xref: /openbsd-src/sys/net/if_bridge.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: if_bridge.c,v 1.225 2014/07/12 18:44:22 tedu Exp $	*/
2 
3 /*
4  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
19  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
25  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  *
28  * Effort sponsored in part by the Defense Advanced Research Projects
29  * Agency (DARPA) and Air Force Research Laboratory, Air Force
30  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
31  *
32  */
33 
34 #include "bpfilter.h"
35 #include "gif.h"
36 #include "pf.h"
37 #include "carp.h"
38 #include "vlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/timeout.h>
45 #include <sys/ioctl.h>
46 #include <sys/errno.h>
47 #include <sys/kernel.h>
48 
49 #include <net/if.h>
50 #include <net/if_types.h>
51 #include <net/if_llc.h>
52 #include <net/route.h>
53 #include <net/netisr.h>
54 
55 /* for arc4random() */
56 #include <dev/rndvar.h>
57 
58 #ifdef INET
59 #include <netinet/in.h>
60 #include <netinet/in_systm.h>
61 #include <netinet/ip.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/if_ether.h>
64 #include <netinet/ip_icmp.h>
65 #endif
66 
67 #ifdef IPSEC
68 #include <netinet/ip_ipsp.h>
69 #include <net/if_enc.h>
70 #endif
71 
72 #ifdef INET6
73 #include <netinet6/in6_var.h>
74 #include <netinet/ip6.h>
75 #include <netinet6/ip6_var.h>
76 #endif
77 
78 #if NPF > 0
79 #include <net/pfvar.h>
80 #define	BRIDGE_IN	PF_IN
81 #define	BRIDGE_OUT	PF_OUT
82 #else
83 #define	BRIDGE_IN	0
84 #define	BRIDGE_OUT	1
85 #endif
86 
87 #if NBPFILTER > 0
88 #include <net/bpf.h>
89 #endif
90 
91 #if NCARP > 0
92 #include <netinet/ip_carp.h>
93 #endif
94 
95 #if NVLAN > 0
96 #include <net/if_vlan_var.h>
97 #endif
98 
99 #include <net/if_bridge.h>
100 
101 /*
102  * Maximum number of addresses to cache
103  */
104 #ifndef	BRIDGE_RTABLE_MAX
105 #define	BRIDGE_RTABLE_MAX	100
106 #endif
107 
108 /*
109  * Timeout (in seconds) for entries learned dynamically
110  */
111 #ifndef	BRIDGE_RTABLE_TIMEOUT
112 #define	BRIDGE_RTABLE_TIMEOUT	240
113 #endif
114 
115 void	bridgeattach(int);
116 int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
117 void	bridge_start(struct ifnet *);
118 void	bridgeintr_frame(struct bridge_softc *, struct mbuf *);
119 void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
120     struct ether_header *, struct mbuf *);
121 void	bridge_localbroadcast(struct bridge_softc *, struct ifnet *,
122     struct ether_header *, struct mbuf *);
123 void	bridge_span(struct bridge_softc *, struct ether_header *,
124     struct mbuf *);
125 void	bridge_stop(struct bridge_softc *);
126 void	bridge_init(struct bridge_softc *);
127 int	bridge_bifconf(struct bridge_softc *, struct ifbifconf *);
128 
129 void	bridge_timer(void *);
130 int	bridge_rtfind(struct bridge_softc *, struct ifbaconf *);
131 void	bridge_rtage(struct bridge_softc *);
132 int	bridge_rtdaddr(struct bridge_softc *, struct ether_addr *);
133 void	bridge_rtflush(struct bridge_softc *, int);
134 struct ifnet *bridge_rtupdate(struct bridge_softc *,
135     struct ether_addr *, struct ifnet *ifp, int, u_int8_t, struct mbuf *);
136 struct bridge_rtnode *bridge_rtlookup(struct bridge_softc *,
137     struct ether_addr *);
138 u_int32_t	bridge_hash(struct bridge_softc *, struct ether_addr *);
139 int bridge_blocknonip(struct ether_header *, struct mbuf *);
140 int		bridge_addrule(struct bridge_iflist *,
141     struct ifbrlreq *, int out);
142 void	bridge_flushrule(struct bridge_iflist *);
143 int	bridge_brlconf(struct bridge_softc *, struct ifbrlconf *);
144 u_int8_t bridge_filterrule(struct brl_head *, struct ether_header *,
145     struct mbuf *);
146 struct mbuf *bridge_ip(struct bridge_softc *, int, struct ifnet *,
147     struct ether_header *, struct mbuf *m);
148 int	bridge_ifenqueue(struct bridge_softc *, struct ifnet *, struct mbuf *);
149 void	bridge_fragment(struct bridge_softc *, struct ifnet *,
150     struct ether_header *, struct mbuf *);
151 #ifdef INET
152 void	bridge_send_icmp_err(struct bridge_softc *, struct ifnet *,
153     struct ether_header *, struct mbuf *, int, struct llc *, int, int, int);
154 #endif
155 #ifdef IPSEC
156 int bridge_ipsec(struct bridge_softc *, struct ifnet *,
157     struct ether_header *, int, struct llc *,
158     int, int, int, struct mbuf *);
159 #define ICMP_DEFLEN MHLEN
160 #endif
161 int     bridge_clone_create(struct if_clone *, int);
162 int	bridge_clone_destroy(struct ifnet *ifp);
163 int	bridge_delete(struct bridge_softc *, struct bridge_iflist *);
164 void	bridge_copyaddr(struct sockaddr *, struct sockaddr *);
165 
166 #define	ETHERADDR_IS_IP_MCAST(a) \
167 	/* struct etheraddr *a;	*/				\
168 	((a)->ether_addr_octet[0] == 0x01 &&			\
169 	 (a)->ether_addr_octet[1] == 0x00 &&			\
170 	 (a)->ether_addr_octet[2] == 0x5e)
171 
172 LIST_HEAD(, bridge_softc) bridge_list;
173 
174 struct if_clone bridge_cloner =
175     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
176 
177 /* ARGSUSED */
178 void
179 bridgeattach(int n)
180 {
181 	LIST_INIT(&bridge_list);
182 	if_clone_attach(&bridge_cloner);
183 }
184 
185 int
186 bridge_clone_create(struct if_clone *ifc, int unit)
187 {
188 	struct bridge_softc *sc;
189 	struct ifnet *ifp;
190 	int i, s;
191 
192 	sc = malloc(sizeof(*sc), M_DEVBUF, M_NOWAIT|M_ZERO);
193 	if (!sc)
194 		return (ENOMEM);
195 
196 	sc->sc_stp = bstp_create(&sc->sc_if);
197 	if (!sc->sc_stp) {
198 		free(sc, M_DEVBUF, 0);
199 		return (ENOMEM);
200 	}
201 
202 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
203 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
204 	timeout_set(&sc->sc_brtimeout, bridge_timer, sc);
205 	TAILQ_INIT(&sc->sc_iflist);
206 	TAILQ_INIT(&sc->sc_spanlist);
207 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++)
208 		LIST_INIT(&sc->sc_rts[i]);
209 	sc->sc_hashkey = arc4random();
210 	ifp = &sc->sc_if;
211 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
212 	    unit);
213 	ifp->if_softc = sc;
214 	ifp->if_mtu = ETHERMTU;
215 	ifp->if_ioctl = bridge_ioctl;
216 	ifp->if_output = bridge_output;
217 	ifp->if_start = bridge_start;
218 	ifp->if_type = IFT_BRIDGE;
219 	ifp->if_hdrlen = ETHER_HDR_LEN;
220 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
221 	IFQ_SET_READY(&ifp->if_snd);
222 
223 	if_attach(ifp);
224 	if_alloc_sadl(ifp);
225 
226 #if NBPFILTER > 0
227 	bpfattach(&sc->sc_if.if_bpf, ifp,
228 	    DLT_EN10MB, ETHER_HDR_LEN);
229 #endif
230 
231 	s = splnet();
232 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
233 	splx(s);
234 
235 	return (0);
236 }
237 
238 int
239 bridge_clone_destroy(struct ifnet *ifp)
240 {
241 	struct bridge_softc *sc = ifp->if_softc;
242 	struct bridge_iflist *bif;
243 	int s;
244 
245 	bridge_stop(sc);
246 	bridge_rtflush(sc, IFBF_FLUSHALL);
247 	while ((bif = TAILQ_FIRST(&sc->sc_iflist)) != NULL)
248 		bridge_delete(sc, bif);
249 	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL) {
250 		TAILQ_REMOVE(&sc->sc_spanlist, bif, next);
251 		free(bif, M_DEVBUF, 0);
252 	}
253 
254 	s = splnet();
255 	LIST_REMOVE(sc, sc_list);
256 	splx(s);
257 
258 	bstp_destroy(sc->sc_stp);
259 	if_detach(ifp);
260 
261 	free(sc, M_DEVBUF, 0);
262 	return (0);
263 }
264 
265 int
266 bridge_delete(struct bridge_softc *sc, struct bridge_iflist *p)
267 {
268 	int error;
269 
270 	if (p->bif_flags & IFBIF_STP)
271 		bstp_delete(p->bif_stp);
272 
273 	p->ifp->if_bridgeport = NULL;
274 	error = ifpromisc(p->ifp, 0);
275 
276 	TAILQ_REMOVE(&sc->sc_iflist, p, next);
277 	bridge_rtdelete(sc, p->ifp, 0);
278 	bridge_flushrule(p);
279 	free(p, M_DEVBUF, 0);
280 
281 	return (error);
282 }
283 
284 int
285 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
286 {
287 	struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
288 	struct ifbreq *req = (struct ifbreq *)data;
289 	struct ifbareq *bareq = (struct ifbareq *)data;
290 	struct ifbrparam *bparam = (struct ifbrparam *)data;
291 	struct ifbrlreq *brlreq = (struct ifbrlreq *)data;
292 	struct ifbropreq *brop = (struct ifbropreq *)data;
293 	struct ifnet *ifs;
294 	struct bridge_iflist *p;
295 	struct bstp_port *bp;
296 	struct bstp_state *bs = sc->sc_stp;
297 	int error = 0, s;
298 
299 	s = splnet();
300 	switch (cmd) {
301 	case SIOCBRDGADD:
302 		if ((error = suser(curproc, 0)) != 0)
303 			break;
304 
305 		ifs = ifunit(req->ifbr_ifsname);
306 		if (ifs == NULL) {			/* no such interface */
307 			error = ENOENT;
308 			break;
309 		}
310 		if (ifs->if_bridgeport != NULL) {
311 			p = (struct bridge_iflist *)ifs->if_bridgeport;
312 			if (p->bridge_sc == sc)
313 				error = EEXIST;
314 			else
315 				error = EBUSY;
316 			break;
317 		}
318 
319 		/* If it's in the span list, it can't be a member. */
320 		TAILQ_FOREACH(p, &sc->sc_spanlist, next)
321 			if (p->ifp == ifs)
322 				break;
323 		if (p != NULL) {
324 			error = EBUSY;
325 			break;
326 		}
327 
328 		if (ifs->if_type == IFT_ETHER) {
329 			if ((ifs->if_flags & IFF_UP) == 0) {
330 				struct ifreq ifreq;
331 
332 				/*
333 				 * Bring interface up long enough to set
334 				 * promiscuous flag, then shut it down again.
335 				 */
336 				strlcpy(ifreq.ifr_name, req->ifbr_ifsname,
337 				    IFNAMSIZ);
338 				ifs->if_flags |= IFF_UP;
339 				ifreq.ifr_flags = ifs->if_flags;
340 				error = (*ifs->if_ioctl)(ifs, SIOCSIFFLAGS,
341 				    (caddr_t)&ifreq);
342 				if (error != 0)
343 					break;
344 
345 				error = ifpromisc(ifs, 1);
346 				if (error != 0)
347 					break;
348 
349 				strlcpy(ifreq.ifr_name, req->ifbr_ifsname,
350 				    IFNAMSIZ);
351 				ifs->if_flags &= ~IFF_UP;
352 				ifreq.ifr_flags = ifs->if_flags;
353 				error = (*ifs->if_ioctl)(ifs, SIOCSIFFLAGS,
354 				    (caddr_t)&ifreq);
355 				if (error != 0) {
356 					ifpromisc(ifs, 0);
357 					break;
358 				}
359 			} else {
360 				error = ifpromisc(ifs, 1);
361 				if (error != 0)
362 					break;
363 			}
364 		}
365 #if NGIF > 0
366 		else if (ifs->if_type == IFT_GIF) {
367 			/* Nothing needed */
368 		}
369 #endif /* NGIF */
370 		else {
371 			error = EINVAL;
372 			break;
373 		}
374 
375 		p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT|M_ZERO);
376 		if (p == NULL) {
377 			if (ifs->if_type == IFT_ETHER)
378 				ifpromisc(ifs, 0);
379 			error = ENOMEM;
380 			break;
381 		}
382 
383 		p->bridge_sc = sc;
384 		p->ifp = ifs;
385 		p->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
386 		SIMPLEQ_INIT(&p->bif_brlin);
387 		SIMPLEQ_INIT(&p->bif_brlout);
388 		ifs->if_bridgeport = (caddr_t)p;
389 		TAILQ_INSERT_TAIL(&sc->sc_iflist, p, next);
390 		break;
391 	case SIOCBRDGDEL:
392 		if ((error = suser(curproc, 0)) != 0)
393 			break;
394 		ifs = ifunit(req->ifbr_ifsname);
395 		if (ifs == NULL) {
396 			error = ENOENT;
397 			break;
398 		}
399 		p = (struct bridge_iflist *)ifs->if_bridgeport;
400 		if (p == NULL || p->bridge_sc != sc) {
401 			error = ESRCH;
402 			break;
403 		}
404 		error = bridge_delete(sc, p);
405 		break;
406 	case SIOCBRDGIFS:
407 		error = bridge_bifconf(sc, (struct ifbifconf *)data);
408 		break;
409 	case SIOCBRDGADDS:
410 		if ((error = suser(curproc, 0)) != 0)
411 			break;
412 		ifs = ifunit(req->ifbr_ifsname);
413 		if (ifs == NULL) {			/* no such interface */
414 			error = ENOENT;
415 			break;
416 		}
417 		if (ifs->if_bridgeport != NULL) {
418 			error = EBUSY;
419 			break;
420 		}
421 		TAILQ_FOREACH(p, &sc->sc_spanlist, next) {
422 			if (p->ifp == ifs)
423 				break;
424 		}
425 		if (p != NULL) {
426 			error = EEXIST;
427 			break;
428 		}
429 		p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT|M_ZERO);
430 		if (p == NULL) {
431 			error = ENOMEM;
432 			break;
433 		}
434 		p->ifp = ifs;
435 		p->bif_flags = IFBIF_SPAN;
436 		SIMPLEQ_INIT(&p->bif_brlin);
437 		SIMPLEQ_INIT(&p->bif_brlout);
438 		TAILQ_INSERT_TAIL(&sc->sc_spanlist, p, next);
439 		break;
440 	case SIOCBRDGDELS:
441 		if ((error = suser(curproc, 0)) != 0)
442 			break;
443 		TAILQ_FOREACH(p, &sc->sc_spanlist, next) {
444 			if (strncmp(p->ifp->if_xname, req->ifbr_ifsname,
445 			    sizeof(p->ifp->if_xname)) == 0) {
446 				TAILQ_REMOVE(&sc->sc_spanlist, p, next);
447 				free(p, M_DEVBUF, 0);
448 				break;
449 			}
450 		}
451 		if (p == NULL) {
452 			error = ENOENT;
453 			break;
454 		}
455 		break;
456 	case SIOCBRDGGIFFLGS:
457 		ifs = ifunit(req->ifbr_ifsname);
458 		if (ifs == NULL) {
459 			error = ENOENT;
460 			break;
461 		}
462 		p = (struct bridge_iflist *)ifs->if_bridgeport;
463 		if (p == NULL || p->bridge_sc != sc) {
464 			error = ESRCH;
465 			break;
466 		}
467 		req->ifbr_ifsflags = p->bif_flags;
468 		req->ifbr_portno = p->ifp->if_index & 0xfff;
469 		if (p->bif_flags & IFBIF_STP) {
470 			bp = p->bif_stp;
471 			req->ifbr_state = bstp_getstate(bs, bp);
472 			req->ifbr_priority = bp->bp_priority;
473 			req->ifbr_path_cost = bp->bp_path_cost;
474 			req->ifbr_proto = bp->bp_protover;
475 			req->ifbr_role = bp->bp_role;
476 			req->ifbr_stpflags = bp->bp_flags;
477 			req->ifbr_fwd_trans = bp->bp_forward_transitions;
478 			req->ifbr_desg_bridge = bp->bp_desg_pv.pv_dbridge_id;
479 			req->ifbr_desg_port = bp->bp_desg_pv.pv_dport_id;
480 			req->ifbr_root_bridge = bp->bp_desg_pv.pv_root_id;
481 			req->ifbr_root_cost = bp->bp_desg_pv.pv_cost;
482 			req->ifbr_root_port = bp->bp_desg_pv.pv_port_id;
483 
484 			/* Copy STP state options as flags */
485 			if (bp->bp_operedge)
486 				req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
487 			if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
488 				req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
489 			if (bp->bp_ptp_link)
490 				req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
491 			if (bp->bp_flags & BSTP_PORT_AUTOPTP)
492 				req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
493 		}
494 		break;
495 	case SIOCBRDGSIFFLGS:
496 		if ((error = suser(curproc, 0)) != 0)
497 			break;
498 		ifs = ifunit(req->ifbr_ifsname);
499 		if (ifs == NULL) {
500 			error = ENOENT;
501 			break;
502 		}
503 		p = (struct bridge_iflist *)ifs->if_bridgeport;
504 		if (p == NULL || p->bridge_sc != sc) {
505 			error = ESRCH;
506 			break;
507 		}
508 		if (req->ifbr_ifsflags & IFBIF_RO_MASK) {
509 			error = EINVAL;
510 			break;
511 		}
512 		if (req->ifbr_ifsflags & IFBIF_STP) {
513 			if ((p->bif_flags & IFBIF_STP) == 0) {
514 				/* Enable STP */
515 				if ((p->bif_stp = bstp_add(sc->sc_stp,
516 				    p->ifp)) == NULL) {
517 					error = ENOMEM;
518 					break;
519 				}
520 			} else {
521 				/* Update STP flags */
522 				bstp_ifsflags(p->bif_stp, req->ifbr_ifsflags);
523 			}
524 		} else if (p->bif_flags & IFBIF_STP) {
525 			bstp_delete(p->bif_stp);
526 			p->bif_stp = NULL;
527 		}
528 		p->bif_flags = req->ifbr_ifsflags;
529 		break;
530 	case SIOCBRDGRTS:
531 		error = bridge_rtfind(sc, (struct ifbaconf *)data);
532 		break;
533 	case SIOCBRDGFLUSH:
534 		if ((error = suser(curproc, 0)) != 0)
535 			break;
536 
537 		bridge_rtflush(sc, req->ifbr_ifsflags);
538 		break;
539 	case SIOCBRDGSADDR:
540 		if ((error = suser(curproc, 0)) != 0)
541 			break;
542 		ifs = ifunit(bareq->ifba_ifsname);
543 		if (ifs == NULL) {			/* no such interface */
544 			error = ENOENT;
545 			break;
546 		}
547 		p = (struct bridge_iflist *)ifs->if_bridgeport;
548 		if (p == NULL || p->bridge_sc != sc) {
549 			error = ESRCH;
550 			break;
551 		}
552 
553 		ifs = bridge_rtupdate(sc, &bareq->ifba_dst, ifs, 1,
554 		    bareq->ifba_flags, NULL);
555 		if (ifs == NULL)
556 			error = ENOMEM;
557 		break;
558 	case SIOCBRDGDADDR:
559 		if ((error = suser(curproc, 0)) != 0)
560 			break;
561 		error = bridge_rtdaddr(sc, &bareq->ifba_dst);
562 		break;
563 	case SIOCBRDGGCACHE:
564 		bparam->ifbrp_csize = sc->sc_brtmax;
565 		break;
566 	case SIOCBRDGSCACHE:
567 		if ((error = suser(curproc, 0)) != 0)
568 			break;
569 		sc->sc_brtmax = bparam->ifbrp_csize;
570 		break;
571 	case SIOCBRDGSTO:
572 		if ((error = suser(curproc, 0)) != 0)
573 			break;
574 		if (bparam->ifbrp_ctime < 0 ||
575 		    bparam->ifbrp_ctime > INT_MAX / hz) {
576 			error = EINVAL;
577 			break;
578 		}
579 		sc->sc_brttimeout = bparam->ifbrp_ctime;
580 		if (bparam->ifbrp_ctime != 0)
581 			timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
582 		else
583 			timeout_del(&sc->sc_brtimeout);
584 		break;
585 	case SIOCBRDGGTO:
586 		bparam->ifbrp_ctime = sc->sc_brttimeout;
587 		break;
588 	case SIOCSIFFLAGS:
589 		if ((ifp->if_flags & IFF_UP) == IFF_UP)
590 			bridge_init(sc);
591 
592 		if ((ifp->if_flags & IFF_UP) == 0)
593 			bridge_stop(sc);
594 
595 		break;
596 	case SIOCBRDGARL:
597 		if ((error = suser(curproc, 0)) != 0)
598 			break;
599 		ifs = ifunit(brlreq->ifbr_ifsname);
600 		if (ifs == NULL) {
601 			error = ENOENT;
602 			break;
603 		}
604 		p = (struct bridge_iflist *)ifs->if_bridgeport;
605 		if (p == NULL || p->bridge_sc != sc) {
606 			error = ESRCH;
607 			break;
608 		}
609 		if ((brlreq->ifbr_action != BRL_ACTION_BLOCK &&
610 		    brlreq->ifbr_action != BRL_ACTION_PASS) ||
611 		    (brlreq->ifbr_flags & (BRL_FLAG_IN|BRL_FLAG_OUT)) == 0) {
612 			error = EINVAL;
613 			break;
614 		}
615 		if (brlreq->ifbr_flags & BRL_FLAG_IN) {
616 			error = bridge_addrule(p, brlreq, 0);
617 			if (error)
618 				break;
619 		}
620 		if (brlreq->ifbr_flags & BRL_FLAG_OUT) {
621 			error = bridge_addrule(p, brlreq, 1);
622 			if (error)
623 				break;
624 		}
625 		break;
626 	case SIOCBRDGFRL:
627 		if ((error = suser(curproc, 0)) != 0)
628 			break;
629 		ifs = ifunit(brlreq->ifbr_ifsname);
630 		if (ifs == NULL) {
631 			error = ENOENT;
632 			break;
633 		}
634 		p = (struct bridge_iflist *)ifs->if_bridgeport;
635 		if (p == NULL || p->bridge_sc != sc) {
636 			error = ESRCH;
637 			break;
638 		}
639 		bridge_flushrule(p);
640 		break;
641 	case SIOCBRDGGRL:
642 		error = bridge_brlconf(sc, (struct ifbrlconf *)data);
643 		break;
644 	case SIOCBRDGGPARAM:
645 		if ((bp = bs->bs_root_port) == NULL)
646 			brop->ifbop_root_port = 0;
647 		else
648 			brop->ifbop_root_port = bp->bp_ifp->if_index;
649 		brop->ifbop_maxage = bs->bs_bridge_max_age >> 8;
650 		brop->ifbop_hellotime = bs->bs_bridge_htime >> 8;
651 		brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
652 		brop->ifbop_holdcount = bs->bs_txholdcount;
653 		brop->ifbop_priority = bs->bs_bridge_priority;
654 		brop->ifbop_protocol = bs->bs_protover;
655 		brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id;
656 		brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
657 		brop->ifbop_root_port = bs->bs_root_pv.pv_port_id;
658 		brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
659 		brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
660 		brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
661 		break;
662 	case SIOCBRDGGPRI:
663 	case SIOCBRDGGMA:
664 	case SIOCBRDGGHT:
665 	case SIOCBRDGGFD:
666 		break;
667 	case SIOCBRDGSPRI:
668 	case SIOCBRDGSFD:
669 	case SIOCBRDGSMA:
670 	case SIOCBRDGSHT:
671 	case SIOCBRDGSTXHC:
672 	case SIOCBRDGSPROTO:
673 	case SIOCBRDGSIFPRIO:
674 	case SIOCBRDGSIFCOST:
675 		error = suser(curproc, 0);
676 		break;
677 	default:
678 		error = ENOTTY;
679 		break;
680 	}
681 
682 	if (!error)
683 		error = bstp_ioctl(ifp, cmd, data);
684 
685 	splx(s);
686 	return (error);
687 }
688 
689 /* Detach an interface from a bridge.  */
690 void
691 bridge_ifdetach(struct ifnet *ifp)
692 {
693 	struct bridge_softc *sc;
694 	struct bridge_iflist *bif;
695 
696 	bif = (struct bridge_iflist *)ifp->if_bridgeport;
697 	sc = bif->bridge_sc;
698 
699 	bridge_delete(sc, bif);
700 }
701 
702 void
703 bridge_update(struct ifnet *ifp, struct ether_addr *ea, int delete)
704 {
705 	struct bridge_softc *sc;
706 	struct bridge_iflist *bif;
707 	u_int8_t *addr;
708 
709 	addr = (u_int8_t *)ea;
710 
711 	bif = (struct bridge_iflist *)ifp->if_bridgeport;
712 	sc = bif->bridge_sc;
713 
714 	/*
715 	 * Update the bridge interface if it is in
716 	 * the learning state.
717 	 */
718 	if ((bif->bif_flags & IFBIF_LEARNING) &&
719 	    (ETHER_IS_MULTICAST(addr) == 0) &&
720 	    !(addr[0] == 0 && addr[1] == 0 && addr[2] == 0 &&
721 	    addr[3] == 0 && addr[4] == 0 && addr[5] == 0)) {
722 		/* Care must be taken with spanning tree */
723 		if ((bif->bif_flags & IFBIF_STP) &&
724 		    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
725 			return;
726 
727 		/* Delete the address from the bridge */
728 		bridge_rtdaddr(sc, ea);
729 
730 		if (!delete) {
731 			/* Update the bridge table */
732 			bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC, NULL);
733 		}
734 	}
735 }
736 
737 int
738 bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc)
739 {
740 	struct bridge_iflist *p;
741 	struct bstp_port *bp;
742 	struct bstp_state *bs = sc->sc_stp;
743 	u_int32_t total = 0, i = 0;
744 	int error = 0;
745 	struct ifbreq *breq = NULL;
746 
747 	TAILQ_FOREACH(p, &sc->sc_iflist, next)
748 		total++;
749 
750 	TAILQ_FOREACH(p, &sc->sc_spanlist, next)
751 		total++;
752 
753 	if (bifc->ifbic_len == 0) {
754 		i = total;
755 		goto done;
756 	}
757 
758 	if ((breq = (struct ifbreq *)
759 	    malloc(sizeof(*breq), M_DEVBUF, M_NOWAIT)) == NULL)
760 		goto done;
761 
762 	TAILQ_FOREACH(p, &sc->sc_iflist, next) {
763 		bzero(breq, sizeof(*breq));
764 		if (bifc->ifbic_len < sizeof(*breq))
765 			break;
766 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
767 		strlcpy(breq->ifbr_ifsname, p->ifp->if_xname, IFNAMSIZ);
768 		breq->ifbr_ifsflags = p->bif_flags;
769 		breq->ifbr_portno = p->ifp->if_index & 0xfff;
770 		if (p->bif_flags & IFBIF_STP) {
771 			bp = p->bif_stp;
772 			breq->ifbr_state = bstp_getstate(sc->sc_stp, bp);
773 			breq->ifbr_priority = bp->bp_priority;
774 			breq->ifbr_path_cost = bp->bp_path_cost;
775 			breq->ifbr_proto = bp->bp_protover;
776 			breq->ifbr_role = bp->bp_role;
777 			breq->ifbr_stpflags = bp->bp_flags;
778 			breq->ifbr_fwd_trans = bp->bp_forward_transitions;
779 			breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id;
780 			breq->ifbr_root_cost = bs->bs_root_pv.pv_cost;
781 			breq->ifbr_root_port = bs->bs_root_pv.pv_port_id;
782 			breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
783 			breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id;
784 
785 			/* Copy STP state options as flags */
786 			if (bp->bp_operedge)
787 				breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
788 			if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
789 				breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
790 			if (bp->bp_ptp_link)
791 				breq->ifbr_ifsflags |= IFBIF_BSTP_PTP;
792 			if (bp->bp_flags & BSTP_PORT_AUTOPTP)
793 				breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
794 		}
795 		error = copyout((caddr_t)breq,
796 		    (caddr_t)(bifc->ifbic_req + i), sizeof(*breq));
797 		if (error)
798 			goto done;
799 		i++;
800 		bifc->ifbic_len -= sizeof(*breq);
801 	}
802 	TAILQ_FOREACH(p, &sc->sc_spanlist, next) {
803 		bzero(breq, sizeof(*breq));
804 		if (bifc->ifbic_len < sizeof(*breq))
805 			break;
806 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
807 		strlcpy(breq->ifbr_ifsname, p->ifp->if_xname, IFNAMSIZ);
808 		breq->ifbr_ifsflags = p->bif_flags | IFBIF_SPAN;
809 		breq->ifbr_portno = p->ifp->if_index & 0xfff;
810 		error = copyout((caddr_t)breq,
811 		    (caddr_t)(bifc->ifbic_req + i), sizeof(*breq));
812 		if (error)
813 			goto done;
814 		i++;
815 		bifc->ifbic_len -= sizeof(*breq);
816 	}
817 
818 done:
819 	if (breq != NULL)
820 		free(breq, M_DEVBUF, 0);
821 	bifc->ifbic_len = i * sizeof(*breq);
822 	return (error);
823 }
824 
825 int
826 bridge_brlconf(struct bridge_softc *sc, struct ifbrlconf *bc)
827 {
828 	struct ifnet *ifp;
829 	struct bridge_iflist *ifl;
830 	struct brl_node *n;
831 	struct ifbrlreq req;
832 	int error = 0;
833 	u_int32_t i = 0, total = 0;
834 
835 	ifp = ifunit(bc->ifbrl_ifsname);
836 	if (ifp == NULL)
837 		return (ENOENT);
838 	ifl = (struct bridge_iflist *)ifp->if_bridgeport;
839 	if (ifl == NULL || ifl->bridge_sc != sc)
840 		return (ESRCH);
841 
842 	SIMPLEQ_FOREACH(n, &ifl->bif_brlin, brl_next) {
843 		total++;
844 	}
845 	SIMPLEQ_FOREACH(n, &ifl->bif_brlout, brl_next) {
846 		total++;
847 	}
848 
849 	if (bc->ifbrl_len == 0) {
850 		i = total;
851 		goto done;
852 	}
853 
854 	SIMPLEQ_FOREACH(n, &ifl->bif_brlin, brl_next) {
855 		bzero(&req, sizeof req);
856 		if (bc->ifbrl_len < sizeof(req))
857 			goto done;
858 		strlcpy(req.ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
859 		strlcpy(req.ifbr_ifsname, ifl->ifp->if_xname, IFNAMSIZ);
860 		req.ifbr_action = n->brl_action;
861 		req.ifbr_flags = n->brl_flags;
862 		req.ifbr_src = n->brl_src;
863 		req.ifbr_dst = n->brl_dst;
864 #if NPF > 0
865 		req.ifbr_tagname[0] = '\0';
866 		if (n->brl_tag)
867 			pf_tag2tagname(n->brl_tag, req.ifbr_tagname);
868 #endif
869 		error = copyout((caddr_t)&req,
870 		    (caddr_t)(bc->ifbrl_buf + (i * sizeof(req))), sizeof(req));
871 		if (error)
872 			goto done;
873 		i++;
874 		bc->ifbrl_len -= sizeof(req);
875 	}
876 
877 	SIMPLEQ_FOREACH(n, &ifl->bif_brlout, brl_next) {
878 		bzero(&req, sizeof req);
879 		if (bc->ifbrl_len < sizeof(req))
880 			goto done;
881 		strlcpy(req.ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
882 		strlcpy(req.ifbr_ifsname, ifl->ifp->if_xname, IFNAMSIZ);
883 		req.ifbr_action = n->brl_action;
884 		req.ifbr_flags = n->brl_flags;
885 		req.ifbr_src = n->brl_src;
886 		req.ifbr_dst = n->brl_dst;
887 #if NPF > 0
888 		req.ifbr_tagname[0] = '\0';
889 		if (n->brl_tag)
890 			pf_tag2tagname(n->brl_tag, req.ifbr_tagname);
891 #endif
892 		error = copyout((caddr_t)&req,
893 		    (caddr_t)(bc->ifbrl_buf + (i * sizeof(req))), sizeof(req));
894 		if (error)
895 			goto done;
896 		i++;
897 		bc->ifbrl_len -= sizeof(req);
898 	}
899 
900 done:
901 	bc->ifbrl_len = i * sizeof(req);
902 	return (error);
903 }
904 
905 void
906 bridge_init(struct bridge_softc *sc)
907 {
908 	struct ifnet *ifp = &sc->sc_if;
909 
910 	if ((ifp->if_flags & IFF_RUNNING) == IFF_RUNNING)
911 		return;
912 
913 	ifp->if_flags |= IFF_RUNNING;
914 	bstp_initialization(sc->sc_stp);
915 
916 	if (sc->sc_brttimeout != 0)
917 		timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
918 }
919 
920 /*
921  * Stop the bridge and deallocate the routing table.
922  */
923 void
924 bridge_stop(struct bridge_softc *sc)
925 {
926 	struct ifnet *ifp = &sc->sc_if;
927 
928 	/*
929 	 * If we're not running, there's nothing to do.
930 	 */
931 	if ((ifp->if_flags & IFF_RUNNING) == 0)
932 		return;
933 
934 	timeout_del(&sc->sc_brtimeout);
935 
936 	bridge_rtflush(sc, IFBF_FLUSHDYN);
937 
938 	ifp->if_flags &= ~IFF_RUNNING;
939 }
940 
941 /*
942  * Send output from the bridge.  The mbuf has the ethernet header
943  * already attached.  We must enqueue or free the mbuf before exiting.
944  */
945 int
946 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
947     struct rtentry *rt)
948 {
949 	struct ether_header *eh;
950 	struct ifnet *dst_if = NULL;
951 	struct bridge_rtnode *dst_p = NULL;
952 	struct ether_addr *dst;
953 	struct bridge_softc *sc;
954 	int s, error, len;
955 #ifdef IPSEC
956 	struct m_tag *mtag;
957 #endif /* IPSEC */
958 
959 	/* ifp must be a member interface of the bridge. */
960 	if (ifp->if_bridgeport == NULL) {
961 		m_freem(m);
962 		return (EINVAL);
963 	}
964 	sc = ((struct bridge_iflist *)ifp->if_bridgeport)->bridge_sc;
965 
966 	if (m->m_len < sizeof(*eh)) {
967 		m = m_pullup(m, sizeof(*eh));
968 		if (m == NULL)
969 			return (ENOBUFS);
970 	}
971 	eh = mtod(m, struct ether_header *);
972 	dst = (struct ether_addr *)&eh->ether_dhost[0];
973 
974 	/*
975 	 * If bridge is down, but original output interface is up,
976 	 * go ahead and send out that interface.  Otherwise the packet
977 	 * is dropped below.
978 	 */
979 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
980 		dst_if = ifp;
981 		goto sendunicast;
982 	}
983 
984 #if NBPFILTER > 0
985 	if (sc->sc_if.if_bpf)
986 		bpf_mtap(sc->sc_if.if_bpf, m, BPF_DIRECTION_OUT);
987 #endif
988 	ifp->if_opackets++;
989 	ifp->if_obytes += m->m_pkthdr.len;
990 
991 	/*
992 	 * If the packet is a broadcast or we don't know a better way to
993 	 * get there, send to all interfaces.
994 	 */
995 	if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
996 		dst_if = dst_p->brt_if;
997 	if (dst_if == NULL || ETHER_IS_MULTICAST(eh->ether_dhost)) {
998 		struct bridge_iflist *p;
999 		struct mbuf *mc;
1000 		int used = 0;
1001 
1002 #ifdef IPSEC
1003 		/*
1004 		 * Don't send out the packet if IPsec is needed, and
1005 		 * notify IPsec to do its own crypto for now.
1006 		 */
1007 		if ((mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED,
1008 		    NULL)) != NULL) {
1009 			ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
1010 			m_freem(m);
1011 			return (0);
1012 		}
1013 #endif /* IPSEC */
1014 		bridge_span(sc, NULL, m);
1015 
1016 		TAILQ_FOREACH(p, &sc->sc_iflist, next) {
1017 			dst_if = p->ifp;
1018 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
1019 				continue;
1020 
1021 			/*
1022 			 * If this is not the original output interface,
1023 			 * and the interface is participating in spanning
1024 			 * tree, make sure the port is in a state that
1025 			 * allows forwarding.
1026 			 */
1027 			if (dst_if != ifp &&
1028 			    (p->bif_flags & IFBIF_STP) &&
1029 			    (p->bif_state == BSTP_IFSTATE_DISCARDING))
1030 				continue;
1031 
1032 			if ((p->bif_flags & IFBIF_DISCOVER) == 0 &&
1033 			    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1034 				continue;
1035 
1036 			if (IF_QFULL(&dst_if->if_snd)) {
1037 				IF_DROP(&dst_if->if_snd);
1038 				sc->sc_if.if_oerrors++;
1039 				continue;
1040 			}
1041 			if (TAILQ_NEXT(p, next) == NULL) {
1042 				used = 1;
1043 				mc = m;
1044 			} else {
1045 				struct mbuf *m1, *m2, *mx;
1046 
1047 				m1 = m_copym2(m, 0, ETHER_HDR_LEN,
1048 				    M_DONTWAIT);
1049 				if (m1 == NULL) {
1050 					sc->sc_if.if_oerrors++;
1051 					continue;
1052 				}
1053 				m2 = m_copym2(m, ETHER_HDR_LEN,
1054 				    M_COPYALL, M_DONTWAIT);
1055 				if (m2 == NULL) {
1056 					m_freem(m1);
1057 					sc->sc_if.if_oerrors++;
1058 					continue;
1059 				}
1060 
1061 				for (mx = m1; mx->m_next != NULL; mx = mx->m_next)
1062 					/*EMPTY*/;
1063 				mx->m_next = m2;
1064 
1065 				if (m1->m_flags & M_PKTHDR) {
1066 					len = 0;
1067 					for (mx = m1; mx != NULL; mx = mx->m_next)
1068 						len += mx->m_len;
1069 					m1->m_pkthdr.len = len;
1070 				}
1071 				mc = m1;
1072 			}
1073 
1074 			s = splnet();
1075 			error = bridge_ifenqueue(sc, dst_if, mc);
1076 			splx(s);
1077 			if (error)
1078 				continue;
1079 		}
1080 		if (!used)
1081 			m_freem(m);
1082 		return (0);
1083 	}
1084 
1085 sendunicast:
1086 	if (dst_p != NULL && dst_p->brt_tunnel.sa.sa_family != AF_UNSPEC &&
1087 	    (sa = bridge_tunneltag(m, dst_p->brt_tunnel.sa.sa_family)) != NULL)
1088 		memcpy(sa, &dst_p->brt_tunnel.sa, dst_p->brt_tunnel.sa.sa_len);
1089 
1090 	bridge_span(sc, NULL, m);
1091 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1092 		m_freem(m);
1093 		return (ENETDOWN);
1094 	}
1095 	s = splnet();
1096 	bridge_ifenqueue(sc, dst_if, m);
1097 	splx(s);
1098 	return (0);
1099 }
1100 
1101 /*
1102  * Start output on the bridge.  This function should never be called.
1103  */
1104 void
1105 bridge_start(struct ifnet *ifp)
1106 {
1107 }
1108 
1109 /*
1110  * Loop through each bridge interface and process their input queues.
1111  */
1112 void
1113 bridgeintr(void)
1114 {
1115 	struct bridge_softc *sc;
1116 	struct mbuf *m;
1117 	int s;
1118 
1119 	LIST_FOREACH(sc, &bridge_list, sc_list) {
1120 		for (;;) {
1121 			s = splnet();
1122 			IF_DEQUEUE(&sc->sc_if.if_snd, m);
1123 			splx(s);
1124 			if (m == NULL)
1125 				break;
1126 			bridgeintr_frame(sc, m);
1127 		}
1128 	}
1129 }
1130 
1131 /*
1132  * Process a single frame.  Frame must be freed or queued before returning.
1133  */
1134 void
1135 bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m)
1136 {
1137 	int s, len;
1138 	struct ifnet *src_if, *dst_if;
1139 	struct bridge_iflist *ifl;
1140 	struct bridge_rtnode *dst_p;
1141 	struct ether_addr *dst, *src;
1142 	struct ether_header eh;
1143 
1144 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
1145 		m_freem(m);
1146 		return;
1147 	}
1148 
1149 	src_if = m->m_pkthdr.rcvif;
1150 
1151 	sc->sc_if.if_ipackets++;
1152 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
1153 
1154 	ifl = (struct bridge_iflist *)src_if->if_bridgeport;
1155 	if (ifl == NULL) {
1156 		m_freem(m);
1157 		return;
1158 	}
1159 
1160 	if ((ifl->bif_flags & IFBIF_STP) &&
1161 	    (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) {
1162 		m_freem(m);
1163 		return;
1164 	}
1165 
1166 	if (m->m_pkthdr.len < sizeof(eh)) {
1167 		m_freem(m);
1168 		return;
1169 	}
1170 	m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&eh);
1171 	dst = (struct ether_addr *)&eh.ether_dhost[0];
1172 	src = (struct ether_addr *)&eh.ether_shost[0];
1173 
1174 	/*
1175 	 * If interface is learning, and if source address
1176 	 * is not broadcast or multicast, record its address.
1177 	 */
1178 	if ((ifl->bif_flags & IFBIF_LEARNING) &&
1179 	    (eh.ether_shost[0] & 1) == 0 &&
1180 	    !(eh.ether_shost[0] == 0 && eh.ether_shost[1] == 0 &&
1181 	    eh.ether_shost[2] == 0 && eh.ether_shost[3] == 0 &&
1182 	    eh.ether_shost[4] == 0 && eh.ether_shost[5] == 0))
1183 		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m);
1184 
1185 	if ((ifl->bif_flags & IFBIF_STP) &&
1186 	    (ifl->bif_state == BSTP_IFSTATE_LEARNING)) {
1187 		m_freem(m);
1188 		return;
1189 	}
1190 
1191 	/*
1192 	 * At this point, the port either doesn't participate in stp or
1193 	 * it's in the forwarding state
1194 	 */
1195 
1196 	/*
1197 	 * If packet is unicast, destined for someone on "this"
1198 	 * side of the bridge, drop it.
1199 	 */
1200 	if ((m->m_flags & (M_BCAST | M_MCAST)) == 0) {
1201 		if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
1202 			dst_if = dst_p->brt_if;
1203 		else
1204 			dst_if = NULL;
1205 		if (dst_if == src_if) {
1206 			m_freem(m);
1207 			return;
1208 		}
1209 	} else
1210 		dst_if = NULL;
1211 
1212 	/*
1213 	 * Multicast packets get handled a little differently:
1214 	 * If interface is:
1215 	 *	-link0,-link1	(default) Forward all multicast
1216 	 *			as broadcast.
1217 	 *	-link0,link1	Drop non-IP multicast, forward
1218 	 *			as broadcast IP multicast.
1219 	 *	link0,-link1	Drop IP multicast, forward as
1220 	 *			broadcast non-IP multicast.
1221 	 *	link0,link1	Drop all multicast.
1222 	 */
1223 	if (m->m_flags & M_MCAST) {
1224 		if ((sc->sc_if.if_flags &
1225 		    (IFF_LINK0 | IFF_LINK1)) ==
1226 		    (IFF_LINK0 | IFF_LINK1)) {
1227 			m_freem(m);
1228 			return;
1229 		}
1230 		if (sc->sc_if.if_flags & IFF_LINK0 &&
1231 		    ETHERADDR_IS_IP_MCAST(dst)) {
1232 			m_freem(m);
1233 			return;
1234 		}
1235 		if (sc->sc_if.if_flags & IFF_LINK1 &&
1236 		    !ETHERADDR_IS_IP_MCAST(dst)) {
1237 			m_freem(m);
1238 			return;
1239 		}
1240 	}
1241 
1242 	if (ifl->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) {
1243 		m_freem(m);
1244 		return;
1245 	}
1246 
1247 	if (bridge_filterrule(&ifl->bif_brlin, &eh, m) == BRL_ACTION_BLOCK) {
1248 		m_freem(m);
1249 		return;
1250 	}
1251 	m = bridge_ip(sc, BRIDGE_IN, src_if, &eh, m);
1252 	if (m == NULL)
1253 		return;
1254 	/*
1255 	 * If the packet is a multicast or broadcast OR if we don't
1256 	 * know any better, forward it to all interfaces.
1257 	 */
1258 	if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_if == NULL) {
1259 		sc->sc_if.if_imcasts++;
1260 		bridge_broadcast(sc, src_if, &eh, m);
1261 		return;
1262 	}
1263 
1264 	/*
1265 	 * At this point, we're dealing with a unicast frame going to a
1266 	 * different interface
1267 	 */
1268 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1269 		m_freem(m);
1270 		return;
1271 	}
1272 	ifl = (struct bridge_iflist *)dst_if->if_bridgeport;
1273 	if ((ifl->bif_flags & IFBIF_STP) &&
1274 	    (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) {
1275 		m_freem(m);
1276 		return;
1277 	}
1278 	if (bridge_filterrule(&ifl->bif_brlout, &eh, m) == BRL_ACTION_BLOCK) {
1279 		m_freem(m);
1280 		return;
1281 	}
1282 	m = bridge_ip(sc, BRIDGE_OUT, dst_if, &eh, m);
1283 	if (m == NULL)
1284 		return;
1285 
1286 	len = m->m_pkthdr.len;
1287 #if NVLAN > 0
1288 	if ((m->m_flags & M_VLANTAG) &&
1289 	    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1290 		len += ETHER_VLAN_ENCAP_LEN;
1291 #endif
1292 	if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1293 		bridge_fragment(sc, dst_if, &eh, m);
1294 	else {
1295 		s = splnet();
1296 		bridge_ifenqueue(sc, dst_if, m);
1297 		splx(s);
1298 	}
1299 }
1300 
1301 /*
1302  * Receive input from an interface.  Queue the packet for bridging if its
1303  * not for us, and schedule an interrupt.
1304  */
1305 struct mbuf *
1306 bridge_input(struct ifnet *ifp, struct ether_header *eh, struct mbuf *m)
1307 {
1308 	struct bridge_softc *sc;
1309 	int s;
1310 	struct bridge_iflist *ifl, *srcifl;
1311 	struct arpcom *ac;
1312 	struct mbuf *mc;
1313 
1314 	/*
1315 	 * Make sure this interface is a bridge member.
1316 	 */
1317 	if (ifp == NULL || ifp->if_bridgeport == NULL || m == NULL)
1318 		return (m);
1319 
1320 	if ((m->m_flags & M_PKTHDR) == 0)
1321 		panic("bridge_input(): no HDR");
1322 
1323 	m->m_flags &= ~M_PROTO1;	/* Loop prevention */
1324 
1325 	ifl = (struct bridge_iflist *)ifp->if_bridgeport;
1326 	sc = ifl->bridge_sc;
1327 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0)
1328 		return (m);
1329 
1330 #if NBPFILTER > 0
1331 	if (sc->sc_if.if_bpf)
1332 		bpf_mtap_hdr(sc->sc_if.if_bpf, (caddr_t)eh,
1333 		    ETHER_HDR_LEN, m, BPF_DIRECTION_IN, NULL);
1334 #endif
1335 
1336 	bridge_span(sc, eh, m);
1337 
1338 	if (m->m_flags & (M_BCAST | M_MCAST)) {
1339 		/*
1340 	 	 * Reserved destination MAC addresses (01:80:C2:00:00:0x)
1341 		 * should not be forwarded to bridge members according to
1342 		 * section 7.12.6 of the 802.1D-2004 specification.  The
1343 		 * STP destination address (as stored in bstp_etheraddr)
1344 		 * is the first of these.
1345 	 	 */
1346 		if (bcmp(eh->ether_dhost, bstp_etheraddr, ETHER_ADDR_LEN - 1)
1347 		    == 0) {
1348 			if (eh->ether_dhost[ETHER_ADDR_LEN - 1] == 0) {
1349 				/* STP traffic */
1350 				if ((m = bstp_input(sc->sc_stp, ifl->bif_stp,
1351 				    eh, m)) == NULL)
1352 					return (NULL);
1353 			} else if (eh->ether_dhost[ETHER_ADDR_LEN - 1] <= 0xf) {
1354 				m_freem(m);
1355 				return (NULL);
1356 			}
1357 		}
1358 
1359 		/*
1360 		 * No need to queue frames for ifs in the discarding state
1361 		 */
1362 		if ((ifl->bif_flags & IFBIF_STP) &&
1363 		    (ifl->bif_state == BSTP_IFSTATE_DISCARDING))
1364 			return (m);
1365 
1366 		/*
1367 		 * make a copy of 'm' with 'eh' tacked on to the
1368 		 * beginning.  Return 'm' for local processing
1369 		 * and enqueue the copy.  Schedule netisr.
1370 		 */
1371 		mc = m_copym2(m, 0, M_COPYALL, M_NOWAIT);
1372 		if (mc == NULL)
1373 			return (m);
1374 		M_PREPEND(mc, ETHER_HDR_LEN, M_DONTWAIT);
1375 		if (mc == NULL)
1376 			return (m);
1377 		bcopy(eh, mtod(mc, caddr_t), ETHER_HDR_LEN);
1378 		s = splnet();
1379 		if (IF_QFULL(&sc->sc_if.if_snd)) {
1380 			m_freem(mc);
1381 			splx(s);
1382 			return (m);
1383 		}
1384 		IF_ENQUEUE(&sc->sc_if.if_snd, mc);
1385 		splx(s);
1386 		schednetisr(NETISR_BRIDGE);
1387 		if (ifp->if_type == IFT_GIF) {
1388 			TAILQ_FOREACH(ifl, &sc->sc_iflist, next) {
1389 				if (ifl->ifp->if_type == IFT_ETHER)
1390 					break;
1391 			}
1392 			if (ifl != NULL) {
1393 				m->m_pkthdr.rcvif = ifl->ifp;
1394 				m->m_pkthdr.ph_rtableid = ifl->ifp->if_rdomain;
1395 #if NBPFILTER > 0
1396 				if (ifl->ifp->if_bpf)
1397 					bpf_mtap(ifl->ifp->if_bpf, m,
1398 					    BPF_DIRECTION_IN);
1399 #endif
1400 				m->m_flags |= M_PROTO1;
1401 				ether_input(ifl->ifp, eh, m);
1402 				ifl->ifp->if_ipackets++;
1403 				m = NULL;
1404 			}
1405 		}
1406 		return (m);
1407 	}
1408 
1409 	/*
1410 	 * No need to queue frames for ifs in the discarding state
1411 	 */
1412 	if ((ifl->bif_flags & IFBIF_STP) &&
1413 	    (ifl->bif_state == BSTP_IFSTATE_DISCARDING))
1414 		return (m);
1415 
1416 	/*
1417 	 * Unicast, make sure it's not for us.
1418 	 */
1419 	srcifl = ifl;
1420 	TAILQ_FOREACH(ifl, &sc->sc_iflist, next) {
1421 		if (ifl->ifp->if_type != IFT_ETHER)
1422 			continue;
1423 		ac = (struct arpcom *)ifl->ifp;
1424 		if (bcmp(ac->ac_enaddr, eh->ether_dhost, ETHER_ADDR_LEN) == 0
1425 #if NCARP > 0
1426 		    || (ifl->ifp->if_carp && carp_ourether(ifl->ifp->if_carp,
1427 			(u_int8_t *)&eh->ether_dhost) != NULL)
1428 #endif
1429 		    ) {
1430 			if (srcifl->bif_flags & IFBIF_LEARNING)
1431 				bridge_rtupdate(sc,
1432 				    (struct ether_addr *)&eh->ether_shost,
1433 				    ifp, 0, IFBAF_DYNAMIC, m);
1434 			if (bridge_filterrule(&srcifl->bif_brlin, eh, m) ==
1435 			    BRL_ACTION_BLOCK) {
1436 				m_freem(m);
1437 				return (NULL);
1438 			}
1439 
1440 			/* Make sure the real incoming interface
1441 			 * is aware */
1442 #if NBPFILTER > 0
1443 			if (ifl->ifp->if_bpf)
1444 				bpf_mtap_hdr(ifl->ifp->if_bpf, (caddr_t)eh,
1445 				    ETHER_HDR_LEN, m, BPF_DIRECTION_IN, NULL);
1446 #endif
1447 			/* Count for the interface we are going to */
1448 			ifl->ifp->if_ipackets++;
1449 
1450 			/* Count for the bridge */
1451 			sc->sc_if.if_ipackets++;
1452 			sc->sc_if.if_ibytes += ETHER_HDR_LEN + m->m_pkthdr.len;
1453 
1454 			m->m_pkthdr.rcvif = ifl->ifp;
1455 			m->m_pkthdr.ph_rtableid = ifl->ifp->if_rdomain;
1456 			if (ifp->if_type == IFT_GIF) {
1457 				m->m_flags |= M_PROTO1;
1458 				ether_input(ifl->ifp, eh, m);
1459 				m = NULL;
1460 			}
1461 			return (m);
1462 		}
1463 		if (bcmp(ac->ac_enaddr, eh->ether_shost, ETHER_ADDR_LEN) == 0
1464 #if NCARP > 0
1465 		    || (ifl->ifp->if_carp && carp_ourether(ifl->ifp->if_carp,
1466 			(u_int8_t *)&eh->ether_shost) != NULL)
1467 #endif
1468 		    ) {
1469 			m_freem(m);
1470 			return (NULL);
1471 		}
1472 	}
1473 	M_PREPEND(m, ETHER_HDR_LEN, M_DONTWAIT);
1474 	if (m == NULL)
1475 		return (NULL);
1476 	bcopy(eh, mtod(m, caddr_t), ETHER_HDR_LEN);
1477 	s = splnet();
1478 	if (IF_QFULL(&sc->sc_if.if_snd)) {
1479 		m_freem(m);
1480 		splx(s);
1481 		return (NULL);
1482 	}
1483 	IF_ENQUEUE(&sc->sc_if.if_snd, m);
1484 	splx(s);
1485 	schednetisr(NETISR_BRIDGE);
1486 	return (NULL);
1487 }
1488 
1489 /*
1490  * Send a frame to all interfaces that are members of the bridge
1491  * (except the one it came in on).
1492  */
1493 void
1494 bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp,
1495     struct ether_header *eh, struct mbuf *m)
1496 {
1497 	struct bridge_iflist *p;
1498 	struct mbuf *mc;
1499 	struct ifnet *dst_if;
1500 	int len, s, used = 0;
1501 
1502 	TAILQ_FOREACH(p, &sc->sc_iflist, next) {
1503 		/*
1504 		 * Don't retransmit out of the same interface where
1505 		 * the packet was received from.
1506 		 */
1507 		dst_if = p->ifp;
1508 		if (dst_if->if_index == ifp->if_index)
1509 			continue;
1510 
1511 		if ((p->bif_flags & IFBIF_STP) &&
1512 		    (p->bif_state == BSTP_IFSTATE_DISCARDING))
1513 			continue;
1514 
1515 		if ((p->bif_flags & IFBIF_DISCOVER) == 0 &&
1516 		    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1517 			continue;
1518 
1519 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1520 			continue;
1521 
1522 		if (IF_QFULL(&dst_if->if_snd)) {
1523 			IF_DROP(&dst_if->if_snd);
1524 			sc->sc_if.if_oerrors++;
1525 			continue;
1526 		}
1527 
1528 		/* Drop non-IP frames if the appropriate flag is set. */
1529 		if (p->bif_flags & IFBIF_BLOCKNONIP &&
1530 		    bridge_blocknonip(eh, m))
1531 			continue;
1532 
1533 		if (bridge_filterrule(&p->bif_brlout, eh, m) == BRL_ACTION_BLOCK)
1534 			continue;
1535 
1536 		bridge_localbroadcast(sc, dst_if, eh, m);
1537 
1538 		/* If last one, reuse the passed-in mbuf */
1539 		if (TAILQ_NEXT(p, next) == NULL) {
1540 			mc = m;
1541 			used = 1;
1542 		} else {
1543 			struct mbuf *m1, *m2, *mx;
1544 
1545 			m1 = m_copym2(m, 0, ETHER_HDR_LEN,
1546 			    M_DONTWAIT);
1547 			if (m1 == NULL) {
1548 				sc->sc_if.if_oerrors++;
1549 				continue;
1550 			}
1551 			m2 = m_copym2(m, ETHER_HDR_LEN,
1552 			    M_COPYALL, M_DONTWAIT);
1553 			if (m2 == NULL) {
1554 				m_freem(m1);
1555 				sc->sc_if.if_oerrors++;
1556 				continue;
1557 			}
1558 
1559 			for (mx = m1; mx->m_next != NULL; mx = mx->m_next)
1560 				/*EMPTY*/;
1561 			mx->m_next = m2;
1562 
1563 			if (m1->m_flags & M_PKTHDR) {
1564 				int len = 0;
1565 
1566 				for (mx = m1; mx != NULL; mx = mx->m_next)
1567 					len += mx->m_len;
1568 				m1->m_pkthdr.len = len;
1569 			}
1570 			mc = m1;
1571 		}
1572 
1573 		mc = bridge_ip(sc, BRIDGE_OUT, dst_if, eh, mc);
1574 		if (mc == NULL)
1575 			continue;
1576 
1577 		len = mc->m_pkthdr.len;
1578 #if NVLAN > 0
1579 		if ((mc->m_flags & M_VLANTAG) &&
1580 		    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1581 			len += ETHER_VLAN_ENCAP_LEN;
1582 #endif
1583 		if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1584 			bridge_fragment(sc, dst_if, eh, mc);
1585 		else {
1586 			s = splnet();
1587 			bridge_ifenqueue(sc, dst_if, mc);
1588 			splx(s);
1589 		}
1590 	}
1591 
1592 	if (!used)
1593 		m_freem(m);
1594 }
1595 
1596 void
1597 bridge_localbroadcast(struct bridge_softc *sc, struct ifnet *ifp,
1598     struct ether_header *eh, struct mbuf *m)
1599 {
1600 	struct mbuf *m1;
1601 	u_int16_t etype;
1602 
1603 #ifdef INET
1604 	/*
1605 	 * quick optimisation, don't send packets up the stack if no
1606 	 * corresponding address has been specified.
1607 	 */
1608 	etype = ntohs(eh->ether_type);
1609 	if (!(m->m_flags & M_VLANTAG) && etype == ETHERTYPE_IP) {
1610 		struct ifaddr *ifa;
1611 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1612 			if (ifa->ifa_addr->sa_family == AF_INET)
1613 				break;
1614 		}
1615 		if (ifa == NULL)
1616 			return;
1617 	}
1618 #endif
1619 
1620 	m1 = m_copym2(m, 0, M_COPYALL, M_DONTWAIT);
1621 	if (m1 == NULL) {
1622 		sc->sc_if.if_oerrors++;
1623 		return;
1624 	}
1625 	/* fixup header a bit */
1626 	m1->m_pkthdr.rcvif = ifp;
1627 	m1->m_pkthdr.ph_rtableid = ifp->if_rdomain;
1628 	m1->m_flags |= M_PROTO1;
1629 
1630 #if NBPFILTER > 0
1631 	if (ifp->if_bpf)
1632 		bpf_mtap(ifp->if_bpf, m1,
1633 		    BPF_DIRECTION_IN);
1634 #endif
1635 
1636 	ether_input(ifp, NULL, m1);
1637 	ifp->if_ipackets++;
1638 }
1639 
1640 void
1641 bridge_span(struct bridge_softc *sc, struct ether_header *eh,
1642     struct mbuf *morig)
1643 {
1644 	struct bridge_iflist *p;
1645 	struct ifnet *ifp;
1646 	struct mbuf *mc, *m;
1647 	int s, error;
1648 
1649 	if (TAILQ_EMPTY(&sc->sc_spanlist))
1650 		return;
1651 
1652 	m = m_copym2(morig, 0, M_COPYALL, M_NOWAIT);
1653 	if (m == NULL)
1654 		return;
1655 	if (eh != NULL) {
1656 		M_PREPEND(m, ETHER_HDR_LEN, M_DONTWAIT);
1657 		if (m == NULL)
1658 			return;
1659 		bcopy(eh, mtod(m, caddr_t), ETHER_HDR_LEN);
1660 	}
1661 
1662 	TAILQ_FOREACH(p, &sc->sc_spanlist, next) {
1663 		ifp = p->ifp;
1664 
1665 		if ((ifp->if_flags & IFF_RUNNING) == 0)
1666 			continue;
1667 
1668 			if (IF_QFULL(&ifp->if_snd)) {
1669 				IF_DROP(&ifp->if_snd);
1670 				sc->sc_if.if_oerrors++;
1671 				continue;
1672 			}
1673 
1674 		mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1675 		if (mc == NULL) {
1676 			sc->sc_if.if_oerrors++;
1677 			continue;
1678 		}
1679 
1680 		s = splnet();
1681 		error = bridge_ifenqueue(sc, ifp, mc);
1682 		splx(s);
1683 		if (error)
1684 			continue;
1685 	}
1686 	m_freem(m);
1687 }
1688 
1689 struct ifnet *
1690 bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
1691     struct ifnet *ifp, int setflags, u_int8_t flags, struct mbuf *m)
1692 {
1693 	struct bridge_rtnode *p, *q;
1694 	struct sockaddr *sa = NULL;
1695 	u_int32_t h;
1696 	int dir;
1697 
1698 	if (m != NULL) {
1699 		/* Check if the mbuf was tagged with a tunnel endpoint addr */
1700 		sa = bridge_tunnel(m);
1701 	}
1702 
1703 	h = bridge_hash(sc, ea);
1704 	p = LIST_FIRST(&sc->sc_rts[h]);
1705 	if (p == NULL) {
1706 		if (sc->sc_brtcnt >= sc->sc_brtmax)
1707 			goto done;
1708 		p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT);
1709 		if (p == NULL)
1710 			goto done;
1711 
1712 		bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
1713 		p->brt_if = ifp;
1714 		p->brt_age = 1;
1715 		bridge_copyaddr(sa, (struct sockaddr *)&p->brt_tunnel);
1716 
1717 		if (setflags)
1718 			p->brt_flags = flags;
1719 		else
1720 			p->brt_flags = IFBAF_DYNAMIC;
1721 
1722 		LIST_INSERT_HEAD(&sc->sc_rts[h], p, brt_next);
1723 		sc->sc_brtcnt++;
1724 		goto want;
1725 	}
1726 
1727 	do {
1728 		q = p;
1729 		p = LIST_NEXT(p, brt_next);
1730 
1731 		dir = memcmp(ea, &q->brt_addr, sizeof(q->brt_addr));
1732 		if (dir == 0) {
1733 			if (setflags) {
1734 				q->brt_if = ifp;
1735 				q->brt_flags = flags;
1736 			} else if (!(q->brt_flags & IFBAF_STATIC))
1737 				q->brt_if = ifp;
1738 
1739 			if (q->brt_if == ifp)
1740 				q->brt_age = 1;
1741 			ifp = q->brt_if;
1742 			bridge_copyaddr(sa,
1743 			     (struct sockaddr *)&q->brt_tunnel);
1744 
1745 			goto want;
1746 		}
1747 
1748 		if (dir > 0) {
1749 			if (sc->sc_brtcnt >= sc->sc_brtmax)
1750 				goto done;
1751 			p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT);
1752 			if (p == NULL)
1753 				goto done;
1754 
1755 			bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
1756 			p->brt_if = ifp;
1757 			p->brt_age = 1;
1758 			bridge_copyaddr(sa,
1759 			    (struct sockaddr *)&p->brt_tunnel);
1760 
1761 			if (setflags)
1762 				p->brt_flags = flags;
1763 			else
1764 				p->brt_flags = IFBAF_DYNAMIC;
1765 
1766 			LIST_INSERT_BEFORE(q, p, brt_next);
1767 			sc->sc_brtcnt++;
1768 			goto want;
1769 		}
1770 
1771 		if (p == NULL) {
1772 			if (sc->sc_brtcnt >= sc->sc_brtmax)
1773 				goto done;
1774 			p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT);
1775 			if (p == NULL)
1776 				goto done;
1777 
1778 			bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
1779 			p->brt_if = ifp;
1780 			p->brt_age = 1;
1781 			bridge_copyaddr(sa,
1782 			    (struct sockaddr *)&p->brt_tunnel);
1783 
1784 			if (setflags)
1785 				p->brt_flags = flags;
1786 			else
1787 				p->brt_flags = IFBAF_DYNAMIC;
1788 			LIST_INSERT_AFTER(q, p, brt_next);
1789 			sc->sc_brtcnt++;
1790 			goto want;
1791 		}
1792 	} while (p != NULL);
1793 
1794 done:
1795 	ifp = NULL;
1796 want:
1797 	return (ifp);
1798 }
1799 
1800 struct bridge_rtnode *
1801 bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea)
1802 {
1803 	struct bridge_rtnode *p;
1804 	u_int32_t h;
1805 	int dir;
1806 
1807 	h = bridge_hash(sc, ea);
1808 	LIST_FOREACH(p, &sc->sc_rts[h], brt_next) {
1809 		dir = memcmp(ea, &p->brt_addr, sizeof(p->brt_addr));
1810 		if (dir == 0)
1811 			return (p);
1812 		if (dir > 0)
1813 			goto fail;
1814 	}
1815 fail:
1816 	return (NULL);
1817 }
1818 
1819 /*
1820  * The following hash function is adapted from 'Hash Functions' by Bob Jenkins
1821  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
1822  * "You may use this code any way you wish, private, educational, or
1823  *  commercial.  It's free."
1824  */
1825 #define	mix(a,b,c) \
1826 	do {						\
1827 		a -= b; a -= c; a ^= (c >> 13);		\
1828 		b -= c; b -= a; b ^= (a << 8);		\
1829 		c -= a; c -= b; c ^= (b >> 13);		\
1830 		a -= b; a -= c; a ^= (c >> 12);		\
1831 		b -= c; b -= a; b ^= (a << 16);		\
1832 		c -= a; c -= b; c ^= (b >> 5);		\
1833 		a -= b; a -= c; a ^= (c >> 3);		\
1834 		b -= c; b -= a; b ^= (a << 10);		\
1835 		c -= a; c -= b; c ^= (b >> 15);		\
1836 	} while (0)
1837 
1838 u_int32_t
1839 bridge_hash(struct bridge_softc *sc, struct ether_addr *addr)
1840 {
1841 	u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_hashkey;
1842 
1843 	b += addr->ether_addr_octet[5] << 8;
1844 	b += addr->ether_addr_octet[4];
1845 	a += addr->ether_addr_octet[3] << 24;
1846 	a += addr->ether_addr_octet[2] << 16;
1847 	a += addr->ether_addr_octet[1] << 8;
1848 	a += addr->ether_addr_octet[0];
1849 
1850 	mix(a, b, c);
1851 	return (c & BRIDGE_RTABLE_MASK);
1852 }
1853 
1854 void
1855 bridge_timer(void *vsc)
1856 {
1857 	struct bridge_softc *sc = vsc;
1858 	int s;
1859 
1860 	s = splsoftnet();
1861 	bridge_rtage(sc);
1862 	splx(s);
1863 }
1864 
1865 /*
1866  * Perform an aging cycle
1867  */
1868 void
1869 bridge_rtage(struct bridge_softc *sc)
1870 {
1871 	struct bridge_rtnode *n, *p;
1872 	int i;
1873 
1874 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) {
1875 		n = LIST_FIRST(&sc->sc_rts[i]);
1876 		while (n != NULL) {
1877 			if ((n->brt_flags & IFBAF_TYPEMASK) == IFBAF_STATIC) {
1878 				n->brt_age = !n->brt_age;
1879 				if (n->brt_age)
1880 					n->brt_age = 0;
1881 				n = LIST_NEXT(n, brt_next);
1882 			} else if (n->brt_age) {
1883 				n->brt_age = 0;
1884 				n = LIST_NEXT(n, brt_next);
1885 			} else {
1886 				p = LIST_NEXT(n, brt_next);
1887 				LIST_REMOVE(n, brt_next);
1888 				sc->sc_brtcnt--;
1889 				free(n, M_DEVBUF, 0);
1890 				n = p;
1891 			}
1892 		}
1893 	}
1894 
1895 	if (sc->sc_brttimeout != 0)
1896 		timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
1897 }
1898 
1899 void
1900 bridge_rtagenode(struct ifnet *ifp, int age)
1901 {
1902 	struct bridge_softc *sc;
1903 	struct bridge_rtnode *n;
1904 	int i;
1905 
1906 	sc = ((struct bridge_iflist *)ifp->if_bridgeport)->bridge_sc;
1907 	if (sc == NULL)
1908 		return;
1909 
1910 	/*
1911 	 * If the age is zero then flush, otherwise set all the expiry times to
1912 	 * age for the interface
1913 	 */
1914 	if (age == 0)
1915 		bridge_rtdelete(sc, ifp, 1);
1916 	else {
1917 		for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) {
1918 			LIST_FOREACH(n, &sc->sc_rts[i], brt_next) {
1919 				/* Cap the expiry time to 'age' */
1920 				if (n->brt_if == ifp &&
1921 				    n->brt_age > time_uptime + age &&
1922 				    (n->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)
1923 					n->brt_age = time_uptime + age;
1924 			}
1925 		}
1926 	}
1927 }
1928 
1929 
1930 
1931 /*
1932  * Remove all dynamic addresses from the cache
1933  */
1934 void
1935 bridge_rtflush(struct bridge_softc *sc, int full)
1936 {
1937 	int i;
1938 	struct bridge_rtnode *p, *n;
1939 
1940 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) {
1941 		n = LIST_FIRST(&sc->sc_rts[i]);
1942 		while (n != NULL) {
1943 			if (full ||
1944 			    (n->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
1945 				p = LIST_NEXT(n, brt_next);
1946 				LIST_REMOVE(n, brt_next);
1947 				sc->sc_brtcnt--;
1948 				free(n, M_DEVBUF, 0);
1949 				n = p;
1950 			} else
1951 				n = LIST_NEXT(n, brt_next);
1952 		}
1953 	}
1954 }
1955 
1956 /*
1957  * Remove an address from the cache
1958  */
1959 int
1960 bridge_rtdaddr(struct bridge_softc *sc, struct ether_addr *ea)
1961 {
1962 	int h;
1963 	struct bridge_rtnode *p;
1964 
1965 	h = bridge_hash(sc, ea);
1966 	LIST_FOREACH(p, &sc->sc_rts[h], brt_next) {
1967 		if (bcmp(ea, &p->brt_addr, sizeof(p->brt_addr)) == 0) {
1968 			LIST_REMOVE(p, brt_next);
1969 			sc->sc_brtcnt--;
1970 			free(p, M_DEVBUF, 0);
1971 			return (0);
1972 		}
1973 	}
1974 
1975 	return (ENOENT);
1976 }
1977 /*
1978  * Delete routes to a specific interface member.
1979  */
1980 void
1981 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int dynonly)
1982 {
1983 	int i;
1984 	struct bridge_rtnode *n, *p;
1985 
1986 	/*
1987 	 * Loop through all of the hash buckets and traverse each
1988 	 * chain looking for routes to this interface.
1989 	 */
1990 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) {
1991 		n = LIST_FIRST(&sc->sc_rts[i]);
1992 		while (n != NULL) {
1993 			if (n->brt_if != ifp) {
1994 				/* Not ours */
1995 				n = LIST_NEXT(n, brt_next);
1996 				continue;
1997 			}
1998 			if (dynonly &&
1999 			    (n->brt_flags & IFBAF_TYPEMASK) != IFBAF_DYNAMIC) {
2000 				/* only deleting dynamics */
2001 				n = LIST_NEXT(n, brt_next);
2002 				continue;
2003 			}
2004 			p = LIST_NEXT(n, brt_next);
2005 			LIST_REMOVE(n, brt_next);
2006 			sc->sc_brtcnt--;
2007 			free(n, M_DEVBUF, 0);
2008 			n = p;
2009 		}
2010 	}
2011 }
2012 
2013 /*
2014  * Gather all of the routes for this interface.
2015  */
2016 int
2017 bridge_rtfind(struct bridge_softc *sc, struct ifbaconf *baconf)
2018 {
2019 	int i, error = 0, onlycnt = 0;
2020 	u_int32_t cnt = 0;
2021 	struct bridge_rtnode *n;
2022 	struct ifbareq bareq;
2023 
2024 	if (baconf->ifbac_len == 0)
2025 		onlycnt = 1;
2026 
2027 	for (i = 0, cnt = 0; i < BRIDGE_RTABLE_SIZE; i++) {
2028 		LIST_FOREACH(n, &sc->sc_rts[i], brt_next) {
2029 			if (!onlycnt) {
2030 				if (baconf->ifbac_len < sizeof(struct ifbareq))
2031 					goto done;
2032 				bcopy(sc->sc_if.if_xname, bareq.ifba_name,
2033 				    sizeof(bareq.ifba_name));
2034 				bcopy(n->brt_if->if_xname, bareq.ifba_ifsname,
2035 				    sizeof(bareq.ifba_ifsname));
2036 				bcopy(&n->brt_addr, &bareq.ifba_dst,
2037 				    sizeof(bareq.ifba_dst));
2038 				bridge_copyaddr(&n->brt_tunnel.sa,
2039 				    (struct sockaddr *)&bareq.ifba_dstsa);
2040 				bareq.ifba_age = n->brt_age;
2041 				bareq.ifba_flags = n->brt_flags;
2042 				error = copyout((caddr_t)&bareq,
2043 				    (caddr_t)(baconf->ifbac_req + cnt), sizeof(bareq));
2044 				if (error)
2045 					goto done;
2046 				baconf->ifbac_len -= sizeof(struct ifbareq);
2047 			}
2048 			cnt++;
2049 		}
2050 	}
2051 done:
2052 	baconf->ifbac_len = cnt * sizeof(struct ifbareq);
2053 	return (error);
2054 }
2055 
2056 /*
2057  * Block non-ip frames:
2058  * Returns 0 if frame is ip, and 1 if it should be dropped.
2059  */
2060 int
2061 bridge_blocknonip(struct ether_header *eh, struct mbuf *m)
2062 {
2063 	struct llc llc;
2064 	u_int16_t etype;
2065 
2066 	if (m->m_pkthdr.len < ETHER_HDR_LEN)
2067 		return (1);
2068 
2069 #if NVLAN > 0
2070 	if (m->m_flags & M_VLANTAG)
2071 		return (1);
2072 #endif
2073 
2074 	etype = ntohs(eh->ether_type);
2075 	switch (etype) {
2076 	case ETHERTYPE_ARP:
2077 	case ETHERTYPE_REVARP:
2078 	case ETHERTYPE_IP:
2079 	case ETHERTYPE_IPV6:
2080 		return (0);
2081 	}
2082 
2083 	if (etype > ETHERMTU)
2084 		return (1);
2085 
2086 	if (m->m_pkthdr.len <
2087 	    (ETHER_HDR_LEN + LLC_SNAPFRAMELEN))
2088 		return (1);
2089 
2090 	m_copydata(m, ETHER_HDR_LEN, LLC_SNAPFRAMELEN,
2091 	    (caddr_t)&llc);
2092 
2093 	etype = ntohs(llc.llc_snap.ether_type);
2094 	if (llc.llc_dsap == LLC_SNAP_LSAP &&
2095 	    llc.llc_ssap == LLC_SNAP_LSAP &&
2096 	    llc.llc_control == LLC_UI &&
2097 	    llc.llc_snap.org_code[0] == 0 &&
2098 	    llc.llc_snap.org_code[1] == 0 &&
2099 	    llc.llc_snap.org_code[2] == 0 &&
2100 	    (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
2101 	    etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)) {
2102 		return (0);
2103 	}
2104 
2105 	return (1);
2106 }
2107 
2108 u_int8_t
2109 bridge_filterrule(struct brl_head *h, struct ether_header *eh, struct mbuf *m)
2110 {
2111 	struct brl_node *n;
2112 	u_int8_t flags;
2113 
2114 	SIMPLEQ_FOREACH(n, h, brl_next) {
2115 		flags = n->brl_flags & (BRL_FLAG_SRCVALID|BRL_FLAG_DSTVALID);
2116 		if (flags == 0)
2117 			goto return_action;
2118 		if (flags == (BRL_FLAG_SRCVALID|BRL_FLAG_DSTVALID)) {
2119 			if (bcmp(eh->ether_shost, &n->brl_src, ETHER_ADDR_LEN))
2120 				continue;
2121 			if (bcmp(eh->ether_dhost, &n->brl_dst, ETHER_ADDR_LEN))
2122 				continue;
2123 			goto return_action;
2124 		}
2125 		if (flags == BRL_FLAG_SRCVALID) {
2126 			if (bcmp(eh->ether_shost, &n->brl_src, ETHER_ADDR_LEN))
2127 				continue;
2128 			goto return_action;
2129 		}
2130 		if (flags == BRL_FLAG_DSTVALID) {
2131 			if (bcmp(eh->ether_dhost, &n->brl_dst, ETHER_ADDR_LEN))
2132 				continue;
2133 			goto return_action;
2134 		}
2135 	}
2136 	return (BRL_ACTION_PASS);
2137 
2138 return_action:
2139 #if NPF > 0
2140 	pf_tag_packet(m, n->brl_tag, -1);
2141 #endif
2142 	return (n->brl_action);
2143 }
2144 
2145 int
2146 bridge_addrule(struct bridge_iflist *bif, struct ifbrlreq *req, int out)
2147 {
2148 	struct brl_node *n;
2149 
2150 	n = malloc(sizeof(*n), M_DEVBUF, M_NOWAIT);
2151 	if (n == NULL)
2152 		return (ENOMEM);
2153 	bcopy(&req->ifbr_src, &n->brl_src, sizeof(struct ether_addr));
2154 	bcopy(&req->ifbr_dst, &n->brl_dst, sizeof(struct ether_addr));
2155 	n->brl_action = req->ifbr_action;
2156 	n->brl_flags = req->ifbr_flags;
2157 #if NPF > 0
2158 	if (req->ifbr_tagname[0])
2159 		n->brl_tag = pf_tagname2tag(req->ifbr_tagname, 1);
2160 	else
2161 		n->brl_tag = 0;
2162 #endif
2163 	if (out) {
2164 		n->brl_flags &= ~BRL_FLAG_IN;
2165 		n->brl_flags |= BRL_FLAG_OUT;
2166 		SIMPLEQ_INSERT_TAIL(&bif->bif_brlout, n, brl_next);
2167 	} else {
2168 		n->brl_flags &= ~BRL_FLAG_OUT;
2169 		n->brl_flags |= BRL_FLAG_IN;
2170 		SIMPLEQ_INSERT_TAIL(&bif->bif_brlin, n, brl_next);
2171 	}
2172 	return (0);
2173 }
2174 
2175 void
2176 bridge_flushrule(struct bridge_iflist *bif)
2177 {
2178 	struct brl_node *p;
2179 
2180 	while (!SIMPLEQ_EMPTY(&bif->bif_brlin)) {
2181 		p = SIMPLEQ_FIRST(&bif->bif_brlin);
2182 		SIMPLEQ_REMOVE_HEAD(&bif->bif_brlin, brl_next);
2183 #if NPF > 0
2184 		pf_tag_unref(p->brl_tag);
2185 #endif
2186 		free(p, M_DEVBUF, 0);
2187 	}
2188 	while (!SIMPLEQ_EMPTY(&bif->bif_brlout)) {
2189 		p = SIMPLEQ_FIRST(&bif->bif_brlout);
2190 		SIMPLEQ_REMOVE_HEAD(&bif->bif_brlout, brl_next);
2191 #if NPF > 0
2192 		pf_tag_unref(p->brl_tag);
2193 #endif
2194 		free(p, M_DEVBUF, 0);
2195 	}
2196 }
2197 
2198 #ifdef IPSEC
2199 int
2200 bridge_ipsec(struct bridge_softc *sc, struct ifnet *ifp,
2201     struct ether_header *eh, int hassnap, struct llc *llc,
2202     int dir, int af, int hlen, struct mbuf *m)
2203 {
2204 	union sockaddr_union dst;
2205 	struct timeval tv;
2206 	struct tdb *tdb;
2207 	u_int32_t spi;
2208 	u_int16_t cpi;
2209 	int error, off, s;
2210 	u_int8_t proto = 0;
2211 #ifdef INET
2212 	struct ip *ip;
2213 #endif /* INET */
2214 #ifdef INET6
2215 	struct ip6_hdr *ip6;
2216 #endif /* INET6 */
2217 #if NPF > 0
2218 	struct ifnet *encif;
2219 #endif
2220 
2221 	if (dir == BRIDGE_IN) {
2222 		switch (af) {
2223 #ifdef INET
2224 		case AF_INET:
2225 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
2226 				break;
2227 
2228 			ip = mtod(m, struct ip *);
2229 			proto = ip->ip_p;
2230 			off = offsetof(struct ip, ip_p);
2231 
2232 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
2233 			    proto != IPPROTO_IPCOMP)
2234 				goto skiplookup;
2235 
2236 			bzero(&dst, sizeof(union sockaddr_union));
2237 			dst.sa.sa_family = AF_INET;
2238 			dst.sin.sin_len = sizeof(struct sockaddr_in);
2239 			m_copydata(m, offsetof(struct ip, ip_dst),
2240 			    sizeof(struct in_addr),
2241 			    (caddr_t)&dst.sin.sin_addr);
2242 
2243 			if (ip->ip_p == IPPROTO_ESP)
2244 				m_copydata(m, hlen, sizeof(u_int32_t),
2245 				    (caddr_t)&spi);
2246 			else if (ip->ip_p == IPPROTO_AH)
2247 				m_copydata(m, hlen + sizeof(u_int32_t),
2248 				    sizeof(u_int32_t), (caddr_t)&spi);
2249 			else if (ip->ip_p == IPPROTO_IPCOMP) {
2250 				m_copydata(m, hlen + sizeof(u_int16_t),
2251 				    sizeof(u_int16_t), (caddr_t)&cpi);
2252 				spi = ntohl(htons(cpi));
2253 			}
2254 			break;
2255 #endif /* INET */
2256 #ifdef INET6
2257 		case AF_INET6:
2258 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
2259 				break;
2260 
2261 			ip6 = mtod(m, struct ip6_hdr *);
2262 
2263 			/* XXX We should chase down the header chain */
2264 			proto = ip6->ip6_nxt;
2265 			off = offsetof(struct ip6_hdr, ip6_nxt);
2266 
2267 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
2268 			    proto != IPPROTO_IPCOMP)
2269 				goto skiplookup;
2270 
2271 			bzero(&dst, sizeof(union sockaddr_union));
2272 			dst.sa.sa_family = AF_INET6;
2273 			dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
2274 			m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
2275 			    sizeof(struct in6_addr),
2276 			    (caddr_t)&dst.sin6.sin6_addr);
2277 
2278 			if (proto == IPPROTO_ESP)
2279 				m_copydata(m, hlen, sizeof(u_int32_t),
2280 				    (caddr_t)&spi);
2281 			else if (proto == IPPROTO_AH)
2282 				m_copydata(m, hlen + sizeof(u_int32_t),
2283 				    sizeof(u_int32_t), (caddr_t)&spi);
2284 			else if (proto == IPPROTO_IPCOMP) {
2285 				m_copydata(m, hlen + sizeof(u_int16_t),
2286 				    sizeof(u_int16_t), (caddr_t)&cpi);
2287 				spi = ntohl(htons(cpi));
2288 			}
2289 			break;
2290 #endif /* INET6 */
2291 		default:
2292 			return (0);
2293 		}
2294 
2295 		if (proto == 0)
2296 			goto skiplookup;
2297 
2298 		s = splsoftnet();
2299 
2300 		tdb = gettdb(ifp->if_rdomain, spi, &dst, proto);
2301 		if (tdb != NULL && (tdb->tdb_flags & TDBF_INVALID) == 0 &&
2302 		    tdb->tdb_xform != NULL) {
2303 			if (tdb->tdb_first_use == 0) {
2304 				tdb->tdb_first_use = time_second;
2305 
2306 				tv.tv_usec = 0;
2307 
2308 				/* Check for wrap-around. */
2309 				if (tdb->tdb_exp_first_use + tdb->tdb_first_use
2310 				    < tdb->tdb_first_use)
2311 					tv.tv_sec = ((unsigned long)-1) / 2;
2312 				else
2313 					tv.tv_sec = tdb->tdb_exp_first_use +
2314 					    tdb->tdb_first_use;
2315 
2316 				if (tdb->tdb_flags & TDBF_FIRSTUSE)
2317 					timeout_add(&tdb->tdb_first_tmo,
2318 					    hzto(&tv));
2319 
2320 				/* Check for wrap-around. */
2321 				if (tdb->tdb_first_use +
2322 				    tdb->tdb_soft_first_use
2323 				    < tdb->tdb_first_use)
2324 					tv.tv_sec = ((unsigned long)-1) / 2;
2325 				else
2326 					tv.tv_sec = tdb->tdb_first_use +
2327 					    tdb->tdb_soft_first_use;
2328 
2329 				if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE)
2330 					timeout_add(&tdb->tdb_sfirst_tmo,
2331 					    hzto(&tv));
2332 			}
2333 
2334 			(*(tdb->tdb_xform->xf_input))(m, tdb, hlen, off);
2335 			splx(s);
2336 			return (1);
2337 		} else {
2338 			splx(s);
2339  skiplookup:
2340 			/* XXX do an input policy lookup */
2341 			return (0);
2342 		}
2343 	} else { /* Outgoing from the bridge. */
2344 		tdb = ipsp_spd_lookup(m, af, hlen, &error,
2345 		    IPSP_DIRECTION_OUT, NULL, NULL, 0);
2346 		if (tdb != NULL) {
2347 			/*
2348 			 * We don't need to do loop detection, the
2349 			 * bridge will do that for us.
2350 			 */
2351 #if NPF > 0
2352 			if ((encif = enc_getif(tdb->tdb_rdomain,
2353 			    tdb->tdb_tap)) == NULL ||
2354 			    pf_test(af, dir, encif,
2355 			    &m, NULL) != PF_PASS) {
2356 				m_freem(m);
2357 				return (1);
2358 			}
2359 			if (m == NULL)
2360 				return (1);
2361 			else if (af == AF_INET)
2362 				in_proto_cksum_out(m, encif);
2363 #ifdef INET6
2364 			else if (af == AF_INET6)
2365 				in6_proto_cksum_out(m, encif);
2366 #endif /* INET6 */
2367 #endif /* NPF */
2368 
2369 			ip = mtod(m, struct ip *);
2370 			if ((af == AF_INET) &&
2371 			    ip_mtudisc && (ip->ip_off & htons(IP_DF)) &&
2372 			    tdb->tdb_mtu && ntohs(ip->ip_len) > tdb->tdb_mtu &&
2373 			    tdb->tdb_mtutimeout > time_second)
2374 				bridge_send_icmp_err(sc, ifp, eh, m,
2375 				    hassnap, llc, tdb->tdb_mtu,
2376 				    ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
2377 			else
2378 				error = ipsp_process_packet(m, tdb, af, 0);
2379 			return (1);
2380 		} else
2381 			return (0);
2382 	}
2383 
2384 	return (0);
2385 }
2386 #endif /* IPSEC */
2387 
2388 /*
2389  * Filter IP packets by peeking into the ethernet frame.  This violates
2390  * the ISO model, but allows us to act as a IP filter at the data link
2391  * layer.  As a result, most of this code will look familiar to those
2392  * who've read net/if_ethersubr.c and netinet/ip_input.c
2393  */
2394 struct mbuf *
2395 bridge_ip(struct bridge_softc *sc, int dir, struct ifnet *ifp,
2396     struct ether_header *eh, struct mbuf *m)
2397 {
2398 	struct llc llc;
2399 	int hassnap = 0;
2400 	struct ip *ip;
2401 	int hlen;
2402 	u_int16_t etype;
2403 
2404 #if NVLAN > 0
2405 	if (m->m_flags & M_VLANTAG)
2406 		return (m);
2407 #endif
2408 
2409 	etype = ntohs(eh->ether_type);
2410 
2411 	if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) {
2412 		if (etype > ETHERMTU ||
2413 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
2414 		    ETHER_HDR_LEN))
2415 			return (m);
2416 
2417 		m_copydata(m, ETHER_HDR_LEN,
2418 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
2419 
2420 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
2421 		    llc.llc_ssap != LLC_SNAP_LSAP ||
2422 		    llc.llc_control != LLC_UI ||
2423 		    llc.llc_snap.org_code[0] ||
2424 		    llc.llc_snap.org_code[1] ||
2425 		    llc.llc_snap.org_code[2])
2426 			return (m);
2427 
2428 		etype = ntohs(llc.llc_snap.ether_type);
2429 		if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6)
2430 			return (m);
2431 		hassnap = 1;
2432 	}
2433 
2434 	m_adj(m, ETHER_HDR_LEN);
2435 	if (hassnap)
2436 		m_adj(m, LLC_SNAPFRAMELEN);
2437 
2438 	switch (etype) {
2439 
2440 	case ETHERTYPE_IP:
2441 		if (m->m_pkthdr.len < sizeof(struct ip))
2442 			goto dropit;
2443 
2444 		/* Copy minimal header, and drop invalids */
2445 		if (m->m_len < sizeof(struct ip) &&
2446 		    (m = m_pullup(m, sizeof(struct ip))) == NULL) {
2447 			ipstat.ips_toosmall++;
2448 			return (NULL);
2449 		}
2450 		ip = mtod(m, struct ip *);
2451 
2452 		if (ip->ip_v != IPVERSION) {
2453 			ipstat.ips_badvers++;
2454 			goto dropit;
2455 		}
2456 
2457 		hlen = ip->ip_hl << 2;	/* get whole header length */
2458 		if (hlen < sizeof(struct ip)) {
2459 			ipstat.ips_badhlen++;
2460 			goto dropit;
2461 		}
2462 
2463 		if (hlen > m->m_len) {
2464 			if ((m = m_pullup(m, hlen)) == NULL) {
2465 				ipstat.ips_badhlen++;
2466 				return (NULL);
2467 			}
2468 			ip = mtod(m, struct ip *);
2469 		}
2470 
2471 		if ((m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_OK) == 0) {
2472 			if (m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_BAD) {
2473 				ipstat.ips_badsum++;
2474 				goto dropit;
2475 			}
2476 
2477 			ipstat.ips_inswcsum++;
2478 			if (in_cksum(m, hlen) != 0) {
2479 				ipstat.ips_badsum++;
2480 				goto dropit;
2481 			}
2482 		}
2483 
2484 		if (ntohs(ip->ip_len) < hlen)
2485 			goto dropit;
2486 
2487 		if (m->m_pkthdr.len < ntohs(ip->ip_len))
2488 			goto dropit;
2489 		if (m->m_pkthdr.len > ntohs(ip->ip_len)) {
2490 			if (m->m_len == m->m_pkthdr.len) {
2491 				m->m_len = ntohs(ip->ip_len);
2492 				m->m_pkthdr.len = ntohs(ip->ip_len);
2493 			} else
2494 				m_adj(m, ntohs(ip->ip_len) - m->m_pkthdr.len);
2495 		}
2496 
2497 #ifdef IPSEC
2498 		if ((sc->sc_if.if_flags & IFF_LINK2) == IFF_LINK2 &&
2499 		    bridge_ipsec(sc, ifp, eh, hassnap, &llc,
2500 		    dir, AF_INET, hlen, m))
2501 			return (NULL);
2502 #endif /* IPSEC */
2503 #if NPF > 0
2504 		/* Finally, we get to filter the packet! */
2505 		if (pf_test(AF_INET, dir, ifp, &m, eh) != PF_PASS)
2506 			goto dropit;
2507 		if (m == NULL)
2508 			goto dropit;
2509 #endif /* NPF > 0 */
2510 
2511 		/* Rebuild the IP header */
2512 		if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
2513 			return (NULL);
2514 		if (m->m_len < sizeof(struct ip))
2515 			goto dropit;
2516 		in_proto_cksum_out(m, ifp);
2517 		ip = mtod(m, struct ip *);
2518 		ip->ip_sum = 0;
2519 		if (0 && (ifp->if_capabilities & IFCAP_CSUM_IPv4))
2520 			m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
2521 		else {
2522 			ipstat.ips_outswcsum++;
2523 			ip->ip_sum = in_cksum(m, hlen);
2524 		}
2525 
2526 		break;
2527 
2528 #ifdef INET6
2529 	case ETHERTYPE_IPV6: {
2530 		struct ip6_hdr *ip6;
2531 
2532 		if (m->m_len < sizeof(struct ip6_hdr)) {
2533 			if ((m = m_pullup(m, sizeof(struct ip6_hdr)))
2534 			    == NULL) {
2535 				ip6stat.ip6s_toosmall++;
2536 				return (NULL);
2537 			}
2538 		}
2539 
2540 		ip6 = mtod(m, struct ip6_hdr *);
2541 
2542 		if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
2543 			ip6stat.ip6s_badvers++;
2544 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
2545 			goto dropit;
2546 		}
2547 
2548 #ifdef IPSEC
2549 		hlen = sizeof(struct ip6_hdr);
2550 
2551 		if ((sc->sc_if.if_flags & IFF_LINK2) == IFF_LINK2 &&
2552 		    bridge_ipsec(sc, ifp, eh, hassnap, &llc,
2553 		    dir, AF_INET6, hlen, m))
2554 			return (NULL);
2555 #endif /* IPSEC */
2556 
2557 #if NPF > 0
2558 		if (pf_test(AF_INET6, dir, ifp, &m, eh) != PF_PASS)
2559 			goto dropit;
2560 		if (m == NULL)
2561 			return (NULL);
2562 #endif /* NPF > 0 */
2563 		in6_proto_cksum_out(m, ifp);
2564 
2565 		break;
2566 	}
2567 #endif /* INET6 */
2568 
2569 	default:
2570 		goto dropit;
2571 		break;
2572 	}
2573 
2574 	/* Reattach SNAP header */
2575 	if (hassnap) {
2576 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
2577 		if (m == NULL)
2578 			goto dropit;
2579 		bcopy(&llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
2580 	}
2581 
2582 	/* Reattach ethernet header */
2583 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
2584 	if (m == NULL)
2585 		goto dropit;
2586 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
2587 
2588 	return (m);
2589 
2590 dropit:
2591 	if (m != NULL)
2592 		m_freem(m);
2593 	return (NULL);
2594 }
2595 
2596 void
2597 bridge_fragment(struct bridge_softc *sc, struct ifnet *ifp,
2598     struct ether_header *eh, struct mbuf *m)
2599 {
2600 	struct llc llc;
2601 	struct mbuf *m0;
2602 	int s, error = 0;
2603 	int hassnap = 0;
2604 #ifdef INET
2605 	u_int16_t etype;
2606 	struct ip *ip;
2607 #endif
2608 
2609 #ifndef INET
2610 	goto dropit;
2611 #else
2612 	etype = ntohs(eh->ether_type);
2613 #if NVLAN > 0
2614 	if ((m->m_flags & M_VLANTAG) || etype == ETHERTYPE_VLAN ||
2615 	    etype == ETHERTYPE_QINQ) {
2616 		int len = m->m_pkthdr.len;
2617 
2618 		if (m->m_flags & M_VLANTAG)
2619 			len += ETHER_VLAN_ENCAP_LEN;
2620 		if ((ifp->if_capabilities & IFCAP_VLAN_MTU) &&
2621 		    (len - sizeof(struct ether_vlan_header) <= ifp->if_mtu)) {
2622 			s = splnet();
2623 			bridge_ifenqueue(sc, ifp, m);
2624 			splx(s);
2625 			return;
2626 		}
2627 		goto dropit;
2628 	}
2629 #endif
2630 	if (etype != ETHERTYPE_IP) {
2631 		if (etype > ETHERMTU ||
2632 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
2633 		    ETHER_HDR_LEN))
2634 			goto dropit;
2635 
2636 		m_copydata(m, ETHER_HDR_LEN,
2637 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
2638 
2639 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
2640 		    llc.llc_ssap != LLC_SNAP_LSAP ||
2641 		    llc.llc_control != LLC_UI ||
2642 		    llc.llc_snap.org_code[0] ||
2643 		    llc.llc_snap.org_code[1] ||
2644 		    llc.llc_snap.org_code[2] ||
2645 		    llc.llc_snap.ether_type != htons(ETHERTYPE_IP))
2646 			goto dropit;
2647 
2648 		hassnap = 1;
2649 	}
2650 
2651 	m_adj(m, ETHER_HDR_LEN);
2652 	if (hassnap)
2653 		m_adj(m, LLC_SNAPFRAMELEN);
2654 
2655 	if (m->m_len < sizeof(struct ip) &&
2656 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
2657 		goto dropit;
2658 	ip = mtod(m, struct ip *);
2659 
2660 	/* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */
2661 	if (ip->ip_off & htons(IP_DF)) {
2662 		bridge_send_icmp_err(sc, ifp, eh, m, hassnap, &llc,
2663 		    ifp->if_mtu, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
2664 		return;
2665 	}
2666 
2667 	error = ip_fragment(m, ifp, ifp->if_mtu);
2668 	if (error) {
2669 		m = NULL;
2670 		goto dropit;
2671 	}
2672 
2673 	for (; m; m = m0) {
2674 		m0 = m->m_nextpkt;
2675 		m->m_nextpkt = NULL;
2676 		if (error == 0) {
2677 			if (hassnap) {
2678 				M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
2679 				if (m == NULL) {
2680 					error = ENOBUFS;
2681 					continue;
2682 				}
2683 				bcopy(&llc, mtod(m, caddr_t),
2684 				    LLC_SNAPFRAMELEN);
2685 			}
2686 			M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
2687 			if (m == NULL) {
2688 				error = ENOBUFS;
2689 				continue;
2690 			}
2691 			bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
2692 			s = splnet();
2693 			error = bridge_ifenqueue(sc, ifp, m);
2694 			if (error) {
2695 				splx(s);
2696 				continue;
2697 			}
2698 			splx(s);
2699 		} else
2700 			m_freem(m);
2701 	}
2702 
2703 	if (error == 0)
2704 		ipstat.ips_fragmented++;
2705 
2706 	return;
2707 #endif /* INET */
2708  dropit:
2709 	if (m != NULL)
2710 		m_freem(m);
2711 }
2712 
2713 int
2714 bridge_ifenqueue(struct bridge_softc *sc, struct ifnet *ifp, struct mbuf *m)
2715 {
2716 	int error, len;
2717 	short mflags;
2718 
2719 #if NGIF > 0
2720 	/* Packet needs etherip encapsulation. */
2721 	if (ifp->if_type == IFT_GIF) {
2722 		m->m_flags |= M_PROTO1;
2723 
2724 		/* Count packets input into the gif from outside */
2725 		ifp->if_ipackets++;
2726 		ifp->if_ibytes += m->m_pkthdr.len;
2727 	}
2728 #endif
2729 #if NVLAN > 0
2730 	/*
2731 	 * If the underlying interface cannot do VLAN tag insertion itself,
2732 	 * create an encapsulation header.
2733 	 */
2734 	if ((m->m_flags & M_VLANTAG) &&
2735 	    (ifp->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0) {
2736 		struct ether_vlan_header evh;
2737 
2738 		m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&evh);
2739 		evh.evl_proto = evh.evl_encap_proto;
2740 		evh.evl_encap_proto = htons(ETHERTYPE_VLAN);
2741 		evh.evl_tag = htons(m->m_pkthdr.ether_vtag);
2742 		m_adj(m, ETHER_HDR_LEN);
2743 		M_PREPEND(m, sizeof(evh), M_DONTWAIT);
2744 		if (m == NULL) {
2745 			sc->sc_if.if_oerrors++;
2746 			return (ENOBUFS);
2747 		}
2748 		m_copyback(m, 0, sizeof(evh), &evh, M_NOWAIT);
2749 		m->m_flags &= ~M_VLANTAG;
2750 	}
2751 #endif
2752 	len = m->m_pkthdr.len;
2753 	mflags = m->m_flags;
2754 	IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error);
2755 	if (error) {
2756 		sc->sc_if.if_oerrors++;
2757 		return (error);
2758 	}
2759 	sc->sc_if.if_opackets++;
2760 	sc->sc_if.if_obytes += len;
2761 	ifp->if_obytes += len;
2762 	if (mflags & M_MCAST)
2763 		ifp->if_omcasts++;
2764 	if_start(ifp);
2765 
2766 	return (0);
2767 }
2768 
2769 #ifdef INET
2770 void
2771 bridge_send_icmp_err(struct bridge_softc *sc, struct ifnet *ifp,
2772     struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc,
2773     int mtu, int type, int code)
2774 {
2775 	struct ip *ip;
2776 	struct icmp *icp;
2777 	struct in_addr t;
2778 	struct mbuf *m, *n2;
2779 	int hlen;
2780 	u_int8_t ether_tmp[ETHER_ADDR_LEN];
2781 
2782 	n2 = m_copym(n, 0, M_COPYALL, M_DONTWAIT);
2783 	if (!n2) {
2784 		m_freem(n);
2785 		return;
2786 	}
2787 	m = icmp_do_error(n, type, code, 0, mtu);
2788 	if (m == NULL) {
2789 		m_freem(n2);
2790 		return;
2791 	}
2792 
2793 	n = n2;
2794 
2795 	ip = mtod(m, struct ip *);
2796 	hlen = ip->ip_hl << 2;
2797 	t = ip->ip_dst;
2798 	ip->ip_dst = ip->ip_src;
2799 	ip->ip_src = t;
2800 
2801 	m->m_data += hlen;
2802 	m->m_len -= hlen;
2803 	icp = mtod(m, struct icmp *);
2804 	icp->icmp_cksum = 0;
2805 	icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
2806 	m->m_data -= hlen;
2807 	m->m_len += hlen;
2808 
2809 	ip->ip_v = IPVERSION;
2810 	ip->ip_off &= htons(IP_DF);
2811 	ip->ip_id = htons(ip_randomid());
2812 	ip->ip_ttl = MAXTTL;
2813 	ip->ip_sum = 0;
2814 	ip->ip_sum = in_cksum(m, hlen);
2815 
2816 	/* Swap ethernet addresses */
2817 	bcopy(&eh->ether_dhost, &ether_tmp, sizeof(ether_tmp));
2818 	bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp));
2819 	bcopy(&ether_tmp, &eh->ether_shost, sizeof(ether_tmp));
2820 
2821 	/* Reattach SNAP header */
2822 	if (hassnap) {
2823 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
2824 		if (m == NULL)
2825 			goto dropit;
2826 		bcopy(llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
2827 	}
2828 
2829 	/* Reattach ethernet header */
2830 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
2831 	if (m == NULL)
2832 		goto dropit;
2833 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
2834 
2835 	bridge_output(ifp, m, NULL, NULL);
2836 	m_freem(n);
2837 	return;
2838 
2839  dropit:
2840 	m_freem(n);
2841 }
2842 #endif
2843 
2844 struct sockaddr *
2845 bridge_tunnel(struct mbuf *m)
2846 {
2847 	struct m_tag    *mtag;
2848 
2849 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL)
2850 		return (NULL);
2851 
2852 	return ((struct sockaddr *)(mtag + 1));
2853 }
2854 
2855 struct sockaddr *
2856 bridge_tunneltag(struct mbuf *m, int af)
2857 {
2858 	struct m_tag    *mtag;
2859 	size_t		 len;
2860 	struct sockaddr	*sa;
2861 
2862 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) {
2863 		sa = (struct sockaddr *)(mtag + 1);
2864 		if (sa->sa_family != af) {
2865 			m_tag_delete(m, mtag);
2866 			mtag = NULL;
2867 		}
2868 	}
2869 	if (mtag == NULL) {
2870 		if (af == AF_INET)
2871 			len = sizeof(struct sockaddr_in);
2872 		else if (af == AF_INET6)
2873 			len = sizeof(struct sockaddr_in6);
2874 		else
2875 			return (NULL);
2876 		mtag = m_tag_get(PACKET_TAG_TUNNEL, len, M_NOWAIT);
2877 		if (mtag == NULL)
2878 			return (NULL);
2879 		bzero(mtag + 1, len);
2880 		sa = (struct sockaddr *)(mtag + 1);
2881 		sa->sa_family = af;
2882 		sa->sa_len = len;
2883 		m_tag_prepend(m, mtag);
2884 	}
2885 
2886 	return ((struct sockaddr *)(mtag + 1));
2887 }
2888 
2889 void
2890 bridge_tunneluntag(struct mbuf *m)
2891 {
2892 	struct m_tag    *mtag;
2893 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL)
2894 		m_tag_delete(m, mtag);
2895 }
2896 
2897 void
2898 bridge_copyaddr(struct sockaddr *src, struct sockaddr *dst)
2899 {
2900 	if (src != NULL && src->sa_family != AF_UNSPEC)
2901 		memcpy(dst, src, src->sa_len);
2902 	else
2903 		dst->sa_family = AF_UNSPEC;
2904 }
2905