![[BACK]](/icons/back.gif){kind=icon}
Return to if_pfsync.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net|
Return to if_pfsync.c CVS log | Up to [local] / sys / net |
1.1 ! nbrk 1: /* $OpenBSD: if_pfsync.c,v 1.83 2007/06/26 14:44:12 mcbride Exp $ */
! 2:
! 3: /*
! 4: * Copyright (c) 2002 Michael Shalayeff
! 5: * All rights reserved.
! 6: *
! 7: * Redistribution and use in source and binary forms, with or without
! 8: * modification, are permitted provided that the following conditions
! 9: * are met:
! 10: * 1. Redistributions of source code must retain the above copyright
! 11: * notice, this list of conditions and the following disclaimer.
! 12: * 2. Redistributions in binary form must reproduce the above copyright
! 13: * notice, this list of conditions and the following disclaimer in the
! 14: * documentation and/or other materials provided with the distribution.
! 15: *
! 16: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 17: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 18: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 19: * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
! 20: * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
! 21: * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
! 22: * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
! 23: * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
! 24: * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
! 25: * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
! 26: * THE POSSIBILITY OF SUCH DAMAGE.
! 27: */
! 28:
! 29:
! 30: #include <sys/param.h>
! 31: #include <sys/proc.h>
! 32: #include <sys/systm.h>
! 33: #include <sys/time.h>
! 34: #include <sys/mbuf.h>
! 35: #include <sys/socket.h>
! 36: #include <sys/ioctl.h>
! 37: #include <sys/timeout.h>
! 38: #include <sys/kernel.h>
! 39:
! 40: #include <net/if.h>
! 41: #include <net/if_types.h>
! 42: #include <net/route.h>
! 43: #include <net/bpf.h>
! 44: #include <netinet/in.h>
! 45: #include <netinet/if_ether.h>
! 46: #include <netinet/tcp.h>
! 47: #include <netinet/tcp_seq.h>
! 48:
! 49: #ifdef INET
! 50: #include <netinet/in_systm.h>
! 51: #include <netinet/in_var.h>
! 52: #include <netinet/ip.h>
! 53: #include <netinet/ip_var.h>
! 54: #endif
! 55:
! 56: #ifdef INET6
! 57: #include <netinet6/nd6.h>
! 58: #endif /* INET6 */
! 59:
! 60: #include "carp.h"
! 61: #if NCARP > 0
! 62: #include <netinet/ip_carp.h>
! 63: #endif
! 64:
! 65: #include <net/pfvar.h>
! 66: #include <net/if_pfsync.h>
! 67:
! 68: #include "bpfilter.h"
! 69: #include "pfsync.h"
! 70:
! 71: #define PFSYNC_MINMTU \
! 72: (sizeof(struct pfsync_header) + sizeof(struct pf_state))
! 73:
! 74: #ifdef PFSYNCDEBUG
! 75: #define DPRINTF(x) do { if (pfsyncdebug) printf x ; } while (0)
! 76: int pfsyncdebug;
! 77: #else
! 78: #define DPRINTF(x)
! 79: #endif
! 80:
! 81: struct pfsync_softc *pfsyncif = NULL;
! 82: struct pfsyncstats pfsyncstats;
! 83:
! 84: void pfsyncattach(int);
! 85: int pfsync_clone_create(struct if_clone *, int);
! 86: int pfsync_clone_destroy(struct ifnet *);
! 87: void pfsync_setmtu(struct pfsync_softc *, int);
! 88: int pfsync_alloc_scrub_memory(struct pfsync_state_peer *,
! 89: struct pf_state_peer *);
! 90: int pfsync_insert_net_state(struct pfsync_state *, u_int8_t);
! 91: void pfsync_update_net_tdb(struct pfsync_tdb *);
! 92: int pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
! 93: struct rtentry *);
! 94: int pfsyncioctl(struct ifnet *, u_long, caddr_t);
! 95: void pfsyncstart(struct ifnet *);
! 96:
! 97: struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **);
! 98: int pfsync_request_update(struct pfsync_state_upd *, struct in_addr *);
! 99: int pfsync_sendout(struct pfsync_softc *);
! 100: int pfsync_tdb_sendout(struct pfsync_softc *);
! 101: int pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *);
! 102: void pfsync_timeout(void *);
! 103: void pfsync_tdb_timeout(void *);
! 104: void pfsync_send_bus(struct pfsync_softc *, u_int8_t);
! 105: void pfsync_bulk_update(void *);
! 106: void pfsync_bulkfail(void *);
! 107:
! 108: int pfsync_sync_ok;
! 109:
! 110: struct if_clone pfsync_cloner =
! 111: IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy);
! 112:
! 113: void
! 114: pfsyncattach(int npfsync)
! 115: {
! 116: if_clone_attach(&pfsync_cloner);
! 117: }
! 118: int
! 119: pfsync_clone_create(struct if_clone *ifc, int unit)
! 120: {
! 121: struct ifnet *ifp;
! 122:
! 123: if (unit != 0)
! 124: return (EINVAL);
! 125:
! 126: pfsync_sync_ok = 1;
! 127: if ((pfsyncif = malloc(sizeof(*pfsyncif), M_DEVBUF, M_NOWAIT)) == NULL)
! 128: return (ENOMEM);
! 129: bzero(pfsyncif, sizeof(*pfsyncif));
! 130: pfsyncif->sc_mbuf = NULL;
! 131: pfsyncif->sc_mbuf_net = NULL;
! 132: pfsyncif->sc_mbuf_tdb = NULL;
! 133: pfsyncif->sc_statep.s = NULL;
! 134: pfsyncif->sc_statep_net.s = NULL;
! 135: pfsyncif->sc_statep_tdb.t = NULL;
! 136: pfsyncif->sc_maxupdates = 128;
! 137: pfsyncif->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
! 138: pfsyncif->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
! 139: pfsyncif->sc_ureq_received = 0;
! 140: pfsyncif->sc_ureq_sent = 0;
! 141: pfsyncif->sc_bulk_send_next = NULL;
! 142: pfsyncif->sc_bulk_terminator = NULL;
! 143: ifp = &pfsyncif->sc_if;
! 144: snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit);
! 145: ifp->if_softc = pfsyncif;
! 146: ifp->if_ioctl = pfsyncioctl;
! 147: ifp->if_output = pfsyncoutput;
! 148: ifp->if_start = pfsyncstart;
! 149: ifp->if_type = IFT_PFSYNC;
! 150: ifp->if_snd.ifq_maxlen = ifqmaxlen;
! 151: ifp->if_hdrlen = PFSYNC_HDRLEN;
! 152: pfsync_setmtu(pfsyncif, ETHERMTU);
! 153: timeout_set(&pfsyncif->sc_tmo, pfsync_timeout, pfsyncif);
! 154: timeout_set(&pfsyncif->sc_tdb_tmo, pfsync_tdb_timeout, pfsyncif);
! 155: timeout_set(&pfsyncif->sc_bulk_tmo, pfsync_bulk_update, pfsyncif);
! 156: timeout_set(&pfsyncif->sc_bulkfail_tmo, pfsync_bulkfail, pfsyncif);
! 157: if_attach(ifp);
! 158: if_alloc_sadl(ifp);
! 159:
! 160: #if NCARP > 0
! 161: if_addgroup(ifp, "carp");
! 162: #endif
! 163:
! 164: #if NBPFILTER > 0
! 165: bpfattach(&pfsyncif->sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
! 166: #endif
! 167:
! 168: return (0);
! 169: }
! 170:
! 171: int
! 172: pfsync_clone_destroy(struct ifnet *ifp)
! 173: {
! 174: #if NBPFILTER > 0
! 175: bpfdetach(ifp);
! 176: #endif
! 177: if_detach(ifp);
! 178: free(pfsyncif, M_DEVBUF);
! 179: pfsyncif = NULL;
! 180: return (0);
! 181: }
! 182:
! 183: /*
! 184: * Start output on the pfsync interface.
! 185: */
! 186: void
! 187: pfsyncstart(struct ifnet *ifp)
! 188: {
! 189: struct mbuf *m;
! 190: int s;
! 191:
! 192: for (;;) {
! 193: s = splnet();
! 194: IF_DROP(&ifp->if_snd);
! 195: IF_DEQUEUE(&ifp->if_snd, m);
! 196: splx(s);
! 197:
! 198: if (m == NULL)
! 199: return;
! 200: else
! 201: m_freem(m);
! 202: }
! 203: }
! 204:
! 205: int
! 206: pfsync_alloc_scrub_memory(struct pfsync_state_peer *s,
! 207: struct pf_state_peer *d)
! 208: {
! 209: if (s->scrub.scrub_flag && d->scrub == NULL) {
! 210: d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
! 211: if (d->scrub == NULL)
! 212: return (ENOMEM);
! 213: bzero(d->scrub, sizeof(*d->scrub));
! 214: }
! 215:
! 216: return (0);
! 217: }
! 218:
! 219: int
! 220: pfsync_insert_net_state(struct pfsync_state *sp, u_int8_t chksum_flag)
! 221: {
! 222: struct pf_state *st = NULL;
! 223: struct pf_state_key *sk = NULL;
! 224: struct pf_rule *r = NULL;
! 225: struct pfi_kif *kif;
! 226:
! 227: if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
! 228: printf("pfsync_insert_net_state: invalid creator id:"
! 229: " %08x\n", ntohl(sp->creatorid));
! 230: return (EINVAL);
! 231: }
! 232:
! 233: kif = pfi_kif_get(sp->ifname);
! 234: if (kif == NULL) {
! 235: if (pf_status.debug >= PF_DEBUG_MISC)
! 236: printf("pfsync_insert_net_state: "
! 237: "unknown interface: %s\n", sp->ifname);
! 238: /* skip this state */
! 239: return (0);
! 240: }
! 241:
! 242: /*
! 243: * If the ruleset checksums match, it's safe to associate the state
! 244: * with the rule of that number.
! 245: */
! 246: if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) && chksum_flag &&
! 247: ntohl(sp->rule) <
! 248: pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount)
! 249: r = pf_main_ruleset.rules[
! 250: PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)];
! 251: else
! 252: r = &pf_default_rule;
! 253:
! 254: if (!r->max_states || r->states < r->max_states)
! 255: st = pool_get(&pf_state_pl, PR_NOWAIT);
! 256: if (st == NULL) {
! 257: pfi_kif_unref(kif, PFI_KIF_REF_NONE);
! 258: return (ENOMEM);
! 259: }
! 260: bzero(st, sizeof(*st));
! 261:
! 262: if ((sk = pf_alloc_state_key(st)) == NULL) {
! 263: pool_put(&pf_state_pl, st);
! 264: pfi_kif_unref(kif, PFI_KIF_REF_NONE);
! 265: return (ENOMEM);
! 266: }
! 267:
! 268: /* allocate memory for scrub info */
! 269: if (pfsync_alloc_scrub_memory(&sp->src, &st->src) ||
! 270: pfsync_alloc_scrub_memory(&sp->dst, &st->dst)) {
! 271: pfi_kif_unref(kif, PFI_KIF_REF_NONE);
! 272: if (st->src.scrub)
! 273: pool_put(&pf_state_scrub_pl, st->src.scrub);
! 274: pool_put(&pf_state_pl, st);
! 275: pool_put(&pf_state_key_pl, sk);
! 276: return (ENOMEM);
! 277: }
! 278:
! 279: st->rule.ptr = r;
! 280: /* XXX get pointers to nat_rule and anchor */
! 281:
! 282: /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
! 283: r->states++;
! 284:
! 285: /* fill in the rest of the state entry */
! 286: pf_state_host_ntoh(&sp->lan, &sk->lan);
! 287: pf_state_host_ntoh(&sp->gwy, &sk->gwy);
! 288: pf_state_host_ntoh(&sp->ext, &sk->ext);
! 289:
! 290: pf_state_peer_ntoh(&sp->src, &st->src);
! 291: pf_state_peer_ntoh(&sp->dst, &st->dst);
! 292:
! 293: bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
! 294: st->creation = time_second - ntohl(sp->creation);
! 295: st->expire = ntohl(sp->expire) + time_second;
! 296:
! 297: sk->af = sp->af;
! 298: sk->proto = sp->proto;
! 299: sk->direction = sp->direction;
! 300: st->log = sp->log;
! 301: st->timeout = sp->timeout;
! 302: st->allow_opts = sp->allow_opts;
! 303:
! 304: bcopy(sp->id, &st->id, sizeof(st->id));
! 305: st->creatorid = sp->creatorid;
! 306: st->sync_flags = PFSTATE_FROMSYNC;
! 307:
! 308: if (pf_insert_state(kif, st)) {
! 309: pfi_kif_unref(kif, PFI_KIF_REF_NONE);
! 310: /* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */
! 311: r->states--;
! 312: if (st->dst.scrub)
! 313: pool_put(&pf_state_scrub_pl, st->dst.scrub);
! 314: if (st->src.scrub)
! 315: pool_put(&pf_state_scrub_pl, st->src.scrub);
! 316: pool_put(&pf_state_pl, st);
! 317: return (EINVAL);
! 318: }
! 319:
! 320: return (0);
! 321: }
! 322:
! 323: void
! 324: pfsync_input(struct mbuf *m, ...)
! 325: {
! 326: struct ip *ip = mtod(m, struct ip *);
! 327: struct pfsync_header *ph;
! 328: struct pfsync_softc *sc = pfsyncif;
! 329: struct pf_state *st;
! 330: struct pf_state_key *sk;
! 331: struct pf_state_cmp id_key;
! 332: struct pfsync_state *sp;
! 333: struct pfsync_state_upd *up;
! 334: struct pfsync_state_del *dp;
! 335: struct pfsync_state_clr *cp;
! 336: struct pfsync_state_upd_req *rup;
! 337: struct pfsync_state_bus *bus;
! 338: #ifdef IPSEC
! 339: struct pfsync_tdb *pt;
! 340: #endif
! 341: struct in_addr src;
! 342: struct mbuf *mp;
! 343: int iplen, action, error, i, s, count, offp, sfail, stale = 0;
! 344: u_int8_t chksum_flag = 0;
! 345:
! 346: pfsyncstats.pfsyncs_ipackets++;
! 347:
! 348: /* verify that we have a sync interface configured */
! 349: if (!sc || !sc->sc_sync_ifp || !pf_status.running)
! 350: goto done;
! 351:
! 352: /* verify that the packet came in on the right interface */
! 353: if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) {
! 354: pfsyncstats.pfsyncs_badif++;
! 355: goto done;
! 356: }
! 357:
! 358: /* verify that the IP TTL is 255. */
! 359: if (ip->ip_ttl != PFSYNC_DFLTTL) {
! 360: pfsyncstats.pfsyncs_badttl++;
! 361: goto done;
! 362: }
! 363:
! 364: iplen = ip->ip_hl << 2;
! 365:
! 366: if (m->m_pkthdr.len < iplen + sizeof(*ph)) {
! 367: pfsyncstats.pfsyncs_hdrops++;
! 368: goto done;
! 369: }
! 370:
! 371: if (iplen + sizeof(*ph) > m->m_len) {
! 372: if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) {
! 373: pfsyncstats.pfsyncs_hdrops++;
! 374: goto done;
! 375: }
! 376: ip = mtod(m, struct ip *);
! 377: }
! 378: ph = (struct pfsync_header *)((char *)ip + iplen);
! 379:
! 380: /* verify the version */
! 381: if (ph->version != PFSYNC_VERSION) {
! 382: pfsyncstats.pfsyncs_badver++;
! 383: goto done;
! 384: }
! 385:
! 386: action = ph->action;
! 387: count = ph->count;
! 388:
! 389: /* make sure it's a valid action code */
! 390: if (action >= PFSYNC_ACT_MAX) {
! 391: pfsyncstats.pfsyncs_badact++;
! 392: goto done;
! 393: }
! 394:
! 395: /* Cheaper to grab this now than having to mess with mbufs later */
! 396: src = ip->ip_src;
! 397:
! 398: if (!bcmp(&ph->pf_chksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
! 399: chksum_flag++;
! 400:
! 401: switch (action) {
! 402: case PFSYNC_ACT_CLR: {
! 403: struct pf_state *nexts;
! 404: struct pf_state_key *nextsk;
! 405: struct pfi_kif *kif;
! 406: u_int32_t creatorid;
! 407: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 408: sizeof(*cp), &offp)) == NULL) {
! 409: pfsyncstats.pfsyncs_badlen++;
! 410: return;
! 411: }
! 412: cp = (struct pfsync_state_clr *)(mp->m_data + offp);
! 413: creatorid = cp->creatorid;
! 414:
! 415: s = splsoftnet();
! 416: if (cp->ifname[0] == '\0') {
! 417: for (st = RB_MIN(pf_state_tree_id, &tree_id);
! 418: st; st = nexts) {
! 419: nexts = RB_NEXT(pf_state_tree_id, &tree_id, st);
! 420: if (st->creatorid == creatorid) {
! 421: st->sync_flags |= PFSTATE_FROMSYNC;
! 422: pf_unlink_state(st);
! 423: }
! 424: }
! 425: } else {
! 426: if ((kif = pfi_kif_get(cp->ifname)) == NULL) {
! 427: splx(s);
! 428: return;
! 429: }
! 430: for (sk = RB_MIN(pf_state_tree_lan_ext,
! 431: &pf_statetbl_lan_ext); sk; sk = nextsk) {
! 432: nextsk = RB_NEXT(pf_state_tree_lan_ext,
! 433: &pf_statetbl_lan_ext, sk);
! 434: TAILQ_FOREACH(st, &sk->states, next) {
! 435: if (st->creatorid == creatorid) {
! 436: st->sync_flags |=
! 437: PFSTATE_FROMSYNC;
! 438: pf_unlink_state(st);
! 439: }
! 440: }
! 441: }
! 442: }
! 443: splx(s);
! 444:
! 445: break;
! 446: }
! 447: case PFSYNC_ACT_INS:
! 448: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 449: count * sizeof(*sp), &offp)) == NULL) {
! 450: pfsyncstats.pfsyncs_badlen++;
! 451: return;
! 452: }
! 453:
! 454: s = splsoftnet();
! 455: for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
! 456: i < count; i++, sp++) {
! 457: /* check for invalid values */
! 458: if (sp->timeout >= PFTM_MAX ||
! 459: sp->src.state > PF_TCPS_PROXY_DST ||
! 460: sp->dst.state > PF_TCPS_PROXY_DST ||
! 461: sp->direction > PF_OUT ||
! 462: (sp->af != AF_INET && sp->af != AF_INET6)) {
! 463: if (pf_status.debug >= PF_DEBUG_MISC)
! 464: printf("pfsync_insert: PFSYNC_ACT_INS: "
! 465: "invalid value\n");
! 466: pfsyncstats.pfsyncs_badstate++;
! 467: continue;
! 468: }
! 469:
! 470: if ((error = pfsync_insert_net_state(sp,
! 471: chksum_flag))) {
! 472: if (error == ENOMEM) {
! 473: splx(s);
! 474: goto done;
! 475: }
! 476: continue;
! 477: }
! 478: }
! 479: splx(s);
! 480: break;
! 481: case PFSYNC_ACT_UPD:
! 482: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 483: count * sizeof(*sp), &offp)) == NULL) {
! 484: pfsyncstats.pfsyncs_badlen++;
! 485: return;
! 486: }
! 487:
! 488: s = splsoftnet();
! 489: for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
! 490: i < count; i++, sp++) {
! 491: int flags = PFSYNC_FLAG_STALE;
! 492:
! 493: /* check for invalid values */
! 494: if (sp->timeout >= PFTM_MAX ||
! 495: sp->src.state > PF_TCPS_PROXY_DST ||
! 496: sp->dst.state > PF_TCPS_PROXY_DST) {
! 497: if (pf_status.debug >= PF_DEBUG_MISC)
! 498: printf("pfsync_insert: PFSYNC_ACT_UPD: "
! 499: "invalid value\n");
! 500: pfsyncstats.pfsyncs_badstate++;
! 501: continue;
! 502: }
! 503:
! 504: bcopy(sp->id, &id_key.id, sizeof(id_key.id));
! 505: id_key.creatorid = sp->creatorid;
! 506:
! 507: st = pf_find_state_byid(&id_key);
! 508: if (st == NULL) {
! 509: /* insert the update */
! 510: if (pfsync_insert_net_state(sp, chksum_flag))
! 511: pfsyncstats.pfsyncs_badstate++;
! 512: continue;
! 513: }
! 514: sk = st->state_key;
! 515: sfail = 0;
! 516: if (sk->proto == IPPROTO_TCP) {
! 517: /*
! 518: * The state should never go backwards except
! 519: * for syn-proxy states. Neither should the
! 520: * sequence window slide backwards.
! 521: */
! 522: if (st->src.state > sp->src.state &&
! 523: (st->src.state < PF_TCPS_PROXY_SRC ||
! 524: sp->src.state >= PF_TCPS_PROXY_SRC))
! 525: sfail = 1;
! 526: else if (SEQ_GT(st->src.seqlo,
! 527: ntohl(sp->src.seqlo)))
! 528: sfail = 3;
! 529: else if (st->dst.state > sp->dst.state) {
! 530: /* There might still be useful
! 531: * information about the src state here,
! 532: * so import that part of the update,
! 533: * then "fail" so we send the updated
! 534: * state back to the peer who is missing
! 535: * our what we know. */
! 536: pf_state_peer_ntoh(&sp->src, &st->src);
! 537: /* XXX do anything with timeouts? */
! 538: sfail = 7;
! 539: flags = 0;
! 540: } else if (st->dst.state >= TCPS_SYN_SENT &&
! 541: SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo)))
! 542: sfail = 4;
! 543: } else {
! 544: /*
! 545: * Non-TCP protocol state machine always go
! 546: * forwards
! 547: */
! 548: if (st->src.state > sp->src.state)
! 549: sfail = 5;
! 550: else if (st->dst.state > sp->dst.state)
! 551: sfail = 6;
! 552: }
! 553: if (sfail) {
! 554: if (pf_status.debug >= PF_DEBUG_MISC)
! 555: printf("pfsync: %s stale update "
! 556: "(%d) id: %016llx "
! 557: "creatorid: %08x\n",
! 558: (sfail < 7 ? "ignoring"
! 559: : "partial"), sfail,
! 560: betoh64(st->id),
! 561: ntohl(st->creatorid));
! 562: pfsyncstats.pfsyncs_badstate++;
! 563:
! 564: if (!(sp->sync_flags & PFSTATE_STALE)) {
! 565: /* we have a better state, send it */
! 566: if (sc->sc_mbuf != NULL && !stale)
! 567: pfsync_sendout(sc);
! 568: stale++;
! 569: if (!st->sync_flags)
! 570: pfsync_pack_state(
! 571: PFSYNC_ACT_UPD, st, flags);
! 572: }
! 573: continue;
! 574: }
! 575: pfsync_alloc_scrub_memory(&sp->dst, &st->dst);
! 576: pf_state_peer_ntoh(&sp->src, &st->src);
! 577: pf_state_peer_ntoh(&sp->dst, &st->dst);
! 578: st->expire = ntohl(sp->expire) + time_second;
! 579: st->timeout = sp->timeout;
! 580: }
! 581: if (stale && sc->sc_mbuf != NULL)
! 582: pfsync_sendout(sc);
! 583: splx(s);
! 584: break;
! 585: /*
! 586: * It's not strictly necessary for us to support the "uncompressed"
! 587: * delete action, but it's relatively simple and maintains consistency.
! 588: */
! 589: case PFSYNC_ACT_DEL:
! 590: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 591: count * sizeof(*sp), &offp)) == NULL) {
! 592: pfsyncstats.pfsyncs_badlen++;
! 593: return;
! 594: }
! 595:
! 596: s = splsoftnet();
! 597: for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
! 598: i < count; i++, sp++) {
! 599: bcopy(sp->id, &id_key.id, sizeof(id_key.id));
! 600: id_key.creatorid = sp->creatorid;
! 601:
! 602: st = pf_find_state_byid(&id_key);
! 603: if (st == NULL) {
! 604: pfsyncstats.pfsyncs_badstate++;
! 605: continue;
! 606: }
! 607: st->sync_flags |= PFSTATE_FROMSYNC;
! 608: pf_unlink_state(st);
! 609: }
! 610: splx(s);
! 611: break;
! 612: case PFSYNC_ACT_UPD_C: {
! 613: int update_requested = 0;
! 614:
! 615: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 616: count * sizeof(*up), &offp)) == NULL) {
! 617: pfsyncstats.pfsyncs_badlen++;
! 618: return;
! 619: }
! 620:
! 621: s = splsoftnet();
! 622: for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp);
! 623: i < count; i++, up++) {
! 624: /* check for invalid values */
! 625: if (up->timeout >= PFTM_MAX ||
! 626: up->src.state > PF_TCPS_PROXY_DST ||
! 627: up->dst.state > PF_TCPS_PROXY_DST) {
! 628: if (pf_status.debug >= PF_DEBUG_MISC)
! 629: printf("pfsync_insert: "
! 630: "PFSYNC_ACT_UPD_C: "
! 631: "invalid value\n");
! 632: pfsyncstats.pfsyncs_badstate++;
! 633: continue;
! 634: }
! 635:
! 636: bcopy(up->id, &id_key.id, sizeof(id_key.id));
! 637: id_key.creatorid = up->creatorid;
! 638:
! 639: st = pf_find_state_byid(&id_key);
! 640: if (st == NULL) {
! 641: /* We don't have this state. Ask for it. */
! 642: error = pfsync_request_update(up, &src);
! 643: if (error == ENOMEM) {
! 644: splx(s);
! 645: goto done;
! 646: }
! 647: update_requested = 1;
! 648: pfsyncstats.pfsyncs_badstate++;
! 649: continue;
! 650: }
! 651: sk = st->state_key;
! 652: sfail = 0;
! 653: if (sk->proto == IPPROTO_TCP) {
! 654: /*
! 655: * The state should never go backwards except
! 656: * for syn-proxy states. Neither should the
! 657: * sequence window slide backwards.
! 658: */
! 659: if (st->src.state > up->src.state &&
! 660: (st->src.state < PF_TCPS_PROXY_SRC ||
! 661: up->src.state >= PF_TCPS_PROXY_SRC))
! 662: sfail = 1;
! 663: else if (st->dst.state > up->dst.state)
! 664: sfail = 2;
! 665: else if (SEQ_GT(st->src.seqlo,
! 666: ntohl(up->src.seqlo)))
! 667: sfail = 3;
! 668: else if (st->dst.state >= TCPS_SYN_SENT &&
! 669: SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo)))
! 670: sfail = 4;
! 671: } else {
! 672: /*
! 673: * Non-TCP protocol state machine always go
! 674: * forwards
! 675: */
! 676: if (st->src.state > up->src.state)
! 677: sfail = 5;
! 678: else if (st->dst.state > up->dst.state)
! 679: sfail = 6;
! 680: }
! 681: if (sfail) {
! 682: if (pf_status.debug >= PF_DEBUG_MISC)
! 683: printf("pfsync: ignoring stale update "
! 684: "(%d) id: %016llx "
! 685: "creatorid: %08x\n", sfail,
! 686: betoh64(st->id),
! 687: ntohl(st->creatorid));
! 688: pfsyncstats.pfsyncs_badstate++;
! 689:
! 690: /* we have a better state, send it out */
! 691: if ((!stale || update_requested) &&
! 692: sc->sc_mbuf != NULL) {
! 693: pfsync_sendout(sc);
! 694: update_requested = 0;
! 695: }
! 696: stale++;
! 697: if (!st->sync_flags)
! 698: pfsync_pack_state(PFSYNC_ACT_UPD, st,
! 699: PFSYNC_FLAG_STALE);
! 700: continue;
! 701: }
! 702: pfsync_alloc_scrub_memory(&up->dst, &st->dst);
! 703: pf_state_peer_ntoh(&up->src, &st->src);
! 704: pf_state_peer_ntoh(&up->dst, &st->dst);
! 705: st->expire = ntohl(up->expire) + time_second;
! 706: st->timeout = up->timeout;
! 707: }
! 708: if ((update_requested || stale) && sc->sc_mbuf)
! 709: pfsync_sendout(sc);
! 710: splx(s);
! 711: break;
! 712: }
! 713: case PFSYNC_ACT_DEL_C:
! 714: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 715: count * sizeof(*dp), &offp)) == NULL) {
! 716: pfsyncstats.pfsyncs_badlen++;
! 717: return;
! 718: }
! 719:
! 720: s = splsoftnet();
! 721: for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp);
! 722: i < count; i++, dp++) {
! 723: bcopy(dp->id, &id_key.id, sizeof(id_key.id));
! 724: id_key.creatorid = dp->creatorid;
! 725:
! 726: st = pf_find_state_byid(&id_key);
! 727: if (st == NULL) {
! 728: pfsyncstats.pfsyncs_badstate++;
! 729: continue;
! 730: }
! 731: st->sync_flags |= PFSTATE_FROMSYNC;
! 732: pf_unlink_state(st);
! 733: }
! 734: splx(s);
! 735: break;
! 736: case PFSYNC_ACT_INS_F:
! 737: case PFSYNC_ACT_DEL_F:
! 738: /* not implemented */
! 739: break;
! 740: case PFSYNC_ACT_UREQ:
! 741: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 742: count * sizeof(*rup), &offp)) == NULL) {
! 743: pfsyncstats.pfsyncs_badlen++;
! 744: return;
! 745: }
! 746:
! 747: s = splsoftnet();
! 748: if (sc->sc_mbuf != NULL)
! 749: pfsync_sendout(sc);
! 750: for (i = 0,
! 751: rup = (struct pfsync_state_upd_req *)(mp->m_data + offp);
! 752: i < count; i++, rup++) {
! 753: bcopy(rup->id, &id_key.id, sizeof(id_key.id));
! 754: id_key.creatorid = rup->creatorid;
! 755:
! 756: if (id_key.id == 0 && id_key.creatorid == 0) {
! 757: sc->sc_ureq_received = time_uptime;
! 758: if (sc->sc_bulk_send_next == NULL)
! 759: sc->sc_bulk_send_next =
! 760: TAILQ_FIRST(&state_list);
! 761: sc->sc_bulk_terminator = sc->sc_bulk_send_next;
! 762: if (pf_status.debug >= PF_DEBUG_MISC)
! 763: printf("pfsync: received "
! 764: "bulk update request\n");
! 765: pfsync_send_bus(sc, PFSYNC_BUS_START);
! 766: timeout_add(&sc->sc_bulk_tmo, 1 * hz);
! 767: } else {
! 768: st = pf_find_state_byid(&id_key);
! 769: if (st == NULL) {
! 770: pfsyncstats.pfsyncs_badstate++;
! 771: continue;
! 772: }
! 773: if (!st->sync_flags)
! 774: pfsync_pack_state(PFSYNC_ACT_UPD,
! 775: st, 0);
! 776: }
! 777: }
! 778: if (sc->sc_mbuf != NULL)
! 779: pfsync_sendout(sc);
! 780: splx(s);
! 781: break;
! 782: case PFSYNC_ACT_BUS:
! 783: /* If we're not waiting for a bulk update, who cares. */
! 784: if (sc->sc_ureq_sent == 0)
! 785: break;
! 786:
! 787: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 788: sizeof(*bus), &offp)) == NULL) {
! 789: pfsyncstats.pfsyncs_badlen++;
! 790: return;
! 791: }
! 792: bus = (struct pfsync_state_bus *)(mp->m_data + offp);
! 793: switch (bus->status) {
! 794: case PFSYNC_BUS_START:
! 795: timeout_add(&sc->sc_bulkfail_tmo,
! 796: pf_pool_limits[PF_LIMIT_STATES].limit /
! 797: (PFSYNC_BULKPACKETS * sc->sc_maxcount));
! 798: if (pf_status.debug >= PF_DEBUG_MISC)
! 799: printf("pfsync: received bulk "
! 800: "update start\n");
! 801: break;
! 802: case PFSYNC_BUS_END:
! 803: if (time_uptime - ntohl(bus->endtime) >=
! 804: sc->sc_ureq_sent) {
! 805: /* that's it, we're happy */
! 806: sc->sc_ureq_sent = 0;
! 807: sc->sc_bulk_tries = 0;
! 808: timeout_del(&sc->sc_bulkfail_tmo);
! 809: #if NCARP > 0
! 810: if (!pfsync_sync_ok)
! 811: carp_group_demote_adj(&sc->sc_if, -1);
! 812: #endif
! 813: pfsync_sync_ok = 1;
! 814: if (pf_status.debug >= PF_DEBUG_MISC)
! 815: printf("pfsync: received valid "
! 816: "bulk update end\n");
! 817: } else {
! 818: if (pf_status.debug >= PF_DEBUG_MISC)
! 819: printf("pfsync: received invalid "
! 820: "bulk update end: bad timestamp\n");
! 821: }
! 822: break;
! 823: }
! 824: break;
! 825: #ifdef IPSEC
! 826: case PFSYNC_ACT_TDB_UPD:
! 827: if ((mp = m_pulldown(m, iplen + sizeof(*ph),
! 828: count * sizeof(*pt), &offp)) == NULL) {
! 829: pfsyncstats.pfsyncs_badlen++;
! 830: return;
! 831: }
! 832: s = splsoftnet();
! 833: for (i = 0, pt = (struct pfsync_tdb *)(mp->m_data + offp);
! 834: i < count; i++, pt++)
! 835: pfsync_update_net_tdb(pt);
! 836: splx(s);
! 837: break;
! 838: #endif
! 839: }
! 840:
! 841: done:
! 842: if (m)
! 843: m_freem(m);
! 844: }
! 845:
! 846: int
! 847: pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
! 848: struct rtentry *rt)
! 849: {
! 850: m_freem(m);
! 851: return (0);
! 852: }
! 853:
! 854: /* ARGSUSED */
! 855: int
! 856: pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
! 857: {
! 858: struct proc *p = curproc;
! 859: struct pfsync_softc *sc = ifp->if_softc;
! 860: struct ifreq *ifr = (struct ifreq *)data;
! 861: struct ip_moptions *imo = &sc->sc_imo;
! 862: struct pfsyncreq pfsyncr;
! 863: struct ifnet *sifp;
! 864: int s, error;
! 865:
! 866: switch (cmd) {
! 867: case SIOCSIFADDR:
! 868: case SIOCAIFADDR:
! 869: case SIOCSIFDSTADDR:
! 870: case SIOCSIFFLAGS:
! 871: if (ifp->if_flags & IFF_UP)
! 872: ifp->if_flags |= IFF_RUNNING;
! 873: else
! 874: ifp->if_flags &= ~IFF_RUNNING;
! 875: break;
! 876: case SIOCSIFMTU:
! 877: if (ifr->ifr_mtu < PFSYNC_MINMTU)
! 878: return (EINVAL);
! 879: if (ifr->ifr_mtu > MCLBYTES)
! 880: ifr->ifr_mtu = MCLBYTES;
! 881: s = splnet();
! 882: if (ifr->ifr_mtu < ifp->if_mtu)
! 883: pfsync_sendout(sc);
! 884: pfsync_setmtu(sc, ifr->ifr_mtu);
! 885: splx(s);
! 886: break;
! 887: case SIOCGETPFSYNC:
! 888: bzero(&pfsyncr, sizeof(pfsyncr));
! 889: if (sc->sc_sync_ifp)
! 890: strlcpy(pfsyncr.pfsyncr_syncdev,
! 891: sc->sc_sync_ifp->if_xname, IFNAMSIZ);
! 892: pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer;
! 893: pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
! 894: if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr))))
! 895: return (error);
! 896: break;
! 897: case SIOCSETPFSYNC:
! 898: if ((error = suser(p, p->p_acflag)) != 0)
! 899: return (error);
! 900: if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
! 901: return (error);
! 902:
! 903: if (pfsyncr.pfsyncr_syncpeer.s_addr == 0)
! 904: sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
! 905: else
! 906: sc->sc_sync_peer.s_addr =
! 907: pfsyncr.pfsyncr_syncpeer.s_addr;
! 908:
! 909: if (pfsyncr.pfsyncr_maxupdates > 255)
! 910: return (EINVAL);
! 911: sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
! 912:
! 913: if (pfsyncr.pfsyncr_syncdev[0] == 0) {
! 914: sc->sc_sync_ifp = NULL;
! 915: if (sc->sc_mbuf_net != NULL) {
! 916: /* Don't keep stale pfsync packets around. */
! 917: s = splnet();
! 918: m_freem(sc->sc_mbuf_net);
! 919: sc->sc_mbuf_net = NULL;
! 920: sc->sc_statep_net.s = NULL;
! 921: splx(s);
! 922: }
! 923: if (imo->imo_num_memberships > 0) {
! 924: in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
! 925: imo->imo_multicast_ifp = NULL;
! 926: }
! 927: break;
! 928: }
! 929:
! 930: if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL)
! 931: return (EINVAL);
! 932:
! 933: s = splnet();
! 934: if (sifp->if_mtu < sc->sc_if.if_mtu ||
! 935: (sc->sc_sync_ifp != NULL &&
! 936: sifp->if_mtu < sc->sc_sync_ifp->if_mtu) ||
! 937: sifp->if_mtu < MCLBYTES - sizeof(struct ip))
! 938: pfsync_sendout(sc);
! 939: sc->sc_sync_ifp = sifp;
! 940:
! 941: pfsync_setmtu(sc, sc->sc_if.if_mtu);
! 942:
! 943: if (imo->imo_num_memberships > 0) {
! 944: in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
! 945: imo->imo_multicast_ifp = NULL;
! 946: }
! 947:
! 948: if (sc->sc_sync_ifp &&
! 949: sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
! 950: struct in_addr addr;
! 951:
! 952: if (!(sc->sc_sync_ifp->if_flags & IFF_MULTICAST)) {
! 953: sc->sc_sync_ifp = NULL;
! 954: splx(s);
! 955: return (EADDRNOTAVAIL);
! 956: }
! 957:
! 958: addr.s_addr = INADDR_PFSYNC_GROUP;
! 959:
! 960: if ((imo->imo_membership[0] =
! 961: in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) {
! 962: sc->sc_sync_ifp = NULL;
! 963: splx(s);
! 964: return (ENOBUFS);
! 965: }
! 966: imo->imo_num_memberships++;
! 967: imo->imo_multicast_ifp = sc->sc_sync_ifp;
! 968: imo->imo_multicast_ttl = PFSYNC_DFLTTL;
! 969: imo->imo_multicast_loop = 0;
! 970: }
! 971:
! 972: if (sc->sc_sync_ifp ||
! 973: sc->sc_sendaddr.s_addr != INADDR_PFSYNC_GROUP) {
! 974: /* Request a full state table update. */
! 975: sc->sc_ureq_sent = time_uptime;
! 976: #if NCARP > 0
! 977: if (pfsync_sync_ok)
! 978: carp_group_demote_adj(&sc->sc_if, 1);
! 979: #endif
! 980: pfsync_sync_ok = 0;
! 981: if (pf_status.debug >= PF_DEBUG_MISC)
! 982: printf("pfsync: requesting bulk update\n");
! 983: timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
! 984: error = pfsync_request_update(NULL, NULL);
! 985: if (error == ENOMEM) {
! 986: splx(s);
! 987: return (ENOMEM);
! 988: }
! 989: pfsync_sendout(sc);
! 990: }
! 991: splx(s);
! 992:
! 993: break;
! 994:
! 995: default:
! 996: return (ENOTTY);
! 997: }
! 998:
! 999: return (0);
! 1000: }
! 1001:
! 1002: void
! 1003: pfsync_setmtu(struct pfsync_softc *sc, int mtu_req)
! 1004: {
! 1005: int mtu;
! 1006:
! 1007: if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req)
! 1008: mtu = sc->sc_sync_ifp->if_mtu;
! 1009: else
! 1010: mtu = mtu_req;
! 1011:
! 1012: sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) /
! 1013: sizeof(struct pfsync_state);
! 1014: if (sc->sc_maxcount > 254)
! 1015: sc->sc_maxcount = 254;
! 1016: sc->sc_if.if_mtu = sizeof(struct pfsync_header) +
! 1017: sc->sc_maxcount * sizeof(struct pfsync_state);
! 1018: }
! 1019:
! 1020: struct mbuf *
! 1021: pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp)
! 1022: {
! 1023: struct pfsync_header *h;
! 1024: struct mbuf *m;
! 1025: int len;
! 1026:
! 1027: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1028: if (m == NULL) {
! 1029: sc->sc_if.if_oerrors++;
! 1030: return (NULL);
! 1031: }
! 1032:
! 1033: switch (action) {
! 1034: case PFSYNC_ACT_CLR:
! 1035: len = sizeof(struct pfsync_header) +
! 1036: sizeof(struct pfsync_state_clr);
! 1037: break;
! 1038: case PFSYNC_ACT_UPD_C:
! 1039: len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) +
! 1040: sizeof(struct pfsync_header);
! 1041: break;
! 1042: case PFSYNC_ACT_DEL_C:
! 1043: len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) +
! 1044: sizeof(struct pfsync_header);
! 1045: break;
! 1046: case PFSYNC_ACT_UREQ:
! 1047: len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) +
! 1048: sizeof(struct pfsync_header);
! 1049: break;
! 1050: case PFSYNC_ACT_BUS:
! 1051: len = sizeof(struct pfsync_header) +
! 1052: sizeof(struct pfsync_state_bus);
! 1053: break;
! 1054: case PFSYNC_ACT_TDB_UPD:
! 1055: len = (sc->sc_maxcount * sizeof(struct pfsync_tdb)) +
! 1056: sizeof(struct pfsync_header);
! 1057: break;
! 1058: default:
! 1059: len = (sc->sc_maxcount * sizeof(struct pfsync_state)) +
! 1060: sizeof(struct pfsync_header);
! 1061: break;
! 1062: }
! 1063:
! 1064: if (len > MHLEN) {
! 1065: MCLGET(m, M_DONTWAIT);
! 1066: if ((m->m_flags & M_EXT) == 0) {
! 1067: m_free(m);
! 1068: sc->sc_if.if_oerrors++;
! 1069: return (NULL);
! 1070: }
! 1071: m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1);
! 1072: } else
! 1073: MH_ALIGN(m, len);
! 1074:
! 1075: m->m_pkthdr.rcvif = NULL;
! 1076: m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header);
! 1077: h = mtod(m, struct pfsync_header *);
! 1078: h->version = PFSYNC_VERSION;
! 1079: h->af = 0;
! 1080: h->count = 0;
! 1081: h->action = action;
! 1082: if (action != PFSYNC_ACT_TDB_UPD)
! 1083: bcopy(&pf_status.pf_chksum, &h->pf_chksum,
! 1084: PF_MD5_DIGEST_LENGTH);
! 1085:
! 1086: *sp = (void *)((char *)h + PFSYNC_HDRLEN);
! 1087: if (action == PFSYNC_ACT_TDB_UPD)
! 1088: timeout_add(&sc->sc_tdb_tmo, hz);
! 1089: else
! 1090: timeout_add(&sc->sc_tmo, hz);
! 1091: return (m);
! 1092: }
! 1093:
! 1094: int
! 1095: pfsync_pack_state(u_int8_t action, struct pf_state *st, int flags)
! 1096: {
! 1097: struct ifnet *ifp = NULL;
! 1098: struct pfsync_softc *sc = pfsyncif;
! 1099: struct pfsync_header *h, *h_net;
! 1100: struct pfsync_state *sp = NULL;
! 1101: struct pfsync_state_upd *up = NULL;
! 1102: struct pfsync_state_del *dp = NULL;
! 1103: struct pf_state_key *sk = st->state_key;
! 1104: struct pf_rule *r;
! 1105: u_long secs;
! 1106: int s, ret = 0;
! 1107: u_int8_t i = 255, newaction = 0;
! 1108:
! 1109: if (sc == NULL)
! 1110: return (0);
! 1111: ifp = &sc->sc_if;
! 1112:
! 1113: /*
! 1114: * If a packet falls in the forest and there's nobody around to
! 1115: * hear, does it make a sound?
! 1116: */
! 1117: if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL &&
! 1118: sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
! 1119: /* Don't leave any stale pfsync packets hanging around. */
! 1120: if (sc->sc_mbuf != NULL) {
! 1121: m_freem(sc->sc_mbuf);
! 1122: sc->sc_mbuf = NULL;
! 1123: sc->sc_statep.s = NULL;
! 1124: }
! 1125: return (0);
! 1126: }
! 1127:
! 1128: if (action >= PFSYNC_ACT_MAX)
! 1129: return (EINVAL);
! 1130:
! 1131: s = splnet();
! 1132: if (sc->sc_mbuf == NULL) {
! 1133: if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
! 1134: (void *)&sc->sc_statep.s)) == NULL) {
! 1135: splx(s);
! 1136: return (ENOMEM);
! 1137: }
! 1138: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1139: } else {
! 1140: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1141: if (h->action != action) {
! 1142: pfsync_sendout(sc);
! 1143: if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
! 1144: (void *)&sc->sc_statep.s)) == NULL) {
! 1145: splx(s);
! 1146: return (ENOMEM);
! 1147: }
! 1148: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1149: } else {
! 1150: /*
! 1151: * If it's an update, look in the packet to see if
! 1152: * we already have an update for the state.
! 1153: */
! 1154: if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) {
! 1155: struct pfsync_state *usp =
! 1156: (void *)((char *)h + PFSYNC_HDRLEN);
! 1157:
! 1158: for (i = 0; i < h->count; i++) {
! 1159: if (!memcmp(usp->id, &st->id,
! 1160: PFSYNC_ID_LEN) &&
! 1161: usp->creatorid == st->creatorid) {
! 1162: sp = usp;
! 1163: sp->updates++;
! 1164: break;
! 1165: }
! 1166: usp++;
! 1167: }
! 1168: }
! 1169: }
! 1170: }
! 1171:
! 1172: secs = time_second;
! 1173:
! 1174: st->pfsync_time = time_uptime;
! 1175:
! 1176: if (sp == NULL) {
! 1177: /* not a "duplicate" update */
! 1178: i = 255;
! 1179: sp = sc->sc_statep.s++;
! 1180: sc->sc_mbuf->m_pkthdr.len =
! 1181: sc->sc_mbuf->m_len += sizeof(struct pfsync_state);
! 1182: h->count++;
! 1183: bzero(sp, sizeof(*sp));
! 1184:
! 1185: bcopy(&st->id, sp->id, sizeof(sp->id));
! 1186: sp->creatorid = st->creatorid;
! 1187:
! 1188: strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
! 1189: pf_state_host_hton(&sk->lan, &sp->lan);
! 1190: pf_state_host_hton(&sk->gwy, &sp->gwy);
! 1191: pf_state_host_hton(&sk->ext, &sp->ext);
! 1192:
! 1193: bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
! 1194:
! 1195: sp->creation = htonl(secs - st->creation);
! 1196: pf_state_counter_hton(st->packets[0], sp->packets[0]);
! 1197: pf_state_counter_hton(st->packets[1], sp->packets[1]);
! 1198: pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
! 1199: pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
! 1200: if ((r = st->rule.ptr) == NULL)
! 1201: sp->rule = htonl(-1);
! 1202: else
! 1203: sp->rule = htonl(r->nr);
! 1204: if ((r = st->anchor.ptr) == NULL)
! 1205: sp->anchor = htonl(-1);
! 1206: else
! 1207: sp->anchor = htonl(r->nr);
! 1208: sp->af = sk->af;
! 1209: sp->proto = sk->proto;
! 1210: sp->direction = sk->direction;
! 1211: sp->log = st->log;
! 1212: sp->allow_opts = st->allow_opts;
! 1213: sp->timeout = st->timeout;
! 1214:
! 1215: if (flags & PFSYNC_FLAG_STALE)
! 1216: sp->sync_flags |= PFSTATE_STALE;
! 1217: }
! 1218:
! 1219: pf_state_peer_hton(&st->src, &sp->src);
! 1220: pf_state_peer_hton(&st->dst, &sp->dst);
! 1221:
! 1222: if (st->expire <= secs)
! 1223: sp->expire = htonl(0);
! 1224: else
! 1225: sp->expire = htonl(st->expire - secs);
! 1226:
! 1227: /* do we need to build "compressed" actions for network transfer? */
! 1228: if (sc->sc_sync_ifp && flags & PFSYNC_FLAG_COMPRESS) {
! 1229: switch (action) {
! 1230: case PFSYNC_ACT_UPD:
! 1231: newaction = PFSYNC_ACT_UPD_C;
! 1232: break;
! 1233: case PFSYNC_ACT_DEL:
! 1234: newaction = PFSYNC_ACT_DEL_C;
! 1235: break;
! 1236: default:
! 1237: /* by default we just send the uncompressed states */
! 1238: break;
! 1239: }
! 1240: }
! 1241:
! 1242: if (newaction) {
! 1243: if (sc->sc_mbuf_net == NULL) {
! 1244: if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction,
! 1245: (void *)&sc->sc_statep_net.s)) == NULL) {
! 1246: splx(s);
! 1247: return (ENOMEM);
! 1248: }
! 1249: }
! 1250: h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *);
! 1251:
! 1252: switch (newaction) {
! 1253: case PFSYNC_ACT_UPD_C:
! 1254: if (i != 255) {
! 1255: up = (void *)((char *)h_net +
! 1256: PFSYNC_HDRLEN + (i * sizeof(*up)));
! 1257: up->updates++;
! 1258: } else {
! 1259: h_net->count++;
! 1260: sc->sc_mbuf_net->m_pkthdr.len =
! 1261: sc->sc_mbuf_net->m_len += sizeof(*up);
! 1262: up = sc->sc_statep_net.u++;
! 1263:
! 1264: bzero(up, sizeof(*up));
! 1265: bcopy(&st->id, up->id, sizeof(up->id));
! 1266: up->creatorid = st->creatorid;
! 1267: }
! 1268: up->timeout = st->timeout;
! 1269: up->expire = sp->expire;
! 1270: up->src = sp->src;
! 1271: up->dst = sp->dst;
! 1272: break;
! 1273: case PFSYNC_ACT_DEL_C:
! 1274: sc->sc_mbuf_net->m_pkthdr.len =
! 1275: sc->sc_mbuf_net->m_len += sizeof(*dp);
! 1276: dp = sc->sc_statep_net.d++;
! 1277: h_net->count++;
! 1278:
! 1279: bzero(dp, sizeof(*dp));
! 1280: bcopy(&st->id, dp->id, sizeof(dp->id));
! 1281: dp->creatorid = st->creatorid;
! 1282: break;
! 1283: }
! 1284: }
! 1285:
! 1286: if (h->count == sc->sc_maxcount ||
! 1287: (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates)))
! 1288: ret = pfsync_sendout(sc);
! 1289:
! 1290: splx(s);
! 1291: return (ret);
! 1292: }
! 1293:
! 1294: /* This must be called in splnet() */
! 1295: int
! 1296: pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src)
! 1297: {
! 1298: struct ifnet *ifp = NULL;
! 1299: struct pfsync_header *h;
! 1300: struct pfsync_softc *sc = pfsyncif;
! 1301: struct pfsync_state_upd_req *rup;
! 1302: int ret = 0;
! 1303:
! 1304: if (sc == NULL)
! 1305: return (0);
! 1306:
! 1307: ifp = &sc->sc_if;
! 1308: if (sc->sc_mbuf == NULL) {
! 1309: if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
! 1310: (void *)&sc->sc_statep.s)) == NULL)
! 1311: return (ENOMEM);
! 1312: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1313: } else {
! 1314: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1315: if (h->action != PFSYNC_ACT_UREQ) {
! 1316: pfsync_sendout(sc);
! 1317: if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
! 1318: (void *)&sc->sc_statep.s)) == NULL)
! 1319: return (ENOMEM);
! 1320: h = mtod(sc->sc_mbuf, struct pfsync_header *);
! 1321: }
! 1322: }
! 1323:
! 1324: if (src != NULL)
! 1325: sc->sc_sendaddr = *src;
! 1326: sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup);
! 1327: h->count++;
! 1328: rup = sc->sc_statep.r++;
! 1329: bzero(rup, sizeof(*rup));
! 1330: if (up != NULL) {
! 1331: bcopy(up->id, rup->id, sizeof(rup->id));
! 1332: rup->creatorid = up->creatorid;
! 1333: }
! 1334:
! 1335: if (h->count == sc->sc_maxcount)
! 1336: ret = pfsync_sendout(sc);
! 1337:
! 1338: return (ret);
! 1339: }
! 1340:
! 1341: int
! 1342: pfsync_clear_states(u_int32_t creatorid, char *ifname)
! 1343: {
! 1344: struct ifnet *ifp = NULL;
! 1345: struct pfsync_softc *sc = pfsyncif;
! 1346: struct pfsync_state_clr *cp;
! 1347: int s, ret;
! 1348:
! 1349: if (sc == NULL)
! 1350: return (0);
! 1351:
! 1352: ifp = &sc->sc_if;
! 1353: s = splnet();
! 1354: if (sc->sc_mbuf != NULL)
! 1355: pfsync_sendout(sc);
! 1356: if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR,
! 1357: (void *)&sc->sc_statep.c)) == NULL) {
! 1358: splx(s);
! 1359: return (ENOMEM);
! 1360: }
! 1361: sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp);
! 1362: cp = sc->sc_statep.c;
! 1363: cp->creatorid = creatorid;
! 1364: if (ifname != NULL)
! 1365: strlcpy(cp->ifname, ifname, IFNAMSIZ);
! 1366:
! 1367: ret = (pfsync_sendout(sc));
! 1368: splx(s);
! 1369: return (ret);
! 1370: }
! 1371:
! 1372: void
! 1373: pfsync_timeout(void *v)
! 1374: {
! 1375: struct pfsync_softc *sc = v;
! 1376: int s;
! 1377:
! 1378: s = splnet();
! 1379: pfsync_sendout(sc);
! 1380: splx(s);
! 1381: }
! 1382:
! 1383: void
! 1384: pfsync_tdb_timeout(void *v)
! 1385: {
! 1386: struct pfsync_softc *sc = v;
! 1387: int s;
! 1388:
! 1389: s = splnet();
! 1390: pfsync_tdb_sendout(sc);
! 1391: splx(s);
! 1392: }
! 1393:
! 1394: /* This must be called in splnet() */
! 1395: void
! 1396: pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status)
! 1397: {
! 1398: struct pfsync_state_bus *bus;
! 1399:
! 1400: if (sc->sc_mbuf != NULL)
! 1401: pfsync_sendout(sc);
! 1402:
! 1403: if (pfsync_sync_ok &&
! 1404: (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS,
! 1405: (void *)&sc->sc_statep.b)) != NULL) {
! 1406: sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus);
! 1407: bus = sc->sc_statep.b;
! 1408: bus->creatorid = pf_status.hostid;
! 1409: bus->status = status;
! 1410: bus->endtime = htonl(time_uptime - sc->sc_ureq_received);
! 1411: pfsync_sendout(sc);
! 1412: }
! 1413: }
! 1414:
! 1415: void
! 1416: pfsync_bulk_update(void *v)
! 1417: {
! 1418: struct pfsync_softc *sc = v;
! 1419: int s, i = 0;
! 1420: struct pf_state *state;
! 1421:
! 1422: s = splnet();
! 1423: if (sc->sc_mbuf != NULL)
! 1424: pfsync_sendout(sc);
! 1425:
! 1426: /*
! 1427: * Grab at most PFSYNC_BULKPACKETS worth of states which have not
! 1428: * been sent since the latest request was made.
! 1429: */
! 1430: state = sc->sc_bulk_send_next;
! 1431: if (state)
! 1432: do {
! 1433: /* send state update if syncable and not already sent */
! 1434: if (!state->sync_flags
! 1435: && state->timeout < PFTM_MAX
! 1436: && state->pfsync_time <= sc->sc_ureq_received) {
! 1437: pfsync_pack_state(PFSYNC_ACT_UPD, state, 0);
! 1438: i++;
! 1439: }
! 1440:
! 1441: /* figure next state to send */
! 1442: state = TAILQ_NEXT(state, entry_list);
! 1443:
! 1444: /* wrap to start of list if we hit the end */
! 1445: if (!state)
! 1446: state = TAILQ_FIRST(&state_list);
! 1447: } while (i < sc->sc_maxcount * PFSYNC_BULKPACKETS &&
! 1448: state != sc->sc_bulk_terminator);
! 1449:
! 1450: if (!state || state == sc->sc_bulk_terminator) {
! 1451: /* we're done */
! 1452: pfsync_send_bus(sc, PFSYNC_BUS_END);
! 1453: sc->sc_ureq_received = 0;
! 1454: sc->sc_bulk_send_next = NULL;
! 1455: sc->sc_bulk_terminator = NULL;
! 1456: timeout_del(&sc->sc_bulk_tmo);
! 1457: if (pf_status.debug >= PF_DEBUG_MISC)
! 1458: printf("pfsync: bulk update complete\n");
! 1459: } else {
! 1460: /* look again for more in a bit */
! 1461: timeout_add(&sc->sc_bulk_tmo, 1);
! 1462: sc->sc_bulk_send_next = state;
! 1463: }
! 1464: if (sc->sc_mbuf != NULL)
! 1465: pfsync_sendout(sc);
! 1466: splx(s);
! 1467: }
! 1468:
! 1469: void
! 1470: pfsync_bulkfail(void *v)
! 1471: {
! 1472: struct pfsync_softc *sc = v;
! 1473: int s, error;
! 1474:
! 1475: if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
! 1476: /* Try again in a bit */
! 1477: timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
! 1478: s = splnet();
! 1479: error = pfsync_request_update(NULL, NULL);
! 1480: if (error == ENOMEM) {
! 1481: if (pf_status.debug >= PF_DEBUG_MISC)
! 1482: printf("pfsync: cannot allocate mbufs for "
! 1483: "bulk update\n");
! 1484: } else
! 1485: pfsync_sendout(sc);
! 1486: splx(s);
! 1487: } else {
! 1488: /* Pretend like the transfer was ok */
! 1489: sc->sc_ureq_sent = 0;
! 1490: sc->sc_bulk_tries = 0;
! 1491: #if NCARP > 0
! 1492: if (!pfsync_sync_ok)
! 1493: carp_group_demote_adj(&sc->sc_if, -1);
! 1494: #endif
! 1495: pfsync_sync_ok = 1;
! 1496: if (pf_status.debug >= PF_DEBUG_MISC)
! 1497: printf("pfsync: failed to receive "
! 1498: "bulk update status\n");
! 1499: timeout_del(&sc->sc_bulkfail_tmo);
! 1500: }
! 1501: }
! 1502:
! 1503: /* This must be called in splnet() */
! 1504: int
! 1505: pfsync_sendout(struct pfsync_softc *sc)
! 1506: {
! 1507: #if NBPFILTER > 0
! 1508: struct ifnet *ifp = &sc->sc_if;
! 1509: #endif
! 1510: struct mbuf *m;
! 1511:
! 1512: timeout_del(&sc->sc_tmo);
! 1513:
! 1514: if (sc->sc_mbuf == NULL)
! 1515: return (0);
! 1516: m = sc->sc_mbuf;
! 1517: sc->sc_mbuf = NULL;
! 1518: sc->sc_statep.s = NULL;
! 1519:
! 1520: #if NBPFILTER > 0
! 1521: if (ifp->if_bpf)
! 1522: bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
! 1523: #endif
! 1524:
! 1525: if (sc->sc_mbuf_net) {
! 1526: m_freem(m);
! 1527: m = sc->sc_mbuf_net;
! 1528: sc->sc_mbuf_net = NULL;
! 1529: sc->sc_statep_net.s = NULL;
! 1530: }
! 1531:
! 1532: return pfsync_sendout_mbuf(sc, m);
! 1533: }
! 1534:
! 1535: int
! 1536: pfsync_tdb_sendout(struct pfsync_softc *sc)
! 1537: {
! 1538: #if NBPFILTER > 0
! 1539: struct ifnet *ifp = &sc->sc_if;
! 1540: #endif
! 1541: struct mbuf *m;
! 1542:
! 1543: timeout_del(&sc->sc_tdb_tmo);
! 1544:
! 1545: if (sc->sc_mbuf_tdb == NULL)
! 1546: return (0);
! 1547: m = sc->sc_mbuf_tdb;
! 1548: sc->sc_mbuf_tdb = NULL;
! 1549: sc->sc_statep_tdb.t = NULL;
! 1550:
! 1551: #if NBPFILTER > 0
! 1552: if (ifp->if_bpf)
! 1553: bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
! 1554: #endif
! 1555:
! 1556: return pfsync_sendout_mbuf(sc, m);
! 1557: }
! 1558:
! 1559: int
! 1560: pfsync_sendout_mbuf(struct pfsync_softc *sc, struct mbuf *m)
! 1561: {
! 1562: struct sockaddr sa;
! 1563: struct ip *ip;
! 1564:
! 1565: if (sc->sc_sync_ifp ||
! 1566: sc->sc_sync_peer.s_addr != INADDR_PFSYNC_GROUP) {
! 1567: M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
! 1568: if (m == NULL) {
! 1569: pfsyncstats.pfsyncs_onomem++;
! 1570: return (0);
! 1571: }
! 1572: ip = mtod(m, struct ip *);
! 1573: ip->ip_v = IPVERSION;
! 1574: ip->ip_hl = sizeof(*ip) >> 2;
! 1575: ip->ip_tos = IPTOS_LOWDELAY;
! 1576: ip->ip_len = htons(m->m_pkthdr.len);
! 1577: ip->ip_id = htons(ip_randomid());
! 1578: ip->ip_off = htons(IP_DF);
! 1579: ip->ip_ttl = PFSYNC_DFLTTL;
! 1580: ip->ip_p = IPPROTO_PFSYNC;
! 1581: ip->ip_sum = 0;
! 1582:
! 1583: bzero(&sa, sizeof(sa));
! 1584: ip->ip_src.s_addr = INADDR_ANY;
! 1585:
! 1586: if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP)
! 1587: m->m_flags |= M_MCAST;
! 1588: ip->ip_dst = sc->sc_sendaddr;
! 1589: sc->sc_sendaddr.s_addr = sc->sc_sync_peer.s_addr;
! 1590:
! 1591: pfsyncstats.pfsyncs_opackets++;
! 1592:
! 1593: if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))
! 1594: pfsyncstats.pfsyncs_oerrors++;
! 1595: } else
! 1596: m_freem(m);
! 1597:
! 1598: return (0);
! 1599: }
! 1600:
! 1601: #ifdef IPSEC
! 1602: /* Update an in-kernel tdb. Silently fail if no tdb is found. */
! 1603: void
! 1604: pfsync_update_net_tdb(struct pfsync_tdb *pt)
! 1605: {
! 1606: struct tdb *tdb;
! 1607: int s;
! 1608:
! 1609: /* check for invalid values */
! 1610: if (ntohl(pt->spi) <= SPI_RESERVED_MAX ||
! 1611: (pt->dst.sa.sa_family != AF_INET &&
! 1612: pt->dst.sa.sa_family != AF_INET6))
! 1613: goto bad;
! 1614:
! 1615: s = spltdb();
! 1616: tdb = gettdb(pt->spi, &pt->dst, pt->sproto);
! 1617: if (tdb) {
! 1618: pt->rpl = ntohl(pt->rpl);
! 1619: pt->cur_bytes = betoh64(pt->cur_bytes);
! 1620:
! 1621: /* Neither replay nor byte counter should ever decrease. */
! 1622: if (pt->rpl < tdb->tdb_rpl ||
! 1623: pt->cur_bytes < tdb->tdb_cur_bytes) {
! 1624: splx(s);
! 1625: goto bad;
! 1626: }
! 1627:
! 1628: tdb->tdb_rpl = pt->rpl;
! 1629: tdb->tdb_cur_bytes = pt->cur_bytes;
! 1630: }
! 1631: splx(s);
! 1632: return;
! 1633:
! 1634: bad:
! 1635: if (pf_status.debug >= PF_DEBUG_MISC)
! 1636: printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: "
! 1637: "invalid value\n");
! 1638: pfsyncstats.pfsyncs_badstate++;
! 1639: return;
! 1640: }
! 1641:
! 1642: /* One of our local tdbs have been updated, need to sync rpl with others */
! 1643: int
! 1644: pfsync_update_tdb(struct tdb *tdb, int output)
! 1645: {
! 1646: struct ifnet *ifp = NULL;
! 1647: struct pfsync_softc *sc = pfsyncif;
! 1648: struct pfsync_header *h;
! 1649: struct pfsync_tdb *pt = NULL;
! 1650: int s, i, ret;
! 1651:
! 1652: if (sc == NULL)
! 1653: return (0);
! 1654:
! 1655: ifp = &sc->sc_if;
! 1656: if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL &&
! 1657: sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
! 1658: /* Don't leave any stale pfsync packets hanging around. */
! 1659: if (sc->sc_mbuf_tdb != NULL) {
! 1660: m_freem(sc->sc_mbuf_tdb);
! 1661: sc->sc_mbuf_tdb = NULL;
! 1662: sc->sc_statep_tdb.t = NULL;
! 1663: }
! 1664: return (0);
! 1665: }
! 1666:
! 1667: s = splnet();
! 1668: if (sc->sc_mbuf_tdb == NULL) {
! 1669: if ((sc->sc_mbuf_tdb = pfsync_get_mbuf(sc, PFSYNC_ACT_TDB_UPD,
! 1670: (void *)&sc->sc_statep_tdb.t)) == NULL) {
! 1671: splx(s);
! 1672: return (ENOMEM);
! 1673: }
! 1674: h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
! 1675: } else {
! 1676: h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
! 1677: if (h->action != PFSYNC_ACT_TDB_UPD) {
! 1678: /*
! 1679: * XXX will never happen as long as there's
! 1680: * only one "TDB action".
! 1681: */
! 1682: pfsync_tdb_sendout(sc);
! 1683: sc->sc_mbuf_tdb = pfsync_get_mbuf(sc,
! 1684: PFSYNC_ACT_TDB_UPD, (void *)&sc->sc_statep_tdb.t);
! 1685: if (sc->sc_mbuf_tdb == NULL) {
! 1686: splx(s);
! 1687: return (ENOMEM);
! 1688: }
! 1689: h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
! 1690: } else if (sc->sc_maxupdates) {
! 1691: /*
! 1692: * If it's an update, look in the packet to see if
! 1693: * we already have an update for the state.
! 1694: */
! 1695: struct pfsync_tdb *u =
! 1696: (void *)((char *)h + PFSYNC_HDRLEN);
! 1697:
! 1698: for (i = 0; !pt && i < h->count; i++) {
! 1699: if (tdb->tdb_spi == u->spi &&
! 1700: tdb->tdb_sproto == u->sproto &&
! 1701: !bcmp(&tdb->tdb_dst, &u->dst,
! 1702: SA_LEN(&u->dst.sa))) {
! 1703: pt = u;
! 1704: pt->updates++;
! 1705: }
! 1706: u++;
! 1707: }
! 1708: }
! 1709: }
! 1710:
! 1711: if (pt == NULL) {
! 1712: /* not a "duplicate" update */
! 1713: pt = sc->sc_statep_tdb.t++;
! 1714: sc->sc_mbuf_tdb->m_pkthdr.len =
! 1715: sc->sc_mbuf_tdb->m_len += sizeof(struct pfsync_tdb);
! 1716: h->count++;
! 1717: bzero(pt, sizeof(*pt));
! 1718:
! 1719: pt->spi = tdb->tdb_spi;
! 1720: memcpy(&pt->dst, &tdb->tdb_dst, sizeof pt->dst);
! 1721: pt->sproto = tdb->tdb_sproto;
! 1722: }
! 1723:
! 1724: /*
! 1725: * When a failover happens, the master's rpl is probably above
! 1726: * what we see here (we may be up to a second late), so
! 1727: * increase it a bit for outbound tdbs to manage most such
! 1728: * situations.
! 1729: *
! 1730: * For now, just add an offset that is likely to be larger
! 1731: * than the number of packets we can see in one second. The RFC
! 1732: * just says the next packet must have a higher seq value.
! 1733: *
! 1734: * XXX What is a good algorithm for this? We could use
! 1735: * a rate-determined increase, but to know it, we would have
! 1736: * to extend struct tdb.
! 1737: * XXX pt->rpl can wrap over MAXINT, but if so the real tdb
! 1738: * will soon be replaced anyway. For now, just don't handle
! 1739: * this edge case.
! 1740: */
! 1741: #define RPL_INCR 16384
! 1742: pt->rpl = htonl(tdb->tdb_rpl + (output ? RPL_INCR : 0));
! 1743: pt->cur_bytes = htobe64(tdb->tdb_cur_bytes);
! 1744:
! 1745: if (h->count == sc->sc_maxcount ||
! 1746: (sc->sc_maxupdates && (pt->updates >= sc->sc_maxupdates)))
! 1747: ret = pfsync_tdb_sendout(sc);
! 1748:
! 1749: splx(s);
! 1750: return (ret);
! 1751: }
! 1752: #endif