1 /*	$OpenBSD: if_pfsync.c,v 1.32 2004/04/30 22:08:18 mcbride Exp $	*/
2 
3 /*
4  * Copyright (c) 2002 Michael Shalayeff
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26  * THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include "bpfilter.h"
30 #include "pfsync.h"
31 
32 #include <sys/param.h>
33 #include <sys/proc.h>
34 #include <sys/systm.h>
35 #include <sys/time.h>
36 #include <sys/mbuf.h>
37 #include <sys/socket.h>
38 #include <sys/ioctl.h>
39 #include <sys/timeout.h>
40 
41 #include <net/if.h>
42 #include <net/if_types.h>
43 #include <net/route.h>
44 #include <net/bpf.h>
45 #include <netinet/tcp.h>
46 #include <netinet/tcp_seq.h>
47 
48 #ifdef	INET
49 #include <netinet/in.h>
50 #include <netinet/in_systm.h>
51 #include <netinet/in_var.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #endif
55 
56 #ifdef INET6
57 #ifndef INET
58 #include <netinet/in.h>
59 #endif
60 #include <netinet6/nd6.h>
61 #endif /* INET6 */
62 
63 #include "carp.h"
64 #if NCARP > 0
65 extern int carp_suppress_preempt;
66 #endif
67 
68 #include <net/pfvar.h>
69 #include <net/if_pfsync.h>
70 
71 #define PFSYNC_MINMTU	\
72     (sizeof(struct pfsync_header) + sizeof(struct pf_state))
73 
74 #ifdef PFSYNCDEBUG
75 #define DPRINTF(x)    do { if (pfsyncdebug) printf x ; } while (0)
76 int pfsyncdebug;
77 #else
78 #define DPRINTF(x)
79 #endif
80 
81 struct pfsync_softc	pfsyncif;
82 struct pfsyncstats	pfsyncstats;
83 
84 void	pfsyncattach(int);
85 void	pfsync_setmtu(struct pfsync_softc *, int);
86 int	pfsync_insert_net_state(struct pfsync_state *);
87 int	pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
88 	    struct rtentry *);
89 int	pfsyncioctl(struct ifnet *, u_long, caddr_t);
90 void	pfsyncstart(struct ifnet *);
91 
92 struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **);
93 int	pfsync_request_update(struct pfsync_state_upd *, struct in_addr *);
94 int	pfsync_sendout(struct pfsync_softc *);
95 void	pfsync_timeout(void *);
96 void	pfsync_send_bus(struct pfsync_softc *, u_int8_t);
97 void	pfsync_bulk_update(void *);
98 void	pfsync_bulkfail(void *);
99 
100 int	pfsync_sync_ok;
101 extern int ifqmaxlen;
102 extern struct timeval time;
103 extern struct timeval mono_time;
104 extern int hz;
105 
106 void
pfsyncattach(int npfsync)107 pfsyncattach(int npfsync)
108 {
109 	struct ifnet *ifp;
110 
111 	pfsync_sync_ok = 1;
112 	bzero(&pfsyncif, sizeof(pfsyncif));
113 	pfsyncif.sc_mbuf = NULL;
114 	pfsyncif.sc_mbuf_net = NULL;
115 	pfsyncif.sc_statep.s = NULL;
116 	pfsyncif.sc_statep_net.s = NULL;
117 	pfsyncif.sc_maxupdates = 128;
118 	pfsyncif.sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
119 	pfsyncif.sc_ureq_received = 0;
120 	pfsyncif.sc_ureq_sent = 0;
121 	ifp = &pfsyncif.sc_if;
122 	strlcpy(ifp->if_xname, "pfsync0", sizeof ifp->if_xname);
123 	ifp->if_softc = &pfsyncif;
124 	ifp->if_ioctl = pfsyncioctl;
125 	ifp->if_output = pfsyncoutput;
126 	ifp->if_start = pfsyncstart;
127 	ifp->if_type = IFT_PFSYNC;
128 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
129 	ifp->if_hdrlen = PFSYNC_HDRLEN;
130 	pfsync_setmtu(&pfsyncif, MCLBYTES);
131 	timeout_set(&pfsyncif.sc_tmo, pfsync_timeout, &pfsyncif);
132 	timeout_set(&pfsyncif.sc_bulk_tmo, pfsync_bulk_update, &pfsyncif);
133 	timeout_set(&pfsyncif.sc_bulkfail_tmo, pfsync_bulkfail, &pfsyncif);
134 	if_attach(ifp);
135 	if_alloc_sadl(ifp);
136 
137 #if NBPFILTER > 0
138 	bpfattach(&pfsyncif.sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
139 #endif
140 }
141 
142 /*
143  * Start output on the pfsync interface.
144  */
145 void
pfsyncstart(struct ifnet * ifp)146 pfsyncstart(struct ifnet *ifp)
147 {
148 	struct mbuf *m;
149 	int s;
150 
151 	for (;;) {
152 		s = splimp();
153 		IF_DROP(&ifp->if_snd);
154 		IF_DEQUEUE(&ifp->if_snd, m);
155 		splx(s);
156 
157 		if (m == NULL)
158 			return;
159 		else
160 			m_freem(m);
161 	}
162 }
163 
164 int
pfsync_insert_net_state(struct pfsync_state * sp)165 pfsync_insert_net_state(struct pfsync_state *sp)
166 {
167 	struct pf_state	*st = NULL;
168 	struct pf_rule *r = NULL;
169 	struct pfi_kif	*kif;
170 
171 	if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
172 		printf("pfsync_insert_net_state: invalid creator id:"
173 		    " %08x\n", ntohl(sp->creatorid));
174 		return (EINVAL);
175 	}
176 
177 	kif = pfi_lookup_create(sp->ifname);
178 	if (kif == NULL) {
179 		if (pf_status.debug >= PF_DEBUG_MISC)
180 			printf("pfsync_insert_net_state: "
181 			    "unknown interface: %s\n", sp->ifname);
182 		/* skip this state */
183 		return (0);
184 	}
185 
186 	/*
187 	 * Just use the default rule until we have infrastructure to find the
188 	 * best matching rule.
189 	 */
190 	r = &pf_default_rule;
191 
192 	if (!r->max_states || r->states < r->max_states)
193 		st = pool_get(&pf_state_pl, PR_NOWAIT);
194 	if (st == NULL) {
195 		pfi_maybe_destroy(kif);
196 		return (ENOMEM);
197 	}
198 	bzero(st, sizeof(*st));
199 
200 	st->rule.ptr = r;
201 	/* XXX get pointers to nat_rule and anchor */
202 
203 	/* fill in the rest of the state entry */
204 	pf_state_host_ntoh(&sp->lan, &st->lan);
205 	pf_state_host_ntoh(&sp->gwy, &st->gwy);
206 	pf_state_host_ntoh(&sp->ext, &st->ext);
207 
208 	pf_state_peer_ntoh(&sp->src, &st->src);
209 	pf_state_peer_ntoh(&sp->dst, &st->dst);
210 
211 	bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
212 	st->creation = ntohl(sp->creation) + time.tv_sec;
213 	st->expire = ntohl(sp->expire) + time.tv_sec;
214 
215 	st->af = sp->af;
216 	st->proto = sp->proto;
217 	st->direction = sp->direction;
218 	st->log = sp->log;
219 	st->timeout = sp->timeout;
220 	st->allow_opts = sp->allow_opts;
221 
222 	bcopy(sp->id, &st->id, sizeof(st->id));
223 	st->creatorid = sp->creatorid;
224 	st->sync_flags = sp->sync_flags | PFSTATE_FROMSYNC;
225 
226 
227 	if (pf_insert_state(kif, st)) {
228 		pfi_maybe_destroy(kif);
229 		pool_put(&pf_state_pl, st);
230 		return (EINVAL);
231 	}
232 
233 	return (0);
234 }
235 
236 void
pfsync_input(struct mbuf * m,...)237 pfsync_input(struct mbuf *m, ...)
238 {
239 	struct ip *ip = mtod(m, struct ip *);
240 	struct pfsync_header *ph;
241 	struct pfsync_softc *sc = &pfsyncif;
242 	struct pf_state *st, key;
243 	struct pfsync_state *sp;
244 	struct pfsync_state_upd *up;
245 	struct pfsync_state_del *dp;
246 	struct pfsync_state_clr *cp;
247 	struct pfsync_state_upd_req *rup;
248 	struct pfsync_state_bus *bus;
249 	struct in_addr src;
250 	struct mbuf *mp;
251 	int iplen, action, error, i, s, count, offp, sfail, stale = 0;
252 
253 	pfsyncstats.pfsyncs_ipackets++;
254 
255 	/* verify that we have a sync interface configured */
256 	if (!sc->sc_sync_ifp || !pf_status.running)
257 		goto done;
258 
259 	/* verify that the packet came in on the right interface */
260 	if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) {
261 		pfsyncstats.pfsyncs_badif++;
262 		goto done;
263 	}
264 
265 	/* verify that the IP TTL is 255.  */
266 	if (ip->ip_ttl != PFSYNC_DFLTTL) {
267 		pfsyncstats.pfsyncs_badttl++;
268 		goto done;
269 	}
270 
271 	iplen = ip->ip_hl << 2;
272 
273 	if (m->m_pkthdr.len < iplen + sizeof(*ph)) {
274 		pfsyncstats.pfsyncs_hdrops++;
275 		goto done;
276 	}
277 
278 	if (iplen + sizeof(*ph) > m->m_len) {
279 		if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) {
280 			pfsyncstats.pfsyncs_hdrops++;
281 			goto done;
282 		}
283 		ip = mtod(m, struct ip *);
284 	}
285 	ph = (struct pfsync_header *)((char *)ip + iplen);
286 
287 	/* verify the version */
288 	if (ph->version != PFSYNC_VERSION) {
289 		pfsyncstats.pfsyncs_badver++;
290 		goto done;
291 	}
292 
293 	action = ph->action;
294 	count = ph->count;
295 
296 	/* make sure it's a valid action code */
297 	if (action >= PFSYNC_ACT_MAX) {
298 		pfsyncstats.pfsyncs_badact++;
299 		goto done;
300 	}
301 
302 	/* Cheaper to grab this now than having to mess with mbufs later */
303 	src = ip->ip_src;
304 
305 	switch (action) {
306 	case PFSYNC_ACT_CLR: {
307 		struct pfi_kif	*kif;
308 		u_int32_t creatorid;
309 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
310 		    sizeof(*cp), &offp)) == NULL) {
311 			pfsyncstats.pfsyncs_badlen++;
312 			return;
313 		}
314 		cp = (struct pfsync_state_clr *)(mp->m_data + offp);
315 		creatorid = cp->creatorid;
316 
317 		s = splsoftnet();
318 		if (cp->ifname[0] == '\0') {
319 			RB_FOREACH(st, pf_state_tree_id, &tree_id) {
320 				if (st->creatorid == creatorid)
321 					st->timeout = PFTM_PURGE;
322 			}
323 		} else {
324 			kif = pfi_lookup_if(cp->ifname);
325 			if (kif == NULL) {
326 				if (pf_status.debug >= PF_DEBUG_MISC)
327 					printf("pfsync_input: PFSYNC_ACT_CLR "
328 					    "bad interface: %s\n", cp->ifname);
329 				splx(s);
330 				goto done;
331 			}
332 			RB_FOREACH(st, pf_state_tree_lan_ext,
333 			    &kif->pfik_lan_ext) {
334 				if (st->creatorid == creatorid) {
335 					st->timeout = PFTM_PURGE;
336 					pf_purge_expired_state(st);
337 				}
338 			}
339 		}
340 		splx(s);
341 
342 		break;
343 	}
344 	case PFSYNC_ACT_INS:
345 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
346 		    count * sizeof(*sp), &offp)) == NULL) {
347 			pfsyncstats.pfsyncs_badlen++;
348 			return;
349 		}
350 
351 		s = splsoftnet();
352 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
353 		    i < count; i++, sp++) {
354 			/* check for invalid values */
355 			if (sp->timeout >= PFTM_MAX ||
356 			    sp->src.state > PF_TCPS_PROXY_DST ||
357 			    sp->dst.state > PF_TCPS_PROXY_DST ||
358 			    sp->direction > PF_OUT ||
359 			    (sp->af != AF_INET && sp->af != AF_INET6)) {
360 				if (pf_status.debug >= PF_DEBUG_MISC)
361 					printf("pfsync_insert: PFSYNC_ACT_INS: "
362 					    "invalid value\n");
363 				pfsyncstats.pfsyncs_badstate++;
364 				continue;
365 			}
366 
367 			if ((error = pfsync_insert_net_state(sp))) {
368 				if (error == ENOMEM) {
369 					splx(s);
370 					goto done;
371 				}
372 				continue;
373 			}
374 		}
375 		splx(s);
376 		break;
377 	case PFSYNC_ACT_UPD:
378 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
379 		    count * sizeof(*sp), &offp)) == NULL) {
380 			pfsyncstats.pfsyncs_badlen++;
381 			return;
382 		}
383 
384 		s = splsoftnet();
385 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
386 		    i < count; i++, sp++) {
387 			/* check for invalid values */
388 			if (sp->timeout >= PFTM_MAX ||
389 			    sp->src.state > PF_TCPS_PROXY_DST ||
390 			    sp->dst.state > PF_TCPS_PROXY_DST) {
391 				if (pf_status.debug >= PF_DEBUG_MISC)
392 					printf("pfsync_insert: PFSYNC_ACT_UPD: "
393 					    "invalid value\n");
394 				pfsyncstats.pfsyncs_badstate++;
395 				continue;
396 			}
397 
398 			bcopy(sp->id, &key.id, sizeof(key.id));
399 			key.creatorid = sp->creatorid;
400 
401 			st = pf_find_state_byid(&key);
402 			if (st == NULL) {
403 				/* insert the update */
404 				if (pfsync_insert_net_state(sp))
405 					pfsyncstats.pfsyncs_badstate++;
406 				continue;
407 			}
408 			sfail = 0;
409 			if (st->proto == IPPROTO_TCP) {
410 				/*
411 				 * The state should never go backwards except
412 				 * for syn-proxy states.  Neither should the
413 				 * sequence window slide backwards.
414 				 */
415 				if (st->src.state > sp->src.state &&
416 				    (st->src.state < PF_TCPS_PROXY_SRC ||
417 				    sp->src.state >= PF_TCPS_PROXY_SRC))
418 					sfail = 1;
419 				else if (st->dst.state > sp->dst.state)
420 					sfail = 2;
421 				else if (SEQ_GT(st->src.seqlo,
422 				    ntohl(sp->src.seqlo)))
423 					sfail = 3;
424 				else if (st->dst.state >= TCPS_SYN_SENT &&
425 				    SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo)))
426 					sfail = 4;
427 			} else {
428 				/*
429 				 * Non-TCP protocol state machine always go
430 				 * forwards
431 				 */
432 				if (st->src.state > sp->src.state)
433 					sfail = 5;
434 				else if ( st->dst.state > sp->dst.state)
435 					sfail = 6;
436 			}
437 			if (sfail) {
438 				if (pf_status.debug >= PF_DEBUG_MISC)
439 					printf("pfsync: ignoring stale update "
440 					    "(%d) id: %016llx "
441 					    "creatorid: %08x\n", sfail,
442 					    betoh64(st->id),
443 					    ntohl(st->creatorid));
444 				pfsyncstats.pfsyncs_badstate++;
445 
446 				/* we have a better state, send it out */
447 				if (sc->sc_mbuf != NULL && !stale)
448 					pfsync_sendout(sc);
449 				stale++;
450 				pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
451 				continue;
452 			}
453 			pf_state_peer_ntoh(&sp->src, &st->src);
454 			pf_state_peer_ntoh(&sp->dst, &st->dst);
455 			st->expire = ntohl(sp->expire) + time.tv_sec;
456 			st->timeout = sp->timeout;
457 		}
458 		if (stale && sc->sc_mbuf != NULL)
459 			pfsync_sendout(sc);
460 		splx(s);
461 		break;
462 	/*
463 	 * It's not strictly necessary for us to support the "uncompressed"
464 	 * delete action, but it's relatively simple and maintains consistency.
465 	 */
466 	case PFSYNC_ACT_DEL:
467 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
468 		    count * sizeof(*sp), &offp)) == NULL) {
469 			pfsyncstats.pfsyncs_badlen++;
470 			return;
471 		}
472 
473 		s = splsoftnet();
474 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
475 		    i < count; i++, sp++) {
476 			bcopy(sp->id, &key.id, sizeof(key.id));
477 			key.creatorid = sp->creatorid;
478 
479 			st = pf_find_state_byid(&key);
480 			if (st == NULL) {
481 				pfsyncstats.pfsyncs_badstate++;
482 				continue;
483 			}
484 			st->timeout = PFTM_PURGE;
485 			st->sync_flags |= PFSTATE_FROMSYNC;
486 			pf_purge_expired_state(st);
487 		}
488 		splx(s);
489 		break;
490 	case PFSYNC_ACT_UPD_C: {
491 		int update_requested = 0;
492 
493 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
494 		    count * sizeof(*up), &offp)) == NULL) {
495 			pfsyncstats.pfsyncs_badlen++;
496 			return;
497 		}
498 
499 		s = splsoftnet();
500 		for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp);
501 		    i < count; i++, up++) {
502 			/* check for invalid values */
503 			if (up->timeout >= PFTM_MAX ||
504 			    up->src.state > PF_TCPS_PROXY_DST ||
505 			    up->dst.state > PF_TCPS_PROXY_DST) {
506 				if (pf_status.debug >= PF_DEBUG_MISC)
507 					printf("pfsync_insert: "
508 					    "PFSYNC_ACT_UPD_C: "
509 					    "invalid value\n");
510 				pfsyncstats.pfsyncs_badstate++;
511 				continue;
512 			}
513 
514 			bcopy(up->id, &key.id, sizeof(key.id));
515 			key.creatorid = up->creatorid;
516 
517 			st = pf_find_state_byid(&key);
518 			if (st == NULL) {
519 				/* We don't have this state. Ask for it. */
520 				error = pfsync_request_update(up, &src);
521 				if (error == ENOMEM) {
522 					splx(s);
523 					goto done;
524 				}
525 				update_requested = 1;
526 				pfsyncstats.pfsyncs_badstate++;
527 				continue;
528 			}
529 			sfail = 0;
530 			if (st->proto == IPPROTO_TCP) {
531 				/*
532 				 * The state should never go backwards except
533 				 * for syn-proxy states.  Neither should the
534 				 * sequence window slide backwards.
535 				 */
536 				if (st->src.state > up->src.state &&
537 				    (st->src.state < PF_TCPS_PROXY_SRC ||
538 				    up->src.state >= PF_TCPS_PROXY_SRC))
539 					sfail = 1;
540 				else if (st->dst.state > up->dst.state)
541 					sfail = 2;
542 				else if (SEQ_GT(st->src.seqlo,
543 				    ntohl(up->src.seqlo)))
544 					sfail = 3;
545 				else if (st->dst.state >= TCPS_SYN_SENT &&
546 				    SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo)))
547 					sfail = 4;
548 			} else {
549 				/*
550 				 * Non-TCP protocol state machine always go
551 				 * forwards
552 				 */
553 				if (st->src.state > up->src.state)
554 					sfail = 5;
555 				else if (st->dst.state > up->dst.state)
556 					sfail = 6;
557 			}
558 			if (sfail) {
559 				if (pf_status.debug >= PF_DEBUG_MISC)
560 					printf("pfsync: ignoring stale update "
561 					    "(%d) id: %016llx "
562 					    "creatorid: %08x\n", sfail,
563 					    betoh64(st->id),
564 					    ntohl(st->creatorid));
565 				pfsyncstats.pfsyncs_badstate++;
566 
567 				/* we have a better state, send it out */
568 				if ((!stale || update_requested) &&
569 				    sc->sc_mbuf != NULL) {
570 					pfsync_sendout(sc);
571 					update_requested = 0;
572 				}
573 				stale++;
574 				pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
575 				continue;
576 			}
577 			pf_state_peer_ntoh(&up->src, &st->src);
578 			pf_state_peer_ntoh(&up->dst, &st->dst);
579 			st->expire = ntohl(up->expire) + time.tv_sec;
580 			st->timeout = up->timeout;
581 		}
582 		if ((update_requested || stale) && sc->sc_mbuf)
583 			pfsync_sendout(sc);
584 		splx(s);
585 		break;
586 	}
587 	case PFSYNC_ACT_DEL_C:
588 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
589 		    count * sizeof(*dp), &offp)) == NULL) {
590 			pfsyncstats.pfsyncs_badlen++;
591 			return;
592 		}
593 
594 		s = splsoftnet();
595 		for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp);
596 		    i < count; i++, dp++) {
597 			bcopy(dp->id, &key.id, sizeof(key.id));
598 			key.creatorid = dp->creatorid;
599 
600 			st = pf_find_state_byid(&key);
601 			if (st == NULL) {
602 				pfsyncstats.pfsyncs_badstate++;
603 				continue;
604 			}
605 			st->timeout = PFTM_PURGE;
606 			st->sync_flags |= PFSTATE_FROMSYNC;
607 			pf_purge_expired_state(st);
608 		}
609 		splx(s);
610 		break;
611 	case PFSYNC_ACT_INS_F:
612 	case PFSYNC_ACT_DEL_F:
613 		/* not implemented */
614 		break;
615 	case PFSYNC_ACT_UREQ:
616 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
617 		    count * sizeof(*rup), &offp)) == NULL) {
618 			pfsyncstats.pfsyncs_badlen++;
619 			return;
620 		}
621 
622 		s = splsoftnet();
623 		if (sc->sc_mbuf != NULL)
624 			pfsync_sendout(sc);
625 		for (i = 0,
626 		    rup = (struct pfsync_state_upd_req *)(mp->m_data + offp);
627 		    i < count; i++, rup++) {
628 			bcopy(rup->id, &key.id, sizeof(key.id));
629 			key.creatorid = rup->creatorid;
630 
631 			if (key.id == 0 && key.creatorid == 0) {
632 				sc->sc_ureq_received = mono_time.tv_sec;
633 				if (pf_status.debug >= PF_DEBUG_MISC)
634 					printf("pfsync: received "
635 					    "bulk update request\n");
636 				pfsync_send_bus(sc, PFSYNC_BUS_START);
637 				timeout_add(&sc->sc_bulk_tmo, 1 * hz);
638 			} else {
639 				st = pf_find_state_byid(&key);
640 				if (st == NULL) {
641 					pfsyncstats.pfsyncs_badstate++;
642 					continue;
643 				}
644 				pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
645 			}
646 		}
647 		if (sc->sc_mbuf != NULL)
648 			pfsync_sendout(sc);
649 		splx(s);
650 		break;
651 	case PFSYNC_ACT_BUS:
652 		/* If we're not waiting for a bulk update, who cares. */
653 		if (sc->sc_ureq_sent == 0)
654 			break;
655 
656 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
657 		    sizeof(*bus), &offp)) == NULL) {
658 			pfsyncstats.pfsyncs_badlen++;
659 			return;
660 		}
661 		bus = (struct pfsync_state_bus *)(mp->m_data + offp);
662 		switch (bus->status) {
663 		case PFSYNC_BUS_START:
664 			timeout_add(&sc->sc_bulkfail_tmo,
665 			    pf_pool_limits[PF_LIMIT_STATES].limit /
666 			    (PFSYNC_BULKPACKETS * sc->sc_maxcount));
667 			if (pf_status.debug >= PF_DEBUG_MISC)
668 				printf("pfsync: received bulk "
669 				    "update start\n");
670 			break;
671 		case PFSYNC_BUS_END:
672 			if (mono_time.tv_sec - ntohl(bus->endtime) >=
673 			    sc->sc_ureq_sent) {
674 				/* that's it, we're happy */
675 				sc->sc_ureq_sent = 0;
676 				sc->sc_bulk_tries = 0;
677 				timeout_del(&sc->sc_bulkfail_tmo);
678 #if NCARP > 0
679 				if (!pfsync_sync_ok)
680 					carp_suppress_preempt--;
681 #endif
682 				pfsync_sync_ok = 1;
683 				if (pf_status.debug >= PF_DEBUG_MISC)
684 					printf("pfsync: received valid "
685 					    "bulk update end\n");
686 			} else {
687 				if (pf_status.debug >= PF_DEBUG_MISC)
688 					printf("pfsync: received invalid "
689 					    "bulk update end: bad timestamp\n");
690 			}
691 			break;
692 		}
693 		break;
694 	}
695 
696 done:
697 	if (m)
698 		m_freem(m);
699 }
700 
701 int
pfsyncoutput(struct ifnet * ifp,struct mbuf * m,struct sockaddr * dst,struct rtentry * rt)702 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
703 	struct rtentry *rt)
704 {
705 	m_freem(m);
706 	return (0);
707 }
708 
709 /* ARGSUSED */
710 int
pfsyncioctl(struct ifnet * ifp,u_long cmd,caddr_t data)711 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
712 {
713 	struct proc *p = curproc;
714 	struct pfsync_softc *sc = ifp->if_softc;
715 	struct ifreq *ifr = (struct ifreq *)data;
716 	struct ip_moptions *imo = &sc->sc_imo;
717 	struct pfsyncreq pfsyncr;
718 	struct ifnet    *sifp;
719 	int s, error;
720 
721 	switch (cmd) {
722 	case SIOCSIFADDR:
723 	case SIOCAIFADDR:
724 	case SIOCSIFDSTADDR:
725 	case SIOCSIFFLAGS:
726 		if (ifp->if_flags & IFF_UP)
727 			ifp->if_flags |= IFF_RUNNING;
728 		else
729 			ifp->if_flags &= ~IFF_RUNNING;
730 		break;
731 	case SIOCSIFMTU:
732 		if (ifr->ifr_mtu < PFSYNC_MINMTU)
733 			return (EINVAL);
734 		if (ifr->ifr_mtu > MCLBYTES)
735 			ifr->ifr_mtu = MCLBYTES;
736 		s = splnet();
737 		if (ifr->ifr_mtu < ifp->if_mtu)
738 			pfsync_sendout(sc);
739 		pfsync_setmtu(sc, ifr->ifr_mtu);
740 		splx(s);
741 		break;
742 	case SIOCGETPFSYNC:
743 		bzero(&pfsyncr, sizeof(pfsyncr));
744 		if (sc->sc_sync_ifp)
745 			strlcpy(pfsyncr.pfsyncr_syncif,
746 			    sc->sc_sync_ifp->if_xname, IFNAMSIZ);
747 		pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
748 		if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr))))
749 			return (error);
750 		break;
751 	case SIOCSETPFSYNC:
752 		if ((error = suser(p, p->p_acflag)) != 0)
753 			return (error);
754 		if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
755 			return (error);
756 
757 		if (pfsyncr.pfsyncr_maxupdates > 255)
758 			return (EINVAL);
759 		sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
760 
761 		if (pfsyncr.pfsyncr_syncif[0] == 0) {
762 			sc->sc_sync_ifp = NULL;
763 			if (sc->sc_mbuf_net != NULL) {
764 				/* Don't keep stale pfsync packets around. */
765 				s = splnet();
766 				m_freem(sc->sc_mbuf_net);
767 				sc->sc_mbuf_net = NULL;
768 				sc->sc_statep_net.s = NULL;
769 				splx(s);
770 			}
771 			break;
772 		}
773 		if ((sifp = ifunit(pfsyncr.pfsyncr_syncif)) == NULL)
774 			return (EINVAL);
775 		else if (sifp == sc->sc_sync_ifp)
776 			break;
777 
778 		s = splnet();
779 		if (sifp->if_mtu < sc->sc_if.if_mtu ||
780 		    (sc->sc_sync_ifp != NULL &&
781 		    sifp->if_mtu < sc->sc_sync_ifp->if_mtu) ||
782 		    sifp->if_mtu < MCLBYTES - sizeof(struct ip))
783 			pfsync_sendout(sc);
784 		sc->sc_sync_ifp = sifp;
785 
786 		pfsync_setmtu(sc, sc->sc_if.if_mtu);
787 
788 		if (imo->imo_num_memberships > 0) {
789 			in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
790 			imo->imo_multicast_ifp = NULL;
791 		}
792 
793 		if (sc->sc_sync_ifp) {
794 			struct in_addr addr;
795 
796 			addr.s_addr = INADDR_PFSYNC_GROUP;
797 			if ((imo->imo_membership[0] =
798 			    in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) {
799 				splx(s);
800 				return (ENOBUFS);
801 			}
802 			imo->imo_num_memberships++;
803 			imo->imo_multicast_ifp = sc->sc_sync_ifp;
804 			imo->imo_multicast_ttl = PFSYNC_DFLTTL;
805 			imo->imo_multicast_loop = 0;
806 
807 			/* Request a full state table update. */
808 			sc->sc_ureq_sent = mono_time.tv_sec;
809 #if NCARP > 0
810 			if (pfsync_sync_ok)
811 				carp_suppress_preempt++;
812 #endif
813 			pfsync_sync_ok = 0;
814 			if (pf_status.debug >= PF_DEBUG_MISC)
815 				printf("pfsync: requesting bulk update\n");
816 			timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
817 			error = pfsync_request_update(NULL, NULL);
818 			if (error == ENOMEM) {
819 				splx(s);
820 				return(ENOMEM);
821 			}
822 			pfsync_sendout(sc);
823 		}
824 		splx(s);
825 
826 		break;
827 
828 	default:
829 		return (ENOTTY);
830 	}
831 
832 	return (0);
833 }
834 
835 void
pfsync_setmtu(struct pfsync_softc * sc,int mtu_req)836 pfsync_setmtu(struct pfsync_softc *sc, int mtu_req)
837 {
838 	int mtu;
839 
840 	if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req)
841 		mtu = sc->sc_sync_ifp->if_mtu;
842 	else
843 		mtu = mtu_req;
844 
845 	sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) /
846 	    sizeof(struct pfsync_state);
847 	if (sc->sc_maxcount > 254)
848 	    sc->sc_maxcount = 254;
849 	sc->sc_if.if_mtu = sizeof(struct pfsync_header) +
850 	    sc->sc_maxcount * sizeof(struct pfsync_state);
851 }
852 
853 struct mbuf *
pfsync_get_mbuf(struct pfsync_softc * sc,u_int8_t action,void ** sp)854 pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp)
855 {
856 	struct pfsync_header *h;
857 	struct mbuf *m;
858 	int len;
859 
860 	MGETHDR(m, M_DONTWAIT, MT_DATA);
861 	if (m == NULL) {
862 		sc->sc_if.if_oerrors++;
863 		return (NULL);
864 	}
865 
866 	switch (action) {
867 	case PFSYNC_ACT_CLR:
868 		len = sizeof(struct pfsync_header) +
869 		    sizeof(struct pfsync_state_clr);
870 		break;
871 	case PFSYNC_ACT_UPD_C:
872 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) +
873 		    sizeof(struct pfsync_header);
874 		break;
875 	case PFSYNC_ACT_DEL_C:
876 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) +
877 		    sizeof(struct pfsync_header);
878 		break;
879 	case PFSYNC_ACT_UREQ:
880 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) +
881 		    sizeof(struct pfsync_header);
882 		break;
883 	case PFSYNC_ACT_BUS:
884 		len = sizeof(struct pfsync_header) +
885 		    sizeof(struct pfsync_state_bus);
886 		break;
887 	default:
888 		len = (sc->sc_maxcount * sizeof(struct pfsync_state)) +
889 		    sizeof(struct pfsync_header);
890 		break;
891 	}
892 
893 	if (len > MHLEN) {
894 		MCLGET(m, M_DONTWAIT);
895 		if ((m->m_flags & M_EXT) == 0) {
896 			m_free(m);
897 			sc->sc_if.if_oerrors++;
898 			return (NULL);
899 		}
900 		m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1);
901 	} else
902 		MH_ALIGN(m, len);
903 
904 	m->m_pkthdr.rcvif = NULL;
905 	m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header);
906 	h = mtod(m, struct pfsync_header *);
907 	h->version = PFSYNC_VERSION;
908 	h->af = 0;
909 	h->count = 0;
910 	h->action = action;
911 
912 	*sp = (void *)((char *)h + PFSYNC_HDRLEN);
913 	timeout_add(&sc->sc_tmo, hz);
914 	return (m);
915 }
916 
917 int
pfsync_pack_state(u_int8_t action,struct pf_state * st,int compress)918 pfsync_pack_state(u_int8_t action, struct pf_state *st, int compress)
919 {
920 	struct ifnet *ifp = &pfsyncif.sc_if;
921 	struct pfsync_softc *sc = ifp->if_softc;
922 	struct pfsync_header *h, *h_net;
923 	struct pfsync_state *sp = NULL;
924 	struct pfsync_state_upd *up = NULL;
925 	struct pfsync_state_del *dp = NULL;
926 	struct pf_rule *r;
927 	time_t secs;
928 	int s, ret = 0;
929 	u_int8_t i = 255, newaction = 0;
930 
931 	/*
932 	 * If a packet falls in the forest and there's nobody around to
933 	 * hear, does it make a sound?
934 	 */
935 	if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL) {
936 		/* Don't leave any stale pfsync packets hanging around. */
937 		if (sc->sc_mbuf != NULL) {
938 			m_freem(sc->sc_mbuf);
939 			sc->sc_mbuf = NULL;
940 			sc->sc_statep.s = NULL;
941 		}
942 		return (0);
943 	}
944 
945 	if (action >= PFSYNC_ACT_MAX)
946 		return (EINVAL);
947 
948 	s = splnet();
949 	if (sc->sc_mbuf == NULL) {
950 		if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
951 		    (void *)&sc->sc_statep.s)) == NULL) {
952 			splx(s);
953 			return (ENOMEM);
954 		}
955 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
956 	} else {
957 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
958 		if (h->action != action) {
959 			pfsync_sendout(sc);
960 			if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
961 			    (void *)&sc->sc_statep.s)) == NULL) {
962 				splx(s);
963 				return (ENOMEM);
964 			}
965 			h = mtod(sc->sc_mbuf, struct pfsync_header *);
966 		} else {
967 			/*
968 			 * If it's an update, look in the packet to see if
969 			 * we already have an update for the state.
970 			 */
971 			if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) {
972 				struct pfsync_state *usp =
973 				    (void *)((char *)h + PFSYNC_HDRLEN);
974 
975 				for (i = 0; i < h->count; i++) {
976 					if (!memcmp(usp->id, &st->id,
977 					    PFSYNC_ID_LEN) &&
978 					    usp->creatorid == st->creatorid) {
979 						sp = usp;
980 						sp->updates++;
981 						break;
982 					}
983 					usp++;
984 				}
985 			}
986 		}
987 	}
988 
989 	secs = time.tv_sec;
990 
991 	st->pfsync_time = mono_time.tv_sec;
992 	TAILQ_REMOVE(&state_updates, st, u.s.entry_updates);
993 	TAILQ_INSERT_TAIL(&state_updates, st, u.s.entry_updates);
994 
995 	if (sp == NULL) {
996 		/* not a "duplicate" update */
997 		i = 255;
998 		sp = sc->sc_statep.s++;
999 		sc->sc_mbuf->m_pkthdr.len =
1000 		    sc->sc_mbuf->m_len += sizeof(struct pfsync_state);
1001 		h->count++;
1002 		bzero(sp, sizeof(*sp));
1003 
1004 		bcopy(&st->id, sp->id, sizeof(sp->id));
1005 		sp->creatorid = st->creatorid;
1006 
1007 		strlcpy(sp->ifname, st->u.s.kif->pfik_name, sizeof(sp->ifname));
1008 		pf_state_host_hton(&st->lan, &sp->lan);
1009 		pf_state_host_hton(&st->gwy, &sp->gwy);
1010 		pf_state_host_hton(&st->ext, &sp->ext);
1011 
1012 		bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
1013 
1014 		sp->creation = htonl(secs - st->creation);
1015 		sp->packets[0] = htonl(st->packets[0]);
1016 		sp->packets[1] = htonl(st->packets[1]);
1017 		sp->bytes[0] = htonl(st->bytes[0]);
1018 		sp->bytes[1] = htonl(st->bytes[1]);
1019 		if ((r = st->rule.ptr) == NULL)
1020 			sp->rule = htonl(-1);
1021 		else
1022 			sp->rule = htonl(r->nr);
1023 		if ((r = st->anchor.ptr) == NULL)
1024 			sp->anchor = htonl(-1);
1025 		else
1026 			sp->anchor = htonl(r->nr);
1027 		sp->af = st->af;
1028 		sp->proto = st->proto;
1029 		sp->direction = st->direction;
1030 		sp->log = st->log;
1031 		sp->allow_opts = st->allow_opts;
1032 		sp->timeout = st->timeout;
1033 
1034 		sp->sync_flags = st->sync_flags & PFSTATE_NOSYNC;
1035 	}
1036 
1037 	pf_state_peer_hton(&st->src, &sp->src);
1038 	pf_state_peer_hton(&st->dst, &sp->dst);
1039 
1040 	if (st->expire <= secs)
1041 		sp->expire = htonl(0);
1042 	else
1043 		sp->expire = htonl(st->expire - secs);
1044 
1045 	/* do we need to build "compressed" actions for network transfer? */
1046 	if (sc->sc_sync_ifp && compress) {
1047 		switch (action) {
1048 		case PFSYNC_ACT_UPD:
1049 			newaction = PFSYNC_ACT_UPD_C;
1050 			break;
1051 		case PFSYNC_ACT_DEL:
1052 			newaction = PFSYNC_ACT_DEL_C;
1053 			break;
1054 		default:
1055 			/* by default we just send the uncompressed states */
1056 			break;
1057 		}
1058 	}
1059 
1060 	if (newaction) {
1061 		if (sc->sc_mbuf_net == NULL) {
1062 			if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction,
1063 			    (void *)&sc->sc_statep_net.s)) == NULL) {
1064 				splx(s);
1065 				return (ENOMEM);
1066 			}
1067 		}
1068 		h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *);
1069 
1070 		switch (newaction) {
1071 		case PFSYNC_ACT_UPD_C:
1072 			if (i != 255) {
1073 				up = (void *)((char *)h_net +
1074 				    PFSYNC_HDRLEN + (i * sizeof(*up)));
1075 				up->updates++;
1076 			} else {
1077 				h_net->count++;
1078 				sc->sc_mbuf_net->m_pkthdr.len =
1079 				    sc->sc_mbuf_net->m_len += sizeof(*up);
1080 				up = sc->sc_statep_net.u++;
1081 
1082 				bzero(up, sizeof(*up));
1083 				bcopy(&st->id, up->id, sizeof(up->id));
1084 				up->creatorid = st->creatorid;
1085 			}
1086 			up->timeout = st->timeout;
1087 			up->expire = sp->expire;
1088 			up->src = sp->src;
1089 			up->dst = sp->dst;
1090 			break;
1091 		case PFSYNC_ACT_DEL_C:
1092 			sc->sc_mbuf_net->m_pkthdr.len =
1093 			    sc->sc_mbuf_net->m_len += sizeof(*dp);
1094 			dp = sc->sc_statep_net.d++;
1095 			h_net->count++;
1096 
1097 			bzero(dp, sizeof(*dp));
1098 			bcopy(&st->id, dp->id, sizeof(dp->id));
1099 			dp->creatorid = st->creatorid;
1100 			break;
1101 		}
1102 	}
1103 
1104 	if (h->count == sc->sc_maxcount ||
1105 	    (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates)))
1106 		ret = pfsync_sendout(sc);
1107 
1108 	splx(s);
1109 	return (ret);
1110 }
1111 
1112 /* This must be called in splnet() */
1113 int
pfsync_request_update(struct pfsync_state_upd * up,struct in_addr * src)1114 pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src)
1115 {
1116 	struct ifnet *ifp = &pfsyncif.sc_if;
1117 	struct pfsync_header *h;
1118 	struct pfsync_softc *sc = ifp->if_softc;
1119 	struct pfsync_state_upd_req *rup;
1120 	int ret;
1121 
1122 	if (sc->sc_mbuf == NULL) {
1123 		if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1124 		    (void *)&sc->sc_statep.s)) == NULL)
1125 			return (ENOMEM);
1126 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1127 	} else {
1128 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1129 		if (h->action != PFSYNC_ACT_UREQ) {
1130 			pfsync_sendout(sc);
1131 			if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1132 			    (void *)&sc->sc_statep.s)) == NULL)
1133 				return (ENOMEM);
1134 			h = mtod(sc->sc_mbuf, struct pfsync_header *);
1135 		}
1136 	}
1137 
1138 	if (src != NULL)
1139 		sc->sc_sendaddr = *src;
1140 	sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup);
1141 	h->count++;
1142 	rup = sc->sc_statep.r++;
1143 	bzero(rup, sizeof(*rup));
1144 	if (up != NULL) {
1145 		bcopy(up->id, rup->id, sizeof(rup->id));
1146 		rup->creatorid = up->creatorid;
1147 	}
1148 
1149 	if (h->count == sc->sc_maxcount)
1150 		ret = pfsync_sendout(sc);
1151 
1152 	return (ret);
1153 }
1154 
1155 int
pfsync_clear_states(u_int32_t creatorid,char * ifname)1156 pfsync_clear_states(u_int32_t creatorid, char *ifname)
1157 {
1158 	struct ifnet *ifp = &pfsyncif.sc_if;
1159 	struct pfsync_softc *sc = ifp->if_softc;
1160 	struct pfsync_state_clr *cp;
1161 	int s, ret;
1162 
1163 	s = splnet();
1164 	if (sc->sc_mbuf != NULL)
1165 		pfsync_sendout(sc);
1166 	if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR,
1167 	    (void *)&sc->sc_statep.c)) == NULL) {
1168 		splx(s);
1169 		return (ENOMEM);
1170 	}
1171 	sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp);
1172 	cp = sc->sc_statep.c;
1173 	cp->creatorid = creatorid;
1174 	if (ifname != NULL)
1175 		strlcpy(cp->ifname, ifname, IFNAMSIZ);
1176 
1177 	ret = (pfsync_sendout(sc));
1178 	splx(s);
1179 	return (ret);
1180 }
1181 
1182 void
pfsync_timeout(void * v)1183 pfsync_timeout(void *v)
1184 {
1185 	struct pfsync_softc *sc = v;
1186 	int s;
1187 
1188 	s = splnet();
1189 	pfsync_sendout(sc);
1190 	splx(s);
1191 }
1192 
1193 /* This must be called in splnet() */
1194 void
pfsync_send_bus(struct pfsync_softc * sc,u_int8_t status)1195 pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status)
1196 {
1197 	struct pfsync_state_bus *bus;
1198 
1199 	if (sc->sc_mbuf != NULL)
1200 		pfsync_sendout(sc);
1201 
1202 	if (pfsync_sync_ok &&
1203 	    (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS,
1204 	    (void *)&sc->sc_statep.b)) != NULL) {
1205 		sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus);
1206 		bus = sc->sc_statep.b;
1207 		bus->creatorid = pf_status.hostid;
1208 		bus->status = status;
1209 		bus->endtime = htonl(mono_time.tv_sec - sc->sc_ureq_received);
1210 		pfsync_sendout(sc);
1211 	}
1212 }
1213 
1214 void
pfsync_bulk_update(void * v)1215 pfsync_bulk_update(void *v)
1216 {
1217 	struct pfsync_softc *sc = v;
1218 	int s, i = 0;
1219 	struct pf_state *state;
1220 
1221 	s = splnet();
1222 	if (sc->sc_mbuf != NULL)
1223 		pfsync_sendout(sc);
1224 
1225 	/*
1226 	 * Grab at most PFSYNC_BULKPACKETS worth of states which have not
1227 	 * been sent since the latest request was made.
1228 	 */
1229 	while ((state = TAILQ_FIRST(&state_updates)) != NULL &&
1230 	    ++i < (sc->sc_maxcount * PFSYNC_BULKPACKETS)) {
1231 		if (state->pfsync_time > sc->sc_ureq_received) {
1232 			/* we're done */
1233 			pfsync_send_bus(sc, PFSYNC_BUS_END);
1234 			sc->sc_ureq_received = 0;
1235 			timeout_del(&sc->sc_bulk_tmo);
1236 			if (pf_status.debug >= PF_DEBUG_MISC)
1237 				printf("pfsync: bulk update complete\n");
1238 			break;
1239 		} else {
1240 			/* send an update and move to end of list */
1241 			if (!state->sync_flags)
1242 				pfsync_pack_state(PFSYNC_ACT_UPD, state, 0);
1243 			state->pfsync_time = mono_time.tv_sec;
1244 			TAILQ_REMOVE(&state_updates, state, u.s.entry_updates);
1245 			TAILQ_INSERT_TAIL(&state_updates, state,
1246 			    u.s.entry_updates);
1247 
1248 			/* look again for more in a bit */
1249 			timeout_add(&sc->sc_bulk_tmo, 1);
1250 		}
1251 	}
1252 	if (sc->sc_mbuf != NULL)
1253 		pfsync_sendout(sc);
1254 	splx(s);
1255 }
1256 
1257 void
pfsync_bulkfail(void * v)1258 pfsync_bulkfail(void *v)
1259 {
1260 	struct pfsync_softc *sc = v;
1261 	int s, error;
1262 
1263 	if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
1264 		/* Try again in a bit */
1265 		timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
1266 		s = splnet();
1267 		error = pfsync_request_update(NULL, NULL);
1268 		if (error == ENOMEM) {
1269 			if (pf_status.debug >= PF_DEBUG_MISC)
1270 				printf("pfsync: cannot allocate mbufs for "
1271 				    "bulk update\n");
1272 		} else
1273 			pfsync_sendout(sc);
1274 		splx(s);
1275 	} else {
1276 		/* Pretend like the transfer was ok */
1277 		sc->sc_ureq_sent = 0;
1278 		sc->sc_bulk_tries = 0;
1279 #if NCARP > 0
1280 		if (!pfsync_sync_ok)
1281 			carp_suppress_preempt--;
1282 #endif
1283 		pfsync_sync_ok = 1;
1284 		if (pf_status.debug >= PF_DEBUG_MISC)
1285 			printf("pfsync: failed to receive "
1286 			    "bulk update status\n");
1287 		timeout_del(&sc->sc_bulkfail_tmo);
1288 	}
1289 }
1290 
1291 /* This must be called in splnet() */
1292 int
pfsync_sendout(sc)1293 pfsync_sendout(sc)
1294 	struct pfsync_softc *sc;
1295 {
1296 	struct ifnet *ifp = &sc->sc_if;
1297 	struct mbuf *m;
1298 
1299 	timeout_del(&sc->sc_tmo);
1300 
1301 	if (sc->sc_mbuf == NULL)
1302 		return (0);
1303 	m = sc->sc_mbuf;
1304 	sc->sc_mbuf = NULL;
1305 	sc->sc_statep.s = NULL;
1306 
1307 #if NBPFILTER > 0
1308 	if (ifp->if_bpf)
1309 		bpf_mtap(ifp->if_bpf, m);
1310 #endif
1311 
1312 	if (sc->sc_mbuf_net) {
1313 		m_freem(m);
1314 		m = sc->sc_mbuf_net;
1315 		sc->sc_mbuf_net = NULL;
1316 		sc->sc_statep_net.s = NULL;
1317 	}
1318 
1319 	if (sc->sc_sync_ifp) {
1320 		struct ip *ip;
1321 		struct ifaddr *ifa;
1322 		struct sockaddr sa;
1323 
1324 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
1325 		if (m == NULL) {
1326 			pfsyncstats.pfsyncs_onomem++;
1327 			return (0);
1328 		}
1329 		ip = mtod(m, struct ip *);
1330 		ip->ip_v = IPVERSION;
1331 		ip->ip_hl = sizeof(*ip) >> 2;
1332 		ip->ip_tos = IPTOS_LOWDELAY;
1333 		ip->ip_len = htons(m->m_pkthdr.len);
1334 		ip->ip_id = htons(ip_randomid());
1335 		ip->ip_off = htons(IP_DF);
1336 		ip->ip_ttl = PFSYNC_DFLTTL;
1337 		ip->ip_p = IPPROTO_PFSYNC;
1338 		ip->ip_sum = 0;
1339 
1340 		bzero(&sa, sizeof(sa));
1341 		sa.sa_family = AF_INET;
1342 		ifa = ifaof_ifpforaddr(&sa, sc->sc_sync_ifp);
1343 		if (ifa == NULL)
1344 			return (0);
1345 		ip->ip_src.s_addr = ifatoia(ifa)->ia_addr.sin_addr.s_addr;
1346 
1347 		if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP)
1348 			m->m_flags |= M_MCAST;
1349 		ip->ip_dst = sc->sc_sendaddr;
1350 		sc->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
1351 
1352 		pfsyncstats.pfsyncs_opackets++;
1353 
1354 		if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))
1355 			pfsyncstats.pfsyncs_oerrors++;
1356 	} else
1357 		m_freem(m);
1358 
1359 	return (0);
1360 }
1361