Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC 253751 and 253843:

- Relax the restriction on the member interfaces with LLAs. Two or more
LLAs on the member interfaces are actually harmless when the parent
interface does not have a LLA.

- Add net.link.bridge.allow_llz_overlap. This is a knob to allow LLAs on
a bridge and the member interfaces at the same time. The default is 0.

Approved by: re (marius)

MFC 253093:

Make mandoc lint happy.

MFC 232379, 252511, 252548, 253060:

- Allow to configure net.inet6.ip6.{accept_rtadv,no_radr} by the
loader tunables as well because they have to be configured before
interface initialization for AF_INET6.

- Allow ND6_IFF_AUTO_LINKLOCAL for IFT_BRIDGE. An interface with IFT_BRIDGE
is initialized with !ND6_IFF_AUTO_LINKLOCAL && !ND6_IFF_ACCEPT_RTADV
regardless of net.inet6.ip6.accept_rtadv and net.inet6.ip6.auto_linklocal.
To configure an autoconfigured link-local address (RFC 4862), the
following rc.conf(5) configuration can be used:

ifconfig_bridge0_ipv6="inet6 auto_linklocal"

- if_bridge(4) now removes IPv6 addresses on a member interface to be
added when the parent interface or one of the existing member
interfaces has an IPv6 address. if_bridge(4) merges each link-local
scope zone which the member interfaces form respectively, so it causes
address scope violation. Removal of the IPv6 addresses prevents it.

- if_lagg(4) now removes IPv6 addresses on a member interfaces
unconditionally.

- Set reasonable flags to non-IPv6-capable interfaces.

MFC r235317:

General mdoc(7) and typo fixes.

PR: 167776

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Fix a bunch of typos and spelling mistakes.

bridge(4) acts like a switch, not like a hub.

PR: 141350
Submitted by: brucec
Reviewed by: thompsa
MFC after: 1 week

Rename man4/if_bridge.4 to man4/bridge.4 in order to be consistent with other
peueso interfaces. The .Nm name hasnt been changed and all xrefs are still
valid.

Fix and add a workaround on an issue of EtherIP packet with reversed
version field sent via gif(4)+if_bridge(4). The EtherIP
implementation found on FreeBSD 6.1, 6.2, 6.3, 7.0, 7.1, and 7.2 had
an interoperability issue because it sent the incorrect EtherIP
packets and discarded the correct ones.

This change introduces the following two flags to gif(4):

accept_rev_ethip_ver: accepts both correct EtherIP packets and ones
with reversed version field, if enabled. If disabled, the gif
accepts the correct packets only. This flag is enabled by
default.

send_rev_ethip_ver: sends EtherIP packets with reversed version field
intentionally, if enabled. If disabled, the gif sends the correct
packets only. This flag is disabled by default.

These flags are stored in struct gif_softc and can be set by
ifconfig(8) on per-interface basis.

Note that this is an incompatible change of EtherIP with the older
FreeBSD releases. If you need to interoperate older FreeBSD boxes and
new versions after this commit, setting "send_rev_ethip_ver" is
needed.

Reviewed by: thompsa and rwatson
Spotted by: Shunsuke SHINOMIYA
PR: kern/125003
MFC after: 2 weeks

Update example with feedback from thompsa@.

s/ath0/wlan0/ since we no longer use the real device directly.

Put the bridge mac inheritance behind a sysctl with the default off as this
still needs all the edge cases fixed.

Submitted by: Eygene Ryabinkin

Remove a comment about bridging wireless client, the new net80211 vap code
supports this.

Bump the document date.

Forgotten by: thompsa
Approved by: re (bmah)

Allow additional packet filtering on the physical interface for locally
destined packets, disabled by default.

PR: kern/116051
Submitted by: Eygene Ryabinkin
Approved by: re (bmah)
MFC after: 2 weeks

s/if_vlan/vlan/

Noted by: brueffer

Add description how the filter works in case of multiple interfaces
with the same MAC.

PR: kern/109815
MFC after: 7 days
Submitted by: Eygene Ryabinkin
Glanced by: rik (all pointy hats are mine)
Discussed with: julian@, rik@

Add a section about RSTP support.

Document net.link.bridge.ipfw_arp for filtering ARP packets with ipfw.

MFC after: 3 days

Spelling.

Fix a few nits with the last revision
- bump document date
- fix punctuation and whitespace

Pointed out by: bmah

- Note that the bridge uses a random MAC and can be overridden.
- Provide an example of assigning an IP to the bridge.

PR: kern/102607
Submitted by: Stefan Bethke <stb@lassitu.de>
MFC after: 3 days

Markup fixes.

Convert to the standard section 4 SYNOPSIS layout.

MFC after: 3 days

Document the log_stp variable.

Document that we can only bridge wireless interfaces in hostap mode, this is
becoming a faq.

MFC after: 1 week

Fix a formatting issue.

Correct sentence, forwarding non IP packets is now an option.

Minor improvements after last revision.

Reviewed by: thompsa

- use ath(4) in the wireless examples rather than the aging wi(4)
- make the packet filtering its own section and clarify a few points
- note that the interfaces need to be upped [1]

PR: docs/94545 [1]

Document the monitor mode and explain how it can be used.

Document which version of 802.1D STP we implement.

Add code that clears certain capabilities from the member interface, these are
restored when its removed from the bridge.

At the moment we only clear IFCAP_TXCSUM. Since a locally generated packet on
the bridge may be sent out any one or more interfaces it cant be assumed that
every card does hardware csums. Most bridges don't generate a lot of traffic
themselves so turning off offloading won't hurt, bridged packets are
unaffected.

Tested by: Bruce Walker (bmw borderware.com)
MFC after: 5 days

When pfil(9) is enabled the bridge only considers ETHERTYPE_ARP, ETHERTYPE_IP and
ETHERTYPE_IPV6 frames. Change this to be a sysctl knob so that is able to still
bridge non-IP packets if desired.

Also return early if all pfil_* sysctls are turned off, the user obviously does
not want to filter on the bridge.

Add RFC 3378 EtherIP support. This change makes it possible to add gif
interfaces to bridges, which will then send and receive IP protocol 97 packets.
Packets are Ethernet frames with an EtherIP header prepended.

Obtained from: NetBSD
MFC after: 2 weeks

-mdoc sweep.

Clarify that any firewall that has pfil(9) hooks can be used.

Suggested by: sam
Approved by: mlaier (mentor)
MFC after: 3 days

Previously the bridge MTU was set to ETHERMTU and could not be changed. Since
we can only bridge interfaces with the same value it meant that all members had
to be set at ETHERMTU as well.

Allow the first member to be added to define the MTU for the bridge, the check
still applies to all additional members.

Print an informative message if the MTU is incorrect [1]

Requested by: Niki Denev [1]
Approved by: mlaier (mentor)
MFC after: 3 days

Fix a type-o in a bridging example.

Submitted by: Niki Denev
Approved by: mlaier (mentor)
Approved by: re (blanket)

(Mostly) markup fixes.

Approved by: re (blanket)

Add dummynet(4) support to if_bridge, this code is largely based on bridge.c.

This is the final piece to match bridge.c in functionality, we can now be a
drop-in replacement.

Approved by: mlaier (mentor)

Bring in IPFW layer2 filtering from bridge.c, this allows Ethernet filtering
using the layer2, mac and mac-type keywords.

This is one of the last features that bridge.c has over if_bridge and gets us
very close to a full functional replacement.

Approved by: mlaier (mentor)

Add if_bridge, which provides more advanced Ethernet bridging and 802.1d
spanning tree support.

Based on Jason Wright's bridge driver from OpenBSD, and modified by Jason R.
Thorpe in NetBSD.

Reviewed by: mlaier, bms, green
Silence from: -net
Approved by: mlaier (mentor)
Obtained from: NetBSD