xref: /xnu-11215.81.4/bsd/net/if_bridge.c (revision d4514f0bc1d3f944c22d92e68b646ac3fb40d452)
1 /*
2  * Copyright (c) 2004-2024 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 
29 /*	$NetBSD: if_bridge.c,v 1.31 2005/06/01 19:45:34 jdc Exp $	*/
30 /*
31  * Copyright 2001 Wasabi Systems, Inc.
32  * All rights reserved.
33  *
34  * Written by Jason R. Thorpe for Wasabi Systems, Inc.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgement:
46  *	This product includes software developed for the NetBSD Project by
47  *	Wasabi Systems, Inc.
48  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
49  *    or promote products derived from this software without specific prior
50  *    written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
54  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
55  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
56  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
57  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
58  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
59  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
60  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
61  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
62  * POSSIBILITY OF SUCH DAMAGE.
63  */
64 
65 /*
66  * Copyright (c) 1999, 2000 Jason L. Wright ([email protected])
67  * All rights reserved.
68  *
69  * Redistribution and use in source and binary forms, with or without
70  * modification, are permitted provided that the following conditions
71  * are met:
72  * 1. Redistributions of source code must retain the above copyright
73  *    notice, this list of conditions and the following disclaimer.
74  * 2. Redistributions in binary form must reproduce the above copyright
75  *    notice, this list of conditions and the following disclaimer in the
76  *    documentation and/or other materials provided with the distribution.
77  *
78  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
79  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
80  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
81  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
82  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
83  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
84  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
86  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
87  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
88  * POSSIBILITY OF SUCH DAMAGE.
89  *
90  * OpenBSD: if_bridge.c,v 1.60 2001/06/15 03:38:33 itojun Exp
91  */
92 
93 /*
94  * Network interface bridge support.
95  *
96  * TODO:
97  *
98  *	- Currently only supports Ethernet-like interfaces (Ethernet,
99  *	  802.11, VLANs on Ethernet, etc.)  Figure out a nice way
100  *	  to bridge other types of interfaces (FDDI-FDDI, and maybe
101  *	  consider heterogenous bridges).
102  *
103  *	- GIF isn't handled due to the lack of IPPROTO_ETHERIP support.
104  */
105 
106 #include <sys/cdefs.h>
107 
108 #include <sys/param.h>
109 #include <sys/mbuf.h>
110 #include <sys/malloc.h>
111 #include <sys/protosw.h>
112 #include <sys/systm.h>
113 #include <sys/time.h>
114 #include <sys/socket.h> /* for net/if.h */
115 #include <sys/sockio.h>
116 #include <sys/kernel.h>
117 #include <sys/random.h>
118 #include <sys/syslog.h>
119 #include <sys/sysctl.h>
120 #include <sys/proc.h>
121 #include <sys/lock.h>
122 #include <sys/mcache.h>
123 
124 #include <sys/kauth.h>
125 
126 #include <kern/thread_call.h>
127 
128 #include <libkern/libkern.h>
129 
130 #include <kern/zalloc.h>
131 
132 #if NBPFILTER > 0
133 #include <net/bpf.h>
134 #endif
135 #include <net/if.h>
136 #include <net/if_dl.h>
137 #include <net/if_types.h>
138 #include <net/if_var.h>
139 #include <net/if_media.h>
140 #include <net/net_api_stats.h>
141 
142 #include <netinet/in.h> /* for struct arpcom */
143 #include <netinet/tcp.h> /* for struct tcphdr */
144 #include <netinet/in_systm.h>
145 #include <netinet/in_var.h>
146 #define _IP_VHL
147 #include <netinet/ip.h>
148 #include <netinet/ip_var.h>
149 #include <netinet/ip6.h>
150 #include <netinet6/ip6_var.h>
151 #include <netinet/if_ether.h> /* for struct arpcom */
152 #include <net/bridgestp.h>
153 #include <net/if_bridgevar.h>
154 #include <net/if_llc.h>
155 #if NVLAN > 0
156 #include <net/if_vlan_var.h>
157 #endif /* NVLAN > 0 */
158 
159 #include <net/if_ether.h>
160 #include <net/dlil.h>
161 #include <net/kpi_interfacefilter.h>
162 #include <net/pfvar.h>
163 
164 #include <net/route.h>
165 #include <dev/random/randomdev.h>
166 
167 #include <netinet/bootp.h>
168 #include <netinet/dhcp.h>
169 
170 #if SKYWALK
171 #include <skywalk/nexus/netif/nx_netif.h>
172 #endif /* SKYWALK */
173 
174 #include <net/sockaddr_utils.h>
175 #include <net/mblist.h>
176 
177 #include <os/log.h>
178 
179 static struct in_addr inaddr_any = { .s_addr = INADDR_ANY };
180 
181 
182 #define __M_FLAGS_ARE_SET(m, flags)     (((m)->m_flags & (flags)) != 0)
183 #define IS_BCAST(m)                     __M_FLAGS_ARE_SET(m, M_BCAST)
184 #define IS_MCAST(m)                     __M_FLAGS_ARE_SET(m, M_MCAST)
185 #define IS_BCAST_MCAST(m)               __M_FLAGS_ARE_SET(m, M_BCAST | M_MCAST)
186 
187 #define HTONS_ETHERTYPE_ARP             htons(ETHERTYPE_ARP)
188 #define HTONS_ETHERTYPE_IP              htons(ETHERTYPE_IP)
189 #define HTONS_ETHERTYPE_IPV6            htons(ETHERTYPE_IPV6)
190 #define HTONS_ARPHRD_ETHER              htons(ARPHRD_ETHER)
191 #define HTONS_ARPOP_REQUEST             htons(ARPOP_REQUEST)
192 #define HTONS_ARPOP_REPLY               htons(ARPOP_REPLY)
193 #define HTONS_IPPORT_BOOTPC             htons(IPPORT_BOOTPC)
194 #define HTONS_IPPORT_BOOTPS             htons(IPPORT_BOOTPS)
195 #define HTONS_DHCP_FLAGS_BROADCAST      htons(DHCP_FLAGS_BROADCAST)
196 
197 /*
198  * if_bridge_debug, BR_DBGF_*
199  * - 'if_bridge_debug' is a bitmask of BR_DBGF_* flags that can be set
200  *   to enable additional logs for the corresponding bridge function
201  * - "sysctl net.link.bridge.debug" controls the value of
202  *   'if_bridge_debug'
203  */
204 static uint32_t if_bridge_debug = 0;
205 #define BR_DBGF_LIFECYCLE       0x0001
206 #define BR_DBGF_INPUT           0x0002
207 #define BR_DBGF_OUTPUT          0x0004
208 #define BR_DBGF_RT_TABLE        0x0008
209 #define BR_DBGF_DELAYED_CALL    0x0010
210 #define BR_DBGF_IOCTL           0x0020
211 #define BR_DBGF_MBUF            0x0040
212 #define BR_DBGF_MCAST           0x0080
213 #define BR_DBGF_HOSTFILTER      0x0100
214 #define BR_DBGF_CHECKSUM        0x0200
215 #define BR_DBGF_MAC_NAT         0x0400
216 #define BR_DBGF_INPUT_LIST      0x0800
217 
218 /*
219  * if_bridge_log_level
220  * - 'if_bridge_log_level' ensures that by default important logs are
221  *   logged regardless of if_bridge_debug by comparing the log level
222  *   in BRIDGE_LOG to if_bridge_log_level
223  * - use "sysctl net.link.bridge.log_level" controls the value of
224  *   'if_bridge_log_level'
225  * - the default value of 'if_bridge_log_level' is LOG_NOTICE; important
226  *   logs must use LOG_NOTICE to ensure they appear by default
227  */
228 static int if_bridge_log_level = LOG_NOTICE;
229 
230 #define BRIDGE_DBGF_ENABLED(__flag)     ((if_bridge_debug & __flag) != 0)
231 
232 /*
233  * BRIDGE_LOG, BRIDGE_LOG_SIMPLE
234  * - macros to generate the specified log conditionally based on
235  *   the specified log level and debug flags
236  * - BRIDGE_LOG_SIMPLE does not include the function name in the log
237  */
238 #define BRIDGE_LOG(__level, __dbgf, __string, ...)              \
239 	do {                                                            \
240 	        if (__level <= if_bridge_log_level ||                   \
241 	            BRIDGE_DBGF_ENABLED(__dbgf)) {                      \
242 	                os_log(OS_LOG_DEFAULT, "%s: " __string, \
243 	                       __func__, ## __VA_ARGS__);       \
244 	        }                                                       \
245 	} while (0)
246 #define BRIDGE_LOG_SIMPLE(__level, __dbgf, __string, ...)               \
247 	do {                                                    \
248 	        if (__level <= if_bridge_log_level ||           \
249 	            BRIDGE_DBGF_ENABLED(__dbgf)) {                      \
250 	                os_log(OS_LOG_DEFAULT, __string, ## __VA_ARGS__); \
251 	        }                                                               \
252 	} while (0)
253 
254 #define _BRIDGE_LOCK(_sc)               lck_mtx_lock(&(_sc)->sc_mtx)
255 #define _BRIDGE_UNLOCK(_sc)             lck_mtx_unlock(&(_sc)->sc_mtx)
256 #define BRIDGE_LOCK_ASSERT_HELD(_sc)            \
257 	LCK_MTX_ASSERT(&(_sc)->sc_mtx, LCK_MTX_ASSERT_OWNED)
258 #define BRIDGE_LOCK_ASSERT_NOTHELD(_sc)         \
259 	LCK_MTX_ASSERT(&(_sc)->sc_mtx, LCK_MTX_ASSERT_NOTOWNED)
260 
261 #define BRIDGE_LOCK_DEBUG      1
262 #if BRIDGE_LOCK_DEBUG
263 
264 #define BR_LCKDBG_MAX                   4
265 
266 #define BRIDGE_LOCK(_sc)                bridge_lock(_sc)
267 #define BRIDGE_UNLOCK(_sc)              bridge_unlock(_sc)
268 #define BRIDGE_LOCK2REF(_sc, _err)      _err = bridge_lock2ref(_sc)
269 #define BRIDGE_UNREF(_sc)               bridge_unref(_sc)
270 #define BRIDGE_XLOCK(_sc)               bridge_xlock(_sc)
271 #define BRIDGE_XDROP(_sc)               bridge_xdrop(_sc)
272 
273 #else /* !BRIDGE_LOCK_DEBUG */
274 
275 #define BRIDGE_LOCK(_sc)                _BRIDGE_LOCK(_sc)
276 #define BRIDGE_UNLOCK(_sc)              _BRIDGE_UNLOCK(_sc)
277 #define BRIDGE_LOCK2REF(_sc, _err)      do {                            \
278 	BRIDGE_LOCK_ASSERT_HELD(_sc);                                   \
279 	if ((_sc)->sc_iflist_xcnt > 0)                                  \
280 	        (_err) = EBUSY;                                         \
281 	else {                                                          \
282 	        (_sc)->sc_iflist_ref++;                                 \
283 	        (_err) = 0;                                             \
284 	}                                                               \
285 	_BRIDGE_UNLOCK(_sc);                                            \
286 } while (0)
287 #define BRIDGE_UNREF(_sc)               do {                            \
288 	_BRIDGE_LOCK(_sc);                                              \
289 	(_sc)->sc_iflist_ref--;                                         \
290 	if (((_sc)->sc_iflist_xcnt > 0) && ((_sc)->sc_iflist_ref == 0))	{ \
291 	        _BRIDGE_UNLOCK(_sc);                                    \
292 	        wakeup(&(_sc)->sc_cv);                                  \
293 	} else                                                          \
294 	        _BRIDGE_UNLOCK(_sc);                                    \
295 } while (0)
296 #define BRIDGE_XLOCK(_sc)               do {                            \
297 	BRIDGE_LOCK_ASSERT_HELD(_sc);                                   \
298 	(_sc)->sc_iflist_xcnt++;                                        \
299 	while ((_sc)->sc_iflist_ref > 0)                                \
300 	        msleep(&(_sc)->sc_cv, &(_sc)->sc_mtx, PZERO,            \
301 	            "BRIDGE_XLOCK", NULL);                              \
302 } while (0)
303 #define BRIDGE_XDROP(_sc)               do {                            \
304 	BRIDGE_LOCK_ASSERT_HELD(_sc);                                   \
305 	(_sc)->sc_iflist_xcnt--;                                        \
306 } while (0)
307 
308 #endif /* BRIDGE_LOCK_DEBUG */
309 
310 #define BRIDGE_BPF_TAP_IN(ifp, m) \
311 	do {                                                            \
312 	        if (ifp->if_bpf != NULL) {                              \
313 	                bpf_tap_in(ifp, DLT_EN10MB, m, NULL, 0);        \
314 	        }                                                       \
315 	} while(0)
316 
317 #define BRIDGE_BPF_TAP_OUT(ifp, m)                                      \
318 	do {                                                            \
319 	        if (ifp->if_bpf != NULL) {                              \
320 	                bpf_tap_out(ifp, DLT_EN10MB, m, NULL, 0);       \
321 	        }                                                       \
322 	} while(0)
323 
324 
325 /*
326  * Initial size of the route hash table.  Must be a power of two.
327  */
328 #ifndef BRIDGE_RTHASH_SIZE
329 #define BRIDGE_RTHASH_SIZE              16
330 #endif
331 
332 /*
333  * Maximum size of the routing hash table
334  */
335 #define BRIDGE_RTHASH_SIZE_MAX          2048
336 
337 #define BRIDGE_RTHASH_MASK(sc)          ((sc)->sc_rthash_size - 1)
338 
339 /*
340  * Maximum number of addresses to cache.
341  */
342 #ifndef BRIDGE_RTABLE_MAX
343 #define BRIDGE_RTABLE_MAX               100
344 #endif
345 
346 /*
347  * Timeout (in seconds) for entries learned dynamically.
348  */
349 #ifndef BRIDGE_RTABLE_TIMEOUT
350 #define BRIDGE_RTABLE_TIMEOUT           (20 * 60)       /* same as ARP */
351 #endif
352 
353 /*
354  * Number of seconds between walks of the route list.
355  */
356 #ifndef BRIDGE_RTABLE_PRUNE_PERIOD
357 #define BRIDGE_RTABLE_PRUNE_PERIOD      (5 * 60)
358 #endif
359 
360 /*
361  * Number of MAC NAT entries
362  * - sized based on 16 clients (including MAC NAT interface)
363  *   each with 4 addresses
364  */
365 #ifndef BRIDGE_MAC_NAT_ENTRY_MAX
366 #define BRIDGE_MAC_NAT_ENTRY_MAX        64
367 #endif /* BRIDGE_MAC_NAT_ENTRY_MAX */
368 
369 /*
370  * List of capabilities to possibly mask on the member interface.
371  */
372 #define BRIDGE_IFCAPS_MASK              (IFCAP_TSO | IFCAP_TXCSUM)
373 /*
374  * List of capabilities to disable on the member interface.
375  */
376 #define BRIDGE_IFCAPS_STRIP             IFCAP_LRO
377 
378 /*
379  * Bridge interface list entry.
380  */
381 struct bridge_iflist {
382 	TAILQ_ENTRY(bridge_iflist) bif_next;
383 	struct ifnet            *bif_ifp;       /* member if */
384 	struct bstp_port        bif_stp;        /* STP state */
385 	uint32_t                bif_ifflags;    /* member if flags */
386 	int                     bif_savedcaps;  /* saved capabilities */
387 	uint32_t                bif_addrmax;    /* max # of addresses */
388 	uint32_t                bif_addrcnt;    /* cur. # of addresses */
389 	uint32_t                bif_addrexceeded; /* # of address violations */
390 
391 	interface_filter_t      bif_iff_ref;
392 	struct bridge_softc     *bif_sc;
393 	uint32_t                bif_flags;
394 
395 	/* host filter */
396 	struct in_addr          bif_hf_ipsrc;
397 	uint8_t                 bif_hf_hwsrc[ETHER_ADDR_LEN];
398 
399 	struct ifbrmstats       bif_stats;
400 };
401 
402 static inline bool
bif_ifflags_are_set(struct bridge_iflist * bif,uint32_t flags)403 bif_ifflags_are_set(struct bridge_iflist * bif, uint32_t flags)
404 {
405 	return (bif->bif_ifflags & flags) != 0;
406 }
407 
408 static inline bool
bif_has_checksum_offload(struct bridge_iflist * bif)409 bif_has_checksum_offload(struct bridge_iflist * bif)
410 {
411 	return bif_ifflags_are_set(bif, IFBIF_CHECKSUM_OFFLOAD);
412 }
413 
414 static inline bool
bif_has_mac_nat(struct bridge_iflist * bif)415 bif_has_mac_nat(struct bridge_iflist * bif)
416 {
417 	return bif_ifflags_are_set(bif, IFBIF_MAC_NAT);
418 }
419 
420 /* fake errors to make the code clearer */
421 #define _EBADIP                 EJUSTRETURN
422 #define _EBADIPCHECKSUM         EJUSTRETURN
423 #define _EBADIPV6               EJUSTRETURN
424 #define _EBADUDP                EJUSTRETURN
425 #define _EBADTCP                EJUSTRETURN
426 #define _EBADUDPCHECKSUM        EJUSTRETURN
427 #define _EBADTCPCHECKSUM        EJUSTRETURN
428 
429 #define BIFF_PROMISC            0x01    /* promiscuous mode set */
430 #define BIFF_PROTO_ATTACHED     0x02    /* protocol attached */
431 #define BIFF_FILTER_ATTACHED    0x04    /* interface filter attached */
432 #define BIFF_MEDIA_ACTIVE       0x08    /* interface media active */
433 #define BIFF_HOST_FILTER        0x10    /* host filter enabled */
434 #define BIFF_HF_HWSRC           0x20    /* host filter source MAC is set */
435 #define BIFF_HF_IPSRC           0x40    /* host filter source IP is set */
436 #define BIFF_INPUT_BROADCAST    0x80    /* send broadcast packets in */
437 #define BIFF_IN_MEMBER_LIST     0x100   /* added to the member list */
438 #define BIFF_WIFI_INFRA         0x200   /* interface is Wi-Fi infra */
439 #define BIFF_ALL_MULTI          0x400   /* allmulti set */
440 #define BIFF_LRO_DISABLED       0x800   /* LRO was disabled */
441 #if SKYWALK
442 #define BIFF_FLOWSWITCH_ATTACHED 0x1000   /* we attached the flowswitch */
443 #define BIFF_NETAGENT_REMOVED    0x2000   /* we removed the netagent */
444 #endif /* SKYWALK */
445 
446 /*
447  * mac_nat_entry
448  * - translates between an IP address and MAC address on a specific
449  *   bridge interface member
450  */
451 struct mac_nat_entry {
452 	LIST_ENTRY(mac_nat_entry) mne_list;     /* list linkage */
453 	struct bridge_iflist    *mne_bif;       /* originating interface */
454 	unsigned long           mne_expire;     /* expiration time */
455 	union {
456 		struct in_addr  mneu_ip;        /* originating IPv4 address */
457 		struct in6_addr mneu_ip6;       /* originating IPv6 address */
458 	} mne_u;
459 	uint8_t                 mne_mac[ETHER_ADDR_LEN];
460 	uint8_t                 mne_flags;
461 	uint8_t                 mne_reserved;
462 };
463 #define mne_ip  mne_u.mneu_ip
464 #define mne_ip6 mne_u.mneu_ip6
465 
466 #define MNE_FLAGS_IPV6          0x01    /* IPv6 address */
467 
468 LIST_HEAD(mac_nat_entry_list, mac_nat_entry);
469 
470 /*
471  * mac_nat_record
472  * - used by bridge_mac_nat_output() to convey the translation that needs
473  *   to take place in bridge_mac_nat_translate
474  * - holds enough information so that the translation can be done later
475  *   when the destination interface is the MAC-NAT interface
476  */
477 struct mac_nat_record {
478 	uint16_t                mnr_ether_type;
479 	union {
480 		uint16_t        mnru_arp_offset;
481 		struct {
482 			uint16_t mnruip_dhcp_flags;
483 			uint16_t mnruip_udp_csum;
484 			uint8_t  mnruip_header_len;
485 		} mnru_ip;
486 		struct {
487 			uint16_t mnruip6_icmp6_len;
488 			uint16_t mnruip6_lladdr_offset;
489 			uint8_t mnruip6_icmp6_type;
490 			uint8_t mnruip6_header_len;
491 		} mnru_ip6;
492 	} mnr_u;
493 };
494 
495 #define mnr_arp_offset  mnr_u.mnru_arp_offset
496 
497 #define mnr_ip_header_len       mnr_u.mnru_ip.mnruip_header_len
498 #define mnr_ip_dhcp_flags       mnr_u.mnru_ip.mnruip_dhcp_flags
499 #define mnr_ip_udp_csum         mnr_u.mnru_ip.mnruip_udp_csum
500 
501 #define mnr_ip6_icmp6_len       mnr_u.mnru_ip6.mnruip6_icmp6_len
502 #define mnr_ip6_icmp6_type      mnr_u.mnru_ip6.mnruip6_icmp6_type
503 #define mnr_ip6_header_len      mnr_u.mnru_ip6.mnruip6_header_len
504 #define mnr_ip6_lladdr_offset   mnr_u.mnru_ip6.mnruip6_lladdr_offset
505 
506 /*
507  * Bridge route node.
508  */
509 struct bridge_rtnode {
510 	LIST_ENTRY(bridge_rtnode) brt_hash;     /* hash table linkage */
511 	LIST_ENTRY(bridge_rtnode) brt_list;     /* list linkage */
512 	struct bridge_iflist    *brt_dst;       /* destination if */
513 	unsigned long           brt_expire;     /* expiration time */
514 	uint8_t                 brt_flags;      /* address flags */
515 	uint8_t                 brt_addr[ETHER_ADDR_LEN];
516 	uint16_t                brt_vlan;       /* vlan id */
517 };
518 
519 #define brt_ifp                 brt_dst->bif_ifp
520 
521 /*
522  * Bridge delayed function call context
523  */
524 typedef void (*bridge_delayed_func_t)(struct bridge_softc *);
525 
526 struct bridge_delayed_call {
527 	struct bridge_softc     *bdc_sc;
528 	bridge_delayed_func_t   bdc_func; /* Function to call */
529 	struct timespec         bdc_ts; /* Time to call */
530 	u_int32_t               bdc_flags;
531 	thread_call_t           bdc_thread_call;
532 };
533 
534 #define BDCF_OUTSTANDING        0x01    /* Delayed call has been scheduled */
535 #define BDCF_CANCELLING         0x02    /* May be waiting for call completion */
536 
537 /*
538  * Software state for each bridge.
539  */
540 LIST_HEAD(_bridge_rtnode_list, bridge_rtnode);
541 
542 struct bridge_softc {
543 	struct ifnet            *sc_ifp;        /* make this an interface */
544 	uint32_t                sc_flags;
545 	LIST_ENTRY(bridge_softc) sc_list;
546 	decl_lck_mtx_data(, sc_mtx);
547 	struct _bridge_rtnode_list * __counted_by(sc_rthash_size) sc_rthash;  /* our forwarding table */
548 	struct _bridge_rtnode_list sc_rtlist;   /* list version of above */
549 	uint32_t                sc_rthash_key;  /* key for hash */
550 	uint32_t                sc_rthash_size; /* size of the hash table */
551 	struct bridge_delayed_call sc_aging_timer;
552 	struct bridge_delayed_call sc_resize_call;
553 	TAILQ_HEAD(, bridge_iflist) sc_spanlist;        /* span ports list */
554 	struct bstp_state       sc_stp;         /* STP state */
555 	void                    *sc_cv;
556 	uint32_t                sc_brtmax;      /* max # of addresses */
557 	uint32_t                sc_brtcnt;      /* cur. # of addresses */
558 	uint32_t                sc_brttimeout;  /* rt timeout in seconds */
559 	uint32_t                sc_iflist_ref;  /* refcount for sc_iflist */
560 	uint32_t                sc_iflist_xcnt; /* refcount for sc_iflist */
561 	TAILQ_HEAD(, bridge_iflist) sc_iflist;  /* member interface list */
562 	uint32_t                sc_brtexceeded; /* # of cache drops */
563 	uint32_t                sc_filter_flags; /* ipf and flags */
564 	struct ifnet            *sc_ifaddr;     /* member mac copied from */
565 	u_char                  sc_defaddr[6];  /* Default MAC address */
566 	char                    sc_if_xname[IFNAMSIZ];
567 
568 	struct bridge_iflist    *sc_mac_nat_bif; /* single MAC NAT interface */
569 	struct mac_nat_entry_list sc_mne_list;  /* MAC NAT IPv4 */
570 	struct mac_nat_entry_list sc_mne_list_v6;/* MAC NAT IPv6 */
571 	uint32_t                sc_mne_max;      /* max # of entries */
572 	uint32_t                sc_mne_count;    /* cur. # of entries */
573 	uint32_t                sc_mne_allocation_failures;
574 #if BRIDGE_LOCK_DEBUG
575 	/*
576 	 * Locking and unlocking calling history
577 	 */
578 	void                    *lock_lr[BR_LCKDBG_MAX];
579 	int                     next_lock_lr;
580 	void                    *unlock_lr[BR_LCKDBG_MAX];
581 	int                     next_unlock_lr;
582 #endif /* BRIDGE_LOCK_DEBUG */
583 };
584 
585 #define SCF_DETACHING            0x01
586 #define SCF_RESIZING             0x02
587 #define SCF_MEDIA_ACTIVE         0x04
588 #define SCF_ADDRESS_ASSIGNED     0x08
589 
590 typedef enum {
591 	CHECKSUM_OPERATION_NONE = 0,
592 	CHECKSUM_OPERATION_CLEAR_OFFLOAD = 1,
593 	CHECKSUM_OPERATION_FINALIZE = 2,
594 	CHECKSUM_OPERATION_COMPUTE = 3,
595 } ChecksumOperation;
596 
597 typedef struct {
598 	u_int           ip_hlen;        /* IP header length */
599 	u_int           ip_pay_len;     /* length of payload (exclusive of ip_hlen) */
600 	u_int           ip_m0_len;      /* bytes available at ip_hdr (without jumping mbufs) */
601 	u_int           ip_opt_len;     /* IPv6 options headers length */
602 	uint8_t         ip_proto;       /* IPPROTO_TCP, IPPROTO_UDP, etc. */
603 	bool            ip_is_ipv4;
604 	bool            ip_is_fragmented;
605 	uint8_t         *__sized_by(ip_m0_len) ip_hdr;   /* pointer to IP header */
606 	uint8_t         *__indexable ip_proto_hdr;   /* ptr to protocol header (TCP) */
607 } ip_packet_info, *ip_packet_info_t;
608 
609 struct bridge_hostfilter_stats bridge_hostfilter_stats;
610 
611 static LCK_GRP_DECLARE(bridge_lock_grp, "if_bridge");
612 #if BRIDGE_LOCK_DEBUG
613 static LCK_ATTR_DECLARE(bridge_lock_attr, 0, 0);
614 #else
615 static LCK_ATTR_DECLARE(bridge_lock_attr, LCK_ATTR_DEBUG, 0);
616 #endif
617 static LCK_MTX_DECLARE_ATTR(bridge_list_mtx, &bridge_lock_grp, &bridge_lock_attr);
618 
619 static int      bridge_rtable_prune_period = BRIDGE_RTABLE_PRUNE_PERIOD;
620 
621 static KALLOC_TYPE_DEFINE(bridge_rtnode_pool, struct bridge_rtnode, NET_KT_DEFAULT);
622 static KALLOC_TYPE_DEFINE(bridge_mne_pool, struct mac_nat_entry, NET_KT_DEFAULT);
623 
624 static int      bridge_clone_create(struct if_clone *, uint32_t, void *);
625 static int      bridge_clone_destroy(struct ifnet *);
626 
627 static errno_t  bridge_ioctl(struct ifnet *, u_long cmd, void *__sized_by(IOCPARM_LEN(cmd)));
628 #if HAS_IF_CAP
629 static void     bridge_mutecaps(struct bridge_softc *);
630 static void     bridge_set_ifcap(struct bridge_softc *, struct bridge_iflist *,
631     int);
632 #endif
633 static errno_t bridge_set_tso(struct bridge_softc *);
634 static void     bridge_proto_attach_changed(struct ifnet *);
635 static int      bridge_init(struct ifnet *);
636 static void     bridge_ifstop(struct ifnet *, int);
637 static int      bridge_output(struct ifnet *, struct mbuf *);
638 static void     bridge_finalize_cksum(struct ifnet *, struct mbuf *);
639 static void     bridge_start(struct ifnet *);
640 static errno_t  bridge_input(struct ifnet *, mbuf_t *);
641 static errno_t  bridge_iff_input(void *, ifnet_t, protocol_family_t,
642     mbuf_t *, char **);
643 static errno_t  bridge_iff_output(void *, ifnet_t, protocol_family_t,
644     mbuf_t *);
645 static errno_t  bridge_member_output(struct bridge_softc *sc, ifnet_t ifp,
646     mbuf_t *m);
647 
648 static int      bridge_enqueue(ifnet_t, struct ifnet *,
649     struct ifnet *, struct mbuf *, ChecksumOperation);
650 static void     bridge_rtdelete(struct bridge_softc *, struct ifnet *ifp, int);
651 
652 static void     bridge_forward(struct bridge_softc *, struct bridge_iflist *,
653     struct mbuf *);
654 
655 static void     bridge_aging_timer(struct bridge_softc *sc);
656 
657 static void     bridge_broadcast(struct bridge_softc *, struct bridge_iflist *,
658     struct mbuf *);
659 static void     bridge_span(struct bridge_softc *, struct mbuf *);
660 
661 static int      bridge_rtupdate(struct bridge_softc *, const uint8_t[ETHER_ADDR_LEN],
662     uint16_t, struct bridge_iflist *, int, uint8_t);
663 static struct ifnet *bridge_rtlookup(struct bridge_softc *, const uint8_t[ETHER_ADDR_LEN],
664     uint16_t);
665 static void     bridge_rttrim(struct bridge_softc *);
666 static void     bridge_rtage(struct bridge_softc *);
667 static void     bridge_rtflush(struct bridge_softc *, int);
668 static int      bridge_rtdaddr(struct bridge_softc *, const uint8_t[ETHER_ADDR_LEN],
669     uint16_t);
670 
671 static int      bridge_rtable_init(struct bridge_softc *);
672 static void     bridge_rtable_fini(struct bridge_softc *);
673 
674 static void     bridge_rthash_resize(struct bridge_softc *);
675 
676 static int      bridge_rtnode_addr_cmp(const uint8_t[ETHER_ADDR_LEN], const uint8_t[ETHER_ADDR_LEN]);
677 static struct bridge_rtnode *bridge_rtnode_lookup(struct bridge_softc *,
678     const uint8_t[ETHER_ADDR_LEN], uint16_t);
679 static int      bridge_rtnode_hash(struct bridge_softc *,
680     struct bridge_rtnode *);
681 static int      bridge_rtnode_insert(struct bridge_softc *,
682     struct bridge_rtnode *);
683 static void     bridge_rtnode_destroy(struct bridge_softc *,
684     struct bridge_rtnode *);
685 #if BRIDGESTP
686 static void     bridge_rtable_expire(struct ifnet *, int);
687 static void     bridge_state_change(struct ifnet *, int);
688 #endif /* BRIDGESTP */
689 
690 static struct bridge_iflist *bridge_lookup_member(struct bridge_softc *,
691     char * __sized_by(IFNAMSIZ) name);
692 static struct bridge_iflist *bridge_lookup_member_if(struct bridge_softc *,
693     struct ifnet *ifp);
694 static void     bridge_delete_member(struct bridge_softc *,
695     struct bridge_iflist *);
696 static void     bridge_delete_span(struct bridge_softc *,
697     struct bridge_iflist *);
698 
699 static int      bridge_ioctl_add(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
700 static int      bridge_ioctl_del(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
701 static int      bridge_ioctl_gifflags(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
702 static int      bridge_ioctl_sifflags(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
703 static int      bridge_ioctl_scache(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
704 static int      bridge_ioctl_gcache(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
705 static int      bridge_ioctl_gifs32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
706 static int      bridge_ioctl_gifs64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
707 static int      bridge_ioctl_rts32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
708 static int      bridge_ioctl_rts64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
709 static int      bridge_ioctl_saddr32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
710 static int      bridge_ioctl_saddr64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
711 static int      bridge_ioctl_sto(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
712 static int      bridge_ioctl_gto(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
713 static int      bridge_ioctl_daddr32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
714 static int      bridge_ioctl_daddr64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
715 static int      bridge_ioctl_flush(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
716 static int      bridge_ioctl_gpri(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
717 static int      bridge_ioctl_spri(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
718 static int      bridge_ioctl_ght(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
719 static int      bridge_ioctl_sht(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
720 static int      bridge_ioctl_gfd(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
721 static int      bridge_ioctl_sfd(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
722 static int      bridge_ioctl_gma(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
723 static int      bridge_ioctl_sma(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
724 static int      bridge_ioctl_sifprio(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
725 static int      bridge_ioctl_sifcost(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
726 static int      bridge_ioctl_sifmaxaddr(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
727 static int      bridge_ioctl_addspan(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
728 static int      bridge_ioctl_delspan(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
729 static int      bridge_ioctl_gbparam32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
730 static int      bridge_ioctl_gbparam64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
731 static int      bridge_ioctl_grte(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
732 static int      bridge_ioctl_gifsstp32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
733 static int      bridge_ioctl_gifsstp64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
734 static int      bridge_ioctl_sproto(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
735 static int      bridge_ioctl_stxhc(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
736 static int      bridge_ioctl_purge(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len);
737 static int      bridge_ioctl_gfilt(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
738 static int      bridge_ioctl_sfilt(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
739 static int      bridge_ioctl_ghostfilter(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
740 static int      bridge_ioctl_shostfilter(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
741 static int      bridge_ioctl_gmnelist32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
742 static int      bridge_ioctl_gmnelist64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
743 static int      bridge_ioctl_gifstats32(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
744 static int      bridge_ioctl_gifstats64(struct bridge_softc *, void *__sized_by(arg_len) arg, size_t arg_len);
745 
746 static int      bridge_pf(struct mbuf **, struct ifnet *,
747     uint32_t sc_filter_flags, bool input);
748 static int bridge_ip_checkbasic(struct mbuf **);
749 static int bridge_ip6_checkbasic(struct mbuf **);
750 
751 static void bridge_detach(ifnet_t);
752 static void bridge_link_event(struct ifnet *, u_int32_t);
753 static void bridge_iflinkevent(struct ifnet *);
754 static u_int32_t bridge_updatelinkstatus(struct bridge_softc *);
755 static int interface_media_active(struct ifnet *);
756 static void bridge_schedule_delayed_call(struct bridge_delayed_call *);
757 static void bridge_cancel_delayed_call(struct bridge_delayed_call *);
758 static void bridge_cleanup_delayed_call(struct bridge_delayed_call *);
759 static int bridge_host_filter(struct bridge_iflist *, mbuf_t *);
760 
761 static errno_t bridge_mac_nat_enable(struct bridge_softc *,
762     struct bridge_iflist *);
763 static void bridge_mac_nat_disable(struct bridge_softc *sc);
764 static void bridge_mac_nat_age_entries(struct bridge_softc *sc, unsigned long);
765 static void bridge_mac_nat_populate_entries(struct bridge_softc *sc);
766 static void bridge_mac_nat_flush_entries(struct bridge_softc *sc,
767     struct bridge_iflist *);
768 static mbuf_t bridge_mac_nat_input(struct bridge_softc *, ifnet_t, mbuf_t,
769     ifnet_t * dst_if);
770 static boolean_t bridge_mac_nat_output(struct bridge_softc *,
771     struct bridge_iflist *, mbuf_t *, struct mac_nat_record *);
772 static void bridge_mac_nat_translate(mbuf_t *, struct mac_nat_record *,
773     const char[ETHER_ADDR_LEN]);
774 
775 static mblist bridge_mac_nat_input_list(struct bridge_softc *sc,
776     ifnet_t external_ifp, mbuf_t m, mbuf_t * forward_head);
777 static mbuf_t bridge_mac_nat_translate_list(struct bridge_softc * sc,
778     struct bridge_iflist *sbif, ifnet_t dst_if, mbuf_t m);
779 static mbuf_t bridge_mac_nat_copy_and_translate_list(struct bridge_softc * sc,
780     struct bridge_iflist *sbif, ifnet_t dst_if, mbuf_t m);
781 
782 static mbuf_t   bridge_pf_list(mbuf_t m, ifnet_t ifp,
783     uint32_t sc_filter_flags, bool input);
784 
785 static bool is_broadcast_ip_packet(mbuf_t *);
786 static bool in_addr_is_ours(const struct in_addr);
787 static bool in6_addr_is_ours(const struct in6_addr *, uint32_t);
788 
789 #define m_copypacket(m, how) m_copym(m, 0, M_COPYALL, how)
790 
791 static mblist
792 gso_tcp(ifnet_t ifp, mbuf_t m, u_int mac_hlen, bool is_ipv4, bool is_tx);
793 
794 static inline mblist
gso_tcp_receive(ifnet_t ifp,mbuf_t m,u_int mac_hlen,bool is_ipv4)795 gso_tcp_receive(ifnet_t ifp, mbuf_t m, u_int mac_hlen, bool is_ipv4)
796 {
797 	return gso_tcp(ifp, m, mac_hlen, is_ipv4, false);
798 }
799 
800 static inline mblist
gso_tcp_transmit(ifnet_t ifp,mbuf_t m,u_int mac_hlen,bool is_ipv4)801 gso_tcp_transmit(ifnet_t ifp, mbuf_t m, u_int mac_hlen, bool is_ipv4)
802 {
803 	return gso_tcp(ifp, m, mac_hlen, is_ipv4, true);
804 }
805 
806 /* The default bridge vlan is 1 (IEEE 802.1Q-2003 Table 9-2) */
807 #define VLANTAGOF(_m)   0
808 
809 #define BSTP_ETHERADDR_RANGE_FIRST      0x00
810 #define BSTP_ETHERADDR_RANGE_LAST       0x0f
811 
812 u_int8_t bstp_etheraddr[ETHER_ADDR_LEN] =
813 { 0x01, 0x80, 0xc2, 0x00, 0x00, BSTP_ETHERADDR_RANGE_FIRST };
814 
815 
816 static u_int8_t ethernulladdr[ETHER_ADDR_LEN] =
817 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
818 
819 #if BRIDGESTP
820 static struct bstp_cb_ops bridge_ops = {
821 	.bcb_state = bridge_state_change,
822 	.bcb_rtage = bridge_rtable_expire
823 };
824 #endif /* BRIDGESTP */
825 
826 SYSCTL_DECL(_net_link);
827 SYSCTL_NODE(_net_link, IFT_BRIDGE, bridge, CTLFLAG_RW | CTLFLAG_LOCKED, 0,
828     "Bridge");
829 
830 static int bridge_inherit_mac = 0;   /* share MAC with first bridge member */
831 SYSCTL_INT(_net_link_bridge, OID_AUTO, inherit_mac,
832     CTLFLAG_RW | CTLFLAG_LOCKED,
833     &bridge_inherit_mac, 0,
834     "Inherit MAC address from the first bridge member");
835 
836 SYSCTL_INT(_net_link_bridge, OID_AUTO, rtable_prune_period,
837     CTLFLAG_RW | CTLFLAG_LOCKED,
838     &bridge_rtable_prune_period, 0,
839     "Interval between pruning of routing table");
840 
841 static unsigned int bridge_rtable_hash_size_max = BRIDGE_RTHASH_SIZE_MAX;
842 SYSCTL_UINT(_net_link_bridge, OID_AUTO, rtable_hash_size_max,
843     CTLFLAG_RW | CTLFLAG_LOCKED,
844     &bridge_rtable_hash_size_max, 0,
845     "Maximum size of the routing hash table");
846 
847 #if BRIDGE_DELAYED_CALLBACK_DEBUG
848 static int bridge_delayed_callback_delay = 0;
849 SYSCTL_INT(_net_link_bridge, OID_AUTO, delayed_callback_delay,
850     CTLFLAG_RW | CTLFLAG_LOCKED,
851     &bridge_delayed_callback_delay, 0,
852     "Delay before calling delayed function");
853 #endif
854 
855 SYSCTL_STRUCT(_net_link_bridge, OID_AUTO,
856     hostfilterstats, CTLFLAG_RD | CTLFLAG_LOCKED,
857     &bridge_hostfilter_stats, bridge_hostfilter_stats, "");
858 
859 #if BRIDGESTP
860 static int log_stp   = 0;   /* log STP state changes */
861 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_stp, CTLFLAG_RW,
862     &log_stp, 0, "Log STP state changes");
863 #endif /* BRIDGESTP */
864 
865 struct bridge_control {
866 	int             (*bc_func)(struct bridge_softc *, void *__sized_by(arg_len) args, size_t arg_len);
867 	unsigned int    bc_argsize;
868 	unsigned int    bc_flags;
869 };
870 
871 #define BC_F_COPYIN             0x01    /* copy arguments in */
872 #define BC_F_COPYOUT            0x02    /* copy arguments out */
873 #define BC_F_SUSER              0x04    /* do super-user check */
874 
875 static const struct bridge_control bridge_control_table32[] = {
876 	{ .bc_func = bridge_ioctl_add, .bc_argsize = sizeof(struct ifbreq),             /* 0 */
877 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
878 	{ .bc_func = bridge_ioctl_del, .bc_argsize = sizeof(struct ifbreq),
879 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
880 
881 	{ .bc_func = bridge_ioctl_gifflags, .bc_argsize = sizeof(struct ifbreq),
882 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
883 	{ .bc_func = bridge_ioctl_sifflags, .bc_argsize = sizeof(struct ifbreq),
884 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
885 
886 	{ .bc_func = bridge_ioctl_scache, .bc_argsize = sizeof(struct ifbrparam),
887 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
888 	{ .bc_func = bridge_ioctl_gcache, .bc_argsize = sizeof(struct ifbrparam),
889 	  .bc_flags = BC_F_COPYOUT },
890 
891 	{ .bc_func = bridge_ioctl_gifs32, .bc_argsize = sizeof(struct ifbifconf32),
892 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
893 	{ .bc_func = bridge_ioctl_rts32, .bc_argsize = sizeof(struct ifbaconf32),
894 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
895 
896 	{ .bc_func = bridge_ioctl_saddr32, .bc_argsize = sizeof(struct ifbareq32),
897 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
898 
899 	{ .bc_func = bridge_ioctl_sto, .bc_argsize = sizeof(struct ifbrparam),
900 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
901 	{ .bc_func = bridge_ioctl_gto, .bc_argsize = sizeof(struct ifbrparam),           /* 10 */
902 	  .bc_flags = BC_F_COPYOUT },
903 
904 	{ .bc_func = bridge_ioctl_daddr32, .bc_argsize = sizeof(struct ifbareq32),
905 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
906 
907 	{ .bc_func = bridge_ioctl_flush, .bc_argsize = sizeof(struct ifbreq),
908 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
909 
910 	{ .bc_func = bridge_ioctl_gpri, .bc_argsize = sizeof(struct ifbrparam),
911 	  .bc_flags = BC_F_COPYOUT },
912 	{ .bc_func = bridge_ioctl_spri, .bc_argsize = sizeof(struct ifbrparam),
913 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
914 
915 	{ .bc_func = bridge_ioctl_ght, .bc_argsize = sizeof(struct ifbrparam),
916 	  .bc_flags = BC_F_COPYOUT },
917 	{ .bc_func = bridge_ioctl_sht, .bc_argsize = sizeof(struct ifbrparam),
918 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
919 
920 	{ .bc_func = bridge_ioctl_gfd, .bc_argsize = sizeof(struct ifbrparam),
921 	  .bc_flags = BC_F_COPYOUT },
922 	{ .bc_func = bridge_ioctl_sfd, .bc_argsize = sizeof(struct ifbrparam),
923 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
924 
925 	{ .bc_func = bridge_ioctl_gma, .bc_argsize = sizeof(struct ifbrparam),
926 	  .bc_flags = BC_F_COPYOUT },
927 	{ .bc_func = bridge_ioctl_sma, .bc_argsize = sizeof(struct ifbrparam),           /* 20 */
928 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
929 
930 	{ .bc_func = bridge_ioctl_sifprio, .bc_argsize = sizeof(struct ifbreq),
931 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
932 
933 	{ .bc_func = bridge_ioctl_sifcost, .bc_argsize = sizeof(struct ifbreq),
934 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
935 
936 	{ .bc_func = bridge_ioctl_gfilt, .bc_argsize = sizeof(struct ifbrparam),
937 	  .bc_flags = BC_F_COPYOUT },
938 	{ .bc_func = bridge_ioctl_sfilt, .bc_argsize = sizeof(struct ifbrparam),
939 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
940 
941 	{ .bc_func = bridge_ioctl_purge, .bc_argsize = sizeof(struct ifbreq),
942 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
943 
944 	{ .bc_func = bridge_ioctl_addspan, .bc_argsize = sizeof(struct ifbreq),
945 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
946 	{ .bc_func = bridge_ioctl_delspan, .bc_argsize = sizeof(struct ifbreq),
947 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
948 
949 	{ .bc_func = bridge_ioctl_gbparam32, .bc_argsize = sizeof(struct ifbropreq32),
950 	  .bc_flags = BC_F_COPYOUT },
951 
952 	{ .bc_func = bridge_ioctl_grte, .bc_argsize = sizeof(struct ifbrparam),
953 	  .bc_flags = BC_F_COPYOUT },
954 
955 	{ .bc_func = bridge_ioctl_gifsstp32, .bc_argsize = sizeof(struct ifbpstpconf32),     /* 30 */
956 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
957 
958 	{ .bc_func = bridge_ioctl_sproto, .bc_argsize = sizeof(struct ifbrparam),
959 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
960 
961 	{ .bc_func = bridge_ioctl_stxhc, .bc_argsize = sizeof(struct ifbrparam),
962 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
963 
964 	{ .bc_func = bridge_ioctl_sifmaxaddr, .bc_argsize = sizeof(struct ifbreq),
965 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
966 
967 	{ .bc_func = bridge_ioctl_ghostfilter, .bc_argsize = sizeof(struct ifbrhostfilter),
968 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
969 	{ .bc_func = bridge_ioctl_shostfilter, .bc_argsize = sizeof(struct ifbrhostfilter),
970 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
971 
972 	{ .bc_func = bridge_ioctl_gmnelist32,
973 	  .bc_argsize = sizeof(struct ifbrmnelist32),
974 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
975 	{ .bc_func = bridge_ioctl_gifstats32,
976 	  .bc_argsize = sizeof(struct ifbrmreq32),
977 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
978 };
979 
980 static const struct bridge_control bridge_control_table64[] = {
981 	{ .bc_func = bridge_ioctl_add, .bc_argsize = sizeof(struct ifbreq),           /* 0 */
982 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
983 	{ .bc_func = bridge_ioctl_del, .bc_argsize = sizeof(struct ifbreq),
984 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
985 
986 	{ .bc_func = bridge_ioctl_gifflags, .bc_argsize = sizeof(struct ifbreq),
987 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
988 	{ .bc_func = bridge_ioctl_sifflags, .bc_argsize = sizeof(struct ifbreq),
989 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
990 
991 	{ .bc_func = bridge_ioctl_scache, .bc_argsize = sizeof(struct ifbrparam),
992 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
993 	{ .bc_func = bridge_ioctl_gcache, .bc_argsize = sizeof(struct ifbrparam),
994 	  .bc_flags = BC_F_COPYOUT },
995 
996 	{ .bc_func = bridge_ioctl_gifs64, .bc_argsize = sizeof(struct ifbifconf64),
997 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
998 	{ .bc_func = bridge_ioctl_rts64, .bc_argsize = sizeof(struct ifbaconf64),
999 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
1000 
1001 	{ .bc_func = bridge_ioctl_saddr64, .bc_argsize = sizeof(struct ifbareq64),
1002 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1003 
1004 	{ .bc_func = bridge_ioctl_sto, .bc_argsize = sizeof(struct ifbrparam),
1005 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1006 	{ .bc_func = bridge_ioctl_gto, .bc_argsize = sizeof(struct ifbrparam),           /* 10 */
1007 	  .bc_flags = BC_F_COPYOUT },
1008 
1009 	{ .bc_func = bridge_ioctl_daddr64, .bc_argsize = sizeof(struct ifbareq64),
1010 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1011 
1012 	{ .bc_func = bridge_ioctl_flush, .bc_argsize = sizeof(struct ifbreq),
1013 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1014 
1015 	{ .bc_func = bridge_ioctl_gpri, .bc_argsize = sizeof(struct ifbrparam),
1016 	  .bc_flags = BC_F_COPYOUT },
1017 	{ .bc_func = bridge_ioctl_spri, .bc_argsize = sizeof(struct ifbrparam),
1018 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1019 
1020 	{ .bc_func = bridge_ioctl_ght, .bc_argsize = sizeof(struct ifbrparam),
1021 	  .bc_flags = BC_F_COPYOUT },
1022 	{ .bc_func = bridge_ioctl_sht, .bc_argsize = sizeof(struct ifbrparam),
1023 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1024 
1025 	{ .bc_func = bridge_ioctl_gfd, .bc_argsize = sizeof(struct ifbrparam),
1026 	  .bc_flags = BC_F_COPYOUT },
1027 	{ .bc_func = bridge_ioctl_sfd, .bc_argsize = sizeof(struct ifbrparam),
1028 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1029 
1030 	{ .bc_func = bridge_ioctl_gma, .bc_argsize = sizeof(struct ifbrparam),
1031 	  .bc_flags = BC_F_COPYOUT },
1032 	{ .bc_func = bridge_ioctl_sma, .bc_argsize = sizeof(struct ifbrparam),           /* 20 */
1033 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1034 
1035 	{ .bc_func = bridge_ioctl_sifprio, .bc_argsize = sizeof(struct ifbreq),
1036 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1037 
1038 	{ .bc_func = bridge_ioctl_sifcost, .bc_argsize = sizeof(struct ifbreq),
1039 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1040 
1041 	{ .bc_func = bridge_ioctl_gfilt, .bc_argsize = sizeof(struct ifbrparam),
1042 	  .bc_flags = BC_F_COPYOUT },
1043 	{ .bc_func = bridge_ioctl_sfilt, .bc_argsize = sizeof(struct ifbrparam),
1044 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1045 
1046 	{ .bc_func = bridge_ioctl_purge, .bc_argsize = sizeof(struct ifbreq),
1047 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1048 
1049 	{ .bc_func = bridge_ioctl_addspan, .bc_argsize = sizeof(struct ifbreq),
1050 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1051 	{ .bc_func = bridge_ioctl_delspan, .bc_argsize = sizeof(struct ifbreq),
1052 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1053 
1054 	{ .bc_func = bridge_ioctl_gbparam64, .bc_argsize = sizeof(struct ifbropreq64),
1055 	  .bc_flags = BC_F_COPYOUT },
1056 
1057 	{ .bc_func = bridge_ioctl_grte, .bc_argsize = sizeof(struct ifbrparam),
1058 	  .bc_flags = BC_F_COPYOUT },
1059 
1060 	{ .bc_func = bridge_ioctl_gifsstp64, .bc_argsize = sizeof(struct ifbpstpconf64),     /* 30 */
1061 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
1062 
1063 	{ .bc_func = bridge_ioctl_sproto, .bc_argsize = sizeof(struct ifbrparam),
1064 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1065 
1066 	{ .bc_func = bridge_ioctl_stxhc, .bc_argsize = sizeof(struct ifbrparam),
1067 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1068 
1069 	{ .bc_func = bridge_ioctl_sifmaxaddr, .bc_argsize = sizeof(struct ifbreq),
1070 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1071 
1072 	{ .bc_func = bridge_ioctl_ghostfilter, .bc_argsize = sizeof(struct ifbrhostfilter),
1073 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
1074 	{ .bc_func = bridge_ioctl_shostfilter, .bc_argsize = sizeof(struct ifbrhostfilter),
1075 	  .bc_flags = BC_F_COPYIN | BC_F_SUSER },
1076 
1077 	{ .bc_func = bridge_ioctl_gmnelist64,
1078 	  .bc_argsize = sizeof(struct ifbrmnelist64),
1079 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
1080 	{ .bc_func = bridge_ioctl_gifstats64,
1081 	  .bc_argsize = sizeof(struct ifbrmreq64),
1082 	  .bc_flags = BC_F_COPYIN | BC_F_COPYOUT },
1083 };
1084 
1085 static const unsigned int bridge_control_table_size =
1086     sizeof(bridge_control_table32) / sizeof(bridge_control_table32[0]);
1087 
1088 static LIST_HEAD(, bridge_softc) bridge_list =
1089     LIST_HEAD_INITIALIZER(bridge_list);
1090 
1091 #define BRIDGENAME      "bridge"
1092 #define BRIDGES_MAX     IF_MAXUNIT
1093 #define BRIDGE_ZONE_MAX_ELEM    MIN(IFNETS_MAX, BRIDGES_MAX)
1094 
1095 static struct if_clone bridge_cloner =
1096     IF_CLONE_INITIALIZER(BRIDGENAME, bridge_clone_create, bridge_clone_destroy,
1097     0, BRIDGES_MAX);
1098 
1099 static int if_bridge_txstart = 0;
1100 SYSCTL_INT(_net_link_bridge, OID_AUTO, txstart, CTLFLAG_RW | CTLFLAG_LOCKED,
1101     &if_bridge_txstart, 0, "Bridge interface uses TXSTART model");
1102 
1103 SYSCTL_INT(_net_link_bridge, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_LOCKED,
1104     &if_bridge_debug, 0, "Bridge debug flags");
1105 
1106 SYSCTL_INT(_net_link_bridge, OID_AUTO, log_level,
1107     CTLFLAG_RW | CTLFLAG_LOCKED,
1108     &if_bridge_log_level, 0, "Bridge log level");
1109 
1110 static int if_bridge_segmentation = 1;
1111 SYSCTL_INT(_net_link_bridge, OID_AUTO, segmentation,
1112     CTLFLAG_RW | CTLFLAG_LOCKED,
1113     &if_bridge_segmentation, 0, "Bridge interface enable segmentation");
1114 
1115 static int if_bridge_output_skip_filters = 1;
1116 SYSCTL_INT(_net_link_bridge, OID_AUTO, output_skip_filters,
1117     CTLFLAG_RW | CTLFLAG_LOCKED,
1118     &if_bridge_output_skip_filters, 0, "Bridge skip output filters");
1119 
1120 int bridge_enable_early_input = 1;   /* DLIL early input */
1121 SYSCTL_INT(_net_link_bridge, OID_AUTO, enable_early_input,
1122     CTLFLAG_RW | CTLFLAG_LOCKED,
1123     &bridge_enable_early_input, 0,
1124     "Bridge enable early input");
1125 
1126 #define BRIDGE_TSO_REDUCE_MSS_FORWARDING_MAX            256
1127 #define BRIDGE_TSO_REDUCE_MSS_FORWARDING_DEFAULT        110
1128 #define BRIDGE_TSO_REDUCE_MSS_TX_MAX                    256
1129 #define BRIDGE_TSO_REDUCE_MSS_TX_DEFAULT                0
1130 
1131 static u_int if_bridge_tso_reduce_mss_forwarding
1132         = BRIDGE_TSO_REDUCE_MSS_FORWARDING_DEFAULT;
1133 static u_int if_bridge_tso_reduce_mss_tx
1134         = BRIDGE_TSO_REDUCE_MSS_TX_DEFAULT;
1135 
1136 static int
bridge_tso_reduce_mss(struct sysctl_req * req,u_int * val,u_int val_max)1137 bridge_tso_reduce_mss(struct sysctl_req *req, u_int * val, u_int val_max)
1138 {
1139 	int     changed;
1140 	int     error;
1141 	u_int   new_value;
1142 
1143 	error = sysctl_io_number(req, *val, sizeof(*val), &new_value,
1144 	    &changed);
1145 	if (error == 0 && changed != 0) {
1146 		if (new_value > val_max) {
1147 			return EINVAL;
1148 		}
1149 		*val = new_value;
1150 	}
1151 	return error;
1152 }
1153 
1154 static int
1155 bridge_tso_reduce_mss_forwarding_sysctl SYSCTL_HANDLER_ARGS
1156 {
1157 	return bridge_tso_reduce_mss(req, &if_bridge_tso_reduce_mss_forwarding,
1158     BRIDGE_TSO_REDUCE_MSS_FORWARDING_MAX);
1159 }
1160 
1161 SYSCTL_PROC(_net_link_bridge, OID_AUTO, tso_reduce_mss_forwarding,
1162     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
1163     0, 0, bridge_tso_reduce_mss_forwarding_sysctl, "IU",
1164     "Bridge tso reduce mss when forwarding");
1165 
1166 static int
1167 bridge_tso_reduce_mss_tx_sysctl SYSCTL_HANDLER_ARGS
1168 {
1169 	return bridge_tso_reduce_mss(req, &if_bridge_tso_reduce_mss_tx,
1170     BRIDGE_TSO_REDUCE_MSS_TX_MAX);
1171 }
1172 
1173 SYSCTL_PROC(_net_link_bridge, OID_AUTO, tso_reduce_mss_tx,
1174     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
1175     0, 0, bridge_tso_reduce_mss_tx_sysctl, "IU",
1176     "Bridge tso reduce mss on transmit");
1177 
1178 #if DEBUG || DEVELOPMENT
1179 /*
1180  * net.link.bridge.reduce_tso_mtu
1181  * - when non-zero, the bridge overrides the interface TSO MTU to a lower
1182  *   value (i.e. 16K) to enable testing the "use GSO instead" path
1183  */
1184 static int if_bridge_reduce_tso_mtu = 0;
1185 SYSCTL_INT(_net_link_bridge, OID_AUTO, reduce_tso_mtu,
1186     CTLFLAG_RW | CTLFLAG_LOCKED,
1187     &if_bridge_reduce_tso_mtu, 0, "Bridge interface reduce TSO MTU");
1188 
1189 #endif /* DEBUG || DEVELOPMENT */
1190 
1191 static void brlog_ether_header(struct ether_header *);
1192 static void brlog_mbuf_data(mbuf_t, size_t, size_t);
1193 static void brlog_mbuf_pkthdr(mbuf_t, const char *, const char *);
1194 static void brlog_mbuf(mbuf_t, const char *, const char *);
1195 static void brlog_link(struct bridge_softc * sc);
1196 
1197 #if BRIDGE_LOCK_DEBUG
1198 static void bridge_lock(struct bridge_softc *);
1199 static void bridge_unlock(struct bridge_softc *);
1200 static int bridge_lock2ref(struct bridge_softc *);
1201 static void bridge_unref(struct bridge_softc *);
1202 static void bridge_xlock(struct bridge_softc *);
1203 static void bridge_xdrop(struct bridge_softc *);
1204 
1205 #define DECL_RETURN_ADDR(v) void * __single v = __unsafe_forge_single(void *, __builtin_return_address(0))
1206 
1207 static void
bridge_lock(struct bridge_softc * sc)1208 bridge_lock(struct bridge_softc *sc)
1209 {
1210 	DECL_RETURN_ADDR(lr_saved);
1211 
1212 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
1213 
1214 	_BRIDGE_LOCK(sc);
1215 
1216 	sc->lock_lr[sc->next_lock_lr] = lr_saved;
1217 	sc->next_lock_lr = (sc->next_lock_lr + 1) % SO_LCKDBG_MAX;
1218 }
1219 
1220 static void
bridge_unlock(struct bridge_softc * sc)1221 bridge_unlock(struct bridge_softc *sc)
1222 {
1223 	DECL_RETURN_ADDR(lr_saved);
1224 
1225 	BRIDGE_LOCK_ASSERT_HELD(sc);
1226 
1227 	sc->unlock_lr[sc->next_unlock_lr] = lr_saved;
1228 	sc->next_unlock_lr = (sc->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1229 
1230 	_BRIDGE_UNLOCK(sc);
1231 }
1232 
1233 static int
bridge_lock2ref(struct bridge_softc * sc)1234 bridge_lock2ref(struct bridge_softc *sc)
1235 {
1236 	int error = 0;
1237 	DECL_RETURN_ADDR(lr_saved);
1238 
1239 	BRIDGE_LOCK_ASSERT_HELD(sc);
1240 
1241 	if (sc->sc_iflist_xcnt > 0) {
1242 		error = EBUSY;
1243 	} else {
1244 		sc->sc_iflist_ref++;
1245 	}
1246 
1247 	sc->unlock_lr[sc->next_unlock_lr] = lr_saved;
1248 	sc->next_unlock_lr = (sc->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1249 
1250 	_BRIDGE_UNLOCK(sc);
1251 
1252 	return error;
1253 }
1254 
1255 static void
bridge_unref(struct bridge_softc * sc)1256 bridge_unref(struct bridge_softc *sc)
1257 {
1258 	DECL_RETURN_ADDR(lr_saved);
1259 
1260 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
1261 
1262 	_BRIDGE_LOCK(sc);
1263 	sc->lock_lr[sc->next_lock_lr] = lr_saved;
1264 	sc->next_lock_lr = (sc->next_lock_lr + 1) % SO_LCKDBG_MAX;
1265 
1266 	sc->sc_iflist_ref--;
1267 
1268 	sc->unlock_lr[sc->next_unlock_lr] = lr_saved;
1269 	sc->next_unlock_lr = (sc->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1270 	if ((sc->sc_iflist_xcnt > 0) && (sc->sc_iflist_ref == 0)) {
1271 		_BRIDGE_UNLOCK(sc);
1272 		wakeup(&sc->sc_cv);
1273 	} else {
1274 		_BRIDGE_UNLOCK(sc);
1275 	}
1276 }
1277 
1278 static void
bridge_xlock(struct bridge_softc * sc)1279 bridge_xlock(struct bridge_softc *sc)
1280 {
1281 	DECL_RETURN_ADDR(lr_saved);
1282 
1283 	BRIDGE_LOCK_ASSERT_HELD(sc);
1284 
1285 	sc->sc_iflist_xcnt++;
1286 	while (sc->sc_iflist_ref > 0) {
1287 		sc->unlock_lr[sc->next_unlock_lr] = lr_saved;
1288 		sc->next_unlock_lr = (sc->next_unlock_lr + 1) % SO_LCKDBG_MAX;
1289 
1290 		msleep(&sc->sc_cv, &sc->sc_mtx, PZERO, "BRIDGE_XLOCK", NULL);
1291 
1292 		sc->lock_lr[sc->next_lock_lr] = lr_saved;
1293 		sc->next_lock_lr = (sc->next_lock_lr + 1) % SO_LCKDBG_MAX;
1294 	}
1295 }
1296 
1297 #undef DECL_RETURN_ADDR
1298 
1299 static void
bridge_xdrop(struct bridge_softc * sc)1300 bridge_xdrop(struct bridge_softc *sc)
1301 {
1302 	BRIDGE_LOCK_ASSERT_HELD(sc);
1303 
1304 	sc->sc_iflist_xcnt--;
1305 }
1306 
1307 #endif /* BRIDGE_LOCK_DEBUG */
1308 
1309 static void
brlog_mbuf_pkthdr(mbuf_t m,const char * prefix,const char * suffix)1310 brlog_mbuf_pkthdr(mbuf_t m, const char *prefix, const char *suffix)
1311 {
1312 	if (m) {
1313 		BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0,
1314 		    "%spktlen: %u rcvif: 0x%llx header: 0x%llx nextpkt: 0x%llx%s",
1315 		    prefix ? prefix : "", (unsigned int)mbuf_pkthdr_len(m),
1316 		    (uint64_t)VM_KERNEL_ADDRPERM(mbuf_pkthdr_rcvif(m)),
1317 		    (uint64_t)VM_KERNEL_ADDRPERM(mbuf_pkthdr_header(m)),
1318 		    (uint64_t)VM_KERNEL_ADDRPERM(mbuf_nextpkt(m)),
1319 		    suffix ? suffix : "");
1320 	} else {
1321 		BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0, "%s<NULL>%s", prefix, suffix);
1322 	}
1323 }
1324 
1325 static void
brlog_mbuf(mbuf_t m,const char * prefix,const char * suffix)1326 brlog_mbuf(mbuf_t m, const char *prefix, const char *suffix)
1327 {
1328 	if (m) {
1329 		BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0,
1330 		    "%s0x%llx type: %u flags: 0x%x len: %u data: 0x%llx "
1331 		    "maxlen: %u datastart: 0x%llx next: 0x%llx%s",
1332 		    prefix ? prefix : "", (uint64_t)VM_KERNEL_ADDRPERM(m),
1333 		    mbuf_type(m), mbuf_flags(m), (unsigned int)mbuf_len(m),
1334 		    (uint64_t)VM_KERNEL_ADDRPERM(mtod(m, void *)),
1335 		    (unsigned int)mbuf_maxlen(m),
1336 		    (uint64_t)VM_KERNEL_ADDRPERM(mbuf_datastart(m)),
1337 		    (uint64_t)VM_KERNEL_ADDRPERM(mbuf_next(m)),
1338 		    !suffix || (mbuf_flags(m) & MBUF_PKTHDR) ? "" : suffix);
1339 		if ((mbuf_flags(m) & MBUF_PKTHDR)) {
1340 			brlog_mbuf_pkthdr(m, "", suffix);
1341 		}
1342 	} else {
1343 		BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0, "%s<NULL>%s", prefix, suffix);
1344 	}
1345 }
1346 
1347 static void
brlog_mbuf_data(mbuf_t m,size_t offset,size_t len)1348 brlog_mbuf_data(mbuf_t m, size_t offset, size_t len)
1349 {
1350 	mbuf_t                  n;
1351 	size_t                  i, j;
1352 	size_t                  pktlen, mlen, maxlen;
1353 	unsigned char   *ptr;
1354 
1355 	pktlen = mbuf_pkthdr_len(m);
1356 
1357 	if (offset > pktlen) {
1358 		return;
1359 	}
1360 
1361 	maxlen = (pktlen - offset > len) ? len : pktlen - offset;
1362 	n = m;
1363 	mlen = mbuf_len(n);
1364 	ptr = mtod(n, unsigned char *);
1365 	for (i = 0, j = 0; i < maxlen; i++, j++) {
1366 		if (j >= mlen) {
1367 			n = mbuf_next(n);
1368 			if (n == 0) {
1369 				break;
1370 			}
1371 			ptr = mtod(n, unsigned char *);
1372 			mlen = mbuf_len(n);
1373 			j = 0;
1374 		}
1375 		if (i >= offset) {
1376 			BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0,
1377 			    "%02x%s", ptr[j], i % 2 ? " " : "");
1378 		}
1379 	}
1380 }
1381 
1382 static void
brlog_ether_header(struct ether_header * eh)1383 brlog_ether_header(struct ether_header *eh)
1384 {
1385 	BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0,
1386 	    "%02x:%02x:%02x:%02x:%02x:%02x > "
1387 	    "%02x:%02x:%02x:%02x:%02x:%02x 0x%04x ",
1388 	    eh->ether_shost[0], eh->ether_shost[1], eh->ether_shost[2],
1389 	    eh->ether_shost[3], eh->ether_shost[4], eh->ether_shost[5],
1390 	    eh->ether_dhost[0], eh->ether_dhost[1], eh->ether_dhost[2],
1391 	    eh->ether_dhost[3], eh->ether_dhost[4], eh->ether_dhost[5],
1392 	    ntohs(eh->ether_type));
1393 }
1394 
1395 static char *
ether_ntop(char * __sized_by (len)buf,size_t len,const u_char ap[ETHER_ADDR_LEN])1396 ether_ntop(char * __sized_by(len) buf, size_t len, const u_char ap[ETHER_ADDR_LEN])
1397 {
1398 	snprintf(buf, len, "%02x:%02x:%02x:%02x:%02x:%02x",
1399 	    ap[0], ap[1], ap[2], ap[3], ap[4], ap[5]);
1400 
1401 	return buf;
1402 }
1403 
1404 static void
brlog_link(struct bridge_softc * sc)1405 brlog_link(struct bridge_softc * sc)
1406 {
1407 	int i;
1408 	uint32_t sdl_buffer[(offsetof(struct sockaddr_dl, sdl_data) +
1409 	IFNAMSIZ + ETHER_ADDR_LEN)];
1410 	struct sockaddr_dl *sdl = SDL((uint8_t*)&sdl_buffer); /* SDL requires byte pointer */
1411 	const u_char * lladdr;
1412 	char lladdr_str[48];
1413 
1414 	memset(sdl_buffer, 0, sizeof(sdl_buffer));
1415 	sdl->sdl_family = AF_LINK;
1416 	sdl->sdl_nlen = strbuflen(sc->sc_if_xname);
1417 	sdl->sdl_alen = ETHER_ADDR_LEN;
1418 	sdl->sdl_len = offsetof(struct sockaddr_dl, sdl_data);
1419 	memcpy(sdl->sdl_data, sc->sc_if_xname, sdl->sdl_nlen);
1420 	memcpy(LLADDR(sdl), sc->sc_defaddr, ETHER_ADDR_LEN);
1421 	lladdr_str[0] = '\0';
1422 	for (i = 0, lladdr = CONST_LLADDR(sdl);
1423 	    i < sdl->sdl_alen;
1424 	    i++, lladdr++) {
1425 		char    byte_str[4];
1426 
1427 		snprintf(byte_str, sizeof(byte_str), "%s%x", i ? ":" : "",
1428 		    *lladdr);
1429 		strbufcat(lladdr_str, byte_str);
1430 	}
1431 	BRIDGE_LOG_SIMPLE(LOG_NOTICE, 0,
1432 	    "%s sdl len %d index %d family %d type 0x%x nlen %d alen %d"
1433 	    " slen %d addr %s", sc->sc_if_xname,
1434 	    sdl->sdl_len, sdl->sdl_index,
1435 	    sdl->sdl_family, sdl->sdl_type, sdl->sdl_nlen,
1436 	    sdl->sdl_alen, sdl->sdl_slen, lladdr_str);
1437 }
1438 
1439 
1440 /*
1441  * bridgeattach:
1442  *
1443  *	Pseudo-device attach routine.
1444  */
1445 __private_extern__ int
bridgeattach(int n)1446 bridgeattach(int n)
1447 {
1448 #pragma unused(n)
1449 	int error;
1450 
1451 	LIST_INIT(&bridge_list);
1452 
1453 #if BRIDGESTP
1454 	bstp_sys_init();
1455 #endif /* BRIDGESTP */
1456 
1457 	error = if_clone_attach(&bridge_cloner);
1458 	if (error != 0) {
1459 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_clone_attach failed %d", error);
1460 	}
1461 	return error;
1462 }
1463 
1464 static void
_mbuf_adjust_pkthdr_and_data(mbuf_t m,int len)1465 _mbuf_adjust_pkthdr_and_data(mbuf_t m, int len)
1466 {
1467 	mbuf_setdata(m, mtodo(m, len), mbuf_len(m) - len);
1468 	mbuf_pkthdr_adjustlen(m, -len);
1469 }
1470 
1471 static errno_t
bridge_ifnet_set_attrs(struct ifnet * ifp)1472 bridge_ifnet_set_attrs(struct ifnet * ifp)
1473 {
1474 	errno_t         error;
1475 
1476 	error = ifnet_set_mtu(ifp, ETHERMTU);
1477 	if (error != 0) {
1478 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_mtu failed %d", error);
1479 		goto done;
1480 	}
1481 	error = ifnet_set_addrlen(ifp, ETHER_ADDR_LEN);
1482 	if (error != 0) {
1483 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_addrlen failed %d", error);
1484 		goto done;
1485 	}
1486 	error = ifnet_set_hdrlen(ifp, ETHER_HDR_LEN);
1487 	if (error != 0) {
1488 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_hdrlen failed %d", error);
1489 		goto done;
1490 	}
1491 	error = ifnet_set_flags(ifp,
1492 	    IFF_BROADCAST | IFF_SIMPLEX | IFF_NOTRAILERS | IFF_MULTICAST,
1493 	    0xffff);
1494 
1495 	if (error != 0) {
1496 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_flags failed %d", error);
1497 		goto done;
1498 	}
1499 done:
1500 	return error;
1501 }
1502 
1503 /*
1504  * bridge_clone_create:
1505  *
1506  *	Create a new bridge instance.
1507  */
1508 static int
bridge_clone_create(struct if_clone * ifc,uint32_t unit,void * params)1509 bridge_clone_create(struct if_clone *ifc, uint32_t unit, void *params)
1510 {
1511 #pragma unused(params)
1512 	ifnet_ref_t ifp = NULL;
1513 	struct bridge_softc *sc = NULL;
1514 	struct bridge_softc *sc2 = NULL;
1515 	struct ifnet_init_eparams init_params;
1516 	errno_t error = 0;
1517 	uint8_t eth_hostid[ETHER_ADDR_LEN];
1518 	int fb, retry, has_hostid;
1519 
1520 	sc = kalloc_type(struct bridge_softc, Z_WAITOK_ZERO_NOFAIL);
1521 	lck_mtx_init(&sc->sc_mtx, &bridge_lock_grp, &bridge_lock_attr);
1522 	sc->sc_brtmax = BRIDGE_RTABLE_MAX;
1523 	sc->sc_mne_max = BRIDGE_MAC_NAT_ENTRY_MAX;
1524 	sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT;
1525 	sc->sc_filter_flags = 0;
1526 
1527 	TAILQ_INIT(&sc->sc_iflist);
1528 
1529 	/* use the interface name as the unique id for ifp recycle */
1530 	snprintf(sc->sc_if_xname, sizeof(sc->sc_if_xname), "%s%d",
1531 	    ifc->ifc_name, unit);
1532 	bzero(&init_params, sizeof(init_params));
1533 	init_params.ver                 = IFNET_INIT_CURRENT_VERSION;
1534 	init_params.len                 = sizeof(init_params);
1535 	/* Initialize our routing table. */
1536 	error = bridge_rtable_init(sc);
1537 	if (error != 0) {
1538 		BRIDGE_LOG(LOG_NOTICE, 0, "bridge_rtable_init failed %d", error);
1539 		goto done;
1540 	}
1541 	TAILQ_INIT(&sc->sc_spanlist);
1542 	if (if_bridge_txstart) {
1543 		init_params.start = bridge_start;
1544 	} else {
1545 		init_params.flags = IFNET_INIT_LEGACY;
1546 		init_params.output = bridge_output;
1547 	}
1548 	init_params.uniqueid_len        = strbuflen(sc->sc_if_xname);
1549 	init_params.uniqueid            = sc->sc_if_xname;
1550 	init_params.sndq_maxlen         = IFQ_MAXLEN;
1551 	init_params.name                = __unsafe_null_terminated_from_indexable(ifc->ifc_name);
1552 	init_params.unit                = unit;
1553 	init_params.family              = IFNET_FAMILY_ETHERNET;
1554 	init_params.type                = IFT_BRIDGE;
1555 	init_params.demux               = ether_demux;
1556 	init_params.add_proto           = ether_add_proto;
1557 	init_params.del_proto           = ether_del_proto;
1558 	init_params.check_multi         = ether_check_multi;
1559 	init_params.framer_extended     = ether_frameout_extended;
1560 	init_params.softc               = sc;
1561 	init_params.ioctl               = bridge_ioctl;
1562 	init_params.detach              = bridge_detach;
1563 	init_params.broadcast_addr      = etherbroadcastaddr;
1564 	init_params.broadcast_len       = ETHER_ADDR_LEN;
1565 
1566 	error = ifnet_allocate_extended(&init_params, &ifp);
1567 	if (error != 0) {
1568 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_allocate failed %d", error);
1569 		goto done;
1570 	}
1571 	LIST_INIT(&sc->sc_mne_list);
1572 	LIST_INIT(&sc->sc_mne_list_v6);
1573 	sc->sc_ifp = ifp;
1574 	error = bridge_ifnet_set_attrs(ifp);
1575 	if (error != 0) {
1576 		BRIDGE_LOG(LOG_NOTICE, 0, "bridge_ifnet_set_attrs failed %d",
1577 		    error);
1578 		goto done;
1579 	}
1580 	/*
1581 	 * Generate an ethernet address with a locally administered address.
1582 	 *
1583 	 * Since we are using random ethernet addresses for the bridge, it is
1584 	 * possible that we might have address collisions, so make sure that
1585 	 * this hardware address isn't already in use on another bridge.
1586 	 * The first try uses the "hostid" and falls back to read_frandom();
1587 	 * for "hostid", we use the MAC address of the first-encountered
1588 	 * Ethernet-type interface that is currently configured.
1589 	 */
1590 	fb = 0;
1591 	has_hostid = (uuid_get_ethernet(&eth_hostid[0]) == 0);
1592 	for (retry = 1; retry != 0;) {
1593 		if (fb || has_hostid == 0) {
1594 			read_frandom(&sc->sc_defaddr, ETHER_ADDR_LEN);
1595 			sc->sc_defaddr[0] &= ~1; /* clear multicast bit */
1596 			sc->sc_defaddr[0] |= 2;  /* set the LAA bit */
1597 		} else {
1598 			bcopy(&eth_hostid[0], &sc->sc_defaddr,
1599 			    ETHER_ADDR_LEN);
1600 			sc->sc_defaddr[0] &= ~1; /* clear multicast bit */
1601 			sc->sc_defaddr[0] |= 2;  /* set the LAA bit */
1602 			sc->sc_defaddr[3] =     /* stir it up a bit */
1603 			    ((sc->sc_defaddr[3] & 0x0f) << 4) |
1604 			    ((sc->sc_defaddr[3] & 0xf0) >> 4);
1605 			/*
1606 			 * Mix in the LSB as it's actually pretty significant,
1607 			 * see rdar://14076061
1608 			 */
1609 			sc->sc_defaddr[4] =
1610 			    (((sc->sc_defaddr[4] & 0x0f) << 4) |
1611 			    ((sc->sc_defaddr[4] & 0xf0) >> 4)) ^
1612 			    sc->sc_defaddr[5];
1613 			sc->sc_defaddr[5] = ifp->if_unit & 0xff;
1614 		}
1615 
1616 		fb = 1;
1617 		retry = 0;
1618 		lck_mtx_lock(&bridge_list_mtx);
1619 		LIST_FOREACH(sc2, &bridge_list, sc_list) {
1620 			if (_ether_cmp(sc->sc_defaddr,
1621 			    IF_LLADDR(sc2->sc_ifp)) == 0) {
1622 				retry = 1;
1623 			}
1624 		}
1625 		lck_mtx_unlock(&bridge_list_mtx);
1626 	}
1627 
1628 	sc->sc_flags &= ~SCF_MEDIA_ACTIVE;
1629 
1630 	if (BRIDGE_DBGF_ENABLED(BR_DBGF_LIFECYCLE)) {
1631 		brlog_link(sc);
1632 	}
1633 	error = ifnet_attach(ifp, NULL);
1634 	if (error != 0) {
1635 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_attach failed %d", error);
1636 		goto done;
1637 	}
1638 
1639 	error = ifnet_set_lladdr_and_type(ifp, sc->sc_defaddr, ETHER_ADDR_LEN,
1640 	    IFT_ETHER);
1641 	if (error != 0) {
1642 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_lladdr_and_type failed %d",
1643 		    error);
1644 		goto done;
1645 	}
1646 
1647 	ifnet_set_offload(ifp,
1648 	    IFNET_CSUM_IP | IFNET_CSUM_TCP | IFNET_CSUM_UDP |
1649 	    IFNET_CSUM_TCPIPV6 | IFNET_CSUM_UDPIPV6 | IFNET_MULTIPAGES);
1650 	error = bridge_set_tso(sc);
1651 	if (error != 0) {
1652 		BRIDGE_LOG(LOG_NOTICE, 0, "bridge_set_tso failed %d", error);
1653 		goto done;
1654 	}
1655 #if BRIDGESTP
1656 	bstp_attach(&sc->sc_stp, &bridge_ops);
1657 #endif /* BRIDGESTP */
1658 
1659 	lck_mtx_lock(&bridge_list_mtx);
1660 	LIST_INSERT_HEAD(&bridge_list, sc, sc_list);
1661 	lck_mtx_unlock(&bridge_list_mtx);
1662 
1663 	/* attach as ethernet */
1664 	error = bpf_attach(ifp, DLT_EN10MB, sizeof(struct ether_header),
1665 	    NULL, NULL);
1666 
1667 done:
1668 	if (error != 0) {
1669 		BRIDGE_LOG(LOG_NOTICE, 0, "failed error %d", error);
1670 		/* TBD: Clean up: sc, sc_rthash etc */
1671 	}
1672 
1673 	return error;
1674 }
1675 
1676 /*
1677  * bridge_clone_destroy:
1678  *
1679  *	Destroy a bridge instance.
1680  */
1681 static int
bridge_clone_destroy(struct ifnet * ifp)1682 bridge_clone_destroy(struct ifnet *ifp)
1683 {
1684 	struct bridge_softc * __single sc = ifp->if_softc;
1685 	struct bridge_iflist *bif;
1686 	errno_t error;
1687 
1688 	BRIDGE_LOCK(sc);
1689 	if ((sc->sc_flags & SCF_DETACHING)) {
1690 		BRIDGE_UNLOCK(sc);
1691 		return 0;
1692 	}
1693 	sc->sc_flags |= SCF_DETACHING;
1694 
1695 	bridge_ifstop(ifp, 1);
1696 
1697 	bridge_cancel_delayed_call(&sc->sc_resize_call);
1698 
1699 	bridge_cleanup_delayed_call(&sc->sc_resize_call);
1700 	bridge_cleanup_delayed_call(&sc->sc_aging_timer);
1701 
1702 	error = ifnet_set_flags(ifp, 0, IFF_UP);
1703 	if (error != 0) {
1704 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_flags failed %d", error);
1705 	}
1706 
1707 	while ((bif = TAILQ_FIRST(&sc->sc_iflist)) != NULL) {
1708 		bridge_delete_member(sc, bif);
1709 	}
1710 
1711 	while ((bif = TAILQ_FIRST(&sc->sc_spanlist)) != NULL) {
1712 		bridge_delete_span(sc, bif);
1713 	}
1714 	BRIDGE_UNLOCK(sc);
1715 
1716 	error = ifnet_detach(ifp);
1717 	if (error != 0) {
1718 		panic("%s (%d): ifnet_detach(%p) failed %d",
1719 		    __func__, __LINE__, ifp, error);
1720 	}
1721 	return 0;
1722 }
1723 
1724 #define DRVSPEC do { \
1725 	if (ifd->ifd_cmd >= bridge_control_table_size) {                \
1726 	        error = EINVAL;                                         \
1727 	        break;                                                  \
1728 	}                                                               \
1729 	bc = &bridge_control_table[ifd->ifd_cmd];                       \
1730                                                                         \
1731 	if (cmd == SIOCGDRVSPEC &&                                      \
1732 	    (bc->bc_flags & BC_F_COPYOUT) == 0) {                       \
1733 	        error = EINVAL;                                         \
1734 	        break;                                                  \
1735 	} else if (cmd == SIOCSDRVSPEC &&                               \
1736 	    (bc->bc_flags & BC_F_COPYOUT) != 0) {                       \
1737 	        error = EINVAL;                                         \
1738 	        break;                                                  \
1739 	}                                                               \
1740                                                                         \
1741 	if (bc->bc_flags & BC_F_SUSER) {                                \
1742 	        error = kauth_authorize_generic(kauth_cred_get(),       \
1743 	            KAUTH_GENERIC_ISSUSER);                             \
1744 	        if (error)                                              \
1745 	                break;                                          \
1746 	}                                                               \
1747                                                                         \
1748 	if (ifd->ifd_len != bc->bc_argsize ||                           \
1749 	    ifd->ifd_len > sizeof (args)) {                             \
1750 	        error = EINVAL;                                         \
1751 	        break;                                                  \
1752 	}                                                               \
1753                                                                         \
1754 	bzero(&args, sizeof (args));                                    \
1755 	if (bc->bc_flags & BC_F_COPYIN) {                               \
1756 	        error = copyin(ifd->ifd_data, &args, ifd->ifd_len);     \
1757 	        if (error)                                              \
1758 	                break;                                          \
1759 	}                                                               \
1760                                                                         \
1761 	BRIDGE_LOCK(sc);                                                \
1762 	error = (*bc->bc_func)(sc, &args, sizeof(args));                \
1763 	BRIDGE_UNLOCK(sc);                                              \
1764 	if (error)                                                      \
1765 	        break;                                                  \
1766                                                                         \
1767 	if (bc->bc_flags & BC_F_COPYOUT)                                \
1768 	        error = copyout(&args, ifd->ifd_data, ifd->ifd_len);    \
1769 } while (0)
1770 
1771 static boolean_t
interface_needs_input_broadcast(struct ifnet * ifp)1772 interface_needs_input_broadcast(struct ifnet * ifp)
1773 {
1774 	/*
1775 	 * Selectively enable input broadcast only when necessary.
1776 	 * The bridge interface itself attaches a fake protocol
1777 	 * so checking for at least two protocols means that the
1778 	 * interface is being used for something besides bridging
1779 	 * and needs to see broadcast packets from other members.
1780 	 */
1781 	return if_get_protolist(ifp, NULL, 0) >= 2;
1782 }
1783 
1784 static boolean_t
bif_set_input_broadcast(struct bridge_iflist * bif,boolean_t input_broadcast)1785 bif_set_input_broadcast(struct bridge_iflist * bif, boolean_t input_broadcast)
1786 {
1787 	boolean_t       old_input_broadcast;
1788 
1789 	old_input_broadcast = (bif->bif_flags & BIFF_INPUT_BROADCAST) != 0;
1790 	if (input_broadcast) {
1791 		bif->bif_flags |= BIFF_INPUT_BROADCAST;
1792 	} else {
1793 		bif->bif_flags &= ~BIFF_INPUT_BROADCAST;
1794 	}
1795 	return old_input_broadcast != input_broadcast;
1796 }
1797 
1798 /*
1799  * bridge_ioctl:
1800  *
1801  *	Handle a control request from the operator.
1802  */
1803 static errno_t
bridge_ioctl(struct ifnet * ifp,u_long cmd,void * __sized_by (IOCPARM_LEN (cmd))data)1804 bridge_ioctl(struct ifnet *ifp, u_long cmd, void *__sized_by(IOCPARM_LEN(cmd)) data)
1805 {
1806 	struct bridge_softc * __single sc = ifp->if_softc;
1807 	struct ifreq *ifr = (struct ifreq *)data;
1808 	struct bridge_iflist *bif;
1809 	int error = 0;
1810 
1811 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
1812 
1813 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_IOCTL,
1814 	    "ifp %s cmd 0x%08lx (%c%c [%lu] %c %lu)",
1815 	    ifp->if_xname, cmd, (cmd & IOC_IN) ? 'I' : ' ',
1816 	    (cmd & IOC_OUT) ? 'O' : ' ', IOCPARM_LEN(cmd),
1817 	    (char)IOCGROUP(cmd), cmd & 0xff);
1818 
1819 	switch (cmd) {
1820 	case SIOCAIFADDR_IN6_32:
1821 	case SIOCAIFADDR_IN6_64:
1822 	case SIOCSIFADDR:
1823 	case SIOCAIFADDR:
1824 		ifnet_set_flags(ifp, IFF_UP, IFF_UP);
1825 		BRIDGE_LOCK(sc);
1826 		sc->sc_flags |= SCF_ADDRESS_ASSIGNED;
1827 		BRIDGE_UNLOCK(sc);
1828 		BRIDGE_LOG(LOG_NOTICE, 0,
1829 		    "ifp %s has address", ifp->if_xname);
1830 		break;
1831 
1832 	case SIOCGIFMEDIA32:
1833 	case SIOCGIFMEDIA64: {
1834 		// cast to 32bit version to work within bounds with 32bit userspace
1835 		struct ifmediareq32 *ifmr = (struct ifmediareq32 *)data;
1836 		user_addr_t user_addr;
1837 
1838 		user_addr = (cmd == SIOCGIFMEDIA64) ?
1839 		    ((struct ifmediareq64 *)data)->ifmu_ulist :
1840 		    CAST_USER_ADDR_T(((struct ifmediareq32 *)data)->ifmu_ulist);
1841 
1842 		ifmr->ifm_status = IFM_AVALID;
1843 		ifmr->ifm_mask = 0;
1844 		ifmr->ifm_count = 1;
1845 
1846 		BRIDGE_LOCK(sc);
1847 		if (!(sc->sc_flags & SCF_DETACHING) &&
1848 		    (sc->sc_flags & SCF_MEDIA_ACTIVE)) {
1849 			ifmr->ifm_status |= IFM_ACTIVE;
1850 			ifmr->ifm_active = ifmr->ifm_current =
1851 			    IFM_ETHER | IFM_AUTO;
1852 		} else {
1853 			ifmr->ifm_active = ifmr->ifm_current = IFM_NONE;
1854 		}
1855 		BRIDGE_UNLOCK(sc);
1856 
1857 		if (user_addr != USER_ADDR_NULL) {
1858 			error = copyout(&ifmr->ifm_current, user_addr,
1859 			    sizeof(int));
1860 		}
1861 		break;
1862 	}
1863 
1864 	case SIOCADDMULTI:
1865 	case SIOCDELMULTI:
1866 		break;
1867 
1868 	case SIOCSDRVSPEC32:
1869 	case SIOCGDRVSPEC32: {
1870 		union {
1871 			struct ifbreq ifbreq;
1872 			struct ifbifconf32 ifbifconf;
1873 			struct ifbareq32 ifbareq;
1874 			struct ifbaconf32 ifbaconf;
1875 			struct ifbrparam ifbrparam;
1876 			struct ifbropreq32 ifbropreq;
1877 		} args;
1878 		struct ifdrv32 *ifd = (struct ifdrv32 *)data;
1879 		const struct bridge_control *bridge_control_table =
1880 		    bridge_control_table32, *bc;
1881 
1882 		DRVSPEC;
1883 
1884 		break;
1885 	}
1886 	case SIOCSDRVSPEC64:
1887 	case SIOCGDRVSPEC64: {
1888 		union {
1889 			struct ifbreq ifbreq;
1890 			struct ifbifconf64 ifbifconf;
1891 			struct ifbareq64 ifbareq;
1892 			struct ifbaconf64 ifbaconf;
1893 			struct ifbrparam ifbrparam;
1894 			struct ifbropreq64 ifbropreq;
1895 		} args;
1896 		struct ifdrv64 *ifd = (struct ifdrv64 *)data;
1897 		const struct bridge_control *bridge_control_table =
1898 		    bridge_control_table64, *bc;
1899 
1900 		DRVSPEC;
1901 
1902 		break;
1903 	}
1904 
1905 	case SIOCSIFFLAGS:
1906 		if (!(ifp->if_flags & IFF_UP) &&
1907 		    (ifp->if_flags & IFF_RUNNING)) {
1908 			/*
1909 			 * If interface is marked down and it is running,
1910 			 * then stop and disable it.
1911 			 */
1912 			BRIDGE_LOCK(sc);
1913 			bridge_ifstop(ifp, 1);
1914 			BRIDGE_UNLOCK(sc);
1915 		} else if ((ifp->if_flags & IFF_UP) &&
1916 		    !(ifp->if_flags & IFF_RUNNING)) {
1917 			/*
1918 			 * If interface is marked up and it is stopped, then
1919 			 * start it.
1920 			 */
1921 			BRIDGE_LOCK(sc);
1922 			error = bridge_init(ifp);
1923 			BRIDGE_UNLOCK(sc);
1924 		}
1925 		break;
1926 
1927 	case SIOCSIFLLADDR:
1928 		error = ifnet_set_lladdr(ifp, ifr->ifr_addr.sa_data,
1929 		    ifr->ifr_addr.sa_len);
1930 		if (error != 0) {
1931 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_IOCTL,
1932 			    "%s SIOCSIFLLADDR error %d", ifp->if_xname,
1933 			    error);
1934 		}
1935 		break;
1936 
1937 	case SIOCSIFMTU:
1938 		if (ifr->ifr_mtu < 576) {
1939 			error = EINVAL;
1940 			break;
1941 		}
1942 		BRIDGE_LOCK(sc);
1943 		if (TAILQ_EMPTY(&sc->sc_iflist)) {
1944 			sc->sc_ifp->if_mtu = ifr->ifr_mtu;
1945 			BRIDGE_UNLOCK(sc);
1946 			break;
1947 		}
1948 		TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
1949 			if (bif->bif_ifp->if_mtu != (unsigned)ifr->ifr_mtu) {
1950 				BRIDGE_LOG(LOG_NOTICE, 0,
1951 				    "%s invalid MTU: %u(%s) != %d",
1952 				    sc->sc_ifp->if_xname,
1953 				    bif->bif_ifp->if_mtu,
1954 				    bif->bif_ifp->if_xname, ifr->ifr_mtu);
1955 				error = EINVAL;
1956 				break;
1957 			}
1958 		}
1959 		if (!error) {
1960 			sc->sc_ifp->if_mtu = ifr->ifr_mtu;
1961 		}
1962 		BRIDGE_UNLOCK(sc);
1963 		break;
1964 
1965 	default:
1966 		error = ether_ioctl(ifp, cmd, data);
1967 		if (error != 0 && error != EOPNOTSUPP) {
1968 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_IOCTL,
1969 			    "ifp %s cmd 0x%08lx "
1970 			    "(%c%c [%lu] %c %lu) failed error: %d",
1971 			    ifp->if_xname, cmd,
1972 			    (cmd & IOC_IN) ? 'I' : ' ',
1973 			    (cmd & IOC_OUT) ? 'O' : ' ',
1974 			    IOCPARM_LEN(cmd), (char)IOCGROUP(cmd),
1975 			    cmd & 0xff, error);
1976 		}
1977 		break;
1978 	}
1979 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
1980 
1981 	return error;
1982 }
1983 
1984 #if HAS_IF_CAP
1985 /*
1986  * bridge_mutecaps:
1987  *
1988  *	Clear or restore unwanted capabilities on the member interface
1989  */
1990 static void
bridge_mutecaps(struct bridge_softc * sc)1991 bridge_mutecaps(struct bridge_softc *sc)
1992 {
1993 	struct bridge_iflist *bif;
1994 	int enabled, mask;
1995 
1996 	/* Initial bitmask of capabilities to test */
1997 	mask = BRIDGE_IFCAPS_MASK;
1998 
1999 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
2000 		/* Every member must support it or its disabled */
2001 		mask &= bif->bif_savedcaps;
2002 	}
2003 
2004 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
2005 		enabled = bif->bif_ifp->if_capenable;
2006 		enabled &= ~BRIDGE_IFCAPS_STRIP;
2007 		/* strip off mask bits and enable them again if allowed */
2008 		enabled &= ~BRIDGE_IFCAPS_MASK;
2009 		enabled |= mask;
2010 
2011 		bridge_set_ifcap(sc, bif, enabled);
2012 	}
2013 }
2014 
2015 static void
bridge_set_ifcap(struct bridge_softc * sc,struct bridge_iflist * bif,int set)2016 bridge_set_ifcap(struct bridge_softc *sc, struct bridge_iflist *bif, int set)
2017 {
2018 	struct ifnet *ifp = bif->bif_ifp;
2019 	struct ifreq ifr;
2020 	int error;
2021 
2022 	bzero(&ifr, sizeof(ifr));
2023 	ifr.ifr_reqcap = set;
2024 
2025 	if (ifp->if_capenable != set) {
2026 		IFF_LOCKGIANT(ifp);
2027 		error = (*ifp->if_ioctl)(ifp, SIOCSIFCAP, (caddr_t)&ifr);
2028 		IFF_UNLOCKGIANT(ifp);
2029 		if (error) {
2030 			BRIDGE_LOG(LOG_NOTICE, 0,
2031 			    "%s error setting interface capabilities on %s",
2032 			    sc->sc_ifp->if_xname, ifp->if_xname);
2033 		}
2034 	}
2035 }
2036 #endif /* HAS_IF_CAP */
2037 
2038 static errno_t
siocsifcap(struct ifnet * ifp,uint32_t cap_enable)2039 siocsifcap(struct ifnet * ifp, uint32_t cap_enable)
2040 {
2041 	struct ifreq    ifr;
2042 
2043 	bzero(&ifr, sizeof(ifr));
2044 	ifr.ifr_reqcap = cap_enable;
2045 	return ifnet_ioctl(ifp, 0, SIOCSIFCAP, &ifr);
2046 }
2047 
2048 static const char *
enable_disable_str(boolean_t enable)2049 enable_disable_str(boolean_t enable)
2050 {
2051 	return (const char * __null_terminated)(enable ? "enable" : "disable");
2052 }
2053 
2054 static boolean_t
bridge_set_lro(struct ifnet * ifp,boolean_t enable)2055 bridge_set_lro(struct ifnet * ifp, boolean_t enable)
2056 {
2057 	uint32_t        cap_enable;
2058 	uint32_t        cap_supported;
2059 	boolean_t       changed = FALSE;
2060 	boolean_t       lro_enabled;
2061 
2062 	cap_supported = ifnet_capabilities_supported(ifp);
2063 	if ((cap_supported & IFCAP_LRO) == 0) {
2064 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_LIFECYCLE,
2065 		    "%s doesn't support LRO",
2066 		    ifp->if_xname);
2067 		goto done;
2068 	}
2069 	cap_enable = ifnet_capabilities_enabled(ifp);
2070 	lro_enabled = (cap_enable & IFCAP_LRO) != 0;
2071 	if (lro_enabled != enable) {
2072 		errno_t         error;
2073 
2074 		if (enable) {
2075 			cap_enable |= IFCAP_LRO;
2076 		} else {
2077 			cap_enable &= ~IFCAP_LRO;
2078 		}
2079 		error = siocsifcap(ifp, cap_enable);
2080 		if (error != 0) {
2081 			BRIDGE_LOG(LOG_NOTICE, 0,
2082 			    "%s %s failed (cap 0x%x) %d",
2083 			    ifp->if_xname,
2084 			    enable_disable_str(enable),
2085 			    cap_enable,
2086 			    error);
2087 		} else {
2088 			changed = TRUE;
2089 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_LIFECYCLE,
2090 			    "%s %s success (cap 0x%x)",
2091 			    ifp->if_xname,
2092 			    enable_disable_str(enable),
2093 			    cap_enable);
2094 		}
2095 	}
2096 done:
2097 	return changed;
2098 }
2099 
2100 static errno_t
bridge_set_tso(struct bridge_softc * sc)2101 bridge_set_tso(struct bridge_softc *sc)
2102 {
2103 	struct bridge_iflist *bif;
2104 	u_int32_t tso_v4_mtu;
2105 	u_int32_t tso_v6_mtu;
2106 	ifnet_offload_t offload;
2107 	errno_t error = 0;
2108 
2109 	/* By default, support TSO */
2110 	offload = sc->sc_ifp->if_hwassist | IFNET_TSO_IPV4 | IFNET_TSO_IPV6;
2111 	tso_v4_mtu = IP_MAXPACKET;
2112 	tso_v6_mtu = IP_MAXPACKET;
2113 
2114 	/* Use the lowest common denominator of the members */
2115 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
2116 		ifnet_t ifp = bif->bif_ifp;
2117 
2118 		if (ifp == NULL) {
2119 			continue;
2120 		}
2121 
2122 		if (offload & IFNET_TSO_IPV4) {
2123 			if (ifp->if_hwassist & IFNET_TSO_IPV4) {
2124 				if (tso_v4_mtu > ifp->if_tso_v4_mtu) {
2125 					tso_v4_mtu = ifp->if_tso_v4_mtu;
2126 				}
2127 			} else {
2128 				offload &= ~IFNET_TSO_IPV4;
2129 				tso_v4_mtu = 0;
2130 			}
2131 		}
2132 		if (offload & IFNET_TSO_IPV6) {
2133 			if (ifp->if_hwassist & IFNET_TSO_IPV6) {
2134 				if (tso_v6_mtu > ifp->if_tso_v6_mtu) {
2135 					tso_v6_mtu = ifp->if_tso_v6_mtu;
2136 				}
2137 			} else {
2138 				offload &= ~IFNET_TSO_IPV6;
2139 				tso_v6_mtu = 0;
2140 			}
2141 		}
2142 	}
2143 
2144 	if (offload != sc->sc_ifp->if_hwassist) {
2145 		error = ifnet_set_offload(sc->sc_ifp, offload);
2146 		if (error != 0) {
2147 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_LIFECYCLE,
2148 			    "ifnet_set_offload(%s, 0x%x) failed %d",
2149 			    sc->sc_ifp->if_xname, offload, error);
2150 			goto done;
2151 		}
2152 		/*
2153 		 * For ifnet_set_tso_mtu() sake, the TSO MTU must be at least
2154 		 * as large as the interface MTU
2155 		 */
2156 		if (sc->sc_ifp->if_hwassist & IFNET_TSO_IPV4) {
2157 			if (tso_v4_mtu < sc->sc_ifp->if_mtu) {
2158 				tso_v4_mtu = sc->sc_ifp->if_mtu;
2159 			}
2160 			error = ifnet_set_tso_mtu(sc->sc_ifp, AF_INET,
2161 			    tso_v4_mtu);
2162 			if (error != 0) {
2163 				BRIDGE_LOG(LOG_NOTICE, BR_DBGF_LIFECYCLE,
2164 				    "ifnet_set_tso_mtu(%s, "
2165 				    "AF_INET, %u) failed %d",
2166 				    sc->sc_ifp->if_xname,
2167 				    tso_v4_mtu, error);
2168 				goto done;
2169 			}
2170 		}
2171 		if (sc->sc_ifp->if_hwassist & IFNET_TSO_IPV6) {
2172 			if (tso_v6_mtu < sc->sc_ifp->if_mtu) {
2173 				tso_v6_mtu = sc->sc_ifp->if_mtu;
2174 			}
2175 			error = ifnet_set_tso_mtu(sc->sc_ifp, AF_INET6,
2176 			    tso_v6_mtu);
2177 			if (error != 0) {
2178 				BRIDGE_LOG(LOG_NOTICE, BR_DBGF_LIFECYCLE,
2179 				    "ifnet_set_tso_mtu(%s, "
2180 				    "AF_INET6, %u) failed %d",
2181 				    sc->sc_ifp->if_xname,
2182 				    tso_v6_mtu, error);
2183 				goto done;
2184 			}
2185 		}
2186 	}
2187 done:
2188 	return error;
2189 }
2190 
2191 static const char *
sanitize_ifname(char * __sized_by (IFNAMSIZ)ifname)2192 sanitize_ifname(char * __sized_by(IFNAMSIZ) ifname)
2193 {
2194 	ifname[IFNAMSIZ - 1] = '\0';
2195 	return __unsafe_null_terminated_from_indexable(ifname, &ifname[IFNAMSIZ - 1]);
2196 }
2197 
2198 /*
2199  * bridge_lookup_member:
2200  *
2201  *	Lookup a bridge member interface.
2202  */
2203 static struct bridge_iflist *
bridge_lookup_member(struct bridge_softc * sc,char * __sized_by (IFNAMSIZ)name_unsanitized)2204 bridge_lookup_member(struct bridge_softc *sc, char * __sized_by(IFNAMSIZ) name_unsanitized)
2205 {
2206 	struct bridge_iflist *bif;
2207 	struct ifnet *ifp;
2208 	const char * __null_terminated name = sanitize_ifname(name_unsanitized);
2209 
2210 	BRIDGE_LOCK_ASSERT_HELD(sc);
2211 
2212 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
2213 		ifp = bif->bif_ifp;
2214 		if (strcmp(ifp->if_xname, name) == 0) {
2215 			return bif;
2216 		}
2217 	}
2218 
2219 	return NULL;
2220 }
2221 
2222 /*
2223  * bridge_lookup_member_if:
2224  *
2225  *	Lookup a bridge member interface by ifnet*.
2226  */
2227 static struct bridge_iflist *
bridge_lookup_member_if(struct bridge_softc * sc,struct ifnet * member_ifp)2228 bridge_lookup_member_if(struct bridge_softc *sc, struct ifnet *member_ifp)
2229 {
2230 	struct bridge_iflist *bif;
2231 
2232 	BRIDGE_LOCK_ASSERT_HELD(sc);
2233 
2234 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
2235 		if (bif->bif_ifp == member_ifp) {
2236 			return bif;
2237 		}
2238 	}
2239 
2240 	return NULL;
2241 }
2242 
2243 static errno_t
bridge_iff_input(void * cookie,ifnet_t ifp,protocol_family_t protocol,mbuf_t * data,char ** frame_ptr)2244 bridge_iff_input(void *cookie, ifnet_t ifp, protocol_family_t protocol,
2245     mbuf_t *data, char **frame_ptr)
2246 {
2247 #pragma unused(protocol)
2248 	errno_t error = 0;
2249 	struct bridge_iflist *bif = (struct bridge_iflist *)cookie;
2250 	struct bridge_softc *sc = bif->bif_sc;
2251 	int included = 0;
2252 	size_t frmlen = 0;
2253 	mbuf_t m = *data;
2254 
2255 	if ((m->m_flags & M_PROTO1)) {
2256 		goto out;
2257 	}
2258 
2259 	if (*frame_ptr >= (char *)mbuf_datastart(m) &&
2260 	    *frame_ptr <= mtod(m, char *)) {
2261 		included = 1;
2262 		frmlen = mtod(m, char *) - *frame_ptr;
2263 	}
2264 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
2265 	    "%s from %s m 0x%llx data 0x%llx frame 0x%llx %s "
2266 	    "frmlen %lu", sc->sc_ifp->if_xname,
2267 	    ifp->if_xname, (uint64_t)VM_KERNEL_ADDRPERM(m),
2268 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(m, void *)),
2269 	    (uint64_t)VM_KERNEL_ADDRPERM(*frame_ptr),
2270 	    included ? "inside" : "outside", frmlen);
2271 	if (BRIDGE_DBGF_ENABLED(BR_DBGF_MBUF)) {
2272 		brlog_mbuf(m, "bridge_iff_input[", "");
2273 		brlog_ether_header((struct ether_header *)
2274 		    (void *)*frame_ptr);
2275 		brlog_mbuf_data(m, 0, 20);
2276 	}
2277 	if (included == 0) {
2278 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT, "frame_ptr outside mbuf");
2279 		goto out;
2280 	}
2281 
2282 	/* Move data pointer to start of frame to the link layer header */
2283 	_mbuf_adjust_pkthdr_and_data(m, -frmlen);
2284 
2285 	/* make sure we can access the ethernet header */
2286 	if (mbuf_pkthdr_len(m) < sizeof(struct ether_header)) {
2287 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
2288 		    "short frame %lu < %lu",
2289 		    mbuf_pkthdr_len(m), sizeof(struct ether_header));
2290 		goto out;
2291 	}
2292 	if (mbuf_len(m) < sizeof(struct ether_header)) {
2293 		error = mbuf_pullup(data, sizeof(struct ether_header));
2294 		if (error != 0) {
2295 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
2296 			    "mbuf_pullup(%lu) failed %d",
2297 			    sizeof(struct ether_header),
2298 			    error);
2299 			error = EJUSTRETURN;
2300 			goto out;
2301 		}
2302 		if (m != *data) {
2303 			m = *data;
2304 			*frame_ptr = mtod(m, char *);
2305 		}
2306 	}
2307 
2308 	error = bridge_input(ifp, data);
2309 
2310 	/* Adjust packet back to original */
2311 	if (error == 0) {
2312 		/* bridge_input might have modified *data */
2313 		if (*data != m) {
2314 			m = *data;
2315 			*frame_ptr = mtod(m, char *);
2316 		}
2317 		_mbuf_adjust_pkthdr_and_data(m, frmlen);
2318 	}
2319 
2320 	if (BRIDGE_DBGF_ENABLED(BR_DBGF_MBUF) &&
2321 	    BRIDGE_DBGF_ENABLED(BR_DBGF_INPUT)) {
2322 		brlog_mbuf(m, "bridge_iff_input]", "");
2323 	}
2324 
2325 out:
2326 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
2327 
2328 	return error;
2329 }
2330 
2331 static errno_t
bridge_iff_output(void * cookie,ifnet_t ifp,protocol_family_t protocol,mbuf_t * data)2332 bridge_iff_output(void *cookie, ifnet_t ifp, protocol_family_t protocol,
2333     mbuf_t *data)
2334 {
2335 #pragma unused(protocol)
2336 	errno_t error = 0;
2337 	struct bridge_iflist *bif = (struct bridge_iflist *)cookie;
2338 	struct bridge_softc *sc = bif->bif_sc;
2339 	mbuf_t m = *data;
2340 
2341 	if ((m->m_flags & M_PROTO1)) {
2342 		goto out;
2343 	}
2344 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_OUTPUT,
2345 	    "%s from %s m 0x%llx data 0x%llx",
2346 	    sc->sc_ifp->if_xname, ifp->if_xname,
2347 	    (uint64_t)VM_KERNEL_ADDRPERM(m),
2348 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(m, void *)));
2349 
2350 	error = bridge_member_output(sc, ifp, data);
2351 	if (error != 0 && error != EJUSTRETURN) {
2352 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_OUTPUT,
2353 		    "bridge_member_output failed error %d",
2354 		    error);
2355 	}
2356 out:
2357 	BRIDGE_LOCK_ASSERT_NOTHELD(sc);
2358 
2359 	return error;
2360 }
2361 
2362 static void
bridge_iff_event(void * cookie,ifnet_t ifp,protocol_family_t protocol,const struct kev_msg * event_msg)2363 bridge_iff_event(void *cookie, ifnet_t ifp, protocol_family_t protocol,
2364     const struct kev_msg *event_msg)
2365 {
2366 #pragma unused(protocol)
2367 	struct bridge_iflist *bif = (struct bridge_iflist *)cookie;
2368 	struct bridge_softc *sc = bif->bif_sc;
2369 
2370 	if (event_msg->vendor_code == KEV_VENDOR_APPLE &&
2371 	    event_msg->kev_class == KEV_NETWORK_CLASS &&
2372 	    event_msg->kev_subclass == KEV_DL_SUBCLASS) {
2373 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE,
2374 		    "%s event_code %u - %s",
2375 		    ifp->if_xname, event_msg->event_code,
2376 		    dlil_kev_dl_code_str(event_msg->event_code));
2377 
2378 		switch (event_msg->event_code) {
2379 		case KEV_DL_LINK_OFF:
2380 		case KEV_DL_LINK_ON: {
2381 			bridge_iflinkevent(ifp);
2382 #if BRIDGESTP
2383 			bstp_linkstate(ifp, event_msg->event_code);
2384 #endif /* BRIDGESTP */
2385 			break;
2386 		}
2387 		case KEV_DL_SIFFLAGS: {
2388 			if ((ifp->if_flags & IFF_UP) == 0) {
2389 				break;
2390 			}
2391 			if ((bif->bif_flags & BIFF_PROMISC) == 0) {
2392 				errno_t error;
2393 
2394 				error = ifnet_set_promiscuous(ifp, 1);
2395 				if (error != 0) {
2396 					BRIDGE_LOG(LOG_NOTICE, 0,
2397 					    "ifnet_set_promiscuous (%s)"
2398 					    " failed %d", ifp->if_xname,
2399 					    error);
2400 				} else {
2401 					bif->bif_flags |= BIFF_PROMISC;
2402 				}
2403 			}
2404 			if ((bif->bif_flags & BIFF_WIFI_INFRA) != 0 &&
2405 			    (bif->bif_flags & BIFF_ALL_MULTI) == 0) {
2406 				errno_t error;
2407 
2408 				error = if_allmulti(ifp, 1);
2409 				if (error != 0) {
2410 					BRIDGE_LOG(LOG_NOTICE, 0,
2411 					    "if_allmulti (%s)"
2412 					    " failed %d", ifp->if_xname,
2413 					    error);
2414 				} else {
2415 					bif->bif_flags |= BIFF_ALL_MULTI;
2416 #ifdef XNU_PLATFORM_AppleTVOS
2417 					ip6_forwarding = 1;
2418 #endif /* XNU_PLATFORM_AppleTVOS */
2419 				}
2420 			}
2421 			break;
2422 		}
2423 		case KEV_DL_IFCAP_CHANGED: {
2424 			BRIDGE_LOCK(sc);
2425 			bridge_set_tso(sc);
2426 			BRIDGE_UNLOCK(sc);
2427 			break;
2428 		}
2429 		case KEV_DL_PROTO_DETACHED:
2430 		case KEV_DL_PROTO_ATTACHED: {
2431 			bridge_proto_attach_changed(ifp);
2432 			break;
2433 		}
2434 		default:
2435 			break;
2436 		}
2437 	}
2438 }
2439 
2440 /*
2441  * bridge_iff_detached:
2442  *
2443  *      Called when our interface filter has been detached from a
2444  *      member interface.
2445  */
2446 static void
bridge_iff_detached(void * cookie,ifnet_t ifp)2447 bridge_iff_detached(void *cookie, ifnet_t ifp)
2448 {
2449 #pragma unused(cookie)
2450 	struct bridge_iflist *bif;
2451 	struct bridge_softc * __single sc = ifp->if_bridge;
2452 
2453 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE, "%s", ifp->if_xname);
2454 
2455 	/* Check if the interface is a bridge member */
2456 	if (sc != NULL) {
2457 		BRIDGE_LOCK(sc);
2458 		bif = bridge_lookup_member_if(sc, ifp);
2459 		if (bif != NULL) {
2460 			bridge_delete_member(sc, bif);
2461 		}
2462 		BRIDGE_UNLOCK(sc);
2463 		return;
2464 	}
2465 	/* Check if the interface is a span port */
2466 	lck_mtx_lock(&bridge_list_mtx);
2467 	LIST_FOREACH(sc, &bridge_list, sc_list) {
2468 		BRIDGE_LOCK(sc);
2469 		TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
2470 		if (ifp == bif->bif_ifp) {
2471 			bridge_delete_span(sc, bif);
2472 			break;
2473 		}
2474 		BRIDGE_UNLOCK(sc);
2475 	}
2476 	lck_mtx_unlock(&bridge_list_mtx);
2477 }
2478 
2479 static errno_t
bridge_proto_input(ifnet_t ifp,protocol_family_t protocol,mbuf_t packet,char * header)2480 bridge_proto_input(ifnet_t ifp, protocol_family_t protocol, mbuf_t packet,
2481     char *header)
2482 {
2483 #pragma unused(protocol, packet, header)
2484 	BRIDGE_LOG(LOG_NOTICE, 0, "%s unexpected packet",
2485 	    ifp->if_xname);
2486 	return 0;
2487 }
2488 
2489 static int
bridge_attach_protocol(struct ifnet * ifp)2490 bridge_attach_protocol(struct ifnet *ifp)
2491 {
2492 	int     error;
2493 	struct ifnet_attach_proto_param reg;
2494 
2495 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE, "%s", ifp->if_xname);
2496 	bzero(&reg, sizeof(reg));
2497 	reg.input = bridge_proto_input;
2498 
2499 	error = ifnet_attach_protocol(ifp, PF_BRIDGE, &reg);
2500 	if (error) {
2501 		BRIDGE_LOG(LOG_NOTICE, 0,
2502 		    "ifnet_attach_protocol(%s) failed, %d",
2503 		    ifp->if_xname, error);
2504 	}
2505 
2506 	return error;
2507 }
2508 
2509 static int
bridge_detach_protocol(struct ifnet * ifp)2510 bridge_detach_protocol(struct ifnet *ifp)
2511 {
2512 	int     error;
2513 
2514 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE, "%s", ifp->if_xname);
2515 	error = ifnet_detach_protocol(ifp, PF_BRIDGE);
2516 	if (error) {
2517 		BRIDGE_LOG(LOG_NOTICE, 0,
2518 		    "ifnet_detach_protocol(%s) failed, %d",
2519 		    ifp->if_xname, error);
2520 	}
2521 
2522 	return error;
2523 }
2524 
2525 /*
2526  * bridge_delete_member:
2527  *
2528  *	Delete the specified member interface.
2529  */
2530 static void
bridge_delete_member(struct bridge_softc * sc,struct bridge_iflist * bif)2531 bridge_delete_member(struct bridge_softc *sc, struct bridge_iflist *bif)
2532 {
2533 #if SKYWALK
2534 	boolean_t add_netagent = FALSE;
2535 #endif /* SKYWALK */
2536 	uint32_t    bif_flags;
2537 	struct ifnet *ifs = bif->bif_ifp, *bifp = sc->sc_ifp;
2538 	int lladdr_changed = 0, error;
2539 	uint8_t eaddr[ETHER_ADDR_LEN];
2540 	u_int32_t event_code = 0;
2541 
2542 	BRIDGE_LOCK_ASSERT_HELD(sc);
2543 	VERIFY(ifs != NULL);
2544 
2545 	/*
2546 	 * Remove the member from the list first so it cannot be found anymore
2547 	 * when we release the bridge lock below
2548 	 */
2549 	if ((bif->bif_flags & BIFF_IN_MEMBER_LIST) != 0) {
2550 		bif->bif_flags &= ~BIFF_IN_MEMBER_LIST;
2551 		BRIDGE_XLOCK(sc);
2552 		TAILQ_REMOVE(&sc->sc_iflist, bif, bif_next);
2553 		BRIDGE_XDROP(sc);
2554 	}
2555 	if (sc->sc_mac_nat_bif != NULL) {
2556 		if (bif == sc->sc_mac_nat_bif) {
2557 			bridge_mac_nat_disable(sc);
2558 		} else {
2559 			bridge_mac_nat_flush_entries(sc, bif);
2560 		}
2561 	}
2562 #if BRIDGESTP
2563 	if ((bif->bif_ifflags & IFBIF_STP) != 0) {
2564 		bstp_disable(&bif->bif_stp);
2565 	}
2566 #endif /* BRIDGESTP */
2567 
2568 	/*
2569 	 * If removing the interface that gave the bridge its mac address, set
2570 	 * the mac address of the bridge to the address of the next member, or
2571 	 * to its default address if no members are left.
2572 	 */
2573 	if (bridge_inherit_mac && sc->sc_ifaddr == ifs) {
2574 		ifnet_release(sc->sc_ifaddr);
2575 		if (TAILQ_EMPTY(&sc->sc_iflist)) {
2576 			bcopy(sc->sc_defaddr, eaddr, ETHER_ADDR_LEN);
2577 			sc->sc_ifaddr = NULL;
2578 		} else {
2579 			struct ifnet *fif =
2580 			    TAILQ_FIRST(&sc->sc_iflist)->bif_ifp;
2581 			bcopy(IF_LLADDR(fif), eaddr, ETHER_ADDR_LEN);
2582 			sc->sc_ifaddr = fif;
2583 			ifnet_reference(fif);   /* for sc_ifaddr */
2584 		}
2585 		lladdr_changed = 1;
2586 	}
2587 
2588 #if HAS_IF_CAP
2589 	bridge_mutecaps(sc);    /* recalculate now this interface is removed */
2590 #endif /* HAS_IF_CAP */
2591 
2592 	error = bridge_set_tso(sc);
2593 	if (error != 0) {
2594 		BRIDGE_LOG(LOG_NOTICE, 0, "bridge_set_tso failed %d", error);
2595 	}
2596 
2597 	bridge_rtdelete(sc, ifs, IFBF_FLUSHALL);
2598 
2599 	KASSERT(bif->bif_addrcnt == 0,
2600 	    ("%s: %d bridge routes referenced", __func__, bif->bif_addrcnt));
2601 
2602 	/*
2603 	 * Update link status of the bridge based on its remaining members
2604 	 */
2605 	event_code = bridge_updatelinkstatus(sc);
2606 	bif_flags = bif->bif_flags;
2607 	BRIDGE_UNLOCK(sc);
2608 
2609 	/* only perform these steps if the interface is still attached */
2610 	if (ifnet_is_attached(ifs, 1)) {
2611 #if SKYWALK
2612 		add_netagent = (bif_flags & BIFF_NETAGENT_REMOVED) != 0;
2613 
2614 		if ((bif_flags & BIFF_FLOWSWITCH_ATTACHED) != 0) {
2615 			ifnet_detach_flowswitch_nexus(ifs);
2616 		}
2617 #endif /* SKYWALK */
2618 		/* disable promiscuous mode */
2619 		if ((bif_flags & BIFF_PROMISC) != 0) {
2620 			(void) ifnet_set_promiscuous(ifs, 0);
2621 		}
2622 		/* disable all multi */
2623 		if ((bif_flags & BIFF_ALL_MULTI) != 0) {
2624 			(void)if_allmulti(ifs, 0);
2625 		}
2626 #if HAS_IF_CAP
2627 		/* re-enable any interface capabilities */
2628 		bridge_set_ifcap(sc, bif, bif->bif_savedcaps);
2629 #endif
2630 		/* detach bridge "protocol" */
2631 		if ((bif_flags & BIFF_PROTO_ATTACHED) != 0) {
2632 			(void)bridge_detach_protocol(ifs);
2633 		}
2634 		/* detach interface filter */
2635 		if ((bif_flags & BIFF_FILTER_ATTACHED) != 0) {
2636 			iflt_detach(bif->bif_iff_ref);
2637 		}
2638 		/* re-enable LRO */
2639 		if ((bif_flags & BIFF_LRO_DISABLED) != 0) {
2640 			(void)bridge_set_lro(ifs, TRUE);
2641 		}
2642 		ifnet_decr_iorefcnt(ifs);
2643 	}
2644 
2645 	if (lladdr_changed &&
2646 	    (error = ifnet_set_lladdr(bifp, eaddr, ETHER_ADDR_LEN)) != 0) {
2647 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_lladdr failed %d", error);
2648 	}
2649 
2650 	if (event_code != 0) {
2651 		bridge_link_event(bifp, event_code);
2652 	}
2653 
2654 #if BRIDGESTP
2655 	bstp_destroy(&bif->bif_stp);    /* prepare to free */
2656 #endif /* BRIDGESTP */
2657 
2658 	kfree_type(struct bridge_iflist, bif);
2659 	ifs->if_bridge = NULL;
2660 #if SKYWALK
2661 	if (add_netagent && ifnet_is_attached(ifs, 1)) {
2662 		(void)ifnet_add_netagent(ifs);
2663 		ifnet_decr_iorefcnt(ifs);
2664 	}
2665 #endif /* SKYWALK */
2666 
2667 	ifnet_release(ifs);
2668 
2669 	BRIDGE_LOCK(sc);
2670 }
2671 
2672 /*
2673  * bridge_delete_span:
2674  *
2675  *	Delete the specified span interface.
2676  */
2677 static void
bridge_delete_span(struct bridge_softc * sc,struct bridge_iflist * bif)2678 bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
2679 {
2680 	BRIDGE_LOCK_ASSERT_HELD(sc);
2681 
2682 	KASSERT(bif->bif_ifp->if_bridge == NULL,
2683 	    ("%s: not a span interface", __func__));
2684 
2685 	ifnet_release(bif->bif_ifp);
2686 
2687 	TAILQ_REMOVE(&sc->sc_spanlist, bif, bif_next);
2688 	kfree_type(struct bridge_iflist, bif);
2689 }
2690 
2691 static int
bridge_ioctl_add(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)2692 bridge_ioctl_add(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
2693 {
2694 	struct ifbreq * __single req = arg;
2695 	struct bridge_iflist *bif = NULL;
2696 	struct ifnet *ifs, *bifp = sc->sc_ifp;
2697 	int error = 0, lladdr_changed = 0;
2698 	uint8_t eaddr[ETHER_ADDR_LEN];
2699 	struct iff_filter iff;
2700 	u_int32_t event_code = 0;
2701 	boolean_t input_broadcast;
2702 	int media_active;
2703 	boolean_t wifi_infra = FALSE;
2704 
2705 	ifs = ifunit(sanitize_ifname(req->ifbr_ifsname));
2706 	if (ifs == NULL) {
2707 		return ENOENT;
2708 	}
2709 	if (ifs->if_ioctl == NULL) {    /* must be supported */
2710 		return EINVAL;
2711 	}
2712 
2713 	if (IFNET_IS_INTCOPROC(ifs) || IFNET_IS_MANAGEMENT(ifs)) {
2714 		return EINVAL;
2715 	}
2716 
2717 	/* If it's in the span list, it can't be a member. */
2718 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
2719 		if (ifs == bif->bif_ifp) {
2720 			return EBUSY;
2721 		}
2722 	}
2723 
2724 	if (ifs->if_bridge == sc) {
2725 		return EEXIST;
2726 	}
2727 
2728 	if (ifs->if_bridge != NULL) {
2729 		return EBUSY;
2730 	}
2731 
2732 	switch (ifs->if_type) {
2733 	case IFT_ETHER:
2734 		if (strcmp(ifs->if_name, "en") == 0 &&
2735 		    ifs->if_subfamily == IFNET_SUBFAMILY_WIFI &&
2736 		    (ifs->if_eflags & IFEF_IPV4_ROUTER) == 0) {
2737 			/* XXX is there a better way to identify Wi-Fi STA? */
2738 			wifi_infra = TRUE;
2739 		}
2740 		break;
2741 	case IFT_L2VLAN:
2742 	case IFT_IEEE8023ADLAG:
2743 		break;
2744 	default:
2745 		return EINVAL;
2746 	}
2747 
2748 	/* fail to add the interface if the MTU doesn't match */
2749 	if (!TAILQ_EMPTY(&sc->sc_iflist) && sc->sc_ifp->if_mtu != ifs->if_mtu) {
2750 		BRIDGE_LOG(LOG_NOTICE, 0, "%s invalid MTU for %s",
2751 		    sc->sc_ifp->if_xname,
2752 		    ifs->if_xname);
2753 		return EINVAL;
2754 	}
2755 
2756 	if (wifi_infra && sc->sc_mac_nat_bif != NULL) {
2757 		/* there's already an interface that's doing MAC NAT */
2758 		return EBUSY;
2759 	}
2760 
2761 	/* prevent the interface from detaching while we add the member */
2762 	if (!ifnet_is_attached(ifs, 1)) {
2763 		return ENXIO;
2764 	}
2765 
2766 	/* allocate a new member */
2767 	bif = kalloc_type(struct bridge_iflist, Z_WAITOK | Z_ZERO | Z_NOFAIL);
2768 	bif->bif_ifp = ifs;
2769 	ifnet_reference(ifs);
2770 	bif->bif_ifflags |= IFBIF_LEARNING | IFBIF_DISCOVER;
2771 #if HAS_IF_CAP
2772 	bif->bif_savedcaps = ifs->if_capenable;
2773 #endif /* HAS_IF_CAP */
2774 	bif->bif_sc = sc;
2775 	if (wifi_infra) {
2776 		(void)bridge_mac_nat_enable(sc, bif);
2777 	}
2778 
2779 	/* Allow the first Ethernet member to define the MTU */
2780 	if (TAILQ_EMPTY(&sc->sc_iflist)) {
2781 		sc->sc_ifp->if_mtu = ifs->if_mtu;
2782 	}
2783 
2784 	/*
2785 	 * Assign the interface's MAC address to the bridge if it's the first
2786 	 * member and the MAC address of the bridge has not been changed from
2787 	 * the default (randomly) generated one.
2788 	 */
2789 	if (bridge_inherit_mac && TAILQ_EMPTY(&sc->sc_iflist) &&
2790 	    _ether_cmp(IF_LLADDR(sc->sc_ifp), sc->sc_defaddr) == 0) {
2791 		bcopy(IF_LLADDR(ifs), eaddr, ETHER_ADDR_LEN);
2792 		sc->sc_ifaddr = ifs;
2793 		ifnet_reference(ifs);   /* for sc_ifaddr */
2794 		lladdr_changed = 1;
2795 	}
2796 
2797 	ifs->if_bridge = sc;
2798 #if BRIDGESTP
2799 	bstp_create(&sc->sc_stp, &bif->bif_stp, bif->bif_ifp);
2800 #endif /* BRIDGESTP */
2801 
2802 #if HAS_IF_CAP
2803 	/* Set interface capabilities to the intersection set of all members */
2804 	bridge_mutecaps(sc);
2805 #endif /* HAS_IF_CAP */
2806 
2807 	/*
2808 	 * Respect lock ordering with DLIL lock for the following operations
2809 	 */
2810 	BRIDGE_UNLOCK(sc);
2811 
2812 	/* enable promiscuous mode */
2813 	error = ifnet_set_promiscuous(ifs, 1);
2814 	switch (error) {
2815 	case 0:
2816 		bif->bif_flags |= BIFF_PROMISC;
2817 		break;
2818 	case ENETDOWN:
2819 	case EPWROFF:
2820 		BRIDGE_LOG(LOG_NOTICE, 0,
2821 		    "ifnet_set_promiscuous(%s) failed %d, ignoring",
2822 		    ifs->if_xname, error);
2823 		/* Ignore error when device is not up */
2824 		error = 0;
2825 		break;
2826 	default:
2827 		BRIDGE_LOG(LOG_NOTICE, 0,
2828 		    "ifnet_set_promiscuous(%s) failed %d",
2829 		    ifs->if_xname, error);
2830 		BRIDGE_LOCK(sc);
2831 		goto out;
2832 	}
2833 	if (wifi_infra) {
2834 		int this_error;
2835 
2836 		/* Wi-Fi doesn't really support promiscuous, set allmulti */
2837 		bif->bif_flags |= BIFF_WIFI_INFRA;
2838 		this_error = if_allmulti(ifs, 1);
2839 		if (this_error == 0) {
2840 			bif->bif_flags |= BIFF_ALL_MULTI;
2841 #ifdef XNU_PLATFORM_AppleTVOS
2842 			ip6_forwarding = 1;
2843 #endif /* XNU_PLATFORM_AppleTVOS */
2844 		} else {
2845 			BRIDGE_LOG(LOG_NOTICE, 0,
2846 			    "if_allmulti(%s) failed %d, ignoring",
2847 			    ifs->if_xname, this_error);
2848 		}
2849 	}
2850 #if SKYWALK
2851 	/* ensure that the flowswitch is present for native interface */
2852 	if (SKYWALK_NATIVE(ifs)) {
2853 		if (ifnet_attach_flowswitch_nexus(ifs)) {
2854 			bif->bif_flags |= BIFF_FLOWSWITCH_ATTACHED;
2855 		}
2856 	}
2857 	/* remove the netagent on the flowswitch (rdar://75050182) */
2858 	if (if_is_fsw_netagent_enabled()) {
2859 		(void)ifnet_remove_netagent(ifs);
2860 		bif->bif_flags |= BIFF_NETAGENT_REMOVED;
2861 	}
2862 #endif /* SKYWALK */
2863 
2864 	/*
2865 	 * install an interface filter
2866 	 */
2867 	memset(&iff, 0, sizeof(struct iff_filter));
2868 	iff.iff_cookie = bif;
2869 	iff.iff_name = "com.apple.kernel.bsd.net.if_bridge";
2870 	iff.iff_input = bridge_iff_input;
2871 	iff.iff_output = bridge_iff_output;
2872 	iff.iff_event = bridge_iff_event;
2873 	iff.iff_detached = bridge_iff_detached;
2874 	error = dlil_attach_filter(ifs, &iff, &bif->bif_iff_ref,
2875 	    DLIL_IFF_TSO | DLIL_IFF_INTERNAL | DLIL_IFF_BRIDGE);
2876 	if (error != 0) {
2877 		BRIDGE_LOG(LOG_NOTICE, 0, "iflt_attach failed %d", error);
2878 		BRIDGE_LOCK(sc);
2879 		goto out;
2880 	}
2881 	bif->bif_flags |= BIFF_FILTER_ATTACHED;
2882 
2883 	/*
2884 	 * install a dummy "bridge" protocol
2885 	 */
2886 	if ((error = bridge_attach_protocol(ifs)) != 0) {
2887 		if (error != 0) {
2888 			BRIDGE_LOG(LOG_NOTICE, 0,
2889 			    "bridge_attach_protocol failed %d", error);
2890 			BRIDGE_LOCK(sc);
2891 			goto out;
2892 		}
2893 	}
2894 	bif->bif_flags |= BIFF_PROTO_ATTACHED;
2895 
2896 	if (lladdr_changed &&
2897 	    (error = ifnet_set_lladdr(bifp, eaddr, ETHER_ADDR_LEN)) != 0) {
2898 		BRIDGE_LOG(LOG_NOTICE, 0, "ifnet_set_lladdr failed %d", error);
2899 	}
2900 
2901 	media_active = interface_media_active(ifs);
2902 
2903 	/* disable LRO */
2904 	if (bridge_set_lro(ifs, FALSE)) {
2905 		bif->bif_flags |= BIFF_LRO_DISABLED;
2906 	}
2907 
2908 	/*
2909 	 * No failures past this point. Add the member to the list.
2910 	 */
2911 	BRIDGE_LOCK(sc);
2912 	bif->bif_flags |= BIFF_IN_MEMBER_LIST;
2913 	BRIDGE_XLOCK(sc);
2914 	TAILQ_INSERT_TAIL(&sc->sc_iflist, bif, bif_next);
2915 	BRIDGE_XDROP(sc);
2916 
2917 	/* cache the member link status */
2918 	if (media_active != 0) {
2919 		bif->bif_flags |= BIFF_MEDIA_ACTIVE;
2920 	} else {
2921 		bif->bif_flags &= ~BIFF_MEDIA_ACTIVE;
2922 	}
2923 
2924 	/* the new member may change the link status of the bridge interface */
2925 	event_code = bridge_updatelinkstatus(sc);
2926 
2927 	/* check whether we need input broadcast or not */
2928 	input_broadcast = interface_needs_input_broadcast(ifs);
2929 	bif_set_input_broadcast(bif, input_broadcast);
2930 	BRIDGE_UNLOCK(sc);
2931 
2932 	if (event_code != 0) {
2933 		bridge_link_event(bifp, event_code);
2934 	}
2935 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE,
2936 	    "%s input broadcast %s", ifs->if_xname,
2937 	    input_broadcast ? "ENABLED" : "DISABLED");
2938 
2939 	BRIDGE_LOCK(sc);
2940 	bridge_set_tso(sc);
2941 
2942 out:
2943 	/* allow the interface to detach */
2944 	ifnet_decr_iorefcnt(ifs);
2945 
2946 	if (error != 0) {
2947 		if (bif != NULL) {
2948 			bridge_delete_member(sc, bif);
2949 		}
2950 	} else if (IFNET_IS_VMNET(ifs)) {
2951 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_vmnet_total);
2952 	}
2953 
2954 	return error;
2955 }
2956 
2957 static int
bridge_ioctl_del(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)2958 bridge_ioctl_del(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
2959 {
2960 	struct ifbreq * __single req = arg;
2961 	struct bridge_iflist *bif;
2962 
2963 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
2964 	if (bif == NULL) {
2965 		return ENOENT;
2966 	}
2967 
2968 	bridge_delete_member(sc, bif);
2969 
2970 	return 0;
2971 }
2972 
2973 static int
bridge_ioctl_purge(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)2974 bridge_ioctl_purge(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
2975 {
2976 #pragma unused(sc, arg, arg_len)
2977 	return 0;
2978 }
2979 
2980 static int
bridge_ioctl_gifflags(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)2981 bridge_ioctl_gifflags(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
2982 {
2983 	struct ifbreq * __single req = arg;
2984 	struct bridge_iflist *bif;
2985 
2986 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
2987 	if (bif == NULL) {
2988 		return ENOENT;
2989 	}
2990 
2991 	struct bstp_port *bp;
2992 
2993 	bp = &bif->bif_stp;
2994 	req->ifbr_state = bp->bp_state;
2995 	req->ifbr_priority = bp->bp_priority;
2996 	req->ifbr_path_cost = bp->bp_path_cost;
2997 	req->ifbr_proto = bp->bp_protover;
2998 	req->ifbr_role = bp->bp_role;
2999 	req->ifbr_stpflags = bp->bp_flags;
3000 	req->ifbr_ifsflags = bif->bif_ifflags;
3001 
3002 	/* Copy STP state options as flags */
3003 	if (bp->bp_operedge) {
3004 		req->ifbr_ifsflags |= IFBIF_BSTP_EDGE;
3005 	}
3006 	if (bp->bp_flags & BSTP_PORT_AUTOEDGE) {
3007 		req->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE;
3008 	}
3009 	if (bp->bp_ptp_link) {
3010 		req->ifbr_ifsflags |= IFBIF_BSTP_PTP;
3011 	}
3012 	if (bp->bp_flags & BSTP_PORT_AUTOPTP) {
3013 		req->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP;
3014 	}
3015 	if (bp->bp_flags & BSTP_PORT_ADMEDGE) {
3016 		req->ifbr_ifsflags |= IFBIF_BSTP_ADMEDGE;
3017 	}
3018 	if (bp->bp_flags & BSTP_PORT_ADMCOST) {
3019 		req->ifbr_ifsflags |= IFBIF_BSTP_ADMCOST;
3020 	}
3021 
3022 	req->ifbr_portno = bif->bif_ifp->if_index & 0xfff;
3023 	req->ifbr_addrcnt = bif->bif_addrcnt;
3024 	req->ifbr_addrmax = bif->bif_addrmax;
3025 	req->ifbr_addrexceeded = bif->bif_addrexceeded;
3026 
3027 	return 0;
3028 }
3029 
3030 static int
bridge_ioctl_sifflags(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3031 bridge_ioctl_sifflags(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3032 {
3033 	struct ifbreq * __single req = arg;
3034 	struct bridge_iflist *bif;
3035 #if BRIDGESTP
3036 	struct bstp_port *bp;
3037 #endif /* BRIDGESTP */
3038 	errno_t error;
3039 	uint32_t ifsflags;
3040 
3041 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
3042 	if (bif == NULL) {
3043 		return ENOENT;
3044 	}
3045 
3046 	ifsflags = req->ifbr_ifsflags;
3047 	if (ifsflags & IFBIF_SPAN) {
3048 		/* SPAN is readonly */
3049 		return EINVAL;
3050 	}
3051 
3052 #define CHECKSUM_OR_MAC_NAT     (IFBIF_CHECKSUM_OFFLOAD | IFBIF_MAC_NAT)
3053 	if ((ifsflags & CHECKSUM_OR_MAC_NAT) == CHECKSUM_OR_MAC_NAT) {
3054 		/* can't specify both MAC-NAT and checksum offload */
3055 		return EINVAL;
3056 	}
3057 	if ((ifsflags & IFBIF_MAC_NAT) != 0) {
3058 		if ((bif->bif_flags & BIFF_HOST_FILTER) != 0) {
3059 			/* no host filter with MAC-NAT */
3060 			return EINVAL;
3061 		}
3062 		error = bridge_mac_nat_enable(sc, bif);
3063 		if (error != 0) {
3064 			return error;
3065 		}
3066 	} else if (sc->sc_mac_nat_bif == bif) {
3067 		bridge_mac_nat_disable(sc);
3068 	}
3069 
3070 #if BRIDGESTP
3071 	if (ifsflags & IFBIF_STP) {
3072 		if ((bif->bif_ifflags & IFBIF_STP) == 0) {
3073 			error = bstp_enable(&bif->bif_stp);
3074 			if (error) {
3075 				return error;
3076 			}
3077 		}
3078 	} else {
3079 		if ((bif->bif_ifflags & IFBIF_STP) != 0) {
3080 			bstp_disable(&bif->bif_stp);
3081 		}
3082 	}
3083 
3084 	/* Pass on STP flags */
3085 	bp = &bif->bif_stp;
3086 	bstp_set_edge(bp, ifsflags & IFBIF_BSTP_EDGE ? 1 : 0);
3087 	bstp_set_autoedge(bp, ifsflags & IFBIF_BSTP_AUTOEDGE ? 1 : 0);
3088 	bstp_set_ptp(bp, ifsflags & IFBIF_BSTP_PTP ? 1 : 0);
3089 	bstp_set_autoptp(bp, ifsflags & IFBIF_BSTP_AUTOPTP ? 1 : 0);
3090 #else /* !BRIDGESTP */
3091 	if (ifsflags & IFBIF_STP) {
3092 		return EOPNOTSUPP;
3093 	}
3094 #endif /* !BRIDGESTP */
3095 
3096 	/* Save the bits relating to the bridge */
3097 	bif->bif_ifflags = ifsflags & IFBIFMASK;
3098 
3099 	return 0;
3100 }
3101 
3102 static int
bridge_ioctl_scache(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3103 bridge_ioctl_scache(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3104 {
3105 	struct ifbrparam * __single param = arg;
3106 
3107 	sc->sc_brtmax = param->ifbrp_csize;
3108 	bridge_rttrim(sc);
3109 	return 0;
3110 }
3111 
3112 static int
bridge_ioctl_gcache(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3113 bridge_ioctl_gcache(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3114 {
3115 	struct ifbrparam * __single param = arg;
3116 
3117 	param->ifbrp_csize = sc->sc_brtmax;
3118 
3119 	return 0;
3120 }
3121 
3122 #define BRIDGE_IOCTL_GIFS do { \
3123 	struct bridge_iflist *bif;                                      \
3124 	struct ifbreq breq;                                             \
3125 	char *buf, *outbuf;                                             \
3126 	unsigned int count, buflen, len;                                \
3127                                                                         \
3128 	count = 0;                                                      \
3129 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next)                    \
3130 	        count++;                                                \
3131 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)                  \
3132 	        count++;                                                \
3133                                                                         \
3134 	buflen = sizeof (breq) * count;                                 \
3135 	if (bifc->ifbic_len == 0) {                                     \
3136 	        bifc->ifbic_len = buflen;                               \
3137 	        return (0);                                             \
3138 	}                                                               \
3139 	BRIDGE_UNLOCK(sc);                                              \
3140 	outbuf = kalloc_data(buflen, Z_WAITOK | Z_ZERO);                \
3141 	BRIDGE_LOCK(sc);                                                \
3142                                                                         \
3143 	count = 0;                                                      \
3144 	buf = outbuf;                                                   \
3145 	len = min(bifc->ifbic_len, buflen);                             \
3146 	bzero(&breq, sizeof (breq));                                    \
3147 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {                  \
3148 	        if (len < sizeof (breq))                                \
3149 	                break;                                          \
3150                                                                         \
3151 	        snprintf(breq.ifbr_ifsname, sizeof (breq.ifbr_ifsname), \
3152 	            "%s", bif->bif_ifp->if_xname);                      \
3153 	/* Fill in the ifbreq structure */                      \
3154 	        error = bridge_ioctl_gifflags(sc, &breq, sizeof(breq)); \
3155 	        if (error)                                              \
3156 	                break;                                          \
3157 	        memcpy(buf, &breq, sizeof (breq));                      \
3158 	        count++;                                                \
3159 	        buf += sizeof (breq);                                   \
3160 	        len -= sizeof (breq);                                   \
3161 	}                                                               \
3162 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {                \
3163 	        if (len < sizeof (breq))                                \
3164 	                break;                                          \
3165                                                                         \
3166 	        snprintf(breq.ifbr_ifsname,                             \
3167 	                 sizeof (breq.ifbr_ifsname),                    \
3168 	                 "%s", bif->bif_ifp->if_xname);                 \
3169 	        breq.ifbr_ifsflags = bif->bif_ifflags;                  \
3170 	        breq.ifbr_portno                                        \
3171 	                = bif->bif_ifp->if_index & 0xfff;               \
3172 	        memcpy(buf, &breq, sizeof (breq));                      \
3173 	        count++;                                                \
3174 	        buf += sizeof (breq);                                   \
3175 	        len -= sizeof (breq);                                   \
3176 	}                                                               \
3177                                                                         \
3178 	BRIDGE_UNLOCK(sc);                                              \
3179 	bifc->ifbic_len = sizeof (breq) * count;                        \
3180 	if (bifc->ifbic_len > 0) {                                      \
3181 	        error = copyout(outbuf, bifc->ifbic_req, bifc->ifbic_len);\
3182 	}                                                               \
3183 	BRIDGE_LOCK(sc);                                                \
3184 	kfree_data(outbuf, buflen);                                     \
3185 } while (0)
3186 
3187 static int
bridge_ioctl_gifs64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3188 bridge_ioctl_gifs64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3189 {
3190 	struct ifbifconf64 * __single bifc = arg;
3191 	int error = 0;
3192 
3193 	BRIDGE_IOCTL_GIFS;
3194 
3195 	return error;
3196 }
3197 
3198 static int
bridge_ioctl_gifs32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3199 bridge_ioctl_gifs32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3200 {
3201 	struct ifbifconf32 * __single bifc = arg;
3202 	int error = 0;
3203 
3204 	BRIDGE_IOCTL_GIFS;
3205 
3206 	return error;
3207 }
3208 
3209 #define BRIDGE_IOCTL_RTS do {                                               \
3210 	struct bridge_rtnode *brt;                                          \
3211 	char *buf;                                                          \
3212 	char *outbuf = NULL;                                                \
3213 	unsigned int count, buflen, len;                                    \
3214 	unsigned long now;                                                  \
3215                                                                             \
3216 	if (bac->ifbac_len == 0)                                            \
3217 	        return (0);                                                 \
3218                                                                             \
3219 	bzero(&bareq, sizeof (bareq));                                      \
3220 	count = 0;                                                          \
3221 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list)                         \
3222 	        count++;                                                    \
3223 	buflen = sizeof (bareq) * count;                                    \
3224                                                                             \
3225 	BRIDGE_UNLOCK(sc);                                                  \
3226 	outbuf = kalloc_data(buflen, Z_WAITOK | Z_ZERO);                    \
3227 	BRIDGE_LOCK(sc);                                                    \
3228                                                                             \
3229 	count = 0;                                                          \
3230 	buf = outbuf;                                                       \
3231 	len = min(bac->ifbac_len, buflen);                                  \
3232 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {                       \
3233 	        if (len < sizeof (bareq))                                   \
3234 	                goto out;                                           \
3235 	        snprintf(bareq.ifba_ifsname, sizeof (bareq.ifba_ifsname),   \
3236 	                 "%s", brt->brt_ifp->if_xname);                     \
3237 	        memcpy(bareq.ifba_dst, brt->brt_addr, sizeof (brt->brt_addr)); \
3238 	        bareq.ifba_vlan = brt->brt_vlan;                            \
3239 	        if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {   \
3240 	                now = (unsigned long) net_uptime();                 \
3241 	                if (now < brt->brt_expire)                          \
3242 	                        bareq.ifba_expire =                         \
3243 	                            brt->brt_expire - now;                  \
3244 	        } else                                                      \
3245 	                bareq.ifba_expire = 0;                              \
3246 	        bareq.ifba_flags = brt->brt_flags;                          \
3247                                                                             \
3248 	        memcpy(buf, &bareq, sizeof (bareq));                        \
3249 	        count++;                                                    \
3250 	        buf += sizeof (bareq);                                      \
3251 	        len -= sizeof (bareq);                                      \
3252 	}                                                                   \
3253 out:                                                                        \
3254 	bac->ifbac_len = sizeof (bareq) * count;                            \
3255 	if (outbuf != NULL) {                                               \
3256 	        BRIDGE_UNLOCK(sc);                                          \
3257 	        if (bac->ifbac_len > 0) {                                   \
3258 	                error = copyout(outbuf, bac->ifbac_req, bac->ifbac_len);\
3259 	        }                                                           \
3260 	        kfree_data(outbuf, buflen);                                 \
3261 	        BRIDGE_LOCK(sc);                                            \
3262 	}                                                                   \
3263 	return (error);                                                     \
3264 } while (0)
3265 
3266 static int
bridge_ioctl_rts64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3267 bridge_ioctl_rts64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3268 {
3269 	struct ifbaconf64 * __single bac = arg;
3270 	struct ifbareq64 bareq;
3271 	int error = 0;
3272 
3273 	BRIDGE_IOCTL_RTS;
3274 	return error;
3275 }
3276 
3277 static int
bridge_ioctl_rts32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3278 bridge_ioctl_rts32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3279 {
3280 	struct ifbaconf32 * __single bac = arg;
3281 	struct ifbareq32 bareq;
3282 	int error = 0;
3283 
3284 	BRIDGE_IOCTL_RTS;
3285 	return error;
3286 }
3287 
3288 static int
bridge_ioctl_saddr32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3289 bridge_ioctl_saddr32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3290 {
3291 	struct ifbareq32 * __single req = arg;
3292 	struct bridge_iflist *bif;
3293 	int error;
3294 
3295 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
3296 	if (bif == NULL) {
3297 		return ENOENT;
3298 	}
3299 
3300 	error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
3301 	    req->ifba_flags);
3302 
3303 	return error;
3304 }
3305 
3306 static int
bridge_ioctl_saddr64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3307 bridge_ioctl_saddr64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3308 {
3309 	struct ifbareq64 * __single req = arg;
3310 	struct bridge_iflist *bif;
3311 	int error;
3312 
3313 	bif = bridge_lookup_member(sc, req->ifba_ifsname);
3314 	if (bif == NULL) {
3315 		return ENOENT;
3316 	}
3317 
3318 	error = bridge_rtupdate(sc, req->ifba_dst, req->ifba_vlan, bif, 1,
3319 	    req->ifba_flags);
3320 
3321 	return error;
3322 }
3323 
3324 static int
bridge_ioctl_sto(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3325 bridge_ioctl_sto(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3326 {
3327 	struct ifbrparam * __single param = arg;
3328 
3329 	sc->sc_brttimeout = param->ifbrp_ctime;
3330 	return 0;
3331 }
3332 
3333 static int
bridge_ioctl_gto(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3334 bridge_ioctl_gto(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3335 {
3336 	struct ifbrparam * __single param = arg;
3337 
3338 	param->ifbrp_ctime = sc->sc_brttimeout;
3339 	return 0;
3340 }
3341 
3342 static int
bridge_ioctl_daddr32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3343 bridge_ioctl_daddr32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3344 {
3345 	struct ifbareq32 * __single req = arg;
3346 
3347 	return bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan);
3348 }
3349 
3350 static int
bridge_ioctl_daddr64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3351 bridge_ioctl_daddr64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3352 {
3353 	struct ifbareq64 * __single req = arg;
3354 
3355 	return bridge_rtdaddr(sc, req->ifba_dst, req->ifba_vlan);
3356 }
3357 
3358 static int
bridge_ioctl_flush(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3359 bridge_ioctl_flush(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3360 {
3361 	struct ifbreq * __single req = arg;
3362 
3363 	bridge_rtflush(sc, req->ifbr_ifsflags);
3364 	return 0;
3365 }
3366 
3367 static int
bridge_ioctl_gpri(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3368 bridge_ioctl_gpri(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3369 {
3370 	struct ifbrparam * __single param = arg;
3371 	struct bstp_state *bs = &sc->sc_stp;
3372 
3373 	param->ifbrp_prio = bs->bs_bridge_priority;
3374 	return 0;
3375 }
3376 
3377 static int
bridge_ioctl_spri(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3378 bridge_ioctl_spri(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3379 {
3380 #if BRIDGESTP
3381 	struct ifbrparam *param = arg;
3382 
3383 	return bstp_set_priority(&sc->sc_stp, param->ifbrp_prio);
3384 #else /* !BRIDGESTP */
3385 #pragma unused(sc, arg)
3386 	return EOPNOTSUPP;
3387 #endif /* !BRIDGESTP */
3388 }
3389 
3390 static int
bridge_ioctl_ght(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3391 bridge_ioctl_ght(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3392 {
3393 	struct ifbrparam * __single param = arg;
3394 	struct bstp_state *bs = &sc->sc_stp;
3395 
3396 	param->ifbrp_hellotime = bs->bs_bridge_htime >> 8;
3397 	return 0;
3398 }
3399 
3400 static int
bridge_ioctl_sht(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3401 bridge_ioctl_sht(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3402 {
3403 #if BRIDGESTP
3404 	struct ifbrparam *param = arg;
3405 
3406 	return bstp_set_htime(&sc->sc_stp, param->ifbrp_hellotime);
3407 #else /* !BRIDGESTP */
3408 #pragma unused(sc, arg)
3409 	return EOPNOTSUPP;
3410 #endif /* !BRIDGESTP */
3411 }
3412 
3413 static int
bridge_ioctl_gfd(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3414 bridge_ioctl_gfd(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3415 {
3416 	struct ifbrparam * __single param;
3417 	struct bstp_state *bs;
3418 
3419 	param = arg;
3420 	bs = &sc->sc_stp;
3421 	param->ifbrp_fwddelay = bs->bs_bridge_fdelay >> 8;
3422 	return 0;
3423 }
3424 
3425 static int
bridge_ioctl_sfd(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3426 bridge_ioctl_sfd(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3427 {
3428 #if BRIDGESTP
3429 	struct ifbrparam *param = arg;
3430 
3431 	return bstp_set_fdelay(&sc->sc_stp, param->ifbrp_fwddelay);
3432 #else /* !BRIDGESTP */
3433 #pragma unused(sc, arg)
3434 	return EOPNOTSUPP;
3435 #endif /* !BRIDGESTP */
3436 }
3437 
3438 static int
bridge_ioctl_gma(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3439 bridge_ioctl_gma(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3440 {
3441 	struct ifbrparam * __single param;
3442 	struct bstp_state *bs;
3443 
3444 	param = arg;
3445 	bs = &sc->sc_stp;
3446 	param->ifbrp_maxage = bs->bs_bridge_max_age >> 8;
3447 	return 0;
3448 }
3449 
3450 static int
bridge_ioctl_sma(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3451 bridge_ioctl_sma(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3452 {
3453 #if BRIDGESTP
3454 	struct ifbrparam *param = arg;
3455 
3456 	return bstp_set_maxage(&sc->sc_stp, param->ifbrp_maxage);
3457 #else /* !BRIDGESTP */
3458 #pragma unused(sc, arg)
3459 	return EOPNOTSUPP;
3460 #endif /* !BRIDGESTP */
3461 }
3462 
3463 static int
bridge_ioctl_sifprio(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3464 bridge_ioctl_sifprio(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3465 {
3466 #if BRIDGESTP
3467 	struct ifbreq *req = arg;
3468 	struct bridge_iflist *bif;
3469 
3470 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
3471 	if (bif == NULL) {
3472 		return ENOENT;
3473 	}
3474 
3475 	return bstp_set_port_priority(&bif->bif_stp, req->ifbr_priority);
3476 #else /* !BRIDGESTP */
3477 #pragma unused(sc, arg)
3478 	return EOPNOTSUPP;
3479 #endif /* !BRIDGESTP */
3480 }
3481 
3482 static int
bridge_ioctl_sifcost(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3483 bridge_ioctl_sifcost(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3484 {
3485 #if BRIDGESTP
3486 	struct ifbreq *req = arg;
3487 	struct bridge_iflist *bif;
3488 
3489 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
3490 	if (bif == NULL) {
3491 		return ENOENT;
3492 	}
3493 
3494 	return bstp_set_path_cost(&bif->bif_stp, req->ifbr_path_cost);
3495 #else /* !BRIDGESTP */
3496 #pragma unused(sc, arg)
3497 	return EOPNOTSUPP;
3498 #endif /* !BRIDGESTP */
3499 }
3500 
3501 static int
bridge_ioctl_gfilt(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3502 bridge_ioctl_gfilt(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3503 {
3504 	struct ifbrparam * __single param = arg;
3505 
3506 	param->ifbrp_filter = sc->sc_filter_flags;
3507 
3508 	return 0;
3509 }
3510 
3511 static int
bridge_ioctl_sfilt(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3512 bridge_ioctl_sfilt(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3513 {
3514 	struct ifbrparam * __single param = arg;
3515 
3516 	if (param->ifbrp_filter & ~IFBF_FILT_MASK) {
3517 		return EINVAL;
3518 	}
3519 
3520 	if (param->ifbrp_filter & IFBF_FILT_USEIPF) {
3521 		return EINVAL;
3522 	}
3523 
3524 	sc->sc_filter_flags = param->ifbrp_filter;
3525 
3526 	return 0;
3527 }
3528 
3529 static int
bridge_ioctl_sifmaxaddr(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3530 bridge_ioctl_sifmaxaddr(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3531 {
3532 	struct ifbreq * __single req = arg;
3533 	struct bridge_iflist *bif;
3534 
3535 	bif = bridge_lookup_member(sc, req->ifbr_ifsname);
3536 	if (bif == NULL) {
3537 		return ENOENT;
3538 	}
3539 
3540 	bif->bif_addrmax = req->ifbr_addrmax;
3541 	return 0;
3542 }
3543 
3544 static int
bridge_ioctl_addspan(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3545 bridge_ioctl_addspan(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3546 {
3547 	struct ifbreq * __single req = arg;
3548 	struct bridge_iflist *bif = NULL;
3549 	struct ifnet *ifs;
3550 
3551 	ifs = ifunit(sanitize_ifname(req->ifbr_ifsname));
3552 	if (ifs == NULL) {
3553 		return ENOENT;
3554 	}
3555 
3556 	if (IFNET_IS_INTCOPROC(ifs) || IFNET_IS_MANAGEMENT(ifs)) {
3557 		return EINVAL;
3558 	}
3559 
3560 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
3561 	if (ifs == bif->bif_ifp) {
3562 		return EBUSY;
3563 	}
3564 
3565 	if (ifs->if_bridge != NULL) {
3566 		return EBUSY;
3567 	}
3568 
3569 	switch (ifs->if_type) {
3570 	case IFT_ETHER:
3571 	case IFT_L2VLAN:
3572 	case IFT_IEEE8023ADLAG:
3573 		break;
3574 	default:
3575 		return EINVAL;
3576 	}
3577 
3578 	bif = kalloc_type(struct bridge_iflist, Z_WAITOK | Z_ZERO | Z_NOFAIL);
3579 
3580 	bif->bif_ifp = ifs;
3581 	bif->bif_ifflags = IFBIF_SPAN;
3582 
3583 	ifnet_reference(bif->bif_ifp);
3584 
3585 	TAILQ_INSERT_HEAD(&sc->sc_spanlist, bif, bif_next);
3586 
3587 	return 0;
3588 }
3589 
3590 static int
bridge_ioctl_delspan(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3591 bridge_ioctl_delspan(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3592 {
3593 	struct ifbreq * __single req = arg;
3594 	struct bridge_iflist *bif;
3595 	struct ifnet *ifs;
3596 
3597 	ifs = ifunit(sanitize_ifname(req->ifbr_ifsname));
3598 	if (ifs == NULL) {
3599 		return ENOENT;
3600 	}
3601 
3602 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next)
3603 	if (ifs == bif->bif_ifp) {
3604 		break;
3605 	}
3606 
3607 	if (bif == NULL) {
3608 		return ENOENT;
3609 	}
3610 
3611 	bridge_delete_span(sc, bif);
3612 
3613 	return 0;
3614 }
3615 
3616 #define BRIDGE_IOCTL_GBPARAM do {                                       \
3617 	struct bstp_state *bs = &sc->sc_stp;                            \
3618 	struct bstp_port *root_port;                                    \
3619                                                                         \
3620 	req->ifbop_maxage = bs->bs_bridge_max_age >> 8;                 \
3621 	req->ifbop_hellotime = bs->bs_bridge_htime >> 8;                \
3622 	req->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;                \
3623                                                                         \
3624 	root_port = bs->bs_root_port;                                   \
3625 	if (root_port == NULL)                                          \
3626 	        req->ifbop_root_port = 0;                               \
3627 	else                                                            \
3628 	        req->ifbop_root_port = root_port->bp_ifp->if_index;     \
3629                                                                         \
3630 	req->ifbop_holdcount = bs->bs_txholdcount;                      \
3631 	req->ifbop_priority = bs->bs_bridge_priority;                   \
3632 	req->ifbop_protocol = bs->bs_protover;                          \
3633 	req->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;             \
3634 	req->ifbop_bridgeid = bs->bs_bridge_pv.pv_dbridge_id;           \
3635 	req->ifbop_designated_root = bs->bs_root_pv.pv_root_id;         \
3636 	req->ifbop_designated_bridge = bs->bs_root_pv.pv_dbridge_id;    \
3637 	req->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;    \
3638 	req->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;  \
3639 } while (0)
3640 
3641 static int
bridge_ioctl_gbparam32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3642 bridge_ioctl_gbparam32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3643 {
3644 	struct ifbropreq32 * __single req = arg;
3645 
3646 	BRIDGE_IOCTL_GBPARAM;
3647 	return 0;
3648 }
3649 
3650 static int
bridge_ioctl_gbparam64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3651 bridge_ioctl_gbparam64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3652 {
3653 	struct ifbropreq64 * __single req = arg;
3654 
3655 	BRIDGE_IOCTL_GBPARAM;
3656 	return 0;
3657 }
3658 
3659 static int
bridge_ioctl_grte(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3660 bridge_ioctl_grte(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3661 {
3662 	struct ifbrparam * __single param = arg;
3663 
3664 	param->ifbrp_cexceeded = sc->sc_brtexceeded;
3665 	return 0;
3666 }
3667 
3668 #define BRIDGE_IOCTL_GIFSSTP do {                                       \
3669 	struct bridge_iflist *bif;                                      \
3670 	struct bstp_port *bp;                                           \
3671 	struct ifbpstpreq bpreq;                                        \
3672 	char *buf, *outbuf;                                             \
3673 	unsigned int count, buflen, len;                                \
3674                                                                         \
3675 	count = 0;                                                      \
3676 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {                  \
3677 	        if ((bif->bif_ifflags & IFBIF_STP) != 0)                \
3678 	                count++;                                        \
3679 	}                                                               \
3680                                                                         \
3681 	buflen = sizeof (bpreq) * count;                                \
3682 	if (bifstp->ifbpstp_len == 0) {                                 \
3683 	        bifstp->ifbpstp_len = buflen;                           \
3684 	        return (0);                                             \
3685 	}                                                               \
3686                                                                         \
3687 	BRIDGE_UNLOCK(sc);                                              \
3688 	outbuf = kalloc_data(buflen, Z_WAITOK | Z_ZERO);                \
3689 	BRIDGE_LOCK(sc);                                                \
3690                                                                         \
3691 	count = 0;                                                      \
3692 	buf = outbuf;                                                   \
3693 	len = min(bifstp->ifbpstp_len, buflen);                         \
3694 	bzero(&bpreq, sizeof (bpreq));                                  \
3695 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {                  \
3696 	        if (len < sizeof (bpreq))                               \
3697 	                break;                                          \
3698                                                                         \
3699 	        if ((bif->bif_ifflags & IFBIF_STP) == 0)                \
3700 	                continue;                                       \
3701                                                                         \
3702 	        bp = &bif->bif_stp;                                     \
3703 	        bpreq.ifbp_portno = bif->bif_ifp->if_index & 0xfff;     \
3704 	        bpreq.ifbp_fwd_trans = bp->bp_forward_transitions;      \
3705 	        bpreq.ifbp_design_cost = bp->bp_desg_pv.pv_cost;        \
3706 	        bpreq.ifbp_design_port = bp->bp_desg_pv.pv_port_id;     \
3707 	        bpreq.ifbp_design_bridge = bp->bp_desg_pv.pv_dbridge_id; \
3708 	        bpreq.ifbp_design_root = bp->bp_desg_pv.pv_root_id;     \
3709                                                                         \
3710 	        memcpy(buf, &bpreq, sizeof (bpreq));                    \
3711 	        count++;                                                \
3712 	        buf += sizeof (bpreq);                                  \
3713 	        len -= sizeof (bpreq);                                  \
3714 	}                                                               \
3715                                                                         \
3716 	BRIDGE_UNLOCK(sc);                                              \
3717 	bifstp->ifbpstp_len = sizeof (bpreq) * count;                   \
3718 	if (bifstp->ifbpstp_len > 0) {                                  \
3719 	        error = copyout(outbuf, bifstp->ifbpstp_req, bifstp->ifbpstp_len);\
3720 	}                                                               \
3721 	BRIDGE_LOCK(sc);                                                \
3722 	kfree_data(outbuf, buflen);                                     \
3723 	return (error);                                                 \
3724 } while (0)
3725 
3726 static int
bridge_ioctl_gifsstp32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3727 bridge_ioctl_gifsstp32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3728 {
3729 	struct ifbpstpconf32 * __single bifstp = arg;
3730 	int error = 0;
3731 
3732 	BRIDGE_IOCTL_GIFSSTP;
3733 	return error;
3734 }
3735 
3736 static int
bridge_ioctl_gifsstp64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3737 bridge_ioctl_gifsstp64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3738 {
3739 	struct ifbpstpconf64 * __single bifstp = arg;
3740 	int error = 0;
3741 
3742 	BRIDGE_IOCTL_GIFSSTP;
3743 	return error;
3744 }
3745 
3746 static int
bridge_ioctl_sproto(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3747 bridge_ioctl_sproto(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3748 {
3749 #if BRIDGESTP
3750 	struct ifbrparam *param = arg;
3751 
3752 	return bstp_set_protocol(&sc->sc_stp, param->ifbrp_proto);
3753 #else /* !BRIDGESTP */
3754 #pragma unused(sc, arg)
3755 	return EOPNOTSUPP;
3756 #endif /* !BRIDGESTP */
3757 }
3758 
3759 static int
bridge_ioctl_stxhc(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3760 bridge_ioctl_stxhc(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3761 {
3762 #if BRIDGESTP
3763 	struct ifbrparam *param = arg;
3764 
3765 	return bstp_set_holdcount(&sc->sc_stp, param->ifbrp_txhc);
3766 #else /* !BRIDGESTP */
3767 #pragma unused(sc, arg)
3768 	return EOPNOTSUPP;
3769 #endif /* !BRIDGESTP */
3770 }
3771 
3772 
3773 static int
bridge_ioctl_ghostfilter(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3774 bridge_ioctl_ghostfilter(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3775 {
3776 	struct ifbrhostfilter * __single req = arg;
3777 	struct bridge_iflist *bif;
3778 
3779 	bif = bridge_lookup_member(sc, req->ifbrhf_ifsname);
3780 	if (bif == NULL) {
3781 		return ENOENT;
3782 	}
3783 
3784 	bzero(req, sizeof(struct ifbrhostfilter));
3785 	if (bif->bif_flags & BIFF_HOST_FILTER) {
3786 		req->ifbrhf_flags |= IFBRHF_ENABLED;
3787 		bcopy(bif->bif_hf_hwsrc, req->ifbrhf_hwsrca,
3788 		    ETHER_ADDR_LEN);
3789 		req->ifbrhf_ipsrc = bif->bif_hf_ipsrc.s_addr;
3790 	}
3791 	return 0;
3792 }
3793 
3794 static int
bridge_ioctl_shostfilter(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3795 bridge_ioctl_shostfilter(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3796 {
3797 	struct ifbrhostfilter * __single req = arg;
3798 	struct bridge_iflist *bif;
3799 
3800 	bif = bridge_lookup_member(sc, req->ifbrhf_ifsname);
3801 	if (bif == NULL) {
3802 		return ENOENT;
3803 	}
3804 	if (bif_has_mac_nat(bif)) {
3805 		/* no host filter with MAC-NAT */
3806 		return EINVAL;
3807 	}
3808 	if (req->ifbrhf_flags & IFBRHF_ENABLED) {
3809 		bif->bif_flags |= BIFF_HOST_FILTER;
3810 
3811 		if (req->ifbrhf_flags & IFBRHF_HWSRC) {
3812 			bcopy(req->ifbrhf_hwsrca, bif->bif_hf_hwsrc,
3813 			    ETHER_ADDR_LEN);
3814 			if (bcmp(req->ifbrhf_hwsrca, ethernulladdr,
3815 			    ETHER_ADDR_LEN) != 0) {
3816 				bif->bif_flags |= BIFF_HF_HWSRC;
3817 			} else {
3818 				bif->bif_flags &= ~BIFF_HF_HWSRC;
3819 			}
3820 		}
3821 		if (req->ifbrhf_flags & IFBRHF_IPSRC) {
3822 			bif->bif_hf_ipsrc.s_addr = req->ifbrhf_ipsrc;
3823 			if (bif->bif_hf_ipsrc.s_addr != INADDR_ANY) {
3824 				bif->bif_flags |= BIFF_HF_IPSRC;
3825 			} else {
3826 				bif->bif_flags &= ~BIFF_HF_IPSRC;
3827 			}
3828 		}
3829 	} else {
3830 		bif->bif_flags &= ~(BIFF_HOST_FILTER | BIFF_HF_HWSRC |
3831 		    BIFF_HF_IPSRC);
3832 		bzero(bif->bif_hf_hwsrc, ETHER_ADDR_LEN);
3833 		bif->bif_hf_ipsrc.s_addr = INADDR_ANY;
3834 	}
3835 
3836 	return 0;
3837 }
3838 
3839 static char *__indexable
bridge_mac_nat_entry_out(struct mac_nat_entry_list * list,unsigned int * count_p,char * __indexable buf,unsigned int * len_p)3840 bridge_mac_nat_entry_out(struct mac_nat_entry_list * list,
3841     unsigned int * count_p, char *__indexable buf,
3842     unsigned int * len_p)
3843 {
3844 	unsigned int            count = *count_p;
3845 	struct ifbrmne          ifbmne;
3846 	unsigned int            len = *len_p;
3847 	struct mac_nat_entry    *mne;
3848 	unsigned long           now;
3849 
3850 	bzero(&ifbmne, sizeof(ifbmne));
3851 	LIST_FOREACH(mne, list, mne_list) {
3852 		if (len < sizeof(ifbmne)) {
3853 			break;
3854 		}
3855 		snprintf(ifbmne.ifbmne_ifname, sizeof(ifbmne.ifbmne_ifname),
3856 		    "%s", mne->mne_bif->bif_ifp->if_xname);
3857 		memcpy(ifbmne.ifbmne_mac, mne->mne_mac,
3858 		    sizeof(ifbmne.ifbmne_mac));
3859 		now = (unsigned long) net_uptime();
3860 		if (now < mne->mne_expire) {
3861 			ifbmne.ifbmne_expire = mne->mne_expire - now;
3862 		} else {
3863 			ifbmne.ifbmne_expire = 0;
3864 		}
3865 		if ((mne->mne_flags & MNE_FLAGS_IPV6) != 0) {
3866 			ifbmne.ifbmne_af = AF_INET6;
3867 			ifbmne.ifbmne_ip6_addr = mne->mne_ip6;
3868 		} else {
3869 			ifbmne.ifbmne_af = AF_INET;
3870 			ifbmne.ifbmne_ip_addr = mne->mne_ip;
3871 		}
3872 		memcpy(buf, &ifbmne, sizeof(ifbmne));
3873 		count++;
3874 		buf += sizeof(ifbmne);
3875 		len -= sizeof(ifbmne);
3876 	}
3877 	*count_p = count;
3878 	*len_p = len;
3879 	return buf;
3880 }
3881 
3882 /*
3883  * bridge_ioctl_gmnelist()
3884  *   Perform the get mac_nat_entry list ioctl.
3885  *
3886  * Note:
3887  *   The struct ifbrmnelist32 and struct ifbrmnelist64 have the same
3888  *   field size/layout except for the last field ifbml_buf, the user-supplied
3889  *   buffer pointer. That is passed in separately via the 'user_addr'
3890  *   parameter from the respective 32-bit or 64-bit ioctl routine.
3891  */
3892 static int
bridge_ioctl_gmnelist(struct bridge_softc * sc,struct ifbrmnelist32 * mnl,user_addr_t user_addr)3893 bridge_ioctl_gmnelist(struct bridge_softc *sc, struct ifbrmnelist32 *mnl,
3894     user_addr_t user_addr)
3895 {
3896 	unsigned int            count;
3897 	char                    *buf;
3898 	int                     error = 0;
3899 	char                    *outbuf = NULL;
3900 	struct mac_nat_entry    *mne;
3901 	unsigned int            buflen;
3902 	unsigned int            len;
3903 
3904 	mnl->ifbml_elsize = sizeof(struct ifbrmne);
3905 	count = 0;
3906 	LIST_FOREACH(mne, &sc->sc_mne_list, mne_list) {
3907 		count++;
3908 	}
3909 	LIST_FOREACH(mne, &sc->sc_mne_list_v6, mne_list) {
3910 		count++;
3911 	}
3912 	buflen = sizeof(struct ifbrmne) * count;
3913 	if (buflen == 0 || mnl->ifbml_len == 0) {
3914 		mnl->ifbml_len = buflen;
3915 		return error;
3916 	}
3917 	BRIDGE_UNLOCK(sc);
3918 	outbuf = kalloc_data(buflen, Z_WAITOK | Z_ZERO);
3919 	BRIDGE_LOCK(sc);
3920 	count = 0;
3921 	buf = outbuf;
3922 	len = min(mnl->ifbml_len, buflen);
3923 	buf = bridge_mac_nat_entry_out(&sc->sc_mne_list, &count, buf, &len);
3924 	buf = bridge_mac_nat_entry_out(&sc->sc_mne_list_v6, &count, buf, &len);
3925 	mnl->ifbml_len = count * sizeof(struct ifbrmne);
3926 	BRIDGE_UNLOCK(sc);
3927 	if (mnl->ifbml_len > 0) {
3928 		error = copyout(outbuf, user_addr, mnl->ifbml_len);
3929 	}
3930 	kfree_data(outbuf, buflen);
3931 	BRIDGE_LOCK(sc);
3932 	return error;
3933 }
3934 
3935 static int
bridge_ioctl_gmnelist64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3936 bridge_ioctl_gmnelist64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3937 {
3938 	struct ifbrmnelist64 * __single mnl = arg;
3939 
3940 	return bridge_ioctl_gmnelist(sc, arg, mnl->ifbml_buf);
3941 }
3942 
3943 static int
bridge_ioctl_gmnelist32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3944 bridge_ioctl_gmnelist32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3945 {
3946 	struct ifbrmnelist32 * __single mnl = arg;
3947 
3948 	return bridge_ioctl_gmnelist(sc, arg,
3949 	           CAST_USER_ADDR_T(mnl->ifbml_buf));
3950 }
3951 
3952 /*
3953  * bridge_ioctl_gifstats()
3954  *   Return per-member stats.
3955  *
3956  * Note:
3957  *   The ifbrmreq32 and ifbrmreq64 structures have the same
3958  *   field size/layout except for the last field brmr_buf, the user-supplied
3959  *   buffer pointer. That is passed in separately via the 'user_addr'
3960  *   parameter from the respective 32-bit or 64-bit ioctl routine.
3961  */
3962 static int
bridge_ioctl_gifstats(struct bridge_softc * sc,struct ifbrmreq32 * mreq,user_addr_t user_addr)3963 bridge_ioctl_gifstats(struct bridge_softc *sc, struct ifbrmreq32 *mreq,
3964     user_addr_t user_addr)
3965 {
3966 	struct bridge_iflist    *bif;
3967 	int                     error = 0;
3968 	unsigned int            buflen;
3969 
3970 	bif = bridge_lookup_member(sc, mreq->brmr_ifname);
3971 	if (bif == NULL) {
3972 		error = ENOENT;
3973 		goto done;
3974 	}
3975 
3976 	buflen = mreq->brmr_elsize = sizeof(struct ifbrmstats);
3977 	if (buflen == 0 || mreq->brmr_len == 0) {
3978 		mreq->brmr_len = buflen;
3979 		goto done;
3980 	}
3981 	if (mreq->brmr_len != 0 && mreq->brmr_len < buflen) {
3982 		error = ENOBUFS;
3983 		goto done;
3984 	}
3985 	mreq->brmr_len = buflen;
3986 	error = copyout(&bif->bif_stats, user_addr, buflen);
3987 done:
3988 	return error;
3989 }
3990 
3991 static int
bridge_ioctl_gifstats32(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)3992 bridge_ioctl_gifstats32(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
3993 {
3994 	struct ifbrmreq32 * __single mreq = arg;
3995 
3996 	return bridge_ioctl_gifstats(sc, arg, mreq->brmr_buf);
3997 }
3998 
3999 static int
bridge_ioctl_gifstats64(struct bridge_softc * sc,void * __sized_by (arg_len)arg,size_t arg_len __unused)4000 bridge_ioctl_gifstats64(struct bridge_softc *sc, void *__sized_by(arg_len) arg, size_t arg_len __unused)
4001 {
4002 	struct ifbrmreq64 * __single mreq = arg;
4003 
4004 	return bridge_ioctl_gifstats(sc, arg, mreq->brmr_buf);
4005 }
4006 
4007 /*
4008  * bridge_proto_attach_changed
4009  *
4010  *	Called when protocol attachment on the interface changes.
4011  */
4012 static void
bridge_proto_attach_changed(struct ifnet * ifp)4013 bridge_proto_attach_changed(struct ifnet *ifp)
4014 {
4015 	boolean_t changed = FALSE;
4016 	struct bridge_iflist *bif;
4017 	boolean_t input_broadcast;
4018 	struct bridge_softc * __single sc = ifp->if_bridge;
4019 
4020 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE, "%s", ifp->if_xname);
4021 	if (sc == NULL) {
4022 		return;
4023 	}
4024 	input_broadcast = interface_needs_input_broadcast(ifp);
4025 	BRIDGE_LOCK(sc);
4026 	bif = bridge_lookup_member_if(sc, ifp);
4027 	if (bif != NULL) {
4028 		changed = bif_set_input_broadcast(bif, input_broadcast);
4029 	}
4030 	BRIDGE_UNLOCK(sc);
4031 	if (changed) {
4032 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE,
4033 		    "%s input broadcast %s", ifp->if_xname,
4034 		    input_broadcast ? "ENABLED" : "DISABLED");
4035 	}
4036 	return;
4037 }
4038 
4039 /*
4040  * interface_media_active:
4041  *
4042  *	Tells if an interface media is active.
4043  */
4044 static int
interface_media_active(struct ifnet * ifp)4045 interface_media_active(struct ifnet *ifp)
4046 {
4047 	struct ifmediareq   ifmr;
4048 	int status = 0;
4049 
4050 	bzero(&ifmr, sizeof(ifmr));
4051 	if (ifnet_ioctl(ifp, 0, SIOCGIFMEDIA, &ifmr) == 0) {
4052 		if ((ifmr.ifm_status & IFM_AVALID) && ifmr.ifm_count > 0) {
4053 			status = ifmr.ifm_status & IFM_ACTIVE ? 1 : 0;
4054 		}
4055 	}
4056 
4057 	return status;
4058 }
4059 
4060 /*
4061  * bridge_updatelinkstatus:
4062  *
4063  *      Update the media active status of the bridge based on the
4064  *	media active status of its member.
4065  *	If changed, return the corresponding onf/off link event.
4066  */
4067 static u_int32_t
bridge_updatelinkstatus(struct bridge_softc * sc)4068 bridge_updatelinkstatus(struct bridge_softc *sc)
4069 {
4070 	struct bridge_iflist *bif;
4071 	int active_member = 0;
4072 	u_int32_t event_code = 0;
4073 
4074 	BRIDGE_LOCK_ASSERT_HELD(sc);
4075 
4076 	/*
4077 	 * Find out if we have an active interface
4078 	 */
4079 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
4080 		if (bif->bif_flags & BIFF_MEDIA_ACTIVE) {
4081 			active_member = 1;
4082 			break;
4083 		}
4084 	}
4085 
4086 	if (active_member && !(sc->sc_flags & SCF_MEDIA_ACTIVE)) {
4087 		sc->sc_flags |= SCF_MEDIA_ACTIVE;
4088 		event_code = KEV_DL_LINK_ON;
4089 	} else if (!active_member && (sc->sc_flags & SCF_MEDIA_ACTIVE)) {
4090 		sc->sc_flags &= ~SCF_MEDIA_ACTIVE;
4091 		event_code = KEV_DL_LINK_OFF;
4092 	}
4093 
4094 	return event_code;
4095 }
4096 
4097 /*
4098  * bridge_iflinkevent:
4099  */
4100 static void
bridge_iflinkevent(struct ifnet * ifp)4101 bridge_iflinkevent(struct ifnet *ifp)
4102 {
4103 	struct bridge_softc * __single sc = ifp->if_bridge;
4104 	struct bridge_iflist *bif;
4105 	u_int32_t event_code = 0;
4106 	int media_active;
4107 
4108 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE, "%s", ifp->if_xname);
4109 
4110 	/* Check if the interface is a bridge member */
4111 	if (sc == NULL) {
4112 		return;
4113 	}
4114 
4115 	media_active = interface_media_active(ifp);
4116 	BRIDGE_LOCK(sc);
4117 	bif = bridge_lookup_member_if(sc, ifp);
4118 	if (bif != NULL) {
4119 		if (media_active) {
4120 			bif->bif_flags |= BIFF_MEDIA_ACTIVE;
4121 		} else {
4122 			bif->bif_flags &= ~BIFF_MEDIA_ACTIVE;
4123 		}
4124 		if (sc->sc_mac_nat_bif != NULL) {
4125 			bridge_mac_nat_flush_entries(sc, bif);
4126 		}
4127 
4128 		event_code = bridge_updatelinkstatus(sc);
4129 	}
4130 	BRIDGE_UNLOCK(sc);
4131 
4132 	if (event_code != 0) {
4133 		bridge_link_event(sc->sc_ifp, event_code);
4134 	}
4135 }
4136 
4137 /*
4138  * bridge_delayed_callback:
4139  *
4140  *	Makes a delayed call
4141  */
4142 static void
bridge_delayed_callback(void * param,__unused void * param2)4143 bridge_delayed_callback(void *param, __unused void *param2)
4144 {
4145 	struct bridge_delayed_call *call = (struct bridge_delayed_call *)param;
4146 	struct bridge_softc *sc = call->bdc_sc;
4147 
4148 #if BRIDGE_DELAYED_CALLBACK_DEBUG
4149 	if (bridge_delayed_callback_delay > 0) {
4150 		struct timespec ts;
4151 
4152 		ts.tv_sec = bridge_delayed_callback_delay;
4153 		ts.tv_nsec = 0;
4154 
4155 		BRIDGE_LOG(LOG_NOTICE, 0,
4156 		    "sleeping for %d seconds",
4157 		    bridge_delayed_callback_delay);
4158 
4159 		msleep(&bridge_delayed_callback_delay, NULL, PZERO,
4160 		    __func__, &ts);
4161 
4162 		BRIDGE_LOG(LOG_NOTICE, 0, "awoken");
4163 	}
4164 #endif /* BRIDGE_DELAYED_CALLBACK_DEBUG */
4165 
4166 	BRIDGE_LOCK(sc);
4167 
4168 #if BRIDGE_DELAYED_CALLBACK_DEBUG
4169 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_DELAYED_CALL,
4170 	    "%s call 0x%llx flags 0x%x",
4171 	    sc->sc_if_xname, (uint64_t)VM_KERNEL_ADDRPERM(call),
4172 	    call->bdc_flags);
4173 }
4174 #endif /* BRIDGE_DELAYED_CALLBACK_DEBUG */
4175 
4176 	if (call->bdc_flags & BDCF_CANCELLING) {
4177 		wakeup(call);
4178 	} else {
4179 		if ((sc->sc_flags & SCF_DETACHING) == 0) {
4180 			(*call->bdc_func)(sc);
4181 		}
4182 	}
4183 	call->bdc_flags &= ~BDCF_OUTSTANDING;
4184 	BRIDGE_UNLOCK(sc);
4185 }
4186 
4187 /*
4188  * bridge_schedule_delayed_call:
4189  *
4190  *	Schedule a function to be called on a separate thread
4191  *      The actual call may be scheduled to run at a given time or ASAP.
4192  */
4193 static void
4194 bridge_schedule_delayed_call(struct bridge_delayed_call *call)
4195 {
4196 	uint64_t deadline = 0;
4197 	struct bridge_softc *sc = call->bdc_sc;
4198 
4199 	BRIDGE_LOCK_ASSERT_HELD(sc);
4200 
4201 	if ((sc->sc_flags & SCF_DETACHING) ||
4202 	    (call->bdc_flags & (BDCF_OUTSTANDING | BDCF_CANCELLING))) {
4203 		return;
4204 	}
4205 
4206 	if (call->bdc_ts.tv_sec || call->bdc_ts.tv_nsec) {
4207 		nanoseconds_to_absolutetime(
4208 			(uint64_t)call->bdc_ts.tv_sec * NSEC_PER_SEC +
4209 			call->bdc_ts.tv_nsec, &deadline);
4210 		clock_absolutetime_interval_to_deadline(deadline, &deadline);
4211 	}
4212 
4213 	call->bdc_flags = BDCF_OUTSTANDING;
4214 
4215 #if BRIDGE_DELAYED_CALLBACK_DEBUG
4216 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_DELAYED_CALL,
4217 	    "%s call 0x%llx flags 0x%x",
4218 	    sc->sc_if_xname, (uint64_t)VM_KERNEL_ADDRPERM(call),
4219 	    call->bdc_flags);
4220 }
4221 #endif /* BRIDGE_DELAYED_CALLBACK_DEBUG */
4222 
4223 	if (call->bdc_ts.tv_sec || call->bdc_ts.tv_nsec) {
4224 		thread_call_func_delayed(
4225 			(thread_call_func_t)bridge_delayed_callback,
4226 			call, deadline);
4227 	} else {
4228 		if (call->bdc_thread_call == NULL) {
4229 			call->bdc_thread_call = thread_call_allocate(
4230 				(thread_call_func_t)bridge_delayed_callback,
4231 				call);
4232 		}
4233 		thread_call_enter(call->bdc_thread_call);
4234 	}
4235 }
4236 
4237 /*
4238  * bridge_cancel_delayed_call:
4239  *
4240  *	Cancel a queued or running delayed call.
4241  *	If call is running, does not return until the call is done to
4242  *	prevent race condition with the brigde interface getting destroyed
4243  */
4244 static void
4245 bridge_cancel_delayed_call(struct bridge_delayed_call *call)
4246 {
4247 	boolean_t result;
4248 	struct bridge_softc *sc = call->bdc_sc;
4249 
4250 	/*
4251 	 * The call was never scheduled
4252 	 */
4253 	if (sc == NULL) {
4254 		return;
4255 	}
4256 
4257 	BRIDGE_LOCK_ASSERT_HELD(sc);
4258 
4259 	call->bdc_flags |= BDCF_CANCELLING;
4260 
4261 	while (call->bdc_flags & BDCF_OUTSTANDING) {
4262 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_DELAYED_CALL,
4263 		    "%s call 0x%llx flags 0x%x",
4264 		    sc->sc_if_xname, (uint64_t)VM_KERNEL_ADDRPERM(call),
4265 		    call->bdc_flags);
4266 		result = thread_call_func_cancel(
4267 			(thread_call_func_t)bridge_delayed_callback, call, FALSE);
4268 
4269 		if (result) {
4270 			/*
4271 			 * We managed to dequeue the delayed call
4272 			 */
4273 			call->bdc_flags &= ~BDCF_OUTSTANDING;
4274 		} else {
4275 			/*
4276 			 * Wait for delayed call do be done running
4277 			 */
4278 			msleep(call, &sc->sc_mtx, PZERO, __func__, NULL);
4279 		}
4280 	}
4281 	call->bdc_flags &= ~BDCF_CANCELLING;
4282 }
4283 
4284 /*
4285  * bridge_cleanup_delayed_call:
4286  *
4287  *	Dispose resource allocated for a delayed call
4288  *	Assume the delayed call is not queued or running .
4289  */
4290 static void
4291 bridge_cleanup_delayed_call(struct bridge_delayed_call *call)
4292 {
4293 	boolean_t result;
4294 	struct bridge_softc *sc = call->bdc_sc;
4295 
4296 	/*
4297 	 * The call was never scheduled
4298 	 */
4299 	if (sc == NULL) {
4300 		return;
4301 	}
4302 
4303 	BRIDGE_LOCK_ASSERT_HELD(sc);
4304 
4305 	VERIFY((call->bdc_flags & BDCF_OUTSTANDING) == 0);
4306 	VERIFY((call->bdc_flags & BDCF_CANCELLING) == 0);
4307 
4308 	if (call->bdc_thread_call != NULL) {
4309 		result = thread_call_free(call->bdc_thread_call);
4310 		if (result == FALSE) {
4311 			panic("%s thread_call_free() failed for call %p",
4312 			    __func__, call);
4313 		}
4314 		call->bdc_thread_call = NULL;
4315 	}
4316 }
4317 
4318 /*
4319  * bridge_init:
4320  *
4321  *	Initialize a bridge interface.
4322  */
4323 static int
4324 bridge_init(struct ifnet *ifp)
4325 {
4326 	struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
4327 	errno_t error;
4328 
4329 	BRIDGE_LOCK_ASSERT_HELD(sc);
4330 
4331 	if ((ifnet_flags(ifp) & IFF_RUNNING)) {
4332 		return 0;
4333 	}
4334 
4335 	error = ifnet_set_flags(ifp, IFF_RUNNING, IFF_RUNNING);
4336 
4337 	/*
4338 	 * Calling bridge_aging_timer() is OK as there are no entries to
4339 	 * age so we're just going to arm the timer
4340 	 */
4341 	bridge_aging_timer(sc);
4342 #if BRIDGESTP
4343 	if (error == 0) {
4344 		bstp_init(&sc->sc_stp); /* Initialize Spanning Tree */
4345 	}
4346 #endif /* BRIDGESTP */
4347 	return error;
4348 }
4349 
4350 /*
4351  * bridge_ifstop:
4352  *
4353  *	Stop the bridge interface.
4354  */
4355 static void
4356 bridge_ifstop(struct ifnet *ifp, int disable)
4357 {
4358 #pragma unused(disable)
4359 	struct bridge_softc * __single sc = ifp->if_softc;
4360 
4361 	BRIDGE_LOCK_ASSERT_HELD(sc);
4362 
4363 	if ((ifnet_flags(ifp) & IFF_RUNNING) == 0) {
4364 		return;
4365 	}
4366 
4367 	bridge_cancel_delayed_call(&sc->sc_aging_timer);
4368 
4369 #if BRIDGESTP
4370 	bstp_stop(&sc->sc_stp);
4371 #endif /* BRIDGESTP */
4372 
4373 	bridge_rtflush(sc, IFBF_FLUSHDYN);
4374 	(void) ifnet_set_flags(ifp, 0, IFF_RUNNING);
4375 }
4376 
4377 /*
4378  * bridge_compute_cksum:
4379  *
4380  *	If the packet has checksum flags, compare the hardware checksum
4381  *	capabilities of the source and destination interfaces. If they
4382  *	are the same, there's nothing to do. If they are different,
4383  *	finalize the checksum so that it can be sent on the destination
4384  *	interface.
4385  */
4386 static void
4387 bridge_compute_cksum(struct ifnet *src_if, struct ifnet *dst_if, struct mbuf *m)
4388 {
4389 	uint32_t csum_flags;
4390 	uint16_t dst_hw_csum;
4391 	uint32_t did_sw = 0;
4392 	struct ether_header *eh;
4393 	uint16_t src_hw_csum;
4394 
4395 	if (src_if == dst_if) {
4396 		return;
4397 	}
4398 	csum_flags = m->m_pkthdr.csum_flags & IF_HWASSIST_CSUM_MASK;
4399 	if (csum_flags == 0) {
4400 		/* no checksum offload */
4401 		return;
4402 	}
4403 
4404 	/*
4405 	 * if destination/source differ in checksum offload
4406 	 * capabilities, finalize/compute the checksum
4407 	 */
4408 	dst_hw_csum = IF_HWASSIST_CSUM_FLAGS(dst_if->if_hwassist);
4409 	src_hw_csum = IF_HWASSIST_CSUM_FLAGS(src_if->if_hwassist);
4410 	if (dst_hw_csum == src_hw_csum) {
4411 		return;
4412 	}
4413 	eh = mtod(m, struct ether_header *);
4414 	switch (eh->ether_type) {
4415 	case HTONS_ETHERTYPE_IP:
4416 		did_sw = in_finalize_cksum(m, sizeof(*eh), csum_flags);
4417 		break;
4418 	case HTONS_ETHERTYPE_IPV6:
4419 		did_sw = in6_finalize_cksum(m, sizeof(*eh), -1, -1, csum_flags);
4420 		break;
4421 	}
4422 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4423 	    "[%s -> %s] before 0x%x did 0x%x after 0x%x",
4424 	    src_if->if_xname, dst_if->if_xname, csum_flags, did_sw,
4425 	    m->m_pkthdr.csum_flags);
4426 }
4427 
4428 static inline errno_t
4429 bridge_transmit(ifnet_t ifp, mbuf_t m)
4430 {
4431 	struct flowadv  adv = { .code = FADV_SUCCESS };
4432 	errno_t         error;
4433 	int             flags = DLIL_OUTPUT_FLAGS_RAW;
4434 
4435 	flags = (if_bridge_output_skip_filters != 0)
4436 	    ? (DLIL_OUTPUT_FLAGS_RAW | DLIL_OUTPUT_FLAGS_SKIP_IF_FILTERS)
4437 	    : DLIL_OUTPUT_FLAGS_RAW;
4438 	error = dlil_output(ifp, 0, m, NULL, NULL, flags, &adv);
4439 	if (error == 0) {
4440 		if (adv.code == FADV_FLOW_CONTROLLED) {
4441 			error = EQFULL;
4442 		} else if (adv.code == FADV_SUSPENDED) {
4443 			error = EQSUSPENDED;
4444 		}
4445 	}
4446 	return error;
4447 }
4448 
4449 static int
4450 get_last_ip6_hdr(struct mbuf *m, int off, int proto, int * nxtp,
4451     bool *is_fragmented)
4452 {
4453 	int newoff;
4454 
4455 	*is_fragmented = false;
4456 	while (1) {
4457 		newoff = ip6_nexthdr(m, off, proto, nxtp);
4458 		if (newoff < 0) {
4459 			return off;
4460 		} else if (newoff < off) {
4461 			return -1;    /* invalid */
4462 		} else if (newoff == off) {
4463 			return newoff;
4464 		}
4465 		off = newoff;
4466 		proto = *nxtp;
4467 		if (proto == IPPROTO_FRAGMENT) {
4468 			*is_fragmented = true;
4469 		}
4470 	}
4471 }
4472 
4473 #define __ATOMIC_INC(s) os_atomic_inc(&s, relaxed)
4474 
4475 static int
4476 bridge_get_ip_proto(struct mbuf * * mp, u_int mac_hlen, bool is_ipv4,
4477     ip_packet_info_t info_p, struct bripstats * stats_p)
4478 {
4479 	int             error = 0;
4480 	u_int           hlen;
4481 	u_int           ip_hlen;
4482 	u_int           ip_pay_len;
4483 	struct mbuf *   m0 = *mp;
4484 	int             off;
4485 	int             opt_len = 0;
4486 	int             proto = 0;
4487 
4488 	bzero(info_p, sizeof(*info_p));
4489 	if (is_ipv4) {
4490 		struct ip *     ip;
4491 		u_int           ip_total_len;
4492 
4493 		/* IPv4 */
4494 		hlen = mac_hlen + sizeof(struct ip);
4495 		if (m0->m_pkthdr.len < hlen) {
4496 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4497 			    "Short IP packet %d < %d",
4498 			    m0->m_pkthdr.len, hlen);
4499 			error = _EBADIP;
4500 			__ATOMIC_INC(stats_p->bips_bad_ip);
4501 			goto done;
4502 		}
4503 		if (m0->m_len < hlen) {
4504 			*mp = m0 = m_pullup(m0, hlen);
4505 			if (m0 == NULL) {
4506 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4507 				    "m_pullup failed hlen %d",
4508 				    hlen);
4509 				error = ENOBUFS;
4510 				__ATOMIC_INC(stats_p->bips_bad_ip);
4511 				goto done;
4512 			}
4513 		}
4514 		ip = (struct ip *)mtodo(m0, mac_hlen);
4515 		if (IP_VHL_V(ip->ip_vhl) != IPVERSION) {
4516 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4517 			    "bad IP version");
4518 			error = _EBADIP;
4519 			__ATOMIC_INC(stats_p->bips_bad_ip);
4520 			goto done;
4521 		}
4522 		ip_hlen = IP_VHL_HL(ip->ip_vhl) << 2;
4523 		if (ip_hlen < sizeof(struct ip)) {
4524 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4525 			    "bad IP header length %d < %d",
4526 			    ip_hlen,
4527 			    (int)sizeof(struct ip));
4528 			error = _EBADIP;
4529 			__ATOMIC_INC(stats_p->bips_bad_ip);
4530 			goto done;
4531 		}
4532 		hlen = mac_hlen + ip_hlen;
4533 		if (m0->m_len < hlen) {
4534 			*mp = m0 = m_pullup(m0, hlen);
4535 			if (m0 == NULL) {
4536 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4537 				    "m_pullup failed hlen %d",
4538 				    hlen);
4539 				error = ENOBUFS;
4540 				__ATOMIC_INC(stats_p->bips_bad_ip);
4541 				goto done;
4542 			}
4543 			ip = (struct ip *)mtodo(m0, mac_hlen);
4544 		}
4545 
4546 		ip_total_len = ntohs(ip->ip_len);
4547 		if (ip_total_len < ip_hlen) {
4548 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4549 			    "IP total len %d < header len %d",
4550 			    ip_total_len, ip_hlen);
4551 			error = _EBADIP;
4552 			__ATOMIC_INC(stats_p->bips_bad_ip);
4553 			goto done;
4554 		}
4555 		if (ip_total_len > (m0->m_pkthdr.len - mac_hlen)) {
4556 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4557 			    "invalid IP payload length %d > %d",
4558 			    ip_total_len,
4559 			    (m0->m_pkthdr.len - mac_hlen));
4560 			error = _EBADIP;
4561 			__ATOMIC_INC(stats_p->bips_bad_ip);
4562 			goto done;
4563 		}
4564 		ip_pay_len = ip_total_len - ip_hlen;
4565 		info_p->ip_proto = ip->ip_p;
4566 		info_p->ip_hdr = mtodo(m0, mac_hlen);
4567 		info_p->ip_m0_len = m0->m_len - mac_hlen;
4568 		info_p->ip_hlen = ip_hlen;
4569 #define FRAG_BITS       (IP_OFFMASK | IP_MF)
4570 		if ((ntohs(ip->ip_off) & FRAG_BITS) != 0) {
4571 			info_p->ip_is_fragmented = true;
4572 		}
4573 		__ATOMIC_INC(stats_p->bips_ip);
4574 	} else {
4575 		struct ip6_hdr *ip6;
4576 
4577 		/* IPv6 */
4578 		hlen = mac_hlen + sizeof(struct ip6_hdr);
4579 		if (m0->m_pkthdr.len < hlen) {
4580 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4581 			    "short IPv6 packet %d < %d",
4582 			    m0->m_pkthdr.len, hlen);
4583 			error = _EBADIPV6;
4584 			__ATOMIC_INC(stats_p->bips_bad_ip6);
4585 			goto done;
4586 		}
4587 		if (m0->m_len < hlen) {
4588 			*mp = m0 = m_pullup(m0, hlen);
4589 			if (m0 == NULL) {
4590 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4591 				    "m_pullup failed hlen %d",
4592 				    hlen);
4593 				error = ENOBUFS;
4594 				__ATOMIC_INC(stats_p->bips_bad_ip6);
4595 				goto done;
4596 			}
4597 		}
4598 		ip6 = (struct ip6_hdr *)(mtodo(m0, mac_hlen));
4599 		if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
4600 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4601 			    "bad IPv6 version");
4602 			error = _EBADIPV6;
4603 			__ATOMIC_INC(stats_p->bips_bad_ip6);
4604 			goto done;
4605 		}
4606 		off = get_last_ip6_hdr(m0, mac_hlen, IPPROTO_IPV6, &proto,
4607 		    &info_p->ip_is_fragmented);
4608 		if (off < 0 || m0->m_pkthdr.len < off) {
4609 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4610 			    "ip6_lasthdr() returned %d",
4611 			    off);
4612 			error = _EBADIPV6;
4613 			__ATOMIC_INC(stats_p->bips_bad_ip6);
4614 			goto done;
4615 		}
4616 		ip_hlen = sizeof(*ip6);
4617 		opt_len = off - mac_hlen - ip_hlen;
4618 		if (opt_len < 0) {
4619 			error = _EBADIPV6;
4620 			__ATOMIC_INC(stats_p->bips_bad_ip6);
4621 			goto done;
4622 		}
4623 		ip_pay_len = ntohs(ip6->ip6_plen);
4624 		if (ip_pay_len > (m0->m_pkthdr.len - mac_hlen - ip_hlen)) {
4625 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4626 			    "invalid IPv6 payload length %d > %d",
4627 			    ip_pay_len,
4628 			    (m0->m_pkthdr.len - mac_hlen - ip_hlen));
4629 			error = _EBADIPV6;
4630 			__ATOMIC_INC(stats_p->bips_bad_ip6);
4631 			goto done;
4632 		}
4633 		info_p->ip_proto = proto;
4634 		info_p->ip_hdr = mtodo(m0, mac_hlen);
4635 		info_p->ip_m0_len = m0->m_len - mac_hlen;
4636 		info_p->ip_hlen = ip_hlen;
4637 		__ATOMIC_INC(stats_p->bips_ip6);
4638 	}
4639 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4640 	    "IPv%c proto %d ip %u pay %u opt %u pkt %u%s",
4641 	    is_ipv4 ? '4' : '6',
4642 	    proto, ip_hlen, ip_pay_len, opt_len,
4643 	    m0->m_pkthdr.len, info_p->ip_is_fragmented ? " frag" : "");
4644 	info_p->ip_pay_len = ip_pay_len;
4645 	info_p->ip_opt_len = opt_len;
4646 	info_p->ip_is_ipv4 = is_ipv4;
4647 done:
4648 	return error;
4649 }
4650 
4651 static int
4652 bridge_get_tcp_header(struct mbuf * * mp, u_int mac_hlen, bool is_ipv4,
4653     ip_packet_info_t info_p, struct bripstats * stats_p)
4654 {
4655 	int             error;
4656 	u_int           hlen;
4657 
4658 	error = bridge_get_ip_proto(mp, mac_hlen, is_ipv4, info_p, stats_p);
4659 	if (error != 0) {
4660 		goto done;
4661 	}
4662 	if (info_p->ip_proto != IPPROTO_TCP) {
4663 		/* not a TCP frame, not an error, just a bad guess */
4664 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4665 		    "non-TCP (%d) IPv%c frame %d bytes",
4666 		    info_p->ip_proto, is_ipv4 ? '4' : '6',
4667 		    (*mp)->m_pkthdr.len);
4668 		goto done;
4669 	}
4670 	if (info_p->ip_is_fragmented) {
4671 		/* both TSO and IP fragmentation don't make sense */
4672 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_CHECKSUM,
4673 		    "fragmented TSO packet?");
4674 		__ATOMIC_INC(stats_p->bips_bad_tcp);
4675 		error = _EBADTCP;
4676 		goto done;
4677 	}
4678 	hlen = mac_hlen + info_p->ip_hlen + sizeof(struct tcphdr) +
4679 	    info_p->ip_opt_len;
4680 	if ((*mp)->m_len < hlen) {
4681 		*mp = m_pullup(*mp, hlen);
4682 		if (*mp == NULL) {
4683 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4684 			    "m_pullup %d failed",
4685 			    hlen);
4686 			__ATOMIC_INC(stats_p->bips_bad_tcp);
4687 			error = _EBADTCP;
4688 			goto done;
4689 		}
4690 	}
4691 	info_p->ip_proto_hdr = info_p->ip_hdr + info_p->ip_hlen +
4692 	    info_p->ip_opt_len;
4693 done:
4694 	return error;
4695 }
4696 
4697 static inline void
4698 proto_csum_stats_increment(uint8_t proto, struct brcsumstats * stats_p)
4699 {
4700 	if (proto == IPPROTO_TCP) {
4701 		__ATOMIC_INC(stats_p->brcs_tcp_checksum);
4702 	} else {
4703 		__ATOMIC_INC(stats_p->brcs_udp_checksum);
4704 	}
4705 	return;
4706 }
4707 
4708 #define ETHER_TYPE_FLAG_NONE    0x00
4709 #define ETHER_TYPE_FLAG_IPV4    0x01
4710 #define ETHER_TYPE_FLAG_IPV6    0x02
4711 #define ETHER_TYPE_FLAG_ARP     0x04
4712 #define ETHER_TYPE_FLAG_IP      (ETHER_TYPE_FLAG_IPV4 | ETHER_TYPE_FLAG_IPV6)
4713 #define ETHER_TYPE_FLAG_IP_ARP  (ETHER_TYPE_FLAG_IP | ETHER_TYPE_FLAG_ARP)
4714 
4715 typedef uint8_t ether_type_flag_t;
4716 
4717 static inline bool
4718 ether_type_flag_is_ip(ether_type_flag_t flag)
4719 {
4720 	return (flag & ETHER_TYPE_FLAG_IP) != 0;
4721 }
4722 
4723 static inline ether_type_flag_t
4724 ether_type_flag_get(uint16_t ether_type)
4725 {
4726 	ether_type_flag_t flag = ETHER_TYPE_FLAG_NONE;
4727 
4728 	switch (ether_type) {
4729 	case HTONS_ETHERTYPE_IP:
4730 		flag = ETHER_TYPE_FLAG_IPV4;
4731 		break;
4732 	case HTONS_ETHERTYPE_IPV6:
4733 		flag = ETHER_TYPE_FLAG_IPV6;
4734 		break;
4735 	case HTONS_ETHERTYPE_ARP:
4736 		flag = ETHER_TYPE_FLAG_ARP;
4737 		break;
4738 	default:
4739 		break;
4740 	}
4741 	return flag;
4742 }
4743 
4744 static bool
4745 ether_header_type_is_ip(struct ether_header * eh, bool *is_ipv4)
4746 {
4747 	uint16_t        ether_type;
4748 	bool            is_ip = TRUE;
4749 
4750 	ether_type = ntohs(eh->ether_type);
4751 	switch (ether_type) {
4752 	case ETHERTYPE_IP:
4753 		*is_ipv4 = TRUE;
4754 		break;
4755 	case ETHERTYPE_IPV6:
4756 		*is_ipv4 = FALSE;
4757 		break;
4758 	default:
4759 		is_ip = FALSE;
4760 		break;
4761 	}
4762 	return is_ip;
4763 }
4764 
4765 static errno_t
4766 bridge_verify_checksum(struct mbuf * * mp, struct ifbrmstats *stats_p)
4767 {
4768 	struct brcsumstats *csum_stats_p;
4769 	struct ether_header     *eh;
4770 	errno_t         error = 0;
4771 	ip_packet_info  info;
4772 	bool            is_ipv4;
4773 	struct mbuf *   m;
4774 	u_int           mac_hlen = sizeof(struct ether_header);
4775 	uint16_t        sum;
4776 	bool            valid;
4777 
4778 	eh = mtod(*mp, struct ether_header *);
4779 	if (!ether_header_type_is_ip(eh, &is_ipv4)) {
4780 		goto done;
4781 	}
4782 	error = bridge_get_ip_proto(mp, mac_hlen, is_ipv4, &info,
4783 	    &stats_p->brms_out_ip);
4784 	m = *mp;
4785 	if (error != 0) {
4786 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4787 		    "bridge_get_ip_proto failed %d",
4788 		    error);
4789 		goto done;
4790 	}
4791 	if (is_ipv4) {
4792 		if ((m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) != 0) {
4793 			/* hardware offloaded IP header checksum */
4794 			valid = (m->m_pkthdr.csum_flags & CSUM_IP_VALID) != 0;
4795 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4796 			    "IP checksum HW %svalid",
4797 			    valid ? "" : "in");
4798 			if (!valid) {
4799 				__ATOMIC_INC(stats_p->brms_out_cksum_bad_hw.brcs_ip_checksum);
4800 				error = _EBADIPCHECKSUM;
4801 				goto done;
4802 			}
4803 			__ATOMIC_INC(stats_p->brms_out_cksum_good_hw.brcs_ip_checksum);
4804 		} else {
4805 			/* verify */
4806 			sum = inet_cksum(m, 0, mac_hlen, info.ip_hlen);
4807 			valid = (sum == 0);
4808 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4809 			    "IP checksum SW %svalid",
4810 			    valid ? "" : "in");
4811 			if (!valid) {
4812 				__ATOMIC_INC(stats_p->brms_out_cksum_bad.brcs_ip_checksum);
4813 				error = _EBADIPCHECKSUM;
4814 				goto done;
4815 			}
4816 			__ATOMIC_INC(stats_p->brms_out_cksum_good.brcs_ip_checksum);
4817 		}
4818 	}
4819 	if (info.ip_is_fragmented) {
4820 		/* can't verify checksum on fragmented packets */
4821 		goto done;
4822 	}
4823 	switch (info.ip_proto) {
4824 	case IPPROTO_TCP:
4825 		__ATOMIC_INC(stats_p->brms_out_ip.bips_tcp);
4826 		break;
4827 	case IPPROTO_UDP:
4828 		__ATOMIC_INC(stats_p->brms_out_ip.bips_udp);
4829 		break;
4830 	default:
4831 		goto done;
4832 	}
4833 	/* check for hardware offloaded UDP/TCP checksum */
4834 #define HW_CSUM         (CSUM_DATA_VALID | CSUM_PSEUDO_HDR)
4835 	if ((m->m_pkthdr.csum_flags & HW_CSUM) == HW_CSUM) {
4836 		/* checksum verified by hardware */
4837 		valid = (m->m_pkthdr.csum_rx_val == 0xffff);
4838 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4839 		    "IPv%c %s checksum HW 0x%x %svalid",
4840 		    is_ipv4 ? '4' : '6',
4841 		    (info.ip_proto == IPPROTO_TCP)
4842 		    ? "TCP" : "UDP",
4843 		    m->m_pkthdr.csum_data,
4844 		    valid ? "" : "in" );
4845 		if (!valid) {
4846 			/* bad checksum */
4847 			csum_stats_p = &stats_p->brms_out_cksum_bad_hw;
4848 			error = (info.ip_proto == IPPROTO_TCP) ? _EBADTCPCHECKSUM
4849 			    : _EBADTCPCHECKSUM;
4850 		} else {
4851 			/* good checksum */
4852 			csum_stats_p = &stats_p->brms_out_cksum_good_hw;
4853 		}
4854 		proto_csum_stats_increment(info.ip_proto, csum_stats_p);
4855 		goto done;
4856 	}
4857 	/* adjust frame to skip mac-layer header */
4858 	_mbuf_adjust_pkthdr_and_data(m, mac_hlen);
4859 	if (is_ipv4) {
4860 		sum = inet_cksum(m, info.ip_proto,
4861 		    info.ip_hlen,
4862 		    info.ip_pay_len);
4863 	} else {
4864 		sum = inet6_cksum(m, info.ip_proto,
4865 		    info.ip_hlen + info.ip_opt_len,
4866 		    info.ip_pay_len - info.ip_opt_len);
4867 	}
4868 	valid = (sum == 0);
4869 	if (valid) {
4870 		csum_stats_p = &stats_p->brms_out_cksum_good;
4871 	} else {
4872 		csum_stats_p = &stats_p->brms_out_cksum_bad;
4873 		error = (info.ip_proto == IPPROTO_TCP)
4874 		    ? _EBADTCPCHECKSUM : _EBADUDPCHECKSUM;
4875 	}
4876 	proto_csum_stats_increment(info.ip_proto, csum_stats_p);
4877 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4878 	    "IPv%c %s checksum SW %svalid (0x%x) hlen %d paylen %d",
4879 	    is_ipv4 ? '4' : '6',
4880 	    (info.ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
4881 	    valid ? "" : "in",
4882 	    sum, info.ip_hlen, info.ip_pay_len);
4883 	/* adjust frame back to start of mac-layer header */
4884 	_mbuf_adjust_pkthdr_and_data(m, -mac_hlen);
4885 
4886 done:
4887 	return error;
4888 }
4889 
4890 static mbuf_t
4891 bridge_verify_checksum_list(mbuf_t in_list, struct bridge_iflist * dbif)
4892 {
4893 	mbuf_t          next_packet;
4894 	mblist          ret;
4895 
4896 	mblist_init(&ret);
4897 	for (mbuf_ref_t scan = in_list; scan != NULL; scan = next_packet) {
4898 		errno_t         error;
4899 
4900 		/* take packet out of the list */
4901 		next_packet = scan->m_nextpkt;
4902 		scan->m_nextpkt = NULL;
4903 
4904 		/* verify checksum */
4905 		error = bridge_verify_checksum(&scan, &dbif->bif_stats);
4906 		if (error != 0) {
4907 			if (scan != NULL) {
4908 				m_freem(scan);
4909 				scan = NULL;
4910 			}
4911 		}
4912 
4913 		/* add it back to the list */
4914 		if (scan != NULL) {
4915 			mblist_append(&ret, scan);
4916 		}
4917 	}
4918 	return ret.head;
4919 }
4920 
4921 
4922 static errno_t
4923 bridge_offload_checksum(struct mbuf * * mp, ip_packet_info * info_p,
4924     struct ifbrmstats * stats_p)
4925 {
4926 	uint16_t *      csum_p;
4927 	errno_t         error = 0;
4928 	u_int           hlen;
4929 	struct mbuf *   m0 = *mp;
4930 	u_int           mac_hlen = sizeof(struct ether_header);
4931 	u_int           pkt_hdr_len;
4932 	struct tcphdr * tcp;
4933 	u_int           tcp_hlen;
4934 	struct udphdr * udp;
4935 
4936 	if (info_p->ip_is_ipv4) {
4937 		/* compute IP header checksum */
4938 		struct ip *ip = (struct ip *)info_p->ip_hdr;
4939 		ip->ip_sum = 0;
4940 		ip->ip_sum = inet_cksum(m0, 0, mac_hlen, info_p->ip_hlen);
4941 		__ATOMIC_INC(stats_p->brms_in_computed_cksum.brcs_ip_checksum);
4942 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4943 		    "IPv4 checksum 0x%x",
4944 		    ntohs(ip->ip_sum));
4945 	}
4946 	if (info_p->ip_is_fragmented) {
4947 		/* can't compute checksum on fragmented packets */
4948 		goto done;
4949 	}
4950 	pkt_hdr_len = m0->m_pkthdr.len;
4951 	switch (info_p->ip_proto) {
4952 	case IPPROTO_TCP:
4953 		hlen = mac_hlen + info_p->ip_hlen + info_p->ip_opt_len
4954 		    + sizeof(struct tcphdr);
4955 		if (m0->m_len < hlen) {
4956 			*mp = m0 = m_pullup(m0, hlen);
4957 			if (m0 == NULL) {
4958 				__ATOMIC_INC(stats_p->brms_in_ip.bips_bad_tcp);
4959 				error = _EBADTCP;
4960 				goto done;
4961 			}
4962 		}
4963 		tcp = (struct tcphdr *)(info_p->ip_hdr + info_p->ip_hlen
4964 		    + info_p->ip_opt_len);
4965 		tcp_hlen = tcp->th_off << 2;
4966 		hlen = mac_hlen + info_p->ip_hlen + info_p->ip_opt_len + tcp_hlen;
4967 		if (hlen > pkt_hdr_len) {
4968 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
4969 			    "bad tcp header length %u",
4970 			    tcp_hlen);
4971 			__ATOMIC_INC(stats_p->brms_in_ip.bips_bad_tcp);
4972 			error = _EBADTCP;
4973 			goto done;
4974 		}
4975 		csum_p = &tcp->th_sum;
4976 		__ATOMIC_INC(stats_p->brms_in_ip.bips_tcp);
4977 		break;
4978 	case IPPROTO_UDP:
4979 		hlen = mac_hlen + info_p->ip_hlen + info_p->ip_opt_len + sizeof(*udp);
4980 		if (m0->m_len < hlen) {
4981 			*mp = m0 = m_pullup(m0, hlen);
4982 			if (m0 == NULL) {
4983 				__ATOMIC_INC(stats_p->brms_in_ip.bips_bad_udp);
4984 				error = ENOBUFS;
4985 				goto done;
4986 			}
4987 		}
4988 		udp = (struct udphdr *)(info_p->ip_hdr + info_p->ip_hlen
4989 		    + info_p->ip_opt_len);
4990 		csum_p = &udp->uh_sum;
4991 		__ATOMIC_INC(stats_p->brms_in_ip.bips_udp);
4992 		break;
4993 	default:
4994 		/* not TCP or UDP */
4995 		goto done;
4996 	}
4997 	*csum_p = 0;
4998 	/* adjust frame to skip mac-layer header */
4999 	_mbuf_adjust_pkthdr_and_data(m0, mac_hlen);
5000 	if (info_p->ip_is_ipv4) {
5001 		*csum_p = inet_cksum(m0, info_p->ip_proto, info_p->ip_hlen,
5002 		    info_p->ip_pay_len);
5003 	} else {
5004 		*csum_p = inet6_cksum(m0, info_p->ip_proto,
5005 		    info_p->ip_hlen + info_p->ip_opt_len,
5006 		    info_p->ip_pay_len - info_p->ip_opt_len);
5007 	}
5008 	if (info_p->ip_proto == IPPROTO_UDP && *csum_p == 0) {
5009 		/* RFC 1122 4.1.3.4 */
5010 		*csum_p = 0xffff;
5011 	}
5012 	/* adjust frame back to start of mac-layer header */
5013 	_mbuf_adjust_pkthdr_and_data(m0, -mac_hlen);
5014 	proto_csum_stats_increment(info_p->ip_proto,
5015 	    &stats_p->brms_in_computed_cksum);
5016 
5017 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5018 	    "IPv%c %s set checksum 0x%x",
5019 	    info_p->ip_is_ipv4 ? '4' : '6',
5020 	    (info_p->ip_proto == IPPROTO_TCP) ? "TCP" : "UDP",
5021 	    ntohs(*csum_p));
5022 done:
5023 	return error;
5024 }
5025 
5026 static inline void
5027 bridge_handle_checksum_op(ifnet_t src_ifp, ifnet_t dst_ifp,
5028     mbuf_t m, ChecksumOperation cksum_op)
5029 {
5030 	switch (cksum_op) {
5031 	case CHECKSUM_OPERATION_CLEAR_OFFLOAD:
5032 		m->m_pkthdr.csum_flags &= ~CSUM_TX_FLAGS;
5033 		break;
5034 	case CHECKSUM_OPERATION_FINALIZE:
5035 		/* the checksum might not be correct, finalize now */
5036 		VERIFY(dst_ifp != NULL);
5037 		bridge_finalize_cksum(dst_ifp, m);
5038 		break;
5039 	case CHECKSUM_OPERATION_COMPUTE:
5040 		VERIFY(dst_ifp != NULL && src_ifp != NULL);
5041 		bridge_compute_cksum(src_ifp, dst_ifp, m);
5042 		break;
5043 	default:
5044 		break;
5045 	}
5046 	return;
5047 }
5048 
5049 static errno_t
5050 bridge_send(ifnet_t src_ifp, ifnet_t dst_ifp,
5051     mbuf_t m, ChecksumOperation cksum_op)
5052 {
5053 	bridge_handle_checksum_op(src_ifp, dst_ifp, m, cksum_op);
5054 #if HAS_IF_CAP
5055 	/*
5056 	 * If underlying interface can not do VLAN tag insertion itself
5057 	 * then attach a packet tag that holds it.
5058 	 */
5059 	if ((m->m_flags & M_VLANTAG) &&
5060 	    (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
5061 		m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
5062 		if (m == NULL) {
5063 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_CHECKSUM,
5064 			    "%s: unable to prepend VLAN header",
5065 			    dst_ifp->if_xname);
5066 			(void) ifnet_stat_increment_out(dst_ifp,
5067 			    0, 0, 1);
5068 			return 0;
5069 		}
5070 		m->m_flags &= ~M_VLANTAG;
5071 	}
5072 #endif /* HAS_IF_CAP */
5073 	return bridge_transmit(dst_ifp, m);
5074 }
5075 
5076 static errno_t
5077 bridge_send_tso(struct ifnet *dst_ifp, struct mbuf *m, bool is_ipv4)
5078 {
5079 	errno_t                 error = 0;
5080 	u_int                   mac_hlen;
5081 	mblist                  segs;
5082 
5083 	mac_hlen = sizeof(struct ether_header);
5084 
5085 #if HAS_IF_CAP
5086 	/*
5087 	 * If underlying interface can not do VLAN tag insertion itself
5088 	 * then attach a packet tag that holds it.
5089 	 */
5090 	if ((m->m_flags & M_VLANTAG) &&
5091 	    (dst_ifp->if_capenable & IFCAP_VLAN_HWTAGGING) == 0) {
5092 		m = ether_vlanencap(m, m->m_pkthdr.ether_vtag);
5093 		if (m == NULL) {
5094 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_CHECKSUM,
5095 			    "%s: unable to prepend VLAN header",
5096 			    dst_ifp->if_xname);
5097 			(void) ifnet_stat_increment_out(dst_ifp,
5098 			    0, 0, 1);
5099 			error = ENOBUFS;
5100 			goto done;
5101 		}
5102 		m->m_flags &= ~M_VLANTAG;
5103 		mac_hlen += ETHER_VLAN_ENCAP_LEN;
5104 	}
5105 #endif /* HAS_IF_CAP */
5106 	segs = gso_tcp_transmit(dst_ifp, m, mac_hlen, is_ipv4);
5107 	if (segs.head != NULL) {
5108 		error = bridge_transmit(dst_ifp, segs.head);
5109 	}
5110 	return error;
5111 }
5112 
5113 static uint32_t
5114 get_if_tso_mtu(struct ifnet * ifp, bool is_ipv4)
5115 {
5116 	uint32_t tso_mtu;
5117 
5118 	tso_mtu = is_ipv4 ? ifp->if_tso_v4_mtu : ifp->if_tso_v6_mtu;
5119 	if (tso_mtu == 0) {
5120 		tso_mtu = IP_MAXPACKET;
5121 	}
5122 
5123 #if DEBUG || DEVELOPMENT
5124 #define REDUCED_TSO_MTU         (16 * 1024)
5125 	if (if_bridge_reduce_tso_mtu != 0 && tso_mtu > REDUCED_TSO_MTU) {
5126 		tso_mtu = REDUCED_TSO_MTU;
5127 	}
5128 #endif /* DEBUG || DEVELOPMENT */
5129 	return tso_mtu;
5130 }
5131 
5132 /*
5133  * tso_hwassist:
5134  * - determine whether the destination interface supports TSO offload
5135  * - if the packet is already marked for offload and the hardware supports
5136  *   it, just allow the packet to continue on
5137  * - if not, parse the packet headers to verify that this is a large TCP
5138  *   packet requiring segmentation; if the hardware doesn't support it
5139  *   set need_sw_tso; otherwise, mark the packet for TSO offload
5140  */
5141 static int
5142 tso_hwassist(struct mbuf **mp, bool is_ipv4, struct ifnet * ifp, u_int mac_hlen,
5143     bool * need_sw_tso, bool * is_large_tcp)
5144 {
5145 	int             error = 0;
5146 	u_int32_t       if_csum;
5147 	u_int32_t       if_tso;
5148 	u_int32_t       mbuf_tso;
5149 	bool            supports_cksum = false;
5150 
5151 	*need_sw_tso = false;
5152 	*is_large_tcp = false;
5153 	if (is_ipv4) {
5154 		/*
5155 		 * Enable both TCP and IP offload if the hardware supports it.
5156 		 * If the hardware doesn't support TCP offload, supports_cksum
5157 		 * will be false so we won't set either offload.
5158 		 */
5159 		if_csum = ifp->if_hwassist & (CSUM_TCP | CSUM_IP);
5160 		supports_cksum = (if_csum & CSUM_TCP) != 0;
5161 		if_tso = IFNET_TSO_IPV4;
5162 		mbuf_tso = CSUM_TSO_IPV4;
5163 	} else {
5164 		supports_cksum = (ifp->if_hwassist & CSUM_TCPIPV6) != 0;
5165 		if_csum = CSUM_TCPIPV6;
5166 		if_tso = IFNET_TSO_IPV6;
5167 		mbuf_tso = CSUM_TSO_IPV6;
5168 	}
5169 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5170 	    "%s: does%s support checksum 0x%x if_csum 0x%x",
5171 	    ifp->if_xname, supports_cksum ? "" : " not",
5172 	    ifp->if_hwassist, if_csum);
5173 	if ((ifp->if_hwassist & if_tso) != 0 &&
5174 	    ((*mp)->m_pkthdr.csum_flags & mbuf_tso) != 0) {
5175 		/* hardware TSO, mbuf already marked */
5176 	} else {
5177 		/* verify that this is a large TCP frame */
5178 		uint32_t                csum_flags;
5179 		ip_packet_info          info;
5180 		int                     mss;
5181 		uint32_t                pkt_mtu;
5182 		struct bripstats        stats;
5183 		struct tcphdr *         tcp;
5184 		uint32_t                tso_mtu;
5185 
5186 		error = bridge_get_tcp_header(mp, mac_hlen, is_ipv4,
5187 		    &info, &stats);
5188 		if (error != 0) {
5189 			/* bad packet */
5190 			goto done;
5191 		}
5192 		if (info.ip_proto_hdr == NULL) {
5193 			/* not a TCP packet */
5194 			goto done;
5195 		}
5196 		pkt_mtu = info.ip_hlen + info.ip_pay_len + info.ip_opt_len;
5197 		if (pkt_mtu <= ifp->if_mtu) {
5198 			/* not actually a large packet */
5199 			goto done;
5200 		}
5201 		if ((ifp->if_hwassist & if_tso) == 0) {
5202 			/* hardware does not support TSO, enable sw tso */
5203 			*need_sw_tso = if_bridge_segmentation != 0;
5204 			goto done;
5205 		}
5206 		tso_mtu = get_if_tso_mtu(ifp, is_ipv4);
5207 		if (pkt_mtu > tso_mtu) {
5208 			/* hardware can't segment this, enable sw tso */
5209 			*need_sw_tso = if_bridge_segmentation != 0;
5210 			goto done;
5211 		}
5212 
5213 		/* use hardware TSO */
5214 		(*mp)->m_pkthdr.pkt_proto = IPPROTO_TCP;
5215 		tcp = (struct tcphdr *)info.ip_proto_hdr;
5216 		mss = ifp->if_mtu - info.ip_hlen - info.ip_opt_len
5217 		    - (tcp->th_off << 2) - if_bridge_tso_reduce_mss_tx;
5218 		assert(mss > 0);
5219 		csum_flags = mbuf_tso;
5220 		if (supports_cksum) {
5221 			csum_flags |= if_csum;
5222 		}
5223 		(*mp)->m_pkthdr.tso_segsz = mss;
5224 		(*mp)->m_pkthdr.csum_flags |= csum_flags;
5225 		(*mp)->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
5226 		*is_large_tcp = true;
5227 	}
5228 done:
5229 	return error;
5230 }
5231 
5232 /*
5233  * bridge_enqueue:
5234  *
5235  *	Enqueue a packet on a bridge member interface.
5236  *
5237  */
5238 static errno_t
5239 bridge_enqueue(ifnet_t bridge_ifp, struct ifnet *src_ifp,
5240     struct ifnet *dst_ifp, struct mbuf *m, ChecksumOperation cksum_op)
5241 {
5242 	errno_t         error = 0;
5243 	int             len;
5244 
5245 	VERIFY(dst_ifp != NULL);
5246 
5247 	for (struct mbuf *next_m = NULL; m != NULL; m = next_m) {
5248 		bool            need_sw_tso = false;
5249 		bool            is_ipv4 = false;
5250 		bool            is_large_pkt;
5251 		errno_t         _error = 0;
5252 
5253 		len = m->m_pkthdr.len;
5254 		m->m_flags |= M_PROTO1; /* set to avoid loops */
5255 		next_m = m->m_nextpkt;
5256 		m->m_nextpkt = NULL;
5257 		/*
5258 		 * Need to segment the packet if it is a large frame
5259 		 * and the destination interface does not support TSO.
5260 		 *
5261 		 * Note that with trailers, it's possible for a packet to
5262 		 * be large but not actually require segmentation.
5263 		 */
5264 		is_large_pkt = (len > (bridge_ifp->if_mtu + ETHER_HDR_LEN));
5265 		if (is_large_pkt) {
5266 			struct ether_header     *eh;
5267 			bool                    is_large_tcp = false;
5268 
5269 			eh = mtod(m, struct ether_header *);
5270 			if (ether_header_type_is_ip(eh, &is_ipv4)) {
5271 				_error = tso_hwassist(&m, is_ipv4,
5272 				    dst_ifp, sizeof(struct ether_header),
5273 				    &need_sw_tso, &is_large_tcp);
5274 				if (is_large_tcp) {
5275 					cksum_op = CHECKSUM_OPERATION_NONE;
5276 				}
5277 			} else {
5278 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5279 				    "large non IP packet");
5280 			}
5281 		}
5282 		if (_error != 0) {
5283 			if (m != NULL) {
5284 				m_freem(m);
5285 			}
5286 		} else if (need_sw_tso) {
5287 			_error = bridge_send_tso(dst_ifp, m, is_ipv4);
5288 		} else {
5289 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5290 			    "%s bridge_send(%s) len %d op %d",
5291 			    bridge_ifp->if_xname,
5292 			    dst_ifp->if_xname,
5293 			    len, cksum_op);
5294 			_error = bridge_send(src_ifp, dst_ifp, m, cksum_op);
5295 		}
5296 
5297 		/* Preserve first error value */
5298 		if (error == 0 && _error != 0) {
5299 			error = _error;
5300 		}
5301 		if (_error == 0) {
5302 			(void) ifnet_stat_increment_out(bridge_ifp, 1, len, 0);
5303 		} else {
5304 			(void) ifnet_stat_increment_out(bridge_ifp, 0, 0, 1);
5305 		}
5306 	}
5307 
5308 	return error;
5309 }
5310 
5311 static void
5312 bridge_enqueue_multi(ifnet_t bridge_ifp, ifnet_t src_if, ifnet_t dst_if,
5313     ether_type_flag_t etypef, mbuf_t in_list, ChecksumOperation orig_cksum_op)
5314 {
5315 	mbuf_t          next_packet;
5316 	uint32_t        out_errors = 0;
5317 	mblist          out_list;
5318 
5319 	VERIFY(dst_if != NULL);
5320 
5321 	mblist_init(&out_list);
5322 	for (mbuf_ref_t scan = in_list; scan != NULL; scan = next_packet) {
5323 		ChecksumOperation cksum_op = orig_cksum_op;
5324 		errno_t         error = 0;
5325 		bool            is_ipv4 = false;
5326 		bool            is_large_pkt;
5327 		int             len;
5328 		bool            need_sw_tso = false;
5329 
5330 		scan->m_flags |= M_PROTO1; /* set to avoid loops */
5331 		next_packet = scan->m_nextpkt;
5332 		scan->m_nextpkt = NULL;
5333 		len = mbuf_pkthdr_len(scan);
5334 
5335 		/*
5336 		 * Need to segment the packet if it is a large frame
5337 		 * and the destination interface does not support TSO.
5338 		 *
5339 		 * Note that with trailers, it's possible for a packet to
5340 		 * be large but not actually require segmentation.
5341 		 */
5342 		is_large_pkt = (len > (bridge_ifp->if_mtu + ETHER_HDR_LEN));
5343 		if (is_large_pkt) {
5344 			bool    is_large_tcp = false;
5345 
5346 			if (ether_type_flag_is_ip(etypef)) {
5347 				is_ipv4 = (etypef == ETHER_TYPE_FLAG_IPV4);
5348 				error = tso_hwassist(&scan, is_ipv4,
5349 				    dst_if, sizeof(struct ether_header),
5350 				    &need_sw_tso, &is_large_tcp);
5351 				if (is_large_tcp) {
5352 					cksum_op = CHECKSUM_OPERATION_NONE;
5353 				}
5354 			} else {
5355 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5356 				    "large non IP packet");
5357 			}
5358 		}
5359 		if (error != 0) {
5360 			if (scan != NULL) {
5361 				m_freem(scan);
5362 				scan = NULL;
5363 			}
5364 			out_errors++;
5365 		} else if (need_sw_tso) {
5366 			int             mac_hlen = sizeof(struct ether_header);
5367 			mblist          segs;
5368 
5369 			/* segment packets, add to list */
5370 			segs = gso_tcp_transmit(dst_if, scan, mac_hlen,
5371 			    is_ipv4);
5372 			if (segs.head != NULL) {
5373 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5374 				    "%s (%s) append gso #segs %u bytes %u",
5375 				    bridge_ifp->if_xname,
5376 				    dst_if->if_xname,
5377 				    segs.count, segs.bytes);
5378 				mblist_append_list(&out_list, segs);
5379 			} else {
5380 				out_errors++;
5381 			}
5382 		} else {
5383 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5384 			    "%s (%s) append %d bytes op %d",
5385 			    bridge_ifp->if_xname,
5386 			    dst_if->if_xname,
5387 			    len, cksum_op);
5388 			bridge_handle_checksum_op(src_if, dst_if,
5389 			    scan, cksum_op);
5390 			mblist_append(&out_list, scan);
5391 		}
5392 	}
5393 	if (out_list.head != NULL) {
5394 		errno_t error;
5395 
5396 		error = bridge_transmit(dst_if, out_list.head);
5397 		if (error != 0) {
5398 			out_errors++;
5399 		}
5400 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5401 		    "%s (%s) bridge_transmit packets %u bytes %u error %d",
5402 		    bridge_ifp->if_xname,
5403 		    dst_if->if_xname,
5404 		    out_list.count, out_list.bytes, error);
5405 	}
5406 	if (out_list.count != 0 || out_errors != 0) {
5407 		ifnet_stat_increment_out(bridge_ifp, out_list.count,
5408 		    out_list.bytes, out_errors);
5409 	}
5410 	return;
5411 }
5412 
5413 /*
5414  * bridge_member_output:
5415  *
5416  *	Send output from a bridge member interface.  This
5417  *	performs the bridging function for locally originated
5418  *	packets.
5419  *
5420  *	The mbuf has the Ethernet header already attached.
5421  */
5422 static errno_t
5423 bridge_member_output(struct bridge_softc *sc, ifnet_t ifp, mbuf_t *data)
5424 {
5425 	ifnet_t bridge_ifp;
5426 	struct ether_header *eh;
5427 	struct ifnet *dst_if;
5428 	uint16_t vlan;
5429 	struct bridge_iflist *mac_nat_bif;
5430 	ifnet_t mac_nat_ifp;
5431 	mbuf_t m = *data;
5432 
5433 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_OUTPUT,
5434 	    "ifp %s", ifp->if_xname);
5435 	if (m->m_len < ETHER_HDR_LEN) {
5436 		m = m_pullup(m, ETHER_HDR_LEN);
5437 		if (m == NULL) {
5438 			*data = NULL;
5439 			return EJUSTRETURN;
5440 		}
5441 	}
5442 
5443 	eh = mtod(m, struct ether_header *);
5444 	vlan = VLANTAGOF(m);
5445 
5446 	BRIDGE_LOCK(sc);
5447 	mac_nat_bif = sc->sc_mac_nat_bif;
5448 	mac_nat_ifp = (mac_nat_bif != NULL) ? mac_nat_bif->bif_ifp : NULL;
5449 	if (mac_nat_ifp == ifp) {
5450 		/* record the IP address used by the MAC NAT interface */
5451 		(void)bridge_mac_nat_output(sc, mac_nat_bif, data, NULL);
5452 		m = *data;
5453 		if (m == NULL) {
5454 			/* packet was deallocated */
5455 			BRIDGE_UNLOCK(sc);
5456 			return EJUSTRETURN;
5457 		}
5458 	}
5459 	bridge_ifp = sc->sc_ifp;
5460 
5461 	/*
5462 	 * APPLE MODIFICATION
5463 	 * If the packet is an 802.1X ethertype, then only send on the
5464 	 * original output interface.
5465 	 */
5466 	if (eh->ether_type == htons(ETHERTYPE_PAE)) {
5467 		dst_if = ifp;
5468 		goto sendunicast;
5469 	}
5470 
5471 	/*
5472 	 * If bridge is down, but the original output interface is up,
5473 	 * go ahead and send out that interface.  Otherwise, the packet
5474 	 * is dropped below.
5475 	 */
5476 	if ((bridge_ifp->if_flags & IFF_RUNNING) == 0) {
5477 		dst_if = ifp;
5478 		goto sendunicast;
5479 	}
5480 
5481 	/*
5482 	 * If the packet is a multicast, or we don't know a better way to
5483 	 * get there, send to all interfaces.
5484 	 */
5485 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
5486 		dst_if = NULL;
5487 	} else {
5488 		dst_if = bridge_rtlookup(sc, eh->ether_dhost, vlan);
5489 	}
5490 	if (dst_if == NULL) {
5491 		struct bridge_iflist *bif;
5492 		struct mbuf *mc;
5493 		errno_t error;
5494 
5495 
5496 		bridge_span(sc, m);
5497 
5498 		BRIDGE_LOCK2REF(sc, error);
5499 		if (error != 0) {
5500 			m_freem(m);
5501 			return EJUSTRETURN;
5502 		}
5503 
5504 		/*
5505 		 * Duplicate and send the packet across all member interfaces
5506 		 * except the originating interface.
5507 		 */
5508 		TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
5509 			dst_if = bif->bif_ifp;
5510 			if (dst_if == ifp) {
5511 				/* skip the originating interface */
5512 				continue;
5513 			}
5514 			/* skip interface with inactive link status */
5515 			if ((bif->bif_flags & BIFF_MEDIA_ACTIVE) == 0) {
5516 				continue;
5517 			}
5518 
5519 			/* skip interface that isn't running */
5520 			if ((dst_if->if_flags & IFF_RUNNING) == 0) {
5521 				continue;
5522 			}
5523 			/*
5524 			 * If the interface is participating in spanning
5525 			 * tree, make sure the port is in a state that
5526 			 * allows forwarding.
5527 			 */
5528 			if ((bif->bif_ifflags & IFBIF_STP) &&
5529 			    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
5530 				continue;
5531 			}
5532 			/*
5533 			 * If the destination is the MAC NAT interface,
5534 			 * skip sending the packet. The packet can't be sent
5535 			 * if the source MAC is incorrect.
5536 			 */
5537 			if (dst_if == mac_nat_ifp) {
5538 				continue;
5539 			}
5540 
5541 			/* make a deep copy to send on this member interface */
5542 			mc = m_dup(m, M_DONTWAIT);
5543 			if (mc == NULL) {
5544 				(void)ifnet_stat_increment_out(bridge_ifp,
5545 				    0, 0, 1);
5546 				continue;
5547 			}
5548 			(void)bridge_enqueue(bridge_ifp, ifp, dst_if,
5549 			    mc, CHECKSUM_OPERATION_COMPUTE);
5550 		}
5551 		BRIDGE_UNREF(sc);
5552 
5553 		if ((ifp->if_flags & IFF_RUNNING) == 0) {
5554 			m_freem(m);
5555 			return EJUSTRETURN;
5556 		}
5557 		/* allow packet to continue on the originating interface */
5558 		return 0;
5559 	}
5560 
5561 sendunicast:
5562 	/*
5563 	 * XXX Spanning tree consideration here?
5564 	 */
5565 
5566 	bridge_span(sc, m);
5567 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
5568 		m_freem(m);
5569 		BRIDGE_UNLOCK(sc);
5570 		return EJUSTRETURN;
5571 	}
5572 
5573 	BRIDGE_UNLOCK(sc);
5574 	if (dst_if == ifp) {
5575 		/* allow packet to continue on the originating interface */
5576 		return 0;
5577 	}
5578 	if (dst_if != mac_nat_ifp) {
5579 		(void) bridge_enqueue(bridge_ifp, ifp, dst_if, m,
5580 		    CHECKSUM_OPERATION_COMPUTE);
5581 	} else {
5582 		/*
5583 		 * This is not the original output interface
5584 		 * and the destination is the MAC NAT interface.
5585 		 * Drop the packet because the packet can't be sent
5586 		 * if the source MAC is incorrect.
5587 		 */
5588 		m_freem(m);
5589 	}
5590 	return EJUSTRETURN;
5591 }
5592 
5593 /*
5594  * Output callback.
5595  *
5596  * This routine is called externally from above only when if_bridge_txstart
5597  * is disabled; otherwise it is called internally by bridge_start().
5598  */
5599 static int
5600 bridge_output(struct ifnet *ifp, struct mbuf *m)
5601 {
5602 	struct bridge_softc * __single sc = ifnet_softc(ifp);
5603 	struct ether_header *eh;
5604 	struct ifnet *dst_if = NULL;
5605 	int error = 0;
5606 
5607 	eh = mtod(m, struct ether_header *);
5608 
5609 	BRIDGE_LOCK(sc);
5610 
5611 	if (!IS_BCAST_MCAST(m)) {
5612 		dst_if = bridge_rtlookup(sc, eh->ether_dhost, 0);
5613 	}
5614 
5615 	(void) ifnet_stat_increment_out(ifp, 1, m->m_pkthdr.len, 0);
5616 
5617 	BRIDGE_BPF_TAP_OUT(ifp, m);
5618 
5619 	if (dst_if == NULL) {
5620 		/* callee will unlock */
5621 		bridge_broadcast(sc, NULL, m);
5622 	} else {
5623 		ifnet_t bridge_ifp;
5624 
5625 		bridge_ifp = sc->sc_ifp;
5626 		BRIDGE_UNLOCK(sc);
5627 
5628 		error = bridge_enqueue(bridge_ifp, NULL, dst_if, m,
5629 		    CHECKSUM_OPERATION_FINALIZE);
5630 	}
5631 
5632 	return error;
5633 }
5634 
5635 static void
5636 bridge_finalize_cksum(struct ifnet *ifp, struct mbuf *m)
5637 {
5638 	struct ether_header *eh;
5639 	bool is_ipv4;
5640 	uint32_t sw_csum, hwcap;
5641 	uint32_t did_sw;
5642 	uint32_t csum_flags;
5643 
5644 	eh = mtod(m, struct ether_header *);
5645 	if (!ether_header_type_is_ip(eh, &is_ipv4)) {
5646 		return;
5647 	}
5648 
5649 	/* do in software what the hardware cannot */
5650 	hwcap = (ifp->if_hwassist | CSUM_DATA_VALID);
5651 	csum_flags = m->m_pkthdr.csum_flags;
5652 	sw_csum = csum_flags & ~IF_HWASSIST_CSUM_FLAGS(hwcap);
5653 	sw_csum &= IF_HWASSIST_CSUM_MASK;
5654 
5655 	if (is_ipv4) {
5656 		if ((hwcap & CSUM_PARTIAL) && !(sw_csum & CSUM_DELAY_DATA) &&
5657 		    (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA)) {
5658 			if (m->m_pkthdr.csum_flags & CSUM_TCP) {
5659 				uint16_t start =
5660 				    sizeof(*eh) + sizeof(struct ip);
5661 				uint16_t ulpoff =
5662 				    m->m_pkthdr.csum_data & 0xffff;
5663 				m->m_pkthdr.csum_flags |=
5664 				    (CSUM_DATA_VALID | CSUM_PARTIAL);
5665 				m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
5666 				m->m_pkthdr.csum_tx_start = start;
5667 			} else {
5668 				sw_csum |= (CSUM_DELAY_DATA &
5669 				    m->m_pkthdr.csum_flags);
5670 			}
5671 		}
5672 		did_sw = in_finalize_cksum(m, sizeof(*eh), sw_csum);
5673 	} else {
5674 		if ((hwcap & CSUM_PARTIAL) &&
5675 		    !(sw_csum & CSUM_DELAY_IPV6_DATA) &&
5676 		    (m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)) {
5677 			if (m->m_pkthdr.csum_flags & CSUM_TCPIPV6) {
5678 				uint16_t start =
5679 				    sizeof(*eh) + sizeof(struct ip6_hdr);
5680 				uint16_t ulpoff =
5681 				    m->m_pkthdr.csum_data & 0xffff;
5682 				m->m_pkthdr.csum_flags |=
5683 				    (CSUM_DATA_VALID | CSUM_PARTIAL);
5684 				m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
5685 				m->m_pkthdr.csum_tx_start = start;
5686 			} else {
5687 				sw_csum |= (CSUM_DELAY_IPV6_DATA &
5688 				    m->m_pkthdr.csum_flags);
5689 			}
5690 		}
5691 		did_sw = in6_finalize_cksum(m, sizeof(*eh), -1, -1, sw_csum);
5692 	}
5693 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
5694 	    "[%s] before 0x%x hwcap 0x%x sw_csum 0x%x did 0x%x after 0x%x",
5695 	    ifp->if_xname, csum_flags, hwcap, sw_csum,
5696 	    did_sw, m->m_pkthdr.csum_flags);
5697 }
5698 
5699 /*
5700  * bridge_start:
5701  *
5702  *	Start output on a bridge.
5703  *
5704  * This routine is invoked by the start worker thread; because we never call
5705  * it directly, there is no need do deploy any serialization mechanism other
5706  * than what's already used by the worker thread, i.e. this is already single
5707  * threaded.
5708  *
5709  * This routine is called only when if_bridge_txstart is enabled.
5710  */
5711 static void
5712 bridge_start(struct ifnet *ifp)
5713 {
5714 	mbuf_ref_t m;
5715 
5716 	for (;;) {
5717 		if (ifnet_dequeue(ifp, &m) != 0) {
5718 			break;
5719 		}
5720 
5721 		(void) bridge_output(ifp, m);
5722 	}
5723 }
5724 
5725 /*
5726  * bridge_forward:
5727  *
5728  *	The forwarding function of the bridge.
5729  *
5730  *	NOTE: Releases the lock on return.
5731  */
5732 static void
5733 bridge_forward(struct bridge_softc *sc, struct bridge_iflist *sbif,
5734     struct mbuf *m)
5735 {
5736 	struct bridge_iflist *dbif;
5737 	ifnet_t bridge_ifp;
5738 	struct ifnet *src_if, *dst_if;
5739 	struct ether_header *eh;
5740 	uint16_t vlan;
5741 	uint8_t *dst;
5742 	int error;
5743 	struct mac_nat_record mnr;
5744 	bool translate_mac = FALSE;
5745 	uint32_t sc_filter_flags;
5746 
5747 	BRIDGE_LOCK_ASSERT_HELD(sc);
5748 
5749 	bridge_ifp = sc->sc_ifp;
5750 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_OUTPUT,
5751 	    "%s m 0x%llx", bridge_ifp->if_xname,
5752 	    (uint64_t)VM_KERNEL_ADDRPERM(m));
5753 
5754 	src_if = sbif->bif_ifp;
5755 	VERIFY(src_if == m->m_pkthdr.rcvif);
5756 
5757 	(void) ifnet_stat_increment_in(bridge_ifp, 1, m->m_pkthdr.len, 0);
5758 	vlan = VLANTAGOF(m);
5759 
5760 	eh = mtod(m, struct ether_header *);
5761 	dst = eh->ether_dhost;
5762 
5763 	/* If the interface is learning, record the address. */
5764 	if (sbif->bif_ifflags & IFBIF_LEARNING) {
5765 		error = bridge_rtupdate(sc, eh->ether_shost, vlan,
5766 		    sbif, 0, IFBAF_DYNAMIC);
5767 		/*
5768 		 * If the interface has addresses limits then deny any source
5769 		 * that is not in the cache.
5770 		 */
5771 		if (error && sbif->bif_addrmax) {
5772 			goto drop;
5773 		}
5774 	}
5775 
5776 	if ((sbif->bif_ifflags & IFBIF_STP) != 0 &&
5777 	    sbif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
5778 		goto drop;
5779 	}
5780 
5781 	/*
5782 	 * At this point, the port either doesn't participate
5783 	 * in spanning tree or it is in the forwarding state.
5784 	 */
5785 
5786 	/*
5787 	 * If the packet is unicast, destined for someone on
5788 	 * "this" side of the bridge, drop it.
5789 	 */
5790 	if (!IS_BCAST_MCAST(m)) {
5791 		/* unicast */
5792 		dst_if = bridge_rtlookup(sc, dst, vlan);
5793 		if (src_if == dst_if) {
5794 			goto drop;
5795 		}
5796 	} else {
5797 		/* broadcast/multicast */
5798 
5799 		/*
5800 		 * Check if it's a reserved multicast address, any address
5801 		 * listed in 802.1D section 7.12.6 may not be forwarded by the
5802 		 * bridge.
5803 		 * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
5804 		 */
5805 		if (dst[0] == 0x01 && dst[1] == 0x80 &&
5806 		    dst[2] == 0xc2 && dst[3] == 0x00 &&
5807 		    dst[4] == 0x00 && dst[5] <= 0x0f) {
5808 			goto drop;
5809 		}
5810 		/* ...forward it to all interfaces. */
5811 		os_atomic_inc(&bridge_ifp->if_imcasts, relaxed);
5812 		dst_if = NULL;
5813 	}
5814 
5815 	/*
5816 	 * If we have a destination interface which is a member of our bridge,
5817 	 * OR this is a unicast packet, push it through the bpf(4) machinery.
5818 	 * For broadcast or multicast packets, don't bother because it will
5819 	 * be reinjected into ether_input. We do this before we pass the packets
5820 	 * through the pfil(9) framework, as it is possible that pfil(9) will
5821 	 * drop the packet, or possibly modify it, making it difficult to debug
5822 	 * firewall issues on the bridge.
5823 	 */
5824 #if NBPFILTER > 0
5825 	if (eh->ether_type == htons(ETHERTYPE_RSN_PREAUTH) ||
5826 	    dst_if != NULL || !IS_BCAST_MCAST(m)) {
5827 		m->m_pkthdr.rcvif = bridge_ifp;
5828 		BRIDGE_BPF_TAP_IN(bridge_ifp, m);
5829 	}
5830 #endif /* NBPFILTER */
5831 
5832 	if (dst_if == NULL) {
5833 		/* bridge_broadcast will unlock */
5834 		bridge_broadcast(sc, sbif, m);
5835 		return;
5836 	}
5837 
5838 	/*
5839 	 * Unicast.
5840 	 */
5841 	/*
5842 	 * At this point, we're dealing with a unicast frame
5843 	 * going to a different interface.
5844 	 */
5845 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
5846 		goto drop;
5847 	}
5848 
5849 	dbif = bridge_lookup_member_if(sc, dst_if);
5850 	if (dbif == NULL) {
5851 		/* Not a member of the bridge (anymore?) */
5852 		goto drop;
5853 	}
5854 
5855 	/* Private segments can not talk to each other */
5856 	if (sbif->bif_ifflags & dbif->bif_ifflags & IFBIF_PRIVATE) {
5857 		goto drop;
5858 	}
5859 
5860 	if ((dbif->bif_ifflags & IFBIF_STP) &&
5861 	    dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
5862 		goto drop;
5863 	}
5864 	if (dbif == sc->sc_mac_nat_bif) {
5865 		/* determine how to translate the packet */
5866 		translate_mac
5867 		        = bridge_mac_nat_output(sc, sbif, &m, &mnr);
5868 		if (m == NULL) {
5869 			/* packet was deallocated */
5870 			BRIDGE_UNLOCK(sc);
5871 			return;
5872 		}
5873 	} else if (bif_has_checksum_offload(dbif) &&
5874 	    !bif_has_checksum_offload(sbif)) {
5875 		/*
5876 		 * If the destination interface has checksum offload enabled,
5877 		 * verify the checksum now, unless the source interface also has
5878 		 * checksum offload enabled. The checksum in that case has
5879 		 * already just been computed and verifying it is unnecessary.
5880 		 */
5881 		error = bridge_verify_checksum(&m, &dbif->bif_stats);
5882 		if (error != 0) {
5883 			BRIDGE_UNLOCK(sc);
5884 			if (m != NULL) {
5885 				m_freem(m);
5886 			}
5887 			return;
5888 		}
5889 	}
5890 
5891 	sc_filter_flags = sc->sc_filter_flags;
5892 
5893 	BRIDGE_UNLOCK(sc);
5894 
5895 	if (translate_mac) {
5896 		/* if we need to, translate the MAC address */
5897 		bridge_mac_nat_translate(&m, &mnr, IF_LLADDR(dst_if));
5898 	}
5899 
5900 	if (m != NULL && PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
5901 		if (bridge_pf(&m, dst_if, sc_filter_flags, false) != 0) {
5902 			return;
5903 		}
5904 		if (m == NULL) {
5905 			return;
5906 		}
5907 	}
5908 
5909 	/*
5910 	 * We're forwarding an inbound packet in which the checksum must
5911 	 * already have been computed and if required, verified.
5912 	 */
5913 	if (m != NULL) {
5914 		(void) bridge_enqueue(bridge_ifp, src_if, dst_if, m,
5915 		    CHECKSUM_OPERATION_CLEAR_OFFLOAD);
5916 	}
5917 	return;
5918 
5919 drop:
5920 	BRIDGE_UNLOCK(sc);
5921 	m_freem(m);
5922 }
5923 
5924 static void
5925 prepare_input_packet(ifnet_t ifp, mbuf_t m)
5926 {
5927 	mbuf_pkthdr_setrcvif(m, ifp);
5928 	mbuf_pkthdr_setheader(m, mtod(m, void *));
5929 	/* adjust frame to skip mac-layer header */
5930 	_mbuf_adjust_pkthdr_and_data(m, ETHER_HDR_LEN);
5931 }
5932 
5933 static void
5934 inject_input_packet(ifnet_t ifp, mbuf_t m)
5935 {
5936 	prepare_input_packet(ifp, m);
5937 	m->m_flags |= M_PROTO1; /* set to avoid loops */
5938 	dlil_input_packet_list(ifp, m);
5939 	return;
5940 }
5941 
5942 static void
5943 inject_input_packet_list(ifnet_t ifp, mbuf_t in_list, bool m_proto1)
5944 {
5945 	for (mbuf_t scan = in_list; scan != NULL; scan = scan->m_nextpkt) {
5946 		/* mark the packets as arriving on the interface */
5947 		BRIDGE_BPF_TAP_IN(ifp, scan);
5948 		if (m_proto1) {
5949 			scan->m_flags |= M_PROTO1; /* set to avoid loops */
5950 		}
5951 		prepare_input_packet(ifp, scan);
5952 	}
5953 	dlil_input_packet_list(ifp, in_list);
5954 	return;
5955 }
5956 
5957 static void
5958 adjust_input_packet_list(mbuf_t in_list)
5959 {
5960 	for (mbuf_t scan = in_list; scan != NULL; scan = scan->m_nextpkt) {
5961 		mbuf_pkthdr_setheader(scan, mtod(scan, void *));
5962 		_mbuf_adjust_pkthdr_and_data(scan, ETHER_HDR_LEN);
5963 	}
5964 }
5965 
5966 static bool
5967 in_addr_is_ours(struct in_addr ip)
5968 {
5969 	struct in_ifaddr *ia;
5970 	bool             ours = false;
5971 
5972 	lck_rw_lock_shared(&in_ifaddr_rwlock);
5973 	TAILQ_FOREACH(ia, INADDR_HASH(ip.s_addr), ia_hash) {
5974 		if (ia->ia_addr.sin_addr.s_addr == ip.s_addr) {
5975 			ours = true;
5976 			break;
5977 		}
5978 	}
5979 	lck_rw_done(&in_ifaddr_rwlock);
5980 	return ours;
5981 }
5982 
5983 static bool
5984 in6_addr_is_ours(const struct in6_addr * ip6_p, uint32_t ifscope)
5985 {
5986 	struct in6_addr         dst_ip;
5987 	struct in6_ifaddr       *ia6;
5988 	bool                    ours = false;
5989 
5990 	if (in6_embedded_scope && IN6_IS_ADDR_LINKLOCAL(ip6_p)) {
5991 		/* need to embed scope ID for comparison */
5992 		bcopy(ip6_p, &dst_ip, sizeof(dst_ip));
5993 		dst_ip.s6_addr16[1] = htons(ifscope);
5994 		ip6_p = &dst_ip;
5995 	}
5996 	lck_rw_lock_shared(&in6_ifaddr_rwlock);
5997 	TAILQ_FOREACH(ia6, IN6ADDR_HASH(ip6_p), ia6_hash) {
5998 		if (in6_are_addr_equal_scoped(&ia6->ia_addr.sin6_addr, ip6_p,
5999 		    ia6->ia_addr.sin6_scope_id, ifscope)) {
6000 			ours = true;
6001 			break;
6002 		}
6003 	}
6004 	lck_rw_done(&in6_ifaddr_rwlock);
6005 	return ours;
6006 }
6007 
6008 
6009 static void
6010 bridge_interface_input(ifnet_t bridge_ifp, mbuf_t m, bool has_address)
6011 {
6012 	bool                    do_segment;
6013 	struct ether_header     *eh;
6014 	uint32_t                in_bytes;
6015 	uint32_t                in_count;
6016 	uint32_t                in_errors = 0;
6017 	bool                    is_ipv4;
6018 	u_int                   mac_hlen;
6019 	mblist                  seg;
6020 
6021 	/* segment large packets before sending them up */
6022 	in_count = 1;
6023 	in_bytes = mbuf_pkthdr_len(m);
6024 	if (!has_address) {
6025 		/* bridge has no address, so we're not forwarding */
6026 		goto done;
6027 	}
6028 	if (if_bridge_segmentation == 0) {
6029 		goto done;
6030 	}
6031 	if (in_bytes <= (bridge_ifp->if_mtu + ETHER_HDR_LEN)) {
6032 		goto done;
6033 	}
6034 	eh = mtod(m, struct ether_header *);
6035 	if (!ether_header_type_is_ip(eh, &is_ipv4)) {
6036 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
6037 		    "large non IPv4/IPv6 packet");
6038 		goto done;
6039 	}
6040 	/* no need to segment if the packet will not be forwarded */
6041 	if (is_ipv4) {
6042 		do_segment = (ipforwarding != 0);
6043 	} else {
6044 		do_segment = (ip6_forwarding != 0);
6045 	}
6046 	if (!do_segment) {
6047 		goto done;
6048 	}
6049 
6050 	/*
6051 	 * We have a large IPv4/IPv6 TCP packet. Segment it if required.
6052 	 *
6053 	 * If gso_tcp_receive() returns non-NULL packets, the packet(s) are
6054 	 * ready to be passed up. If the destination is a local IP address,
6055 	 * the packet will not be segmented.
6056 	 */
6057 	mac_hlen = sizeof(*eh);
6058 	seg = gso_tcp_receive(bridge_ifp, m, mac_hlen, is_ipv4);
6059 	if (seg.head == NULL) {
6060 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
6061 		    "gso_tcp returned no packets");
6062 		in_errors++;
6063 		in_bytes = in_count = 0;
6064 		m = NULL;
6065 	} else {
6066 		m = seg.head;
6067 		in_count = seg.count;
6068 		in_bytes = seg.bytes;
6069 	}
6070 
6071 done:
6072 	if (m != NULL) {
6073 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6074 		    "%s packets %d bytes %d",
6075 		    bridge_ifp->if_xname, in_count, in_bytes);
6076 		/* Mark the packets as arriving on the bridge interface */
6077 		inject_input_packet_list(bridge_ifp, m, false);
6078 	}
6079 	ifnet_stat_increment_in(bridge_ifp, in_count, in_bytes, in_errors);
6080 	return;
6081 }
6082 
6083 static void
6084 bridge_interface_input_list(ifnet_t bridge_ifp, ether_type_flag_t etypef,
6085     mblist list, bool has_address)
6086 {
6087 	bool            do_segment = false;
6088 	uint32_t        in_errors = 0;
6089 	bool            is_ipv4;
6090 	mblist          in_list;
6091 	u_int           mac_hlen;
6092 	mbuf_t          next_packet;
6093 
6094 	if (has_address && if_bridge_segmentation != 0 &&
6095 	    ether_type_flag_is_ip(etypef)) {
6096 		if (etypef == ETHER_TYPE_FLAG_IPV4) {
6097 			is_ipv4 = true;
6098 			do_segment = (ipforwarding != 0);
6099 		} else {
6100 			is_ipv4 = false;
6101 			do_segment = (ip6_forwarding != 0);
6102 		}
6103 	}
6104 	if (!do_segment) {
6105 		in_list = list;
6106 		goto done;
6107 	}
6108 
6109 	mblist_init(&in_list);
6110 	mac_hlen = sizeof(struct ether_header);
6111 	for (mbuf_t scan = list.head; scan != NULL; scan = next_packet) {
6112 		uint32_t        len;
6113 		mblist          seg;
6114 
6115 		/* take it out of the list */
6116 		next_packet = scan->m_nextpkt;
6117 		scan->m_nextpkt = NULL;
6118 
6119 		/* check whether it might need segmentation */
6120 		len = mbuf_pkthdr_len(scan);
6121 		if (len <= (bridge_ifp->if_mtu + ETHER_HDR_LEN)) {
6122 			mblist_append(&in_list, scan);
6123 		} else {
6124 			/* segment before sending up */
6125 			seg = gso_tcp_receive(bridge_ifp, scan, mac_hlen,
6126 			    is_ipv4);
6127 			if (seg.head == NULL) {
6128 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
6129 				    "gso_tcp returned no packets");
6130 				in_errors++;
6131 			} else {
6132 				mblist_append_list(&in_list, seg);
6133 			}
6134 		}
6135 	}
6136 
6137 done:
6138 	if (in_list.head != NULL) {
6139 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6140 		    "%s packets %d bytes %d",
6141 		    bridge_ifp->if_xname,
6142 		    in_list.count, in_list.bytes);
6143 		/* Mark the packets as arriving on the bridge interface */
6144 		inject_input_packet_list(bridge_ifp, in_list.head, false);
6145 		ifnet_stat_increment_in(bridge_ifp, in_list.count,
6146 		    in_list.bytes, in_errors);
6147 	}
6148 	return;
6149 }
6150 
6151 /*
6152  * bridge_input:
6153  *
6154  *	Filter input from a member interface.  Queue the packet for
6155  *	bridging if it is not for us.
6156  */
6157 errno_t
6158 bridge_input(struct ifnet *ifp, mbuf_t *data)
6159 {
6160 	struct bridge_softc * __single sc = ifp->if_bridge;
6161 	struct bridge_iflist *bif, *bif2;
6162 	uint8_t *dhost;
6163 	struct ether_header eh_in;
6164 	bool is_ip = false;
6165 	bool is_ipv4 = false;
6166 	ifnet_t bridge_ifp;
6167 	unsigned int mac_hlen = sizeof(struct ether_header);
6168 	uint16_t vlan;
6169 	errno_t error;
6170 	ip_packet_info info;
6171 	bool is_broadcast;
6172 	bool is_ip_broadcast = false;
6173 	bool is_ifp_mac = false;
6174 	mbuf_t m;
6175 	uint32_t sc_filter_flags;
6176 	bool bridge_has_address;
6177 
6178 	if (sc == NULL) {
6179 		return 0;
6180 	}
6181 	m = *data;
6182 	is_broadcast = IS_BCAST_MCAST(m);
6183 
6184 	bridge_ifp = sc->sc_ifp;
6185 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6186 	    "%s %sfrom %s m 0x%llx data 0x%llx",
6187 	    bridge_ifp->if_xname, is_broadcast ? "bcast_mcast " : "",
6188 	    ifp->if_xname,
6189 	    (uint64_t)VM_KERNEL_ADDRPERM(m),
6190 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(m, void *)));
6191 	if ((bridge_ifp->if_flags & IFF_RUNNING) == 0) {
6192 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6193 		    "%s not running passing along",
6194 		    bridge_ifp->if_xname);
6195 		return 0;
6196 	}
6197 
6198 	vlan = VLANTAGOF(m);
6199 
6200 	if (!is_broadcast) {
6201 		/*
6202 		 * Need to clear the promiscuous flag otherwise it will be
6203 		 * dropped by DLIL after processing filters
6204 		 */
6205 		if ((m->m_flags & M_PROMISC) != 0) {
6206 			m->m_flags &= ~M_PROMISC;
6207 		} else {
6208 			is_ifp_mac = true;
6209 		}
6210 	}
6211 
6212 
6213 	/* copy the ethernet header */
6214 	eh_in = *(mtod(m, struct ether_header *));
6215 	dhost = eh_in.ether_dhost;
6216 
6217 	is_ip = ether_header_type_is_ip(&eh_in, &is_ipv4);
6218 
6219 	sc_filter_flags = sc->sc_filter_flags;
6220 	if (PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
6221 		error = bridge_pf(data, ifp, sc_filter_flags, true);
6222 		m = *data;
6223 		if (error != 0 || m == NULL) {
6224 			return EJUSTRETURN;
6225 		}
6226 	}
6227 
6228 	BRIDGE_LOCK(sc);
6229 	bif = bridge_lookup_member_if(sc, ifp);
6230 	if (bif == NULL) {
6231 		BRIDGE_UNLOCK(sc);
6232 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6233 		    "%s bridge_lookup_member_if failed",
6234 		    bridge_ifp->if_xname);
6235 		return 0;
6236 	}
6237 	if (is_ip && bif_has_checksum_offload(bif)) {
6238 		error = bridge_get_ip_proto(data, mac_hlen, is_ipv4,
6239 		    &info, &bif->bif_stats.brms_in_ip);
6240 		if (error != 0) {
6241 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_CHECKSUM,
6242 			    "%s(%s) bridge_get_ip_proto failed %d",
6243 			    bridge_ifp->if_xname,
6244 			    bif->bif_ifp->if_xname, error);
6245 		} else {
6246 			/* need to compute IP/UDP/TCP/checksums */
6247 			error = bridge_offload_checksum(data, &info,
6248 			    &bif->bif_stats);
6249 			if (error != 0) {
6250 				BRIDGE_LOG(LOG_NOTICE, BR_DBGF_CHECKSUM,
6251 				    "%s(%s) bridge_offload_checksum failed %d",
6252 				    bridge_ifp->if_xname,
6253 				    bif->bif_ifp->if_xname, error);
6254 			}
6255 		}
6256 		if (error != 0) {
6257 			BRIDGE_UNLOCK(sc);
6258 			if (*data != NULL) {
6259 				m_freem(*data);
6260 				*data = NULL;
6261 			}
6262 			return EJUSTRETURN;
6263 		}
6264 		m = *data;
6265 	}
6266 
6267 	if (bif->bif_flags & BIFF_HOST_FILTER) {
6268 		error = bridge_host_filter(bif, data);
6269 		if (error != 0) {
6270 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
6271 			    "%s bridge_host_filter failed",
6272 			    bif->bif_ifp->if_xname);
6273 			BRIDGE_UNLOCK(sc);
6274 			return EJUSTRETURN;
6275 		}
6276 		m = *data;
6277 	}
6278 
6279 	/*
6280 	 * A link-layer unicast packet directed at the MAC-NAT interface
6281 	 * could be an IP broadcast packet. An IP broadcast packet needs to
6282 	 * be forwarded like regular link-layer broadcast.
6283 	 */
6284 	if (sc->sc_mac_nat_bif == bif && is_ifp_mac && is_ip) {
6285 		is_ip_broadcast = is_broadcast_ip_packet(data);
6286 		m = *data;
6287 		if (m == NULL) {
6288 			BRIDGE_UNLOCK(sc);
6289 			return EJUSTRETURN;
6290 		}
6291 	}
6292 
6293 	bridge_span(sc, m);
6294 
6295 	if (is_broadcast || is_ip_broadcast) {
6296 		struct mbuf *mc;
6297 
6298 		if (IS_MCAST(m)) {
6299 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MCAST,
6300 			    " multicast: "
6301 			    "%02x:%02x:%02x:%02x:%02x:%02x",
6302 			    dhost[0], dhost[1],
6303 			    dhost[2], dhost[3],
6304 			    dhost[4], dhost[5]);
6305 			/* Tap off 802.1D packets; they do not get forwarded. */
6306 			if (_ether_cmp(dhost, bstp_etheraddr) == 0) {
6307 #if BRIDGESTP
6308 				bstp_input(&bif->bif_stp, m);
6309 				m = NULL;
6310 #else /* !BRIDGESTP */
6311 				m_freem(m);
6312 				*data = m = NULL;
6313 #endif /* !BRIDGESTP */
6314 				if (m == NULL) {
6315 					BRIDGE_UNLOCK(sc);
6316 					return EJUSTRETURN;
6317 				}
6318 			}
6319 		} else if (is_broadcast) {
6320 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MCAST,
6321 			    " broadcast: "
6322 			    "%02x:%02x:%02x:%02x:%02x:%02x",
6323 			    dhost[0], dhost[1],
6324 			    dhost[2], dhost[3],
6325 			    dhost[4], dhost[5]);
6326 		}
6327 
6328 		if ((bif->bif_ifflags & IFBIF_STP) &&
6329 		    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
6330 			BRIDGE_UNLOCK(sc);
6331 			return 0;
6332 		}
6333 		/*
6334 		 * Make a deep copy of the packet and enqueue the copy
6335 		 * for bridge processing.
6336 		 */
6337 		mc = m_dup(m, M_DONTWAIT);
6338 		if (mc == NULL) {
6339 			BRIDGE_UNLOCK(sc);
6340 			return 0;
6341 		}
6342 		/*
6343 		 * Perform the bridge forwarding function with the copy.
6344 		 *
6345 		 * Note that bridge_forward calls BRIDGE_UNLOCK
6346 		 */
6347 		if (is_ip_broadcast) {
6348 			struct ether_header *eh;
6349 
6350 			/* make the copy look like it is actually broadcast */
6351 			mc->m_flags |= M_BCAST;
6352 			eh = mtod(mc, struct ether_header *);
6353 			bcopy(etherbroadcastaddr, eh->ether_dhost,
6354 			    ETHER_ADDR_LEN);
6355 		}
6356 
6357 		bridge_forward(sc, bif, mc);
6358 
6359 		/*
6360 		 * Reinject the mbuf as arriving on the bridge so we have a
6361 		 * chance at claiming multicast packets. We can not loop back
6362 		 * here from ether_input as a bridge is never a member of a
6363 		 * bridge.
6364 		 */
6365 		if (is_broadcast) {
6366 			VERIFY(bridge_ifp->if_bridge == NULL);
6367 			mc = m_dup(m, M_DONTWAIT);
6368 			if (mc != NULL) {
6369 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MCAST,
6370 				    "%s mcast for us", bridge_ifp->if_xname);
6371 				BRIDGE_BPF_TAP_IN(ifp, mc);
6372 				prepare_input_packet(bridge_ifp, mc);
6373 				ifnet_stat_increment_in(bridge_ifp, 1,
6374 				    mbuf_pkthdr_len(mc), 0);
6375 				dlil_input_packet_list(bridge_ifp, mc);
6376 			}
6377 		}
6378 
6379 		/* Return the original packet for local processing. */
6380 		return 0;
6381 	}
6382 
6383 	if ((bif->bif_ifflags & IFBIF_STP) &&
6384 	    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
6385 		BRIDGE_UNLOCK(sc);
6386 		return 0;
6387 	}
6388 
6389 #define GRAB_OUR_PACKETS(iface)                                         \
6390 	/* It is destined for us. */                                    \
6391 	if (_ether_cmp(IF_LLADDR((iface)), dhost) == 0) {               \
6392 	        BRIDGE_BPF_TAP_IN(iface, m);                            \
6393 	        if (bif->bif_ifflags & IFBIF_LEARNING) {                \
6394 	                error = bridge_rtupdate(sc, eh_in.ether_shost,  \
6395 	                    vlan, bif, 0, IFBAF_DYNAMIC);               \
6396 	                if (error && bif->bif_addrmax) {                \
6397 	                        BRIDGE_UNLOCK(sc);                      \
6398 	                        m_freem(m);                             \
6399 	                        return (EJUSTRETURN);                   \
6400 	                }                                               \
6401 	        }                                                       \
6402 	        BRIDGE_UNLOCK(sc);                                      \
6403 	        inject_input_packet(iface, m);                          \
6404 	        return (EJUSTRETURN);                                   \
6405 	}                                                               \
6406                                                                         \
6407 	/* We just received a packet that we sent out. */               \
6408 	if (_ether_cmp(IF_LLADDR((iface)), eh_in.ether_shost) == 0) {   \
6409 	        BRIDGE_UNLOCK(sc);                                      \
6410 	        m_freem(m);                                             \
6411 	        return (EJUSTRETURN);                                   \
6412 	}
6413 
6414 	/*
6415 	 * Unicast.
6416 	 */
6417 
6418 	/* handle MAC-NAT if enabled */
6419 	if (is_ifp_mac && sc->sc_mac_nat_bif == bif) {
6420 		ifnet_ref_t dst_if = NULL;
6421 
6422 		m = *data = bridge_mac_nat_input(sc, ifp, m, &dst_if);
6423 		if (m == NULL) {
6424 			/* packet was deallocated */
6425 			BRIDGE_UNLOCK(sc);
6426 			return EJUSTRETURN;
6427 		}
6428 		if (dst_if != NULL) {
6429 			/* need to forward the packet */
6430 			BRIDGE_UNLOCK(sc);
6431 			(void)bridge_enqueue(bridge_ifp, NULL,
6432 			    dst_if, m,
6433 			    CHECKSUM_OPERATION_CLEAR_OFFLOAD);
6434 			return EJUSTRETURN;
6435 		}
6436 	}
6437 
6438 	/*
6439 	 * If the destination MAC matches the bridge interface, and
6440 	 * the bridge has an address assigned, or the address is
6441 	 * distinct from the receive interface, claim the packets
6442 	 * for the bridge interface.
6443 	 */
6444 	bridge_has_address = (sc->sc_flags & SCF_ADDRESS_ASSIGNED) != 0;
6445 	if (_ether_cmp(dhost, IF_LLADDR(bridge_ifp)) == 0 &&
6446 	    (bridge_has_address || _ether_cmp(dhost, IF_LLADDR(ifp)) != 0)) {
6447 		/*
6448 		 * If the interface is learning, and the source
6449 		 * address is valid and not multicast, record
6450 		 * the address.
6451 		 */
6452 		if (bif->bif_ifflags & IFBIF_LEARNING) {
6453 			(void) bridge_rtupdate(sc, eh_in.ether_shost,
6454 			    vlan, bif, 0, IFBAF_DYNAMIC);
6455 		}
6456 		BRIDGE_UNLOCK(sc);
6457 		bridge_interface_input(bridge_ifp, m, bridge_has_address);
6458 		return EJUSTRETURN;
6459 	}
6460 
6461 	/*
6462 	 * if the destination of the packet is for the MAC address of
6463 	 * the member interface itself, then we don't need to forward
6464 	 * it -- just pass it back.  Note that it'll likely just be
6465 	 * dropped by the stack, but if something else is bound to
6466 	 * the interface directly (for example, the wireless stats
6467 	 * protocol -- although that actually uses BPF right now),
6468 	 * then it will consume the packet
6469 	 *
6470 	 * ALSO, note that we do this check AFTER checking for the
6471 	 * bridge's own MAC address, because the bridge may be
6472 	 * using the SAME MAC address as one of its interfaces
6473 	 */
6474 	if (is_ifp_mac) {
6475 		BRIDGE_UNLOCK(sc);
6476 		return 0;
6477 	}
6478 
6479 	/* Now check the remaining bridge members. */
6480 	TAILQ_FOREACH(bif2, &sc->sc_iflist, bif_next) {
6481 		if (bif2->bif_ifp != ifp) {
6482 			GRAB_OUR_PACKETS(bif2->bif_ifp);
6483 		}
6484 	}
6485 
6486 #undef GRAB_OUR_PACKETS
6487 
6488 	/*
6489 	 * Perform the bridge forwarding function.
6490 	 *
6491 	 * Note that bridge_forward calls BRIDGE_UNLOCK
6492 	 */
6493 	bridge_forward(sc, bif, m);
6494 
6495 	return EJUSTRETURN;
6496 }
6497 
6498 /*
6499  * bridge_broadcast:
6500  *
6501  *	Send a frame to all interfaces that are members of
6502  *	the bridge, except for the one on which the packet
6503  *	arrived.
6504  *
6505  *	NOTE: Releases the lock on return.
6506  */
6507 static void
6508 bridge_broadcast(struct bridge_softc *sc, struct bridge_iflist * sbif,
6509     struct mbuf *m)
6510 {
6511 	ifnet_t bridge_ifp;
6512 	struct bridge_iflist *dbif;
6513 	struct ifnet * src_if;
6514 	mbuf_ref_t mc;
6515 	struct mbuf *mc_in;
6516 	int error = 0, used = 0;
6517 	ChecksumOperation cksum_op;
6518 	struct mac_nat_record mnr;
6519 	struct bridge_iflist *mac_nat_bif = sc->sc_mac_nat_bif;
6520 	boolean_t translate_mac = FALSE;
6521 	uint32_t sc_filter_flags;
6522 	bool is_bcast_mcast;
6523 
6524 	bridge_ifp = sc->sc_ifp;
6525 	if (sbif != NULL) {
6526 		src_if = sbif->bif_ifp;
6527 		cksum_op = CHECKSUM_OPERATION_CLEAR_OFFLOAD;
6528 		if (mac_nat_bif != NULL && sbif != mac_nat_bif) {
6529 			/* get the translation record */
6530 			translate_mac
6531 			        = bridge_mac_nat_output(sc, sbif, &m, &mnr);
6532 			if (m == NULL) {
6533 				/* packet was deallocated */
6534 				BRIDGE_UNLOCK(sc);
6535 				return;
6536 			}
6537 		}
6538 	} else {
6539 		/*
6540 		 * sbif is NULL when the bridge interface calls
6541 		 * bridge_broadcast().
6542 		 */
6543 		cksum_op = CHECKSUM_OPERATION_FINALIZE;
6544 		src_if = NULL;
6545 	}
6546 
6547 	BRIDGE_LOCK2REF(sc, error);
6548 	if (error) {
6549 		m_freem(m);
6550 		return;
6551 	}
6552 	is_bcast_mcast = IS_BCAST_MCAST(m);
6553 	sc_filter_flags = sc->sc_filter_flags;
6554 	TAILQ_FOREACH(dbif, &sc->sc_iflist, bif_next) {
6555 		ifnet_t         dst_if;
6556 
6557 		dst_if = dbif->bif_ifp;
6558 		if (dst_if == src_if) {
6559 			/* skip the interface that the packet came in on */
6560 			continue;
6561 		}
6562 
6563 		/* Private segments can not talk to each other */
6564 		if (sbif != NULL &&
6565 		    (sbif->bif_ifflags & dbif->bif_ifflags & IFBIF_PRIVATE)) {
6566 			continue;
6567 		}
6568 
6569 		if ((dbif->bif_ifflags & IFBIF_STP) &&
6570 		    dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
6571 			continue;
6572 		}
6573 
6574 		if ((dbif->bif_ifflags & IFBIF_DISCOVER) == 0 &&
6575 		    !is_bcast_mcast) {
6576 			continue;
6577 		}
6578 
6579 		if ((dst_if->if_flags & IFF_RUNNING) == 0) {
6580 			continue;
6581 		}
6582 
6583 		if ((dbif->bif_flags & BIFF_MEDIA_ACTIVE) == 0) {
6584 			continue;
6585 		}
6586 
6587 		if (TAILQ_NEXT(dbif, bif_next) == NULL) {
6588 			mc = m;
6589 			used = 1;
6590 		} else {
6591 			mc = m_dup(m, M_DONTWAIT);
6592 			if (mc == NULL) {
6593 				(void) ifnet_stat_increment_out(bridge_ifp,
6594 				    0, 0, 1);
6595 				continue;
6596 			}
6597 		}
6598 
6599 		/*
6600 		 * If broadcast input is enabled, do so only if this
6601 		 * is an input packet.
6602 		 */
6603 		if (sbif != NULL && is_bcast_mcast &&
6604 		    (dbif->bif_flags & BIFF_INPUT_BROADCAST) != 0) {
6605 			mc_in = m_dup(mc, M_DONTWAIT);
6606 			/* this could fail, but we continue anyways */
6607 		} else {
6608 			mc_in = NULL;
6609 		}
6610 
6611 		/* out */
6612 		if (translate_mac && mac_nat_bif == dbif) {
6613 			/* translate the packet */
6614 			bridge_mac_nat_translate(&mc, &mnr, IF_LLADDR(dst_if));
6615 		}
6616 
6617 		if (mc != NULL && sbif != NULL &&
6618 		    PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
6619 			if (used == 0) {
6620 				/* Keep the layer3 header aligned */
6621 				int i = min(mc->m_pkthdr.len, max_protohdr);
6622 				mc = m_copyup(mc, i, ETHER_ALIGN);
6623 				if (mc == NULL) {
6624 					(void) ifnet_stat_increment_out(
6625 						sc->sc_ifp, 0, 0, 1);
6626 					if (mc_in != NULL) {
6627 						m_freem(mc_in);
6628 						mc_in = NULL;
6629 					}
6630 					continue;
6631 				}
6632 			}
6633 			if (bridge_pf(&mc, dst_if, sc_filter_flags, false) != 0) {
6634 				if (mc_in != NULL) {
6635 					m_freem(mc_in);
6636 					mc_in = NULL;
6637 				}
6638 				continue;
6639 			}
6640 			if (mc == NULL) {
6641 				if (mc_in != NULL) {
6642 					m_freem(mc_in);
6643 					mc_in = NULL;
6644 				}
6645 				continue;
6646 			}
6647 		}
6648 
6649 		if (mc != NULL) {
6650 			/* verify checksum if necessary */
6651 			if (bif_has_checksum_offload(dbif) && sbif != NULL &&
6652 			    !bif_has_checksum_offload(sbif)) {
6653 				error = bridge_verify_checksum(&mc,
6654 				    &dbif->bif_stats);
6655 				if (error != 0) {
6656 					if (mc != NULL) {
6657 						m_freem(mc);
6658 					}
6659 					mc = NULL;
6660 				}
6661 			}
6662 			if (mc != NULL) {
6663 				(void) bridge_enqueue(bridge_ifp,
6664 				    NULL, dst_if, mc, cksum_op);
6665 			}
6666 		}
6667 
6668 		/* in */
6669 		if (mc_in == NULL) {
6670 			continue;
6671 		}
6672 		BRIDGE_BPF_TAP_IN(dst_if, mc_in);
6673 		prepare_input_packet(dst_if, mc_in);
6674 		mc_in->m_flags |= M_PROTO1; /* set to avoid loops */
6675 		dlil_input_packet_list(dst_if, mc_in);
6676 	}
6677 	if (used == 0) {
6678 		m_freem(m);
6679 	}
6680 
6681 
6682 	BRIDGE_UNREF(sc);
6683 }
6684 
6685 static mbuf_t
6686 copy_packet_list(mbuf_t m)
6687 {
6688 	mblist  ret;
6689 	mbuf_t  next_packet;
6690 
6691 	mblist_init(&ret);
6692 	for (mbuf_t scan = m; scan != NULL; scan = next_packet) {
6693 		mbuf_t  copy_m;
6694 
6695 		/* take it out of the list */
6696 		next_packet = scan->m_nextpkt;
6697 		scan->m_nextpkt = NULL;
6698 
6699 		/* create a copy and add it to the new list */
6700 		copy_m = m_dup(scan, M_DONTWAIT);
6701 		if (copy_m != NULL) {
6702 			mblist_append(&ret, copy_m);
6703 		}
6704 
6705 		/* put it back in the original list */
6706 		scan->m_nextpkt = next_packet;
6707 	}
6708 	return ret.head;
6709 }
6710 
6711 /*
6712  * bridge_broadcast_list:
6713  *
6714  *      Broadcast a list of packets to all members except `sbif`.
6715  *      If `need_copy` is false, consumes `m` before returning.
6716  *
6717  *	NOTE: Releases the lock on return.
6718  */
6719 static void
6720 bridge_broadcast_list(struct bridge_softc *sc, struct bridge_iflist * sbif,
6721     ether_type_flag_t etypef, mbuf_t m, bool need_copy)
6722 {
6723 	bool                    bridge_has_address;
6724 	ifnet_t                 bridge_ifp;
6725 	struct bridge_iflist *  dbif;
6726 	bool                    is_bcast_mcast;
6727 	errno_t                 error = 0;
6728 	ChecksumOperation       cksum_op;
6729 	struct bridge_iflist *  mac_nat_bif = sc->sc_mac_nat_bif;
6730 	ifnet_t                 mac_nat_if = NULL;
6731 	bool                    need_mac_nat = false;
6732 	mbuf_t                  out_mac_nat = NULL;
6733 	ifnet_t                 src_if;
6734 	uint32_t                sc_filter_flags;
6735 	bool                    used = false;
6736 
6737 	bridge_ifp = sc->sc_ifp;
6738 	if (sbif != NULL) {
6739 		src_if = sbif->bif_ifp;
6740 		cksum_op = CHECKSUM_OPERATION_CLEAR_OFFLOAD;
6741 
6742 		/*
6743 		 * If MAC-NAT is enabled and we'll be sending the packets
6744 		 * over it, verify that it is up and active before
6745 		 * deciding to make a translated copy.
6746 		 */
6747 		if (mac_nat_bif != NULL && sbif != mac_nat_bif) {
6748 			mac_nat_if = mac_nat_bif->bif_ifp;
6749 			if ((mac_nat_if->if_flags & IFF_RUNNING) != 0 &&
6750 			    (mac_nat_bif->bif_flags & BIFF_MEDIA_ACTIVE) != 0) {
6751 				need_mac_nat = true;
6752 			}
6753 		}
6754 	} else {
6755 		/*
6756 		 * sbif is NULL when the bridge interface calls
6757 		 * bridge_broadcast().
6758 		 */
6759 		cksum_op = CHECKSUM_OPERATION_FINALIZE;
6760 		src_if = NULL;
6761 	}
6762 
6763 	/*
6764 	 * Create a translated copy for packets destined to MAC-NAT interface.
6765 	 */
6766 	if (need_mac_nat) {
6767 		out_mac_nat
6768 		        = bridge_mac_nat_copy_and_translate_list(sc, sbif,
6769 		    mac_nat_if, m);
6770 	}
6771 	sc_filter_flags = sc->sc_filter_flags;
6772 	bridge_has_address = (sc->sc_flags & SCF_ADDRESS_ASSIGNED) != 0;
6773 	BRIDGE_LOCK2REF(sc, error);
6774 	if (error) {
6775 		goto done;
6776 	}
6777 	is_bcast_mcast = IS_BCAST_MCAST(m);
6778 
6779 	/* make a copy for the bridge interface */
6780 	if (is_bcast_mcast && bridge_has_address) {
6781 		mbuf_t  in_list;
6782 
6783 		in_list = copy_packet_list(m);
6784 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MCAST,
6785 		    "%s mcast for us in_m %p",
6786 		    bridge_ifp->if_xname, in_list);
6787 		if (in_list != NULL) {
6788 			inject_input_packet_list(bridge_ifp, in_list, false);
6789 		}
6790 	}
6791 
6792 	TAILQ_FOREACH(dbif, &sc->sc_iflist, bif_next) {
6793 		ifnet_t         dst_if;
6794 		mbuf_t          in_m = NULL;
6795 		mbuf_t          out_m = NULL;
6796 
6797 		dst_if = dbif->bif_ifp;
6798 		if (dst_if == src_if) {
6799 			/* skip the interface that the packet came in on */
6800 			continue;
6801 		}
6802 
6803 		/* Private segments can not talk to each other */
6804 		if (sbif != NULL &&
6805 		    (sbif->bif_ifflags & dbif->bif_ifflags & IFBIF_PRIVATE)) {
6806 			continue;
6807 		}
6808 
6809 		if ((dbif->bif_ifflags & IFBIF_STP) &&
6810 		    dbif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING) {
6811 			continue;
6812 		}
6813 
6814 		if ((dbif->bif_ifflags & IFBIF_DISCOVER) == 0 &&
6815 		    !is_bcast_mcast) {
6816 			continue;
6817 		}
6818 
6819 		if ((dst_if->if_flags & IFF_RUNNING) == 0) {
6820 			continue;
6821 		}
6822 
6823 		if ((dbif->bif_flags & BIFF_MEDIA_ACTIVE) == 0) {
6824 			continue;
6825 		}
6826 		if (dbif == mac_nat_bif) {
6827 			/* translated copy was created above, use that */
6828 			out_m = out_mac_nat;
6829 			out_mac_nat = NULL;
6830 		} else if (!need_copy && TAILQ_NEXT(dbif, bif_next) == NULL) {
6831 			/* consume `m` */
6832 			out_m = m;
6833 			used = true;
6834 		} else {
6835 			/* needs a copy */
6836 			out_m = copy_packet_list(m);
6837 		}
6838 
6839 		if (out_m == NULL) {
6840 			ifnet_stat_increment_out(bridge_ifp, 0, 0, 1);
6841 			continue;
6842 		}
6843 		/*
6844 		 * If broadcast input is enabled, do so only if this
6845 		 * is an input packet.
6846 		 */
6847 		if (sbif != NULL && is_bcast_mcast &&
6848 		    (dbif->bif_flags & BIFF_INPUT_BROADCAST) != 0) {
6849 			in_m = copy_packet_list(m);
6850 			/* this could fail, but we continue anyways */
6851 		} else {
6852 			in_m = NULL;
6853 		}
6854 
6855 		if (sbif != NULL &&
6856 		    PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
6857 			out_m = bridge_pf_list(out_m, dst_if,
6858 			    sc_filter_flags, false);
6859 		}
6860 		if (out_m != NULL) {
6861 			/* verify checksum if necessary */
6862 			if (sbif != NULL &&
6863 			    ether_type_flag_is_ip(etypef) &&
6864 			    bif_has_checksum_offload(dbif) &&
6865 			    !bif_has_checksum_offload(sbif)) {
6866 				out_m = bridge_verify_checksum_list(out_m, dbif);
6867 			}
6868 			if (out_m != NULL) {
6869 				bridge_enqueue_multi(bridge_ifp, src_if, dst_if,
6870 				    etypef, out_m, cksum_op);
6871 			}
6872 		}
6873 
6874 		/* in */
6875 		if (in_m != NULL) {
6876 			inject_input_packet_list(dst_if, in_m, true);
6877 		}
6878 	}
6879 
6880 	BRIDGE_UNREF(sc);
6881 
6882 done:
6883 	if (out_mac_nat != NULL) {
6884 		m_freem_list(out_mac_nat);
6885 	}
6886 	if (!need_copy && !used) {
6887 		m_freem_list(m);
6888 	}
6889 	return;
6890 }
6891 
6892 static void
6893 bridge_forward_list(struct bridge_softc *sc, struct bridge_iflist * sbif,
6894     ifnet_t dst_if, ether_type_flag_t etypef, mbuf_t m)
6895 {
6896 	ifnet_t                 bridge_ifp;
6897 	struct bridge_iflist *  dbif;
6898 	uint32_t                sc_filter_flags;
6899 	ifnet_t                 src_if;
6900 
6901 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
6902 		goto drop;
6903 	}
6904 	dbif = bridge_lookup_member_if(sc, dst_if);
6905 	if (dbif == NULL) {
6906 		/* Not a member of the bridge (anymore?) */
6907 		goto drop;
6908 	}
6909 
6910 	/* Private segments can not talk to each other */
6911 	if ((sbif->bif_ifflags & dbif->bif_ifflags & IFBIF_PRIVATE) != 0) {
6912 		goto drop;
6913 	}
6914 	if (dbif == sc->sc_mac_nat_bif) {
6915 		/* translate the packets before forwarding them */
6916 		if ((etypef & ETHER_TYPE_FLAG_IP_ARP) != 0) {
6917 			m = bridge_mac_nat_translate_list(sc, sbif, dst_if, m);
6918 		}
6919 	} else if (ether_type_flag_is_ip(etypef) &&
6920 	    bif_has_checksum_offload(dbif) &&
6921 	    !bif_has_checksum_offload(sbif)) {
6922 		/*
6923 		 * If the destination interface has checksum offload enabled,
6924 		 * verify the checksum now, unless the source interface also has
6925 		 * checksum offload enabled. The checksum in that case has
6926 		 * already just been computed and verifying it is unnecessary.
6927 		 */
6928 		m = bridge_verify_checksum_list(m, dbif);
6929 	}
6930 	sc_filter_flags = sc->sc_filter_flags;
6931 	bridge_ifp = sc->sc_ifp;
6932 	src_if = sbif->bif_ifp;
6933 	BRIDGE_UNLOCK(sc);
6934 	if (PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
6935 		m = bridge_pf_list(m, dst_if, sc_filter_flags, false);
6936 	}
6937 
6938 	/*
6939 	 * We're forwarding inbound packets for which the checksums must
6940 	 * already have been computed and if required, verified.
6941 	 */
6942 	if (m != NULL) {
6943 		bridge_enqueue_multi(bridge_ifp, src_if, dst_if, etypef, m,
6944 		    CHECKSUM_OPERATION_CLEAR_OFFLOAD);
6945 	}
6946 	return;
6947 
6948 drop:
6949 	BRIDGE_UNLOCK(sc);
6950 	m_freem_list(m);
6951 	return;
6952 }
6953 
6954 /*
6955  * bridge_span:
6956  *
6957  *	Duplicate a packet out one or more interfaces that are in span mode,
6958  *	the original mbuf is unmodified.
6959  */
6960 static void
6961 bridge_span(struct bridge_softc *sc, struct mbuf *m)
6962 {
6963 	struct bridge_iflist *bif;
6964 	struct ifnet *dst_if;
6965 	struct mbuf *mc;
6966 
6967 	if (TAILQ_EMPTY(&sc->sc_spanlist)) {
6968 		return;
6969 	}
6970 
6971 	TAILQ_FOREACH(bif, &sc->sc_spanlist, bif_next) {
6972 		dst_if = bif->bif_ifp;
6973 
6974 		if ((dst_if->if_flags & IFF_RUNNING) == 0) {
6975 			continue;
6976 		}
6977 
6978 		mc = m_copypacket(m, M_DONTWAIT);
6979 		if (mc == NULL) {
6980 			(void) ifnet_stat_increment_out(sc->sc_ifp, 0, 0, 1);
6981 			continue;
6982 		}
6983 
6984 		(void) bridge_enqueue(sc->sc_ifp, NULL, dst_if, mc,
6985 		    CHECKSUM_OPERATION_NONE);
6986 	}
6987 }
6988 
6989 /*
6990  * bridge_rtupdate:
6991  *
6992  *	Add a bridge routing entry.
6993  */
6994 static int
6995 bridge_rtupdate(struct bridge_softc *sc, const uint8_t dst[ETHER_ADDR_LEN], uint16_t vlan,
6996     struct bridge_iflist *bif, int setflags, uint8_t flags)
6997 {
6998 	struct bridge_rtnode *brt;
6999 	int error;
7000 
7001 	BRIDGE_LOCK_ASSERT_HELD(sc);
7002 
7003 	/* Check the source address is valid and not multicast. */
7004 	if (ETHER_IS_MULTICAST(dst) ||
7005 	    (dst[0] == 0 && dst[1] == 0 && dst[2] == 0 &&
7006 	    dst[3] == 0 && dst[4] == 0 && dst[5] == 0) != 0) {
7007 		return EINVAL;
7008 	}
7009 
7010 	/* 802.1p frames map to vlan 1 */
7011 	if (vlan == 0) {
7012 		vlan = 1;
7013 	}
7014 
7015 	/*
7016 	 * A route for this destination might already exist.  If so,
7017 	 * update it, otherwise create a new one.
7018 	 */
7019 	if ((brt = bridge_rtnode_lookup(sc, dst, vlan)) == NULL) {
7020 		if (sc->sc_brtcnt >= sc->sc_brtmax) {
7021 			sc->sc_brtexceeded++;
7022 			return ENOSPC;
7023 		}
7024 		/* Check per interface address limits (if enabled) */
7025 		if (bif->bif_addrmax && bif->bif_addrcnt >= bif->bif_addrmax) {
7026 			bif->bif_addrexceeded++;
7027 			return ENOSPC;
7028 		}
7029 
7030 		/*
7031 		 * Allocate a new bridge forwarding node, and
7032 		 * initialize the expiration time and Ethernet
7033 		 * address.
7034 		 */
7035 		brt = zalloc_noblock(bridge_rtnode_pool);
7036 		if (brt == NULL) {
7037 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_RT_TABLE,
7038 			    "zalloc_nolock failed");
7039 			return ENOMEM;
7040 		}
7041 		bzero(brt, sizeof(struct bridge_rtnode));
7042 
7043 		if (bif->bif_ifflags & IFBIF_STICKY) {
7044 			brt->brt_flags = IFBAF_STICKY;
7045 		} else {
7046 			brt->brt_flags = IFBAF_DYNAMIC;
7047 		}
7048 
7049 		memcpy(brt->brt_addr, dst, ETHER_ADDR_LEN);
7050 		brt->brt_vlan = vlan;
7051 
7052 		if ((error = bridge_rtnode_insert(sc, brt)) != 0) {
7053 			zfree(bridge_rtnode_pool, brt);
7054 			return error;
7055 		}
7056 		brt->brt_dst = bif;
7057 		bif->bif_addrcnt++;
7058 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_RT_TABLE,
7059 		    "added %02x:%02x:%02x:%02x:%02x:%02x "
7060 		    "on %s count %u hashsize %u",
7061 		    dst[0], dst[1], dst[2], dst[3], dst[4], dst[5],
7062 		    sc->sc_ifp->if_xname, sc->sc_brtcnt,
7063 		    sc->sc_rthash_size);
7064 	}
7065 
7066 	if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC &&
7067 	    brt->brt_dst != bif) {
7068 		brt->brt_dst->bif_addrcnt--;
7069 		brt->brt_dst = bif;
7070 		brt->brt_dst->bif_addrcnt++;
7071 	}
7072 
7073 	if ((flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
7074 		unsigned long now;
7075 
7076 		now = (unsigned long) net_uptime();
7077 		brt->brt_expire = now + sc->sc_brttimeout;
7078 	}
7079 	if (setflags) {
7080 		brt->brt_flags = flags;
7081 	}
7082 
7083 	return 0;
7084 }
7085 
7086 /*
7087  * bridge_rtlookup:
7088  *
7089  *	Lookup the destination interface for an address.
7090  */
7091 static struct ifnet *
7092 bridge_rtlookup(struct bridge_softc *sc, const uint8_t addr[ETHER_ADDR_LEN], uint16_t vlan)
7093 {
7094 	struct bridge_rtnode *brt;
7095 
7096 	BRIDGE_LOCK_ASSERT_HELD(sc);
7097 
7098 	if ((brt = bridge_rtnode_lookup(sc, addr, vlan)) == NULL) {
7099 		return NULL;
7100 	}
7101 
7102 	return brt->brt_ifp;
7103 }
7104 
7105 /*
7106  * bridge_rttrim:
7107  *
7108  *	Trim the routine table so that we have a number
7109  *	of routing entries less than or equal to the
7110  *	maximum number.
7111  */
7112 static void
7113 bridge_rttrim(struct bridge_softc *sc)
7114 {
7115 	struct bridge_rtnode *brt, *nbrt;
7116 
7117 	BRIDGE_LOCK_ASSERT_HELD(sc);
7118 
7119 	/* Make sure we actually need to do this. */
7120 	if (sc->sc_brtcnt <= sc->sc_brtmax) {
7121 		return;
7122 	}
7123 
7124 	/* Force an aging cycle; this might trim enough addresses. */
7125 	bridge_rtage(sc);
7126 	if (sc->sc_brtcnt <= sc->sc_brtmax) {
7127 		return;
7128 	}
7129 
7130 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
7131 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
7132 			bridge_rtnode_destroy(sc, brt);
7133 			if (sc->sc_brtcnt <= sc->sc_brtmax) {
7134 				return;
7135 			}
7136 		}
7137 	}
7138 }
7139 
7140 /*
7141  * bridge_aging_timer:
7142  *
7143  *	Aging periodic timer for the bridge routing table.
7144  */
7145 static void
7146 bridge_aging_timer(struct bridge_softc *sc)
7147 {
7148 	BRIDGE_LOCK_ASSERT_HELD(sc);
7149 
7150 	bridge_rtage(sc);
7151 	if ((sc->sc_ifp->if_flags & IFF_RUNNING) &&
7152 	    (sc->sc_flags & SCF_DETACHING) == 0) {
7153 		sc->sc_aging_timer.bdc_sc = sc;
7154 		sc->sc_aging_timer.bdc_func = bridge_aging_timer;
7155 		sc->sc_aging_timer.bdc_ts.tv_sec = bridge_rtable_prune_period;
7156 		bridge_schedule_delayed_call(&sc->sc_aging_timer);
7157 	}
7158 }
7159 
7160 /*
7161  * bridge_rtage:
7162  *
7163  *	Perform an aging cycle.
7164  */
7165 static void
7166 bridge_rtage(struct bridge_softc *sc)
7167 {
7168 	struct bridge_rtnode *brt, *nbrt;
7169 	unsigned long now;
7170 
7171 	BRIDGE_LOCK_ASSERT_HELD(sc);
7172 
7173 	now = (unsigned long) net_uptime();
7174 
7175 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
7176 		if ((brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
7177 			if (now >= brt->brt_expire) {
7178 				bridge_rtnode_destroy(sc, brt);
7179 			}
7180 		}
7181 	}
7182 	if (sc->sc_mac_nat_bif != NULL) {
7183 		bridge_mac_nat_age_entries(sc, now);
7184 	}
7185 }
7186 
7187 /*
7188  * bridge_rtflush:
7189  *
7190  *	Remove all dynamic addresses from the bridge.
7191  */
7192 static void
7193 bridge_rtflush(struct bridge_softc *sc, int full)
7194 {
7195 	struct bridge_rtnode *brt, *nbrt;
7196 
7197 	BRIDGE_LOCK_ASSERT_HELD(sc);
7198 
7199 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
7200 		if (full || (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
7201 			bridge_rtnode_destroy(sc, brt);
7202 		}
7203 	}
7204 }
7205 
7206 /*
7207  * bridge_rtdaddr:
7208  *
7209  *	Remove an address from the table.
7210  */
7211 static int
7212 bridge_rtdaddr(struct bridge_softc *sc, const uint8_t addr[ETHER_ADDR_LEN], uint16_t vlan)
7213 {
7214 	struct bridge_rtnode *brt;
7215 	int found = 0;
7216 
7217 	BRIDGE_LOCK_ASSERT_HELD(sc);
7218 
7219 	/*
7220 	 * If vlan is zero then we want to delete for all vlans so the lookup
7221 	 * may return more than one.
7222 	 */
7223 	while ((brt = bridge_rtnode_lookup(sc, addr, vlan)) != NULL) {
7224 		bridge_rtnode_destroy(sc, brt);
7225 		found = 1;
7226 	}
7227 
7228 	return found ? 0 : ENOENT;
7229 }
7230 
7231 /*
7232  * bridge_rtdelete:
7233  *
7234  *	Delete routes to a specific member interface.
7235  */
7236 static void
7237 bridge_rtdelete(struct bridge_softc *sc, struct ifnet *ifp, int full)
7238 {
7239 	struct bridge_rtnode *brt, *nbrt;
7240 
7241 	BRIDGE_LOCK_ASSERT_HELD(sc);
7242 
7243 	LIST_FOREACH_SAFE(brt, &sc->sc_rtlist, brt_list, nbrt) {
7244 		if (brt->brt_ifp == ifp && (full ||
7245 		    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC)) {
7246 			bridge_rtnode_destroy(sc, brt);
7247 		}
7248 	}
7249 }
7250 
7251 /*
7252  * bridge_rtable_init:
7253  *
7254  *	Initialize the route table for this bridge.
7255  */
7256 static int
7257 bridge_rtable_init(struct bridge_softc *sc)
7258 {
7259 	u_int32_t i;
7260 
7261 	sc->sc_rthash = kalloc_type(struct _bridge_rtnode_list,
7262 	    BRIDGE_RTHASH_SIZE, Z_WAITOK_ZERO_NOFAIL);
7263 	sc->sc_rthash_size = BRIDGE_RTHASH_SIZE;
7264 
7265 	for (i = 0; i < sc->sc_rthash_size; i++) {
7266 		LIST_INIT(&sc->sc_rthash[i]);
7267 	}
7268 
7269 	sc->sc_rthash_key = RandomULong();
7270 
7271 	LIST_INIT(&sc->sc_rtlist);
7272 
7273 	return 0;
7274 }
7275 
7276 /*
7277  * bridge_rthash_delayed_resize:
7278  *
7279  *	Resize the routing table hash on a delayed thread call.
7280  */
7281 static void
7282 bridge_rthash_delayed_resize(struct bridge_softc *sc)
7283 {
7284 	u_int32_t new_rthash_size = 0;
7285 	u_int32_t old_rthash_size = 0;
7286 	struct _bridge_rtnode_list *new_rthash = NULL;
7287 	struct _bridge_rtnode_list *old_rthash = NULL;
7288 	u_int32_t i;
7289 	struct bridge_rtnode *brt;
7290 	int error = 0;
7291 
7292 	BRIDGE_LOCK_ASSERT_HELD(sc);
7293 
7294 	/*
7295 	 * Four entries per hash bucket is our ideal load factor
7296 	 */
7297 	if (sc->sc_brtcnt < sc->sc_rthash_size * 4) {
7298 		goto out;
7299 	}
7300 
7301 	/*
7302 	 * Doubling the number of hash buckets may be too simplistic
7303 	 * especially when facing a spike of new entries
7304 	 */
7305 	new_rthash_size = sc->sc_rthash_size * 2;
7306 
7307 	sc->sc_flags |= SCF_RESIZING;
7308 	BRIDGE_UNLOCK(sc);
7309 
7310 	new_rthash = kalloc_type(struct _bridge_rtnode_list, new_rthash_size,
7311 	    Z_WAITOK | Z_ZERO);
7312 
7313 	BRIDGE_LOCK(sc);
7314 	sc->sc_flags &= ~SCF_RESIZING;
7315 
7316 	if (new_rthash == NULL) {
7317 		error = ENOMEM;
7318 		goto out;
7319 	}
7320 	if ((sc->sc_flags & SCF_DETACHING)) {
7321 		error = ENODEV;
7322 		goto out;
7323 	}
7324 	/*
7325 	 * Fail safe from here on
7326 	 */
7327 	old_rthash = sc->sc_rthash;
7328 	old_rthash_size = sc->sc_rthash_size;
7329 	sc->sc_rthash = new_rthash;
7330 	sc->sc_rthash_size = new_rthash_size;
7331 
7332 	/*
7333 	 * Get a new key to force entries to be shuffled around to reduce
7334 	 * the likelihood they will land in the same buckets
7335 	 */
7336 	sc->sc_rthash_key = RandomULong();
7337 
7338 	for (i = 0; i < sc->sc_rthash_size; i++) {
7339 		LIST_INIT(&sc->sc_rthash[i]);
7340 	}
7341 
7342 	LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
7343 		LIST_REMOVE(brt, brt_hash);
7344 		(void) bridge_rtnode_hash(sc, brt);
7345 	}
7346 out:
7347 	if (error == 0) {
7348 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_RT_TABLE,
7349 		    "%s new size %u",
7350 		    sc->sc_ifp->if_xname, sc->sc_rthash_size);
7351 		kfree_type(struct _bridge_rtnode_list, old_rthash_size, old_rthash);
7352 	} else {
7353 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_RT_TABLE,
7354 		    "%s failed %d", sc->sc_ifp->if_xname, error);
7355 		kfree_type(struct _bridge_rtnode_list, new_rthash_size, new_rthash);
7356 	}
7357 }
7358 
7359 /*
7360  * Resize the number of hash buckets based on the load factor
7361  * Currently only grow
7362  * Failing to resize the hash table is not fatal
7363  */
7364 static void
7365 bridge_rthash_resize(struct bridge_softc *sc)
7366 {
7367 	BRIDGE_LOCK_ASSERT_HELD(sc);
7368 
7369 	if ((sc->sc_flags & SCF_DETACHING) || (sc->sc_flags & SCF_RESIZING)) {
7370 		return;
7371 	}
7372 
7373 	/*
7374 	 * Four entries per hash bucket is our ideal load factor
7375 	 */
7376 	if (sc->sc_brtcnt < sc->sc_rthash_size * 4) {
7377 		return;
7378 	}
7379 	/*
7380 	 * Hard limit on the size of the routing hash table
7381 	 */
7382 	if (sc->sc_rthash_size >= bridge_rtable_hash_size_max) {
7383 		return;
7384 	}
7385 
7386 	sc->sc_resize_call.bdc_sc = sc;
7387 	sc->sc_resize_call.bdc_func = bridge_rthash_delayed_resize;
7388 	bridge_schedule_delayed_call(&sc->sc_resize_call);
7389 }
7390 
7391 /*
7392  * bridge_rtable_fini:
7393  *
7394  *	Deconstruct the route table for this bridge.
7395  */
7396 static void
7397 bridge_rtable_fini(struct bridge_softc *sc)
7398 {
7399 	KASSERT(sc->sc_brtcnt == 0,
7400 	    ("%s: %d bridge routes referenced", __func__, sc->sc_brtcnt));
7401 	kfree_type_counted_by(struct _bridge_rtnode_list, sc->sc_rthash_size,
7402 	    sc->sc_rthash);
7403 	sc->sc_rthash = NULL;
7404 	sc->sc_rthash_size = 0;
7405 }
7406 
7407 /*
7408  * The following hash function is adapted from "Hash Functions" by Bob Jenkins
7409  * ("Algorithm Alley", Dr. Dobbs Journal, September 1997).
7410  */
7411 #define mix(a, b, c)                                                    \
7412 do {                                                                    \
7413 	a -= b; a -= c; a ^= (c >> 13);                                 \
7414 	b -= c; b -= a; b ^= (a << 8);                                  \
7415 	c -= a; c -= b; c ^= (b >> 13);                                 \
7416 	a -= b; a -= c; a ^= (c >> 12);                                 \
7417 	b -= c; b -= a; b ^= (a << 16);                                 \
7418 	c -= a; c -= b; c ^= (b >> 5);                                  \
7419 	a -= b; a -= c; a ^= (c >> 3);                                  \
7420 	b -= c; b -= a; b ^= (a << 10);                                 \
7421 	c -= a; c -= b; c ^= (b >> 15);                                 \
7422 } while ( /*CONSTCOND*/ 0)
7423 
7424 static __inline uint32_t
7425 bridge_rthash(struct bridge_softc *sc, const uint8_t addr[ETHER_ADDR_LEN])
7426 {
7427 	uint32_t a = 0x9e3779b9, b = 0x9e3779b9, c = sc->sc_rthash_key;
7428 
7429 	b += addr[5] << 8;
7430 	b += addr[4];
7431 	a += addr[3] << 24;
7432 	a += addr[2] << 16;
7433 	a += addr[1] << 8;
7434 	a += addr[0];
7435 
7436 	mix(a, b, c);
7437 
7438 	return c & BRIDGE_RTHASH_MASK(sc);
7439 }
7440 
7441 #undef mix
7442 
7443 static int
7444 bridge_rtnode_addr_cmp(const uint8_t a[ETHER_ADDR_LEN], const uint8_t b[ETHER_ADDR_LEN])
7445 {
7446 	int i, d;
7447 
7448 	for (i = 0, d = 0; i < ETHER_ADDR_LEN && d == 0; i++) {
7449 		d = ((int)a[i]) - ((int)b[i]);
7450 	}
7451 
7452 	return d;
7453 }
7454 
7455 /*
7456  * bridge_rtnode_lookup:
7457  *
7458  *	Look up a bridge route node for the specified destination. Compare the
7459  *	vlan id or if zero then just return the first match.
7460  */
7461 static struct bridge_rtnode *
7462 bridge_rtnode_lookup(struct bridge_softc *sc, const uint8_t addr[ETHER_ADDR_LEN],
7463     uint16_t vlan)
7464 {
7465 	struct bridge_rtnode *brt;
7466 	uint32_t hash;
7467 	int dir;
7468 
7469 	BRIDGE_LOCK_ASSERT_HELD(sc);
7470 
7471 	hash = bridge_rthash(sc, addr);
7472 	LIST_FOREACH(brt, &sc->sc_rthash[hash], brt_hash) {
7473 		dir = bridge_rtnode_addr_cmp(addr, brt->brt_addr);
7474 		if (dir == 0 && (brt->brt_vlan == vlan || vlan == 0)) {
7475 			return brt;
7476 		}
7477 		if (dir > 0) {
7478 			return NULL;
7479 		}
7480 	}
7481 
7482 	return NULL;
7483 }
7484 
7485 /*
7486  * bridge_rtnode_hash:
7487  *
7488  *	Insert the specified bridge node into the route hash table.
7489  *	This is used when adding a new node or to rehash when resizing
7490  *	the hash table
7491  */
7492 static int
7493 bridge_rtnode_hash(struct bridge_softc *sc, struct bridge_rtnode *brt)
7494 {
7495 	struct bridge_rtnode *lbrt;
7496 	uint32_t hash;
7497 	int dir;
7498 
7499 	BRIDGE_LOCK_ASSERT_HELD(sc);
7500 
7501 	hash = bridge_rthash(sc, brt->brt_addr);
7502 
7503 	lbrt = LIST_FIRST(&sc->sc_rthash[hash]);
7504 	if (lbrt == NULL) {
7505 		LIST_INSERT_HEAD(&sc->sc_rthash[hash], brt, brt_hash);
7506 		goto out;
7507 	}
7508 
7509 	do {
7510 		dir = bridge_rtnode_addr_cmp(brt->brt_addr, lbrt->brt_addr);
7511 		if (dir == 0 && brt->brt_vlan == lbrt->brt_vlan) {
7512 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_RT_TABLE,
7513 			    "%s EEXIST %02x:%02x:%02x:%02x:%02x:%02x",
7514 			    sc->sc_ifp->if_xname,
7515 			    brt->brt_addr[0], brt->brt_addr[1],
7516 			    brt->brt_addr[2], brt->brt_addr[3],
7517 			    brt->brt_addr[4], brt->brt_addr[5]);
7518 			return EEXIST;
7519 		}
7520 		if (dir > 0) {
7521 			LIST_INSERT_BEFORE(lbrt, brt, brt_hash);
7522 			goto out;
7523 		}
7524 		if (LIST_NEXT(lbrt, brt_hash) == NULL) {
7525 			LIST_INSERT_AFTER(lbrt, brt, brt_hash);
7526 			goto out;
7527 		}
7528 		lbrt = LIST_NEXT(lbrt, brt_hash);
7529 	} while (lbrt != NULL);
7530 
7531 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_RT_TABLE,
7532 	    "%s impossible %02x:%02x:%02x:%02x:%02x:%02x",
7533 	    sc->sc_ifp->if_xname,
7534 	    brt->brt_addr[0], brt->brt_addr[1], brt->brt_addr[2],
7535 	    brt->brt_addr[3], brt->brt_addr[4], brt->brt_addr[5]);
7536 out:
7537 	return 0;
7538 }
7539 
7540 /*
7541  * bridge_rtnode_insert:
7542  *
7543  *	Insert the specified bridge node into the route table.  We
7544  *	assume the entry is not already in the table.
7545  */
7546 static int
7547 bridge_rtnode_insert(struct bridge_softc *sc, struct bridge_rtnode *brt)
7548 {
7549 	int error;
7550 
7551 	error = bridge_rtnode_hash(sc, brt);
7552 	if (error != 0) {
7553 		return error;
7554 	}
7555 
7556 	LIST_INSERT_HEAD(&sc->sc_rtlist, brt, brt_list);
7557 	sc->sc_brtcnt++;
7558 
7559 	bridge_rthash_resize(sc);
7560 
7561 	return 0;
7562 }
7563 
7564 /*
7565  * bridge_rtnode_destroy:
7566  *
7567  *	Destroy a bridge rtnode.
7568  */
7569 static void
7570 bridge_rtnode_destroy(struct bridge_softc *sc, struct bridge_rtnode *brt)
7571 {
7572 	BRIDGE_LOCK_ASSERT_HELD(sc);
7573 
7574 	LIST_REMOVE(brt, brt_hash);
7575 
7576 	LIST_REMOVE(brt, brt_list);
7577 	sc->sc_brtcnt--;
7578 	brt->brt_dst->bif_addrcnt--;
7579 	zfree(bridge_rtnode_pool, brt);
7580 }
7581 
7582 #if BRIDGESTP
7583 /*
7584  * bridge_rtable_expire:
7585  *
7586  *	Set the expiry time for all routes on an interface.
7587  */
7588 static void
7589 bridge_rtable_expire(struct ifnet *ifp, int age)
7590 {
7591 	struct bridge_softc *sc = ifp->if_bridge;
7592 	struct bridge_rtnode *brt;
7593 
7594 	BRIDGE_LOCK(sc);
7595 
7596 	/*
7597 	 * If the age is zero then flush, otherwise set all the expiry times to
7598 	 * age for the interface
7599 	 */
7600 	if (age == 0) {
7601 		bridge_rtdelete(sc, ifp, IFBF_FLUSHDYN);
7602 	} else {
7603 		unsigned long now;
7604 
7605 		now = (unsigned long) net_uptime();
7606 
7607 		LIST_FOREACH(brt, &sc->sc_rtlist, brt_list) {
7608 			/* Cap the expiry time to 'age' */
7609 			if (brt->brt_ifp == ifp &&
7610 			    brt->brt_expire > now + age &&
7611 			    (brt->brt_flags & IFBAF_TYPEMASK) == IFBAF_DYNAMIC) {
7612 				brt->brt_expire = now + age;
7613 			}
7614 		}
7615 	}
7616 	BRIDGE_UNLOCK(sc);
7617 }
7618 
7619 /*
7620  * bridge_state_change:
7621  *
7622  *	Callback from the bridgestp code when a port changes states.
7623  */
7624 static void
7625 bridge_state_change(struct ifnet *ifp, int state)
7626 {
7627 	struct bridge_softc *sc = ifp->if_bridge;
7628 	static const char *stpstates[] = {
7629 		"disabled",
7630 		"listening",
7631 		"learning",
7632 		"forwarding",
7633 		"blocking",
7634 		"discarding"
7635 	};
7636 
7637 	if (log_stp) {
7638 		log(LOG_NOTICE, "%s: state changed to %s on %s",
7639 		    sc->sc_ifp->if_xname,
7640 		    stpstates[state], ifp->if_xname);
7641 	}
7642 }
7643 #endif /* BRIDGESTP */
7644 
7645 /*
7646  * bridge_detach:
7647  *
7648  *	Callback when interface has been detached.
7649  */
7650 static void
7651 bridge_detach(ifnet_t ifp)
7652 {
7653 	struct bridge_softc *sc = (struct bridge_softc *)ifnet_softc(ifp);
7654 
7655 #if BRIDGESTP
7656 	bstp_detach(&sc->sc_stp);
7657 #endif /* BRIDGESTP */
7658 
7659 	/* Tear down the routing table. */
7660 	bridge_rtable_fini(sc);
7661 
7662 	lck_mtx_lock(&bridge_list_mtx);
7663 	LIST_REMOVE(sc, sc_list);
7664 	lck_mtx_unlock(&bridge_list_mtx);
7665 
7666 	ifnet_release(ifp);
7667 
7668 	lck_mtx_destroy(&sc->sc_mtx, &bridge_lock_grp);
7669 	kfree_type(struct bridge_softc, sc);
7670 }
7671 
7672 /*
7673  * bridge_link_event:
7674  *
7675  *	Report a data link event on an interface
7676  */
7677 static void
7678 bridge_link_event(struct ifnet *ifp, u_int32_t event_code)
7679 {
7680 	struct event {
7681 		u_int32_t ifnet_family;
7682 		u_int32_t unit;
7683 		char if_name[IFNAMSIZ];
7684 	};
7685 	_Alignas(struct kern_event_msg) char message[sizeof(struct kern_event_msg) + sizeof(struct event)] = { 0 };
7686 	struct kern_event_msg *header = (struct kern_event_msg*)message;
7687 	struct event *data = (struct event *)(message + KEV_MSG_HEADER_SIZE);
7688 
7689 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_LIFECYCLE,
7690 	    "%s event_code %u - %s", ifp->if_xname,
7691 	    event_code, dlil_kev_dl_code_str(event_code));
7692 	header->total_size   = sizeof(message);
7693 	header->vendor_code  = KEV_VENDOR_APPLE;
7694 	header->kev_class    = KEV_NETWORK_CLASS;
7695 	header->kev_subclass = KEV_DL_SUBCLASS;
7696 	header->event_code   = event_code;
7697 	data->ifnet_family   = ifnet_family(ifp);
7698 	data->unit           = (u_int32_t)ifnet_unit(ifp);
7699 	strlcpy(data->if_name, ifnet_name(ifp), IFNAMSIZ);
7700 	ifnet_event(ifp, header);
7701 }
7702 
7703 #define BRIDGE_HF_DROP(reason, func, line) {                            \
7704 	        bridge_hostfilter_stats.reason++;                       \
7705 	        BRIDGE_LOG(LOG_DEBUG, BR_DBGF_HOSTFILTER,               \
7706 	                   "%s.%d" #reason, func, line);                \
7707 	        error = EINVAL;                                         \
7708 	}
7709 
7710 /*
7711  * Make sure this is a DHCP or Bootp request that match the host filter
7712  */
7713 static int
7714 bridge_dhcp_filter(struct bridge_iflist *bif, struct mbuf *m, size_t offset)
7715 {
7716 	int error = EINVAL;
7717 	struct dhcp dhcp;
7718 
7719 	/*
7720 	 * Note: We use the dhcp structure because bootp structure definition
7721 	 * is larger and some vendors do not pad the request
7722 	 */
7723 	error = mbuf_copydata(m, offset, sizeof(struct dhcp), &dhcp);
7724 	if (error != 0) {
7725 		BRIDGE_HF_DROP(brhf_dhcp_too_small, __func__, __LINE__);
7726 		goto done;
7727 	}
7728 	if (dhcp.dp_op != BOOTREQUEST) {
7729 		BRIDGE_HF_DROP(brhf_dhcp_bad_op, __func__, __LINE__);
7730 		goto done;
7731 	}
7732 	/*
7733 	 * The hardware address must be an exact match
7734 	 */
7735 	if (dhcp.dp_htype != ARPHRD_ETHER) {
7736 		BRIDGE_HF_DROP(brhf_dhcp_bad_htype, __func__, __LINE__);
7737 		goto done;
7738 	}
7739 	if (dhcp.dp_hlen != ETHER_ADDR_LEN) {
7740 		BRIDGE_HF_DROP(brhf_dhcp_bad_hlen, __func__, __LINE__);
7741 		goto done;
7742 	}
7743 	if (bcmp(dhcp.dp_chaddr, bif->bif_hf_hwsrc,
7744 	    ETHER_ADDR_LEN) != 0) {
7745 		BRIDGE_HF_DROP(brhf_dhcp_bad_chaddr, __func__, __LINE__);
7746 		goto done;
7747 	}
7748 	/*
7749 	 * Client address must match the host address or be not specified
7750 	 */
7751 	if (dhcp.dp_ciaddr.s_addr != bif->bif_hf_ipsrc.s_addr &&
7752 	    dhcp.dp_ciaddr.s_addr != INADDR_ANY) {
7753 		BRIDGE_HF_DROP(brhf_dhcp_bad_ciaddr, __func__, __LINE__);
7754 		goto done;
7755 	}
7756 	error = 0;
7757 done:
7758 	return error;
7759 }
7760 
7761 static int
7762 bridge_host_filter_arp(struct bridge_iflist *bif, mbuf_t *data)
7763 {
7764 	struct ether_arp *ea;
7765 	struct ether_header *eh;
7766 	int error = EINVAL;
7767 	mbuf_t m = *data;
7768 	size_t minlen = sizeof(struct ether_header) + sizeof(struct ether_arp);
7769 
7770 	/*
7771 	 * Make the Ethernet and ARP headers contiguous
7772 	 */
7773 	if (mbuf_pkthdr_len(m) < minlen) {
7774 		BRIDGE_HF_DROP(brhf_arp_too_small, __func__, __LINE__);
7775 		goto done;
7776 	}
7777 	if (mbuf_len(m) < minlen && mbuf_pullup(data, minlen) != 0) {
7778 		BRIDGE_HF_DROP(brhf_arp_pullup_failed,
7779 		    __func__, __LINE__);
7780 		goto done;
7781 	}
7782 	m = *data;
7783 
7784 	/*
7785 	 * Restrict Ethernet protocols to ARP and IP/IPv6
7786 	 */
7787 	eh = mtod(m, struct ether_header *);
7788 	ea = (struct ether_arp *)(eh + 1);
7789 	if (ea->arp_hrd != HTONS_ARPHRD_ETHER) {
7790 		BRIDGE_HF_DROP(brhf_arp_bad_hw_type,
7791 		    __func__, __LINE__);
7792 		goto done;
7793 	}
7794 	if (ea->arp_pro != HTONS_ETHERTYPE_IP) {
7795 		BRIDGE_HF_DROP(brhf_arp_bad_pro_type,
7796 		    __func__, __LINE__);
7797 		goto done;
7798 	}
7799 	/*
7800 	 * Verify the address lengths are correct
7801 	 */
7802 	if (ea->arp_hln != ETHER_ADDR_LEN) {
7803 		BRIDGE_HF_DROP(brhf_arp_bad_hw_len, __func__, __LINE__);
7804 		goto done;
7805 	}
7806 	if (ea->arp_pln != sizeof(struct in_addr)) {
7807 		BRIDGE_HF_DROP(brhf_arp_bad_pro_len,
7808 		    __func__, __LINE__);
7809 		goto done;
7810 	}
7811 	/*
7812 	 * Allow only ARP request or ARP reply
7813 	 */
7814 	if (ea->arp_op != HTONS_ARPOP_REQUEST &&
7815 	    ea->arp_op != HTONS_ARPOP_REPLY) {
7816 		BRIDGE_HF_DROP(brhf_arp_bad_op, __func__, __LINE__);
7817 		goto done;
7818 	}
7819 	if ((bif->bif_flags & BIFF_HF_HWSRC) != 0) {
7820 		/*
7821 		 * Verify source hardware address matches
7822 		 */
7823 		if (bcmp(ea->arp_sha, bif->bif_hf_hwsrc,
7824 		    ETHER_ADDR_LEN) != 0) {
7825 			BRIDGE_HF_DROP(brhf_arp_bad_sha, __func__, __LINE__);
7826 			goto done;
7827 		}
7828 	}
7829 	if ((bif->bif_flags & BIFF_HF_IPSRC) != 0) {
7830 		/*
7831 		 * Verify source protocol address:
7832 		 * May be null for an ARP probe
7833 		 */
7834 		if (bcmp(ea->arp_spa, &bif->bif_hf_ipsrc.s_addr,
7835 		    sizeof(struct in_addr)) != 0 &&
7836 		    bcmp(ea->arp_spa, &inaddr_any,
7837 		    sizeof(struct in_addr)) != 0) {
7838 			BRIDGE_HF_DROP(brhf_arp_bad_spa, __func__, __LINE__);
7839 			goto done;
7840 		}
7841 	}
7842 	bridge_hostfilter_stats.brhf_arp_ok += 1;
7843 	error = 0;
7844 done:
7845 	return error;
7846 }
7847 
7848 static int
7849 bridge_host_filter(struct bridge_iflist *bif, mbuf_t *data)
7850 {
7851 	int error = EINVAL;
7852 	struct ether_header *eh;
7853 	mbuf_t m = *data;
7854 
7855 	eh = mtod(m, struct ether_header *);
7856 
7857 	/*
7858 	 * Restrict the source hardware address
7859 	 */
7860 	if ((bif->bif_flags & BIFF_HF_HWSRC) != 0 &&
7861 	    bcmp(eh->ether_shost, bif->bif_hf_hwsrc,
7862 	    ETHER_ADDR_LEN) != 0) {
7863 		BRIDGE_HF_DROP(brhf_bad_ether_srchw_addr, __func__, __LINE__);
7864 		goto done;
7865 	}
7866 
7867 	/*
7868 	 * Restrict Ethernet protocols to ARP and IP/IPv6
7869 	 */
7870 	if (eh->ether_type == htons(ETHERTYPE_ARP)) {
7871 		error = bridge_host_filter_arp(bif, data);
7872 		if (error != 0) {
7873 			goto done;
7874 		}
7875 	} else if (eh->ether_type == htons(ETHERTYPE_IP)) {
7876 		size_t minlen = sizeof(struct ether_header) + sizeof(struct ip);
7877 		struct ip iphdr;
7878 		size_t offset;
7879 
7880 		/*
7881 		 * Make the Ethernet and IP headers contiguous
7882 		 */
7883 		if (mbuf_pkthdr_len(m) < minlen) {
7884 			BRIDGE_HF_DROP(brhf_ip_too_small, __func__, __LINE__);
7885 			goto done;
7886 		}
7887 		offset = sizeof(struct ether_header);
7888 		error = mbuf_copydata(m, offset, sizeof(struct ip), &iphdr);
7889 		if (error != 0) {
7890 			BRIDGE_HF_DROP(brhf_ip_too_small, __func__, __LINE__);
7891 			goto done;
7892 		}
7893 		if ((bif->bif_flags & BIFF_HF_IPSRC) != 0) {
7894 			/*
7895 			 * Verify the source IP address
7896 			 */
7897 			if (iphdr.ip_p == IPPROTO_UDP) {
7898 				struct udphdr udp;
7899 
7900 				minlen += sizeof(struct udphdr);
7901 				if (mbuf_pkthdr_len(m) < minlen) {
7902 					BRIDGE_HF_DROP(brhf_ip_too_small,
7903 					    __func__, __LINE__);
7904 					goto done;
7905 				}
7906 
7907 				/*
7908 				 * Allow all zero addresses for DHCP requests
7909 				 */
7910 				if (iphdr.ip_src.s_addr != bif->bif_hf_ipsrc.s_addr &&
7911 				    iphdr.ip_src.s_addr != INADDR_ANY) {
7912 					BRIDGE_HF_DROP(brhf_ip_bad_srcaddr,
7913 					    __func__, __LINE__);
7914 					goto done;
7915 				}
7916 				offset = sizeof(struct ether_header) +
7917 				    (IP_VHL_HL(iphdr.ip_vhl) << 2);
7918 				error = mbuf_copydata(m, offset,
7919 				    sizeof(struct udphdr), &udp);
7920 				if (error != 0) {
7921 					BRIDGE_HF_DROP(brhf_ip_too_small,
7922 					    __func__, __LINE__);
7923 					goto done;
7924 				}
7925 				/*
7926 				 * Either it's a Bootp/DHCP packet that we like or
7927 				 * it's a UDP packet from the host IP as source address
7928 				 */
7929 				if (udp.uh_sport == htons(IPPORT_BOOTPC) &&
7930 				    udp.uh_dport == htons(IPPORT_BOOTPS)) {
7931 					minlen += sizeof(struct dhcp);
7932 					if (mbuf_pkthdr_len(m) < minlen) {
7933 						BRIDGE_HF_DROP(brhf_ip_too_small,
7934 						    __func__, __LINE__);
7935 						goto done;
7936 					}
7937 					offset += sizeof(struct udphdr);
7938 					error = bridge_dhcp_filter(bif, m, offset);
7939 					if (error != 0) {
7940 						goto done;
7941 					}
7942 				} else if (iphdr.ip_src.s_addr == INADDR_ANY) {
7943 					BRIDGE_HF_DROP(brhf_ip_bad_srcaddr,
7944 					    __func__, __LINE__);
7945 					goto done;
7946 				}
7947 			} else if (iphdr.ip_src.s_addr != bif->bif_hf_ipsrc.s_addr) {
7948 				assert(bif->bif_hf_ipsrc.s_addr != INADDR_ANY);
7949 				BRIDGE_HF_DROP(brhf_ip_bad_srcaddr, __func__, __LINE__);
7950 				goto done;
7951 			}
7952 		}
7953 		/*
7954 		 * Allow only boring IP protocols
7955 		 */
7956 		if (iphdr.ip_p != IPPROTO_TCP &&
7957 		    iphdr.ip_p != IPPROTO_UDP &&
7958 		    iphdr.ip_p != IPPROTO_ICMP &&
7959 		    iphdr.ip_p != IPPROTO_IGMP) {
7960 			BRIDGE_HF_DROP(brhf_ip_bad_proto, __func__, __LINE__);
7961 			goto done;
7962 		}
7963 		bridge_hostfilter_stats.brhf_ip_ok += 1;
7964 		error = 0;
7965 	} else if (eh->ether_type == htons(ETHERTYPE_IPV6)) {
7966 		size_t minlen = sizeof(struct ether_header) + sizeof(struct ip6_hdr);
7967 		struct ip6_hdr ip6hdr;
7968 		size_t offset;
7969 
7970 		/*
7971 		 * Make the Ethernet and IP headers contiguous
7972 		 */
7973 		if (mbuf_pkthdr_len(m) < minlen) {
7974 			BRIDGE_HF_DROP(brhf_ip_too_small, __func__, __LINE__);
7975 			goto done;
7976 		}
7977 		offset = sizeof(struct ether_header);
7978 		error = mbuf_copydata(m, offset, sizeof(struct ip6_hdr), &ip6hdr);
7979 		if (error != 0) {
7980 			BRIDGE_HF_DROP(brhf_ip_too_small, __func__, __LINE__);
7981 			goto done;
7982 		}
7983 		/*
7984 		 * Allow only boring IPv6 protocols
7985 		 */
7986 		if (ip6hdr.ip6_nxt != IPPROTO_TCP &&
7987 		    ip6hdr.ip6_nxt != IPPROTO_UDP &&
7988 		    ip6hdr.ip6_nxt != IPPROTO_ICMPV6) {
7989 			BRIDGE_HF_DROP(brhf_ip_bad_proto, __func__, __LINE__);
7990 			goto done;
7991 		}
7992 		bridge_hostfilter_stats.brhf_ip_ok += 1;
7993 		error = 0;
7994 	} else {
7995 		BRIDGE_HF_DROP(brhf_bad_ether_type, __func__, __LINE__);
7996 		goto done;
7997 	}
7998 done:
7999 	if (error != 0) {
8000 		if (BRIDGE_DBGF_ENABLED(BR_DBGF_HOSTFILTER)) {
8001 			if (m) {
8002 				brlog_mbuf_data(m, 0,
8003 				    sizeof(struct ether_header) +
8004 				    sizeof(struct ip));
8005 			}
8006 		}
8007 
8008 		if (m != NULL) {
8009 			m_freem(m);
8010 			*data = NULL;
8011 		}
8012 	}
8013 	return error;
8014 }
8015 
8016 /*
8017  * MAC NAT
8018  */
8019 
8020 static errno_t
8021 bridge_mac_nat_enable(struct bridge_softc *sc, struct bridge_iflist *bif)
8022 {
8023 	errno_t         error = 0;
8024 
8025 	BRIDGE_LOCK_ASSERT_HELD(sc);
8026 
8027 	if (IFNET_IS_VMNET(bif->bif_ifp)) {
8028 		error = EINVAL;
8029 		goto done;
8030 	}
8031 	if (sc->sc_mac_nat_bif != NULL) {
8032 		if (sc->sc_mac_nat_bif != bif) {
8033 			error = EBUSY;
8034 		}
8035 		goto done;
8036 	}
8037 	sc->sc_mac_nat_bif = bif;
8038 	bif->bif_ifflags |= IFBIF_MAC_NAT;
8039 	bridge_mac_nat_populate_entries(sc);
8040 
8041 done:
8042 	return error;
8043 }
8044 
8045 static void
8046 bridge_mac_nat_disable(struct bridge_softc *sc)
8047 {
8048 	struct bridge_iflist *mac_nat_bif = sc->sc_mac_nat_bif;
8049 
8050 	assert(mac_nat_bif != NULL);
8051 	bridge_mac_nat_flush_entries(sc, mac_nat_bif);
8052 	mac_nat_bif->bif_ifflags &= ~IFBIF_MAC_NAT;
8053 	sc->sc_mac_nat_bif = NULL;
8054 	return;
8055 }
8056 
8057 static void
8058 mac_nat_entry_print2(struct mac_nat_entry *mne,
8059     const char ifname[IFNAMSIZ], const char *msg1, const char *msg2)
8060 {
8061 	int             af;
8062 	char            etopbuf[24];
8063 	char            ntopbuf[MAX_IPv6_STR_LEN];
8064 	const char      *space;
8065 
8066 	af = ((mne->mne_flags & MNE_FLAGS_IPV6) != 0) ? AF_INET6 : AF_INET;
8067 	ether_ntop(etopbuf, sizeof(etopbuf), mne->mne_mac);
8068 	(void)inet_ntop(af, &mne->mne_u, ntopbuf, sizeof(ntopbuf));
8069 	if (msg2 == NULL) {
8070 		msg2 = "";
8071 		space = "";
8072 	} else {
8073 		space = " ";
8074 	}
8075 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8076 	    "%.*s %s%s%s %p (%s, %s, %s)", IFNAMSIZ, ifname, msg1, space, msg2, mne,
8077 	    mne->mne_bif->bif_ifp->if_xname, ntopbuf, etopbuf);
8078 }
8079 
8080 static void
8081 mac_nat_entry_print(struct mac_nat_entry *mne,
8082     const char ifname[IFNAMSIZ], const char *msg)
8083 {
8084 	mac_nat_entry_print2(mne, ifname, msg, NULL);
8085 }
8086 
8087 static struct mac_nat_entry *
8088 bridge_lookup_mac_nat_entry_ipv4(const struct bridge_softc *sc, const struct in_addr *ip)
8089 {
8090 	struct mac_nat_entry    *mne;
8091 	struct mac_nat_entry    *ret_mne = NULL;
8092 
8093 	LIST_FOREACH(mne, &sc->sc_mne_list, mne_list) {
8094 		if (mne->mne_ip.s_addr == ip->s_addr) {
8095 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8096 				mac_nat_entry_print(mne, sc->sc_if_xname,
8097 				    "found");
8098 			}
8099 			ret_mne = mne;
8100 			break;
8101 		}
8102 	}
8103 
8104 	return ret_mne;
8105 }
8106 
8107 static struct mac_nat_entry *
8108 bridge_lookup_mac_nat_entry_ipv6(const struct bridge_softc *sc, const struct in6_addr *ip6)
8109 {
8110 	struct mac_nat_entry    *mne;
8111 	struct mac_nat_entry    *ret_mne = NULL;
8112 
8113 	LIST_FOREACH(mne, &sc->sc_mne_list_v6, mne_list) {
8114 		if (IN6_ARE_ADDR_EQUAL(&mne->mne_ip6, ip6)) {
8115 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8116 				mac_nat_entry_print(mne, sc->sc_if_xname,
8117 				    "found");
8118 			}
8119 			ret_mne = mne;
8120 			break;
8121 		}
8122 	}
8123 
8124 	return ret_mne;
8125 }
8126 
8127 static void
8128 bridge_destroy_mac_nat_entry(struct bridge_softc *sc,
8129     struct mac_nat_entry *mne, const char *reason)
8130 {
8131 	LIST_REMOVE(mne, mne_list);
8132 	if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8133 		mac_nat_entry_print(mne, sc->sc_if_xname, reason);
8134 	}
8135 	zfree(bridge_mne_pool, mne);
8136 	sc->sc_mne_count--;
8137 }
8138 
8139 static struct mac_nat_entry *
8140 bridge_create_mac_nat_entry_common(struct bridge_softc *sc,
8141     struct bridge_iflist *bif, const char eaddr[ETHER_ADDR_LEN])
8142 {
8143 	struct mac_nat_entry *mne;
8144 
8145 	if (sc->sc_mne_count >= sc->sc_mne_max) {
8146 		sc->sc_mne_allocation_failures++;
8147 		return NULL;
8148 	}
8149 
8150 	mne = zalloc_noblock(bridge_mne_pool);
8151 	if (mne == NULL) {
8152 		sc->sc_mne_allocation_failures++;
8153 		return NULL;
8154 	}
8155 
8156 	sc->sc_mne_count++;
8157 	bzero(mne, sizeof(*mne));
8158 	bcopy(eaddr, mne->mne_mac, sizeof(mne->mne_mac));
8159 
8160 	mne->mne_bif = bif;
8161 	mne->mne_expire = (unsigned long)net_uptime() + sc->sc_brttimeout;
8162 
8163 	if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8164 		mac_nat_entry_print(mne, sc->sc_if_xname, "created");
8165 	}
8166 
8167 	return mne;
8168 }
8169 
8170 static struct mac_nat_entry *
8171 bridge_create_mac_nat_entry_ipv4(struct bridge_softc *sc,
8172     struct bridge_iflist *bif, const struct in_addr *ip, const char eaddr[ETHER_ADDR_LEN])
8173 {
8174 	struct mac_nat_entry *mne;
8175 
8176 	mne = bridge_create_mac_nat_entry_common(sc, bif, eaddr);
8177 	if (mne == NULL) {
8178 		return NULL;
8179 	}
8180 
8181 	bcopy(ip, &mne->mne_ip, sizeof(mne->mne_ip));
8182 	LIST_INSERT_HEAD(&sc->sc_mne_list, mne, mne_list);
8183 
8184 	return mne;
8185 }
8186 
8187 static struct mac_nat_entry *
8188 bridge_create_mac_nat_entry_ipv6(struct bridge_softc *sc,
8189     struct bridge_iflist *bif, const struct in6_addr *ip6, const char eaddr[ETHER_ADDR_LEN])
8190 {
8191 	struct mac_nat_entry *mne;
8192 
8193 	mne = bridge_create_mac_nat_entry_common(sc, bif, eaddr);
8194 	if (mne == NULL) {
8195 		return NULL;
8196 	}
8197 
8198 	bcopy(ip6, &mne->mne_ip6, sizeof(mne->mne_ip6));
8199 	mne->mne_flags |= MNE_FLAGS_IPV6;
8200 	LIST_INSERT_HEAD(&sc->sc_mne_list_v6, mne, mne_list);
8201 
8202 	return mne;
8203 }
8204 
8205 static struct mac_nat_entry *
8206 bridge_update_mac_nat_entry_common(struct bridge_softc *sc, struct bridge_iflist *bif,
8207     struct mac_nat_entry *mne, const char eaddr[ETHER_ADDR_LEN])
8208 {
8209 	struct bridge_iflist *mac_nat_bif = sc->sc_mac_nat_bif;
8210 
8211 	if (mne->mne_bif == mac_nat_bif) {
8212 		/* the MAC NAT interface takes precedence */
8213 		if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8214 			if (mne->mne_bif != bif) {
8215 				mac_nat_entry_print2(mne,
8216 				    sc->sc_if_xname, "reject",
8217 				    bif->bif_ifp->if_xname);
8218 			}
8219 		}
8220 	} else if (mne->mne_bif != bif) {
8221 		const char *__null_terminated old_if = mne->mne_bif->bif_ifp->if_xname;
8222 
8223 		mne->mne_bif = bif;
8224 		if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8225 			mac_nat_entry_print2(mne,
8226 			    sc->sc_if_xname, "replaced",
8227 			    old_if);
8228 		}
8229 		bcopy(eaddr, mne->mne_mac, sizeof(mne->mne_mac));
8230 	}
8231 
8232 	mne->mne_expire = (unsigned long)net_uptime() + sc->sc_brttimeout;
8233 
8234 	return mne;
8235 }
8236 
8237 static struct mac_nat_entry *
8238 bridge_update_mac_nat_entry_ipv4(struct bridge_softc *sc,
8239     struct bridge_iflist *bif, struct in_addr *ip, const char eaddr[ETHER_ADDR_LEN])
8240 {
8241 	struct mac_nat_entry *mne;
8242 
8243 	mne = bridge_lookup_mac_nat_entry_ipv4(sc, ip);
8244 	if (mne != NULL) {
8245 		return bridge_update_mac_nat_entry_common(sc, bif, mne, eaddr);
8246 	}
8247 
8248 	mne = bridge_create_mac_nat_entry_ipv4(sc, bif, ip, eaddr);
8249 	return mne;
8250 }
8251 
8252 static struct mac_nat_entry *
8253 bridge_update_mac_nat_entry_ipv6(struct bridge_softc *sc,
8254     struct bridge_iflist *bif, struct in6_addr *ip6, const char eaddr[ETHER_ADDR_LEN])
8255 {
8256 	struct mac_nat_entry *mne;
8257 
8258 	mne = bridge_lookup_mac_nat_entry_ipv6(sc, ip6);
8259 	if (mne != NULL) {
8260 		return bridge_update_mac_nat_entry_common(sc, bif, mne, eaddr);
8261 	}
8262 
8263 	mne = bridge_create_mac_nat_entry_ipv6(sc, bif, ip6, eaddr);
8264 	return mne;
8265 }
8266 
8267 static void
8268 bridge_mac_nat_flush_entries_common(struct bridge_softc *sc,
8269     struct mac_nat_entry_list *list, struct bridge_iflist *bif)
8270 {
8271 	struct mac_nat_entry *mne;
8272 	struct mac_nat_entry *tmne;
8273 
8274 	LIST_FOREACH_SAFE(mne, list, mne_list, tmne) {
8275 		if (bif != NULL && mne->mne_bif != bif) {
8276 			continue;
8277 		}
8278 		bridge_destroy_mac_nat_entry(sc, mne, "flushed");
8279 	}
8280 }
8281 
8282 /*
8283  * bridge_mac_nat_flush_entries:
8284  *
8285  * Flush MAC NAT entries for the specified member. Flush all entries if
8286  * the member is the one that requires MAC NAT, otherwise just flush the
8287  * ones for the specified member.
8288  */
8289 static void
8290 bridge_mac_nat_flush_entries(struct bridge_softc *sc, struct bridge_iflist * bif)
8291 {
8292 	struct bridge_iflist *flush_bif;
8293 
8294 	flush_bif = (bif == sc->sc_mac_nat_bif) ? NULL : bif;
8295 	bridge_mac_nat_flush_entries_common(sc, &sc->sc_mne_list, flush_bif);
8296 	bridge_mac_nat_flush_entries_common(sc, &sc->sc_mne_list_v6, flush_bif);
8297 }
8298 
8299 static void
8300 bridge_mac_nat_populate_entries(struct bridge_softc *sc)
8301 {
8302 	errno_t                 error;
8303 	ifnet_t                 ifp;
8304 	uint16_t                addresses_count = 0;
8305 	ifaddr_t                * __counted_by(addresses_count) list;
8306 	struct bridge_iflist    *mac_nat_bif = sc->sc_mac_nat_bif;
8307 
8308 	assert(mac_nat_bif != NULL);
8309 	ifp = mac_nat_bif->bif_ifp;
8310 	error = ifnet_get_address_list_family_with_count(ifp, &list, &addresses_count, 0);
8311 	if (error != 0) {
8312 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8313 		    "ifnet_get_address_list(%s) failed %d",
8314 		    ifp->if_xname, error);
8315 		return;
8316 	}
8317 
8318 	for (uint16_t i = 0; i < addresses_count; ++i) {
8319 		sa_family_t af;
8320 
8321 		af = ifaddr_address_family(list[i]);
8322 		switch (af) {
8323 		case AF_INET: {
8324 			struct sockaddr_in sin;
8325 
8326 			error = ifaddr_address(list[i], (struct sockaddr *)&sin, sizeof(sin));
8327 			if (error != 0) {
8328 				BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8329 				    "ifaddr_address failed %d",
8330 				    error);
8331 				break;
8332 			}
8333 
8334 			bridge_create_mac_nat_entry_ipv4(sc, mac_nat_bif, &sin.sin_addr, IF_LLADDR(ifp));
8335 			break;
8336 		}
8337 
8338 		case AF_INET6: {
8339 			struct sockaddr_in6 sin6;
8340 
8341 			error = ifaddr_address(list[i], (struct sockaddr *)&sin6, sizeof(sin6));
8342 			if (error != 0) {
8343 				BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8344 				    "ifaddr_address failed %d",
8345 				    error);
8346 				break;
8347 			}
8348 
8349 			if (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
8350 				/* remove scope ID */
8351 				sin6.sin6_addr.s6_addr16[1] = 0;
8352 			}
8353 
8354 			bridge_create_mac_nat_entry_ipv6(sc, mac_nat_bif, &sin6.sin6_addr, IF_LLADDR(ifp));
8355 			break;
8356 		}
8357 
8358 		default:
8359 			BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8360 			    "ifaddr_address_family unknown %d",
8361 			    af);
8362 			break;
8363 		}
8364 	}
8365 
8366 	ifnet_address_list_free_counted_by(list, addresses_count);
8367 	return;
8368 }
8369 
8370 static void
8371 bridge_mac_nat_age_entries_common(struct bridge_softc *sc,
8372     struct mac_nat_entry_list *list, unsigned long now)
8373 {
8374 	struct mac_nat_entry *mne;
8375 	struct mac_nat_entry *tmne;
8376 
8377 	LIST_FOREACH_SAFE(mne, list, mne_list, tmne) {
8378 		if (now >= mne->mne_expire) {
8379 			bridge_destroy_mac_nat_entry(sc, mne, "aged out");
8380 		}
8381 	}
8382 }
8383 
8384 static void
8385 bridge_mac_nat_age_entries(struct bridge_softc *sc, unsigned long now)
8386 {
8387 	if (sc->sc_mac_nat_bif == NULL) {
8388 		return;
8389 	}
8390 	bridge_mac_nat_age_entries_common(sc, &sc->sc_mne_list, now);
8391 	bridge_mac_nat_age_entries_common(sc, &sc->sc_mne_list_v6, now);
8392 }
8393 
8394 static const char *
8395 get_in_out_string(boolean_t is_output)
8396 {
8397 	return (const char * __null_terminated)(is_output ? "OUT" : "IN");
8398 }
8399 
8400 /*
8401  * is_valid_arp_packet:
8402  *	Verify that this is a valid ARP packet.
8403  *
8404  *	Returns TRUE if the packet is valid, FALSE otherwise.
8405  */
8406 static boolean_t
8407 is_valid_arp_packet(mbuf_t *data, bool is_output,
8408     struct ether_header **eh_p, struct ether_arp **ea_p)
8409 {
8410 	struct ether_arp *ea;
8411 	struct ether_header *eh;
8412 	size_t minlen = sizeof(struct ether_header) + sizeof(struct ether_arp);
8413 	boolean_t is_valid = FALSE;
8414 	int flags = is_output ? BR_DBGF_OUTPUT : BR_DBGF_INPUT;
8415 
8416 	if (mbuf_pkthdr_len(*data) < minlen) {
8417 		BRIDGE_LOG(LOG_DEBUG, flags,
8418 		    "ARP %s short frame %lu < %lu",
8419 		    get_in_out_string(is_output),
8420 		    mbuf_pkthdr_len(*data), minlen);
8421 		goto done;
8422 	}
8423 	if (mbuf_len(*data) < minlen && mbuf_pullup(data, minlen) != 0) {
8424 		BRIDGE_LOG(LOG_DEBUG, flags,
8425 		    "ARP %s size %lu mbuf_pullup fail",
8426 		    get_in_out_string(is_output),
8427 		    minlen);
8428 		*data = NULL;
8429 		goto done;
8430 	}
8431 
8432 	/* validate ARP packet */
8433 	eh = mtod(*data, struct ether_header *);
8434 	ea = (struct ether_arp *)(eh + 1);
8435 	if (ea->arp_hrd != HTONS_ARPHRD_ETHER) {
8436 		BRIDGE_LOG(LOG_DEBUG, flags,
8437 		    "ARP %s htype not ethernet",
8438 		    get_in_out_string(is_output));
8439 		goto done;
8440 	}
8441 	if (ea->arp_hln != ETHER_ADDR_LEN) {
8442 		BRIDGE_LOG(LOG_DEBUG, flags,
8443 		    "ARP %s hlen not ethernet",
8444 		    get_in_out_string(is_output));
8445 		goto done;
8446 	}
8447 	if (ea->arp_pro != HTONS_ETHERTYPE_IP) {
8448 		BRIDGE_LOG(LOG_DEBUG, flags,
8449 		    "ARP %s ptype not IP",
8450 		    get_in_out_string(is_output));
8451 		goto done;
8452 	}
8453 	if (ea->arp_pln != sizeof(struct in_addr)) {
8454 		BRIDGE_LOG(LOG_DEBUG, flags,
8455 		    "ARP %s plen not IP",
8456 		    get_in_out_string(is_output));
8457 		goto done;
8458 	}
8459 	is_valid = TRUE;
8460 	*ea_p = ea;
8461 	*eh_p = eh;
8462 done:
8463 	return is_valid;
8464 }
8465 
8466 static struct mac_nat_entry *
8467 bridge_mac_nat_arp_input(struct bridge_softc *sc, mbuf_t *data)
8468 {
8469 	struct ether_arp        * __single ea;
8470 	struct ether_header     * __single eh;
8471 	struct mac_nat_entry    *mne = NULL;
8472 	u_short                 op;
8473 	struct in_addr          tpa;
8474 
8475 	if (!is_valid_arp_packet(data, FALSE, &eh, &ea)) {
8476 		goto done;
8477 	}
8478 	op = ea->arp_op;
8479 	switch (op) {
8480 	case HTONS_ARPOP_REQUEST:
8481 	case HTONS_ARPOP_REPLY:
8482 		/* only care about REQUEST and REPLY */
8483 		break;
8484 	default:
8485 		goto done;
8486 	}
8487 
8488 	/* check the target IP address for a NAT entry */
8489 	bcopy(ea->arp_tpa, &tpa, sizeof(tpa));
8490 	if (tpa.s_addr != 0) {
8491 		mne = bridge_lookup_mac_nat_entry_ipv4(sc, &tpa);
8492 	}
8493 	if (mne != NULL) {
8494 		if (op == HTONS_ARPOP_REPLY) {
8495 			/* translate the MAC address */
8496 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8497 				char    mac_src[24];
8498 				char    mac_dst[24];
8499 
8500 				ether_ntop(mac_src, sizeof(mac_src),
8501 				    ea->arp_tha);
8502 				ether_ntop(mac_dst, sizeof(mac_dst),
8503 				    mne->mne_mac);
8504 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8505 				    "%s %s ARP %s -> %s",
8506 				    sc->sc_if_xname,
8507 				    mne->mne_bif->bif_ifp->if_xname,
8508 				    mac_src, mac_dst);
8509 			}
8510 			bcopy(mne->mne_mac, ea->arp_tha, sizeof(ea->arp_tha));
8511 		}
8512 	} else {
8513 		/* handle conflicting ARP (sender matches mne) */
8514 		struct in_addr spa;
8515 
8516 		bcopy(ea->arp_spa, &spa, sizeof(spa));
8517 		if (spa.s_addr != 0 && spa.s_addr != tpa.s_addr) {
8518 			/* check the source IP for a NAT entry */
8519 			mne = bridge_lookup_mac_nat_entry_ipv4(sc, &spa);
8520 		}
8521 	}
8522 
8523 done:
8524 	return mne;
8525 }
8526 
8527 static boolean_t
8528 bridge_mac_nat_arp_output(struct bridge_softc *sc,
8529     struct bridge_iflist *bif, mbuf_t *data, struct mac_nat_record *mnr)
8530 {
8531 	struct ether_arp        * __single ea;
8532 	struct ether_header     * __single eh;
8533 	struct in_addr          ip;
8534 	struct mac_nat_entry    *mne = NULL;
8535 	u_short                 op;
8536 	boolean_t               translate = FALSE;
8537 
8538 	if (!is_valid_arp_packet(data, TRUE, &eh, &ea)) {
8539 		goto done;
8540 	}
8541 	op = ea->arp_op;
8542 	switch (op) {
8543 	case HTONS_ARPOP_REQUEST:
8544 	case HTONS_ARPOP_REPLY:
8545 		/* only care about REQUEST and REPLY */
8546 		break;
8547 	default:
8548 		goto done;
8549 	}
8550 
8551 	bcopy(ea->arp_spa, &ip, sizeof(ip));
8552 	if (ip.s_addr == 0) {
8553 		goto done;
8554 	}
8555 	/* XXX validate IP address: no multicast/broadcast */
8556 	mne = bridge_update_mac_nat_entry_ipv4(sc, bif, &ip,
8557 	    (const char *)ea->arp_sha);
8558 	if (mnr != NULL && mne != NULL) {
8559 		/* record the offset to do the replacement */
8560 		translate = TRUE;
8561 		mnr->mnr_arp_offset = (char *)ea->arp_sha - (char *)eh;
8562 	}
8563 
8564 done:
8565 	return translate;
8566 }
8567 
8568 #define ETHER_IPV4_HEADER_LEN   (sizeof(struct ether_header) +  \
8569 	                         + sizeof(struct ip))
8570 static uint8_t * __indexable
8571 get_ether_ip_header_ptr(mbuf_t *data, boolean_t is_output)
8572 {
8573 	uint8_t         *header = NULL;
8574 	int             flags = is_output ? BR_DBGF_OUTPUT : BR_DBGF_INPUT;
8575 	size_t          minlen = ETHER_IPV4_HEADER_LEN;
8576 
8577 	if (mbuf_pkthdr_len(*data) < minlen) {
8578 		BRIDGE_LOG(LOG_DEBUG, flags,
8579 		    "IP %s short frame %lu < %lu",
8580 		    get_in_out_string(is_output),
8581 		    mbuf_pkthdr_len(*data), minlen);
8582 		goto done;
8583 	}
8584 	if (mbuf_len(*data) < minlen && mbuf_pullup(data, minlen) != 0) {
8585 		BRIDGE_LOG(LOG_DEBUG, flags,
8586 		    "IP %s size %lu mbuf_pullup fail",
8587 		    get_in_out_string(is_output),
8588 		    minlen);
8589 		*data = NULL;
8590 		goto done;
8591 	}
8592 	header = mtod(*data, uint8_t *);
8593 done:
8594 	return header;
8595 }
8596 
8597 static bool
8598 is_broadcast_ip_packet(mbuf_t *data)
8599 {
8600 	uint8_t                 *header;
8601 	struct ether_header     *eh;
8602 	bool                    is_broadcast = FALSE;
8603 
8604 	eh = mtod(*data, struct ether_header *);
8605 	switch (eh->ether_type) {
8606 	case HTONS_ETHERTYPE_IP:
8607 		header = get_ether_ip_header_ptr(data, FALSE);
8608 		if (header != NULL) {
8609 			struct in_addr  dst;
8610 			struct ip       *iphdr;
8611 
8612 			iphdr = (struct ip *)(header + sizeof(struct ether_header));
8613 			bcopy(&iphdr->ip_dst, &dst, sizeof(dst));
8614 			is_broadcast = (dst.s_addr == INADDR_BROADCAST);
8615 		}
8616 		break;
8617 	default:
8618 		break;
8619 	}
8620 	return is_broadcast;
8621 }
8622 
8623 static struct mac_nat_entry *
8624 bridge_mac_nat_ip_input(struct bridge_softc *sc, mbuf_t *data)
8625 {
8626 	struct in_addr          dst;
8627 	uint8_t                 *header;
8628 	struct ip               *iphdr;
8629 	struct mac_nat_entry    *mne = NULL;
8630 
8631 	header = get_ether_ip_header_ptr(data, FALSE);
8632 	if (header == NULL) {
8633 		goto done;
8634 	}
8635 	iphdr = (struct ip *)(void *)(header + sizeof(struct ether_header));
8636 	bcopy(&iphdr->ip_dst, &dst, sizeof(dst));
8637 	/* XXX validate IP address */
8638 	if (dst.s_addr == 0) {
8639 		goto done;
8640 	}
8641 	mne = bridge_lookup_mac_nat_entry_ipv4(sc, &dst);
8642 done:
8643 	return mne;
8644 }
8645 
8646 static void
8647 bridge_mac_nat_udp_output(struct bridge_softc *sc,
8648     struct bridge_iflist *bif, mbuf_t m,
8649     uint8_t ip_header_len, struct mac_nat_record *mnr)
8650 {
8651 	uint16_t        dp_flags;
8652 	errno_t         error;
8653 	size_t          offset;
8654 	struct udphdr   udphdr;
8655 
8656 	/* copy the UDP header */
8657 	offset = sizeof(struct ether_header) + ip_header_len;
8658 	error = mbuf_copydata(m, offset, sizeof(struct udphdr), &udphdr);
8659 	if (error != 0) {
8660 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8661 		    "mbuf_copydata udphdr failed %d",
8662 		    error);
8663 		return;
8664 	}
8665 	if (udphdr.uh_sport != HTONS_IPPORT_BOOTPC ||
8666 	    udphdr.uh_dport != HTONS_IPPORT_BOOTPS) {
8667 		/* not a BOOTP/DHCP packet */
8668 		return;
8669 	}
8670 	/* check whether the broadcast bit is already set */
8671 	offset += sizeof(struct udphdr) + offsetof(struct dhcp, dp_flags);
8672 	error = mbuf_copydata(m, offset, sizeof(dp_flags), &dp_flags);
8673 	if (error != 0) {
8674 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8675 		    "mbuf_copydata dp_flags failed %d",
8676 		    error);
8677 		return;
8678 	}
8679 	if ((dp_flags & HTONS_DHCP_FLAGS_BROADCAST) != 0) {
8680 		/* it's already set, nothing to do */
8681 		return;
8682 	}
8683 	/* broadcast bit needs to be set */
8684 	mnr->mnr_ip_dhcp_flags = dp_flags | htons(DHCP_FLAGS_BROADCAST);
8685 	mnr->mnr_ip_header_len = ip_header_len;
8686 	if (udphdr.uh_sum != 0) {
8687 		uint16_t        delta;
8688 
8689 		/* adjust checksum to take modified dp_flags into account */
8690 		delta = dp_flags - mnr->mnr_ip_dhcp_flags;
8691 		mnr->mnr_ip_udp_csum = udphdr.uh_sum + delta;
8692 	}
8693 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8694 	    "%s %s DHCP dp_flags 0x%x UDP cksum 0x%x",
8695 	    sc->sc_if_xname,
8696 	    bif->bif_ifp->if_xname,
8697 	    ntohs(mnr->mnr_ip_dhcp_flags),
8698 	    ntohs(mnr->mnr_ip_udp_csum));
8699 	return;
8700 }
8701 
8702 static boolean_t
8703 bridge_mac_nat_ip_output(struct bridge_softc *sc,
8704     struct bridge_iflist *bif, mbuf_t *data, struct mac_nat_record *mnr)
8705 {
8706 #pragma unused(mnr)
8707 	uint8_t                 *header;
8708 	struct ether_header     *eh;
8709 	struct in_addr          ip;
8710 	struct ip               *iphdr;
8711 	uint8_t                 ip_header_len;
8712 	struct mac_nat_entry    *mne = NULL;
8713 	boolean_t               translate = FALSE;
8714 
8715 	header = get_ether_ip_header_ptr(data, TRUE);
8716 	if (header == NULL) {
8717 		goto done;
8718 	}
8719 
8720 	eh = (struct ether_header *)header;
8721 	iphdr = (struct ip *)(header + sizeof(*eh));
8722 	ip_header_len = IP_VHL_HL(iphdr->ip_vhl) << 2;
8723 	if (ip_header_len < sizeof(ip)) {
8724 		/* bogus IP header */
8725 		goto done;
8726 	}
8727 	bcopy(&iphdr->ip_src, &ip, sizeof(ip));
8728 	/* XXX validate the source address */
8729 	if (ip.s_addr != 0) {
8730 		mne = bridge_update_mac_nat_entry_ipv4(sc, bif, &ip,
8731 		    (const char *)eh->ether_shost);
8732 	}
8733 	if (mnr != NULL) {
8734 		if (ip.s_addr == 0 && iphdr->ip_p == IPPROTO_UDP) {
8735 			/* handle DHCP must broadcast */
8736 			bridge_mac_nat_udp_output(sc, bif, *data,
8737 			    ip_header_len, mnr);
8738 		}
8739 		translate = TRUE;
8740 	}
8741 done:
8742 	return translate;
8743 }
8744 
8745 #define ETHER_IPV6_HEADER_LEN   (sizeof(struct ether_header) +  \
8746 	                         + sizeof(struct ip6_hdr))
8747 static uint8_t * __indexable
8748 get_ether_ipv6_header_ptr(mbuf_t *data, size_t plen, boolean_t is_output)
8749 {
8750 	uint8_t         *header = NULL;
8751 	int             flags = is_output ? BR_DBGF_OUTPUT : BR_DBGF_INPUT;
8752 	size_t          minlen = ETHER_IPV6_HEADER_LEN + plen;
8753 
8754 	if (mbuf_pkthdr_len(*data) < minlen) {
8755 		BRIDGE_LOG(LOG_DEBUG, flags,
8756 		    "IP %s short frame %lu < %lu",
8757 		    get_in_out_string(is_output),
8758 		    mbuf_pkthdr_len(*data), minlen);
8759 		goto done;
8760 	}
8761 	if (mbuf_len(*data) < minlen && mbuf_pullup(data, minlen) != 0) {
8762 		BRIDGE_LOG(LOG_DEBUG, flags,
8763 		    "IP %s size %lu mbuf_pullup fail",
8764 		    get_in_out_string(is_output),
8765 		    minlen);
8766 		*data = NULL;
8767 		goto done;
8768 	}
8769 	header = mtod(*data, uint8_t *);
8770 done:
8771 	return header;
8772 }
8773 
8774 #include <netinet/icmp6.h>
8775 #include <netinet6/nd6.h>
8776 
8777 #define ETHER_ND_LLADDR_LEN     (ETHER_ADDR_LEN + sizeof(struct nd_opt_hdr))
8778 
8779 static void
8780 bridge_mac_nat_icmpv6_output(struct bridge_softc *sc,
8781     struct bridge_iflist *bif,
8782     mbuf_t *data, struct ip6_hdr *ip6h,
8783     struct in6_addr *saddrp,
8784     struct mac_nat_record *mnr)
8785 {
8786 	uint8_t *header;
8787 	struct ether_header *eh;
8788 	struct icmp6_hdr *icmp6;
8789 	uint8_t         icmp6_type;
8790 	uint32_t        icmp6len;
8791 	int             lladdrlen = 0;
8792 	char            *lladdr = NULL;
8793 	unsigned int    off = sizeof(*ip6h);
8794 
8795 	icmp6len = (u_int32_t)ntohs(ip6h->ip6_plen);
8796 	if (icmp6len < sizeof(*icmp6)) {
8797 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8798 		    "short IPv6 payload length %d < %lu",
8799 		    icmp6len, sizeof(*icmp6));
8800 		return;
8801 	}
8802 
8803 	/* pullup IP6 header + ICMPv6 header */
8804 	header = get_ether_ipv6_header_ptr(data, sizeof(*icmp6), TRUE);
8805 	if (header == NULL) {
8806 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8807 		    "failed to pullup icmp6 header");
8808 		return;
8809 	}
8810 	eh = (struct ether_header *)header;
8811 	ip6h = (struct ip6_hdr *)(header + sizeof(*eh));
8812 	icmp6 = (struct icmp6_hdr *)(header + sizeof(*eh) + off);
8813 	icmp6_type = icmp6->icmp6_type;
8814 	switch (icmp6_type) {
8815 	case ND_NEIGHBOR_SOLICIT:
8816 	case ND_NEIGHBOR_ADVERT:
8817 	case ND_ROUTER_ADVERT:
8818 	case ND_ROUTER_SOLICIT:
8819 		break;
8820 	default:
8821 		return;
8822 	}
8823 
8824 	/* pullup IP6 header + payload */
8825 	header = get_ether_ipv6_header_ptr(data, icmp6len, TRUE);
8826 	if (header == NULL) {
8827 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
8828 		    "failed to pullup icmp6 + payload");
8829 		return;
8830 	}
8831 	eh = (struct ether_header *)header;
8832 	ip6h = (struct ip6_hdr *)(header + sizeof(*eh));
8833 	icmp6 = (struct icmp6_hdr *)(header + sizeof(*eh) + off);
8834 
8835 	switch (icmp6_type) {
8836 	case ND_NEIGHBOR_SOLICIT: {
8837 		struct nd_neighbor_solicit *nd_ns;
8838 		union nd_opts ndopts;
8839 		boolean_t is_dad_probe;
8840 		struct in6_addr taddr;
8841 
8842 		if (icmp6len < sizeof(*nd_ns)) {
8843 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8844 			    "short nd_ns %d < %lu",
8845 			    icmp6len, sizeof(*nd_ns));
8846 			return;
8847 		}
8848 
8849 		nd_ns = (struct nd_neighbor_solicit *)(void *)icmp6;
8850 		bcopy(&nd_ns->nd_ns_target, &taddr, sizeof(taddr));
8851 		if (IN6_IS_ADDR_MULTICAST(&taddr) ||
8852 		    IN6_IS_ADDR_UNSPECIFIED(&taddr)) {
8853 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8854 			    "invalid target ignored");
8855 			return;
8856 		}
8857 
8858 		/* parse options */
8859 		nd6_option_init(nd_ns + 1, icmp6len - sizeof(*nd_ns), &ndopts);
8860 		if (nd6_options(&ndopts) < 0) {
8861 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8862 			    "invalid ND6 NS option");
8863 			return;
8864 		}
8865 		if (ndopts.nd_opts_src_lladdr != NULL) {
8866 			ND_OPT_LLADDR(ndopts.nd_opts_src_lladdr, nd_opt_len,
8867 			    lladdr, lladdrlen);
8868 		}
8869 		is_dad_probe = IN6_IS_ADDR_UNSPECIFIED(saddrp);
8870 		if (lladdr != NULL) {
8871 			if (is_dad_probe) {
8872 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8873 				    "bad ND6 DAD packet");
8874 				return;
8875 			}
8876 			if (lladdrlen != ETHER_ND_LLADDR_LEN) {
8877 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8878 				    "source lladdrlen %d != %lu",
8879 				    lladdrlen, ETHER_ND_LLADDR_LEN);
8880 				return;
8881 			}
8882 		}
8883 		if (is_dad_probe) {
8884 			/* node is trying use taddr, create an mne for taddr */
8885 			*saddrp = taddr;
8886 		}
8887 		break;
8888 	}
8889 	case ND_NEIGHBOR_ADVERT: {
8890 		struct nd_neighbor_advert *nd_na;
8891 		union nd_opts ndopts;
8892 		struct in6_addr taddr;
8893 
8894 
8895 		nd_na = (struct nd_neighbor_advert *)(void *)icmp6;
8896 
8897 		if (icmp6len < sizeof(*nd_na)) {
8898 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8899 			    "short nd_na %d < %lu",
8900 			    icmp6len, sizeof(*nd_na));
8901 			return;
8902 		}
8903 
8904 		bcopy(&nd_na->nd_na_target, &taddr, sizeof(taddr));
8905 		if (IN6_IS_ADDR_MULTICAST(&taddr) ||
8906 		    IN6_IS_ADDR_UNSPECIFIED(&taddr)) {
8907 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8908 			    "invalid target ignored");
8909 			return;
8910 		}
8911 
8912 		/* parse options */
8913 		nd6_option_init(nd_na + 1, icmp6len - sizeof(*nd_na), &ndopts);
8914 		if (nd6_options(&ndopts) < 0) {
8915 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8916 			    "invalid ND6 NA option");
8917 			return;
8918 		}
8919 		if (ndopts.nd_opts_tgt_lladdr == NULL) {
8920 			/* target linklayer, nothing to do */
8921 			return;
8922 		}
8923 
8924 		ND_OPT_LLADDR(ndopts.nd_opts_tgt_lladdr, nd_opt_len, lladdr, lladdrlen);
8925 		if (lladdrlen != ETHER_ND_LLADDR_LEN) {
8926 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8927 			    "target lladdrlen %d != %lu",
8928 			    lladdrlen, ETHER_ND_LLADDR_LEN);
8929 			return;
8930 		}
8931 		break;
8932 	}
8933 	case ND_ROUTER_ADVERT:
8934 	case ND_ROUTER_SOLICIT: {
8935 		union nd_opts ndopts;
8936 		uint32_t type_length;
8937 		const char *description;
8938 
8939 		if (icmp6_type == ND_ROUTER_ADVERT) {
8940 			type_length = sizeof(struct nd_router_advert);
8941 			description = "RA";
8942 		} else {
8943 			type_length = sizeof(struct nd_router_solicit);
8944 			description = "RS";
8945 		}
8946 		if (icmp6len < type_length) {
8947 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8948 			    "short ND6 %s %d < %d",
8949 			    description, icmp6len, type_length);
8950 			return;
8951 		}
8952 
8953 		/* parse options */
8954 		nd6_option_init(((uint8_t *)icmp6) + type_length,
8955 		    icmp6len - type_length, &ndopts);
8956 		if (nd6_options(&ndopts) < 0) {
8957 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8958 			    "invalid ND6 %s option", description);
8959 			return;
8960 		}
8961 		if (ndopts.nd_opts_src_lladdr != NULL) {
8962 			ND_OPT_LLADDR(ndopts.nd_opts_src_lladdr, nd_opt_len, lladdr, lladdrlen);
8963 
8964 			if (lladdrlen != ETHER_ND_LLADDR_LEN) {
8965 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
8966 				    "source lladdrlen %d != %lu",
8967 				    lladdrlen, ETHER_ND_LLADDR_LEN);
8968 				return;
8969 			}
8970 		}
8971 		break;
8972 	}
8973 	default:
8974 		break;
8975 	}
8976 
8977 	if (lladdr != NULL) {
8978 		mnr->mnr_ip6_lladdr_offset = (uint16_t)
8979 		    ((uintptr_t)lladdr - (uintptr_t)eh);
8980 		mnr->mnr_ip6_icmp6_len = icmp6len;
8981 		mnr->mnr_ip6_icmp6_type = icmp6_type;
8982 		mnr->mnr_ip6_header_len = off;
8983 		if (BRIDGE_DBGF_ENABLED(BR_DBGF_MAC_NAT)) {
8984 			const char *str;
8985 
8986 			switch (mnr->mnr_ip6_icmp6_type) {
8987 			case ND_ROUTER_ADVERT:
8988 				str = "ROUTER ADVERT";
8989 				break;
8990 			case ND_ROUTER_SOLICIT:
8991 				str = "ROUTER SOLICIT";
8992 				break;
8993 			case ND_NEIGHBOR_ADVERT:
8994 				str = "NEIGHBOR ADVERT";
8995 				break;
8996 			case ND_NEIGHBOR_SOLICIT:
8997 				str = "NEIGHBOR SOLICIT";
8998 				break;
8999 			default:
9000 				str = "";
9001 				break;
9002 			}
9003 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
9004 			    "%s %s %s ip6len %d icmp6len %d lladdr offset %d",
9005 			    sc->sc_if_xname, bif->bif_ifp->if_xname, str,
9006 			    mnr->mnr_ip6_header_len,
9007 			    mnr->mnr_ip6_icmp6_len, mnr->mnr_ip6_lladdr_offset);
9008 		}
9009 	}
9010 }
9011 
9012 static struct mac_nat_entry *
9013 bridge_mac_nat_ipv6_input(struct bridge_softc *sc, mbuf_t *data)
9014 {
9015 	struct in6_addr         dst;
9016 	uint8_t                 *header;
9017 	struct ether_header     *eh;
9018 	struct ip6_hdr          *ip6h;
9019 	struct mac_nat_entry    *mne = NULL;
9020 
9021 	header = get_ether_ipv6_header_ptr(data, 0, FALSE);
9022 	if (header == NULL) {
9023 		goto done;
9024 	}
9025 	eh = (struct ether_header *)header;
9026 	ip6h = (struct ip6_hdr *)(header + sizeof(*eh));
9027 	bcopy(&ip6h->ip6_dst, &dst, sizeof(dst));
9028 	/* XXX validate IPv6 address */
9029 	if (IN6_IS_ADDR_UNSPECIFIED(&dst)) {
9030 		goto done;
9031 	}
9032 	mne = bridge_lookup_mac_nat_entry_ipv6(sc, &dst);
9033 
9034 done:
9035 	return mne;
9036 }
9037 
9038 static boolean_t
9039 bridge_mac_nat_ipv6_output(struct bridge_softc *sc,
9040     struct bridge_iflist *bif, mbuf_t *data, struct mac_nat_record *mnr)
9041 {
9042 	uint8_t                 *header;
9043 	struct ether_header     *eh;
9044 	ether_addr_t            ether_shost;
9045 	struct ip6_hdr          *ip6h;
9046 	struct in6_addr         saddr;
9047 	boolean_t               translate;
9048 
9049 	translate = (bif == sc->sc_mac_nat_bif) ? FALSE : TRUE;
9050 	header = get_ether_ipv6_header_ptr(data, 0, TRUE);
9051 	if (header == NULL) {
9052 		translate = FALSE;
9053 		goto done;
9054 	}
9055 	eh = (struct ether_header *)header;
9056 	bcopy(eh->ether_shost, &ether_shost, sizeof(ether_shost));
9057 	ip6h = (struct ip6_hdr *)(header + sizeof(*eh));
9058 	bcopy(&ip6h->ip6_src, &saddr, sizeof(saddr));
9059 	if (mnr != NULL && ip6h->ip6_nxt == IPPROTO_ICMPV6) {
9060 		bridge_mac_nat_icmpv6_output(sc, bif, data, ip6h, &saddr, mnr);
9061 	}
9062 	if (IN6_IS_ADDR_UNSPECIFIED(&saddr)) {
9063 		goto done;
9064 	}
9065 	(void)bridge_update_mac_nat_entry_ipv6(sc, bif, &saddr,
9066 	    (const char *)ether_shost.octet);
9067 
9068 done:
9069 	return translate;
9070 }
9071 
9072 /*
9073  * Function: bridge_mac_nat_input:
9074  *
9075  * Purpose:
9076  *   Process a unicast packet arriving on the external interface `external_ifp`.
9077  *
9078  *   If the packet is ARP, IPv4, or IPv6, lookup the address from the packet in
9079  *   the mac_nat_entry table. If an entry is found, and the interface is
9080  *   not `external_ifp`, replace the destination MAC address in the
9081  *   ethernet header with the corresponding internal MAC address, and return
9082  *   the interface via `*dst_if`.
9083  *
9084  * Returns:
9085  *   NULL if the packet was deallocated during processing.
9086  *
9087  *   Otherwise, returns non-NULL packet that should:
9088  *   1) if `*dst_if` is NULL, continue on as an input packet
9089  *      over `external_ifp`, OR
9090  *   2) if `*dst_if` is not NULL, be delivered as an output packet
9091  *      over `*dst_if`.
9092  */
9093 static mbuf_t
9094 bridge_mac_nat_input(struct bridge_softc *sc, ifnet_t external_ifp,
9095     mbuf_t m, ifnet_t * dst_if)
9096 {
9097 	struct ether_header     *eh;
9098 	mbuf_t                  m0 = m;
9099 	struct mac_nat_entry    *mne = NULL;
9100 
9101 	BRIDGE_LOCK_ASSERT_HELD(sc);
9102 	*dst_if = NULL;
9103 	eh = mtod(m, struct ether_header *);
9104 	switch (eh->ether_type) {
9105 	case HTONS_ETHERTYPE_ARP:
9106 		mne = bridge_mac_nat_arp_input(sc, &m);
9107 		break;
9108 	case HTONS_ETHERTYPE_IP:
9109 		mne = bridge_mac_nat_ip_input(sc, &m);
9110 		break;
9111 	case HTONS_ETHERTYPE_IPV6:
9112 		mne = bridge_mac_nat_ipv6_input(sc, &m);
9113 		break;
9114 	default:
9115 		break;
9116 	}
9117 	if (m != NULL & mne != NULL) {
9118 		*dst_if = mne->mne_bif->bif_ifp;
9119 		if (*dst_if == external_ifp) {
9120 			/* receive packet for ifp */
9121 			*dst_if = NULL;
9122 		} else {
9123 			/* replace the destination MAC with internal one */
9124 			if (m != m0) {
9125 				/* it may have changed */
9126 				eh = mtod(m, struct ether_header *);
9127 			}
9128 			bcopy(mne->mne_mac, eh->ether_dhost,
9129 			    sizeof(eh->ether_dhost));
9130 		}
9131 	}
9132 	return m;
9133 }
9134 
9135 
9136 static mblist
9137 bridge_mac_nat_input_list(struct bridge_softc *sc, ifnet_t external_ifp,
9138     mbuf_t m, mbuf_t * forward_head)
9139 {
9140 	mblist          forward;
9141 	mbuf_t          next_packet;
9142 	mblist          ret;
9143 
9144 	mblist_init(&ret);
9145 	mblist_init(&forward);
9146 	for (mbuf_t scan = m; scan != NULL; scan = next_packet) {
9147 		ifnet_ref_t     dst_if;
9148 
9149 		/* take packet out of the list */
9150 		next_packet = scan->m_nextpkt;
9151 		scan->m_nextpkt = NULL;
9152 
9153 		scan = bridge_mac_nat_input(sc, external_ifp, scan, &dst_if);
9154 		if (scan != NULL) {
9155 			if (dst_if != NULL) {
9156 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
9157 				    "%s MAC-NAT input translate to %s",
9158 				    sc->sc_if_xname, dst_if->if_xname);
9159 				/* use rcvif to store the egress interface */
9160 				mbuf_pkthdr_setrcvif(scan, dst_if);
9161 				/* add it to the forwarding list */
9162 				mblist_append(&forward, scan);
9163 			} else {
9164 				/* add it to the "continue on as input" list */
9165 				BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
9166 				    "%s MAC-NAT input for %s",
9167 				    sc->sc_if_xname,
9168 				    external_ifp->if_xname);
9169 				mblist_append(&ret, scan);
9170 			}
9171 		}
9172 	}
9173 	*forward_head = forward.head;
9174 	return ret;
9175 }
9176 
9177 /*
9178  * bridge_mac_nat_translate_list:
9179  * Process a list of packets destined to the MAC-NAT interface `dst_if`
9180  * from the bridge member `sbif`.
9181  *
9182  * For each packet in the list, update the MAC-NAT record, and if
9183  * translation is required, translate it.
9184  *
9185  * Returns the list of packets that should be delivered to the MAC-NAT
9186  * interface.
9187  */
9188 static mbuf_t
9189 bridge_mac_nat_translate_list(struct bridge_softc * sc,
9190     struct bridge_iflist *sbif, ifnet_t dst_if, mbuf_t m)
9191 {
9192 	mbuf_t          next_packet;
9193 	mblist          ret;
9194 
9195 	mblist_init(&ret);
9196 	for (mbuf_ref_t scan = m; scan != NULL; scan = next_packet) {
9197 		struct mac_nat_record   mnr;
9198 		bool                    translate_mac;
9199 
9200 		/* take packet out of the list */
9201 		next_packet = scan->m_nextpkt;
9202 		scan->m_nextpkt = NULL;
9203 		translate_mac = bridge_mac_nat_output(sc, sbif, &scan, &mnr);
9204 		if (scan != NULL) {
9205 			if (translate_mac) {
9206 				bridge_mac_nat_translate(&scan, &mnr,
9207 				    IF_LLADDR(dst_if));
9208 			}
9209 			if (scan != NULL) {
9210 				/* add it back to the list */
9211 				mblist_append(&ret, scan);
9212 			}
9213 		}
9214 	}
9215 	return ret.head;
9216 }
9217 
9218 /*
9219  * bridge_mac_nat_copy_and_translate_list:
9220  * Same as bridge_mac_nat_translate_list() except that a copy of the
9221  * packet list is returned instead.
9222  *
9223  * The packet list `m` is left unaltered.
9224  */
9225 static mbuf_t
9226 bridge_mac_nat_copy_and_translate_list(struct bridge_softc * sc,
9227     struct bridge_iflist *sbif, ifnet_t dst_if, mbuf_t m)
9228 {
9229 	mbuf_t          next_packet;
9230 	mblist          ret;
9231 
9232 	mblist_init(&ret);
9233 	for (mbuf_t scan = m; scan != NULL; scan = next_packet) {
9234 		mbuf_ref_t              mc = NULL;
9235 		struct mac_nat_record   mnr;
9236 		bool                    translate_mac;
9237 
9238 		/* take packet out of the list, make a copy, put it back */
9239 		next_packet = scan->m_nextpkt;
9240 		scan->m_nextpkt = NULL;
9241 		mc = m_dup(scan, M_DONTWAIT);
9242 		scan->m_nextpkt = next_packet;
9243 		if (mc == NULL) {
9244 			continue;
9245 		}
9246 		translate_mac = bridge_mac_nat_output(sc, sbif, &mc, &mnr);
9247 		if (mc != NULL) {
9248 			if (translate_mac) {
9249 				bridge_mac_nat_translate(&mc, &mnr,
9250 				    IF_LLADDR(dst_if));
9251 			}
9252 			if (mc != NULL) {
9253 				/* add it to the new list */
9254 				mblist_append(&ret, mc);
9255 			}
9256 		}
9257 	}
9258 	return ret.head;
9259 }
9260 
9261 static void
9262 bridge_mac_nat_forward_list(ifnet_t bridge_ifp, ether_type_flag_t etypef,
9263     mbuf_t m)
9264 {
9265 	int             count = 0;
9266 	ifnet_t         dst_if;
9267 	mblist          list;
9268 	int             n_lists = 0;
9269 	mbuf_t          next_packet;
9270 
9271 	mblist_init(&list);
9272 	for (mbuf_t scan = m; scan != NULL; scan = next_packet) {
9273 		ifnet_t         this_if;
9274 
9275 		next_packet = scan->m_nextpkt;
9276 		this_if = mbuf_pkthdr_rcvif(scan);
9277 		mbuf_pkthdr_setrcvif(scan, NULL);
9278 		if (list.head == NULL) {
9279 			/* start a new list */
9280 			list.head = list.tail = scan;
9281 			count = 1;
9282 			dst_if = this_if;
9283 		} else if (dst_if != this_if) {
9284 			/* send up the previous chain */
9285 			if (list.tail != NULL) {
9286 				/* terminate the list */
9287 				list.tail->m_nextpkt = NULL;
9288 			}
9289 			n_lists++;
9290 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
9291 			    "(%s): sublist %u pkts %u",
9292 			    dst_if->if_xname, n_lists, count);
9293 			bridge_enqueue_multi(bridge_ifp, NULL,
9294 			    dst_if, etypef, list.head,
9295 			    CHECKSUM_OPERATION_CLEAR_OFFLOAD);
9296 
9297 			/* start new list */
9298 			list.head = list.tail = scan;
9299 			count = 1;
9300 			dst_if = this_if;
9301 		} else {
9302 			count++;
9303 			list.tail = scan;
9304 		}
9305 		if (next_packet == NULL) {
9306 			/* last list */
9307 			n_lists++;
9308 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MAC_NAT,
9309 			    "(%s): sublist %u pkts %u",
9310 			    dst_if->if_xname, n_lists, count);
9311 			bridge_enqueue_multi(bridge_ifp, NULL,
9312 			    dst_if, etypef, list.head,
9313 			    CHECKSUM_OPERATION_CLEAR_OFFLOAD);
9314 		}
9315 	}
9316 	return;
9317 }
9318 
9319 /*
9320  * bridge_mac_nat_output:
9321  * Process a packet destined to the MAC NAT interface (sc_mac_nat_bif)
9322  * from the interface 'bif'.
9323  *
9324  * Create a mac_nat_entry containing the source IP address and MAC address
9325  * from the packet. Populate a mac_nat_record with information detailing
9326  * how to translate the packet. Translation takes place later by calling
9327  * `bridge_mac_nat_translate()`.
9328  *
9329  * If 'bif' == sc_mac_nat_bif, the stack over the MAC NAT
9330  * interface is generating an output packet. No translation is required in this
9331  * case, we just record the IP address used to prevent another bif from
9332  * claiming our IP address.
9333  *
9334  * Returns:
9335  * TRUE if the packet should be translated (*mnr updated as well),
9336  * FALSE otherwise.
9337  *
9338  * *data may be updated to point at a different mbuf chain or NULL if
9339  * the chain was deallocated during processing.
9340  */
9341 
9342 static boolean_t
9343 bridge_mac_nat_output(struct bridge_softc *sc,
9344     struct bridge_iflist *bif, mbuf_t *data, struct mac_nat_record *mnr)
9345 {
9346 	struct ether_header     *eh;
9347 	boolean_t               translate = FALSE;
9348 
9349 	BRIDGE_LOCK_ASSERT_HELD(sc);
9350 	assert(sc->sc_mac_nat_bif != NULL);
9351 
9352 	eh = mtod(*data, struct ether_header *);
9353 	if (mnr != NULL) {
9354 		bzero(mnr, sizeof(*mnr));
9355 		mnr->mnr_ether_type = eh->ether_type;
9356 	}
9357 	switch (eh->ether_type) {
9358 	case HTONS_ETHERTYPE_ARP:
9359 		translate = bridge_mac_nat_arp_output(sc, bif, data, mnr);
9360 		break;
9361 	case HTONS_ETHERTYPE_IP:
9362 		translate = bridge_mac_nat_ip_output(sc, bif, data, mnr);
9363 		break;
9364 	case HTONS_ETHERTYPE_IPV6:
9365 		translate = bridge_mac_nat_ipv6_output(sc, bif, data, mnr);
9366 		break;
9367 	default:
9368 		break;
9369 	}
9370 	return translate;
9371 }
9372 
9373 static void
9374 bridge_mac_nat_arp_translate(mbuf_t *data, struct mac_nat_record *mnr,
9375     const char eaddr[ETHER_ADDR_LEN])
9376 {
9377 	errno_t                 error;
9378 
9379 	if (mnr->mnr_arp_offset == 0) {
9380 		return;
9381 	}
9382 	/* replace the source hardware address */
9383 	error = mbuf_copyback(*data, mnr->mnr_arp_offset,
9384 	    ETHER_ADDR_LEN, eaddr,
9385 	    MBUF_DONTWAIT);
9386 	if (error != 0) {
9387 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9388 		    "mbuf_copyback failed");
9389 		m_freem(*data);
9390 		*data = NULL;
9391 	}
9392 	return;
9393 }
9394 
9395 static void
9396 bridge_mac_nat_ip_translate(mbuf_t *data, struct mac_nat_record *mnr)
9397 {
9398 	errno_t         error;
9399 	size_t          offset;
9400 
9401 	if (mnr->mnr_ip_header_len == 0) {
9402 		return;
9403 	}
9404 	/* update the UDP checksum */
9405 	offset = sizeof(struct ether_header) + mnr->mnr_ip_header_len;
9406 	error = mbuf_copyback(*data, offset + offsetof(struct udphdr, uh_sum),
9407 	    sizeof(mnr->mnr_ip_udp_csum),
9408 	    &mnr->mnr_ip_udp_csum,
9409 	    MBUF_DONTWAIT);
9410 	if (error != 0) {
9411 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9412 		    "mbuf_copyback uh_sum failed");
9413 		m_freem(*data);
9414 		*data = NULL;
9415 	}
9416 	/* update the DHCP must broadcast flag */
9417 	offset += sizeof(struct udphdr);
9418 	error = mbuf_copyback(*data, offset + offsetof(struct dhcp, dp_flags),
9419 	    sizeof(mnr->mnr_ip_dhcp_flags),
9420 	    &mnr->mnr_ip_dhcp_flags,
9421 	    MBUF_DONTWAIT);
9422 	if (error != 0) {
9423 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9424 		    "mbuf_copyback dp_flags failed");
9425 		m_freem(*data);
9426 		*data = NULL;
9427 	}
9428 }
9429 
9430 static void
9431 bridge_mac_nat_ipv6_translate(mbuf_t *data, struct mac_nat_record *mnr,
9432     const char eaddr[ETHER_ADDR_LEN])
9433 {
9434 	uint16_t        cksum;
9435 	errno_t         error;
9436 	mbuf_t          m = *data;
9437 
9438 	if (mnr->mnr_ip6_header_len == 0) {
9439 		return;
9440 	}
9441 	switch (mnr->mnr_ip6_icmp6_type) {
9442 	case ND_ROUTER_ADVERT:
9443 	case ND_ROUTER_SOLICIT:
9444 	case ND_NEIGHBOR_SOLICIT:
9445 	case ND_NEIGHBOR_ADVERT:
9446 		if (mnr->mnr_ip6_lladdr_offset == 0) {
9447 			/* nothing to do */
9448 			return;
9449 		}
9450 		break;
9451 	default:
9452 		return;
9453 	}
9454 
9455 	/*
9456 	 * replace the lladdr
9457 	 */
9458 	error = mbuf_copyback(m, mnr->mnr_ip6_lladdr_offset,
9459 	    ETHER_ADDR_LEN, eaddr,
9460 	    MBUF_DONTWAIT);
9461 	if (error != 0) {
9462 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9463 		    "mbuf_copyback lladdr failed");
9464 		m_freem(m);
9465 		*data = NULL;
9466 		return;
9467 	}
9468 
9469 	/*
9470 	 * recompute the icmp6 checksum
9471 	 */
9472 
9473 	/* skip past the ethernet header */
9474 	_mbuf_adjust_pkthdr_and_data(m, ETHER_HDR_LEN);
9475 
9476 #define CKSUM_OFFSET_ICMP6      offsetof(struct icmp6_hdr, icmp6_cksum)
9477 	/* set the checksum to zero */
9478 	cksum = 0;
9479 	error = mbuf_copyback(m, mnr->mnr_ip6_header_len + CKSUM_OFFSET_ICMP6,
9480 	    sizeof(cksum), &cksum, MBUF_DONTWAIT);
9481 	if (error != 0) {
9482 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9483 		    "mbuf_copyback cksum=0 failed");
9484 		m_freem(m);
9485 		*data = NULL;
9486 		return;
9487 	}
9488 	/* compute and set the new checksum */
9489 	cksum = in6_cksum(m, IPPROTO_ICMPV6, mnr->mnr_ip6_header_len,
9490 	    mnr->mnr_ip6_icmp6_len);
9491 	error = mbuf_copyback(m, mnr->mnr_ip6_header_len + CKSUM_OFFSET_ICMP6,
9492 	    sizeof(cksum), &cksum, MBUF_DONTWAIT);
9493 	if (error != 0) {
9494 		BRIDGE_LOG(LOG_NOTICE, BR_DBGF_MAC_NAT,
9495 		    "mbuf_copyback cksum failed");
9496 		m_freem(m);
9497 		*data = NULL;
9498 		return;
9499 	}
9500 	/* restore the ethernet header */
9501 	_mbuf_adjust_pkthdr_and_data(m, -ETHER_HDR_LEN);
9502 	return;
9503 }
9504 
9505 static void
9506 bridge_mac_nat_translate(mbuf_t *data, struct mac_nat_record *mnr,
9507     const char eaddr[ETHER_ADDR_LEN])
9508 {
9509 	struct ether_header     *eh;
9510 
9511 	/* replace the source ethernet address with the single MAC */
9512 	eh = mtod(*data, struct ether_header *);
9513 	bcopy(eaddr, eh->ether_shost, sizeof(eh->ether_shost));
9514 	switch (mnr->mnr_ether_type) {
9515 	case HTONS_ETHERTYPE_ARP:
9516 		bridge_mac_nat_arp_translate(data, mnr, eaddr);
9517 		break;
9518 
9519 	case HTONS_ETHERTYPE_IP:
9520 		bridge_mac_nat_ip_translate(data, mnr);
9521 		break;
9522 
9523 	case HTONS_ETHERTYPE_IPV6:
9524 		bridge_mac_nat_ipv6_translate(data, mnr, eaddr);
9525 		break;
9526 
9527 	default:
9528 		break;
9529 	}
9530 	return;
9531 }
9532 
9533 /*
9534  * bridge packet filtering
9535  */
9536 
9537 /*
9538  * Perform basic checks on header size since
9539  * pfil assumes ip_input has already processed
9540  * it for it.  Cut-and-pasted from ip_input.c.
9541  * Given how simple the IPv6 version is,
9542  * does the IPv4 version really need to be
9543  * this complicated?
9544  *
9545  * XXX Should we update ipstat here, or not?
9546  * XXX Right now we update ipstat but not
9547  * XXX csum_counter.
9548  */
9549 static int
9550 bridge_ip_checkbasic(struct mbuf **mp)
9551 {
9552 	struct mbuf *m = *mp;
9553 	struct ip *ip;
9554 	int len, hlen;
9555 	u_short sum;
9556 
9557 	if (*mp == NULL) {
9558 		return -1;
9559 	}
9560 
9561 	if (IP_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
9562 		/* max_linkhdr is already rounded up to nearest 4-byte */
9563 		if ((m = m_copyup(m, sizeof(struct ip),
9564 		    max_linkhdr)) == NULL) {
9565 			/* XXXJRT new stat, please */
9566 			ipstat.ips_toosmall++;
9567 			goto bad;
9568 		}
9569 	} else if (OS_EXPECT((size_t)m->m_len < sizeof(struct ip), 0)) {
9570 		if ((m = m_pullup(m, sizeof(struct ip))) == NULL) {
9571 			ipstat.ips_toosmall++;
9572 			goto bad;
9573 		}
9574 	}
9575 	ip = mtod(m, struct ip *);
9576 	if (ip == NULL) {
9577 		goto bad;
9578 	}
9579 
9580 	if (IP_VHL_V(ip->ip_vhl) != IPVERSION) {
9581 		ipstat.ips_badvers++;
9582 		goto bad;
9583 	}
9584 	hlen = IP_VHL_HL(ip->ip_vhl) << 2;
9585 	if (hlen < (int)sizeof(struct ip)) {  /* minimum header length */
9586 		ipstat.ips_badhlen++;
9587 		goto bad;
9588 	}
9589 	if (hlen > m->m_len) {
9590 		if ((m = m_pullup(m, hlen)) == 0) {
9591 			ipstat.ips_badhlen++;
9592 			goto bad;
9593 		}
9594 		ip = mtod(m, struct ip *);
9595 		if (ip == NULL) {
9596 			goto bad;
9597 		}
9598 	}
9599 
9600 	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED) {
9601 		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
9602 	} else {
9603 		if (hlen == sizeof(struct ip)) {
9604 			sum = in_cksum_hdr(ip);
9605 		} else {
9606 			sum = in_cksum(m, hlen);
9607 		}
9608 	}
9609 	if (sum) {
9610 		ipstat.ips_badsum++;
9611 		goto bad;
9612 	}
9613 
9614 	/* Retrieve the packet length. */
9615 	len = ntohs(ip->ip_len);
9616 
9617 	/*
9618 	 * Check for additional length bogosity
9619 	 */
9620 	if (len < hlen) {
9621 		ipstat.ips_badlen++;
9622 		goto bad;
9623 	}
9624 
9625 	/*
9626 	 * Check that the amount of data in the buffers
9627 	 * is as at least much as the IP header would have us expect.
9628 	 * Drop packet if shorter than we expect.
9629 	 */
9630 	if (m->m_pkthdr.len < len) {
9631 		ipstat.ips_tooshort++;
9632 		goto bad;
9633 	}
9634 
9635 	/* Checks out, proceed */
9636 	*mp = m;
9637 	return 0;
9638 
9639 bad:
9640 	*mp = m;
9641 	return -1;
9642 }
9643 
9644 /*
9645  * Same as above, but for IPv6.
9646  * Cut-and-pasted from ip6_input.c.
9647  * XXX Should we update ip6stat, or not?
9648  */
9649 static int
9650 bridge_ip6_checkbasic(struct mbuf **mp)
9651 {
9652 	struct mbuf *m = *mp;
9653 	struct ip6_hdr *ip6;
9654 
9655 	/*
9656 	 * If the IPv6 header is not aligned, slurp it up into a new
9657 	 * mbuf with space for link headers, in the event we forward
9658 	 * it.  Otherwise, if it is aligned, make sure the entire base
9659 	 * IPv6 header is in the first mbuf of the chain.
9660 	 */
9661 	if (IP6_HDR_ALIGNED_P(mtod(m, caddr_t)) == 0) {
9662 		struct ifnet *inifp = m->m_pkthdr.rcvif;
9663 		/* max_linkhdr is already rounded up to nearest 4-byte */
9664 		if ((m = m_copyup(m, sizeof(struct ip6_hdr),
9665 		    max_linkhdr)) == NULL) {
9666 			/* XXXJRT new stat, please */
9667 			ip6stat.ip6s_toosmall++;
9668 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
9669 			goto bad;
9670 		}
9671 	} else if (OS_EXPECT((size_t)m->m_len < sizeof(struct ip6_hdr), 0)) {
9672 		struct ifnet *inifp = m->m_pkthdr.rcvif;
9673 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
9674 			ip6stat.ip6s_toosmall++;
9675 			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
9676 			goto bad;
9677 		}
9678 	}
9679 
9680 	ip6 = mtod(m, struct ip6_hdr *);
9681 
9682 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
9683 		ip6stat.ip6s_badvers++;
9684 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
9685 		goto bad;
9686 	}
9687 
9688 	/* Checks out, proceed */
9689 	*mp = m;
9690 	return 0;
9691 
9692 bad:
9693 	*mp = m;
9694 	return -1;
9695 }
9696 
9697 /*
9698  * the PF routines expect to be called from ip_input, so we
9699  * need to do and undo here some of the same processing.
9700  *
9701  * XXX : this is heavily inspired on bridge_pfil()
9702  */
9703 static int
9704 bridge_pf(struct mbuf **mp, struct ifnet *ifp, uint32_t sc_filter_flags,
9705     bool input)
9706 {
9707 	/*
9708 	 * XXX : mpetit : heavily inspired by bridge_pfil()
9709 	 */
9710 
9711 	int snap, error, i, hlen;
9712 	struct ether_header *eh1, eh2;
9713 	struct ip *ip;
9714 	struct llc llc1;
9715 	u_int16_t ether_type;
9716 
9717 	snap = 0;
9718 	error = -1;     /* Default error if not error == 0 */
9719 
9720 	if ((sc_filter_flags & IFBF_FILT_MEMBER) == 0) {
9721 		return 0; /* filtering is disabled */
9722 	}
9723 	i = min((*mp)->m_pkthdr.len, max_protohdr);
9724 	if ((*mp)->m_len < i) {
9725 		*mp = m_pullup(*mp, i);
9726 		if (*mp == NULL) {
9727 			BRIDGE_LOG(LOG_NOTICE, 0, "m_pullup failed");
9728 			return -1;
9729 		}
9730 	}
9731 
9732 	eh1 = mtod(*mp, struct ether_header *);
9733 	ether_type = ntohs(eh1->ether_type);
9734 
9735 	/*
9736 	 * Check for SNAP/LLC.
9737 	 */
9738 	if (ether_type < ETHERMTU) {
9739 		struct llc *llc2 = (struct llc *)(eh1 + 1);
9740 
9741 		if ((*mp)->m_len >= ETHER_HDR_LEN + 8 &&
9742 		    llc2->llc_dsap == LLC_SNAP_LSAP &&
9743 		    llc2->llc_ssap == LLC_SNAP_LSAP &&
9744 		    llc2->llc_control == LLC_UI) {
9745 			ether_type = htons(llc2->llc_un.type_snap.ether_type);
9746 			snap = 1;
9747 		}
9748 	}
9749 
9750 	/*
9751 	 * If we're trying to filter bridge traffic, don't look at anything
9752 	 * other than IP and ARP traffic.  If the filter doesn't understand
9753 	 * IPv6, don't allow IPv6 through the bridge either.  This is lame
9754 	 * since if we really wanted, say, an AppleTalk filter, we are hosed,
9755 	 * but of course we don't have an AppleTalk filter to begin with.
9756 	 * (Note that since pfil doesn't understand ARP it will pass *ALL*
9757 	 * ARP traffic.)
9758 	 */
9759 	switch (ether_type) {
9760 	case ETHERTYPE_ARP:
9761 	case ETHERTYPE_REVARP:
9762 		return 0;         /* Automatically pass */
9763 
9764 	case ETHERTYPE_IP:
9765 	case ETHERTYPE_IPV6:
9766 		break;
9767 	default:
9768 		/*
9769 		 * Check to see if the user wants to pass non-ip
9770 		 * packets, these will not be checked by pf and
9771 		 * passed unconditionally so the default is to drop.
9772 		 */
9773 		if ((sc_filter_flags & IFBF_FILT_ONLYIP)) {
9774 			goto bad;
9775 		}
9776 		break;
9777 	}
9778 
9779 	/* Strip off the Ethernet header and keep a copy. */
9780 	m_copydata(*mp, 0, ETHER_HDR_LEN, (caddr_t)&eh2);
9781 	m_adj(*mp, ETHER_HDR_LEN);
9782 
9783 	/* Strip off snap header, if present */
9784 	if (snap) {
9785 		m_copydata(*mp, 0, sizeof(struct llc), (caddr_t)&llc1);
9786 		m_adj(*mp, sizeof(struct llc));
9787 	}
9788 
9789 	/*
9790 	 * Check the IP header for alignment and errors
9791 	 */
9792 	switch (ether_type) {
9793 	case ETHERTYPE_IP:
9794 		error = bridge_ip_checkbasic(mp);
9795 		break;
9796 	case ETHERTYPE_IPV6:
9797 		error = bridge_ip6_checkbasic(mp);
9798 		break;
9799 	default:
9800 		error = 0;
9801 		break;
9802 	}
9803 	if (error) {
9804 		goto bad;
9805 	}
9806 
9807 	error = 0;
9808 
9809 	/*
9810 	 * Run the packet through pf rules
9811 	 */
9812 	switch (ether_type) {
9813 	case ETHERTYPE_IP:
9814 		/*
9815 		 * before calling the firewall, swap fields the same as
9816 		 * IP does. here we assume the header is contiguous
9817 		 */
9818 		ip = mtod(*mp, struct ip *);
9819 
9820 		ip->ip_len = ntohs(ip->ip_len);
9821 		ip->ip_off = ntohs(ip->ip_off);
9822 
9823 		if (ifp != NULL) {
9824 			error = pf_af_hook(ifp, 0, mp, AF_INET, input, NULL);
9825 		}
9826 
9827 		if (*mp == NULL || error != 0) { /* filter may consume */
9828 			break;
9829 		}
9830 
9831 		/* Recalculate the ip checksum and restore byte ordering */
9832 		ip = mtod(*mp, struct ip *);
9833 		hlen = IP_VHL_HL(ip->ip_vhl) << 2;
9834 		if (hlen < (int)sizeof(struct ip)) {
9835 			goto bad;
9836 		}
9837 		if (hlen > (*mp)->m_len) {
9838 			if ((*mp = m_pullup(*mp, hlen)) == 0) {
9839 				goto bad;
9840 			}
9841 			ip = mtod(*mp, struct ip *);
9842 			if (ip == NULL) {
9843 				goto bad;
9844 			}
9845 		}
9846 		ip->ip_len = htons(ip->ip_len);
9847 		ip->ip_off = htons(ip->ip_off);
9848 		ip->ip_sum = 0;
9849 		if (hlen == sizeof(struct ip)) {
9850 			ip->ip_sum = in_cksum_hdr(ip);
9851 		} else {
9852 			ip->ip_sum = in_cksum(*mp, hlen);
9853 		}
9854 		break;
9855 
9856 	case ETHERTYPE_IPV6:
9857 		if (ifp != NULL) {
9858 			error = pf_af_hook(ifp, 0, mp, AF_INET6, input, NULL);
9859 		}
9860 
9861 		if (*mp == NULL || error != 0) { /* filter may consume */
9862 			break;
9863 		}
9864 		break;
9865 	default:
9866 		error = 0;
9867 		break;
9868 	}
9869 
9870 	if (*mp == NULL) {
9871 		return error;
9872 	}
9873 	if (error != 0) {
9874 		goto bad;
9875 	}
9876 
9877 	error = -1;
9878 
9879 	/*
9880 	 * Finally, put everything back the way it was and return
9881 	 */
9882 	if (snap) {
9883 		M_PREPEND(*mp, sizeof(struct llc), M_DONTWAIT, 0);
9884 		if (*mp == NULL) {
9885 			return error;
9886 		}
9887 		bcopy(&llc1, mtod(*mp, caddr_t), sizeof(struct llc));
9888 	}
9889 
9890 	M_PREPEND(*mp, ETHER_HDR_LEN, M_DONTWAIT, 0);
9891 	if (*mp == NULL) {
9892 		return error;
9893 	}
9894 	bcopy(&eh2, mtod(*mp, caddr_t), ETHER_HDR_LEN);
9895 
9896 	return 0;
9897 
9898 bad:
9899 	m_freem(*mp);
9900 	*mp = NULL;
9901 	return error;
9902 }
9903 
9904 #if BRIDGESTP
9905 static void
9906 bridge_bstp_input_list(struct bstp_port *bp, struct mbuf *head)
9907 {
9908 	mbuf_t  next_packet = NULL;
9909 
9910 	for (mbuf_t scan = head; scan != NULL; scan = next_packet) {
9911 		next_packet = scan->m_nextpkt;
9912 		scan->m_nextpkt = NULL;
9913 		bstp_input(bp, scan);
9914 	}
9915 }
9916 #endif /* BRIDGESTP */
9917 
9918 static mblist
9919 bridge_filter_arp_list(struct bridge_iflist * bif, mbuf_t m)
9920 {
9921 	mbuf_t          next_packet = NULL;
9922 	mblist          ret;
9923 
9924 	mblist_init(&ret);
9925 	for (mbuf_ref_t scan = m; scan != NULL; scan = next_packet) {
9926 		errno_t                 error;
9927 
9928 		/* take packet out of the list */
9929 		next_packet = scan->m_nextpkt;
9930 		scan->m_nextpkt = NULL;
9931 		/* filter the ARP packet */
9932 		error = bridge_host_filter_arp(bif, &scan);
9933 		if (error != 0 && scan != NULL) {
9934 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_HOSTFILTER)) {
9935 				brlog_mbuf_data(scan, 0,
9936 				    sizeof(struct ether_header) +
9937 				    sizeof(struct ip));
9938 			}
9939 			m_freem(scan);
9940 			scan = NULL;
9941 		}
9942 		if (scan != NULL) {
9943 			/* add it to the list */
9944 			mblist_append(&ret, scan);
9945 		}
9946 	}
9947 	return ret;
9948 }
9949 
9950 static mbuf_t
9951 bridge_filter_checksum(ifnet_t bridge_ifp, struct bridge_iflist * bif, mbuf_t m,
9952     bool is_ipv4, bool host_filter, bool checksum)
9953 {
9954 	uint32_t                dbgf = 0;
9955 	errno_t                 error;
9956 	ip_packet_info          info;
9957 	u_int                   mac_hlen = sizeof(struct ether_header);
9958 
9959 	if (host_filter) {
9960 		dbgf |= BR_DBGF_HOSTFILTER;
9961 	}
9962 	if (checksum) {
9963 		dbgf |= BR_DBGF_CHECKSUM;
9964 	}
9965 
9966 	/* get the IP protocol header */
9967 	error = bridge_get_ip_proto(&m, mac_hlen, is_ipv4, &info,
9968 	    &bif->bif_stats.brms_in_ip);
9969 	if (error != 0) {
9970 		BRIDGE_LOG(LOG_NOTICE, dbgf,
9971 		    "%s(%s) bridge_get_ip_proto failed %d",
9972 		    bridge_ifp->if_xname,
9973 		    bif->bif_ifp->if_xname, error);
9974 		goto drop;
9975 	}
9976 	if (host_filter) {
9977 		bool            drop = true;
9978 
9979 		/* restrict IP protocols */
9980 		switch (info.ip_proto) {
9981 		case IPPROTO_ICMP:
9982 		case IPPROTO_IGMP:
9983 			drop = !is_ipv4;
9984 			break;
9985 		case IPPROTO_TCP:
9986 		case IPPROTO_UDP:
9987 			drop = false;
9988 			break;
9989 		case IPPROTO_ICMPV6:
9990 			drop = is_ipv4;
9991 			break;
9992 		default:
9993 			break;
9994 		}
9995 		if (drop) {
9996 			BRIDGE_HF_DROP(brhf_ip_bad_proto, __func__, __LINE__);
9997 			goto drop;
9998 		}
9999 		bridge_hostfilter_stats.brhf_ip_ok += 1;
10000 	}
10001 	if (checksum) {
10002 		/* need to compute IP/UDP/TCP/checksums */
10003 		error = bridge_offload_checksum(&m, &info, &bif->bif_stats);
10004 		if (error != 0) {
10005 			BRIDGE_LOG(LOG_NOTICE, dbgf,
10006 			    "%s(%s) bridge_offload_checksum failed %d",
10007 			    bridge_ifp->if_xname,
10008 			    bif->bif_ifp->if_xname, error);
10009 			goto drop;
10010 		}
10011 	}
10012 	return m;
10013 
10014 drop:
10015 	/* toss the packet */
10016 	if (m != NULL) {
10017 		if (host_filter &&
10018 		    BRIDGE_DBGF_ENABLED(BR_DBGF_HOSTFILTER)) {
10019 			brlog_mbuf_data(m, 0,
10020 			    sizeof(struct ether_header) +
10021 			    sizeof(struct ip));
10022 		}
10023 		m_freem(m);
10024 		m = NULL;
10025 	}
10026 	return NULL;
10027 }
10028 
10029 static mblist
10030 bridge_filter_checksum_list(ifnet_t bridge_ifp, struct bridge_iflist * bif,
10031     mbuf_t in_list, ether_type_flag_t etypef, bool host_filter, bool checksum)
10032 {
10033 	bool                    is_ipv4 = (etypef == ETHER_TYPE_FLAG_IPV4);
10034 	mbuf_t                  next_packet = NULL;
10035 	mblist                  ret;
10036 
10037 	mblist_init(&ret);
10038 	for (mbuf_t scan = in_list; scan != NULL; scan = next_packet) {
10039 		/* take packet out of the list */
10040 		next_packet = scan->m_nextpkt;
10041 		scan->m_nextpkt = NULL;
10042 		scan = bridge_filter_checksum(bridge_ifp, bif,
10043 		    scan, is_ipv4, host_filter, checksum);
10044 		if (scan != NULL) {
10045 			/* add packet to the list */
10046 			mblist_append(&ret, scan);
10047 		}
10048 	}
10049 	return ret;
10050 }
10051 
10052 static mbuf_t
10053 copy_broadcast_packet(mbuf_t m)
10054 {
10055 	mbuf_t  mc;
10056 
10057 	/* make a copy of the packet */
10058 	mc = m_dup(m, M_DONTWAIT);
10059 	if (mc != NULL) {
10060 		struct ether_header *eh;
10061 
10062 		/* make copy look like it is broadcast */
10063 		mc->m_flags |= M_BCAST;
10064 		eh = mtod(mc, struct ether_header *);
10065 		bcopy(etherbroadcastaddr, eh->ether_dhost, ETHER_ADDR_LEN);
10066 	}
10067 	return mc;
10068 }
10069 
10070 static mblist
10071 bridge_find_broadcast_ipv4(mbuf_t in_list, mbuf_t * ip_bcast_head)
10072 {
10073 	mblist          ip_bcast;
10074 	mbuf_t          next_packet = NULL;
10075 	mblist          ret;
10076 
10077 	mblist_init(&ret);
10078 	mblist_init(&ip_bcast);
10079 	for (mbuf_ref_t scan = in_list; scan != NULL; scan = next_packet) {
10080 		mbuf_t  bcast_pkt = NULL;
10081 		uint8_t *header;
10082 
10083 		/* take packet out of the list */
10084 		next_packet = scan->m_nextpkt;
10085 		scan->m_nextpkt = NULL;
10086 
10087 		header = get_ether_ip_header_ptr(&scan, FALSE);
10088 		if (header != NULL) {
10089 			struct in_addr  dst;
10090 			struct ip       *iphdr;
10091 
10092 			iphdr = (struct ip *)(header + sizeof(struct ether_header));
10093 			bcopy(&iphdr->ip_dst, &dst, sizeof(dst));
10094 			if (dst.s_addr == INADDR_BROADCAST) {
10095 				bcast_pkt = copy_broadcast_packet(scan);
10096 			}
10097 		}
10098 		if (bcast_pkt != NULL) {
10099 			/* add packet to broadcast list */
10100 			mblist_append(&ip_bcast, bcast_pkt);
10101 		}
10102 		if (scan != NULL) {
10103 			/* add packet back into the list */
10104 			mblist_append(&ret, scan);
10105 		}
10106 	}
10107 	*ip_bcast_head = ip_bcast.head;
10108 	return ret;
10109 }
10110 
10111 static ifnet_t
10112 bridge_find_member(struct bridge_softc * sc, uint8_t * lladdr,
10113     struct bridge_iflist * sbif)
10114 {
10115 	struct bridge_iflist * bif;
10116 
10117 	TAILQ_FOREACH(bif, &sc->sc_iflist, bif_next) {
10118 		if (bif == sbif) {
10119 			/* skip the input member */
10120 			continue;
10121 		}
10122 		if (_ether_cmp(IF_LLADDR(bif->bif_ifp), lladdr) == 0) {
10123 			return bif->bif_ifp;
10124 		}
10125 	}
10126 	return NULL;
10127 }
10128 
10129 
10130 /*
10131  * Function: bridge_input_list
10132  *
10133  * Purpose:
10134  *   Process a list of input packets through the bridge.
10135  *   The caller ensures that all of the packets in the list
10136  *  `list_head` .. `list_tail` have the same ethernet header.
10137  *
10138  * Returns:
10139  *    Non-NULL head of the chain of packets that were not consumed/freed,
10140  *    *tail_p set to the tail of that chain.
10141  *
10142  *    NULL if all of the packets were consumed.
10143  */
10144 static mblist
10145 bridge_input_list(struct bridge_softc * sc, ifnet_t ifp,
10146     struct ether_header * eh_in_p, mblist list, bool is_promisc)
10147 {
10148 	struct bridge_iflist *  bif;
10149 	bool                    bridge_has_address;
10150 	ifnet_t                 bridge_ifp;
10151 	bool                    checksum_offload;
10152 	uint8_t *               dhost;
10153 #if BRIDGESTP
10154 	bool                    discarding = false;
10155 #endif /* BRIDGESTP */
10156 	ifnet_t                 dst_if = NULL;
10157 	errno_t                 error;
10158 	ether_type_flag_t       etypef;
10159 	bool                    host_filter;
10160 	bool                    host_filter_drop = false;
10161 	mbuf_ref_t              ip_bcast = NULL;
10162 	bool                    is_bridge_mac = false;
10163 	bool                    is_broadcast;
10164 	bool                    is_ifp_mac;
10165 	ifnet_t                 member_input = NULL;
10166 	uint8_t *               shost;
10167 	uint16_t                vlan;
10168 
10169 	if (ifp->if_bridge == NULL) {
10170 		/* no longer part of bridge */
10171 		goto done;
10172 	}
10173 	bridge_ifp = sc->sc_ifp;
10174 	is_broadcast = IS_BCAST_MCAST(list.head);
10175 	is_ifp_mac = (!is_broadcast && !is_promisc);
10176 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
10177 	    "%s from %s count %d head 0x%llx.0x%llx tail 0x%llx.0x%llx",
10178 	    bridge_ifp->if_xname, ifp->if_xname, list.count,
10179 	    (uint64_t)VM_KERNEL_ADDRPERM(list.head),
10180 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(list.head, void *)),
10181 	    (uint64_t)VM_KERNEL_ADDRPERM(list.tail),
10182 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(list.tail, void *)));
10183 
10184 	/* assume we'll return all packets */
10185 	if ((bridge_ifp->if_flags & IFF_RUNNING) == 0) {
10186 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
10187 		    "%s not running passing along",
10188 		    bridge_ifp->if_xname);
10189 		goto done;
10190 	}
10191 
10192 	vlan = VLANTAGOF(m);
10193 
10194 	/* lookup the bridge member */
10195 	BRIDGE_LOCK(sc);
10196 	bif = bridge_lookup_member_if(sc, ifp);
10197 	if (bif == NULL) {
10198 		BRIDGE_UNLOCK(sc);
10199 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
10200 		    "%s bridge_lookup_member_if failed",
10201 		    bridge_ifp->if_xname);
10202 		goto done;
10203 	}
10204 
10205 	/*
10206 	 * host filter drops packets that:
10207 	 * - are not ARP, IPv4, or IPv6
10208 	 * - have incorrect source MAC address
10209 	 */
10210 	host_filter = (bif->bif_flags & BIFF_HOST_FILTER) != 0;
10211 	etypef = ether_type_flag_get(eh_in_p->ether_type);
10212 	if (host_filter
10213 	    && (etypef & ETHER_TYPE_FLAG_IP_ARP) == 0) {
10214 		/* ether type not one of ARP, IPv4, or IPv6 */
10215 		BRIDGE_HF_DROP(brhf_bad_ether_type, __func__, __LINE__);
10216 		host_filter_drop = true;
10217 	} else if ((bif->bif_flags & BIFF_HF_HWSRC) != 0 &&
10218 	    bcmp(eh_in_p->ether_shost, bif->bif_hf_hwsrc, ETHER_ADDR_LEN)
10219 	    != 0) {
10220 		/* only allow the single source MAC address */
10221 		BRIDGE_HF_DROP(brhf_bad_ether_srchw_addr,
10222 		    __func__, __LINE__);
10223 		host_filter_drop = true;
10224 	}
10225 	if (host_filter_drop) {
10226 		BRIDGE_UNLOCK(sc);
10227 		m_freem_list(list.head);
10228 		list.head = list.tail = NULL;
10229 		goto done;
10230 	}
10231 
10232 #if BRIDGESTP
10233 	discarding = (bif->bif_ifflags & IFBIF_STP) != 0 &&
10234 	    bif->bif_stp.bp_state == BSTP_IFSTATE_DISCARDING;
10235 #endif /* BRIDGESTP */
10236 
10237 	dhost = eh_in_p->ether_dhost;
10238 	shost = eh_in_p->ether_shost;
10239 	/*
10240 	 * Reserved multicast address listed in 802.1D section 7.12.6
10241 	 * must not be forwarded by the bridge.
10242 	 * This is currently 01-80-C2-00-00-00 to 01-80-C2-00-00-0F
10243 	 */
10244 	if (is_broadcast) {
10245 		if (IS_MCAST(list.head)) {
10246 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_MCAST,
10247 			    " multicast: "
10248 			    "%02x:%02x:%02x:%02x:%02x:%02x",
10249 			    dhost[0], dhost[1],
10250 			    dhost[2], dhost[3],
10251 			    dhost[4], dhost[5]);
10252 		}
10253 		if (bcmp(dhost, bstp_etheraddr, (ETHER_ADDR_LEN - 1)) == 0) {
10254 			if (dhost[5] == BSTP_ETHERADDR_RANGE_FIRST) {
10255 				/* multicast for spanning tree */
10256 #if BRIDGESTP
10257 				bridge_bstp_input_list(&bif->bif_stp, list.head);
10258 #else /* BRIDGESTP */
10259 				m_freem_list(list.head);
10260 #endif /* BRIDGESTP */
10261 				list.head = list.tail = NULL;
10262 				BRIDGE_UNLOCK(sc);
10263 				goto done;
10264 			}
10265 			if (dhost[5] <= BSTP_ETHERADDR_RANGE_LAST) {
10266 				/* allow packet to continue up the stack */
10267 				BRIDGE_UNLOCK(sc);
10268 				goto done;
10269 			}
10270 		}
10271 		/* broadcast to all members */
10272 		os_atomic_add(&bridge_ifp->if_imcasts, list.count, relaxed);
10273 	}
10274 
10275 #if BRIDGESTP
10276 	if (discarding) {
10277 		BRIDGE_UNLOCK(sc);
10278 		goto done;
10279 	}
10280 #endif /* BRIDGESTP */
10281 
10282 	/* If the interface is learning, record the address. */
10283 	if ((bif->bif_ifflags & IFBIF_LEARNING) != 0) {
10284 		error = bridge_rtupdate(sc, shost, vlan, bif, 0, IFBAF_DYNAMIC);
10285 		/*
10286 		 * If the interface has addresses limits then deny any source
10287 		 * that is not in the cache.
10288 		 */
10289 		if (error != 0 && bif->bif_addrmax) {
10290 			BRIDGE_UNLOCK(sc);
10291 			goto done;
10292 		}
10293 	}
10294 #if BRIDGESTP
10295 	if ((bif->bif_ifflags & IFBIF_STP) != 0 &&
10296 	    bif->bif_stp.bp_state == BSTP_IFSTATE_LEARNING) {
10297 		BRIDGE_UNLOCK(sc);
10298 		goto done;
10299 	}
10300 #endif /* BRIDGESTP */
10301 
10302 	/*
10303 	 * If the packet is not IP, let the host filter drop ARP packets.
10304 	 * Otherwise, if the host filter is enabled or we need to compute
10305 	 * checksums, do that.
10306 	 * Otherwise, if MAC-NAT is enabled and this is an IPv4 packet,
10307 	 * check for IPv4 broadcast packets. Accumulate those in a separate
10308 	 * list `ip_bcast`.
10309 	 */
10310 	checksum_offload = bif_has_checksum_offload(bif);
10311 	if (!ether_type_flag_is_ip(etypef)) {
10312 		/* host filter process ARP */
10313 		if (host_filter) {
10314 			/* host filter check earlier means this must be ARP */
10315 			VERIFY(etypef == ETHER_TYPE_FLAG_ARP);
10316 			list = bridge_filter_arp_list(bif, list.head);
10317 			if (list.head == NULL) {
10318 				VERIFY(list.tail == NULL);
10319 				BRIDGE_UNLOCK(sc);
10320 				goto done;
10321 			}
10322 		}
10323 	} else if (host_filter || checksum_offload) {
10324 		/* host filter and/or checksum */
10325 		list = bridge_filter_checksum_list(bridge_ifp, bif,
10326 		    list.head, etypef, host_filter, checksum_offload);
10327 		if (list.head == NULL) {
10328 			VERIFY(list.tail == NULL);
10329 			BRIDGE_UNLOCK(sc);
10330 			goto done;
10331 		}
10332 	} else if (is_ifp_mac && bif == sc->sc_mac_nat_bif &&
10333 	    etypef == ETHER_TYPE_FLAG_IPV4) {
10334 		/* look for broadcast IPv4 packet */
10335 		list = bridge_find_broadcast_ipv4(list.head, &ip_bcast);
10336 		if (list.head == NULL && ip_bcast == NULL) {
10337 			/* all packets were consumed */
10338 			BRIDGE_UNLOCK(sc);
10339 			goto done;
10340 		}
10341 	}
10342 
10343 	/*
10344 	 * If the destination MAC matches the bridge interface, and
10345 	 * the bridge has an address assigned, or the address is
10346 	 * distinct from the receive interface, claim the packets
10347 	 * for the bridge interface.
10348 	 */
10349 	bridge_has_address = (sc->sc_flags & SCF_ADDRESS_ASSIGNED) != 0;
10350 	if (!is_broadcast &&
10351 	    _ether_cmp(dhost, IF_LLADDR(bridge_ifp)) == 0 &&
10352 	    (bridge_has_address || _ether_cmp(dhost, IF_LLADDR(ifp)) != 0)) {
10353 		is_bridge_mac = true;
10354 	}
10355 	if (is_ifp_mac) {
10356 		/* unicast to the interface */
10357 		if (sc->sc_mac_nat_bif == bif) {
10358 			mbuf_ref_t  forward = NULL;
10359 
10360 			if (list.head != NULL) {
10361 				/* handle MAC-NAT if enabled */
10362 				list = bridge_mac_nat_input_list(sc, ifp,
10363 				    list.head, &forward);
10364 			}
10365 			if (ip_bcast != NULL) {
10366 				/* forward to all members except this one */
10367 				/* bridge_broadcast_list unlocks */
10368 				bridge_broadcast_list(sc, bif, etypef, ip_bcast,
10369 				    false);
10370 			} else {
10371 				BRIDGE_UNLOCK(sc);
10372 			}
10373 			if (forward != NULL) {
10374 				bridge_mac_nat_forward_list(bridge_ifp, etypef,
10375 				    forward);
10376 			}
10377 		} else {
10378 			BRIDGE_UNLOCK(sc);
10379 		}
10380 		/* unicast packets for this interface do not get forwarded */
10381 		goto done;
10382 	}
10383 	if (is_bridge_mac || list.head == NULL) {
10384 		BRIDGE_UNLOCK(sc);
10385 		goto done;
10386 	}
10387 	if (!is_broadcast) {
10388 		/* find where to send the packet */
10389 		dst_if = bridge_rtlookup(sc, dhost, vlan);
10390 		if (ifp == dst_if) {
10391 			/* nothing to forward */
10392 			BRIDGE_UNLOCK(sc);
10393 			goto done;
10394 		}
10395 		if (dst_if == NULL) {
10396 			/* if a member is the dhost, deliver as input */
10397 			member_input = bridge_find_member(sc, dhost, bif);
10398 			if (member_input != NULL) {
10399 				/* grab packets destined to member */
10400 				BRIDGE_UNLOCK(sc);
10401 				goto done;
10402 			}
10403 			/* if a member is shost, there's a loop, drop it */
10404 			if (bridge_find_member(sc, shost, bif) != NULL) {
10405 				BRIDGE_UNLOCK(sc);
10406 				m_freem_list(list.head);
10407 				list.head = list.tail = NULL;
10408 				goto done;
10409 			}
10410 		}
10411 	}
10412 	if (dst_if == NULL) {
10413 		/* bridge_broadcast_list() copies list and unlocks */
10414 		bridge_broadcast_list(sc, bif, etypef, list.head, true);
10415 	} else {
10416 		/* bridge_forward_list() consumes list and unlocks */
10417 		bridge_forward_list(sc, bif, dst_if, etypef, list.head);
10418 		list.head = list.tail = NULL;
10419 	}
10420 
10421 done:
10422 	if (list.head != NULL) {
10423 		if (member_input != NULL) {
10424 			/* member gets the packets */
10425 			inject_input_packet_list(member_input, list.head, true);
10426 			list.head = list.tail = NULL;
10427 		} else if (is_bridge_mac) {
10428 			/* bridge consumes all the unicast packets */
10429 			bridge_interface_input_list(bridge_ifp, etypef, list,
10430 			    bridge_has_address);
10431 			list.head = list.tail = NULL;
10432 		} else {
10433 			adjust_input_packet_list(list.head);
10434 		}
10435 	}
10436 	return list;
10437 }
10438 
10439 static inline void
10440 update_mbuf_flags(struct ifnet * ifp, mbuf_t m, struct ether_header * eh)
10441 {
10442 	/* duplicate some of the work done in ether_demux */
10443 	if ((eh->ether_dhost[0] & 1) == 0) {
10444 		if (_ether_cmp(eh->ether_dhost, IF_LLADDR(ifp)) != 0) {
10445 			m->m_flags |= M_PROMISC;
10446 		}
10447 	} else {
10448 		/* Check for broadcast */
10449 		if (_ether_cmp(etherbroadcastaddr, eh->ether_dhost) == 0) {
10450 			m->m_flags |= M_BCAST;
10451 		} else {
10452 			m->m_flags |= M_MCAST;
10453 		}
10454 	}
10455 	if (m->m_flags & M_HASFCS) {
10456 		/*
10457 		 * If the M_HASFCS is set by the driver we want to make sure
10458 		 * that we strip off the trailing FCS data before handing it
10459 		 * up the stack.
10460 		 */
10461 		m_adj(m, -ETHER_CRC_LEN);
10462 		m->m_flags &= ~M_HASFCS;
10463 	}
10464 	return;
10465 }
10466 
10467 static mbuf_t
10468 bridge_pf_list(mbuf_t m, ifnet_t ifp, uint32_t sc_filter_flags, bool input)
10469 {
10470 	mbuf_t  next_packet = NULL;
10471 	mblist  ret;
10472 
10473 	mblist_init(&ret);
10474 	for (mbuf_ref_t scan = m; scan != NULL; scan = next_packet) {
10475 		next_packet = scan->m_nextpkt;
10476 
10477 		/* remove packet from list, and pass through PF */
10478 		scan->m_nextpkt = NULL;
10479 		MBUF_INPUT_CHECK(scan, ifp);
10480 		bridge_pf(&scan, ifp, sc_filter_flags, input);
10481 		if (scan != NULL) {
10482 			/* add packet back to the list */
10483 			mblist_append(&ret, scan);
10484 		}
10485 	}
10486 	return ret.head;
10487 }
10488 
10489 static inline bool
10490 get_and_clear_promisc(mbuf_t m)
10491 {
10492 	bool    is_promisc;
10493 
10494 	/*
10495 	 * Need to clear the promiscuous flag otherwise the packet will be
10496 	 * dropped by DLIL after processing filters
10497 	 */
10498 	is_promisc = (mbuf_flags(m) & MBUF_PROMISC) != 0;
10499 	if (is_promisc) {
10500 		mbuf_setflags_mask(m, 0, MBUF_PROMISC);
10501 	}
10502 	return is_promisc;
10503 }
10504 
10505 static inline bool
10506 bridge_check_frame_header(struct bridge_softc * sc, ifnet_t ifp, mbuf_t m)
10507 {
10508 	bool                    included = false;
10509 	char * __single         header;
10510 	size_t                  header_length = 0;
10511 
10512 	header = m->m_pkthdr.pkt_hdr;
10513 	if (header >= (char *)mbuf_datastart(m) &&
10514 	    header <= mtod(m, char *)) {
10515 		header_length = mtod(m, char *) - header;
10516 		if (header_length >= ETHER_HDR_LEN) {
10517 			included = true;
10518 		}
10519 	}
10520 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
10521 	    "%s from %s m 0x%llx data 0x%llx frame 0x%llx %s "
10522 	    "header length %lu", sc->sc_ifp->if_xname,
10523 	    ifp->if_xname, (uint64_t)VM_KERNEL_ADDRPERM(m),
10524 	    (uint64_t)VM_KERNEL_ADDRPERM(mtod(m, void *)),
10525 	    (uint64_t)VM_KERNEL_ADDRPERM(header),
10526 	    included ? "inside" : "outside", header_length);
10527 	if (!included) {
10528 		BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT,
10529 		    "%s: frame_header outside mbuf", ifp->if_xname);
10530 	}
10531 	return included;
10532 }
10533 
10534 
10535 mbuf_t
10536 bridge_early_input(struct ifnet *ifp, mbuf_t in_list, u_int32_t cnt)
10537 {
10538 	struct ether_header eh;
10539 	mblist          list;
10540 	volatile bool   list_is_promisc;
10541 	int             n_lists = 0;
10542 	mbuf_t          next_packet = NULL;
10543 	mblist          ret;
10544 	struct bridge_softc * __single sc = ifp->if_bridge;
10545 	uint32_t        sc_filter_flags;
10546 
10547 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT_LIST,
10548 	    "(%s): count %u", ifp->if_xname, cnt);
10549 
10550 	/* run packet list through PF first */
10551 	sc_filter_flags = sc->sc_filter_flags;
10552 	if (PF_IS_ENABLED && (sc_filter_flags & IFBF_FILT_MEMBER)) {
10553 		in_list = bridge_pf_list(in_list, ifp, sc_filter_flags, true);
10554 	}
10555 
10556 	/* form sublists with the same ethernet header */
10557 	mblist_init(&list);
10558 	mblist_init(&ret);
10559 	for (mbuf_t scan = in_list; scan != NULL; scan = next_packet) {
10560 		struct ether_header *   eh_p;
10561 		volatile bool           is_promisc;
10562 		mblist                  resid;
10563 
10564 		/* take it out of the list */
10565 		next_packet = scan->m_nextpkt;
10566 		scan->m_nextpkt = NULL;
10567 
10568 		/* don't loop the packet */
10569 		if ((scan->m_flags & M_PROTO1) != 0) {
10570 			mblist_append(&ret, scan);
10571 			continue;
10572 		}
10573 		/* Check if this mbuf looks valid */
10574 		MBUF_INPUT_CHECK(scan, ifp);
10575 
10576 		/* if the frame header isn't in the first mbuf, ignore */
10577 		if (!bridge_check_frame_header(sc, ifp, scan)) {
10578 			mblist_append(&ret, scan);
10579 			continue;
10580 		}
10581 		eh_p = __unsafe_forge_single(struct ether_header *,
10582 		    scan->m_pkthdr.pkt_hdr);
10583 		update_mbuf_flags(ifp, scan, eh_p);
10584 
10585 		/* set start back to include ether header */
10586 		_mbuf_adjust_pkthdr_and_data(scan, -ETHER_HDR_LEN);
10587 
10588 		is_promisc = get_and_clear_promisc(scan);
10589 		if (list.head == NULL) {
10590 			/* start a new list */
10591 			mblist_append(&list, scan);
10592 			bcopy(eh_p, &eh, sizeof(eh));
10593 			list_is_promisc = is_promisc;
10594 		} else if (bcmp(eh_p, &eh, sizeof(eh)) != 0) {
10595 			n_lists++;
10596 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT_LIST,
10597 			    "(%s): sublist %u pkts %u",
10598 			    ifp->if_xname, n_lists, list.count);
10599 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_INPUT_LIST)) {
10600 				brlog_ether_header(&eh);
10601 			}
10602 			resid = bridge_input_list(sc, ifp, &eh, list,
10603 			    list_is_promisc);
10604 			if (resid.head != NULL) {
10605 				/* add to the packets to be returned */
10606 				mblist_append_list(&ret, resid);
10607 			}
10608 			/* start new list */
10609 			mblist_init(&list);
10610 			mblist_append(&list, scan);
10611 			list_is_promisc = is_promisc;
10612 			bcopy(eh_p, &eh, sizeof(eh));
10613 		} else {
10614 			mblist_append(&list, scan);
10615 			VERIFY(is_promisc == list_is_promisc);
10616 		}
10617 		if (next_packet == NULL) {
10618 			/* last list */
10619 			n_lists++;
10620 			BRIDGE_LOG(LOG_DEBUG, BR_DBGF_INPUT_LIST,
10621 			    "(%s): sublist %u pkts %u",
10622 			    ifp->if_xname, n_lists, list.count);
10623 			if (BRIDGE_DBGF_ENABLED(BR_DBGF_INPUT_LIST)) {
10624 				brlog_ether_header(&eh);
10625 			}
10626 			resid = bridge_input_list(sc, ifp, &eh, list,
10627 			    list_is_promisc);
10628 			if (resid.head != NULL) {
10629 				/* add to the packets to be returned */
10630 				mblist_append_list(&ret, resid);
10631 			}
10632 		}
10633 	}
10634 	return ret.head;
10635 }
10636 
10637 /*
10638  * Copyright (C) 2014, Stefano Garzarella - Universita` di Pisa.
10639  * All rights reserved.
10640  *
10641  * Redistribution and use in source and binary forms, with or without
10642  * modification, are permitted provided that the following conditions
10643  * are met:
10644  *   1. Redistributions of source code must retain the above copyright
10645  *      notice, this list of conditions and the following disclaimer.
10646  *   2. Redistributions in binary form must reproduce the above copyright
10647  *      notice, this list of conditions and the following disclaimer in the
10648  *      documentation and/or other materials provided with the distribution.
10649  *
10650  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
10651  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
10652  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
10653  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
10654  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
10655  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
10656  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
10657  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
10658  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
10659  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
10660  * SUCH DAMAGE.
10661  */
10662 
10663 /*
10664  * XXX-ste: Maybe this function must be moved into kern/uipc_mbuf.c
10665  *
10666  * Create a queue of packets/segments which fit the given mss + hdr_len.
10667  * m0 points to mbuf chain to be segmented.
10668  * This function splits the payload (m0-> m_pkthdr.len - hdr_len)
10669  * into segments of length MSS bytes and then copy the first hdr_len bytes
10670  * from m0 at the top of each segment.
10671  * If hdr2_buf is not NULL (hdr2_len is the buf length), it is copied
10672  * in each segment after the first hdr_len bytes
10673  *
10674  * Return the new queue with the segments on success, NULL on failure.
10675  * (the mbuf queue is freed in this case).
10676  */
10677 
10678 static mblist
10679 m_seg(struct mbuf *m0, int hdr_len, int mss, char * hdr2_buf, int hdr2_len)
10680 {
10681 	int off = 0, n, firstlen;
10682 	struct mbuf *mseg;
10683 	int total_len = m0->m_pkthdr.len;
10684 	mblist ret;
10685 
10686 	mblist_init(&ret);
10687 	mblist_append(&ret, m0);
10688 
10689 	/*
10690 	 * Segmentation useless
10691 	 */
10692 	if (total_len <= hdr_len + mss) {
10693 		n = 1;
10694 		goto done;
10695 	}
10696 
10697 	if (hdr2_buf == NULL || hdr2_len <= 0) {
10698 		hdr2_buf = NULL;
10699 		hdr2_len = 0;
10700 	}
10701 
10702 	off = hdr_len + mss;
10703 	firstlen = mss; /* first segment stored in the original mbuf */
10704 
10705 	for (n = 1; off < total_len; off += mss, n++) {
10706 		struct mbuf *m;
10707 		/*
10708 		 * Copy the header from the original packet
10709 		 * and create a new mbuf chain
10710 		 */
10711 		if (MHLEN < hdr_len) {
10712 			m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
10713 		} else {
10714 			m = m_gethdr(M_NOWAIT, MT_DATA);
10715 		}
10716 
10717 		if (m == NULL) {
10718 #ifdef GSO_DEBUG
10719 			D("MGETHDR error\n");
10720 #endif
10721 			goto err;
10722 		}
10723 
10724 		m_copydata(m0, 0, hdr_len, mtod(m, caddr_t));
10725 
10726 		m->m_len = hdr_len;
10727 		/*
10728 		 * if the optional header is present, copy it
10729 		 */
10730 		if (hdr2_buf != NULL) {
10731 			m_copyback(m, hdr_len, hdr2_len, hdr2_buf);
10732 		}
10733 
10734 		m->m_flags |= (m0->m_flags & M_COPYFLAGS);
10735 		if (off + mss >= total_len) {           /* last segment */
10736 			mss = total_len - off;
10737 		}
10738 		/*
10739 		 * Copy the payload from original packet
10740 		 */
10741 		mseg = m_copym(m0, off, mss, M_NOWAIT);
10742 		if (mseg == NULL) {
10743 			m_freem(m);
10744 #ifdef GSO_DEBUG
10745 			D("m_copym error\n");
10746 #endif
10747 			goto err;
10748 		}
10749 		m_cat(m, mseg);
10750 
10751 		m->m_pkthdr.len = hdr_len + hdr2_len + mss;
10752 		m->m_pkthdr.rcvif = m0->m_pkthdr.rcvif;
10753 		/*
10754 		 * Copy the checksum flags and data (in_cksum() need this)
10755 		 */
10756 		m->m_pkthdr.csum_flags = m0->m_pkthdr.csum_flags;
10757 		m->m_pkthdr.csum_data = m0->m_pkthdr.csum_data;
10758 		m->m_pkthdr.tso_segsz = m0->m_pkthdr.tso_segsz;
10759 
10760 		mblist_append(&ret, m);
10761 	}
10762 
10763 	/*
10764 	 * Update first segment.
10765 	 * If the optional header is present, is necessary
10766 	 * to insert it into the first segment.
10767 	 */
10768 	if (hdr2_buf == NULL) {
10769 		m_adj(m0, hdr_len + firstlen - total_len);
10770 		m0->m_pkthdr.len = hdr_len + firstlen;
10771 	} else {
10772 		mseg = m_copym(m0, hdr_len, firstlen, M_NOWAIT);
10773 		if (mseg == NULL) {
10774 #ifdef GSO_DEBUG
10775 			D("m_copym error\n");
10776 #endif
10777 			goto err;
10778 		}
10779 		m_adj(m0, hdr_len - total_len);
10780 		m_copyback(m0, hdr_len, hdr2_len, hdr2_buf);
10781 		m_cat(m0, mseg);
10782 		m0->m_pkthdr.len = hdr_len + hdr2_len + firstlen;
10783 	}
10784 
10785 done:
10786 	return ret;
10787 
10788 err:
10789 	if (ret.head != NULL) {
10790 		m_freem_list(ret.head);
10791 		mblist_init(&ret);
10792 	}
10793 	return ret;
10794 }
10795 
10796 /*
10797  * Wrappers of IPv4 checksum functions
10798  */
10799 static inline void
10800 gso_ipv4_data_cksum(struct mbuf *m, struct ip *ip, int mac_hlen)
10801 {
10802 	m->m_data += mac_hlen;
10803 	m->m_len -= mac_hlen;
10804 	m->m_pkthdr.len -= mac_hlen;
10805 #if __FreeBSD_version < 1000000
10806 	ip->ip_len = ntohs(ip->ip_len); /* needed for in_delayed_cksum() */
10807 #endif
10808 
10809 	in_delayed_cksum(m);
10810 
10811 #if __FreeBSD_version < 1000000
10812 	ip->ip_len = htons(ip->ip_len);
10813 #endif
10814 	m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
10815 	m->m_len += mac_hlen;
10816 	m->m_pkthdr.len += mac_hlen;
10817 	m->m_data -= mac_hlen;
10818 }
10819 
10820 static inline void
10821 gso_ipv4_hdr_cksum(struct mbuf *m, struct ip *ip, int mac_hlen, int ip_hlen)
10822 {
10823 	m->m_data += mac_hlen;
10824 
10825 	ip->ip_sum = in_cksum(m, ip_hlen);
10826 
10827 	m->m_pkthdr.csum_flags &= ~CSUM_IP;
10828 	m->m_data -= mac_hlen;
10829 }
10830 
10831 /*
10832  * Structure that contains the state during the TCP segmentation
10833  */
10834 struct gso_ip_tcp_state {
10835 	void    (*update)
10836 	(struct gso_ip_tcp_state*, struct mbuf*);
10837 	void    (*internal)
10838 	(struct gso_ip_tcp_state*, struct mbuf*);
10839 	u_int ip_m0_len;
10840 	uint8_t * __counted_by(ip_m0_len) hdr;
10841 	struct tcphdr *tcp;
10842 	int mac_hlen;
10843 	int ip_hlen;
10844 	int tcp_hlen;
10845 	int hlen;
10846 	int pay_len;
10847 	int sw_csum;
10848 	uint32_t tcp_seq;
10849 	uint16_t ip_id;
10850 	boolean_t is_tx;
10851 };
10852 
10853 /*
10854  * Update the pointers to TCP and IPv4 headers
10855  */
10856 static inline void
10857 gso_ipv4_tcp_update(struct gso_ip_tcp_state *state, struct mbuf *m)
10858 {
10859 	state->hdr = mtodo(m, state->mac_hlen);
10860 	state->ip_m0_len = m->m_len - state->mac_hlen;
10861 	state->ip_hlen = state->ip_hlen;
10862 	state->tcp = (struct tcphdr *)(state->hdr + state->ip_hlen);
10863 	state->pay_len = m->m_pkthdr.len - state->hlen;
10864 }
10865 
10866 /*
10867  * Set properly the TCP and IPv4 headers
10868  */
10869 static inline void
10870 gso_ipv4_tcp_internal(struct gso_ip_tcp_state *state, struct mbuf *m)
10871 {
10872 	struct ip *ip;
10873 	/*
10874 	 * Update IP header
10875 	 */
10876 	ip = (struct ip *)state->hdr;
10877 	ip->ip_id = htons((state->ip_id)++);
10878 	ip->ip_len = htons(m->m_pkthdr.len - state->mac_hlen);
10879 	/*
10880 	 * TCP Checksum
10881 	 */
10882 	state->tcp->th_sum = 0;
10883 	state->tcp->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
10884 	    htons(state->tcp_hlen + IPPROTO_TCP + state->pay_len));
10885 	/*
10886 	 * Checksum HW not supported (TCP)
10887 	 */
10888 	if (state->sw_csum & CSUM_DELAY_DATA) {
10889 		gso_ipv4_data_cksum(m, ip, state->mac_hlen);
10890 	}
10891 
10892 	state->tcp_seq += state->pay_len;
10893 	/*
10894 	 * IP Checksum
10895 	 */
10896 	ip->ip_sum = 0;
10897 	/*
10898 	 * Checksum HW not supported (IP)
10899 	 */
10900 	if (state->sw_csum & CSUM_IP) {
10901 		gso_ipv4_hdr_cksum(m, ip, state->mac_hlen, state->ip_hlen);
10902 	}
10903 }
10904 
10905 
10906 /*
10907  * Updates the pointers to TCP and IPv6 headers
10908  */
10909 static inline void
10910 gso_ipv6_tcp_update(struct gso_ip_tcp_state *state, struct mbuf *m)
10911 {
10912 	state->hdr = mtodo(m, state->mac_hlen);
10913 	state->ip_m0_len = m->m_len - state->mac_hlen;
10914 	state->ip_hlen = state->ip_hlen;
10915 	state->tcp = (struct tcphdr *)(state->hdr + state->ip_hlen);
10916 	state->pay_len = m->m_pkthdr.len - state->hlen;
10917 }
10918 
10919 /*
10920  * Sets properly the TCP and IPv6 headers
10921  */
10922 static inline void
10923 gso_ipv6_tcp_internal(struct gso_ip_tcp_state *state, struct mbuf *m)
10924 {
10925 	struct ip6_hdr *ip6;
10926 
10927 	ip6 = (struct ip6_hdr *)state->hdr;
10928 	ip6->ip6_plen = htons(m->m_pkthdr.len - state->mac_hlen - state->ip_hlen);
10929 	/*
10930 	 * TCP Checksum
10931 	 */
10932 	state->tcp->th_sum = 0;
10933 	state->tcp->th_sum = in6_pseudo(&ip6->ip6_src, &ip6->ip6_dst,
10934 	    htonl(state->tcp_hlen + state->pay_len + IPPROTO_TCP));
10935 	/*
10936 	 * Checksum HW not supported (TCP)
10937 	 */
10938 	if (state->sw_csum & CSUM_DELAY_IPV6_DATA) {
10939 		(void)in6_finalize_cksum(m, state->mac_hlen, -1, -1, state->sw_csum);
10940 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_IPV6_DATA;
10941 	}
10942 	state->tcp_seq += state->pay_len;
10943 }
10944 
10945 /*
10946  * Init the state during the TCP segmentation
10947  */
10948 static void
10949 gso_ip_tcp_init_state(struct gso_ip_tcp_state *state, struct ifnet *ifp,
10950     bool is_ipv4, int mac_hlen, int ip_hlen,
10951     uint8_t *__counted_by(ip_m0_len) ip_hdr, u_int ip_m0_len,
10952     struct tcphdr * tcp_hdr)
10953 {
10954 #pragma unused(ifp)
10955 
10956 	state->hdr = ip_hdr;
10957 	state->ip_m0_len = ip_m0_len;
10958 	state->ip_hlen = ip_hlen;
10959 	state->tcp = tcp_hdr;
10960 	if (is_ipv4) {
10961 		state->ip_id = ntohs(((struct ip *)state->hdr)->ip_id);
10962 		state->update = gso_ipv4_tcp_update;
10963 		state->internal = gso_ipv4_tcp_internal;
10964 		state->sw_csum = CSUM_DELAY_DATA | CSUM_IP; /* XXX */
10965 	} else {
10966 		state->update = gso_ipv6_tcp_update;
10967 		state->internal = gso_ipv6_tcp_internal;
10968 		state->sw_csum = CSUM_DELAY_IPV6_DATA; /* XXX */
10969 	}
10970 	state->mac_hlen = mac_hlen;
10971 	state->tcp_hlen = state->tcp->th_off << 2;
10972 	state->hlen = mac_hlen + ip_hlen + state->tcp_hlen;
10973 	state->tcp_seq = ntohl(state->tcp->th_seq);
10974 	//state->sw_csum = m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_FLAGS(ifp->if_hwassist);
10975 	return;
10976 }
10977 
10978 /*
10979  * GSO on TCP/IP (v4 or v6)
10980  *
10981  * Segment the given mbuf and return the list of packets.
10982  *
10983  */
10984 static mblist
10985 gso_ip_tcp(ifnet_t ifp, mbuf_t m0, struct gso_ip_tcp_state *state, bool is_tx)
10986 {
10987 	struct mbuf *m;
10988 	int mss = 0;
10989 #ifdef GSO_STATS
10990 	int total_len = m0->m_pkthdr.len;
10991 #endif /* GSO_STATS */
10992 	mblist seg;
10993 
10994 #if 1
10995 	/* hack: we don't get MSS via packet metadata */
10996 	u_int reduce_mss;
10997 
10998 	reduce_mss = is_tx ? if_bridge_tso_reduce_mss_tx
10999 	    : if_bridge_tso_reduce_mss_forwarding;
11000 	mss = ifp->if_mtu - state->ip_hlen - state->tcp_hlen - reduce_mss;
11001 	assert(mss > 0);
11002 #else
11003 	if (m0->m_pkthdr.csum_flags & ifp->if_hwassist & CSUM_TSO) {/* TSO with GSO */
11004 		mss = ifp->if_hw_tsomax - state->ip_hlen - state->tcp_hlen;
11005 	} else {
11006 		mss = m0->m_pkthdr.tso_segsz;
11007 	}
11008 #endif
11009 	seg = m_seg(m0, state->hlen, mss, 0, 0);
11010 	if (seg.head == NULL || seg.head->m_nextpkt == NULL) {
11011 		return seg;
11012 	}
11013 	BRIDGE_LOG(LOG_DEBUG, BR_DBGF_CHECKSUM,
11014 	    "%s %s mss %d nsegs %d",
11015 	    ifp->if_xname,
11016 	    is_tx ? "TX" : "RX",
11017 	    mss, seg.count);
11018 #ifdef GSO_STATS
11019 	GSOSTAT_SET_MAX(tcp.gsos_max_mss, mss);
11020 	GSOSTAT_SET_MIN(tcp.gsos_min_mss, mss);
11021 	GSOSTAT_ADD(tcp.gsos_osegments, seg.count);
11022 #endif /* GSO_STATS */
11023 
11024 	/* first pkt */
11025 	VERIFY(seg.head == m0);
11026 	m = m0;
11027 
11028 	state->update(state, m);
11029 
11030 	do {
11031 		state->tcp->th_flags &= ~(TH_FIN | TH_PUSH);
11032 
11033 		state->internal(state, m);
11034 		m = m->m_nextpkt;
11035 		state->update(state, m);
11036 		state->tcp->th_flags &= ~TH_CWR;
11037 		state->tcp->th_seq = htonl(state->tcp_seq);
11038 	} while (m->m_nextpkt);
11039 
11040 	/* last pkt */
11041 	state->internal(state, m);
11042 
11043 #ifdef GSO_STATS
11044 	if (!error) {
11045 		GSOSTAT_INC(tcp.gsos_segmented);
11046 		GSOSTAT_SET_MAX(tcp.gsos_maxsegmented, total_len);
11047 		GSOSTAT_SET_MIN(tcp.gsos_minsegmented, total_len);
11048 		GSOSTAT_ADD(tcp.gsos_totalbyteseg, total_len);
11049 	}
11050 #endif /* GSO_STATS */
11051 	return seg;
11052 }
11053 
11054 /*
11055  * GSO for TCP/IPv[46]
11056  */
11057 static mblist
11058 gso_tcp(ifnet_t ifp, mbuf_t m, u_int mac_hlen, bool is_ipv4, bool is_tx)
11059 {
11060 	int error;
11061 	ip_packet_info  info;
11062 	uint32_t csum_flags;
11063 	struct gso_ip_tcp_state state;
11064 	struct bripstats stats; /* XXX ignored */
11065 	struct tcphdr *tcp;
11066 	mblist ret;
11067 
11068 	mblist_init(&ret);
11069 	error = bridge_get_tcp_header(&m, mac_hlen, is_ipv4, &info, &stats);
11070 	if (error != 0) {
11071 		if (m != NULL) {
11072 			m_freem(m);
11073 			m = NULL;
11074 		}
11075 		goto no_segment;
11076 	}
11077 	if (info.ip_proto_hdr == NULL) {
11078 		/* not actually a TCP packet, no segmentation */
11079 		goto no_segment;
11080 	}
11081 	tcp = (struct tcphdr *)(void *)info.ip_proto_hdr;
11082 	gso_ip_tcp_init_state(&state, ifp, is_ipv4, mac_hlen,
11083 	    info.ip_hlen + info.ip_opt_len, info.ip_hdr, info.ip_m0_len, tcp);
11084 	if (is_ipv4) {
11085 		csum_flags = CSUM_DELAY_DATA; /* XXX */
11086 		if (!is_tx) {
11087 			/* if RX to our local IP address, don't segment */
11088 			struct in_addr  dst_ip;
11089 
11090 			bcopy(&((struct ip *)state.hdr)->ip_dst, &dst_ip, sizeof(dst_ip));
11091 			if (in_addr_is_ours(dst_ip)) {
11092 				goto no_segment;
11093 			}
11094 		}
11095 	} else {
11096 		csum_flags = CSUM_DELAY_IPV6_DATA; /* XXX */
11097 		if (!is_tx) {
11098 			/* if RX to our local IP address, don't segment */
11099 			if (in6_addr_is_ours(&((struct ip6_hdr *)state.hdr)->ip6_dst,
11100 			    ifp->if_index)) {
11101 				/* local IP address, no need to segment */
11102 				goto no_segment;
11103 			}
11104 		}
11105 	}
11106 	m->m_pkthdr.csum_flags = csum_flags;
11107 	m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
11108 	return gso_ip_tcp(ifp, m, &state, is_tx);
11109 
11110 no_segment:
11111 	if (m != NULL) {
11112 		mblist_append(&ret, m);
11113 	}
11114 	return ret;
11115 }
11116