xref: /openbsd-src/sys/net/if_bridge.c (revision cba26e98faa2b48aa4705f205ed876af460243a2)
1 /*	$OpenBSD: if_bridge.c,v 1.347 2021/01/08 23:31:53 dlg Exp $	*/
2 
3 /*
4  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
19  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
25  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  *
28  * Effort sponsored in part by the Defense Advanced Research Projects
29  * Agency (DARPA) and Air Force Research Laboratory, Air Force
30  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
31  *
32  */
33 
34 #include "bpfilter.h"
35 #include "gif.h"
36 #include "pf.h"
37 #include "carp.h"
38 #include "vlan.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/ioctl.h>
45 #include <sys/kernel.h>
46 
47 #include <net/if.h>
48 #include <net/if_types.h>
49 #include <net/if_llc.h>
50 #include <net/netisr.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/ip.h>
54 #include <netinet/ip_var.h>
55 #include <netinet/if_ether.h>
56 #include <netinet/ip_icmp.h>
57 
58 #ifdef IPSEC
59 #include <netinet/ip_ipsp.h>
60 #include <net/if_enc.h>
61 #endif
62 
63 #ifdef INET6
64 #include <netinet6/in6_var.h>
65 #include <netinet/ip6.h>
66 #include <netinet6/ip6_var.h>
67 #endif
68 
69 #if NPF > 0
70 #include <net/pfvar.h>
71 #define	BRIDGE_IN	PF_IN
72 #define	BRIDGE_OUT	PF_OUT
73 #else
74 #define	BRIDGE_IN	0
75 #define	BRIDGE_OUT	1
76 #endif
77 
78 #if NBPFILTER > 0
79 #include <net/bpf.h>
80 #endif
81 
82 #if NCARP > 0
83 #include <netinet/ip_carp.h>
84 #endif
85 
86 #if NVLAN > 0
87 #include <net/if_vlan_var.h>
88 #endif
89 
90 #include <net/if_bridge.h>
91 
92 /*
93  * Maximum number of addresses to cache
94  */
95 #ifndef	BRIDGE_RTABLE_MAX
96 #define	BRIDGE_RTABLE_MAX	100
97 #endif
98 
99 /*
100  * Timeout (in seconds) for entries learned dynamically
101  */
102 #ifndef	BRIDGE_RTABLE_TIMEOUT
103 #define	BRIDGE_RTABLE_TIMEOUT	240
104 #endif
105 
106 void	bridgeattach(int);
107 int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
108 void	bridge_ifdetach(void *);
109 void	bridge_spandetach(void *);
110 int	bridge_ifremove(struct bridge_iflist *);
111 void	bridge_spanremove(struct bridge_iflist *);
112 struct mbuf *
113 	bridge_input(struct ifnet *, struct mbuf *, void *);
114 void	bridge_process(struct ifnet *, struct mbuf *);
115 void	bridgeintr_frame(struct ifnet *, struct ifnet *, struct mbuf *);
116 void	bridge_bifgetstp(struct bridge_softc *, struct bridge_iflist *,
117 	    struct ifbreq *);
118 void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
119     struct ether_header *, struct mbuf *);
120 int	bridge_localbroadcast(struct ifnet *, struct ether_header *,
121     struct mbuf *);
122 void	bridge_span(struct ifnet *, struct mbuf *);
123 void	bridge_stop(struct bridge_softc *);
124 void	bridge_init(struct bridge_softc *);
125 int	bridge_bifconf(struct bridge_softc *, struct ifbifconf *);
126 int bridge_blocknonip(struct ether_header *, struct mbuf *);
127 void	bridge_ifinput(struct ifnet *, struct mbuf *);
128 int	bridge_dummy_output(struct ifnet *, struct mbuf *, struct sockaddr *,
129     struct rtentry *);
130 void	bridge_send_icmp_err(struct ifnet *, struct ether_header *,
131     struct mbuf *, int, struct llc *, int, int, int);
132 int	bridge_ifenqueue(struct ifnet *, struct ifnet *, struct mbuf *);
133 struct mbuf *bridge_ip(struct ifnet *, int, struct ifnet *,
134     struct ether_header *, struct mbuf *);
135 #ifdef IPSEC
136 int bridge_ipsec(struct ifnet *, struct ether_header *, int, struct llc *,
137     int, int, int, struct mbuf *);
138 #endif
139 int     bridge_clone_create(struct if_clone *, int);
140 int	bridge_clone_destroy(struct ifnet *);
141 
142 #define	ETHERADDR_IS_IP_MCAST(a) \
143 	/* struct etheraddr *a;	*/				\
144 	((a)->ether_addr_octet[0] == 0x01 &&			\
145 	 (a)->ether_addr_octet[1] == 0x00 &&			\
146 	 (a)->ether_addr_octet[2] == 0x5e)
147 
148 struct niqueue bridgeintrq = NIQUEUE_INITIALIZER(1024, NETISR_BRIDGE);
149 
150 struct if_clone bridge_cloner =
151     IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy);
152 
153 const struct ether_brport bridge_brport = {
154 	bridge_input,
155 	NULL,
156 };
157 
158 void
159 bridgeattach(int n)
160 {
161 	if_clone_attach(&bridge_cloner);
162 }
163 
164 int
165 bridge_clone_create(struct if_clone *ifc, int unit)
166 {
167 	struct bridge_softc *sc;
168 	struct ifnet *ifp;
169 	int i;
170 
171 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
172 	sc->sc_stp = bstp_create();
173 	if (!sc->sc_stp) {
174 		free(sc, M_DEVBUF, sizeof *sc);
175 		return (ENOMEM);
176 	}
177 
178 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
179 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
180 	timeout_set(&sc->sc_brtimeout, bridge_rtage, sc);
181 	SMR_SLIST_INIT(&sc->sc_iflist);
182 	SMR_SLIST_INIT(&sc->sc_spanlist);
183 	mtx_init(&sc->sc_mtx, IPL_MPFLOOR);
184 	for (i = 0; i < BRIDGE_RTABLE_SIZE; i++)
185 		LIST_INIT(&sc->sc_rts[i]);
186 	arc4random_buf(&sc->sc_hashkey, sizeof(sc->sc_hashkey));
187 	ifp = &sc->sc_if;
188 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
189 	    unit);
190 	ifp->if_softc = sc;
191 	ifp->if_mtu = ETHERMTU;
192 	ifp->if_ioctl = bridge_ioctl;
193 	ifp->if_output = bridge_dummy_output;
194 	ifp->if_xflags = IFXF_CLONED;
195 	ifp->if_start = NULL;
196 	ifp->if_type = IFT_BRIDGE;
197 	ifp->if_hdrlen = ETHER_HDR_LEN;
198 
199 	if_attach(ifp);
200 	if_alloc_sadl(ifp);
201 
202 #if NBPFILTER > 0
203 	bpfattach(&sc->sc_if.if_bpf, ifp,
204 	    DLT_EN10MB, ETHER_HDR_LEN);
205 #endif
206 
207 	return (0);
208 }
209 
210 int
211 bridge_dummy_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
212     struct rtentry *rt)
213 {
214 	m_freem(m);
215 	return (EAFNOSUPPORT);
216 }
217 
218 int
219 bridge_clone_destroy(struct ifnet *ifp)
220 {
221 	struct bridge_softc *sc = ifp->if_softc;
222 	struct bridge_iflist *bif;
223 
224 	/*
225 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
226 	 * use of smr_barrier() while holding the lock might lead to a
227 	 * deadlock situation.
228 	 */
229 	NET_ASSERT_UNLOCKED();
230 
231 	bridge_stop(sc);
232 	bridge_rtflush(sc, IFBF_FLUSHALL);
233 	while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_iflist)) != NULL)
234 		bridge_ifremove(bif);
235 	while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_spanlist)) != NULL)
236 		bridge_spanremove(bif);
237 
238 	bstp_destroy(sc->sc_stp);
239 
240 	if_detach(ifp);
241 
242 	free(sc, M_DEVBUF, sizeof *sc);
243 	return (0);
244 }
245 
246 int
247 bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
248 {
249 	struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
250 	struct ifbreq *req = (struct ifbreq *)data;
251 	struct ifbropreq *brop = (struct ifbropreq *)data;
252 	struct ifnet *ifs;
253 	struct bridge_iflist *bif;
254 	struct bstp_port *bp;
255 	struct bstp_state *bs = sc->sc_stp;
256 	int error = 0;
257 
258 	/*
259 	 * bridge(4) data structure aren't protected by the NET_LOCK().
260 	 * Idealy it shouldn't be taken before calling `ifp->if_ioctl'
261 	 * but we aren't there yet.
262 	 */
263 	NET_UNLOCK();
264 
265 	switch (cmd) {
266 	case SIOCBRDGADD:
267 	/* bridge(4) does not distinguish between routing/forwarding ports */
268 	case SIOCBRDGADDL:
269 		if ((error = suser(curproc)) != 0)
270 			break;
271 
272 		ifs = ifunit(req->ifbr_ifsname);
273 		if (ifs == NULL) {			/* no such interface */
274 			error = ENOENT;
275 			break;
276 		}
277 		if (ifs->if_type != IFT_ETHER) {
278 			error = EINVAL;
279 			break;
280 		}
281 		if (ifs->if_bridgeidx != 0) {
282 			if (ifs->if_bridgeidx == ifp->if_index)
283 				error = EEXIST;
284 			else
285 				error = EBUSY;
286 			break;
287 		}
288 
289 		error = ether_brport_isset(ifs);
290 		if (error != 0)
291 			break;
292 
293 		/* If it's in the span list, it can't be a member. */
294 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
295 			if (bif->ifp == ifs)
296 				break;
297 		}
298 		if (bif != NULL) {
299 			error = EBUSY;
300 			break;
301 		}
302 
303 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
304 		if (bif == NULL) {
305 			error = ENOMEM;
306 			break;
307 		}
308 
309 		NET_LOCK();
310 		error = ifpromisc(ifs, 1);
311 		NET_UNLOCK();
312 		if (error != 0) {
313 			free(bif, M_DEVBUF, sizeof(*bif));
314 			break;
315 		}
316 
317 		/*
318 		 * XXX If the NET_LOCK() or ifpromisc() calls above
319 		 * had to sleep, then something else could have come
320 		 * along and taken over ifs while the kernel lock was
321 		 * released. Or worse, ifs could have been destroyed
322 		 * cos ifunit() is... optimistic.
323 		 */
324 
325 		bif->bridge_sc = sc;
326 		bif->ifp = ifs;
327 		bif->bif_flags = IFBIF_LEARNING | IFBIF_DISCOVER;
328 		SIMPLEQ_INIT(&bif->bif_brlin);
329 		SIMPLEQ_INIT(&bif->bif_brlout);
330 		ifs->if_bridgeidx = ifp->if_index;
331 		task_set(&bif->bif_dtask, bridge_ifdetach, bif);
332 		if_detachhook_add(ifs, &bif->bif_dtask);
333 		ether_brport_set(bif->ifp, &bridge_brport);
334 		SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_iflist, bif, bif_next);
335 		break;
336 	case SIOCBRDGDEL:
337 		if ((error = suser(curproc)) != 0)
338 			break;
339 		ifs = ifunit(req->ifbr_ifsname);
340 		if (ifs == NULL) {
341 			error = ENOENT;
342 			break;
343 		}
344 		if (ifs->if_bridgeidx != ifp->if_index) {
345 			error = ESRCH;
346 			break;
347 		}
348 		bif = bridge_getbif(ifs);
349 		bridge_ifremove(bif);
350 		break;
351 	case SIOCBRDGIFS:
352 		error = bridge_bifconf(sc, (struct ifbifconf *)data);
353 		break;
354 	case SIOCBRDGADDS:
355 		if ((error = suser(curproc)) != 0)
356 			break;
357 		ifs = ifunit(req->ifbr_ifsname);
358 		if (ifs == NULL) {			/* no such interface */
359 			error = ENOENT;
360 			break;
361 		}
362 		if (ifs->if_type != IFT_ETHER) {
363 			error = EINVAL;
364 			break;
365 		}
366 		if (ifs->if_bridgeidx != 0) {
367 			if (ifs->if_bridgeidx == ifp->if_index)
368 				error = EEXIST;
369 			else
370 				error = EBUSY;
371 			break;
372 		}
373 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
374 			if (bif->ifp == ifs)
375 				break;
376 		}
377 		if (bif != NULL) {
378 			error = EEXIST;
379 			break;
380 		}
381 		bif = malloc(sizeof(*bif), M_DEVBUF, M_NOWAIT|M_ZERO);
382 		if (bif == NULL) {
383 			error = ENOMEM;
384 			break;
385 		}
386 		bif->bridge_sc = sc;
387 		bif->ifp = ifs;
388 		bif->bif_flags = IFBIF_SPAN;
389 		SIMPLEQ_INIT(&bif->bif_brlin);
390 		SIMPLEQ_INIT(&bif->bif_brlout);
391 		task_set(&bif->bif_dtask, bridge_spandetach, bif);
392 		if_detachhook_add(ifs, &bif->bif_dtask);
393 		SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_spanlist, bif, bif_next);
394 		break;
395 	case SIOCBRDGDELS:
396 		if ((error = suser(curproc)) != 0)
397 			break;
398 		ifs = ifunit(req->ifbr_ifsname);
399 		if (ifs == NULL) {
400 			error = ENOENT;
401 			break;
402 		}
403 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
404 			if (bif->ifp == ifs)
405 				break;
406 		}
407 		if (bif == NULL) {
408 			error = ESRCH;
409 			break;
410 		}
411 		bridge_spanremove(bif);
412 		break;
413 	case SIOCBRDGGIFFLGS:
414 		ifs = ifunit(req->ifbr_ifsname);
415 		if (ifs == NULL) {
416 			error = ENOENT;
417 			break;
418 		}
419 		if (ifs->if_bridgeidx != ifp->if_index) {
420 			error = ESRCH;
421 			break;
422 		}
423 		bif = bridge_getbif(ifs);
424 		req->ifbr_ifsflags = bif->bif_flags;
425 		req->ifbr_portno = bif->ifp->if_index & 0xfff;
426 		req->ifbr_protected = bif->bif_protected;
427 		if (bif->bif_flags & IFBIF_STP)
428 			bridge_bifgetstp(sc, bif, req);
429 		break;
430 	case SIOCBRDGSIFFLGS:
431 		if ((error = suser(curproc)) != 0)
432 			break;
433 		ifs = ifunit(req->ifbr_ifsname);
434 		if (ifs == NULL) {
435 			error = ENOENT;
436 			break;
437 		}
438 		if (ifs->if_bridgeidx != ifp->if_index) {
439 			error = ESRCH;
440 			break;
441 		}
442 		if (req->ifbr_ifsflags & IFBIF_RO_MASK) {
443 			error = EINVAL;
444 			break;
445 		}
446 		bif = bridge_getbif(ifs);
447 		if (req->ifbr_ifsflags & IFBIF_STP) {
448 			if ((bif->bif_flags & IFBIF_STP) == 0) {
449 				/* Enable STP */
450 				if ((bif->bif_stp = bstp_add(sc->sc_stp,
451 				    bif->ifp)) == NULL) {
452 					error = ENOMEM;
453 					break;
454 				}
455 			} else {
456 				/* Update STP flags */
457 				bstp_ifsflags(bif->bif_stp, req->ifbr_ifsflags);
458 			}
459 		} else if (bif->bif_flags & IFBIF_STP) {
460 			bstp_delete(bif->bif_stp);
461 			bif->bif_stp = NULL;
462 		}
463 		bif->bif_flags = req->ifbr_ifsflags;
464 		break;
465 	case SIOCSIFFLAGS:
466 		if ((ifp->if_flags & IFF_UP) == IFF_UP)
467 			bridge_init(sc);
468 
469 		if ((ifp->if_flags & IFF_UP) == 0)
470 			bridge_stop(sc);
471 
472 		break;
473 	case SIOCBRDGGPARAM:
474 		if ((bp = bs->bs_root_port) == NULL)
475 			brop->ifbop_root_port = 0;
476 		else
477 			brop->ifbop_root_port = bp->bp_ifindex;
478 		brop->ifbop_maxage = bs->bs_bridge_max_age >> 8;
479 		brop->ifbop_hellotime = bs->bs_bridge_htime >> 8;
480 		brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
481 		brop->ifbop_holdcount = bs->bs_txholdcount;
482 		brop->ifbop_priority = bs->bs_bridge_priority;
483 		brop->ifbop_protocol = bs->bs_protover;
484 		brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id;
485 		brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
486 		brop->ifbop_root_port = bs->bs_root_pv.pv_port_id;
487 		brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
488 		brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
489 		brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
490 		break;
491 	case SIOCBRDGSIFPROT:
492 		ifs = ifunit(req->ifbr_ifsname);
493 		if (ifs == NULL) {
494 			error = ENOENT;
495 			break;
496 		}
497 		if (ifs->if_bridgeidx != ifp->if_index) {
498 			error = ESRCH;
499 			break;
500 		}
501 		bif = bridge_getbif(ifs);
502 		bif->bif_protected = req->ifbr_protected;
503 		break;
504 	case SIOCBRDGRTS:
505 	case SIOCBRDGGCACHE:
506 	case SIOCBRDGGPRI:
507 	case SIOCBRDGGMA:
508 	case SIOCBRDGGHT:
509 	case SIOCBRDGGFD:
510 	case SIOCBRDGGTO:
511 	case SIOCBRDGGRL:
512 		break;
513 	case SIOCBRDGFLUSH:
514 	case SIOCBRDGSADDR:
515 	case SIOCBRDGDADDR:
516 	case SIOCBRDGSCACHE:
517 	case SIOCBRDGSTO:
518 	case SIOCBRDGARL:
519 	case SIOCBRDGFRL:
520 	case SIOCBRDGSPRI:
521 	case SIOCBRDGSFD:
522 	case SIOCBRDGSMA:
523 	case SIOCBRDGSHT:
524 	case SIOCBRDGSTXHC:
525 	case SIOCBRDGSPROTO:
526 	case SIOCBRDGSIFPRIO:
527 	case SIOCBRDGSIFCOST:
528 		error = suser(curproc);
529 		break;
530 	default:
531 		error = ENOTTY;
532 		break;
533 	}
534 
535 	if (!error)
536 		error = bridgectl_ioctl(ifp, cmd, data);
537 
538 	if (!error)
539 		error = bstp_ioctl(ifp, cmd, data);
540 
541 	NET_LOCK();
542 	return (error);
543 }
544 
545 /* Detach an interface from a bridge.  */
546 int
547 bridge_ifremove(struct bridge_iflist *bif)
548 {
549 	struct bridge_softc *sc = bif->bridge_sc;
550 	int error;
551 
552 	SMR_SLIST_REMOVE_LOCKED(&sc->sc_iflist, bif, bridge_iflist, bif_next);
553 	if_detachhook_del(bif->ifp, &bif->bif_dtask);
554 	ether_brport_clr(bif->ifp);
555 
556 	smr_barrier();
557 
558 	if (bif->bif_flags & IFBIF_STP) {
559 		bstp_delete(bif->bif_stp);
560 		bif->bif_stp = NULL;
561 	}
562 
563 	bif->ifp->if_bridgeidx = 0;
564 	NET_LOCK();
565 	error = ifpromisc(bif->ifp, 0);
566 	NET_UNLOCK();
567 
568 	bridge_rtdelete(sc, bif->ifp, 0);
569 	bridge_flushrule(bif);
570 
571 	bif->ifp = NULL;
572 	free(bif, M_DEVBUF, sizeof(*bif));
573 
574 	return (error);
575 }
576 
577 void
578 bridge_spanremove(struct bridge_iflist *bif)
579 {
580 	struct bridge_softc *sc = bif->bridge_sc;
581 
582 	SMR_SLIST_REMOVE_LOCKED(&sc->sc_spanlist, bif, bridge_iflist, bif_next);
583 	if_detachhook_del(bif->ifp, &bif->bif_dtask);
584 
585 	smr_barrier();
586 
587 	bif->ifp = NULL;
588 	free(bif, M_DEVBUF, sizeof(*bif));
589 }
590 
591 void
592 bridge_ifdetach(void *xbif)
593 {
594 	struct bridge_iflist *bif = xbif;
595 
596 	/*
597 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
598 	 * use of smr_barrier() while holding the lock might lead to a
599 	 * deadlock situation.
600 	 */
601 	NET_UNLOCK();
602 	bridge_ifremove(bif);
603 	NET_LOCK();
604 }
605 
606 void
607 bridge_spandetach(void *xbif)
608 {
609 	struct bridge_iflist *bif = xbif;
610 
611 	/*
612 	 * bridge(4) detach hook doesn't need the NET_LOCK(), worst the
613 	 * use of smr_barrier() while holding the lock might lead to a
614 	 * deadlock situation.
615 	 */
616 	NET_UNLOCK();
617 	bridge_spanremove(bif);
618 	NET_LOCK();
619 }
620 
621 void
622 bridge_bifgetstp(struct bridge_softc *sc, struct bridge_iflist *bif,
623     struct ifbreq *breq)
624 {
625 	struct bstp_state *bs = sc->sc_stp;
626 	struct bstp_port *bp = bif->bif_stp;
627 
628 	breq->ifbr_state = bstp_getstate(bs, bp);
629 	breq->ifbr_priority = bp->bp_priority;
630 	breq->ifbr_path_cost = bp->bp_path_cost;
631 	breq->ifbr_proto = bp->bp_protover;
632 	breq->ifbr_role = bp->bp_role;
633 	breq->ifbr_stpflags = bp->bp_flags;
634 	breq->ifbr_fwd_trans = bp->bp_forward_transitions;
635 	breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id;
636 	breq->ifbr_root_cost = bs->bs_root_pv.pv_cost;
637 	breq->ifbr_root_port = bs->bs_root_pv.pv_port_id;
638 	breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
639 	breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id;
640 
641 	/* Copy STP state options as flags */
642 	if (bp->bp_operedge)
643 		breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
644 	if (bp->bp_flags & BSTP_PORT_AUTOEDGE)
645 		breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
646 	if (bp->bp_ptp_link)
647 		breq->ifbr_ifsflags |= IFBIF_BSTP_PTP;
648 	if (bp->bp_flags & BSTP_PORT_AUTOPTP)
649 		breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
650 }
651 
652 int
653 bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc)
654 {
655 	struct bridge_iflist *bif;
656 	u_int32_t total = 0, i = 0;
657 	int error = 0;
658 	struct ifbreq *breq, *breqs = NULL;
659 
660 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)
661 		total++;
662 
663 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)
664 		total++;
665 
666 	if (bifc->ifbic_len == 0) {
667 		i = total;
668 		goto done;
669 	}
670 
671 	breqs = mallocarray(total, sizeof(*breqs), M_TEMP, M_NOWAIT|M_ZERO);
672 	if (breqs == NULL)
673 		goto done;
674 
675 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
676 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
677 			break;
678 		breq = &breqs[i];
679 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
680 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
681 		breq->ifbr_ifsflags = bif->bif_flags;
682 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
683 		breq->ifbr_protected = bif->bif_protected;
684 		if (bif->bif_flags & IFBIF_STP)
685 			bridge_bifgetstp(sc, bif, breq);
686 		i++;
687 	}
688 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next) {
689 		if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
690 			break;
691 		breq = &breqs[i];
692 		strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ);
693 		strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ);
694 		breq->ifbr_ifsflags = bif->bif_flags | IFBIF_SPAN;
695 		breq->ifbr_portno = bif->ifp->if_index & 0xfff;
696 		i++;
697 	}
698 
699 	error = copyout(breqs, bifc->ifbic_req, i * sizeof(*breqs));
700 done:
701 	free(breqs, M_TEMP, total * sizeof(*breq));
702 	bifc->ifbic_len = i * sizeof(*breq);
703 	return (error);
704 }
705 
706 struct bridge_iflist *
707 bridge_getbif(struct ifnet *ifp)
708 {
709 	struct bridge_iflist *bif;
710 	struct bridge_softc *sc;
711 	struct ifnet *bifp;
712 
713 	KERNEL_ASSERT_LOCKED();
714 
715 	bifp = if_get(ifp->if_bridgeidx);
716 	if (bifp == NULL)
717 		return (NULL);
718 
719 	sc = bifp->if_softc;
720 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
721 		if (bif->ifp == ifp)
722 			break;
723 	}
724 
725 	if_put(bifp);
726 
727 	return (bif);
728 }
729 
730 void
731 bridge_init(struct bridge_softc *sc)
732 {
733 	struct ifnet *ifp = &sc->sc_if;
734 
735 	if (ISSET(ifp->if_flags, IFF_RUNNING))
736 		return;
737 
738 	bstp_enable(sc->sc_stp, ifp->if_index);
739 
740 	if (sc->sc_brttimeout != 0)
741 		timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
742 
743 	SET(ifp->if_flags, IFF_RUNNING);
744 }
745 
746 /*
747  * Stop the bridge and deallocate the routing table.
748  */
749 void
750 bridge_stop(struct bridge_softc *sc)
751 {
752 	struct ifnet *ifp = &sc->sc_if;
753 
754 	if (!ISSET(ifp->if_flags, IFF_RUNNING))
755 		return;
756 
757 	CLR(ifp->if_flags, IFF_RUNNING);
758 
759 	bstp_disable(sc->sc_stp);
760 
761 	timeout_del_barrier(&sc->sc_brtimeout);
762 
763 	bridge_rtflush(sc, IFBF_FLUSHDYN);
764 }
765 
766 /*
767  * Send output from the bridge.  The mbuf has the ethernet header
768  * already attached.  We must enqueue or free the mbuf before exiting.
769  */
770 int
771 bridge_enqueue(struct ifnet *ifp, struct mbuf *m)
772 {
773 	struct ifnet *brifp;
774 	struct ether_header *eh;
775 	struct ifnet *dst_if = NULL;
776 	unsigned int dst_ifidx = 0;
777 #if NBPFILTER > 0
778 	caddr_t if_bpf;
779 #endif
780 	int error = 0;
781 
782 	if (m->m_len < sizeof(*eh)) {
783 		m = m_pullup(m, sizeof(*eh));
784 		if (m == NULL)
785 			return (ENOBUFS);
786 	}
787 
788 	/* ifp must be a member interface of the bridge. */
789 	brifp = if_get(ifp->if_bridgeidx);
790 	if (brifp == NULL) {
791 		m_freem(m);
792 		return (EINVAL);
793 	}
794 
795 	/*
796 	 * If bridge is down, but original output interface is up,
797 	 * go ahead and send out that interface.  Otherwise the packet
798 	 * is dropped below.
799 	 */
800 	if (!ISSET(brifp->if_flags, IFF_RUNNING)) {
801 		/* Loop prevention. */
802 		m->m_flags |= M_PROTO1;
803 		error = if_enqueue(ifp, m);
804 		if_put(brifp);
805 		return (error);
806 	}
807 
808 #if NBPFILTER > 0
809 	if_bpf = brifp->if_bpf;
810 	if (if_bpf)
811 		bpf_mtap(if_bpf, m, BPF_DIRECTION_OUT);
812 #endif
813 	ifp->if_opackets++;
814 	ifp->if_obytes += m->m_pkthdr.len;
815 
816 	bridge_span(brifp, m);
817 
818 	eh = mtod(m, struct ether_header *);
819 	if (!ETHER_IS_MULTICAST(eh->ether_dhost)) {
820 		struct ether_addr *dst;
821 
822 		dst = (struct ether_addr *)&eh->ether_dhost[0];
823 		dst_ifidx = bridge_rtlookup(brifp, dst, m);
824 	}
825 
826 	/*
827 	 * If the packet is a broadcast or we don't know a better way to
828 	 * get there, send to all interfaces.
829 	 */
830 	if (dst_ifidx == 0) {
831 		struct bridge_softc *sc = brifp->if_softc;
832 		struct bridge_iflist *bif;
833 		struct mbuf *mc;
834 
835 		smr_read_enter();
836 		SMR_SLIST_FOREACH(bif, &sc->sc_iflist, bif_next) {
837 			dst_if = bif->ifp;
838 			if ((dst_if->if_flags & IFF_RUNNING) == 0)
839 				continue;
840 
841 			/*
842 			 * If this is not the original output interface,
843 			 * and the interface is participating in spanning
844 			 * tree, make sure the port is in a state that
845 			 * allows forwarding.
846 			 */
847 			if (dst_if != ifp &&
848 			    (bif->bif_flags & IFBIF_STP) &&
849 			    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
850 				continue;
851 			if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
852 			    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
853 				continue;
854 
855 			if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
856 			    BRL_ACTION_BLOCK)
857 				continue;
858 
859 			mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
860 			if (mc == NULL) {
861 				brifp->if_oerrors++;
862 				continue;
863 			}
864 
865 			error = bridge_ifenqueue(brifp, dst_if, mc);
866 			if (error)
867 				continue;
868 		}
869 		smr_read_leave();
870 		m_freem(m);
871 		goto out;
872 	}
873 
874 	dst_if = if_get(dst_ifidx);
875 	if ((dst_if == NULL) || !ISSET(dst_if->if_flags, IFF_RUNNING)) {
876 		m_freem(m);
877 		if_put(dst_if);
878 		error = ENETDOWN;
879 		goto out;
880 	}
881 
882 	bridge_ifenqueue(brifp, dst_if, m);
883 	if_put(dst_if);
884 out:
885 	if_put(brifp);
886 	return (error);
887 }
888 
889 /*
890  * Loop through each bridge interface and process their input queues.
891  */
892 void
893 bridgeintr(void)
894 {
895 	struct mbuf_list ml;
896 	struct mbuf *m;
897 	struct ifnet *ifp;
898 
899 	niq_delist(&bridgeintrq, &ml);
900 	if (ml_empty(&ml))
901 		return;
902 
903 	KERNEL_LOCK();
904 	while ((m = ml_dequeue(&ml)) != NULL) {
905 
906 		ifp = if_get(m->m_pkthdr.ph_ifidx);
907 		if (ifp == NULL) {
908 			m_freem(m);
909 			continue;
910 		}
911 
912 		bridge_process(ifp, m);
913 
914 		if_put(ifp);
915 	}
916 	KERNEL_UNLOCK();
917 }
918 
919 /*
920  * Process a single frame.  Frame must be freed or queued before returning.
921  */
922 void
923 bridgeintr_frame(struct ifnet *brifp, struct ifnet *src_if, struct mbuf *m)
924 {
925 	struct bridge_softc *sc = brifp->if_softc;
926 	struct ifnet *dst_if = NULL;
927 	struct bridge_iflist *bif;
928 	struct ether_addr *dst, *src;
929 	struct ether_header eh;
930 	unsigned int dst_ifidx;
931 	u_int32_t protected;
932 	int len;
933 
934 
935 	sc->sc_if.if_ipackets++;
936 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
937 
938 	bif = bridge_getbif(src_if);
939 	KASSERT(bif != NULL);
940 
941 	m_copydata(m, 0, ETHER_HDR_LEN, (caddr_t)&eh);
942 	dst = (struct ether_addr *)&eh.ether_dhost[0];
943 	src = (struct ether_addr *)&eh.ether_shost[0];
944 
945 	/*
946 	 * If interface is learning, and if source address
947 	 * is not broadcast or multicast, record its address.
948 	 */
949 	if ((bif->bif_flags & IFBIF_LEARNING) &&
950 	    !ETHER_IS_MULTICAST(eh.ether_shost) &&
951 	    !ETHER_IS_ANYADDR(eh.ether_shost))
952 		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m);
953 
954 	if ((bif->bif_flags & IFBIF_STP) &&
955 	    (bif->bif_state == BSTP_IFSTATE_LEARNING)) {
956 		m_freem(m);
957 		return;
958 	}
959 
960 	/*
961 	 * At this point, the port either doesn't participate in stp or
962 	 * it's in the forwarding state
963 	 */
964 
965 	/*
966 	 * If packet is unicast, destined for someone on "this"
967 	 * side of the bridge, drop it.
968 	 */
969 	if (!ETHER_IS_MULTICAST(eh.ether_dhost)) {
970 		dst_ifidx = bridge_rtlookup(brifp, dst, NULL);
971 		if (dst_ifidx == src_if->if_index) {
972 			m_freem(m);
973 			return;
974 		}
975 	} else {
976 		if (ETHER_IS_BROADCAST(eh.ether_dhost))
977 			m->m_flags |= M_BCAST;
978 		else
979 			m->m_flags |= M_MCAST;
980 	}
981 
982 	/*
983 	 * Multicast packets get handled a little differently:
984 	 * If interface is:
985 	 *	-link0,-link1	(default) Forward all multicast
986 	 *			as broadcast.
987 	 *	-link0,link1	Drop non-IP multicast, forward
988 	 *			as broadcast IP multicast.
989 	 *	link0,-link1	Drop IP multicast, forward as
990 	 *			broadcast non-IP multicast.
991 	 *	link0,link1	Drop all multicast.
992 	 */
993 	if (m->m_flags & M_MCAST) {
994 		if ((sc->sc_if.if_flags &
995 		    (IFF_LINK0 | IFF_LINK1)) ==
996 		    (IFF_LINK0 | IFF_LINK1)) {
997 			m_freem(m);
998 			return;
999 		}
1000 		if (sc->sc_if.if_flags & IFF_LINK0 &&
1001 		    ETHERADDR_IS_IP_MCAST(dst)) {
1002 			m_freem(m);
1003 			return;
1004 		}
1005 		if (sc->sc_if.if_flags & IFF_LINK1 &&
1006 		    !ETHERADDR_IS_IP_MCAST(dst)) {
1007 			m_freem(m);
1008 			return;
1009 		}
1010 	}
1011 
1012 	if (bif->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) {
1013 		m_freem(m);
1014 		return;
1015 	}
1016 
1017 	if (bridge_filterrule(&bif->bif_brlin, &eh, m) == BRL_ACTION_BLOCK) {
1018 		m_freem(m);
1019 		return;
1020 	}
1021 	m = bridge_ip(&sc->sc_if, BRIDGE_IN, src_if, &eh, m);
1022 	if (m == NULL)
1023 		return;
1024 	/*
1025 	 * If the packet is a multicast or broadcast OR if we don't
1026 	 * know any better, forward it to all interfaces.
1027 	 */
1028 	if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_ifidx == 0) {
1029 		sc->sc_if.if_imcasts++;
1030 		bridge_broadcast(sc, src_if, &eh, m);
1031 		return;
1032 	}
1033 	protected = bif->bif_protected;
1034 
1035 	dst_if = if_get(dst_ifidx);
1036 	if (dst_if == NULL)
1037 		goto bad;
1038 
1039 	/*
1040 	 * At this point, we're dealing with a unicast frame going to a
1041 	 * different interface
1042 	 */
1043 	if (!ISSET(dst_if->if_flags, IFF_RUNNING))
1044 		goto bad;
1045 	bif = bridge_getbif(dst_if);
1046 	if ((bif == NULL) || ((bif->bif_flags & IFBIF_STP) &&
1047 	    (bif->bif_state == BSTP_IFSTATE_DISCARDING)))
1048 		goto bad;
1049 	/*
1050 	 * Do not transmit if both ports are part of the same protected
1051 	 * domain.
1052 	 */
1053 	if (protected != 0 && (protected & bif->bif_protected))
1054 		goto bad;
1055 	if (bridge_filterrule(&bif->bif_brlout, &eh, m) == BRL_ACTION_BLOCK)
1056 		goto bad;
1057 	m = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, &eh, m);
1058 	if (m == NULL)
1059 		goto bad;
1060 
1061 	len = m->m_pkthdr.len;
1062 #if NVLAN > 0
1063 	if ((m->m_flags & M_VLANTAG) &&
1064 	    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1065 		len += ETHER_VLAN_ENCAP_LEN;
1066 #endif
1067 	if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1068 		bridge_fragment(&sc->sc_if, dst_if, &eh, m);
1069 	else {
1070 		bridge_ifenqueue(&sc->sc_if, dst_if, m);
1071 	}
1072 	m = NULL;
1073 bad:
1074 	if_put(dst_if);
1075 	m_freem(m);
1076 }
1077 
1078 /*
1079  * Return 1 if `ena' belongs to `bif', 0 otherwise.
1080  */
1081 int
1082 bridge_ourether(struct ifnet *ifp, uint8_t *ena)
1083 {
1084 	struct arpcom *ac = (struct arpcom *)ifp;
1085 
1086 	if (memcmp(ac->ac_enaddr, ena, ETHER_ADDR_LEN) == 0)
1087 		return (1);
1088 
1089 #if NCARP > 0
1090 	if (carp_ourether(ifp, ena))
1091 		return (1);
1092 #endif
1093 
1094 	return (0);
1095 }
1096 
1097 /*
1098  * Receive input from an interface.  Queue the packet for bridging if its
1099  * not for us, and schedule an interrupt.
1100  */
1101 struct mbuf *
1102 bridge_input(struct ifnet *ifp, struct mbuf *m, void *null)
1103 {
1104 	KASSERT(m->m_flags & M_PKTHDR);
1105 
1106 	if (m->m_flags & M_PROTO1) {
1107 		m->m_flags &= ~M_PROTO1;
1108 		return (m);
1109 	}
1110 
1111 	niq_enqueue(&bridgeintrq, m);
1112 
1113 	return (NULL);
1114 }
1115 
1116 void
1117 bridge_process(struct ifnet *ifp, struct mbuf *m)
1118 {
1119 	struct ifnet *brifp;
1120 	struct bridge_softc *sc;
1121 	struct bridge_iflist *bif = NULL, *bif0 = NULL;
1122 	struct ether_header *eh;
1123 	struct mbuf *mc;
1124 #if NBPFILTER > 0
1125 	caddr_t if_bpf;
1126 #endif
1127 
1128 	KERNEL_ASSERT_LOCKED();
1129 
1130 	brifp = if_get(ifp->if_bridgeidx);
1131 	if ((brifp == NULL) || !ISSET(brifp->if_flags, IFF_RUNNING))
1132 		goto reenqueue;
1133 
1134 	if (m->m_pkthdr.len < sizeof(*eh))
1135 		goto bad;
1136 
1137 #if NVLAN > 0
1138 	/*
1139 	 * If the underlying interface removed the VLAN header itself,
1140 	 * add it back.
1141 	 */
1142 	if (ISSET(m->m_flags, M_VLANTAG)) {
1143 		m = vlan_inject(m, ETHERTYPE_VLAN, m->m_pkthdr.ether_vtag);
1144 		if (m == NULL)
1145 			goto bad;
1146 	}
1147 #endif
1148 
1149 #if NBPFILTER > 0
1150 	if_bpf = brifp->if_bpf;
1151 	if (if_bpf)
1152 		bpf_mtap_ether(if_bpf, m, BPF_DIRECTION_IN);
1153 #endif
1154 
1155 	eh = mtod(m, struct ether_header *);
1156 
1157 	sc = brifp->if_softc;
1158 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1159 		struct arpcom *ac = (struct arpcom *)bif->ifp;
1160 		if (memcmp(ac->ac_enaddr, eh->ether_shost, ETHER_ADDR_LEN) == 0)
1161 			goto bad;
1162 		if (bif->ifp == ifp)
1163 			bif0 = bif;
1164 	}
1165 	if (bif0 == NULL)
1166 		goto reenqueue;
1167 
1168 	bridge_span(brifp, m);
1169 
1170 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
1171 		/*
1172 		 * Reserved destination MAC addresses (01:80:C2:00:00:0x)
1173 		 * should not be forwarded to bridge members according to
1174 		 * section 7.12.6 of the 802.1D-2004 specification.  The
1175 		 * STP destination address (as stored in bstp_etheraddr)
1176 		 * is the first of these.
1177 		 */
1178 		if (memcmp(eh->ether_dhost, bstp_etheraddr,
1179 		    ETHER_ADDR_LEN - 1) == 0) {
1180 			if (eh->ether_dhost[ETHER_ADDR_LEN - 1] == 0) {
1181 				/* STP traffic */
1182 				m = bstp_input(sc->sc_stp, bif0->bif_stp, eh,
1183 				    m);
1184 				if (m == NULL)
1185 					goto bad;
1186 			} else if (eh->ether_dhost[ETHER_ADDR_LEN - 1] <= 0xf)
1187 				goto bad;
1188 		}
1189 
1190 		/*
1191 		 * No need to process frames for ifs in the discarding state
1192 		 */
1193 		if ((bif0->bif_flags & IFBIF_STP) &&
1194 		    (bif0->bif_state == BSTP_IFSTATE_DISCARDING))
1195 			goto reenqueue;
1196 
1197 		mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1198 		if (mc == NULL)
1199 			goto reenqueue;
1200 
1201 		bridge_ifinput(ifp, mc);
1202 
1203 		bridgeintr_frame(brifp, ifp, m);
1204 		if_put(brifp);
1205 		return;
1206 	}
1207 
1208 	/*
1209 	 * Unicast, make sure it's not for us.
1210 	 */
1211 	if (bridge_ourether(bif0->ifp, eh->ether_dhost)) {
1212 		bif = bif0;
1213 	} else {
1214 		SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1215 			if (bif->ifp == ifp)
1216 				continue;
1217 			if (bridge_ourether(bif->ifp, eh->ether_dhost))
1218 				break;
1219 		}
1220 	}
1221 	if (bif != NULL) {
1222 		if (bif0->bif_flags & IFBIF_LEARNING)
1223 			bridge_rtupdate(sc,
1224 			    (struct ether_addr *)&eh->ether_shost,
1225 			    ifp, 0, IFBAF_DYNAMIC, m);
1226 		if (bridge_filterrule(&bif0->bif_brlin, eh, m) ==
1227 		    BRL_ACTION_BLOCK) {
1228 			goto bad;
1229 		}
1230 
1231 		/* Count for the bridge */
1232 		brifp->if_ipackets++;
1233 		brifp->if_ibytes += m->m_pkthdr.len;
1234 
1235 		ifp = bif->ifp;
1236 		goto reenqueue;
1237 	}
1238 
1239 	bridgeintr_frame(brifp, ifp, m);
1240 	if_put(brifp);
1241 	return;
1242 
1243 reenqueue:
1244 	bridge_ifinput(ifp, m);
1245 	m = NULL;
1246 bad:
1247 	m_freem(m);
1248 	if_put(brifp);
1249 }
1250 
1251 /*
1252  * Send a frame to all interfaces that are members of the bridge
1253  * (except the one it came in on).
1254  */
1255 void
1256 bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp,
1257     struct ether_header *eh, struct mbuf *m)
1258 {
1259 	struct bridge_iflist *bif;
1260 	struct mbuf *mc;
1261 	struct ifnet *dst_if;
1262 	int len, used = 0;
1263 	u_int32_t protected;
1264 
1265 	bif = bridge_getbif(ifp);
1266 	KASSERT(bif != NULL);
1267 	protected = bif->bif_protected;
1268 
1269 	SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next) {
1270 		dst_if = bif->ifp;
1271 
1272 		if ((dst_if->if_flags & IFF_RUNNING) == 0)
1273 			continue;
1274 
1275 		if ((bif->bif_flags & IFBIF_STP) &&
1276 		    (bif->bif_state == BSTP_IFSTATE_DISCARDING))
1277 			continue;
1278 
1279 		if ((bif->bif_flags & IFBIF_DISCOVER) == 0 &&
1280 		    (m->m_flags & (M_BCAST | M_MCAST)) == 0)
1281 			continue;
1282 
1283 		/* Drop non-IP frames if the appropriate flag is set. */
1284 		if (bif->bif_flags & IFBIF_BLOCKNONIP &&
1285 		    bridge_blocknonip(eh, m))
1286 			continue;
1287 
1288 		/*
1289 		 * Do not transmit if both ports are part of the same
1290 		 * protected domain.
1291 		 */
1292 		if (protected != 0 && (protected & bif->bif_protected))
1293 			continue;
1294 
1295 		if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
1296 		    BRL_ACTION_BLOCK)
1297 			continue;
1298 
1299 		/*
1300 		 * Don't retransmit out of the same interface where
1301 		 * the packet was received from.
1302 		 */
1303 		if (dst_if->if_index == ifp->if_index)
1304 			continue;
1305 
1306 		if (bridge_localbroadcast(dst_if, eh, m))
1307 			sc->sc_if.if_oerrors++;
1308 
1309 		/* If last one, reuse the passed-in mbuf */
1310 		if (SMR_SLIST_NEXT_LOCKED(bif, bif_next) == NULL) {
1311 			mc = m;
1312 			used = 1;
1313 		} else {
1314 			mc = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1315 			if (mc == NULL) {
1316 				sc->sc_if.if_oerrors++;
1317 				continue;
1318 			}
1319 		}
1320 
1321 		mc = bridge_ip(&sc->sc_if, BRIDGE_OUT, dst_if, eh, mc);
1322 		if (mc == NULL)
1323 			continue;
1324 
1325 		len = mc->m_pkthdr.len;
1326 #if NVLAN > 0
1327 		if ((mc->m_flags & M_VLANTAG) &&
1328 		    (dst_if->if_capabilities & IFCAP_VLAN_HWTAGGING) == 0)
1329 			len += ETHER_VLAN_ENCAP_LEN;
1330 #endif
1331 		if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
1332 			bridge_fragment(&sc->sc_if, dst_if, eh, mc);
1333 		else {
1334 			bridge_ifenqueue(&sc->sc_if, dst_if, mc);
1335 		}
1336 	}
1337 
1338 	if (!used)
1339 		m_freem(m);
1340 }
1341 
1342 int
1343 bridge_localbroadcast(struct ifnet *ifp, struct ether_header *eh,
1344     struct mbuf *m)
1345 {
1346 	struct mbuf *m1;
1347 	u_int16_t etype;
1348 
1349 	/*
1350 	 * quick optimisation, don't send packets up the stack if no
1351 	 * corresponding address has been specified.
1352 	 */
1353 	etype = ntohs(eh->ether_type);
1354 	if (!(m->m_flags & M_VLANTAG) && etype == ETHERTYPE_IP) {
1355 		struct ifaddr *ifa;
1356 		TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
1357 			if (ifa->ifa_addr->sa_family == AF_INET)
1358 				break;
1359 		}
1360 		if (ifa == NULL)
1361 			return (0);
1362 	}
1363 
1364 	m1 = m_dup_pkt(m, ETHER_ALIGN, M_NOWAIT);
1365 	if (m1 == NULL)
1366 		return (1);
1367 
1368 #if NPF > 0
1369 	pf_pkt_addr_changed(m1);
1370 #endif	/* NPF */
1371 
1372 	bridge_ifinput(ifp, m1);
1373 
1374 	return (0);
1375 }
1376 
1377 void
1378 bridge_span(struct ifnet *brifp, struct mbuf *m)
1379 {
1380 	struct bridge_softc *sc = brifp->if_softc;
1381 	struct bridge_iflist *bif;
1382 	struct ifnet *ifp;
1383 	struct mbuf *mc;
1384 	int error;
1385 
1386 	smr_read_enter();
1387 	SMR_SLIST_FOREACH(bif, &sc->sc_spanlist, bif_next) {
1388 		ifp = bif->ifp;
1389 
1390 		if ((ifp->if_flags & IFF_RUNNING) == 0)
1391 			continue;
1392 
1393 		mc = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
1394 		if (mc == NULL) {
1395 			brifp->if_oerrors++;
1396 			continue;
1397 		}
1398 
1399 		error = bridge_ifenqueue(brifp, ifp, mc);
1400 		if (error)
1401 			continue;
1402 	}
1403 	smr_read_leave();
1404 }
1405 
1406 /*
1407  * Block non-ip frames:
1408  * Returns 0 if frame is ip, and 1 if it should be dropped.
1409  */
1410 int
1411 bridge_blocknonip(struct ether_header *eh, struct mbuf *m)
1412 {
1413 	struct llc llc;
1414 	u_int16_t etype;
1415 
1416 	if (m->m_pkthdr.len < ETHER_HDR_LEN)
1417 		return (1);
1418 
1419 #if NVLAN > 0
1420 	if (m->m_flags & M_VLANTAG)
1421 		return (1);
1422 #endif
1423 
1424 	etype = ntohs(eh->ether_type);
1425 	switch (etype) {
1426 	case ETHERTYPE_ARP:
1427 	case ETHERTYPE_REVARP:
1428 	case ETHERTYPE_IP:
1429 	case ETHERTYPE_IPV6:
1430 		return (0);
1431 	}
1432 
1433 	if (etype > ETHERMTU)
1434 		return (1);
1435 
1436 	if (m->m_pkthdr.len <
1437 	    (ETHER_HDR_LEN + LLC_SNAPFRAMELEN))
1438 		return (1);
1439 
1440 	m_copydata(m, ETHER_HDR_LEN, LLC_SNAPFRAMELEN,
1441 	    (caddr_t)&llc);
1442 
1443 	etype = ntohs(llc.llc_snap.ether_type);
1444 	if (llc.llc_dsap == LLC_SNAP_LSAP &&
1445 	    llc.llc_ssap == LLC_SNAP_LSAP &&
1446 	    llc.llc_control == LLC_UI &&
1447 	    llc.llc_snap.org_code[0] == 0 &&
1448 	    llc.llc_snap.org_code[1] == 0 &&
1449 	    llc.llc_snap.org_code[2] == 0 &&
1450 	    (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
1451 	    etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)) {
1452 		return (0);
1453 	}
1454 
1455 	return (1);
1456 }
1457 
1458 #ifdef IPSEC
1459 int
1460 bridge_ipsec(struct ifnet *ifp, struct ether_header *eh, int hassnap,
1461     struct llc *llc, int dir, int af, int hlen, struct mbuf *m)
1462 {
1463 	union sockaddr_union dst;
1464 	struct tdb *tdb;
1465 	u_int32_t spi;
1466 	u_int16_t cpi;
1467 	int error, off;
1468 	u_int8_t proto = 0;
1469 	struct ip *ip;
1470 #ifdef INET6
1471 	struct ip6_hdr *ip6;
1472 #endif /* INET6 */
1473 #if NPF > 0
1474 	struct ifnet *encif;
1475 #endif
1476 
1477 	if (dir == BRIDGE_IN) {
1478 		switch (af) {
1479 		case AF_INET:
1480 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1481 				goto skiplookup;
1482 
1483 			ip = mtod(m, struct ip *);
1484 			proto = ip->ip_p;
1485 			off = offsetof(struct ip, ip_p);
1486 
1487 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1488 			    proto != IPPROTO_IPCOMP)
1489 				goto skiplookup;
1490 
1491 			bzero(&dst, sizeof(union sockaddr_union));
1492 			dst.sa.sa_family = AF_INET;
1493 			dst.sin.sin_len = sizeof(struct sockaddr_in);
1494 			m_copydata(m, offsetof(struct ip, ip_dst),
1495 			    sizeof(struct in_addr),
1496 			    (caddr_t)&dst.sin.sin_addr);
1497 
1498 			break;
1499 #ifdef INET6
1500 		case AF_INET6:
1501 			if (m->m_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
1502 				goto skiplookup;
1503 
1504 			ip6 = mtod(m, struct ip6_hdr *);
1505 
1506 			/* XXX We should chase down the header chain */
1507 			proto = ip6->ip6_nxt;
1508 			off = offsetof(struct ip6_hdr, ip6_nxt);
1509 
1510 			if (proto != IPPROTO_ESP && proto != IPPROTO_AH &&
1511 			    proto != IPPROTO_IPCOMP)
1512 				goto skiplookup;
1513 
1514 			bzero(&dst, sizeof(union sockaddr_union));
1515 			dst.sa.sa_family = AF_INET6;
1516 			dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1517 			m_copydata(m, offsetof(struct ip6_hdr, ip6_nxt),
1518 			    sizeof(struct in6_addr),
1519 			    (caddr_t)&dst.sin6.sin6_addr);
1520 
1521 			break;
1522 #endif /* INET6 */
1523 		default:
1524 			return (0);
1525 		}
1526 
1527 		switch (proto) {
1528 		case IPPROTO_ESP:
1529 			m_copydata(m, hlen, sizeof(u_int32_t), (caddr_t)&spi);
1530 			break;
1531 		case IPPROTO_AH:
1532 			m_copydata(m, hlen + sizeof(u_int32_t),
1533 			    sizeof(u_int32_t), (caddr_t)&spi);
1534 			break;
1535 		case IPPROTO_IPCOMP:
1536 			m_copydata(m, hlen + sizeof(u_int16_t),
1537 			    sizeof(u_int16_t), (caddr_t)&cpi);
1538 			spi = ntohl(htons(cpi));
1539 			break;
1540 		}
1541 
1542 		NET_ASSERT_LOCKED();
1543 
1544 		tdb = gettdb(ifp->if_rdomain, spi, &dst, proto);
1545 		if (tdb != NULL && (tdb->tdb_flags & TDBF_INVALID) == 0 &&
1546 		    tdb->tdb_xform != NULL) {
1547 			if (tdb->tdb_first_use == 0) {
1548 				tdb->tdb_first_use = gettime();
1549 				if (tdb->tdb_flags & TDBF_FIRSTUSE)
1550 					timeout_add_sec(&tdb->tdb_first_tmo,
1551 					    tdb->tdb_exp_first_use);
1552 				if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE)
1553 					timeout_add_sec(&tdb->tdb_sfirst_tmo,
1554 					    tdb->tdb_soft_first_use);
1555 			}
1556 
1557 			(*(tdb->tdb_xform->xf_input))(m, tdb, hlen, off);
1558 			return (1);
1559 		} else {
1560  skiplookup:
1561 			/* XXX do an input policy lookup */
1562 			return (0);
1563 		}
1564 	} else { /* Outgoing from the bridge. */
1565 		tdb = ipsp_spd_lookup(m, af, hlen, &error,
1566 		    IPSP_DIRECTION_OUT, NULL, NULL, 0);
1567 		if (tdb != NULL) {
1568 			/*
1569 			 * We don't need to do loop detection, the
1570 			 * bridge will do that for us.
1571 			 */
1572 #if NPF > 0
1573 			if ((encif = enc_getif(tdb->tdb_rdomain,
1574 			    tdb->tdb_tap)) == NULL ||
1575 			    pf_test(af, dir, encif, &m) != PF_PASS) {
1576 				m_freem(m);
1577 				return (1);
1578 			}
1579 			if (m == NULL)
1580 				return (1);
1581 			else if (af == AF_INET)
1582 				in_proto_cksum_out(m, encif);
1583 #ifdef INET6
1584 			else if (af == AF_INET6)
1585 				in6_proto_cksum_out(m, encif);
1586 #endif /* INET6 */
1587 #endif /* NPF */
1588 
1589 			ip = mtod(m, struct ip *);
1590 			if ((af == AF_INET) &&
1591 			    ip_mtudisc && (ip->ip_off & htons(IP_DF)) &&
1592 			    tdb->tdb_mtu && ntohs(ip->ip_len) > tdb->tdb_mtu &&
1593 			    tdb->tdb_mtutimeout > gettime())
1594 				bridge_send_icmp_err(ifp, eh, m,
1595 				    hassnap, llc, tdb->tdb_mtu,
1596 				    ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1597 			else
1598 				error = ipsp_process_packet(m, tdb, af, 0);
1599 			return (1);
1600 		} else
1601 			return (0);
1602 	}
1603 
1604 	return (0);
1605 }
1606 #endif /* IPSEC */
1607 
1608 /*
1609  * Filter IP packets by peeking into the ethernet frame.  This violates
1610  * the ISO model, but allows us to act as a IP filter at the data link
1611  * layer.  As a result, most of this code will look familiar to those
1612  * who've read net/if_ethersubr.c and netinet/ip_input.c
1613  */
1614 struct mbuf *
1615 bridge_ip(struct ifnet *brifp, int dir, struct ifnet *ifp,
1616     struct ether_header *eh, struct mbuf *m)
1617 {
1618 	struct llc llc;
1619 	int hassnap = 0;
1620 	struct ip *ip;
1621 	int hlen;
1622 	u_int16_t etype;
1623 
1624 #if NVLAN > 0
1625 	if (m->m_flags & M_VLANTAG)
1626 		return (m);
1627 #endif
1628 
1629 	etype = ntohs(eh->ether_type);
1630 
1631 	if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6) {
1632 		if (etype > ETHERMTU ||
1633 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1634 		    ETHER_HDR_LEN))
1635 			return (m);
1636 
1637 		m_copydata(m, ETHER_HDR_LEN,
1638 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1639 
1640 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1641 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1642 		    llc.llc_control != LLC_UI ||
1643 		    llc.llc_snap.org_code[0] ||
1644 		    llc.llc_snap.org_code[1] ||
1645 		    llc.llc_snap.org_code[2])
1646 			return (m);
1647 
1648 		etype = ntohs(llc.llc_snap.ether_type);
1649 		if (etype != ETHERTYPE_IP && etype != ETHERTYPE_IPV6)
1650 			return (m);
1651 		hassnap = 1;
1652 	}
1653 
1654 	m_adj(m, ETHER_HDR_LEN);
1655 	if (hassnap)
1656 		m_adj(m, LLC_SNAPFRAMELEN);
1657 
1658 	switch (etype) {
1659 
1660 	case ETHERTYPE_IP:
1661 		if (m->m_pkthdr.len < sizeof(struct ip))
1662 			goto dropit;
1663 
1664 		/* Copy minimal header, and drop invalids */
1665 		if (m->m_len < sizeof(struct ip) &&
1666 		    (m = m_pullup(m, sizeof(struct ip))) == NULL) {
1667 			ipstat_inc(ips_toosmall);
1668 			return (NULL);
1669 		}
1670 		ip = mtod(m, struct ip *);
1671 
1672 		if (ip->ip_v != IPVERSION) {
1673 			ipstat_inc(ips_badvers);
1674 			goto dropit;
1675 		}
1676 
1677 		hlen = ip->ip_hl << 2;	/* get whole header length */
1678 		if (hlen < sizeof(struct ip)) {
1679 			ipstat_inc(ips_badhlen);
1680 			goto dropit;
1681 		}
1682 
1683 		if (hlen > m->m_len) {
1684 			if ((m = m_pullup(m, hlen)) == NULL) {
1685 				ipstat_inc(ips_badhlen);
1686 				return (NULL);
1687 			}
1688 			ip = mtod(m, struct ip *);
1689 		}
1690 
1691 		if ((m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_OK) == 0) {
1692 			if (m->m_pkthdr.csum_flags & M_IPV4_CSUM_IN_BAD) {
1693 				ipstat_inc(ips_badsum);
1694 				goto dropit;
1695 			}
1696 
1697 			ipstat_inc(ips_inswcsum);
1698 			if (in_cksum(m, hlen) != 0) {
1699 				ipstat_inc(ips_badsum);
1700 				goto dropit;
1701 			}
1702 		}
1703 
1704 		if (ntohs(ip->ip_len) < hlen)
1705 			goto dropit;
1706 
1707 		if (m->m_pkthdr.len < ntohs(ip->ip_len))
1708 			goto dropit;
1709 		if (m->m_pkthdr.len > ntohs(ip->ip_len)) {
1710 			if (m->m_len == m->m_pkthdr.len) {
1711 				m->m_len = ntohs(ip->ip_len);
1712 				m->m_pkthdr.len = ntohs(ip->ip_len);
1713 			} else
1714 				m_adj(m, ntohs(ip->ip_len) - m->m_pkthdr.len);
1715 		}
1716 
1717 #ifdef IPSEC
1718 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1719 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET, hlen, m))
1720 			return (NULL);
1721 #endif /* IPSEC */
1722 #if NPF > 0
1723 		/* Finally, we get to filter the packet! */
1724 		if (pf_test(AF_INET, dir, ifp, &m) != PF_PASS)
1725 			goto dropit;
1726 		if (m == NULL)
1727 			goto dropit;
1728 #endif /* NPF > 0 */
1729 
1730 		/* Rebuild the IP header */
1731 		if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
1732 			return (NULL);
1733 		if (m->m_len < sizeof(struct ip))
1734 			goto dropit;
1735 		in_proto_cksum_out(m, ifp);
1736 		ip = mtod(m, struct ip *);
1737 		ip->ip_sum = 0;
1738 		if (0 && (ifp->if_capabilities & IFCAP_CSUM_IPv4))
1739 			m->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
1740 		else {
1741 			ipstat_inc(ips_outswcsum);
1742 			ip->ip_sum = in_cksum(m, hlen);
1743 		}
1744 
1745 #if NPF > 0
1746 		if (dir == BRIDGE_IN &&
1747 		    m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1748 			m_resethdr(m);
1749 			m->m_pkthdr.ph_ifidx = ifp->if_index;
1750 			m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
1751 			ipv4_input(ifp, m);
1752 			return (NULL);
1753 		}
1754 #endif /* NPF > 0 */
1755 
1756 		break;
1757 
1758 #ifdef INET6
1759 	case ETHERTYPE_IPV6: {
1760 		struct ip6_hdr *ip6;
1761 
1762 		if (m->m_len < sizeof(struct ip6_hdr)) {
1763 			if ((m = m_pullup(m, sizeof(struct ip6_hdr)))
1764 			    == NULL) {
1765 				ip6stat_inc(ip6s_toosmall);
1766 				return (NULL);
1767 			}
1768 		}
1769 
1770 		ip6 = mtod(m, struct ip6_hdr *);
1771 
1772 		if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
1773 			ip6stat_inc(ip6s_badvers);
1774 			goto dropit;
1775 		}
1776 
1777 #ifdef IPSEC
1778 		hlen = sizeof(struct ip6_hdr);
1779 
1780 		if ((brifp->if_flags & IFF_LINK2) == IFF_LINK2 &&
1781 		    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET6, hlen,
1782 		    m))
1783 			return (NULL);
1784 #endif /* IPSEC */
1785 
1786 #if NPF > 0
1787 		if (pf_test(AF_INET6, dir, ifp, &m) != PF_PASS)
1788 			goto dropit;
1789 		if (m == NULL)
1790 			return (NULL);
1791 #endif /* NPF > 0 */
1792 		in6_proto_cksum_out(m, ifp);
1793 
1794 #if NPF > 0
1795 		if (dir == BRIDGE_IN &&
1796 		    m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1797 			m_resethdr(m);
1798 			m->m_pkthdr.ph_ifidx = ifp->if_index;
1799 			m->m_pkthdr.ph_rtableid = ifp->if_rdomain;
1800 			ipv6_input(ifp, m);
1801 			return (NULL);
1802 		}
1803 #endif /* NPF > 0 */
1804 
1805 		break;
1806 	}
1807 #endif /* INET6 */
1808 
1809 	default:
1810 		goto dropit;
1811 		break;
1812 	}
1813 
1814 	/* Reattach SNAP header */
1815 	if (hassnap) {
1816 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1817 		if (m == NULL)
1818 			goto dropit;
1819 		bcopy(&llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
1820 	}
1821 
1822 	/* Reattach ethernet header */
1823 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1824 	if (m == NULL)
1825 		goto dropit;
1826 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1827 
1828 	return (m);
1829 
1830 dropit:
1831 	m_freem(m);
1832 	return (NULL);
1833 }
1834 
1835 void
1836 bridge_fragment(struct ifnet *brifp, struct ifnet *ifp, struct ether_header *eh,
1837     struct mbuf *m)
1838 {
1839 	struct llc llc;
1840 	struct mbuf *m0;
1841 	int error = 0;
1842 	int hassnap = 0;
1843 	u_int16_t etype;
1844 	struct ip *ip;
1845 
1846 	etype = ntohs(eh->ether_type);
1847 #if NVLAN > 0
1848 	if ((m->m_flags & M_VLANTAG) || etype == ETHERTYPE_VLAN ||
1849 	    etype == ETHERTYPE_QINQ) {
1850 		int len = m->m_pkthdr.len;
1851 
1852 		if (m->m_flags & M_VLANTAG)
1853 			len += ETHER_VLAN_ENCAP_LEN;
1854 		if ((ifp->if_capabilities & IFCAP_VLAN_MTU) &&
1855 		    (len - sizeof(struct ether_vlan_header) <= ifp->if_mtu)) {
1856 			bridge_ifenqueue(brifp, ifp, m);
1857 			return;
1858 		}
1859 		goto dropit;
1860 	}
1861 #endif
1862 	if (etype != ETHERTYPE_IP) {
1863 		if (etype > ETHERMTU ||
1864 		    m->m_pkthdr.len < (LLC_SNAPFRAMELEN +
1865 		    ETHER_HDR_LEN))
1866 			goto dropit;
1867 
1868 		m_copydata(m, ETHER_HDR_LEN,
1869 		    LLC_SNAPFRAMELEN, (caddr_t)&llc);
1870 
1871 		if (llc.llc_dsap != LLC_SNAP_LSAP ||
1872 		    llc.llc_ssap != LLC_SNAP_LSAP ||
1873 		    llc.llc_control != LLC_UI ||
1874 		    llc.llc_snap.org_code[0] ||
1875 		    llc.llc_snap.org_code[1] ||
1876 		    llc.llc_snap.org_code[2] ||
1877 		    llc.llc_snap.ether_type != htons(ETHERTYPE_IP))
1878 			goto dropit;
1879 
1880 		hassnap = 1;
1881 	}
1882 
1883 	m_adj(m, ETHER_HDR_LEN);
1884 	if (hassnap)
1885 		m_adj(m, LLC_SNAPFRAMELEN);
1886 
1887 	if (m->m_len < sizeof(struct ip) &&
1888 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
1889 		goto dropit;
1890 	ip = mtod(m, struct ip *);
1891 
1892 	/* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */
1893 	if (ip->ip_off & htons(IP_DF)) {
1894 		bridge_send_icmp_err(ifp, eh, m, hassnap, &llc,
1895 		    ifp->if_mtu, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG);
1896 		return;
1897 	}
1898 
1899 	error = ip_fragment(m, ifp, ifp->if_mtu);
1900 	if (error) {
1901 		m = NULL;
1902 		goto dropit;
1903 	}
1904 
1905 	for (; m; m = m0) {
1906 		m0 = m->m_nextpkt;
1907 		m->m_nextpkt = NULL;
1908 		if (error == 0) {
1909 			if (hassnap) {
1910 				M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
1911 				if (m == NULL) {
1912 					error = ENOBUFS;
1913 					continue;
1914 				}
1915 				bcopy(&llc, mtod(m, caddr_t),
1916 				    LLC_SNAPFRAMELEN);
1917 			}
1918 			M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
1919 			if (m == NULL) {
1920 				error = ENOBUFS;
1921 				continue;
1922 			}
1923 			bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
1924 			error = bridge_ifenqueue(brifp, ifp, m);
1925 			if (error) {
1926 				continue;
1927 			}
1928 		} else
1929 			m_freem(m);
1930 	}
1931 
1932 	if (error == 0)
1933 		ipstat_inc(ips_fragmented);
1934 
1935 	return;
1936  dropit:
1937 	m_freem(m);
1938 }
1939 
1940 int
1941 bridge_ifenqueue(struct ifnet *brifp, struct ifnet *ifp, struct mbuf *m)
1942 {
1943 	int error, len;
1944 
1945 	/* Loop prevention. */
1946 	m->m_flags |= M_PROTO1;
1947 
1948 	len = m->m_pkthdr.len;
1949 
1950 	error = if_enqueue(ifp, m);
1951 	if (error) {
1952 		brifp->if_oerrors++;
1953 		return (error);
1954 	}
1955 
1956 	brifp->if_opackets++;
1957 	brifp->if_obytes += len;
1958 
1959 	return (0);
1960 }
1961 
1962 void
1963 bridge_ifinput(struct ifnet *ifp, struct mbuf *m)
1964 {
1965 	struct mbuf_list ml = MBUF_LIST_INITIALIZER();
1966 
1967 	m->m_flags |= M_PROTO1;
1968 
1969 	ml_enqueue(&ml, m);
1970 	if_input(ifp, &ml);
1971 }
1972 
1973 void
1974 bridge_send_icmp_err(struct ifnet *ifp,
1975     struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc,
1976     int mtu, int type, int code)
1977 {
1978 	struct ip *ip;
1979 	struct icmp *icp;
1980 	struct in_addr t;
1981 	struct mbuf *m, *n2;
1982 	int hlen;
1983 	u_int8_t ether_tmp[ETHER_ADDR_LEN];
1984 
1985 	n2 = m_copym(n, 0, M_COPYALL, M_DONTWAIT);
1986 	if (!n2) {
1987 		m_freem(n);
1988 		return;
1989 	}
1990 	m = icmp_do_error(n, type, code, 0, mtu);
1991 	if (m == NULL) {
1992 		m_freem(n2);
1993 		return;
1994 	}
1995 
1996 	n = n2;
1997 
1998 	ip = mtod(m, struct ip *);
1999 	hlen = ip->ip_hl << 2;
2000 	t = ip->ip_dst;
2001 	ip->ip_dst = ip->ip_src;
2002 	ip->ip_src = t;
2003 
2004 	m->m_data += hlen;
2005 	m->m_len -= hlen;
2006 	icp = mtod(m, struct icmp *);
2007 	icp->icmp_cksum = 0;
2008 	icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len) - hlen);
2009 	m->m_data -= hlen;
2010 	m->m_len += hlen;
2011 
2012 	ip->ip_v = IPVERSION;
2013 	ip->ip_off &= htons(IP_DF);
2014 	ip->ip_id = htons(ip_randomid());
2015 	ip->ip_ttl = MAXTTL;
2016 	ip->ip_sum = 0;
2017 	ip->ip_sum = in_cksum(m, hlen);
2018 
2019 	/* Swap ethernet addresses */
2020 	bcopy(&eh->ether_dhost, &ether_tmp, sizeof(ether_tmp));
2021 	bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp));
2022 	bcopy(&ether_tmp, &eh->ether_shost, sizeof(ether_tmp));
2023 
2024 	/* Reattach SNAP header */
2025 	if (hassnap) {
2026 		M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT);
2027 		if (m == NULL)
2028 			goto dropit;
2029 		bcopy(llc, mtod(m, caddr_t), LLC_SNAPFRAMELEN);
2030 	}
2031 
2032 	/* Reattach ethernet header */
2033 	M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
2034 	if (m == NULL)
2035 		goto dropit;
2036 	bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
2037 
2038 	bridge_enqueue(ifp, m);
2039 	m_freem(n);
2040 	return;
2041 
2042  dropit:
2043 	m_freem(n);
2044 }
2045