xref: /openbsd-src/sys/net/if_bridge.c (revision c90a81c56dcebd6a1b73fe4aff9b03385b8e63b3)
1 /*	$OpenBSD: if_bridge.c,v 1.315 2018/12/12 14:19:15 mpi Exp $	*/
2 
3 /*
4  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
19  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
25  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  *
28  * Effort sponsored in part by the Defense Advanced Research Projects
29  * Agency (DARPA) and Air Force Research Laboratory, Air Force
30  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
31  *
32  */
33 
34 #include "bpfilter.h"
35 #include "gif.h"
36 #include "pf.h"
37 #include "carp.h"
38 #include "vlan.h"
39 #include "mpw.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/mbuf.h>
44 #include <sys/socket.h>
45 #include <sys/ioctl.h>
46 #include <sys/kernel.h>
47 
48 #include <net/if.h>
49 #include <net/if_types.h>
50 #include <net/if_llc.h>
51 #include <net/netisr.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip_var.h>
56 #include <netinet/if_ether.h>
57 #include <netinet/ip_icmp.h>
58 
59 #ifdef IPSEC
60 #include <netinet/ip_ipsp.h>
61 #include <net/if_enc.h>
62 #endif
63 
64 #ifdef INET6
65 #include <netinet6/in6_var.h>
66 #include <netinet/ip6.h>
67 #include <netinet6/ip6_var.h>
68 #endif
69 
70 #if NPF > 0
71 #include <net/pfvar.h>
72 #define	BRIDGE_IN	PF_IN
73 #define	BRIDGE_OUT	PF_OUT
74 #else
75 #define	BRIDGE_IN	0
76 #define	BRIDGE_OUT	1
77 #endif
78 
79 #if NBPFILTER > 0
80 #include <net/bpf.h>
81 #endif
82 
83 #if NCARP > 0
84 #include <netinet/ip_carp.h>
85 #endif
86 
87 #if NVLAN > 0
88 #include <net/if_vlan_var.h>
89 #endif
90 
91 #include <net/if_bridge.h>
92 
93 /*
94  * Maximum number of addresses to cache
95  */
96 #ifndef	BRIDGE_RTABLE_MAX
97 #define	BRIDGE_RTABLE_MAX	100
98 #endif
99 
100 /*
101  * Timeout (in seconds) for entries learned dynamically
102  */
103 #ifndef	BRIDGE_RTABLE_TIMEOUT
104 #define	BRIDGE_RTABLE_TIMEOUT	240
105 #endif
106 
107 void	bridgeattach(int);
108 int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
109 void	bridge_ifdetach(void *);
110 void	bridge_spandetach(void *);
111 int	bridge_input(struct ifnet *, struct mbuf *, void *);
112 void	bridge_process(struct ifnet *, struct mbuf *);
113 void	bridgeintr_frame(struct bridge_softc *, struct ifnet *, struct mbuf *);
114 void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
115     struct ether_header *, struct mbuf *);
116 int	bridge_localbroadcast(struct ifnet *, struct ether_header *,
117     struct mbuf *);
118 void	bridge_span(struct bridge_softc *, struct mbuf *);
119 void	bridge_stop(struct bridge_softc *);
120 void	bridge_init(struct bridge_softc *);
121 int	bridge_bifconf(struct bridge_softc *, struct ifbifconf *);
122 int bridge_blocknonip(struct ether_header *, struct mbuf *);
123 void	bridge_ifinput(struct ifnet *, struct mbuf *);
124 int	bridge_dummy_output(struct ifnet *, struct mbuf *, struct sockaddr *,
125     struct rtentry *);
126 void	bridge_send_icmp_err(struct ifnet *, struct ether_header *,
127     struct mbuf *, int, struct llc *, int, int, int);
128 int	bridge_ifenqueue(struct ifnet *, struct ifnet *, struct mbuf *);
129 struct mbuf *bridge_ip(struct ifnet *, int, struct ifnet *,
130     struct ether_header *, struct mbuf *);
131 #ifdef IPSEC
132 int bridge_ipsec(struct ifnet *, struct ether_header *, int, struct llc *,
133     int, int, int, struct mbuf *);
134 #endif
135 int     bridge_clone_create(struct if_clone *, int);
136 int	bridge_clone_destroy(struct ifnet *);
137 int	bridge_delete(struct bridge_softc *, struct bridge_iflist *);
138 
139 #define	ETHERADDR_IS_IP_MCAST(a) \
140 	/* struct etheraddr *a;	*/				\
141 	((a)->ether_addr_octet[0] == 0x01 &&			\
142 	 (a)->ether_addr_octet[1] == 0x00 &&			\
143 	 (a)->ether_addr_octet[2] == 0x5e)
144 
145 struct niqueue bridgeintrq = NIQUEUE_INITIALIZER(1024, NETISR_BRIDGE);
146 
147 struct if_clone bridge_cloner =
148     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
149 
150 void
151 bridgeattach(int n)
152 {
153 	if_clone_attach(&bridge_cloner);
154 }
155 
156 int
157 bridge_clone_create(struct if_clone *ifc, int unit)
158 {
159 	struct bridge_softc *sc;
160 	struct ifnet *ifp;
161 	int i;
162 
163 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
164 	sc->sc_stp = bstp_create(&sc->sc_if);
165 	if (!sc->sc_stp) {
166 		free(sc, M_DEVBUF, sizeof *sc);
167 		return (ENOMEM);
168 	}
169 
170 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
171 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
172 	timeout_set(&sc->sc_brtimeout, bridge_rtage, sc);
173 	TAILQ_INIT(&sc->sc_iflist);
174 	TAILQ_INIT(&sc->sc_spanlist);
175 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++)
176 		LIST_INIT(&sc->sc_rts[i]);
177 	arc4random_buf(&sc->sc_hashkey, sizeof(sc->sc_hashkey));
178 	ifp = &sc->sc_if;
179 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
180 	    unit);
181 	ifp->if_softc = sc;
182 	ifp->if_mtu = ETHERMTU;
183 	ifp->if_ioctl = bridge_ioctl;
184 	ifp->if_output = bridge_dummy_output;
185 	ifp->if_xflags = IFXF_CLONED;
186 	ifp->if_start = NULL;
187 	ifp->if_type = IFT_BRIDGE;
188 	ifp->if_hdrlen = ETHER_HDR_LEN;
189 
190 	if_attach(ifp);
191 	if_alloc_sadl(ifp);
192 
193 #if NBPFILTER > 0
194 	bpfattach(&sc->sc_if.if_bpf, ifp,
195 	    DLT_EN10MB, ETHER_HDR_LEN);
196 #endif
197 
198 	if_ih_insert(ifp, ether_input, NULL);
199 
200 	return (0);
201 }
202 
203 int
204 bridge_dummy_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
205     struct rtentry *rt)
206 {
207 	m_freem(m);
208 	return (EAFNOSUPPORT);
209 }
210 
211 int
212 bridge_clone_destroy(struct ifnet *ifp)
213 {
214 	struct bridge_softc *sc = ifp->if_softc;
215 	struct bridge_iflist *bif;
216 
217 	bridge_stop(sc);
218 	bridge_rtflush(sc, IFBF_FLUSHALL);
219 	while ((bif = TAILQ_FIRST(&sc->sc_iflist)) != NULL)
220 		bridge_delete(sc, bif);
221 	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL)
222 		bridge_spandetach(bif);
223 
224 	bstp_destroy(sc->sc_stp);
225 
226 	/* Undo pseudo-driver changes. */
227 	if_deactivate(ifp);
228 
229 	if_ih_remove(ifp, ether_input, NULL);
230 
231 	KASSERT(SRPL_EMPTY_LOCKED(&ifp->if_inputs));
232 
233 	if_detach(ifp);
234 
235 	free(sc, M_DEVBUF, sizeof *sc);
236 	return (0);
237 }
238 
239 int
240 bridge_delete(struct bridge_softc *sc, struct bridge_iflist *bif)
241 {
242 	int error;
243 
244 	if (bif->bif_flags & IFBIF_STP)
245 		bstp_delete(bif->bif_stp);
246 
247 	bif->ifp->if_bridgeport = NULL;
248 	error = ifpromisc(bif->ifp, 0);
249 	hook_disestablish(bif->ifp->if_detachhooks, bif->bif_dhcookie);
250 
251 	if_ih_remove(bif->ifp, bridge_input, NULL);
252 	TAILQ_REMOVE(&sc->sc_iflist, bif, next);
253 	bridge_rtdelete(sc, bif->ifp, 0);
254 	bridge_flushrule(bif);
255 	free(bif, M_DEVBUF, sizeof *bif);
256 
257 	return (error);
258 }
259 
260 int
261 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
262 {
263 	struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
264 	struct ifbreq *req = (struct ifbreq *)data;
265 	struct ifbropreq *brop = (struct ifbropreq *)data;
266 	struct ifnet *ifs;
267 	struct bridge_iflist *bif;
268 	struct bstp_port *bp;
269 	struct bstp_state *bs = sc->sc_stp;
270 	int error = 0;
271 
272 	switch (cmd) {
273 	case SIOCBRDGADD:
274 	/* bridge(4) does not distinguish between routing/forwarding ports */
275 	case SIOCBRDGADDL:
276 		if ((error = suser(curproc)) != 0)
277 			break;
278 
279 		ifs = ifunit(req->ifbr_ifsname);
280 
281 		/* try to create the interface if it does't exist */
282 		if (ifs == NULL && if_clone_create(req->ifbr_ifsname, 0) == 0)
283 			ifs = ifunit(req->ifbr_ifsname);
284 
285 		if (ifs == NULL) {			/* no such interface */
286 			error = ENOENT;
287 			break;
288 		}
289 
290 		if (ifs->if_bridgeport != NULL) {
291 			bif = (struct bridge_iflist *)ifs->if_bridgeport;
292 			if (bif->bridge_sc == sc)
293 				error = EEXIST;
294 			else
295 				error = EBUSY;
296 			break;
297 		}
298 
299 		/* If it's in the span list, it can't be a member. */
300 		TAILQ_FOREACH(bif, &sc->sc_spanlist, next) {
301 			if (bif->ifp == ifs)
302 				break;
303 		}
304 		if (bif != NULL) {
305 			error = EBUSY;
306 			break;
307 		}
308 
309 		if (ifs->if_type == IFT_ETHER) {
310 			error = ifpromisc(ifs, 1);
311 			if (error != 0)
312 				break;
313 		}
314 #if NMPW > 0
315 		else if (ifs->if_type == IFT_MPLSTUNNEL) {
316 			/* Nothing needed */
317 		}
318 #endif /* NMPW */
319 		else {
320 			error = EINVAL;
321 			break;
322 		}
323 
324 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
325 		if (bif == NULL) {
326 			if (ifs->if_type == IFT_ETHER)
327 				ifpromisc(ifs, 0);
328 			error = ENOMEM;
329 			break;
330 		}
331 
332 		bif->bridge_sc = sc;
333 		bif->ifp = ifs;
334 		bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
335 		SIMPLEQ_INIT(&bif->bif_brlin);
336 		SIMPLEQ_INIT(&bif->bif_brlout);
337 		ifs->if_bridgeport = (caddr_t)bif;
338 		bif->bif_dhcookie = hook_establish(ifs->if_detachhooks, 0,
339 		    bridge_ifdetach, bif);
340 		if_ih_insert(bif->ifp, bridge_input, NULL);
341 		TAILQ_INSERT_TAIL(&sc->sc_iflist, bif, next);
342 		break;
343 	case SIOCBRDGDEL:
344 		if ((error = suser(curproc)) != 0)
345 			break;
346 		ifs = ifunit(req->ifbr_ifsname);
347 		if (ifs == NULL) {
348 			error = ENOENT;
349 			break;
350 		}
351 		bif = (struct bridge_iflist *)ifs->if_bridgeport;
352 		if (bif == NULL || bif->bridge_sc != sc) {
353 			error = ESRCH;
354 			break;
355 		}
356 		error = bridge_delete(sc, bif);
357 		break;
358 	case SIOCBRDGIFS:
359 		error = bridge_bifconf(sc, (struct ifbifconf *)data);
360 		break;
361 	case SIOCBRDGADDS:
362 		if ((error = suser(curproc)) != 0)
363 			break;
364 		ifs = ifunit(req->ifbr_ifsname);
365 		if (ifs == NULL) {			/* no such interface */
366 			error = ENOENT;
367 			break;
368 		}
369 		if (ifs->if_type != IFT_ETHER &&
370 		    ifs->if_type != IFT_MPLSTUNNEL) {
371 			error = EINVAL;
372 			break;
373 		}
374 		if (ifs->if_bridgeport != NULL) {
375 			error = EBUSY;
376 			break;
377 		}
378 		TAILQ_FOREACH(bif, &sc->sc_spanlist, next) {
379 			if (bif->ifp == ifs)
380 				break;
381 		}
382 		if (bif != NULL) {
383 			error = EEXIST;
384 			break;
385 		}
386 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
387 		if (bif == NULL) {
388 			error = ENOMEM;
389 			break;
390 		}
391 		bif->ifp = ifs;
392 		bif->bif_flags = IFBIF_SPAN;
393 		bif->bridge_sc = sc;
394 		bif->bif_dhcookie = hook_establish(ifs->if_detachhooks, 0,
395 		    bridge_spandetach, bif);
396 		SIMPLEQ_INIT(&bif->bif_brlin);
397 		SIMPLEQ_INIT(&bif->bif_brlout);
398 		TAILQ_INSERT_TAIL(&sc->sc_spanlist, bif, next);
399 		break;
400 	case SIOCBRDGDELS:
401 		if ((error = suser(curproc)) != 0)
402 			break;
403 		ifs = ifunit(req->ifbr_ifsname);
404 		if (ifs == NULL) {
405 			error = ENOENT;
406 			break;
407 		}
408 		TAILQ_FOREACH(bif, &sc->sc_spanlist, next) {
409 			if (bif->ifp == ifs)
410 				break;
411 		}
412 		if (bif == NULL) {
413 			error = ENOENT;
414 			break;
415 		}
416 		bridge_spandetach(bif);
417 		break;
418 	case SIOCBRDGGIFFLGS:
419 		ifs = ifunit(req->ifbr_ifsname);
420 		if (ifs == NULL) {
421 			error = ENOENT;
422 			break;
423 		}
424 		bif = (struct bridge_iflist *)ifs->if_bridgeport;
425 		if (bif == NULL || bif->bridge_sc != sc) {
426 			error = ESRCH;
427 			break;
428 		}
429 		req->ifbr_ifsflags = bif->bif_flags;
430 		req->ifbr_portno = bif->ifp->if_index & 0xfff;
431 		req->ifbr_protected = bif->bif_protected;
432 		if (bif->bif_flags & IFBIF_STP) {
433 			bp = bif->bif_stp;
434 			req->ifbr_state = bstp_getstate(bs, bp);
435 			req->ifbr_priority = bp->bp_priority;
436 			req->ifbr_path_cost = bp->bp_path_cost;
437 			req->ifbr_proto = bp->bp_protover;
438 			req->ifbr_role = bp->bp_role;
439 			req->ifbr_stpflags = bp->bp_flags;
440 			req->ifbr_fwd_trans = bp->bp_forward_transitions;
441 			req->ifbr_desg_bridge = bp->bp_desg_pv.pv_dbridge_id;
442 			req->ifbr_desg_port = bp->bp_desg_pv.pv_dport_id;
443 			req->ifbr_root_bridge = bp->bp_desg_pv.pv_root_id;
444 			req->ifbr_root_cost = bp->bp_desg_pv.pv_cost;
445 			req->ifbr_root_port = bp->bp_desg_pv.pv_port_id;
446 
447 			/* Copy STP state options as flags */
448 			if (bp->bp_operedge)
449 				req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
450 			if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
451 				req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
452 			if (bp->bp_ptp_link)
453 				req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
454 			if (bp->bp_flags & BSTP_PORT_AUTOPTP)
455 				req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
456 		}
457 		break;
458 	case SIOCBRDGSIFFLGS:
459 		if ((error = suser(curproc)) != 0)
460 			break;
461 		ifs = ifunit(req->ifbr_ifsname);
462 		if (ifs == NULL) {
463 			error = ENOENT;
464 			break;
465 		}
466 		bif = (struct bridge_iflist *)ifs->if_bridgeport;
467 		if (bif == NULL || bif->bridge_sc != sc) {
468 			error = ESRCH;
469 			break;
470 		}
471 		if (req->ifbr_ifsflags & IFBIF_RO_MASK) {
472 			error = EINVAL;
473 			break;
474 		}
475 		if (req->ifbr_ifsflags & IFBIF_STP) {
476 			if ((bif->bif_flags & IFBIF_STP) == 0) {
477 				/* Enable STP */
478 				if ((bif->bif_stp = bstp_add(sc->sc_stp,
479 				    bif->ifp)) == NULL) {
480 					error = ENOMEM;
481 					break;
482 				}
483 			} else {
484 				/* Update STP flags */
485 				bstp_ifsflags(bif->bif_stp, req->ifbr_ifsflags);
486 			}
487 		} else if (bif->bif_flags & IFBIF_STP) {
488 			bstp_delete(bif->bif_stp);
489 			bif->bif_stp = NULL;
490 		}
491 		bif->bif_flags = req->ifbr_ifsflags;
492 		break;
493 	case SIOCSIFFLAGS:
494 		if ((ifp->if_flags & IFF_UP) == IFF_UP)
495 			bridge_init(sc);
496 
497 		if ((ifp->if_flags & IFF_UP) == 0)
498 			bridge_stop(sc);
499 
500 		break;
501 	case SIOCBRDGGPARAM:
502 		if ((bp = bs->bs_root_port) == NULL)
503 			brop->ifbop_root_port = 0;
504 		else
505 			brop->ifbop_root_port = bp->bp_ifp->if_index;
506 		brop->ifbop_maxage = bs->bs_bridge_max_age >> 8;
507 		brop->ifbop_hellotime = bs->bs_bridge_htime >> 8;
508 		brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
509 		brop->ifbop_holdcount = bs->bs_txholdcount;
510 		brop->ifbop_priority = bs->bs_bridge_priority;
511 		brop->ifbop_protocol = bs->bs_protover;
512 		brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id;
513 		brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
514 		brop->ifbop_root_port = bs->bs_root_pv.pv_port_id;
515 		brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
516 		brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
517 		brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
518 		break;
519 	case SIOCBRDGSIFPROT:
520 		ifs = ifunit(req->ifbr_ifsname);
521 		if (ifs == NULL) {
522 			error = ENOENT;
523 			break;
524 		}
525 		bif = (struct bridge_iflist *)ifs->if_bridgeport;
526 		if (bif == NULL || bif->bridge_sc != sc) {
527 			error = ESRCH;
528 			break;
529 		}
530 		bif->bif_protected = req->ifbr_protected;
531 		break;
532 	case SIOCBRDGRTS:
533 	case SIOCBRDGGCACHE:
534 	case SIOCBRDGGPRI:
535 	case SIOCBRDGGMA:
536 	case SIOCBRDGGHT:
537 	case SIOCBRDGGFD:
538 	case SIOCBRDGGTO:
539 	case SIOCBRDGGRL:
540 		break;
541 	case SIOCBRDGFLUSH:
542 	case SIOCBRDGSADDR:
543 	case SIOCBRDGDADDR:
544 	case SIOCBRDGSCACHE:
545 	case SIOCBRDGSTO:
546 	case SIOCBRDGARL:
547 	case SIOCBRDGFRL:
548 	case SIOCBRDGSPRI:
549 	case SIOCBRDGSFD:
550 	case SIOCBRDGSMA:
551 	case SIOCBRDGSHT:
552 	case SIOCBRDGSTXHC:
553 	case SIOCBRDGSPROTO:
554 	case SIOCBRDGSIFPRIO:
555 	case SIOCBRDGSIFCOST:
556 		error = suser(curproc);
557 		break;
558 	default:
559 		error = ENOTTY;
560 		break;
561 	}
562 
563 	if (!error)
564 		error = bridgectl_ioctl(ifp, cmd, data);
565 
566 	if (!error)
567 		error = bstp_ioctl(ifp, cmd, data);
568 
569 	return (error);
570 }
571 
572 /* Detach an interface from a bridge.  */
573 void
574 bridge_ifdetach(void *xbif)
575 {
576 	struct bridge_iflist *bif = xbif;
577 	struct bridge_softc *sc = bif->bridge_sc;
578 
579 	bridge_delete(sc, bif);
580 }
581 
582 void
583 bridge_spandetach(void *xbif)
584 {
585 	struct bridge_iflist *bif = xbif;
586 	struct bridge_softc *sc = bif->bridge_sc;
587 
588 	hook_disestablish(bif->ifp->if_detachhooks, bif->bif_dhcookie);
589 	TAILQ_REMOVE(&sc->sc_spanlist, bif, next);
590 	free(bif, M_DEVBUF, sizeof(*bif));
591 }
592 
593 int
594 bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc)
595 {
596 	struct bridge_iflist *bif;
597 	struct bstp_port *bp;
598 	struct bstp_state *bs = sc->sc_stp;
599 	u_int32_t total = 0, i = 0;
600 	int error = 0;
601 	struct ifbreq *breq, *breqs = NULL;
602 
603 	TAILQ_FOREACH(bif, &sc->sc_iflist, next)
604 		total++;
605 
606 	TAILQ_FOREACH(bif, &sc->sc_spanlist, next)
607 		total++;
608 
609 	if (bifc->ifbic_len == 0) {
610 		i = total;
611 		goto done;
612 	}
613 
614 	breqs = mallocarray(total, sizeof(*breqs), M_TEMP, M_NOWAIT|M_ZERO);
615 	if (breqs == NULL)
616 		goto done;
617 
618 	TAILQ_FOREACH(bif, &sc->sc_iflist, next) {
619 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
620 			break;
621 		breq = &breqs[i];
622 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
623 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
624 		breq->ifbr_ifsflags = bif->bif_flags;
625 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
626 		breq->ifbr_protected = bif->bif_protected;
627 		if (bif->bif_flags & IFBIF_STP) {
628 			bp = bif->bif_stp;
629 			breq->ifbr_state = bstp_getstate(sc->sc_stp, bp);
630 			breq->ifbr_priority = bp->bp_priority;
631 			breq->ifbr_path_cost = bp->bp_path_cost;
632 			breq->ifbr_proto = bp->bp_protover;
633 			breq->ifbr_role = bp->bp_role;
634 			breq->ifbr_stpflags = bp->bp_flags;
635 			breq->ifbr_fwd_trans = bp->bp_forward_transitions;
636 			breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id;
637 			breq->ifbr_root_cost = bs->bs_root_pv.pv_cost;
638 			breq->ifbr_root_port = bs->bs_root_pv.pv_port_id;
639 			breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
640 			breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id;
641 
642 			/* Copy STP state options as flags */
643 			if (bp->bp_operedge)
644 				breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
645 			if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
646 				breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
647 			if (bp->bp_ptp_link)
648 				breq->ifbr_ifsflags |= IFBIF_BSTP_PTP;
649 			if (bp->bp_flags & BSTP_PORT_AUTOPTP)
650 				breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
651 		}
652 		i++;
653 	}
654 	TAILQ_FOREACH(bif, &sc->sc_spanlist, next) {
655 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
656 			break;
657 		breq = &breqs[i];
658 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
659 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
660 		breq->ifbr_ifsflags = bif->bif_flags | IFBIF_SPAN;
661 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
662 		i++;
663 	}
664 
665 	error = copyout(breqs, bifc->ifbic_req, i * sizeof(*breqs));
666 done:
667 	free(breqs, M_TEMP, total * sizeof(*breq));
668 	bifc->ifbic_len = i * sizeof(*breq);
669 	return (error);
670 }
671 
672 void
673 bridge_init(struct bridge_softc *sc)
674 {
675 	struct ifnet *ifp = &sc->sc_if;
676 
677 	if ((ifp->if_flags & IFF_RUNNING) == IFF_RUNNING)
678 		return;
679 
680 	ifp->if_flags |= IFF_RUNNING;
681 	bstp_initialization(sc->sc_stp);
682 
683 	if (sc->sc_brttimeout != 0)
684 		timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
685 }
686 
687 /*
688  * Stop the bridge and deallocate the routing table.
689  */
690 void
691 bridge_stop(struct bridge_softc *sc)
692 {
693 	struct ifnet *ifp = &sc->sc_if;
694 
695 	/*
696 	 * If we're not running, there's nothing to do.
697 	 */
698 	if ((ifp->if_flags & IFF_RUNNING) == 0)
699 		return;
700 
701 	timeout_del(&sc->sc_brtimeout);
702 
703 	bridge_rtflush(sc, IFBF_FLUSHDYN);
704 
705 	ifp->if_flags &= ~IFF_RUNNING;
706 }
707 
708 /*
709  * Send output from the bridge.  The mbuf has the ethernet header
710  * already attached.  We must enqueue or free the mbuf before exiting.
711  */
712 int
713 bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
714     struct rtentry *rt)
715 {
716 	struct bridge_iflist *bif;
717 	struct ether_header *eh;
718 	struct ifnet *dst_if = NULL;
719 	struct bridge_rtnode *dst_p = NULL;
720 	struct ether_addr *dst;
721 	struct bridge_softc *sc;
722 	struct bridge_tunneltag *brtag;
723 #if NBPFILTER > 0
724 	caddr_t if_bpf;
725 #endif
726 	int error;
727 
728 	KERNEL_ASSERT_LOCKED();
729 
730 	/* ifp must be a member interface of the bridge. */
731 	bif = (struct bridge_iflist *)ifp->if_bridgeport;
732 	if (bif == NULL) {
733 		m_freem(m);
734 		return (EINVAL);
735 	}
736 	sc = bif->bridge_sc;
737 
738 	if (m->m_len < sizeof(*eh)) {
739 		m = m_pullup(m, sizeof(*eh));
740 		if (m == NULL)
741 			return (ENOBUFS);
742 	}
743 	eh = mtod(m, struct ether_header *);
744 	dst = (struct ether_addr *)&eh->ether_dhost[0];
745 
746 	/*
747 	 * If bridge is down, but original output interface is up,
748 	 * go ahead and send out that interface.  Otherwise the packet
749 	 * is dropped below.
750 	 */
751 	if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
752 		dst_if = ifp;
753 		goto sendunicast;
754 	}
755 
756 #if NBPFILTER > 0
757 	if_bpf = sc->sc_if.if_bpf;
758 	if (if_bpf)
759 		bpf_mtap(if_bpf, m, BPF_DIRECTION_OUT);
760 #endif
761 	ifp->if_opackets++;
762 	ifp->if_obytes += m->m_pkthdr.len;
763 
764 	/*
765 	 * If the packet is a broadcast or we don't know a better way to
766 	 * get there, send to all interfaces.
767 	 */
768 	if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
769 		dst_if = dst_p->brt_if;
770 	if (dst_if == NULL || ETHER_IS_MULTICAST(eh->ether_dhost)) {
771 		struct bridge_iflist *bif, *bif0;
772 		struct mbuf *mc;
773 		int used = 0;
774 
775 		bridge_span(sc, m);
776 
777 		TAILQ_FOREACH(bif, &sc->sc_iflist, next) {
778 			dst_if = bif->ifp;
779 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
780 				continue;
781 
782 			/*
783 			 * If this is not the original output interface,
784 			 * and the interface is participating in spanning
785 			 * tree, make sure the port is in a state that
786 			 * allows forwarding.
787 			 */
788 			if (dst_if != ifp &&
789 			    (bif->bif_flags & IFBIF_STP) &&
790 			    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
791 				continue;
792 #if NMPW > 0
793 			/*
794 			 * Split horizon: avoid broadcasting messages from
795 			 * wire to another wire.
796 			 */
797 			if (ifp->if_type == IFT_MPLSTUNNEL &&
798 			    dst_if->if_type == IFT_MPLSTUNNEL)
799 				continue;
800 #endif /* NMPW */
801 			if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
802 			    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
803 				continue;
804 
805 			if (TAILQ_NEXT(bif, next) == NULL) {
806 				used = 1;
807 				mc = m;
808 			} else {
809 				mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
810 				if (mc == NULL) {
811 					sc->sc_if.if_oerrors++;
812 					continue;
813 				}
814 			}
815 
816 			bif0 = (struct bridge_iflist *)dst_if->if_bridgeport;
817 			KASSERT(bif0 != NULL);
818 			if (bridge_filterrule(&bif0->bif_brlout, eh, mc) ==
819 			    BRL_ACTION_BLOCK)
820 				continue;
821 
822 			error = bridge_ifenqueue(&sc->sc_if, dst_if, mc);
823 			if (error)
824 				continue;
825 		}
826 		if (!used)
827 			m_freem(m);
828 		return (0);
829 	}
830 
831 sendunicast:
832 	if ((dst_p != NULL) &&
833 	    (dst_p->brt_tunnel.brtag_peer.sa.sa_family != AF_UNSPEC) &&
834 	    ((brtag = bridge_tunneltag(m)) != NULL))
835 		bridge_copytag(&dst_p->brt_tunnel, brtag);
836 
837 	bridge_span(sc, m);
838 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
839 		m_freem(m);
840 		return (ENETDOWN);
841 	}
842 	bridge_ifenqueue(&sc->sc_if, dst_if, m);
843 	return (0);
844 }
845 
846 /*
847  * Loop through each bridge interface and process their input queues.
848  */
849 void
850 bridgeintr(void)
851 {
852 	struct mbuf_list ml;
853 	struct mbuf *m;
854 	struct ifnet *ifp;
855 
856 	niq_delist(&bridgeintrq, &ml);
857 	if (ml_empty(&ml))
858 		return;
859 
860 	KERNEL_LOCK();
861 	while ((m = ml_dequeue(&ml)) != NULL) {
862 
863 		ifp = if_get(m->m_pkthdr.ph_ifidx);
864 		if (ifp == NULL) {
865 			m_freem(m);
866 			continue;
867 		}
868 
869 		bridge_process(ifp, m);
870 
871 		if_put(ifp);
872 	}
873 	KERNEL_UNLOCK();
874 }
875 
876 /*
877  * Process a single frame.  Frame must be freed or queued before returning.
878  */
879 void
880 bridgeintr_frame(struct bridge_softc *sc, struct ifnet *src_if, struct mbuf *m)
881 {
882 	struct ifnet *dst_if;
883 	struct bridge_iflist *bif;
884 	struct bridge_rtnode *dst_p;
885 	struct ether_addr *dst, *src;
886 	struct ether_header eh;
887 	u_int32_t protected;
888 	int len;
889 
890 
891 	sc->sc_if.if_ipackets++;
892 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
893 
894 	bif = (struct bridge_iflist *)src_if->if_bridgeport;
895 	KASSERT(bif != NULL);
896 
897 	if (m->m_pkthdr.len < sizeof(eh)) {
898 		m_freem(m);
899 		return;
900 	}
901 	m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&eh);
902 	dst = (struct ether_addr *)&eh.ether_dhost[0];
903 	src = (struct ether_addr *)&eh.ether_shost[0];
904 
905 	/*
906 	 * If interface is learning, and if source address
907 	 * is not broadcast or multicast, record its address.
908 	 */
909 	if ((bif->bif_flags & IFBIF_LEARNING) &&
910 	    (eh.ether_shost[0] & 1) == 0 &&
911 	    !(eh.ether_shost[0] == 0 && eh.ether_shost[1] == 0 &&
912 	    eh.ether_shost[2] == 0 && eh.ether_shost[3] == 0 &&
913 	    eh.ether_shost[4] == 0 && eh.ether_shost[5] == 0))
914 		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m);
915 
916 	if ((bif->bif_flags & IFBIF_STP) &&
917 	    (bif->bif_state == BSTP_IFSTATE_LEARNING)) {
918 		m_freem(m);
919 		return;
920 	}
921 
922 	/*
923 	 * At this point, the port either doesn't participate in stp or
924 	 * it's in the forwarding state
925 	 */
926 
927 	/*
928 	 * If packet is unicast, destined for someone on "this"
929 	 * side of the bridge, drop it.
930 	 */
931 	if (!ETHER_IS_MULTICAST(eh.ether_dhost)) {
932 		if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
933 			dst_if = dst_p->brt_if;
934 		else
935 			dst_if = NULL;
936 		if (dst_if == src_if) {
937 			m_freem(m);
938 			return;
939 		}
940 	} else {
941 		if (memcmp(etherbroadcastaddr, eh.ether_dhost,
942 		    sizeof(etherbroadcastaddr)) == 0)
943 			m->m_flags |= M_BCAST;
944 		else
945 			m->m_flags |= M_MCAST;
946 		dst_if = NULL;
947 	}
948 
949 	/*
950 	 * Multicast packets get handled a little differently:
951 	 * If interface is:
952 	 *	-link0,-link1	(default) Forward all multicast
953 	 *			as broadcast.
954 	 *	-link0,link1	Drop non-IP multicast, forward
955 	 *			as broadcast IP multicast.
956 	 *	link0,-link1	Drop IP multicast, forward as
957 	 *			broadcast non-IP multicast.
958 	 *	link0,link1	Drop all multicast.
959 	 */
960 	if (m->m_flags & M_MCAST) {
961 		if ((sc->sc_if.if_flags &
962 		    (IFF_LINK0 | IFF_LINK1)) ==
963 		    (IFF_LINK0 | IFF_LINK1)) {
964 			m_freem(m);
965 			return;
966 		}
967 		if (sc->sc_if.if_flags & IFF_LINK0 &&
968 		    ETHERADDR_IS_IP_MCAST(dst)) {
969 			m_freem(m);
970 			return;
971 		}
972 		if (sc->sc_if.if_flags & IFF_LINK1 &&
973 		    !ETHERADDR_IS_IP_MCAST(dst)) {
974 			m_freem(m);
975 			return;
976 		}
977 	}
978 
979 	if (bif->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) {
980 		m_freem(m);
981 		return;
982 	}
983 
984 	if (bridge_filterrule(&bif->bif_brlin, &eh, m) == BRL_ACTION_BLOCK) {
985 		m_freem(m);
986 		return;
987 	}
988 	m = bridge_ip(&sc->sc_if, BRIDGE_IN, src_if, &eh, m);
989 	if (m == NULL)
990 		return;
991 	/*
992 	 * If the packet is a multicast or broadcast OR if we don't
993 	 * know any better, forward it to all interfaces.
994 	 */
995 	if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_if == NULL) {
996 		sc->sc_if.if_imcasts++;
997 		bridge_broadcast(sc, src_if, &eh, m);
998 		return;
999 	}
1000 	protected = bif->bif_protected;
1001 
1002 	/*
1003 	 * At this point, we're dealing with a unicast frame going to a
1004 	 * different interface
1005 	 */
1006 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
1007 		m_freem(m);
1008 		return;
1009 	}
1010 	bif = (struct bridge_iflist *)dst_if->if_bridgeport;
1011 	if ((bif->bif_flags & IFBIF_STP) &&
1012 	    (bif->bif_state == BSTP_IFSTATE_DISCARDING)) {
1013 		m_freem(m);
1014 		return;
1015 	}
1016 	/*
1017 	 * Do not transmit if both ports are part of the same protected
1018 	 * domain.
1019 	 */
1020 	if (protected != 0 && (protected & bif->bif_protected)) {
1021 		m_freem(m);
1022 		return;
1023 	}
1024 	if (bridge_filterrule(&bif->bif_brlout, &eh, m) == BRL_ACTION_BLOCK) {
1025 		m_freem(m);
1026 		return;
1027 	}
1028 	m = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, &eh, m);
1029 	if (m == NULL)
1030 		return;
1031 
1032 	len = m->m_pkthdr.len;
1033 #if NVLAN > 0
1034 	if ((m->m_flags & M_VLANTAG) &&
1035 	    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1036 		len += ETHER_VLAN_ENCAP_LEN;
1037 #endif
1038 	if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1039 		bridge_fragment(&sc->sc_if, dst_if, &eh, m);
1040 	else {
1041 		bridge_ifenqueue(&sc->sc_if, dst_if, m);
1042 	}
1043 }
1044 
1045 /*
1046  * Return 1 if `ena' belongs to `bif', 0 otherwise.
1047  */
1048 int
1049 bridge_ourether(struct bridge_iflist *bif, uint8_t *ena)
1050 {
1051 	struct arpcom *ac = (struct arpcom *)bif->ifp;
1052 
1053 	if (memcmp(ac->ac_enaddr, ena, ETHER_ADDR_LEN) == 0)
1054 		return (1);
1055 
1056 #if NCARP > 0
1057 	if (carp_ourether(bif->ifp, ena))
1058 		return (1);
1059 #endif
1060 
1061 	return (0);
1062 }
1063 
1064 /*
1065  * Receive input from an interface.  Queue the packet for bridging if its
1066  * not for us, and schedule an interrupt.
1067  */
1068 int
1069 bridge_input(struct ifnet *ifp, struct mbuf *m, void *cookie)
1070 {
1071 	KASSERT(m->m_flags & M_PKTHDR);
1072 
1073 	if (m->m_flags & M_PROTO1) {
1074 		m->m_flags &= ~M_PROTO1;
1075 		return (0);
1076 	}
1077 
1078 	niq_enqueue(&bridgeintrq, m);
1079 
1080 	return (1);
1081 }
1082 
1083 void
1084 bridge_process(struct ifnet *ifp, struct mbuf *m)
1085 {
1086 	struct bridge_softc *sc;
1087 	struct bridge_iflist *bif, *bif0;
1088 	struct ether_header *eh;
1089 	struct mbuf *mc;
1090 #if NBPFILTER > 0
1091 	caddr_t if_bpf;
1092 #endif
1093 
1094 	KERNEL_ASSERT_LOCKED();
1095 
1096 	bif = (struct bridge_iflist *)ifp->if_bridgeport;
1097 	if (bif == NULL)
1098 		goto reenqueue;
1099 
1100 	sc = bif->bridge_sc;
1101 	if ((sc->sc_if.if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING))
1102 		goto reenqueue;
1103 
1104 #if NVLAN > 0
1105 	/*
1106 	 * If the underlying interface removed the VLAN header itself,
1107 	 * add it back.
1108 	 */
1109 	if (ISSET(m->m_flags, M_VLANTAG)) {
1110 		m = vlan_inject(m, ETHERTYPE_VLAN, m->m_pkthdr.ether_vtag);
1111 		if (m == NULL)
1112 			return;
1113 	}
1114 #endif
1115 
1116 #if NBPFILTER > 0
1117 	if_bpf = sc->sc_if.if_bpf;
1118 	if (if_bpf)
1119 		bpf_mtap_ether(if_bpf, m, BPF_DIRECTION_IN);
1120 #endif
1121 
1122 	bridge_span(sc, m);
1123 
1124 	eh = mtod(m, struct ether_header *);
1125 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1126 		/*
1127 		 * Reserved destination MAC addresses (01:80:C2:00:00:0x)
1128 		 * should not be forwarded to bridge members according to
1129 		 * section 7.12.6 of the 802.1D-2004 specification.  The
1130 		 * STP destination address (as stored in bstp_etheraddr)
1131 		 * is the first of these.
1132 		 */
1133 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1134 		    ETHER_ADDR_LEN - 1) == 0) {
1135 			if (eh->ether_dhost[ETHER_ADDR_LEN - 1] == 0) {
1136 				/* STP traffic */
1137 				if ((m = bstp_input(sc->sc_stp, bif->bif_stp,
1138 				    eh, m)) == NULL)
1139 					return;
1140 			} else if (eh->ether_dhost[ETHER_ADDR_LEN - 1] <= 0xf) {
1141 				m_freem(m);
1142 				return;
1143 			}
1144 		}
1145 
1146 		/*
1147 		 * No need to process frames for ifs in the discarding state
1148 		 */
1149 		if ((bif->bif_flags & IFBIF_STP) &&
1150 		    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
1151 			goto reenqueue;
1152 
1153 		mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1154 		if (mc == NULL)
1155 			goto reenqueue;
1156 
1157 		bridge_ifinput(ifp, mc);
1158 
1159 		bridgeintr_frame(sc, ifp, m);
1160 		return;
1161 	}
1162 
1163 	/*
1164 	 * No need to queue frames for ifs in the discarding state
1165 	 */
1166 	if ((bif->bif_flags & IFBIF_STP) &&
1167 	    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
1168 		goto reenqueue;
1169 
1170 	/*
1171 	 * Unicast, make sure it's not for us.
1172 	 */
1173 	bif0 = bif;
1174 	TAILQ_FOREACH(bif, &sc->sc_iflist, next) {
1175 		if (bif->ifp->if_type != IFT_ETHER)
1176 			continue;
1177 		if (bridge_ourether(bif, eh->ether_dhost)) {
1178 			if (bif0->bif_flags & IFBIF_LEARNING)
1179 				bridge_rtupdate(sc,
1180 				    (struct ether_addr *)&eh->ether_shost,
1181 				    ifp, 0, IFBAF_DYNAMIC, m);
1182 			if (bridge_filterrule(&bif0->bif_brlin, eh, m) ==
1183 			    BRL_ACTION_BLOCK) {
1184 				m_freem(m);
1185 				return;
1186 			}
1187 
1188 			/* Count for the bridge */
1189 			sc->sc_if.if_ipackets++;
1190 			sc->sc_if.if_ibytes += m->m_pkthdr.len;
1191 
1192 			bridge_ifinput(bif->ifp, m);
1193 			return;
1194 		}
1195 		if (bridge_ourether(bif, eh->ether_shost)) {
1196 			m_freem(m);
1197 			return;
1198 		}
1199 	}
1200 
1201 	bridgeintr_frame(sc, ifp, m);
1202 	return;
1203 
1204 reenqueue:
1205 	bridge_ifinput(ifp, m);
1206 }
1207 
1208 /*
1209  * Send a frame to all interfaces that are members of the bridge
1210  * (except the one it came in on).
1211  */
1212 void
1213 bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp,
1214     struct ether_header *eh, struct mbuf *m)
1215 {
1216 	struct bridge_iflist *bif;
1217 	struct mbuf *mc;
1218 	struct ifnet *dst_if;
1219 	int len, used = 0;
1220 	u_int32_t protected;
1221 
1222 	bif = (struct bridge_iflist *)ifp->if_bridgeport;
1223 	protected = bif->bif_protected;
1224 
1225 	TAILQ_FOREACH(bif, &sc->sc_iflist, next) {
1226 		dst_if = bif->ifp;
1227 
1228 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1229 			continue;
1230 
1231 		if ((bif->bif_flags & IFBIF_STP) &&
1232 		    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
1233 			continue;
1234 
1235 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1236 		    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1237 			continue;
1238 
1239 		/* Drop non-IP frames if the appropriate flag is set. */
1240 		if (bif->bif_flags & IFBIF_BLOCKNONIP &&
1241 		    bridge_blocknonip(eh, m))
1242 			continue;
1243 
1244 		/*
1245 		 * Do not transmit if both ports are part of the same
1246 		 * protected domain.
1247 		 */
1248 		if (protected != 0 && (protected & bif->bif_protected))
1249 			continue;
1250 
1251 		if (bridge_filterrule(&bif->bif_brlout, eh, m) == BRL_ACTION_BLOCK)
1252 			continue;
1253 
1254 		/*
1255 		 * Don't retransmit out of the same interface where
1256 		 * the packet was received from.
1257 		 */
1258 		if (dst_if->if_index == ifp->if_index)
1259 			continue;
1260 
1261 		if (bridge_localbroadcast(dst_if, eh, m))
1262 			sc->sc_if.if_oerrors++;
1263 
1264 #if NMPW > 0
1265 		/*
1266 		 * Split horizon: avoid broadcasting messages from wire to
1267 		 * another wire.
1268 		 */
1269 		if (ifp->if_type == IFT_MPLSTUNNEL &&
1270 		    dst_if->if_type == IFT_MPLSTUNNEL)
1271 			continue;
1272 #endif /* NMPW */
1273 
1274 		/* If last one, reuse the passed-in mbuf */
1275 		if (TAILQ_NEXT(bif, next) == NULL) {
1276 			mc = m;
1277 			used = 1;
1278 		} else {
1279 			mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1280 			if (mc == NULL) {
1281 				sc->sc_if.if_oerrors++;
1282 				continue;
1283 			}
1284 		}
1285 
1286 		mc = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, eh, mc);
1287 		if (mc == NULL)
1288 			continue;
1289 
1290 		len = mc->m_pkthdr.len;
1291 #if NVLAN > 0
1292 		if ((mc->m_flags & M_VLANTAG) &&
1293 		    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1294 			len += ETHER_VLAN_ENCAP_LEN;
1295 #endif
1296 		if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1297 			bridge_fragment(&sc->sc_if, dst_if, eh, mc);
1298 		else {
1299 			bridge_ifenqueue(&sc->sc_if, dst_if, mc);
1300 		}
1301 	}
1302 
1303 	if (!used)
1304 		m_freem(m);
1305 }
1306 
1307 int
1308 bridge_localbroadcast(struct ifnet *ifp, struct ether_header *eh,
1309     struct mbuf *m)
1310 {
1311 	struct mbuf *m1;
1312 	u_int16_t etype;
1313 
1314 	/*
1315 	 * quick optimisation, don't send packets up the stack if no
1316 	 * corresponding address has been specified.
1317 	 */
1318 	etype = ntohs(eh->ether_type);
1319 	if (!(m->m_flags & M_VLANTAG) && etype == ETHERTYPE_IP) {
1320 		struct ifaddr *ifa;
1321 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1322 			if (ifa->ifa_addr->sa_family == AF_INET)
1323 				break;
1324 		}
1325 		if (ifa == NULL)
1326 			return (0);
1327 	}
1328 
1329 	m1 = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1330 	if (m1 == NULL)
1331 		return (1);
1332 
1333 #if NPF > 0
1334 	pf_pkt_addr_changed(m1);
1335 #endif	/* NPF */
1336 
1337 	bridge_ifinput(ifp, m1);
1338 
1339 	return (0);
1340 }
1341 
1342 void
1343 bridge_span(struct bridge_softc *sc, struct mbuf *m)
1344 {
1345 	struct bridge_iflist *bif;
1346 	struct ifnet *ifp;
1347 	struct mbuf *mc;
1348 	int error;
1349 
1350 	TAILQ_FOREACH(bif, &sc->sc_spanlist, next) {
1351 		ifp = bif->ifp;
1352 
1353 		if ((ifp->if_flags & IFF_RUNNING) == 0)
1354 			continue;
1355 
1356 		mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1357 		if (mc == NULL) {
1358 			sc->sc_if.if_oerrors++;
1359 			continue;
1360 		}
1361 
1362 		error = bridge_ifenqueue(&sc->sc_if, ifp, mc);
1363 		if (error)
1364 			continue;
1365 	}
1366 }
1367 
1368 /*
1369  * Block non-ip frames:
1370  * Returns 0 if frame is ip, and 1 if it should be dropped.
1371  */
1372 int
1373 bridge_blocknonip(struct ether_header *eh, struct mbuf *m)
1374 {
1375 	struct llc llc;
1376 	u_int16_t etype;
1377 
1378 	if (m->m_pkthdr.len < ETHER_HDR_LEN)
1379 		return (1);
1380 
1381 #if NVLAN > 0
1382 	if (m->m_flags & M_VLANTAG)
1383 		return (1);
1384 #endif
1385 
1386 	etype = ntohs(eh->ether_type);
1387 	switch (etype) {
1388 	case ETHERTYPE_ARP:
1389 	case ETHERTYPE_REVARP:
1390 	case ETHERTYPE_IP:
1391 	case ETHERTYPE_IPV6:
1392 		return (0);
1393 	}
1394 
1395 	if (etype > ETHERMTU)
1396 		return (1);
1397 
1398 	if (m->m_pkthdr.len <
1399 	    (ETHER_HDR_LEN + LLC_SNAPFRAMELEN))
1400 		return (1);
1401 
1402 	m_copydata(m, ETHER_HDR_LEN, LLC_SNAPFRAMELEN,
1403 	    (caddr_t)&llc);
1404 
1405 	etype = ntohs(llc.llc_snap.ether_type);
1406 	if (llc.llc_dsap == LLC_SNAP_LSAP &&
1407 	    llc.llc_ssap == LLC_SNAP_LSAP &&
1408 	    llc.llc_control == LLC_UI &&
1409 	    llc.llc_snap.org_code[0] == 0 &&
1410 	    llc.llc_snap.org_code[1] == 0 &&
1411 	    llc.llc_snap.org_code[2] == 0 &&
1412 	    (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
1413 	    etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)) {
1414 		return (0);
1415 	}
1416 
1417 	return (1);
1418 }
1419 
1420 #ifdef IPSEC
1421 int
1422 bridge_ipsec(struct ifnet *ifp, struct ether_header *eh, int hassnap,
1423     struct llc *llc, int dir, int af, int hlen, struct mbuf *m)
1424 {
1425 	union sockaddr_union dst;
1426 	struct tdb *tdb;
1427 	u_int32_t spi;
1428 	u_int16_t cpi;
1429 	int error, off;
1430 	u_int8_t proto = 0;
1431 	struct ip *ip;
1432 #ifdef INET6
1433 	struct ip6_hdr *ip6;
1434 #endif /* INET6 */
1435 #if NPF > 0
1436 	struct ifnet *encif;
1437 #endif
1438 
1439 	if (dir == BRIDGE_IN) {
1440 		switch (af) {
1441 		case AF_INET:
1442 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1443 				goto skiplookup;
1444 
1445 			ip = mtod(m, struct ip *);
1446 			proto = ip->ip_p;
1447 			off = offsetof(struct ip, ip_p);
1448 
1449 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1450 			    proto != IPPROTO_IPCOMP)
1451 				goto skiplookup;
1452 
1453 			bzero(&dst, sizeof(union sockaddr_union));
1454 			dst.sa.sa_family = AF_INET;
1455 			dst.sin.sin_len = sizeof(struct sockaddr_in);
1456 			m_copydata(m, offsetof(struct ip, ip_dst),
1457 			    sizeof(struct in_addr),
1458 			    (caddr_t)&dst.sin.sin_addr);
1459 
1460 			break;
1461 #ifdef INET6
1462 		case AF_INET6:
1463 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1464 				goto skiplookup;
1465 
1466 			ip6 = mtod(m, struct ip6_hdr *);
1467 
1468 			/* XXX We should chase down the header chain */
1469 			proto = ip6->ip6_nxt;
1470 			off = offsetof(struct ip6_hdr, ip6_nxt);
1471 
1472 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1473 			    proto != IPPROTO_IPCOMP)
1474 				goto skiplookup;
1475 
1476 			bzero(&dst, sizeof(union sockaddr_union));
1477 			dst.sa.sa_family = AF_INET6;
1478 			dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1479 			m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
1480 			    sizeof(struct in6_addr),
1481 			    (caddr_t)&dst.sin6.sin6_addr);
1482 
1483 			break;
1484 #endif /* INET6 */
1485 		default:
1486 			return (0);
1487 		}
1488 
1489 		switch (proto) {
1490 		case IPPROTO_ESP:
1491 			m_copydata(m, hlen, sizeof(u_int32_t), (caddr_t)&spi);
1492 			break;
1493 		case IPPROTO_AH:
1494 			m_copydata(m, hlen + sizeof(u_int32_t),
1495 			    sizeof(u_int32_t), (caddr_t)&spi);
1496 			break;
1497 		case IPPROTO_IPCOMP:
1498 			m_copydata(m, hlen + sizeof(u_int16_t),
1499 			    sizeof(u_int16_t), (caddr_t)&cpi);
1500 			spi = ntohl(htons(cpi));
1501 			break;
1502 		}
1503 
1504 		NET_ASSERT_LOCKED();
1505 
1506 		tdb = gettdb(ifp->if_rdomain, spi, &dst, proto);
1507 		if (tdb != NULL && (tdb->tdb_flags & TDBF_INVALID) == 0 &&
1508 		    tdb->tdb_xform != NULL) {
1509 			if (tdb->tdb_first_use == 0) {
1510 				tdb->tdb_first_use = time_second;
1511 				if (tdb->tdb_flags & TDBF_FIRSTUSE)
1512 					timeout_add_sec(&tdb->tdb_first_tmo,
1513 					    tdb->tdb_exp_first_use);
1514 				if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE)
1515 					timeout_add_sec(&tdb->tdb_sfirst_tmo,
1516 					    tdb->tdb_soft_first_use);
1517 			}
1518 
1519 			(*(tdb->tdb_xform->xf_input))(m, tdb, hlen, off);
1520 			return (1);
1521 		} else {
1522  skiplookup:
1523 			/* XXX do an input policy lookup */
1524 			return (0);
1525 		}
1526 	} else { /* Outgoing from the bridge. */
1527 		tdb = ipsp_spd_lookup(m, af, hlen, &error,
1528 		    IPSP_DIRECTION_OUT, NULL, NULL, 0);
1529 		if (tdb != NULL) {
1530 			/*
1531 			 * We don't need to do loop detection, the
1532 			 * bridge will do that for us.
1533 			 */
1534 #if NPF > 0
1535 			if ((encif = enc_getif(tdb->tdb_rdomain,
1536 			    tdb->tdb_tap)) == NULL ||
1537 			    pf_test(af, dir, encif, &m) != PF_PASS) {
1538 				m_freem(m);
1539 				return (1);
1540 			}
1541 			if (m == NULL)
1542 				return (1);
1543 			else if (af == AF_INET)
1544 				in_proto_cksum_out(m, encif);
1545 #ifdef INET6
1546 			else if (af == AF_INET6)
1547 				in6_proto_cksum_out(m, encif);
1548 #endif /* INET6 */
1549 #endif /* NPF */
1550 
1551 			ip = mtod(m, struct ip *);
1552 			if ((af == AF_INET) &&
1553 			    ip_mtudisc && (ip->ip_off & htons(IP_DF)) &&
1554 			    tdb->tdb_mtu && ntohs(ip->ip_len) > tdb->tdb_mtu &&
1555 			    tdb->tdb_mtutimeout > time_second)
1556 				bridge_send_icmp_err(ifp, eh, m,
1557 				    hassnap, llc, tdb->tdb_mtu,
1558 				    ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1559 			else
1560 				error = ipsp_process_packet(m, tdb, af, 0);
1561 			return (1);
1562 		} else
1563 			return (0);
1564 	}
1565 
1566 	return (0);
1567 }
1568 #endif /* IPSEC */
1569 
1570 /*
1571  * Filter IP packets by peeking into the ethernet frame.  This violates
1572  * the ISO model, but allows us to act as a IP filter at the data link
1573  * layer.  As a result, most of this code will look familiar to those
1574  * who've read net/if_ethersubr.c and netinet/ip_input.c
1575  */
1576 struct mbuf *
1577 bridge_ip(struct ifnet *brifp, int dir, struct ifnet *ifp,
1578     struct ether_header *eh, struct mbuf *m)
1579 {
1580 	struct llc llc;
1581 	int hassnap = 0;
1582 	struct ip *ip;
1583 	int hlen;
1584 	u_int16_t etype;
1585 
1586 #if NVLAN > 0
1587 	if (m->m_flags & M_VLANTAG)
1588 		return (m);
1589 #endif
1590 
1591 	etype = ntohs(eh->ether_type);
1592 
1593 	if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) {
1594 		if (etype > ETHERMTU ||
1595 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1596 		    ETHER_HDR_LEN))
1597 			return (m);
1598 
1599 		m_copydata(m, ETHER_HDR_LEN,
1600 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1601 
1602 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1603 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1604 		    llc.llc_control != LLC_UI ||
1605 		    llc.llc_snap.org_code[0] ||
1606 		    llc.llc_snap.org_code[1] ||
1607 		    llc.llc_snap.org_code[2])
1608 			return (m);
1609 
1610 		etype = ntohs(llc.llc_snap.ether_type);
1611 		if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6)
1612 			return (m);
1613 		hassnap = 1;
1614 	}
1615 
1616 	m_adj(m, ETHER_HDR_LEN);
1617 	if (hassnap)
1618 		m_adj(m, LLC_SNAPFRAMELEN);
1619 
1620 	switch (etype) {
1621 
1622 	case ETHERTYPE_IP:
1623 		if (m->m_pkthdr.len < sizeof(struct ip))
1624 			goto dropit;
1625 
1626 		/* Copy minimal header, and drop invalids */
1627 		if (m->m_len < sizeof(struct ip) &&
1628 		    (m = m_pullup(m, sizeof(struct ip))) == NULL) {
1629 			ipstat_inc(ips_toosmall);
1630 			return (NULL);
1631 		}
1632 		ip = mtod(m, struct ip *);
1633 
1634 		if (ip->ip_v != IPVERSION) {
1635 			ipstat_inc(ips_badvers);
1636 			goto dropit;
1637 		}
1638 
1639 		hlen = ip->ip_hl << 2;	/* get whole header length */
1640 		if (hlen < sizeof(struct ip)) {
1641 			ipstat_inc(ips_badhlen);
1642 			goto dropit;
1643 		}
1644 
1645 		if (hlen > m->m_len) {
1646 			if ((m = m_pullup(m, hlen)) == NULL) {
1647 				ipstat_inc(ips_badhlen);
1648 				return (NULL);
1649 			}
1650 			ip = mtod(m, struct ip *);
1651 		}
1652 
1653 		if ((m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_OK) == 0) {
1654 			if (m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_BAD) {
1655 				ipstat_inc(ips_badsum);
1656 				goto dropit;
1657 			}
1658 
1659 			ipstat_inc(ips_inswcsum);
1660 			if (in_cksum(m, hlen) != 0) {
1661 				ipstat_inc(ips_badsum);
1662 				goto dropit;
1663 			}
1664 		}
1665 
1666 		if (ntohs(ip->ip_len) < hlen)
1667 			goto dropit;
1668 
1669 		if (m->m_pkthdr.len < ntohs(ip->ip_len))
1670 			goto dropit;
1671 		if (m->m_pkthdr.len > ntohs(ip->ip_len)) {
1672 			if (m->m_len == m->m_pkthdr.len) {
1673 				m->m_len = ntohs(ip->ip_len);
1674 				m->m_pkthdr.len = ntohs(ip->ip_len);
1675 			} else
1676 				m_adj(m, ntohs(ip->ip_len) - m->m_pkthdr.len);
1677 		}
1678 
1679 #ifdef IPSEC
1680 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1681 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET, hlen, m))
1682 			return (NULL);
1683 #endif /* IPSEC */
1684 #if NPF > 0
1685 		/* Finally, we get to filter the packet! */
1686 		if (pf_test(AF_INET, dir, ifp, &m) != PF_PASS)
1687 			goto dropit;
1688 		if (m == NULL)
1689 			goto dropit;
1690 #endif /* NPF > 0 */
1691 
1692 		/* Rebuild the IP header */
1693 		if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
1694 			return (NULL);
1695 		if (m->m_len < sizeof(struct ip))
1696 			goto dropit;
1697 		in_proto_cksum_out(m, ifp);
1698 		ip = mtod(m, struct ip *);
1699 		ip->ip_sum = 0;
1700 		if (0 && (ifp->if_capabilities & IFCAP_CSUM_IPv4))
1701 			m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
1702 		else {
1703 			ipstat_inc(ips_outswcsum);
1704 			ip->ip_sum = in_cksum(m, hlen);
1705 		}
1706 
1707 		break;
1708 
1709 #ifdef INET6
1710 	case ETHERTYPE_IPV6: {
1711 		struct ip6_hdr *ip6;
1712 
1713 		if (m->m_len < sizeof(struct ip6_hdr)) {
1714 			if ((m = m_pullup(m, sizeof(struct ip6_hdr)))
1715 			    == NULL) {
1716 				ip6stat_inc(ip6s_toosmall);
1717 				return (NULL);
1718 			}
1719 		}
1720 
1721 		ip6 = mtod(m, struct ip6_hdr *);
1722 
1723 		if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
1724 			ip6stat_inc(ip6s_badvers);
1725 			goto dropit;
1726 		}
1727 
1728 #ifdef IPSEC
1729 		hlen = sizeof(struct ip6_hdr);
1730 
1731 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1732 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET6, hlen,
1733 		    m))
1734 			return (NULL);
1735 #endif /* IPSEC */
1736 
1737 #if NPF > 0
1738 		if (pf_test(AF_INET6, dir, ifp, &m) != PF_PASS)
1739 			goto dropit;
1740 		if (m == NULL)
1741 			return (NULL);
1742 #endif /* NPF > 0 */
1743 		in6_proto_cksum_out(m, ifp);
1744 
1745 		break;
1746 	}
1747 #endif /* INET6 */
1748 
1749 	default:
1750 		goto dropit;
1751 		break;
1752 	}
1753 
1754 	/* Reattach SNAP header */
1755 	if (hassnap) {
1756 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1757 		if (m == NULL)
1758 			goto dropit;
1759 		bcopy(&llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
1760 	}
1761 
1762 	/* Reattach ethernet header */
1763 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1764 	if (m == NULL)
1765 		goto dropit;
1766 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1767 
1768 	return (m);
1769 
1770 dropit:
1771 	m_freem(m);
1772 	return (NULL);
1773 }
1774 
1775 void
1776 bridge_fragment(struct ifnet *brifp, struct ifnet *ifp, struct ether_header *eh,
1777     struct mbuf *m)
1778 {
1779 	struct llc llc;
1780 	struct mbuf *m0;
1781 	int error = 0;
1782 	int hassnap = 0;
1783 	u_int16_t etype;
1784 	struct ip *ip;
1785 
1786 	etype = ntohs(eh->ether_type);
1787 #if NVLAN > 0
1788 	if ((m->m_flags & M_VLANTAG) || etype == ETHERTYPE_VLAN ||
1789 	    etype == ETHERTYPE_QINQ) {
1790 		int len = m->m_pkthdr.len;
1791 
1792 		if (m->m_flags & M_VLANTAG)
1793 			len += ETHER_VLAN_ENCAP_LEN;
1794 		if ((ifp->if_capabilities & IFCAP_VLAN_MTU) &&
1795 		    (len - sizeof(struct ether_vlan_header) <= ifp->if_mtu)) {
1796 			bridge_ifenqueue(brifp, ifp, m);
1797 			return;
1798 		}
1799 		goto dropit;
1800 	}
1801 #endif
1802 	if (etype != ETHERTYPE_IP) {
1803 		if (etype > ETHERMTU ||
1804 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1805 		    ETHER_HDR_LEN))
1806 			goto dropit;
1807 
1808 		m_copydata(m, ETHER_HDR_LEN,
1809 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1810 
1811 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1812 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1813 		    llc.llc_control != LLC_UI ||
1814 		    llc.llc_snap.org_code[0] ||
1815 		    llc.llc_snap.org_code[1] ||
1816 		    llc.llc_snap.org_code[2] ||
1817 		    llc.llc_snap.ether_type != htons(ETHERTYPE_IP))
1818 			goto dropit;
1819 
1820 		hassnap = 1;
1821 	}
1822 
1823 	m_adj(m, ETHER_HDR_LEN);
1824 	if (hassnap)
1825 		m_adj(m, LLC_SNAPFRAMELEN);
1826 
1827 	if (m->m_len < sizeof(struct ip) &&
1828 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
1829 		goto dropit;
1830 	ip = mtod(m, struct ip *);
1831 
1832 	/* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */
1833 	if (ip->ip_off & htons(IP_DF)) {
1834 		bridge_send_icmp_err(ifp, eh, m, hassnap, &llc,
1835 		    ifp->if_mtu, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1836 		return;
1837 	}
1838 
1839 	error = ip_fragment(m, ifp, ifp->if_mtu);
1840 	if (error) {
1841 		m = NULL;
1842 		goto dropit;
1843 	}
1844 
1845 	for (; m; m = m0) {
1846 		m0 = m->m_nextpkt;
1847 		m->m_nextpkt = NULL;
1848 		if (error == 0) {
1849 			if (hassnap) {
1850 				M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1851 				if (m == NULL) {
1852 					error = ENOBUFS;
1853 					continue;
1854 				}
1855 				bcopy(&llc, mtod(m, caddr_t),
1856 				    LLC_SNAPFRAMELEN);
1857 			}
1858 			M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1859 			if (m == NULL) {
1860 				error = ENOBUFS;
1861 				continue;
1862 			}
1863 			bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1864 			error = bridge_ifenqueue(brifp, ifp, m);
1865 			if (error) {
1866 				continue;
1867 			}
1868 		} else
1869 			m_freem(m);
1870 	}
1871 
1872 	if (error == 0)
1873 		ipstat_inc(ips_fragmented);
1874 
1875 	return;
1876  dropit:
1877 	m_freem(m);
1878 }
1879 
1880 int
1881 bridge_ifenqueue(struct ifnet *brifp, struct ifnet *ifp, struct mbuf *m)
1882 {
1883 	int error, len;
1884 
1885 	/* Loop prevention. */
1886 	m->m_flags |= M_PROTO1;
1887 
1888 	len = m->m_pkthdr.len;
1889 
1890 	error = if_enqueue(ifp, m);
1891 	if (error) {
1892 		brifp->if_oerrors++;
1893 		return (error);
1894 	}
1895 
1896 	brifp->if_opackets++;
1897 	brifp->if_obytes += len;
1898 
1899 	return (0);
1900 }
1901 
1902 void
1903 bridge_ifinput(struct ifnet *ifp, struct mbuf *m)
1904 {
1905 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1906 
1907 	m->m_flags |= M_PROTO1;
1908 
1909 	ml_enqueue(&ml, m);
1910 	if_input(ifp, &ml);
1911 }
1912 
1913 void
1914 bridge_send_icmp_err(struct ifnet *ifp,
1915     struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc,
1916     int mtu, int type, int code)
1917 {
1918 	struct ip *ip;
1919 	struct icmp *icp;
1920 	struct in_addr t;
1921 	struct mbuf *m, *n2;
1922 	int hlen;
1923 	u_int8_t ether_tmp[ETHER_ADDR_LEN];
1924 
1925 	n2 = m_copym(n, 0, M_COPYALL, M_DONTWAIT);
1926 	if (!n2) {
1927 		m_freem(n);
1928 		return;
1929 	}
1930 	m = icmp_do_error(n, type, code, 0, mtu);
1931 	if (m == NULL) {
1932 		m_freem(n2);
1933 		return;
1934 	}
1935 
1936 	n = n2;
1937 
1938 	ip = mtod(m, struct ip *);
1939 	hlen = ip->ip_hl << 2;
1940 	t = ip->ip_dst;
1941 	ip->ip_dst = ip->ip_src;
1942 	ip->ip_src = t;
1943 
1944 	m->m_data += hlen;
1945 	m->m_len -= hlen;
1946 	icp = mtod(m, struct icmp *);
1947 	icp->icmp_cksum = 0;
1948 	icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
1949 	m->m_data -= hlen;
1950 	m->m_len += hlen;
1951 
1952 	ip->ip_v = IPVERSION;
1953 	ip->ip_off &= htons(IP_DF);
1954 	ip->ip_id = htons(ip_randomid());
1955 	ip->ip_ttl = MAXTTL;
1956 	ip->ip_sum = 0;
1957 	ip->ip_sum = in_cksum(m, hlen);
1958 
1959 	/* Swap ethernet addresses */
1960 	bcopy(&eh->ether_dhost, &ether_tmp, sizeof(ether_tmp));
1961 	bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp));
1962 	bcopy(&ether_tmp, &eh->ether_shost, sizeof(ether_tmp));
1963 
1964 	/* Reattach SNAP header */
1965 	if (hassnap) {
1966 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1967 		if (m == NULL)
1968 			goto dropit;
1969 		bcopy(llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
1970 	}
1971 
1972 	/* Reattach ethernet header */
1973 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1974 	if (m == NULL)
1975 		goto dropit;
1976 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1977 
1978 	bridge_output(ifp, m, NULL, NULL);
1979 	m_freem(n);
1980 	return;
1981 
1982  dropit:
1983 	m_freem(n);
1984 }
1985 
1986 struct bridge_tunneltag *
1987 bridge_tunnel(struct mbuf *m)
1988 {
1989 	struct m_tag    *mtag;
1990 
1991 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL)
1992 		return (NULL);
1993 
1994 	return ((struct bridge_tunneltag *)(mtag + 1));
1995 }
1996 
1997 struct bridge_tunneltag *
1998 bridge_tunneltag(struct mbuf *m)
1999 {
2000 	struct m_tag	*mtag;
2001 
2002 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL) {
2003 		mtag = m_tag_get(PACKET_TAG_TUNNEL,
2004 		    sizeof(struct bridge_tunneltag), M_NOWAIT);
2005 		if (mtag == NULL)
2006 			return (NULL);
2007 		bzero(mtag + 1, sizeof(struct bridge_tunneltag));
2008 		m_tag_prepend(m, mtag);
2009 	}
2010 
2011 	return ((struct bridge_tunneltag *)(mtag + 1));
2012 }
2013 
2014 void
2015 bridge_tunneluntag(struct mbuf *m)
2016 {
2017 	struct m_tag    *mtag;
2018 	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL)
2019 		m_tag_delete(m, mtag);
2020 }
2021 
2022 void
2023 bridge_copyaddr(struct sockaddr *src, struct sockaddr *dst)
2024 {
2025 	if (src != NULL && src->sa_family != AF_UNSPEC)
2026 		memcpy(dst, src, src->sa_len);
2027 	else {
2028 		dst->sa_family = AF_UNSPEC;
2029 		dst->sa_len = 0;
2030 	}
2031 }
2032 
2033 void
2034 bridge_copytag(struct bridge_tunneltag *src, struct bridge_tunneltag *dst)
2035 {
2036 	if (src == NULL) {
2037 		memset(dst, 0, sizeof(*dst));
2038 	} else {
2039 		bridge_copyaddr(&src->brtag_peer.sa, &dst->brtag_peer.sa);
2040 		bridge_copyaddr(&src->brtag_local.sa, &dst->brtag_local.sa);
2041 		dst->brtag_id = src->brtag_id;
2042 	}
2043 }
2044