* Send bridge packets through pfil if they are one of the types pfil can deal * with, or if they are ARP or REVARP. (pfil will pass ARP and REVARP without * question.) If *bifp or *ifp are NULL then packet filtering is skipped for * that interface. */
| 3165 | * that interface. |
| 3166 | */ |
| 3167 | static int |
| 3168 | bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir) |
| 3169 | { |
| 3170 | int snap, error, i, hlen; |
| 3171 | struct ether_header *eh1, eh2; |
| 3172 | struct ip *ip; |
| 3173 | struct llc llc1; |
| 3174 | u_int16_t ether_type; |
| 3175 | pfil_return_t rv; |
| 3176 | |
| 3177 | snap = 0; |
| 3178 | error = -1; /* Default error if not error == 0 */ |
| 3179 | |
| 3180 | #if 0 |
| 3181 | /* we may return with the IP fields swapped, ensure its not shared */ |
| 3182 | KASSERT(M_WRITABLE(*mp), ("%s: modifying a shared mbuf", __func__)); |
| 3183 | #endif |
| 3184 | |
| 3185 | if (V_pfil_bridge == 0 && V_pfil_member == 0 && V_pfil_ipfw == 0) |
| 3186 | return (0); /* filtering is disabled */ |
| 3187 | |
| 3188 | i = min((*mp)->m_pkthdr.len, max_protohdr); |
| 3189 | if ((*mp)->m_len < i) { |
| 3190 | *mp = m_pullup(*mp, i); |
| 3191 | if (*mp == NULL) { |
| 3192 | printf("%s: m_pullup failed\n", __func__); |
| 3193 | return (-1); |
| 3194 | } |
| 3195 | } |
| 3196 | |
| 3197 | eh1 = mtod(*mp, struct ether_header *); |
| 3198 | ether_type = ntohs(eh1->ether_type); |
| 3199 | |
| 3200 | /* |
| 3201 | * Check for SNAP/LLC. |
| 3202 | */ |
| 3203 | if (ether_type < ETHERMTU) { |
| 3204 | struct llc *llc2 = (struct llc *)(eh1 + 1); |
| 3205 | |
| 3206 | if ((*mp)->m_len >= ETHER_HDR_LEN + 8 && |
| 3207 | llc2->llc_dsap == LLC_SNAP_LSAP && |
| 3208 | llc2->llc_ssap == LLC_SNAP_LSAP && |
| 3209 | llc2->llc_control == LLC_UI) { |
| 3210 | ether_type = htons(llc2->llc_un.type_snap.ether_type); |
| 3211 | snap = 1; |
| 3212 | } |
| 3213 | } |
| 3214 | |
| 3215 | /* |
| 3216 | * If we're trying to filter bridge traffic, don't look at anything |
| 3217 | * other than IP and ARP traffic. If the filter doesn't understand |
| 3218 | * IPv6, don't allow IPv6 through the bridge either. This is lame |
| 3219 | * since if we really wanted, say, an AppleTalk filter, we are hosed, |
| 3220 | * but of course we don't have an AppleTalk filter to begin with. |
| 3221 | * (Note that since pfil doesn't understand ARP it will pass *ALL* |
| 3222 | * ARP traffic.) |
| 3223 | */ |
| 3224 | switch (ether_type) { |
no test coverage detected