.\" $OpenBSD: bridge.4,v 1.57 2004/05/04 16:29:30 cedric Exp $ .\" .\" Copyright (c) 1999-2001 Jason L. Wright (jason@thought.net) .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED .\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE .\" DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, .\" INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES .\" (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR .\" SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, .\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" .Dd February 26, 1999 .Dt BRIDGE 4 .Os .Sh NAME .Nm bridge .Nd Ethernet bridge interface .Sh SYNOPSIS .Cd "pseudo-device bridge" Op Ar count .Sh DESCRIPTION The .Nm device creates a logical link between two or more Ethernet interfaces or encapsulation interfaces (see .Xr gif 4 ) . This link between the interfaces selectively forwards frames from each interface on the bridge to every other interface on the bridge. A bridge can serve several services, including isolation of traffic between sets of machines so that traffic local to one set of machines is not available on the wire of another set of machines, and it can act as a transparent filter for .Xr ip 4 datagrams. .Pp A .Nm interface can be created at runtime using the .Ic ifconfig bridgeN create command or by setting up a .Xr bridgename.if 5 configuration file for .Xr netstart 8 . .Pp The bridges provided by this interface are learning bridges with filtering, see .Xr pf 4 . In general a bridge works like a hub, forwarding traffic from one interface to another. It differs from a hub in that it will "learn" which machines are on each of its attached segments by actively listening to incoming traffic and examining the headers of each frame. A table is built containing the MAC address and segment to which the MAC address is attached. This allows a bridge to be more selective about what it forwards, which can be used to reduce traffic on a set of segments and also to provide an IP firewall without changing the topology of the network. .Pp The algorithm works as follows by default, but can be modified via .Xr ioctl 2 or the utility .Xr brconfig 8 . When a frame comes in, the origin segment and the source address are recorded. If the bridge has no knowledge about where the destination is to be found, the bridge will forward the frame to all attached segments. If the destination is known to be on a different segment from its origin, the bridge will forward the packet only to the destination segment. If the destination is on the same segment as the origin segment, the bridge will drop the packet because the receiver has already had a chance to see the frame. Before forwarding a frame, the bridge will check to see if the packet contains an .Xr ip 4 or .Xr ip6 4 datagram; if so, the datagram is run through the .Xr pf 4 interface so that it can be filtered. .Sh IOCTLS A .Nm interface responds to all of the .Xr ioctl 2 calls specific to other interfaces listed in .Xr netintro 4 . The following .Xr ioctl 2 calls are specific to .Nm devices. They are defined in .Aq Pa sys/sockio.h . .Bl -tag -width SIOCBRDGGIFFLGS .It Dv SIOCBRDGIFS .Pq Li "struct ifbifconf" Retrieve member interface list from a bridge. This request takes an .Li ifbifconf structure (see below) as a value-result parameter. The .Fa ifbic_len field should be initially set to the size of the buffer pointed to by .Fa ifbic_buf . On return it will contain the length, in bytes, of the configuration list. Alternatively, if the .Fa ifbic_len passed in is set to 0, .Dv SIOCBRDGIFS will set .Fa ifbic_len to the size that .Fa ifbic_buf needs to be to fit the entire configuration list, and will not fill in the other parameters. This is useful for determining the exact size that .Fa ifbic_buf needs to be in advance. .Pp The argument structure is defined as follows: .Bd -literal -offset indent struct ifbreq { char ifbr_name[IFNAMSIZ]; /* brdg nam */ char ifbr_ifsname[IFNAMSIZ]; /* if name */ u_int32_t ifbr_ifsflags; /* if flags */ }; #define IFBIF_LEARNING 0x1 /* learns addrs */ #define IFBIF_DISCOVER 0x2 /* gets fwd'd pkts */ struct ifbifconf { char ifbic_name[IFNAMSIZ]; /* brdg name */ u_int32_t ifbic_len; /* buf size */ union { caddr_t ifbicu_buf; /* buffer */ struct ifbreq *ifbicu_req; } ifbic_ifbicu; #define ifbic_buf ifbic_ifbicu.ifbicu_buf #define ifbic_req ifbic_ifbicu.ifbicu_req }; .Ed .It Dv SIOCBRDGADD .Pq Li "struct ifbreq" Add the interface named in .Fa ifbr_ifsname to the bridge named in .Fa ifbr_name . .It Dv SIOCBRDGDEL .Pq Li "struct ifbreq" Delete the interface named in .Fa ifbr_ifsname from the bridge named in .Fa ifbr_name . .It Dv SIOCBRDGADDS .Pq Li "struct ifbreq" Add the interface named in .Fa ifbr_ifsname as a span port to the bridge named in .Fa ifbr_name . .It Dv SIOCBRDGDELS .Pq Li "struct ifbreq" Delete the interface named in .Fa ifbr_ifsname from the list of span ports of the bridge named in .Fa ifbr_name . .It Dv SIOCBRDGSIFFLGS .Pq Li "struct ifbreq" Set the bridge member interface flags for the interface named in .Fa ifbr_ifsname attached to the bridge .Fa ifbr_name . If the flag .Dv IFBIF_LEARNING is set on an interface, source addresses from frames received on the interface are recorded in the address cache. If the flag .Dv IFBIF_DISCOVER is set, the interface will receive packets destined for unknown destinations, otherwise a frame that has a destination not found in the address cache is not forwarded to this interface. The default for newly added interfaces has both flags set. If the flag .Dv IFBIF_BLOCKNONIP is set, packets that are one of .Xr ip 4 , .Xr ip6 4 , .Xr arp 4 , or Reverse ARP, will not be bridged from and to the interface. .It Dv SIOCBRDGGIFFLGS Retrieve the bridge member interface flags for the interface named in .Fa ifbr_ifsname attached to the bridge .Fa ifbr_name . .It Dv SIOCBRDGRTS .Pq Li "struct ifbaconf" Retrieve the address cache of the bridge named in .Fa ifbac_name . This request takes an .Li ifbaconf structure (see below) as a value result parameter. The .Fa ifbac_len field should be initially set to the size of the buffer pointed to by .Fa ifbac_buf . On return, it will contain the length, in bytes, of the configuration list. Alternatively, if the .Fa ifbac_len passed in is set to 0, .Dv SIOCBRDGRTS will set it to the size that .Fa ifbac_buf needs to be to fit the entire configuration list and not fill in the other parameters. As with .Dv SIOCBRDGIFS , this is useful for determining the exact size that .Fa ifbac_buf needs to be in advance. .Pp The argument structure is defined as follows: .Bd -literal -offset indent struct ifbareq { char ifba_name[IFNAMSIZ]; /* brdg nam */ char ifba_ifsname[IFNAMSIZ];/* dest ifs */ u_int8_t ifba_age; /* addr age */ u_int8_t ifba_flags; /* addr flag */ struct ether_addr ifba_dst; /* dst addr */ }; #define IFBAF_TYPEMASK 0x03 /* addr type mask */ #define IFBAF_DYNAMIC 0x00 /* dynamic addr */ #define IFBAF_STATIC 0x01 /* static address */ struct ifbaconf { char ifbac_name[IFNAMSIZ]; /* brdg name */ u_int32_t ifbac_len; /* buf size */ union { caddr_t ifbacu_buf; /* buf */ struct ifbareq *ifbacu_req; } ifbac_ifbacu; #define ifbac_buf ifbac_ifbacu.ifbacu_buf #define ifbac_req ifbac_ifbacu.ifbacu_req }; .Ed Address cache entries with the type set to .Dv IFBAF_DYNAMIC in .Fa ifba_flags are entries learned by the bridge. Entries with the type set to .Dv IFBAF_STATIC are manually added entries. .It Dv SIOCBRDGSADDR .Pq Li "struct ifbareq" Add an entry, manually, to the address cache for the bridge named in .Fa ifba_name . The address and its associated interface and flags are set in the .Fa ifba_dst , .Fa ifba_ifsname , and .Fa ifba_flags fields, respectively. .It Dv SIOCBRDGDADDR .Pq Li "struct ifbareq" Delete an entry from the address cache of the bridge named in .Fa ifba_name . Entries are deleted strictly based on the address field .Fa ifba_dst . .It Dv SIOCBRDGSCACHE .Pq Li "struct ifbcachereq" Set the maximum address cache size for the bridge named in .Fa ifbc_name to .Fa ifbc_size entries. .Pp The argument structure is as follows: .Bd -literal -offset indent struct ifbcachereq { char ifbc_name[IFNAMSIZ]; /* bridge */ u_int32_t ifbc_size; /* size */ }; .Ed .It Dv SIOCBRDGGCACHE .Pq Li "struct ifbcachereq" Retrieve the maximum size of the address cache for the bridge .Fa ifbc_name . .It Dv SIOCBRDGSTO .Pq Li "struct ifbcachetoreq" Set the time, in seconds, that addresses which have not been seen on the network (transmitted a packet) remain in the cache. If the time is set to zero, no aging is performed on the address cache. The argument structure is as follows: .Bd -literal -offset indent struct ifbcachetoreq { char ifbct_name[IFNAMSIZ]; /* bridge */ u_int32_t ifbct_time; /* time */ }; .Ed .It Dv SIOCBRDGGTO .Pq Li "struct ifbcachetoreq" Retrieve the address cache expiration time (see above). .It Dv SIOCBRDGFLUSH .Pq Li "struct ifbreq" Flush addresses from the cache. .Fa ifbr_name contains the name of the bridge device, and .Fa ifbr_ifsflags should be set to .Dv IFBF_FLUSHALL to flush all addresses from the cache or .Dv IFBF_FLUSHDYN to flush only the dynamically learned addresses from the cache. .It Dv SIOCBRDGARL .Pq Li "struct ifbrlreq" Add an Ethernet address filtering rule to the bridge on a specific interface. .Fa ifbr_name contains the name of the bridge device, and .Fa ifbr_ifsname contains the name of the bridge member interface. The .Fa ifbr_action field is one of .Fa BRL_ACTION_PASS or .Fa BRL_ACTION_BLOCK , to pass or block matching frames respectively. The .Fa ifbr_flags specifies whether the rule should match on input, output, or both be using the flags .Fa BRL_FLAG_IN and .Fa BRL_FLAG_OUT . It also specifies whether either (or both) of the source and destination addresses should be matched by using the .Fa BRL_FLAG_SRCVALID and .Fa BRL_FLAG_DSTVALID flags. The .Fa ifbr_src field is the source address that triggers the rule (only considered if .Fa ifbr_flags has the .Fa BRL_FLAG_SRCVALID bit set). The .Fa ifbr_src field is the destination address that triggers the rule (only considered if .Fa ifbr_flags has the .Fa BRL_FLAG_DSTVALID bit set). .Pp The argument structure is as follows: .Bd -literal -offset indent struct ifbrlreq { char ifbr_name[IFNAMSIZ]; char ifbr_ifsname[IFNAMSIZ]; u_int8_t ifbr_action; u_int8_t ifbr_flags; struct ether_addr ifbr_src; struct ether_addr ifbr_dst; char ifbr_tagname[PF_TAG_NAME_SIZE]; }; #define BRL_ACTION_BLOCK 0x01 #define BRL_ACTION_PASS 0x02 #define BRL_FLAG_IN 0x08 #define BRL_FLAG_OUT 0x04 .Ed .It Dv SIOCBRDGFRL .Pq Li "struct ifbrlreq" Remove all filtering rules from a bridge interface member. .Fa ifbr_name contains the name of the bridge device, and .Fa ifbr_ifsname contains the name of the bridge member interface. .It Dv SIOCBRDGGRL .Pq Li "struct ifbrlconf" Retrieve all of the rules from the bridge, .Fa ifbrl_name , for the member interface, .Fa ifbrl_ifsname . This request takes an .Li ifbrlconf structure (see below) as a value result parameter. The .Fa ifbrl_len field should be initially set to the size of the buffer pointed to by .Fa ifbrl_buf . On return, it will contain the length, in bytes, of the configuration list. Alternatively, if the .Fa ifbrl_len passed in is set to 0, .Dv SIOCBRDGGRL will set it to the size that .Fa ifbrl_buf needs to be to fit the entire configuration list and not fill in the other parameters. As with .Dv SIOCBRDGIFS , this is useful for determining the exact size that .Fa ifbrl_buf needs to be in advance. .Pp The argument structure is defined as follows: .Bd -literal -offset indent struct ifbrlconf { char ifbrl_name[IFNAMSIZ]; /* brdg nam */ char ifbrl_ifsname[IFNAMSIZ];/* ifs name */ u_int32_t ifbr_len; /* buf len */ union { caddr_t ifbrlu_buf; struct ifbrlreq *ifbrlu_req; } ifrl_ifbrlu; #define ifbrl_buf ifbrl_ifbrlu.ifbrlu_buf #define ifbrl_req ifbrl_ifbrlu.ifbrlu_req }; .Ed .It Dv SIOCBRDGARL .Pq Li "struct ifbrlreq" Add a filtering rule to the bridge named in .Fa ifbr_name on the interface named in .Fa ifbr_ifsname . The argument structure is as follows: .Bd -literal -offset indent struct ifbrlreq { char ifbr_name[IFNAMSIZ]; /* bridge */ char ifbr_ifsname[IFNAMSIZ]; /* ifs */ u_int8_t ifbr_action; /* handling */ u_int8_t ifbr_flags; /* flags */ struct ether_addr ifbr_src; /* src mac */ struct ether_addr ifbr_dst; /* dst mac */ }; #define BRL_ACTION_BLOCK 0x01 #define BRL_ACTION_PASS 0x02 #define BRL_FLAG_IN 0x08 #define BRL_FLAG_OUT 0x04 #define BRL_FLAG_SRCVALID 0x02 #define BRL_FLAG_DSTVALID 0x01 .Ed .Pp Rules are applied in the order in which they were added to the bridge, and the first matching rule's action parameter determines the fate of the packet. The .Fa ifbr_action parameter specifies whether a frame matching the rule is to be blocked or passed. .Pp If the .Dv BRL_FLAG_IN bit is set in .Fa ifbr_flags , then the rule applies to frames received by the interface. If the .Dv BRL_FLAG_OUT bit is set, then the rule applies to frame transmitted by the interface. At least one of .Dv BRL_FLAG_IN or .Dv BRL_FLAG_OUT must be set. .Pp The source Ethernet address in .Fa ifbr_src is checked if the .Dv BRL_FLAG_SRCVALID bit is set in .Fa ifbr_flags . The destination address in .Fa ifbr_dst is checked if the .Dv BRL_FLAG_DSTVALID bit is set. If neither bit is set, the rule matches all frames. .It Dv SIOCBRDGFRL .Pq Li "struct ifbrlreq" Flush rules from the bridge .Fa ifbr_name on the interface .Fa ifbr_ifsname . .It Dv SIOCBRDGGRL .Pq Li "struct ifbrlconf" Retrieve an array of rules from the bridge for a particular interface. This request takes an .Li ifbrlconf structure (see below) as a value-result parameter. The .Fa ifbrl_len field should be initially set to the size of the buffer pointed to by .Fa ifbrl_buf . On return it will contain the length, in bytes, of the rule list. Alternatively, if the .Fa ifbrl_len passed in is set to 0, .Dv SIOCBRDGGRL will set .Fa ifbrl_len to the size that .Fa ifbrl_buf needs to be to fit the entire configuration list, and will not fill in the other parameters. This is useful for determining the exact size that .Fa ifbrl_buf needs to be in advance. .Pp The argument structure is as follows: .Bd -literal -offset indent struct ifbrlconf { char ifbrl_name[IFNAMSIZ]; /* bridge */ char ifbrl_ifsname[IFNAMSIZ];/* member */ u_int32_t ifbrl_len; /* buflen */ union { caddr_t ifbrlu_buf; struct ifbrlreq *ifbrlu_req; } ifbrl_ifbrlu; #define ifbrl_buf ifbrl_ifbrlu.ifbrlu_buf #define ifbrl_req ifbrl_ifbrlu.ifbrlu_req }; .Ed .El .Sh ERRORS If the .Xr ioctl 2 call fails, .Xr errno 2 is set to one of the following values: .Bl -tag -width Er .It Bq Eq ENOENT For an add request, this means that the named interface is not configured into the system. For a delete operation, it means that the named interface is not a member of the bridge. For an address cache deletion, the address was not found in the table. .It Bq Eq ENOMEM Memory could not be allocated for an interface or cache entry to be added to the bridge. .It Bq Eq EEXIST The named interface is already a member of the bridge. .It Bq Eq EBUSY The named interface is already a member of another bridge. .It Bq Eq EINVAL The named interface is not an Ethernet interface or an invalid ioctl was performed on the bridge. .It Bq Eq ENETDOWN Address cache operation (flush, add, delete) on a bridge that is in the down state. .It Bq Eq EPERM Super-user privilege is required to add and delete interfaces to and from bridges and to set the bridge interface flags. .It Bq Eq EFAULT The buffer used in a .Dv SIOCBRDGIFS or .Dv SIOCBRDGRTS request points outside of the process's allocated address space. .It Bq Eq ESRCH No such member interface in the bridge. .El .Sh NOTES Bridged packets pass through .Xr pf 4 twice. They can be filtered on any interface, in both directions. For stateful filtering, filtering on only one interface (using .Sq keep state ) and passing all traffic on the other interfaces is recommended. A state entry only permits outgoing packets from initial source to destination and incoming packets from initial destination to source. Since bridged packets pass through the filter twice with the source and destination addresses reversed between interfaces, two state entries (one for each direction) are required when all interfaces are filtered statefully. .Pp Return packets generated by PF itself are not routed using the kernel routing table. Instead, PF will send these replies back to the same Ethernet address that the original packet came from. This applies to rules with .Ar return , .Ar return-rst , .Ar return-icmp , .Ar return-icmp6 or .Ar synproxy defined. At the moment, only .Ar return-rst on IPv4 is implemented and the other packet generating rules are unsupported. .Pp If an IP packet is too large for the outgoing interface the bridge will perform IP fragmentation. This can happen when bridge members have different MTUs or when IP fragments are reassembled by .Xr pf 4 . Non-IP packets which are too large for the outgoing interface will be dropped. .Pp If the LINK2 flag is set on the .Nm bridge interface, the bridge will also perform transparent .Xr ipsec 4 processing on the packets (encrypt or decrypt them), according to the policies set with the .Xr ipsecadm 8 command by the administrator. If appropriate security associations (SAs) do not exist, any key management daemons such as .Xr isakmpd 8 that are running on the bridge will be invoked to establish the necessary SAs. These daemons have to be configured as if they were running on the host whose traffic they are protecting (i.e., they need to have the appropriate authentication and authorization material, such as keys and certificates, to impersonate the protected host(s). .Sh SEE ALSO .Xr errno 2 , .Xr ioctl 2 , .Xr arp 4 , .Xr gif 4 , .Xr ip 4 , .Xr ip6 4 , .Xr ipsec 4 , .Xr netintro 4 , .Xr pf 4 , .Xr bridgename.if 5 , .Xr brconfig 8 , .Xr ipsecadm 8 , .Xr isakmpd 8 .Sh HISTORY The .Xr brconfig 8 command and the .Nm bridge kernel interface first appeared in .Ox 2.5 . .Sh AUTHORS The .Xr brconfig 8 command and the .Nm bridge kernel interface were written by .An Jason L. Wright Aq jason@thought.net as part of an undergraduate independent study at the University of North Carolina at Greensboro.