xref: /openbsd-src/sys/net/if_bridge.c (revision 1a8dbaac879b9f3335ad7fb25429ce63ac1d6bac)
1 /*	$OpenBSD: if_bridge.c,v 1.345 2020/08/06 19:47:44 bluhm Exp $	*/
2 
3 /*
4  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
19  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
25  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  *
28  * Effort sponsored in part by the Defense Advanced Research Projects
29  * Agency (DARPA) and Air Force Research Laboratory, Air Force
30  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
31  *
32  */
33 
34 #include "bpfilter.h"
35 #include "gif.h"
36 #include "pf.h"
37 #include "carp.h"
38 #include "vlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/ioctl.h>
45 #include <sys/kernel.h>
46 
47 #include <net/if.h>
48 #include <net/if_types.h>
49 #include <net/if_llc.h>
50 #include <net/netisr.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/ip.h>
54 #include <netinet/ip_var.h>
55 #include <netinet/if_ether.h>
56 #include <netinet/ip_icmp.h>
57 
58 #ifdef IPSEC
59 #include <netinet/ip_ipsp.h>
60 #include <net/if_enc.h>
61 #endif
62 
63 #ifdef INET6
64 #include <netinet6/in6_var.h>
65 #include <netinet/ip6.h>
66 #include <netinet6/ip6_var.h>
67 #endif
68 
69 #if NPF > 0
70 #include <net/pfvar.h>
71 #define	BRIDGE_IN	PF_IN
72 #define	BRIDGE_OUT	PF_OUT
73 #else
74 #define	BRIDGE_IN	0
75 #define	BRIDGE_OUT	1
76 #endif
77 
78 #if NBPFILTER > 0
79 #include <net/bpf.h>
80 #endif
81 
82 #if NCARP > 0
83 #include <netinet/ip_carp.h>
84 #endif
85 
86 #if NVLAN > 0
87 #include <net/if_vlan_var.h>
88 #endif
89 
90 #include <net/if_bridge.h>
91 
92 /*
93  * Maximum number of addresses to cache
94  */
95 #ifndef	BRIDGE_RTABLE_MAX
96 #define	BRIDGE_RTABLE_MAX	100
97 #endif
98 
99 /*
100  * Timeout (in seconds) for entries learned dynamically
101  */
102 #ifndef	BRIDGE_RTABLE_TIMEOUT
103 #define	BRIDGE_RTABLE_TIMEOUT	240
104 #endif
105 
106 void	bridgeattach(int);
107 int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
108 void	bridge_ifdetach(void *);
109 void	bridge_spandetach(void *);
110 int	bridge_ifremove(struct bridge_iflist *);
111 void	bridge_spanremove(struct bridge_iflist *);
112 struct mbuf *
113 	bridge_input(struct ifnet *, struct mbuf *, void *);
114 void	bridge_process(struct ifnet *, struct mbuf *);
115 void	bridgeintr_frame(struct ifnet *, struct ifnet *, struct mbuf *);
116 void	bridge_bifgetstp(struct bridge_softc *, struct bridge_iflist *,
117 	    struct ifbreq *);
118 void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
119     struct ether_header *, struct mbuf *);
120 int	bridge_localbroadcast(struct ifnet *, struct ether_header *,
121     struct mbuf *);
122 void	bridge_span(struct ifnet *, struct mbuf *);
123 void	bridge_stop(struct bridge_softc *);
124 void	bridge_init(struct bridge_softc *);
125 int	bridge_bifconf(struct bridge_softc *, struct ifbifconf *);
126 int bridge_blocknonip(struct ether_header *, struct mbuf *);
127 void	bridge_ifinput(struct ifnet *, struct mbuf *);
128 int	bridge_dummy_output(struct ifnet *, struct mbuf *, struct sockaddr *,
129     struct rtentry *);
130 void	bridge_send_icmp_err(struct ifnet *, struct ether_header *,
131     struct mbuf *, int, struct llc *, int, int, int);
132 int	bridge_ifenqueue(struct ifnet *, struct ifnet *, struct mbuf *);
133 struct mbuf *bridge_ip(struct ifnet *, int, struct ifnet *,
134     struct ether_header *, struct mbuf *);
135 #ifdef IPSEC
136 int bridge_ipsec(struct ifnet *, struct ether_header *, int, struct llc *,
137     int, int, int, struct mbuf *);
138 #endif
139 int     bridge_clone_create(struct if_clone *, int);
140 int	bridge_clone_destroy(struct ifnet *);
141 
142 #define	ETHERADDR_IS_IP_MCAST(a) \
143 	/* struct etheraddr *a;	*/				\
144 	((a)->ether_addr_octet[0] == 0x01 &&			\
145 	 (a)->ether_addr_octet[1] == 0x00 &&			\
146 	 (a)->ether_addr_octet[2] == 0x5e)
147 
148 struct niqueue bridgeintrq = NIQUEUE_INITIALIZER(1024, NETISR_BRIDGE);
149 
150 struct if_clone bridge_cloner =
151     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
152 
153 const struct ether_brport bridge_brport = {
154 	bridge_input,
155 	NULL,
156 };
157 
158 void
159 bridgeattach(int n)
160 {
161 	if_clone_attach(&bridge_cloner);
162 }
163 
164 int
165 bridge_clone_create(struct if_clone *ifc, int unit)
166 {
167 	struct bridge_softc *sc;
168 	struct ifnet *ifp;
169 	int i;
170 
171 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
172 	sc->sc_stp = bstp_create();
173 	if (!sc->sc_stp) {
174 		free(sc, M_DEVBUF, sizeof *sc);
175 		return (ENOMEM);
176 	}
177 
178 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
179 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
180 	timeout_set(&sc->sc_brtimeout, bridge_rtage, sc);
181 	SMR_SLIST_INIT(&sc->sc_iflist);
182 	SMR_SLIST_INIT(&sc->sc_spanlist);
183 	mtx_init(&sc->sc_mtx, IPL_MPFLOOR);
184 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++)
185 		LIST_INIT(&sc->sc_rts[i]);
186 	arc4random_buf(&sc->sc_hashkey, sizeof(sc->sc_hashkey));
187 	ifp = &sc->sc_if;
188 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
189 	    unit);
190 	ifp->if_softc = sc;
191 	ifp->if_mtu = ETHERMTU;
192 	ifp->if_ioctl = bridge_ioctl;
193 	ifp->if_output = bridge_dummy_output;
194 	ifp->if_xflags = IFXF_CLONED;
195 	ifp->if_start = NULL;
196 	ifp->if_type = IFT_BRIDGE;
197 	ifp->if_hdrlen = ETHER_HDR_LEN;
198 
199 	if_attach(ifp);
200 	if_alloc_sadl(ifp);
201 
202 #if NBPFILTER > 0
203 	bpfattach(&sc->sc_if.if_bpf, ifp,
204 	    DLT_EN10MB, ETHER_HDR_LEN);
205 #endif
206 
207 	return (0);
208 }
209 
210 int
211 bridge_dummy_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
212     struct rtentry *rt)
213 {
214 	m_freem(m);
215 	return (EAFNOSUPPORT);
216 }
217 
218 int
219 bridge_clone_destroy(struct ifnet *ifp)
220 {
221 	struct bridge_softc *sc = ifp->if_softc;
222 	struct bridge_iflist *bif;
223 
224 	/*
225 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
226 	 * use of smr_barrier() while holding the lock might lead to a
227 	 * deadlock situation.
228 	 */
229 	NET_ASSERT_UNLOCKED();
230 
231 	bridge_stop(sc);
232 	bridge_rtflush(sc, IFBF_FLUSHALL);
233 	while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_iflist)) != NULL)
234 		bridge_ifremove(bif);
235 	while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_spanlist)) != NULL)
236 		bridge_spanremove(bif);
237 
238 	bstp_destroy(sc->sc_stp);
239 
240 	/* Undo pseudo-driver changes. */
241 	if_deactivate(ifp);
242 
243 	if_detach(ifp);
244 
245 	free(sc, M_DEVBUF, sizeof *sc);
246 	return (0);
247 }
248 
249 int
250 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
251 {
252 	struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
253 	struct ifbreq *req = (struct ifbreq *)data;
254 	struct ifbropreq *brop = (struct ifbropreq *)data;
255 	struct ifnet *ifs;
256 	struct bridge_iflist *bif;
257 	struct bstp_port *bp;
258 	struct bstp_state *bs = sc->sc_stp;
259 	int error = 0;
260 
261 	/*
262 	 * bridge(4) data structure aren't protected by the NET_LOCK().
263 	 * Idealy it shouldn't be taken before calling `ifp->if_ioctl'
264 	 * but we aren't there yet.
265 	 */
266 	NET_UNLOCK();
267 
268 	switch (cmd) {
269 	case SIOCBRDGADD:
270 	/* bridge(4) does not distinguish between routing/forwarding ports */
271 	case SIOCBRDGADDL:
272 		if ((error = suser(curproc)) != 0)
273 			break;
274 
275 		ifs = ifunit(req->ifbr_ifsname);
276 		if (ifs == NULL) {			/* no such interface */
277 			error = ENOENT;
278 			break;
279 		}
280 		if (ifs->if_type != IFT_ETHER) {
281 			error = EINVAL;
282 			break;
283 		}
284 		if (ifs->if_bridgeidx != 0) {
285 			if (ifs->if_bridgeidx == ifp->if_index)
286 				error = EEXIST;
287 			else
288 				error = EBUSY;
289 			break;
290 		}
291 
292 		error = ether_brport_isset(ifs);
293 		if (error != 0)
294 			break;
295 
296 		/* If it's in the span list, it can't be a member. */
297 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
298 			if (bif->ifp == ifs)
299 				break;
300 		}
301 		if (bif != NULL) {
302 			error = EBUSY;
303 			break;
304 		}
305 
306 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
307 		if (bif == NULL) {
308 			error = ENOMEM;
309 			break;
310 		}
311 
312 		NET_LOCK();
313 		error = ifpromisc(ifs, 1);
314 		NET_UNLOCK();
315 		if (error != 0) {
316 			free(bif, M_DEVBUF, sizeof(*bif));
317 			break;
318 		}
319 
320 		/*
321 		 * XXX If the NET_LOCK() or ifpromisc() calls above
322 		 * had to sleep, then something else could have come
323 		 * along and taken over ifs while the kernel lock was
324 		 * released. Or worse, ifs could have been destroyed
325 		 * cos ifunit() is... optimistic.
326 		 */
327 
328 		bif->bridge_sc = sc;
329 		bif->ifp = ifs;
330 		bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
331 		SIMPLEQ_INIT(&bif->bif_brlin);
332 		SIMPLEQ_INIT(&bif->bif_brlout);
333 		ifs->if_bridgeidx = ifp->if_index;
334 		task_set(&bif->bif_dtask, bridge_ifdetach, bif);
335 		if_detachhook_add(ifs, &bif->bif_dtask);
336 		ether_brport_set(bif->ifp, &bridge_brport);
337 		SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_iflist, bif, bif_next);
338 		break;
339 	case SIOCBRDGDEL:
340 		if ((error = suser(curproc)) != 0)
341 			break;
342 		ifs = ifunit(req->ifbr_ifsname);
343 		if (ifs == NULL) {
344 			error = ENOENT;
345 			break;
346 		}
347 		if (ifs->if_bridgeidx != ifp->if_index) {
348 			error = ESRCH;
349 			break;
350 		}
351 		bif = bridge_getbif(ifs);
352 		bridge_ifremove(bif);
353 		break;
354 	case SIOCBRDGIFS:
355 		error = bridge_bifconf(sc, (struct ifbifconf *)data);
356 		break;
357 	case SIOCBRDGADDS:
358 		if ((error = suser(curproc)) != 0)
359 			break;
360 		ifs = ifunit(req->ifbr_ifsname);
361 		if (ifs == NULL) {			/* no such interface */
362 			error = ENOENT;
363 			break;
364 		}
365 		if (ifs->if_type != IFT_ETHER) {
366 			error = EINVAL;
367 			break;
368 		}
369 		if (ifs->if_bridgeidx != 0) {
370 			if (ifs->if_bridgeidx == ifp->if_index)
371 				error = EEXIST;
372 			else
373 				error = EBUSY;
374 			break;
375 		}
376 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
377 			if (bif->ifp == ifs)
378 				break;
379 		}
380 		if (bif != NULL) {
381 			error = EEXIST;
382 			break;
383 		}
384 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
385 		if (bif == NULL) {
386 			error = ENOMEM;
387 			break;
388 		}
389 		bif->bridge_sc = sc;
390 		bif->ifp = ifs;
391 		bif->bif_flags = IFBIF_SPAN;
392 		SIMPLEQ_INIT(&bif->bif_brlin);
393 		SIMPLEQ_INIT(&bif->bif_brlout);
394 		task_set(&bif->bif_dtask, bridge_spandetach, bif);
395 		if_detachhook_add(ifs, &bif->bif_dtask);
396 		SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_spanlist, bif, bif_next);
397 		break;
398 	case SIOCBRDGDELS:
399 		if ((error = suser(curproc)) != 0)
400 			break;
401 		ifs = ifunit(req->ifbr_ifsname);
402 		if (ifs == NULL) {
403 			error = ENOENT;
404 			break;
405 		}
406 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
407 			if (bif->ifp == ifs)
408 				break;
409 		}
410 		if (bif == NULL) {
411 			error = ESRCH;
412 			break;
413 		}
414 		bridge_spanremove(bif);
415 		break;
416 	case SIOCBRDGGIFFLGS:
417 		ifs = ifunit(req->ifbr_ifsname);
418 		if (ifs == NULL) {
419 			error = ENOENT;
420 			break;
421 		}
422 		if (ifs->if_bridgeidx != ifp->if_index) {
423 			error = ESRCH;
424 			break;
425 		}
426 		bif = bridge_getbif(ifs);
427 		req->ifbr_ifsflags = bif->bif_flags;
428 		req->ifbr_portno = bif->ifp->if_index & 0xfff;
429 		req->ifbr_protected = bif->bif_protected;
430 		if (bif->bif_flags & IFBIF_STP)
431 			bridge_bifgetstp(sc, bif, req);
432 		break;
433 	case SIOCBRDGSIFFLGS:
434 		if ((error = suser(curproc)) != 0)
435 			break;
436 		ifs = ifunit(req->ifbr_ifsname);
437 		if (ifs == NULL) {
438 			error = ENOENT;
439 			break;
440 		}
441 		if (ifs->if_bridgeidx != ifp->if_index) {
442 			error = ESRCH;
443 			break;
444 		}
445 		if (req->ifbr_ifsflags & IFBIF_RO_MASK) {
446 			error = EINVAL;
447 			break;
448 		}
449 		bif = bridge_getbif(ifs);
450 		if (req->ifbr_ifsflags & IFBIF_STP) {
451 			if ((bif->bif_flags & IFBIF_STP) == 0) {
452 				/* Enable STP */
453 				if ((bif->bif_stp = bstp_add(sc->sc_stp,
454 				    bif->ifp)) == NULL) {
455 					error = ENOMEM;
456 					break;
457 				}
458 			} else {
459 				/* Update STP flags */
460 				bstp_ifsflags(bif->bif_stp, req->ifbr_ifsflags);
461 			}
462 		} else if (bif->bif_flags & IFBIF_STP) {
463 			bstp_delete(bif->bif_stp);
464 			bif->bif_stp = NULL;
465 		}
466 		bif->bif_flags = req->ifbr_ifsflags;
467 		break;
468 	case SIOCSIFFLAGS:
469 		if ((ifp->if_flags & IFF_UP) == IFF_UP)
470 			bridge_init(sc);
471 
472 		if ((ifp->if_flags & IFF_UP) == 0)
473 			bridge_stop(sc);
474 
475 		break;
476 	case SIOCBRDGGPARAM:
477 		if ((bp = bs->bs_root_port) == NULL)
478 			brop->ifbop_root_port = 0;
479 		else
480 			brop->ifbop_root_port = bp->bp_ifindex;
481 		brop->ifbop_maxage = bs->bs_bridge_max_age >> 8;
482 		brop->ifbop_hellotime = bs->bs_bridge_htime >> 8;
483 		brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
484 		brop->ifbop_holdcount = bs->bs_txholdcount;
485 		brop->ifbop_priority = bs->bs_bridge_priority;
486 		brop->ifbop_protocol = bs->bs_protover;
487 		brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id;
488 		brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
489 		brop->ifbop_root_port = bs->bs_root_pv.pv_port_id;
490 		brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
491 		brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
492 		brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
493 		break;
494 	case SIOCBRDGSIFPROT:
495 		ifs = ifunit(req->ifbr_ifsname);
496 		if (ifs == NULL) {
497 			error = ENOENT;
498 			break;
499 		}
500 		if (ifs->if_bridgeidx != ifp->if_index) {
501 			error = ESRCH;
502 			break;
503 		}
504 		bif = bridge_getbif(ifs);
505 		bif->bif_protected = req->ifbr_protected;
506 		break;
507 	case SIOCBRDGRTS:
508 	case SIOCBRDGGCACHE:
509 	case SIOCBRDGGPRI:
510 	case SIOCBRDGGMA:
511 	case SIOCBRDGGHT:
512 	case SIOCBRDGGFD:
513 	case SIOCBRDGGTO:
514 	case SIOCBRDGGRL:
515 		break;
516 	case SIOCBRDGFLUSH:
517 	case SIOCBRDGSADDR:
518 	case SIOCBRDGDADDR:
519 	case SIOCBRDGSCACHE:
520 	case SIOCBRDGSTO:
521 	case SIOCBRDGARL:
522 	case SIOCBRDGFRL:
523 	case SIOCBRDGSPRI:
524 	case SIOCBRDGSFD:
525 	case SIOCBRDGSMA:
526 	case SIOCBRDGSHT:
527 	case SIOCBRDGSTXHC:
528 	case SIOCBRDGSPROTO:
529 	case SIOCBRDGSIFPRIO:
530 	case SIOCBRDGSIFCOST:
531 		error = suser(curproc);
532 		break;
533 	default:
534 		error = ENOTTY;
535 		break;
536 	}
537 
538 	if (!error)
539 		error = bridgectl_ioctl(ifp, cmd, data);
540 
541 	if (!error)
542 		error = bstp_ioctl(ifp, cmd, data);
543 
544 	NET_LOCK();
545 	return (error);
546 }
547 
548 /* Detach an interface from a bridge.  */
549 int
550 bridge_ifremove(struct bridge_iflist *bif)
551 {
552 	struct bridge_softc *sc = bif->bridge_sc;
553 	int error;
554 
555 	SMR_SLIST_REMOVE_LOCKED(&sc->sc_iflist, bif, bridge_iflist, bif_next);
556 	if_detachhook_del(bif->ifp, &bif->bif_dtask);
557 	ether_brport_clr(bif->ifp);
558 
559 	smr_barrier();
560 
561 	if (bif->bif_flags & IFBIF_STP) {
562 		bstp_delete(bif->bif_stp);
563 		bif->bif_stp = NULL;
564 	}
565 
566 	bif->ifp->if_bridgeidx = 0;
567 	NET_LOCK();
568 	error = ifpromisc(bif->ifp, 0);
569 	NET_UNLOCK();
570 
571 	bridge_rtdelete(sc, bif->ifp, 0);
572 	bridge_flushrule(bif);
573 
574 	bif->ifp = NULL;
575 	free(bif, M_DEVBUF, sizeof(*bif));
576 
577 	return (error);
578 }
579 
580 void
581 bridge_spanremove(struct bridge_iflist *bif)
582 {
583 	struct bridge_softc *sc = bif->bridge_sc;
584 
585 	SMR_SLIST_REMOVE_LOCKED(&sc->sc_spanlist, bif, bridge_iflist, bif_next);
586 	if_detachhook_del(bif->ifp, &bif->bif_dtask);
587 
588 	smr_barrier();
589 
590 	bif->ifp = NULL;
591 	free(bif, M_DEVBUF, sizeof(*bif));
592 }
593 
594 void
595 bridge_ifdetach(void *xbif)
596 {
597 	struct bridge_iflist *bif = xbif;
598 
599 	/*
600 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
601 	 * use of smr_barrier() while holding the lock might lead to a
602 	 * deadlock situation.
603 	 */
604 	NET_UNLOCK();
605 	bridge_ifremove(bif);
606 	NET_LOCK();
607 }
608 
609 void
610 bridge_spandetach(void *xbif)
611 {
612 	struct bridge_iflist *bif = xbif;
613 
614 	/*
615 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
616 	 * use of smr_barrier() while holding the lock might lead to a
617 	 * deadlock situation.
618 	 */
619 	NET_UNLOCK();
620 	bridge_spanremove(bif);
621 	NET_LOCK();
622 }
623 
624 void
625 bridge_bifgetstp(struct bridge_softc *sc, struct bridge_iflist *bif,
626     struct ifbreq *breq)
627 {
628 	struct bstp_state *bs = sc->sc_stp;
629 	struct bstp_port *bp = bif->bif_stp;
630 
631 	breq->ifbr_state = bstp_getstate(bs, bp);
632 	breq->ifbr_priority = bp->bp_priority;
633 	breq->ifbr_path_cost = bp->bp_path_cost;
634 	breq->ifbr_proto = bp->bp_protover;
635 	breq->ifbr_role = bp->bp_role;
636 	breq->ifbr_stpflags = bp->bp_flags;
637 	breq->ifbr_fwd_trans = bp->bp_forward_transitions;
638 	breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id;
639 	breq->ifbr_root_cost = bs->bs_root_pv.pv_cost;
640 	breq->ifbr_root_port = bs->bs_root_pv.pv_port_id;
641 	breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
642 	breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id;
643 
644 	/* Copy STP state options as flags */
645 	if (bp->bp_operedge)
646 		breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
647 	if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
648 		breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
649 	if (bp->bp_ptp_link)
650 		breq->ifbr_ifsflags |= IFBIF_BSTP_PTP;
651 	if (bp->bp_flags & BSTP_PORT_AUTOPTP)
652 		breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
653 }
654 
655 int
656 bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc)
657 {
658 	struct bridge_iflist *bif;
659 	u_int32_t total = 0, i = 0;
660 	int error = 0;
661 	struct ifbreq *breq, *breqs = NULL;
662 
663 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)
664 		total++;
665 
666 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)
667 		total++;
668 
669 	if (bifc->ifbic_len == 0) {
670 		i = total;
671 		goto done;
672 	}
673 
674 	breqs = mallocarray(total, sizeof(*breqs), M_TEMP, M_NOWAIT|M_ZERO);
675 	if (breqs == NULL)
676 		goto done;
677 
678 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
679 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
680 			break;
681 		breq = &breqs[i];
682 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
683 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
684 		breq->ifbr_ifsflags = bif->bif_flags;
685 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
686 		breq->ifbr_protected = bif->bif_protected;
687 		if (bif->bif_flags & IFBIF_STP)
688 			bridge_bifgetstp(sc, bif, breq);
689 		i++;
690 	}
691 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
692 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
693 			break;
694 		breq = &breqs[i];
695 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
696 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
697 		breq->ifbr_ifsflags = bif->bif_flags | IFBIF_SPAN;
698 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
699 		i++;
700 	}
701 
702 	error = copyout(breqs, bifc->ifbic_req, i * sizeof(*breqs));
703 done:
704 	free(breqs, M_TEMP, total * sizeof(*breq));
705 	bifc->ifbic_len = i * sizeof(*breq);
706 	return (error);
707 }
708 
709 struct bridge_iflist *
710 bridge_getbif(struct ifnet *ifp)
711 {
712 	struct bridge_iflist *bif;
713 	struct bridge_softc *sc;
714 	struct ifnet *bifp;
715 
716 	KERNEL_ASSERT_LOCKED();
717 
718 	bifp = if_get(ifp->if_bridgeidx);
719 	if (bifp == NULL)
720 		return (NULL);
721 
722 	sc = bifp->if_softc;
723 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
724 		if (bif->ifp == ifp)
725 			break;
726 	}
727 
728 	if_put(bifp);
729 
730 	return (bif);
731 }
732 
733 void
734 bridge_init(struct bridge_softc *sc)
735 {
736 	struct ifnet *ifp = &sc->sc_if;
737 
738 	if (ISSET(ifp->if_flags, IFF_RUNNING))
739 		return;
740 
741 	bstp_enable(sc->sc_stp, ifp->if_index);
742 
743 	if (sc->sc_brttimeout != 0)
744 		timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
745 
746 	SET(ifp->if_flags, IFF_RUNNING);
747 }
748 
749 /*
750  * Stop the bridge and deallocate the routing table.
751  */
752 void
753 bridge_stop(struct bridge_softc *sc)
754 {
755 	struct ifnet *ifp = &sc->sc_if;
756 
757 	if (!ISSET(ifp->if_flags, IFF_RUNNING))
758 		return;
759 
760 	CLR(ifp->if_flags, IFF_RUNNING);
761 
762 	bstp_disable(sc->sc_stp);
763 
764 	timeout_del_barrier(&sc->sc_brtimeout);
765 
766 	bridge_rtflush(sc, IFBF_FLUSHDYN);
767 }
768 
769 /*
770  * Send output from the bridge.  The mbuf has the ethernet header
771  * already attached.  We must enqueue or free the mbuf before exiting.
772  */
773 int
774 bridge_enqueue(struct ifnet *ifp, struct mbuf *m)
775 {
776 	struct ifnet *brifp;
777 	struct ether_header *eh;
778 	struct ifnet *dst_if = NULL;
779 	unsigned int dst_ifidx = 0;
780 #if NBPFILTER > 0
781 	caddr_t if_bpf;
782 #endif
783 	int error = 0;
784 
785 	if (m->m_len < sizeof(*eh)) {
786 		m = m_pullup(m, sizeof(*eh));
787 		if (m == NULL)
788 			return (ENOBUFS);
789 	}
790 
791 	/* ifp must be a member interface of the bridge. */
792 	brifp = if_get(ifp->if_bridgeidx);
793 	if (brifp == NULL) {
794 		m_freem(m);
795 		return (EINVAL);
796 	}
797 
798 	/*
799 	 * If bridge is down, but original output interface is up,
800 	 * go ahead and send out that interface.  Otherwise the packet
801 	 * is dropped below.
802 	 */
803 	if (!ISSET(brifp->if_flags, IFF_RUNNING)) {
804 		/* Loop prevention. */
805 		m->m_flags |= M_PROTO1;
806 		error = if_enqueue(ifp, m);
807 		if_put(brifp);
808 		return (error);
809 	}
810 
811 #if NBPFILTER > 0
812 	if_bpf = brifp->if_bpf;
813 	if (if_bpf)
814 		bpf_mtap(if_bpf, m, BPF_DIRECTION_OUT);
815 #endif
816 	ifp->if_opackets++;
817 	ifp->if_obytes += m->m_pkthdr.len;
818 
819 	bridge_span(brifp, m);
820 
821 	eh = mtod(m, struct ether_header *);
822 	if (!ETHER_IS_MULTICAST(eh->ether_dhost)) {
823 		struct ether_addr *dst;
824 
825 		dst = (struct ether_addr *)&eh->ether_dhost[0];
826 		dst_ifidx = bridge_rtlookup(brifp, dst, m);
827 	}
828 
829 	/*
830 	 * If the packet is a broadcast or we don't know a better way to
831 	 * get there, send to all interfaces.
832 	 */
833 	if (dst_ifidx == 0) {
834 		struct bridge_softc *sc = brifp->if_softc;
835 		struct bridge_iflist *bif;
836 		struct mbuf *mc;
837 
838 		smr_read_enter();
839 		SMR_SLIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
840 			dst_if = bif->ifp;
841 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
842 				continue;
843 
844 			/*
845 			 * If this is not the original output interface,
846 			 * and the interface is participating in spanning
847 			 * tree, make sure the port is in a state that
848 			 * allows forwarding.
849 			 */
850 			if (dst_if != ifp &&
851 			    (bif->bif_flags & IFBIF_STP) &&
852 			    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
853 				continue;
854 			if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
855 			    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
856 				continue;
857 
858 			if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
859 			    BRL_ACTION_BLOCK)
860 				continue;
861 
862 			mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
863 			if (mc == NULL) {
864 				brifp->if_oerrors++;
865 				continue;
866 			}
867 
868 			error = bridge_ifenqueue(brifp, dst_if, mc);
869 			if (error)
870 				continue;
871 		}
872 		smr_read_leave();
873 		m_freem(m);
874 		goto out;
875 	}
876 
877 	dst_if = if_get(dst_ifidx);
878 	if ((dst_if == NULL) || !ISSET(dst_if->if_flags, IFF_RUNNING)) {
879 		m_freem(m);
880 		if_put(dst_if);
881 		error = ENETDOWN;
882 		goto out;
883 	}
884 
885 	bridge_ifenqueue(brifp, dst_if, m);
886 	if_put(dst_if);
887 out:
888 	if_put(brifp);
889 	return (error);
890 }
891 
892 /*
893  * Loop through each bridge interface and process their input queues.
894  */
895 void
896 bridgeintr(void)
897 {
898 	struct mbuf_list ml;
899 	struct mbuf *m;
900 	struct ifnet *ifp;
901 
902 	niq_delist(&bridgeintrq, &ml);
903 	if (ml_empty(&ml))
904 		return;
905 
906 	KERNEL_LOCK();
907 	while ((m = ml_dequeue(&ml)) != NULL) {
908 
909 		ifp = if_get(m->m_pkthdr.ph_ifidx);
910 		if (ifp == NULL) {
911 			m_freem(m);
912 			continue;
913 		}
914 
915 		bridge_process(ifp, m);
916 
917 		if_put(ifp);
918 	}
919 	KERNEL_UNLOCK();
920 }
921 
922 /*
923  * Process a single frame.  Frame must be freed or queued before returning.
924  */
925 void
926 bridgeintr_frame(struct ifnet *brifp, struct ifnet *src_if, struct mbuf *m)
927 {
928 	struct bridge_softc *sc = brifp->if_softc;
929 	struct ifnet *dst_if = NULL;
930 	struct bridge_iflist *bif;
931 	struct ether_addr *dst, *src;
932 	struct ether_header eh;
933 	unsigned int dst_ifidx;
934 	u_int32_t protected;
935 	int len;
936 
937 
938 	sc->sc_if.if_ipackets++;
939 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
940 
941 	bif = bridge_getbif(src_if);
942 	KASSERT(bif != NULL);
943 
944 	m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&eh);
945 	dst = (struct ether_addr *)&eh.ether_dhost[0];
946 	src = (struct ether_addr *)&eh.ether_shost[0];
947 
948 	/*
949 	 * If interface is learning, and if source address
950 	 * is not broadcast or multicast, record its address.
951 	 */
952 	if ((bif->bif_flags & IFBIF_LEARNING) &&
953 	    !ETHER_IS_MULTICAST(eh.ether_shost) &&
954 	    !ETHER_IS_ANYADDR(eh.ether_shost))
955 		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m);
956 
957 	if ((bif->bif_flags & IFBIF_STP) &&
958 	    (bif->bif_state == BSTP_IFSTATE_LEARNING)) {
959 		m_freem(m);
960 		return;
961 	}
962 
963 	/*
964 	 * At this point, the port either doesn't participate in stp or
965 	 * it's in the forwarding state
966 	 */
967 
968 	/*
969 	 * If packet is unicast, destined for someone on "this"
970 	 * side of the bridge, drop it.
971 	 */
972 	if (!ETHER_IS_MULTICAST(eh.ether_dhost)) {
973 		dst_ifidx = bridge_rtlookup(brifp, dst, NULL);
974 		if (dst_ifidx == src_if->if_index) {
975 			m_freem(m);
976 			return;
977 		}
978 	} else {
979 		if (ETHER_IS_BROADCAST(eh.ether_dhost))
980 			m->m_flags |= M_BCAST;
981 		else
982 			m->m_flags |= M_MCAST;
983 	}
984 
985 	/*
986 	 * Multicast packets get handled a little differently:
987 	 * If interface is:
988 	 *	-link0,-link1	(default) Forward all multicast
989 	 *			as broadcast.
990 	 *	-link0,link1	Drop non-IP multicast, forward
991 	 *			as broadcast IP multicast.
992 	 *	link0,-link1	Drop IP multicast, forward as
993 	 *			broadcast non-IP multicast.
994 	 *	link0,link1	Drop all multicast.
995 	 */
996 	if (m->m_flags & M_MCAST) {
997 		if ((sc->sc_if.if_flags &
998 		    (IFF_LINK0 | IFF_LINK1)) ==
999 		    (IFF_LINK0 | IFF_LINK1)) {
1000 			m_freem(m);
1001 			return;
1002 		}
1003 		if (sc->sc_if.if_flags & IFF_LINK0 &&
1004 		    ETHERADDR_IS_IP_MCAST(dst)) {
1005 			m_freem(m);
1006 			return;
1007 		}
1008 		if (sc->sc_if.if_flags & IFF_LINK1 &&
1009 		    !ETHERADDR_IS_IP_MCAST(dst)) {
1010 			m_freem(m);
1011 			return;
1012 		}
1013 	}
1014 
1015 	if (bif->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) {
1016 		m_freem(m);
1017 		return;
1018 	}
1019 
1020 	if (bridge_filterrule(&bif->bif_brlin, &eh, m) == BRL_ACTION_BLOCK) {
1021 		m_freem(m);
1022 		return;
1023 	}
1024 	m = bridge_ip(&sc->sc_if, BRIDGE_IN, src_if, &eh, m);
1025 	if (m == NULL)
1026 		return;
1027 	/*
1028 	 * If the packet is a multicast or broadcast OR if we don't
1029 	 * know any better, forward it to all interfaces.
1030 	 */
1031 	if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_ifidx == 0) {
1032 		sc->sc_if.if_imcasts++;
1033 		bridge_broadcast(sc, src_if, &eh, m);
1034 		return;
1035 	}
1036 	protected = bif->bif_protected;
1037 
1038 	dst_if = if_get(dst_ifidx);
1039 	if (dst_if == NULL)
1040 		goto bad;
1041 
1042 	/*
1043 	 * At this point, we're dealing with a unicast frame going to a
1044 	 * different interface
1045 	 */
1046 	if (!ISSET(dst_if->if_flags, IFF_RUNNING))
1047 		goto bad;
1048 	bif = bridge_getbif(dst_if);
1049 	if ((bif == NULL) || ((bif->bif_flags & IFBIF_STP) &&
1050 	    (bif->bif_state == BSTP_IFSTATE_DISCARDING)))
1051 		goto bad;
1052 	/*
1053 	 * Do not transmit if both ports are part of the same protected
1054 	 * domain.
1055 	 */
1056 	if (protected != 0 && (protected & bif->bif_protected))
1057 		goto bad;
1058 	if (bridge_filterrule(&bif->bif_brlout, &eh, m) == BRL_ACTION_BLOCK)
1059 		goto bad;
1060 	m = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, &eh, m);
1061 	if (m == NULL)
1062 		goto bad;
1063 
1064 	len = m->m_pkthdr.len;
1065 #if NVLAN > 0
1066 	if ((m->m_flags & M_VLANTAG) &&
1067 	    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1068 		len += ETHER_VLAN_ENCAP_LEN;
1069 #endif
1070 	if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1071 		bridge_fragment(&sc->sc_if, dst_if, &eh, m);
1072 	else {
1073 		bridge_ifenqueue(&sc->sc_if, dst_if, m);
1074 	}
1075 	m = NULL;
1076 bad:
1077 	if_put(dst_if);
1078 	m_freem(m);
1079 }
1080 
1081 /*
1082  * Return 1 if `ena' belongs to `bif', 0 otherwise.
1083  */
1084 int
1085 bridge_ourether(struct ifnet *ifp, uint8_t *ena)
1086 {
1087 	struct arpcom *ac = (struct arpcom *)ifp;
1088 
1089 	if (memcmp(ac->ac_enaddr, ena, ETHER_ADDR_LEN) == 0)
1090 		return (1);
1091 
1092 #if NCARP > 0
1093 	if (carp_ourether(ifp, ena))
1094 		return (1);
1095 #endif
1096 
1097 	return (0);
1098 }
1099 
1100 /*
1101  * Receive input from an interface.  Queue the packet for bridging if its
1102  * not for us, and schedule an interrupt.
1103  */
1104 struct mbuf *
1105 bridge_input(struct ifnet *ifp, struct mbuf *m, void *null)
1106 {
1107 	KASSERT(m->m_flags & M_PKTHDR);
1108 
1109 	if (m->m_flags & M_PROTO1) {
1110 		m->m_flags &= ~M_PROTO1;
1111 		return (m);
1112 	}
1113 
1114 	niq_enqueue(&bridgeintrq, m);
1115 
1116 	return (NULL);
1117 }
1118 
1119 void
1120 bridge_process(struct ifnet *ifp, struct mbuf *m)
1121 {
1122 	struct ifnet *brifp;
1123 	struct bridge_softc *sc;
1124 	struct bridge_iflist *bif = NULL, *bif0 = NULL;
1125 	struct ether_header *eh;
1126 	struct mbuf *mc;
1127 #if NBPFILTER > 0
1128 	caddr_t if_bpf;
1129 #endif
1130 
1131 	KERNEL_ASSERT_LOCKED();
1132 
1133 	brifp = if_get(ifp->if_bridgeidx);
1134 	if ((brifp == NULL) || !ISSET(brifp->if_flags, IFF_RUNNING))
1135 		goto reenqueue;
1136 
1137 	if (m->m_pkthdr.len < sizeof(*eh))
1138 		goto bad;
1139 
1140 #if NVLAN > 0
1141 	/*
1142 	 * If the underlying interface removed the VLAN header itself,
1143 	 * add it back.
1144 	 */
1145 	if (ISSET(m->m_flags, M_VLANTAG)) {
1146 		m = vlan_inject(m, ETHERTYPE_VLAN, m->m_pkthdr.ether_vtag);
1147 		if (m == NULL)
1148 			goto bad;
1149 	}
1150 #endif
1151 
1152 #if NBPFILTER > 0
1153 	if_bpf = brifp->if_bpf;
1154 	if (if_bpf)
1155 		bpf_mtap_ether(if_bpf, m, BPF_DIRECTION_IN);
1156 #endif
1157 
1158 	eh = mtod(m, struct ether_header *);
1159 
1160 	sc = brifp->if_softc;
1161 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1162 		if (bridge_ourether(bif->ifp, eh->ether_shost))
1163 			goto bad;
1164 		if (bif->ifp == ifp)
1165 			bif0 = bif;
1166 	}
1167 	if (bif0 == NULL)
1168 		goto reenqueue;
1169 
1170 	bridge_span(brifp, m);
1171 
1172 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1173 		/*
1174 		 * Reserved destination MAC addresses (01:80:C2:00:00:0x)
1175 		 * should not be forwarded to bridge members according to
1176 		 * section 7.12.6 of the 802.1D-2004 specification.  The
1177 		 * STP destination address (as stored in bstp_etheraddr)
1178 		 * is the first of these.
1179 		 */
1180 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1181 		    ETHER_ADDR_LEN - 1) == 0) {
1182 			if (eh->ether_dhost[ETHER_ADDR_LEN - 1] == 0) {
1183 				/* STP traffic */
1184 				m = bstp_input(sc->sc_stp, bif0->bif_stp, eh,
1185 				    m);
1186 				if (m == NULL)
1187 					goto bad;
1188 			} else if (eh->ether_dhost[ETHER_ADDR_LEN - 1] <= 0xf)
1189 				goto bad;
1190 		}
1191 
1192 		/*
1193 		 * No need to process frames for ifs in the discarding state
1194 		 */
1195 		if ((bif0->bif_flags & IFBIF_STP) &&
1196 		    (bif0->bif_state == BSTP_IFSTATE_DISCARDING))
1197 			goto reenqueue;
1198 
1199 		mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1200 		if (mc == NULL)
1201 			goto reenqueue;
1202 
1203 		bridge_ifinput(ifp, mc);
1204 
1205 		bridgeintr_frame(brifp, ifp, m);
1206 		if_put(brifp);
1207 		return;
1208 	}
1209 
1210 	/*
1211 	 * Unicast, make sure it's not for us.
1212 	 */
1213 	if (bridge_ourether(bif0->ifp, eh->ether_dhost)) {
1214 		bif = bif0;
1215 	} else {
1216 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1217 			if (bif->ifp == ifp)
1218 				continue;
1219 			if (bridge_ourether(bif->ifp, eh->ether_dhost))
1220 				break;
1221 		}
1222 	}
1223 	if (bif != NULL) {
1224 		if (bif0->bif_flags & IFBIF_LEARNING)
1225 			bridge_rtupdate(sc,
1226 			    (struct ether_addr *)&eh->ether_shost,
1227 			    ifp, 0, IFBAF_DYNAMIC, m);
1228 		if (bridge_filterrule(&bif0->bif_brlin, eh, m) ==
1229 		    BRL_ACTION_BLOCK) {
1230 			goto bad;
1231 		}
1232 
1233 		/* Count for the bridge */
1234 		brifp->if_ipackets++;
1235 		brifp->if_ibytes += m->m_pkthdr.len;
1236 
1237 		ifp = bif->ifp;
1238 		goto reenqueue;
1239 	}
1240 
1241 	bridgeintr_frame(brifp, ifp, m);
1242 	if_put(brifp);
1243 	return;
1244 
1245 reenqueue:
1246 	bridge_ifinput(ifp, m);
1247 	m = NULL;
1248 bad:
1249 	m_freem(m);
1250 	if_put(brifp);
1251 }
1252 
1253 /*
1254  * Send a frame to all interfaces that are members of the bridge
1255  * (except the one it came in on).
1256  */
1257 void
1258 bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp,
1259     struct ether_header *eh, struct mbuf *m)
1260 {
1261 	struct bridge_iflist *bif;
1262 	struct mbuf *mc;
1263 	struct ifnet *dst_if;
1264 	int len, used = 0;
1265 	u_int32_t protected;
1266 
1267 	bif = bridge_getbif(ifp);
1268 	KASSERT(bif != NULL);
1269 	protected = bif->bif_protected;
1270 
1271 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1272 		dst_if = bif->ifp;
1273 
1274 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1275 			continue;
1276 
1277 		if ((bif->bif_flags & IFBIF_STP) &&
1278 		    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
1279 			continue;
1280 
1281 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1282 		    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1283 			continue;
1284 
1285 		/* Drop non-IP frames if the appropriate flag is set. */
1286 		if (bif->bif_flags & IFBIF_BLOCKNONIP &&
1287 		    bridge_blocknonip(eh, m))
1288 			continue;
1289 
1290 		/*
1291 		 * Do not transmit if both ports are part of the same
1292 		 * protected domain.
1293 		 */
1294 		if (protected != 0 && (protected & bif->bif_protected))
1295 			continue;
1296 
1297 		if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
1298 		    BRL_ACTION_BLOCK)
1299 			continue;
1300 
1301 		/*
1302 		 * Don't retransmit out of the same interface where
1303 		 * the packet was received from.
1304 		 */
1305 		if (dst_if->if_index == ifp->if_index)
1306 			continue;
1307 
1308 		if (bridge_localbroadcast(dst_if, eh, m))
1309 			sc->sc_if.if_oerrors++;
1310 
1311 		/* If last one, reuse the passed-in mbuf */
1312 		if (SMR_SLIST_NEXT_LOCKED(bif, bif_next) == NULL) {
1313 			mc = m;
1314 			used = 1;
1315 		} else {
1316 			mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1317 			if (mc == NULL) {
1318 				sc->sc_if.if_oerrors++;
1319 				continue;
1320 			}
1321 		}
1322 
1323 		mc = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, eh, mc);
1324 		if (mc == NULL)
1325 			continue;
1326 
1327 		len = mc->m_pkthdr.len;
1328 #if NVLAN > 0
1329 		if ((mc->m_flags & M_VLANTAG) &&
1330 		    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1331 			len += ETHER_VLAN_ENCAP_LEN;
1332 #endif
1333 		if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1334 			bridge_fragment(&sc->sc_if, dst_if, eh, mc);
1335 		else {
1336 			bridge_ifenqueue(&sc->sc_if, dst_if, mc);
1337 		}
1338 	}
1339 
1340 	if (!used)
1341 		m_freem(m);
1342 }
1343 
1344 int
1345 bridge_localbroadcast(struct ifnet *ifp, struct ether_header *eh,
1346     struct mbuf *m)
1347 {
1348 	struct mbuf *m1;
1349 	u_int16_t etype;
1350 
1351 	/*
1352 	 * quick optimisation, don't send packets up the stack if no
1353 	 * corresponding address has been specified.
1354 	 */
1355 	etype = ntohs(eh->ether_type);
1356 	if (!(m->m_flags & M_VLANTAG) && etype == ETHERTYPE_IP) {
1357 		struct ifaddr *ifa;
1358 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1359 			if (ifa->ifa_addr->sa_family == AF_INET)
1360 				break;
1361 		}
1362 		if (ifa == NULL)
1363 			return (0);
1364 	}
1365 
1366 	m1 = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1367 	if (m1 == NULL)
1368 		return (1);
1369 
1370 #if NPF > 0
1371 	pf_pkt_addr_changed(m1);
1372 #endif	/* NPF */
1373 
1374 	bridge_ifinput(ifp, m1);
1375 
1376 	return (0);
1377 }
1378 
1379 void
1380 bridge_span(struct ifnet *brifp, struct mbuf *m)
1381 {
1382 	struct bridge_softc *sc = brifp->if_softc;
1383 	struct bridge_iflist *bif;
1384 	struct ifnet *ifp;
1385 	struct mbuf *mc;
1386 	int error;
1387 
1388 	smr_read_enter();
1389 	SMR_SLIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1390 		ifp = bif->ifp;
1391 
1392 		if ((ifp->if_flags & IFF_RUNNING) == 0)
1393 			continue;
1394 
1395 		mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1396 		if (mc == NULL) {
1397 			brifp->if_oerrors++;
1398 			continue;
1399 		}
1400 
1401 		error = bridge_ifenqueue(brifp, ifp, mc);
1402 		if (error)
1403 			continue;
1404 	}
1405 	smr_read_leave();
1406 }
1407 
1408 /*
1409  * Block non-ip frames:
1410  * Returns 0 if frame is ip, and 1 if it should be dropped.
1411  */
1412 int
1413 bridge_blocknonip(struct ether_header *eh, struct mbuf *m)
1414 {
1415 	struct llc llc;
1416 	u_int16_t etype;
1417 
1418 	if (m->m_pkthdr.len < ETHER_HDR_LEN)
1419 		return (1);
1420 
1421 #if NVLAN > 0
1422 	if (m->m_flags & M_VLANTAG)
1423 		return (1);
1424 #endif
1425 
1426 	etype = ntohs(eh->ether_type);
1427 	switch (etype) {
1428 	case ETHERTYPE_ARP:
1429 	case ETHERTYPE_REVARP:
1430 	case ETHERTYPE_IP:
1431 	case ETHERTYPE_IPV6:
1432 		return (0);
1433 	}
1434 
1435 	if (etype > ETHERMTU)
1436 		return (1);
1437 
1438 	if (m->m_pkthdr.len <
1439 	    (ETHER_HDR_LEN + LLC_SNAPFRAMELEN))
1440 		return (1);
1441 
1442 	m_copydata(m, ETHER_HDR_LEN, LLC_SNAPFRAMELEN,
1443 	    (caddr_t)&llc);
1444 
1445 	etype = ntohs(llc.llc_snap.ether_type);
1446 	if (llc.llc_dsap == LLC_SNAP_LSAP &&
1447 	    llc.llc_ssap == LLC_SNAP_LSAP &&
1448 	    llc.llc_control == LLC_UI &&
1449 	    llc.llc_snap.org_code[0] == 0 &&
1450 	    llc.llc_snap.org_code[1] == 0 &&
1451 	    llc.llc_snap.org_code[2] == 0 &&
1452 	    (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
1453 	    etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)) {
1454 		return (0);
1455 	}
1456 
1457 	return (1);
1458 }
1459 
1460 #ifdef IPSEC
1461 int
1462 bridge_ipsec(struct ifnet *ifp, struct ether_header *eh, int hassnap,
1463     struct llc *llc, int dir, int af, int hlen, struct mbuf *m)
1464 {
1465 	union sockaddr_union dst;
1466 	struct tdb *tdb;
1467 	u_int32_t spi;
1468 	u_int16_t cpi;
1469 	int error, off;
1470 	u_int8_t proto = 0;
1471 	struct ip *ip;
1472 #ifdef INET6
1473 	struct ip6_hdr *ip6;
1474 #endif /* INET6 */
1475 #if NPF > 0
1476 	struct ifnet *encif;
1477 #endif
1478 
1479 	if (dir == BRIDGE_IN) {
1480 		switch (af) {
1481 		case AF_INET:
1482 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1483 				goto skiplookup;
1484 
1485 			ip = mtod(m, struct ip *);
1486 			proto = ip->ip_p;
1487 			off = offsetof(struct ip, ip_p);
1488 
1489 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1490 			    proto != IPPROTO_IPCOMP)
1491 				goto skiplookup;
1492 
1493 			bzero(&dst, sizeof(union sockaddr_union));
1494 			dst.sa.sa_family = AF_INET;
1495 			dst.sin.sin_len = sizeof(struct sockaddr_in);
1496 			m_copydata(m, offsetof(struct ip, ip_dst),
1497 			    sizeof(struct in_addr),
1498 			    (caddr_t)&dst.sin.sin_addr);
1499 
1500 			break;
1501 #ifdef INET6
1502 		case AF_INET6:
1503 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1504 				goto skiplookup;
1505 
1506 			ip6 = mtod(m, struct ip6_hdr *);
1507 
1508 			/* XXX We should chase down the header chain */
1509 			proto = ip6->ip6_nxt;
1510 			off = offsetof(struct ip6_hdr, ip6_nxt);
1511 
1512 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1513 			    proto != IPPROTO_IPCOMP)
1514 				goto skiplookup;
1515 
1516 			bzero(&dst, sizeof(union sockaddr_union));
1517 			dst.sa.sa_family = AF_INET6;
1518 			dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1519 			m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
1520 			    sizeof(struct in6_addr),
1521 			    (caddr_t)&dst.sin6.sin6_addr);
1522 
1523 			break;
1524 #endif /* INET6 */
1525 		default:
1526 			return (0);
1527 		}
1528 
1529 		switch (proto) {
1530 		case IPPROTO_ESP:
1531 			m_copydata(m, hlen, sizeof(u_int32_t), (caddr_t)&spi);
1532 			break;
1533 		case IPPROTO_AH:
1534 			m_copydata(m, hlen + sizeof(u_int32_t),
1535 			    sizeof(u_int32_t), (caddr_t)&spi);
1536 			break;
1537 		case IPPROTO_IPCOMP:
1538 			m_copydata(m, hlen + sizeof(u_int16_t),
1539 			    sizeof(u_int16_t), (caddr_t)&cpi);
1540 			spi = ntohl(htons(cpi));
1541 			break;
1542 		}
1543 
1544 		NET_ASSERT_LOCKED();
1545 
1546 		tdb = gettdb(ifp->if_rdomain, spi, &dst, proto);
1547 		if (tdb != NULL && (tdb->tdb_flags & TDBF_INVALID) == 0 &&
1548 		    tdb->tdb_xform != NULL) {
1549 			if (tdb->tdb_first_use == 0) {
1550 				tdb->tdb_first_use = gettime();
1551 				if (tdb->tdb_flags & TDBF_FIRSTUSE)
1552 					timeout_add_sec(&tdb->tdb_first_tmo,
1553 					    tdb->tdb_exp_first_use);
1554 				if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE)
1555 					timeout_add_sec(&tdb->tdb_sfirst_tmo,
1556 					    tdb->tdb_soft_first_use);
1557 			}
1558 
1559 			(*(tdb->tdb_xform->xf_input))(m, tdb, hlen, off);
1560 			return (1);
1561 		} else {
1562  skiplookup:
1563 			/* XXX do an input policy lookup */
1564 			return (0);
1565 		}
1566 	} else { /* Outgoing from the bridge. */
1567 		tdb = ipsp_spd_lookup(m, af, hlen, &error,
1568 		    IPSP_DIRECTION_OUT, NULL, NULL, 0);
1569 		if (tdb != NULL) {
1570 			/*
1571 			 * We don't need to do loop detection, the
1572 			 * bridge will do that for us.
1573 			 */
1574 #if NPF > 0
1575 			if ((encif = enc_getif(tdb->tdb_rdomain,
1576 			    tdb->tdb_tap)) == NULL ||
1577 			    pf_test(af, dir, encif, &m) != PF_PASS) {
1578 				m_freem(m);
1579 				return (1);
1580 			}
1581 			if (m == NULL)
1582 				return (1);
1583 			else if (af == AF_INET)
1584 				in_proto_cksum_out(m, encif);
1585 #ifdef INET6
1586 			else if (af == AF_INET6)
1587 				in6_proto_cksum_out(m, encif);
1588 #endif /* INET6 */
1589 #endif /* NPF */
1590 
1591 			ip = mtod(m, struct ip *);
1592 			if ((af == AF_INET) &&
1593 			    ip_mtudisc && (ip->ip_off & htons(IP_DF)) &&
1594 			    tdb->tdb_mtu && ntohs(ip->ip_len) > tdb->tdb_mtu &&
1595 			    tdb->tdb_mtutimeout > gettime())
1596 				bridge_send_icmp_err(ifp, eh, m,
1597 				    hassnap, llc, tdb->tdb_mtu,
1598 				    ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1599 			else
1600 				error = ipsp_process_packet(m, tdb, af, 0);
1601 			return (1);
1602 		} else
1603 			return (0);
1604 	}
1605 
1606 	return (0);
1607 }
1608 #endif /* IPSEC */
1609 
1610 /*
1611  * Filter IP packets by peeking into the ethernet frame.  This violates
1612  * the ISO model, but allows us to act as a IP filter at the data link
1613  * layer.  As a result, most of this code will look familiar to those
1614  * who've read net/if_ethersubr.c and netinet/ip_input.c
1615  */
1616 struct mbuf *
1617 bridge_ip(struct ifnet *brifp, int dir, struct ifnet *ifp,
1618     struct ether_header *eh, struct mbuf *m)
1619 {
1620 	struct llc llc;
1621 	int hassnap = 0;
1622 	struct ip *ip;
1623 	int hlen;
1624 	u_int16_t etype;
1625 
1626 #if NVLAN > 0
1627 	if (m->m_flags & M_VLANTAG)
1628 		return (m);
1629 #endif
1630 
1631 	etype = ntohs(eh->ether_type);
1632 
1633 	if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) {
1634 		if (etype > ETHERMTU ||
1635 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1636 		    ETHER_HDR_LEN))
1637 			return (m);
1638 
1639 		m_copydata(m, ETHER_HDR_LEN,
1640 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1641 
1642 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1643 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1644 		    llc.llc_control != LLC_UI ||
1645 		    llc.llc_snap.org_code[0] ||
1646 		    llc.llc_snap.org_code[1] ||
1647 		    llc.llc_snap.org_code[2])
1648 			return (m);
1649 
1650 		etype = ntohs(llc.llc_snap.ether_type);
1651 		if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6)
1652 			return (m);
1653 		hassnap = 1;
1654 	}
1655 
1656 	m_adj(m, ETHER_HDR_LEN);
1657 	if (hassnap)
1658 		m_adj(m, LLC_SNAPFRAMELEN);
1659 
1660 	switch (etype) {
1661 
1662 	case ETHERTYPE_IP:
1663 		if (m->m_pkthdr.len < sizeof(struct ip))
1664 			goto dropit;
1665 
1666 		/* Copy minimal header, and drop invalids */
1667 		if (m->m_len < sizeof(struct ip) &&
1668 		    (m = m_pullup(m, sizeof(struct ip))) == NULL) {
1669 			ipstat_inc(ips_toosmall);
1670 			return (NULL);
1671 		}
1672 		ip = mtod(m, struct ip *);
1673 
1674 		if (ip->ip_v != IPVERSION) {
1675 			ipstat_inc(ips_badvers);
1676 			goto dropit;
1677 		}
1678 
1679 		hlen = ip->ip_hl << 2;	/* get whole header length */
1680 		if (hlen < sizeof(struct ip)) {
1681 			ipstat_inc(ips_badhlen);
1682 			goto dropit;
1683 		}
1684 
1685 		if (hlen > m->m_len) {
1686 			if ((m = m_pullup(m, hlen)) == NULL) {
1687 				ipstat_inc(ips_badhlen);
1688 				return (NULL);
1689 			}
1690 			ip = mtod(m, struct ip *);
1691 		}
1692 
1693 		if ((m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_OK) == 0) {
1694 			if (m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_BAD) {
1695 				ipstat_inc(ips_badsum);
1696 				goto dropit;
1697 			}
1698 
1699 			ipstat_inc(ips_inswcsum);
1700 			if (in_cksum(m, hlen) != 0) {
1701 				ipstat_inc(ips_badsum);
1702 				goto dropit;
1703 			}
1704 		}
1705 
1706 		if (ntohs(ip->ip_len) < hlen)
1707 			goto dropit;
1708 
1709 		if (m->m_pkthdr.len < ntohs(ip->ip_len))
1710 			goto dropit;
1711 		if (m->m_pkthdr.len > ntohs(ip->ip_len)) {
1712 			if (m->m_len == m->m_pkthdr.len) {
1713 				m->m_len = ntohs(ip->ip_len);
1714 				m->m_pkthdr.len = ntohs(ip->ip_len);
1715 			} else
1716 				m_adj(m, ntohs(ip->ip_len) - m->m_pkthdr.len);
1717 		}
1718 
1719 #ifdef IPSEC
1720 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1721 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET, hlen, m))
1722 			return (NULL);
1723 #endif /* IPSEC */
1724 #if NPF > 0
1725 		/* Finally, we get to filter the packet! */
1726 		if (pf_test(AF_INET, dir, ifp, &m) != PF_PASS)
1727 			goto dropit;
1728 		if (m == NULL)
1729 			goto dropit;
1730 #endif /* NPF > 0 */
1731 
1732 		/* Rebuild the IP header */
1733 		if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
1734 			return (NULL);
1735 		if (m->m_len < sizeof(struct ip))
1736 			goto dropit;
1737 		in_proto_cksum_out(m, ifp);
1738 		ip = mtod(m, struct ip *);
1739 		ip->ip_sum = 0;
1740 		if (0 && (ifp->if_capabilities & IFCAP_CSUM_IPv4))
1741 			m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
1742 		else {
1743 			ipstat_inc(ips_outswcsum);
1744 			ip->ip_sum = in_cksum(m, hlen);
1745 		}
1746 
1747 #if NPF > 0
1748 		if (dir == BRIDGE_IN &&
1749 		    m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1750 			m_resethdr(m);
1751 			m->m_pkthdr.ph_ifidx = ifp->if_index;
1752 			m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
1753 			ipv4_input(ifp, m);
1754 			return (NULL);
1755 		}
1756 #endif /* NPF > 0 */
1757 
1758 		break;
1759 
1760 #ifdef INET6
1761 	case ETHERTYPE_IPV6: {
1762 		struct ip6_hdr *ip6;
1763 
1764 		if (m->m_len < sizeof(struct ip6_hdr)) {
1765 			if ((m = m_pullup(m, sizeof(struct ip6_hdr)))
1766 			    == NULL) {
1767 				ip6stat_inc(ip6s_toosmall);
1768 				return (NULL);
1769 			}
1770 		}
1771 
1772 		ip6 = mtod(m, struct ip6_hdr *);
1773 
1774 		if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
1775 			ip6stat_inc(ip6s_badvers);
1776 			goto dropit;
1777 		}
1778 
1779 #ifdef IPSEC
1780 		hlen = sizeof(struct ip6_hdr);
1781 
1782 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1783 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET6, hlen,
1784 		    m))
1785 			return (NULL);
1786 #endif /* IPSEC */
1787 
1788 #if NPF > 0
1789 		if (pf_test(AF_INET6, dir, ifp, &m) != PF_PASS)
1790 			goto dropit;
1791 		if (m == NULL)
1792 			return (NULL);
1793 #endif /* NPF > 0 */
1794 		in6_proto_cksum_out(m, ifp);
1795 
1796 #if NPF > 0
1797 		if (dir == BRIDGE_IN &&
1798 		    m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1799 			m_resethdr(m);
1800 			m->m_pkthdr.ph_ifidx = ifp->if_index;
1801 			m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
1802 			ipv6_input(ifp, m);
1803 			return (NULL);
1804 		}
1805 #endif /* NPF > 0 */
1806 
1807 		break;
1808 	}
1809 #endif /* INET6 */
1810 
1811 	default:
1812 		goto dropit;
1813 		break;
1814 	}
1815 
1816 	/* Reattach SNAP header */
1817 	if (hassnap) {
1818 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1819 		if (m == NULL)
1820 			goto dropit;
1821 		bcopy(&llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
1822 	}
1823 
1824 	/* Reattach ethernet header */
1825 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1826 	if (m == NULL)
1827 		goto dropit;
1828 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1829 
1830 	return (m);
1831 
1832 dropit:
1833 	m_freem(m);
1834 	return (NULL);
1835 }
1836 
1837 void
1838 bridge_fragment(struct ifnet *brifp, struct ifnet *ifp, struct ether_header *eh,
1839     struct mbuf *m)
1840 {
1841 	struct llc llc;
1842 	struct mbuf *m0;
1843 	int error = 0;
1844 	int hassnap = 0;
1845 	u_int16_t etype;
1846 	struct ip *ip;
1847 
1848 	etype = ntohs(eh->ether_type);
1849 #if NVLAN > 0
1850 	if ((m->m_flags & M_VLANTAG) || etype == ETHERTYPE_VLAN ||
1851 	    etype == ETHERTYPE_QINQ) {
1852 		int len = m->m_pkthdr.len;
1853 
1854 		if (m->m_flags & M_VLANTAG)
1855 			len += ETHER_VLAN_ENCAP_LEN;
1856 		if ((ifp->if_capabilities & IFCAP_VLAN_MTU) &&
1857 		    (len - sizeof(struct ether_vlan_header) <= ifp->if_mtu)) {
1858 			bridge_ifenqueue(brifp, ifp, m);
1859 			return;
1860 		}
1861 		goto dropit;
1862 	}
1863 #endif
1864 	if (etype != ETHERTYPE_IP) {
1865 		if (etype > ETHERMTU ||
1866 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1867 		    ETHER_HDR_LEN))
1868 			goto dropit;
1869 
1870 		m_copydata(m, ETHER_HDR_LEN,
1871 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1872 
1873 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1874 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1875 		    llc.llc_control != LLC_UI ||
1876 		    llc.llc_snap.org_code[0] ||
1877 		    llc.llc_snap.org_code[1] ||
1878 		    llc.llc_snap.org_code[2] ||
1879 		    llc.llc_snap.ether_type != htons(ETHERTYPE_IP))
1880 			goto dropit;
1881 
1882 		hassnap = 1;
1883 	}
1884 
1885 	m_adj(m, ETHER_HDR_LEN);
1886 	if (hassnap)
1887 		m_adj(m, LLC_SNAPFRAMELEN);
1888 
1889 	if (m->m_len < sizeof(struct ip) &&
1890 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
1891 		goto dropit;
1892 	ip = mtod(m, struct ip *);
1893 
1894 	/* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */
1895 	if (ip->ip_off & htons(IP_DF)) {
1896 		bridge_send_icmp_err(ifp, eh, m, hassnap, &llc,
1897 		    ifp->if_mtu, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1898 		return;
1899 	}
1900 
1901 	error = ip_fragment(m, ifp, ifp->if_mtu);
1902 	if (error) {
1903 		m = NULL;
1904 		goto dropit;
1905 	}
1906 
1907 	for (; m; m = m0) {
1908 		m0 = m->m_nextpkt;
1909 		m->m_nextpkt = NULL;
1910 		if (error == 0) {
1911 			if (hassnap) {
1912 				M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1913 				if (m == NULL) {
1914 					error = ENOBUFS;
1915 					continue;
1916 				}
1917 				bcopy(&llc, mtod(m, caddr_t),
1918 				    LLC_SNAPFRAMELEN);
1919 			}
1920 			M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1921 			if (m == NULL) {
1922 				error = ENOBUFS;
1923 				continue;
1924 			}
1925 			bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1926 			error = bridge_ifenqueue(brifp, ifp, m);
1927 			if (error) {
1928 				continue;
1929 			}
1930 		} else
1931 			m_freem(m);
1932 	}
1933 
1934 	if (error == 0)
1935 		ipstat_inc(ips_fragmented);
1936 
1937 	return;
1938  dropit:
1939 	m_freem(m);
1940 }
1941 
1942 int
1943 bridge_ifenqueue(struct ifnet *brifp, struct ifnet *ifp, struct mbuf *m)
1944 {
1945 	int error, len;
1946 
1947 	/* Loop prevention. */
1948 	m->m_flags |= M_PROTO1;
1949 
1950 	len = m->m_pkthdr.len;
1951 
1952 	error = if_enqueue(ifp, m);
1953 	if (error) {
1954 		brifp->if_oerrors++;
1955 		return (error);
1956 	}
1957 
1958 	brifp->if_opackets++;
1959 	brifp->if_obytes += len;
1960 
1961 	return (0);
1962 }
1963 
1964 void
1965 bridge_ifinput(struct ifnet *ifp, struct mbuf *m)
1966 {
1967 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1968 
1969 	m->m_flags |= M_PROTO1;
1970 
1971 	ml_enqueue(&ml, m);
1972 	if_input(ifp, &ml);
1973 }
1974 
1975 void
1976 bridge_send_icmp_err(struct ifnet *ifp,
1977     struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc,
1978     int mtu, int type, int code)
1979 {
1980 	struct ip *ip;
1981 	struct icmp *icp;
1982 	struct in_addr t;
1983 	struct mbuf *m, *n2;
1984 	int hlen;
1985 	u_int8_t ether_tmp[ETHER_ADDR_LEN];
1986 
1987 	n2 = m_copym(n, 0, M_COPYALL, M_DONTWAIT);
1988 	if (!n2) {
1989 		m_freem(n);
1990 		return;
1991 	}
1992 	m = icmp_do_error(n, type, code, 0, mtu);
1993 	if (m == NULL) {
1994 		m_freem(n2);
1995 		return;
1996 	}
1997 
1998 	n = n2;
1999 
2000 	ip = mtod(m, struct ip *);
2001 	hlen = ip->ip_hl << 2;
2002 	t = ip->ip_dst;
2003 	ip->ip_dst = ip->ip_src;
2004 	ip->ip_src = t;
2005 
2006 	m->m_data += hlen;
2007 	m->m_len -= hlen;
2008 	icp = mtod(m, struct icmp *);
2009 	icp->icmp_cksum = 0;
2010 	icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
2011 	m->m_data -= hlen;
2012 	m->m_len += hlen;
2013 
2014 	ip->ip_v = IPVERSION;
2015 	ip->ip_off &= htons(IP_DF);
2016 	ip->ip_id = htons(ip_randomid());
2017 	ip->ip_ttl = MAXTTL;
2018 	ip->ip_sum = 0;
2019 	ip->ip_sum = in_cksum(m, hlen);
2020 
2021 	/* Swap ethernet addresses */
2022 	bcopy(&eh->ether_dhost, &ether_tmp, sizeof(ether_tmp));
2023 	bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp));
2024 	bcopy(&ether_tmp, &eh->ether_shost, sizeof(ether_tmp));
2025 
2026 	/* Reattach SNAP header */
2027 	if (hassnap) {
2028 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
2029 		if (m == NULL)
2030 			goto dropit;
2031 		bcopy(llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
2032 	}
2033 
2034 	/* Reattach ethernet header */
2035 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
2036 	if (m == NULL)
2037 		goto dropit;
2038 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
2039 
2040 	bridge_enqueue(ifp, m);
2041 	m_freem(n);
2042 	return;
2043 
2044  dropit:
2045 	m_freem(n);
2046 }
2047