if_pfsync.c revision 171637
190075Sobrien/* $OpenBSD: if_pfsync.c,v 1.73 2006/11/16 13:13:38 henning Exp $ */ 290075Sobrien 3169689Skan/* 4169689Skan * Copyright (c) 2002 Michael Shalayeff 590075Sobrien * All rights reserved. 690075Sobrien * 790075Sobrien * Redistribution and use in source and binary forms, with or without 890075Sobrien * modification, are permitted provided that the following conditions 990075Sobrien * are met: 1090075Sobrien * 1. Redistributions of source code must retain the above copyright 1190075Sobrien * notice, this list of conditions and the following disclaimer. 1290075Sobrien * 2. Redistributions in binary form must reproduce the above copyright 1390075Sobrien * notice, this list of conditions and the following disclaimer in the 1490075Sobrien * documentation and/or other materials provided with the distribution. 1590075Sobrien * 1690075Sobrien * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1790075Sobrien * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1890075Sobrien * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 1990075Sobrien * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 20169689Skan * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21169689Skan * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 2290075Sobrien * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2390075Sobrien * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24132718Skan * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 2590075Sobrien * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 2690075Sobrien * THE POSSIBILITY OF SUCH DAMAGE. 2790075Sobrien */ 2890075Sobrien 2990075Sobrien#ifdef __FreeBSD__ 3090075Sobrien#include "opt_inet.h" 3190075Sobrien#include "opt_inet6.h" 3290075Sobrien#include "opt_carp.h" 3390075Sobrien#include "opt_bpf.h" 3490075Sobrien#include "opt_pf.h" 3590075Sobrien 3690075Sobrien#include <sys/cdefs.h> 3790075Sobrien__FBSDID("$FreeBSD: head/sys/contrib/pf/net/if_pfsync.c 171637 2007-07-28 07:31:30Z rwatson $"); 3890075Sobrien 3990075Sobrien#ifdef DEV_BPF 4090075Sobrien#define NBPFILTER DEV_BPF 4190075Sobrien#else 42117395Skan#define NBPFILTER 0 43132718Skan#endif 44132718Skan 45132718Skan#ifdef DEV_PFSYNC 46132718Skan#define NPFSYNC DEV_PFSYNC 4790075Sobrien#else 4890075Sobrien#define NPFSYNC 0 4990075Sobrien#endif 5090075Sobrien 51132718Skan#ifdef DEV_CARP 52132718Skan#define NCARP DEV_CARP 5390075Sobrien#else 5490075Sobrien#define NCARP 0 5590075Sobrien#endif 5690075Sobrien#endif /* __FreeBSD__ */ 5790075Sobrien 5890075Sobrien#include <sys/param.h> 5990075Sobrien#ifdef __FreeBSD__ 6090075Sobrien#include <sys/priv.h> 6190075Sobrien#endif 6290075Sobrien#include <sys/proc.h> 6390075Sobrien#include <sys/systm.h> 64169689Skan#include <sys/time.h> 65169689Skan#include <sys/mbuf.h> 66169689Skan#include <sys/socket.h> 67169689Skan#ifdef __FreeBSD__ 68132718Skan#include <sys/endian.h> 6990075Sobrien#include <sys/malloc.h> 7090075Sobrien#include <sys/module.h> 7190075Sobrien#include <sys/sockio.h> 72169689Skan#include <sys/taskqueue.h> 7390075Sobrien#include <sys/lock.h> 74132718Skan#include <sys/mutex.h> 75132718Skan#include <sys/sysctl.h> 7690075Sobrien#else 77169689Skan#include <sys/ioctl.h> 78169689Skan#include <sys/timeout.h> 7990075Sobrien#endif 8090075Sobrien#include <sys/kernel.h> 8190075Sobrien 82132718Skan#include <net/if.h> 8390075Sobrien#ifdef __FreeBSD__ 84169689Skan#include <net/if_clone.h> 85169689Skan#endif 8690075Sobrien#include <net/if_types.h> 87169689Skan#include <net/route.h> 88169689Skan#include <net/bpf.h> 89169689Skan#include <netinet/in.h> 90169689Skan#include <netinet/if_ether.h> 91169689Skan#include <netinet/tcp.h> 92169689Skan#include <netinet/tcp_seq.h> 9390075Sobrien 9490075Sobrien#ifdef INET 9590075Sobrien#include <netinet/in_systm.h> 9690075Sobrien#include <netinet/in_var.h> 9790075Sobrien#include <netinet/ip.h> 9890075Sobrien#include <netinet/ip_var.h> 99169689Skan#endif 10090075Sobrien 10190075Sobrien#ifdef INET6 102169689Skan#include <netinet6/nd6.h> 10390075Sobrien#endif /* INET6 */ 10490075Sobrien 10590075Sobrien#ifndef __FreeBSD__ 10690075Sobrien#include "carp.h" 10790075Sobrien#endif 108132718Skan#if NCARP > 0 10990075Sobrien#include <netinet/ip_carp.h> 110117395Skan#endif 11190075Sobrien 112169689Skan#include <net/pfvar.h> 11390075Sobrien#include <net/if_pfsync.h> 114117395Skan 11590075Sobrien#ifndef __FreeBSD__ 116169689Skan#include "bpfilter.h" 117169689Skan#include "pfsync.h" 118169689Skan#endif 119169689Skan 12090075Sobrien#define PFSYNC_MINMTU \ 12190075Sobrien (sizeof(struct pfsync_header) + sizeof(struct pf_state)) 122169689Skan 123169689Skan#ifdef PFSYNCDEBUG 124169689Skan#define DPRINTF(x) do { if (pfsyncdebug) printf x ; } while (0) 125169689Skanint pfsyncdebug; 12690075Sobrien#else 127169689Skan#define DPRINTF(x) 12890075Sobrien#endif 12990075Sobrien 13090075Sobrienstruct pfsync_softc *pfsyncif = NULL; 13190075Sobrienstruct pfsyncstats pfsyncstats; 13290075Sobrien#ifdef __FreeBSD__ 133132718SkanSYSCTL_DECL(_net_inet_pfsync); 13490075SobrienSYSCTL_STRUCT(_net_inet_pfsync, 0, stats, CTLFLAG_RW, 13590075Sobrien &pfsyncstats, pfsyncstats, 136169689Skan "PFSYNC statistics (struct pfsyncstats, net/if_pfsync.h)"); 13790075Sobrien#endif 13890075Sobrien 13990075Sobrienvoid pfsyncattach(int); 140117395Skan#ifdef __FreeBSD__ 141117395Skanint pfsync_clone_create(struct if_clone *, int, caddr_t); 142132718Skanvoid pfsync_clone_destroy(struct ifnet *); 143117395Skan#else 144117395Skanint pfsync_clone_create(struct if_clone *, int); 145117395Skanint pfsync_clone_destroy(struct ifnet *); 146117395Skan#endif 147117395Skanvoid pfsync_setmtu(struct pfsync_softc *, int); 148117395Skanint pfsync_alloc_scrub_memory(struct pfsync_state_peer *, 14990075Sobrien struct pf_state_peer *); 150117395Skanint pfsync_insert_net_state(struct pfsync_state *, u_int8_t); 15190075Sobrien#ifdef PFSYNC_TDB 152132718Skanvoid pfsync_update_net_tdb(struct pfsync_tdb *); 15396263Sobrien#endif 154117395Skanint pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *, 155117395Skan struct rtentry *); 156169689Skanint pfsyncioctl(struct ifnet *, u_long, caddr_t); 157169689Skanvoid pfsyncstart(struct ifnet *); 158117395Skan 159117395Skanstruct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **); 160117395Skanint pfsync_request_update(struct pfsync_state_upd *, struct in_addr *); 161117395Skanint pfsync_sendout(struct pfsync_softc *); 162132718Skan#ifdef PFSYNC_TDB 163117395Skanint pfsync_tdb_sendout(struct pfsync_softc *); 164117395Skan#endif 165117395Skanint pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *); 166132718Skanvoid pfsync_timeout(void *); 167169689Skan#ifdef PFSYNC_TDB 168169689Skanvoid pfsync_tdb_timeout(void *); 169169689Skan#endif 170169689Skanvoid pfsync_send_bus(struct pfsync_softc *, u_int8_t); 171169689Skanvoid pfsync_bulk_update(void *); 172117395Skanvoid pfsync_bulkfail(void *); 173169689Skan 174117395Skan#ifdef __FreeBSD__ 175117395Skanvoid pfsync_ifdetach(void *, struct ifnet *); 176117395Skanvoid pfsync_senddef(void *, int); 177117395Skan 178169689Skan/* XXX: ugly */ 179117395Skan#define betoh64 (unsigned long long)be64toh 180169689Skan#define timeout_del callout_stop 181169689Skan#endif 182169689Skan 183117395Skanint pfsync_sync_ok; 184117395Skan#ifndef __FreeBSD__ 185117395Skanextern int ifqmaxlen; 186117395Skan#endif 187117395Skan 188117395Skan#ifdef __FreeBSD__ 189132718SkanIFC_SIMPLE_DECLARE(pfsync, 1); 190117395Skan#else 191117395Skanstruct if_clone pfsync_cloner = 192169689Skan IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy); 193117395Skan#endif 194169689Skan 195169689Skanvoid 196169689Skanpfsyncattach(int npfsync) 197169689Skan{ 198169689Skan if_clone_attach(&pfsync_cloner); 19996263Sobrien} 200117395Skan 201169689Skanint 202169689Skan#ifdef __FreeBSD__ 203169689Skanpfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param) 204169689Skan#else 205169689Skanpfsync_clone_create(struct if_clone *ifc, int unit) 206169689Skan#endif 207169689Skan{ 208169689Skan struct ifnet *ifp; 209169689Skan 210169689Skan if (unit != 0) 211169689Skan return (EINVAL); 212169689Skan 213169689Skan pfsync_sync_ok = 1; 214169689Skan if ((pfsyncif = malloc(sizeof(*pfsyncif), M_DEVBUF, M_NOWAIT)) == NULL) 215169689Skan return (ENOMEM); 216169689Skan bzero(pfsyncif, sizeof(*pfsyncif)); 217169689Skan#ifdef __FreeBSD__ 218169689Skan if ((pfsyncif->sc_imo.imo_membership = (struct in_multi **)malloc( 219169689Skan (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_DEVBUF, 220169689Skan M_NOWAIT)) == NULL) { 221169689Skan free(pfsyncif, M_DEVBUF); 222169689Skan return (ENOSPC); 223169689Skan } 224169689Skan pfsyncif->sc_imo.imo_mfilters = NULL; 225169689Skan pfsyncif->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS; 226169689Skan pfsyncif->sc_imo.imo_multicast_vif = -1; 227169689Skan 228169689Skan ifp = pfsyncif->sc_ifp = if_alloc(IFT_PFSYNC); 229169689Skan if (ifp == NULL) { 230169689Skan free(pfsyncif->sc_imo.imo_membership, M_DEVBUF); 231169689Skan free(pfsyncif, M_DEVBUF); 232169689Skan return (ENOSPC); 233169689Skan } 234169689Skan if_initname(ifp, ifc->ifc_name, unit); 235169689Skan 236169689Skan pfsyncif->sc_detachtag = EVENTHANDLER_REGISTER(ifnet_departure_event, 237169689Skan pfsync_ifdetach, pfsyncif, EVENTHANDLER_PRI_ANY); 238169689Skan if (pfsyncif->sc_detachtag == NULL) { 239169689Skan if_free(ifp); 240169689Skan free(pfsyncif->sc_imo.imo_membership, M_DEVBUF); 241169689Skan free(pfsyncif, M_DEVBUF); 242169689Skan return (ENOSPC); 243169689Skan } 244169689Skan 245169689Skan pfsyncif->sc_ifq.ifq_maxlen = ifqmaxlen; 246169689Skan mtx_init(&pfsyncif->sc_ifq.ifq_mtx, ifp->if_xname, 247169689Skan "pfsync send queue", MTX_DEF); 248169689Skan TASK_INIT(&pfsyncif->sc_send_task, 0, pfsync_senddef, pfsyncif); 249169689Skan#endif 250169689Skan pfsyncif->sc_mbuf = NULL; 251169689Skan pfsyncif->sc_mbuf_net = NULL; 252169689Skan#ifdef PFSYNC_TDB 253169689Skan pfsyncif->sc_mbuf_tdb = NULL; 254169689Skan#endif 255169689Skan pfsyncif->sc_statep.s = NULL; 256169689Skan pfsyncif->sc_statep_net.s = NULL; 257169689Skan#ifdef PFSYNC_TDB 258117395Skan pfsyncif->sc_statep_tdb.t = NULL; 259117395Skan#endif 260117395Skan pfsyncif->sc_maxupdates = 128; 26196263Sobrien#ifdef __FreeBSD__ 262117395Skan pfsyncif->sc_sync_peer.s_addr = htonl(INADDR_PFSYNC_GROUP); 263132718Skan pfsyncif->sc_sendaddr.s_addr = htonl(INADDR_PFSYNC_GROUP); 26490075Sobrien#else 265117395Skan pfsyncif->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP; 266169689Skan pfsyncif->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP; 267117395Skan#endif 26890075Sobrien pfsyncif->sc_ureq_received = 0; 269117395Skan pfsyncif->sc_ureq_sent = 0; 270117395Skan pfsyncif->sc_bulk_send_next = NULL; 271117395Skan pfsyncif->sc_bulk_terminator = NULL; 27296263Sobrien#ifndef __FreeBSD__ 273169689Skan ifp = &pfsyncif->sc_if; 274169689Skan snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit); 275117395Skan#endif 276169689Skan ifp->if_softc = pfsyncif; 277169689Skan ifp->if_ioctl = pfsyncioctl; 278117395Skan ifp->if_output = pfsyncoutput; 27990075Sobrien ifp->if_start = pfsyncstart; 280132718Skan ifp->if_type = IFT_PFSYNC; 28190075Sobrien ifp->if_snd.ifq_maxlen = ifqmaxlen; 28290075Sobrien ifp->if_hdrlen = PFSYNC_HDRLEN; 28390075Sobrien pfsync_setmtu(pfsyncif, ETHERMTU); 28490075Sobrien#ifdef __FreeBSD__ 285169689Skan callout_init(&pfsyncif->sc_tmo, CALLOUT_MPSAFE); 28690075Sobrien#ifdef PFSYNC_TDB 287169689Skan callout_init(&pfsyncif->sc_tdb_tmo, CALLOUT_MPSAFE); 288169689Skan#endif 289169689Skan callout_init(&pfsyncif->sc_bulk_tmo, CALLOUT_MPSAFE); 290169689Skan callout_init(&pfsyncif->sc_bulkfail_tmo, CALLOUT_MPSAFE); 29190075Sobrien#else 292169689Skan timeout_set(&pfsyncif->sc_tmo, pfsync_timeout, pfsyncif); 293169689Skan timeout_set(&pfsyncif->sc_tdb_tmo, pfsync_tdb_timeout, pfsyncif); 294169689Skan timeout_set(&pfsyncif->sc_bulk_tmo, pfsync_bulk_update, pfsyncif); 295169689Skan timeout_set(&pfsyncif->sc_bulkfail_tmo, pfsync_bulkfail, pfsyncif); 296169689Skan#endif 297169689Skan if_attach(ifp); 298169689Skan#ifndef __FreeBSD__ 299169689Skan if_alloc_sadl(ifp); 30090075Sobrien#endif 301169689Skan 302169689Skan#if NCARP > 0 303169689Skan if_addgroup(ifp, "carp"); 30490075Sobrien#endif 305169689Skan 306169689Skan#if NBPFILTER > 0 30790075Sobrien#ifdef __FreeBSD__ 30890075Sobrien bpfattach(ifp, DLT_PFSYNC, PFSYNC_HDRLEN); 309169689Skan#else 31090075Sobrien bpfattach(&pfsyncif->sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN); 31190075Sobrien#endif 31290075Sobrien#endif 31390075Sobrien 31490075Sobrien return (0); 31590075Sobrien} 316132718Skan 31790075Sobrien#ifdef __FreeBSD__ 318169689Skanvoid 319169689Skan#else 320169689Skanint 321169689Skan#endif 322169689Skanpfsync_clone_destroy(struct ifnet *ifp) 323169689Skan{ 324169689Skan#ifdef __FreeBSD__ 325169689Skan EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfsyncif->sc_detachtag); 326169689Skan callout_stop(&pfsyncif->sc_tmo); 327169689Skan#ifdef PFSYNC_TDB 32890075Sobrien callout_stop(&pfsyncif->sc_tdb_tmo); 32990075Sobrien#endif 33090075Sobrien callout_stop(&pfsyncif->sc_bulk_tmo); 33190075Sobrien callout_stop(&pfsyncif->sc_bulkfail_tmo); 33290075Sobrien /* XXX: more? */ 33390075Sobrien#endif 334132718Skan 33590075Sobrien#if NBPFILTER > 0 33690075Sobrien bpfdetach(ifp); 33790075Sobrien#endif 33890075Sobrien if_detach(ifp); 33990075Sobrien#ifdef __FreeBSD__ 34090075Sobrien if_free(ifp); 34190075Sobrien free(pfsyncif->sc_imo.imo_membership, M_DEVBUF); 34290075Sobrien#endif 34390075Sobrien free(pfsyncif, M_DEVBUF); 34490075Sobrien pfsyncif = NULL; 34590075Sobrien#ifndef __FreeBSD__ 346132718Skan return (0); 34790075Sobrien#endif 348169689Skan} 349169689Skan 35090075Sobrien/* 351169689Skan * Start output on the pfsync interface. 352169689Skan */ 35390075Sobrienvoid 35490075Sobrienpfsyncstart(struct ifnet *ifp) 35590075Sobrien{ 35690075Sobrien struct mbuf *m; 35790075Sobrien#ifndef __FreeBSD__ 35890075Sobrien int s; 35990075Sobrien#endif 360132718Skan 36190075Sobrien for (;;) { 362169689Skan#ifdef __FreeBSD__ 36390075Sobrien IF_LOCK(&ifp->if_snd); 364169689Skan _IF_DROP(&ifp->if_snd); 36590075Sobrien _IF_DEQUEUE(&ifp->if_snd, m); 366169689Skan IF_UNLOCK(&ifp->if_snd); 367169689Skan#else 36890075Sobrien s = splnet(); 369169689Skan IF_DROP(&ifp->if_snd); 370169689Skan IF_DEQUEUE(&ifp->if_snd, m); 371169689Skan splx(s); 37290075Sobrien#endif 37390075Sobrien 37490075Sobrien if (m == NULL) 37590075Sobrien return; 37690075Sobrien else 377132718Skan m_freem(m); 37890075Sobrien } 37990075Sobrien} 38090075Sobrien 381169689Skanint 382169689Skanpfsync_alloc_scrub_memory(struct pfsync_state_peer *s, 38390075Sobrien struct pf_state_peer *d) 38490075Sobrien{ 38590075Sobrien if (s->scrub.scrub_flag && d->scrub == NULL) { 386117395Skan d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT); 387117395Skan if (d->scrub == NULL) 38890075Sobrien return (ENOMEM); 38990075Sobrien bzero(d->scrub, sizeof(*d->scrub)); 39090075Sobrien } 39190075Sobrien 39290075Sobrien return (0); 39390075Sobrien} 39490075Sobrien 39590075Sobrienint 39690075Sobrienpfsync_insert_net_state(struct pfsync_state *sp, u_int8_t chksum_flag) 39790075Sobrien{ 39890075Sobrien struct pf_state *st = NULL; 39990075Sobrien struct pf_rule *r = NULL; 40090075Sobrien struct pfi_kif *kif; 401132718Skan 40290075Sobrien if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) { 403169689Skan printf("pfsync_insert_net_state: invalid creator id:" 40490075Sobrien " %08x\n", ntohl(sp->creatorid)); 405169689Skan return (EINVAL); 40690075Sobrien } 40790075Sobrien 408169689Skan kif = pfi_kif_get(sp->ifname); 40990075Sobrien if (kif == NULL) { 410117395Skan if (pf_status.debug >= PF_DEBUG_MISC) 411169689Skan printf("pfsync_insert_net_state: " 412117395Skan "unknown interface: %s\n", sp->ifname); 413132718Skan /* skip this state */ 414117395Skan return (0); 415117395Skan } 416117395Skan 417117395Skan /* 418169689Skan * If the ruleset checksums match, it's safe to associate the state 419169689Skan * with the rule of that number. 420117395Skan */ 42190075Sobrien if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) && chksum_flag) 422169689Skan r = pf_main_ruleset.rules[ 423169689Skan PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)]; 424169689Skan else 425169689Skan r = &pf_default_rule; 426169689Skan 42790075Sobrien if (!r->max_states || r->states < r->max_states) 428169689Skan st = pool_get(&pf_state_pl, PR_NOWAIT); 42990075Sobrien if (st == NULL) { 430169689Skan pfi_kif_unref(kif, PFI_KIF_REF_NONE); 431169689Skan return (ENOMEM); 432169689Skan } 433169689Skan bzero(st, sizeof(*st)); 43490075Sobrien 435169689Skan /* allocate memory for scrub info */ 436169689Skan if (pfsync_alloc_scrub_memory(&sp->src, &st->src) || 43790075Sobrien pfsync_alloc_scrub_memory(&sp->dst, &st->dst)) { 438169689Skan pfi_kif_unref(kif, PFI_KIF_REF_NONE); 439169689Skan if (st->src.scrub) 440169689Skan pool_put(&pf_state_scrub_pl, st->src.scrub); 441169689Skan pool_put(&pf_state_pl, st); 442169689Skan return (ENOMEM); 443169689Skan } 444169689Skan 445169689Skan st->rule.ptr = r; 446169689Skan /* XXX get pointers to nat_rule and anchor */ 447169689Skan 448169689Skan /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */ 449169689Skan r->states++; 450169689Skan 451169689Skan /* fill in the rest of the state entry */ 452169689Skan pf_state_host_ntoh(&sp->lan, &st->lan); 453169689Skan pf_state_host_ntoh(&sp->gwy, &st->gwy); 454169689Skan pf_state_host_ntoh(&sp->ext, &st->ext); 455169689Skan 456169689Skan pf_state_peer_ntoh(&sp->src, &st->src); 457169689Skan pf_state_peer_ntoh(&sp->dst, &st->dst); 458169689Skan 459169689Skan bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr)); 460169689Skan st->creation = time_second - ntohl(sp->creation); 461169689Skan st->expire = ntohl(sp->expire) + time_second; 462169689Skan 463169689Skan st->af = sp->af; 464169689Skan st->proto = sp->proto; 465169689Skan st->direction = sp->direction; 466169689Skan st->log = sp->log; 467169689Skan st->timeout = sp->timeout; 468169689Skan st->allow_opts = sp->allow_opts; 469169689Skan 470169689Skan bcopy(sp->id, &st->id, sizeof(st->id)); 471169689Skan st->creatorid = sp->creatorid; 472169689Skan st->sync_flags = PFSTATE_FROMSYNC; 473169689Skan 474169689Skan if (pf_insert_state(kif, st)) { 475169689Skan pfi_kif_unref(kif, PFI_KIF_REF_NONE); 476169689Skan /* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */ 477169689Skan r->states--; 478169689Skan if (st->dst.scrub) 479169689Skan pool_put(&pf_state_scrub_pl, st->dst.scrub); 480169689Skan if (st->src.scrub) 481169689Skan pool_put(&pf_state_scrub_pl, st->src.scrub); 48290075Sobrien pool_put(&pf_state_pl, st); 483169689Skan return (EINVAL); 48490075Sobrien } 485169689Skan 486169689Skan return (0); 487169689Skan} 488169689Skan 489169689Skanvoid 490169689Skan#ifdef __FreeBSD__ 49190075Sobrienpfsync_input(struct mbuf *m, __unused int off) 492117395Skan#else 493117395Skanpfsync_input(struct mbuf *m, ...) 494117395Skan#endif 495117395Skan{ 496117395Skan struct ip *ip = mtod(m, struct ip *); 497117395Skan struct pfsync_header *ph; 49890075Sobrien struct pfsync_softc *sc = pfsyncif; 499169689Skan struct pf_state *st; 500169689Skan struct pf_state_cmp key; 50190075Sobrien struct pfsync_state *sp; 502169689Skan struct pfsync_state_upd *up; 50390075Sobrien struct pfsync_state_del *dp; 504169689Skan struct pfsync_state_clr *cp; 505169689Skan struct pfsync_state_upd_req *rup; 506169689Skan struct pfsync_state_bus *bus; 507169689Skan#ifdef PFSYNC_TDB 50890075Sobrien struct pfsync_tdb *pt; 509169689Skan#endif 51090075Sobrien struct in_addr src; 511169689Skan struct mbuf *mp; 512169689Skan int iplen, action, error, i, s, count, offp, sfail, stale = 0; 513169689Skan u_int8_t chksum_flag = 0; 514169689Skan 515169689Skan pfsyncstats.pfsyncs_ipackets++; 516169689Skan 517169689Skan /* verify that we have a sync interface configured */ 518169689Skan if (!sc || !sc->sc_sync_ifp || !pf_status.running) 51990075Sobrien goto done; 520169689Skan 521169689Skan /* verify that the packet came in on the right interface */ 522169689Skan if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) { 523169689Skan pfsyncstats.pfsyncs_badif++; 524169689Skan goto done; 525169689Skan } 52690075Sobrien 527169689Skan /* verify that the IP TTL is 255. */ 528169689Skan if (ip->ip_ttl != PFSYNC_DFLTTL) { 529117395Skan pfsyncstats.pfsyncs_badttl++; 530169689Skan goto done; 531169689Skan } 532169689Skan 533169689Skan iplen = ip->ip_hl << 2; 534169689Skan 535169689Skan if (m->m_pkthdr.len < iplen + sizeof(*ph)) { 536169689Skan pfsyncstats.pfsyncs_hdrops++; 537169689Skan goto done; 538169689Skan } 539169689Skan 540169689Skan if (iplen + sizeof(*ph) > m->m_len) { 541169689Skan if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) { 542169689Skan pfsyncstats.pfsyncs_hdrops++; 543169689Skan goto done; 544169689Skan } 545169689Skan ip = mtod(m, struct ip *); 546169689Skan } 547169689Skan ph = (struct pfsync_header *)((char *)ip + iplen); 548169689Skan 549169689Skan /* verify the version */ 550169689Skan if (ph->version != PFSYNC_VERSION) { 551169689Skan pfsyncstats.pfsyncs_badver++; 552169689Skan goto done; 553169689Skan } 554169689Skan 555169689Skan action = ph->action; 556169689Skan count = ph->count; 557169689Skan 558169689Skan /* make sure it's a valid action code */ 559169689Skan if (action >= PFSYNC_ACT_MAX) { 560169689Skan pfsyncstats.pfsyncs_badact++; 561169689Skan goto done; 562169689Skan } 563169689Skan 564169689Skan /* Cheaper to grab this now than having to mess with mbufs later */ 565169689Skan src = ip->ip_src; 566169689Skan 567169689Skan if (!bcmp(&ph->pf_chksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH)) 568169689Skan chksum_flag++; 569169689Skan 570169689Skan switch (action) { 571169689Skan case PFSYNC_ACT_CLR: { 572169689Skan struct pf_state *nexts; 573169689Skan struct pfi_kif *kif; 574169689Skan u_int32_t creatorid; 575169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 576169689Skan sizeof(*cp), &offp)) == NULL) { 577169689Skan pfsyncstats.pfsyncs_badlen++; 578169689Skan return; 579169689Skan } 580169689Skan cp = (struct pfsync_state_clr *)(mp->m_data + offp); 581169689Skan creatorid = cp->creatorid; 582169689Skan 58390075Sobrien s = splsoftnet(); 58490075Sobrien#ifdef __FreeBSD__ 585169689Skan PF_LOCK(); 586169689Skan#endif 587169689Skan if (cp->ifname[0] == '\0') { 588169689Skan for (st = RB_MIN(pf_state_tree_id, &tree_id); 589169689Skan st; st = nexts) { 590169689Skan nexts = RB_NEXT(pf_state_tree_id, &tree_id, st); 591169689Skan if (st->creatorid == creatorid) { 59290075Sobrien st->sync_flags |= PFSTATE_FROMSYNC; 59390075Sobrien pf_unlink_state(st); 59490075Sobrien } 59590075Sobrien } 596132718Skan } else { 59790075Sobrien if ((kif = pfi_kif_get(cp->ifname)) == NULL) { 598169689Skan#ifdef __FreeBSD__ 59990075Sobrien PF_UNLOCK(); 60090075Sobrien#endif 60190075Sobrien splx(s); 602132718Skan return; 60390075Sobrien } 60490075Sobrien for (st = RB_MIN(pf_state_tree_lan_ext, 60590075Sobrien &kif->pfik_lan_ext); st; st = nexts) { 60690075Sobrien nexts = RB_NEXT(pf_state_tree_lan_ext, 60790075Sobrien &kif->pfik_lan_ext, st); 60890075Sobrien if (st->creatorid == creatorid) { 60990075Sobrien st->sync_flags |= PFSTATE_FROMSYNC; 61090075Sobrien pf_unlink_state(st); 61190075Sobrien } 61290075Sobrien } 61390075Sobrien } 61490075Sobrien#ifdef __FreeBSD__ 61590075Sobrien PF_UNLOCK(); 61690075Sobrien#endif 61790075Sobrien splx(s); 61890075Sobrien 61990075Sobrien break; 62090075Sobrien } 62190075Sobrien case PFSYNC_ACT_INS: 62290075Sobrien if ((mp = m_pulldown(m, iplen + sizeof(*ph), 62390075Sobrien count * sizeof(*sp), &offp)) == NULL) { 624132718Skan pfsyncstats.pfsyncs_badlen++; 625132718Skan return; 626169689Skan } 627169689Skan 628132718Skan s = splsoftnet(); 62990075Sobrien#ifdef __FreeBSD__ 63090075Sobrien PF_LOCK(); 63190075Sobrien#endif 63290075Sobrien for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 63390075Sobrien i < count; i++, sp++) { 63490075Sobrien /* check for invalid values */ 63590075Sobrien if (sp->timeout >= PFTM_MAX || 63690075Sobrien sp->src.state > PF_TCPS_PROXY_DST || 63790075Sobrien sp->dst.state > PF_TCPS_PROXY_DST || 63890075Sobrien sp->direction > PF_OUT || 63990075Sobrien (sp->af != AF_INET && sp->af != AF_INET6)) { 64090075Sobrien if (pf_status.debug >= PF_DEBUG_MISC) 64190075Sobrien printf("pfsync_insert: PFSYNC_ACT_INS: " 64290075Sobrien "invalid value\n"); 64390075Sobrien pfsyncstats.pfsyncs_badstate++; 64490075Sobrien continue; 64590075Sobrien } 64690075Sobrien 64790075Sobrien if ((error = pfsync_insert_net_state(sp, 64890075Sobrien chksum_flag))) { 64990075Sobrien if (error == ENOMEM) { 65090075Sobrien#ifdef __FreeBSD__ 65190075Sobrien PF_UNLOCK(); 65290075Sobrien#endif 65390075Sobrien splx(s); 65490075Sobrien goto done; 65590075Sobrien } 65690075Sobrien continue; 65790075Sobrien } 658117395Skan } 65990075Sobrien#ifdef __FreeBSD__ 66090075Sobrien PF_UNLOCK(); 66190075Sobrien#endif 662132718Skan splx(s); 66390075Sobrien break; 66490075Sobrien case PFSYNC_ACT_UPD: 665169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 66690075Sobrien count * sizeof(*sp), &offp)) == NULL) { 66790075Sobrien pfsyncstats.pfsyncs_badlen++; 66890075Sobrien return; 66990075Sobrien } 67090075Sobrien 67190075Sobrien s = splsoftnet(); 67290075Sobrien#ifdef __FreeBSD__ 67390075Sobrien PF_LOCK(); 674132718Skan#endif 67590075Sobrien for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 67690075Sobrien i < count; i++, sp++) { 67790075Sobrien int flags = PFSYNC_FLAG_STALE; 67890075Sobrien 67990075Sobrien /* check for invalid values */ 68090075Sobrien if (sp->timeout >= PFTM_MAX || 68190075Sobrien sp->src.state > PF_TCPS_PROXY_DST || 68290075Sobrien sp->dst.state > PF_TCPS_PROXY_DST) { 683169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 684169689Skan printf("pfsync_insert: PFSYNC_ACT_UPD: " 685169689Skan "invalid value\n"); 68690075Sobrien pfsyncstats.pfsyncs_badstate++; 687132718Skan continue; 68890075Sobrien } 68990075Sobrien 690117395Skan bcopy(sp->id, &key.id, sizeof(key.id)); 69190075Sobrien key.creatorid = sp->creatorid; 692117395Skan 693117395Skan st = pf_find_state_byid(&key); 69490075Sobrien if (st == NULL) { 69590075Sobrien /* insert the update */ 69690075Sobrien if (pfsync_insert_net_state(sp, chksum_flag)) 69790075Sobrien pfsyncstats.pfsyncs_badstate++; 69890075Sobrien continue; 69990075Sobrien } 700132718Skan sfail = 0; 70190075Sobrien if (st->proto == IPPROTO_TCP) { 702117395Skan /* 70390075Sobrien * The state should never go backwards except 704117395Skan * for syn-proxy states. Neither should the 705117395Skan * sequence window slide backwards. 70690075Sobrien */ 70790075Sobrien if (st->src.state > sp->src.state && 70890075Sobrien (st->src.state < PF_TCPS_PROXY_SRC || 70990075Sobrien sp->src.state >= PF_TCPS_PROXY_SRC)) 71090075Sobrien sfail = 1; 71190075Sobrien else if (SEQ_GT(st->src.seqlo, 712132718Skan ntohl(sp->src.seqlo))) 71390075Sobrien sfail = 3; 714169689Skan else if (st->dst.state > sp->dst.state) { 71590075Sobrien /* There might still be useful 71690075Sobrien * information about the src state here, 71790075Sobrien * so import that part of the update, 71890075Sobrien * then "fail" so we send the updated 71990075Sobrien * state back to the peer who is missing 72090075Sobrien * our what we know. */ 721117395Skan pf_state_peer_ntoh(&sp->src, &st->src); 72290075Sobrien /* XXX do anything with timeouts? */ 72390075Sobrien sfail = 7; 72490075Sobrien flags = 0; 725132718Skan } else if (st->dst.state >= TCPS_SYN_SENT && 72690075Sobrien SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo))) 72790075Sobrien sfail = 4; 728169689Skan } else { 72990075Sobrien /* 73090075Sobrien * Non-TCP protocol state machine always go 73190075Sobrien * forwards 73290075Sobrien */ 73390075Sobrien if (st->src.state > sp->src.state) 73490075Sobrien sfail = 5; 73590075Sobrien else if (st->dst.state > sp->dst.state) 73690075Sobrien sfail = 6; 737132718Skan } 73890075Sobrien if (sfail) { 73990075Sobrien if (pf_status.debug >= PF_DEBUG_MISC) 74090075Sobrien printf("pfsync: %s stale update " 74190075Sobrien "(%d) id: %016llx " 74290075Sobrien "creatorid: %08x\n", 74390075Sobrien (sfail < 7 ? "ignoring" 74490075Sobrien : "partial"), sfail, 74590075Sobrien betoh64(st->id), 746169689Skan ntohl(st->creatorid)); 747169689Skan pfsyncstats.pfsyncs_badstate++; 748169689Skan 74990075Sobrien if (!(sp->sync_flags & PFSTATE_STALE)) { 750132718Skan /* we have a better state, send it */ 75190075Sobrien if (sc->sc_mbuf != NULL && !stale) 75290075Sobrien pfsync_sendout(sc); 753117395Skan stale++; 754117395Skan if (!st->sync_flags) 755117395Skan pfsync_pack_state( 75690075Sobrien PFSYNC_ACT_UPD, st, flags); 75790075Sobrien } 758169689Skan continue; 75990075Sobrien } 760169689Skan pfsync_alloc_scrub_memory(&sp->dst, &st->dst); 76190075Sobrien pf_state_peer_ntoh(&sp->src, &st->src); 76290075Sobrien pf_state_peer_ntoh(&sp->dst, &st->dst); 76390075Sobrien st->expire = ntohl(sp->expire) + time_second; 76490075Sobrien st->timeout = sp->timeout; 76590075Sobrien } 76690075Sobrien if (stale && sc->sc_mbuf != NULL) 76790075Sobrien pfsync_sendout(sc); 76890075Sobrien#ifdef __FreeBSD__ 769132718Skan PF_UNLOCK(); 77090075Sobrien#endif 771117395Skan splx(s); 772117395Skan break; 77390075Sobrien /* 774117395Skan * It's not strictly necessary for us to support the "uncompressed" 77590075Sobrien * delete action, but it's relatively simple and maintains consistency. 776169689Skan */ 777169689Skan case PFSYNC_ACT_DEL: 77890075Sobrien if ((mp = m_pulldown(m, iplen + sizeof(*ph), 77990075Sobrien count * sizeof(*sp), &offp)) == NULL) { 78090075Sobrien pfsyncstats.pfsyncs_badlen++; 78190075Sobrien return; 78290075Sobrien } 78390075Sobrien 78490075Sobrien s = splsoftnet(); 78590075Sobrien#ifdef __FreeBSD__ 786132718Skan PF_LOCK(); 78790075Sobrien#endif 788169689Skan for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 78990075Sobrien i < count; i++, sp++) { 79090075Sobrien bcopy(sp->id, &key.id, sizeof(key.id)); 79190075Sobrien key.creatorid = sp->creatorid; 79290075Sobrien 79390075Sobrien st = pf_find_state_byid(&key); 794132718Skan if (st == NULL) { 795132718Skan pfsyncstats.pfsyncs_badstate++; 796169689Skan continue; 797132718Skan } 798169689Skan st->sync_flags |= PFSTATE_FROMSYNC; 799169689Skan pf_unlink_state(st); 800132718Skan } 801169689Skan#ifdef __FreeBSD__ 802169689Skan PF_UNLOCK(); 803169689Skan#endif 804169689Skan splx(s); 805169689Skan break; 806169689Skan case PFSYNC_ACT_UPD_C: { 807169689Skan int update_requested = 0; 808132718Skan 809169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 810169689Skan count * sizeof(*up), &offp)) == NULL) { 811169689Skan pfsyncstats.pfsyncs_badlen++; 812169689Skan return; 813169689Skan } 814169689Skan 815169689Skan s = splsoftnet(); 816169689Skan#ifdef __FreeBSD__ 817169689Skan PF_LOCK(); 818132718Skan#endif 819169689Skan for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp); 820169689Skan i < count; i++, up++) { 821169689Skan /* check for invalid values */ 822169689Skan if (up->timeout >= PFTM_MAX || 823132718Skan up->src.state > PF_TCPS_PROXY_DST || 824169689Skan up->dst.state > PF_TCPS_PROXY_DST) { 825169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 826169689Skan printf("pfsync_insert: " 827169689Skan "PFSYNC_ACT_UPD_C: " 828169689Skan "invalid value\n"); 829169689Skan pfsyncstats.pfsyncs_badstate++; 830169689Skan continue; 831169689Skan } 832169689Skan 833260011Spfg bcopy(up->id, &key.id, sizeof(key.id)); 834169689Skan key.creatorid = up->creatorid; 835169689Skan 836169689Skan st = pf_find_state_byid(&key); 837169689Skan if (st == NULL) { 838132718Skan /* We don't have this state. Ask for it. */ 839169689Skan error = pfsync_request_update(up, &src); 840169689Skan if (error == ENOMEM) { 841169689Skan#ifdef __FreeBSD__ 842132718Skan PF_UNLOCK(); 843169689Skan#endif 844169689Skan splx(s); 845169689Skan goto done; 846169689Skan } 847169689Skan update_requested = 1; 848169689Skan pfsyncstats.pfsyncs_badstate++; 849169689Skan continue; 850169689Skan } 851169689Skan sfail = 0; 852169689Skan if (st->proto == IPPROTO_TCP) { 853169689Skan /* 854169689Skan * The state should never go backwards except 855169689Skan * for syn-proxy states. Neither should the 856169689Skan * sequence window slide backwards. 857132718Skan */ 858169689Skan if (st->src.state > up->src.state && 859169689Skan (st->src.state < PF_TCPS_PROXY_SRC || 860169689Skan up->src.state >= PF_TCPS_PROXY_SRC)) 861132718Skan sfail = 1; 862169689Skan else if (st->dst.state > up->dst.state) 863169689Skan sfail = 2; 864169689Skan else if (SEQ_GT(st->src.seqlo, 865132718Skan ntohl(up->src.seqlo))) 866169689Skan sfail = 3; 867169689Skan else if (st->dst.state >= TCPS_SYN_SENT && 868169689Skan SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo))) 869169689Skan sfail = 4; 870169689Skan } else { 871169689Skan /* 872169689Skan * Non-TCP protocol state machine always go 873169689Skan * forwards 874169689Skan */ 875169689Skan if (st->src.state > up->src.state) 876132718Skan sfail = 5; 877169689Skan else if (st->dst.state > up->dst.state) 878169689Skan sfail = 6; 879169689Skan } 880169689Skan if (sfail) { 881169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 882169689Skan printf("pfsync: ignoring stale update " 883169689Skan "(%d) id: %016llx " 884169689Skan "creatorid: %08x\n", sfail, 885132718Skan betoh64(st->id), 886169689Skan ntohl(st->creatorid)); 887169689Skan pfsyncstats.pfsyncs_badstate++; 888169689Skan 889169689Skan /* we have a better state, send it out */ 890169689Skan if ((!stale || update_requested) && 891169689Skan sc->sc_mbuf != NULL) { 892169689Skan pfsync_sendout(sc); 893169689Skan update_requested = 0; 894169689Skan } 895169689Skan stale++; 896169689Skan if (!st->sync_flags) 897169689Skan pfsync_pack_state(PFSYNC_ACT_UPD, st, 898169689Skan PFSYNC_FLAG_STALE); 899169689Skan continue; 900169689Skan } 901132718Skan pfsync_alloc_scrub_memory(&up->dst, &st->dst); 902169689Skan pf_state_peer_ntoh(&up->src, &st->src); 903169689Skan pf_state_peer_ntoh(&up->dst, &st->dst); 904169689Skan st->expire = ntohl(up->expire) + time_second; 905169689Skan st->timeout = up->timeout; 906169689Skan } 907169689Skan if ((update_requested || stale) && sc->sc_mbuf) 908169689Skan pfsync_sendout(sc); 909169689Skan#ifdef __FreeBSD__ 910169689Skan PF_UNLOCK(); 911169689Skan#endif 912169689Skan splx(s); 913169689Skan break; 914169689Skan } 915169689Skan case PFSYNC_ACT_DEL_C: 916169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 917169689Skan count * sizeof(*dp), &offp)) == NULL) { 918169689Skan pfsyncstats.pfsyncs_badlen++; 919169689Skan return; 920169689Skan } 921169689Skan 922169689Skan s = splsoftnet(); 923132718Skan#ifdef __FreeBSD__ 924169689Skan PF_LOCK(); 925132718Skan#endif 926169689Skan for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp); 927169689Skan i < count; i++, dp++) { 928169689Skan bcopy(dp->id, &key.id, sizeof(key.id)); 929132718Skan key.creatorid = dp->creatorid; 930132718Skan 931132718Skan st = pf_find_state_byid(&key); 932169689Skan if (st == NULL) { 933169689Skan pfsyncstats.pfsyncs_badstate++; 934169689Skan continue; 935169689Skan } 936169689Skan st->sync_flags |= PFSTATE_FROMSYNC; 937169689Skan pf_unlink_state(st); 938169689Skan } 939169689Skan#ifdef __FreeBSD__ 940169689Skan PF_UNLOCK(); 941169689Skan#endif 942132718Skan splx(s); 943169689Skan break; 944169689Skan case PFSYNC_ACT_INS_F: 945169689Skan case PFSYNC_ACT_DEL_F: 946169689Skan /* not implemented */ 947169689Skan break; 948169689Skan case PFSYNC_ACT_UREQ: 949169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 950169689Skan count * sizeof(*rup), &offp)) == NULL) { 951169689Skan pfsyncstats.pfsyncs_badlen++; 952169689Skan return; 953169689Skan } 954169689Skan 955169689Skan s = splsoftnet(); 956169689Skan#ifdef __FreeBSD__ 957169689Skan PF_LOCK(); 958169689Skan#endif 959169689Skan if (sc->sc_mbuf != NULL) 960169689Skan pfsync_sendout(sc); 961169689Skan for (i = 0, 962169689Skan rup = (struct pfsync_state_upd_req *)(mp->m_data + offp); 963169689Skan i < count; i++, rup++) { 964169689Skan bcopy(rup->id, &key.id, sizeof(key.id)); 965169689Skan key.creatorid = rup->creatorid; 966132718Skan 967169689Skan if (key.id == 0 && key.creatorid == 0) { 968169689Skan sc->sc_ureq_received = time_uptime; 969169689Skan if (sc->sc_bulk_send_next == NULL) 970132718Skan sc->sc_bulk_send_next = 971169689Skan TAILQ_FIRST(&state_list); 972169689Skan sc->sc_bulk_terminator = sc->sc_bulk_send_next; 973169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 974169689Skan printf("pfsync: received " 975169689Skan "bulk update request\n"); 976169689Skan pfsync_send_bus(sc, PFSYNC_BUS_START); 977169689Skan#ifdef __FreeBSD__ 978169689Skan callout_reset(&sc->sc_bulk_tmo, 1 * hz, 979169689Skan pfsync_bulk_update, pfsyncif); 980169689Skan#else 981169689Skan timeout_add(&sc->sc_bulk_tmo, 1 * hz); 982169689Skan#endif 983169689Skan } else { 984169689Skan st = pf_find_state_byid(&key); 985169689Skan if (st == NULL) { 986132718Skan pfsyncstats.pfsyncs_badstate++; 987169689Skan continue; 988169689Skan } 989169689Skan if (!st->sync_flags) 990169689Skan pfsync_pack_state(PFSYNC_ACT_UPD, 991169689Skan st, 0); 992169689Skan } 993169689Skan } 994169689Skan if (sc->sc_mbuf != NULL) 995169689Skan pfsync_sendout(sc); 996169689Skan#ifdef __FreeBSD__ 997169689Skan PF_UNLOCK(); 998132718Skan#endif 999169689Skan splx(s); 1000169689Skan break; 1001169689Skan case PFSYNC_ACT_BUS: 1002169689Skan /* If we're not waiting for a bulk update, who cares. */ 1003169689Skan if (sc->sc_ureq_sent == 0) 1004169689Skan break; 1005169689Skan 1006169689Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 1007169689Skan sizeof(*bus), &offp)) == NULL) { 1008169689Skan pfsyncstats.pfsyncs_badlen++; 1009169689Skan return; 1010169689Skan } 1011169689Skan bus = (struct pfsync_state_bus *)(mp->m_data + offp); 1012132718Skan switch (bus->status) { 1013169689Skan case PFSYNC_BUS_START: 1014169689Skan#ifdef __FreeBSD__ 1015169689Skan callout_reset(&sc->sc_bulkfail_tmo, 1016169689Skan pf_pool_limits[PF_LIMIT_STATES].limit / 1017169689Skan (PFSYNC_BULKPACKETS * sc->sc_maxcount), 1018132718Skan pfsync_bulkfail, pfsyncif); 1019169689Skan#else 1020169689Skan timeout_add(&sc->sc_bulkfail_tmo, 1021169689Skan pf_pool_limits[PF_LIMIT_STATES].limit / 1022169689Skan (PFSYNC_BULKPACKETS * sc->sc_maxcount)); 1023169689Skan#endif 1024169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 1025169689Skan printf("pfsync: received bulk " 1026169689Skan "update start\n"); 1027169689Skan break; 1028169689Skan case PFSYNC_BUS_END: 1029169689Skan if (time_uptime - ntohl(bus->endtime) >= 1030169689Skan sc->sc_ureq_sent) { 1031169689Skan /* that's it, we're happy */ 1032169689Skan sc->sc_ureq_sent = 0; 1033169689Skan sc->sc_bulk_tries = 0; 1034132718Skan timeout_del(&sc->sc_bulkfail_tmo); 1035169689Skan#if NCARP > 0 1036169689Skan if (!pfsync_sync_ok) 1037169689Skan#ifdef __FreeBSD__ 1038169689Skan#ifdef CARP_ADVANCED 1039169689Skan carp_group_demote_adj(sc->sc_ifp, -1); 1040169689Skan#endif 1041169689Skan#else 1042132718Skan carp_group_demote_adj(&sc->sc_if, -1); 1043169689Skan#endif 1044169689Skan#endif 1045132718Skan pfsync_sync_ok = 1; 1046169689Skan if (pf_status.debug >= PF_DEBUG_MISC) 1047169689Skan printf("pfsync: received valid " 1048132718Skan "bulk update end\n"); 1049169689Skan } else { 1050132718Skan if (pf_status.debug >= PF_DEBUG_MISC) 1051169689Skan printf("pfsync: received invalid " 1052169689Skan "bulk update end: bad timestamp\n"); 1053169689Skan } 1054169689Skan break; 1055169689Skan } 1056169689Skan break; 1057169689Skan#ifdef PFSYNC_TDB 1058169689Skan case PFSYNC_ACT_TDB_UPD: 1059132718Skan if ((mp = m_pulldown(m, iplen + sizeof(*ph), 1060169689Skan count * sizeof(*pt), &offp)) == NULL) { 1061169689Skan pfsyncstats.pfsyncs_badlen++; 1062169689Skan return; 1063169689Skan } 1064169689Skan s = splsoftnet(); 1065169689Skan#ifdef __FreeBSD__ 1066169689Skan PF_LOCK(); 1067169689Skan#endif 1068169689Skan for (i = 0, pt = (struct pfsync_tdb *)(mp->m_data + offp); 1069169689Skan i < count; i++, pt++) 1070169689Skan pfsync_update_net_tdb(pt); 1071169689Skan#ifdef __FreeBSD__ 1072169689Skan PF_UNLOCK(); 1073132718Skan#endif 1074169689Skan splx(s); 1075169689Skan break; 1076169689Skan#endif 1077169689Skan } 1078169689Skan 1079169689Skandone: 1080169689Skan if (m) 1081169689Skan m_freem(m); 1082169689Skan} 1083132718Skan 1084169689Skanint 1085169689Skanpfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 1086169689Skan struct rtentry *rt) 1087169689Skan{ 1088169689Skan m_freem(m); 1089169689Skan return (0); 1090169689Skan} 1091169689Skan 1092169689Skan/* ARGSUSED */ 1093169689Skanint 1094169689Skanpfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 1095169689Skan{ 1096169689Skan#ifndef __FreeBSD__ 1097132718Skan struct proc *p = curproc; 1098132718Skan#endif 1099169689Skan struct pfsync_softc *sc = ifp->if_softc; 1100169689Skan struct ifreq *ifr = (struct ifreq *)data; 1101169689Skan struct ip_moptions *imo = &sc->sc_imo; 1102169689Skan struct pfsyncreq pfsyncr; 1103169689Skan struct ifnet *sifp; 1104169689Skan int s, error; 1105169689Skan 1106169689Skan switch (cmd) { 1107169689Skan case SIOCSIFADDR: 1108169689Skan case SIOCAIFADDR: 1109169689Skan case SIOCSIFDSTADDR: 1110169689Skan case SIOCSIFFLAGS: 1111169689Skan#ifdef __FreeBSD__ 1112169689Skan if (ifp->if_flags & IFF_UP) 1113169689Skan ifp->if_drv_flags |= IFF_DRV_RUNNING; 1114169689Skan else 1115169689Skan ifp->if_drv_flags &= ~IFF_DRV_RUNNING; 1116169689Skan#else 1117169689Skan if (ifp->if_flags & IFF_UP) 1118132718Skan ifp->if_flags |= IFF_RUNNING; 1119169689Skan else 1120132718Skan ifp->if_flags &= ~IFF_RUNNING; 1121169689Skan#endif 1122169689Skan break; 1123169689Skan case SIOCSIFMTU: 1124169689Skan if (ifr->ifr_mtu < PFSYNC_MINMTU) 1125169689Skan return (EINVAL); 1126169689Skan if (ifr->ifr_mtu > MCLBYTES) 1127169689Skan ifr->ifr_mtu = MCLBYTES; 1128169689Skan s = splnet(); 1129169689Skan#ifdef __FreeBSD__ 1130169689Skan PF_LOCK(); 1131169689Skan#endif 1132169689Skan if (ifr->ifr_mtu < ifp->if_mtu) 1133169689Skan pfsync_sendout(sc); 1134169689Skan pfsync_setmtu(sc, ifr->ifr_mtu); 1135169689Skan#ifdef __FreeBSD__ 1136169689Skan PF_UNLOCK(); 1137169689Skan#endif 1138169689Skan splx(s); 1139132718Skan break; 1140132718Skan case SIOCGETPFSYNC: 1141169689Skan bzero(&pfsyncr, sizeof(pfsyncr)); 1142132718Skan if (sc->sc_sync_ifp) 1143169689Skan strlcpy(pfsyncr.pfsyncr_syncdev, 1144132718Skan sc->sc_sync_ifp->if_xname, IFNAMSIZ); 1145169689Skan pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer; 1146169689Skan pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates; 1147169689Skan if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr)))) 1148169689Skan return (error); 1149169689Skan break; 1150169689Skan case SIOCSETPFSYNC: 1151169689Skan#ifdef __FreeBSD__ 1152169689Skan if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0) 1153169689Skan#else 1154169689Skan if ((error = suser(p, p->p_acflag)) != 0) 1155169689Skan#endif 1156132718Skan return (error); 1157 if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr)))) 1158 return (error); 1159 1160#ifdef __FreeBSD__ 1161 PF_LOCK(); 1162#endif 1163 if (pfsyncr.pfsyncr_syncpeer.s_addr == 0) 1164#ifdef __FreeBSD__ 1165 sc->sc_sync_peer.s_addr = htonl(INADDR_PFSYNC_GROUP); 1166#else 1167 sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP; 1168#endif 1169 else 1170 sc->sc_sync_peer.s_addr = 1171 pfsyncr.pfsyncr_syncpeer.s_addr; 1172 1173 if (pfsyncr.pfsyncr_maxupdates > 255) 1174#ifdef __FreeBSD__ 1175 { 1176 PF_UNLOCK(); 1177#endif 1178 return (EINVAL); 1179#ifdef __FreeBSD__ 1180 } 1181#endif 1182 sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates; 1183 1184 if (pfsyncr.pfsyncr_syncdev[0] == 0) { 1185 sc->sc_sync_ifp = NULL; 1186 if (sc->sc_mbuf_net != NULL) { 1187 /* Don't keep stale pfsync packets around. */ 1188 s = splnet(); 1189 m_freem(sc->sc_mbuf_net); 1190 sc->sc_mbuf_net = NULL; 1191 sc->sc_statep_net.s = NULL; 1192 splx(s); 1193 } 1194#ifdef __FreeBSD__ 1195 PF_UNLOCK(); 1196#endif 1197 if (imo->imo_num_memberships > 0) { 1198 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]); 1199 imo->imo_multicast_ifp = NULL; 1200 } 1201 break; 1202 } 1203 1204#ifdef __FreeBSD__ 1205 PF_UNLOCK(); 1206#endif 1207 if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL) 1208 return (EINVAL); 1209#ifdef __FreeBSD__ 1210 PF_LOCK(); 1211#endif 1212 1213 s = splnet(); 1214#ifdef __FreeBSD__ 1215 if (sifp->if_mtu < sc->sc_ifp->if_mtu || 1216#else 1217 if (sifp->if_mtu < sc->sc_if.if_mtu || 1218#endif 1219 (sc->sc_sync_ifp != NULL && 1220 sifp->if_mtu < sc->sc_sync_ifp->if_mtu) || 1221 sifp->if_mtu < MCLBYTES - sizeof(struct ip)) 1222 pfsync_sendout(sc); 1223 sc->sc_sync_ifp = sifp; 1224 1225#ifdef __FreeBSD__ 1226 pfsync_setmtu(sc, sc->sc_ifp->if_mtu); 1227#else 1228 pfsync_setmtu(sc, sc->sc_if.if_mtu); 1229#endif 1230 1231 if (imo->imo_num_memberships > 0) { 1232#ifdef __FreeBSD__ 1233 PF_UNLOCK(); 1234#endif 1235 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]); 1236#ifdef __FreeBSD__ 1237 PF_LOCK(); 1238#endif 1239 imo->imo_multicast_ifp = NULL; 1240 } 1241 1242 if (sc->sc_sync_ifp && 1243#ifdef __FreeBSD__ 1244 sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) { 1245#else 1246 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) { 1247#endif 1248 struct in_addr addr; 1249 1250 if (!(sc->sc_sync_ifp->if_flags & IFF_MULTICAST)) { 1251 sc->sc_sync_ifp = NULL; 1252#ifdef __FreeBSD__ 1253 PF_UNLOCK(); 1254#endif 1255 splx(s); 1256 return (EADDRNOTAVAIL); 1257 } 1258 1259#ifdef __FreeBSD__ 1260 addr.s_addr = htonl(INADDR_PFSYNC_GROUP); 1261#else 1262 addr.s_addr = INADDR_PFSYNC_GROUP; 1263#endif 1264 1265#ifdef __FreeBSD__ 1266 PF_UNLOCK(); 1267#endif 1268 if ((imo->imo_membership[0] = 1269 in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) { 1270 sc->sc_sync_ifp = NULL; 1271 splx(s); 1272 return (ENOBUFS); 1273 } 1274#ifdef __FreeBSD__ 1275 PF_LOCK(); 1276#endif 1277 imo->imo_num_memberships++; 1278 imo->imo_multicast_ifp = sc->sc_sync_ifp; 1279 imo->imo_multicast_ttl = PFSYNC_DFLTTL; 1280 imo->imo_multicast_loop = 0; 1281 } 1282 1283 if (sc->sc_sync_ifp || 1284#ifdef __FreeBSD__ 1285 sc->sc_sendaddr.s_addr != htonl(INADDR_PFSYNC_GROUP)) { 1286#else 1287 sc->sc_sendaddr.s_addr != INADDR_PFSYNC_GROUP) { 1288#endif 1289 /* Request a full state table update. */ 1290 sc->sc_ureq_sent = time_uptime; 1291#if NCARP > 0 1292 if (pfsync_sync_ok) 1293#ifdef __FreeBSD__ 1294#ifdef CARP_ADVANCED 1295 carp_group_demote_adj(sc->sc_ifp, 1); 1296#endif 1297#else 1298 carp_group_demote_adj(&sc->sc_if, 1); 1299#endif 1300#endif 1301 pfsync_sync_ok = 0; 1302 if (pf_status.debug >= PF_DEBUG_MISC) 1303 printf("pfsync: requesting bulk update\n"); 1304#ifdef __FreeBSD__ 1305 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, 1306 pfsync_bulkfail, pfsyncif); 1307#else 1308 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz); 1309#endif 1310 error = pfsync_request_update(NULL, NULL); 1311 if (error == ENOMEM) { 1312#ifdef __FreeBSD__ 1313 PF_UNLOCK(); 1314#endif 1315 splx(s); 1316 return (ENOMEM); 1317 } 1318 pfsync_sendout(sc); 1319 } 1320#ifdef __FreeBSD__ 1321 PF_UNLOCK(); 1322#endif 1323 splx(s); 1324 1325 break; 1326 1327 default: 1328 return (ENOTTY); 1329 } 1330 1331 return (0); 1332} 1333 1334void 1335pfsync_setmtu(struct pfsync_softc *sc, int mtu_req) 1336{ 1337 int mtu; 1338 1339 if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req) 1340 mtu = sc->sc_sync_ifp->if_mtu; 1341 else 1342 mtu = mtu_req; 1343 1344 sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) / 1345 sizeof(struct pfsync_state); 1346 if (sc->sc_maxcount > 254) 1347 sc->sc_maxcount = 254; 1348#ifdef __FreeBSD__ 1349 sc->sc_ifp->if_mtu = sizeof(struct pfsync_header) + 1350#else 1351 sc->sc_if.if_mtu = sizeof(struct pfsync_header) + 1352#endif 1353 sc->sc_maxcount * sizeof(struct pfsync_state); 1354} 1355 1356struct mbuf * 1357pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp) 1358{ 1359 struct pfsync_header *h; 1360 struct mbuf *m; 1361 int len; 1362 1363 MGETHDR(m, M_DONTWAIT, MT_DATA); 1364 if (m == NULL) { 1365#ifdef __FreeBSD__ 1366 sc->sc_ifp->if_oerrors++; 1367#else 1368 sc->sc_if.if_oerrors++; 1369#endif 1370 return (NULL); 1371 } 1372 1373 switch (action) { 1374 case PFSYNC_ACT_CLR: 1375 len = sizeof(struct pfsync_header) + 1376 sizeof(struct pfsync_state_clr); 1377 break; 1378 case PFSYNC_ACT_UPD_C: 1379 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) + 1380 sizeof(struct pfsync_header); 1381 break; 1382 case PFSYNC_ACT_DEL_C: 1383 len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) + 1384 sizeof(struct pfsync_header); 1385 break; 1386 case PFSYNC_ACT_UREQ: 1387 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) + 1388 sizeof(struct pfsync_header); 1389 break; 1390 case PFSYNC_ACT_BUS: 1391 len = sizeof(struct pfsync_header) + 1392 sizeof(struct pfsync_state_bus); 1393 break; 1394#ifdef PFSYNC_TDB 1395 case PFSYNC_ACT_TDB_UPD: 1396 len = (sc->sc_maxcount * sizeof(struct pfsync_tdb)) + 1397 sizeof(struct pfsync_header); 1398 break; 1399#endif 1400 default: 1401 len = (sc->sc_maxcount * sizeof(struct pfsync_state)) + 1402 sizeof(struct pfsync_header); 1403 break; 1404 } 1405 1406 if (len > MHLEN) { 1407 MCLGET(m, M_DONTWAIT); 1408 if ((m->m_flags & M_EXT) == 0) { 1409 m_free(m); 1410#ifdef __FreeBSD__ 1411 sc->sc_ifp->if_oerrors++; 1412#else 1413 sc->sc_if.if_oerrors++; 1414#endif 1415 return (NULL); 1416 } 1417 m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1); 1418 } else 1419 MH_ALIGN(m, len); 1420 1421 m->m_pkthdr.rcvif = NULL; 1422 m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header); 1423 h = mtod(m, struct pfsync_header *); 1424 h->version = PFSYNC_VERSION; 1425 h->af = 0; 1426 h->count = 0; 1427 h->action = action; 1428#ifndef PFSYNC_TDB 1429 if (action != PFSYNC_ACT_TDB_UPD) 1430#endif 1431 bcopy(&pf_status.pf_chksum, &h->pf_chksum, 1432 PF_MD5_DIGEST_LENGTH); 1433 1434 *sp = (void *)((char *)h + PFSYNC_HDRLEN); 1435#ifdef PFSYNC_TDB 1436 if (action == PFSYNC_ACT_TDB_UPD) 1437#ifdef __FreeBSD__ 1438 callout_reset(&sc->sc_tdb_tmo, hz, pfsync_tdb_timeout, 1439 pfsyncif); 1440#else 1441 timeout_add(&sc->sc_tdb_tmo, hz); 1442#endif 1443 else 1444#endif 1445#ifdef __FreeBSD__ 1446 callout_reset(&sc->sc_tmo, hz, pfsync_timeout, pfsyncif); 1447#else 1448 timeout_add(&sc->sc_tmo, hz); 1449#endif 1450 return (m); 1451} 1452 1453int 1454pfsync_pack_state(u_int8_t action, struct pf_state *st, int flags) 1455{ 1456 struct ifnet *ifp = NULL; 1457 struct pfsync_softc *sc = pfsyncif; 1458 struct pfsync_header *h, *h_net; 1459 struct pfsync_state *sp = NULL; 1460 struct pfsync_state_upd *up = NULL; 1461 struct pfsync_state_del *dp = NULL; 1462 struct pf_rule *r; 1463 u_long secs; 1464 int s, ret = 0; 1465 u_int8_t i = 255, newaction = 0; 1466 1467 if (sc == NULL) 1468 return (0); 1469#ifdef __FreeBSD__ 1470 ifp = sc->sc_ifp; 1471#else 1472 ifp = &sc->sc_if; 1473#endif 1474 1475 /* 1476 * If a packet falls in the forest and there's nobody around to 1477 * hear, does it make a sound? 1478 */ 1479 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL && 1480#ifdef __FreeBSD__ 1481 sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) { 1482#else 1483 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) { 1484#endif 1485 /* Don't leave any stale pfsync packets hanging around. */ 1486 if (sc->sc_mbuf != NULL) { 1487 m_freem(sc->sc_mbuf); 1488 sc->sc_mbuf = NULL; 1489 sc->sc_statep.s = NULL; 1490 } 1491 return (0); 1492 } 1493 1494 if (action >= PFSYNC_ACT_MAX) 1495 return (EINVAL); 1496 1497 s = splnet(); 1498#ifdef __FreeBSD__ 1499 PF_ASSERT(MA_OWNED); 1500#endif 1501 if (sc->sc_mbuf == NULL) { 1502 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action, 1503 (void *)&sc->sc_statep.s)) == NULL) { 1504 splx(s); 1505 return (ENOMEM); 1506 } 1507 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1508 } else { 1509 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1510 if (h->action != action) { 1511 pfsync_sendout(sc); 1512 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action, 1513 (void *)&sc->sc_statep.s)) == NULL) { 1514 splx(s); 1515 return (ENOMEM); 1516 } 1517 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1518 } else { 1519 /* 1520 * If it's an update, look in the packet to see if 1521 * we already have an update for the state. 1522 */ 1523 if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) { 1524 struct pfsync_state *usp = 1525 (void *)((char *)h + PFSYNC_HDRLEN); 1526 1527 for (i = 0; i < h->count; i++) { 1528 if (!memcmp(usp->id, &st->id, 1529 PFSYNC_ID_LEN) && 1530 usp->creatorid == st->creatorid) { 1531 sp = usp; 1532 sp->updates++; 1533 break; 1534 } 1535 usp++; 1536 } 1537 } 1538 } 1539 } 1540 1541 secs = time_second; 1542 1543 st->pfsync_time = time_uptime; 1544 1545 if (sp == NULL) { 1546 /* not a "duplicate" update */ 1547 i = 255; 1548 sp = sc->sc_statep.s++; 1549 sc->sc_mbuf->m_pkthdr.len = 1550 sc->sc_mbuf->m_len += sizeof(struct pfsync_state); 1551 h->count++; 1552 bzero(sp, sizeof(*sp)); 1553 1554 bcopy(&st->id, sp->id, sizeof(sp->id)); 1555 sp->creatorid = st->creatorid; 1556 1557 strlcpy(sp->ifname, st->u.s.kif->pfik_name, sizeof(sp->ifname)); 1558 pf_state_host_hton(&st->lan, &sp->lan); 1559 pf_state_host_hton(&st->gwy, &sp->gwy); 1560 pf_state_host_hton(&st->ext, &sp->ext); 1561 1562 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr)); 1563 1564 sp->creation = htonl(secs - st->creation); 1565 pf_state_counter_hton(st->packets[0], sp->packets[0]); 1566 pf_state_counter_hton(st->packets[1], sp->packets[1]); 1567 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 1568 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 1569 if ((r = st->rule.ptr) == NULL) 1570 sp->rule = htonl(-1); 1571 else 1572 sp->rule = htonl(r->nr); 1573 if ((r = st->anchor.ptr) == NULL) 1574 sp->anchor = htonl(-1); 1575 else 1576 sp->anchor = htonl(r->nr); 1577 sp->af = st->af; 1578 sp->proto = st->proto; 1579 sp->direction = st->direction; 1580 sp->log = st->log; 1581 sp->allow_opts = st->allow_opts; 1582 sp->timeout = st->timeout; 1583 1584 if (flags & PFSYNC_FLAG_STALE) 1585 sp->sync_flags |= PFSTATE_STALE; 1586 } 1587 1588 pf_state_peer_hton(&st->src, &sp->src); 1589 pf_state_peer_hton(&st->dst, &sp->dst); 1590 1591 if (st->expire <= secs) 1592 sp->expire = htonl(0); 1593 else 1594 sp->expire = htonl(st->expire - secs); 1595 1596 /* do we need to build "compressed" actions for network transfer? */ 1597 if (sc->sc_sync_ifp && flags & PFSYNC_FLAG_COMPRESS) { 1598 switch (action) { 1599 case PFSYNC_ACT_UPD: 1600 newaction = PFSYNC_ACT_UPD_C; 1601 break; 1602 case PFSYNC_ACT_DEL: 1603 newaction = PFSYNC_ACT_DEL_C; 1604 break; 1605 default: 1606 /* by default we just send the uncompressed states */ 1607 break; 1608 } 1609 } 1610 1611 if (newaction) { 1612 if (sc->sc_mbuf_net == NULL) { 1613 if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction, 1614 (void *)&sc->sc_statep_net.s)) == NULL) { 1615 splx(s); 1616 return (ENOMEM); 1617 } 1618 } 1619 h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *); 1620 1621 switch (newaction) { 1622 case PFSYNC_ACT_UPD_C: 1623 if (i != 255) { 1624 up = (void *)((char *)h_net + 1625 PFSYNC_HDRLEN + (i * sizeof(*up))); 1626 up->updates++; 1627 } else { 1628 h_net->count++; 1629 sc->sc_mbuf_net->m_pkthdr.len = 1630 sc->sc_mbuf_net->m_len += sizeof(*up); 1631 up = sc->sc_statep_net.u++; 1632 1633 bzero(up, sizeof(*up)); 1634 bcopy(&st->id, up->id, sizeof(up->id)); 1635 up->creatorid = st->creatorid; 1636 } 1637 up->timeout = st->timeout; 1638 up->expire = sp->expire; 1639 up->src = sp->src; 1640 up->dst = sp->dst; 1641 break; 1642 case PFSYNC_ACT_DEL_C: 1643 sc->sc_mbuf_net->m_pkthdr.len = 1644 sc->sc_mbuf_net->m_len += sizeof(*dp); 1645 dp = sc->sc_statep_net.d++; 1646 h_net->count++; 1647 1648 bzero(dp, sizeof(*dp)); 1649 bcopy(&st->id, dp->id, sizeof(dp->id)); 1650 dp->creatorid = st->creatorid; 1651 break; 1652 } 1653 } 1654 1655 if (h->count == sc->sc_maxcount || 1656 (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates))) 1657 ret = pfsync_sendout(sc); 1658 1659 splx(s); 1660 return (ret); 1661} 1662 1663/* This must be called in splnet() */ 1664int 1665pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src) 1666{ 1667 struct ifnet *ifp = NULL; 1668 struct pfsync_header *h; 1669 struct pfsync_softc *sc = pfsyncif; 1670 struct pfsync_state_upd_req *rup; 1671 int ret = 0; 1672 1673 if (sc == NULL) 1674 return (0); 1675 1676#ifdef __FreeBSD__ 1677 ifp = sc->sc_ifp; 1678#else 1679 ifp = &sc->sc_if; 1680#endif 1681 if (sc->sc_mbuf == NULL) { 1682 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ, 1683 (void *)&sc->sc_statep.s)) == NULL) 1684 return (ENOMEM); 1685 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1686 } else { 1687 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1688 if (h->action != PFSYNC_ACT_UREQ) { 1689 pfsync_sendout(sc); 1690 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ, 1691 (void *)&sc->sc_statep.s)) == NULL) 1692 return (ENOMEM); 1693 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1694 } 1695 } 1696 1697 if (src != NULL) 1698 sc->sc_sendaddr = *src; 1699 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup); 1700 h->count++; 1701 rup = sc->sc_statep.r++; 1702 bzero(rup, sizeof(*rup)); 1703 if (up != NULL) { 1704 bcopy(up->id, rup->id, sizeof(rup->id)); 1705 rup->creatorid = up->creatorid; 1706 } 1707 1708 if (h->count == sc->sc_maxcount) 1709 ret = pfsync_sendout(sc); 1710 1711 return (ret); 1712} 1713 1714int 1715pfsync_clear_states(u_int32_t creatorid, char *ifname) 1716{ 1717 struct ifnet *ifp = NULL; 1718 struct pfsync_softc *sc = pfsyncif; 1719 struct pfsync_state_clr *cp; 1720 int s, ret; 1721 1722 if (sc == NULL) 1723 return (0); 1724 1725#ifdef __FreeBSD__ 1726 ifp = sc->sc_ifp; 1727#else 1728 ifp = &sc->sc_if; 1729#endif 1730#ifdef __FreeBSD__ 1731 PF_ASSERT(MA_OWNED); 1732#endif 1733 s = splnet(); 1734 if (sc->sc_mbuf != NULL) 1735 pfsync_sendout(sc); 1736 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR, 1737 (void *)&sc->sc_statep.c)) == NULL) { 1738 splx(s); 1739 return (ENOMEM); 1740 } 1741 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp); 1742 cp = sc->sc_statep.c; 1743 cp->creatorid = creatorid; 1744 if (ifname != NULL) 1745 strlcpy(cp->ifname, ifname, IFNAMSIZ); 1746 1747 ret = (pfsync_sendout(sc)); 1748 splx(s); 1749 return (ret); 1750} 1751 1752void 1753pfsync_timeout(void *v) 1754{ 1755 struct pfsync_softc *sc = v; 1756 int s; 1757 1758 s = splnet(); 1759#ifdef __FreeBSD__ 1760 PF_LOCK(); 1761#endif 1762 pfsync_sendout(sc); 1763#ifdef __FreeBSD__ 1764 PF_UNLOCK(); 1765#endif 1766 splx(s); 1767} 1768 1769#ifdef PFSYNC_TDB 1770void 1771pfsync_tdb_timeout(void *v) 1772{ 1773 struct pfsync_softc *sc = v; 1774 int s; 1775 1776 s = splnet(); 1777#ifdef __FreeBSD__ 1778 PF_LOCK(); 1779#endif 1780 pfsync_tdb_sendout(sc); 1781#ifdef __FreeBSD__ 1782 PF_UNLOCK(); 1783#endif 1784 splx(s); 1785} 1786#endif 1787 1788/* This must be called in splnet() */ 1789void 1790pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status) 1791{ 1792 struct pfsync_state_bus *bus; 1793 1794#ifdef __FreeBSD__ 1795 PF_ASSERT(MA_OWNED); 1796#endif 1797 if (sc->sc_mbuf != NULL) 1798 pfsync_sendout(sc); 1799 1800 if (pfsync_sync_ok && 1801 (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS, 1802 (void *)&sc->sc_statep.b)) != NULL) { 1803 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus); 1804 bus = sc->sc_statep.b; 1805 bus->creatorid = pf_status.hostid; 1806 bus->status = status; 1807 bus->endtime = htonl(time_uptime - sc->sc_ureq_received); 1808 pfsync_sendout(sc); 1809 } 1810} 1811 1812void 1813pfsync_bulk_update(void *v) 1814{ 1815 struct pfsync_softc *sc = v; 1816 int s, i = 0; 1817 struct pf_state *state; 1818 1819 s = splnet(); 1820#ifdef __FreeBSD__ 1821 PF_LOCK(); 1822#endif 1823 if (sc->sc_mbuf != NULL) 1824 pfsync_sendout(sc); 1825 1826 /* 1827 * Grab at most PFSYNC_BULKPACKETS worth of states which have not 1828 * been sent since the latest request was made. 1829 */ 1830 state = sc->sc_bulk_send_next; 1831 if (state) 1832 do { 1833 /* send state update if syncable and not already sent */ 1834 if (!state->sync_flags 1835 && state->timeout < PFTM_MAX 1836 && state->pfsync_time <= sc->sc_ureq_received) { 1837 pfsync_pack_state(PFSYNC_ACT_UPD, state, 0); 1838 i++; 1839 } 1840 1841 /* figure next state to send */ 1842 state = TAILQ_NEXT(state, u.s.entry_list); 1843 1844 /* wrap to start of list if we hit the end */ 1845 if (!state) 1846 state = TAILQ_FIRST(&state_list); 1847 } while (i < sc->sc_maxcount * PFSYNC_BULKPACKETS && 1848 state != sc->sc_bulk_terminator); 1849 1850 if (!state || state == sc->sc_bulk_terminator) { 1851 /* we're done */ 1852 pfsync_send_bus(sc, PFSYNC_BUS_END); 1853 sc->sc_ureq_received = 0; 1854 sc->sc_bulk_send_next = NULL; 1855 sc->sc_bulk_terminator = NULL; 1856 timeout_del(&sc->sc_bulk_tmo); 1857 if (pf_status.debug >= PF_DEBUG_MISC) 1858 printf("pfsync: bulk update complete\n"); 1859 } else { 1860 /* look again for more in a bit */ 1861#ifdef __FreeBSD__ 1862 callout_reset(&sc->sc_bulk_tmo, 1, pfsync_bulk_update, 1863 pfsyncif); 1864#else 1865 timeout_add(&sc->sc_bulk_tmo, 1); 1866#endif 1867 sc->sc_bulk_send_next = state; 1868 } 1869 if (sc->sc_mbuf != NULL) 1870 pfsync_sendout(sc); 1871 splx(s); 1872#ifdef __FreeBSD__ 1873 PF_UNLOCK(); 1874#endif 1875} 1876 1877void 1878pfsync_bulkfail(void *v) 1879{ 1880 struct pfsync_softc *sc = v; 1881 int s, error; 1882 1883#ifdef __FreeBSD__ 1884 PF_LOCK(); 1885#endif 1886 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) { 1887 /* Try again in a bit */ 1888#ifdef __FreeBSD__ 1889 callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulkfail, 1890 pfsyncif); 1891#else 1892 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz); 1893#endif 1894 s = splnet(); 1895 error = pfsync_request_update(NULL, NULL); 1896 if (error == ENOMEM) { 1897 if (pf_status.debug >= PF_DEBUG_MISC) 1898 printf("pfsync: cannot allocate mbufs for " 1899 "bulk update\n"); 1900 } else 1901 pfsync_sendout(sc); 1902 splx(s); 1903 } else { 1904 /* Pretend like the transfer was ok */ 1905 sc->sc_ureq_sent = 0; 1906 sc->sc_bulk_tries = 0; 1907#if NCARP > 0 1908 if (!pfsync_sync_ok) 1909#ifdef __FreeBSD__ 1910#ifdef CARP_ADVANCED 1911 carp_group_demote_adj(sc->sc_ifp, -1); 1912#endif 1913#else 1914 carp_group_demote_adj(&sc->sc_if, -1); 1915#endif 1916#endif 1917 pfsync_sync_ok = 1; 1918 if (pf_status.debug >= PF_DEBUG_MISC) 1919 printf("pfsync: failed to receive " 1920 "bulk update status\n"); 1921 timeout_del(&sc->sc_bulkfail_tmo); 1922 } 1923#ifdef __FreeBSD__ 1924 PF_UNLOCK(); 1925#endif 1926} 1927 1928/* This must be called in splnet() */ 1929int 1930pfsync_sendout(struct pfsync_softc *sc) 1931{ 1932#if NBPFILTER > 0 1933#ifdef __FreeBSD__ 1934 struct ifnet *ifp = sc->sc_ifp; 1935#else 1936 struct ifnet *ifp = &sc->sc_if; 1937#endif 1938#endif 1939 struct mbuf *m; 1940 1941#ifdef __FreeBSD__ 1942 PF_ASSERT(MA_OWNED); 1943#endif 1944 timeout_del(&sc->sc_tmo); 1945 1946 if (sc->sc_mbuf == NULL) 1947 return (0); 1948 m = sc->sc_mbuf; 1949 sc->sc_mbuf = NULL; 1950 sc->sc_statep.s = NULL; 1951 1952#if NBPFILTER > 0 1953 if (ifp->if_bpf) 1954#ifdef __FreeBSD__ 1955 BPF_MTAP(ifp, m); 1956#else 1957 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT); 1958#endif 1959#endif 1960 1961 if (sc->sc_mbuf_net) { 1962 m_freem(m); 1963 m = sc->sc_mbuf_net; 1964 sc->sc_mbuf_net = NULL; 1965 sc->sc_statep_net.s = NULL; 1966 } 1967 1968 return pfsync_sendout_mbuf(sc, m); 1969} 1970 1971#ifdef PFSYNC_TDB 1972int 1973pfsync_tdb_sendout(struct pfsync_softc *sc) 1974{ 1975#if NBPFILTER > 0 1976#ifdef __FreeBSD__ 1977 struct ifnet *ifp = sc->sc_ifp; 1978#else 1979 struct ifnet *ifp = &sc->sc_if; 1980#endif 1981#endif 1982 struct mbuf *m; 1983 1984#ifdef __FreeBSD__ 1985 PF_ASSERT(MA_OWNED); 1986#endif 1987 timeout_del(&sc->sc_tdb_tmo); 1988 1989 if (sc->sc_mbuf_tdb == NULL) 1990 return (0); 1991 m = sc->sc_mbuf_tdb; 1992 sc->sc_mbuf_tdb = NULL; 1993 sc->sc_statep_tdb.t = NULL; 1994 1995#if NBPFILTER > 0 1996 if (ifp->if_bpf) 1997#ifdef __FreeBSD__ 1998 BPF_MTAP(ifp, m); 1999#else 2000 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT); 2001#endif 2002#endif 2003 2004 return pfsync_sendout_mbuf(sc, m); 2005} 2006#endif 2007 2008int 2009pfsync_sendout_mbuf(struct pfsync_softc *sc, struct mbuf *m) 2010{ 2011 struct sockaddr sa; 2012 struct ip *ip; 2013 2014#ifdef __FreeBSD__ 2015 PF_ASSERT(MA_OWNED); 2016#endif 2017 if (sc->sc_sync_ifp || 2018#ifdef __FreeBSD__ 2019 sc->sc_sync_peer.s_addr != htonl(INADDR_PFSYNC_GROUP)) { 2020#else 2021 sc->sc_sync_peer.s_addr != INADDR_PFSYNC_GROUP) { 2022#endif 2023 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 2024 if (m == NULL) { 2025 pfsyncstats.pfsyncs_onomem++; 2026 return (0); 2027 } 2028 ip = mtod(m, struct ip *); 2029 ip->ip_v = IPVERSION; 2030 ip->ip_hl = sizeof(*ip) >> 2; 2031 ip->ip_tos = IPTOS_LOWDELAY; 2032#ifdef __FreeBSD__ 2033 ip->ip_len = m->m_pkthdr.len; 2034#else 2035 ip->ip_len = htons(m->m_pkthdr.len); 2036#endif 2037 ip->ip_id = htons(ip_randomid()); 2038#ifdef __FreeBSD__ 2039 ip->ip_off = IP_DF; 2040#else 2041 ip->ip_off = htons(IP_DF); 2042#endif 2043 ip->ip_ttl = PFSYNC_DFLTTL; 2044 ip->ip_p = IPPROTO_PFSYNC; 2045 ip->ip_sum = 0; 2046 2047 bzero(&sa, sizeof(sa)); 2048 ip->ip_src.s_addr = INADDR_ANY; 2049 2050#ifdef __FreeBSD__ 2051 if (sc->sc_sendaddr.s_addr == htonl(INADDR_PFSYNC_GROUP)) 2052#else 2053 if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP) 2054#endif 2055 m->m_flags |= M_MCAST; 2056 ip->ip_dst = sc->sc_sendaddr; 2057 sc->sc_sendaddr.s_addr = sc->sc_sync_peer.s_addr; 2058 2059 pfsyncstats.pfsyncs_opackets++; 2060 2061#ifdef __FreeBSD__ 2062 if (!IF_HANDOFF(&sc->sc_ifq, m, NULL)) 2063 pfsyncstats.pfsyncs_oerrors++; 2064 taskqueue_enqueue(taskqueue_thread, &pfsyncif->sc_send_task); 2065#else 2066 if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL)) 2067 pfsyncstats.pfsyncs_oerrors++; 2068#endif 2069 } else 2070 m_freem(m); 2071 2072 return (0); 2073} 2074 2075#ifdef PFSYNC_TDB 2076/* Update an in-kernel tdb. Silently fail if no tdb is found. */ 2077void 2078pfsync_update_net_tdb(struct pfsync_tdb *pt) 2079{ 2080 struct tdb *tdb; 2081 int s; 2082 2083 /* check for invalid values */ 2084 if (ntohl(pt->spi) <= SPI_RESERVED_MAX || 2085 (pt->dst.sa.sa_family != AF_INET && 2086 pt->dst.sa.sa_family != AF_INET6)) 2087 goto bad; 2088 2089 s = spltdb(); 2090 tdb = gettdb(pt->spi, &pt->dst, pt->sproto); 2091 if (tdb) { 2092 pt->rpl = ntohl(pt->rpl); 2093 pt->cur_bytes = betoh64(pt->cur_bytes); 2094 2095 /* Neither replay nor byte counter should ever decrease. */ 2096 if (pt->rpl < tdb->tdb_rpl || 2097 pt->cur_bytes < tdb->tdb_cur_bytes) { 2098 splx(s); 2099 goto bad; 2100 } 2101 2102 tdb->tdb_rpl = pt->rpl; 2103 tdb->tdb_cur_bytes = pt->cur_bytes; 2104 } 2105 splx(s); 2106 return; 2107 2108 bad: 2109 if (pf_status.debug >= PF_DEBUG_MISC) 2110 printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: " 2111 "invalid value\n"); 2112 pfsyncstats.pfsyncs_badstate++; 2113 return; 2114} 2115 2116/* One of our local tdbs have been updated, need to sync rpl with others */ 2117int 2118pfsync_update_tdb(struct tdb *tdb, int output) 2119{ 2120 struct ifnet *ifp = NULL; 2121 struct pfsync_softc *sc = pfsyncif; 2122 struct pfsync_header *h; 2123 struct pfsync_tdb *pt = NULL; 2124 int s, i, ret; 2125 2126 if (sc == NULL) 2127 return (0); 2128 2129#ifdef __FreeBSD__ 2130 ifp = sc->sc_ifp; 2131#else 2132 ifp = &sc->sc_if; 2133#endif 2134 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL && 2135#ifdef __FreeBSD__ 2136 sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) { 2137#else 2138 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) { 2139#endif 2140 /* Don't leave any stale pfsync packets hanging around. */ 2141 if (sc->sc_mbuf_tdb != NULL) { 2142 m_freem(sc->sc_mbuf_tdb); 2143 sc->sc_mbuf_tdb = NULL; 2144 sc->sc_statep_tdb.t = NULL; 2145 } 2146 return (0); 2147 } 2148 2149#ifdef __FreeBSD__ 2150 PF_ASSERT(MA_OWNED); 2151#endif 2152 s = splnet(); 2153 if (sc->sc_mbuf_tdb == NULL) { 2154 if ((sc->sc_mbuf_tdb = pfsync_get_mbuf(sc, PFSYNC_ACT_TDB_UPD, 2155 (void *)&sc->sc_statep_tdb.t)) == NULL) { 2156 splx(s); 2157 return (ENOMEM); 2158 } 2159 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *); 2160 } else { 2161 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *); 2162 if (h->action != PFSYNC_ACT_TDB_UPD) { 2163 /* 2164 * XXX will never happen as long as there's 2165 * only one "TDB action". 2166 */ 2167 pfsync_tdb_sendout(sc); 2168 sc->sc_mbuf_tdb = pfsync_get_mbuf(sc, 2169 PFSYNC_ACT_TDB_UPD, (void *)&sc->sc_statep_tdb.t); 2170 if (sc->sc_mbuf_tdb == NULL) { 2171 splx(s); 2172 return (ENOMEM); 2173 } 2174 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *); 2175 } else if (sc->sc_maxupdates) { 2176 /* 2177 * If it's an update, look in the packet to see if 2178 * we already have an update for the state. 2179 */ 2180 struct pfsync_tdb *u = 2181 (void *)((char *)h + PFSYNC_HDRLEN); 2182 2183 for (i = 0; !pt && i < h->count; i++) { 2184 if (tdb->tdb_spi == u->spi && 2185 tdb->tdb_sproto == u->sproto && 2186 !bcmp(&tdb->tdb_dst, &u->dst, 2187 SA_LEN(&u->dst.sa))) { 2188 pt = u; 2189 pt->updates++; 2190 } 2191 u++; 2192 } 2193 } 2194 } 2195 2196 if (pt == NULL) { 2197 /* not a "duplicate" update */ 2198 pt = sc->sc_statep_tdb.t++; 2199 sc->sc_mbuf_tdb->m_pkthdr.len = 2200 sc->sc_mbuf_tdb->m_len += sizeof(struct pfsync_tdb); 2201 h->count++; 2202 bzero(pt, sizeof(*pt)); 2203 2204 pt->spi = tdb->tdb_spi; 2205 memcpy(&pt->dst, &tdb->tdb_dst, sizeof pt->dst); 2206 pt->sproto = tdb->tdb_sproto; 2207 } 2208 2209 /* 2210 * When a failover happens, the master's rpl is probably above 2211 * what we see here (we may be up to a second late), so 2212 * increase it a bit for outbound tdbs to manage most such 2213 * situations. 2214 * 2215 * For now, just add an offset that is likely to be larger 2216 * than the number of packets we can see in one second. The RFC 2217 * just says the next packet must have a higher seq value. 2218 * 2219 * XXX What is a good algorithm for this? We could use 2220 * a rate-determined increase, but to know it, we would have 2221 * to extend struct tdb. 2222 * XXX pt->rpl can wrap over MAXINT, but if so the real tdb 2223 * will soon be replaced anyway. For now, just don't handle 2224 * this edge case. 2225 */ 2226#define RPL_INCR 16384 2227 pt->rpl = htonl(tdb->tdb_rpl + (output ? RPL_INCR : 0)); 2228 pt->cur_bytes = htobe64(tdb->tdb_cur_bytes); 2229 2230 if (h->count == sc->sc_maxcount || 2231 (sc->sc_maxupdates && (pt->updates >= sc->sc_maxupdates))) 2232 ret = pfsync_tdb_sendout(sc); 2233 2234 splx(s); 2235 return (ret); 2236} 2237#endif /* PFSYNC_TDB */ 2238 2239#ifdef __FreeBSD__ 2240void 2241pfsync_ifdetach(void *arg, struct ifnet *ifp) 2242{ 2243 struct pfsync_softc *sc = (struct pfsync_softc *)arg; 2244 struct ip_moptions *imo; 2245 2246 if (sc == NULL || sc->sc_sync_ifp != ifp) 2247 return; /* not for us; unlocked read */ 2248 2249 PF_LOCK(); 2250 2251 /* Deal with a member interface going away from under us. */ 2252 sc->sc_sync_ifp = NULL; 2253 if (sc->sc_mbuf_net != NULL) { 2254 m_freem(sc->sc_mbuf_net); 2255 sc->sc_mbuf_net = NULL; 2256 sc->sc_statep_net.s = NULL; 2257 } 2258 imo = &sc->sc_imo; 2259 if (imo->imo_num_memberships > 0) { 2260 KASSERT(imo->imo_num_memberships == 1, 2261 ("%s: imo_num_memberships != 1", __func__)); 2262 /* 2263 * Our event handler is always called after protocol 2264 * domains have been detached from the underlying ifnet. 2265 * Do not call in_delmulti(); we held a single reference 2266 * which the protocol domain has purged in in_purgemaddrs(). 2267 */ 2268 PF_UNLOCK(); 2269 imo->imo_membership[--imo->imo_num_memberships] = NULL; 2270 PF_LOCK(); 2271 imo->imo_multicast_ifp = NULL; 2272 } 2273 2274 PF_UNLOCK(); 2275} 2276 2277void 2278pfsync_senddef(void *arg, __unused int pending) 2279{ 2280 struct pfsync_softc *sc = (struct pfsync_softc *)arg; 2281 struct mbuf *m; 2282 2283 for(;;) { 2284 IF_DEQUEUE(&sc->sc_ifq, m); 2285 if (m == NULL) 2286 break; 2287 /* Deal with a member interface going away from under us. */ 2288 if (sc->sc_sync_ifp == NULL) { 2289 pfsyncstats.pfsyncs_oerrors++; 2290 m_freem(m); 2291 continue; 2292 } 2293 if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL)) 2294 pfsyncstats.pfsyncs_oerrors++; 2295 } 2296} 2297 2298static int 2299pfsync_modevent(module_t mod, int type, void *data) 2300{ 2301 int error = 0; 2302 2303 switch (type) { 2304 case MOD_LOAD: 2305 pfsyncattach(0); 2306 break; 2307 case MOD_UNLOAD: 2308 if_clone_detach(&pfsync_cloner); 2309 break; 2310 default: 2311 error = EINVAL; 2312 break; 2313 } 2314 2315 return error; 2316} 2317 2318static moduledata_t pfsync_mod = { 2319 "pfsync", 2320 pfsync_modevent, 2321 0 2322}; 2323 2324#define PFSYNC_MODVER 1 2325 2326DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY); 2327MODULE_VERSION(pfsync, PFSYNC_MODVER); 2328MODULE_DEPEND(pflog, pf, PF_MODVER, PF_MODVER, PF_MODVER); 2329#endif /* __FreeBSD__ */ 2330