summaryrefslogtreecommitdiff
path: root/sys/net/if_bridge.c
AgeCommit message (Collapse)Author
2019-07-20When multiple ports share the same MAC, pick the physical one for delivery.Martin Pieuchot
Fix an issue reported by Eygene Ryabinkin where packet where dropped by pf(4) because a vlan(4) interface was picked instead of its underlying em(4). While here do some refactoring to avoid code duplication. Based on a submission from Eygene Ryabinkin <rea at codelabs dot ru>. ok bluhm@, kn@
2019-07-17Introduce ETHER_IS_BROADCAST/ANYADDR/EQ() and use them where appropriate.Martin Pieuchot
ok dlg@, sthen@, millert@
2019-06-09Always return EEXIST if an interface is already part of a bridge.Martin Pieuchot
2019-06-09Remove code for non-Ethernet members, these are no longer supported.Martin Pieuchot
From Eygene Ryabinkin.
2019-05-13Deal with the case where bridge_getbif() can return NULL.Martin Pieuchot
Since `bif' are removed from the interface list before calling smr_barrier() and the hash queue is cleaned up afterward, it is possible to find an ifidx with bridge_rtlookup() that won't match to any `bif'. Fix a panic reported by Hrvoje Popovski, ok visa@
2019-05-12Switch the list of span interfaces and interfaces to SMR.Martin Pieuchot
This removes the KERNEL_LOCK() around the list iteration in bridge_enqueue(). Since the NET_LOCK() isn't protecting any data structure, release it early in all the code paths coming from the Network Stack to prevent possible deadlock situations with smr_barrier(). bridge_input() is still KERNEL_LOCK()ed as well as bridge_filterrule(). ok visa@
2019-05-12pushing NET_LOCK() further down from if_clone_{create,destroy}()Alexandr Nedvedicky
OK mpi@
2019-05-10Move bridge_filterrule() before doing the mbuf copy. Fixes a memory leakClaudio Jeker
when multiple interfaces do MAC filtering. Memory leak reported by Daniel Levai With and OK mpi@
2019-05-03An if_put() was missing in one branch of bridge_process(). ThisAlexander Bluhm
caused a hanging "ifconfig bridge0 destroy" and a subsequent uvm fault. reported and tested by Hrvoje Popovski; OK visa@
2019-04-28Removes the KERNEL_LOCK() from bridge(4)'s output fast-path.Martin Pieuchot
This redefines the ifp <-> bridge relationship. No lock can be currently used across the multiples contexts where the bridge has tentacles to protect a pointer, use an interface index. Tested by various, ok dlg@, visa@
2019-04-15Use timeout_del_barrier(9) instead of timeout_del(9) followed byVisa Hankala
conditional timeout_barrier(9). OK kn@ dlg@
2019-03-31Fix output accounting when bridge(4) is down.Martin Pieuchot
ok visa@
2019-03-12Merge copy/pasted code to export STP states via ioctl into a function.Martin Pieuchot
2019-03-08Do not grab a `bif' pointer again, we already have it.Martin Pieuchot
ok visa@
2019-03-08Move the tag mechanism outside of net/if_bridge.c.Martin Pieuchot
This will help for future (un)locking. ok visa@
2019-02-20Protect the hash table with a mutex.Martin Pieuchot
inputs & ok visa@
2019-02-14Use timeout_barrier() when bringing the bridge(4) down and only executeMartin Pieuchot
the timeout handler if the interface is running. ok claudio@
2019-02-14Remove mpw(4) hacks now that all the world is Ethernet.Martin Pieuchot
2019-01-29Plumbing to simplify upcoming locking.Martin Pieuchot
- Do checks that do not access shared data structures first, they don't need locking and save us some dances. - Use the common !ETHER_IS_MULTICAST() idiom and move some code that won't be executed if the bridge(4) is down. ok bluhm@, visa@
2019-01-23Pass an `ifp' pointer to bridge_ourether().Martin Pieuchot
ok kn@, claudio@, visa@
2019-01-23Only copy packets for span ports if the bridge is UP.Martin Pieuchot
ok claudio@, kn@, visa@
2019-01-17Convert interface lists from TAILQ to SLIST in preparation for fineMartin Pieuchot
grained locking. ok visa@, florian@
2018-12-12Various cleanups:Martin Pieuchot
- Unify the two hooks by passing the same argument - Check for nullity before dereferencing `if_bridgeport', this will matter when we go MP - Use the same pattern to find a member in the ioctl path ok bluhm@, visa@
2018-12-07Stop passing `sc' when it isn't needed and use `ifp' where it's goodMartin Pieuchot
enough. ok sthen@, visa@
2018-11-14Batch copyout(9)s in preparation for finer locking.Martin Pieuchot
Tested by Hrvoje Popovski, inputs and ok visa@
2018-10-01Put bridge_input & output back under the KERNEL_LOCK().Martin Pieuchot
Wireless drivers call if_enqueue() out of the NET_LOCK() so it cannot be used to serialize bridge(4) states. Found by stsp@, ok visa@
2018-09-27Coherently name "struct bridge_iflist" variables `bif'.Martin Pieuchot
ok visa@
2018-09-26Move bridge input/output paths outside of the KERNEL_LOCK().Martin Pieuchot
Tested by Hrvoje Popovski who measured a 30% improvement of forwarded packets in the best case. ok visa@
2018-09-19Always call bridge_iflist `bif'.Martin Pieuchot
ok bluhm@, visa@
2018-04-19when adding span ports, restrict them to ether and mplstunnel interfaces.David Gwynne
this is the same check that's done when adding normal members to the bridge. it prevents things like gif(4) being added to the bridge, which in turn prevents panics when shoving ethernet packets down a layer 3 interface. reported and tested by jasper@
2018-02-19Remove almost unused `flags' argument of suser().Martin Pieuchot
The account flag `ASU' will no longer be set but that makes suser() mpsafe since it no longer mess with a per-process field. No objection from millert@, ok tedu@, bluhm@
2018-02-11if an interface is added to the bridge that doesn't exist, try to create itHenning Brauer
triggered by djm's dhclient on vether on bridge setup ok djm benno claudio
2018-02-08Add a new '-protected' option for bridge members.Martin Pieuchot
Bridge members that are part of the same protected domain, refered by a number between 1 and 31, cannot talk to each others. This is useful to isolate VMs or untrusted networks at layer 2. Members can be part of multiple protected domain making it possible to create complex protected setups. ok ccardenas@, claudio@, dlg@, henning@
2018-02-07Unbreak carp(4) MAC check in bridge_process().Martin Pieuchot
Introduce bridge_ourether() and move carp(4)-specific SRPL code inside carp_ourether(). ok bluhm@
2018-02-05bcmp -> memcmp; kinda req'd / not-just-kinda ok'd by claudioHenning Brauer
2018-02-05implement an arp filterHenning Brauer
allows arp (and rarp) requests and replies to be matched, including matching based on the source and target host and protocol adresses, and thus control over arp traffic and learning. written for medical x-ray machines, but useful in many spread out L2 networks ok claudio benno
2018-01-10get rid of struct carp_if by moving the srpl into struct ifnet if_carp.David Gwynne
currently carp uses a struct carp_if to hold an srp list head, which is accessed by both if_carp in struct ifnet, and via the if input handlers list. this gets rid of some indirection by making if_carp itself the list head, rather than a pointer to the list head via a struct carp_if. it also makes accessing the list consistent by only using if_carp to get to it. ok mpi@
2018-01-09Creating a cloned interface could return ENOMEM due to temporaryAlexander Bluhm
memory shortage. As it is invoked from a system call, it should not fail and wait instead. OK visa@ mpi@
2017-11-20Remove duplicated code working around the fact that ifpromisc() requiredMartin Pieuchot
a DOWN interface. ok visa@
2017-08-17Skip SPD lookups for short packets on IPsec-enabled bridgeMike Belopuhov
When short packets are sent to the bridge with IPsec enabled, an incorrect error path can be taken which leads to a lookup of an SPD entry using an uninitialized SPI. Most of the time this will fail, however there's a chance that an existing SPD entry corresponds to the provided SPI which leads to use of another uninitialized variable used to offset the IP or IPv6 header in order to get to the security protocol header. ESP performs packet length checks and will fail when such packets will reach it, but AH and IPComp don't have similar checks and are affected the most. CID 1452946, 1452957; Severity: Major OK millert, visa, bluhm
2017-05-16Replace remaining splsoftassert(IPL_SOFTNET) by NET_ASSERT_LOCKED().Martin Pieuchot
ok visa@
2017-05-15bridge_ioctl() doesn't need to call splnet().Martin Pieuchot
All interface ioctl()s are executed with the NET_LOCK() held, which protects all soft states of the network stack. IPL_NET is only needed in drivers dealing with hardware and by extension the wireless stack.
2017-05-12Unify duplicate code from address family switch in bridge_ipsec().Alexander Bluhm
Remove an if condition that cannot happen. OK mikeb@
2017-02-05Use percpu counters for ip6statJeremie Courreges-Anglas
Try to follow the existing examples. Some notes: - don't implement counters_dec() yet, which could be used in two similar chunks of code. Let's see if there are more users first. - stop incrementing IPv6-specific mbuf stats, IPv4 has no equivalent. Input from mpi@, ok bluhm@ mpi@
2017-01-24A space here, a space there. Soon we're talking real whitespaceKenneth R Westerback
rectification.
2017-01-23Flag pseudo-interfaces as such in order to call add_net_randomness()Martin Pieuchot
only once per packet. Fix a regression introduced when if_input() started to be called by every pseudo-driver. ok claudio@, dlg@
2017-01-11No need for a splsoftnet()/splx() dance when the KERNEL_LOCK() is whatMartin Pieuchot
serialize access to bridge(4) data structures. ok mikeb@
2016-12-19Assert that IPL_SOFTNET is needed rather than calling splsoftnet()Martin Pieuchot
recursively. ok bluhm@
2016-11-21bridge(4) does not distinguish between routing/forwarding ports, soReyk Floeter
make "addlocal" an alias to "add" on bridge. addlocal is handled differently on switch(4). OK yasuoka@
2016-11-14turn ipstat into a set of percpu counters.David Gwynne
each counter is identified by an enum value which correspond to the original members of the ipstat struct. ipstat_inc(ips_foo) replaces ipstat.ips_foo++ for the actual updates. ipstat_inc is a thin wrapper around counters_inc. counters are still returned to userland via the ipstat struct for now. ok mpi@ mikeb@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-23 22:29:58 +0000