summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorJason Wright <jason@cvs.openbsd.org>2000-02-21 17:38:08 +0000
committerJason Wright <jason@cvs.openbsd.org>2000-02-21 17:38:08 +0000
commitaab558c85dbe34564dcc9027ecba5ffbbf2e0b1c (patch)
tree95650778314175246c46054e9c6a38b30879ca08 /sys
parent021c7d76099397dc741ceddd3927981f3b13b7b7 (diff)
Rework bridge_filter() so that it does not require a full packet copy
Allow for reusing the current mbuf (rather than a copy) for the last interface in the list in bridge_output(). Replace some pointer derefs with on the stack copies of the data.
Diffstat (limited to 'sys')
-rw-r--r--sys/net/if_bridge.c356
1 files changed, 184 insertions, 172 deletions
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 1ce9c96cdd6..f98e4e6fa2e 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: if_bridge.c,v 1.26 2000/02/19 08:59:05 niklas Exp $ */
+/* $OpenBSD: if_bridge.c,v 1.27 2000/02/21 17:38:07 jason Exp $ */
/*
* Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
@@ -94,13 +94,6 @@
#define BRIDGE_RTABLE_TIMEOUT 240
#endif
-/*
- * This really should be defined in if_llc.h but in case it isn't.
- */
-#ifndef llc_snap
-#define llc_snap llc_un.type_snap
-#endif
-
extern int ifqmaxlen;
/*
@@ -148,12 +141,13 @@ struct bridge_softc {
LIST_HEAD(bridge_rthead, bridge_rtnode) *sc_rts;/* hash table */
};
-/*
- * Ethernet header and SNAP header
- */
-struct ehllc {
- struct ether_header eh;
- struct llc llc;
+/* SNAP LLC header */
+struct snap {
+ u_int8_t dsap;
+ u_int8_t ssap;
+ u_int8_t control;
+ u_int8_t org[3];
+ u_int16_t type;
};
struct bridge_softc bridgectl[NBRIDGE];
@@ -179,7 +173,7 @@ struct ifnet * bridge_rtupdate __P((struct bridge_softc *,
struct ifnet * bridge_rtlookup __P((struct bridge_softc *,
struct ether_addr *));
u_int32_t bridge_hash __P((struct ether_addr *));
-struct mbuf *bridge_blocknonip __P((struct mbuf *));
+int bridge_blocknonip __P((struct ether_header *, struct mbuf *));
int bridge_addrule __P((struct bridge_iflist *,
struct ifbrlreq *, int out));
int bridge_flushrule __P((struct bridge_iflist *));
@@ -197,10 +191,8 @@ u_int8_t bridge_filterrule __P((struct brl_node *, struct ether_header *));
/*
* Filter hooks
*/
-#define BRIDGE_FILTER_PASS 0
-#define BRIDGE_FILTER_DROP 1
-int bridge_filter __P((struct bridge_softc *, struct ifnet *,
- struct ether_header *, struct mbuf **));
+struct mbuf *bridge_filter __P((struct bridge_softc *, struct ifnet *,
+ struct ether_header *, struct mbuf *m));
#endif
void
@@ -759,8 +751,6 @@ bridge_output(ifp, m, sa, rt)
struct ifnet *dst_if;
struct ether_addr *src, *dst;
struct bridge_softc *sc;
- struct bridge_iflist *p;
- struct mbuf *mc;
int s;
if (m->m_len < sizeof(*eh)) {
@@ -791,20 +781,29 @@ bridge_output(ifp, m, sa, rt)
*/
dst_if = bridge_rtlookup(sc, dst);
if (dst_if == NULL || eh->ether_dhost[0] & 1) {
+ struct bridge_iflist *p;
+ struct mbuf *mc;
+ int used = 0;
+
for (p = LIST_FIRST(&sc->sc_iflist); p != NULL;
- p = LIST_NEXT(p, next)) {
+ p = LIST_NEXT(p, next)) {
if ((p->ifp->if_flags & IFF_RUNNING) == 0)
continue;
-
if (IF_QFULL(&p->ifp->if_snd)) {
sc->sc_if.if_oerrors++;
continue;
}
- mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);
- if (mc == NULL) {
- sc->sc_if.if_oerrors++;
- continue;
+ if (LIST_NEXT(p, next) == NULL) {
+ used = 1;
+ mc = m;
+ }
+ else {
+ mc = m_copym(m, 0, M_COPYALL, M_NOWAIT);
+ if (mc == NULL) {
+ sc->sc_if.if_oerrors++;
+ continue;
+ }
}
sc->sc_if.if_opackets++;
@@ -813,7 +812,8 @@ bridge_output(ifp, m, sa, rt)
if ((p->ifp->if_flags & IFF_OACTIVE) == 0)
(*p->ifp->if_start)(p->ifp);
}
- m_freem(m);
+ if (!used)
+ m_freem(m);
splx(s);
return (0);
}
@@ -880,7 +880,7 @@ bridgeintr_frame(sc, m)
struct ifnet *src_if, *dst_if;
struct bridge_iflist *ifl;
struct ether_addr *dst, *src;
- struct ether_header *eh;
+ struct ether_header eh;
if ((sc->sc_if.if_flags & IFF_RUNNING) == 0) {
m_freem(m);
@@ -907,34 +907,33 @@ bridgeintr_frame(sc, m)
return;
}
- if (m->m_len < sizeof(*eh)) {
- m = m_pullup(m, sizeof(*eh));
- if (m == NULL)
- return;
+ if (m->m_pkthdr.len < sizeof(eh)) {
+ m_freem(m);
+ return;
}
- eh = mtod(m, struct ether_header *);
- dst = (struct ether_addr *)&eh->ether_dhost[0];
- src = (struct ether_addr *)&eh->ether_shost[0];
+ m_copydata(m, 0, sizeof(struct ether_header), (caddr_t)&eh);
+ dst = (struct ether_addr *)&eh.ether_dhost[0];
+ src = (struct ether_addr *)&eh.ether_shost[0];
/*
* If interface is learning, and if source address
* is not broadcast or multicast, record it's address.
*/
if ((ifl->bif_flags & IFBIF_LEARNING) &&
- (eh->ether_shost[0] & 1) == 0 &&
- !(eh->ether_shost[0] == 0 &&
- eh->ether_shost[1] == 0 &&
- eh->ether_shost[2] == 0 &&
- eh->ether_shost[3] == 0 &&
- eh->ether_shost[4] == 0 &&
- eh->ether_shost[5] == 0))
+ (eh.ether_shost[0] & 1) == 0 &&
+ !(eh.ether_shost[0] == 0 &&
+ eh.ether_shost[1] == 0 &&
+ eh.ether_shost[2] == 0 &&
+ eh.ether_shost[3] == 0 &&
+ eh.ether_shost[4] == 0 &&
+ eh.ether_shost[5] == 0))
bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC);
/*
* If packet is unicast, destined for someone on "this"
* side of the bridge, drop it.
*/
- if (m->m_flags & (M_BCAST | M_MCAST)) {
+ if ((m->m_flags & (M_BCAST | M_MCAST)) == 0) {
dst_if = bridge_rtlookup(sc, dst);
if (dst_if == src_if) {
m_freem(m);
@@ -973,28 +972,22 @@ bridgeintr_frame(sc, m)
}
}
- if (ifl->bif_flags & IFBIF_BLOCKNONIP) {
- m = bridge_blocknonip(m);
- if (m == NULL)
- return;
- eh = mtod(m, struct ether_header *);
- dst = (struct ether_addr *)&eh->ether_dhost[0];
- src = (struct ether_addr *)&eh->ether_shost[0];
+ if (ifl->bif_flags & IFBIF_BLOCKNONIP && bridge_blocknonip(&eh, m)) {
+ m_freem(m);
+ return;
}
if (SIMPLEQ_FIRST(&ifl->bif_brlin) &&
- bridge_filterrule(SIMPLEQ_FIRST(&ifl->bif_brlin), eh) ==
+ bridge_filterrule(SIMPLEQ_FIRST(&ifl->bif_brlin), &eh) ==
BRL_ACTION_BLOCK) {
m_freem(m);
return;
}
#if defined(INET) && (defined(IPFILTER) || defined(IPFILTER_LKM))
- if (bridge_filter(sc, src_if, eh, &m) == BRIDGE_FILTER_DROP) {
- if (m != NULL)
- m_freem(m);
+ m = bridge_filter(sc, src_if, &eh, m);
+ if (m == NULL)
return;
- }
#endif
/*
@@ -1003,7 +996,9 @@ bridgeintr_frame(sc, m)
*/
if ((m->m_flags & (M_BCAST | M_MCAST)) || dst_if == NULL) {
sc->sc_if.if_imcasts++;
- bridge_broadcast(sc, src_if, eh, m);
+ s = splimp();
+ bridge_broadcast(sc, src_if, &eh, m);
+ splx(s);
return;
}
@@ -1019,7 +1014,7 @@ bridgeintr_frame(sc, m)
while (ifl != NULL && ifl->ifp != dst_if)
ifl = LIST_NEXT(ifl, next);
if (SIMPLEQ_FIRST(&ifl->bif_brlout) &&
- bridge_filterrule(SIMPLEQ_FIRST(&ifl->bif_brlout), eh) ==
+ bridge_filterrule(SIMPLEQ_FIRST(&ifl->bif_brlout), &eh) ==
BRL_ACTION_BLOCK) {
m_freem(m);
return;
@@ -1040,8 +1035,8 @@ bridgeintr_frame(sc, m)
}
/*
- * Receive input from an interface. Rebroadcast if necessary to other
- * bridge members.
+ * Receive input from an interface. Queue the packet for bridging if its
+ * not for us, and schedule an interrupt.
*/
struct mbuf *
bridge_input(ifp, eh, m)
@@ -1062,6 +1057,9 @@ bridge_input(ifp, eh, m)
if (ifp == NULL || ifp->if_bridge == NULL || m == NULL)
return (m);
+ if ((m->m_flags & M_PKTHDR) == 0)
+ panic("bridge_input(): no HDR");
+
sc = (struct bridge_softc *)ifp->if_bridge;
if ((sc->sc_if.if_flags & IFF_RUNNING) == 0)
return (m);
@@ -1186,10 +1184,10 @@ bridge_broadcast(sc, ifp, eh, m)
}
}
- if (p->bif_flags & IFBIF_BLOCKNONIP) {
- mc = bridge_blocknonip(mc);
- if (mc == NULL)
- continue;
+ if (p->bif_flags & IFBIF_BLOCKNONIP &&
+ bridge_blocknonip(eh, mc)) {
+ m_freem(mc);
+ continue;
}
sc->sc_if.if_opackets++;
@@ -1662,41 +1660,52 @@ done:
return (error);
}
-struct mbuf *
-bridge_blocknonip(m)
+/*
+ * Block non-ip frames:
+ * Returns 0 if frame is ip, and 1 if it should be dropped.
+ */
+int
+bridge_blocknonip(eh, m)
+ struct ether_header *eh;
struct mbuf *m;
{
- struct ehllc *ehllc;
+ struct snap snap;
u_int16_t etype;
- if (m->m_len < sizeof(struct ehllc)) {
- m = m_pullup(m, sizeof(struct ehllc));
- if (m == NULL)
- return (m);
- }
-
- ehllc = mtod(m, struct ehllc *);
- etype = ntohs(ehllc->eh.ether_type);
+ if (m->m_pkthdr.len < sizeof(struct ether_header))
+ return (1);
- if (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
- etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)
- return (m);
+ etype = ntohs(eh->ether_type);
+ switch (etype) {
+ case ETHERTYPE_ARP:
+ case ETHERTYPE_REVARP:
+ case ETHERTYPE_IP:
+ case ETHERTYPE_IPV6:
+ return (0);
+ }
if (etype > ETHERMTU)
- goto notip;
-
- if (ehllc->llc.llc_control == LLC_UI &&
- ehllc->llc.llc_dsap == LLC_SNAP_LSAP &&
- ehllc->llc.llc_ssap == LLC_SNAP_LSAP) {
- etype = ntohs(ehllc->llc.llc_snap.ether_type);
- if (etype == ETHERTYPE_ARP || etype == ETHERTYPE_REVARP ||
- etype == ETHERTYPE_IP || etype == ETHERTYPE_IPV6)
- return (m);
+ return (1);
+
+ if (m->m_pkthdr.len <
+ (sizeof(struct ether_header) + sizeof(struct snap)))
+ return (1);
+
+ m_copydata(m, sizeof(struct ether_header), sizeof(struct snap),
+ (caddr_t)&snap);
+
+ etype = ntohs(snap.type);
+ if (snap.dsap == LLC_SNAP_LSAP && snap.ssap == LLC_SNAP_LSAP &&
+ snap.control == LLC_UI &&
+ snap.org[0] == 0 && snap.org[1] == 0 && snap.org[2] == 0 &&
+ (etype == ETHERTYPE_ARP ||
+ etype == ETHERTYPE_REVARP ||
+ etype == ETHERTYPE_IP ||
+ etype == ETHERTYPE_IPV6)) {
+ return (0);
}
-notip:
- m_freem(m);
- return (NULL);
+ return (1);
}
u_int8_t
@@ -1785,110 +1794,87 @@ bridge_flushrule(bif)
#if defined(INET) && (defined(IPFILTER) || defined(IPFILTER_LKM))
/*
+ * Maximum sized IP header
+ */
+union maxip {
+ struct ip ip;
+ u_int32_t _padding[16];
+};
+
+/*
* Filter IP packets by peeking into the ethernet frame. This violates
* the ISO model, but allows us to act as a IP filter at the data link
* layer. As a result, most of this code will look familiar to those
* who've read net/if_ethersubr.c and netinet/ip_input.c
*/
-int
-bridge_filter(sc, ifp, eh, np)
+struct mbuf *
+bridge_filter(sc, ifp, eh, m)
struct bridge_softc *sc;
struct ifnet *ifp;
struct ether_header *eh;
- struct mbuf **np;
+ struct mbuf *m;
{
- struct mbuf *m = *np;
- struct ehllc *ehllc;
+ struct snap snap;
+ int hassnap = 0;
struct ip *ip;
- u_int16_t etype;
- int hlen, r, off = sizeof(struct ether_header);
+ int hlen;
if (fr_checkp == NULL)
- return (BRIDGE_FILTER_PASS);
+ return (m);
- if (m->m_len < sizeof(struct ehllc)) {
- m = m_pullup(m, sizeof(struct ehllc));
- *np = m;
- if (m == NULL)
- return (BRIDGE_FILTER_DROP);
- }
+ if (eh->ether_type != htons(ETHERTYPE_IP)) {
+ if (eh->ether_type > ETHERMTU ||
+ m->m_pkthdr.len < (sizeof(struct snap) +
+ sizeof(struct ether_header)))
+ return (m);
- ehllc = mtod(m, struct ehllc *);
- etype = ntohs(ehllc->eh.ether_type);
- if (etype != ETHERTYPE_IP) {
- if (etype > ETHERMTU) /* Can't be SNAP */
- return (BRIDGE_FILTER_PASS);
-
- if (ehllc->llc.llc_control != LLC_UI ||
- ehllc->llc.llc_dsap != LLC_SNAP_LSAP ||
- ehllc->llc.llc_ssap != LLC_SNAP_LSAP ||
- ehllc->llc.llc_snap.org_code[0] != 0 ||
- ehllc->llc.llc_snap.org_code[1] != 0 ||
- ehllc->llc.llc_snap.org_code[2] != 0 ||
- ntohs(ehllc->llc.llc_snap.ether_type) != ETHERTYPE_IP)
- return (BRIDGE_FILTER_PASS);
- off += 8;
+ m_copydata(m, sizeof(struct ether_header),
+ sizeof(struct snap), (caddr_t)&snap);
+
+ if (snap.dsap != LLC_SNAP_LSAP || snap.ssap != LLC_SNAP_LSAP ||
+ snap.control != LLC_UI ||
+ snap.org[0] != 0 || snap.org[1] != 0 || snap.org[2] ||
+ snap.type != htons(ETHERTYPE_IP))
+ return (m);
+ hassnap = 1;
}
- /*
- * We need a full copy because we're going to be destructive
- * to the packet before we pass it to the ip filter code.
- * XXX This needs to be turned into a munge -> check ->
- * XXX unmunge section, for now, we copy.
- * XXX Copy at offset 0 so that the mbuf header is copied, too.
- */
- m = m_copym2(m, 0, M_COPYALL, M_NOWAIT);
- m_adj(m, off);
- if (m == NULL)
- return (BRIDGE_FILTER_DROP);
+ m_adj(m, sizeof(struct ether_header));
+ if (hassnap)
+ m_adj(m, sizeof(struct snap));
- /*
- * Pull up the IP header
- */
- if (m->m_len < sizeof(struct ip)) {
- m = m_pullup(m, sizeof(struct ip));
- if (m == NULL)
- return (BRIDGE_FILTER_DROP);
- }
+ if (m->m_pkthdr.len < sizeof(struct ip))
+ goto dropit;
- /*
- * Examine the ip header, and drop invalid packets
- */
+ /* Copy minimal header, and drop invalids */
+ if (m->m_len < sizeof(struct ip) &&
+ (m = m_pullup(m, sizeof(struct ip))) == NULL)
+ return (NULL);
ip = mtod(m, struct ip *);
- if (ip->ip_v != IPVERSION) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
- hlen = ip->ip_hl << 2; /* get whole header length */
- if (hlen < sizeof(struct ip)) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
- if (hlen > m->m_len) { /* pull up whole header */
- if ((m = m_pullup(m, hlen)) == 0) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
+ if (ip->ip_v != IPVERSION)
+ goto dropit;
+
+ hlen = ip->ip_hl << 2; /* get whole header length */
+ if (hlen < sizeof(struct ip))
+ goto dropit;
+ if (hlen > m->m_len) {
+ if ((m = m_pullup(m, sizeof(struct ip))) == NULL)
+ return (NULL);
ip = mtod(m, struct ip *);
}
- if ((ip->ip_sum = in_cksum(m, hlen)) != 0) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
+
+ if ((ip->ip_sum = in_cksum(m, hlen)) != 0)
+ goto dropit;
NTOHS(ip->ip_len);
- if (ip->ip_len < hlen) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
+ if (ip->ip_len < hlen)
+ goto dropit;
NTOHS(ip->ip_id);
NTOHS(ip->ip_off);
- if (m->m_pkthdr.len < ip->ip_len) {
- r = BRIDGE_FILTER_DROP;
- goto out;
- }
+ if (m->m_pkthdr.len < ip->ip_len)
+ goto dropit;
if (m->m_pkthdr.len > ip->ip_len) {
if (m->m_len == m->m_pkthdr.len) {
m->m_len = ip->ip_len;
@@ -1899,13 +1885,39 @@ bridge_filter(sc, ifp, eh, np)
/* Finally, we get to filter the packet! */
if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 0, &m))
- return (BRIDGE_FILTER_DROP);
+ return (NULL);
+
+ /* Rebuild the IP header */
+ if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
+ return (NULL);
+ if (m->m_len < sizeof(struct ip))
+ goto dropit;
+ ip = mtod(m, struct ip *);
+ HTONS(ip->ip_len);
+ HTONS(ip->ip_id);
+ HTONS(ip->ip_off);
+ ip->ip_sum = in_cksum(m, hlen);
+
+ /* Reattach SNAP header */
+ if (hassnap) {
+ M_PREPEND(m, sizeof(snap), M_DONTWAIT);
+ if (m == NULL)
+ goto dropit;
+ bcopy(&snap, mtod(m, caddr_t), sizeof(snap));
+ }
+
+ /* Reattach ethernet header */
+ M_PREPEND(m, sizeof(*eh), M_DONTWAIT);
+ if (m == NULL)
+ goto dropit;
+ bcopy(eh, mtod(m, caddr_t), sizeof(*eh));
- r = BRIDGE_FILTER_PASS;
+ return (m);
-out:
- m_freem(m);
- return (r);
+dropit:
+ if (m != NULL)
+ m_freem(m);
+ return (NULL);
}
#endif