1 /* $OpenBSD: if_pfsync.c,v 1.32 2004/04/30 22:08:18 mcbride Exp $ */
2
3 /*
4 * Copyright (c) 2002 Michael Shalayeff
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26 * THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include "bpfilter.h"
30 #include "pfsync.h"
31
32 #include <sys/param.h>
33 #include <sys/proc.h>
34 #include <sys/systm.h>
35 #include <sys/time.h>
36 #include <sys/mbuf.h>
37 #include <sys/socket.h>
38 #include <sys/ioctl.h>
39 #include <sys/timeout.h>
40
41 #include <net/if.h>
42 #include <net/if_types.h>
43 #include <net/route.h>
44 #include <net/bpf.h>
45 #include <netinet/tcp.h>
46 #include <netinet/tcp_seq.h>
47
48 #ifdef INET
49 #include <netinet/in.h>
50 #include <netinet/in_systm.h>
51 #include <netinet/in_var.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #endif
55
56 #ifdef INET6
57 #ifndef INET
58 #include <netinet/in.h>
59 #endif
60 #include <netinet6/nd6.h>
61 #endif /* INET6 */
62
63 #include "carp.h"
64 #if NCARP > 0
65 extern int carp_suppress_preempt;
66 #endif
67
68 #include <net/pfvar.h>
69 #include <net/if_pfsync.h>
70
71 #define PFSYNC_MINMTU \
72 (sizeof(struct pfsync_header) + sizeof(struct pf_state))
73
74 #ifdef PFSYNCDEBUG
75 #define DPRINTF(x) do { if (pfsyncdebug) printf x ; } while (0)
76 int pfsyncdebug;
77 #else
78 #define DPRINTF(x)
79 #endif
80
81 struct pfsync_softc pfsyncif;
82 struct pfsyncstats pfsyncstats;
83
84 void pfsyncattach(int);
85 void pfsync_setmtu(struct pfsync_softc *, int);
86 int pfsync_insert_net_state(struct pfsync_state *);
87 int pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
88 struct rtentry *);
89 int pfsyncioctl(struct ifnet *, u_long, caddr_t);
90 void pfsyncstart(struct ifnet *);
91
92 struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **);
93 int pfsync_request_update(struct pfsync_state_upd *, struct in_addr *);
94 int pfsync_sendout(struct pfsync_softc *);
95 void pfsync_timeout(void *);
96 void pfsync_send_bus(struct pfsync_softc *, u_int8_t);
97 void pfsync_bulk_update(void *);
98 void pfsync_bulkfail(void *);
99
100 int pfsync_sync_ok;
101 extern int ifqmaxlen;
102 extern struct timeval time;
103 extern struct timeval mono_time;
104 extern int hz;
105
106 void
pfsyncattach(int npfsync)107 pfsyncattach(int npfsync)
108 {
109 struct ifnet *ifp;
110
111 pfsync_sync_ok = 1;
112 bzero(&pfsyncif, sizeof(pfsyncif));
113 pfsyncif.sc_mbuf = NULL;
114 pfsyncif.sc_mbuf_net = NULL;
115 pfsyncif.sc_statep.s = NULL;
116 pfsyncif.sc_statep_net.s = NULL;
117 pfsyncif.sc_maxupdates = 128;
118 pfsyncif.sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
119 pfsyncif.sc_ureq_received = 0;
120 pfsyncif.sc_ureq_sent = 0;
121 ifp = &pfsyncif.sc_if;
122 strlcpy(ifp->if_xname, "pfsync0", sizeof ifp->if_xname);
123 ifp->if_softc = &pfsyncif;
124 ifp->if_ioctl = pfsyncioctl;
125 ifp->if_output = pfsyncoutput;
126 ifp->if_start = pfsyncstart;
127 ifp->if_type = IFT_PFSYNC;
128 ifp->if_snd.ifq_maxlen = ifqmaxlen;
129 ifp->if_hdrlen = PFSYNC_HDRLEN;
130 pfsync_setmtu(&pfsyncif, MCLBYTES);
131 timeout_set(&pfsyncif.sc_tmo, pfsync_timeout, &pfsyncif);
132 timeout_set(&pfsyncif.sc_bulk_tmo, pfsync_bulk_update, &pfsyncif);
133 timeout_set(&pfsyncif.sc_bulkfail_tmo, pfsync_bulkfail, &pfsyncif);
134 if_attach(ifp);
135 if_alloc_sadl(ifp);
136
137 #if NBPFILTER > 0
138 bpfattach(&pfsyncif.sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
139 #endif
140 }
141
142 /*
143 * Start output on the pfsync interface.
144 */
145 void
pfsyncstart(struct ifnet * ifp)146 pfsyncstart(struct ifnet *ifp)
147 {
148 struct mbuf *m;
149 int s;
150
151 for (;;) {
152 s = splimp();
153 IF_DROP(&ifp->if_snd);
154 IF_DEQUEUE(&ifp->if_snd, m);
155 splx(s);
156
157 if (m == NULL)
158 return;
159 else
160 m_freem(m);
161 }
162 }
163
164 int
pfsync_insert_net_state(struct pfsync_state * sp)165 pfsync_insert_net_state(struct pfsync_state *sp)
166 {
167 struct pf_state *st = NULL;
168 struct pf_rule *r = NULL;
169 struct pfi_kif *kif;
170
171 if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
172 printf("pfsync_insert_net_state: invalid creator id:"
173 " %08x\n", ntohl(sp->creatorid));
174 return (EINVAL);
175 }
176
177 kif = pfi_lookup_create(sp->ifname);
178 if (kif == NULL) {
179 if (pf_status.debug >= PF_DEBUG_MISC)
180 printf("pfsync_insert_net_state: "
181 "unknown interface: %s\n", sp->ifname);
182 /* skip this state */
183 return (0);
184 }
185
186 /*
187 * Just use the default rule until we have infrastructure to find the
188 * best matching rule.
189 */
190 r = &pf_default_rule;
191
192 if (!r->max_states || r->states < r->max_states)
193 st = pool_get(&pf_state_pl, PR_NOWAIT);
194 if (st == NULL) {
195 pfi_maybe_destroy(kif);
196 return (ENOMEM);
197 }
198 bzero(st, sizeof(*st));
199
200 st->rule.ptr = r;
201 /* XXX get pointers to nat_rule and anchor */
202
203 /* fill in the rest of the state entry */
204 pf_state_host_ntoh(&sp->lan, &st->lan);
205 pf_state_host_ntoh(&sp->gwy, &st->gwy);
206 pf_state_host_ntoh(&sp->ext, &st->ext);
207
208 pf_state_peer_ntoh(&sp->src, &st->src);
209 pf_state_peer_ntoh(&sp->dst, &st->dst);
210
211 bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
212 st->creation = ntohl(sp->creation) + time.tv_sec;
213 st->expire = ntohl(sp->expire) + time.tv_sec;
214
215 st->af = sp->af;
216 st->proto = sp->proto;
217 st->direction = sp->direction;
218 st->log = sp->log;
219 st->timeout = sp->timeout;
220 st->allow_opts = sp->allow_opts;
221
222 bcopy(sp->id, &st->id, sizeof(st->id));
223 st->creatorid = sp->creatorid;
224 st->sync_flags = sp->sync_flags | PFSTATE_FROMSYNC;
225
226
227 if (pf_insert_state(kif, st)) {
228 pfi_maybe_destroy(kif);
229 pool_put(&pf_state_pl, st);
230 return (EINVAL);
231 }
232
233 return (0);
234 }
235
236 void
pfsync_input(struct mbuf * m,...)237 pfsync_input(struct mbuf *m, ...)
238 {
239 struct ip *ip = mtod(m, struct ip *);
240 struct pfsync_header *ph;
241 struct pfsync_softc *sc = &pfsyncif;
242 struct pf_state *st, key;
243 struct pfsync_state *sp;
244 struct pfsync_state_upd *up;
245 struct pfsync_state_del *dp;
246 struct pfsync_state_clr *cp;
247 struct pfsync_state_upd_req *rup;
248 struct pfsync_state_bus *bus;
249 struct in_addr src;
250 struct mbuf *mp;
251 int iplen, action, error, i, s, count, offp, sfail, stale = 0;
252
253 pfsyncstats.pfsyncs_ipackets++;
254
255 /* verify that we have a sync interface configured */
256 if (!sc->sc_sync_ifp || !pf_status.running)
257 goto done;
258
259 /* verify that the packet came in on the right interface */
260 if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) {
261 pfsyncstats.pfsyncs_badif++;
262 goto done;
263 }
264
265 /* verify that the IP TTL is 255. */
266 if (ip->ip_ttl != PFSYNC_DFLTTL) {
267 pfsyncstats.pfsyncs_badttl++;
268 goto done;
269 }
270
271 iplen = ip->ip_hl << 2;
272
273 if (m->m_pkthdr.len < iplen + sizeof(*ph)) {
274 pfsyncstats.pfsyncs_hdrops++;
275 goto done;
276 }
277
278 if (iplen + sizeof(*ph) > m->m_len) {
279 if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) {
280 pfsyncstats.pfsyncs_hdrops++;
281 goto done;
282 }
283 ip = mtod(m, struct ip *);
284 }
285 ph = (struct pfsync_header *)((char *)ip + iplen);
286
287 /* verify the version */
288 if (ph->version != PFSYNC_VERSION) {
289 pfsyncstats.pfsyncs_badver++;
290 goto done;
291 }
292
293 action = ph->action;
294 count = ph->count;
295
296 /* make sure it's a valid action code */
297 if (action >= PFSYNC_ACT_MAX) {
298 pfsyncstats.pfsyncs_badact++;
299 goto done;
300 }
301
302 /* Cheaper to grab this now than having to mess with mbufs later */
303 src = ip->ip_src;
304
305 switch (action) {
306 case PFSYNC_ACT_CLR: {
307 struct pfi_kif *kif;
308 u_int32_t creatorid;
309 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
310 sizeof(*cp), &offp)) == NULL) {
311 pfsyncstats.pfsyncs_badlen++;
312 return;
313 }
314 cp = (struct pfsync_state_clr *)(mp->m_data + offp);
315 creatorid = cp->creatorid;
316
317 s = splsoftnet();
318 if (cp->ifname[0] == '\0') {
319 RB_FOREACH(st, pf_state_tree_id, &tree_id) {
320 if (st->creatorid == creatorid)
321 st->timeout = PFTM_PURGE;
322 }
323 } else {
324 kif = pfi_lookup_if(cp->ifname);
325 if (kif == NULL) {
326 if (pf_status.debug >= PF_DEBUG_MISC)
327 printf("pfsync_input: PFSYNC_ACT_CLR "
328 "bad interface: %s\n", cp->ifname);
329 splx(s);
330 goto done;
331 }
332 RB_FOREACH(st, pf_state_tree_lan_ext,
333 &kif->pfik_lan_ext) {
334 if (st->creatorid == creatorid) {
335 st->timeout = PFTM_PURGE;
336 pf_purge_expired_state(st);
337 }
338 }
339 }
340 splx(s);
341
342 break;
343 }
344 case PFSYNC_ACT_INS:
345 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
346 count * sizeof(*sp), &offp)) == NULL) {
347 pfsyncstats.pfsyncs_badlen++;
348 return;
349 }
350
351 s = splsoftnet();
352 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
353 i < count; i++, sp++) {
354 /* check for invalid values */
355 if (sp->timeout >= PFTM_MAX ||
356 sp->src.state > PF_TCPS_PROXY_DST ||
357 sp->dst.state > PF_TCPS_PROXY_DST ||
358 sp->direction > PF_OUT ||
359 (sp->af != AF_INET && sp->af != AF_INET6)) {
360 if (pf_status.debug >= PF_DEBUG_MISC)
361 printf("pfsync_insert: PFSYNC_ACT_INS: "
362 "invalid value\n");
363 pfsyncstats.pfsyncs_badstate++;
364 continue;
365 }
366
367 if ((error = pfsync_insert_net_state(sp))) {
368 if (error == ENOMEM) {
369 splx(s);
370 goto done;
371 }
372 continue;
373 }
374 }
375 splx(s);
376 break;
377 case PFSYNC_ACT_UPD:
378 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
379 count * sizeof(*sp), &offp)) == NULL) {
380 pfsyncstats.pfsyncs_badlen++;
381 return;
382 }
383
384 s = splsoftnet();
385 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
386 i < count; i++, sp++) {
387 /* check for invalid values */
388 if (sp->timeout >= PFTM_MAX ||
389 sp->src.state > PF_TCPS_PROXY_DST ||
390 sp->dst.state > PF_TCPS_PROXY_DST) {
391 if (pf_status.debug >= PF_DEBUG_MISC)
392 printf("pfsync_insert: PFSYNC_ACT_UPD: "
393 "invalid value\n");
394 pfsyncstats.pfsyncs_badstate++;
395 continue;
396 }
397
398 bcopy(sp->id, &key.id, sizeof(key.id));
399 key.creatorid = sp->creatorid;
400
401 st = pf_find_state_byid(&key);
402 if (st == NULL) {
403 /* insert the update */
404 if (pfsync_insert_net_state(sp))
405 pfsyncstats.pfsyncs_badstate++;
406 continue;
407 }
408 sfail = 0;
409 if (st->proto == IPPROTO_TCP) {
410 /*
411 * The state should never go backwards except
412 * for syn-proxy states. Neither should the
413 * sequence window slide backwards.
414 */
415 if (st->src.state > sp->src.state &&
416 (st->src.state < PF_TCPS_PROXY_SRC ||
417 sp->src.state >= PF_TCPS_PROXY_SRC))
418 sfail = 1;
419 else if (st->dst.state > sp->dst.state)
420 sfail = 2;
421 else if (SEQ_GT(st->src.seqlo,
422 ntohl(sp->src.seqlo)))
423 sfail = 3;
424 else if (st->dst.state >= TCPS_SYN_SENT &&
425 SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo)))
426 sfail = 4;
427 } else {
428 /*
429 * Non-TCP protocol state machine always go
430 * forwards
431 */
432 if (st->src.state > sp->src.state)
433 sfail = 5;
434 else if ( st->dst.state > sp->dst.state)
435 sfail = 6;
436 }
437 if (sfail) {
438 if (pf_status.debug >= PF_DEBUG_MISC)
439 printf("pfsync: ignoring stale update "
440 "(%d) id: %016llx "
441 "creatorid: %08x\n", sfail,
442 betoh64(st->id),
443 ntohl(st->creatorid));
444 pfsyncstats.pfsyncs_badstate++;
445
446 /* we have a better state, send it out */
447 if (sc->sc_mbuf != NULL && !stale)
448 pfsync_sendout(sc);
449 stale++;
450 pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
451 continue;
452 }
453 pf_state_peer_ntoh(&sp->src, &st->src);
454 pf_state_peer_ntoh(&sp->dst, &st->dst);
455 st->expire = ntohl(sp->expire) + time.tv_sec;
456 st->timeout = sp->timeout;
457 }
458 if (stale && sc->sc_mbuf != NULL)
459 pfsync_sendout(sc);
460 splx(s);
461 break;
462 /*
463 * It's not strictly necessary for us to support the "uncompressed"
464 * delete action, but it's relatively simple and maintains consistency.
465 */
466 case PFSYNC_ACT_DEL:
467 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
468 count * sizeof(*sp), &offp)) == NULL) {
469 pfsyncstats.pfsyncs_badlen++;
470 return;
471 }
472
473 s = splsoftnet();
474 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
475 i < count; i++, sp++) {
476 bcopy(sp->id, &key.id, sizeof(key.id));
477 key.creatorid = sp->creatorid;
478
479 st = pf_find_state_byid(&key);
480 if (st == NULL) {
481 pfsyncstats.pfsyncs_badstate++;
482 continue;
483 }
484 st->timeout = PFTM_PURGE;
485 st->sync_flags |= PFSTATE_FROMSYNC;
486 pf_purge_expired_state(st);
487 }
488 splx(s);
489 break;
490 case PFSYNC_ACT_UPD_C: {
491 int update_requested = 0;
492
493 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
494 count * sizeof(*up), &offp)) == NULL) {
495 pfsyncstats.pfsyncs_badlen++;
496 return;
497 }
498
499 s = splsoftnet();
500 for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp);
501 i < count; i++, up++) {
502 /* check for invalid values */
503 if (up->timeout >= PFTM_MAX ||
504 up->src.state > PF_TCPS_PROXY_DST ||
505 up->dst.state > PF_TCPS_PROXY_DST) {
506 if (pf_status.debug >= PF_DEBUG_MISC)
507 printf("pfsync_insert: "
508 "PFSYNC_ACT_UPD_C: "
509 "invalid value\n");
510 pfsyncstats.pfsyncs_badstate++;
511 continue;
512 }
513
514 bcopy(up->id, &key.id, sizeof(key.id));
515 key.creatorid = up->creatorid;
516
517 st = pf_find_state_byid(&key);
518 if (st == NULL) {
519 /* We don't have this state. Ask for it. */
520 error = pfsync_request_update(up, &src);
521 if (error == ENOMEM) {
522 splx(s);
523 goto done;
524 }
525 update_requested = 1;
526 pfsyncstats.pfsyncs_badstate++;
527 continue;
528 }
529 sfail = 0;
530 if (st->proto == IPPROTO_TCP) {
531 /*
532 * The state should never go backwards except
533 * for syn-proxy states. Neither should the
534 * sequence window slide backwards.
535 */
536 if (st->src.state > up->src.state &&
537 (st->src.state < PF_TCPS_PROXY_SRC ||
538 up->src.state >= PF_TCPS_PROXY_SRC))
539 sfail = 1;
540 else if (st->dst.state > up->dst.state)
541 sfail = 2;
542 else if (SEQ_GT(st->src.seqlo,
543 ntohl(up->src.seqlo)))
544 sfail = 3;
545 else if (st->dst.state >= TCPS_SYN_SENT &&
546 SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo)))
547 sfail = 4;
548 } else {
549 /*
550 * Non-TCP protocol state machine always go
551 * forwards
552 */
553 if (st->src.state > up->src.state)
554 sfail = 5;
555 else if (st->dst.state > up->dst.state)
556 sfail = 6;
557 }
558 if (sfail) {
559 if (pf_status.debug >= PF_DEBUG_MISC)
560 printf("pfsync: ignoring stale update "
561 "(%d) id: %016llx "
562 "creatorid: %08x\n", sfail,
563 betoh64(st->id),
564 ntohl(st->creatorid));
565 pfsyncstats.pfsyncs_badstate++;
566
567 /* we have a better state, send it out */
568 if ((!stale || update_requested) &&
569 sc->sc_mbuf != NULL) {
570 pfsync_sendout(sc);
571 update_requested = 0;
572 }
573 stale++;
574 pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
575 continue;
576 }
577 pf_state_peer_ntoh(&up->src, &st->src);
578 pf_state_peer_ntoh(&up->dst, &st->dst);
579 st->expire = ntohl(up->expire) + time.tv_sec;
580 st->timeout = up->timeout;
581 }
582 if ((update_requested || stale) && sc->sc_mbuf)
583 pfsync_sendout(sc);
584 splx(s);
585 break;
586 }
587 case PFSYNC_ACT_DEL_C:
588 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
589 count * sizeof(*dp), &offp)) == NULL) {
590 pfsyncstats.pfsyncs_badlen++;
591 return;
592 }
593
594 s = splsoftnet();
595 for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp);
596 i < count; i++, dp++) {
597 bcopy(dp->id, &key.id, sizeof(key.id));
598 key.creatorid = dp->creatorid;
599
600 st = pf_find_state_byid(&key);
601 if (st == NULL) {
602 pfsyncstats.pfsyncs_badstate++;
603 continue;
604 }
605 st->timeout = PFTM_PURGE;
606 st->sync_flags |= PFSTATE_FROMSYNC;
607 pf_purge_expired_state(st);
608 }
609 splx(s);
610 break;
611 case PFSYNC_ACT_INS_F:
612 case PFSYNC_ACT_DEL_F:
613 /* not implemented */
614 break;
615 case PFSYNC_ACT_UREQ:
616 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
617 count * sizeof(*rup), &offp)) == NULL) {
618 pfsyncstats.pfsyncs_badlen++;
619 return;
620 }
621
622 s = splsoftnet();
623 if (sc->sc_mbuf != NULL)
624 pfsync_sendout(sc);
625 for (i = 0,
626 rup = (struct pfsync_state_upd_req *)(mp->m_data + offp);
627 i < count; i++, rup++) {
628 bcopy(rup->id, &key.id, sizeof(key.id));
629 key.creatorid = rup->creatorid;
630
631 if (key.id == 0 && key.creatorid == 0) {
632 sc->sc_ureq_received = mono_time.tv_sec;
633 if (pf_status.debug >= PF_DEBUG_MISC)
634 printf("pfsync: received "
635 "bulk update request\n");
636 pfsync_send_bus(sc, PFSYNC_BUS_START);
637 timeout_add(&sc->sc_bulk_tmo, 1 * hz);
638 } else {
639 st = pf_find_state_byid(&key);
640 if (st == NULL) {
641 pfsyncstats.pfsyncs_badstate++;
642 continue;
643 }
644 pfsync_pack_state(PFSYNC_ACT_UPD, st, 0);
645 }
646 }
647 if (sc->sc_mbuf != NULL)
648 pfsync_sendout(sc);
649 splx(s);
650 break;
651 case PFSYNC_ACT_BUS:
652 /* If we're not waiting for a bulk update, who cares. */
653 if (sc->sc_ureq_sent == 0)
654 break;
655
656 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
657 sizeof(*bus), &offp)) == NULL) {
658 pfsyncstats.pfsyncs_badlen++;
659 return;
660 }
661 bus = (struct pfsync_state_bus *)(mp->m_data + offp);
662 switch (bus->status) {
663 case PFSYNC_BUS_START:
664 timeout_add(&sc->sc_bulkfail_tmo,
665 pf_pool_limits[PF_LIMIT_STATES].limit /
666 (PFSYNC_BULKPACKETS * sc->sc_maxcount));
667 if (pf_status.debug >= PF_DEBUG_MISC)
668 printf("pfsync: received bulk "
669 "update start\n");
670 break;
671 case PFSYNC_BUS_END:
672 if (mono_time.tv_sec - ntohl(bus->endtime) >=
673 sc->sc_ureq_sent) {
674 /* that's it, we're happy */
675 sc->sc_ureq_sent = 0;
676 sc->sc_bulk_tries = 0;
677 timeout_del(&sc->sc_bulkfail_tmo);
678 #if NCARP > 0
679 if (!pfsync_sync_ok)
680 carp_suppress_preempt--;
681 #endif
682 pfsync_sync_ok = 1;
683 if (pf_status.debug >= PF_DEBUG_MISC)
684 printf("pfsync: received valid "
685 "bulk update end\n");
686 } else {
687 if (pf_status.debug >= PF_DEBUG_MISC)
688 printf("pfsync: received invalid "
689 "bulk update end: bad timestamp\n");
690 }
691 break;
692 }
693 break;
694 }
695
696 done:
697 if (m)
698 m_freem(m);
699 }
700
701 int
pfsyncoutput(struct ifnet * ifp,struct mbuf * m,struct sockaddr * dst,struct rtentry * rt)702 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
703 struct rtentry *rt)
704 {
705 m_freem(m);
706 return (0);
707 }
708
709 /* ARGSUSED */
710 int
pfsyncioctl(struct ifnet * ifp,u_long cmd,caddr_t data)711 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
712 {
713 struct proc *p = curproc;
714 struct pfsync_softc *sc = ifp->if_softc;
715 struct ifreq *ifr = (struct ifreq *)data;
716 struct ip_moptions *imo = &sc->sc_imo;
717 struct pfsyncreq pfsyncr;
718 struct ifnet *sifp;
719 int s, error;
720
721 switch (cmd) {
722 case SIOCSIFADDR:
723 case SIOCAIFADDR:
724 case SIOCSIFDSTADDR:
725 case SIOCSIFFLAGS:
726 if (ifp->if_flags & IFF_UP)
727 ifp->if_flags |= IFF_RUNNING;
728 else
729 ifp->if_flags &= ~IFF_RUNNING;
730 break;
731 case SIOCSIFMTU:
732 if (ifr->ifr_mtu < PFSYNC_MINMTU)
733 return (EINVAL);
734 if (ifr->ifr_mtu > MCLBYTES)
735 ifr->ifr_mtu = MCLBYTES;
736 s = splnet();
737 if (ifr->ifr_mtu < ifp->if_mtu)
738 pfsync_sendout(sc);
739 pfsync_setmtu(sc, ifr->ifr_mtu);
740 splx(s);
741 break;
742 case SIOCGETPFSYNC:
743 bzero(&pfsyncr, sizeof(pfsyncr));
744 if (sc->sc_sync_ifp)
745 strlcpy(pfsyncr.pfsyncr_syncif,
746 sc->sc_sync_ifp->if_xname, IFNAMSIZ);
747 pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
748 if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr))))
749 return (error);
750 break;
751 case SIOCSETPFSYNC:
752 if ((error = suser(p, p->p_acflag)) != 0)
753 return (error);
754 if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
755 return (error);
756
757 if (pfsyncr.pfsyncr_maxupdates > 255)
758 return (EINVAL);
759 sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
760
761 if (pfsyncr.pfsyncr_syncif[0] == 0) {
762 sc->sc_sync_ifp = NULL;
763 if (sc->sc_mbuf_net != NULL) {
764 /* Don't keep stale pfsync packets around. */
765 s = splnet();
766 m_freem(sc->sc_mbuf_net);
767 sc->sc_mbuf_net = NULL;
768 sc->sc_statep_net.s = NULL;
769 splx(s);
770 }
771 break;
772 }
773 if ((sifp = ifunit(pfsyncr.pfsyncr_syncif)) == NULL)
774 return (EINVAL);
775 else if (sifp == sc->sc_sync_ifp)
776 break;
777
778 s = splnet();
779 if (sifp->if_mtu < sc->sc_if.if_mtu ||
780 (sc->sc_sync_ifp != NULL &&
781 sifp->if_mtu < sc->sc_sync_ifp->if_mtu) ||
782 sifp->if_mtu < MCLBYTES - sizeof(struct ip))
783 pfsync_sendout(sc);
784 sc->sc_sync_ifp = sifp;
785
786 pfsync_setmtu(sc, sc->sc_if.if_mtu);
787
788 if (imo->imo_num_memberships > 0) {
789 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
790 imo->imo_multicast_ifp = NULL;
791 }
792
793 if (sc->sc_sync_ifp) {
794 struct in_addr addr;
795
796 addr.s_addr = INADDR_PFSYNC_GROUP;
797 if ((imo->imo_membership[0] =
798 in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) {
799 splx(s);
800 return (ENOBUFS);
801 }
802 imo->imo_num_memberships++;
803 imo->imo_multicast_ifp = sc->sc_sync_ifp;
804 imo->imo_multicast_ttl = PFSYNC_DFLTTL;
805 imo->imo_multicast_loop = 0;
806
807 /* Request a full state table update. */
808 sc->sc_ureq_sent = mono_time.tv_sec;
809 #if NCARP > 0
810 if (pfsync_sync_ok)
811 carp_suppress_preempt++;
812 #endif
813 pfsync_sync_ok = 0;
814 if (pf_status.debug >= PF_DEBUG_MISC)
815 printf("pfsync: requesting bulk update\n");
816 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
817 error = pfsync_request_update(NULL, NULL);
818 if (error == ENOMEM) {
819 splx(s);
820 return(ENOMEM);
821 }
822 pfsync_sendout(sc);
823 }
824 splx(s);
825
826 break;
827
828 default:
829 return (ENOTTY);
830 }
831
832 return (0);
833 }
834
835 void
pfsync_setmtu(struct pfsync_softc * sc,int mtu_req)836 pfsync_setmtu(struct pfsync_softc *sc, int mtu_req)
837 {
838 int mtu;
839
840 if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req)
841 mtu = sc->sc_sync_ifp->if_mtu;
842 else
843 mtu = mtu_req;
844
845 sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) /
846 sizeof(struct pfsync_state);
847 if (sc->sc_maxcount > 254)
848 sc->sc_maxcount = 254;
849 sc->sc_if.if_mtu = sizeof(struct pfsync_header) +
850 sc->sc_maxcount * sizeof(struct pfsync_state);
851 }
852
853 struct mbuf *
pfsync_get_mbuf(struct pfsync_softc * sc,u_int8_t action,void ** sp)854 pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp)
855 {
856 struct pfsync_header *h;
857 struct mbuf *m;
858 int len;
859
860 MGETHDR(m, M_DONTWAIT, MT_DATA);
861 if (m == NULL) {
862 sc->sc_if.if_oerrors++;
863 return (NULL);
864 }
865
866 switch (action) {
867 case PFSYNC_ACT_CLR:
868 len = sizeof(struct pfsync_header) +
869 sizeof(struct pfsync_state_clr);
870 break;
871 case PFSYNC_ACT_UPD_C:
872 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) +
873 sizeof(struct pfsync_header);
874 break;
875 case PFSYNC_ACT_DEL_C:
876 len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) +
877 sizeof(struct pfsync_header);
878 break;
879 case PFSYNC_ACT_UREQ:
880 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) +
881 sizeof(struct pfsync_header);
882 break;
883 case PFSYNC_ACT_BUS:
884 len = sizeof(struct pfsync_header) +
885 sizeof(struct pfsync_state_bus);
886 break;
887 default:
888 len = (sc->sc_maxcount * sizeof(struct pfsync_state)) +
889 sizeof(struct pfsync_header);
890 break;
891 }
892
893 if (len > MHLEN) {
894 MCLGET(m, M_DONTWAIT);
895 if ((m->m_flags & M_EXT) == 0) {
896 m_free(m);
897 sc->sc_if.if_oerrors++;
898 return (NULL);
899 }
900 m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1);
901 } else
902 MH_ALIGN(m, len);
903
904 m->m_pkthdr.rcvif = NULL;
905 m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header);
906 h = mtod(m, struct pfsync_header *);
907 h->version = PFSYNC_VERSION;
908 h->af = 0;
909 h->count = 0;
910 h->action = action;
911
912 *sp = (void *)((char *)h + PFSYNC_HDRLEN);
913 timeout_add(&sc->sc_tmo, hz);
914 return (m);
915 }
916
917 int
pfsync_pack_state(u_int8_t action,struct pf_state * st,int compress)918 pfsync_pack_state(u_int8_t action, struct pf_state *st, int compress)
919 {
920 struct ifnet *ifp = &pfsyncif.sc_if;
921 struct pfsync_softc *sc = ifp->if_softc;
922 struct pfsync_header *h, *h_net;
923 struct pfsync_state *sp = NULL;
924 struct pfsync_state_upd *up = NULL;
925 struct pfsync_state_del *dp = NULL;
926 struct pf_rule *r;
927 time_t secs;
928 int s, ret = 0;
929 u_int8_t i = 255, newaction = 0;
930
931 /*
932 * If a packet falls in the forest and there's nobody around to
933 * hear, does it make a sound?
934 */
935 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL) {
936 /* Don't leave any stale pfsync packets hanging around. */
937 if (sc->sc_mbuf != NULL) {
938 m_freem(sc->sc_mbuf);
939 sc->sc_mbuf = NULL;
940 sc->sc_statep.s = NULL;
941 }
942 return (0);
943 }
944
945 if (action >= PFSYNC_ACT_MAX)
946 return (EINVAL);
947
948 s = splnet();
949 if (sc->sc_mbuf == NULL) {
950 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
951 (void *)&sc->sc_statep.s)) == NULL) {
952 splx(s);
953 return (ENOMEM);
954 }
955 h = mtod(sc->sc_mbuf, struct pfsync_header *);
956 } else {
957 h = mtod(sc->sc_mbuf, struct pfsync_header *);
958 if (h->action != action) {
959 pfsync_sendout(sc);
960 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
961 (void *)&sc->sc_statep.s)) == NULL) {
962 splx(s);
963 return (ENOMEM);
964 }
965 h = mtod(sc->sc_mbuf, struct pfsync_header *);
966 } else {
967 /*
968 * If it's an update, look in the packet to see if
969 * we already have an update for the state.
970 */
971 if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) {
972 struct pfsync_state *usp =
973 (void *)((char *)h + PFSYNC_HDRLEN);
974
975 for (i = 0; i < h->count; i++) {
976 if (!memcmp(usp->id, &st->id,
977 PFSYNC_ID_LEN) &&
978 usp->creatorid == st->creatorid) {
979 sp = usp;
980 sp->updates++;
981 break;
982 }
983 usp++;
984 }
985 }
986 }
987 }
988
989 secs = time.tv_sec;
990
991 st->pfsync_time = mono_time.tv_sec;
992 TAILQ_REMOVE(&state_updates, st, u.s.entry_updates);
993 TAILQ_INSERT_TAIL(&state_updates, st, u.s.entry_updates);
994
995 if (sp == NULL) {
996 /* not a "duplicate" update */
997 i = 255;
998 sp = sc->sc_statep.s++;
999 sc->sc_mbuf->m_pkthdr.len =
1000 sc->sc_mbuf->m_len += sizeof(struct pfsync_state);
1001 h->count++;
1002 bzero(sp, sizeof(*sp));
1003
1004 bcopy(&st->id, sp->id, sizeof(sp->id));
1005 sp->creatorid = st->creatorid;
1006
1007 strlcpy(sp->ifname, st->u.s.kif->pfik_name, sizeof(sp->ifname));
1008 pf_state_host_hton(&st->lan, &sp->lan);
1009 pf_state_host_hton(&st->gwy, &sp->gwy);
1010 pf_state_host_hton(&st->ext, &sp->ext);
1011
1012 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
1013
1014 sp->creation = htonl(secs - st->creation);
1015 sp->packets[0] = htonl(st->packets[0]);
1016 sp->packets[1] = htonl(st->packets[1]);
1017 sp->bytes[0] = htonl(st->bytes[0]);
1018 sp->bytes[1] = htonl(st->bytes[1]);
1019 if ((r = st->rule.ptr) == NULL)
1020 sp->rule = htonl(-1);
1021 else
1022 sp->rule = htonl(r->nr);
1023 if ((r = st->anchor.ptr) == NULL)
1024 sp->anchor = htonl(-1);
1025 else
1026 sp->anchor = htonl(r->nr);
1027 sp->af = st->af;
1028 sp->proto = st->proto;
1029 sp->direction = st->direction;
1030 sp->log = st->log;
1031 sp->allow_opts = st->allow_opts;
1032 sp->timeout = st->timeout;
1033
1034 sp->sync_flags = st->sync_flags & PFSTATE_NOSYNC;
1035 }
1036
1037 pf_state_peer_hton(&st->src, &sp->src);
1038 pf_state_peer_hton(&st->dst, &sp->dst);
1039
1040 if (st->expire <= secs)
1041 sp->expire = htonl(0);
1042 else
1043 sp->expire = htonl(st->expire - secs);
1044
1045 /* do we need to build "compressed" actions for network transfer? */
1046 if (sc->sc_sync_ifp && compress) {
1047 switch (action) {
1048 case PFSYNC_ACT_UPD:
1049 newaction = PFSYNC_ACT_UPD_C;
1050 break;
1051 case PFSYNC_ACT_DEL:
1052 newaction = PFSYNC_ACT_DEL_C;
1053 break;
1054 default:
1055 /* by default we just send the uncompressed states */
1056 break;
1057 }
1058 }
1059
1060 if (newaction) {
1061 if (sc->sc_mbuf_net == NULL) {
1062 if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction,
1063 (void *)&sc->sc_statep_net.s)) == NULL) {
1064 splx(s);
1065 return (ENOMEM);
1066 }
1067 }
1068 h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *);
1069
1070 switch (newaction) {
1071 case PFSYNC_ACT_UPD_C:
1072 if (i != 255) {
1073 up = (void *)((char *)h_net +
1074 PFSYNC_HDRLEN + (i * sizeof(*up)));
1075 up->updates++;
1076 } else {
1077 h_net->count++;
1078 sc->sc_mbuf_net->m_pkthdr.len =
1079 sc->sc_mbuf_net->m_len += sizeof(*up);
1080 up = sc->sc_statep_net.u++;
1081
1082 bzero(up, sizeof(*up));
1083 bcopy(&st->id, up->id, sizeof(up->id));
1084 up->creatorid = st->creatorid;
1085 }
1086 up->timeout = st->timeout;
1087 up->expire = sp->expire;
1088 up->src = sp->src;
1089 up->dst = sp->dst;
1090 break;
1091 case PFSYNC_ACT_DEL_C:
1092 sc->sc_mbuf_net->m_pkthdr.len =
1093 sc->sc_mbuf_net->m_len += sizeof(*dp);
1094 dp = sc->sc_statep_net.d++;
1095 h_net->count++;
1096
1097 bzero(dp, sizeof(*dp));
1098 bcopy(&st->id, dp->id, sizeof(dp->id));
1099 dp->creatorid = st->creatorid;
1100 break;
1101 }
1102 }
1103
1104 if (h->count == sc->sc_maxcount ||
1105 (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates)))
1106 ret = pfsync_sendout(sc);
1107
1108 splx(s);
1109 return (ret);
1110 }
1111
1112 /* This must be called in splnet() */
1113 int
pfsync_request_update(struct pfsync_state_upd * up,struct in_addr * src)1114 pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src)
1115 {
1116 struct ifnet *ifp = &pfsyncif.sc_if;
1117 struct pfsync_header *h;
1118 struct pfsync_softc *sc = ifp->if_softc;
1119 struct pfsync_state_upd_req *rup;
1120 int ret;
1121
1122 if (sc->sc_mbuf == NULL) {
1123 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1124 (void *)&sc->sc_statep.s)) == NULL)
1125 return (ENOMEM);
1126 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1127 } else {
1128 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1129 if (h->action != PFSYNC_ACT_UREQ) {
1130 pfsync_sendout(sc);
1131 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1132 (void *)&sc->sc_statep.s)) == NULL)
1133 return (ENOMEM);
1134 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1135 }
1136 }
1137
1138 if (src != NULL)
1139 sc->sc_sendaddr = *src;
1140 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup);
1141 h->count++;
1142 rup = sc->sc_statep.r++;
1143 bzero(rup, sizeof(*rup));
1144 if (up != NULL) {
1145 bcopy(up->id, rup->id, sizeof(rup->id));
1146 rup->creatorid = up->creatorid;
1147 }
1148
1149 if (h->count == sc->sc_maxcount)
1150 ret = pfsync_sendout(sc);
1151
1152 return (ret);
1153 }
1154
1155 int
pfsync_clear_states(u_int32_t creatorid,char * ifname)1156 pfsync_clear_states(u_int32_t creatorid, char *ifname)
1157 {
1158 struct ifnet *ifp = &pfsyncif.sc_if;
1159 struct pfsync_softc *sc = ifp->if_softc;
1160 struct pfsync_state_clr *cp;
1161 int s, ret;
1162
1163 s = splnet();
1164 if (sc->sc_mbuf != NULL)
1165 pfsync_sendout(sc);
1166 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR,
1167 (void *)&sc->sc_statep.c)) == NULL) {
1168 splx(s);
1169 return (ENOMEM);
1170 }
1171 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp);
1172 cp = sc->sc_statep.c;
1173 cp->creatorid = creatorid;
1174 if (ifname != NULL)
1175 strlcpy(cp->ifname, ifname, IFNAMSIZ);
1176
1177 ret = (pfsync_sendout(sc));
1178 splx(s);
1179 return (ret);
1180 }
1181
1182 void
pfsync_timeout(void * v)1183 pfsync_timeout(void *v)
1184 {
1185 struct pfsync_softc *sc = v;
1186 int s;
1187
1188 s = splnet();
1189 pfsync_sendout(sc);
1190 splx(s);
1191 }
1192
1193 /* This must be called in splnet() */
1194 void
pfsync_send_bus(struct pfsync_softc * sc,u_int8_t status)1195 pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status)
1196 {
1197 struct pfsync_state_bus *bus;
1198
1199 if (sc->sc_mbuf != NULL)
1200 pfsync_sendout(sc);
1201
1202 if (pfsync_sync_ok &&
1203 (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS,
1204 (void *)&sc->sc_statep.b)) != NULL) {
1205 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus);
1206 bus = sc->sc_statep.b;
1207 bus->creatorid = pf_status.hostid;
1208 bus->status = status;
1209 bus->endtime = htonl(mono_time.tv_sec - sc->sc_ureq_received);
1210 pfsync_sendout(sc);
1211 }
1212 }
1213
1214 void
pfsync_bulk_update(void * v)1215 pfsync_bulk_update(void *v)
1216 {
1217 struct pfsync_softc *sc = v;
1218 int s, i = 0;
1219 struct pf_state *state;
1220
1221 s = splnet();
1222 if (sc->sc_mbuf != NULL)
1223 pfsync_sendout(sc);
1224
1225 /*
1226 * Grab at most PFSYNC_BULKPACKETS worth of states which have not
1227 * been sent since the latest request was made.
1228 */
1229 while ((state = TAILQ_FIRST(&state_updates)) != NULL &&
1230 ++i < (sc->sc_maxcount * PFSYNC_BULKPACKETS)) {
1231 if (state->pfsync_time > sc->sc_ureq_received) {
1232 /* we're done */
1233 pfsync_send_bus(sc, PFSYNC_BUS_END);
1234 sc->sc_ureq_received = 0;
1235 timeout_del(&sc->sc_bulk_tmo);
1236 if (pf_status.debug >= PF_DEBUG_MISC)
1237 printf("pfsync: bulk update complete\n");
1238 break;
1239 } else {
1240 /* send an update and move to end of list */
1241 if (!state->sync_flags)
1242 pfsync_pack_state(PFSYNC_ACT_UPD, state, 0);
1243 state->pfsync_time = mono_time.tv_sec;
1244 TAILQ_REMOVE(&state_updates, state, u.s.entry_updates);
1245 TAILQ_INSERT_TAIL(&state_updates, state,
1246 u.s.entry_updates);
1247
1248 /* look again for more in a bit */
1249 timeout_add(&sc->sc_bulk_tmo, 1);
1250 }
1251 }
1252 if (sc->sc_mbuf != NULL)
1253 pfsync_sendout(sc);
1254 splx(s);
1255 }
1256
1257 void
pfsync_bulkfail(void * v)1258 pfsync_bulkfail(void *v)
1259 {
1260 struct pfsync_softc *sc = v;
1261 int s, error;
1262
1263 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
1264 /* Try again in a bit */
1265 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
1266 s = splnet();
1267 error = pfsync_request_update(NULL, NULL);
1268 if (error == ENOMEM) {
1269 if (pf_status.debug >= PF_DEBUG_MISC)
1270 printf("pfsync: cannot allocate mbufs for "
1271 "bulk update\n");
1272 } else
1273 pfsync_sendout(sc);
1274 splx(s);
1275 } else {
1276 /* Pretend like the transfer was ok */
1277 sc->sc_ureq_sent = 0;
1278 sc->sc_bulk_tries = 0;
1279 #if NCARP > 0
1280 if (!pfsync_sync_ok)
1281 carp_suppress_preempt--;
1282 #endif
1283 pfsync_sync_ok = 1;
1284 if (pf_status.debug >= PF_DEBUG_MISC)
1285 printf("pfsync: failed to receive "
1286 "bulk update status\n");
1287 timeout_del(&sc->sc_bulkfail_tmo);
1288 }
1289 }
1290
1291 /* This must be called in splnet() */
1292 int
pfsync_sendout(sc)1293 pfsync_sendout(sc)
1294 struct pfsync_softc *sc;
1295 {
1296 struct ifnet *ifp = &sc->sc_if;
1297 struct mbuf *m;
1298
1299 timeout_del(&sc->sc_tmo);
1300
1301 if (sc->sc_mbuf == NULL)
1302 return (0);
1303 m = sc->sc_mbuf;
1304 sc->sc_mbuf = NULL;
1305 sc->sc_statep.s = NULL;
1306
1307 #if NBPFILTER > 0
1308 if (ifp->if_bpf)
1309 bpf_mtap(ifp->if_bpf, m);
1310 #endif
1311
1312 if (sc->sc_mbuf_net) {
1313 m_freem(m);
1314 m = sc->sc_mbuf_net;
1315 sc->sc_mbuf_net = NULL;
1316 sc->sc_statep_net.s = NULL;
1317 }
1318
1319 if (sc->sc_sync_ifp) {
1320 struct ip *ip;
1321 struct ifaddr *ifa;
1322 struct sockaddr sa;
1323
1324 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
1325 if (m == NULL) {
1326 pfsyncstats.pfsyncs_onomem++;
1327 return (0);
1328 }
1329 ip = mtod(m, struct ip *);
1330 ip->ip_v = IPVERSION;
1331 ip->ip_hl = sizeof(*ip) >> 2;
1332 ip->ip_tos = IPTOS_LOWDELAY;
1333 ip->ip_len = htons(m->m_pkthdr.len);
1334 ip->ip_id = htons(ip_randomid());
1335 ip->ip_off = htons(IP_DF);
1336 ip->ip_ttl = PFSYNC_DFLTTL;
1337 ip->ip_p = IPPROTO_PFSYNC;
1338 ip->ip_sum = 0;
1339
1340 bzero(&sa, sizeof(sa));
1341 sa.sa_family = AF_INET;
1342 ifa = ifaof_ifpforaddr(&sa, sc->sc_sync_ifp);
1343 if (ifa == NULL)
1344 return (0);
1345 ip->ip_src.s_addr = ifatoia(ifa)->ia_addr.sin_addr.s_addr;
1346
1347 if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP)
1348 m->m_flags |= M_MCAST;
1349 ip->ip_dst = sc->sc_sendaddr;
1350 sc->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
1351
1352 pfsyncstats.pfsyncs_opackets++;
1353
1354 if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))
1355 pfsyncstats.pfsyncs_oerrors++;
1356 } else
1357 m_freem(m);
1358
1359 return (0);
1360 }
1361