xref: /netbsd-src/sys/net/if_bridge.c (revision 5bbd2a12505d72a8177929a37b5cee489d0a1cfd)
1 /*	$NetBSD: if_bridge.c,v 1.76 2012/03/22 12:59:33 wiz Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. All advertising materials mentioning features or use of this software
51  *    must display the following acknowledgement:
52  *	This product includes software developed by Jason L. Wright
53  * 4. The name of the author may not be used to endorse or promote products
54  *    derived from this software without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
66  * POSSIBILITY OF SUCH DAMAGE.
67  *
68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  */
81 
82 #include <sys/cdefs.h>
83 __KERNEL_RCSID(0, "$NetBSD: if_bridge.c,v 1.76 2012/03/22 12:59:33 wiz Exp $");
84 
85 #ifdef _KERNEL_OPT
86 #include "opt_bridge_ipf.h"
87 #include "opt_inet.h"
88 #include "opt_pfil_hooks.h"
89 #endif /* _KERNEL_OPT */
90 
91 #include <sys/param.h>
92 #include <sys/kernel.h>
93 #include <sys/mbuf.h>
94 #include <sys/queue.h>
95 #include <sys/socket.h>
96 #include <sys/socketvar.h> /* for softnet_lock */
97 #include <sys/sockio.h>
98 #include <sys/systm.h>
99 #include <sys/proc.h>
100 #include <sys/pool.h>
101 #include <sys/kauth.h>
102 #include <sys/cpu.h>
103 #include <sys/cprng.h>
104 
105 #include <net/bpf.h>
106 #include <net/if.h>
107 #include <net/if_dl.h>
108 #include <net/if_types.h>
109 #include <net/if_llc.h>
110 
111 #include <net/if_ether.h>
112 #include <net/if_bridgevar.h>
113 
114 #if defined(BRIDGE_IPF) && defined(PFIL_HOOKS)
115 /* Used for bridge_ip[6]_checkbasic */
116 #include <netinet/in.h>
117 #include <netinet/in_systm.h>
118 #include <netinet/ip.h>
119 #include <netinet/ip_var.h>
120 #include <netinet/ip_private.h>		/* XXX */
121 
122 #include <netinet/ip6.h>
123 #include <netinet6/in6_var.h>
124 #include <netinet6/ip6_var.h>
125 #include <netinet6/ip6_private.h>	/* XXX */
126 #endif /* BRIDGE_IPF && PFIL_HOOKS */
127 
128 /*
129  * Size of the route hash table.  Must be a power of two.
130  */
131 #ifndef BRIDGE_RTHASH_SIZE
132 #define	BRIDGE_RTHASH_SIZE		1024
133 #endif
134 
135 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
136 
137 #include "carp.h"
138 #if NCARP > 0
139 #include <netinet/in.h>
140 #include <netinet/in_var.h>
141 #include <netinet/ip_carp.h>
142 #endif
143 
144 /*
145  * Maximum number of addresses to cache.
146  */
147 #ifndef BRIDGE_RTABLE_MAX
148 #define	BRIDGE_RTABLE_MAX		100
149 #endif
150 
151 /*
152  * Spanning tree defaults.
153  */
154 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
155 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
156 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
157 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
158 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
159 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
160 #define	BSTP_DEFAULT_PATH_COST		55
161 
162 /*
163  * Timeout (in seconds) for entries learned dynamically.
164  */
165 #ifndef BRIDGE_RTABLE_TIMEOUT
166 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
167 #endif
168 
169 /*
170  * Number of seconds between walks of the route list.
171  */
172 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
173 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
174 #endif
175 
176 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
177 
178 static struct pool bridge_rtnode_pool;
179 
180 void	bridgeattach(int);
181 
182 static int	bridge_clone_create(struct if_clone *, int);
183 static int	bridge_clone_destroy(struct ifnet *);
184 
185 static int	bridge_ioctl(struct ifnet *, u_long, void *);
186 static int	bridge_init(struct ifnet *);
187 static void	bridge_stop(struct ifnet *, int);
188 static void	bridge_start(struct ifnet *);
189 
190 static void	bridge_forward(void *);
191 
192 static void	bridge_timer(void *);
193 
194 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
195 				 struct mbuf *);
196 
197 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
198 				struct ifnet *, int, uint8_t);
199 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
200 static void	bridge_rttrim(struct bridge_softc *);
201 static void	bridge_rtage(struct bridge_softc *);
202 static void	bridge_rtflush(struct bridge_softc *, int);
203 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
204 static void	bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp);
205 
206 static int	bridge_rtable_init(struct bridge_softc *);
207 static void	bridge_rtable_fini(struct bridge_softc *);
208 
209 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
210 						  const uint8_t *);
211 static int	bridge_rtnode_insert(struct bridge_softc *,
212 				     struct bridge_rtnode *);
213 static void	bridge_rtnode_destroy(struct bridge_softc *,
214 				      struct bridge_rtnode *);
215 
216 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
217 						  const char *name);
218 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
219 						     struct ifnet *ifp);
220 static void	bridge_delete_member(struct bridge_softc *,
221 				     struct bridge_iflist *);
222 
223 static int	bridge_ioctl_add(struct bridge_softc *, void *);
224 static int	bridge_ioctl_del(struct bridge_softc *, void *);
225 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
226 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
227 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
228 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
229 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
230 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
231 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
232 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
233 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
234 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
235 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
236 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
237 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
238 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
239 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
240 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
241 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
242 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
243 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
244 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
245 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
246 #if defined(BRIDGE_IPF) && defined(PFIL_HOOKS)
247 static int	bridge_ioctl_gfilt(struct bridge_softc *, void *);
248 static int	bridge_ioctl_sfilt(struct bridge_softc *, void *);
249 static int	bridge_ipf(void *, struct mbuf **, struct ifnet *, int);
250 static int	bridge_ip_checkbasic(struct mbuf **mp);
251 # ifdef INET6
252 static int	bridge_ip6_checkbasic(struct mbuf **mp);
253 # endif /* INET6 */
254 #endif /* BRIDGE_IPF && PFIL_HOOKS */
255 
256 struct bridge_control {
257 	int	(*bc_func)(struct bridge_softc *, void *);
258 	int	bc_argsize;
259 	int	bc_flags;
260 };
261 
262 #define	BC_F_COPYIN		0x01	/* copy arguments in */
263 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
264 #define	BC_F_SUSER		0x04	/* do super-user check */
265 
266 static const struct bridge_control bridge_control_table[] = {
267 [BRDGADD] = {bridge_ioctl_add, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
268 [BRDGDEL] = {bridge_ioctl_del, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
269 
270 [BRDGGIFFLGS] = {bridge_ioctl_gifflags, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_COPYOUT},
271 [BRDGSIFFLGS] = {bridge_ioctl_sifflags, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
272 
273 [BRDGSCACHE] = {bridge_ioctl_scache, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
274 [BRDGGCACHE] = {bridge_ioctl_gcache, sizeof(struct ifbrparam), BC_F_COPYOUT},
275 
276 [BRDGGIFS] = {bridge_ioctl_gifs, sizeof(struct ifbifconf), BC_F_COPYIN|BC_F_COPYOUT},
277 [BRDGRTS] = {bridge_ioctl_rts, sizeof(struct ifbaconf), BC_F_COPYIN|BC_F_COPYOUT},
278 
279 [BRDGSADDR] = {bridge_ioctl_saddr, sizeof(struct ifbareq), BC_F_COPYIN|BC_F_SUSER},
280 
281 [BRDGSTO] = {bridge_ioctl_sto, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
282 [BRDGGTO] = {bridge_ioctl_gto, sizeof(struct ifbrparam), BC_F_COPYOUT},
283 
284 [BRDGDADDR] = {bridge_ioctl_daddr, sizeof(struct ifbareq), BC_F_COPYIN|BC_F_SUSER},
285 
286 [BRDGFLUSH] = {bridge_ioctl_flush, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
287 
288 [BRDGGPRI] = {bridge_ioctl_gpri, sizeof(struct ifbrparam), BC_F_COPYOUT},
289 [BRDGSPRI] = {bridge_ioctl_spri, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
290 
291 [BRDGGHT] = {bridge_ioctl_ght, sizeof(struct ifbrparam), BC_F_COPYOUT},
292 [BRDGSHT] = {bridge_ioctl_sht, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
293 
294 [BRDGGFD] = {bridge_ioctl_gfd, sizeof(struct ifbrparam), BC_F_COPYOUT},
295 [BRDGSFD] = {bridge_ioctl_sfd, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
296 
297 [BRDGGMA] = {bridge_ioctl_gma, sizeof(struct ifbrparam), BC_F_COPYOUT},
298 [BRDGSMA] = {bridge_ioctl_sma, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
299 
300 [BRDGSIFPRIO] = {bridge_ioctl_sifprio, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
301 
302 [BRDGSIFCOST] = {bridge_ioctl_sifcost, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
303 #if defined(BRIDGE_IPF) && defined(PFIL_HOOKS)
304 [BRDGGFILT] = {bridge_ioctl_gfilt, sizeof(struct ifbrparam), BC_F_COPYOUT},
305 [BRDGSFILT] = {bridge_ioctl_sfilt, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
306 #endif /* BRIDGE_IPF && PFIL_HOOKS */
307 };
308 static const int bridge_control_table_size = __arraycount(bridge_control_table);
309 
310 static LIST_HEAD(, bridge_softc) bridge_list;
311 
312 static struct if_clone bridge_cloner =
313     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
314 
315 /*
316  * bridgeattach:
317  *
318  *	Pseudo-device attach routine.
319  */
320 void
321 bridgeattach(int n)
322 {
323 
324 	pool_init(&bridge_rtnode_pool, sizeof(struct bridge_rtnode),
325 	    0, 0, 0, "brtpl", NULL, IPL_NET);
326 
327 	LIST_INIT(&bridge_list);
328 	if_clone_attach(&bridge_cloner);
329 }
330 
331 /*
332  * bridge_clone_create:
333  *
334  *	Create a new bridge instance.
335  */
336 static int
337 bridge_clone_create(struct if_clone *ifc, int unit)
338 {
339 	struct bridge_softc *sc;
340 	struct ifnet *ifp;
341 	int s;
342 
343 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
344 	ifp = &sc->sc_if;
345 
346 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
347 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
348 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
349 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
350 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
351 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
352 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
353 	sc->sc_filter_flags = 0;
354 
355 	/* software interrupt to do the work */
356 	sc->sc_softintr = softint_establish(SOFTINT_NET, bridge_forward, sc);
357 	if (sc->sc_softintr == NULL) {
358 		free(sc, M_DEVBUF);
359 		return ENOMEM;
360 	}
361 
362 	/* Initialize our routing table. */
363 	bridge_rtable_init(sc);
364 
365 	callout_init(&sc->sc_brcallout, 0);
366 	callout_init(&sc->sc_bstpcallout, 0);
367 
368 	LIST_INIT(&sc->sc_iflist);
369 
370 	if_initname(ifp, ifc->ifc_name, unit);
371 	ifp->if_softc = sc;
372 	ifp->if_mtu = ETHERMTU;
373 	ifp->if_ioctl = bridge_ioctl;
374 	ifp->if_output = bridge_output;
375 	ifp->if_start = bridge_start;
376 	ifp->if_stop = bridge_stop;
377 	ifp->if_init = bridge_init;
378 	ifp->if_type = IFT_BRIDGE;
379 	ifp->if_addrlen = 0;
380 	ifp->if_dlt = DLT_EN10MB;
381 	ifp->if_hdrlen = ETHER_HDR_LEN;
382 	IFQ_SET_READY(&ifp->if_snd);
383 
384 	if_attach(ifp);
385 
386 	if_alloc_sadl(ifp);
387 
388 	s = splnet();
389 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
390 	splx(s);
391 
392 	return (0);
393 }
394 
395 /*
396  * bridge_clone_destroy:
397  *
398  *	Destroy a bridge instance.
399  */
400 static int
401 bridge_clone_destroy(struct ifnet *ifp)
402 {
403 	struct bridge_softc *sc = ifp->if_softc;
404 	struct bridge_iflist *bif;
405 	int s;
406 
407 	s = splnet();
408 
409 	bridge_stop(ifp, 1);
410 
411 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
412 		bridge_delete_member(sc, bif);
413 
414 	LIST_REMOVE(sc, sc_list);
415 
416 	splx(s);
417 
418 	if_detach(ifp);
419 
420 	/* Tear down the routing table. */
421 	bridge_rtable_fini(sc);
422 
423 	softint_disestablish(sc->sc_softintr);
424 
425 	free(sc, M_DEVBUF);
426 
427 	return (0);
428 }
429 
430 /*
431  * bridge_ioctl:
432  *
433  *	Handle a control request from the operator.
434  */
435 static int
436 bridge_ioctl(struct ifnet *ifp, u_long cmd, void *data)
437 {
438 	struct bridge_softc *sc = ifp->if_softc;
439 	struct lwp *l = curlwp;	/* XXX */
440 	union {
441 		struct ifbreq ifbreq;
442 		struct ifbifconf ifbifconf;
443 		struct ifbareq ifbareq;
444 		struct ifbaconf ifbaconf;
445 		struct ifbrparam ifbrparam;
446 	} args;
447 	struct ifdrv *ifd = (struct ifdrv *) data;
448 	const struct bridge_control *bc = NULL; /* XXXGCC */
449 	int s, error = 0;
450 
451 	/* Authorize command before calling splnet(). */
452 	switch (cmd) {
453 	case SIOCGDRVSPEC:
454 	case SIOCSDRVSPEC:
455 		if (ifd->ifd_cmd >= bridge_control_table_size) {
456 			error = EINVAL;
457 			return error;
458 		}
459 
460 		bc = &bridge_control_table[ifd->ifd_cmd];
461 
462 		/* We only care about BC_F_SUSER at this point. */
463 		if ((bc->bc_flags & BC_F_SUSER) == 0)
464 			break;
465 
466 		error = kauth_authorize_network(l->l_cred,
467 		    KAUTH_NETWORK_INTERFACE_BRIDGE,
468 		    cmd == SIOCGDRVSPEC ?
469 		     KAUTH_REQ_NETWORK_INTERFACE_BRIDGE_GETPRIV :
470 		     KAUTH_REQ_NETWORK_INTERFACE_BRIDGE_SETPRIV,
471 		     ifd, NULL, NULL);
472 		if (error)
473 			return (error);
474 
475 		break;
476 	}
477 
478 	s = splnet();
479 
480 	switch (cmd) {
481 	case SIOCGDRVSPEC:
482 	case SIOCSDRVSPEC:
483 		KASSERT(bc != NULL);
484 		if (cmd == SIOCGDRVSPEC &&
485 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
486 			error = EINVAL;
487 			break;
488 		}
489 		else if (cmd == SIOCSDRVSPEC &&
490 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
491 			error = EINVAL;
492 			break;
493 		}
494 
495 		/* BC_F_SUSER is checked above, before splnet(). */
496 
497 		if (ifd->ifd_len != bc->bc_argsize ||
498 		    ifd->ifd_len > sizeof(args)) {
499 			error = EINVAL;
500 			break;
501 		}
502 
503 		memset(&args, 0, sizeof(args));
504 		if (bc->bc_flags & BC_F_COPYIN) {
505 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
506 			if (error)
507 				break;
508 		}
509 
510 		error = (*bc->bc_func)(sc, &args);
511 		if (error)
512 			break;
513 
514 		if (bc->bc_flags & BC_F_COPYOUT)
515 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
516 
517 		break;
518 
519 	case SIOCSIFFLAGS:
520 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
521 			break;
522 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
523 		case IFF_RUNNING:
524 			/*
525 			 * If interface is marked down and it is running,
526 			 * then stop and disable it.
527 			 */
528 			(*ifp->if_stop)(ifp, 1);
529 			break;
530 		case IFF_UP:
531 			/*
532 			 * If interface is marked up and it is stopped, then
533 			 * start it.
534 			 */
535 			error = (*ifp->if_init)(ifp);
536 			break;
537 		default:
538 			break;
539 		}
540 		break;
541 
542 	default:
543 		error = ifioctl_common(ifp, cmd, data);
544 		break;
545 	}
546 
547 	splx(s);
548 
549 	return (error);
550 }
551 
552 /*
553  * bridge_lookup_member:
554  *
555  *	Lookup a bridge member interface.  Must be called at splnet().
556  */
557 static struct bridge_iflist *
558 bridge_lookup_member(struct bridge_softc *sc, const char *name)
559 {
560 	struct bridge_iflist *bif;
561 	struct ifnet *ifp;
562 
563 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
564 		ifp = bif->bif_ifp;
565 		if (strcmp(ifp->if_xname, name) == 0)
566 			return (bif);
567 	}
568 
569 	return (NULL);
570 }
571 
572 /*
573  * bridge_lookup_member_if:
574  *
575  *	Lookup a bridge member interface by ifnet*.  Must be called at splnet().
576  */
577 static struct bridge_iflist *
578 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
579 {
580 	struct bridge_iflist *bif;
581 
582 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
583 		if (bif->bif_ifp == member_ifp)
584 			return (bif);
585 	}
586 
587 	return (NULL);
588 }
589 
590 /*
591  * bridge_delete_member:
592  *
593  *	Delete the specified member interface.
594  */
595 static void
596 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif)
597 {
598 	struct ifnet *ifs = bif->bif_ifp;
599 
600 	switch (ifs->if_type) {
601 	case IFT_ETHER:
602 		/*
603 		 * Take the interface out of promiscuous mode.
604 		 */
605 		(void) ifpromisc(ifs, 0);
606 		break;
607 	default:
608 #ifdef DIAGNOSTIC
609 		panic("bridge_delete_member: impossible");
610 #endif
611 		break;
612 	}
613 
614 	ifs->if_bridge = NULL;
615 	LIST_REMOVE(bif, bif_next);
616 
617 	bridge_rtdelete(sc, ifs);
618 
619 	free(bif, M_DEVBUF);
620 
621 	if (sc->sc_if.if_flags & IFF_RUNNING)
622 		bstp_initialization(sc);
623 }
624 
625 static int
626 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
627 {
628 	struct ifbreq *req = arg;
629 	struct bridge_iflist *bif = NULL;
630 	struct ifnet *ifs;
631 	int error = 0;
632 
633 	ifs = ifunit(req->ifbr_ifsname);
634 	if (ifs == NULL)
635 		return (ENOENT);
636 
637 	if (sc->sc_if.if_mtu != ifs->if_mtu)
638 		return (EINVAL);
639 
640 	if (ifs->if_bridge == sc)
641 		return (EEXIST);
642 
643 	if (ifs->if_bridge != NULL)
644 		return (EBUSY);
645 
646 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT);
647 	if (bif == NULL)
648 		return (ENOMEM);
649 
650 	switch (ifs->if_type) {
651 	case IFT_ETHER:
652 		/*
653 		 * Place the interface into promiscuous mode.
654 		 */
655 		error = ifpromisc(ifs, 1);
656 		if (error)
657 			goto out;
658 		break;
659 	default:
660 		error = EINVAL;
661 		goto out;
662 	}
663 
664 	bif->bif_ifp = ifs;
665 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
666 	bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
667 	bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
668 
669 	ifs->if_bridge = sc;
670 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
671 
672 	if (sc->sc_if.if_flags & IFF_RUNNING)
673 		bstp_initialization(sc);
674 	else
675 		bstp_stop(sc);
676 
677  out:
678 	if (error) {
679 		if (bif != NULL)
680 			free(bif, M_DEVBUF);
681 	}
682 	return (error);
683 }
684 
685 static int
686 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
687 {
688 	struct ifbreq *req = arg;
689 	struct bridge_iflist *bif;
690 
691 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
692 	if (bif == NULL)
693 		return (ENOENT);
694 
695 	bridge_delete_member(sc, bif);
696 
697 	return (0);
698 }
699 
700 static int
701 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
702 {
703 	struct ifbreq *req = arg;
704 	struct bridge_iflist *bif;
705 
706 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
707 	if (bif == NULL)
708 		return (ENOENT);
709 
710 	req->ifbr_ifsflags = bif->bif_flags;
711 	req->ifbr_state = bif->bif_state;
712 	req->ifbr_priority = bif->bif_priority;
713 	req->ifbr_path_cost = bif->bif_path_cost;
714 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
715 
716 	return (0);
717 }
718 
719 static int
720 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
721 {
722 	struct ifbreq *req = arg;
723 	struct bridge_iflist *bif;
724 
725 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
726 	if (bif == NULL)
727 		return (ENOENT);
728 
729 	if (req->ifbr_ifsflags & IFBIF_STP) {
730 		switch (bif->bif_ifp->if_type) {
731 		case IFT_ETHER:
732 			/* These can do spanning tree. */
733 			break;
734 
735 		default:
736 			/* Nothing else can. */
737 			return (EINVAL);
738 		}
739 	}
740 
741 	bif->bif_flags = req->ifbr_ifsflags;
742 
743 	if (sc->sc_if.if_flags & IFF_RUNNING)
744 		bstp_initialization(sc);
745 
746 	return (0);
747 }
748 
749 static int
750 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
751 {
752 	struct ifbrparam *param = arg;
753 
754 	sc->sc_brtmax = param->ifbrp_csize;
755 	bridge_rttrim(sc);
756 
757 	return (0);
758 }
759 
760 static int
761 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
762 {
763 	struct ifbrparam *param = arg;
764 
765 	param->ifbrp_csize = sc->sc_brtmax;
766 
767 	return (0);
768 }
769 
770 static int
771 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
772 {
773 	struct ifbifconf *bifc = arg;
774 	struct bridge_iflist *bif;
775 	struct ifbreq breq;
776 	int count, len, error = 0;
777 
778 	count = 0;
779 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
780 		count++;
781 
782 	if (bifc->ifbic_len == 0) {
783 		bifc->ifbic_len = sizeof(breq) * count;
784 		return (0);
785 	}
786 
787 	count = 0;
788 	len = bifc->ifbic_len;
789 	memset(&breq, 0, sizeof breq);
790 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
791 		if (len < sizeof(breq))
792 			break;
793 
794 		strlcpy(breq.ifbr_ifsname, bif->bif_ifp->if_xname,
795 		    sizeof(breq.ifbr_ifsname));
796 		breq.ifbr_ifsflags = bif->bif_flags;
797 		breq.ifbr_state = bif->bif_state;
798 		breq.ifbr_priority = bif->bif_priority;
799 		breq.ifbr_path_cost = bif->bif_path_cost;
800 		breq.ifbr_portno = bif->bif_ifp->if_index & 0xff;
801 		error = copyout(&breq, bifc->ifbic_req + count, sizeof(breq));
802 		if (error)
803 			break;
804 		count++;
805 		len -= sizeof(breq);
806 	}
807 
808 	bifc->ifbic_len = sizeof(breq) * count;
809 	return (error);
810 }
811 
812 static int
813 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
814 {
815 	struct ifbaconf *bac = arg;
816 	struct bridge_rtnode *brt;
817 	struct ifbareq bareq;
818 	int count = 0, error = 0, len;
819 
820 	if (bac->ifbac_len == 0)
821 		return (0);
822 
823 	len = bac->ifbac_len;
824 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
825 		if (len < sizeof(bareq))
826 			goto out;
827 		memset(&bareq, 0, sizeof(bareq));
828 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
829 		    sizeof(bareq.ifba_ifsname));
830 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
831 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
832 			bareq.ifba_expire = brt->brt_expire - time_uptime;
833 		} else
834 			bareq.ifba_expire = 0;
835 		bareq.ifba_flags = brt->brt_flags;
836 
837 		error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
838 		if (error)
839 			goto out;
840 		count++;
841 		len -= sizeof(bareq);
842 	}
843  out:
844 	bac->ifbac_len = sizeof(bareq) * count;
845 	return (error);
846 }
847 
848 static int
849 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
850 {
851 	struct ifbareq *req = arg;
852 	struct bridge_iflist *bif;
853 	int error;
854 
855 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
856 	if (bif == NULL)
857 		return (ENOENT);
858 
859 	error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
860 	    req->ifba_flags);
861 
862 	return (error);
863 }
864 
865 static int
866 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
867 {
868 	struct ifbrparam *param = arg;
869 
870 	sc->sc_brttimeout = param->ifbrp_ctime;
871 
872 	return (0);
873 }
874 
875 static int
876 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
877 {
878 	struct ifbrparam *param = arg;
879 
880 	param->ifbrp_ctime = sc->sc_brttimeout;
881 
882 	return (0);
883 }
884 
885 static int
886 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
887 {
888 	struct ifbareq *req = arg;
889 
890 	return (bridge_rtdaddr(sc, req->ifba_dst));
891 }
892 
893 static int
894 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
895 {
896 	struct ifbreq *req = arg;
897 
898 	bridge_rtflush(sc, req->ifbr_ifsflags);
899 
900 	return (0);
901 }
902 
903 static int
904 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
905 {
906 	struct ifbrparam *param = arg;
907 
908 	param->ifbrp_prio = sc->sc_bridge_priority;
909 
910 	return (0);
911 }
912 
913 static int
914 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
915 {
916 	struct ifbrparam *param = arg;
917 
918 	sc->sc_bridge_priority = param->ifbrp_prio;
919 
920 	if (sc->sc_if.if_flags & IFF_RUNNING)
921 		bstp_initialization(sc);
922 
923 	return (0);
924 }
925 
926 static int
927 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
928 {
929 	struct ifbrparam *param = arg;
930 
931 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
932 
933 	return (0);
934 }
935 
936 static int
937 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
938 {
939 	struct ifbrparam *param = arg;
940 
941 	if (param->ifbrp_hellotime == 0)
942 		return (EINVAL);
943 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
944 
945 	if (sc->sc_if.if_flags & IFF_RUNNING)
946 		bstp_initialization(sc);
947 
948 	return (0);
949 }
950 
951 static int
952 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
953 {
954 	struct ifbrparam *param = arg;
955 
956 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
957 
958 	return (0);
959 }
960 
961 static int
962 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
963 {
964 	struct ifbrparam *param = arg;
965 
966 	if (param->ifbrp_fwddelay == 0)
967 		return (EINVAL);
968 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
969 
970 	if (sc->sc_if.if_flags & IFF_RUNNING)
971 		bstp_initialization(sc);
972 
973 	return (0);
974 }
975 
976 static int
977 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
978 {
979 	struct ifbrparam *param = arg;
980 
981 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
982 
983 	return (0);
984 }
985 
986 static int
987 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
988 {
989 	struct ifbrparam *param = arg;
990 
991 	if (param->ifbrp_maxage == 0)
992 		return (EINVAL);
993 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
994 
995 	if (sc->sc_if.if_flags & IFF_RUNNING)
996 		bstp_initialization(sc);
997 
998 	return (0);
999 }
1000 
1001 static int
1002 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1003 {
1004 	struct ifbreq *req = arg;
1005 	struct bridge_iflist *bif;
1006 
1007 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1008 	if (bif == NULL)
1009 		return (ENOENT);
1010 
1011 	bif->bif_priority = req->ifbr_priority;
1012 
1013 	if (sc->sc_if.if_flags & IFF_RUNNING)
1014 		bstp_initialization(sc);
1015 
1016 	return (0);
1017 }
1018 
1019 #if defined(BRIDGE_IPF) && defined(PFIL_HOOKS)
1020 static int
1021 bridge_ioctl_gfilt(struct bridge_softc *sc, void *arg)
1022 {
1023 	struct ifbrparam *param = arg;
1024 
1025 	param->ifbrp_filter = sc->sc_filter_flags;
1026 
1027 	return (0);
1028 }
1029 
1030 static int
1031 bridge_ioctl_sfilt(struct bridge_softc *sc, void *arg)
1032 {
1033 	struct ifbrparam *param = arg;
1034 	uint32_t nflags, oflags;
1035 
1036 	if (param->ifbrp_filter & ~IFBF_FILT_MASK)
1037 		return (EINVAL);
1038 
1039 	nflags = param->ifbrp_filter;
1040 	oflags = sc->sc_filter_flags;
1041 
1042 	if ((nflags & IFBF_FILT_USEIPF) && !(oflags & IFBF_FILT_USEIPF)) {
1043 		pfil_add_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1044 			&sc->sc_if.if_pfil);
1045 	}
1046 	if (!(nflags & IFBF_FILT_USEIPF) && (oflags & IFBF_FILT_USEIPF)) {
1047 		pfil_remove_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1048 			&sc->sc_if.if_pfil);
1049 	}
1050 
1051 	sc->sc_filter_flags = nflags;
1052 
1053 	return (0);
1054 }
1055 #endif /* BRIDGE_IPF && PFIL_HOOKS */
1056 
1057 static int
1058 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1059 {
1060 	struct ifbreq *req = arg;
1061 	struct bridge_iflist *bif;
1062 
1063 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1064 	if (bif == NULL)
1065 		return (ENOENT);
1066 
1067 	bif->bif_path_cost = req->ifbr_path_cost;
1068 
1069 	if (sc->sc_if.if_flags & IFF_RUNNING)
1070 		bstp_initialization(sc);
1071 
1072 	return (0);
1073 }
1074 
1075 /*
1076  * bridge_ifdetach:
1077  *
1078  *	Detach an interface from a bridge.  Called when a member
1079  *	interface is detaching.
1080  */
1081 void
1082 bridge_ifdetach(struct ifnet *ifp)
1083 {
1084 	struct bridge_softc *sc = ifp->if_bridge;
1085 	struct ifbreq breq;
1086 
1087 	memset(&breq, 0, sizeof(breq));
1088 	strlcpy(breq.ifbr_ifsname, ifp->if_xname, sizeof(breq.ifbr_ifsname));
1089 
1090 	(void) bridge_ioctl_del(sc, &breq);
1091 }
1092 
1093 /*
1094  * bridge_init:
1095  *
1096  *	Initialize a bridge interface.
1097  */
1098 static int
1099 bridge_init(struct ifnet *ifp)
1100 {
1101 	struct bridge_softc *sc = ifp->if_softc;
1102 
1103 	if (ifp->if_flags & IFF_RUNNING)
1104 		return (0);
1105 
1106 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1107 	    bridge_timer, sc);
1108 
1109 	ifp->if_flags |= IFF_RUNNING;
1110 	bstp_initialization(sc);
1111 	return (0);
1112 }
1113 
1114 /*
1115  * bridge_stop:
1116  *
1117  *	Stop the bridge interface.
1118  */
1119 static void
1120 bridge_stop(struct ifnet *ifp, int disable)
1121 {
1122 	struct bridge_softc *sc = ifp->if_softc;
1123 
1124 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1125 		return;
1126 
1127 	callout_stop(&sc->sc_brcallout);
1128 	bstp_stop(sc);
1129 
1130 	IF_PURGE(&ifp->if_snd);
1131 
1132 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1133 
1134 	ifp->if_flags &= ~IFF_RUNNING;
1135 }
1136 
1137 /*
1138  * bridge_enqueue:
1139  *
1140  *	Enqueue a packet on a bridge member interface.
1141  *
1142  *	NOTE: must be called at splnet().
1143  */
1144 void
1145 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m,
1146     int runfilt)
1147 {
1148 	ALTQ_DECL(struct altq_pktattr pktattr;)
1149 	int len, error;
1150 	short mflags;
1151 
1152 	/*
1153 	 * Clear any in-bound checksum flags for this packet.
1154 	 */
1155 	m->m_pkthdr.csum_flags = 0;
1156 
1157 #ifdef PFIL_HOOKS
1158 	if (runfilt) {
1159 		if (pfil_run_hooks(&sc->sc_if.if_pfil, &m,
1160 		    dst_ifp, PFIL_OUT) != 0) {
1161 			if (m != NULL)
1162 				m_freem(m);
1163 			return;
1164 		}
1165 		if (m == NULL)
1166 			return;
1167 	}
1168 #endif /* PFIL_HOOKS */
1169 
1170 #ifdef ALTQ
1171 	/*
1172 	 * If ALTQ is enabled on the member interface, do
1173 	 * classification; the queueing discipline might
1174 	 * not require classification, but might require
1175 	 * the address family/header pointer in the pktattr.
1176 	 */
1177 	if (ALTQ_IS_ENABLED(&dst_ifp->if_snd)) {
1178 		/* XXX IFT_ETHER */
1179 		altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
1180 	}
1181 #endif /* ALTQ */
1182 
1183 	len = m->m_pkthdr.len;
1184 	m->m_flags |= M_PROTO1;
1185 	mflags = m->m_flags;
1186 	IFQ_ENQUEUE(&dst_ifp->if_snd, m, &pktattr, error);
1187 	if (error) {
1188 		/* mbuf is already freed */
1189 		sc->sc_if.if_oerrors++;
1190 		return;
1191 	}
1192 
1193 	sc->sc_if.if_opackets++;
1194 	sc->sc_if.if_obytes += len;
1195 
1196 	dst_ifp->if_obytes += len;
1197 
1198 	if (mflags & M_MCAST) {
1199 		sc->sc_if.if_omcasts++;
1200 		dst_ifp->if_omcasts++;
1201 	}
1202 
1203 	if ((dst_ifp->if_flags & IFF_OACTIVE) == 0)
1204 		(*dst_ifp->if_start)(dst_ifp);
1205 }
1206 
1207 /*
1208  * bridge_output:
1209  *
1210  *	Send output from a bridge member interface.  This
1211  *	performs the bridging function for locally originated
1212  *	packets.
1213  *
1214  *	The mbuf has the Ethernet header already attached.  We must
1215  *	enqueue or free the mbuf before returning.
1216  */
1217 int
1218 bridge_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *sa,
1219     struct rtentry *rt)
1220 {
1221 	struct ether_header *eh;
1222 	struct ifnet *dst_if;
1223 	struct bridge_softc *sc;
1224 	int s;
1225 
1226 	if (m->m_len < ETHER_HDR_LEN) {
1227 		m = m_pullup(m, ETHER_HDR_LEN);
1228 		if (m == NULL)
1229 			return (0);
1230 	}
1231 
1232 	eh = mtod(m, struct ether_header *);
1233 	sc = ifp->if_bridge;
1234 
1235 	s = splnet();
1236 
1237 	/*
1238 	 * If bridge is down, but the original output interface is up,
1239 	 * go ahead and send out that interface.  Otherwise, the packet
1240 	 * is dropped below.
1241 	 */
1242 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1243 		dst_if = ifp;
1244 		goto sendunicast;
1245 	}
1246 
1247 	/*
1248 	 * If the packet is a multicast, or we don't know a better way to
1249 	 * get there, send to all interfaces.
1250 	 */
1251 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1252 		dst_if = NULL;
1253 	else
1254 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1255 	if (dst_if == NULL) {
1256 		struct bridge_iflist *bif;
1257 		struct mbuf *mc;
1258 		int used = 0;
1259 
1260 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1261 			dst_if = bif->bif_ifp;
1262 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
1263 				continue;
1264 
1265 			/*
1266 			 * If this is not the original output interface,
1267 			 * and the interface is participating in spanning
1268 			 * tree, make sure the port is in a state that
1269 			 * allows forwarding.
1270 			 */
1271 			if (dst_if != ifp &&
1272 			    (bif->bif_flags & IFBIF_STP) != 0) {
1273 				switch (bif->bif_state) {
1274 				case BSTP_IFSTATE_BLOCKING:
1275 				case BSTP_IFSTATE_LISTENING:
1276 				case BSTP_IFSTATE_DISABLED:
1277 					continue;
1278 				}
1279 			}
1280 
1281 			if (LIST_NEXT(bif, bif_next) == NULL) {
1282 				used = 1;
1283 				mc = m;
1284 			} else {
1285 				mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);
1286 				if (mc == NULL) {
1287 					sc->sc_if.if_oerrors++;
1288 					continue;
1289 				}
1290 			}
1291 
1292 			bridge_enqueue(sc, dst_if, mc, 0);
1293 		}
1294 		if (used == 0)
1295 			m_freem(m);
1296 		splx(s);
1297 		return (0);
1298 	}
1299 
1300  sendunicast:
1301 	/*
1302 	 * XXX Spanning tree consideration here?
1303 	 */
1304 
1305 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1306 		m_freem(m);
1307 		splx(s);
1308 		return (0);
1309 	}
1310 
1311 	bridge_enqueue(sc, dst_if, m, 0);
1312 
1313 	splx(s);
1314 	return (0);
1315 }
1316 
1317 /*
1318  * bridge_start:
1319  *
1320  *	Start output on a bridge.
1321  *
1322  *	NOTE: This routine should never be called in this implementation.
1323  */
1324 static void
1325 bridge_start(struct ifnet *ifp)
1326 {
1327 
1328 	printf("%s: bridge_start() called\n", ifp->if_xname);
1329 }
1330 
1331 /*
1332  * bridge_forward:
1333  *
1334  *	The forwarding function of the bridge.
1335  */
1336 static void
1337 bridge_forward(void *v)
1338 {
1339 	struct bridge_softc *sc = v;
1340 	struct mbuf *m;
1341 	struct bridge_iflist *bif;
1342 	struct ifnet *src_if, *dst_if;
1343 	struct ether_header *eh;
1344 	int s;
1345 
1346 	mutex_enter(softnet_lock);
1347 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1348 		mutex_exit(softnet_lock);
1349 		return;
1350 	}
1351 
1352 	s = splnet();
1353 	while (1) {
1354 		IFQ_POLL(&sc->sc_if.if_snd, m);
1355 		if (m == NULL)
1356 			break;
1357 		IFQ_DEQUEUE(&sc->sc_if.if_snd, m);
1358 
1359 		src_if = m->m_pkthdr.rcvif;
1360 
1361 		sc->sc_if.if_ipackets++;
1362 		sc->sc_if.if_ibytes += m->m_pkthdr.len;
1363 
1364 		/*
1365 		 * Look up the bridge_iflist.
1366 		 */
1367 		bif = bridge_lookup_member_if(sc, src_if);
1368 		if (bif == NULL) {
1369 			/* Interface is not a bridge member (anymore?) */
1370 			m_freem(m);
1371 			continue;
1372 		}
1373 
1374 		if (bif->bif_flags & IFBIF_STP) {
1375 			switch (bif->bif_state) {
1376 			case BSTP_IFSTATE_BLOCKING:
1377 			case BSTP_IFSTATE_LISTENING:
1378 			case BSTP_IFSTATE_DISABLED:
1379 				m_freem(m);
1380 				continue;
1381 			}
1382 		}
1383 
1384 		eh = mtod(m, struct ether_header *);
1385 
1386 		/*
1387 		 * If the interface is learning, and the source
1388 		 * address is valid and not multicast, record
1389 		 * the address.
1390 		 */
1391 		if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1392 		    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1393 		    (eh->ether_shost[0] == 0 &&
1394 		     eh->ether_shost[1] == 0 &&
1395 		     eh->ether_shost[2] == 0 &&
1396 		     eh->ether_shost[3] == 0 &&
1397 		     eh->ether_shost[4] == 0 &&
1398 		     eh->ether_shost[5] == 0) == 0) {
1399 			(void) bridge_rtupdate(sc, eh->ether_shost,
1400 			    src_if, 0, IFBAF_DYNAMIC);
1401 		}
1402 
1403 		if ((bif->bif_flags & IFBIF_STP) != 0 &&
1404 		    bif->bif_state == BSTP_IFSTATE_LEARNING) {
1405 			m_freem(m);
1406 			continue;
1407 		}
1408 
1409 		/*
1410 		 * At this point, the port either doesn't participate
1411 		 * in spanning tree or it is in the forwarding state.
1412 		 */
1413 
1414 		/*
1415 		 * If the packet is unicast, destined for someone on
1416 		 * "this" side of the bridge, drop it.
1417 		 */
1418 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1419 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1420 			if (src_if == dst_if) {
1421 				m_freem(m);
1422 				continue;
1423 			}
1424 		} else {
1425 			/* ...forward it to all interfaces. */
1426 			sc->sc_if.if_imcasts++;
1427 			dst_if = NULL;
1428 		}
1429 
1430 #ifdef PFIL_HOOKS
1431 		if (pfil_run_hooks(&sc->sc_if.if_pfil, &m,
1432 		    m->m_pkthdr.rcvif, PFIL_IN) != 0) {
1433 			if (m != NULL)
1434 				m_freem(m);
1435 			continue;
1436 		}
1437 		if (m == NULL)
1438 			continue;
1439 #endif /* PFIL_HOOKS */
1440 
1441 		if (dst_if == NULL) {
1442 			bridge_broadcast(sc, src_if, m);
1443 			continue;
1444 		}
1445 
1446 		/*
1447 		 * At this point, we're dealing with a unicast frame
1448 		 * going to a different interface.
1449 		 */
1450 		if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1451 			m_freem(m);
1452 			continue;
1453 		}
1454 		bif = bridge_lookup_member_if(sc, dst_if);
1455 		if (bif == NULL) {
1456 			/* Not a member of the bridge (anymore?) */
1457 			m_freem(m);
1458 			continue;
1459 		}
1460 
1461 		if (bif->bif_flags & IFBIF_STP) {
1462 			switch (bif->bif_state) {
1463 			case BSTP_IFSTATE_DISABLED:
1464 			case BSTP_IFSTATE_BLOCKING:
1465 				m_freem(m);
1466 				continue;
1467 			}
1468 		}
1469 
1470 		bridge_enqueue(sc, dst_if, m, 1);
1471 	}
1472 	splx(s);
1473 	mutex_exit(softnet_lock);
1474 }
1475 
1476 /*
1477  * bridge_input:
1478  *
1479  *	Receive input from a member interface.  Queue the packet for
1480  *	bridging if it is not for us.
1481  *	should be called at splnet()
1482  */
1483 struct mbuf *
1484 bridge_input(struct ifnet *ifp, struct mbuf *m)
1485 {
1486 	struct bridge_softc *sc = ifp->if_bridge;
1487 	struct bridge_iflist *bif;
1488 	struct ether_header *eh;
1489 	struct mbuf *mc;
1490 
1491 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0)
1492 		return (m);
1493 
1494 	bif = bridge_lookup_member_if(sc, ifp);
1495 	if (bif == NULL)
1496 		return (m);
1497 
1498 	eh = mtod(m, struct ether_header *);
1499 
1500 	if (m->m_flags & (M_BCAST|M_MCAST)) {
1501 		if (bif->bif_flags & IFBIF_STP) {
1502 			/* Tap off 802.1D packets; they do not get forwarded. */
1503 			if (memcmp(eh->ether_dhost, bstp_etheraddr,
1504 			    ETHER_ADDR_LEN) == 0) {
1505 				m = bstp_input(sc, bif, m);
1506 				if (m == NULL)
1507 					return (NULL);
1508 			}
1509 
1510 			switch (bif->bif_state) {
1511 			case BSTP_IFSTATE_BLOCKING:
1512 			case BSTP_IFSTATE_LISTENING:
1513 			case BSTP_IFSTATE_DISABLED:
1514 				return (m);
1515 			}
1516 		}
1517 
1518 		/*
1519 		 * Make a deep copy of the packet and enqueue the copy
1520 		 * for bridge processing; return the original packet for
1521 		 * local processing.
1522 		 */
1523 		if (IF_QFULL(&sc->sc_if.if_snd)) {
1524 			IF_DROP(&sc->sc_if.if_snd);
1525 			return (m);
1526 		}
1527 		mc = m_dup(m, 0, M_COPYALL, M_NOWAIT);
1528 		if (mc == NULL)
1529 			return (m);
1530 
1531 		/* Perform the bridge forwarding function with the copy. */
1532 		IF_ENQUEUE(&sc->sc_if.if_snd, mc);
1533 		softint_schedule(sc->sc_softintr);
1534 
1535 		/* Return the original packet for local processing. */
1536 		return (m);
1537 	}
1538 
1539 	if (bif->bif_flags & IFBIF_STP) {
1540 		switch (bif->bif_state) {
1541 		case BSTP_IFSTATE_BLOCKING:
1542 		case BSTP_IFSTATE_LISTENING:
1543 		case BSTP_IFSTATE_DISABLED:
1544 			return (m);
1545 		}
1546 	}
1547 
1548 	/*
1549 	 * Unicast.  Make sure it's not for us.
1550 	 */
1551 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1552 		/* It is destined for us. */
1553 		if (memcmp(CLLADDR(bif->bif_ifp->if_sadl), eh->ether_dhost,
1554 		    ETHER_ADDR_LEN) == 0
1555 #if NCARP > 0
1556 		    || (bif->bif_ifp->if_carp && carp_ourether(bif->bif_ifp->if_carp,
1557 			eh, IFT_ETHER, 0) != NULL)
1558 #endif /* NCARP > 0 */
1559 		    ) {
1560 			if (bif->bif_flags & IFBIF_LEARNING)
1561 				(void) bridge_rtupdate(sc,
1562 				    eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1563 			m->m_pkthdr.rcvif = bif->bif_ifp;
1564 			return (m);
1565 		}
1566 
1567 		/* We just received a packet that we sent out. */
1568 		if (memcmp(CLLADDR(bif->bif_ifp->if_sadl), eh->ether_shost,
1569 		    ETHER_ADDR_LEN) == 0
1570 #if NCARP > 0
1571 		    || (bif->bif_ifp->if_carp && carp_ourether(bif->bif_ifp->if_carp,
1572 			eh, IFT_ETHER, 1) != NULL)
1573 #endif /* NCARP > 0 */
1574 		    ) {
1575 			m_freem(m);
1576 			return (NULL);
1577 		}
1578 	}
1579 
1580 	/* Perform the bridge forwarding function. */
1581 	if (IF_QFULL(&sc->sc_if.if_snd)) {
1582 		IF_DROP(&sc->sc_if.if_snd);
1583 		m_freem(m);
1584 		return (NULL);
1585 	}
1586 	IF_ENQUEUE(&sc->sc_if.if_snd, m);
1587 	softint_schedule(sc->sc_softintr);
1588 
1589 	return (NULL);
1590 }
1591 
1592 /*
1593  * bridge_broadcast:
1594  *
1595  *	Send a frame to all interfaces that are members of
1596  *	the bridge, except for the one on which the packet
1597  *	arrived.
1598  */
1599 static void
1600 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
1601     struct mbuf *m)
1602 {
1603 	struct bridge_iflist *bif;
1604 	struct mbuf *mc;
1605 	struct ifnet *dst_if;
1606 	int used = 0;
1607 
1608 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1609 		dst_if = bif->bif_ifp;
1610 		if (dst_if == src_if)
1611 			continue;
1612 
1613 		if (bif->bif_flags & IFBIF_STP) {
1614 			switch (bif->bif_state) {
1615 			case BSTP_IFSTATE_BLOCKING:
1616 			case BSTP_IFSTATE_DISABLED:
1617 				continue;
1618 			}
1619 		}
1620 
1621 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1622 		    (m->m_flags & (M_BCAST|M_MCAST)) == 0)
1623 			continue;
1624 
1625 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1626 			continue;
1627 
1628 		if (LIST_NEXT(bif, bif_next) == NULL) {
1629 			mc = m;
1630 			used = 1;
1631 		} else {
1632 			mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1633 			if (mc == NULL) {
1634 				sc->sc_if.if_oerrors++;
1635 				continue;
1636 			}
1637 		}
1638 
1639 		bridge_enqueue(sc, dst_if, mc, 1);
1640 	}
1641 	if (used == 0)
1642 		m_freem(m);
1643 }
1644 
1645 /*
1646  * bridge_rtupdate:
1647  *
1648  *	Add a bridge routing entry.
1649  */
1650 static int
1651 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
1652     struct ifnet *dst_if, int setflags, uint8_t flags)
1653 {
1654 	struct bridge_rtnode *brt;
1655 	int error, s;
1656 
1657 	/*
1658 	 * A route for this destination might already exist.  If so,
1659 	 * update it, otherwise create a new one.
1660 	 */
1661 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
1662 		if (sc->sc_brtcnt >= sc->sc_brtmax)
1663 			return (ENOSPC);
1664 
1665 		/*
1666 		 * Allocate a new bridge forwarding node, and
1667 		 * initialize the expiration time and Ethernet
1668 		 * address.
1669 		 */
1670 		s = splnet();
1671 		brt = pool_get(&bridge_rtnode_pool, PR_NOWAIT);
1672 		splx(s);
1673 		if (brt == NULL)
1674 			return (ENOMEM);
1675 
1676 		memset(brt, 0, sizeof(*brt));
1677 		brt->brt_expire = time_uptime + sc->sc_brttimeout;
1678 		brt->brt_flags = IFBAF_DYNAMIC;
1679 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
1680 
1681 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
1682 			s = splnet();
1683 			pool_put(&bridge_rtnode_pool, brt);
1684 			splx(s);
1685 			return (error);
1686 		}
1687 	}
1688 
1689 	brt->brt_ifp = dst_if;
1690 	if (setflags) {
1691 		brt->brt_flags = flags;
1692 		if (flags & IFBAF_STATIC)
1693 			brt->brt_expire = 0;
1694 		else
1695 			brt->brt_expire = time_uptime + sc->sc_brttimeout;
1696 	}
1697 
1698 	return (0);
1699 }
1700 
1701 /*
1702  * bridge_rtlookup:
1703  *
1704  *	Lookup the destination interface for an address.
1705  */
1706 static struct ifnet *
1707 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
1708 {
1709 	struct bridge_rtnode *brt;
1710 
1711 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
1712 		return (NULL);
1713 
1714 	return (brt->brt_ifp);
1715 }
1716 
1717 /*
1718  * bridge_rttrim:
1719  *
1720  *	Trim the routine table so that we have a number
1721  *	of routing entries less than or equal to the
1722  *	maximum number.
1723  */
1724 static void
1725 bridge_rttrim(struct bridge_softc *sc)
1726 {
1727 	struct bridge_rtnode *brt, *nbrt;
1728 
1729 	/* Make sure we actually need to do this. */
1730 	if (sc->sc_brtcnt <= sc->sc_brtmax)
1731 		return;
1732 
1733 	/* Force an aging cycle; this might trim enough addresses. */
1734 	bridge_rtage(sc);
1735 	if (sc->sc_brtcnt <= sc->sc_brtmax)
1736 		return;
1737 
1738 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1739 		nbrt = LIST_NEXT(brt, brt_list);
1740 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1741 			bridge_rtnode_destroy(sc, brt);
1742 			if (sc->sc_brtcnt <= sc->sc_brtmax)
1743 				return;
1744 		}
1745 	}
1746 }
1747 
1748 /*
1749  * bridge_timer:
1750  *
1751  *	Aging timer for the bridge.
1752  */
1753 static void
1754 bridge_timer(void *arg)
1755 {
1756 	struct bridge_softc *sc = arg;
1757 	int s;
1758 
1759 	s = splnet();
1760 	bridge_rtage(sc);
1761 	splx(s);
1762 
1763 	if (sc->sc_if.if_flags & IFF_RUNNING)
1764 		callout_reset(&sc->sc_brcallout,
1765 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
1766 }
1767 
1768 /*
1769  * bridge_rtage:
1770  *
1771  *	Perform an aging cycle.
1772  */
1773 static void
1774 bridge_rtage(struct bridge_softc *sc)
1775 {
1776 	struct bridge_rtnode *brt, *nbrt;
1777 
1778 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1779 		nbrt = LIST_NEXT(brt, brt_list);
1780 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1781 			if (time_uptime >= brt->brt_expire)
1782 				bridge_rtnode_destroy(sc, brt);
1783 		}
1784 	}
1785 }
1786 
1787 /*
1788  * bridge_rtflush:
1789  *
1790  *	Remove all dynamic addresses from the bridge.
1791  */
1792 static void
1793 bridge_rtflush(struct bridge_softc *sc, int full)
1794 {
1795 	struct bridge_rtnode *brt, *nbrt;
1796 
1797 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1798 		nbrt = LIST_NEXT(brt, brt_list);
1799 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
1800 			bridge_rtnode_destroy(sc, brt);
1801 	}
1802 }
1803 
1804 /*
1805  * bridge_rtdaddr:
1806  *
1807  *	Remove an address from the table.
1808  */
1809 static int
1810 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
1811 {
1812 	struct bridge_rtnode *brt;
1813 
1814 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL)
1815 		return (ENOENT);
1816 
1817 	bridge_rtnode_destroy(sc, brt);
1818 	return (0);
1819 }
1820 
1821 /*
1822  * bridge_rtdelete:
1823  *
1824  *	Delete routes to a speicifc member interface.
1825  */
1826 static void
1827 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp)
1828 {
1829 	struct bridge_rtnode *brt, *nbrt;
1830 
1831 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
1832 		nbrt = LIST_NEXT(brt, brt_list);
1833 		if (brt->brt_ifp == ifp)
1834 			bridge_rtnode_destroy(sc, brt);
1835 	}
1836 }
1837 
1838 /*
1839  * bridge_rtable_init:
1840  *
1841  *	Initialize the route table for this bridge.
1842  */
1843 static int
1844 bridge_rtable_init(struct bridge_softc *sc)
1845 {
1846 	int i;
1847 
1848 	sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
1849 	    M_DEVBUF, M_NOWAIT);
1850 	if (sc->sc_rthash == NULL)
1851 		return (ENOMEM);
1852 
1853 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
1854 		LIST_INIT(&sc->sc_rthash[i]);
1855 
1856 	sc->sc_rthash_key = cprng_fast32();
1857 
1858 	LIST_INIT(&sc->sc_rtlist);
1859 
1860 	return (0);
1861 }
1862 
1863 /*
1864  * bridge_rtable_fini:
1865  *
1866  *	Deconstruct the route table for this bridge.
1867  */
1868 static void
1869 bridge_rtable_fini(struct bridge_softc *sc)
1870 {
1871 
1872 	free(sc->sc_rthash, M_DEVBUF);
1873 }
1874 
1875 /*
1876  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
1877  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
1878  */
1879 #define	mix(a, b, c)							\
1880 do {									\
1881 	a -= b; a -= c; a ^= (c >> 13);					\
1882 	b -= c; b -= a; b ^= (a << 8);					\
1883 	c -= a; c -= b; c ^= (b >> 13);					\
1884 	a -= b; a -= c; a ^= (c >> 12);					\
1885 	b -= c; b -= a; b ^= (a << 16);					\
1886 	c -= a; c -= b; c ^= (b >> 5);					\
1887 	a -= b; a -= c; a ^= (c >> 3);					\
1888 	b -= c; b -= a; b ^= (a << 10);					\
1889 	c -= a; c -= b; c ^= (b >> 15);					\
1890 } while (/*CONSTCOND*/0)
1891 
1892 static inline uint32_t
1893 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
1894 {
1895 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
1896 
1897 	b += addr[5] << 8;
1898 	b += addr[4];
1899 	a += addr[3] << 24;
1900 	a += addr[2] << 16;
1901 	a += addr[1] << 8;
1902 	a += addr[0];
1903 
1904 	mix(a, b, c);
1905 
1906 	return (c & BRIDGE_RTHASH_MASK);
1907 }
1908 
1909 #undef mix
1910 
1911 /*
1912  * bridge_rtnode_lookup:
1913  *
1914  *	Look up a bridge route node for the specified destination.
1915  */
1916 static struct bridge_rtnode *
1917 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
1918 {
1919 	struct bridge_rtnode *brt;
1920 	uint32_t hash;
1921 	int dir;
1922 
1923 	hash = bridge_rthash(sc, addr);
1924 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
1925 		dir = memcmp(addr, brt->brt_addr, ETHER_ADDR_LEN);
1926 		if (dir == 0)
1927 			return (brt);
1928 		if (dir > 0)
1929 			return (NULL);
1930 	}
1931 
1932 	return (NULL);
1933 }
1934 
1935 /*
1936  * bridge_rtnode_insert:
1937  *
1938  *	Insert the specified bridge node into the route table.  We
1939  *	assume the entry is not already in the table.
1940  */
1941 static int
1942 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
1943 {
1944 	struct bridge_rtnode *lbrt;
1945 	uint32_t hash;
1946 	int dir;
1947 
1948 	hash = bridge_rthash(sc, brt->brt_addr);
1949 
1950 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
1951 	if (lbrt == NULL) {
1952 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
1953 		goto out;
1954 	}
1955 
1956 	do {
1957 		dir = memcmp(brt->brt_addr, lbrt->brt_addr, ETHER_ADDR_LEN);
1958 		if (dir == 0)
1959 			return (EEXIST);
1960 		if (dir > 0) {
1961 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
1962 			goto out;
1963 		}
1964 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
1965 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
1966 			goto out;
1967 		}
1968 		lbrt = LIST_NEXT(lbrt, brt_hash);
1969 	} while (lbrt != NULL);
1970 
1971 #ifdef DIAGNOSTIC
1972 	panic("bridge_rtnode_insert: impossible");
1973 #endif
1974 
1975  out:
1976 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
1977 	sc->sc_brtcnt++;
1978 
1979 	return (0);
1980 }
1981 
1982 /*
1983  * bridge_rtnode_destroy:
1984  *
1985  *	Destroy a bridge rtnode.
1986  */
1987 static void
1988 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
1989 {
1990 	int s = splnet();
1991 
1992 	LIST_REMOVE(brt, brt_hash);
1993 
1994 	LIST_REMOVE(brt, brt_list);
1995 	sc->sc_brtcnt--;
1996 	pool_put(&bridge_rtnode_pool, brt);
1997 
1998 	splx(s);
1999 }
2000 
2001 #if defined(BRIDGE_IPF) && defined(PFIL_HOOKS)
2002 extern struct pfil_head inet_pfil_hook;                 /* XXX */
2003 extern struct pfil_head inet6_pfil_hook;                /* XXX */
2004 
2005 /*
2006  * Send bridge packets through IPF if they are one of the types IPF can deal
2007  * with, or if they are ARP or REVARP.  (IPF will pass ARP and REVARP without
2008  * question.)
2009  */
2010 static int
2011 bridge_ipf(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
2012 {
2013 	int snap, error;
2014 	struct ether_header *eh1, eh2;
2015 	struct llc llc1;
2016 	uint16_t ether_type;
2017 
2018 	snap = 0;
2019 	error = -1;	/* Default error if not error == 0 */
2020 	eh1 = mtod(*mp, struct ether_header *);
2021 	ether_type = ntohs(eh1->ether_type);
2022 
2023 	/*
2024 	 * Check for SNAP/LLC.
2025 	 */
2026         if (ether_type < ETHERMTU) {
2027                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2028 
2029                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2030                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2031                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2032                     llc2->llc_control == LLC_UI) {
2033                 	ether_type = htons(llc2->llc_un.type_snap.ether_type);
2034 			snap = 1;
2035                 }
2036         }
2037 
2038 	/*
2039 	 * If we're trying to filter bridge traffic, don't look at anything
2040 	 * other than IP and ARP traffic.  If the filter doesn't understand
2041 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
2042 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
2043 	 * but of course we don't have an AppleTalk filter to begin with.
2044 	 * (Note that since IPF doesn't understand ARP it will pass *ALL*
2045 	 * ARP traffic.)
2046 	 */
2047 	switch (ether_type) {
2048 		case ETHERTYPE_ARP:
2049 		case ETHERTYPE_REVARP:
2050 			return 0; /* Automatically pass */
2051 		case ETHERTYPE_IP:
2052 # ifdef INET6
2053 		case ETHERTYPE_IPV6:
2054 # endif /* INET6 */
2055 			break;
2056 		default:
2057 			goto bad;
2058 	}
2059 
2060 	/* Strip off the Ethernet header and keep a copy. */
2061 	m_copydata(*mp, 0, ETHER_HDR_LEN, (void *) &eh2);
2062 	m_adj(*mp, ETHER_HDR_LEN);
2063 
2064 	/* Strip off snap header, if present */
2065 	if (snap) {
2066 		m_copydata(*mp, 0, sizeof(struct llc), (void *) &llc1);
2067 		m_adj(*mp, sizeof(struct llc));
2068 	}
2069 
2070 	/*
2071 	 * Check basic packet sanity and run IPF through pfil.
2072 	 */
2073 	KASSERT(!cpu_intr_p());
2074 	switch (ether_type)
2075 	{
2076 	case ETHERTYPE_IP :
2077 		error = (dir == PFIL_IN) ? bridge_ip_checkbasic(mp) : 0;
2078 		if (error == 0)
2079 			error = pfil_run_hooks(&inet_pfil_hook, mp, ifp, dir);
2080 		break;
2081 # ifdef INET6
2082 	case ETHERTYPE_IPV6 :
2083 		error = (dir == PFIL_IN) ? bridge_ip6_checkbasic(mp) : 0;
2084 		if (error == 0)
2085 			error = pfil_run_hooks(&inet6_pfil_hook, mp, ifp, dir);
2086 		break;
2087 # endif
2088 	default :
2089 		error = 0;
2090 		break;
2091 	}
2092 
2093 	if (*mp == NULL)
2094 		return error;
2095 	if (error != 0)
2096 		goto bad;
2097 
2098 	error = -1;
2099 
2100 	/*
2101 	 * Finally, put everything back the way it was and return
2102 	 */
2103 	if (snap) {
2104 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2105 		if (*mp == NULL)
2106 			return error;
2107 		bcopy(&llc1, mtod(*mp, void *), sizeof(struct llc));
2108 	}
2109 
2110 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2111 	if (*mp == NULL)
2112 		return error;
2113 	bcopy(&eh2, mtod(*mp, void *), ETHER_HDR_LEN);
2114 
2115 	return 0;
2116 
2117     bad:
2118 	m_freem(*mp);
2119 	*mp = NULL;
2120 	return error;
2121 }
2122 
2123 /*
2124  * Perform basic checks on header size since
2125  * IPF assumes ip_input has already processed
2126  * it for it.  Cut-and-pasted from ip_input.c.
2127  * Given how simple the IPv6 version is,
2128  * does the IPv4 version really need to be
2129  * this complicated?
2130  *
2131  * XXX Should we update ipstat here, or not?
2132  * XXX Right now we update ipstat but not
2133  * XXX csum_counter.
2134  */
2135 static int
2136 bridge_ip_checkbasic(struct mbuf **mp)
2137 {
2138 	struct mbuf *m = *mp;
2139 	struct ip *ip;
2140 	int len, hlen;
2141 
2142 	if (*mp == NULL)
2143 		return -1;
2144 
2145 	if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
2146 		if ((m = m_copyup(m, sizeof(struct ip),
2147 			(max_linkhdr + 3) & ~3)) == NULL) {
2148 			/* XXXJRT new stat, please */
2149 			ip_statinc(IP_STAT_TOOSMALL);
2150 			goto bad;
2151 		}
2152 	} else if (__predict_false(m->m_len < sizeof (struct ip))) {
2153 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2154 			ip_statinc(IP_STAT_TOOSMALL);
2155 			goto bad;
2156 		}
2157 	}
2158 	ip = mtod(m, struct ip *);
2159 	if (ip == NULL) goto bad;
2160 
2161 	if (ip->ip_v != IPVERSION) {
2162 		ip_statinc(IP_STAT_BADVERS);
2163 		goto bad;
2164 	}
2165 	hlen = ip->ip_hl << 2;
2166 	if (hlen < sizeof(struct ip)) { /* minimum header length */
2167 		ip_statinc(IP_STAT_BADHLEN);
2168 		goto bad;
2169 	}
2170 	if (hlen > m->m_len) {
2171 		if ((m = m_pullup(m, hlen)) == 0) {
2172 			ip_statinc(IP_STAT_BADHLEN);
2173 			goto bad;
2174 		}
2175 		ip = mtod(m, struct ip *);
2176 		if (ip == NULL) goto bad;
2177 	}
2178 
2179         switch (m->m_pkthdr.csum_flags &
2180                 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_IPv4) |
2181                  M_CSUM_IPv4_BAD)) {
2182         case M_CSUM_IPv4|M_CSUM_IPv4_BAD:
2183                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_bad); */
2184                 goto bad;
2185 
2186         case M_CSUM_IPv4:
2187                 /* Checksum was okay. */
2188                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_ok); */
2189                 break;
2190 
2191         default:
2192                 /* Must compute it ourselves. */
2193                 /* INET_CSUM_COUNTER_INCR(&ip_swcsum); */
2194                 if (in_cksum(m, hlen) != 0)
2195                         goto bad;
2196                 break;
2197         }
2198 
2199         /* Retrieve the packet length. */
2200         len = ntohs(ip->ip_len);
2201 
2202         /*
2203          * Check for additional length bogosity
2204          */
2205         if (len < hlen) {
2206 		ip_statinc(IP_STAT_BADLEN);
2207                 goto bad;
2208         }
2209 
2210         /*
2211          * Check that the amount of data in the buffers
2212          * is as at least much as the IP header would have us expect.
2213          * Drop packet if shorter than we expect.
2214          */
2215         if (m->m_pkthdr.len < len) {
2216 		ip_statinc(IP_STAT_TOOSHORT);
2217                 goto bad;
2218         }
2219 
2220 	/* Checks out, proceed */
2221 	*mp = m;
2222 	return 0;
2223 
2224     bad:
2225 	*mp = m;
2226 	return -1;
2227 }
2228 
2229 # ifdef INET6
2230 /*
2231  * Same as above, but for IPv6.
2232  * Cut-and-pasted from ip6_input.c.
2233  * XXX Should we update ip6stat, or not?
2234  */
2235 static int
2236 bridge_ip6_checkbasic(struct mbuf **mp)
2237 {
2238 	struct mbuf *m = *mp;
2239 	struct ip6_hdr *ip6;
2240 
2241         /*
2242          * If the IPv6 header is not aligned, slurp it up into a new
2243          * mbuf with space for link headers, in the event we forward
2244          * it.  Otherwise, if it is aligned, make sure the entire base
2245          * IPv6 header is in the first mbuf of the chain.
2246          */
2247         if (IP6_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
2248                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2249                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2250                                   (max_linkhdr + 3) & ~3)) == NULL) {
2251                         /* XXXJRT new stat, please */
2252 			ip6_statinc(IP6_STAT_TOOSMALL);
2253                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2254                         goto bad;
2255                 }
2256         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2257                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2258                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2259 			ip6_statinc(IP6_STAT_TOOSMALL);
2260                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2261                         goto bad;
2262                 }
2263         }
2264 
2265         ip6 = mtod(m, struct ip6_hdr *);
2266 
2267         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2268 		ip6_statinc(IP6_STAT_BADVERS);
2269                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2270                 goto bad;
2271         }
2272 
2273 	/* Checks out, proceed */
2274 	*mp = m;
2275 	return 0;
2276 
2277     bad:
2278 	*mp = m;
2279 	return -1;
2280 }
2281 # endif /* INET6 */
2282 #endif /* BRIDGE_IPF && PFIL_HOOKS */
2283