xref: /netbsd-src/sys/net/if_bridge.c (revision 80d9064ac03cbb6a4174695f0d5b237c8766d3d0)
1 /*	$NetBSD: if_bridge.c,v 1.91 2014/08/15 15:32:24 ozaki-r Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *	This product includes software developed for the NetBSD Project by
20  *	Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
40  * All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. All advertising materials mentioning features or use of this software
51  *    must display the following acknowledgement:
52  *	This product includes software developed by Jason L. Wright
53  * 4. The name of the author may not be used to endorse or promote products
54  *    derived from this software without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
57  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
58  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
59  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
60  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
61  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
62  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
64  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
65  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
66  * POSSIBILITY OF SUCH DAMAGE.
67  *
68  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
69  */
70 
71 /*
72  * Network interface bridge support.
73  *
74  * TODO:
75  *
76  *	- Currently only supports Ethernet-like interfaces (Ethernet,
77  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
78  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
79  *	  consider heterogenous bridges).
80  */
81 
82 #include <sys/cdefs.h>
83 __KERNEL_RCSID(0, "$NetBSD: if_bridge.c,v 1.91 2014/08/15 15:32:24 ozaki-r Exp $");
84 
85 #ifdef _KERNEL_OPT
86 #include "opt_bridge_ipf.h"
87 #include "opt_inet.h"
88 #endif /* _KERNEL_OPT */
89 
90 #include <sys/param.h>
91 #include <sys/kernel.h>
92 #include <sys/mbuf.h>
93 #include <sys/queue.h>
94 #include <sys/socket.h>
95 #include <sys/socketvar.h> /* for softnet_lock */
96 #include <sys/sockio.h>
97 #include <sys/systm.h>
98 #include <sys/proc.h>
99 #include <sys/pool.h>
100 #include <sys/kauth.h>
101 #include <sys/cpu.h>
102 #include <sys/cprng.h>
103 #include <sys/mutex.h>
104 
105 #include <net/bpf.h>
106 #include <net/if.h>
107 #include <net/if_dl.h>
108 #include <net/if_types.h>
109 #include <net/if_llc.h>
110 #include <net/pktqueue.h>
111 
112 #include <net/if_ether.h>
113 #include <net/if_bridgevar.h>
114 
115 #if defined(BRIDGE_IPF)
116 /* Used for bridge_ip[6]_checkbasic */
117 #include <netinet/in.h>
118 #include <netinet/in_systm.h>
119 #include <netinet/ip.h>
120 #include <netinet/ip_var.h>
121 #include <netinet/ip_private.h>		/* XXX */
122 
123 #include <netinet/ip6.h>
124 #include <netinet6/in6_var.h>
125 #include <netinet6/ip6_var.h>
126 #include <netinet6/ip6_private.h>	/* XXX */
127 #endif /* BRIDGE_IPF */
128 
129 /*
130  * Size of the route hash table.  Must be a power of two.
131  */
132 #ifndef BRIDGE_RTHASH_SIZE
133 #define	BRIDGE_RTHASH_SIZE		1024
134 #endif
135 
136 #define	BRIDGE_RTHASH_MASK		(BRIDGE_RTHASH_SIZE - 1)
137 
138 #include "carp.h"
139 #if NCARP > 0
140 #include <netinet/in.h>
141 #include <netinet/in_var.h>
142 #include <netinet/ip_carp.h>
143 #endif
144 
145 /*
146  * Maximum number of addresses to cache.
147  */
148 #ifndef BRIDGE_RTABLE_MAX
149 #define	BRIDGE_RTABLE_MAX		100
150 #endif
151 
152 /*
153  * Spanning tree defaults.
154  */
155 #define	BSTP_DEFAULT_MAX_AGE		(20 * 256)
156 #define	BSTP_DEFAULT_HELLO_TIME		(2 * 256)
157 #define	BSTP_DEFAULT_FORWARD_DELAY	(15 * 256)
158 #define	BSTP_DEFAULT_HOLD_TIME		(1 * 256)
159 #define	BSTP_DEFAULT_BRIDGE_PRIORITY	0x8000
160 #define	BSTP_DEFAULT_PORT_PRIORITY	0x80
161 #define	BSTP_DEFAULT_PATH_COST		55
162 
163 /*
164  * Timeout (in seconds) for entries learned dynamically.
165  */
166 #ifndef BRIDGE_RTABLE_TIMEOUT
167 #define	BRIDGE_RTABLE_TIMEOUT		(20 * 60)	/* same as ARP */
168 #endif
169 
170 /*
171  * Number of seconds between walks of the route list.
172  */
173 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
174 #define	BRIDGE_RTABLE_PRUNE_PERIOD	(5 * 60)
175 #endif
176 
177 int	bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
178 
179 static struct pool bridge_rtnode_pool;
180 
181 void	bridgeattach(int);
182 
183 static int	bridge_clone_create(struct if_clone *, int);
184 static int	bridge_clone_destroy(struct ifnet *);
185 
186 static int	bridge_ioctl(struct ifnet *, u_long, void *);
187 static int	bridge_init(struct ifnet *);
188 static void	bridge_stop(struct ifnet *, int);
189 static void	bridge_start(struct ifnet *);
190 
191 static void	bridge_input(struct ifnet *, struct mbuf *);
192 static void	bridge_forward(void *);
193 
194 static void	bridge_timer(void *);
195 
196 static void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
197 				 struct mbuf *);
198 
199 static int	bridge_rtupdate(struct bridge_softc *, const uint8_t *,
200 				struct ifnet *, int, uint8_t);
201 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t *);
202 static void	bridge_rttrim(struct bridge_softc *);
203 static void	bridge_rtage(struct bridge_softc *);
204 static void	bridge_rtflush(struct bridge_softc *, int);
205 static int	bridge_rtdaddr(struct bridge_softc *, const uint8_t *);
206 static void	bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp);
207 
208 static int	bridge_rtable_init(struct bridge_softc *);
209 static void	bridge_rtable_fini(struct bridge_softc *);
210 
211 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
212 						  const uint8_t *);
213 static int	bridge_rtnode_insert(struct bridge_softc *,
214 				     struct bridge_rtnode *);
215 static void	bridge_rtnode_destroy(struct bridge_softc *,
216 				      struct bridge_rtnode *);
217 
218 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
219 						  const char *name);
220 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
221 						     struct ifnet *ifp);
222 static void	bridge_release_member(struct bridge_softc *, struct bridge_iflist *);
223 static void	bridge_delete_member(struct bridge_softc *,
224 				     struct bridge_iflist *);
225 
226 static int	bridge_ioctl_add(struct bridge_softc *, void *);
227 static int	bridge_ioctl_del(struct bridge_softc *, void *);
228 static int	bridge_ioctl_gifflags(struct bridge_softc *, void *);
229 static int	bridge_ioctl_sifflags(struct bridge_softc *, void *);
230 static int	bridge_ioctl_scache(struct bridge_softc *, void *);
231 static int	bridge_ioctl_gcache(struct bridge_softc *, void *);
232 static int	bridge_ioctl_gifs(struct bridge_softc *, void *);
233 static int	bridge_ioctl_rts(struct bridge_softc *, void *);
234 static int	bridge_ioctl_saddr(struct bridge_softc *, void *);
235 static int	bridge_ioctl_sto(struct bridge_softc *, void *);
236 static int	bridge_ioctl_gto(struct bridge_softc *, void *);
237 static int	bridge_ioctl_daddr(struct bridge_softc *, void *);
238 static int	bridge_ioctl_flush(struct bridge_softc *, void *);
239 static int	bridge_ioctl_gpri(struct bridge_softc *, void *);
240 static int	bridge_ioctl_spri(struct bridge_softc *, void *);
241 static int	bridge_ioctl_ght(struct bridge_softc *, void *);
242 static int	bridge_ioctl_sht(struct bridge_softc *, void *);
243 static int	bridge_ioctl_gfd(struct bridge_softc *, void *);
244 static int	bridge_ioctl_sfd(struct bridge_softc *, void *);
245 static int	bridge_ioctl_gma(struct bridge_softc *, void *);
246 static int	bridge_ioctl_sma(struct bridge_softc *, void *);
247 static int	bridge_ioctl_sifprio(struct bridge_softc *, void *);
248 static int	bridge_ioctl_sifcost(struct bridge_softc *, void *);
249 #if defined(BRIDGE_IPF)
250 static int	bridge_ioctl_gfilt(struct bridge_softc *, void *);
251 static int	bridge_ioctl_sfilt(struct bridge_softc *, void *);
252 static int	bridge_ipf(void *, struct mbuf **, struct ifnet *, int);
253 static int	bridge_ip_checkbasic(struct mbuf **mp);
254 # ifdef INET6
255 static int	bridge_ip6_checkbasic(struct mbuf **mp);
256 # endif /* INET6 */
257 #endif /* BRIDGE_IPF */
258 
259 static void bridge_sysctl_fwdq_setup(struct sysctllog **clog,
260     struct bridge_softc *sc);
261 
262 struct bridge_control {
263 	int	(*bc_func)(struct bridge_softc *, void *);
264 	int	bc_argsize;
265 	int	bc_flags;
266 };
267 
268 #define	BC_F_COPYIN		0x01	/* copy arguments in */
269 #define	BC_F_COPYOUT		0x02	/* copy arguments out */
270 #define	BC_F_SUSER		0x04	/* do super-user check */
271 
272 static const struct bridge_control bridge_control_table[] = {
273 [BRDGADD] = {bridge_ioctl_add, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
274 [BRDGDEL] = {bridge_ioctl_del, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
275 
276 [BRDGGIFFLGS] = {bridge_ioctl_gifflags, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_COPYOUT},
277 [BRDGSIFFLGS] = {bridge_ioctl_sifflags, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
278 
279 [BRDGSCACHE] = {bridge_ioctl_scache, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
280 [BRDGGCACHE] = {bridge_ioctl_gcache, sizeof(struct ifbrparam), BC_F_COPYOUT},
281 
282 [BRDGGIFS] = {bridge_ioctl_gifs, sizeof(struct ifbifconf), BC_F_COPYIN|BC_F_COPYOUT},
283 [BRDGRTS] = {bridge_ioctl_rts, sizeof(struct ifbaconf), BC_F_COPYIN|BC_F_COPYOUT},
284 
285 [BRDGSADDR] = {bridge_ioctl_saddr, sizeof(struct ifbareq), BC_F_COPYIN|BC_F_SUSER},
286 
287 [BRDGSTO] = {bridge_ioctl_sto, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
288 [BRDGGTO] = {bridge_ioctl_gto, sizeof(struct ifbrparam), BC_F_COPYOUT},
289 
290 [BRDGDADDR] = {bridge_ioctl_daddr, sizeof(struct ifbareq), BC_F_COPYIN|BC_F_SUSER},
291 
292 [BRDGFLUSH] = {bridge_ioctl_flush, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
293 
294 [BRDGGPRI] = {bridge_ioctl_gpri, sizeof(struct ifbrparam), BC_F_COPYOUT},
295 [BRDGSPRI] = {bridge_ioctl_spri, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
296 
297 [BRDGGHT] = {bridge_ioctl_ght, sizeof(struct ifbrparam), BC_F_COPYOUT},
298 [BRDGSHT] = {bridge_ioctl_sht, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
299 
300 [BRDGGFD] = {bridge_ioctl_gfd, sizeof(struct ifbrparam), BC_F_COPYOUT},
301 [BRDGSFD] = {bridge_ioctl_sfd, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
302 
303 [BRDGGMA] = {bridge_ioctl_gma, sizeof(struct ifbrparam), BC_F_COPYOUT},
304 [BRDGSMA] = {bridge_ioctl_sma, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
305 
306 [BRDGSIFPRIO] = {bridge_ioctl_sifprio, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
307 
308 [BRDGSIFCOST] = {bridge_ioctl_sifcost, sizeof(struct ifbreq), BC_F_COPYIN|BC_F_SUSER},
309 #if defined(BRIDGE_IPF)
310 [BRDGGFILT] = {bridge_ioctl_gfilt, sizeof(struct ifbrparam), BC_F_COPYOUT},
311 [BRDGSFILT] = {bridge_ioctl_sfilt, sizeof(struct ifbrparam), BC_F_COPYIN|BC_F_SUSER},
312 #endif /* BRIDGE_IPF */
313 };
314 static const int bridge_control_table_size = __arraycount(bridge_control_table);
315 
316 static LIST_HEAD(, bridge_softc) bridge_list;
317 static kmutex_t bridge_list_lock;
318 
319 static struct if_clone bridge_cloner =
320     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
321 
322 /*
323  * bridgeattach:
324  *
325  *	Pseudo-device attach routine.
326  */
327 void
328 bridgeattach(int n)
329 {
330 
331 	pool_init(&bridge_rtnode_pool, sizeof(struct bridge_rtnode),
332 	    0, 0, 0, "brtpl", NULL, IPL_NET);
333 
334 	LIST_INIT(&bridge_list);
335 	mutex_init(&bridge_list_lock, MUTEX_DEFAULT, IPL_NET);
336 	if_clone_attach(&bridge_cloner);
337 }
338 
339 /*
340  * bridge_clone_create:
341  *
342  *	Create a new bridge instance.
343  */
344 static int
345 bridge_clone_create(struct if_clone *ifc, int unit)
346 {
347 	struct bridge_softc *sc;
348 	struct ifnet *ifp;
349 
350 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
351 	ifp = &sc->sc_if;
352 
353 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
354 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
355 	sc->sc_bridge_max_age = BSTP_DEFAULT_MAX_AGE;
356 	sc->sc_bridge_hello_time = BSTP_DEFAULT_HELLO_TIME;
357 	sc->sc_bridge_forward_delay = BSTP_DEFAULT_FORWARD_DELAY;
358 	sc->sc_bridge_priority = BSTP_DEFAULT_BRIDGE_PRIORITY;
359 	sc->sc_hold_time = BSTP_DEFAULT_HOLD_TIME;
360 	sc->sc_filter_flags = 0;
361 
362 	/* Initialize our routing table. */
363 	bridge_rtable_init(sc);
364 
365 	callout_init(&sc->sc_brcallout, 0);
366 	callout_init(&sc->sc_bstpcallout, 0);
367 
368 	LIST_INIT(&sc->sc_iflist);
369 #ifdef BRIDGE_MPSAFE
370 	sc->sc_iflist_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NET);
371 #else
372 	sc->sc_iflist_lock = NULL;
373 #endif
374 	cv_init(&sc->sc_iflist_cv, "if_bridge_cv");
375 
376 	if_initname(ifp, ifc->ifc_name, unit);
377 	ifp->if_softc = sc;
378 	ifp->if_mtu = ETHERMTU;
379 	ifp->if_ioctl = bridge_ioctl;
380 	ifp->if_output = bridge_output;
381 	ifp->if_start = bridge_start;
382 	ifp->if_stop = bridge_stop;
383 	ifp->if_init = bridge_init;
384 	ifp->if_type = IFT_BRIDGE;
385 	ifp->if_addrlen = 0;
386 	ifp->if_dlt = DLT_EN10MB;
387 	ifp->if_hdrlen = ETHER_HDR_LEN;
388 
389 	sc->sc_fwd_pktq = pktq_create(IFQ_MAXLEN, bridge_forward, sc);
390 	KASSERT(sc->sc_fwd_pktq != NULL);
391 
392 	bridge_sysctl_fwdq_setup(&ifp->if_sysctl_log, sc);
393 
394 	if_attach(ifp);
395 
396 	if_alloc_sadl(ifp);
397 
398 	mutex_enter(&bridge_list_lock);
399 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
400 	mutex_exit(&bridge_list_lock);
401 
402 	return (0);
403 }
404 
405 /*
406  * bridge_clone_destroy:
407  *
408  *	Destroy a bridge instance.
409  */
410 static int
411 bridge_clone_destroy(struct ifnet *ifp)
412 {
413 	struct bridge_softc *sc = ifp->if_softc;
414 	struct bridge_iflist *bif;
415 	int s;
416 
417 	/* Must be called during IFF_RUNNING, i.e., before bridge_stop */
418 	pktq_barrier(sc->sc_fwd_pktq);
419 
420 	s = splnet();
421 
422 	bridge_stop(ifp, 1);
423 
424 	BRIDGE_LOCK(sc);
425 	while ((bif = LIST_FIRST(&sc->sc_iflist)) != NULL)
426 		bridge_delete_member(sc, bif);
427 	BRIDGE_UNLOCK(sc);
428 
429 	mutex_enter(&bridge_list_lock);
430 	LIST_REMOVE(sc, sc_list);
431 	mutex_exit(&bridge_list_lock);
432 
433 	splx(s);
434 
435 	if_detach(ifp);
436 
437 	/* Should be called after if_detach for safe */
438 	pktq_flush(sc->sc_fwd_pktq);
439 	pktq_destroy(sc->sc_fwd_pktq);
440 
441 	/* Tear down the routing table. */
442 	bridge_rtable_fini(sc);
443 
444 	cv_destroy(&sc->sc_iflist_cv);
445 	if (sc->sc_iflist_lock)
446 		mutex_obj_free(sc->sc_iflist_lock);
447 
448 	free(sc, M_DEVBUF);
449 
450 	return (0);
451 }
452 
453 static int
454 bridge_sysctl_fwdq_maxlen(SYSCTLFN_ARGS)
455 {
456 	struct sysctlnode node = *rnode;
457 	const struct bridge_softc *sc =	node.sysctl_data;
458 	return sysctl_pktq_maxlen(SYSCTLFN_CALL(rnode), sc->sc_fwd_pktq);
459 }
460 
461 #define	SYSCTL_BRIDGE_PKTQ(cn, c)					\
462 	static int							\
463 	bridge_sysctl_fwdq_##cn(SYSCTLFN_ARGS)				\
464 	{								\
465 		struct sysctlnode node = *rnode;			\
466 		const struct bridge_softc *sc =	node.sysctl_data;	\
467 		return sysctl_pktq_count(SYSCTLFN_CALL(rnode),		\
468 					 sc->sc_fwd_pktq, c);		\
469 	}
470 
471 SYSCTL_BRIDGE_PKTQ(items, PKTQ_NITEMS)
472 SYSCTL_BRIDGE_PKTQ(drops, PKTQ_DROPS)
473 
474 static void
475 bridge_sysctl_fwdq_setup(struct sysctllog **clog, struct bridge_softc *sc)
476 {
477 	const struct sysctlnode *cnode, *rnode;
478 	sysctlfn len_func = NULL, maxlen_func = NULL, drops_func = NULL;
479 	const char *ifname = sc->sc_if.if_xname;
480 
481 	len_func = bridge_sysctl_fwdq_items;
482 	maxlen_func = bridge_sysctl_fwdq_maxlen;
483 	drops_func = bridge_sysctl_fwdq_drops;
484 
485 	if (sysctl_createv(clog, 0, NULL, &rnode,
486 			   CTLFLAG_PERMANENT,
487 			   CTLTYPE_NODE, "interfaces",
488 			   SYSCTL_DESCR("Per-interface controls"),
489 			   NULL, 0, NULL, 0,
490 			   CTL_NET, CTL_CREATE, CTL_EOL) != 0)
491 		goto bad;
492 
493 	if (sysctl_createv(clog, 0, &rnode, &rnode,
494 			   CTLFLAG_PERMANENT,
495 			   CTLTYPE_NODE, ifname,
496 			   SYSCTL_DESCR("Interface controls"),
497 			   NULL, 0, NULL, 0,
498 			   CTL_CREATE, CTL_EOL) != 0)
499 		goto bad;
500 
501 	if (sysctl_createv(clog, 0, &rnode, &rnode,
502 			   CTLFLAG_PERMANENT,
503 			   CTLTYPE_NODE, "fwdq",
504 			   SYSCTL_DESCR("Protocol input queue controls"),
505 			   NULL, 0, NULL, 0,
506 			   CTL_CREATE, CTL_EOL) != 0)
507 		goto bad;
508 
509 	if (sysctl_createv(clog, 0, &rnode, &cnode,
510 			   CTLFLAG_PERMANENT,
511 			   CTLTYPE_INT, "len",
512 			   SYSCTL_DESCR("Current forwarding queue length"),
513 			   len_func, 0, (void *)sc, 0,
514 			   CTL_CREATE, IFQCTL_LEN, CTL_EOL) != 0)
515 		goto bad;
516 
517 	if (sysctl_createv(clog, 0, &rnode, &cnode,
518 			   CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
519 			   CTLTYPE_INT, "maxlen",
520 			   SYSCTL_DESCR("Maximum allowed forwarding queue length"),
521 			   maxlen_func, 0, (void *)sc, 0,
522 			   CTL_CREATE, IFQCTL_MAXLEN, CTL_EOL) != 0)
523 		goto bad;
524 
525 	if (sysctl_createv(clog, 0, &rnode, &cnode,
526 			   CTLFLAG_PERMANENT,
527 			   CTLTYPE_INT, "drops",
528 			   SYSCTL_DESCR("Packets dropped due to full forwarding queue"),
529 			   drops_func, 0, (void *)sc, 0,
530 			   CTL_CREATE, IFQCTL_DROPS, CTL_EOL) != 0)
531 		goto bad;
532 
533 	return;
534 bad:
535 	aprint_error("%s: could not attach sysctl nodes\n", ifname);
536 	return;
537 }
538 
539 /*
540  * bridge_ioctl:
541  *
542  *	Handle a control request from the operator.
543  */
544 static int
545 bridge_ioctl(struct ifnet *ifp, u_long cmd, void *data)
546 {
547 	struct bridge_softc *sc = ifp->if_softc;
548 	struct lwp *l = curlwp;	/* XXX */
549 	union {
550 		struct ifbreq ifbreq;
551 		struct ifbifconf ifbifconf;
552 		struct ifbareq ifbareq;
553 		struct ifbaconf ifbaconf;
554 		struct ifbrparam ifbrparam;
555 	} args;
556 	struct ifdrv *ifd = (struct ifdrv *) data;
557 	const struct bridge_control *bc = NULL; /* XXXGCC */
558 	int s, error = 0;
559 
560 	/* Authorize command before calling splnet(). */
561 	switch (cmd) {
562 	case SIOCGDRVSPEC:
563 	case SIOCSDRVSPEC:
564 		if (ifd->ifd_cmd >= bridge_control_table_size) {
565 			error = EINVAL;
566 			return error;
567 		}
568 
569 		bc = &bridge_control_table[ifd->ifd_cmd];
570 
571 		/* We only care about BC_F_SUSER at this point. */
572 		if ((bc->bc_flags & BC_F_SUSER) == 0)
573 			break;
574 
575 		error = kauth_authorize_network(l->l_cred,
576 		    KAUTH_NETWORK_INTERFACE_BRIDGE,
577 		    cmd == SIOCGDRVSPEC ?
578 		     KAUTH_REQ_NETWORK_INTERFACE_BRIDGE_GETPRIV :
579 		     KAUTH_REQ_NETWORK_INTERFACE_BRIDGE_SETPRIV,
580 		     ifd, NULL, NULL);
581 		if (error)
582 			return (error);
583 
584 		break;
585 	}
586 
587 	s = splnet();
588 
589 	switch (cmd) {
590 	case SIOCGDRVSPEC:
591 	case SIOCSDRVSPEC:
592 		KASSERT(bc != NULL);
593 		if (cmd == SIOCGDRVSPEC &&
594 		    (bc->bc_flags & BC_F_COPYOUT) == 0) {
595 			error = EINVAL;
596 			break;
597 		}
598 		else if (cmd == SIOCSDRVSPEC &&
599 		    (bc->bc_flags & BC_F_COPYOUT) != 0) {
600 			error = EINVAL;
601 			break;
602 		}
603 
604 		/* BC_F_SUSER is checked above, before splnet(). */
605 
606 		if (ifd->ifd_len != bc->bc_argsize ||
607 		    ifd->ifd_len > sizeof(args)) {
608 			error = EINVAL;
609 			break;
610 		}
611 
612 		memset(&args, 0, sizeof(args));
613 		if (bc->bc_flags & BC_F_COPYIN) {
614 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
615 			if (error)
616 				break;
617 		}
618 
619 		error = (*bc->bc_func)(sc, &args);
620 		if (error)
621 			break;
622 
623 		if (bc->bc_flags & BC_F_COPYOUT)
624 			error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
625 
626 		break;
627 
628 	case SIOCSIFFLAGS:
629 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
630 			break;
631 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
632 		case IFF_RUNNING:
633 			/*
634 			 * If interface is marked down and it is running,
635 			 * then stop and disable it.
636 			 */
637 			(*ifp->if_stop)(ifp, 1);
638 			break;
639 		case IFF_UP:
640 			/*
641 			 * If interface is marked up and it is stopped, then
642 			 * start it.
643 			 */
644 			error = (*ifp->if_init)(ifp);
645 			break;
646 		default:
647 			break;
648 		}
649 		break;
650 
651 	case SIOCSIFMTU:
652 		if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
653 			error = 0;
654 		break;
655 
656 	default:
657 		error = ifioctl_common(ifp, cmd, data);
658 		break;
659 	}
660 
661 	splx(s);
662 
663 	return (error);
664 }
665 
666 /*
667  * bridge_lookup_member:
668  *
669  *	Lookup a bridge member interface.
670  */
671 static struct bridge_iflist *
672 bridge_lookup_member(struct bridge_softc *sc, const char *name)
673 {
674 	struct bridge_iflist *bif;
675 	struct ifnet *ifp;
676 
677 	BRIDGE_LOCK(sc);
678 
679 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
680 		ifp = bif->bif_ifp;
681 		if (strcmp(ifp->if_xname, name) == 0)
682 			break;
683 	}
684 
685 #ifdef BRIDGE_MPSAFE
686 	if (bif != NULL) {
687 		if (bif->bif_waiting)
688 			bif = NULL;
689 		else
690 			atomic_inc_32(&bif->bif_refs);
691 	}
692 #endif
693 
694 	BRIDGE_UNLOCK(sc);
695 
696 	return bif;
697 }
698 
699 /*
700  * bridge_lookup_member_if:
701  *
702  *	Lookup a bridge member interface by ifnet*.
703  */
704 static struct bridge_iflist *
705 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
706 {
707 	struct bridge_iflist *bif;
708 
709 	BRIDGE_LOCK(sc);
710 
711 	bif = member_ifp->if_bridgeif;
712 
713 #ifdef BRIDGE_MPSAFE
714 	if (bif != NULL) {
715 		if (bif->bif_waiting)
716 			bif = NULL;
717 		else
718 			atomic_inc_32(&bif->bif_refs);
719 	}
720 #endif
721 
722 	BRIDGE_UNLOCK(sc);
723 
724 	return bif;
725 }
726 
727 /*
728  * bridge_release_member:
729  *
730  *	Release the specified member interface.
731  */
732 static void
733 bridge_release_member(struct bridge_softc *sc, struct bridge_iflist *bif)
734 {
735 #ifdef BRIDGE_MPSAFE
736 	atomic_dec_32(&bif->bif_refs);
737 	membar_sync();
738 	if (__predict_false(bif->bif_waiting && bif->bif_refs == 0)) {
739 		BRIDGE_LOCK(sc);
740 		cv_broadcast(&sc->sc_iflist_cv);
741 		BRIDGE_UNLOCK(sc);
742 	}
743 #else
744 	(void)sc;
745 	(void)bif;
746 #endif
747 }
748 
749 /*
750  * bridge_delete_member:
751  *
752  *	Delete the specified member interface.
753  */
754 static void
755 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif)
756 {
757 	struct ifnet *ifs = bif->bif_ifp;
758 
759 	KASSERT(BRIDGE_LOCKED(sc));
760 
761 	ifs->if_input = ether_input;
762 	ifs->if_bridge = NULL;
763 	ifs->if_bridgeif = NULL;
764 
765 	LIST_REMOVE(bif, bif_next);
766 
767 #ifdef BRIDGE_MPSAFE
768 	bif->bif_waiting = true;
769 	membar_sync();
770 	while (bif->bif_refs > 0) {
771 		aprint_debug("%s: cv_wait on iflist\n", __func__);
772 		cv_wait(&sc->sc_iflist_cv, sc->sc_iflist_lock);
773 	}
774 #endif
775 
776 	free(bif, M_DEVBUF);
777 }
778 
779 static int
780 bridge_ioctl_add(struct bridge_softc *sc, void *arg)
781 {
782 	struct ifbreq *req = arg;
783 	struct bridge_iflist *bif = NULL;
784 	struct ifnet *ifs;
785 	int error = 0;
786 
787 	ifs = ifunit(req->ifbr_ifsname);
788 	if (ifs == NULL)
789 		return (ENOENT);
790 
791 	if (sc->sc_if.if_mtu != ifs->if_mtu)
792 		return (EINVAL);
793 
794 	if (ifs->if_bridge == sc)
795 		return (EEXIST);
796 
797 	if (ifs->if_bridge != NULL)
798 		return (EBUSY);
799 
800 	if (ifs->if_input != ether_input)
801 		return EINVAL;
802 
803 	/* FIXME: doesn't work with non-IFF_SIMPLEX interfaces */
804 	if ((ifs->if_flags & IFF_SIMPLEX) == 0)
805 		return EINVAL;
806 
807 	bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT);
808 	if (bif == NULL)
809 		return (ENOMEM);
810 
811 	switch (ifs->if_type) {
812 	case IFT_ETHER:
813 		/*
814 		 * Place the interface into promiscuous mode.
815 		 */
816 		error = ifpromisc(ifs, 1);
817 		if (error)
818 			goto out;
819 		break;
820 	default:
821 		error = EINVAL;
822 		goto out;
823 	}
824 
825 	bif->bif_ifp = ifs;
826 	bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
827 	bif->bif_priority = BSTP_DEFAULT_PORT_PRIORITY;
828 	bif->bif_path_cost = BSTP_DEFAULT_PATH_COST;
829 	bif->bif_refs = 0;
830 	bif->bif_waiting = false;
831 
832 	BRIDGE_LOCK(sc);
833 
834 	ifs->if_bridge = sc;
835 	ifs->if_bridgeif = bif;
836 	LIST_INSERT_HEAD(&sc->sc_iflist, bif, bif_next);
837 	ifs->if_input = bridge_input;
838 
839 	BRIDGE_UNLOCK(sc);
840 
841 	if (sc->sc_if.if_flags & IFF_RUNNING)
842 		bstp_initialization(sc);
843 	else
844 		bstp_stop(sc);
845 
846  out:
847 	if (error) {
848 		if (bif != NULL)
849 			free(bif, M_DEVBUF);
850 	}
851 	return (error);
852 }
853 
854 static int
855 bridge_ioctl_del(struct bridge_softc *sc, void *arg)
856 {
857 	struct ifbreq *req = arg;
858 	const char *name = req->ifbr_ifsname;
859 	struct bridge_iflist *bif;
860 	struct ifnet *ifs;
861 
862 	BRIDGE_LOCK(sc);
863 
864 	/*
865 	 * Don't use bridge_lookup_member. We want to get a member
866 	 * with bif_refs == 0.
867 	 */
868 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
869 		ifs = bif->bif_ifp;
870 		if (strcmp(ifs->if_xname, name) == 0)
871 			break;
872 	}
873 
874 	if (bif == NULL) {
875 		BRIDGE_UNLOCK(sc);
876 		return ENOENT;
877 	}
878 
879 	bridge_delete_member(sc, bif);
880 
881 	BRIDGE_UNLOCK(sc);
882 
883 	switch (ifs->if_type) {
884 	case IFT_ETHER:
885 		/*
886 		 * Take the interface out of promiscuous mode.
887 		 * Don't call it with holding sc_iflist_lock.
888 		 */
889 		(void) ifpromisc(ifs, 0);
890 		break;
891 	default:
892 #ifdef DIAGNOSTIC
893 		panic("bridge_delete_member: impossible");
894 #endif
895 		break;
896 	}
897 
898 	bridge_rtdelete(sc, ifs);
899 
900 	if (sc->sc_if.if_flags & IFF_RUNNING)
901 		bstp_initialization(sc);
902 
903 	return 0;
904 }
905 
906 static int
907 bridge_ioctl_gifflags(struct bridge_softc *sc, void *arg)
908 {
909 	struct ifbreq *req = arg;
910 	struct bridge_iflist *bif;
911 
912 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
913 	if (bif == NULL)
914 		return (ENOENT);
915 
916 	req->ifbr_ifsflags = bif->bif_flags;
917 	req->ifbr_state = bif->bif_state;
918 	req->ifbr_priority = bif->bif_priority;
919 	req->ifbr_path_cost = bif->bif_path_cost;
920 	req->ifbr_portno = bif->bif_ifp->if_index & 0xff;
921 
922 	bridge_release_member(sc, bif);
923 
924 	return (0);
925 }
926 
927 static int
928 bridge_ioctl_sifflags(struct bridge_softc *sc, void *arg)
929 {
930 	struct ifbreq *req = arg;
931 	struct bridge_iflist *bif;
932 
933 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
934 	if (bif == NULL)
935 		return (ENOENT);
936 
937 	if (req->ifbr_ifsflags & IFBIF_STP) {
938 		switch (bif->bif_ifp->if_type) {
939 		case IFT_ETHER:
940 			/* These can do spanning tree. */
941 			break;
942 
943 		default:
944 			/* Nothing else can. */
945 			bridge_release_member(sc, bif);
946 			return (EINVAL);
947 		}
948 	}
949 
950 	bif->bif_flags = req->ifbr_ifsflags;
951 
952 	bridge_release_member(sc, bif);
953 
954 	if (sc->sc_if.if_flags & IFF_RUNNING)
955 		bstp_initialization(sc);
956 
957 	return (0);
958 }
959 
960 static int
961 bridge_ioctl_scache(struct bridge_softc *sc, void *arg)
962 {
963 	struct ifbrparam *param = arg;
964 
965 	sc->sc_brtmax = param->ifbrp_csize;
966 	bridge_rttrim(sc);
967 
968 	return (0);
969 }
970 
971 static int
972 bridge_ioctl_gcache(struct bridge_softc *sc, void *arg)
973 {
974 	struct ifbrparam *param = arg;
975 
976 	param->ifbrp_csize = sc->sc_brtmax;
977 
978 	return (0);
979 }
980 
981 static int
982 bridge_ioctl_gifs(struct bridge_softc *sc, void *arg)
983 {
984 	struct ifbifconf *bifc = arg;
985 	struct bridge_iflist *bif;
986 	struct ifbreq *breqs;
987 	int i, count, error = 0;
988 
989 	BRIDGE_LOCK(sc);
990 
991 	count = 0;
992 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next)
993 		count++;
994 
995 	if (bifc->ifbic_len == 0 || bifc->ifbic_len < (sizeof(*breqs) * count)) {
996 		BRIDGE_UNLOCK(sc);
997 		/* Tell that a larger buffer is needed */
998 		bifc->ifbic_len = sizeof(*breqs) * count;
999 		return 0;
1000 	}
1001 
1002 	breqs = malloc(sizeof(*breqs) * count, M_DEVBUF, M_NOWAIT);
1003 
1004 	i = 0;
1005 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1006 		struct ifbreq *breq = &breqs[i++];
1007 		memset(breq, 0, sizeof(*breq));
1008 
1009 		strlcpy(breq->ifbr_ifsname, bif->bif_ifp->if_xname,
1010 		    sizeof(breq->ifbr_ifsname));
1011 		breq->ifbr_ifsflags = bif->bif_flags;
1012 		breq->ifbr_state = bif->bif_state;
1013 		breq->ifbr_priority = bif->bif_priority;
1014 		breq->ifbr_path_cost = bif->bif_path_cost;
1015 		breq->ifbr_portno = bif->bif_ifp->if_index & 0xff;
1016 	}
1017 
1018 	/* Don't call copyout with holding the mutex */
1019 	BRIDGE_UNLOCK(sc);
1020 
1021 	for (i = 0; i < count; i++) {
1022 		error = copyout(&breqs[i], bifc->ifbic_req + i, sizeof(*breqs));
1023 		if (error)
1024 			break;
1025 	}
1026 	bifc->ifbic_len = sizeof(*breqs) * i;
1027 
1028 	free(breqs, M_DEVBUF);
1029 
1030 	return error;
1031 }
1032 
1033 static int
1034 bridge_ioctl_rts(struct bridge_softc *sc, void *arg)
1035 {
1036 	struct ifbaconf *bac = arg;
1037 	struct bridge_rtnode *brt;
1038 	struct ifbareq bareq;
1039 	int count = 0, error = 0, len;
1040 
1041 	if (bac->ifbac_len == 0)
1042 		return (0);
1043 
1044 	mutex_enter(sc->sc_rtlist_lock);
1045 
1046 	len = bac->ifbac_len;
1047 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
1048 		if (len < sizeof(bareq))
1049 			goto out;
1050 		memset(&bareq, 0, sizeof(bareq));
1051 		strlcpy(bareq.ifba_ifsname, brt->brt_ifp->if_xname,
1052 		    sizeof(bareq.ifba_ifsname));
1053 		memcpy(bareq.ifba_dst, brt->brt_addr, sizeof(brt->brt_addr));
1054 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1055 			bareq.ifba_expire = brt->brt_expire - time_uptime;
1056 		} else
1057 			bareq.ifba_expire = 0;
1058 		bareq.ifba_flags = brt->brt_flags;
1059 
1060 		error = copyout(&bareq, bac->ifbac_req + count, sizeof(bareq));
1061 		if (error)
1062 			goto out;
1063 		count++;
1064 		len -= sizeof(bareq);
1065 	}
1066  out:
1067 	mutex_exit(sc->sc_rtlist_lock);
1068 
1069 	bac->ifbac_len = sizeof(bareq) * count;
1070 	return (error);
1071 }
1072 
1073 static int
1074 bridge_ioctl_saddr(struct bridge_softc *sc, void *arg)
1075 {
1076 	struct ifbareq *req = arg;
1077 	struct bridge_iflist *bif;
1078 	int error;
1079 
1080 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
1081 	if (bif == NULL)
1082 		return (ENOENT);
1083 
1084 	error = bridge_rtupdate(sc, req->ifba_dst, bif->bif_ifp, 1,
1085 	    req->ifba_flags);
1086 
1087 	bridge_release_member(sc, bif);
1088 
1089 	return (error);
1090 }
1091 
1092 static int
1093 bridge_ioctl_sto(struct bridge_softc *sc, void *arg)
1094 {
1095 	struct ifbrparam *param = arg;
1096 
1097 	sc->sc_brttimeout = param->ifbrp_ctime;
1098 
1099 	return (0);
1100 }
1101 
1102 static int
1103 bridge_ioctl_gto(struct bridge_softc *sc, void *arg)
1104 {
1105 	struct ifbrparam *param = arg;
1106 
1107 	param->ifbrp_ctime = sc->sc_brttimeout;
1108 
1109 	return (0);
1110 }
1111 
1112 static int
1113 bridge_ioctl_daddr(struct bridge_softc *sc, void *arg)
1114 {
1115 	struct ifbareq *req = arg;
1116 
1117 	return (bridge_rtdaddr(sc, req->ifba_dst));
1118 }
1119 
1120 static int
1121 bridge_ioctl_flush(struct bridge_softc *sc, void *arg)
1122 {
1123 	struct ifbreq *req = arg;
1124 
1125 	bridge_rtflush(sc, req->ifbr_ifsflags);
1126 
1127 	return (0);
1128 }
1129 
1130 static int
1131 bridge_ioctl_gpri(struct bridge_softc *sc, void *arg)
1132 {
1133 	struct ifbrparam *param = arg;
1134 
1135 	param->ifbrp_prio = sc->sc_bridge_priority;
1136 
1137 	return (0);
1138 }
1139 
1140 static int
1141 bridge_ioctl_spri(struct bridge_softc *sc, void *arg)
1142 {
1143 	struct ifbrparam *param = arg;
1144 
1145 	sc->sc_bridge_priority = param->ifbrp_prio;
1146 
1147 	if (sc->sc_if.if_flags & IFF_RUNNING)
1148 		bstp_initialization(sc);
1149 
1150 	return (0);
1151 }
1152 
1153 static int
1154 bridge_ioctl_ght(struct bridge_softc *sc, void *arg)
1155 {
1156 	struct ifbrparam *param = arg;
1157 
1158 	param->ifbrp_hellotime = sc->sc_bridge_hello_time >> 8;
1159 
1160 	return (0);
1161 }
1162 
1163 static int
1164 bridge_ioctl_sht(struct bridge_softc *sc, void *arg)
1165 {
1166 	struct ifbrparam *param = arg;
1167 
1168 	if (param->ifbrp_hellotime == 0)
1169 		return (EINVAL);
1170 	sc->sc_bridge_hello_time = param->ifbrp_hellotime << 8;
1171 
1172 	if (sc->sc_if.if_flags & IFF_RUNNING)
1173 		bstp_initialization(sc);
1174 
1175 	return (0);
1176 }
1177 
1178 static int
1179 bridge_ioctl_gfd(struct bridge_softc *sc, void *arg)
1180 {
1181 	struct ifbrparam *param = arg;
1182 
1183 	param->ifbrp_fwddelay = sc->sc_bridge_forward_delay >> 8;
1184 
1185 	return (0);
1186 }
1187 
1188 static int
1189 bridge_ioctl_sfd(struct bridge_softc *sc, void *arg)
1190 {
1191 	struct ifbrparam *param = arg;
1192 
1193 	if (param->ifbrp_fwddelay == 0)
1194 		return (EINVAL);
1195 	sc->sc_bridge_forward_delay = param->ifbrp_fwddelay << 8;
1196 
1197 	if (sc->sc_if.if_flags & IFF_RUNNING)
1198 		bstp_initialization(sc);
1199 
1200 	return (0);
1201 }
1202 
1203 static int
1204 bridge_ioctl_gma(struct bridge_softc *sc, void *arg)
1205 {
1206 	struct ifbrparam *param = arg;
1207 
1208 	param->ifbrp_maxage = sc->sc_bridge_max_age >> 8;
1209 
1210 	return (0);
1211 }
1212 
1213 static int
1214 bridge_ioctl_sma(struct bridge_softc *sc, void *arg)
1215 {
1216 	struct ifbrparam *param = arg;
1217 
1218 	if (param->ifbrp_maxage == 0)
1219 		return (EINVAL);
1220 	sc->sc_bridge_max_age = param->ifbrp_maxage << 8;
1221 
1222 	if (sc->sc_if.if_flags & IFF_RUNNING)
1223 		bstp_initialization(sc);
1224 
1225 	return (0);
1226 }
1227 
1228 static int
1229 bridge_ioctl_sifprio(struct bridge_softc *sc, void *arg)
1230 {
1231 	struct ifbreq *req = arg;
1232 	struct bridge_iflist *bif;
1233 
1234 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1235 	if (bif == NULL)
1236 		return (ENOENT);
1237 
1238 	bif->bif_priority = req->ifbr_priority;
1239 
1240 	if (sc->sc_if.if_flags & IFF_RUNNING)
1241 		bstp_initialization(sc);
1242 
1243 	bridge_release_member(sc, bif);
1244 
1245 	return (0);
1246 }
1247 
1248 #if defined(BRIDGE_IPF)
1249 static int
1250 bridge_ioctl_gfilt(struct bridge_softc *sc, void *arg)
1251 {
1252 	struct ifbrparam *param = arg;
1253 
1254 	param->ifbrp_filter = sc->sc_filter_flags;
1255 
1256 	return (0);
1257 }
1258 
1259 static int
1260 bridge_ioctl_sfilt(struct bridge_softc *sc, void *arg)
1261 {
1262 	struct ifbrparam *param = arg;
1263 	uint32_t nflags, oflags;
1264 
1265 	if (param->ifbrp_filter & ~IFBF_FILT_MASK)
1266 		return (EINVAL);
1267 
1268 	nflags = param->ifbrp_filter;
1269 	oflags = sc->sc_filter_flags;
1270 
1271 	if ((nflags & IFBF_FILT_USEIPF) && !(oflags & IFBF_FILT_USEIPF)) {
1272 		pfil_add_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1273 			sc->sc_if.if_pfil);
1274 	}
1275 	if (!(nflags & IFBF_FILT_USEIPF) && (oflags & IFBF_FILT_USEIPF)) {
1276 		pfil_remove_hook((void *)bridge_ipf, NULL, PFIL_IN|PFIL_OUT,
1277 			sc->sc_if.if_pfil);
1278 	}
1279 
1280 	sc->sc_filter_flags = nflags;
1281 
1282 	return (0);
1283 }
1284 #endif /* BRIDGE_IPF */
1285 
1286 static int
1287 bridge_ioctl_sifcost(struct bridge_softc *sc, void *arg)
1288 {
1289 	struct ifbreq *req = arg;
1290 	struct bridge_iflist *bif;
1291 
1292 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
1293 	if (bif == NULL)
1294 		return (ENOENT);
1295 
1296 	bif->bif_path_cost = req->ifbr_path_cost;
1297 
1298 	if (sc->sc_if.if_flags & IFF_RUNNING)
1299 		bstp_initialization(sc);
1300 
1301 	bridge_release_member(sc, bif);
1302 
1303 	return (0);
1304 }
1305 
1306 /*
1307  * bridge_ifdetach:
1308  *
1309  *	Detach an interface from a bridge.  Called when a member
1310  *	interface is detaching.
1311  */
1312 void
1313 bridge_ifdetach(struct ifnet *ifp)
1314 {
1315 	struct bridge_softc *sc = ifp->if_bridge;
1316 	struct ifbreq breq;
1317 
1318 	/* ioctl_lock should prevent this from happening */
1319 	KASSERT(sc != NULL);
1320 
1321 	memset(&breq, 0, sizeof(breq));
1322 	strlcpy(breq.ifbr_ifsname, ifp->if_xname, sizeof(breq.ifbr_ifsname));
1323 
1324 	(void) bridge_ioctl_del(sc, &breq);
1325 }
1326 
1327 /*
1328  * bridge_init:
1329  *
1330  *	Initialize a bridge interface.
1331  */
1332 static int
1333 bridge_init(struct ifnet *ifp)
1334 {
1335 	struct bridge_softc *sc = ifp->if_softc;
1336 
1337 	if (ifp->if_flags & IFF_RUNNING)
1338 		return (0);
1339 
1340 	callout_reset(&sc->sc_brcallout, bridge_rtable_prune_period * hz,
1341 	    bridge_timer, sc);
1342 
1343 	ifp->if_flags |= IFF_RUNNING;
1344 	bstp_initialization(sc);
1345 	return (0);
1346 }
1347 
1348 /*
1349  * bridge_stop:
1350  *
1351  *	Stop the bridge interface.
1352  */
1353 static void
1354 bridge_stop(struct ifnet *ifp, int disable)
1355 {
1356 	struct bridge_softc *sc = ifp->if_softc;
1357 
1358 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1359 		return;
1360 
1361 	callout_stop(&sc->sc_brcallout);
1362 	bstp_stop(sc);
1363 
1364 	bridge_rtflush(sc, IFBF_FLUSHDYN);
1365 
1366 	ifp->if_flags &= ~IFF_RUNNING;
1367 }
1368 
1369 /*
1370  * bridge_enqueue:
1371  *
1372  *	Enqueue a packet on a bridge member interface.
1373  */
1374 void
1375 bridge_enqueue(struct bridge_softc *sc, struct ifnet *dst_ifp, struct mbuf *m,
1376     int runfilt)
1377 {
1378 	ALTQ_DECL(struct altq_pktattr pktattr;)
1379 	int len, error;
1380 	short mflags;
1381 
1382 	/*
1383 	 * Clear any in-bound checksum flags for this packet.
1384 	 */
1385 	m->m_pkthdr.csum_flags = 0;
1386 
1387 	if (runfilt) {
1388 		if (pfil_run_hooks(sc->sc_if.if_pfil, &m,
1389 		    dst_ifp, PFIL_OUT) != 0) {
1390 			if (m != NULL)
1391 				m_freem(m);
1392 			return;
1393 		}
1394 		if (m == NULL)
1395 			return;
1396 	}
1397 
1398 #ifdef ALTQ
1399 	/*
1400 	 * If ALTQ is enabled on the member interface, do
1401 	 * classification; the queueing discipline might
1402 	 * not require classification, but might require
1403 	 * the address family/header pointer in the pktattr.
1404 	 */
1405 	if (ALTQ_IS_ENABLED(&dst_ifp->if_snd)) {
1406 		/* XXX IFT_ETHER */
1407 		altq_etherclassify(&dst_ifp->if_snd, m, &pktattr);
1408 	}
1409 #endif /* ALTQ */
1410 
1411 	len = m->m_pkthdr.len;
1412 	m->m_flags |= M_PROTO1;
1413 	mflags = m->m_flags;
1414 
1415 	IFQ_ENQUEUE(&dst_ifp->if_snd, m, &pktattr, error);
1416 
1417 	if (error) {
1418 		/* mbuf is already freed */
1419 		sc->sc_if.if_oerrors++;
1420 		return;
1421 	}
1422 
1423 	sc->sc_if.if_opackets++;
1424 	sc->sc_if.if_obytes += len;
1425 
1426 	dst_ifp->if_obytes += len;
1427 
1428 	if (mflags & M_MCAST) {
1429 		sc->sc_if.if_omcasts++;
1430 		dst_ifp->if_omcasts++;
1431 	}
1432 
1433 	if ((dst_ifp->if_flags & IFF_OACTIVE) == 0)
1434 		(*dst_ifp->if_start)(dst_ifp);
1435 }
1436 
1437 /*
1438  * bridge_output:
1439  *
1440  *	Send output from a bridge member interface.  This
1441  *	performs the bridging function for locally originated
1442  *	packets.
1443  *
1444  *	The mbuf has the Ethernet header already attached.  We must
1445  *	enqueue or free the mbuf before returning.
1446  */
1447 int
1448 bridge_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *sa,
1449     struct rtentry *rt)
1450 {
1451 	struct ether_header *eh;
1452 	struct ifnet *dst_if;
1453 	struct bridge_softc *sc;
1454 #ifndef BRIDGE_MPSAFE
1455 	int s;
1456 #endif
1457 
1458 	if (m->m_len < ETHER_HDR_LEN) {
1459 		m = m_pullup(m, ETHER_HDR_LEN);
1460 		if (m == NULL)
1461 			return (0);
1462 	}
1463 
1464 	eh = mtod(m, struct ether_header *);
1465 	sc = ifp->if_bridge;
1466 
1467 #ifndef BRIDGE_MPSAFE
1468 	s = splnet();
1469 #endif
1470 
1471 	/*
1472 	 * If bridge is down, but the original output interface is up,
1473 	 * go ahead and send out that interface.  Otherwise, the packet
1474 	 * is dropped below.
1475 	 */
1476 	if (__predict_false(sc == NULL) ||
1477 	    (sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1478 		dst_if = ifp;
1479 		goto sendunicast;
1480 	}
1481 
1482 	/*
1483 	 * If the packet is a multicast, or we don't know a better way to
1484 	 * get there, send to all interfaces.
1485 	 */
1486 	if (ETHER_IS_MULTICAST(eh->ether_dhost))
1487 		dst_if = NULL;
1488 	else
1489 		dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1490 	if (dst_if == NULL) {
1491 		struct bridge_iflist *bif;
1492 		struct mbuf *mc;
1493 		int used = 0;
1494 
1495 		BRIDGE_LOCK(sc);
1496 
1497 		LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1498 			dst_if = bif->bif_ifp;
1499 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
1500 				continue;
1501 
1502 			/*
1503 			 * If this is not the original output interface,
1504 			 * and the interface is participating in spanning
1505 			 * tree, make sure the port is in a state that
1506 			 * allows forwarding.
1507 			 */
1508 			if (dst_if != ifp &&
1509 			    (bif->bif_flags & IFBIF_STP) != 0) {
1510 				switch (bif->bif_state) {
1511 				case BSTP_IFSTATE_BLOCKING:
1512 				case BSTP_IFSTATE_LISTENING:
1513 				case BSTP_IFSTATE_DISABLED:
1514 					continue;
1515 				}
1516 			}
1517 
1518 			if (LIST_NEXT(bif, bif_next) == NULL) {
1519 				used = 1;
1520 				mc = m;
1521 			} else {
1522 				mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);
1523 				if (mc == NULL) {
1524 					sc->sc_if.if_oerrors++;
1525 					continue;
1526 				}
1527 			}
1528 
1529 			bridge_enqueue(sc, dst_if, mc, 0);
1530 		}
1531 
1532 		BRIDGE_UNLOCK(sc);
1533 
1534 		if (used == 0)
1535 			m_freem(m);
1536 #ifndef BRIDGE_MPSAFE
1537 		splx(s);
1538 #endif
1539 		return (0);
1540 	}
1541 
1542  sendunicast:
1543 	/*
1544 	 * XXX Spanning tree consideration here?
1545 	 */
1546 
1547 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1548 		m_freem(m);
1549 #ifndef BRIDGE_MPSAFE
1550 		splx(s);
1551 #endif
1552 		return (0);
1553 	}
1554 
1555 	bridge_enqueue(sc, dst_if, m, 0);
1556 
1557 #ifndef BRIDGE_MPSAFE
1558 	splx(s);
1559 #endif
1560 	return (0);
1561 }
1562 
1563 /*
1564  * bridge_start:
1565  *
1566  *	Start output on a bridge.
1567  *
1568  *	NOTE: This routine should never be called in this implementation.
1569  */
1570 static void
1571 bridge_start(struct ifnet *ifp)
1572 {
1573 
1574 	printf("%s: bridge_start() called\n", ifp->if_xname);
1575 }
1576 
1577 /*
1578  * bridge_forward:
1579  *
1580  *	The forwarding function of the bridge.
1581  */
1582 static void
1583 bridge_forward(void *v)
1584 {
1585 	struct bridge_softc *sc = v;
1586 	struct mbuf *m;
1587 	struct bridge_iflist *bif;
1588 	struct ifnet *src_if, *dst_if;
1589 	struct ether_header *eh;
1590 #ifndef BRIDGE_MPSAFE
1591 	int s;
1592 
1593 	KERNEL_LOCK(1, NULL);
1594 	mutex_enter(softnet_lock);
1595 #endif
1596 
1597 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1598 #ifndef BRIDGE_MPSAFE
1599 		mutex_exit(softnet_lock);
1600 		KERNEL_UNLOCK_ONE(NULL);
1601 #endif
1602 		return;
1603 	}
1604 
1605 #ifndef BRIDGE_MPSAFE
1606 	s = splnet();
1607 #endif
1608 	while ((m = pktq_dequeue(sc->sc_fwd_pktq)) != NULL) {
1609 		src_if = m->m_pkthdr.rcvif;
1610 
1611 		sc->sc_if.if_ipackets++;
1612 		sc->sc_if.if_ibytes += m->m_pkthdr.len;
1613 
1614 		/*
1615 		 * Look up the bridge_iflist.
1616 		 */
1617 		bif = bridge_lookup_member_if(sc, src_if);
1618 		if (bif == NULL) {
1619 			/* Interface is not a bridge member (anymore?) */
1620 			m_freem(m);
1621 			continue;
1622 		}
1623 
1624 		if (bif->bif_flags & IFBIF_STP) {
1625 			switch (bif->bif_state) {
1626 			case BSTP_IFSTATE_BLOCKING:
1627 			case BSTP_IFSTATE_LISTENING:
1628 			case BSTP_IFSTATE_DISABLED:
1629 				m_freem(m);
1630 				bridge_release_member(sc, bif);
1631 				continue;
1632 			}
1633 		}
1634 
1635 		eh = mtod(m, struct ether_header *);
1636 
1637 		/*
1638 		 * If the interface is learning, and the source
1639 		 * address is valid and not multicast, record
1640 		 * the address.
1641 		 */
1642 		if ((bif->bif_flags & IFBIF_LEARNING) != 0 &&
1643 		    ETHER_IS_MULTICAST(eh->ether_shost) == 0 &&
1644 		    (eh->ether_shost[0] == 0 &&
1645 		     eh->ether_shost[1] == 0 &&
1646 		     eh->ether_shost[2] == 0 &&
1647 		     eh->ether_shost[3] == 0 &&
1648 		     eh->ether_shost[4] == 0 &&
1649 		     eh->ether_shost[5] == 0) == 0) {
1650 			(void) bridge_rtupdate(sc, eh->ether_shost,
1651 			    src_if, 0, IFBAF_DYNAMIC);
1652 		}
1653 
1654 		if ((bif->bif_flags & IFBIF_STP) != 0 &&
1655 		    bif->bif_state == BSTP_IFSTATE_LEARNING) {
1656 			m_freem(m);
1657 			bridge_release_member(sc, bif);
1658 			continue;
1659 		}
1660 
1661 		bridge_release_member(sc, bif);
1662 
1663 		/*
1664 		 * At this point, the port either doesn't participate
1665 		 * in spanning tree or it is in the forwarding state.
1666 		 */
1667 
1668 		/*
1669 		 * If the packet is unicast, destined for someone on
1670 		 * "this" side of the bridge, drop it.
1671 		 */
1672 		if ((m->m_flags & (M_BCAST|M_MCAST)) == 0) {
1673 			dst_if = bridge_rtlookup(sc, eh->ether_dhost);
1674 			if (src_if == dst_if) {
1675 				m_freem(m);
1676 				continue;
1677 			}
1678 		} else {
1679 			/* ...forward it to all interfaces. */
1680 			sc->sc_if.if_imcasts++;
1681 			dst_if = NULL;
1682 		}
1683 
1684 		if (pfil_run_hooks(sc->sc_if.if_pfil, &m,
1685 		    m->m_pkthdr.rcvif, PFIL_IN) != 0) {
1686 			if (m != NULL)
1687 				m_freem(m);
1688 			continue;
1689 		}
1690 		if (m == NULL)
1691 			continue;
1692 
1693 		if (dst_if == NULL) {
1694 			bridge_broadcast(sc, src_if, m);
1695 			continue;
1696 		}
1697 
1698 		/*
1699 		 * At this point, we're dealing with a unicast frame
1700 		 * going to a different interface.
1701 		 */
1702 		if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1703 			m_freem(m);
1704 			continue;
1705 		}
1706 
1707 		bif = bridge_lookup_member_if(sc, dst_if);
1708 		if (bif == NULL) {
1709 			/* Not a member of the bridge (anymore?) */
1710 			m_freem(m);
1711 			continue;
1712 		}
1713 
1714 		if (bif->bif_flags & IFBIF_STP) {
1715 			switch (bif->bif_state) {
1716 			case BSTP_IFSTATE_DISABLED:
1717 			case BSTP_IFSTATE_BLOCKING:
1718 				m_freem(m);
1719 				bridge_release_member(sc, bif);
1720 				continue;
1721 			}
1722 		}
1723 
1724 		bridge_release_member(sc, bif);
1725 
1726 		bridge_enqueue(sc, dst_if, m, 1);
1727 	}
1728 #ifndef BRIDGE_MPSAFE
1729 	splx(s);
1730 	mutex_exit(softnet_lock);
1731 	KERNEL_UNLOCK_ONE(NULL);
1732 #endif
1733 }
1734 
1735 static bool
1736 bstp_state_before_learning(struct bridge_iflist *bif)
1737 {
1738 	if (bif->bif_flags & IFBIF_STP) {
1739 		switch (bif->bif_state) {
1740 		case BSTP_IFSTATE_BLOCKING:
1741 		case BSTP_IFSTATE_LISTENING:
1742 		case BSTP_IFSTATE_DISABLED:
1743 			return true;
1744 		}
1745 	}
1746 	return false;
1747 }
1748 
1749 static bool
1750 bridge_ourether(struct bridge_iflist *bif, struct ether_header *eh, int src)
1751 {
1752 	uint8_t *ether = src ? eh->ether_shost : eh->ether_dhost;
1753 
1754 	if (memcmp(CLLADDR(bif->bif_ifp->if_sadl), ether, ETHER_ADDR_LEN) == 0
1755 #if NCARP > 0
1756 	    || (bif->bif_ifp->if_carp &&
1757 	        carp_ourether(bif->bif_ifp->if_carp, eh, IFT_ETHER, src) != NULL)
1758 #endif /* NCARP > 0 */
1759 	    )
1760 		return true;
1761 
1762 	return false;
1763 }
1764 
1765 /*
1766  * bridge_input:
1767  *
1768  *	Receive input from a member interface.  Queue the packet for
1769  *	bridging if it is not for us.
1770  */
1771 static void
1772 bridge_input(struct ifnet *ifp, struct mbuf *m)
1773 {
1774 	struct bridge_softc *sc = ifp->if_bridge;
1775 	struct bridge_iflist *bif;
1776 	struct ether_header *eh;
1777 
1778 	if (__predict_false(sc == NULL) ||
1779 	    (sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1780 		ether_input(ifp, m);
1781 		return;
1782 	}
1783 
1784 	bif = bridge_lookup_member_if(sc, ifp);
1785 	if (bif == NULL) {
1786 		ether_input(ifp, m);
1787 		return;
1788 	}
1789 
1790 	eh = mtod(m, struct ether_header *);
1791 
1792 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1793 		if (memcmp(etherbroadcastaddr,
1794 		    eh->ether_dhost, ETHER_ADDR_LEN) == 0)
1795 			m->m_flags |= M_BCAST;
1796 		else
1797 			m->m_flags |= M_MCAST;
1798 	}
1799 
1800 	/*
1801 	 * A 'fast' path for packets addressed to interfaces that are
1802 	 * part of this bridge.
1803 	 */
1804 	if (!(m->m_flags & (M_BCAST|M_MCAST)) &&
1805 	    !bstp_state_before_learning(bif)) {
1806 		struct bridge_iflist *_bif;
1807 
1808 		BRIDGE_LOCK(sc);
1809 		LIST_FOREACH(_bif, &sc->sc_iflist, bif_next) {
1810 			/* It is destined for us. */
1811 			if (bridge_ourether(_bif, eh, 0)) {
1812 				if (_bif->bif_flags & IFBIF_LEARNING)
1813 					(void) bridge_rtupdate(sc,
1814 					    eh->ether_shost, ifp, 0, IFBAF_DYNAMIC);
1815 				m->m_pkthdr.rcvif = _bif->bif_ifp;
1816 				ether_input(_bif->bif_ifp, m);
1817 				break;
1818 			}
1819 
1820 			/* We just received a packet that we sent out. */
1821 			if (bridge_ourether(_bif, eh, 1)) {
1822 				m_freem(m);
1823 				break;
1824 			}
1825 		}
1826 		BRIDGE_UNLOCK(sc);
1827 
1828 		if (_bif != NULL) {
1829 			bridge_release_member(sc, bif);
1830 			return;
1831 		}
1832 	}
1833 
1834 	/* Tap off 802.1D packets; they do not get forwarded. */
1835 	if (bif->bif_flags & IFBIF_STP &&
1836 	    memcmp(eh->ether_dhost, bstp_etheraddr, ETHER_ADDR_LEN) == 0) {
1837 		bstp_input(sc, bif, m);
1838 		bridge_release_member(sc, bif);
1839 		return;
1840 	}
1841 
1842 	/*
1843 	 * A normal switch would discard the packet here, but that's not what
1844 	 * we've done historically. This also prevents some obnoxious behaviour.
1845 	 */
1846 	if (bstp_state_before_learning(bif)) {
1847 		ether_input(ifp, m);
1848 		bridge_release_member(sc, bif);
1849 		return;
1850 	}
1851 
1852 	bridge_release_member(sc, bif);
1853 
1854 	/* Queue the packet for bridge forwarding. */
1855 	if (__predict_false(!pktq_enqueue(sc->sc_fwd_pktq, m, 0)))
1856 		m_freem(m);
1857 }
1858 
1859 /*
1860  * bridge_broadcast:
1861  *
1862  *	Send a frame to all interfaces that are members of
1863  *	the bridge, except for the one on which the packet
1864  *	arrived.
1865  */
1866 static void
1867 bridge_broadcast(struct bridge_softc *sc, struct ifnet *src_if,
1868     struct mbuf *m)
1869 {
1870 	struct bridge_iflist *bif;
1871 	struct mbuf *mc;
1872 	struct ifnet *dst_if;
1873 	bool used, bmcast;
1874 
1875 	used = bmcast = m->m_flags & (M_BCAST|M_MCAST);
1876 
1877 	BRIDGE_LOCK(sc);
1878 
1879 	LIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
1880 		dst_if = bif->bif_ifp;
1881 		if (dst_if == src_if)
1882 			continue;
1883 
1884 		if (bif->bif_flags & IFBIF_STP) {
1885 			switch (bif->bif_state) {
1886 			case BSTP_IFSTATE_BLOCKING:
1887 			case BSTP_IFSTATE_DISABLED:
1888 				continue;
1889 			}
1890 		}
1891 
1892 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 && !bmcast)
1893 			continue;
1894 
1895 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1896 			continue;
1897 
1898 		if (!used && LIST_NEXT(bif, bif_next) == NULL) {
1899 			mc = m;
1900 			used = true;
1901 		} else {
1902 			mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1903 			if (mc == NULL) {
1904 				sc->sc_if.if_oerrors++;
1905 				continue;
1906 			}
1907 		}
1908 
1909 		bridge_enqueue(sc, dst_if, mc, 1);
1910 	}
1911 
1912 	if (bmcast)
1913 		ether_input(src_if, m);
1914 	else if (!used)
1915 		m_freem(m);
1916 
1917 	BRIDGE_UNLOCK(sc);
1918 }
1919 
1920 /*
1921  * bridge_rtupdate:
1922  *
1923  *	Add a bridge routing entry.
1924  */
1925 static int
1926 bridge_rtupdate(struct bridge_softc *sc, const uint8_t *dst,
1927     struct ifnet *dst_if, int setflags, uint8_t flags)
1928 {
1929 	struct bridge_rtnode *brt;
1930 	int error = 0;
1931 
1932 	mutex_enter(sc->sc_rtlist_lock);
1933 
1934 	/*
1935 	 * A route for this destination might already exist.  If so,
1936 	 * update it, otherwise create a new one.
1937 	 */
1938 	if ((brt = bridge_rtnode_lookup(sc, dst)) == NULL) {
1939 		if (sc->sc_brtcnt >= sc->sc_brtmax) {
1940 			error = ENOSPC;
1941 			goto out;
1942 		}
1943 
1944 		/*
1945 		 * Allocate a new bridge forwarding node, and
1946 		 * initialize the expiration time and Ethernet
1947 		 * address.
1948 		 */
1949 		brt = pool_get(&bridge_rtnode_pool, PR_NOWAIT);
1950 		if (brt == NULL) {
1951 			error = ENOMEM;
1952 			goto out;
1953 		}
1954 
1955 		memset(brt, 0, sizeof(*brt));
1956 		brt->brt_expire = time_uptime + sc->sc_brttimeout;
1957 		brt->brt_flags = IFBAF_DYNAMIC;
1958 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
1959 
1960 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
1961 			pool_put(&bridge_rtnode_pool, brt);
1962 			goto out;
1963 		}
1964 	}
1965 
1966 	brt->brt_ifp = dst_if;
1967 	if (setflags) {
1968 		brt->brt_flags = flags;
1969 		if (flags & IFBAF_STATIC)
1970 			brt->brt_expire = 0;
1971 		else
1972 			brt->brt_expire = time_uptime + sc->sc_brttimeout;
1973 	}
1974 
1975 out:
1976 	mutex_exit(sc->sc_rtlist_lock);
1977 
1978 	return error;
1979 }
1980 
1981 /*
1982  * bridge_rtlookup:
1983  *
1984  *	Lookup the destination interface for an address.
1985  */
1986 static struct ifnet *
1987 bridge_rtlookup(struct bridge_softc *sc, const uint8_t *addr)
1988 {
1989 	struct bridge_rtnode *brt;
1990 	struct ifnet *ifs = NULL;
1991 
1992 	mutex_enter(sc->sc_rtlist_lock);
1993 
1994 	brt = bridge_rtnode_lookup(sc, addr);
1995 	if (brt != NULL)
1996 		ifs = brt->brt_ifp;
1997 
1998 	mutex_exit(sc->sc_rtlist_lock);
1999 
2000 	return ifs;
2001 }
2002 
2003 /*
2004  * bridge_rttrim:
2005  *
2006  *	Trim the routine table so that we have a number
2007  *	of routing entries less than or equal to the
2008  *	maximum number.
2009  */
2010 static void
2011 bridge_rttrim(struct bridge_softc *sc)
2012 {
2013 	struct bridge_rtnode *brt, *nbrt;
2014 
2015 	mutex_enter(sc->sc_rtlist_lock);
2016 
2017 	/* Make sure we actually need to do this. */
2018 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2019 		goto out;
2020 
2021 	/* Force an aging cycle; this might trim enough addresses. */
2022 	bridge_rtage(sc);
2023 	if (sc->sc_brtcnt <= sc->sc_brtmax)
2024 		goto out;
2025 
2026 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2027 		nbrt = LIST_NEXT(brt, brt_list);
2028 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2029 			bridge_rtnode_destroy(sc, brt);
2030 			if (sc->sc_brtcnt <= sc->sc_brtmax)
2031 				goto out;
2032 		}
2033 	}
2034 
2035 out:
2036 	mutex_exit(sc->sc_rtlist_lock);
2037 
2038 	return;
2039 }
2040 
2041 /*
2042  * bridge_timer:
2043  *
2044  *	Aging timer for the bridge.
2045  */
2046 static void
2047 bridge_timer(void *arg)
2048 {
2049 	struct bridge_softc *sc = arg;
2050 
2051 	mutex_enter(sc->sc_rtlist_lock);
2052 
2053 	bridge_rtage(sc);
2054 
2055 	if (sc->sc_if.if_flags & IFF_RUNNING)
2056 		callout_reset(&sc->sc_brcallout,
2057 		    bridge_rtable_prune_period * hz, bridge_timer, sc);
2058 
2059 	mutex_exit(sc->sc_rtlist_lock);
2060 }
2061 
2062 /*
2063  * bridge_rtage:
2064  *
2065  *	Perform an aging cycle.
2066  */
2067 static void
2068 bridge_rtage(struct bridge_softc *sc)
2069 {
2070 	struct bridge_rtnode *brt, *nbrt;
2071 
2072 	KASSERT(mutex_owned(sc->sc_rtlist_lock));
2073 
2074 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2075 		nbrt = LIST_NEXT(brt, brt_list);
2076 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
2077 			if (time_uptime >= brt->brt_expire)
2078 				bridge_rtnode_destroy(sc, brt);
2079 		}
2080 	}
2081 }
2082 
2083 /*
2084  * bridge_rtflush:
2085  *
2086  *	Remove all dynamic addresses from the bridge.
2087  */
2088 static void
2089 bridge_rtflush(struct bridge_softc *sc, int full)
2090 {
2091 	struct bridge_rtnode *brt, *nbrt;
2092 
2093 	mutex_enter(sc->sc_rtlist_lock);
2094 
2095 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2096 		nbrt = LIST_NEXT(brt, brt_list);
2097 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
2098 			bridge_rtnode_destroy(sc, brt);
2099 	}
2100 
2101 	mutex_exit(sc->sc_rtlist_lock);
2102 }
2103 
2104 /*
2105  * bridge_rtdaddr:
2106  *
2107  *	Remove an address from the table.
2108  */
2109 static int
2110 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t *addr)
2111 {
2112 	struct bridge_rtnode *brt;
2113 	int error = 0;
2114 
2115 	mutex_enter(sc->sc_rtlist_lock);
2116 
2117 	if ((brt = bridge_rtnode_lookup(sc, addr)) == NULL) {
2118 		error = ENOENT;
2119 		goto out;
2120 	}
2121 
2122 	bridge_rtnode_destroy(sc, brt);
2123 
2124 out:
2125 	mutex_exit(sc->sc_rtlist_lock);
2126 
2127 	return error;
2128 }
2129 
2130 /*
2131  * bridge_rtdelete:
2132  *
2133  *	Delete routes to a speicifc member interface.
2134  */
2135 static void
2136 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp)
2137 {
2138 	struct bridge_rtnode *brt, *nbrt;
2139 
2140 	mutex_enter(sc->sc_rtlist_lock);
2141 
2142 	for (brt = LIST_FIRST(&sc->sc_rtlist); brt != NULL; brt = nbrt) {
2143 		nbrt = LIST_NEXT(brt, brt_list);
2144 		if (brt->brt_ifp == ifp)
2145 			bridge_rtnode_destroy(sc, brt);
2146 	}
2147 
2148 	mutex_exit(sc->sc_rtlist_lock);
2149 }
2150 
2151 /*
2152  * bridge_rtable_init:
2153  *
2154  *	Initialize the route table for this bridge.
2155  */
2156 static int
2157 bridge_rtable_init(struct bridge_softc *sc)
2158 {
2159 	int i;
2160 
2161 	sc->sc_rthash = malloc(sizeof(*sc->sc_rthash) * BRIDGE_RTHASH_SIZE,
2162 	    M_DEVBUF, M_NOWAIT);
2163 	if (sc->sc_rthash == NULL)
2164 		return (ENOMEM);
2165 
2166 	for (i = 0; i < BRIDGE_RTHASH_SIZE; i++)
2167 		LIST_INIT(&sc->sc_rthash[i]);
2168 
2169 	sc->sc_rthash_key = cprng_fast32();
2170 
2171 	LIST_INIT(&sc->sc_rtlist);
2172 
2173 	sc->sc_rtlist_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NET);
2174 
2175 	return (0);
2176 }
2177 
2178 /*
2179  * bridge_rtable_fini:
2180  *
2181  *	Deconstruct the route table for this bridge.
2182  */
2183 static void
2184 bridge_rtable_fini(struct bridge_softc *sc)
2185 {
2186 
2187 	free(sc->sc_rthash, M_DEVBUF);
2188 	if (sc->sc_rtlist_lock)
2189 		mutex_obj_free(sc->sc_rtlist_lock);
2190 }
2191 
2192 /*
2193  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
2194  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
2195  */
2196 #define	mix(a, b, c)							\
2197 do {									\
2198 	a -= b; a -= c; a ^= (c >> 13);					\
2199 	b -= c; b -= a; b ^= (a << 8);					\
2200 	c -= a; c -= b; c ^= (b >> 13);					\
2201 	a -= b; a -= c; a ^= (c >> 12);					\
2202 	b -= c; b -= a; b ^= (a << 16);					\
2203 	c -= a; c -= b; c ^= (b >> 5);					\
2204 	a -= b; a -= c; a ^= (c >> 3);					\
2205 	b -= c; b -= a; b ^= (a << 10);					\
2206 	c -= a; c -= b; c ^= (b >> 15);					\
2207 } while (/*CONSTCOND*/0)
2208 
2209 static inline uint32_t
2210 bridge_rthash(struct bridge_softc *sc, const uint8_t *addr)
2211 {
2212 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
2213 
2214 	b += addr[5] << 8;
2215 	b += addr[4];
2216 	a += addr[3] << 24;
2217 	a += addr[2] << 16;
2218 	a += addr[1] << 8;
2219 	a += addr[0];
2220 
2221 	mix(a, b, c);
2222 
2223 	return (c & BRIDGE_RTHASH_MASK);
2224 }
2225 
2226 #undef mix
2227 
2228 /*
2229  * bridge_rtnode_lookup:
2230  *
2231  *	Look up a bridge route node for the specified destination.
2232  */
2233 static struct bridge_rtnode *
2234 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t *addr)
2235 {
2236 	struct bridge_rtnode *brt;
2237 	uint32_t hash;
2238 	int dir;
2239 
2240 	KASSERT(mutex_owned(sc->sc_rtlist_lock));
2241 
2242 	hash = bridge_rthash(sc, addr);
2243 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
2244 		dir = memcmp(addr, brt->brt_addr, ETHER_ADDR_LEN);
2245 		if (dir == 0)
2246 			return (brt);
2247 		if (dir > 0)
2248 			return (NULL);
2249 	}
2250 
2251 	return (NULL);
2252 }
2253 
2254 /*
2255  * bridge_rtnode_insert:
2256  *
2257  *	Insert the specified bridge node into the route table.  We
2258  *	assume the entry is not already in the table.
2259  */
2260 static int
2261 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
2262 {
2263 	struct bridge_rtnode *lbrt;
2264 	uint32_t hash;
2265 	int dir;
2266 
2267 	KASSERT(mutex_owned(sc->sc_rtlist_lock));
2268 
2269 	hash = bridge_rthash(sc, brt->brt_addr);
2270 
2271 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
2272 	if (lbrt == NULL) {
2273 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
2274 		goto out;
2275 	}
2276 
2277 	do {
2278 		dir = memcmp(brt->brt_addr, lbrt->brt_addr, ETHER_ADDR_LEN);
2279 		if (dir == 0)
2280 			return (EEXIST);
2281 		if (dir > 0) {
2282 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
2283 			goto out;
2284 		}
2285 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
2286 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
2287 			goto out;
2288 		}
2289 		lbrt = LIST_NEXT(lbrt, brt_hash);
2290 	} while (lbrt != NULL);
2291 
2292 #ifdef DIAGNOSTIC
2293 	panic("bridge_rtnode_insert: impossible");
2294 #endif
2295 
2296  out:
2297 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
2298 	sc->sc_brtcnt++;
2299 
2300 	return (0);
2301 }
2302 
2303 /*
2304  * bridge_rtnode_destroy:
2305  *
2306  *	Destroy a bridge rtnode.
2307  */
2308 static void
2309 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
2310 {
2311 
2312 	KASSERT(mutex_owned(sc->sc_rtlist_lock));
2313 
2314 	LIST_REMOVE(brt, brt_hash);
2315 
2316 	LIST_REMOVE(brt, brt_list);
2317 	sc->sc_brtcnt--;
2318 	pool_put(&bridge_rtnode_pool, brt);
2319 }
2320 
2321 #if defined(BRIDGE_IPF)
2322 extern pfil_head_t *inet_pfil_hook;                 /* XXX */
2323 extern pfil_head_t *inet6_pfil_hook;                /* XXX */
2324 
2325 /*
2326  * Send bridge packets through IPF if they are one of the types IPF can deal
2327  * with, or if they are ARP or REVARP.  (IPF will pass ARP and REVARP without
2328  * question.)
2329  */
2330 static int
2331 bridge_ipf(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
2332 {
2333 	int snap, error;
2334 	struct ether_header *eh1, eh2;
2335 	struct llc llc1;
2336 	uint16_t ether_type;
2337 
2338 	snap = 0;
2339 	error = -1;	/* Default error if not error == 0 */
2340 	eh1 = mtod(*mp, struct ether_header *);
2341 	ether_type = ntohs(eh1->ether_type);
2342 
2343 	/*
2344 	 * Check for SNAP/LLC.
2345 	 */
2346         if (ether_type < ETHERMTU) {
2347                 struct llc *llc2 = (struct llc *)(eh1 + 1);
2348 
2349                 if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
2350                     llc2->llc_dsap == LLC_SNAP_LSAP &&
2351                     llc2->llc_ssap == LLC_SNAP_LSAP &&
2352                     llc2->llc_control == LLC_UI) {
2353                 	ether_type = htons(llc2->llc_un.type_snap.ether_type);
2354 			snap = 1;
2355                 }
2356         }
2357 
2358 	/*
2359 	 * If we're trying to filter bridge traffic, don't look at anything
2360 	 * other than IP and ARP traffic.  If the filter doesn't understand
2361 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
2362 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
2363 	 * but of course we don't have an AppleTalk filter to begin with.
2364 	 * (Note that since IPF doesn't understand ARP it will pass *ALL*
2365 	 * ARP traffic.)
2366 	 */
2367 	switch (ether_type) {
2368 		case ETHERTYPE_ARP:
2369 		case ETHERTYPE_REVARP:
2370 			return 0; /* Automatically pass */
2371 		case ETHERTYPE_IP:
2372 # ifdef INET6
2373 		case ETHERTYPE_IPV6:
2374 # endif /* INET6 */
2375 			break;
2376 		default:
2377 			goto bad;
2378 	}
2379 
2380 	/* Strip off the Ethernet header and keep a copy. */
2381 	m_copydata(*mp, 0, ETHER_HDR_LEN, (void *) &eh2);
2382 	m_adj(*mp, ETHER_HDR_LEN);
2383 
2384 	/* Strip off snap header, if present */
2385 	if (snap) {
2386 		m_copydata(*mp, 0, sizeof(struct llc), (void *) &llc1);
2387 		m_adj(*mp, sizeof(struct llc));
2388 	}
2389 
2390 	/*
2391 	 * Check basic packet sanity and run IPF through pfil.
2392 	 */
2393 	KASSERT(!cpu_intr_p());
2394 	switch (ether_type)
2395 	{
2396 	case ETHERTYPE_IP :
2397 		error = (dir == PFIL_IN) ? bridge_ip_checkbasic(mp) : 0;
2398 		if (error == 0)
2399 			error = pfil_run_hooks(inet_pfil_hook, mp, ifp, dir);
2400 		break;
2401 # ifdef INET6
2402 	case ETHERTYPE_IPV6 :
2403 		error = (dir == PFIL_IN) ? bridge_ip6_checkbasic(mp) : 0;
2404 		if (error == 0)
2405 			error = pfil_run_hooks(inet6_pfil_hook, mp, ifp, dir);
2406 		break;
2407 # endif
2408 	default :
2409 		error = 0;
2410 		break;
2411 	}
2412 
2413 	if (*mp == NULL)
2414 		return error;
2415 	if (error != 0)
2416 		goto bad;
2417 
2418 	error = -1;
2419 
2420 	/*
2421 	 * Finally, put everything back the way it was and return
2422 	 */
2423 	if (snap) {
2424 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT);
2425 		if (*mp == NULL)
2426 			return error;
2427 		bcopy(&llc1, mtod(*mp, void *), sizeof(struct llc));
2428 	}
2429 
2430 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT);
2431 	if (*mp == NULL)
2432 		return error;
2433 	bcopy(&eh2, mtod(*mp, void *), ETHER_HDR_LEN);
2434 
2435 	return 0;
2436 
2437     bad:
2438 	m_freem(*mp);
2439 	*mp = NULL;
2440 	return error;
2441 }
2442 
2443 /*
2444  * Perform basic checks on header size since
2445  * IPF assumes ip_input has already processed
2446  * it for it.  Cut-and-pasted from ip_input.c.
2447  * Given how simple the IPv6 version is,
2448  * does the IPv4 version really need to be
2449  * this complicated?
2450  *
2451  * XXX Should we update ipstat here, or not?
2452  * XXX Right now we update ipstat but not
2453  * XXX csum_counter.
2454  */
2455 static int
2456 bridge_ip_checkbasic(struct mbuf **mp)
2457 {
2458 	struct mbuf *m = *mp;
2459 	struct ip *ip;
2460 	int len, hlen;
2461 
2462 	if (*mp == NULL)
2463 		return -1;
2464 
2465 	if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
2466 		if ((m = m_copyup(m, sizeof(struct ip),
2467 			(max_linkhdr + 3) & ~3)) == NULL) {
2468 			/* XXXJRT new stat, please */
2469 			ip_statinc(IP_STAT_TOOSMALL);
2470 			goto bad;
2471 		}
2472 	} else if (__predict_false(m->m_len < sizeof (struct ip))) {
2473 		if ((m = m_pullup(m, sizeof (struct ip))) == NULL) {
2474 			ip_statinc(IP_STAT_TOOSMALL);
2475 			goto bad;
2476 		}
2477 	}
2478 	ip = mtod(m, struct ip *);
2479 	if (ip == NULL) goto bad;
2480 
2481 	if (ip->ip_v != IPVERSION) {
2482 		ip_statinc(IP_STAT_BADVERS);
2483 		goto bad;
2484 	}
2485 	hlen = ip->ip_hl << 2;
2486 	if (hlen < sizeof(struct ip)) { /* minimum header length */
2487 		ip_statinc(IP_STAT_BADHLEN);
2488 		goto bad;
2489 	}
2490 	if (hlen > m->m_len) {
2491 		if ((m = m_pullup(m, hlen)) == 0) {
2492 			ip_statinc(IP_STAT_BADHLEN);
2493 			goto bad;
2494 		}
2495 		ip = mtod(m, struct ip *);
2496 		if (ip == NULL) goto bad;
2497 	}
2498 
2499         switch (m->m_pkthdr.csum_flags &
2500                 ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_IPv4) |
2501                  M_CSUM_IPv4_BAD)) {
2502         case M_CSUM_IPv4|M_CSUM_IPv4_BAD:
2503                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_bad); */
2504                 goto bad;
2505 
2506         case M_CSUM_IPv4:
2507                 /* Checksum was okay. */
2508                 /* INET_CSUM_COUNTER_INCR(&ip_hwcsum_ok); */
2509                 break;
2510 
2511         default:
2512                 /* Must compute it ourselves. */
2513                 /* INET_CSUM_COUNTER_INCR(&ip_swcsum); */
2514                 if (in_cksum(m, hlen) != 0)
2515                         goto bad;
2516                 break;
2517         }
2518 
2519         /* Retrieve the packet length. */
2520         len = ntohs(ip->ip_len);
2521 
2522         /*
2523          * Check for additional length bogosity
2524          */
2525         if (len < hlen) {
2526 		ip_statinc(IP_STAT_BADLEN);
2527                 goto bad;
2528         }
2529 
2530         /*
2531          * Check that the amount of data in the buffers
2532          * is as at least much as the IP header would have us expect.
2533          * Drop packet if shorter than we expect.
2534          */
2535         if (m->m_pkthdr.len < len) {
2536 		ip_statinc(IP_STAT_TOOSHORT);
2537                 goto bad;
2538         }
2539 
2540 	/* Checks out, proceed */
2541 	*mp = m;
2542 	return 0;
2543 
2544     bad:
2545 	*mp = m;
2546 	return -1;
2547 }
2548 
2549 # ifdef INET6
2550 /*
2551  * Same as above, but for IPv6.
2552  * Cut-and-pasted from ip6_input.c.
2553  * XXX Should we update ip6stat, or not?
2554  */
2555 static int
2556 bridge_ip6_checkbasic(struct mbuf **mp)
2557 {
2558 	struct mbuf *m = *mp;
2559 	struct ip6_hdr *ip6;
2560 
2561         /*
2562          * If the IPv6 header is not aligned, slurp it up into a new
2563          * mbuf with space for link headers, in the event we forward
2564          * it.  Otherwise, if it is aligned, make sure the entire base
2565          * IPv6 header is in the first mbuf of the chain.
2566          */
2567         if (IP6_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
2568                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2569                 if ((m = m_copyup(m, sizeof(struct ip6_hdr),
2570                                   (max_linkhdr + 3) & ~3)) == NULL) {
2571                         /* XXXJRT new stat, please */
2572 			ip6_statinc(IP6_STAT_TOOSMALL);
2573                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2574                         goto bad;
2575                 }
2576         } else if (__predict_false(m->m_len < sizeof(struct ip6_hdr))) {
2577                 struct ifnet *inifp = m->m_pkthdr.rcvif;
2578                 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
2579 			ip6_statinc(IP6_STAT_TOOSMALL);
2580                         in6_ifstat_inc(inifp, ifs6_in_hdrerr);
2581                         goto bad;
2582                 }
2583         }
2584 
2585         ip6 = mtod(m, struct ip6_hdr *);
2586 
2587         if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2588 		ip6_statinc(IP6_STAT_BADVERS);
2589                 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2590                 goto bad;
2591         }
2592 
2593 	/* Checks out, proceed */
2594 	*mp = m;
2595 	return 0;
2596 
2597     bad:
2598 	*mp = m;
2599 	return -1;
2600 }
2601 # endif /* INET6 */
2602 #endif /* BRIDGE_IPF */
2603