1 /* $OpenBSD: if_pfsync.c,v 1.73 2006/11/16 13:13:38 henning Exp $ */
4 * Copyright (c) 2002 Michael Shalayeff
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26 * THE POSSIBILITY OF SUCH DAMAGE.
30 #include <sys/param.h>
32 #include <sys/systm.h>
35 #include <sys/socket.h>
36 #include <sys/ioctl.h>
37 #include <sys/timeout.h>
38 #include <sys/kernel.h>
41 #include <net/if_types.h>
42 #include <net/route.h>
44 #include <netinet/in.h>
45 #include <netinet/if_ether.h>
46 #include <netinet/tcp.h>
47 #include <netinet/tcp_seq.h>
50 #include <netinet/in_systm.h>
51 #include <netinet/in_var.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
57 #include <netinet6/nd6.h>
62 #include <netinet/ip_carp.h>
65 #include <net/pfvar.h>
66 #include <net/if_pfsync.h>
71 #define PFSYNC_MINMTU \
72 (sizeof(struct pfsync_header) + sizeof(struct pf_state))
75 #define DPRINTF(x) do { if (pfsyncdebug) printf x ; } while (0)
81 struct pfsync_softc *pfsyncif = NULL;
82 struct pfsyncstats pfsyncstats;
84 void pfsyncattach(int);
85 int pfsync_clone_create(struct if_clone *, int);
86 int pfsync_clone_destroy(struct ifnet *);
87 void pfsync_setmtu(struct pfsync_softc *, int);
88 int pfsync_alloc_scrub_memory(struct pfsync_state_peer *,
89 struct pf_state_peer *);
90 int pfsync_insert_net_state(struct pfsync_state *, u_int8_t);
91 void pfsync_update_net_tdb(struct pfsync_tdb *);
92 int pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
94 int pfsyncioctl(struct ifnet *, u_long, caddr_t);
95 void pfsyncstart(struct ifnet *);
97 struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **);
98 int pfsync_request_update(struct pfsync_state_upd *, struct in_addr *);
99 int pfsync_sendout(struct pfsync_softc *);
100 int pfsync_tdb_sendout(struct pfsync_softc *);
101 int pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *);
102 void pfsync_timeout(void *);
103 void pfsync_tdb_timeout(void *);
104 void pfsync_send_bus(struct pfsync_softc *, u_int8_t);
105 void pfsync_bulk_update(void *);
106 void pfsync_bulkfail(void *);
109 extern int ifqmaxlen;
111 struct if_clone pfsync_cloner =
112 IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy);
115 pfsyncattach(int npfsync)
117 if_clone_attach(&pfsync_cloner);
120 pfsync_clone_create(struct if_clone *ifc, int unit)
128 if ((pfsyncif = malloc(sizeof(*pfsyncif), M_DEVBUF, M_WAITOK)) == NULL)
130 bzero(pfsyncif, sizeof(*pfsyncif));
131 pfsyncif->sc_mbuf = NULL;
132 pfsyncif->sc_mbuf_net = NULL;
133 pfsyncif->sc_mbuf_tdb = NULL;
134 pfsyncif->sc_statep.s = NULL;
135 pfsyncif->sc_statep_net.s = NULL;
136 pfsyncif->sc_statep_tdb.t = NULL;
137 pfsyncif->sc_maxupdates = 128;
138 pfsyncif->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
139 pfsyncif->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP;
140 pfsyncif->sc_ureq_received = 0;
141 pfsyncif->sc_ureq_sent = 0;
142 pfsyncif->sc_bulk_send_next = NULL;
143 pfsyncif->sc_bulk_terminator = NULL;
144 ifp = &pfsyncif->sc_if;
145 snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit);
146 ifp->if_softc = pfsyncif;
147 ifp->if_ioctl = pfsyncioctl;
148 ifp->if_output = pfsyncoutput;
149 ifp->if_start = pfsyncstart;
150 ifp->if_type = IFT_PFSYNC;
151 ifp->if_snd.ifq_maxlen = ifqmaxlen;
152 ifp->if_hdrlen = PFSYNC_HDRLEN;
153 pfsync_setmtu(pfsyncif, ETHERMTU);
154 timeout_set(&pfsyncif->sc_tmo, pfsync_timeout, pfsyncif);
155 timeout_set(&pfsyncif->sc_tdb_tmo, pfsync_tdb_timeout, pfsyncif);
156 timeout_set(&pfsyncif->sc_bulk_tmo, pfsync_bulk_update, pfsyncif);
157 timeout_set(&pfsyncif->sc_bulkfail_tmo, pfsync_bulkfail, pfsyncif);
162 if_addgroup(ifp, "carp");
166 bpfattach(&pfsyncif->sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
173 pfsync_clone_destroy(struct ifnet *ifp)
179 free(pfsyncif, M_DEVBUF);
185 * Start output on the pfsync interface.
188 pfsyncstart(struct ifnet *ifp)
195 IF_DROP(&ifp->if_snd);
196 IF_DEQUEUE(&ifp->if_snd, m);
207 pfsync_alloc_scrub_memory(struct pfsync_state_peer *s,
208 struct pf_state_peer *d)
210 if (s->scrub.scrub_flag && d->scrub == NULL) {
211 d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
212 if (d->scrub == NULL)
214 bzero(d->scrub, sizeof(*d->scrub));
221 pfsync_insert_net_state(struct pfsync_state *sp, u_int8_t chksum_flag)
223 struct pf_state *st = NULL;
224 struct pf_rule *r = NULL;
227 if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
228 printf("pfsync_insert_net_state: invalid creator id:"
229 " %08x\n", ntohl(sp->creatorid));
233 kif = pfi_kif_get(sp->ifname);
235 if (pf_status.debug >= PF_DEBUG_MISC)
236 printf("pfsync_insert_net_state: "
237 "unknown interface: %s\n", sp->ifname);
238 /* skip this state */
243 * If the ruleset checksums match, it's safe to associate the state
244 * with the rule of that number.
246 if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) && chksum_flag)
247 r = pf_main_ruleset.rules[
248 PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)];
250 r = &pf_default_rule;
252 if (!r->max_states || r->states < r->max_states)
253 st = pool_get(&pf_state_pl, PR_NOWAIT);
255 pfi_kif_unref(kif, PFI_KIF_REF_NONE);
258 bzero(st, sizeof(*st));
260 /* allocate memory for scrub info */
261 if (pfsync_alloc_scrub_memory(&sp->src, &st->src) ||
262 pfsync_alloc_scrub_memory(&sp->dst, &st->dst)) {
263 pfi_kif_unref(kif, PFI_KIF_REF_NONE);
265 pool_put(&pf_state_scrub_pl, st->src.scrub);
266 pool_put(&pf_state_pl, st);
271 /* XXX get pointers to nat_rule and anchor */
273 /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
276 /* fill in the rest of the state entry */
277 pf_state_host_ntoh(&sp->lan, &st->lan);
278 pf_state_host_ntoh(&sp->gwy, &st->gwy);
279 pf_state_host_ntoh(&sp->ext, &st->ext);
281 pf_state_peer_ntoh(&sp->src, &st->src);
282 pf_state_peer_ntoh(&sp->dst, &st->dst);
284 bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
285 st->creation = time_second - ntohl(sp->creation);
286 st->expire = ntohl(sp->expire) + time_second;
289 st->proto = sp->proto;
290 st->direction = sp->direction;
292 st->timeout = sp->timeout;
293 st->allow_opts = sp->allow_opts;
295 bcopy(sp->id, &st->id, sizeof(st->id));
296 st->creatorid = sp->creatorid;
297 st->sync_flags = PFSTATE_FROMSYNC;
299 if (pf_insert_state(kif, st)) {
300 pfi_kif_unref(kif, PFI_KIF_REF_NONE);
301 /* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */
304 pool_put(&pf_state_scrub_pl, st->dst.scrub);
306 pool_put(&pf_state_scrub_pl, st->src.scrub);
307 pool_put(&pf_state_pl, st);
315 pfsync_input(struct mbuf *m, ...)
317 struct ip *ip = mtod(m, struct ip *);
318 struct pfsync_header *ph;
319 struct pfsync_softc *sc = pfsyncif;
321 struct pf_state_cmp key;
322 struct pfsync_state *sp;
323 struct pfsync_state_upd *up;
324 struct pfsync_state_del *dp;
325 struct pfsync_state_clr *cp;
326 struct pfsync_state_upd_req *rup;
327 struct pfsync_state_bus *bus;
328 struct pfsync_tdb *pt;
331 int iplen, action, error, i, s, count, offp, sfail, stale = 0;
332 u_int8_t chksum_flag = 0;
334 pfsyncstats.pfsyncs_ipackets++;
336 /* verify that we have a sync interface configured */
337 if (!sc || !sc->sc_sync_ifp || !pf_status.running)
340 /* verify that the packet came in on the right interface */
341 if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) {
342 pfsyncstats.pfsyncs_badif++;
346 /* verify that the IP TTL is 255. */
347 if (ip->ip_ttl != PFSYNC_DFLTTL) {
348 pfsyncstats.pfsyncs_badttl++;
352 iplen = ip->ip_hl << 2;
354 if (m->m_pkthdr.len < iplen + sizeof(*ph)) {
355 pfsyncstats.pfsyncs_hdrops++;
359 if (iplen + sizeof(*ph) > m->m_len) {
360 if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) {
361 pfsyncstats.pfsyncs_hdrops++;
364 ip = mtod(m, struct ip *);
366 ph = (struct pfsync_header *)((char *)ip + iplen);
368 /* verify the version */
369 if (ph->version != PFSYNC_VERSION) {
370 pfsyncstats.pfsyncs_badver++;
377 /* make sure it's a valid action code */
378 if (action >= PFSYNC_ACT_MAX) {
379 pfsyncstats.pfsyncs_badact++;
383 /* Cheaper to grab this now than having to mess with mbufs later */
386 if (!bcmp(&ph->pf_chksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
390 case PFSYNC_ACT_CLR: {
391 struct pf_state *nexts;
394 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
395 sizeof(*cp), &offp)) == NULL) {
396 pfsyncstats.pfsyncs_badlen++;
399 cp = (struct pfsync_state_clr *)(mp->m_data + offp);
400 creatorid = cp->creatorid;
403 if (cp->ifname[0] == '\0') {
404 for (st = RB_MIN(pf_state_tree_id, &tree_id);
406 nexts = RB_NEXT(pf_state_tree_id, &tree_id, st);
407 if (st->creatorid == creatorid) {
408 st->sync_flags |= PFSTATE_FROMSYNC;
413 if ((kif = pfi_kif_get(cp->ifname)) == NULL) {
417 for (st = RB_MIN(pf_state_tree_lan_ext,
418 &kif->pfik_lan_ext); st; st = nexts) {
419 nexts = RB_NEXT(pf_state_tree_lan_ext,
420 &kif->pfik_lan_ext, st);
421 if (st->creatorid == creatorid) {
422 st->sync_flags |= PFSTATE_FROMSYNC;
432 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
433 count * sizeof(*sp), &offp)) == NULL) {
434 pfsyncstats.pfsyncs_badlen++;
439 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
440 i < count; i++, sp++) {
441 /* check for invalid values */
442 if (sp->timeout >= PFTM_MAX ||
443 sp->src.state > PF_TCPS_PROXY_DST ||
444 sp->dst.state > PF_TCPS_PROXY_DST ||
445 sp->direction > PF_OUT ||
446 (sp->af != AF_INET && sp->af != AF_INET6)) {
447 if (pf_status.debug >= PF_DEBUG_MISC)
448 printf("pfsync_insert: PFSYNC_ACT_INS: "
450 pfsyncstats.pfsyncs_badstate++;
454 if ((error = pfsync_insert_net_state(sp,
456 if (error == ENOMEM) {
466 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
467 count * sizeof(*sp), &offp)) == NULL) {
468 pfsyncstats.pfsyncs_badlen++;
473 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
474 i < count; i++, sp++) {
475 int flags = PFSYNC_FLAG_STALE;
477 /* check for invalid values */
478 if (sp->timeout >= PFTM_MAX ||
479 sp->src.state > PF_TCPS_PROXY_DST ||
480 sp->dst.state > PF_TCPS_PROXY_DST) {
481 if (pf_status.debug >= PF_DEBUG_MISC)
482 printf("pfsync_insert: PFSYNC_ACT_UPD: "
484 pfsyncstats.pfsyncs_badstate++;
488 bcopy(sp->id, &key.id, sizeof(key.id));
489 key.creatorid = sp->creatorid;
491 st = pf_find_state_byid(&key);
493 /* insert the update */
494 if (pfsync_insert_net_state(sp, chksum_flag))
495 pfsyncstats.pfsyncs_badstate++;
499 if (st->proto == IPPROTO_TCP) {
501 * The state should never go backwards except
502 * for syn-proxy states. Neither should the
503 * sequence window slide backwards.
505 if (st->src.state > sp->src.state &&
506 (st->src.state < PF_TCPS_PROXY_SRC ||
507 sp->src.state >= PF_TCPS_PROXY_SRC))
509 else if (SEQ_GT(st->src.seqlo,
510 ntohl(sp->src.seqlo)))
512 else if (st->dst.state > sp->dst.state) {
513 /* There might still be useful
514 * information about the src state here,
515 * so import that part of the update,
516 * then "fail" so we send the updated
517 * state back to the peer who is missing
518 * our what we know. */
519 pf_state_peer_ntoh(&sp->src, &st->src);
520 /* XXX do anything with timeouts? */
523 } else if (st->dst.state >= TCPS_SYN_SENT &&
524 SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo)))
528 * Non-TCP protocol state machine always go
531 if (st->src.state > sp->src.state)
533 else if (st->dst.state > sp->dst.state)
537 if (pf_status.debug >= PF_DEBUG_MISC)
538 printf("pfsync: %s stale update "
541 (sfail < 7 ? "ignoring"
544 ntohl(st->creatorid));
545 pfsyncstats.pfsyncs_badstate++;
547 if (!(sp->sync_flags & PFSTATE_STALE)) {
548 /* we have a better state, send it */
549 if (sc->sc_mbuf != NULL && !stale)
554 PFSYNC_ACT_UPD, st, flags);
558 pfsync_alloc_scrub_memory(&sp->dst, &st->dst);
559 pf_state_peer_ntoh(&sp->src, &st->src);
560 pf_state_peer_ntoh(&sp->dst, &st->dst);
561 st->expire = ntohl(sp->expire) + time_second;
562 st->timeout = sp->timeout;
564 if (stale && sc->sc_mbuf != NULL)
569 * It's not strictly necessary for us to support the "uncompressed"
570 * delete action, but it's relatively simple and maintains consistency.
573 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
574 count * sizeof(*sp), &offp)) == NULL) {
575 pfsyncstats.pfsyncs_badlen++;
580 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
581 i < count; i++, sp++) {
582 bcopy(sp->id, &key.id, sizeof(key.id));
583 key.creatorid = sp->creatorid;
585 st = pf_find_state_byid(&key);
587 pfsyncstats.pfsyncs_badstate++;
590 st->sync_flags |= PFSTATE_FROMSYNC;
595 case PFSYNC_ACT_UPD_C: {
596 int update_requested = 0;
598 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
599 count * sizeof(*up), &offp)) == NULL) {
600 pfsyncstats.pfsyncs_badlen++;
605 for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp);
606 i < count; i++, up++) {
607 /* check for invalid values */
608 if (up->timeout >= PFTM_MAX ||
609 up->src.state > PF_TCPS_PROXY_DST ||
610 up->dst.state > PF_TCPS_PROXY_DST) {
611 if (pf_status.debug >= PF_DEBUG_MISC)
612 printf("pfsync_insert: "
615 pfsyncstats.pfsyncs_badstate++;
619 bcopy(up->id, &key.id, sizeof(key.id));
620 key.creatorid = up->creatorid;
622 st = pf_find_state_byid(&key);
624 /* We don't have this state. Ask for it. */
625 error = pfsync_request_update(up, &src);
626 if (error == ENOMEM) {
630 update_requested = 1;
631 pfsyncstats.pfsyncs_badstate++;
635 if (st->proto == IPPROTO_TCP) {
637 * The state should never go backwards except
638 * for syn-proxy states. Neither should the
639 * sequence window slide backwards.
641 if (st->src.state > up->src.state &&
642 (st->src.state < PF_TCPS_PROXY_SRC ||
643 up->src.state >= PF_TCPS_PROXY_SRC))
645 else if (st->dst.state > up->dst.state)
647 else if (SEQ_GT(st->src.seqlo,
648 ntohl(up->src.seqlo)))
650 else if (st->dst.state >= TCPS_SYN_SENT &&
651 SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo)))
655 * Non-TCP protocol state machine always go
658 if (st->src.state > up->src.state)
660 else if (st->dst.state > up->dst.state)
664 if (pf_status.debug >= PF_DEBUG_MISC)
665 printf("pfsync: ignoring stale update "
667 "creatorid: %08x\n", sfail,
669 ntohl(st->creatorid));
670 pfsyncstats.pfsyncs_badstate++;
672 /* we have a better state, send it out */
673 if ((!stale || update_requested) &&
674 sc->sc_mbuf != NULL) {
676 update_requested = 0;
680 pfsync_pack_state(PFSYNC_ACT_UPD, st,
684 pfsync_alloc_scrub_memory(&up->dst, &st->dst);
685 pf_state_peer_ntoh(&up->src, &st->src);
686 pf_state_peer_ntoh(&up->dst, &st->dst);
687 st->expire = ntohl(up->expire) + time_second;
688 st->timeout = up->timeout;
690 if ((update_requested || stale) && sc->sc_mbuf)
695 case PFSYNC_ACT_DEL_C:
696 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
697 count * sizeof(*dp), &offp)) == NULL) {
698 pfsyncstats.pfsyncs_badlen++;
703 for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp);
704 i < count; i++, dp++) {
705 bcopy(dp->id, &key.id, sizeof(key.id));
706 key.creatorid = dp->creatorid;
708 st = pf_find_state_byid(&key);
710 pfsyncstats.pfsyncs_badstate++;
713 st->sync_flags |= PFSTATE_FROMSYNC;
718 case PFSYNC_ACT_INS_F:
719 case PFSYNC_ACT_DEL_F:
720 /* not implemented */
722 case PFSYNC_ACT_UREQ:
723 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
724 count * sizeof(*rup), &offp)) == NULL) {
725 pfsyncstats.pfsyncs_badlen++;
730 if (sc->sc_mbuf != NULL)
733 rup = (struct pfsync_state_upd_req *)(mp->m_data + offp);
734 i < count; i++, rup++) {
735 bcopy(rup->id, &key.id, sizeof(key.id));
736 key.creatorid = rup->creatorid;
738 if (key.id == 0 && key.creatorid == 0) {
739 sc->sc_ureq_received = time_uptime;
740 if (sc->sc_bulk_send_next == NULL)
741 sc->sc_bulk_send_next =
742 TAILQ_FIRST(&state_list);
743 sc->sc_bulk_terminator = sc->sc_bulk_send_next;
744 if (pf_status.debug >= PF_DEBUG_MISC)
745 printf("pfsync: received "
746 "bulk update request\n");
747 pfsync_send_bus(sc, PFSYNC_BUS_START);
748 timeout_add(&sc->sc_bulk_tmo, 1 * hz);
750 st = pf_find_state_byid(&key);
752 pfsyncstats.pfsyncs_badstate++;
756 pfsync_pack_state(PFSYNC_ACT_UPD,
760 if (sc->sc_mbuf != NULL)
765 /* If we're not waiting for a bulk update, who cares. */
766 if (sc->sc_ureq_sent == 0)
769 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
770 sizeof(*bus), &offp)) == NULL) {
771 pfsyncstats.pfsyncs_badlen++;
774 bus = (struct pfsync_state_bus *)(mp->m_data + offp);
775 switch (bus->status) {
776 case PFSYNC_BUS_START:
777 timeout_add(&sc->sc_bulkfail_tmo,
778 pf_pool_limits[PF_LIMIT_STATES].limit /
779 (PFSYNC_BULKPACKETS * sc->sc_maxcount));
780 if (pf_status.debug >= PF_DEBUG_MISC)
781 printf("pfsync: received bulk "
785 if (time_uptime - ntohl(bus->endtime) >=
787 /* that's it, we're happy */
788 sc->sc_ureq_sent = 0;
789 sc->sc_bulk_tries = 0;
790 timeout_del(&sc->sc_bulkfail_tmo);
793 carp_group_demote_adj(&sc->sc_if, -1);
796 if (pf_status.debug >= PF_DEBUG_MISC)
797 printf("pfsync: received valid "
798 "bulk update end\n");
800 if (pf_status.debug >= PF_DEBUG_MISC)
801 printf("pfsync: received invalid "
802 "bulk update end: bad timestamp\n");
807 case PFSYNC_ACT_TDB_UPD:
808 if ((mp = m_pulldown(m, iplen + sizeof(*ph),
809 count * sizeof(*pt), &offp)) == NULL) {
810 pfsyncstats.pfsyncs_badlen++;
814 for (i = 0, pt = (struct pfsync_tdb *)(mp->m_data + offp);
815 i < count; i++, pt++)
816 pfsync_update_net_tdb(pt);
827 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
836 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
838 struct proc *p = curproc;
839 struct pfsync_softc *sc = ifp->if_softc;
840 struct ifreq *ifr = (struct ifreq *)data;
841 struct ip_moptions *imo = &sc->sc_imo;
842 struct pfsyncreq pfsyncr;
851 if (ifp->if_flags & IFF_UP)
852 ifp->if_flags |= IFF_RUNNING;
854 ifp->if_flags &= ~IFF_RUNNING;
857 if (ifr->ifr_mtu < PFSYNC_MINMTU)
859 if (ifr->ifr_mtu > MCLBYTES)
860 ifr->ifr_mtu = MCLBYTES;
862 if (ifr->ifr_mtu < ifp->if_mtu)
864 pfsync_setmtu(sc, ifr->ifr_mtu);
868 bzero(&pfsyncr, sizeof(pfsyncr));
870 strlcpy(pfsyncr.pfsyncr_syncdev,
871 sc->sc_sync_ifp->if_xname, IFNAMSIZ);
872 pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer;
873 pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
874 if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr))))
878 if ((error = suser(p, p->p_acflag)) != 0)
880 if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
883 if (pfsyncr.pfsyncr_syncpeer.s_addr == 0)
884 sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
886 sc->sc_sync_peer.s_addr =
887 pfsyncr.pfsyncr_syncpeer.s_addr;
889 if (pfsyncr.pfsyncr_maxupdates > 255)
891 sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
893 if (pfsyncr.pfsyncr_syncdev[0] == 0) {
894 sc->sc_sync_ifp = NULL;
895 if (sc->sc_mbuf_net != NULL) {
896 /* Don't keep stale pfsync packets around. */
898 m_freem(sc->sc_mbuf_net);
899 sc->sc_mbuf_net = NULL;
900 sc->sc_statep_net.s = NULL;
903 if (imo->imo_num_memberships > 0) {
904 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
905 imo->imo_multicast_ifp = NULL;
910 if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL)
914 if (sifp->if_mtu < sc->sc_if.if_mtu ||
915 (sc->sc_sync_ifp != NULL &&
916 sifp->if_mtu < sc->sc_sync_ifp->if_mtu) ||
917 sifp->if_mtu < MCLBYTES - sizeof(struct ip))
919 sc->sc_sync_ifp = sifp;
921 pfsync_setmtu(sc, sc->sc_if.if_mtu);
923 if (imo->imo_num_memberships > 0) {
924 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
925 imo->imo_multicast_ifp = NULL;
928 if (sc->sc_sync_ifp &&
929 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
932 if (!(sc->sc_sync_ifp->if_flags & IFF_MULTICAST)) {
933 sc->sc_sync_ifp = NULL;
935 return (EADDRNOTAVAIL);
938 addr.s_addr = INADDR_PFSYNC_GROUP;
940 if ((imo->imo_membership[0] =
941 in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) {
942 sc->sc_sync_ifp = NULL;
946 imo->imo_num_memberships++;
947 imo->imo_multicast_ifp = sc->sc_sync_ifp;
948 imo->imo_multicast_ttl = PFSYNC_DFLTTL;
949 imo->imo_multicast_loop = 0;
952 if (sc->sc_sync_ifp ||
953 sc->sc_sendaddr.s_addr != INADDR_PFSYNC_GROUP) {
954 /* Request a full state table update. */
955 sc->sc_ureq_sent = time_uptime;
958 carp_group_demote_adj(&sc->sc_if, 1);
961 if (pf_status.debug >= PF_DEBUG_MISC)
962 printf("pfsync: requesting bulk update\n");
963 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
964 error = pfsync_request_update(NULL, NULL);
965 if (error == ENOMEM) {
983 pfsync_setmtu(struct pfsync_softc *sc, int mtu_req)
987 if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req)
988 mtu = sc->sc_sync_ifp->if_mtu;
992 sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) /
993 sizeof(struct pfsync_state);
994 if (sc->sc_maxcount > 254)
995 sc->sc_maxcount = 254;
996 sc->sc_if.if_mtu = sizeof(struct pfsync_header) +
997 sc->sc_maxcount * sizeof(struct pfsync_state);
1001 pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp)
1003 struct pfsync_header *h;
1007 MGETHDR(m, M_DONTWAIT, MT_DATA);
1009 sc->sc_if.if_oerrors++;
1014 case PFSYNC_ACT_CLR:
1015 len = sizeof(struct pfsync_header) +
1016 sizeof(struct pfsync_state_clr);
1018 case PFSYNC_ACT_UPD_C:
1019 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) +
1020 sizeof(struct pfsync_header);
1022 case PFSYNC_ACT_DEL_C:
1023 len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) +
1024 sizeof(struct pfsync_header);
1026 case PFSYNC_ACT_UREQ:
1027 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) +
1028 sizeof(struct pfsync_header);
1030 case PFSYNC_ACT_BUS:
1031 len = sizeof(struct pfsync_header) +
1032 sizeof(struct pfsync_state_bus);
1034 case PFSYNC_ACT_TDB_UPD:
1035 len = (sc->sc_maxcount * sizeof(struct pfsync_tdb)) +
1036 sizeof(struct pfsync_header);
1039 len = (sc->sc_maxcount * sizeof(struct pfsync_state)) +
1040 sizeof(struct pfsync_header);
1045 MCLGET(m, M_DONTWAIT);
1046 if ((m->m_flags & M_EXT) == 0) {
1048 sc->sc_if.if_oerrors++;
1051 m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1);
1055 m->m_pkthdr.rcvif = NULL;
1056 m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header);
1057 h = mtod(m, struct pfsync_header *);
1058 h->version = PFSYNC_VERSION;
1062 if (action != PFSYNC_ACT_TDB_UPD)
1063 bcopy(&pf_status.pf_chksum, &h->pf_chksum,
1064 PF_MD5_DIGEST_LENGTH);
1066 *sp = (void *)((char *)h + PFSYNC_HDRLEN);
1067 if (action == PFSYNC_ACT_TDB_UPD)
1068 timeout_add(&sc->sc_tdb_tmo, hz);
1070 timeout_add(&sc->sc_tmo, hz);
1075 pfsync_pack_state(u_int8_t action, struct pf_state *st, int flags)
1077 struct ifnet *ifp = NULL;
1078 struct pfsync_softc *sc = pfsyncif;
1079 struct pfsync_header *h, *h_net;
1080 struct pfsync_state *sp = NULL;
1081 struct pfsync_state_upd *up = NULL;
1082 struct pfsync_state_del *dp = NULL;
1086 u_int8_t i = 255, newaction = 0;
1093 * If a packet falls in the forest and there's nobody around to
1094 * hear, does it make a sound?
1096 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL &&
1097 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
1098 /* Don't leave any stale pfsync packets hanging around. */
1099 if (sc->sc_mbuf != NULL) {
1100 m_freem(sc->sc_mbuf);
1102 sc->sc_statep.s = NULL;
1107 if (action >= PFSYNC_ACT_MAX)
1111 if (sc->sc_mbuf == NULL) {
1112 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
1113 (void *)&sc->sc_statep.s)) == NULL) {
1117 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1119 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1120 if (h->action != action) {
1122 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
1123 (void *)&sc->sc_statep.s)) == NULL) {
1127 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1130 * If it's an update, look in the packet to see if
1131 * we already have an update for the state.
1133 if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) {
1134 struct pfsync_state *usp =
1135 (void *)((char *)h + PFSYNC_HDRLEN);
1137 for (i = 0; i < h->count; i++) {
1138 if (!memcmp(usp->id, &st->id,
1140 usp->creatorid == st->creatorid) {
1153 st->pfsync_time = time_uptime;
1156 /* not a "duplicate" update */
1158 sp = sc->sc_statep.s++;
1159 sc->sc_mbuf->m_pkthdr.len =
1160 sc->sc_mbuf->m_len += sizeof(struct pfsync_state);
1162 bzero(sp, sizeof(*sp));
1164 bcopy(&st->id, sp->id, sizeof(sp->id));
1165 sp->creatorid = st->creatorid;
1167 strlcpy(sp->ifname, st->u.s.kif->pfik_name, sizeof(sp->ifname));
1168 pf_state_host_hton(&st->lan, &sp->lan);
1169 pf_state_host_hton(&st->gwy, &sp->gwy);
1170 pf_state_host_hton(&st->ext, &sp->ext);
1172 bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
1174 sp->creation = htonl(secs - st->creation);
1175 pf_state_counter_hton(st->packets[0], sp->packets[0]);
1176 pf_state_counter_hton(st->packets[1], sp->packets[1]);
1177 pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
1178 pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
1179 if ((r = st->rule.ptr) == NULL)
1180 sp->rule = htonl(-1);
1182 sp->rule = htonl(r->nr);
1183 if ((r = st->anchor.ptr) == NULL)
1184 sp->anchor = htonl(-1);
1186 sp->anchor = htonl(r->nr);
1188 sp->proto = st->proto;
1189 sp->direction = st->direction;
1191 sp->allow_opts = st->allow_opts;
1192 sp->timeout = st->timeout;
1194 if (flags & PFSYNC_FLAG_STALE)
1195 sp->sync_flags |= PFSTATE_STALE;
1198 pf_state_peer_hton(&st->src, &sp->src);
1199 pf_state_peer_hton(&st->dst, &sp->dst);
1201 if (st->expire <= secs)
1202 sp->expire = htonl(0);
1204 sp->expire = htonl(st->expire - secs);
1206 /* do we need to build "compressed" actions for network transfer? */
1207 if (sc->sc_sync_ifp && flags & PFSYNC_FLAG_COMPRESS) {
1209 case PFSYNC_ACT_UPD:
1210 newaction = PFSYNC_ACT_UPD_C;
1212 case PFSYNC_ACT_DEL:
1213 newaction = PFSYNC_ACT_DEL_C;
1216 /* by default we just send the uncompressed states */
1222 if (sc->sc_mbuf_net == NULL) {
1223 if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction,
1224 (void *)&sc->sc_statep_net.s)) == NULL) {
1229 h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *);
1231 switch (newaction) {
1232 case PFSYNC_ACT_UPD_C:
1234 up = (void *)((char *)h_net +
1235 PFSYNC_HDRLEN + (i * sizeof(*up)));
1239 sc->sc_mbuf_net->m_pkthdr.len =
1240 sc->sc_mbuf_net->m_len += sizeof(*up);
1241 up = sc->sc_statep_net.u++;
1243 bzero(up, sizeof(*up));
1244 bcopy(&st->id, up->id, sizeof(up->id));
1245 up->creatorid = st->creatorid;
1247 up->timeout = st->timeout;
1248 up->expire = sp->expire;
1252 case PFSYNC_ACT_DEL_C:
1253 sc->sc_mbuf_net->m_pkthdr.len =
1254 sc->sc_mbuf_net->m_len += sizeof(*dp);
1255 dp = sc->sc_statep_net.d++;
1258 bzero(dp, sizeof(*dp));
1259 bcopy(&st->id, dp->id, sizeof(dp->id));
1260 dp->creatorid = st->creatorid;
1265 if (h->count == sc->sc_maxcount ||
1266 (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates)))
1267 ret = pfsync_sendout(sc);
1273 /* This must be called in splnet() */
1275 pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src)
1277 struct ifnet *ifp = NULL;
1278 struct pfsync_header *h;
1279 struct pfsync_softc *sc = pfsyncif;
1280 struct pfsync_state_upd_req *rup;
1287 if (sc->sc_mbuf == NULL) {
1288 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1289 (void *)&sc->sc_statep.s)) == NULL)
1291 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1293 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1294 if (h->action != PFSYNC_ACT_UREQ) {
1296 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1297 (void *)&sc->sc_statep.s)) == NULL)
1299 h = mtod(sc->sc_mbuf, struct pfsync_header *);
1304 sc->sc_sendaddr = *src;
1305 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup);
1307 rup = sc->sc_statep.r++;
1308 bzero(rup, sizeof(*rup));
1310 bcopy(up->id, rup->id, sizeof(rup->id));
1311 rup->creatorid = up->creatorid;
1314 if (h->count == sc->sc_maxcount)
1315 ret = pfsync_sendout(sc);
1321 pfsync_clear_states(u_int32_t creatorid, char *ifname)
1323 struct ifnet *ifp = NULL;
1324 struct pfsync_softc *sc = pfsyncif;
1325 struct pfsync_state_clr *cp;
1333 if (sc->sc_mbuf != NULL)
1335 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR,
1336 (void *)&sc->sc_statep.c)) == NULL) {
1340 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp);
1341 cp = sc->sc_statep.c;
1342 cp->creatorid = creatorid;
1344 strlcpy(cp->ifname, ifname, IFNAMSIZ);
1346 ret = (pfsync_sendout(sc));
1352 pfsync_timeout(void *v)
1354 struct pfsync_softc *sc = v;
1363 pfsync_tdb_timeout(void *v)
1365 struct pfsync_softc *sc = v;
1369 pfsync_tdb_sendout(sc);
1373 /* This must be called in splnet() */
1375 pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status)
1377 struct pfsync_state_bus *bus;
1379 if (sc->sc_mbuf != NULL)
1382 if (pfsync_sync_ok &&
1383 (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS,
1384 (void *)&sc->sc_statep.b)) != NULL) {
1385 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus);
1386 bus = sc->sc_statep.b;
1387 bus->creatorid = pf_status.hostid;
1388 bus->status = status;
1389 bus->endtime = htonl(time_uptime - sc->sc_ureq_received);
1395 pfsync_bulk_update(void *v)
1397 struct pfsync_softc *sc = v;
1399 struct pf_state *state;
1402 if (sc->sc_mbuf != NULL)
1406 * Grab at most PFSYNC_BULKPACKETS worth of states which have not
1407 * been sent since the latest request was made.
1409 state = sc->sc_bulk_send_next;
1412 /* send state update if syncable and not already sent */
1413 if (!state->sync_flags
1414 && state->timeout < PFTM_MAX
1415 && state->pfsync_time <= sc->sc_ureq_received) {
1416 pfsync_pack_state(PFSYNC_ACT_UPD, state, 0);
1420 /* figure next state to send */
1421 state = TAILQ_NEXT(state, u.s.entry_list);
1423 /* wrap to start of list if we hit the end */
1425 state = TAILQ_FIRST(&state_list);
1426 } while (i < sc->sc_maxcount * PFSYNC_BULKPACKETS &&
1427 state != sc->sc_bulk_terminator);
1429 if (!state || state == sc->sc_bulk_terminator) {
1431 pfsync_send_bus(sc, PFSYNC_BUS_END);
1432 sc->sc_ureq_received = 0;
1433 sc->sc_bulk_send_next = NULL;
1434 sc->sc_bulk_terminator = NULL;
1435 timeout_del(&sc->sc_bulk_tmo);
1436 if (pf_status.debug >= PF_DEBUG_MISC)
1437 printf("pfsync: bulk update complete\n");
1439 /* look again for more in a bit */
1440 timeout_add(&sc->sc_bulk_tmo, 1);
1441 sc->sc_bulk_send_next = state;
1443 if (sc->sc_mbuf != NULL)
1449 pfsync_bulkfail(void *v)
1451 struct pfsync_softc *sc = v;
1454 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
1455 /* Try again in a bit */
1456 timeout_add(&sc->sc_bulkfail_tmo, 5 * hz);
1458 error = pfsync_request_update(NULL, NULL);
1459 if (error == ENOMEM) {
1460 if (pf_status.debug >= PF_DEBUG_MISC)
1461 printf("pfsync: cannot allocate mbufs for "
1467 /* Pretend like the transfer was ok */
1468 sc->sc_ureq_sent = 0;
1469 sc->sc_bulk_tries = 0;
1471 if (!pfsync_sync_ok)
1472 carp_group_demote_adj(&sc->sc_if, -1);
1475 if (pf_status.debug >= PF_DEBUG_MISC)
1476 printf("pfsync: failed to receive "
1477 "bulk update status\n");
1478 timeout_del(&sc->sc_bulkfail_tmo);
1482 /* This must be called in splnet() */
1484 pfsync_sendout(struct pfsync_softc *sc)
1487 struct ifnet *ifp = &sc->sc_if;
1491 timeout_del(&sc->sc_tmo);
1493 if (sc->sc_mbuf == NULL)
1497 sc->sc_statep.s = NULL;
1501 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1504 if (sc->sc_mbuf_net) {
1506 m = sc->sc_mbuf_net;
1507 sc->sc_mbuf_net = NULL;
1508 sc->sc_statep_net.s = NULL;
1511 return pfsync_sendout_mbuf(sc, m);
1515 pfsync_tdb_sendout(struct pfsync_softc *sc)
1518 struct ifnet *ifp = &sc->sc_if;
1522 timeout_del(&sc->sc_tdb_tmo);
1524 if (sc->sc_mbuf_tdb == NULL)
1526 m = sc->sc_mbuf_tdb;
1527 sc->sc_mbuf_tdb = NULL;
1528 sc->sc_statep_tdb.t = NULL;
1532 bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1535 return pfsync_sendout_mbuf(sc, m);
1539 pfsync_sendout_mbuf(struct pfsync_softc *sc, struct mbuf *m)
1544 if (sc->sc_sync_ifp ||
1545 sc->sc_sync_peer.s_addr != INADDR_PFSYNC_GROUP) {
1546 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
1548 pfsyncstats.pfsyncs_onomem++;
1551 ip = mtod(m, struct ip *);
1552 ip->ip_v = IPVERSION;
1553 ip->ip_hl = sizeof(*ip) >> 2;
1554 ip->ip_tos = IPTOS_LOWDELAY;
1555 ip->ip_len = htons(m->m_pkthdr.len);
1556 ip->ip_id = htons(ip_randomid());
1557 ip->ip_off = htons(IP_DF);
1558 ip->ip_ttl = PFSYNC_DFLTTL;
1559 ip->ip_p = IPPROTO_PFSYNC;
1562 bzero(&sa, sizeof(sa));
1563 ip->ip_src.s_addr = INADDR_ANY;
1565 if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP)
1566 m->m_flags |= M_MCAST;
1567 ip->ip_dst = sc->sc_sendaddr;
1568 sc->sc_sendaddr.s_addr = sc->sc_sync_peer.s_addr;
1570 pfsyncstats.pfsyncs_opackets++;
1572 if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))
1573 pfsyncstats.pfsyncs_oerrors++;
1580 /* Update an in-kernel tdb. Silently fail if no tdb is found. */
1582 pfsync_update_net_tdb(struct pfsync_tdb *pt)
1587 /* check for invalid values */
1588 if (ntohl(pt->spi) <= SPI_RESERVED_MAX ||
1589 (pt->dst.sa.sa_family != AF_INET &&
1590 pt->dst.sa.sa_family != AF_INET6))
1594 tdb = gettdb(pt->spi, &pt->dst, pt->sproto);
1596 pt->rpl = ntohl(pt->rpl);
1597 pt->cur_bytes = betoh64(pt->cur_bytes);
1599 /* Neither replay nor byte counter should ever decrease. */
1600 if (pt->rpl < tdb->tdb_rpl ||
1601 pt->cur_bytes < tdb->tdb_cur_bytes) {
1606 tdb->tdb_rpl = pt->rpl;
1607 tdb->tdb_cur_bytes = pt->cur_bytes;
1613 if (pf_status.debug >= PF_DEBUG_MISC)
1614 printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: "
1616 pfsyncstats.pfsyncs_badstate++;
1620 /* One of our local tdbs have been updated, need to sync rpl with others */
1622 pfsync_update_tdb(struct tdb *tdb, int output)
1624 struct ifnet *ifp = NULL;
1625 struct pfsync_softc *sc = pfsyncif;
1626 struct pfsync_header *h;
1627 struct pfsync_tdb *pt = NULL;
1634 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL &&
1635 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
1636 /* Don't leave any stale pfsync packets hanging around. */
1637 if (sc->sc_mbuf_tdb != NULL) {
1638 m_freem(sc->sc_mbuf_tdb);
1639 sc->sc_mbuf_tdb = NULL;
1640 sc->sc_statep_tdb.t = NULL;
1646 if (sc->sc_mbuf_tdb == NULL) {
1647 if ((sc->sc_mbuf_tdb = pfsync_get_mbuf(sc, PFSYNC_ACT_TDB_UPD,
1648 (void *)&sc->sc_statep_tdb.t)) == NULL) {
1652 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
1654 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
1655 if (h->action != PFSYNC_ACT_TDB_UPD) {
1657 * XXX will never happen as long as there's
1658 * only one "TDB action".
1660 pfsync_tdb_sendout(sc);
1661 sc->sc_mbuf_tdb = pfsync_get_mbuf(sc,
1662 PFSYNC_ACT_TDB_UPD, (void *)&sc->sc_statep_tdb.t);
1663 if (sc->sc_mbuf_tdb == NULL) {
1667 h = mtod(sc->sc_mbuf_tdb, struct pfsync_header *);
1668 } else if (sc->sc_maxupdates) {
1670 * If it's an update, look in the packet to see if
1671 * we already have an update for the state.
1673 struct pfsync_tdb *u =
1674 (void *)((char *)h + PFSYNC_HDRLEN);
1676 for (i = 0; !pt && i < h->count; i++) {
1677 if (tdb->tdb_spi == u->spi &&
1678 tdb->tdb_sproto == u->sproto &&
1679 !bcmp(&tdb->tdb_dst, &u->dst,
1680 SA_LEN(&u->dst.sa))) {
1690 /* not a "duplicate" update */
1691 pt = sc->sc_statep_tdb.t++;
1692 sc->sc_mbuf_tdb->m_pkthdr.len =
1693 sc->sc_mbuf_tdb->m_len += sizeof(struct pfsync_tdb);
1695 bzero(pt, sizeof(*pt));
1697 pt->spi = tdb->tdb_spi;
1698 memcpy(&pt->dst, &tdb->tdb_dst, sizeof pt->dst);
1699 pt->sproto = tdb->tdb_sproto;
1703 * When a failover happens, the master's rpl is probably above
1704 * what we see here (we may be up to a second late), so
1705 * increase it a bit for outbound tdbs to manage most such
1708 * For now, just add an offset that is likely to be larger
1709 * than the number of packets we can see in one second. The RFC
1710 * just says the next packet must have a higher seq value.
1712 * XXX What is a good algorithm for this? We could use
1713 * a rate-determined increase, but to know it, we would have
1714 * to extend struct tdb.
1715 * XXX pt->rpl can wrap over MAXINT, but if so the real tdb
1716 * will soon be replaced anyway. For now, just don't handle
1719 #define RPL_INCR 16384
1720 pt->rpl = htonl(tdb->tdb_rpl + (output ? RPL_INCR : 0));
1721 pt->cur_bytes = htobe64(tdb->tdb_cur_bytes);
1723 if (h->count == sc->sc_maxcount ||
1724 (sc->sc_maxupdates && (pt->updates >= sc->sc_maxupdates)))
1725 ret = pfsync_tdb_sendout(sc);