Commit Graph

66 Commits

Author SHA1 Message Date
Sam Leffler
6b7330e2d4 Revise network interface cloning to take an optional opaque
parameter that can specify configuration parameters:
o rev cloner api's to add optional parameter block
o add SIOCCREATE2 that accepts parameter data
o rev vlan support to use new api (maintain old code)

Reviewed by:	arch@
2006-07-09 06:04:01 +00:00
Andrew Thompson
690d79381a Allow gif interfaces to be added as span ports, the user may want to send a
copy of all packets to the other side of the world.
2006-06-20 21:28:18 +00:00
Andrew Thompson
615fccc52b Fix spelling mistake in comment. 2006-06-19 02:25:11 +00:00
Andrew Thompson
80829fccd7 Use bit operations to get a locally administered address rather than using a
hardcoded OUI code.
2006-06-12 22:43:37 +00:00
Andrew Thompson
b3a1f9373a Allow bridge and carp to play nicely together by returning the packet if its
destined for a carp interface.

Obtained from:	OpenBSD
MFC after:	2 weeks
2006-06-08 23:40:16 +00:00
Andrew Thompson
dc1b1b7b6a Fix style(9) nits, whitespace and parentheses. 2006-05-16 22:50:41 +00:00
Daniel Hartmeier
2557a639a5 Recalculate IP checksum after running pfil hooks.
Reviewed by:	thompsa
Tested by:	Adam McDougall <mcdouga9@egr.msu.edu>
2006-05-15 11:49:01 +00:00
Andrew Thompson
7f87a57ca3 Add support for fragmenting ipv4 packets.
The packet filter may reassemble the ip fragments and return a packet that is
larger than the MTU of the sending interface. There is no check for DF or icmp
replies as we can only get a large packet to fragment by reassembling a
previous fragment, and this only happens after a call to pfil(9).

Obtained from:	OpenBSD (mostly)
Glanced at by:	mlaier
MFC after:	1 month
2006-04-29 05:37:25 +00:00
Andrew Thompson
64cb85059e Assert that the mbuf is not shared to ensure problems like the last commit are
not reintroduced.
2006-03-26 20:52:47 +00:00
Roman Kurakin
5cb7f13aee m_dup () packet not m_copypacket () since we will modify it. For more
details see PR kern/94448.

PR:     kern/94448

Original patch: Eygene A. Ryabinkin <rea-fbsd at rea dot mbslab dot kiae dot ru>Final patch:    thompsa@
Tested by:      thompsa@, Eygene A. Ryabinkin

MFC after:      7 days
2006-03-23 22:57:10 +00:00
Andrew Thompson
158a726c96 Since we are using random ethernet addresses for the bridge, it is possible
that we might have address collisions, so make sure that this hardware address
isn't already in use on another bridge.

Submitted by:	csjp
MFC after:	1 month
2006-03-03 09:12:21 +00:00
Christian S.J. Peron
6f75ef188b Slightly re-worked bpf(4) code associated with bridging: if we have a
destination interface as a member of our bridge or this is a unicast packet,
push it through the bpf(4) machinery.

For broadcast or multicast packets, don't bother with the bpf(4) because it will
be re-injected into ether_input. We do this before we pass the packets through
the pfil(9) framework, as it is possible that pfil(9) will drop the packet or
possibly modify it, making it very difficult to debug firewall issues on the
bridge.

Further, implemented IFF_MONITOR for bridge interfaces. This does much the same
thing that it does for regular network interfaces: it pushes the packet to any
bpf(4) peers and then returns. This bypasses all of the bridge machinery,
saving mutex acquisitions, list traversals, and other operations performed by
the bridging code.

This change to the bridging code is useful in situations where individuals use a
bridge to multiplex RX/TX signals from two interfaces, as is required by some
network taps for de-multiplexing links and transmitting the RX/TX signals
out through two separate interfaces. This behaviour is quite common for network
taps monitoring links, especially for certain manufacturers.

Reviewed by:	thompsa
MFC after:	1 month
Sponsored by:	Seccuris Labs
2006-03-03 05:58:18 +00:00
Oleg Bulyzhin
3ecf1851df Properly initialize args structure before passing it to ipfw_chk(): having
uninitialized args.inp is unhealthy for uid/gid/jail ipfw rules.

PR:		kern/92589
Approved by:	glebius (mentor)
MFC after:	1 week
2006-02-03 23:03:07 +00:00
Christian S.J. Peron
f5cdbcf14c Use PFIL_HOOKED macros in if_bridge and pass the right argument to
rw_assert. This un-breaks the build.

Submitted by:	Kostik Belousov
Pointy hat to:	csjp
2006-02-02 16:41:20 +00:00
Andrew Thompson
6637e0f390 Fix two bugs with the bridge
- code expects memcmp() to return a signed value, our memcmp() returns 0 if
   args are equal and > 0 if not.

 - It's possible to hijack interface for static entry. If bridge recieves
   packet from interface marked as learning it will replace the bridge_rtnode
   entry for the source address even if such entry marked as static.

Submitted by:	Gleb Kurtsov <k-gleb yandex.ru>
MFC after:	3 days
2006-01-31 21:21:28 +00:00
Colin Percival
02d4ab93fb Make sure buffers in if_bridge are fully initialized before copying
them to userland.

Security:	FreeBSD-SA-06:06.kmem
2006-01-25 10:00:40 +00:00
Andrew Thompson
7c2fb83a0b Add code that clears certain capabilities from the member interface, these are
restored when its removed from the bridge.

At the moment we only clear IFCAP_TXCSUM. Since a locally generated packet on
the bridge may be sent out any one or more interfaces it cant be assumed that
every card does hardware csums. Most bridges don't generate a lot of traffic
themselves so turning off offloading won't hurt, bridged packets are
unaffected.

Tested by:	Bruce Walker (bmw borderware.com)
MFC after:	5 days
2006-01-14 03:51:31 +00:00
Andrew Thompson
f0feaf4f19 Fix a brain-o in the last commit, the conditional was always false. 2006-01-02 23:02:43 +00:00
Andrew Thompson
94e45ae5e8 Reorganise bridge_rtupdate slightly to reduce duplication. 2006-01-02 22:44:54 +00:00
Andrew Thompson
ef9ac7c49a Reset the route expiry time on each update rather than always letting them get
GC'd and recreated.
2006-01-02 22:29:41 +00:00
Andrew Thompson
bc9f74c7cb It is better to use time_uptime here since it is monotonic.
Pointed out by:	glebius
2006-01-02 22:23:03 +00:00
Andrew Thompson
ec311647fb Minor whitespace cleanup. 2006-01-02 09:50:34 +00:00
Andrew Thompson
f595d62759 Read time_second directly rather than calling getmicrotime().
Obtained from:	DragonflyBSD
2006-01-02 09:36:53 +00:00
Andrew Thompson
a47f91cdc4 When pfil(9) is enabled the bridge only considers ETHERTYPE_ARP, ETHERTYPE_IP and
ETHERTYPE_IPV6 frames. Change this to be a sysctl knob so that is able to still
bridge non-IP packets if desired.

Also return early if all pfil_* sysctls are turned off, the user obviously does
not want to filter on the bridge.
2005-12-29 09:39:15 +00:00
Andrew Thompson
73ff045c57 Add RFC 3378 EtherIP support. This change makes it possible to add gif
interfaces to bridges, which will then send and receive IP protocol 97 packets.
Packets are Ethernet frames with an EtherIP header prepended.

Obtained from:	NetBSD
MFC after:	2 weeks
2005-12-21 21:29:45 +00:00
Andrew Thompson
1e4200620a As of r1.21 all broadcast packets are reprocessed by ether_input as arriving on
the bridge, this caused these packets to show up twice via bpf. Do not process
them twice with BPF_TAP.

MFC after:	3 days
2005-12-21 09:39:59 +00:00
Andrew Thompson
9d5e4aa8b1 Use M_ZERO for the bridge_iflist to ensure there are no unexpected suprises. 2005-12-17 10:12:20 +00:00
Andrew Thompson
6b74382014 Minor whitespace cleanup. 2005-12-17 10:03:48 +00:00
Andrew Thompson
e0a87e8acd Change from a callback in if_ethersubr to using EVENTHANDLER in order to detach
span ports when they disappear. The span port does not have a pointer to the
softc so revert r1.31 and bring back the softc linked-list.

MFC after:	2 weeks
2005-12-17 06:33:51 +00:00
Andrew Thompson
7536320f62 It is not safe to use m_copypacket() here as the returned mbuf is readonly,
change to m_dup and keep the alignment on the layer3 header.

MFC after:	1 week
2005-12-15 19:34:39 +00:00
Andrew Thompson
91f6764e93 Add support for creating span ports so that one can snoop bridged traffic
from another interface/machine/network.

Obtained from:	OpenBSD
MFC after:	2 weeks
2005-12-14 02:52:13 +00:00
Andrew Thompson
53b5c4604a The bridge is capable of sending broadcast packets so enable IFF_BROADCAST
Requested by:	des
2005-11-29 20:29:44 +00:00
Andrew Thompson
16e7e7d4bc Fix a second missed case where the refcount is not decremented.
MFC after:	3 days
2005-11-13 20:26:19 +00:00
Andrew Thompson
bb4b5f54a5 Fix a mbuf and refcnt leak in the broadcast code.
If the packet is rejected from pfil(9) then continue the loop rather than
returning, this means that we can still try to send it out the remaining
interfaces but more importantly the mbuf is freed and refcount decremented on
exit.
2005-11-13 19:36:59 +00:00
Ruslan Ermilov
4a0d6638b3 - Store pointer to the link-level address right in "struct ifnet"
rather than in ifindex_table[]; all (except one) accesses are
  through ifp anyway.  IF_LLADDR() works faster, and all (except
  one) ifaddr_byindex() users were converted to use ifp->if_addr.

- Stop storing a (pointer to) Ethernet address in "struct arpcom",
  and drop the IFP2ENADDR() macro; all users have been converted
  to use IF_LLADDR() instead.
2005-11-11 16:04:59 +00:00
Andrew Thompson
4e7e0183e1 Move the cloned interface list management in to if_clone. For some drivers the
softc lists and associated mutex are now unused so these have been removed.

Calling if_clone_detach() will now destroy all the cloned interfaces for the
driver and in most cases is all thats needed to unload.

Idea by:	brooks
Reviewed by:	brooks
2005-11-08 20:08:34 +00:00
Andrew Thompson
1a2661371b If we have been called from ether_ifdetach() then do not try and clear the
promisc flag from the member interface, this is a no-op anyway since the
interface is disappearing. The driver may have already released
its resources such as miibus and this is likely to panic the kernel.

Submitted and tested by:	Wojciech A. Koszek
MFC after:			2 weeks
2005-10-23 22:30:07 +00:00
Andrew Thompson
4c84347939 Make four more functions static that were missed in the last commit. 2005-10-14 20:57:02 +00:00
Andrew Thompson
6b32f3d3f2 Change most of the bridge and stp funtions to static. This has highlighted
that the following funtions are not used, wrap in '#ifdef noused' for the
moment.

 bstp_enable_change_detection
 bstp_disable_change_detection
 bstp_set_bridge_priority
 bstp_set_port_priority
 bstp_set_path_cost
2005-10-14 10:38:12 +00:00
Andrew Thompson
fd6238a659 Further clean up the bridge hooks in if_ethersubr.c and ng_ether.c
- move the function pointer definitions to if_bridgevar.h
- move most of the logic to the new BRIDGE_INPUT and BRIDGE_OUTPUT macros
- remove unneeded functions from if_bridgevar.h and sort a little.
2005-10-14 02:38:47 +00:00
Andrew Thompson
20a65f37a0 From 101 ways to panic your kernel.
Use bridge_ifdetach() to notify the bridge that a member has been detached. The
bridge can then remove it from its interface list and not try to send out via a
dead pointer.
2005-10-13 23:05:55 +00:00
Andrew Thompson
9cff52f7f6 Clean up the if_bridge hooks a bit in if_ethersubr.c and ng_ether.c, move
the broadcast/multicast test to bridge_input().

Requested by:	glebius
2005-10-13 09:43:30 +00:00
Andrew Thompson
febd0759f3 Change the reference counting to count the number of cloned interfaces for each
cloner. This ensures that ifc->ifc_units is not prematurely freed in
if_clone_detach() before the clones are destroyed, resulting in memory modified
after free. This could be triggered with if_vlan.

Assert that all cloners have been destroyed when freeing the memory.

Change all simple cloners to destroy their clones with ifc_simple_destroy() on
module unload so the reference count is properly updated. This also cleans up
the interface destroy routines and allows future optimisation.

Discussed with:	brooks, pjd, -current
Reviewed by:	brooks
2005-10-12 19:52:16 +00:00
Andrew Thompson
d5edd47e8f Do not packet filter in the bridge_start() routine, locally generated packets
are already filtered by the higher layers.

Approved by:	mlaier (mentor)
MFC after:	3 days
2005-10-02 19:15:56 +00:00
Andrew Thompson
ef64cd1947 Fix an alignment panic my preserving the 2byte padding (ETHER_ALIGN) on our
copied mbuf, which keeps the IP header 32-bit aligned. This copied mbuf is
reinjected back into ether_input and off to the IP routines.

Reported and tested by:	Peter van Dijk
Approved by:		mlaier (mentor)
MFC after:		3 days
2005-09-22 01:46:11 +00:00
Andrew Thompson
59280079d3 Add support for multicast to the bridge and allow inet6 addresses to be
assigned to the interface.

IPv6 auto-configuration is disabled. An IPv6 link-local address has a
link-local scope within one link, the spec is unclear for the bridge case and
it may cause scope violation.

An address can be assigned in the usual way;
  ifconfig bridge0 inet6 xxxx:...

Tested by:	bmah
Reviewed by:	ume (netinet6)
Approved by:	mlaier (mentor)
MFC after:	1 week
2005-09-06 21:11:59 +00:00
Andrew Thompson
68e84b98b2 Fix a panic in softclock() if the interface is destroyed with a bpf consumer
attached.

This is caused by bpf_detachd clearing IFF_PROMISC on the interface which does
a SIOCSIFFLAGS ioctl. The problem here is that while the interface has been
stopped, IFF_UP has not been cleared so IFF_UP != IFF_DRV_RUNNING, this causes
the ioctl function to init() the interface which resets the callouts.

The destroy then completes and frees the softc but softclock will panic on a
dead callout pointer.

Ensure ifp->if_flags matches reality by clearing IFF_UP when we destroy.

Silence from:	rwatson
Approved by:	mlaier (mentor)
MFC after:	3 days
2005-08-27 01:17:42 +00:00
Andrew Thompson
dba31bdea1 The mtu check in bridge_enqueue is bogus as the maximum Ethernet frame is
actually 1514, so comparing the mbuf length which includes the Ethernet header
to the interface MTU is wrong.

The check was a little over the top so just remove it.

Approved by:	mlaier (mentor)
MFC after:	3 days
2005-08-23 19:49:00 +00:00
Andrew Thompson
23e7643185 Mark the callouts as MPSAFE as if_bridge has been giant-free since day 1.
Use the SMP friendly callout_init_mtx() while we are here.

Approved by:	mlaier (mentor)
MFC after:	3 days
2005-08-18 20:17:00 +00:00
Andrew Thompson
a1c0fd4dee Ensure that we are holding the lock when initialising the bridge interface. We
could initialise while unlocked if the bridge is not up when setting the inet
address, ether_ioctl() would call bridge_init.

Change it so bridge_init is always called unlocked and then locks before
calling bstp_initialization().

Reported by:	Michal Mertl
Approved by:	mlaier (mentor)
MFC after:	3 days
2005-08-15 02:50:13 +00:00