summaryrefslogtreecommitdiffstats
path: root/sys/net/if_bridge.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* pass the uint64_t dst ethernet address from ether_input to bridges.dlg2021-03-051-3/+3
| | | | tested on amd64 and sparc64.
* Refactor ip_fragment() and ip6_fragment(). Use a mbuf list tobluhm2021-03-011-31/+23
| | | | | | | | | | simplify the handling of the fragment list. Now the functions ip_fragment() and ip6_fragment() always consume the mbuf. They free the mbuf and mbuf list in case of an error and take care about the counter. Adjust the code a bit to make v4 and v6 look similar. Fixes a potential mbuf leak when pf_route6() called pf_refragment6() and it failed. Now the mbuf is always freed by ip6_fragment(). OK dlg@ mvs@
* we don't have to cast to caddr_t when calling m_copydata anymore.dlg2021-02-251-15/+10
| | | | | | | | | | | | | | | | the first cut of this diff was made with coccinelle using this spatch: @rule@ type caddr_t; expression m, off, len, cp; @@ -m_copydata(m, off, len, (caddr_t)cp) +m_copydata(m, off, len, cp) i had fix it's opinionated idea of formatting by hand though, so i'm not sure it was worth it. ok deraadt@ bluhm@
* small adjustment of the deck chairs, no functional change.dlg2021-02-231-2/+2
|
* use the ipv6 dst addr to look up an ipsec tdb in bridge_ipsec in.dlg2021-02-231-2/+2
| | | | | | | | | using the ipv6 next protocol header probably doesnt work. it also probably doesnt matter cos i'm not sure anyone uses this feature in bridge. or maybe there isn't anyone who uses ipv6. both are plausible options. hahaha^Wok patrick@
* bridge(4): convert ifunit() to if_unit(9)mvs2021-01-281-14/+34
| | | | ok bluhm@ sashan@
* We have this sequence in bridge(4) ioctl(2) path:mvs2021-01-251-40/+40
| | | | | | | | | | | | | | | | | | | | ifs = ifunit(req->ifbr_ifsname); if (ifs == NULL) { error = ENOENT; break; } if (ifs->if_bridgeidx != ifp->if_index) { error = ESRCH; break; } bif = bridge_getbif(ifs); This sequence repeats 8 times. Also we don't check value returned by bridge_getbig() before use. Newly introduced bridge_getbig() function replaces this sequence. This not only reduces duplicated code but also makes `bif' dereference safe. ok bluhm@
* don't check local carp addresses as part of the antispoof checks.dlg2021-01-081-2/+3
| | | | | | | | | | | | | | | | | | bridge(4) drops packets coming from somewhere else that have a source MAC address that's owned by one of the interfaces that's a member of the bridge. because this check was done with bridge_ourether, it included the addresses of active carp interfaces hanging off these member interfaces. this meant if the local machine is the carp master while another machine is trying to preempt it by sending hellos, the packets from the other machine were dropped because the local one is already the master. carp roles are supposed to move around a l2 network, so another host sending a packet with a carp mac address is actually normal and necessary. found by and fix tested by stsp@ ok stsp@ claudio@
* Don't call if_deactivate() in bridge_clone_destroy(). Followingmvs2021-01-021-4/+1
| | | | | | if_detach() will do this. ok kn@
* Allow pf(4) to divert packets from bridge(4) to local socket.bluhm2020-08-061-1/+23
| | | | joint work markus@ patrick@ bluhm@
* `struct bstp_state' stores pointer to parent `ifnet' as `bs_ifp'.mvs2020-07-301-3/+5
| | | | | | | Replace this pointer by interface index. This allow us to avoid some use after free issues caused by ifioctl() races. ok sashan@
* Use interface index instead of pointer to `ifnet' in `struct bstp_port'.mvs2020-07-221-2/+2
| | | | ok yasuoka@
* register as a bridge port, not an input handler, on member ifaces.dlg2020-07-221-14/+26
| | | | | | | | | | | this is a step toward making all types of bridges coordinate their use of port interfaces, and is a step toward deprecating the interface input handler lists. bridge(4), switch(4), and tpmr(4) now coordinate their access so only one of them can own a port at a time. this has been in snaps as part of a larger diff for over a week.
* when adding a non-existent interface as a port, don't try create missing ones.dlg2020-07-131-9/+1
| | | | | | | | | | | | | | | this was annoying if i made a typo like "ifconfig bridge0 add gre0" instead of "ifconfig bridge0 add egre0" because it would create gre0 and then get upset cos it's not an Ethernet interface. also, it left gre0 lying around. this used to be useful when configuring a bridge on boot because interfaces used to be created when they were configured, and bridges could be configured before some virtual interfaces. however, netstart now creates all necessary interfaces before configuring any of them, so bridge being helpful isn't necessary anymore. ok kn@
* kernel: use gettime(9)/getuptime(9) in lieu of time_second(9)/time_uptime(9)cheloha2020-06-241-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | time_second(9) and time_uptime(9) are widely used in the kernel to quickly get the system UTC or system uptime as a time_t. However, time_t is 64-bit everywhere, so it is not generally safe to use them on 32-bit platforms: you have a split-read problem if your hardware cannot perform atomic 64-bit reads. This patch replaces time_second(9) with gettime(9), a safer successor interface, throughout the kernel. Similarly, time_uptime(9) is replaced with getuptime(9). There is a performance cost on 32-bit platforms in exchange for eliminating the split-read problem: instead of two register reads you now have a lockless read loop to pull the values from the timehands. This is really not *too* bad in the grand scheme of things, but compared to what we were doing before it is several times slower. There is no performance cost on 64-bit (__LP64__) platforms. With input from visa@, dlg@, and tedu@. Several bugs squashed by visa@. ok kettenis@
* ifpromisc() requires NET_LOCK(), so acquire the lock when changingvisa2020-04-121-1/+5
| | | | | | | | | promiscuous mode from bridge(4). This fixes a regression of r1.332 of sys/net/if_bridge.c. splassert with bridge(4) and vlan(4) reported by David Hill OK mpi@, dlg@
* replace the hooks used with if_detachhooks with a task list.dlg2019-11-061-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | the main semantic change is that things registering detach hooks have to allocate and set a task structure that then gets added to the list. this means if the task is allocated up front (eg, as part of carps softc or bridges port structure), it avoids the possibility that adding a hook can fail. a lot of drivers weren't checking for failure, and unwinding state in the event of failure in other parts was error prone. while doing this i discovered that the list operations have to be in a particular order, but drivers weren't doing that consistently either. this diff wraps the list ops up so you have to seriously go out of your way to screw them up. ive also sprinkled some NET_ASSERT_LOCKED around the list operations so we can make sure there's no potential for the list to be corrupted, especially while it's being run. hrvoje popovski has tested this a bit, and some issues he discovered have been fixed. ok sashan@
* When multiple ports share the same MAC, pick the physical one for delivery.mpi2019-07-201-31/+39
| | | | | | | | | | | | Fix an issue reported by Eygene Ryabinkin where packet where dropped by pf(4) because a vlan(4) interface was picked instead of its underlying em(4). While here do some refactoring to avoid code duplication. Based on a submission from Eygene Ryabinkin <rea at codelabs dot ru>. ok bluhm@, kn@
* Introduce ETHER_IS_BROADCAST/ANYADDR/EQ() and use them where appropriate.mpi2019-07-171-7/+4
| | | | ok dlg@, sthen@, millert@
* Always return EEXIST if an interface is already part of a bridge.mpi2019-06-091-2/+5
|
* Remove code for non-Ethernet members, these are no longer supported.mpi2019-06-091-15/+11
| | | | From Eygene Ryabinkin.
* Deal with the case where bridge_getbif() can return NULL.mpi2019-05-131-3/+4
| | | | | | | | Since `bif' are removed from the interface list before calling smr_barrier() and the hash queue is cleaned up afterward, it is possible to find an ifidx with bridge_rtlookup() that won't match to any `bif'. Fix a panic reported by Hrvoje Popovski, ok visa@
* Switch the list of span interfaces and interfaces to SMR.mpi2019-05-121-71/+92
| | | | | | | | | | | | This removes the KERNEL_LOCK() around the list iteration in bridge_enqueue(). Since the NET_LOCK() isn't protecting any data structure, release it early in all the code paths coming from the Network Stack to prevent possible deadlock situations with smr_barrier(). bridge_input() is still KERNEL_LOCK()ed as well as bridge_filterrule(). ok visa@
* pushing NET_LOCK() further down from if_clone_{create,destroy}()sashan2019-05-121-3/+9
| | | | OK mpi@
* Move bridge_filterrule() before doing the mbuf copy. Fixes a memory leakclaudio2019-05-101-6/+7
| | | | | | when multiple interfaces do MAC filtering. Memory leak reported by Daniel Levai With and OK mpi@
* An if_put() was missing in one branch of bridge_process(). Thisbluhm2019-05-031-1/+2
| | | | | | caused a hanging "ifconfig bridge0 destroy" and a subsequent uvm fault. reported and tested by Hrvoje Popovski; OK visa@
* Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.mpi2019-04-281-102/+137
| | | | | | | | This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
* Use timeout_del_barrier(9) instead of timeout_del(9) followed byvisa2019-04-151-3/+2
| | | | | | conditional timeout_barrier(9). OK kn@ dlg@
* Fix output accounting when bridge(4) is down.mpi2019-03-311-4/+5
| | | | ok visa@
* Merge copy/pasted code to export STP states via ioctl into a function.mpi2019-03-121-53/+38
|
* Do not grab a `bif' pointer again, we already have it.mpi2019-03-081-5/+2
| | | | ok visa@
* Move the tag mechanism outside of net/if_bridge.c.mpi2019-03-081-72/+3
| | | | | | This will help for future (un)locking. ok visa@
* Protect the hash table with a mutex.mpi2019-02-201-1/+2
| | | | inputs & ok visa@
* Use timeout_barrier() when bringing the bridge(4) down and only executempi2019-02-141-10/+9
| | | | | | the timeout handler if the interface is running. ok claudio@
* Remove mpw(4) hacks now that all the world is Ethernet.mpi2019-02-141-30/+3
|
* Plumbing to simplify upcoming locking.mpi2019-01-291-26/+27
| | | | | | | | | | - Do checks that do not access shared data structures first, they don't need locking and save us some dances. - Use the common !ETHER_IS_MULTICAST() idiom and move some code that won't be executed if the bridge(4) is down. ok bluhm@, visa@
* Pass an `ifp' pointer to bridge_ourether().mpi2019-01-231-6/+6
| | | | ok kn@, claudio@, visa@
* Only copy packets for span ports if the bridge is UP.mpi2019-01-231-4/+3
| | | | ok claudio@, kn@, visa@
* Convert interface lists from TAILQ to SLIST in preparation for finempi2019-01-171-32/+48
| | | | | | grained locking. ok visa@, florian@
* Various cleanups:mpi2018-12-121-18/+20
| | | | | | | | | | - Unify the two hooks by passing the same argument - Check for nullity before dereferencing `if_bridgeport', this will matter when we go MP - Use the same pattern to find a member in the ioctl path ok bluhm@, visa@
* Stop passing `sc' when it isn't needed and use `ifp' where it's goodmpi2018-12-071-46/+49
| | | | | | enough. ok sthen@, visa@
* Batch copyout(9)s in preparation for finer locking.mpi2018-11-141-20/+10
| | | | Tested by Hrvoje Popovski, inputs and ok visa@
* Put bridge_input & output back under the KERNEL_LOCK().mpi2018-10-011-3/+5
| | | | | | | Wireless drivers call if_enqueue() out of the NET_LOCK() so it cannot be used to serialize bridge(4) states. Found by stsp@, ok visa@
* Coherently name "struct bridge_iflist" variables `bif'.mpi2018-09-271-42/+40
| | | | ok visa@
* Move bridge input/output paths outside of the KERNEL_LOCK().mpi2018-09-261-5/+17
| | | | | | | Tested by Hrvoje Popovski who measured a 30% improvement of forwarded packets in the best case. ok visa@
* Always call bridge_iflist `bif'.mpi2018-09-191-111/+111
| | | | ok bluhm@, visa@
* when adding span ports, restrict them to ether and mplstunnel interfaces.dlg2018-04-191-1/+6
| | | | | | | | | this is the same check that's done when adding normal members to the bridge. it prevents things like gif(4) being added to the bridge, which in turn prevents panics when shoving ethernet packets down a layer 3 interface. reported and tested by jasper@
* Remove almost unused `flags' argument of suser().mpi2018-02-191-7/+7
| | | | | | | The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
* if an interface is added to the bridge that doesn't exist, try to create ithenning2018-02-111-1/+7
| | | | | triggered by djm's dhclient on vether on bridge setup ok djm benno claudio
* Add a new '-protected' option for bridge members.mpi2018-02-081-1/+37
| | | | | | | | | | | Bridge members that are part of the same protected domain, refered by a number between 1 and 31, cannot talk to each others. This is useful to isolate VMs or untrusted networks at layer 2. Members can be part of multiple protected domain making it possible to create complex protected setups. ok ccardenas@, claudio@, dlg@, henning@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.