_MASK);
2482 }
2483 
2484 #undef mix
2485 
2486 static int
2487 bridge_rtnode_addr_cmp(const uint8_t *a, const uint8_t *b)
2488 {
2489 	int i, d;
2490 
2491 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
2492 		d = ((int)a[i]) - ((int)b[i]);
2493 	}
2494 
2495 	return (d);
2496 }
2497 
2498 /*
2499  * bridge_rtnode_lookup:
2500  *
2501  *	Look up a bridge route node for the specified destination.
2502  */
2503 static struct bridge_rtnode *
2504 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2505 {
2506 	struct bridge_rtnode *brt;
2507 	uint32_t hash;
2508 	int dir;
2509 
2510 	BRIDGE_LOCK_ASSERT(sc);
2511 
2512 	hash = bridge_rthash(sc, addr);
2513 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2514 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
2515 		if (dir == 0)
2516 			return (brt);
2517 		if (dir > 0)
2518 			return (NULL);
2519 	}
2520 
2521 	return (NULL);
2522 }
2523 
2524 /*
2525  * bridge_rtnode_insert:
2526  *
2527  *	Insert the specified bridge node into the route table.  We
2528  *	assume the entry is not already in the table.
2529  */
2530 static int
2531 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2532 {
2533 	struct bridge_rtnode *lbrt;
2534 	uint32_t hash;
2535 	int dir;
2536 
2537 	BRIDGE_LOCK_ASSERT(sc);
2538 
2539 	hash = bridge_rthash(sc, brt->brt_addr);
2540 
2541 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2542 	if (lbrt == NULL) {
2543 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2544 		goto out;
2545 	}
2546 
2547 	do {
2548 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
2549 		if (dir == 0)
2550 			return (EEXIST);
2551 		if (dir > 0) {
2552 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2553 			goto out;
2554 		}
2555 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2556 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2557 			goto out;
2558 		}
2559 		lbrt = LIST_NEXT(lbrt, brt_hash);
2560 	} while (lbrt != NULL);
2561 
2562 #ifdef DIAGNOSTIC
2563 	panic("bridge_rtnode_insert: impossible");
2564 #endif
2565 
2566 out:
2567 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2568 	sc->sc_brtcnt++;
2569 
2570 	return (0);
2571 }
2572 
2573 /*
2574  * bridge_rtnode_destroy:
2575  *
2576  *	Destroy a bridge rtnode.
2577  */
2578 static void
2579 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2580 {
2581 	BRIDGE_LOCK_ASSERT(sc);
2582 
2583 	LIST_REMOVE(brt, brt_hash);
2584 
2585 	LIST_REMOVE(brt, brt_list);
2586 	sc->sc_brtcnt--;
2587 	uma_zfree(bridge_rtnode_zone, brt);
2588 }
2589 
2590 /*
2591  * Send bridge packets through pfil if they are one of the types pfil can deal
2592  * with, or if they are ARP or REVARP.  (pfil will pass ARP and REVARP without
2593  * question.) If *bifp or *ifp are NULL then packet filtering is skipped for
2594  * that interface.
2595  */
2596 static int
2597 bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
2598 {
2599 	int snap, error, i, hlen;
2600 	struct ether_header *eh1, eh2;
2601 	struct ip_fw_args args;
2602 	struct ip *ip;
2603 	struct llc llc1;
2604 	u_int16_t ether_type;
2605 
2606 	snap = 0;
2607 	error = -1;	/* Default error if not error == 0 */
2608 
2609 	/* we may return with the IP fields swapped, ensure its not shared */
2610 	KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__));
2611 
2612 	if (pfil_bridge == 0 && pfil_member == 0 && pfil_ipfw == 0)
2613 		return (0); /* filtering is disabled */
2614 
2615 	i = min((*mp)->m_pkthdr.len, max_protohdr);
2616 	if ((*mp)->m_len < i) {
2617 	    *mp = m_pullup(*mp, i);
2618 	    if (*mp == NULL) {
2619 		printf("%s: m_pullup failed\n", __func__);
2620 		return (-1);
2621 	    }
2622 	}
2623 
2624 	eh1 = mtod(*mp, struct ether_header *);
2625 	ether_type = ntohs(eh1->ether_type);
2626 
2627 	/*
2628 	 * Check for SNAP/LLC.
2629 	 */
2630 	if (ether_type < ETHERMTU) {
2631 		struct llc *llc2 = (struct llc *)(eh1 + 1);
2632 
2633 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2634 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
2635 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
2636 		    llc2->llc_control == LLC_UI) {
2637 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
2638 			snap = 1;
2639 		}
2640 	}
2641 
2642 	/*
2643 	 * If we're trying to filter bridge traffic, don't look at anything
2644 	 * other than IP and ARP traffic.  If the filter doesn't understand
2645 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
2646 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
2647 	 * but of course we don't have an AppleTalk filter to begin with.
2648 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
2649 	 * ARP traffic.)
2650 	 */
2651 	switch (ether_type) {
2652 		case ETHERTYPE_ARP:
2653 		case ETHERTYPE_REVARP:
2654 			return (0); /* Automatically pass */
2655 		case ETHERTYPE_IP:
2656 #ifdef INET6
2657 		case ETHERTYPE_IPV6:
2658 #endif /* INET6 */
2659 			break;
2660 		default:
2661 			/*
2662 			 * Check to see if the user wants to pass non-ip
2663 			 * packets, these will not be checked by pfil(9) and
2664 			 * passed unconditionally so the default is to drop.
2665 			 */
2666 			if (pfil_onlyip)
2667 				goto bad;
2668 	}
2669 
2670 	/* Strip off the Ethernet header and keep a copy. */
2671 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
2672 	m_adj(*mp, ETHER_HDR_LEN);
2673 
2674 	/* Strip off snap header, if present */
2675 	if (snap) {
2676 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc1);
2677 		m_adj(*mp, sizeof(struct llc));
2678 	}
2679 
2680 	/*
2681 	 * Check the IP header for alignment and errors
2682 	 */
2683 	if (dir == PFIL_IN) {
2684 		switch (ether_type) {
2685 			case ETHERTYPE_IP:
2686 				error = bridge_ip_checkbasic(mp);
2687 				break;
2688 #ifdef INET6
2689 			case ETHERTYPE_IPV6:
2690 				error = bridge_ip6_checkbasic(mp);
2691 				break;
2692 #endif /* INET6 */
2693 			default:
2694 				error = 0;
2695 		}
2696 		if (error)
2697 			goto bad;
2698 	}
2699 
2700 	if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
2701 		error = -1;
2702 		args.rule = ip_dn_claim_rule(*mp);
2703 		if (args.rule != NULL && fw_one_pass)
2704 			goto ipfwpass; /* packet already partially processed */
2705 
2706 		args.m = *mp;
2707 		args.oif = ifp;
2708 		args.next_hop = NULL;
2709 		args.eh = &eh2;
2710 		args.inp = NULL;	/* used by ipfw uid/gid/jail rules */
2711 		i = ip_fw_chk_ptr(&args);
2712 		*mp = args.m;
2713 
2714 		if (*mp == NULL)
2715 			return (error);
2716 
2717 		if (DUMMYNET_LOADED && (i == IP_FW_DUMMYNET)) {
2718 
2719 			/* put the Ethernet header back on */
2720 			M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2721 			if (*mp == NULL)
2722 				return (error);
2723 			bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2724 
2725 			/*
2726 			 * Pass the pkt to dummynet, which consumes it. The
2727 			 * packet will return to us via bridge_dummynet().
2728 			 */
2729 			args.oif = ifp;
2730 			ip_dn_io_ptr(*mp, DN_TO_IFB_FWD, &args);
2731 			return (error);
2732 		}
2733 
2734 		if (i != IP_FW_PASS) /* drop */
2735 			goto bad;
2736 	}
2737 
2738 ipfwpass:
2739 	error = 0;
2740 
2741 	/*
2742 	 * Run the packet through pfil
2743 	 */
2744 	switch (ether_type) {
2745 	case ETHERTYPE_IP:
2746 		/*
2747 		 * before calling the firewall, swap fields the same as
2748 		 * IP does. here we assume the header is contiguous
2749 		 */
2750 		ip = mtod(*mp, struct ip *);
2751 
2752 		ip->ip_len = ntohs(ip->ip_len);
2753 		ip->ip_off = ntohs(ip->ip_off);
2754 
2755 		/*
2756 		 * Run pfil on the member interface and the bridge, both can
2757 		 * be skipped by clearing pfil_member or pfil_bridge.
2758 		 *
2759 		 * Keep the order:
2760 		 *   in_if -> bridge_if -> out_if
2761 		 */
2762 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2763 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2764 					dir, NULL);
2765 
2766 		if (*mp == NULL || error != 0) /* filter may consume */
2767 			break;
2768 
2769 		if (pfil_member && ifp != NULL)
2770 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp,
2771 					dir, NULL);
2772 
2773 		if (*mp == NULL || error != 0) /* filter may consume */
2774 			break;
2775 
2776 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2777 			error = pfil_run_hooks(&inet_pfil_hook, mp, bifp,
2778 					dir, NULL);
2779 
2780 		if (*mp == NULL || error != 0) /* filter may consume */
2781 			break;
2782 
2783 		/* check if we need to fragment the packet */
2784 		if (pfil_member && ifp != NULL && dir == PFIL_OUT) {
2785 			i = (*mp)->m_pkthdr.len;
2786 			if (i > ifp->if_mtu) {
2787 				error = bridge_fragment(ifp, *mp, &eh2, snap,
2788 					    &llc1);
2789 				return (error);
2790 			}
2791 		}
2792 
2793 		/* Recalculate the ip checksum and restore byte ordering */
2794 		ip = mtod(*mp, struct ip *);
2795 		hlen = ip->ip_hl << 2;
2796 		if (hlen < sizeof(struct ip))
2797 			goto bad;
2798 		if (hlen > (*mp)->m_len) {
2799 			if ((*mp = m_pullup(*mp, hlen)) == 0)
2800 				goto bad;
2801 			ip = mtod(*mp, struct ip *);
2802 			if (ip == NULL)
2803 				goto bad;
2804 		}
2805 		ip->ip_len = htons(ip->ip_len);
2806 		ip->ip_off = htons(ip->ip_off);
2807 		ip->ip_sum = 0;
2808 		if (hlen == sizeof(struct ip))
2809 			ip->ip_sum = in_cksum_hdr(ip);
2810 		else
2811 			ip->ip_sum = in_cksum(*mp, hlen);
2812 
2813 		break;
2814 #ifdef INET6
2815 	case ETHERTYPE_IPV6:
2816 		if (pfil_bridge && dir == PFIL_OUT && bifp != NULL)
2817 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2818 					dir, NULL);
2819 
2820 		if (*mp == NULL || error != 0) /* filter may consume */
2821 			break;
2822 
2823 		if (pfil_member && ifp != NULL)
2824 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp,
2825 					dir, NULL);
2826 
2827 		if (*mp == NULL || error != 0) /* filter may consume */
2828 			break;
2829 
2830 		if (pfil_bridge && dir == PFIL_IN && bifp != NULL)
2831 			error = pfil_run_hooks(&inet6_pfil_hook, mp, bifp,
2832 					dir, NULL);
2833 		break;
2834 #endif
2835 	default:
2836 		error = 0;
2837 		break;
2838 	}
2839 
2840 	if (*mp == NULL)
2841 		return (error);
2842 	if (error != 0)
2843 		goto bad;
2844 
2845 	error = -1;
2846 
2847 	/*
2848 	 * Finally, put everything back the way it was and return
2849 	 */
2850 	if (snap) {
2851 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2852 		if (*mp == NULL)
2853 			return (error);
2854 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
2855 	}
2856 
2857 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2858 	if (*mp == NULL)
2859 		return (error);
2860 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2861 
2862 	return (0);
2863 
2864 bad:
2865 	m_freem(*mp);
2866 	*mp = NULL;
2867 	return (error);
2868 }
2869 
2870 /*
2871  * Perform basic checks on header size since
2872  * pfil assumes ip_input has already processed
2873  * it for it.  Cut-and-pasted from ip_input.c.
2874  * Given how simple the IPv6 version is,
2875  * does the IPv4 version really need to be
2876  * this complicated?
2877  *
2878  * XXX Should we update ipstat here, or not?
2879  * XXX Right now we update ipstat but not
2880  * XXX csum_counter.
2881  */
2882 static int
2883 bridge_ip_checkbasic(struct mbuf **mp)
2884 {
2885 	struct mbuf *m = *mp;
2886 	struct ip *ip;
2887 	int len, hlen;
2888 	u_short sum;
2889 
2890 	if (*mp == NULL)
2891 		return (-1);
2892 
2893 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2894 		if ((m = m_copyup(m, sizeof(struct ip),
2895 			(max_linkhdr + 3) & ~3)) == NULL) {
2896 			/* XXXJRT new stat, please */
2897 			ipstat.ips_toosmall++;
2898 			goto bad;
2899 		}
2900 	} else if (__predict_false(m->m_len < sizeof (struct ip))) {
2901 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2902 			ipstat.ips_toosmall++;
2903 			goto bad;
2904 		}
2905 	}
2906 	ip = mtod(m, struct ip *);
2907 	if (ip == NULL) goto bad;
2908 
2909 	if (ip->ip_v != IPVERSION) {
2910 		ipstat.ips_badvers++;
2911 		goto bad;
2912 	}
2913 	hlen = ip->ip_hl << 2;
2914 	if (hlen < sizeof(struct ip)) { /* minimum header length */
2915 		ipstat.ips_badhlen++;
2916 		goto bad;
2917 	}
2918 	if (hlen > m->m_len) {
2919 		if ((m = m_pullup(m, hlen)) == 0) {
2920 			ipstat.ips_badhlen++;
2921 			goto bad;
2922 		}
2923 		ip = mtod(m, struct ip *);
2924 		if (ip == NULL) goto bad;
2925 	}
2926 
2927 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
2928 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
2929 	} else {
2930 		if (hlen == sizeof(struct ip)) {
2931 			sum = in_cksum_hdr(ip);
2932 		} else {
2933 			sum = in_cksum(m, hlen);
2934 		}
2935 	}
2936 	if (sum) {
2937 		ipstat.ips_badsum++;
2938 		goto bad;
2939 	}
2940 
2941 	/* Retrieve the packet length. */
2942 	len = ntohs(ip->ip_len);
2943 
2944 	/*
2945 	 * Check for additional length bogosity
2946 	 */
2947 	if (len < hlen) {
2948 		ipstat.ips_badlen++;
2949 		goto bad;
2950 	}
2951 
2952 	/*
2953 	 * Check that the amount of data in the buffers
2954 	 * is as at least much as the IP header would have us expect.
2955 	 * Drop packet if shorter than we expect.
2956 	 */
2957 	if (m->m_pkthdr.len < len) {
2958 		ipstat.ips_tooshort++;
2959 		goto bad;
2960 	}
2961 
2962 	/* Checks out, proceed */
2963 	*mp = m;
2964 	return (0);
2965 
2966 bad:
2967 	*mp = m;
2968 	return (-1);
2969 }
2970 
2971 #ifdef INET6
2972 /*
2973  * Same as above, but for IPv6.
2974  * Cut-and-pasted from ip6_input.c.
2975  * XXX Should we update ip6stat, or not?
2976  */
2977 static int
2978 bridge_ip6_checkbasic(struct mbuf **mp)
2979 {
2980 	struct mbuf *m = *mp;
2981 	struct ip6_hdr *ip6;
2982 
2983 	/*
2984 	 * If the IPv6 header is not aligned, slurp it up into a new
2985 	 * mbuf with space for link headers, in the event we forward
2986 	 * it.  Otherwise, if it is aligned, make sure the entire base
2987 	 * IPv6 header is in the first mbuf of the chain.
2988 	 */
2989 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2990 		struct ifnet *inifp = m->m_pkthdr.rcvif;
2991 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2992 			    (max_linkhdr + 3) & ~3)) == NULL) {
2993 			/* XXXJRT new stat, please */
2994 			ip6stat.ip6s_toosmall++;
2995 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2996 			goto bad;
2997 		}
2998 	} else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2999 		struct ifnet *inifp = m->m_pkthdr.rcvif;
3000 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
3001 			ip6stat.ip6s_toosmall++;
3002 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
3003 			goto bad;
3004 		}
3005 	}
3006 
3007 	ip6 = mtod(m, struct ip6_hdr *);
3008 
3009 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
3010 		ip6stat.ip6s_badvers++;
3011 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
3012 		goto bad;
3013 	}
3014 
3015 	/* Checks out, proceed */
3016 	*mp = m;
3017 	return (0);
3018 
3019 bad:
3020 	*mp = m;
3021 	return (-1);
3022 }
3023 #endif /* INET6 */
3024 
3025 /*
3026  * bridge_fragment:
3027  *
3028  *	Return a fragmented mbuf chain.
3029  */
3030 static int
3031 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
3032     int snap, struct llc *llc)
3033 {
3034 	struct mbuf *m0;
3035 	struct ip *ip;
3036 	int error = -1;
3037 
3038 	if (m->m_len < sizeof(struct ip) &&
3039 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
3040 		goto out;
3041 	ip = mtod(m, struct ip *);
3042 
3043 	error = ip_fragment(ip, &m, ifp->if_mtu, ifp->if_hwassist,
3044 		    CSUM_DELAY_IP);
3045 	if (error)
3046 		goto out;
3047 
3048 	/* walk the chain and re-add the Ethernet header */
3049 	for (m0 = m; m0; m0 = m0->m_nextpkt) {
3050 		if (error == 0) {
3051 			if (snap) {
3052 				M_PREPEND(m0, sizeof(struct llc), M_DONTWAIT);
3053 				if (m0 == NULL) {
3054 					error = ENOBUFS;
3055 					continue;
3056 				}
3057 				bcopy(llc, mtod(m0, caddr_t),
3058 				    sizeof(struct llc));
3059 			}
3060 			M_PREPEND(m0, ETHER_HDR_LEN, M_DONTWAIT);
3061 			if (m0 == NULL) {
3062 				error = ENOBUFS;
3063 				continue;
3064 			}
3065 			bcopy(eh, mtod(m0, caddr_t), ETHER_HDR_LEN);
3066 		} else
3067 			m_freem(m);
3068 	}
3069 
3070 	if (error == 0)
3071 		ipstat.ips_fragmented++;
3072 
3073 	return (error);
3074 
3075 out:
3076 	if (m != NULL)
3077 		m_freem(m);
3078 	return (error);
3079 }
3080