/usr/src/sys/net/if

Bug Summary

File:	net/if_bridge.c
Warning:	line 1066, column 54 The left operand of '==' is a garbage value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name if_bridge.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/net/if_bridge.c
1/*	$OpenBSD: if_bridge.c,v 1.368 2023/05/16 14:32:54 jan Exp $	*/

3/*
* Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
* ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
* Effort sponsored in part by the Defense Advanced Research Projects
* Agency (DARPA) and Air Force Research Laboratory, Air Force
* Materiel Command, USAF, under agreement number F30602-01-2-0537.
*
*/

34#include "bpfilter.h"
35#include "gif.h"
36#include "pf.h"
37#include "carp.h"
38#include "vlan.h"

40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/mbuf.h>
43#include <sys/socket.h>
44#include <sys/ioctl.h>
45#include <sys/kernel.h>

47#include <net/if.h>
48#include <net/if_types.h>
49#include <net/if_llc.h>
50#include <net/netisr.h>

52#include <netinet/in.h>
53#include <netinet/ip.h>
54#include <netinet/ip_var.h>
55#include <netinet/if_ether.h>
56#include <netinet/ip_icmp.h>

58#ifdef IPSEC1
59#include <netinet/ip_ipsp.h>
60#include <net/if_enc.h>
61#endif

63#ifdef INET61
64#include <netinet6/in6_var.h>
65#include <netinet/ip6.h>
66#include <netinet6/ip6_var.h>
67#endif

69#if NPF1 > 0
70#include <net/pfvar.h>
71#define	BRIDGE_INPF_IN	PF_IN
72#define	BRIDGE_OUTPF_OUT	PF_OUT
73#else
74#define	BRIDGE_INPF_IN	0
75#define	BRIDGE_OUTPF_OUT	1
76#endif

78#if NBPFILTER1 > 0
79#include <net/bpf.h>
80#endif

82#if NCARP1 > 0
83#include <netinet/ip_carp.h>
84#endif

86#if NVLAN1 > 0
87#include <net/if_vlan_var.h>
88#endif

90#include <net/if_bridge.h>

92/*
* Maximum number of addresses to cache
*/
95#ifndef	BRIDGE_RTABLE_MAX100
96#define	BRIDGE_RTABLE_MAX100	100
97#endif

99/*
* Timeout (in seconds) for entries learned dynamically
*/
102#ifndef	BRIDGE_RTABLE_TIMEOUT240
103#define	BRIDGE_RTABLE_TIMEOUT240	240
104#endif

106void	bridgeattach(int);
107int	bridge_ioctl(struct ifnet *, u_long, caddr_t);
108void	bridge_ifdetach(void *);
109void	bridge_spandetach(void *);
110int	bridge_ifremove(struct bridge_iflist *);
111void	bridge_spanremove(struct bridge_iflist *);
112struct mbuf *
bridge_input(struct ifnet *, struct mbuf *, uint64_t, void *);
114void	bridge_process(struct ifnet *, struct mbuf *);
115void	bridgeintr_frame(struct ifnet *, struct ifnet *, struct mbuf *);
116void	bridge_bifgetstp(struct bridge_softc *, struct bridge_iflist *,
   struct ifbreq *);
118void	bridge_broadcast(struct bridge_softc *, struct ifnet *,
  struct ether_header *, struct mbuf *);
120int	bridge_localbroadcast(struct ifnet *, struct ether_header *,
  struct mbuf *);
122void	bridge_span(struct ifnet *, struct mbuf *);
123void	bridge_stop(struct bridge_softc *);
124void	bridge_init(struct bridge_softc *);
125int	bridge_bifconf(struct bridge_softc *, struct ifbifconf *);
126int bridge_blocknonip(struct ether_header *, struct mbuf *);
127void	bridge_ifinput(struct ifnet *, struct mbuf *);
128int	bridge_dummy_output(struct ifnet *, struct mbuf *, struct sockaddr *,
  struct rtentry *);
130void	bridge_send_icmp_err(struct ifnet *, struct ether_header *,
  struct mbuf *, int, struct llc *, int, int, int);
132int	bridge_ifenqueue(struct ifnet *, struct ifnet *, struct mbuf *);
133struct mbuf *bridge_ip(struct ifnet *, int, struct ifnet *,
  struct ether_header *, struct mbuf *);
135#ifdef IPSEC1
136int bridge_ipsec(struct ifnet *, struct ether_header *, int, struct llc *,
  int, int, int, struct mbuf *);
138#endif
139int     bridge_clone_create(struct if_clone *, int);
140int	bridge_clone_destroy(struct ifnet *);
141void	bridge_take(void *);
142void	bridge_rele(void *);

144#define	ETHERADDR_IS_IP_MCAST(a)((a)->ether_addr_octet[0] == 0x01 && (a)->ether_addr_octet
[1] == 0x00 && (a)->ether_addr_octet[2] == 0x5e) \
/* struct etheraddr *a;	*/				\
((a)->ether_addr_octet[0] == 0x01 &&			\
(a)->ether_addr_octet[1] == 0x00 &&			\
(a)->ether_addr_octet[2] == 0x5e)

150struct niqueue bridgeintrq = NIQUEUE_INITIALIZER(1024, NETISR_BRIDGE){ { { ((void *)0), ((((0x4)) > 0x0 && ((0x4)) <
 0x9) ? 0x9 : ((0x4))), 0x0 }, { ((void *)0), ((void *)0), 0 }
, ((1024)), 0 }, (29) };

152struct if_clone bridge_cloner =
  IF_CLONE_INITIALIZER("bridge", bridge_clone_create, bridge_clone_destroy){ .ifc_list = { ((void *)0), ((void *)0) }, .ifc_name = "bridge"
, .ifc_namelen = sizeof("bridge") - 1, .ifc_create = bridge_clone_create
, .ifc_destroy = bridge_clone_destroy, };

155const struct ether_brport bridge_brport = {
bridge_input,
bridge_take,
bridge_rele,
NULL((void *)0),
160};

162void
163bridgeattach(int n)
164{
if_clone_attach(&bridge_cloner);
166}

168int
169bridge_clone_create(struct if_clone *ifc, int unit)
170{
struct bridge_softc *sc;
struct ifnet *ifp;
int i;

sc = malloc(sizeof(*sc), M_DEVBUF2, M_WAITOK0x0001|M_ZERO0x0008);
sc->sc_stp = bstp_create();
if (!sc->sc_stp) {
free(sc, M_DEVBUF2, sizeof *sc);
return (ENOMEM12);
}

sc->sc_brtmax = BRIDGE_RTABLE_MAX100;
sc->sc_brttimeout = BRIDGE_RTABLE_TIMEOUT240;
timeout_set(&sc->sc_brtimeout, bridge_rtage, sc);
SMR_SLIST_INIT(&sc->sc_iflist)do { (&sc->sc_iflist)->smr_slh_first = ((void *)0);
 } while (0);
SMR_SLIST_INIT(&sc->sc_spanlist)do { (&sc->sc_spanlist)->smr_slh_first = ((void *)0
); } while (0);
mtx_init(&sc->sc_mtx, IPL_MPFLOOR)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_mtx), ((((0x9)) > 0x0 && ((0x9)) < 0x9) ? 0x9
 : ((0x9)))); } while (0);
for (i = 0; i < BRIDGE_RTABLE_SIZE1024; i++)
LIST_INIT(&sc->sc_rts[i])do { ((&sc->sc_rts[i])->lh_first) = ((void *)0); } while
 (0);
arc4random_buf(&sc->sc_hashkey, sizeof(sc->sc_hashkey));
ifp = &sc->sc_if;
snprintf(ifp->if_xname, sizeof ifp->if_xname, "%s%d", ifc->ifc_name,
   unit);
ifp->if_softc = sc;
ifp->if_mtuif_data.ifi_mtu = ETHERMTU(1518 - ((6 * 2) + 2) - 4);
ifp->if_ioctl = bridge_ioctl;
ifp->if_output = bridge_dummy_output;
ifp->if_xflags = IFXF_CLONED0x2;
ifp->if_start = NULL((void *)0);
ifp->if_typeif_data.ifi_type = IFT_BRIDGE0xd1;
ifp->if_hdrlenif_data.ifi_hdrlen = ETHER_HDR_LEN((6 * 2) + 2);

if_attach(ifp);
if_alloc_sadl(ifp);

206#if NBPFILTER1 > 0
bpfattach(&sc->sc_if.if_bpf, ifp,
   DLT_EN10MB1, ETHER_HDR_LEN((6 * 2) + 2));
209#endif

return (0);
212}

214int
215bridge_dummy_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
  struct rtentry *rt)
217{
m_freem(m);
return (EAFNOSUPPORT47);
220}

222int
223bridge_clone_destroy(struct ifnet *ifp)
224{
struct bridge_softc *sc = ifp->if_softc;
struct bridge_iflist *bif;

/*
* bridge(4) detach hook doesn't need the NET_LOCK(), worst the
* use of smr_barrier() while holding the lock might lead to a
* deadlock situation.
*/
NET_ASSERT_UNLOCKED()do { int _s = rw_status(&netlock); if ((splassert_ctl >
 0) && (_s == 0x0001UL)) splassert_fail(0, 0x0001UL, __func__
); } while (0);

bridge_stop(sc);
bridge_rtflush(sc, IFBF_FLUSHALL0x1);
while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_iflist)(*(&(&sc->sc_iflist)->smr_slh_first))) != NULL((void *)0))
bridge_ifremove(bif);
while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_spanlist)(*(&(&sc->sc_spanlist)->smr_slh_first))) != NULL((void *)0))
bridge_spanremove(bif);

bstp_destroy(sc->sc_stp);

if_detach(ifp);

free(sc, M_DEVBUF2, sizeof *sc);
return (0);
248}

250int
251bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
252{
struct bridge_softc *sc = (struct bridge_softc *)ifp->if_softc;
struct ifbreq *req = (struct ifbreq *)data;
struct ifbropreq *brop = (struct ifbropreq *)data;
struct ifnet *ifs;
struct bridge_iflist *bif;
struct bstp_port *bp;
struct bstp_state *bs = sc->sc_stp;
int error = 0;

/*
* bridge(4) data structure aren't protected by the NET_LOCK().
* Idealy it shouldn't be taken before calling `ifp->if_ioctl'
* but we aren't there yet.  Media ioctl run without netlock.
*/
switch (cmd) {
case SIOCSIFMEDIA(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((55))):
case SIOCGIFMEDIA(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifmediareq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((56))):
return (ENOTTY25);
}
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);

switch (cmd) {
case SIOCBRDGADD((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((60))):
/* bridge(4) does not distinguish between routing/forwarding ports */
case SIOCBRDGADDL((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((73))):
if ((error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)) != 0)
	break;

ifs = if_unit(req->ifbr_ifsname);
if (ifs == NULL((void *)0)) {			/* no such interface */
	error = ENOENT2;
	break;
}
if (ifs->if_typeif_data.ifi_type != IFT_ETHER0x06) {
	if_put(ifs);
	error = EINVAL22;
	break;
}
if (ifs->if_bridgeidx != 0) {
	if (ifs->if_bridgeidx == ifp->if_index)
		error = EEXIST17;
	else
		error = EBUSY16;
	if_put(ifs);
	break;
}

error = ether_brport_isset(ifs);
if (error != 0) {
	if_put(ifs);
	break;
}

/* If it's in the span list, it can't be a member. */
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)for ((bif) = (*(&(&sc->sc_spanlist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
	if (bif->ifp == ifs)
		break;
}
if (bif != NULL((void *)0)) {
	if_put(ifs);
	error = EBUSY16;
	break;
}

bif = malloc(sizeof(*bif), M_DEVBUF2, M_NOWAIT0x0002|M_ZERO0x0008);
if (bif == NULL((void *)0)) {
	if_put(ifs);
	error = ENOMEM12;
	break;
}

NET_LOCK()do { rw_enter_write(&netlock); } while (0);
error = ifpromisc(ifs, 1);
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);
if (error != 0) {
	if_put(ifs);
	free(bif, M_DEVBUF2, sizeof(*bif));
	break;
}

/*
 * XXX If the NET_LOCK() or ifpromisc() calls above
 * had to sleep, then something else could have come
 * along and taken over ifs while the kernel lock was
 * released.
 */

NET_LOCK()do { rw_enter_write(&netlock); } while (0);
ifsetlro(ifs, 0);
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);

bif->bridge_sc = sc;
bif->ifp = ifs;
bif->bif_flags = IFBIF_LEARNING0x0001 | IFBIF_DISCOVER0x0002;
SIMPLEQ_INIT(&bif->bif_brlin)do { (&bif->bif_brlin)->sqh_first = ((void *)0); (&
bif->bif_brlin)->sqh_last = &(&bif->bif_brlin
)->sqh_first; } while (0);
SIMPLEQ_INIT(&bif->bif_brlout)do { (&bif->bif_brlout)->sqh_first = ((void *)0); (
&bif->bif_brlout)->sqh_last = &(&bif->bif_brlout
)->sqh_first; } while (0);
ifs->if_bridgeidx = ifp->if_index;
task_set(&bif->bif_dtask, bridge_ifdetach, bif);
if_detachhook_add(ifs, &bif->bif_dtask);
ether_brport_set(bif->ifp, &bridge_brport);
SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_iflist, bif, bif_next)do { (bif)->bif_next.smr_sle_next = (&sc->sc_iflist
)->smr_slh_first; do { __asm volatile("" ::: "memory"); } while
 (0); (&sc->sc_iflist)->smr_slh_first = (bif); } while
 (0);
break;
case SIOCBRDGDEL((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((61))):
if ((error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)) != 0)
	break;
error = bridge_findbif(sc, req->ifbr_ifsname, &bif);
if (error != 0)
	break;
bridge_ifremove(bif);
break;
case SIOCBRDGIFS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((66))):
error = bridge_bifconf(sc, (struct ifbifconf *)data);
break;
case SIOCBRDGADDS((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((65))):
if ((error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)) != 0)
	break;
ifs = if_unit(req->ifbr_ifsname);
if (ifs == NULL((void *)0)) {			/* no such interface */
	error = ENOENT2;
	break;
}
if (ifs->if_typeif_data.ifi_type != IFT_ETHER0x06) {
	if_put(ifs);
	error = EINVAL22;
	break;
}
if (ifs->if_bridgeidx != 0) {
	if (ifs->if_bridgeidx == ifp->if_index)
		error = EEXIST17;
	else
		error = EBUSY16;
	if_put(ifs);
	break;
}
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)for ((bif) = (*(&(&sc->sc_spanlist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
	if (bif->ifp == ifs)
		break;
}
if (bif != NULL((void *)0)) {
	if_put(ifs);
	error = EEXIST17;
	break;
}
bif = malloc(sizeof(*bif), M_DEVBUF2, M_NOWAIT0x0002|M_ZERO0x0008);
if (bif == NULL((void *)0)) {
	if_put(ifs);
	error = ENOMEM12;
	break;
}

NET_LOCK()do { rw_enter_write(&netlock); } while (0);
ifsetlro(ifs, 0);
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);

bif->bridge_sc = sc;
bif->ifp = ifs;
bif->bif_flags = IFBIF_SPAN0x0100;
SIMPLEQ_INIT(&bif->bif_brlin)do { (&bif->bif_brlin)->sqh_first = ((void *)0); (&
bif->bif_brlin)->sqh_last = &(&bif->bif_brlin
)->sqh_first; } while (0);
SIMPLEQ_INIT(&bif->bif_brlout)do { (&bif->bif_brlout)->sqh_first = ((void *)0); (
&bif->bif_brlout)->sqh_last = &(&bif->bif_brlout
)->sqh_first; } while (0);
task_set(&bif->bif_dtask, bridge_spandetach, bif);
if_detachhook_add(ifs, &bif->bif_dtask);
SMR_SLIST_INSERT_HEAD_LOCKED(&sc->sc_spanlist, bif, bif_next)do { (bif)->bif_next.smr_sle_next = (&sc->sc_spanlist
)->smr_slh_first; do { __asm volatile("" ::: "memory"); } while
 (0); (&sc->sc_spanlist)->smr_slh_first = (bif); } while
 (0);
break;
case SIOCBRDGDELS((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((66))):
if ((error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)) != 0)
	break;
ifs = if_unit(req->ifbr_ifsname);
if (ifs == NULL((void *)0)) {
	error = ENOENT2;
	break;
}
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)for ((bif) = (*(&(&sc->sc_spanlist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
	if (bif->ifp == ifs)
		break;
}
if_put(ifs);
if (bif == NULL((void *)0)) {
	error = ESRCH3;
	break;
}
bridge_spanremove(bif);
break;
case SIOCBRDGGIFFLGS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((62))):
error = bridge_findbif(sc, req->ifbr_ifsname, &bif);
if (error != 0)
	break;
req->ifbr_ifsflags = bif->bif_flags;
req->ifbr_portno = bif->ifp->if_index & 0xfff;
req->ifbr_protected = bif->bif_protected;
if (bif->bif_flags & IFBIF_STP0x0008)
	bridge_bifgetstp(sc, bif, req);
break;
case SIOCBRDGSIFFLGS((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((63))):
if (req->ifbr_ifsflags & IFBIF_RO_MASK0x0f00) {
	error = EINVAL22;
	break;
}
if ((error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc)) != 0)
	break;
error = bridge_findbif(sc, req->ifbr_ifsname, &bif);
if (error != 0)
	break;
if (req->ifbr_ifsflags & IFBIF_STP0x0008) {
	if ((bif->bif_flags & IFBIF_STP0x0008) == 0) {
		/* Enable STP */
		if ((bif->bif_stp = bstp_add(sc->sc_stp,
		    bif->ifp)) == NULL((void *)0)) {
			error = ENOMEM12;
			break;
		}
	} else {
		/* Update STP flags */
		bstp_ifsflags(bif->bif_stp, req->ifbr_ifsflags);
	}
} else if (bif->bif_flags & IFBIF_STP0x0008) {
	bstp_delete(bif->bif_stp);
	bif->bif_stp = NULL((void *)0);
}
bif->bif_flags = req->ifbr_ifsflags;
break;
case SIOCSIFFLAGS((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((16))):
if ((ifp->if_flags & IFF_UP0x1) == IFF_UP0x1)
	bridge_init(sc);

if ((ifp->if_flags & IFF_UP0x1) == 0)
	bridge_stop(sc);

break;
case SIOCBRDGGPARAM(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbropreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((88))):
if ((bp = bs->bs_root_port) == NULL((void *)0))
	brop->ifbop_root_port = 0;
else
	brop->ifbop_root_port = bp->bp_ifindex;
brop->ifbop_maxage = bs->bs_bridge_max_age >> 8;
brop->ifbop_hellotime = bs->bs_bridge_htime >> 8;
brop->ifbop_fwddelay = bs->bs_bridge_fdelay >> 8;
brop->ifbop_holdcount = bs->bs_txholdcount;
brop->ifbop_priority = bs->bs_bridge_priority;
brop->ifbop_protocol = bs->bs_protover;
brop->ifbop_root_bridge = bs->bs_root_pv.pv_root_id;
brop->ifbop_root_path_cost = bs->bs_root_pv.pv_cost;
brop->ifbop_root_port = bs->bs_root_pv.pv_port_id;
brop->ifbop_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
brop->ifbop_last_tc_time.tv_sec = bs->bs_last_tc_time.tv_sec;
brop->ifbop_last_tc_time.tv_usec = bs->bs_last_tc_time.tv_usec;
break;
case SIOCBRDGSIFPROT((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((74))):
error = bridge_findbif(sc, req->ifbr_ifsname, &bif);
if (error != 0)
	break;
bif->bif_protected = req->ifbr_protected;
break;
case SIOCBRDGRTS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbaconf) & 0x1fff) << 16) | ((('i')) <<
 8) | ((67))):
case SIOCBRDGGCACHE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((65))):
case SIOCBRDGGPRI(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((80))):
case SIOCBRDGGMA(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((83))):
case SIOCBRDGGHT(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((81))):
case SIOCBRDGGFD(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((82))):
case SIOCBRDGGTO(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrparam) & 0x1fff) << 16) | ((('i')) <<
 8) | ((70))):
case SIOCBRDGGRL(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbrlconf) & 0x1fff) << 16) | ((('i')) <<
 8) | ((79))):
break;
case SIOCBRDGFLUSH((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((72))):
case SIOCBRDGSADDR(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifbareq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((68))):
case SIOCBRDGDADDR((unsigned long)0x80000000 | ((sizeof(struct ifbareq) & 0x1fff
) << 16) | ((('i')) << 8) | ((71))):
case SIOCBRDGSCACHE((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((64))):
case SIOCBRDGSTO((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((69))):
case SIOCBRDGARL((unsigned long)0x80000000 | ((sizeof(struct ifbrlreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((77))):
case SIOCBRDGFRL((unsigned long)0x80000000 | ((sizeof(struct ifbrlreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((78))):
case SIOCBRDGSPRI((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((80))):
case SIOCBRDGSFD((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((82))):
case SIOCBRDGSMA((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((83))):
case SIOCBRDGSHT((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((81))):
case SIOCBRDGSTXHC((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((89))):
case SIOCBRDGSPROTO((unsigned long)0x80000000 | ((sizeof(struct ifbrparam) &
 0x1fff) << 16) | ((('i')) << 8) | ((90))):
case SIOCBRDGSIFPRIO((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((84))):
case SIOCBRDGSIFCOST((unsigned long)0x80000000 | ((sizeof(struct ifbreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((85))):
error = suser(curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
 (__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
 __ci;})->ci_curproc);
break;
default:
error = ENOTTY25;
break;
}

if (!error)
error = bridgectl_ioctl(ifp, cmd, data);

if (!error)
error = bstp_ioctl(ifp, cmd, data);

NET_LOCK()do { rw_enter_write(&netlock); } while (0);
return (error);
544}

546/* Detach an interface from a bridge.  */
547int
548bridge_ifremove(struct bridge_iflist *bif)
549{
struct bridge_softc *sc = bif->bridge_sc;
int error;

SMR_SLIST_REMOVE_LOCKED(&sc->sc_iflist, bif, bridge_iflist, bif_next)do { if ((&sc->sc_iflist)->smr_slh_first == (bif)) {
 do { ((&sc->sc_iflist))->smr_slh_first = ((&sc
->sc_iflist))->smr_slh_first->bif_next.smr_sle_next;
} while (0); } else { struct bridge_iflist *curelm = (&sc
->sc_iflist)->smr_slh_first; while (curelm->bif_next
.smr_sle_next != (bif)) curelm = curelm->bif_next.smr_sle_next
; curelm->bif_next.smr_sle_next = curelm->bif_next.smr_sle_next
->bif_next.smr_sle_next; } } while (0);
if_detachhook_del(bif->ifp, &bif->bif_dtask);
ether_brport_clr(bif->ifp);

smr_barrier()smr_barrier_impl(0);

if (bif->bif_flags & IFBIF_STP0x0008) {
bstp_delete(bif->bif_stp);
bif->bif_stp = NULL((void *)0);
}

bif->ifp->if_bridgeidx = 0;
NET_LOCK()do { rw_enter_write(&netlock); } while (0);
error = ifpromisc(bif->ifp, 0);
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);

bridge_rtdelete(sc, bif->ifp, 0);
bridge_flushrule(bif);

if_put(bif->ifp);
bif->ifp = NULL((void *)0);
free(bif, M_DEVBUF2, sizeof(*bif));

return (error);
577}

579void
580bridge_spanremove(struct bridge_iflist *bif)
581{
struct bridge_softc *sc = bif->bridge_sc;

SMR_SLIST_REMOVE_LOCKED(&sc->sc_spanlist, bif, bridge_iflist, bif_next)do { if ((&sc->sc_spanlist)->smr_slh_first == (bif)
) { do { ((&sc->sc_spanlist))->smr_slh_first = ((&
sc->sc_spanlist))->smr_slh_first->bif_next.smr_sle_next
;} while (0); } else { struct bridge_iflist *curelm = (&sc
->sc_spanlist)->smr_slh_first; while (curelm->bif_next
.smr_sle_next != (bif)) curelm = curelm->bif_next.smr_sle_next
; curelm->bif_next.smr_sle_next = curelm->bif_next.smr_sle_next
->bif_next.smr_sle_next; } } while (0);
if_detachhook_del(bif->ifp, &bif->bif_dtask);

smr_barrier()smr_barrier_impl(0);

if_put(bif->ifp);
bif->ifp = NULL((void *)0);
free(bif, M_DEVBUF2, sizeof(*bif));
592}

594void
595bridge_ifdetach(void *xbif)
596{
struct bridge_iflist *bif = xbif;

/*
* bridge(4) detach hook doesn't need the NET_LOCK(), worst the
* use of smr_barrier() while holding the lock might lead to a
* deadlock situation.
*/
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);
bridge_ifremove(bif);
NET_LOCK()do { rw_enter_write(&netlock); } while (0);
607}

609void
610bridge_spandetach(void *xbif)
611{
struct bridge_iflist *bif = xbif;

/*
* bridge(4) detach hook doesn't need the NET_LOCK(), worst the
* use of smr_barrier() while holding the lock might lead to a
* deadlock situation.
*/
NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);
bridge_spanremove(bif);
NET_LOCK()do { rw_enter_write(&netlock); } while (0);
622}

624void
625bridge_bifgetstp(struct bridge_softc *sc, struct bridge_iflist *bif,
  struct ifbreq *breq)
627{
struct bstp_state *bs = sc->sc_stp;
struct bstp_port *bp = bif->bif_stp;

breq->ifbr_state = bstp_getstate(bs, bp);
breq->ifbr_priority = bp->bp_priority;
breq->ifbr_path_cost = bp->bp_path_cost;
breq->ifbr_proto = bp->bp_protover;
breq->ifbr_role = bp->bp_role;
breq->ifbr_stpflags = bp->bp_flags;
breq->ifbr_fwd_trans = bp->bp_forward_transitions;
breq->ifbr_root_bridge = bs->bs_root_pv.pv_root_id;
breq->ifbr_root_cost = bs->bs_root_pv.pv_cost;
breq->ifbr_root_port = bs->bs_root_pv.pv_port_id;
breq->ifbr_desg_bridge = bs->bs_root_pv.pv_dbridge_id;
breq->ifbr_desg_port = bs->bs_root_pv.pv_dport_id;

/* Copy STP state options as flags */
if (bp->bp_operedge)
breq->ifbr_ifsflags |= IFBIF_BSTP_EDGE0x0010;
if (bp->bp_flags & BSTP_PORT_AUTOEDGE0x0010)
breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOEDGE0x0020;
if (bp->bp_ptp_link)
breq->ifbr_ifsflags |= IFBIF_BSTP_PTP0x0040;
if (bp->bp_flags & BSTP_PORT_AUTOPTP0x0020)
breq->ifbr_ifsflags |= IFBIF_BSTP_AUTOPTP0x0080;
653}

655int
656bridge_bifconf(struct bridge_softc *sc, struct ifbifconf *bifc)
657{
struct bridge_iflist *bif;
u_int32_t total = 0, i = 0;
int error = 0;
struct ifbreq *breq, *breqs = NULL((void *)0);

SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next)))
total++;

SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)for ((bif) = (*(&(&sc->sc_spanlist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next)))
total++;

if (bifc->ifbic_len == 0) {
i = total;
goto done;
}

breqs = mallocarray(total, sizeof(*breqs), M_TEMP127, M_NOWAIT0x0002|M_ZERO0x0008);
if (breqs == NULL((void *)0))
goto done;

SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
	break;
breq = &breqs[i];
strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ16);
strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ16);
breq->ifbr_ifsflags = bif->bif_flags;
breq->ifbr_portno = bif->ifp->if_index & 0xfff;
breq->ifbr_protected = bif->bif_protected;
if (bif->bif_flags & IFBIF_STP0x0008)
	bridge_bifgetstp(sc, bif, breq);
i++;
}
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_spanlist, bif_next)for ((bif) = (*(&(&sc->sc_spanlist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
if (bifc->ifbic_len < (i + 1) * sizeof(*breqs))
	break;
breq = &breqs[i];
strlcpy(breq->ifbr_name, sc->sc_if.if_xname, IFNAMSIZ16);
strlcpy(breq->ifbr_ifsname, bif->ifp->if_xname, IFNAMSIZ16);
breq->ifbr_ifsflags = bif->bif_flags | IFBIF_SPAN0x0100;
breq->ifbr_portno = bif->ifp->if_index & 0xfff;
i++;
}

error = copyout(breqs, bifc->ifbic_reqifbic_ifbicu.ifbicu_req, i * sizeof(*breqs));
703done:
free(breqs, M_TEMP127, total * sizeof(*breq));
bifc->ifbic_len = i * sizeof(*breq);
return (error);
707}

709int
710bridge_findbif(struct bridge_softc *sc, const char *name,
  struct bridge_iflist **rbif)
712{
struct ifnet *ifp;
struct bridge_iflist *bif;
int error = 0;

KERNEL_ASSERT_LOCKED()((_kernel_lock_held()) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/net/if_bridge.c"
, 717, "_kernel_lock_held()"));

if ((ifp = if_unit(name)) == NULL((void *)0))
return (ENOENT2);

if (ifp->if_bridgeidx != sc->sc_if.if_index) {
error = ESRCH3;
goto put;
}

SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
if (bif->ifp == ifp)
	break;
}

if (bif == NULL((void *)0)) {
error = ENOENT2;
goto put;
}

*rbif = bif;
738put:
if_put(ifp);

return (error);
742}

744struct bridge_iflist *
745bridge_getbif(struct ifnet *ifp)
746{
struct bridge_iflist *bif;
struct bridge_softc *sc;
struct ifnet *bifp;

KERNEL_ASSERT_LOCKED()((_kernel_lock_held()) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/net/if_bridge.c"
, 751, "_kernel_lock_held()"));

bifp = if_get(ifp->if_bridgeidx);
if (bifp == NULL((void *)0))
return (NULL((void *)0));

sc = bifp->if_softc;
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
if (bif->ifp == ifp)
	break;
}

if_put(bifp);

return (bif);
766}

768void
769bridge_init(struct bridge_softc *sc)
770{
struct ifnet *ifp = &sc->sc_if;

if (ISSET(ifp->if_flags, IFF_RUNNING)((ifp->if_flags) & (0x40)))
return;

bstp_enable(sc->sc_stp, ifp->if_index);

if (sc->sc_brttimeout != 0)
timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);

SET(ifp->if_flags, IFF_RUNNING)((ifp->if_flags) |= (0x40));
782}

784/*
* Stop the bridge and deallocate the routing table.
*/
787void
788bridge_stop(struct bridge_softc *sc)
789{
struct ifnet *ifp = &sc->sc_if;

if (!ISSET(ifp->if_flags, IFF_RUNNING)((ifp->if_flags) & (0x40)))
return;

CLR(ifp->if_flags, IFF_RUNNING)((ifp->if_flags) &= ~(0x40));

bstp_disable(sc->sc_stp);

timeout_del_barrier(&sc->sc_brtimeout);

bridge_rtflush(sc, IFBF_FLUSHDYN0x0);
802}

804/*
* Send output from the bridge.  The mbuf has the ethernet header
* already attached.  We must enqueue or free the mbuf before exiting.
*/
808int
809bridge_enqueue(struct ifnet *ifp, struct mbuf *m)
810{
struct ifnet *brifp;
struct ether_header *eh;
struct ifnet *dst_if = NULL((void *)0);
unsigned int dst_ifidx = 0;
815#if NBPFILTER1 > 0
caddr_t if_bpf;
817#endif
int error = 0;

if (m->m_lenm_hdr.mh_len < sizeof(*eh)) {
m = m_pullup(m, sizeof(*eh));
if (m == NULL((void *)0))
	return (ENOBUFS55);
}

/* ifp must be a member interface of the bridge. */
brifp = if_get(ifp->if_bridgeidx);
if (brifp == NULL((void *)0)) {
m_freem(m);
return (EINVAL22);
}

/*
* If bridge is down, but original output interface is up,
* go ahead and send out that interface.  Otherwise the packet
* is dropped below.
*/
if (!ISSET(brifp->if_flags, IFF_RUNNING)((brifp->if_flags) & (0x40))) {
/* Loop prevention. */
m->m_flagsm_hdr.mh_flags |= M_PROTO10x0010;
error = if_enqueue(ifp, m);
if_put(brifp);
return (error);
}

846#if NBPFILTER1 > 0
if_bpf = brifp->if_bpf;
if (if_bpf)
bpf_mtap(if_bpf, m, BPF_DIRECTION_OUT(1 << 1));
850#endif
ifp->if_opacketsif_data.ifi_opackets++;
ifp->if_obytesif_data.ifi_obytes += m->m_pkthdrM_dat.MH.MH_pkthdr.len;

bridge_span(brifp, m);

eh = mtod(m, struct ether_header *)((struct ether_header *)((m)->m_hdr.mh_data));
if (!ETHER_IS_MULTICAST(eh->ether_dhost)(*(eh->ether_dhost) & 0x01)) {
struct ether_addr *dst;

dst = (struct ether_addr *)&eh->ether_dhost[0];
dst_ifidx = bridge_rtlookup(brifp, dst, m);
}

/*
* If the packet is a broadcast or we don't know a better way to
* get there, send to all interfaces.
*/
if (dst_ifidx == 0) {
struct bridge_softc *sc = brifp->if_softc;
struct bridge_iflist *bif;
struct mbuf *mc;

smr_read_enter();
SMR_SLIST_FOREACH(bif, &sc->sc_iflist, bif_next)for ((bif) = ({ typeof(*&(&sc->sc_iflist)->smr_slh_first
) __tmp = *(volatile typeof(*&(&sc->sc_iflist)->
smr_slh_first) *)&(*&(&sc->sc_iflist)->smr_slh_first
); membar_datadep_consumer(); __tmp; }); (bif) != ((void *)0)
; (bif) = ({ typeof(*&(bif)->bif_next.smr_sle_next) __tmp
 = *(volatile typeof(*&(bif)->bif_next.smr_sle_next) *
)&(*&(bif)->bif_next.smr_sle_next); membar_datadep_consumer
(); __tmp; })) {
	dst_if = bif->ifp;
	if ((dst_if->if_flags & IFF_RUNNING0x40) == 0)
		continue;

	/*
	 * If this is not the original output interface,
	 * and the interface is participating in spanning
	 * tree, make sure the port is in a state that
	 * allows forwarding.
	 */
	if (dst_if != ifp &&
	    (bif->bif_flags & IFBIF_STP0x0008) &&
	    (bif->bif_statebif_stp->bp_state == BSTP_IFSTATE_DISCARDING5))
		continue;
	if ((bif->bif_flags & IFBIF_DISCOVER0x0002) == 0 &&
	    (m->m_flagsm_hdr.mh_flags & (M_BCAST0x0100 | M_MCAST0x0200)) == 0)
		continue;

	if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
	    BRL_ACTION_BLOCK0x01)
		continue;

	mc = m_dup_pkt(m, ETHER_ALIGN2, M_NOWAIT0x0002);
	if (mc == NULL((void *)0)) {
		brifp->if_oerrorsif_data.ifi_oerrors++;
		continue;
	}

	error = bridge_ifenqueue(brifp, dst_if, mc);
	if (error)
		continue;
}
smr_read_leave();
m_freem(m);
goto out;
}

dst_if = if_get(dst_ifidx);
if ((dst_if == NULL((void *)0)) || !ISSET(dst_if->if_flags, IFF_RUNNING)((dst_if->if_flags) & (0x40))) {
m_freem(m);
if_put(dst_if);
error = ENETDOWN50;
goto out;
}

bridge_ifenqueue(brifp, dst_if, m);
if_put(dst_if);
922out:
if_put(brifp);
return (error);
925}

927/*
* Loop through each bridge interface and process their input queues.
*/
930void
931bridgeintr(void)
932{
struct mbuf_list ml;
struct mbuf *m;
struct ifnet *ifp;

niq_delist(&bridgeintrq, &ml)mq_delist(&(&bridgeintrq)->ni_q, (&ml));
if (ml_empty(&ml)((&ml)->ml_len == 0))
1
Assuming field 'ml_len' is not equal to 0→
2
←
Taking false branch→
return;

KERNEL_LOCK()_kernel_lock();
while ((m = ml_dequeue(&ml)) != NULL((void *)0)) {
3
←
Assuming the condition is true→
4
←
Loop condition is true.  Entering loop body→

ifp = if_get(m->m_pkthdrM_dat.MH.MH_pkthdr.ph_ifidx);
if (ifp == NULL((void *)0)) {
5
←
Assuming 'ifp' is not equal to NULL→
6
←
Taking false branch→
	m_freem(m);
	continue;
}

bridge_process(ifp, m);
7
←
Calling 'bridge_process'→

if_put(ifp);
}
KERNEL_UNLOCK()_kernel_unlock();
955}

957/*
* Process a single frame.  Frame must be freed or queued before returning.
*/
960void
961bridgeintr_frame(struct ifnet *brifp, struct ifnet *src_if, struct mbuf *m)
962{
struct bridge_softc *sc = brifp->if_softc;
struct ifnet *dst_if = NULL((void *)0);
struct bridge_iflist *bif;
struct ether_addr *dst, *src;
struct ether_header eh;
unsigned int dst_ifidx;
35
←
'dst_ifidx' declared without an initial value→
u_int32_t protected;
int len;


sc->sc_if.if_ipacketsif_data.ifi_ipackets++;
sc->sc_if.if_ibytesif_data.ifi_ibytes += m->m_pkthdrM_dat.MH.MH_pkthdr.len;

bif = bridge_getbif(src_if);
KASSERT(bif != NULL)((bif != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/net/if_bridge.c"
, 977, "bif != NULL"));
36
←
Assuming 'bif' is not equal to null→
37
←
'?' condition is true→

m_copydata(m, 0, ETHER_HDR_LEN((6 * 2) + 2), &eh);
dst = (struct ether_addr *)&eh.ether_dhost[0];
src = (struct ether_addr *)&eh.ether_shost[0];

/*
* If interface is learning, and if source address
* is not broadcast or multicast, record its address.
*/
if ((bif->bif_flags & IFBIF_LEARNING0x0001) &&
38
←
Assuming the condition is false→
   !ETHER_IS_MULTICAST(eh.ether_shost)(*(eh.ether_shost) & 0x01) &&
   !ETHER_IS_ANYADDR(eh.ether_shost)(((eh.ether_shost)[0] | (eh.ether_shost)[1] | (eh.ether_shost
)[2] | (eh.ether_shost)[3] | (eh.ether_shost)[4] | (eh.ether_shost
)[5]) == 0x00))
bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC0x00, m);

if ((bif->bif_flags & IFBIF_STP0x0008) &&
39
←
Assuming the condition is false→
   (bif->bif_statebif_stp->bp_state == BSTP_IFSTATE_LEARNING2)) {
m_freem(m);
return;
}

/*
* At this point, the port either doesn't participate in stp or
* it's in the forwarding state
*/

/*
* If packet is unicast, destined for someone on "this"
* side of the bridge, drop it.
*/
if (!ETHER_IS_MULTICAST(eh.ether_dhost)(*(eh.ether_dhost) & 0x01)) {
40
←
Assuming the condition is false→
41
←
Taking false branch→
dst_ifidx = bridge_rtlookup(brifp, dst, NULL((void *)0));
if (dst_ifidx == src_if->if_index) {
	m_freem(m);
	return;
}
} else {
if (ETHER_IS_BROADCAST(eh.ether_dhost)(((eh.ether_dhost)[0] & (eh.ether_dhost)[1] & (eh.ether_dhost
)[2] & (eh.ether_dhost)[3] & (eh.ether_dhost)[4] &
 (eh.ether_dhost)[5]) == 0xff))
42
←
Assuming the condition is false→
43
←
Taking false branch→
	m->m_flagsm_hdr.mh_flags |= M_BCAST0x0100;
else
	m->m_flagsm_hdr.mh_flags |= M_MCAST0x0200;
}

/*
* Multicast packets get handled a little differently:
* If interface is:
*	-link0,-link1	(default) Forward all multicast
*			as broadcast.
*	-link0,link1	Drop non-IP multicast, forward
*			as broadcast IP multicast.
*	link0,-link1	Drop IP multicast, forward as
*			broadcast non-IP multicast.
*	link0,link1	Drop all multicast.
*/
if (m->m_flagsm_hdr.mh_flags & M_MCAST0x0200) {
44
←
Assuming the condition is false→
if ((sc->sc_if.if_flags &
    (IFF_LINK00x1000 | IFF_LINK10x2000)) ==
    (IFF_LINK00x1000 | IFF_LINK10x2000)) {
	m_freem(m);
	return;
}
if (sc->sc_if.if_flags & IFF_LINK00x1000 &&
    ETHERADDR_IS_IP_MCAST(dst)((dst)->ether_addr_octet[0] == 0x01 && (dst)->ether_addr_octet
[1] == 0x00 && (dst)->ether_addr_octet[2] == 0x5e)) {
	m_freem(m);
	return;
}
if (sc->sc_if.if_flags & IFF_LINK10x2000 &&
    !ETHERADDR_IS_IP_MCAST(dst)((dst)->ether_addr_octet[0] == 0x01 && (dst)->ether_addr_octet
[1] == 0x00 && (dst)->ether_addr_octet[2] == 0x5e)) {
	m_freem(m);
	return;
}
}

if (bif->bif_flags & IFBIF_BLOCKNONIP0x0004 && bridge_blocknonip(&eh, m)) {
45
←
Assuming the condition is false→
m_freem(m);
return;
}

if (bridge_filterrule(&bif->bif_brlin, &eh, m) == BRL_ACTION_BLOCK0x01) {
46
←
Assuming the condition is false→
47
←
Taking false branch→
m_freem(m);
return;
}
m = bridge_ip(&sc->sc_if, BRIDGE_INPF_IN, src_if, &eh, m);
if (m47.1
'm' is not equal to NULL
 == NULL((void *)0))
return;
/*
* If the packet is a multicast or broadcast OR if we don't
* know any better, forward it to all interfaces.
*/
if ((m->m_flagsm_hdr.mh_flags & (M_BCAST0x0100 | M_MCAST0x0200)) || dst_ifidx == 0) {
48
←
Assuming the condition is false→
49
←
The left operand of '==' is a garbage value
sc->sc_if.if_imcastsif_data.ifi_imcasts++;
bridge_broadcast(sc, src_if, &eh, m);
return;
}
protected = bif->bif_protected;

dst_if = if_get(dst_ifidx);
if (dst_if == NULL((void *)0))
goto bad;

/*
* At this point, we're dealing with a unicast frame going to a
* different interface
*/
if (!ISSET(dst_if->if_flags, IFF_RUNNING)((dst_if->if_flags) & (0x40)))
goto bad;
bif = bridge_getbif(dst_if);
if ((bif == NULL((void *)0)) || ((bif->bif_flags & IFBIF_STP0x0008) &&
   (bif->bif_statebif_stp->bp_state == BSTP_IFSTATE_DISCARDING5)))
goto bad;
/*
* Do not transmit if both ports are part of the same protected
* domain.
*/
if (protected != 0 && (protected & bif->bif_protected))
goto bad;
if (bridge_filterrule(&bif->bif_brlout, &eh, m) == BRL_ACTION_BLOCK0x01)
goto bad;
m = bridge_ip(&sc->sc_if, BRIDGE_OUTPF_OUT, dst_if, &eh, m);
if (m == NULL((void *)0))
goto bad;

len = m->m_pkthdrM_dat.MH.MH_pkthdr.len;
1100#if NVLAN1 > 0
if ((m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020) &&
   (dst_if->if_capabilitiesif_data.ifi_capabilities & IFCAP_VLAN_HWTAGGING0x00000020) == 0)
len += ETHER_VLAN_ENCAP_LEN4;
1104#endif
if ((len - ETHER_HDR_LEN((6 * 2) + 2)) > dst_if->if_mtuif_data.ifi_mtu)
bridge_fragment(&sc->sc_if, dst_if, &eh, m);
else {
bridge_ifenqueue(&sc->sc_if, dst_if, m);
}
m = NULL((void *)0);
1111bad:
if_put(dst_if);
m_freem(m);
1114}

1116/*
* Return 1 if `ena' belongs to `bif', 0 otherwise.
*/
1119int
1120bridge_ourether(struct ifnet *ifp, uint8_t *ena)
1121{
struct arpcom *ac = (struct arpcom *)ifp;

if (memcmp(ac->ac_enaddr, ena, ETHER_ADDR_LEN)__builtin_memcmp((ac->ac_enaddr), (ena), (6)) == 0)
return (1);

1127#if NCARP1 > 0
if (carp_ourether(ifp, ena))
return (1);
1130#endif

return (0);
1133}

1135/*
* Receive input from an interface.  Queue the packet for bridging if its
* not for us, and schedule an interrupt.
*/
1139struct mbuf *
1140bridge_input(struct ifnet *ifp, struct mbuf *m, uint64_t dst, void *null)
1141{
KASSERT(m->m_flags & M_PKTHDR)((m->m_hdr.mh_flags & 0x0002) ? (void)0 : __assert("diagnostic "
, "/usr/src/sys/net/if_bridge.c", 1142, "m->m_flags & M_PKTHDR"
));

if (m->m_flagsm_hdr.mh_flags & M_PROTO10x0010) {
m->m_flagsm_hdr.mh_flags &= ~M_PROTO10x0010;
return (m);
}

niq_enqueue(&bridgeintrq, m);

return (NULL((void *)0));
1152}

1154void
1155bridge_process(struct ifnet *ifp, struct mbuf *m)
1156{
struct ifnet *brifp;
struct bridge_softc *sc;
struct bridge_iflist *bif = NULL((void *)0), *bif0 = NULL((void *)0);
struct ether_header *eh;
struct mbuf *mc;
1162#if NBPFILTER1 > 0
caddr_t if_bpf;
1164#endif

KERNEL_ASSERT_LOCKED()((_kernel_lock_held()) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/net/if_bridge.c"
, 1166, "_kernel_lock_held()"));
8
←
Assuming the condition is true→
9
←
'?' condition is true→

brifp = if_get(ifp->if_bridgeidx);
if ((brifp == NULL((void *)0)) || !ISSET(brifp->if_flags, IFF_RUNNING)((brifp->if_flags) & (0x40)))
10
←
Assuming 'brifp' is not equal to NULL→
11
←
Assuming the condition is false→
12
←
Taking false branch→
goto reenqueue;

if (m->m_pkthdrM_dat.MH.MH_pkthdr.len < sizeof(*eh))
13
←
Assuming the condition is false→
14
←
Taking false branch→
goto bad;

1175#if NVLAN1 > 0
/*
* If the underlying interface removed the VLAN header itself,
* add it back.
*/
if (ISSET(m->m_flags, M_VLANTAG)((m->m_hdr.mh_flags) & (0x0020))) {
15
←
Assuming the condition is false→
16
←
Taking false branch→
m = vlan_inject(m, ETHERTYPE_VLAN0x8100, m->m_pkthdrM_dat.MH.MH_pkthdr.ether_vtag);
if (m == NULL((void *)0))
	goto bad;
}
1185#endif

1187#if NBPFILTER1 > 0
if_bpf = brifp->if_bpf;
if (if_bpf)
17
←
Assuming 'if_bpf' is null→
18
←
Taking false branch→
bpf_mtap_ether(if_bpf, m, BPF_DIRECTION_IN(1 << 0));
1191#endif

eh = mtod(m, struct ether_header *)((struct ether_header *)((m)->m_hdr.mh_data));

sc = brifp->if_softc;
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
19
←
Assuming 'bif' is not equal to null→
20
←
Loop condition is true.  Entering loop body→
25
←
Assuming 'bif' is equal to null→
26
←
Loop condition is false. Execution continues on line 1203→
struct arpcom *ac = (struct arpcom *)bif->ifp;
if (memcmp(ac->ac_enaddr, eh->ether_shost, ETHER_ADDR_LEN)__builtin_memcmp((ac->ac_enaddr), (eh->ether_shost), (6
)) == 0)
21
←
Assuming the condition is false→
22
←
Taking false branch→
	goto bad;
if (bif->ifp == ifp)
23
←
Assuming 'ifp' is equal to field 'ifp'→
24
←
Taking true branch→
	bif0 = bif;
}
if (bif026.1
'bif0' is not equal to NULL
 == NULL((void *)0))
27
←
Taking false branch→
goto reenqueue;

bridge_span(brifp, m);

if (ETHER_IS_MULTICAST(eh->ether_dhost)(*(eh->ether_dhost) & 0x01)) {
28
←
Assuming the condition is true→
29
←
Taking true branch→
/*
 * Reserved destination MAC addresses (01:80:C2:00:00:0x)
 * should not be forwarded to bridge members according to
 * section 7.12.6 of the 802.1D-2004 specification.  The
 * STP destination address (as stored in bstp_etheraddr)
 * is the first of these.
 */
if (memcmp(eh->ether_dhost, bstp_etheraddr,__builtin_memcmp((eh->ether_dhost), (bstp_etheraddr), (6 -
 1))
30
←
Assuming the condition is false→
    ETHER_ADDR_LEN - 1)__builtin_memcmp((eh->ether_dhost), (bstp_etheraddr), (6 -
 1)) == 0) {
	if (eh->ether_dhost[ETHER_ADDR_LEN6 - 1] == 0) {
		/* STP traffic */
		m = bstp_input(sc->sc_stp, bif0->bif_stp, eh,
		    m);
		if (m == NULL((void *)0))
			goto bad;
	} else if (eh->ether_dhost[ETHER_ADDR_LEN6 - 1] <= 0xf)
		goto bad;
}

/*
 * No need to process frames for ifs in the discarding state
 */
if ((bif0->bif_flags & IFBIF_STP0x0008) &&
31
←
Assuming the condition is false→
    (bif0->bif_statebif_stp->bp_state == BSTP_IFSTATE_DISCARDING5))
	goto reenqueue;

mc = m_dup_pkt(m, ETHER_ALIGN2, M_NOWAIT0x0002);
if (mc == NULL((void *)0))
32
←
Assuming 'mc' is not equal to NULL→
33
←
Taking false branch→
	goto reenqueue;

bridge_ifinput(ifp, mc);

bridgeintr_frame(brifp, ifp, m);
34
←
Calling 'bridgeintr_frame'→
if_put(brifp);
return;
}

/*
* Unicast, make sure it's not for us.
*/
if (bridge_ourether(bif0->ifp, eh->ether_dhost)) {
bif = bif0;
} else {
SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
	if (bif->ifp == ifp)
		continue;
	if (bridge_ourether(bif->ifp, eh->ether_dhost))
		break;
}
}
if (bif != NULL((void *)0)) {
if (bif0->bif_flags & IFBIF_LEARNING0x0001)
	bridge_rtupdate(sc,
	    (struct ether_addr *)&eh->ether_shost,
	    ifp, 0, IFBAF_DYNAMIC0x00, m);
if (bridge_filterrule(&bif0->bif_brlin, eh, m) ==
    BRL_ACTION_BLOCK0x01) {
	goto bad;
}

/* Count for the bridge */
brifp->if_ipacketsif_data.ifi_ipackets++;
brifp->if_ibytesif_data.ifi_ibytes += m->m_pkthdrM_dat.MH.MH_pkthdr.len;

ifp = bif->ifp;
goto reenqueue;
}

bridgeintr_frame(brifp, ifp, m);
if_put(brifp);
return;

1281reenqueue:
bridge_ifinput(ifp, m);
m = NULL((void *)0);
1284bad:
m_freem(m);
if_put(brifp);
1287}

1289/*
* Send a frame to all interfaces that are members of the bridge
* (except the one it came in on).
*/
1293void
1294bridge_broadcast(struct bridge_softc *sc, struct ifnet *ifp,
  struct ether_header *eh, struct mbuf *m)
1296{
struct bridge_iflist *bif;
struct mbuf *mc;
struct ifnet *dst_if;
int len, used = 0;
u_int32_t protected;

bif = bridge_getbif(ifp);
KASSERT(bif != NULL)((bif != ((void *)0)) ? (void)0 : __assert("diagnostic ", "/usr/src/sys/net/if_bridge.c"
, 1304, "bif != NULL"));
protected = bif->bif_protected;

SMR_SLIST_FOREACH_LOCKED(bif, &sc->sc_iflist, bif_next)for ((bif) = (*(&(&sc->sc_iflist)->smr_slh_first
)); (bif) != ((void *)0); (bif) = (*(&(bif)->bif_next.
smr_sle_next))) {
dst_if = bif->ifp;

if ((dst_if->if_flags & IFF_RUNNING0x40) == 0)
	continue;

if ((bif->bif_flags & IFBIF_STP0x0008) &&
    (bif->bif_statebif_stp->bp_state == BSTP_IFSTATE_DISCARDING5))
	continue;

if ((bif->bif_flags & IFBIF_DISCOVER0x0002) == 0 &&
    (m->m_flagsm_hdr.mh_flags & (M_BCAST0x0100 | M_MCAST0x0200)) == 0)
	continue;

/* Drop non-IP frames if the appropriate flag is set. */
if (bif->bif_flags & IFBIF_BLOCKNONIP0x0004 &&
    bridge_blocknonip(eh, m))
	continue;

/*
 * Do not transmit if both ports are part of the same
 * protected domain.
 */
if (protected != 0 && (protected & bif->bif_protected))
	continue;

if (bridge_filterrule(&bif->bif_brlout, eh, m) ==
    BRL_ACTION_BLOCK0x01)
	continue;

/*
 * Don't retransmit out of the same interface where
 * the packet was received from.
 */
if (dst_if->if_index == ifp->if_index)
	continue;

if (bridge_localbroadcast(dst_if, eh, m))
	sc->sc_if.if_oerrorsif_data.ifi_oerrors++;

/* If last one, reuse the passed-in mbuf */
if (SMR_SLIST_NEXT_LOCKED(bif, bif_next)(*(&(bif)->bif_next.smr_sle_next)) == NULL((void *)0)) {
	mc = m;
	used = 1;
} else {
	mc = m_dup_pkt(m, ETHER_ALIGN2, M_NOWAIT0x0002);
	if (mc == NULL((void *)0)) {
		sc->sc_if.if_oerrorsif_data.ifi_oerrors++;
		continue;
	}
}

mc = bridge_ip(&sc->sc_if, BRIDGE_OUTPF_OUT, dst_if, eh, mc);
if (mc == NULL((void *)0))
	continue;

len = mc->m_pkthdrM_dat.MH.MH_pkthdr.len;
1364#if NVLAN1 > 0
if ((mc->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020) &&
    (dst_if->if_capabilitiesif_data.ifi_capabilities & IFCAP_VLAN_HWTAGGING0x00000020) == 0)
	len += ETHER_VLAN_ENCAP_LEN4;
1368#endif
if ((len - ETHER_HDR_LEN((6 * 2) + 2)) > dst_if->if_mtuif_data.ifi_mtu)
	bridge_fragment(&sc->sc_if, dst_if, eh, mc);
else {
	bridge_ifenqueue(&sc->sc_if, dst_if, mc);
}
}

if (!used)
m_freem(m);
1378}

1380int
1381bridge_localbroadcast(struct ifnet *ifp, struct ether_header *eh,
  struct mbuf *m)
1383{
struct mbuf *m1;
u_int16_t etype;

/*
* quick optimisation, don't send packets up the stack if no
* corresponding address has been specified.
*/
etype = ntohs(eh->ether_type)(__uint16_t)(__builtin_constant_p(eh->ether_type) ? (__uint16_t
)(((__uint16_t)(eh->ether_type) & 0xffU) << 8 | (
(__uint16_t)(eh->ether_type) & 0xff00U) >> 8) : __swap16md
(eh->ether_type));
if (!(m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020) && etype == ETHERTYPE_IP0x0800) {
struct ifaddr *ifa;
TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)for((ifa) = ((&ifp->if_addrlist)->tqh_first); (ifa)
 != ((void *)0); (ifa) = ((ifa)->ifa_list.tqe_next)) {
	if (ifa->ifa_addr->sa_family == AF_INET2)
		break;
}
if (ifa == NULL((void *)0))
	return (0);
}

m1 = m_dup_pkt(m, ETHER_ALIGN2, M_NOWAIT0x0002);
if (m1 == NULL((void *)0))
return (1);

1406#if NPF1 > 0
pf_pkt_addr_changed(m1);
1408#endif	/* NPF */

bridge_ifinput(ifp, m1);

return (0);
1413}

1415void
1416bridge_span(struct ifnet *brifp, struct mbuf *m)
1417{
struct bridge_softc *sc = brifp->if_softc;
struct bridge_iflist *bif;
struct ifnet *ifp;
struct mbuf *mc;
int error;

smr_read_enter();
SMR_SLIST_FOREACH(bif, &sc->sc_spanlist, bif_next)for ((bif) = ({ typeof(*&(&sc->sc_spanlist)->smr_slh_first
) __tmp = *(volatile typeof(*&(&sc->sc_spanlist)->
smr_slh_first) *)&(*&(&sc->sc_spanlist)->smr_slh_first
); membar_datadep_consumer(); __tmp; }); (bif) != ((void *)0)
; (bif) = ({ typeof(*&(bif)->bif_next.smr_sle_next) __tmp
 = *(volatile typeof(*&(bif)->bif_next.smr_sle_next) *
)&(*&(bif)->bif_next.smr_sle_next); membar_datadep_consumer
(); __tmp; })) {
ifp = bif->ifp;

if ((ifp->if_flags & IFF_RUNNING0x40) == 0)
	continue;

mc = m_copym(m, 0, M_COPYALL1000000000, M_DONTWAIT0x0002);
if (mc == NULL((void *)0)) {
	brifp->if_oerrorsif_data.ifi_oerrors++;
	continue;
}

error = bridge_ifenqueue(brifp, ifp, mc);
if (error)
	continue;
}
smr_read_leave();
1442}

1444/*
* Block non-ip frames:
* Returns 0 if frame is ip, and 1 if it should be dropped.
*/
1448int
1449bridge_blocknonip(struct ether_header *eh, struct mbuf *m)
1450{
struct llc llc;
u_int16_t etype;

if (m->m_pkthdrM_dat.MH.MH_pkthdr.len < ETHER_HDR_LEN((6 * 2) + 2))
return (1);

1457#if NVLAN1 > 0
if (m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020)
return (1);
1460#endif

etype = ntohs(eh->ether_type)(__uint16_t)(__builtin_constant_p(eh->ether_type) ? (__uint16_t
)(((__uint16_t)(eh->ether_type) & 0xffU) << 8 | (
(__uint16_t)(eh->ether_type) & 0xff00U) >> 8) : __swap16md
(eh->ether_type));
switch (etype) {
case ETHERTYPE_ARP0x0806:
case ETHERTYPE_REVARP0x8035:
case ETHERTYPE_IP0x0800:
case ETHERTYPE_IPV60x86DD:
return (0);
}

if (etype > ETHERMTU(1518 - ((6 * 2) + 2) - 4))
return (1);

if (m->m_pkthdrM_dat.MH.MH_pkthdr.len <
   (ETHER_HDR_LEN((6 * 2) + 2) + LLC_SNAPFRAMELEN8))
return (1);

m_copydata(m, ETHER_HDR_LEN((6 * 2) + 2), LLC_SNAPFRAMELEN8, &llc);

etype = ntohs(llc.llc_snap.ether_type)(__uint16_t)(__builtin_constant_p(llc.llc_un.type_snap.ether_type
) ? (__uint16_t)(((__uint16_t)(llc.llc_un.type_snap.ether_type
) & 0xffU) << 8 | ((__uint16_t)(llc.llc_un.type_snap
.ether_type) & 0xff00U) >> 8) : __swap16md(llc.llc_un
.type_snap.ether_type));
if (llc.llc_dsap == LLC_SNAP_LSAP0xaa &&
   llc.llc_ssap == LLC_SNAP_LSAP0xaa &&
   llc.llc_controlllc_un.type_u.control == LLC_UI0x3 &&
   llc.llc_snapllc_un.type_snap.org_code[0] == 0 &&
   llc.llc_snapllc_un.type_snap.org_code[1] == 0 &&
   llc.llc_snapllc_un.type_snap.org_code[2] == 0 &&
   (etype == ETHERTYPE_ARP0x0806 || etype == ETHERTYPE_REVARP0x8035 ||
   etype == ETHERTYPE_IP0x0800 || etype == ETHERTYPE_IPV60x86DD)) {
return (0);
}

return (1);
1493}

1495#ifdef IPSEC1
1496int
1497bridge_ipsec(struct ifnet *ifp, struct ether_header *eh, int hassnap,
  struct llc *llc, int dir, int af, int hlen, struct mbuf *m)
1499{
union sockaddr_union dst;
struct tdb *tdb;
u_int32_t spi;
u_int16_t cpi;
int error, off, prot;
u_int8_t proto = 0;
struct ip *ip;
1507#ifdef INET61
struct ip6_hdr *ip6;
1509#endif /* INET6 */
1510#if NPF1 > 0
struct ifnet *encif;
1512#endif

if (dir == BRIDGE_INPF_IN) {
switch (af) {
case AF_INET2:
	if (m->m_pkthdrM_dat.MH.MH_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
		goto skiplookup;

	ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
	proto = ip->ip_p;
	off = offsetof(struct ip, ip_p)__builtin_offsetof(struct ip, ip_p);

	if (proto != IPPROTO_ESP50 && proto != IPPROTO_AH51 &&
	    proto != IPPROTO_IPCOMP108)
		goto skiplookup;

	bzero(&dst, sizeof(union sockaddr_union))__builtin_bzero((&dst), (sizeof(union sockaddr_union)));
	dst.sa.sa_family = AF_INET2;
	dst.sin.sin_len = sizeof(struct sockaddr_in);
	m_copydata(m, offsetof(struct ip, ip_dst)__builtin_offsetof(struct ip, ip_dst),
	    sizeof(struct in_addr), &dst.sin.sin_addr);

	break;
1535#ifdef INET61
case AF_INET624:
	if (m->m_pkthdrM_dat.MH.MH_pkthdr.len - hlen < 2 * sizeof(u_int32_t))
		goto skiplookup;

	ip6 = mtod(m, struct ip6_hdr *)((struct ip6_hdr *)((m)->m_hdr.mh_data));

	/* XXX We should chase down the header chain */
	proto = ip6->ip6_nxtip6_ctlun.ip6_un1.ip6_un1_nxt;
	off = offsetof(struct ip6_hdr, ip6_nxt)__builtin_offsetof(struct ip6_hdr, ip6_ctlun.ip6_un1.ip6_un1_nxt
);

	if (proto != IPPROTO_ESP50 && proto != IPPROTO_AH51 &&
	    proto != IPPROTO_IPCOMP108)
		goto skiplookup;

	bzero(&dst, sizeof(union sockaddr_union))__builtin_bzero((&dst), (sizeof(union sockaddr_union)));
	dst.sa.sa_family = AF_INET624;
	dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
	m_copydata(m, offsetof(struct ip6_hdr, ip6_dst)__builtin_offsetof(struct ip6_hdr, ip6_dst),
	    sizeof(struct in6_addr), &dst.sin6.sin6_addr);

	break;
1557#endif /* INET6 */
default:
	return (0);
}

switch (proto) {
case IPPROTO_ESP50:
	m_copydata(m, hlen, sizeof(u_int32_t), &spi);
	break;
case IPPROTO_AH51:
	m_copydata(m, hlen + sizeof(u_int32_t),
	    sizeof(u_int32_t), &spi);
	break;
case IPPROTO_IPCOMP108:
	m_copydata(m, hlen + sizeof(u_int16_t),
	    sizeof(u_int16_t), &cpi);
	spi = htonl(ntohs(cpi))(__uint32_t)(__builtin_constant_p((__uint16_t)(__builtin_constant_p
(cpi) ? (__uint16_t)(((__uint16_t)(cpi) & 0xffU) <<
| ((__uint16_t)(cpi) & 0xff00U) >> 8) : __swap16md
(cpi))) ? (__uint32_t)(((__uint32_t)((__uint16_t)(__builtin_constant_p
(cpi) ? (__uint16_t)(((__uint16_t)(cpi) & 0xffU) <<
| ((__uint16_t)(cpi) & 0xff00U) >> 8) : __swap16md
(cpi))) & 0xff) << 24 | ((__uint32_t)((__uint16_t)(
__builtin_constant_p(cpi) ? (__uint16_t)(((__uint16_t)(cpi) &
 0xffU) << 8 | ((__uint16_t)(cpi) & 0xff00U) >>
 8) : __swap16md(cpi))) & 0xff00) << 8 | ((__uint32_t
)((__uint16_t)(__builtin_constant_p(cpi) ? (__uint16_t)(((__uint16_t
)(cpi) & 0xffU) << 8 | ((__uint16_t)(cpi) & 0xff00U
) >> 8) : __swap16md(cpi))) & 0xff0000) >> 8 |
 ((__uint32_t)((__uint16_t)(__builtin_constant_p(cpi) ? (__uint16_t
)(((__uint16_t)(cpi) & 0xffU) << 8 | ((__uint16_t)(
cpi) & 0xff00U) >> 8) : __swap16md(cpi))) & 0xff000000
) >> 24) : __swap32md((__uint16_t)(__builtin_constant_p
(cpi) ? (__uint16_t)(((__uint16_t)(cpi) & 0xffU) <<
| ((__uint16_t)(cpi) & 0xff00U) >> 8) : __swap16md
(cpi))));
	break;
}

NET_ASSERT_LOCKED()do { int _s = rw_status(&netlock); if ((splassert_ctl >
 0) && (_s != 0x0001UL && _s != 0x0002UL)) splassert_fail
(0x0002UL, _s, __func__); } while (0);

tdb = gettdb(ifp->if_rdomain, spi, &dst, proto)gettdb_dir((ifp->if_data.ifi_rdomain),(spi),(&dst),(proto
),0);
if (tdb != NULL((void *)0) && (tdb->tdb_flags & TDBF_INVALID0x00010) == 0 &&
    tdb->tdb_xform != NULL((void *)0)) {
	if (tdb->tdb_first_use == 0) {
		tdb->tdb_first_use = gettime();
		if (tdb->tdb_flags & TDBF_FIRSTUSE0x00020) {
			if (timeout_add_sec(
			    &tdb->tdb_first_tmo,
			    tdb->tdb_exp_first_use))
				tdb_ref(tdb);
		}
		if (tdb->tdb_flags & TDBF_SOFT_FIRSTUSE0x00400) {
			if (timeout_add_sec(
			    &tdb->tdb_sfirst_tmo,
			    tdb->tdb_soft_first_use))
				tdb_ref(tdb);
		}
	}

	prot = (*(tdb->tdb_xform->xf_input))(&m, tdb, hlen,
	    off);
	tdb_unref(tdb);
	if (prot != IPPROTO_DONE257)
		ip_deliver(&m, &hlen, prot, af);
	return (1);
} else {
	tdb_unref(tdb);
skiplookup:
	/* XXX do an input policy lookup */
	return (0);
}
} else { /* Outgoing from the bridge. */
error = ipsp_spd_lookup(m, af, hlen, IPSP_DIRECTION_OUT0x2,
    NULL((void *)0), NULL((void *)0), &tdb, NULL((void *)0));
if (error == 0 && tdb != NULL((void *)0)) {
	/*
	 * We don't need to do loop detection, the
	 * bridge will do that for us.
	 */
1618#if NPF1 > 0
	if ((encif = enc_getif(tdb->tdb_rdomain,
	    tdb->tdb_tap)) == NULL((void *)0) ||
	    pf_test(af, dir, encif, &m) != PF_PASS) {
		m_freem(m);
		tdb_unref(tdb);
		return (1);
	}
	if (m == NULL((void *)0)) {
		tdb_unref(tdb);
		return (1);
	}
	if (af == AF_INET2)
		in_proto_cksum_out(m, encif);
1632#ifdef INET61
	else if (af == AF_INET624)
		in6_proto_cksum_out(m, encif);
1635#endif /* INET6 */
1636#endif /* NPF */

	ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
	if ((af == AF_INET2) &&
	    ip_mtudisc && (ip->ip_off & htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000))) &&
	    tdb->tdb_mtu && ntohs(ip->ip_len)(__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) > tdb->tdb_mtu &&
	    tdb->tdb_mtutimeout > gettime()) {
		bridge_send_icmp_err(ifp, eh, m,
		    hassnap, llc, tdb->tdb_mtu,
		    ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4);
	} else {
		KERNEL_LOCK()_kernel_lock();
		error = ipsp_process_packet(m, tdb, af, 0);
		KERNEL_UNLOCK()_kernel_unlock();
	}
	tdb_unref(tdb);
	return (1);
} else
	return (0);
}

return (0);
1658}
1659#endif /* IPSEC */

1661/*
* Filter IP packets by peeking into the ethernet frame.  This violates
* the ISO model, but allows us to act as a IP filter at the data link
* layer.  As a result, most of this code will look familiar to those
* who've read net/if_ethersubr.c and netinet/ip_input.c
*/
1667struct mbuf *
1668bridge_ip(struct ifnet *brifp, int dir, struct ifnet *ifp,
  struct ether_header *eh, struct mbuf *m)
1670{
struct llc llc;
int hassnap = 0;
struct ip *ip;
int hlen;
u_int16_t etype;

1677#if NVLAN1 > 0
if (m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020)
return (m);
1680#endif

etype = ntohs(eh->ether_type)(__uint16_t)(__builtin_constant_p(eh->ether_type) ? (__uint16_t
)(((__uint16_t)(eh->ether_type) & 0xffU) << 8 | (
(__uint16_t)(eh->ether_type) & 0xff00U) >> 8) : __swap16md
(eh->ether_type));

if (etype != ETHERTYPE_IP0x0800 && etype != ETHERTYPE_IPV60x86DD) {
if (etype > ETHERMTU(1518 - ((6 * 2) + 2) - 4) ||
    m->m_pkthdrM_dat.MH.MH_pkthdr.len < (LLC_SNAPFRAMELEN8 +
    ETHER_HDR_LEN((6 * 2) + 2)))
	return (m);

m_copydata(m, ETHER_HDR_LEN((6 * 2) + 2), LLC_SNAPFRAMELEN8, &llc);

if (llc.llc_dsap != LLC_SNAP_LSAP0xaa ||
    llc.llc_ssap != LLC_SNAP_LSAP0xaa ||
    llc.llc_controlllc_un.type_u.control != LLC_UI0x3 ||
    llc.llc_snapllc_un.type_snap.org_code[0] ||
    llc.llc_snapllc_un.type_snap.org_code[1] ||
    llc.llc_snapllc_un.type_snap.org_code[2])
	return (m);

etype = ntohs(llc.llc_snap.ether_type)(__uint16_t)(__builtin_constant_p(llc.llc_un.type_snap.ether_type
) ? (__uint16_t)(((__uint16_t)(llc.llc_un.type_snap.ether_type
) & 0xffU) << 8 | ((__uint16_t)(llc.llc_un.type_snap
.ether_type) & 0xff00U) >> 8) : __swap16md(llc.llc_un
.type_snap.ether_type));
if (etype != ETHERTYPE_IP0x0800 && etype != ETHERTYPE_IPV60x86DD)
	return (m);
hassnap = 1;
}

m_adj(m, ETHER_HDR_LEN((6 * 2) + 2));
if (hassnap)
m_adj(m, LLC_SNAPFRAMELEN8);

switch (etype) {

case ETHERTYPE_IP0x0800:
m = ipv4_check(ifp, m);
if (m == NULL((void *)0))
	return (NULL((void *)0));

ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
hlen = ip->ip_hl << 2;

1720#ifdef IPSEC1
if ((brifp->if_flags & IFF_LINK20x4000) == IFF_LINK20x4000 &&
    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET2, hlen, m))
	return (NULL((void *)0));
1724#endif /* IPSEC */
1725#if NPF1 > 0
/* Finally, we get to filter the packet! */
if (pf_test(AF_INET2, dir, ifp, &m) != PF_PASS)
	goto dropit;
if (m == NULL((void *)0))
	goto dropit;
1731#endif /* NPF > 0 */

/* Rebuild the IP header */
if (m->m_lenm_hdr.mh_len < hlen && ((m = m_pullup(m, hlen)) == NULL((void *)0)))
	return (NULL((void *)0));
if (m->m_lenm_hdr.mh_len < sizeof(struct ip))
	goto dropit;
in_hdr_cksum_out(m, ifp);
in_proto_cksum_out(m, ifp);

1741#if NPF1 > 0
if (dir == BRIDGE_INPF_IN &&
    m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags & PF_TAG_DIVERTED0x08) {
	m_resethdr(m);
	m->m_pkthdrM_dat.MH.MH_pkthdr.ph_ifidx = ifp->if_index;
	m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid = ifp->if_rdomainif_data.ifi_rdomain;
	ipv4_input(ifp, m);
	return (NULL((void *)0));
}
1750#endif /* NPF > 0 */

break;

1754#ifdef INET61
case ETHERTYPE_IPV60x86DD:
m = ipv6_check(ifp, m);
if (m == NULL((void *)0))
	return (NULL((void *)0));

1760#ifdef IPSEC1
hlen = sizeof(struct ip6_hdr);

if ((brifp->if_flags & IFF_LINK20x4000) == IFF_LINK20x4000 &&
    bridge_ipsec(ifp, eh, hassnap, &llc, dir, AF_INET624, hlen,
    m))
	return (NULL((void *)0));
1767#endif /* IPSEC */

1769#if NPF1 > 0
if (pf_test(AF_INET624, dir, ifp, &m) != PF_PASS)
	goto dropit;
if (m == NULL((void *)0))
	return (NULL((void *)0));
1774#endif /* NPF > 0 */
in6_proto_cksum_out(m, ifp);

1777#if NPF1 > 0
if (dir == BRIDGE_INPF_IN &&
    m->m_pkthdrM_dat.MH.MH_pkthdr.pf.flags & PF_TAG_DIVERTED0x08) {
	m_resethdr(m);
	m->m_pkthdrM_dat.MH.MH_pkthdr.ph_ifidx = ifp->if_index;
	m->m_pkthdrM_dat.MH.MH_pkthdr.ph_rtableid = ifp->if_rdomainif_data.ifi_rdomain;
	ipv6_input(ifp, m);
	return (NULL((void *)0));
}
1786#endif /* NPF > 0 */

break;
1789#endif /* INET6 */

default:
goto dropit;
break;
}

/* Reattach SNAP header */
if (hassnap) {
M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT)(m) = m_prepend((m), (8), (0x0002));
if (m == NULL((void *)0))
	goto dropit;
bcopy(&llc, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), LLC_SNAPFRAMELEN8);
}

/* Reattach ethernet header */
M_PREPEND(m, sizeof(*eh), M_DONTWAIT)(m) = m_prepend((m), (sizeof(*eh)), (0x0002));
if (m == NULL((void *)0))
goto dropit;
bcopy(eh, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), sizeof(*eh));

return (m);

1812dropit:
m_freem(m);
return (NULL((void *)0));
1815}

1817void
1818bridge_fragment(struct ifnet *brifp, struct ifnet *ifp, struct ether_header *eh,
  struct mbuf *m)
1820{
struct llc llc;
struct mbuf_list ml;
int error = 0;
int hassnap = 0;
u_int16_t etype;
struct ip *ip;

etype = ntohs(eh->ether_type)(__uint16_t)(__builtin_constant_p(eh->ether_type) ? (__uint16_t
)(((__uint16_t)(eh->ether_type) & 0xffU) << 8 | (
(__uint16_t)(eh->ether_type) & 0xff00U) >> 8) : __swap16md
(eh->ether_type));
1829#if NVLAN1 > 0
if ((m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020) || etype == ETHERTYPE_VLAN0x8100 ||
   etype == ETHERTYPE_QINQ0x88A8) {
int len = m->m_pkthdrM_dat.MH.MH_pkthdr.len;

if (m->m_flagsm_hdr.mh_flags & M_VLANTAG0x0020)
	len += ETHER_VLAN_ENCAP_LEN4;
if ((ifp->if_capabilitiesif_data.ifi_capabilities & IFCAP_VLAN_MTU0x00000010) &&
    (len - sizeof(struct ether_vlan_header) <= ifp->if_mtuif_data.ifi_mtu)) {
	bridge_ifenqueue(brifp, ifp, m);
	return;
}
goto dropit;
}
1843#endif
if (etype != ETHERTYPE_IP0x0800) {
if (etype > ETHERMTU(1518 - ((6 * 2) + 2) - 4) ||
    m->m_pkthdrM_dat.MH.MH_pkthdr.len < (LLC_SNAPFRAMELEN8 +
    ETHER_HDR_LEN((6 * 2) + 2)))
	goto dropit;

m_copydata(m, ETHER_HDR_LEN((6 * 2) + 2), LLC_SNAPFRAMELEN8, &llc);

if (llc.llc_dsap != LLC_SNAP_LSAP0xaa ||
    llc.llc_ssap != LLC_SNAP_LSAP0xaa ||
    llc.llc_controlllc_un.type_u.control != LLC_UI0x3 ||
    llc.llc_snapllc_un.type_snap.org_code[0] ||
    llc.llc_snapllc_un.type_snap.org_code[1] ||
    llc.llc_snapllc_un.type_snap.org_code[2] ||
    llc.llc_snapllc_un.type_snap.ether_type != htons(ETHERTYPE_IP)(__uint16_t)(__builtin_constant_p(0x0800) ? (__uint16_t)(((__uint16_t
)(0x0800) & 0xffU) << 8 | ((__uint16_t)(0x0800) &
 0xff00U) >> 8) : __swap16md(0x0800)))
	goto dropit;

hassnap = 1;
}

m_adj(m, ETHER_HDR_LEN((6 * 2) + 2));
if (hassnap)
m_adj(m, LLC_SNAPFRAMELEN8);

if (m->m_lenm_hdr.mh_len < sizeof(struct ip) &&
   (m = m_pullup(m, sizeof(struct ip))) == NULL((void *)0))
goto dropit;
ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));

/* Respect IP_DF, return a ICMP_UNREACH_NEEDFRAG. */
if (ip->ip_off & htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000))) {
bridge_send_icmp_err(ifp, eh, m, hassnap, &llc,
    ifp->if_mtuif_data.ifi_mtu, ICMP_UNREACH3, ICMP_UNREACH_NEEDFRAG4);
return;
}

error = ip_fragment(m, &ml, ifp, ifp->if_mtuif_data.ifi_mtu);
if (error)
return;

while ((m = ml_dequeue(&ml)) != NULL((void *)0)) {
if (hassnap) {
	M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT)(m) = m_prepend((m), (8), (0x0002));
	if (m == NULL((void *)0)) {
		error = ENOBUFS55;
		break;
	}
	bcopy(&llc, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), LLC_SNAPFRAMELEN8);
}
M_PREPEND(m, sizeof(*eh), M_DONTWAIT)(m) = m_prepend((m), (sizeof(*eh)), (0x0002));
if (m == NULL((void *)0)) {
	error = ENOBUFS55;
	break;
}
bcopy(eh, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), sizeof(*eh));
error = bridge_ifenqueue(brifp, ifp, m);
if (error)
	break;
}
if (error)
ml_purge(&ml);
else
ipstat_inc(ips_fragmented);

return;
dropit:
m_freem(m);
1911}

1913int
1914bridge_ifenqueue(struct ifnet *brifp, struct ifnet *ifp, struct mbuf *m)
1915{
int error, len;

/* Loop prevention. */
m->m_flagsm_hdr.mh_flags |= M_PROTO10x0010;

len = m->m_pkthdrM_dat.MH.MH_pkthdr.len;

error = if_enqueue(ifp, m);
if (error) {
brifp->if_oerrorsif_data.ifi_oerrors++;
return (error);
}

brifp->if_opacketsif_data.ifi_opackets++;
brifp->if_obytesif_data.ifi_obytes += len;

return (0);
1933}

1935void
1936bridge_ifinput(struct ifnet *ifp, struct mbuf *m)
1937{
struct mbuf_list ml = MBUF_LIST_INITIALIZER(){ ((void *)0), ((void *)0), 0 };

m->m_flagsm_hdr.mh_flags |= M_PROTO10x0010;

ml_enqueue(&ml, m);
if_input(ifp, &ml);
1944}

1946void
1947bridge_send_icmp_err(struct ifnet *ifp,
  struct ether_header *eh, struct mbuf *n, int hassnap, struct llc *llc,
  int mtu, int type, int code)
1950{
struct ip *ip;
struct icmp *icp;
struct in_addr t;
struct mbuf *m, *n2;
int hlen;
u_int8_t ether_tmp[ETHER_ADDR_LEN6];

n2 = m_copym(n, 0, M_COPYALL1000000000, M_DONTWAIT0x0002);
if (!n2) {
m_freem(n);
return;
}
m = icmp_do_error(n, type, code, 0, mtu);
if (m == NULL((void *)0)) {
m_freem(n2);
return;
}

n = n2;

ip = mtod(m, struct ip *)((struct ip *)((m)->m_hdr.mh_data));
hlen = ip->ip_hl << 2;
t = ip->ip_dst;
ip->ip_dst = ip->ip_src;
ip->ip_src = t;

m->m_datam_hdr.mh_data += hlen;
m->m_lenm_hdr.mh_len -= hlen;
icp = mtod(m, struct icmp *)((struct icmp *)((m)->m_hdr.mh_data));
icp->icmp_cksum = 0;
icp->icmp_cksum = in_cksum(m, ntohs(ip->ip_len)(__uint16_t)(__builtin_constant_p(ip->ip_len) ? (__uint16_t
)(((__uint16_t)(ip->ip_len) & 0xffU) << 8 | ((__uint16_t
)(ip->ip_len) & 0xff00U) >> 8) : __swap16md(ip->
ip_len)) - hlen);
m->m_datam_hdr.mh_data -= hlen;
m->m_lenm_hdr.mh_len += hlen;

ip->ip_v = IPVERSION4;
ip->ip_off &= htons(IP_DF)(__uint16_t)(__builtin_constant_p(0x4000) ? (__uint16_t)(((__uint16_t
)(0x4000) & 0xffU) << 8 | ((__uint16_t)(0x4000) &
 0xff00U) >> 8) : __swap16md(0x4000));
ip->ip_id = htons(ip_randomid())(__uint16_t)(__builtin_constant_p(ip_randomid()) ? (__uint16_t
)(((__uint16_t)(ip_randomid()) & 0xffU) << 8 | ((__uint16_t
)(ip_randomid()) & 0xff00U) >> 8) : __swap16md(ip_randomid
()));
ip->ip_ttl = MAXTTL255;
in_hdr_cksum_out(m, NULL((void *)0));

/* Swap ethernet addresses */
bcopy(&eh->ether_dhost, &ether_tmp, sizeof(ether_tmp));
bcopy(&eh->ether_shost, &eh->ether_dhost, sizeof(ether_tmp));
bcopy(&ether_tmp, &eh->ether_shost, sizeof(ether_tmp));

/* Reattach SNAP header */
if (hassnap) {
M_PREPEND(m, LLC_SNAPFRAMELEN, M_DONTWAIT)(m) = m_prepend((m), (8), (0x0002));
if (m == NULL((void *)0))
	goto dropit;
bcopy(llc, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), LLC_SNAPFRAMELEN8);
}

/* Reattach ethernet header */
M_PREPEND(m, sizeof(*eh), M_DONTWAIT)(m) = m_prepend((m), (sizeof(*eh)), (0x0002));
if (m == NULL((void *)0))
goto dropit;
bcopy(eh, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), sizeof(*eh));

bridge_enqueue(ifp, m);
m_freem(n);
return;

dropit:
m_freem(n);
2016}

2018void
2019bridge_take(void *unused)
2020{
return;
2022}

2024void
2025bridge_rele(void *unused)
2026{
return;
2028}