xref: /netbsd-src/sys/net/if_bridge.c (revision 21e37cc72a480a47828990a439cde7ac9ffaf0c6)
1 /*	$NetBSD: if_bridge.c,v 1.24 2004/04/21 19:10:31 itojun Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. All advertising materials mentioning features or use of this software
51  *    must display the following acknowledgement:
52  *	This product includes software developed by Jason L. Wright
53  * 4. The name of the author may not be used to endorse or promote products
54  *    derived from this software without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
66  * POSSIBILITY OF SUCH DAMAGE.
67  *
68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  */
81 
82 #include <sys/cdefs.h>
83 __KERNEL_RCSID(0, "$NetBSD: if_bridge.c,v 1.24 2004/04/21 19:10:31 itojun Exp $");
84 
85 #include "opt_bridge_ipf.h"
86 #include "opt_inet.h"
87 #include "opt_pfil_hooks.h"
88 #include "bpfilter.h"
89 
90 #include <sys/param.h>
91 #include <sys/kernel.h>
92 #include <sys/mbuf.h>
93 #include <sys/queue.h>
94 #include <sys/socket.h>
95 #include <sys/sockio.h>
96 #include <sys/systm.h>
97 #include <sys/proc.h>
98 #include <sys/pool.h>
99 
100 #if NBPFILTER > 0
101 #include <net/bpf.h>
102 #endif
103 #include <net/if.h>
104 #include <net/if_dl.h>
105 #include <net/if_types.h>
106 #include <net/if_llc.h>
107 
108 #include <net/if_ether.h>
109 #include <net/if_bridgevar.h>
110 
111 #ifdef BRIDGE_IPF /* Used for bridge_ip[6]_checkbasic */
112 #include <netinet/in.h>
113 #include <netinet/in_systm.h>
114 #include <netinet/ip.h>
115 #include <netinet/ip_var.h>
116 
117 #include <netinet/ip6.h>
118 #include <netinet6/in6_var.h>
119 #include <netinet6/ip6_var.h>
120 #endif /* BRIDGE_IPF */
121 
122 /*
123  * Size of the route hash table.  Must be a power of two.
124  */
125 #ifndef BRIDGE_RTHASH_SIZE
126 #define	BRIDGE_RTHASH_SIZE		1024
127 #endif
128 
129 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
130 
131 /*
132  * Maximum number of addresses to cache.
133  */
134 #ifndef BRIDGE_RTABLE_MAX
135 #define	BRIDGE_RTABLE_MAX		100
136 #endif
137 
138 /*
139  * Spanning tree defaults.
140  */
141 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
142 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
143 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
144 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
145 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
146 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
147 #define	BSTP_DEFAULT_PATH_COST		55
148 
149 /*
150  * Timeout (in seconds) for entries learned dynamically.
151  */
152 #ifndef BRIDGE_RTABLE_TIMEOUT
153 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
154 #endif
155 
156 /*
157  * Number of seconds between walks of the route list.
158  */
159 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
160 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
161 #endif
162 
163 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
164 
165 struct pool bridge_rtnode_pool;
166 
167 void	bridgeattach(int);
168 
169 int	bridge_clone_create(struct if_clone *, int);
170 void	bridge_clone_destroy(struct ifnet *);
171 
172 int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
173 int	bridge_init(struct ifnet *);
174 void	bridge_stop(struct ifnet *, int);
175 void	bridge_start(struct ifnet *);
176 
177 void	bridge_forward(struct bridge_softc *, struct mbuf *m);
178 
179 void	bridge_timer(void *);
180 
181 void	bridge_broadcast(struct bridge_softc *, struct ifnet *, struct mbuf *);
182 
183 int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
184 	    struct ifnet *, int, uint8_t);
185 struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
186 void	bridge_rttrim(struct bridge_softc *);
187 void	bridge_rtage(struct bridge_softc *);
188 void	bridge_rtflush(struct bridge_softc *, int);
189 int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
190 void	bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp);
191 
192 int	bridge_rtable_init(struct bridge_softc *);
193 void	bridge_rtable_fini(struct bridge_softc *);
194 
195 struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
196 	    const uint8_t *);
197 int	bridge_rtnode_insert(struct bridge_softc *, struct bridge_rtnode *);
198 void	bridge_rtnode_destroy(struct bridge_softc *, struct bridge_rtnode *);
199 
200 struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
201 	    const char *name);
202 struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
203 	    struct ifnet *ifp);
204 void	bridge_delete_member(struct bridge_softc *, struct bridge_iflist *);
205 
206 int	bridge_ioctl_add(struct bridge_softc *, void *);
207 int	bridge_ioctl_del(struct bridge_softc *, void *);
208 int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
209 int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
210 int	bridge_ioctl_scache(struct bridge_softc *, void *);
211 int	bridge_ioctl_gcache(struct bridge_softc *, void *);
212 int	bridge_ioctl_gifs(struct bridge_softc *, void *);
213 int	bridge_ioctl_rts(struct bridge_softc *, void *);
214 int	bridge_ioctl_saddr(struct bridge_softc *, void *);
215 int	bridge_ioctl_sto(struct bridge_softc *, void *);
216 int	bridge_ioctl_gto(struct bridge_softc *, void *);
217 int	bridge_ioctl_daddr(struct bridge_softc *, void *);
218 int	bridge_ioctl_flush(struct bridge_softc *, void *);
219 int	bridge_ioctl_gpri(struct bridge_softc *, void *);
220 int	bridge_ioctl_spri(struct bridge_softc *, void *);
221 int	bridge_ioctl_ght(struct bridge_softc *, void *);
222 int	bridge_ioctl_sht(struct bridge_softc *, void *);
223 int	bridge_ioctl_gfd(struct bridge_softc *, void *);
224 int	bridge_ioctl_sfd(struct bridge_softc *, void *);
225 int	bridge_ioctl_gma(struct bridge_softc *, void *);
226 int	bridge_ioctl_sma(struct bridge_softc *, void *);
227 int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
228 int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
229 #ifdef BRIDGE_IPF
230 int	bridge_ioctl_gfilt(struct bridge_softc *, void *);
231 int	bridge_ioctl_sfilt(struct bridge_softc *, void *);
232 static int bridge_ipf(void *, struct mbuf **, struct ifnet *, int);
233 static int bridge_ip_checkbasic(struct mbuf **mp);
234 # ifdef INET6
235 static int bridge_ip6_checkbasic(struct mbuf **mp);
236 # endif /* INET6 */
237 #endif /* BRIDGE_IPF */
238 
239 struct bridge_control {
240 	int	(*bc_func)(struct bridge_softc *, void *);
241 	int	bc_argsize;
242 	int	bc_flags;
243 };
244 
245 #define	BC_F_COPYIN		0x01	/* copy arguments in */
246 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
247 #define	BC_F_SUSER		0x04	/* do super-user check */
248 
249 const struct bridge_control bridge_control_table[] = {
250 	{ bridge_ioctl_add,		sizeof(struct ifbreq),
251 	  BC_F_COPYIN|BC_F_SUSER },
252 	{ bridge_ioctl_del,		sizeof(struct ifbreq),
253 	  BC_F_COPYIN|BC_F_SUSER },
254 
255 	{ bridge_ioctl_gifflags,	sizeof(struct ifbreq),
256 	  BC_F_COPYIN|BC_F_COPYOUT },
257 	{ bridge_ioctl_sifflags,	sizeof(struct ifbreq),
258 	  BC_F_COPYIN|BC_F_SUSER },
259 
260 	{ bridge_ioctl_scache,		sizeof(struct ifbrparam),
261 	  BC_F_COPYIN|BC_F_SUSER },
262 	{ bridge_ioctl_gcache,		sizeof(struct ifbrparam),
263 	  BC_F_COPYOUT },
264 
265 	{ bridge_ioctl_gifs,		sizeof(struct ifbifconf),
266 	  BC_F_COPYIN|BC_F_COPYOUT },
267 	{ bridge_ioctl_rts,		sizeof(struct ifbaconf),
268 	  BC_F_COPYIN|BC_F_COPYOUT },
269 
270 	{ bridge_ioctl_saddr,		sizeof(struct ifbareq),
271 	  BC_F_COPYIN|BC_F_SUSER },
272 
273 	{ bridge_ioctl_sto,		sizeof(struct ifbrparam),
274 	  BC_F_COPYIN|BC_F_SUSER },
275 	{ bridge_ioctl_gto,		sizeof(struct ifbrparam),
276 	  BC_F_COPYOUT },
277 
278 	{ bridge_ioctl_daddr,		sizeof(struct ifbareq),
279 	  BC_F_COPYIN|BC_F_SUSER },
280 
281 	{ bridge_ioctl_flush,		sizeof(struct ifbreq),
282 	  BC_F_COPYIN|BC_F_SUSER },
283 
284 	{ bridge_ioctl_gpri,		sizeof(struct ifbrparam),
285 	  BC_F_COPYOUT },
286 	{ bridge_ioctl_spri,		sizeof(struct ifbrparam),
287 	  BC_F_COPYIN|BC_F_SUSER },
288 
289 	{ bridge_ioctl_ght,		sizeof(struct ifbrparam),
290 	  BC_F_COPYOUT },
291 	{ bridge_ioctl_sht,		sizeof(struct ifbrparam),
292 	  BC_F_COPYIN|BC_F_SUSER },
293 
294 	{ bridge_ioctl_gfd,		sizeof(struct ifbrparam),
295 	  BC_F_COPYOUT },
296 	{ bridge_ioctl_sfd,		sizeof(struct ifbrparam),
297 	  BC_F_COPYIN|BC_F_SUSER },
298 
299 	{ bridge_ioctl_gma,		sizeof(struct ifbrparam),
300 	  BC_F_COPYOUT },
301 	{ bridge_ioctl_sma,		sizeof(struct ifbrparam),
302 	  BC_F_COPYIN|BC_F_SUSER },
303 
304 	{ bridge_ioctl_sifprio,		sizeof(struct ifbreq),
305 	  BC_F_COPYIN|BC_F_SUSER },
306 
307 	{ bridge_ioctl_sifcost,		sizeof(struct ifbreq),
308 	  BC_F_COPYIN|BC_F_SUSER },
309 #ifdef BRIDGE_IPF
310 	{ bridge_ioctl_gfilt,		sizeof(struct ifbrparam),
311 	  BC_F_COPYOUT },
312 	{ bridge_ioctl_sfilt,		sizeof(struct ifbrparam),
313 	  BC_F_COPYIN|BC_F_SUSER },
314 #endif /* BRIDGE_IPF */
315 };
316 const int bridge_control_table_size =
317     sizeof(bridge_control_table) / sizeof(bridge_control_table[0]);
318 
319 LIST_HEAD(, bridge_softc) bridge_list;
320 
321 struct if_clone bridge_cloner =
322     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
323 
324 /*
325  * bridgeattach:
326  *
327  *	Pseudo-device attach routine.
328  */
329 void
330 bridgeattach(int n)
331 {
332 
333 	pool_init(&bridge_rtnode_pool, sizeof(struct bridge_rtnode),
334 	    0, 0, 0, "brtpl", NULL);
335 
336 	LIST_INIT(&bridge_list);
337 	if_clone_attach(&bridge_cloner);
338 }
339 
340 /*
341  * bridge_clone_create:
342  *
343  *	Create a new bridge instance.
344  */
345 int
346 bridge_clone_create(struct if_clone *ifc, int unit)
347 {
348 	struct bridge_softc *sc;
349 	struct ifnet *ifp;
350 	int s;
351 
352 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK);
353 	memset(sc, 0, sizeof(*sc));
354 	ifp = &sc->sc_if;
355 
356 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
357 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
358 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
359 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
360 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
361 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
362 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
363 	sc->sc_filter_flags = 0;
364 
365 	/* Initialize our routing table. */
366 	bridge_rtable_init(sc);
367 
368 	callout_init(&sc->sc_brcallout);
369 	callout_init(&sc->sc_bstpcallout);
370 
371 	LIST_INIT(&sc->sc_iflist);
372 
373 	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "%s%d", ifc->ifc_name,
374 	    unit);
375 	ifp->if_softc = sc;
376 	ifp->if_mtu = ETHERMTU;
377 	ifp->if_ioctl = bridge_ioctl;
378 	ifp->if_output = bridge_output;
379 	ifp->if_start = bridge_start;
380 	ifp->if_stop = bridge_stop;
381 	ifp->if_init = bridge_init;
382 	ifp->if_type = IFT_BRIDGE;
383 	ifp->if_addrlen = 0;
384 	ifp->if_dlt = DLT_EN10MB;
385 	ifp->if_hdrlen = ETHER_HDR_LEN;
386 
387 	if_attach(ifp);
388 
389 	if_alloc_sadl(ifp);
390 
391 	s = splnet();
392 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
393 	splx(s);
394 
395 	return (0);
396 }
397 
398 /*
399  * bridge_clone_destroy:
400  *
401  *	Destroy a bridge instance.
402  */
403 void
404 bridge_clone_destroy(struct ifnet *ifp)
405 {
406 	struct bridge_softc *sc = ifp->if_softc;
407 	struct bridge_iflist *bif;
408 	int s;
409 
410 	s = splnet();
411 
412 	bridge_stop(ifp, 1);
413 
414 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
415 		bridge_delete_member(sc, bif);
416 
417 	LIST_REMOVE(sc, sc_list);
418 
419 	splx(s);
420 
421 	if_detach(ifp);
422 
423 	/* Tear down the routing table. */
424 	bridge_rtable_fini(sc);
425 
426 	free(sc, M_DEVBUF);
427 }
428 
429 /*
430  * bridge_ioctl:
431  *
432  *	Handle a control request from the operator.
433  */
434 int
435 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
436 {
437 	struct bridge_softc *sc = ifp->if_softc;
438 	struct proc *p = curproc;	/* XXX */
439 	union {
440 		struct ifbreq ifbreq;
441 		struct ifbifconf ifbifconf;
442 		struct ifbareq ifbareq;
443 		struct ifbaconf ifbaconf;
444 		struct ifbrparam ifbrparam;
445 	} args;
446 	struct ifdrv *ifd = (struct ifdrv *) data;
447 	const struct bridge_control *bc;
448 	int s, error = 0;
449 
450 	s = splnet();
451 
452 	switch (cmd) {
453 	case SIOCGDRVSPEC:
454 	case SIOCSDRVSPEC:
455 		if (ifd->ifd_cmd >= bridge_control_table_size) {
456 			error = EINVAL;
457 			break;
458 		}
459 		bc = &bridge_control_table[ifd->ifd_cmd];
460 
461 		if (cmd == SIOCGDRVSPEC &&
462 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
463 			error = EINVAL;
464 			break;
465 		}
466 		else if (cmd == SIOCSDRVSPEC &&
467 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
468 			error = EINVAL;
469 			break;
470 		}
471 
472 		if (bc->bc_flags & BC_F_SUSER) {
473 			error = suser(p->p_ucred, &p->p_acflag);
474 			if (error)
475 				break;
476 		}
477 
478 		if (ifd->ifd_len != bc->bc_argsize ||
479 		    ifd->ifd_len > sizeof(args)) {
480 			error = EINVAL;
481 			break;
482 		}
483 
484 		if (bc->bc_flags & BC_F_COPYIN) {
485 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
486 			if (error)
487 				break;
488 		}
489 
490 		error = (*bc->bc_func)(sc, &args);
491 		if (error)
492 			break;
493 
494 		if (bc->bc_flags & BC_F_COPYOUT)
495 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
496 
497 		break;
498 
499 	case SIOCSIFFLAGS:
500 		if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) == IFF_RUNNING) {
501 			/*
502 			 * If interface is marked down and it is running,
503 			 * then stop and disable it.
504 			 */
505 			(*ifp->if_stop)(ifp, 1);
506 		} else if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) == IFF_UP) {
507 			/*
508 			 * If interface is marked up and it is stopped, then
509 			 * start it.
510 			 */
511 			error = (*ifp->if_init)(ifp);
512 		}
513 		break;
514 
515 	default:
516 		error = ENOTTY;
517 		break;
518 	}
519 
520 	splx(s);
521 
522 	return (error);
523 }
524 
525 /*
526  * bridge_lookup_member:
527  *
528  *	Lookup a bridge member interface.  Must be called at splnet().
529  */
530 struct bridge_iflist *
531 bridge_lookup_member(struct bridge_softc *sc, const char *name)
532 {
533 	struct bridge_iflist *bif;
534 	struct ifnet *ifp;
535 
536 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
537 		ifp = bif->bif_ifp;
538 		if (strcmp(ifp->if_xname, name) == 0)
539 			return (bif);
540 	}
541 
542 	return (NULL);
543 }
544 
545 /*
546  * bridge_lookup_member_if:
547  *
548  *	Lookup a bridge member interface by ifnet*.  Must be called at splnet().
549  */
550 struct bridge_iflist *
551 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
552 {
553 	struct bridge_iflist *bif;
554 
555 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
556 		if (bif->bif_ifp == member_ifp)
557 			return (bif);
558 	}
559 
560 	return (NULL);
561 }
562 
563 /*
564  * bridge_delete_member:
565  *
566  *	Delete the specified member interface.
567  */
568 void
569 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif)
570 {
571 	struct ifnet *ifs = bif->bif_ifp;
572 
573 	switch (ifs->if_type) {
574 	case IFT_ETHER:
575 		/*
576 		 * Take the interface out of promiscuous mode.
577 		 */
578 		(void) ifpromisc(ifs, 0);
579 		break;
580 
581 	default:
582 #ifdef DIAGNOSTIC
583 		panic("bridge_delete_member: impossible");
584 #endif
585 		break;
586 	}
587 
588 	ifs->if_bridge = NULL;
589 	LIST_REMOVE(bif, bif_next);
590 
591 	bridge_rtdelete(sc, ifs);
592 
593 	free(bif, M_DEVBUF);
594 
595 	if (sc->sc_if.if_flags & IFF_RUNNING)
596 		bstp_initialization(sc);
597 }
598 
599 int
600 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
601 {
602 	struct ifbreq *req = arg;
603 	struct bridge_iflist *bif = NULL;
604 	struct ifnet *ifs;
605 	int error = 0;
606 
607 	ifs = ifunit(req->ifbr_ifsname);
608 	if (ifs == NULL)
609 		return (ENOENT);
610 
611 	if (sc->sc_if.if_mtu != ifs->if_mtu)
612 		return (EINVAL);
613 
614 	if (ifs->if_bridge == sc)
615 		return (EEXIST);
616 
617 	if (ifs->if_bridge != NULL)
618 		return (EBUSY);
619 
620 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT);
621 	if (bif == NULL)
622 		return (ENOMEM);
623 
624 	switch (ifs->if_type) {
625 	case IFT_ETHER:
626 		/*
627 		 * Place the interface into promiscuous mode.
628 		 */
629 		error = ifpromisc(ifs, 1);
630 		if (error)
631 			goto out;
632 		break;
633 
634 	default:
635 		error = EINVAL;
636 		goto out;
637 	}
638 
639 	bif->bif_ifp = ifs;
640 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
641 	bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
642 	bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
643 
644 	ifs->if_bridge = sc;
645 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
646 
647 	if (sc->sc_if.if_flags & IFF_RUNNING)
648 		bstp_initialization(sc);
649 	else
650 		bstp_stop(sc);
651 
652  out:
653 	if (error) {
654 		if (bif != NULL)
655 			free(bif, M_DEVBUF);
656 	}
657 	return (error);
658 }
659 
660 int
661 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
662 {
663 	struct ifbreq *req = arg;
664 	struct bridge_iflist *bif;
665 
666 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
667 	if (bif == NULL)
668 		return (ENOENT);
669 
670 	bridge_delete_member(sc, bif);
671 
672 	return (0);
673 }
674 
675 int
676 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
677 {
678 	struct ifbreq *req = arg;
679 	struct bridge_iflist *bif;
680 
681 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
682 	if (bif == NULL)
683 		return (ENOENT);
684 
685 	req->ifbr_ifsflags = bif->bif_flags;
686 	req->ifbr_state = bif->bif_state;
687 	req->ifbr_priority = bif->bif_priority;
688 	req->ifbr_path_cost = bif->bif_path_cost;
689 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
690 
691 	return (0);
692 }
693 
694 int
695 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
696 {
697 	struct ifbreq *req = arg;
698 	struct bridge_iflist *bif;
699 
700 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
701 	if (bif == NULL)
702 		return (ENOENT);
703 
704 	if (req->ifbr_ifsflags & IFBIF_STP) {
705 		switch (bif->bif_ifp->if_type) {
706 		case IFT_ETHER:
707 			/* These can do spanning tree. */
708 			break;
709 
710 		default:
711 			/* Nothing else can. */
712 			return (EINVAL);
713 		}
714 	}
715 
716 	bif->bif_flags = req->ifbr_ifsflags;
717 
718 	if (sc->sc_if.if_flags & IFF_RUNNING)
719 		bstp_initialization(sc);
720 
721 	return (0);
722 }
723 
724 int
725 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
726 {
727 	struct ifbrparam *param = arg;
728 
729 	sc->sc_brtmax = param->ifbrp_csize;
730 	bridge_rttrim(sc);
731 
732 	return (0);
733 }
734 
735 int
736 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
737 {
738 	struct ifbrparam *param = arg;
739 
740 	param->ifbrp_csize = sc->sc_brtmax;
741 
742 	return (0);
743 }
744 
745 int
746 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
747 {
748 	struct ifbifconf *bifc = arg;
749 	struct bridge_iflist *bif;
750 	struct ifbreq breq;
751 	int count, len, error = 0;
752 
753 	count = 0;
754 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
755 		count++;
756 
757 	if (bifc->ifbic_len == 0) {
758 		bifc->ifbic_len = sizeof(breq) * count;
759 		return (0);
760 	}
761 
762 	count = 0;
763 	len = bifc->ifbic_len;
764 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
765 		if (len < sizeof(breq))
766 			break;
767 
768 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
769 		    sizeof(breq.ifbr_ifsname));
770 		breq.ifbr_ifsflags = bif->bif_flags;
771 		breq.ifbr_state = bif->bif_state;
772 		breq.ifbr_priority = bif->bif_priority;
773 		breq.ifbr_path_cost = bif->bif_path_cost;
774 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
775 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
776 		if (error)
777 			break;
778 		count++;
779 		len -= sizeof(breq);
780 	}
781 
782 	bifc->ifbic_len = sizeof(breq) * count;
783 	return (error);
784 }
785 
786 int
787 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
788 {
789 	struct ifbaconf *bac = arg;
790 	struct bridge_rtnode *brt;
791 	struct ifbareq bareq;
792 	int count = 0, error = 0, len;
793 
794 	if (bac->ifbac_len == 0)
795 		return (0);
796 
797 	len = bac->ifbac_len;
798 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
799 		if (len < sizeof(bareq))
800 			goto out;
801 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
802 		    sizeof(bareq.ifba_ifsname));
803 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
804 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
805 			bareq.ifba_expire = brt->brt_expire - mono_time.tv_sec;
806 		else
807 			bareq.ifba_expire = 0;
808 		bareq.ifba_flags = brt->brt_flags;
809 
810 		error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
811 		if (error)
812 			goto out;
813 		count++;
814 		len -= sizeof(bareq);
815 	}
816  out:
817 	bac->ifbac_len = sizeof(bareq) * count;
818 	return (error);
819 }
820 
821 int
822 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
823 {
824 	struct ifbareq *req = arg;
825 	struct bridge_iflist *bif;
826 	int error;
827 
828 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
829 	if (bif == NULL)
830 		return (ENOENT);
831 
832 	error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
833 	    req->ifba_flags);
834 
835 	return (error);
836 }
837 
838 int
839 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
840 {
841 	struct ifbrparam *param = arg;
842 
843 	sc->sc_brttimeout = param->ifbrp_ctime;
844 
845 	return (0);
846 }
847 
848 int
849 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
850 {
851 	struct ifbrparam *param = arg;
852 
853 	param->ifbrp_ctime = sc->sc_brttimeout;
854 
855 	return (0);
856 }
857 
858 int
859 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
860 {
861 	struct ifbareq *req = arg;
862 
863 	return (bridge_rtdaddr(sc, req->ifba_dst));
864 }
865 
866 int
867 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
868 {
869 	struct ifbreq *req = arg;
870 
871 	bridge_rtflush(sc, req->ifbr_ifsflags);
872 
873 	return (0);
874 }
875 
876 int
877 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
878 {
879 	struct ifbrparam *param = arg;
880 
881 	param->ifbrp_prio = sc->sc_bridge_priority;
882 
883 	return (0);
884 }
885 
886 int
887 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
888 {
889 	struct ifbrparam *param = arg;
890 
891 	sc->sc_bridge_priority = param->ifbrp_prio;
892 
893 	if (sc->sc_if.if_flags & IFF_RUNNING)
894 		bstp_initialization(sc);
895 
896 	return (0);
897 }
898 
899 int
900 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
901 {
902 	struct ifbrparam *param = arg;
903 
904 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
905 
906 	return (0);
907 }
908 
909 int
910 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
911 {
912 	struct ifbrparam *param = arg;
913 
914 	if (param->ifbrp_hellotime == 0)
915 		return (EINVAL);
916 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
917 
918 	if (sc->sc_if.if_flags & IFF_RUNNING)
919 		bstp_initialization(sc);
920 
921 	return (0);
922 }
923 
924 int
925 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
926 {
927 	struct ifbrparam *param = arg;
928 
929 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
930 
931 	return (0);
932 }
933 
934 int
935 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
936 {
937 	struct ifbrparam *param = arg;
938 
939 	if (param->ifbrp_fwddelay == 0)
940 		return (EINVAL);
941 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
942 
943 	if (sc->sc_if.if_flags & IFF_RUNNING)
944 		bstp_initialization(sc);
945 
946 	return (0);
947 }
948 
949 int
950 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
951 {
952 	struct ifbrparam *param = arg;
953 
954 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
955 
956 	return (0);
957 }
958 
959 int
960 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
961 {
962 	struct ifbrparam *param = arg;
963 
964 	if (param->ifbrp_maxage == 0)
965 		return (EINVAL);
966 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
967 
968 	if (sc->sc_if.if_flags & IFF_RUNNING)
969 		bstp_initialization(sc);
970 
971 	return (0);
972 }
973 
974 int
975 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
976 {
977 	struct ifbreq *req = arg;
978 	struct bridge_iflist *bif;
979 
980 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
981 	if (bif == NULL)
982 		return (ENOENT);
983 
984 	bif->bif_priority = req->ifbr_priority;
985 
986 	if (sc->sc_if.if_flags & IFF_RUNNING)
987 		bstp_initialization(sc);
988 
989 	return (0);
990 }
991 
992 #ifdef BRIDGE_IPF
993 int
994 bridge_ioctl_gfilt(struct bridge_softc *sc, void *arg)
995 {
996 	struct ifbrparam *param = arg;
997 
998 	param->ifbrp_filter = sc->sc_filter_flags;
999 
1000 	return (0);
1001 }
1002 
1003 int
1004 bridge_ioctl_sfilt(struct bridge_softc *sc, void *arg)
1005 {
1006 	struct ifbrparam *param = arg;
1007 	uint32_t nflags, oflags;
1008 
1009 	if (param->ifbrp_filter & ~IFBF_FILT_MASK)
1010 		return (EINVAL);
1011 
1012 	nflags = param->ifbrp_filter;
1013 	oflags = sc->sc_filter_flags;
1014 
1015 	if ((nflags & IFBF_FILT_USEIPF) && !(oflags & IFBF_FILT_USEIPF)) {
1016 		pfil_add_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1017 			&sc->sc_if.if_pfil);
1018 	}
1019 	if (!(nflags & IFBF_FILT_USEIPF) && (oflags & IFBF_FILT_USEIPF)) {
1020 		pfil_remove_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1021 			&sc->sc_if.if_pfil);
1022 	}
1023 
1024 	sc->sc_filter_flags = nflags;
1025 
1026 	return (0);
1027 }
1028 #endif /* BRIDGE_IPF */
1029 
1030 int
1031 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1032 {
1033 	struct ifbreq *req = arg;
1034 	struct bridge_iflist *bif;
1035 
1036 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1037 	if (bif == NULL)
1038 		return (ENOENT);
1039 
1040 	bif->bif_path_cost = req->ifbr_path_cost;
1041 
1042 	if (sc->sc_if.if_flags & IFF_RUNNING)
1043 		bstp_initialization(sc);
1044 
1045 	return (0);
1046 }
1047 
1048 /*
1049  * bridge_ifdetach:
1050  *
1051  *	Detach an interface from a bridge.  Called when a member
1052  *	interface is detaching.
1053  */
1054 void
1055 bridge_ifdetach(struct ifnet *ifp)
1056 {
1057 	struct bridge_softc *sc = ifp->if_bridge;
1058 	struct ifbreq breq;
1059 
1060 	memset(&breq, 0, sizeof(breq));
1061 	snprintf(breq.ifbr_ifsname, sizeof(breq.ifbr_ifsname), ifp->if_xname);
1062 
1063 	(void) bridge_ioctl_del(sc, &breq);
1064 }
1065 
1066 /*
1067  * bridge_init:
1068  *
1069  *	Initialize a bridge interface.
1070  */
1071 int
1072 bridge_init(struct ifnet *ifp)
1073 {
1074 	struct bridge_softc *sc = ifp->if_softc;
1075 
1076 	if (ifp->if_flags & IFF_RUNNING)
1077 		return (0);
1078 
1079 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1080 	    bridge_timer, sc);
1081 
1082 	ifp->if_flags |= IFF_RUNNING;
1083 	bstp_initialization(sc);
1084 	return (0);
1085 }
1086 
1087 /*
1088  * bridge_stop:
1089  *
1090  *	Stop the bridge interface.
1091  */
1092 void
1093 bridge_stop(struct ifnet *ifp, int disable)
1094 {
1095 	struct bridge_softc *sc = ifp->if_softc;
1096 
1097 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1098 		return;
1099 
1100 	callout_stop(&sc->sc_brcallout);
1101 	bstp_stop(sc);
1102 
1103 	IF_PURGE(&ifp->if_snd);
1104 
1105 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1106 
1107 	ifp->if_flags &= ~IFF_RUNNING;
1108 }
1109 
1110 /*
1111  * bridge_enqueue:
1112  *
1113  *	Enqueue a packet on a bridge member interface.
1114  *
1115  *	NOTE: must be called at splnet().
1116  */
1117 __inline void
1118 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m,
1119     int runfilt)
1120 {
1121 	ALTQ_DECL(struct altq_pktattr pktattr;)
1122 	int len, error;
1123 	short mflags;
1124 
1125 #ifdef PFIL_HOOKS
1126 	if (runfilt) {
1127 		if (pfil_run_hooks(&sc->sc_if.if_pfil, &m,
1128 		    dst_ifp, PFIL_OUT) != 0) {
1129 			if (m != NULL)
1130 				m_freem(m);
1131 			return;
1132 		}
1133 		if (m == NULL)
1134 			return;
1135 	}
1136 #endif /* PFIL_HOOKS */
1137 
1138 #ifdef ALTQ
1139 	/*
1140 	 * If ALTQ is enabled on the member interface, do
1141 	 * classification; the queueing discipline might
1142 	 * not require classification, but might require
1143 	 * the address family/header pointer in the pktattr.
1144 	 */
1145 	if (ALTQ_IS_ENABLED(&dst_ifp->if_snd)) {
1146 		/* XXX IFT_ETHER */
1147 		altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
1148 	}
1149 #endif /* ALTQ */
1150 
1151 	len = m->m_pkthdr.len;
1152 	mflags = m->m_flags;
1153 	IFQ_ENQUEUE(&dst_ifp->if_snd, m, &pktattr, error);
1154 	if (error) {
1155 		/* mbuf is already freed */
1156 		sc->sc_if.if_oerrors++;
1157 		return;
1158 	}
1159 
1160 	sc->sc_if.if_opackets++;
1161 	sc->sc_if.if_obytes += len;
1162 
1163 	dst_ifp->if_obytes += len;
1164 
1165 	if (mflags & M_MCAST) {
1166 		sc->sc_if.if_omcasts++;
1167 		dst_ifp->if_omcasts++;
1168 	}
1169 
1170 	if ((dst_ifp->if_flags & IFF_OACTIVE) == 0)
1171 		(*dst_ifp->if_start)(dst_ifp);
1172 }
1173 
1174 /*
1175  * bridge_output:
1176  *
1177  *	Send output from a bridge member interface.  This
1178  *	performs the bridging function for locally originated
1179  *	packets.
1180  *
1181  *	The mbuf has the Ethernet header already attached.  We must
1182  *	enqueue or free the mbuf before returning.
1183  */
1184 int
1185 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
1186     struct rtentry *rt)
1187 {
1188 	struct ether_header *eh;
1189 	struct ifnet *dst_if;
1190 	struct bridge_softc *sc;
1191 	int s;
1192 
1193 	if (m->m_len < ETHER_HDR_LEN) {
1194 		m = m_pullup(m, ETHER_HDR_LEN);
1195 		if (m == NULL)
1196 			return (0);
1197 	}
1198 
1199 	eh = mtod(m, struct ether_header *);
1200 	sc = ifp->if_bridge;
1201 
1202 	s = splnet();
1203 
1204 	/*
1205 	 * If bridge is down, but the original output interface is up,
1206 	 * go ahead and send out that interface.  Otherwise, the packet
1207 	 * is dropped below.
1208 	 */
1209 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1210 		dst_if = ifp;
1211 		goto sendunicast;
1212 	}
1213 
1214 	/*
1215 	 * If the packet is a multicast, or we don't know a better way to
1216 	 * get there, send to all interfaces.
1217 	 */
1218 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1219 		dst_if = NULL;
1220 	else
1221 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1222 	if (dst_if == NULL) {
1223 		struct bridge_iflist *bif;
1224 		struct mbuf *mc;
1225 		int used = 0;
1226 
1227 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1228 			dst_if = bif->bif_ifp;
1229 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
1230 				continue;
1231 
1232 			/*
1233 			 * If this is not the original output interface,
1234 			 * and the interface is participating in spanning
1235 			 * tree, make sure the port is in a state that
1236 			 * allows forwarding.
1237 			 */
1238 			if (dst_if != ifp &&
1239 			    (bif->bif_flags & IFBIF_STP) != 0) {
1240 				switch (bif->bif_state) {
1241 				case BSTP_IFSTATE_BLOCKING:
1242 				case BSTP_IFSTATE_LISTENING:
1243 				case BSTP_IFSTATE_DISABLED:
1244 					continue;
1245 				}
1246 			}
1247 
1248 			if (LIST_NEXT(bif, bif_next) == NULL) {
1249 				used = 1;
1250 				mc = m;
1251 			} else {
1252 				mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);
1253 				if (mc == NULL) {
1254 					sc->sc_if.if_oerrors++;
1255 					continue;
1256 				}
1257 			}
1258 
1259 			bridge_enqueue(sc, dst_if, mc, 0);
1260 		}
1261 		if (used == 0)
1262 			m_freem(m);
1263 		splx(s);
1264 		return (0);
1265 	}
1266 
1267  sendunicast:
1268 	/*
1269 	 * XXX Spanning tree consideration here?
1270 	 */
1271 
1272 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1273 		m_freem(m);
1274 		splx(s);
1275 		return (0);
1276 	}
1277 
1278 	bridge_enqueue(sc, dst_if, m, 0);
1279 
1280 	splx(s);
1281 	return (0);
1282 }
1283 
1284 /*
1285  * bridge_start:
1286  *
1287  *	Start output on a bridge.
1288  *
1289  *	NOTE: This routine should never be called in this implementation.
1290  */
1291 void
1292 bridge_start(struct ifnet *ifp)
1293 {
1294 
1295 	printf("%s: bridge_start() called\n", ifp->if_xname);
1296 }
1297 
1298 /*
1299  * bridge_forward:
1300  *
1301  *	The forwarding function of the bridge.
1302  */
1303 void
1304 bridge_forward(struct bridge_softc *sc, struct mbuf *m)
1305 {
1306 	struct bridge_iflist *bif;
1307 	struct ifnet *src_if, *dst_if;
1308 	struct ether_header *eh;
1309 
1310 	src_if = m->m_pkthdr.rcvif;
1311 
1312 	sc->sc_if.if_ipackets++;
1313 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
1314 
1315 	/*
1316 	 * Look up the bridge_iflist.
1317 	 */
1318 	bif = bridge_lookup_member_if(sc, src_if);
1319 	if (bif == NULL) {
1320 		/* Interface is not a bridge member (anymore?) */
1321 		m_freem(m);
1322 		return;
1323 	}
1324 
1325 	if (bif->bif_flags & IFBIF_STP) {
1326 		switch (bif->bif_state) {
1327 		case BSTP_IFSTATE_BLOCKING:
1328 		case BSTP_IFSTATE_LISTENING:
1329 		case BSTP_IFSTATE_DISABLED:
1330 			m_freem(m);
1331 			return;
1332 		}
1333 	}
1334 
1335 	eh = mtod(m, struct ether_header *);
1336 
1337 	/*
1338 	 * If the interface is learning, and the source
1339 	 * address is valid and not multicast, record
1340 	 * the address.
1341 	 */
1342 	if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1343 	    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1344 	    (eh->ether_shost[0] == 0 &&
1345 	     eh->ether_shost[1] == 0 &&
1346 	     eh->ether_shost[2] == 0 &&
1347 	     eh->ether_shost[3] == 0 &&
1348 	     eh->ether_shost[4] == 0 &&
1349 	     eh->ether_shost[5] == 0) == 0) {
1350 		(void) bridge_rtupdate(sc, eh->ether_shost,
1351 		    src_if, 0, IFBAF_DYNAMIC);
1352 	}
1353 
1354 	if ((bif->bif_flags & IFBIF_STP) != 0 &&
1355 	    bif->bif_state == BSTP_IFSTATE_LEARNING) {
1356 		m_freem(m);
1357 		return;
1358 	}
1359 
1360 	/*
1361 	 * At this point, the port either doesn't participate
1362 	 * in spanning tree or it is in the forwarding state.
1363 	 */
1364 
1365 	/*
1366 	 * If the packet is unicast, destined for someone on
1367 	 * "this" side of the bridge, drop it.
1368 	 */
1369 	if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1370 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1371 		if (src_if == dst_if) {
1372 			m_freem(m);
1373 			return;
1374 		}
1375 	} else {
1376 		/* ...forward it to all interfaces. */
1377 		sc->sc_if.if_imcasts++;
1378 		dst_if = NULL;
1379 	}
1380 
1381 #ifdef PFIL_HOOKS
1382 	if (pfil_run_hooks(&sc->sc_if.if_pfil, &m,
1383 	    m->m_pkthdr.rcvif, PFIL_IN) != 0) {
1384 		if (m != NULL)
1385 			m_freem(m);
1386 		return;
1387 	}
1388 	if (m == NULL)
1389 		return;
1390 #endif /* PFIL_HOOKS */
1391 
1392 	if (dst_if == NULL) {
1393 		bridge_broadcast(sc, src_if, m);
1394 		return;
1395 	}
1396 
1397 	/*
1398 	 * At this point, we're dealing with a unicast frame
1399 	 * going to a different interface.
1400 	 */
1401 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1402 		m_freem(m);
1403 		return;
1404 	}
1405 	bif = bridge_lookup_member_if(sc, dst_if);
1406 	if (bif == NULL) {
1407 		/* Not a member of the bridge (anymore?) */
1408 		m_freem(m);
1409 		return;
1410 	}
1411 
1412 	if (bif->bif_flags & IFBIF_STP) {
1413 		switch (bif->bif_state) {
1414 		case BSTP_IFSTATE_DISABLED:
1415 		case BSTP_IFSTATE_BLOCKING:
1416 			m_freem(m);
1417 			return;
1418 		}
1419 	}
1420 
1421 	bridge_enqueue(sc, dst_if, m, 1);
1422 }
1423 
1424 /*
1425  * bridge_input:
1426  *
1427  *	Receive input from a member interface.  Queue the packet for
1428  *	bridging if it is not for us.
1429  */
1430 struct mbuf *
1431 bridge_input(struct ifnet *ifp, struct mbuf *m)
1432 {
1433 	struct bridge_softc *sc = ifp->if_bridge;
1434 	struct bridge_iflist *bif;
1435 	struct ether_header *eh;
1436 	struct mbuf *mc;
1437 
1438 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0)
1439 		return (m);
1440 
1441 	bif = bridge_lookup_member_if(sc, ifp);
1442 	if (bif == NULL)
1443 		return (m);
1444 
1445 	eh = mtod(m, struct ether_header *);
1446 
1447 	if (m->m_flags & (M_BCAST|M_MCAST)) {
1448 		/* Tap off 802.1D packets; they do not get forwarded. */
1449 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1450 		    ETHER_ADDR_LEN) == 0) {
1451 			m = bstp_input(ifp, m);
1452 			if (m == NULL)
1453 				return (NULL);
1454 		}
1455 
1456 		if (bif->bif_flags & IFBIF_STP) {
1457 			switch (bif->bif_state) {
1458 			case BSTP_IFSTATE_BLOCKING:
1459 			case BSTP_IFSTATE_LISTENING:
1460 			case BSTP_IFSTATE_DISABLED:
1461 				return (m);
1462 			}
1463 		}
1464 
1465 		/*
1466 		 * Make a deep copy of the packet and enqueue the copy
1467 		 * for bridge processing; return the original packet for
1468 		 * local processing.
1469 		 */
1470 		mc = m_dup(m, 0, M_COPYALL, M_NOWAIT);
1471 		if (mc == NULL)
1472 			return (m);
1473 
1474 		/* Perform the bridge forwarding function with the copy. */
1475 		bridge_forward(sc, mc);
1476 
1477 		/* Return the original packet for local processing. */
1478 		return (m);
1479 	}
1480 
1481 	if (bif->bif_flags & IFBIF_STP) {
1482 		switch (bif->bif_state) {
1483 		case BSTP_IFSTATE_BLOCKING:
1484 		case BSTP_IFSTATE_LISTENING:
1485 		case BSTP_IFSTATE_DISABLED:
1486 			return (m);
1487 		}
1488 	}
1489 
1490 	/*
1491 	 * Unicast.  Make sure it's not for us.
1492 	 */
1493 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1494 		/* It is destined for us. */
1495 		if (memcmp(LLADDR(bif->bif_ifp->if_sadl), eh->ether_dhost,
1496 		    ETHER_ADDR_LEN) == 0) {
1497 			if (bif->bif_flags & IFBIF_LEARNING)
1498 				(void) bridge_rtupdate(sc,
1499 				    eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1500 			m->m_pkthdr.rcvif = bif->bif_ifp;
1501 			return (m);
1502 		}
1503 
1504 		/* We just received a packet that we sent out. */
1505 		if (memcmp(LLADDR(bif->bif_ifp->if_sadl), eh->ether_shost,
1506 		    ETHER_ADDR_LEN) == 0) {
1507 			m_freem(m);
1508 			return (NULL);
1509 		}
1510 	}
1511 
1512 	/* Perform the bridge forwarding function. */
1513 	bridge_forward(sc, m);
1514 
1515 	return (NULL);
1516 }
1517 
1518 /*
1519  * bridge_broadcast:
1520  *
1521  *	Send a frame to all interfaces that are members of
1522  *	the bridge, except for the one on which the packet
1523  *	arrived.
1524  */
1525 void
1526 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
1527     struct mbuf *m)
1528 {
1529 	struct bridge_iflist *bif;
1530 	struct mbuf *mc;
1531 	struct ifnet *dst_if;
1532 	int used = 0;
1533 
1534 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1535 		dst_if = bif->bif_ifp;
1536 		if (dst_if == src_if)
1537 			continue;
1538 
1539 		if (bif->bif_flags & IFBIF_STP) {
1540 			switch (bif->bif_state) {
1541 			case BSTP_IFSTATE_BLOCKING:
1542 			case BSTP_IFSTATE_DISABLED:
1543 				continue;
1544 			}
1545 		}
1546 
1547 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1548 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
1549 			continue;
1550 
1551 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1552 			continue;
1553 
1554 		if (LIST_NEXT(bif, bif_next) == NULL) {
1555 			mc = m;
1556 			used = 1;
1557 		} else {
1558 			mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1559 			if (mc == NULL) {
1560 				sc->sc_if.if_oerrors++;
1561 				continue;
1562 			}
1563 		}
1564 
1565 		bridge_enqueue(sc, dst_if, mc, 1);
1566 	}
1567 	if (used == 0)
1568 		m_freem(m);
1569 }
1570 
1571 /*
1572  * bridge_rtupdate:
1573  *
1574  *	Add a bridge routing entry.
1575  */
1576 int
1577 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
1578     struct ifnet *dst_if, int setflags, uint8_t flags)
1579 {
1580 	struct bridge_rtnode *brt;
1581 	int error;
1582 
1583 	/*
1584 	 * A route for this destination might already exist.  If so,
1585 	 * update it, otherwise create a new one.
1586 	 */
1587 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
1588 		if (sc->sc_brtcnt >= sc->sc_brtmax)
1589 			return (ENOSPC);
1590 
1591 		/*
1592 		 * Allocate a new bridge forwarding node, and
1593 		 * initialize the expiration time and Ethernet
1594 		 * address.
1595 		 */
1596 		brt = pool_get(&bridge_rtnode_pool, PR_NOWAIT);
1597 		if (brt == NULL)
1598 			return (ENOMEM);
1599 
1600 		memset(brt, 0, sizeof(*brt));
1601 		brt->brt_expire = mono_time.tv_sec + sc->sc_brttimeout;
1602 		brt->brt_flags = IFBAF_DYNAMIC;
1603 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
1604 
1605 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
1606 			pool_put(&bridge_rtnode_pool, brt);
1607 			return (error);
1608 		}
1609 	}
1610 
1611 	brt->brt_ifp = dst_if;
1612 	if (setflags) {
1613 		brt->brt_flags = flags;
1614 		brt->brt_expire = (flags & IFBAF_STATIC) ? 0 :
1615 		    mono_time.tv_sec + sc->sc_brttimeout;
1616 	}
1617 
1618 	return (0);
1619 }
1620 
1621 /*
1622  * bridge_rtlookup:
1623  *
1624  *	Lookup the destination interface for an address.
1625  */
1626 struct ifnet *
1627 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
1628 {
1629 	struct bridge_rtnode *brt;
1630 
1631 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
1632 		return (NULL);
1633 
1634 	return (brt->brt_ifp);
1635 }
1636 
1637 /*
1638  * bridge_rttrim:
1639  *
1640  *	Trim the routine table so that we have a number
1641  *	of routing entries less than or equal to the
1642  *	maximum number.
1643  */
1644 void
1645 bridge_rttrim(struct bridge_softc *sc)
1646 {
1647 	struct bridge_rtnode *brt, *nbrt;
1648 
1649 	/* Make sure we actually need to do this. */
1650 	if (sc->sc_brtcnt <= sc->sc_brtmax)
1651 		return;
1652 
1653 	/* Force an aging cycle; this might trim enough addresses. */
1654 	bridge_rtage(sc);
1655 	if (sc->sc_brtcnt <= sc->sc_brtmax)
1656 		return;
1657 
1658 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1659 		nbrt = LIST_NEXT(brt, brt_list);
1660 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1661 			bridge_rtnode_destroy(sc, brt);
1662 			if (sc->sc_brtcnt <= sc->sc_brtmax)
1663 				return;
1664 		}
1665 	}
1666 }
1667 
1668 /*
1669  * bridge_timer:
1670  *
1671  *	Aging timer for the bridge.
1672  */
1673 void
1674 bridge_timer(void *arg)
1675 {
1676 	struct bridge_softc *sc = arg;
1677 	int s;
1678 
1679 	s = splnet();
1680 	bridge_rtage(sc);
1681 	splx(s);
1682 
1683 	if (sc->sc_if.if_flags & IFF_RUNNING)
1684 		callout_reset(&sc->sc_brcallout,
1685 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
1686 }
1687 
1688 /*
1689  * bridge_rtage:
1690  *
1691  *	Perform an aging cycle.
1692  */
1693 void
1694 bridge_rtage(struct bridge_softc *sc)
1695 {
1696 	struct bridge_rtnode *brt, *nbrt;
1697 
1698 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1699 		nbrt = LIST_NEXT(brt, brt_list);
1700 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1701 			if (mono_time.tv_sec >= brt->brt_expire)
1702 				bridge_rtnode_destroy(sc, brt);
1703 		}
1704 	}
1705 }
1706 
1707 /*
1708  * bridge_rtflush:
1709  *
1710  *	Remove all dynamic addresses from the bridge.
1711  */
1712 void
1713 bridge_rtflush(struct bridge_softc *sc, int full)
1714 {
1715 	struct bridge_rtnode *brt, *nbrt;
1716 
1717 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1718 		nbrt = LIST_NEXT(brt, brt_list);
1719 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
1720 			bridge_rtnode_destroy(sc, brt);
1721 	}
1722 }
1723 
1724 /*
1725  * bridge_rtdaddr:
1726  *
1727  *	Remove an address from the table.
1728  */
1729 int
1730 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
1731 {
1732 	struct bridge_rtnode *brt;
1733 
1734 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
1735 		return (ENOENT);
1736 
1737 	bridge_rtnode_destroy(sc, brt);
1738 	return (0);
1739 }
1740 
1741 /*
1742  * bridge_rtdelete:
1743  *
1744  *	Delete routes to a speicifc member interface.
1745  */
1746 void
1747 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp)
1748 {
1749 	struct bridge_rtnode *brt, *nbrt;
1750 
1751 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1752 		nbrt = LIST_NEXT(brt, brt_list);
1753 		if (brt->brt_ifp == ifp)
1754 			bridge_rtnode_destroy(sc, brt);
1755 	}
1756 }
1757 
1758 /*
1759  * bridge_rtable_init:
1760  *
1761  *	Initialize the route table for this bridge.
1762  */
1763 int
1764 bridge_rtable_init(struct bridge_softc *sc)
1765 {
1766 	int i;
1767 
1768 	sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
1769 	    M_DEVBUF, M_NOWAIT);
1770 	if (sc->sc_rthash == NULL)
1771 		return (ENOMEM);
1772 
1773 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
1774 		LIST_INIT(&sc->sc_rthash[i]);
1775 
1776 	sc->sc_rthash_key = arc4random();
1777 
1778 	LIST_INIT(&sc->sc_rtlist);
1779 
1780 	return (0);
1781 }
1782 
1783 /*
1784  * bridge_rtable_fini:
1785  *
1786  *	Deconstruct the route table for this bridge.
1787  */
1788 void
1789 bridge_rtable_fini(struct bridge_softc *sc)
1790 {
1791 
1792 	free(sc->sc_rthash, M_DEVBUF);
1793 }
1794 
1795 /*
1796  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
1797  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
1798  */
1799 #define	mix(a, b, c)							\
1800 do {									\
1801 	a -= b; a -= c; a ^= (c >> 13);					\
1802 	b -= c; b -= a; b ^= (a << 8);					\
1803 	c -= a; c -= b; c ^= (b >> 13);					\
1804 	a -= b; a -= c; a ^= (c >> 12);					\
1805 	b -= c; b -= a; b ^= (a << 16);					\
1806 	c -= a; c -= b; c ^= (b >> 5);					\
1807 	a -= b; a -= c; a ^= (c >> 3);					\
1808 	b -= c; b -= a; b ^= (a << 10);					\
1809 	c -= a; c -= b; c ^= (b >> 15);					\
1810 } while (/*CONSTCOND*/0)
1811 
1812 static __inline uint32_t
1813 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
1814 {
1815 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
1816 
1817 	b += addr[5] << 8;
1818 	b += addr[4];
1819 	a += addr[3] << 24;
1820 	a += addr[2] << 16;
1821 	a += addr[1] << 8;
1822 	a += addr[0];
1823 
1824 	mix(a, b, c);
1825 
1826 	return (c & BRIDGE_RTHASH_MASK);
1827 }
1828 
1829 #undef mix
1830 
1831 /*
1832  * bridge_rtnode_lookup:
1833  *
1834  *	Look up a bridge route node for the specified destination.
1835  */
1836 struct bridge_rtnode *
1837 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
1838 {
1839 	struct bridge_rtnode *brt;
1840 	uint32_t hash;
1841 	int dir;
1842 
1843 	hash = bridge_rthash(sc, addr);
1844 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
1845 		dir = memcmp(addr, brt->brt_addr, ETHER_ADDR_LEN);
1846 		if (dir == 0)
1847 			return (brt);
1848 		if (dir > 0)
1849 			return (NULL);
1850 	}
1851 
1852 	return (NULL);
1853 }
1854 
1855 /*
1856  * bridge_rtnode_insert:
1857  *
1858  *	Insert the specified bridge node into the route table.  We
1859  *	assume the entry is not already in the table.
1860  */
1861 int
1862 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
1863 {
1864 	struct bridge_rtnode *lbrt;
1865 	uint32_t hash;
1866 	int dir;
1867 
1868 	hash = bridge_rthash(sc, brt->brt_addr);
1869 
1870 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
1871 	if (lbrt == NULL) {
1872 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
1873 		goto out;
1874 	}
1875 
1876 	do {
1877 		dir = memcmp(brt->brt_addr, lbrt->brt_addr, ETHER_ADDR_LEN);
1878 		if (dir == 0)
1879 			return (EEXIST);
1880 		if (dir > 0) {
1881 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
1882 			goto out;
1883 		}
1884 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
1885 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
1886 			goto out;
1887 		}
1888 		lbrt = LIST_NEXT(lbrt, brt_hash);
1889 	} while (lbrt != NULL);
1890 
1891 #ifdef DIAGNOSTIC
1892 	panic("bridge_rtnode_insert: impossible");
1893 #endif
1894 
1895  out:
1896 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
1897 	sc->sc_brtcnt++;
1898 
1899 	return (0);
1900 }
1901 
1902 /*
1903  * bridge_rtnode_destroy:
1904  *
1905  *	Destroy a bridge rtnode.
1906  */
1907 void
1908 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
1909 {
1910 
1911 	LIST_REMOVE(brt, brt_hash);
1912 
1913 	LIST_REMOVE(brt, brt_list);
1914 	sc->sc_brtcnt--;
1915 	pool_put(&bridge_rtnode_pool, brt);
1916 }
1917 
1918 #ifdef BRIDGE_IPF
1919 extern struct pfil_head inet_pfil_hook;                 /* XXX */
1920 extern struct pfil_head inet6_pfil_hook;                /* XXX */
1921 
1922 /*
1923  * Send bridge packets through IPF if they are one of the types IPF can deal
1924  * with, or if they are ARP or REVARP.  (IPF will pass ARP and REVARP without
1925  * question.)
1926  */
1927 static int bridge_ipf(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
1928 {
1929 	int snap, error;
1930 	struct ether_header *eh1, eh2;
1931 	struct llc llc;
1932 	u_int16_t ether_type;
1933 
1934 	snap = 0;
1935 	error = -1;	/* Default error if not error == 0 */
1936 	eh1 = mtod(*mp, struct ether_header *);
1937 	ether_type = ntohs(eh1->ether_type);
1938 
1939 	/*
1940 	 * Check for SNAP/LLC.
1941 	 */
1942         if (ether_type < ETHERMTU) {
1943                 struct llc *llc = (struct llc *)(eh1 + 1);
1944 
1945                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
1946                     llc->llc_dsap == LLC_SNAP_LSAP &&
1947                     llc->llc_ssap == LLC_SNAP_LSAP &&
1948                     llc->llc_control == LLC_UI) {
1949                 	ether_type = htons(llc->llc_un.type_snap.ether_type);
1950 			snap = 1;
1951                 }
1952         }
1953 
1954 	/*
1955 	 * If we're trying to filter bridge traffic, don't look at anything
1956 	 * other than IP and ARP traffic.  If the filter doesn't understand
1957 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
1958 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
1959 	 * but of course we don't have an AppleTalk filter to begin with.
1960 	 * (Note that since IPF doesn't understand ARP it will pass *ALL*
1961 	 * ARP traffic.)
1962 	 */
1963 	switch (ether_type) {
1964 		case ETHERTYPE_ARP:
1965 		case ETHERTYPE_REVARP:
1966 			return 0; /* Automatically pass */
1967 		case ETHERTYPE_IP:
1968 # ifdef INET6
1969 		case ETHERTYPE_IPV6:
1970 # endif /* INET6 */
1971 			break;
1972 		default:
1973 			goto bad;
1974 	}
1975 
1976 	/* Strip off the Ethernet header and keep a copy. */
1977 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t) &eh2);
1978 	m_adj(*mp, ETHER_HDR_LEN);
1979 
1980 	/* Strip off snap header, if present */
1981 	if (snap) {
1982 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t) &llc);
1983 		m_adj(*mp, sizeof(struct llc));
1984 	}
1985 
1986 	/*
1987 	 * Check basic packet sanity and run IPF through pfil.
1988 	 */
1989 	switch (ether_type)
1990 	{
1991 	case ETHERTYPE_IP :
1992 		error = (dir == PFIL_IN) ? bridge_ip_checkbasic(mp) : 0;
1993 		if (error == 0)
1994 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
1995 		break;
1996 # ifdef INET6
1997 	case ETHERTYPE_IPV6 :
1998 		error = (dir == PFIL_IN) ? bridge_ip6_checkbasic(mp) : 0;
1999 		if (error == 0)
2000 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp, dir);
2001 		break;
2002 # endif
2003 	default :
2004 		error = 0;
2005 		break;
2006 	}
2007 
2008 	if (*mp == NULL)
2009 		return error;
2010 	if (error != 0)
2011 		goto bad;
2012 
2013 	error = -1;
2014 
2015 	/*
2016 	 * Finally, put everything back the way it was and return
2017 	 */
2018 	if (snap) {
2019 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2020 		if (*mp == NULL)
2021 			return error;
2022 		bcopy(&llc, mtod(*mp, caddr_t), sizeof(struct llc));
2023 	}
2024 
2025 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2026 	if (*mp == NULL)
2027 		return error;
2028 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
2029 
2030 	return 0;
2031 
2032     bad:
2033 	m_freem(*mp);
2034 	*mp = NULL;
2035 	return error;
2036 }
2037 
2038 /*
2039  * Perform basic checks on header size since
2040  * IPF assumes ip_input has already processed
2041  * it for it.  Cut-and-pasted from ip_input.c.
2042  * Given how simple the IPv6 version is,
2043  * does the IPv4 version really need to be
2044  * this complicated?
2045  *
2046  * XXX Should we update ipstat here, or not?
2047  * XXX Right now we update ipstat but not
2048  * XXX csum_counter.
2049  */
2050 static int
2051 bridge_ip_checkbasic(struct mbuf **mp)
2052 {
2053 	struct mbuf *m = *mp;
2054 	struct ip *ip;
2055 	int len, hlen;
2056 
2057 	if (*mp == NULL)
2058 		return -1;
2059 
2060 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2061 		if ((m = m_copyup(m, sizeof(struct ip),
2062 			(max_linkhdr + 3) & ~3)) == NULL) {
2063 			/* XXXJRT new stat, please */
2064 			ipstat.ips_toosmall++;
2065 			goto bad;
2066 		}
2067 	} else if (__predict_false(m->m_len < sizeof (struct ip))) {
2068 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2069 			ipstat.ips_toosmall++;
2070 			goto bad;
2071 		}
2072 	}
2073 	ip = mtod(m, struct ip *);
2074 	if (ip == NULL) goto bad;
2075 
2076 	if (ip->ip_v != IPVERSION) {
2077 		ipstat.ips_badvers++;
2078 		goto bad;
2079 	}
2080 	hlen = ip->ip_hl << 2;
2081 	if (hlen < sizeof(struct ip)) { /* minimum header length */
2082 		ipstat.ips_badhlen++;
2083 		goto bad;
2084 	}
2085 	if (hlen > m->m_len) {
2086 		if ((m = m_pullup(m, hlen)) == 0) {
2087 			ipstat.ips_badhlen++;
2088 			goto bad;
2089 		}
2090 		ip = mtod(m, struct ip *);
2091 		if (ip == NULL) goto bad;
2092 	}
2093 
2094         switch (m->m_pkthdr.csum_flags &
2095                 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_IPv4) |
2096                  M_CSUM_IPv4_BAD)) {
2097         case M_CSUM_IPv4|M_CSUM_IPv4_BAD:
2098                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_bad); */
2099                 goto bad;
2100 
2101         case M_CSUM_IPv4:
2102                 /* Checksum was okay. */
2103                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_ok); */
2104                 break;
2105 
2106         default:
2107                 /* Must compute it ourselves. */
2108                 /* INET_CSUM_COUNTER_INCR(&ip_swcsum); */
2109                 if (in_cksum(m, hlen) != 0)
2110                         goto bad;
2111                 break;
2112         }
2113 
2114         /* Retrieve the packet length. */
2115         len = ntohs(ip->ip_len);
2116 
2117         /*
2118          * Check for additional length bogosity
2119          */
2120         if (len < hlen) {
2121                 ipstat.ips_badlen++;
2122                 goto bad;
2123         }
2124 
2125         /*
2126          * Check that the amount of data in the buffers
2127          * is as at least much as the IP header would have us expect.
2128          * Drop packet if shorter than we expect.
2129          */
2130         if (m->m_pkthdr.len < len) {
2131                 ipstat.ips_tooshort++;
2132                 goto bad;
2133         }
2134 
2135 	/* Checks out, proceed */
2136 	*mp = m;
2137 	return 0;
2138 
2139     bad:
2140 	*mp = m;
2141 	return -1;
2142 }
2143 
2144 # ifdef INET6
2145 /*
2146  * Same as above, but for IPv6.
2147  * Cut-and-pasted from ip6_input.c.
2148  * XXX Should we update ip6stat, or not?
2149  */
2150 static int
2151 bridge_ip6_checkbasic(struct mbuf **mp)
2152 {
2153 	struct mbuf *m = *mp;
2154 	struct ip6_hdr *ip6;
2155 
2156         /*
2157          * If the IPv6 header is not aligned, slurp it up into a new
2158          * mbuf with space for link headers, in the event we forward
2159          * it.  Otherwise, if it is aligned, make sure the entire base
2160          * IPv6 header is in the first mbuf of the chain.
2161          */
2162         if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
2163                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2164                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2165                                   (max_linkhdr + 3) & ~3)) == NULL) {
2166                         /* XXXJRT new stat, please */
2167                         ip6stat.ip6s_toosmall++;
2168                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2169                         goto bad;
2170                 }
2171         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2172                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2173                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2174                         ip6stat.ip6s_toosmall++;
2175                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2176                         goto bad;
2177                 }
2178         }
2179 
2180         ip6 = mtod(m, struct ip6_hdr *);
2181 
2182         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2183                 ip6stat.ip6s_badvers++;
2184                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2185                 goto bad;
2186         }
2187 
2188 	/* Checks out, proceed */
2189 	*mp = m;
2190 	return 0;
2191 
2192     bad:
2193 	*mp = m;
2194 	return -1;
2195 }
2196 # endif /* INET6 */
2197 #endif /* BRIDGE_IPF */
2198