1 /* $OpenBSD: if_bridge.c,v 1.225 2014/07/12 18:44:22 tedu Exp $ */ 2 3 /* 4 * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 18 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 19 * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, 20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 25 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 * 28 * Effort sponsored in part by the Defense Advanced Research Projects 29 * Agency (DARPA) and Air Force Research Laboratory, Air Force 30 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 31 * 32 */ 33 34 #include "bpfilter.h" 35 #include "gif.h" 36 #include "pf.h" 37 #include "carp.h" 38 #include "vlan.h" 39 40 #include <sys/param.h> 41 #include <sys/systm.h> 42 #include <sys/mbuf.h> 43 #include <sys/socket.h> 44 #include <sys/timeout.h> 45 #include <sys/ioctl.h> 46 #include <sys/errno.h> 47 #include <sys/kernel.h> 48 49 #include <net/if.h> 50 #include <net/if_types.h> 51 #include <net/if_llc.h> 52 #include <net/route.h> 53 #include <net/netisr.h> 54 55 /* for arc4random() */ 56 #include <dev/rndvar.h> 57 58 #ifdef INET 59 #include <netinet/in.h> 60 #include <netinet/in_systm.h> 61 #include <netinet/ip.h> 62 #include <netinet/ip_var.h> 63 #include <netinet/if_ether.h> 64 #include <netinet/ip_icmp.h> 65 #endif 66 67 #ifdef IPSEC 68 #include <netinet/ip_ipsp.h> 69 #include <net/if_enc.h> 70 #endif 71 72 #ifdef INET6 73 #include <netinet6/in6_var.h> 74 #include <netinet/ip6.h> 75 #include <netinet6/ip6_var.h> 76 #endif 77 78 #if NPF > 0 79 #include <net/pfvar.h> 80 #define BRIDGE_IN PF_IN 81 #define BRIDGE_OUT PF_OUT 82 #else 83 #define BRIDGE_IN 0 84 #define BRIDGE_OUT 1 85 #endif 86 87 #if NBPFILTER > 0 88 #include <net/bpf.h> 89 #endif 90 91 #if NCARP > 0 92 #include <netinet/ip_carp.h> 93 #endif 94 95 #if NVLAN > 0 96 #include <net/if_vlan_var.h> 97 #endif 98 99 #include <net/if_bridge.h> 100 101 /* 102 * Maximum number of addresses to cache 103 */ 104 #ifndef BRIDGE_RTABLE_MAX 105 #define BRIDGE_RTABLE_MAX 100 106 #endif 107 108 /* 109 * Timeout (in seconds) for entries learned dynamically 110 */ 111 #ifndef BRIDGE_RTABLE_TIMEOUT 112 #define BRIDGE_RTABLE_TIMEOUT 240 113 #endif 114 115 void bridgeattach(int); 116 int bridge_ioctl(struct ifnet *, u_long, caddr_t); 117 void bridge_start(struct ifnet *); 118 void bridgeintr_frame(struct bridge_softc *, struct mbuf *); 119 void bridge_broadcast(struct bridge_softc *, struct ifnet *, 120 struct ether_header *, struct mbuf *); 121 void bridge_localbroadcast(struct bridge_softc *, struct ifnet *, 122 struct ether_header *, struct mbuf *); 123 void bridge_span(struct bridge_softc *, struct ether_header *, 124 struct mbuf *); 125 void bridge_stop(struct bridge_softc *); 126 void bridge_init(struct bridge_softc *); 127 int bridge_bifconf(struct bridge_softc *, struct ifbifconf *); 128 129 void bridge_timer(void *); 130 int bridge_rtfind(struct bridge_softc *, struct ifbaconf *); 131 void bridge_rtage(struct bridge_softc *); 132 int bridge_rtdaddr(struct bridge_softc *, struct ether_addr *); 133 void bridge_rtflush(struct bridge_softc *, int); 134 struct ifnet *bridge_rtupdate(struct bridge_softc *, 135 struct ether_addr *, struct ifnet *ifp, int, u_int8_t, struct mbuf *); 136 struct bridge_rtnode *bridge_rtlookup(struct bridge_softc *, 137 struct ether_addr *); 138 u_int32_t bridge_hash(struct bridge_softc *, struct ether_addr *); 139 int bridge_blocknonip(struct ether_header *, struct mbuf *); 140 int bridge_addrule(struct bridge_iflist *, 141 struct ifbrlreq *, int out); 142 void bridge_flushrule(struct bridge_iflist *); 143 int bridge_brlconf(struct bridge_softc *, struct ifbrlconf *); 144 u_int8_t bridge_filterrule(struct brl_head *, struct ether_header *, 145 struct mbuf *); 146 struct mbuf *bridge_ip(struct bridge_softc *, int, struct ifnet *, 147 struct ether_header *, struct mbuf *m); 148 int bridge_ifenqueue(struct bridge_softc *, struct ifnet *, struct mbuf *); 149 void bridge_fragment(struct bridge_softc *, struct ifnet *, 150 struct ether_header *, struct mbuf *); 151 #ifdef INET 152 void bridge_send_icmp_err(struct bridge_softc *, struct ifnet *, 153 struct ether_header *, struct mbuf *, int, struct llc *, int, int, int); 154 #endif 155 #ifdef IPSEC 156 int bridge_ipsec(struct bridge_softc *, struct ifnet *, 157 struct ether_header *, int, struct llc *, 158 int, int, int, struct mbuf *); 159 #define ICMP_DEFLEN MHLEN 160 #endif 161 int bridge_clone_create(struct if_clone *, int); 162 int bridge_clone_destroy(struct ifnet *ifp); 163 int bridge_delete(struct bridge_softc *, struct bridge_iflist *); 164 void bridge_copyaddr(struct sockaddr *, struct sockaddr *); 165 166 #define ETHERADDR_IS_IP_MCAST(a) \ 167 /* struct etheraddr *a; */ \ 168 ((a)->ether_addr_octet[0] == 0x01 && \ 169 (a)->ether_addr_octet[1] == 0x00 && \ 170 (a)->ether_addr_octet[2] == 0x5e) 171 172 LIST_HEAD(, bridge_softc) bridge_list; 173 174 struct if_clone bridge_cloner = 175 IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy); 176 177 /* ARGSUSED */ 178 void 179 bridgeattach(int n) 180 { 181 LIST_INIT(&bridge_list); 182 if_clone_attach(&bridge_cloner); 183 } 184 185 int 186 bridge_clone_create(struct if_clone *ifc, int unit) 187 { 188 struct bridge_softc *sc; 189 struct ifnet *ifp; 190 int i, s; 191 192 sc = malloc(sizeof(*sc), M_DEVBUF, M_NOWAIT|M_ZERO); 193 if (!sc) 194 return (ENOMEM); 195 196 sc->sc_stp = bstp_create(&sc->sc_if); 197 if (!sc->sc_stp) { 198 free(sc, M_DEVBUF, 0); 199 return (ENOMEM); 200 } 201 202 sc->sc_brtmax = BRIDGE_RTABLE_MAX; 203 sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT; 204 timeout_set(&sc->sc_brtimeout, bridge_timer, sc); 205 TAILQ_INIT(&sc->sc_iflist); 206 TAILQ_INIT(&sc->sc_spanlist); 207 for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) 208 LIST_INIT(&sc->sc_rts[i]); 209 sc->sc_hashkey = arc4random(); 210 ifp = &sc->sc_if; 211 snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name, 212 unit); 213 ifp->if_softc = sc; 214 ifp->if_mtu = ETHERMTU; 215 ifp->if_ioctl = bridge_ioctl; 216 ifp->if_output = bridge_output; 217 ifp->if_start = bridge_start; 218 ifp->if_type = IFT_BRIDGE; 219 ifp->if_hdrlen = ETHER_HDR_LEN; 220 IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN); 221 IFQ_SET_READY(&ifp->if_snd); 222 223 if_attach(ifp); 224 if_alloc_sadl(ifp); 225 226 #if NBPFILTER > 0 227 bpfattach(&sc->sc_if.if_bpf, ifp, 228 DLT_EN10MB, ETHER_HDR_LEN); 229 #endif 230 231 s = splnet(); 232 LIST_INSERT_HEAD(&bridge_list, sc, sc_list); 233 splx(s); 234 235 return (0); 236 } 237 238 int 239 bridge_clone_destroy(struct ifnet *ifp) 240 { 241 struct bridge_softc *sc = ifp->if_softc; 242 struct bridge_iflist *bif; 243 int s; 244 245 bridge_stop(sc); 246 bridge_rtflush(sc, IFBF_FLUSHALL); 247 while ((bif = TAILQ_FIRST(&sc->sc_iflist)) != NULL) 248 bridge_delete(sc, bif); 249 while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL) { 250 TAILQ_REMOVE(&sc->sc_spanlist, bif, next); 251 free(bif, M_DEVBUF, 0); 252 } 253 254 s = splnet(); 255 LIST_REMOVE(sc, sc_list); 256 splx(s); 257 258 bstp_destroy(sc->sc_stp); 259 if_detach(ifp); 260 261 free(sc, M_DEVBUF, 0); 262 return (0); 263 } 264 265 int 266 bridge_delete(struct bridge_softc *sc, struct bridge_iflist *p) 267 { 268 int error; 269 270 if (p->bif_flags & IFBIF_STP) 271 bstp_delete(p->bif_stp); 272 273 p->ifp->if_bridgeport = NULL; 274 error = ifpromisc(p->ifp, 0); 275 276 TAILQ_REMOVE(&sc->sc_iflist, p, next); 277 bridge_rtdelete(sc, p->ifp, 0); 278 bridge_flushrule(p); 279 free(p, M_DEVBUF, 0); 280 281 return (error); 282 } 283 284 int 285 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 286 { 287 struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc; 288 struct ifbreq *req = (struct ifbreq *)data; 289 struct ifbareq *bareq = (struct ifbareq *)data; 290 struct ifbrparam *bparam = (struct ifbrparam *)data; 291 struct ifbrlreq *brlreq = (struct ifbrlreq *)data; 292 struct ifbropreq *brop = (struct ifbropreq *)data; 293 struct ifnet *ifs; 294 struct bridge_iflist *p; 295 struct bstp_port *bp; 296 struct bstp_state *bs = sc->sc_stp; 297 int error = 0, s; 298 299 s = splnet(); 300 switch (cmd) { 301 case SIOCBRDGADD: 302 if ((error = suser(curproc, 0)) != 0) 303 break; 304 305 ifs = ifunit(req->ifbr_ifsname); 306 if (ifs == NULL) { /* no such interface */ 307 error = ENOENT; 308 break; 309 } 310 if (ifs->if_bridgeport != NULL) { 311 p = (struct bridge_iflist *)ifs->if_bridgeport; 312 if (p->bridge_sc == sc) 313 error = EEXIST; 314 else 315 error = EBUSY; 316 break; 317 } 318 319 /* If it's in the span list, it can't be a member. */ 320 TAILQ_FOREACH(p, &sc->sc_spanlist, next) 321 if (p->ifp == ifs) 322 break; 323 if (p != NULL) { 324 error = EBUSY; 325 break; 326 } 327 328 if (ifs->if_type == IFT_ETHER) { 329 if ((ifs->if_flags & IFF_UP) == 0) { 330 struct ifreq ifreq; 331 332 /* 333 * Bring interface up long enough to set 334 * promiscuous flag, then shut it down again. 335 */ 336 strlcpy(ifreq.ifr_name, req->ifbr_ifsname, 337 IFNAMSIZ); 338 ifs->if_flags |= IFF_UP; 339 ifreq.ifr_flags = ifs->if_flags; 340 error = (*ifs->if_ioctl)(ifs, SIOCSIFFLAGS, 341 (caddr_t)&ifreq); 342 if (error != 0) 343 break; 344 345 error = ifpromisc(ifs, 1); 346 if (error != 0) 347 break; 348 349 strlcpy(ifreq.ifr_name, req->ifbr_ifsname, 350 IFNAMSIZ); 351 ifs->if_flags &= ~IFF_UP; 352 ifreq.ifr_flags = ifs->if_flags; 353 error = (*ifs->if_ioctl)(ifs, SIOCSIFFLAGS, 354 (caddr_t)&ifreq); 355 if (error != 0) { 356 ifpromisc(ifs, 0); 357 break; 358 } 359 } else { 360 error = ifpromisc(ifs, 1); 361 if (error != 0) 362 break; 363 } 364 } 365 #if NGIF > 0 366 else if (ifs->if_type == IFT_GIF) { 367 /* Nothing needed */ 368 } 369 #endif /* NGIF */ 370 else { 371 error = EINVAL; 372 break; 373 } 374 375 p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT|M_ZERO); 376 if (p == NULL) { 377 if (ifs->if_type == IFT_ETHER) 378 ifpromisc(ifs, 0); 379 error = ENOMEM; 380 break; 381 } 382 383 p->bridge_sc = sc; 384 p->ifp = ifs; 385 p->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER; 386 SIMPLEQ_INIT(&p->bif_brlin); 387 SIMPLEQ_INIT(&p->bif_brlout); 388 ifs->if_bridgeport = (caddr_t)p; 389 TAILQ_INSERT_TAIL(&sc->sc_iflist, p, next); 390 break; 391 case SIOCBRDGDEL: 392 if ((error = suser(curproc, 0)) != 0) 393 break; 394 ifs = ifunit(req->ifbr_ifsname); 395 if (ifs == NULL) { 396 error = ENOENT; 397 break; 398 } 399 p = (struct bridge_iflist *)ifs->if_bridgeport; 400 if (p == NULL || p->bridge_sc != sc) { 401 error = ESRCH; 402 break; 403 } 404 error = bridge_delete(sc, p); 405 break; 406 case SIOCBRDGIFS: 407 error = bridge_bifconf(sc, (struct ifbifconf *)data); 408 break; 409 case SIOCBRDGADDS: 410 if ((error = suser(curproc, 0)) != 0) 411 break; 412 ifs = ifunit(req->ifbr_ifsname); 413 if (ifs == NULL) { /* no such interface */ 414 error = ENOENT; 415 break; 416 } 417 if (ifs->if_bridgeport != NULL) { 418 error = EBUSY; 419 break; 420 } 421 TAILQ_FOREACH(p, &sc->sc_spanlist, next) { 422 if (p->ifp == ifs) 423 break; 424 } 425 if (p != NULL) { 426 error = EEXIST; 427 break; 428 } 429 p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT|M_ZERO); 430 if (p == NULL) { 431 error = ENOMEM; 432 break; 433 } 434 p->ifp = ifs; 435 p->bif_flags = IFBIF_SPAN; 436 SIMPLEQ_INIT(&p->bif_brlin); 437 SIMPLEQ_INIT(&p->bif_brlout); 438 TAILQ_INSERT_TAIL(&sc->sc_spanlist, p, next); 439 break; 440 case SIOCBRDGDELS: 441 if ((error = suser(curproc, 0)) != 0) 442 break; 443 TAILQ_FOREACH(p, &sc->sc_spanlist, next) { 444 if (strncmp(p->ifp->if_xname, req->ifbr_ifsname, 445 sizeof(p->ifp->if_xname)) == 0) { 446 TAILQ_REMOVE(&sc->sc_spanlist, p, next); 447 free(p, M_DEVBUF, 0); 448 break; 449 } 450 } 451 if (p == NULL) { 452 error = ENOENT; 453 break; 454 } 455 break; 456 case SIOCBRDGGIFFLGS: 457 ifs = ifunit(req->ifbr_ifsname); 458 if (ifs == NULL) { 459 error = ENOENT; 460 break; 461 } 462 p = (struct bridge_iflist *)ifs->if_bridgeport; 463 if (p == NULL || p->bridge_sc != sc) { 464 error = ESRCH; 465 break; 466 } 467 req->ifbr_ifsflags = p->bif_flags; 468 req->ifbr_portno = p->ifp->if_index & 0xfff; 469 if (p->bif_flags & IFBIF_STP) { 470 bp = p->bif_stp; 471 req->ifbr_state = bstp_getstate(bs, bp); 472 req->ifbr_priority = bp->bp_priority; 473 req->ifbr_path_cost = bp->bp_path_cost; 474 req->ifbr_proto = bp->bp_protover; 475 req->ifbr_role = bp->bp_role; 476 req->ifbr_stpflags = bp->bp_flags; 477 req->ifbr_fwd_trans = bp->bp_forward_transitions; 478 req->ifbr_desg_bridge = bp->bp_desg_pv.pv_dbridge_id; 479 req->ifbr_desg_port = bp->bp_desg_pv.pv_dport_id; 480 req->ifbr_root_bridge = bp->bp_desg_pv.pv_root_id; 481 req->ifbr_root_cost = bp->bp_desg_pv.pv_cost; 482 req->ifbr_root_port = bp->bp_desg_pv.pv_port_id; 483 484 /* Copy STP state options as flags */ 485 if (bp->bp_operedge) 486 req->ifbr_ifsflags |= IFBIF_BSTP_EDGE; 487 if (bp->bp_flags & BSTP_PORT_AUTOEDGE) 488 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE; 489 if (bp->bp_ptp_link) 490 req->ifbr_ifsflags |= IFBIF_BSTP_PTP; 491 if (bp->bp_flags & BSTP_PORT_AUTOPTP) 492 req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP; 493 } 494 break; 495 case SIOCBRDGSIFFLGS: 496 if ((error = suser(curproc, 0)) != 0) 497 break; 498 ifs = ifunit(req->ifbr_ifsname); 499 if (ifs == NULL) { 500 error = ENOENT; 501 break; 502 } 503 p = (struct bridge_iflist *)ifs->if_bridgeport; 504 if (p == NULL || p->bridge_sc != sc) { 505 error = ESRCH; 506 break; 507 } 508 if (req->ifbr_ifsflags & IFBIF_RO_MASK) { 509 error = EINVAL; 510 break; 511 } 512 if (req->ifbr_ifsflags & IFBIF_STP) { 513 if ((p->bif_flags & IFBIF_STP) == 0) { 514 /* Enable STP */ 515 if ((p->bif_stp = bstp_add(sc->sc_stp, 516 p->ifp)) == NULL) { 517 error = ENOMEM; 518 break; 519 } 520 } else { 521 /* Update STP flags */ 522 bstp_ifsflags(p->bif_stp, req->ifbr_ifsflags); 523 } 524 } else if (p->bif_flags & IFBIF_STP) { 525 bstp_delete(p->bif_stp); 526 p->bif_stp = NULL; 527 } 528 p->bif_flags = req->ifbr_ifsflags; 529 break; 530 case SIOCBRDGRTS: 531 error = bridge_rtfind(sc, (struct ifbaconf *)data); 532 break; 533 case SIOCBRDGFLUSH: 534 if ((error = suser(curproc, 0)) != 0) 535 break; 536 537 bridge_rtflush(sc, req->ifbr_ifsflags); 538 break; 539 case SIOCBRDGSADDR: 540 if ((error = suser(curproc, 0)) != 0) 541 break; 542 ifs = ifunit(bareq->ifba_ifsname); 543 if (ifs == NULL) { /* no such interface */ 544 error = ENOENT; 545 break; 546 } 547 p = (struct bridge_iflist *)ifs->if_bridgeport; 548 if (p == NULL || p->bridge_sc != sc) { 549 error = ESRCH; 550 break; 551 } 552 553 ifs = bridge_rtupdate(sc, &bareq->ifba_dst, ifs, 1, 554 bareq->ifba_flags, NULL); 555 if (ifs == NULL) 556 error = ENOMEM; 557 break; 558 case SIOCBRDGDADDR: 559 if ((error = suser(curproc, 0)) != 0) 560 break; 561 error = bridge_rtdaddr(sc, &bareq->ifba_dst); 562 break; 563 case SIOCBRDGGCACHE: 564 bparam->ifbrp_csize = sc->sc_brtmax; 565 break; 566 case SIOCBRDGSCACHE: 567 if ((error = suser(curproc, 0)) != 0) 568 break; 569 sc->sc_brtmax = bparam->ifbrp_csize; 570 break; 571 case SIOCBRDGSTO: 572 if ((error = suser(curproc, 0)) != 0) 573 break; 574 if (bparam->ifbrp_ctime < 0 || 575 bparam->ifbrp_ctime > INT_MAX / hz) { 576 error = EINVAL; 577 break; 578 } 579 sc->sc_brttimeout = bparam->ifbrp_ctime; 580 if (bparam->ifbrp_ctime != 0) 581 timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout); 582 else 583 timeout_del(&sc->sc_brtimeout); 584 break; 585 case SIOCBRDGGTO: 586 bparam->ifbrp_ctime = sc->sc_brttimeout; 587 break; 588 case SIOCSIFFLAGS: 589 if ((ifp->if_flags & IFF_UP) == IFF_UP) 590 bridge_init(sc); 591 592 if ((ifp->if_flags & IFF_UP) == 0) 593 bridge_stop(sc); 594 595 break; 596 case SIOCBRDGARL: 597 if ((error = suser(curproc, 0)) != 0) 598 break; 599 ifs = ifunit(brlreq->ifbr_ifsname); 600 if (ifs == NULL) { 601 error = ENOENT; 602 break; 603 } 604 p = (struct bridge_iflist *)ifs->if_bridgeport; 605 if (p == NULL || p->bridge_sc != sc) { 606 error = ESRCH; 607 break; 608 } 609 if ((brlreq->ifbr_action != BRL_ACTION_BLOCK && 610 brlreq->ifbr_action != BRL_ACTION_PASS) || 611 (brlreq->ifbr_flags & (BRL_FLAG_IN|BRL_FLAG_OUT)) == 0) { 612 error = EINVAL; 613 break; 614 } 615 if (brlreq->ifbr_flags & BRL_FLAG_IN) { 616 error = bridge_addrule(p, brlreq, 0); 617 if (error) 618 break; 619 } 620 if (brlreq->ifbr_flags & BRL_FLAG_OUT) { 621 error = bridge_addrule(p, brlreq, 1); 622 if (error) 623 break; 624 } 625 break; 626 case SIOCBRDGFRL: 627 if ((error = suser(curproc, 0)) != 0) 628 break; 629 ifs = ifunit(brlreq->ifbr_ifsname); 630 if (ifs == NULL) { 631 error = ENOENT; 632 break; 633 } 634 p = (struct bridge_iflist *)ifs->if_bridgeport; 635 if (p == NULL || p->bridge_sc != sc) { 636 error = ESRCH; 637 break; 638 } 639 bridge_flushrule(p); 640 break; 641 case SIOCBRDGGRL: 642 error = bridge_brlconf(sc, (struct ifbrlconf *)data); 643 break; 644 case SIOCBRDGGPARAM: 645 if ((bp = bs->bs_root_port) == NULL) 646 brop->ifbop_root_port = 0; 647 else 648 brop->ifbop_root_port = bp->bp_ifp->if_index; 649 brop->ifbop_maxage = bs->bs_bridge_max_age >> 8; 650 brop->ifbop_hellotime = bs->bs_bridge_htime >> 8; 651 brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8; 652 brop->ifbop_holdcount = bs->bs_txholdcount; 653 brop->ifbop_priority = bs->bs_bridge_priority; 654 brop->ifbop_protocol = bs->bs_protover; 655 brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id; 656 brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost; 657 brop->ifbop_root_port = bs->bs_root_pv.pv_port_id; 658 brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id; 659 brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec; 660 brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec; 661 break; 662 case SIOCBRDGGPRI: 663 case SIOCBRDGGMA: 664 case SIOCBRDGGHT: 665 case SIOCBRDGGFD: 666 break; 667 case SIOCBRDGSPRI: 668 case SIOCBRDGSFD: 669 case SIOCBRDGSMA: 670 case SIOCBRDGSHT: 671 case SIOCBRDGSTXHC: 672 case SIOCBRDGSPROTO: 673 case SIOCBRDGSIFPRIO: 674 case SIOCBRDGSIFCOST: 675 error = suser(curproc, 0); 676 break; 677 default: 678 error = ENOTTY; 679 break; 680 } 681 682 if (!error) 683 error = bstp_ioctl(ifp, cmd, data); 684 685 splx(s); 686 return (error); 687 } 688 689 /* Detach an interface from a bridge. */ 690 void 691 bridge_ifdetach(struct ifnet *ifp) 692 { 693 struct bridge_softc *sc; 694 struct bridge_iflist *bif; 695 696 bif = (struct bridge_iflist *)ifp->if_bridgeport; 697 sc = bif->bridge_sc; 698 699 bridge_delete(sc, bif); 700 } 701 702 void 703 bridge_update(struct ifnet *ifp, struct ether_addr *ea, int delete) 704 { 705 struct bridge_softc *sc; 706 struct bridge_iflist *bif; 707 u_int8_t *addr; 708 709 addr = (u_int8_t *)ea; 710 711 bif = (struct bridge_iflist *)ifp->if_bridgeport; 712 sc = bif->bridge_sc; 713 714 /* 715 * Update the bridge interface if it is in 716 * the learning state. 717 */ 718 if ((bif->bif_flags & IFBIF_LEARNING) && 719 (ETHER_IS_MULTICAST(addr) == 0) && 720 !(addr[0] == 0 && addr[1] == 0 && addr[2] == 0 && 721 addr[3] == 0 && addr[4] == 0 && addr[5] == 0)) { 722 /* Care must be taken with spanning tree */ 723 if ((bif->bif_flags & IFBIF_STP) && 724 (bif->bif_state == BSTP_IFSTATE_DISCARDING)) 725 return; 726 727 /* Delete the address from the bridge */ 728 bridge_rtdaddr(sc, ea); 729 730 if (!delete) { 731 /* Update the bridge table */ 732 bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC, NULL); 733 } 734 } 735 } 736 737 int 738 bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc) 739 { 740 struct bridge_iflist *p; 741 struct bstp_port *bp; 742 struct bstp_state *bs = sc->sc_stp; 743 u_int32_t total = 0, i = 0; 744 int error = 0; 745 struct ifbreq *breq = NULL; 746 747 TAILQ_FOREACH(p, &sc->sc_iflist, next) 748 total++; 749 750 TAILQ_FOREACH(p, &sc->sc_spanlist, next) 751 total++; 752 753 if (bifc->ifbic_len == 0) { 754 i = total; 755 goto done; 756 } 757 758 if ((breq = (struct ifbreq *) 759 malloc(sizeof(*breq), M_DEVBUF, M_NOWAIT)) == NULL) 760 goto done; 761 762 TAILQ_FOREACH(p, &sc->sc_iflist, next) { 763 bzero(breq, sizeof(*breq)); 764 if (bifc->ifbic_len < sizeof(*breq)) 765 break; 766 strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ); 767 strlcpy(breq->ifbr_ifsname, p->ifp->if_xname, IFNAMSIZ); 768 breq->ifbr_ifsflags = p->bif_flags; 769 breq->ifbr_portno = p->ifp->if_index & 0xfff; 770 if (p->bif_flags & IFBIF_STP) { 771 bp = p->bif_stp; 772 breq->ifbr_state = bstp_getstate(sc->sc_stp, bp); 773 breq->ifbr_priority = bp->bp_priority; 774 breq->ifbr_path_cost = bp->bp_path_cost; 775 breq->ifbr_proto = bp->bp_protover; 776 breq->ifbr_role = bp->bp_role; 777 breq->ifbr_stpflags = bp->bp_flags; 778 breq->ifbr_fwd_trans = bp->bp_forward_transitions; 779 breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id; 780 breq->ifbr_root_cost = bs->bs_root_pv.pv_cost; 781 breq->ifbr_root_port = bs->bs_root_pv.pv_port_id; 782 breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id; 783 breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id; 784 785 /* Copy STP state options as flags */ 786 if (bp->bp_operedge) 787 breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE; 788 if (bp->bp_flags & BSTP_PORT_AUTOEDGE) 789 breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE; 790 if (bp->bp_ptp_link) 791 breq->ifbr_ifsflags |= IFBIF_BSTP_PTP; 792 if (bp->bp_flags & BSTP_PORT_AUTOPTP) 793 breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP; 794 } 795 error = copyout((caddr_t)breq, 796 (caddr_t)(bifc->ifbic_req + i), sizeof(*breq)); 797 if (error) 798 goto done; 799 i++; 800 bifc->ifbic_len -= sizeof(*breq); 801 } 802 TAILQ_FOREACH(p, &sc->sc_spanlist, next) { 803 bzero(breq, sizeof(*breq)); 804 if (bifc->ifbic_len < sizeof(*breq)) 805 break; 806 strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ); 807 strlcpy(breq->ifbr_ifsname, p->ifp->if_xname, IFNAMSIZ); 808 breq->ifbr_ifsflags = p->bif_flags | IFBIF_SPAN; 809 breq->ifbr_portno = p->ifp->if_index & 0xfff; 810 error = copyout((caddr_t)breq, 811 (caddr_t)(bifc->ifbic_req + i), sizeof(*breq)); 812 if (error) 813 goto done; 814 i++; 815 bifc->ifbic_len -= sizeof(*breq); 816 } 817 818 done: 819 if (breq != NULL) 820 free(breq, M_DEVBUF, 0); 821 bifc->ifbic_len = i * sizeof(*breq); 822 return (error); 823 } 824 825 int 826 bridge_brlconf(struct bridge_softc *sc, struct ifbrlconf *bc) 827 { 828 struct ifnet *ifp; 829 struct bridge_iflist *ifl; 830 struct brl_node *n; 831 struct ifbrlreq req; 832 int error = 0; 833 u_int32_t i = 0, total = 0; 834 835 ifp = ifunit(bc->ifbrl_ifsname); 836 if (ifp == NULL) 837 return (ENOENT); 838 ifl = (struct bridge_iflist *)ifp->if_bridgeport; 839 if (ifl == NULL || ifl->bridge_sc != sc) 840 return (ESRCH); 841 842 SIMPLEQ_FOREACH(n, &ifl->bif_brlin, brl_next) { 843 total++; 844 } 845 SIMPLEQ_FOREACH(n, &ifl->bif_brlout, brl_next) { 846 total++; 847 } 848 849 if (bc->ifbrl_len == 0) { 850 i = total; 851 goto done; 852 } 853 854 SIMPLEQ_FOREACH(n, &ifl->bif_brlin, brl_next) { 855 bzero(&req, sizeof req); 856 if (bc->ifbrl_len < sizeof(req)) 857 goto done; 858 strlcpy(req.ifbr_name, sc->sc_if.if_xname, IFNAMSIZ); 859 strlcpy(req.ifbr_ifsname, ifl->ifp->if_xname, IFNAMSIZ); 860 req.ifbr_action = n->brl_action; 861 req.ifbr_flags = n->brl_flags; 862 req.ifbr_src = n->brl_src; 863 req.ifbr_dst = n->brl_dst; 864 #if NPF > 0 865 req.ifbr_tagname[0] = '\0'; 866 if (n->brl_tag) 867 pf_tag2tagname(n->brl_tag, req.ifbr_tagname); 868 #endif 869 error = copyout((caddr_t)&req, 870 (caddr_t)(bc->ifbrl_buf + (i * sizeof(req))), sizeof(req)); 871 if (error) 872 goto done; 873 i++; 874 bc->ifbrl_len -= sizeof(req); 875 } 876 877 SIMPLEQ_FOREACH(n, &ifl->bif_brlout, brl_next) { 878 bzero(&req, sizeof req); 879 if (bc->ifbrl_len < sizeof(req)) 880 goto done; 881 strlcpy(req.ifbr_name, sc->sc_if.if_xname, IFNAMSIZ); 882 strlcpy(req.ifbr_ifsname, ifl->ifp->if_xname, IFNAMSIZ); 883 req.ifbr_action = n->brl_action; 884 req.ifbr_flags = n->brl_flags; 885 req.ifbr_src = n->brl_src; 886 req.ifbr_dst = n->brl_dst; 887 #if NPF > 0 888 req.ifbr_tagname[0] = '\0'; 889 if (n->brl_tag) 890 pf_tag2tagname(n->brl_tag, req.ifbr_tagname); 891 #endif 892 error = copyout((caddr_t)&req, 893 (caddr_t)(bc->ifbrl_buf + (i * sizeof(req))), sizeof(req)); 894 if (error) 895 goto done; 896 i++; 897 bc->ifbrl_len -= sizeof(req); 898 } 899 900 done: 901 bc->ifbrl_len = i * sizeof(req); 902 return (error); 903 } 904 905 void 906 bridge_init(struct bridge_softc *sc) 907 { 908 struct ifnet *ifp = &sc->sc_if; 909 910 if ((ifp->if_flags & IFF_RUNNING) == IFF_RUNNING) 911 return; 912 913 ifp->if_flags |= IFF_RUNNING; 914 bstp_initialization(sc->sc_stp); 915 916 if (sc->sc_brttimeout != 0) 917 timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout); 918 } 919 920 /* 921 * Stop the bridge and deallocate the routing table. 922 */ 923 void 924 bridge_stop(struct bridge_softc *sc) 925 { 926 struct ifnet *ifp = &sc->sc_if; 927 928 /* 929 * If we're not running, there's nothing to do. 930 */ 931 if ((ifp->if_flags & IFF_RUNNING) == 0) 932 return; 933 934 timeout_del(&sc->sc_brtimeout); 935 936 bridge_rtflush(sc, IFBF_FLUSHDYN); 937 938 ifp->if_flags &= ~IFF_RUNNING; 939 } 940 941 /* 942 * Send output from the bridge. The mbuf has the ethernet header 943 * already attached. We must enqueue or free the mbuf before exiting. 944 */ 945 int 946 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa, 947 struct rtentry *rt) 948 { 949 struct ether_header *eh; 950 struct ifnet *dst_if = NULL; 951 struct bridge_rtnode *dst_p = NULL; 952 struct ether_addr *dst; 953 struct bridge_softc *sc; 954 int s, error, len; 955 #ifdef IPSEC 956 struct m_tag *mtag; 957 #endif /* IPSEC */ 958 959 /* ifp must be a member interface of the bridge. */ 960 if (ifp->if_bridgeport == NULL) { 961 m_freem(m); 962 return (EINVAL); 963 } 964 sc = ((struct bridge_iflist *)ifp->if_bridgeport)->bridge_sc; 965 966 if (m->m_len < sizeof(*eh)) { 967 m = m_pullup(m, sizeof(*eh)); 968 if (m == NULL) 969 return (ENOBUFS); 970 } 971 eh = mtod(m, struct ether_header *); 972 dst = (struct ether_addr *)&eh->ether_dhost[0]; 973 974 /* 975 * If bridge is down, but original output interface is up, 976 * go ahead and send out that interface. Otherwise the packet 977 * is dropped below. 978 */ 979 if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) { 980 dst_if = ifp; 981 goto sendunicast; 982 } 983 984 #if NBPFILTER > 0 985 if (sc->sc_if.if_bpf) 986 bpf_mtap(sc->sc_if.if_bpf, m, BPF_DIRECTION_OUT); 987 #endif 988 ifp->if_opackets++; 989 ifp->if_obytes += m->m_pkthdr.len; 990 991 /* 992 * If the packet is a broadcast or we don't know a better way to 993 * get there, send to all interfaces. 994 */ 995 if ((dst_p = bridge_rtlookup(sc, dst)) != NULL) 996 dst_if = dst_p->brt_if; 997 if (dst_if == NULL || ETHER_IS_MULTICAST(eh->ether_dhost)) { 998 struct bridge_iflist *p; 999 struct mbuf *mc; 1000 int used = 0; 1001 1002 #ifdef IPSEC 1003 /* 1004 * Don't send out the packet if IPsec is needed, and 1005 * notify IPsec to do its own crypto for now. 1006 */ 1007 if ((mtag = m_tag_find(m, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, 1008 NULL)) != NULL) { 1009 ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1)); 1010 m_freem(m); 1011 return (0); 1012 } 1013 #endif /* IPSEC */ 1014 bridge_span(sc, NULL, m); 1015 1016 TAILQ_FOREACH(p, &sc->sc_iflist, next) { 1017 dst_if = p->ifp; 1018 if ((dst_if->if_flags & IFF_RUNNING) == 0) 1019 continue; 1020 1021 /* 1022 * If this is not the original output interface, 1023 * and the interface is participating in spanning 1024 * tree, make sure the port is in a state that 1025 * allows forwarding. 1026 */ 1027 if (dst_if != ifp && 1028 (p->bif_flags & IFBIF_STP) && 1029 (p->bif_state == BSTP_IFSTATE_DISCARDING)) 1030 continue; 1031 1032 if ((p->bif_flags & IFBIF_DISCOVER) == 0 && 1033 (m->m_flags & (M_BCAST | M_MCAST)) == 0) 1034 continue; 1035 1036 if (IF_QFULL(&dst_if->if_snd)) { 1037 IF_DROP(&dst_if->if_snd); 1038 sc->sc_if.if_oerrors++; 1039 continue; 1040 } 1041 if (TAILQ_NEXT(p, next) == NULL) { 1042 used = 1; 1043 mc = m; 1044 } else { 1045 struct mbuf *m1, *m2, *mx; 1046 1047 m1 = m_copym2(m, 0, ETHER_HDR_LEN, 1048 M_DONTWAIT); 1049 if (m1 == NULL) { 1050 sc->sc_if.if_oerrors++; 1051 continue; 1052 } 1053 m2 = m_copym2(m, ETHER_HDR_LEN, 1054 M_COPYALL, M_DONTWAIT); 1055 if (m2 == NULL) { 1056 m_freem(m1); 1057 sc->sc_if.if_oerrors++; 1058 continue; 1059 } 1060 1061 for (mx = m1; mx->m_next != NULL; mx = mx->m_next) 1062 /*EMPTY*/; 1063 mx->m_next = m2; 1064 1065 if (m1->m_flags & M_PKTHDR) { 1066 len = 0; 1067 for (mx = m1; mx != NULL; mx = mx->m_next) 1068 len += mx->m_len; 1069 m1->m_pkthdr.len = len; 1070 } 1071 mc = m1; 1072 } 1073 1074 s = splnet(); 1075 error = bridge_ifenqueue(sc, dst_if, mc); 1076 splx(s); 1077 if (error) 1078 continue; 1079 } 1080 if (!used) 1081 m_freem(m); 1082 return (0); 1083 } 1084 1085 sendunicast: 1086 if (dst_p != NULL && dst_p->brt_tunnel.sa.sa_family != AF_UNSPEC && 1087 (sa = bridge_tunneltag(m, dst_p->brt_tunnel.sa.sa_family)) != NULL) 1088 memcpy(sa, &dst_p->brt_tunnel.sa, dst_p->brt_tunnel.sa.sa_len); 1089 1090 bridge_span(sc, NULL, m); 1091 if ((dst_if->if_flags & IFF_RUNNING) == 0) { 1092 m_freem(m); 1093 return (ENETDOWN); 1094 } 1095 s = splnet(); 1096 bridge_ifenqueue(sc, dst_if, m); 1097 splx(s); 1098 return (0); 1099 } 1100 1101 /* 1102 * Start output on the bridge. This function should never be called. 1103 */ 1104 void 1105 bridge_start(struct ifnet *ifp) 1106 { 1107 } 1108 1109 /* 1110 * Loop through each bridge interface and process their input queues. 1111 */ 1112 void 1113 bridgeintr(void) 1114 { 1115 struct bridge_softc *sc; 1116 struct mbuf *m; 1117 int s; 1118 1119 LIST_FOREACH(sc, &bridge_list, sc_list) { 1120 for (;;) { 1121 s = splnet(); 1122 IF_DEQUEUE(&sc->sc_if.if_snd, m); 1123 splx(s); 1124 if (m == NULL) 1125 break; 1126 bridgeintr_frame(sc, m); 1127 } 1128 } 1129 } 1130 1131 /* 1132 * Process a single frame. Frame must be freed or queued before returning. 1133 */ 1134 void 1135 bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m) 1136 { 1137 int s, len; 1138 struct ifnet *src_if, *dst_if; 1139 struct bridge_iflist *ifl; 1140 struct bridge_rtnode *dst_p; 1141 struct ether_addr *dst, *src; 1142 struct ether_header eh; 1143 1144 if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) { 1145 m_freem(m); 1146 return; 1147 } 1148 1149 src_if = m->m_pkthdr.rcvif; 1150 1151 sc->sc_if.if_ipackets++; 1152 sc->sc_if.if_ibytes += m->m_pkthdr.len; 1153 1154 ifl = (struct bridge_iflist *)src_if->if_bridgeport; 1155 if (ifl == NULL) { 1156 m_freem(m); 1157 return; 1158 } 1159 1160 if ((ifl->bif_flags & IFBIF_STP) && 1161 (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) { 1162 m_freem(m); 1163 return; 1164 } 1165 1166 if (m->m_pkthdr.len < sizeof(eh)) { 1167 m_freem(m); 1168 return; 1169 } 1170 m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&eh); 1171 dst = (struct ether_addr *)&eh.ether_dhost[0]; 1172 src = (struct ether_addr *)&eh.ether_shost[0]; 1173 1174 /* 1175 * If interface is learning, and if source address 1176 * is not broadcast or multicast, record its address. 1177 */ 1178 if ((ifl->bif_flags & IFBIF_LEARNING) && 1179 (eh.ether_shost[0] & 1) == 0 && 1180 !(eh.ether_shost[0] == 0 && eh.ether_shost[1] == 0 && 1181 eh.ether_shost[2] == 0 && eh.ether_shost[3] == 0 && 1182 eh.ether_shost[4] == 0 && eh.ether_shost[5] == 0)) 1183 bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m); 1184 1185 if ((ifl->bif_flags & IFBIF_STP) && 1186 (ifl->bif_state == BSTP_IFSTATE_LEARNING)) { 1187 m_freem(m); 1188 return; 1189 } 1190 1191 /* 1192 * At this point, the port either doesn't participate in stp or 1193 * it's in the forwarding state 1194 */ 1195 1196 /* 1197 * If packet is unicast, destined for someone on "this" 1198 * side of the bridge, drop it. 1199 */ 1200 if ((m->m_flags & (M_BCAST | M_MCAST)) == 0) { 1201 if ((dst_p = bridge_rtlookup(sc, dst)) != NULL) 1202 dst_if = dst_p->brt_if; 1203 else 1204 dst_if = NULL; 1205 if (dst_if == src_if) { 1206 m_freem(m); 1207 return; 1208 } 1209 } else 1210 dst_if = NULL; 1211 1212 /* 1213 * Multicast packets get handled a little differently: 1214 * If interface is: 1215 * -link0,-link1 (default) Forward all multicast 1216 * as broadcast. 1217 * -link0,link1 Drop non-IP multicast, forward 1218 * as broadcast IP multicast. 1219 * link0,-link1 Drop IP multicast, forward as 1220 * broadcast non-IP multicast. 1221 * link0,link1 Drop all multicast. 1222 */ 1223 if (m->m_flags & M_MCAST) { 1224 if ((sc->sc_if.if_flags & 1225 (IFF_LINK0 | IFF_LINK1)) == 1226 (IFF_LINK0 | IFF_LINK1)) { 1227 m_freem(m); 1228 return; 1229 } 1230 if (sc->sc_if.if_flags & IFF_LINK0 && 1231 ETHERADDR_IS_IP_MCAST(dst)) { 1232 m_freem(m); 1233 return; 1234 } 1235 if (sc->sc_if.if_flags & IFF_LINK1 && 1236 !ETHERADDR_IS_IP_MCAST(dst)) { 1237 m_freem(m); 1238 return; 1239 } 1240 } 1241 1242 if (ifl->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) { 1243 m_freem(m); 1244 return; 1245 } 1246 1247 if (bridge_filterrule(&ifl->bif_brlin, &eh, m) == BRL_ACTION_BLOCK) { 1248 m_freem(m); 1249 return; 1250 } 1251 m = bridge_ip(sc, BRIDGE_IN, src_if, &eh, m); 1252 if (m == NULL) 1253 return; 1254 /* 1255 * If the packet is a multicast or broadcast OR if we don't 1256 * know any better, forward it to all interfaces. 1257 */ 1258 if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_if == NULL) { 1259 sc->sc_if.if_imcasts++; 1260 bridge_broadcast(sc, src_if, &eh, m); 1261 return; 1262 } 1263 1264 /* 1265 * At this point, we're dealing with a unicast frame going to a 1266 * different interface 1267 */ 1268 if ((dst_if->if_flags & IFF_RUNNING) == 0) { 1269 m_freem(m); 1270 return; 1271 } 1272 ifl = (struct bridge_iflist *)dst_if->if_bridgeport; 1273 if ((ifl->bif_flags & IFBIF_STP) && 1274 (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) { 1275 m_freem(m); 1276 return; 1277 } 1278 if (bridge_filterrule(&ifl->bif_brlout, &eh, m) == BRL_ACTION_BLOCK) { 1279 m_freem(m); 1280 return; 1281 } 1282 m = bridge_ip(sc, BRIDGE_OUT, dst_if, &eh, m); 1283 if (m == NULL) 1284 return; 1285 1286 len = m->m_pkthdr.len; 1287 #if NVLAN > 0 1288 if ((m->m_flags & M_VLANTAG) && 1289 (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0) 1290 len += ETHER_VLAN_ENCAP_LEN; 1291 #endif 1292 if ((len - ETHER_HDR_LEN) > dst_if->if_mtu) 1293 bridge_fragment(sc, dst_if, &eh, m); 1294 else { 1295 s = splnet(); 1296 bridge_ifenqueue(sc, dst_if, m); 1297 splx(s); 1298 } 1299 } 1300 1301 /* 1302 * Receive input from an interface. Queue the packet for bridging if its 1303 * not for us, and schedule an interrupt. 1304 */ 1305 struct mbuf * 1306 bridge_input(struct ifnet *ifp, struct ether_header *eh, struct mbuf *m) 1307 { 1308 struct bridge_softc *sc; 1309 int s; 1310 struct bridge_iflist *ifl, *srcifl; 1311 struct arpcom *ac; 1312 struct mbuf *mc; 1313 1314 /* 1315 * Make sure this interface is a bridge member. 1316 */ 1317 if (ifp == NULL || ifp->if_bridgeport == NULL || m == NULL) 1318 return (m); 1319 1320 if ((m->m_flags & M_PKTHDR) == 0) 1321 panic("bridge_input(): no HDR"); 1322 1323 m->m_flags &= ~M_PROTO1; /* Loop prevention */ 1324 1325 ifl = (struct bridge_iflist *)ifp->if_bridgeport; 1326 sc = ifl->bridge_sc; 1327 if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) 1328 return (m); 1329 1330 #if NBPFILTER > 0 1331 if (sc->sc_if.if_bpf) 1332 bpf_mtap_hdr(sc->sc_if.if_bpf, (caddr_t)eh, 1333 ETHER_HDR_LEN, m, BPF_DIRECTION_IN, NULL); 1334 #endif 1335 1336 bridge_span(sc, eh, m); 1337 1338 if (m->m_flags & (M_BCAST | M_MCAST)) { 1339 /* 1340 * Reserved destination MAC addresses (01:80:C2:00:00:0x) 1341 * should not be forwarded to bridge members according to 1342 * section 7.12.6 of the 802.1D-2004 specification. The 1343 * STP destination address (as stored in bstp_etheraddr) 1344 * is the first of these. 1345 */ 1346 if (bcmp(eh->ether_dhost, bstp_etheraddr, ETHER_ADDR_LEN - 1) 1347 == 0) { 1348 if (eh->ether_dhost[ETHER_ADDR_LEN - 1] == 0) { 1349 /* STP traffic */ 1350 if ((m = bstp_input(sc->sc_stp, ifl->bif_stp, 1351 eh, m)) == NULL) 1352 return (NULL); 1353 } else if (eh->ether_dhost[ETHER_ADDR_LEN - 1] <= 0xf) { 1354 m_freem(m); 1355 return (NULL); 1356 } 1357 } 1358 1359 /* 1360 * No need to queue frames for ifs in the discarding state 1361 */ 1362 if ((ifl->bif_flags & IFBIF_STP) && 1363 (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) 1364 return (m); 1365 1366 /* 1367 * make a copy of 'm' with 'eh' tacked on to the 1368 * beginning. Return 'm' for local processing 1369 * and enqueue the copy. Schedule netisr. 1370 */ 1371 mc = m_copym2(m, 0, M_COPYALL, M_NOWAIT); 1372 if (mc == NULL) 1373 return (m); 1374 M_PREPEND(mc, ETHER_HDR_LEN, M_DONTWAIT); 1375 if (mc == NULL) 1376 return (m); 1377 bcopy(eh, mtod(mc, caddr_t), ETHER_HDR_LEN); 1378 s = splnet(); 1379 if (IF_QFULL(&sc->sc_if.if_snd)) { 1380 m_freem(mc); 1381 splx(s); 1382 return (m); 1383 } 1384 IF_ENQUEUE(&sc->sc_if.if_snd, mc); 1385 splx(s); 1386 schednetisr(NETISR_BRIDGE); 1387 if (ifp->if_type == IFT_GIF) { 1388 TAILQ_FOREACH(ifl, &sc->sc_iflist, next) { 1389 if (ifl->ifp->if_type == IFT_ETHER) 1390 break; 1391 } 1392 if (ifl != NULL) { 1393 m->m_pkthdr.rcvif = ifl->ifp; 1394 m->m_pkthdr.ph_rtableid = ifl->ifp->if_rdomain; 1395 #if NBPFILTER > 0 1396 if (ifl->ifp->if_bpf) 1397 bpf_mtap(ifl->ifp->if_bpf, m, 1398 BPF_DIRECTION_IN); 1399 #endif 1400 m->m_flags |= M_PROTO1; 1401 ether_input(ifl->ifp, eh, m); 1402 ifl->ifp->if_ipackets++; 1403 m = NULL; 1404 } 1405 } 1406 return (m); 1407 } 1408 1409 /* 1410 * No need to queue frames for ifs in the discarding state 1411 */ 1412 if ((ifl->bif_flags & IFBIF_STP) && 1413 (ifl->bif_state == BSTP_IFSTATE_DISCARDING)) 1414 return (m); 1415 1416 /* 1417 * Unicast, make sure it's not for us. 1418 */ 1419 srcifl = ifl; 1420 TAILQ_FOREACH(ifl, &sc->sc_iflist, next) { 1421 if (ifl->ifp->if_type != IFT_ETHER) 1422 continue; 1423 ac = (struct arpcom *)ifl->ifp; 1424 if (bcmp(ac->ac_enaddr, eh->ether_dhost, ETHER_ADDR_LEN) == 0 1425 #if NCARP > 0 1426 || (ifl->ifp->if_carp && carp_ourether(ifl->ifp->if_carp, 1427 (u_int8_t *)&eh->ether_dhost) != NULL) 1428 #endif 1429 ) { 1430 if (srcifl->bif_flags & IFBIF_LEARNING) 1431 bridge_rtupdate(sc, 1432 (struct ether_addr *)&eh->ether_shost, 1433 ifp, 0, IFBAF_DYNAMIC, m); 1434 if (bridge_filterrule(&srcifl->bif_brlin, eh, m) == 1435 BRL_ACTION_BLOCK) { 1436 m_freem(m); 1437 return (NULL); 1438 } 1439 1440 /* Make sure the real incoming interface 1441 * is aware */ 1442 #if NBPFILTER > 0 1443 if (ifl->ifp->if_bpf) 1444 bpf_mtap_hdr(ifl->ifp->if_bpf, (caddr_t)eh, 1445 ETHER_HDR_LEN, m, BPF_DIRECTION_IN, NULL); 1446 #endif 1447 /* Count for the interface we are going to */ 1448 ifl->ifp->if_ipackets++; 1449 1450 /* Count for the bridge */ 1451 sc->sc_if.if_ipackets++; 1452 sc->sc_if.if_ibytes += ETHER_HDR_LEN + m->m_pkthdr.len; 1453 1454 m->m_pkthdr.rcvif = ifl->ifp; 1455 m->m_pkthdr.ph_rtableid = ifl->ifp->if_rdomain; 1456 if (ifp->if_type == IFT_GIF) { 1457 m->m_flags |= M_PROTO1; 1458 ether_input(ifl->ifp, eh, m); 1459 m = NULL; 1460 } 1461 return (m); 1462 } 1463 if (bcmp(ac->ac_enaddr, eh->ether_shost, ETHER_ADDR_LEN) == 0 1464 #if NCARP > 0 1465 || (ifl->ifp->if_carp && carp_ourether(ifl->ifp->if_carp, 1466 (u_int8_t *)&eh->ether_shost) != NULL) 1467 #endif 1468 ) { 1469 m_freem(m); 1470 return (NULL); 1471 } 1472 } 1473 M_PREPEND(m, ETHER_HDR_LEN, M_DONTWAIT); 1474 if (m == NULL) 1475 return (NULL); 1476 bcopy(eh, mtod(m, caddr_t), ETHER_HDR_LEN); 1477 s = splnet(); 1478 if (IF_QFULL(&sc->sc_if.if_snd)) { 1479 m_freem(m); 1480 splx(s); 1481 return (NULL); 1482 } 1483 IF_ENQUEUE(&sc->sc_if.if_snd, m); 1484 splx(s); 1485 schednetisr(NETISR_BRIDGE); 1486 return (NULL); 1487 } 1488 1489 /* 1490 * Send a frame to all interfaces that are members of the bridge 1491 * (except the one it came in on). 1492 */ 1493 void 1494 bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp, 1495 struct ether_header *eh, struct mbuf *m) 1496 { 1497 struct bridge_iflist *p; 1498 struct mbuf *mc; 1499 struct ifnet *dst_if; 1500 int len, s, used = 0; 1501 1502 TAILQ_FOREACH(p, &sc->sc_iflist, next) { 1503 /* 1504 * Don't retransmit out of the same interface where 1505 * the packet was received from. 1506 */ 1507 dst_if = p->ifp; 1508 if (dst_if->if_index == ifp->if_index) 1509 continue; 1510 1511 if ((p->bif_flags & IFBIF_STP) && 1512 (p->bif_state == BSTP_IFSTATE_DISCARDING)) 1513 continue; 1514 1515 if ((p->bif_flags & IFBIF_DISCOVER) == 0 && 1516 (m->m_flags & (M_BCAST | M_MCAST)) == 0) 1517 continue; 1518 1519 if ((dst_if->if_flags & IFF_RUNNING) == 0) 1520 continue; 1521 1522 if (IF_QFULL(&dst_if->if_snd)) { 1523 IF_DROP(&dst_if->if_snd); 1524 sc->sc_if.if_oerrors++; 1525 continue; 1526 } 1527 1528 /* Drop non-IP frames if the appropriate flag is set. */ 1529 if (p->bif_flags & IFBIF_BLOCKNONIP && 1530 bridge_blocknonip(eh, m)) 1531 continue; 1532 1533 if (bridge_filterrule(&p->bif_brlout, eh, m) == BRL_ACTION_BLOCK) 1534 continue; 1535 1536 bridge_localbroadcast(sc, dst_if, eh, m); 1537 1538 /* If last one, reuse the passed-in mbuf */ 1539 if (TAILQ_NEXT(p, next) == NULL) { 1540 mc = m; 1541 used = 1; 1542 } else { 1543 struct mbuf *m1, *m2, *mx; 1544 1545 m1 = m_copym2(m, 0, ETHER_HDR_LEN, 1546 M_DONTWAIT); 1547 if (m1 == NULL) { 1548 sc->sc_if.if_oerrors++; 1549 continue; 1550 } 1551 m2 = m_copym2(m, ETHER_HDR_LEN, 1552 M_COPYALL, M_DONTWAIT); 1553 if (m2 == NULL) { 1554 m_freem(m1); 1555 sc->sc_if.if_oerrors++; 1556 continue; 1557 } 1558 1559 for (mx = m1; mx->m_next != NULL; mx = mx->m_next) 1560 /*EMPTY*/; 1561 mx->m_next = m2; 1562 1563 if (m1->m_flags & M_PKTHDR) { 1564 int len = 0; 1565 1566 for (mx = m1; mx != NULL; mx = mx->m_next) 1567 len += mx->m_len; 1568 m1->m_pkthdr.len = len; 1569 } 1570 mc = m1; 1571 } 1572 1573 mc = bridge_ip(sc, BRIDGE_OUT, dst_if, eh, mc); 1574 if (mc == NULL) 1575 continue; 1576 1577 len = mc->m_pkthdr.len; 1578 #if NVLAN > 0 1579 if ((mc->m_flags & M_VLANTAG) && 1580 (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0) 1581 len += ETHER_VLAN_ENCAP_LEN; 1582 #endif 1583 if ((len - ETHER_HDR_LEN) > dst_if->if_mtu) 1584 bridge_fragment(sc, dst_if, eh, mc); 1585 else { 1586 s = splnet(); 1587 bridge_ifenqueue(sc, dst_if, mc); 1588 splx(s); 1589 } 1590 } 1591 1592 if (!used) 1593 m_freem(m); 1594 } 1595 1596 void 1597 bridge_localbroadcast(struct bridge_softc *sc, struct ifnet *ifp, 1598 struct ether_header *eh, struct mbuf *m) 1599 { 1600 struct mbuf *m1; 1601 u_int16_t etype; 1602 1603 #ifdef INET 1604 /* 1605 * quick optimisation, don't send packets up the stack if no 1606 * corresponding address has been specified. 1607 */ 1608 etype = ntohs(eh->ether_type); 1609 if (!(m->m_flags & M_VLANTAG) && etype == ETHERTYPE_IP) { 1610 struct ifaddr *ifa; 1611 TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) { 1612 if (ifa->ifa_addr->sa_family == AF_INET) 1613 break; 1614 } 1615 if (ifa == NULL) 1616 return; 1617 } 1618 #endif 1619 1620 m1 = m_copym2(m, 0, M_COPYALL, M_DONTWAIT); 1621 if (m1 == NULL) { 1622 sc->sc_if.if_oerrors++; 1623 return; 1624 } 1625 /* fixup header a bit */ 1626 m1->m_pkthdr.rcvif = ifp; 1627 m1->m_pkthdr.ph_rtableid = ifp->if_rdomain; 1628 m1->m_flags |= M_PROTO1; 1629 1630 #if NBPFILTER > 0 1631 if (ifp->if_bpf) 1632 bpf_mtap(ifp->if_bpf, m1, 1633 BPF_DIRECTION_IN); 1634 #endif 1635 1636 ether_input(ifp, NULL, m1); 1637 ifp->if_ipackets++; 1638 } 1639 1640 void 1641 bridge_span(struct bridge_softc *sc, struct ether_header *eh, 1642 struct mbuf *morig) 1643 { 1644 struct bridge_iflist *p; 1645 struct ifnet *ifp; 1646 struct mbuf *mc, *m; 1647 int s, error; 1648 1649 if (TAILQ_EMPTY(&sc->sc_spanlist)) 1650 return; 1651 1652 m = m_copym2(morig, 0, M_COPYALL, M_NOWAIT); 1653 if (m == NULL) 1654 return; 1655 if (eh != NULL) { 1656 M_PREPEND(m, ETHER_HDR_LEN, M_DONTWAIT); 1657 if (m == NULL) 1658 return; 1659 bcopy(eh, mtod(m, caddr_t), ETHER_HDR_LEN); 1660 } 1661 1662 TAILQ_FOREACH(p, &sc->sc_spanlist, next) { 1663 ifp = p->ifp; 1664 1665 if ((ifp->if_flags & IFF_RUNNING) == 0) 1666 continue; 1667 1668 if (IF_QFULL(&ifp->if_snd)) { 1669 IF_DROP(&ifp->if_snd); 1670 sc->sc_if.if_oerrors++; 1671 continue; 1672 } 1673 1674 mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT); 1675 if (mc == NULL) { 1676 sc->sc_if.if_oerrors++; 1677 continue; 1678 } 1679 1680 s = splnet(); 1681 error = bridge_ifenqueue(sc, ifp, mc); 1682 splx(s); 1683 if (error) 1684 continue; 1685 } 1686 m_freem(m); 1687 } 1688 1689 struct ifnet * 1690 bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, 1691 struct ifnet *ifp, int setflags, u_int8_t flags, struct mbuf *m) 1692 { 1693 struct bridge_rtnode *p, *q; 1694 struct sockaddr *sa = NULL; 1695 u_int32_t h; 1696 int dir; 1697 1698 if (m != NULL) { 1699 /* Check if the mbuf was tagged with a tunnel endpoint addr */ 1700 sa = bridge_tunnel(m); 1701 } 1702 1703 h = bridge_hash(sc, ea); 1704 p = LIST_FIRST(&sc->sc_rts[h]); 1705 if (p == NULL) { 1706 if (sc->sc_brtcnt >= sc->sc_brtmax) 1707 goto done; 1708 p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT); 1709 if (p == NULL) 1710 goto done; 1711 1712 bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); 1713 p->brt_if = ifp; 1714 p->brt_age = 1; 1715 bridge_copyaddr(sa, (struct sockaddr *)&p->brt_tunnel); 1716 1717 if (setflags) 1718 p->brt_flags = flags; 1719 else 1720 p->brt_flags = IFBAF_DYNAMIC; 1721 1722 LIST_INSERT_HEAD(&sc->sc_rts[h], p, brt_next); 1723 sc->sc_brtcnt++; 1724 goto want; 1725 } 1726 1727 do { 1728 q = p; 1729 p = LIST_NEXT(p, brt_next); 1730 1731 dir = memcmp(ea, &q->brt_addr, sizeof(q->brt_addr)); 1732 if (dir == 0) { 1733 if (setflags) { 1734 q->brt_if = ifp; 1735 q->brt_flags = flags; 1736 } else if (!(q->brt_flags & IFBAF_STATIC)) 1737 q->brt_if = ifp; 1738 1739 if (q->brt_if == ifp) 1740 q->brt_age = 1; 1741 ifp = q->brt_if; 1742 bridge_copyaddr(sa, 1743 (struct sockaddr *)&q->brt_tunnel); 1744 1745 goto want; 1746 } 1747 1748 if (dir > 0) { 1749 if (sc->sc_brtcnt >= sc->sc_brtmax) 1750 goto done; 1751 p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT); 1752 if (p == NULL) 1753 goto done; 1754 1755 bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); 1756 p->brt_if = ifp; 1757 p->brt_age = 1; 1758 bridge_copyaddr(sa, 1759 (struct sockaddr *)&p->brt_tunnel); 1760 1761 if (setflags) 1762 p->brt_flags = flags; 1763 else 1764 p->brt_flags = IFBAF_DYNAMIC; 1765 1766 LIST_INSERT_BEFORE(q, p, brt_next); 1767 sc->sc_brtcnt++; 1768 goto want; 1769 } 1770 1771 if (p == NULL) { 1772 if (sc->sc_brtcnt >= sc->sc_brtmax) 1773 goto done; 1774 p = malloc(sizeof(*p), M_DEVBUF, M_NOWAIT); 1775 if (p == NULL) 1776 goto done; 1777 1778 bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); 1779 p->brt_if = ifp; 1780 p->brt_age = 1; 1781 bridge_copyaddr(sa, 1782 (struct sockaddr *)&p->brt_tunnel); 1783 1784 if (setflags) 1785 p->brt_flags = flags; 1786 else 1787 p->brt_flags = IFBAF_DYNAMIC; 1788 LIST_INSERT_AFTER(q, p, brt_next); 1789 sc->sc_brtcnt++; 1790 goto want; 1791 } 1792 } while (p != NULL); 1793 1794 done: 1795 ifp = NULL; 1796 want: 1797 return (ifp); 1798 } 1799 1800 struct bridge_rtnode * 1801 bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea) 1802 { 1803 struct bridge_rtnode *p; 1804 u_int32_t h; 1805 int dir; 1806 1807 h = bridge_hash(sc, ea); 1808 LIST_FOREACH(p, &sc->sc_rts[h], brt_next) { 1809 dir = memcmp(ea, &p->brt_addr, sizeof(p->brt_addr)); 1810 if (dir == 0) 1811 return (p); 1812 if (dir > 0) 1813 goto fail; 1814 } 1815 fail: 1816 return (NULL); 1817 } 1818 1819 /* 1820 * The following hash function is adapted from 'Hash Functions' by Bob Jenkins 1821 * ("Algorithm Alley", Dr. Dobbs Journal, September 1997). 1822 * "You may use this code any way you wish, private, educational, or 1823 * commercial. It's free." 1824 */ 1825 #define mix(a,b,c) \ 1826 do { \ 1827 a -= b; a -= c; a ^= (c >> 13); \ 1828 b -= c; b -= a; b ^= (a << 8); \ 1829 c -= a; c -= b; c ^= (b >> 13); \ 1830 a -= b; a -= c; a ^= (c >> 12); \ 1831 b -= c; b -= a; b ^= (a << 16); \ 1832 c -= a; c -= b; c ^= (b >> 5); \ 1833 a -= b; a -= c; a ^= (c >> 3); \ 1834 b -= c; b -= a; b ^= (a << 10); \ 1835 c -= a; c -= b; c ^= (b >> 15); \ 1836 } while (0) 1837 1838 u_int32_t 1839 bridge_hash(struct bridge_softc *sc, struct ether_addr *addr) 1840 { 1841 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_hashkey; 1842 1843 b += addr->ether_addr_octet[5] << 8; 1844 b += addr->ether_addr_octet[4]; 1845 a += addr->ether_addr_octet[3] << 24; 1846 a += addr->ether_addr_octet[2] << 16; 1847 a += addr->ether_addr_octet[1] << 8; 1848 a += addr->ether_addr_octet[0]; 1849 1850 mix(a, b, c); 1851 return (c & BRIDGE_RTABLE_MASK); 1852 } 1853 1854 void 1855 bridge_timer(void *vsc) 1856 { 1857 struct bridge_softc *sc = vsc; 1858 int s; 1859 1860 s = splsoftnet(); 1861 bridge_rtage(sc); 1862 splx(s); 1863 } 1864 1865 /* 1866 * Perform an aging cycle 1867 */ 1868 void 1869 bridge_rtage(struct bridge_softc *sc) 1870 { 1871 struct bridge_rtnode *n, *p; 1872 int i; 1873 1874 for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) { 1875 n = LIST_FIRST(&sc->sc_rts[i]); 1876 while (n != NULL) { 1877 if ((n->brt_flags & IFBAF_TYPEMASK) == IFBAF_STATIC) { 1878 n->brt_age = !n->brt_age; 1879 if (n->brt_age) 1880 n->brt_age = 0; 1881 n = LIST_NEXT(n, brt_next); 1882 } else if (n->brt_age) { 1883 n->brt_age = 0; 1884 n = LIST_NEXT(n, brt_next); 1885 } else { 1886 p = LIST_NEXT(n, brt_next); 1887 LIST_REMOVE(n, brt_next); 1888 sc->sc_brtcnt--; 1889 free(n, M_DEVBUF, 0); 1890 n = p; 1891 } 1892 } 1893 } 1894 1895 if (sc->sc_brttimeout != 0) 1896 timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout); 1897 } 1898 1899 void 1900 bridge_rtagenode(struct ifnet *ifp, int age) 1901 { 1902 struct bridge_softc *sc; 1903 struct bridge_rtnode *n; 1904 int i; 1905 1906 sc = ((struct bridge_iflist *)ifp->if_bridgeport)->bridge_sc; 1907 if (sc == NULL) 1908 return; 1909 1910 /* 1911 * If the age is zero then flush, otherwise set all the expiry times to 1912 * age for the interface 1913 */ 1914 if (age == 0) 1915 bridge_rtdelete(sc, ifp, 1); 1916 else { 1917 for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) { 1918 LIST_FOREACH(n, &sc->sc_rts[i], brt_next) { 1919 /* Cap the expiry time to 'age' */ 1920 if (n->brt_if == ifp && 1921 n->brt_age > time_uptime + age && 1922 (n->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) 1923 n->brt_age = time_uptime + age; 1924 } 1925 } 1926 } 1927 } 1928 1929 1930 1931 /* 1932 * Remove all dynamic addresses from the cache 1933 */ 1934 void 1935 bridge_rtflush(struct bridge_softc *sc, int full) 1936 { 1937 int i; 1938 struct bridge_rtnode *p, *n; 1939 1940 for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) { 1941 n = LIST_FIRST(&sc->sc_rts[i]); 1942 while (n != NULL) { 1943 if (full || 1944 (n->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) { 1945 p = LIST_NEXT(n, brt_next); 1946 LIST_REMOVE(n, brt_next); 1947 sc->sc_brtcnt--; 1948 free(n, M_DEVBUF, 0); 1949 n = p; 1950 } else 1951 n = LIST_NEXT(n, brt_next); 1952 } 1953 } 1954 } 1955 1956 /* 1957 * Remove an address from the cache 1958 */ 1959 int 1960 bridge_rtdaddr(struct bridge_softc *sc, struct ether_addr *ea) 1961 { 1962 int h; 1963 struct bridge_rtnode *p; 1964 1965 h = bridge_hash(sc, ea); 1966 LIST_FOREACH(p, &sc->sc_rts[h], brt_next) { 1967 if (bcmp(ea, &p->brt_addr, sizeof(p->brt_addr)) == 0) { 1968 LIST_REMOVE(p, brt_next); 1969 sc->sc_brtcnt--; 1970 free(p, M_DEVBUF, 0); 1971 return (0); 1972 } 1973 } 1974 1975 return (ENOENT); 1976 } 1977 /* 1978 * Delete routes to a specific interface member. 1979 */ 1980 void 1981 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int dynonly) 1982 { 1983 int i; 1984 struct bridge_rtnode *n, *p; 1985 1986 /* 1987 * Loop through all of the hash buckets and traverse each 1988 * chain looking for routes to this interface. 1989 */ 1990 for (i = 0; i < BRIDGE_RTABLE_SIZE; i++) { 1991 n = LIST_FIRST(&sc->sc_rts[i]); 1992 while (n != NULL) { 1993 if (n->brt_if != ifp) { 1994 /* Not ours */ 1995 n = LIST_NEXT(n, brt_next); 1996 continue; 1997 } 1998 if (dynonly && 1999 (n->brt_flags & IFBAF_TYPEMASK) != IFBAF_DYNAMIC) { 2000 /* only deleting dynamics */ 2001 n = LIST_NEXT(n, brt_next); 2002 continue; 2003 } 2004 p = LIST_NEXT(n, brt_next); 2005 LIST_REMOVE(n, brt_next); 2006 sc->sc_brtcnt--; 2007 free(n, M_DEVBUF, 0); 2008 n = p; 2009 } 2010 } 2011 } 2012 2013 /* 2014 * Gather all of the routes for this interface. 2015 */ 2016 int 2017 bridge_rtfind(struct bridge_softc *sc, struct ifbaconf *baconf) 2018 { 2019 int i, error = 0, onlycnt = 0; 2020 u_int32_t cnt = 0; 2021 struct bridge_rtnode *n; 2022 struct ifbareq bareq; 2023 2024 if (baconf->ifbac_len == 0) 2025 onlycnt = 1; 2026 2027 for (i = 0, cnt = 0; i < BRIDGE_RTABLE_SIZE; i++) { 2028 LIST_FOREACH(n, &sc->sc_rts[i], brt_next) { 2029 if (!onlycnt) { 2030 if (baconf->ifbac_len < sizeof(struct ifbareq)) 2031 goto done; 2032 bcopy(sc->sc_if.if_xname, bareq.ifba_name, 2033 sizeof(bareq.ifba_name)); 2034 bcopy(n->brt_if->if_xname, bareq.ifba_ifsname, 2035 sizeof(bareq.ifba_ifsname)); 2036 bcopy(&n->brt_addr, &bareq.ifba_dst, 2037 sizeof(bareq.ifba_dst)); 2038 bridge_copyaddr(&n->brt_tunnel.sa, 2039 (struct sockaddr *)&bareq.ifba_dstsa); 2040 bareq.ifba_age = n->brt_age; 2041 bareq.ifba_flags = n->brt_flags; 2042 error = copyout((caddr_t)&bareq, 2043 (caddr_t)(baconf->ifbac_req + cnt), sizeof(bareq)); 2044 if (error) 2045 goto done; 2046 baconf->ifbac_len -= sizeof(struct ifbareq); 2047 } 2048 cnt++; 2049 } 2050 } 2051 done: 2052 baconf->ifbac_len = cnt * sizeof(struct ifbareq); 2053 return (error); 2054 } 2055 2056 /* 2057 * Block non-ip frames: 2058 * Returns 0 if frame is ip, and 1 if it should be dropped. 2059 */ 2060 int 2061 bridge_blocknonip(struct ether_header *eh, struct mbuf *m) 2062 { 2063 struct llc llc; 2064 u_int16_t etype; 2065 2066 if (m->m_pkthdr.len < ETHER_HDR_LEN) 2067 return (1); 2068 2069 #if NVLAN > 0 2070 if (m->m_flags & M_VLANTAG) 2071 return (1); 2072 #endif 2073 2074 etype = ntohs(eh->ether_type); 2075 switch (etype) { 2076 case ETHERTYPE_ARP: 2077 case ETHERTYPE_REVARP: 2078 case ETHERTYPE_IP: 2079 case ETHERTYPE_IPV6: 2080 return (0); 2081 } 2082 2083 if (etype > ETHERMTU) 2084 return (1); 2085 2086 if (m->m_pkthdr.len < 2087 (ETHER_HDR_LEN + LLC_SNAPFRAMELEN)) 2088 return (1); 2089 2090 m_copydata(m, ETHER_HDR_LEN, LLC_SNAPFRAMELEN, 2091 (caddr_t)&llc); 2092 2093 etype = ntohs(llc.llc_snap.ether_type); 2094 if (llc.llc_dsap == LLC_SNAP_LSAP && 2095 llc.llc_ssap == LLC_SNAP_LSAP && 2096 llc.llc_control == LLC_UI && 2097 llc.llc_snap.org_code[0] == 0 && 2098 llc.llc_snap.org_code[1] == 0 && 2099 llc.llc_snap.org_code[2] == 0 && 2100 (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP || 2101 etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)) { 2102 return (0); 2103 } 2104 2105 return (1); 2106 } 2107 2108 u_int8_t 2109 bridge_filterrule(struct brl_head *h, struct ether_header *eh, struct mbuf *m) 2110 { 2111 struct brl_node *n; 2112 u_int8_t flags; 2113 2114 SIMPLEQ_FOREACH(n, h, brl_next) { 2115 flags = n->brl_flags & (BRL_FLAG_SRCVALID|BRL_FLAG_DSTVALID); 2116 if (flags == 0) 2117 goto return_action; 2118 if (flags == (BRL_FLAG_SRCVALID|BRL_FLAG_DSTVALID)) { 2119 if (bcmp(eh->ether_shost, &n->brl_src, ETHER_ADDR_LEN)) 2120 continue; 2121 if (bcmp(eh->ether_dhost, &n->brl_dst, ETHER_ADDR_LEN)) 2122 continue; 2123 goto return_action; 2124 } 2125 if (flags == BRL_FLAG_SRCVALID) { 2126 if (bcmp(eh->ether_shost, &n->brl_src, ETHER_ADDR_LEN)) 2127 continue; 2128 goto return_action; 2129 } 2130 if (flags == BRL_FLAG_DSTVALID) { 2131 if (bcmp(eh->ether_dhost, &n->brl_dst, ETHER_ADDR_LEN)) 2132 continue; 2133 goto return_action; 2134 } 2135 } 2136 return (BRL_ACTION_PASS); 2137 2138 return_action: 2139 #if NPF > 0 2140 pf_tag_packet(m, n->brl_tag, -1); 2141 #endif 2142 return (n->brl_action); 2143 } 2144 2145 int 2146 bridge_addrule(struct bridge_iflist *bif, struct ifbrlreq *req, int out) 2147 { 2148 struct brl_node *n; 2149 2150 n = malloc(sizeof(*n), M_DEVBUF, M_NOWAIT); 2151 if (n == NULL) 2152 return (ENOMEM); 2153 bcopy(&req->ifbr_src, &n->brl_src, sizeof(struct ether_addr)); 2154 bcopy(&req->ifbr_dst, &n->brl_dst, sizeof(struct ether_addr)); 2155 n->brl_action = req->ifbr_action; 2156 n->brl_flags = req->ifbr_flags; 2157 #if NPF > 0 2158 if (req->ifbr_tagname[0]) 2159 n->brl_tag = pf_tagname2tag(req->ifbr_tagname, 1); 2160 else 2161 n->brl_tag = 0; 2162 #endif 2163 if (out) { 2164 n->brl_flags &= ~BRL_FLAG_IN; 2165 n->brl_flags |= BRL_FLAG_OUT; 2166 SIMPLEQ_INSERT_TAIL(&bif->bif_brlout, n, brl_next); 2167 } else { 2168 n->brl_flags &= ~BRL_FLAG_OUT; 2169 n->brl_flags |= BRL_FLAG_IN; 2170 SIMPLEQ_INSERT_TAIL(&bif->bif_brlin, n, brl_next); 2171 } 2172 return (0); 2173 } 2174 2175 void 2176 bridge_flushrule(struct bridge_iflist *bif) 2177 { 2178 struct brl_node *p; 2179 2180 while (!SIMPLEQ_EMPTY(&bif->bif_brlin)) { 2181 p = SIMPLEQ_FIRST(&bif->bif_brlin); 2182 SIMPLEQ_REMOVE_HEAD(&bif->bif_brlin, brl_next); 2183 #if NPF > 0 2184 pf_tag_unref(p->brl_tag); 2185 #endif 2186 free(p, M_DEVBUF, 0); 2187 } 2188 while (!SIMPLEQ_EMPTY(&bif->bif_brlout)) { 2189 p = SIMPLEQ_FIRST(&bif->bif_brlout); 2190 SIMPLEQ_REMOVE_HEAD(&bif->bif_brlout, brl_next); 2191 #if NPF > 0 2192 pf_tag_unref(p->brl_tag); 2193 #endif 2194 free(p, M_DEVBUF, 0); 2195 } 2196 } 2197 2198 #ifdef IPSEC 2199 int 2200 bridge_ipsec(struct bridge_softc *sc, struct ifnet *ifp, 2201 struct ether_header *eh, int hassnap, struct llc *llc, 2202 int dir, int af, int hlen, struct mbuf *m) 2203 { 2204 union sockaddr_union dst; 2205 struct timeval tv; 2206 struct tdb *tdb; 2207 u_int32_t spi; 2208 u_int16_t cpi; 2209 int error, off, s; 2210 u_int8_t proto = 0; 2211 #ifdef INET 2212 struct ip *ip; 2213 #endif /* INET */ 2214 #ifdef INET6 2215 struct ip6_hdr *ip6; 2216 #endif /* INET6 */ 2217 #if NPF > 0 2218 struct ifnet *encif; 2219 #endif 2220 2221 if (dir == BRIDGE_IN) { 2222 switch (af) { 2223 #ifdef INET 2224 case AF_INET: 2225 if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t)) 2226 break; 2227 2228 ip = mtod(m, struct ip *); 2229 proto = ip->ip_p; 2230 off = offsetof(struct ip, ip_p); 2231 2232 if (proto != IPPROTO_ESP && proto != IPPROTO_AH && 2233 proto != IPPROTO_IPCOMP) 2234 goto skiplookup; 2235 2236 bzero(&dst, sizeof(union sockaddr_union)); 2237 dst.sa.sa_family = AF_INET; 2238 dst.sin.sin_len = sizeof(struct sockaddr_in); 2239 m_copydata(m, offsetof(struct ip, ip_dst), 2240 sizeof(struct in_addr), 2241 (caddr_t)&dst.sin.sin_addr); 2242 2243 if (ip->ip_p == IPPROTO_ESP) 2244 m_copydata(m, hlen, sizeof(u_int32_t), 2245 (caddr_t)&spi); 2246 else if (ip->ip_p == IPPROTO_AH) 2247 m_copydata(m, hlen + sizeof(u_int32_t), 2248 sizeof(u_int32_t), (caddr_t)&spi); 2249 else if (ip->ip_p == IPPROTO_IPCOMP) { 2250 m_copydata(m, hlen + sizeof(u_int16_t), 2251 sizeof(u_int16_t), (caddr_t)&cpi); 2252 spi = ntohl(htons(cpi)); 2253 } 2254 break; 2255 #endif /* INET */ 2256 #ifdef INET6 2257 case AF_INET6: 2258 if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t)) 2259 break; 2260 2261 ip6 = mtod(m, struct ip6_hdr *); 2262 2263 /* XXX We should chase down the header chain */ 2264 proto = ip6->ip6_nxt; 2265 off = offsetof(struct ip6_hdr, ip6_nxt); 2266 2267 if (proto != IPPROTO_ESP && proto != IPPROTO_AH && 2268 proto != IPPROTO_IPCOMP) 2269 goto skiplookup; 2270 2271 bzero(&dst, sizeof(union sockaddr_union)); 2272 dst.sa.sa_family = AF_INET6; 2273 dst.sin6.sin6_len = sizeof(struct sockaddr_in6); 2274 m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt), 2275 sizeof(struct in6_addr), 2276 (caddr_t)&dst.sin6.sin6_addr); 2277 2278 if (proto == IPPROTO_ESP) 2279 m_copydata(m, hlen, sizeof(u_int32_t), 2280 (caddr_t)&spi); 2281 else if (proto == IPPROTO_AH) 2282 m_copydata(m, hlen + sizeof(u_int32_t), 2283 sizeof(u_int32_t), (caddr_t)&spi); 2284 else if (proto == IPPROTO_IPCOMP) { 2285 m_copydata(m, hlen + sizeof(u_int16_t), 2286 sizeof(u_int16_t), (caddr_t)&cpi); 2287 spi = ntohl(htons(cpi)); 2288 } 2289 break; 2290 #endif /* INET6 */ 2291 default: 2292 return (0); 2293 } 2294 2295 if (proto == 0) 2296 goto skiplookup; 2297 2298 s = splsoftnet(); 2299 2300 tdb = gettdb(ifp->if_rdomain, spi, &dst, proto); 2301 if (tdb != NULL && (tdb->tdb_flags & TDBF_INVALID) == 0 && 2302 tdb->tdb_xform != NULL) { 2303 if (tdb->tdb_first_use == 0) { 2304 tdb->tdb_first_use = time_second; 2305 2306 tv.tv_usec = 0; 2307 2308 /* Check for wrap-around. */ 2309 if (tdb->tdb_exp_first_use + tdb->tdb_first_use 2310 < tdb->tdb_first_use) 2311 tv.tv_sec = ((unsigned long)-1) / 2; 2312 else 2313 tv.tv_sec = tdb->tdb_exp_first_use + 2314 tdb->tdb_first_use; 2315 2316 if (tdb->tdb_flags & TDBF_FIRSTUSE) 2317 timeout_add(&tdb->tdb_first_tmo, 2318 hzto(&tv)); 2319 2320 /* Check for wrap-around. */ 2321 if (tdb->tdb_first_use + 2322 tdb->tdb_soft_first_use 2323 < tdb->tdb_first_use) 2324 tv.tv_sec = ((unsigned long)-1) / 2; 2325 else 2326 tv.tv_sec = tdb->tdb_first_use + 2327 tdb->tdb_soft_first_use; 2328 2329 if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE) 2330 timeout_add(&tdb->tdb_sfirst_tmo, 2331 hzto(&tv)); 2332 } 2333 2334 (*(tdb->tdb_xform->xf_input))(m, tdb, hlen, off); 2335 splx(s); 2336 return (1); 2337 } else { 2338 splx(s); 2339 skiplookup: 2340 /* XXX do an input policy lookup */ 2341 return (0); 2342 } 2343 } else { /* Outgoing from the bridge. */ 2344 tdb = ipsp_spd_lookup(m, af, hlen, &error, 2345 IPSP_DIRECTION_OUT, NULL, NULL, 0); 2346 if (tdb != NULL) { 2347 /* 2348 * We don't need to do loop detection, the 2349 * bridge will do that for us. 2350 */ 2351 #if NPF > 0 2352 if ((encif = enc_getif(tdb->tdb_rdomain, 2353 tdb->tdb_tap)) == NULL || 2354 pf_test(af, dir, encif, 2355 &m, NULL) != PF_PASS) { 2356 m_freem(m); 2357 return (1); 2358 } 2359 if (m == NULL) 2360 return (1); 2361 else if (af == AF_INET) 2362 in_proto_cksum_out(m, encif); 2363 #ifdef INET6 2364 else if (af == AF_INET6) 2365 in6_proto_cksum_out(m, encif); 2366 #endif /* INET6 */ 2367 #endif /* NPF */ 2368 2369 ip = mtod(m, struct ip *); 2370 if ((af == AF_INET) && 2371 ip_mtudisc && (ip->ip_off & htons(IP_DF)) && 2372 tdb->tdb_mtu && ntohs(ip->ip_len) > tdb->tdb_mtu && 2373 tdb->tdb_mtutimeout > time_second) 2374 bridge_send_icmp_err(sc, ifp, eh, m, 2375 hassnap, llc, tdb->tdb_mtu, 2376 ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG); 2377 else 2378 error = ipsp_process_packet(m, tdb, af, 0); 2379 return (1); 2380 } else 2381 return (0); 2382 } 2383 2384 return (0); 2385 } 2386 #endif /* IPSEC */ 2387 2388 /* 2389 * Filter IP packets by peeking into the ethernet frame. This violates 2390 * the ISO model, but allows us to act as a IP filter at the data link 2391 * layer. As a result, most of this code will look familiar to those 2392 * who've read net/if_ethersubr.c and netinet/ip_input.c 2393 */ 2394 struct mbuf * 2395 bridge_ip(struct bridge_softc *sc, int dir, struct ifnet *ifp, 2396 struct ether_header *eh, struct mbuf *m) 2397 { 2398 struct llc llc; 2399 int hassnap = 0; 2400 struct ip *ip; 2401 int hlen; 2402 u_int16_t etype; 2403 2404 #if NVLAN > 0 2405 if (m->m_flags & M_VLANTAG) 2406 return (m); 2407 #endif 2408 2409 etype = ntohs(eh->ether_type); 2410 2411 if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) { 2412 if (etype > ETHERMTU || 2413 m->m_pkthdr.len < (LLC_SNAPFRAMELEN + 2414 ETHER_HDR_LEN)) 2415 return (m); 2416 2417 m_copydata(m, ETHER_HDR_LEN, 2418 LLC_SNAPFRAMELEN, (caddr_t)&llc); 2419 2420 if (llc.llc_dsap != LLC_SNAP_LSAP || 2421 llc.llc_ssap != LLC_SNAP_LSAP || 2422 llc.llc_control != LLC_UI || 2423 llc.llc_snap.org_code[0] || 2424 llc.llc_snap.org_code[1] || 2425 llc.llc_snap.org_code[2]) 2426 return (m); 2427 2428 etype = ntohs(llc.llc_snap.ether_type); 2429 if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) 2430 return (m); 2431 hassnap = 1; 2432 } 2433 2434 m_adj(m, ETHER_HDR_LEN); 2435 if (hassnap) 2436 m_adj(m, LLC_SNAPFRAMELEN); 2437 2438 switch (etype) { 2439 2440 case ETHERTYPE_IP: 2441 if (m->m_pkthdr.len < sizeof(struct ip)) 2442 goto dropit; 2443 2444 /* Copy minimal header, and drop invalids */ 2445 if (m->m_len < sizeof(struct ip) && 2446 (m = m_pullup(m, sizeof(struct ip))) == NULL) { 2447 ipstat.ips_toosmall++; 2448 return (NULL); 2449 } 2450 ip = mtod(m, struct ip *); 2451 2452 if (ip->ip_v != IPVERSION) { 2453 ipstat.ips_badvers++; 2454 goto dropit; 2455 } 2456 2457 hlen = ip->ip_hl << 2; /* get whole header length */ 2458 if (hlen < sizeof(struct ip)) { 2459 ipstat.ips_badhlen++; 2460 goto dropit; 2461 } 2462 2463 if (hlen > m->m_len) { 2464 if ((m = m_pullup(m, hlen)) == NULL) { 2465 ipstat.ips_badhlen++; 2466 return (NULL); 2467 } 2468 ip = mtod(m, struct ip *); 2469 } 2470 2471 if ((m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_OK) == 0) { 2472 if (m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_BAD) { 2473 ipstat.ips_badsum++; 2474 goto dropit; 2475 } 2476 2477 ipstat.ips_inswcsum++; 2478 if (in_cksum(m, hlen) != 0) { 2479 ipstat.ips_badsum++; 2480 goto dropit; 2481 } 2482 } 2483 2484 if (ntohs(ip->ip_len) < hlen) 2485 goto dropit; 2486 2487 if (m->m_pkthdr.len < ntohs(ip->ip_len)) 2488 goto dropit; 2489 if (m->m_pkthdr.len > ntohs(ip->ip_len)) { 2490 if (m->m_len == m->m_pkthdr.len) { 2491 m->m_len = ntohs(ip->ip_len); 2492 m->m_pkthdr.len = ntohs(ip->ip_len); 2493 } else 2494 m_adj(m, ntohs(ip->ip_len) - m->m_pkthdr.len); 2495 } 2496 2497 #ifdef IPSEC 2498 if ((sc->sc_if.if_flags & IFF_LINK2) == IFF_LINK2 && 2499 bridge_ipsec(sc, ifp, eh, hassnap, &llc, 2500 dir, AF_INET, hlen, m)) 2501 return (NULL); 2502 #endif /* IPSEC */ 2503 #if NPF > 0 2504 /* Finally, we get to filter the packet! */ 2505 if (pf_test(AF_INET, dir, ifp, &m, eh) != PF_PASS) 2506 goto dropit; 2507 if (m == NULL) 2508 goto dropit; 2509 #endif /* NPF > 0 */ 2510 2511 /* Rebuild the IP header */ 2512 if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL)) 2513 return (NULL); 2514 if (m->m_len < sizeof(struct ip)) 2515 goto dropit; 2516 in_proto_cksum_out(m, ifp); 2517 ip = mtod(m, struct ip *); 2518 ip->ip_sum = 0; 2519 if (0 && (ifp->if_capabilities & IFCAP_CSUM_IPv4)) 2520 m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT; 2521 else { 2522 ipstat.ips_outswcsum++; 2523 ip->ip_sum = in_cksum(m, hlen); 2524 } 2525 2526 break; 2527 2528 #ifdef INET6 2529 case ETHERTYPE_IPV6: { 2530 struct ip6_hdr *ip6; 2531 2532 if (m->m_len < sizeof(struct ip6_hdr)) { 2533 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) 2534 == NULL) { 2535 ip6stat.ip6s_toosmall++; 2536 return (NULL); 2537 } 2538 } 2539 2540 ip6 = mtod(m, struct ip6_hdr *); 2541 2542 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) { 2543 ip6stat.ip6s_badvers++; 2544 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr); 2545 goto dropit; 2546 } 2547 2548 #ifdef IPSEC 2549 hlen = sizeof(struct ip6_hdr); 2550 2551 if ((sc->sc_if.if_flags & IFF_LINK2) == IFF_LINK2 && 2552 bridge_ipsec(sc, ifp, eh, hassnap, &llc, 2553 dir, AF_INET6, hlen, m)) 2554 return (NULL); 2555 #endif /* IPSEC */ 2556 2557 #if NPF > 0 2558 if (pf_test(AF_INET6, dir, ifp, &m, eh) != PF_PASS) 2559 goto dropit; 2560 if (m == NULL) 2561 return (NULL); 2562 #endif /* NPF > 0 */ 2563 in6_proto_cksum_out(m, ifp); 2564 2565 break; 2566 } 2567 #endif /* INET6 */ 2568 2569 default: 2570 goto dropit; 2571 break; 2572 } 2573 2574 /* Reattach SNAP header */ 2575 if (hassnap) { 2576 M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT); 2577 if (m == NULL) 2578 goto dropit; 2579 bcopy(&llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN); 2580 } 2581 2582 /* Reattach ethernet header */ 2583 M_PREPEND(m, sizeof(*eh), M_DONTWAIT); 2584 if (m == NULL) 2585 goto dropit; 2586 bcopy(eh, mtod(m, caddr_t), sizeof(*eh)); 2587 2588 return (m); 2589 2590 dropit: 2591 if (m != NULL) 2592 m_freem(m); 2593 return (NULL); 2594 } 2595 2596 void 2597 bridge_fragment(struct bridge_softc *sc, struct ifnet *ifp, 2598 struct ether_header *eh, struct mbuf *m) 2599 { 2600 struct llc llc; 2601 struct mbuf *m0; 2602 int s, error = 0; 2603 int hassnap = 0; 2604 #ifdef INET 2605 u_int16_t etype; 2606 struct ip *ip; 2607 #endif 2608 2609 #ifndef INET 2610 goto dropit; 2611 #else 2612 etype = ntohs(eh->ether_type); 2613 #if NVLAN > 0 2614 if ((m->m_flags & M_VLANTAG) || etype == ETHERTYPE_VLAN || 2615 etype == ETHERTYPE_QINQ) { 2616 int len = m->m_pkthdr.len; 2617 2618 if (m->m_flags & M_VLANTAG) 2619 len += ETHER_VLAN_ENCAP_LEN; 2620 if ((ifp->if_capabilities & IFCAP_VLAN_MTU) && 2621 (len - sizeof(struct ether_vlan_header) <= ifp->if_mtu)) { 2622 s = splnet(); 2623 bridge_ifenqueue(sc, ifp, m); 2624 splx(s); 2625 return; 2626 } 2627 goto dropit; 2628 } 2629 #endif 2630 if (etype != ETHERTYPE_IP) { 2631 if (etype > ETHERMTU || 2632 m->m_pkthdr.len < (LLC_SNAPFRAMELEN + 2633 ETHER_HDR_LEN)) 2634 goto dropit; 2635 2636 m_copydata(m, ETHER_HDR_LEN, 2637 LLC_SNAPFRAMELEN, (caddr_t)&llc); 2638 2639 if (llc.llc_dsap != LLC_SNAP_LSAP || 2640 llc.llc_ssap != LLC_SNAP_LSAP || 2641 llc.llc_control != LLC_UI || 2642 llc.llc_snap.org_code[0] || 2643 llc.llc_snap.org_code[1] || 2644 llc.llc_snap.org_code[2] || 2645 llc.llc_snap.ether_type != htons(ETHERTYPE_IP)) 2646 goto dropit; 2647 2648 hassnap = 1; 2649 } 2650 2651 m_adj(m, ETHER_HDR_LEN); 2652 if (hassnap) 2653 m_adj(m, LLC_SNAPFRAMELEN); 2654 2655 if (m->m_len < sizeof(struct ip) && 2656 (m = m_pullup(m, sizeof(struct ip))) == NULL) 2657 goto dropit; 2658 ip = mtod(m, struct ip *); 2659 2660 /* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */ 2661 if (ip->ip_off & htons(IP_DF)) { 2662 bridge_send_icmp_err(sc, ifp, eh, m, hassnap, &llc, 2663 ifp->if_mtu, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG); 2664 return; 2665 } 2666 2667 error = ip_fragment(m, ifp, ifp->if_mtu); 2668 if (error) { 2669 m = NULL; 2670 goto dropit; 2671 } 2672 2673 for (; m; m = m0) { 2674 m0 = m->m_nextpkt; 2675 m->m_nextpkt = NULL; 2676 if (error == 0) { 2677 if (hassnap) { 2678 M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT); 2679 if (m == NULL) { 2680 error = ENOBUFS; 2681 continue; 2682 } 2683 bcopy(&llc, mtod(m, caddr_t), 2684 LLC_SNAPFRAMELEN); 2685 } 2686 M_PREPEND(m, sizeof(*eh), M_DONTWAIT); 2687 if (m == NULL) { 2688 error = ENOBUFS; 2689 continue; 2690 } 2691 bcopy(eh, mtod(m, caddr_t), sizeof(*eh)); 2692 s = splnet(); 2693 error = bridge_ifenqueue(sc, ifp, m); 2694 if (error) { 2695 splx(s); 2696 continue; 2697 } 2698 splx(s); 2699 } else 2700 m_freem(m); 2701 } 2702 2703 if (error == 0) 2704 ipstat.ips_fragmented++; 2705 2706 return; 2707 #endif /* INET */ 2708 dropit: 2709 if (m != NULL) 2710 m_freem(m); 2711 } 2712 2713 int 2714 bridge_ifenqueue(struct bridge_softc *sc, struct ifnet *ifp, struct mbuf *m) 2715 { 2716 int error, len; 2717 short mflags; 2718 2719 #if NGIF > 0 2720 /* Packet needs etherip encapsulation. */ 2721 if (ifp->if_type == IFT_GIF) { 2722 m->m_flags |= M_PROTO1; 2723 2724 /* Count packets input into the gif from outside */ 2725 ifp->if_ipackets++; 2726 ifp->if_ibytes += m->m_pkthdr.len; 2727 } 2728 #endif 2729 #if NVLAN > 0 2730 /* 2731 * If the underlying interface cannot do VLAN tag insertion itself, 2732 * create an encapsulation header. 2733 */ 2734 if ((m->m_flags & M_VLANTAG) && 2735 (ifp->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0) { 2736 struct ether_vlan_header evh; 2737 2738 m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&evh); 2739 evh.evl_proto = evh.evl_encap_proto; 2740 evh.evl_encap_proto = htons(ETHERTYPE_VLAN); 2741 evh.evl_tag = htons(m->m_pkthdr.ether_vtag); 2742 m_adj(m, ETHER_HDR_LEN); 2743 M_PREPEND(m, sizeof(evh), M_DONTWAIT); 2744 if (m == NULL) { 2745 sc->sc_if.if_oerrors++; 2746 return (ENOBUFS); 2747 } 2748 m_copyback(m, 0, sizeof(evh), &evh, M_NOWAIT); 2749 m->m_flags &= ~M_VLANTAG; 2750 } 2751 #endif 2752 len = m->m_pkthdr.len; 2753 mflags = m->m_flags; 2754 IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error); 2755 if (error) { 2756 sc->sc_if.if_oerrors++; 2757 return (error); 2758 } 2759 sc->sc_if.if_opackets++; 2760 sc->sc_if.if_obytes += len; 2761 ifp->if_obytes += len; 2762 if (mflags & M_MCAST) 2763 ifp->if_omcasts++; 2764 if_start(ifp); 2765 2766 return (0); 2767 } 2768 2769 #ifdef INET 2770 void 2771 bridge_send_icmp_err(struct bridge_softc *sc, struct ifnet *ifp, 2772 struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc, 2773 int mtu, int type, int code) 2774 { 2775 struct ip *ip; 2776 struct icmp *icp; 2777 struct in_addr t; 2778 struct mbuf *m, *n2; 2779 int hlen; 2780 u_int8_t ether_tmp[ETHER_ADDR_LEN]; 2781 2782 n2 = m_copym(n, 0, M_COPYALL, M_DONTWAIT); 2783 if (!n2) { 2784 m_freem(n); 2785 return; 2786 } 2787 m = icmp_do_error(n, type, code, 0, mtu); 2788 if (m == NULL) { 2789 m_freem(n2); 2790 return; 2791 } 2792 2793 n = n2; 2794 2795 ip = mtod(m, struct ip *); 2796 hlen = ip->ip_hl << 2; 2797 t = ip->ip_dst; 2798 ip->ip_dst = ip->ip_src; 2799 ip->ip_src = t; 2800 2801 m->m_data += hlen; 2802 m->m_len -= hlen; 2803 icp = mtod(m, struct icmp *); 2804 icp->icmp_cksum = 0; 2805 icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen); 2806 m->m_data -= hlen; 2807 m->m_len += hlen; 2808 2809 ip->ip_v = IPVERSION; 2810 ip->ip_off &= htons(IP_DF); 2811 ip->ip_id = htons(ip_randomid()); 2812 ip->ip_ttl = MAXTTL; 2813 ip->ip_sum = 0; 2814 ip->ip_sum = in_cksum(m, hlen); 2815 2816 /* Swap ethernet addresses */ 2817 bcopy(&eh->ether_dhost, ðer_tmp, sizeof(ether_tmp)); 2818 bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp)); 2819 bcopy(ðer_tmp, &eh->ether_shost, sizeof(ether_tmp)); 2820 2821 /* Reattach SNAP header */ 2822 if (hassnap) { 2823 M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT); 2824 if (m == NULL) 2825 goto dropit; 2826 bcopy(llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN); 2827 } 2828 2829 /* Reattach ethernet header */ 2830 M_PREPEND(m, sizeof(*eh), M_DONTWAIT); 2831 if (m == NULL) 2832 goto dropit; 2833 bcopy(eh, mtod(m, caddr_t), sizeof(*eh)); 2834 2835 bridge_output(ifp, m, NULL, NULL); 2836 m_freem(n); 2837 return; 2838 2839 dropit: 2840 m_freem(n); 2841 } 2842 #endif 2843 2844 struct sockaddr * 2845 bridge_tunnel(struct mbuf *m) 2846 { 2847 struct m_tag *mtag; 2848 2849 if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL) 2850 return (NULL); 2851 2852 return ((struct sockaddr *)(mtag + 1)); 2853 } 2854 2855 struct sockaddr * 2856 bridge_tunneltag(struct mbuf *m, int af) 2857 { 2858 struct m_tag *mtag; 2859 size_t len; 2860 struct sockaddr *sa; 2861 2862 if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) { 2863 sa = (struct sockaddr *)(mtag + 1); 2864 if (sa->sa_family != af) { 2865 m_tag_delete(m, mtag); 2866 mtag = NULL; 2867 } 2868 } 2869 if (mtag == NULL) { 2870 if (af == AF_INET) 2871 len = sizeof(struct sockaddr_in); 2872 else if (af == AF_INET6) 2873 len = sizeof(struct sockaddr_in6); 2874 else 2875 return (NULL); 2876 mtag = m_tag_get(PACKET_TAG_TUNNEL, len, M_NOWAIT); 2877 if (mtag == NULL) 2878 return (NULL); 2879 bzero(mtag + 1, len); 2880 sa = (struct sockaddr *)(mtag + 1); 2881 sa->sa_family = af; 2882 sa->sa_len = len; 2883 m_tag_prepend(m, mtag); 2884 } 2885 2886 return ((struct sockaddr *)(mtag + 1)); 2887 } 2888 2889 void 2890 bridge_tunneluntag(struct mbuf *m) 2891 { 2892 struct m_tag *mtag; 2893 if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) 2894 m_tag_delete(m, mtag); 2895 } 2896 2897 void 2898 bridge_copyaddr(struct sockaddr *src, struct sockaddr *dst) 2899 { 2900 if (src != NULL && src->sa_family != AF_UNSPEC) 2901 memcpy(dst, src, src->sa_len); 2902 else 2903 dst->sa_family = AF_UNSPEC; 2904 } 2905