if_veb: Add veb(4) pseudo network device

[acesp25]

Summary

veb(4) is a minimal L2 Ethernet bridge for virtual topologies such
as bhyve(8) VMs and VNET jail(8)s. It is modeled on OpenBSD's veb(4)
and derived from if_bridge.c, but it is not a replacement for
bridge(4): it has no STP, no pfil(9) hooks, and no implicit host
presence. The host joins a veb explicitly through a vport,
which behaves as an ordinary Ethernet interface.

We add the veb(4) driver as it's structure allows for:

• Treating host forwarding similar to any other member
• L2 logic only: ports are not allowed any inet/inet6 address (besides the vport)
• Faster forwarding (up to 29% faster on multicast scenarios) due to reduced m_dup and m_copyup calls during packet path
• Added security with explicit host presence
• Groundwork for Bhyve networking enhancements (i.e. easy bi-directional packet transfers)

These things are not possible for bridge(4).

veb is configured over netlink, and ifconfig(8) gains veb support.
Because veb ports reuse ifp->if_bridge, bridge_ifdetach() now checks
that the departing interface's if_bridge_input is bridge_input
before treating if_bridge as one of its members.

Notes:

• Control plane is netlink-only (IFLA_INFO_DATA for link attributes, plus a small "veb" genl family for the address table)
• Follow-up: ifconfig.8 documentation for veb commands

Feedback is especially welcome on the netlink implementation and the vport design.

Test Plan

17 tests in total, to run the tests:

$ kyua test -k /usr/tests/sys/net/Kyuafile if_veb
if_veb:bridge_mutual_exclusion  ->  passed  [0.098s]
if_veb:create_destroy  ->  passed  [0.083s]
if_veb:delete_with_ports  ->  passed  [0.083s]
if_veb:flags  ->  passed  [0.103s]
if_veb:learning  ->  passed  [0.139s]
if_veb:mtu  ->  passed  [0.130s]
if_veb:no_host_presence  ->  passed  [1.159s]
if_veb:port_add_del  ->  passed  [0.106s]
if_veb:port_departure  ->  passed  [0.079s]
if_veb:private_ports  ->  passed  [2.241s]
if_veb:static_addresses  ->  passed  [0.149s]
if_veb:timeout  ->  passed  [0.072s]
if_veb:transmit_ipv4_multicast  ->  passed  [1.171s]
if_veb:transmit_ipv4_unicast  ->  passed  [0.098s]
if_veb:unprivileged  ->  passed  [0.076s]
if_veb:vport_constraints  ->  passed  [0.097s]
if_veb:vport_host_path  ->  passed  [0.086s]

[kp]

The commit message needs to answer the 'why' question.
Why do we want this? We already have if_bridge, what does veb do that if_bridge does not?

Ideally the ifconfig changes should be split between libifconfig and ifconfig itself. (i.e. the netlink interfacing belongs in libifconfig, as useful functions for applications that want to interact with veb, and ifconfig should only have the argument parsing and calls to libifconfig.)

[acesp25]

Move netlink logic to libifconfig

Per kp@ suggestion; moved the netlink logic to libifconfig, ifconfig now uses libifconfig functions.
This also changes the way errors are returned from the driver, I adjusted the tests to match the proper functionality.

[ziaee]

lib/libifconfig/libifconfig_veb.c

2–28

We updated our preferred licensing guidelines for new files, take a look:

https://docs.freebsd.org/en/articles/license-guide/

Key points:

• The hyphen at the beginning was for a parser that never worked right and was scrapped ~20 years ago, we removed it from all our style guides
• All rights reserved is the default per the Berne convention agreed on by 182 countries
• The SPDX license identifier is a linux foundation initiative which is also an ISO spec to let us stop duplicating the text so many times in the same tree

sbin/ifconfig/ifveb.c

2–28

Ditto

share/man/man4/veb.4

2–27

We updated our preferred license for new files last year, check it out:

https://docs.freebsd.org/en/articles/license-guide/

sys/net/if_veb_nl.h

2–28

ditto

tests/sys/net/if_veb.sh

2–26

Ditto

[acesp25]

Updated copyright comments

Per ziaee@ suggestion, adjusted the newly created files to have the proper style of copyright comments.