xref: /dragonfly/sys/net/pf/if_pfsync.c (revision b575ab8a)
1 /*	$OpenBSD: if_pfsync.c,v 1.98 2008/06/29 08:42:15 mcbride Exp $	*/
2 
3 /*
4  * Copyright (c) 2002 Michael Shalayeff
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
22  * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
25  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
26  * THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include "opt_inet.h"
30 #include "opt_inet6.h"
31 #include "opt_carp.h"
32 
33 #include <sys/param.h>
34 #include <sys/endian.h>
35 #include <sys/proc.h>
36 #include <sys/priv.h>
37 #include <sys/systm.h>
38 #include <sys/time.h>
39 #include <sys/mbuf.h>
40 #include <sys/socket.h>
41 #include <sys/kernel.h>
42 #include <sys/malloc.h>
43 #include <sys/module.h>
44 #include <sys/sockio.h>
45 #include <sys/thread2.h>
46 
47 #include <machine/inttypes.h>
48 
49 #include <net/if.h>
50 #include <net/if_types.h>
51 #include <net/route.h>
52 #include <net/bpf.h>
53 #include <netinet/in.h>
54 #include <netinet/if_ether.h>
55 #include <netinet/ip_carp.h>
56 #include <netinet/tcp.h>
57 #include <netinet/tcp_seq.h>
58 
59 #ifdef	INET
60 #include <netinet/in_systm.h>
61 #include <netinet/in_var.h>
62 #include <netinet/ip.h>
63 #include <netinet/ip_var.h>
64 #endif
65 
66 #ifdef INET6
67 #include <netinet6/nd6.h>
68 #endif /* INET6 */
69 
70 #include <net/pf/pfvar.h>
71 #include <net/pf/if_pfsync.h>
72 
73 #define	PFSYNCNAME	"pfsync"
74 
75 #define PFSYNC_MINMTU	\
76     (sizeof(struct pfsync_header) + sizeof(struct pf_state))
77 
78 #ifdef PFSYNCDEBUG
79 #define DPRINTF(x)    do { if (pfsyncdebug) kprintf x ; } while (0)
80 int pfsyncdebug;
81 #else
82 #define DPRINTF(x)
83 #endif
84 
85 struct pfsync_softc	*pfsyncif = NULL;
86 struct pfsyncstats	 pfsyncstats;
87 
88 void	pfsyncattach(int);
89 static int	pfsync_clone_destroy(struct ifnet *);
90 static int	pfsync_clone_create(struct if_clone *, int, caddr_t);
91 void	pfsync_setmtu(struct pfsync_softc *, int);
92 int	pfsync_alloc_scrub_memory(struct pfsync_state_peer *,
93 	    struct pf_state_peer *);
94 int	pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
95 	    struct rtentry *);
96 int	pfsyncioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
97 void	pfsyncstart(struct ifnet *);
98 
99 struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **);
100 int	pfsync_request_update(struct pfsync_state_upd *, struct in_addr *);
101 int	pfsync_sendout(struct pfsync_softc *);
102 int	pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *);
103 void	pfsync_timeout(void *);
104 void	pfsync_send_bus(struct pfsync_softc *, u_int8_t);
105 void	pfsync_bulk_update(void *);
106 void	pfsync_bulkfail(void *);
107 
108 static MALLOC_DEFINE(M_PFSYNC, PFSYNCNAME, "Packet Filter State Sync. Interface");
109 static LIST_HEAD(pfsync_list, pfsync_softc) pfsync_list;
110 
111 int	pfsync_sync_ok;
112 
113 struct if_clone	pfsync_cloner =
114     IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy, 1 ,1);
115 
116 void
117 pfsyncattach(int npfsync)
118 {
119 	if_clone_attach(&pfsync_cloner);
120 }
121 static int
122 pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param __unused)
123 {
124 	struct pfsync_softc *sc;
125 	struct ifnet *ifp;
126 
127 	lwkt_gettoken(&pf_token);
128 
129 	sc = kmalloc(sizeof(*sc), M_PFSYNC, M_WAITOK | M_ZERO);
130 	pfsync_sync_ok = 1;
131 	sc->sc_mbuf = NULL;
132 	sc->sc_mbuf_net = NULL;
133 	sc->sc_mbuf_tdb = NULL;
134 	sc->sc_statep.s = NULL;
135 	sc->sc_statep_net.s = NULL;
136 	sc->sc_statep_tdb.t = NULL;
137 	sc->sc_maxupdates = 128;
138 	sc->sc_sync_peer.s_addr =htonl(INADDR_PFSYNC_GROUP);
139 	sc->sc_sendaddr.s_addr = htonl(INADDR_PFSYNC_GROUP);
140 	sc->sc_ureq_received = 0;
141 	sc->sc_ureq_sent = 0;
142 	sc->sc_bulk_send_next = NULL;
143 	sc->sc_bulk_terminator = NULL;
144 	sc->sc_imo.imo_max_memberships = IP_MAX_MEMBERSHIPS;
145 	lwkt_reltoken(&pf_token);
146 	ifp = &sc->sc_if;
147 	ksnprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit);
148 	if_initname(ifp, ifc->ifc_name, unit);
149 	ifp->if_ioctl = pfsyncioctl;
150 	ifp->if_output = pfsyncoutput;
151 	ifp->if_start = pfsyncstart;
152 	ifp->if_type = IFT_PFSYNC;
153 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
154 	ifp->if_hdrlen = PFSYNC_HDRLEN;
155 	ifp->if_baudrate = IF_Mbps(100);
156 	ifp->if_softc = sc;
157 	pfsync_setmtu(sc, MCLBYTES);
158 	callout_init(&sc->sc_tmo);
159 	/* callout_init(&sc->sc_tdb_tmo); XXX we don't support tdb (yet) */
160 	callout_init(&sc->sc_bulk_tmo);
161 	callout_init(&sc->sc_bulkfail_tmo);
162 	if_attach(ifp, NULL);
163 
164 	LIST_INSERT_HEAD(&pfsync_list, sc, sc_next);
165 
166 
167 #if NCARP > 0
168 	if_addgroup(ifp, "carp");
169 #endif
170 
171 #if NBPFILTER > 0
172 	bpfattach(&sc->sc_if, DLT_PFSYNC, PFSYNC_HDRLEN);
173 #endif
174 	lwkt_gettoken(&pf_token);
175 
176 	lwkt_reltoken(&pf_token);
177 	return (0);
178 }
179 
180 static int
181 pfsync_clone_destroy(struct ifnet *ifp)
182 {
183 	lwkt_gettoken(&pf_token);
184 	lwkt_reltoken(&pf_token);
185 
186 	struct pfsync_softc *sc = ifp->if_softc;
187 	callout_stop(&sc->sc_tmo);
188 	/* callout_stop(&sc->sc_tdb_tmo); XXX we don't support tdb (yet) */
189 	callout_stop(&sc->sc_bulk_tmo);
190 	callout_stop(&sc->sc_bulkfail_tmo);
191 #if NCARP > 0
192 	if (!pfsync_sync_ok)
193 		carp_group_demote_adj(&sc->sc_if, -1);
194 #endif
195 #if NBPFILTER > 0
196 	bpfdetach(ifp);
197 #endif
198 	if_detach(ifp);
199 	lwkt_gettoken(&pf_token);
200 	LIST_REMOVE(sc, sc_next);
201 	kfree(sc, M_PFSYNC);
202 	lwkt_reltoken(&pf_token);
203 
204 
205 	return 0;
206 }
207 
208 /*
209  * Start output on the pfsync interface.
210  */
211 void
212 pfsyncstart(struct ifnet *ifp)
213 {
214 	crit_enter();
215 	IF_DROP(&ifp->if_snd);
216 	IF_DRAIN(&ifp->if_snd);
217 	crit_exit();
218 }
219 
220 int
221 pfsync_alloc_scrub_memory(struct pfsync_state_peer *s,
222     struct pf_state_peer *d)
223 {
224 	if (s->scrub.scrub_flag && d->scrub == NULL) {
225 		d->scrub = kmalloc(sizeof(struct pf_state_scrub), M_PFSYNC, M_NOWAIT|M_ZERO);
226 
227 		if (d->scrub == NULL)
228 			return (ENOMEM);
229 	}
230 
231 	return (0);
232 }
233 
234 void
235 pfsync_state_export(struct pfsync_state *sp, struct pf_state *st)
236 {
237 	bzero(sp, sizeof(struct pfsync_state));
238 
239 	/* copy from state key */
240 	sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
241 	sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
242 	sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
243 	sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
244 	sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
245 	sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
246 	sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
247 	sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
248 	sp->proto = st->key[PF_SK_WIRE]->proto;
249 	sp->af = st->key[PF_SK_WIRE]->af;
250 
251 	/* copy from state */
252 	strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
253 	bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
254 	sp->creation = htonl(time_second - st->creation);
255 	sp->expire = pf_state_expires(st);
256 	if (sp->expire <= time_second)
257 		sp->expire = htonl(0);
258 	else
259 		sp->expire = htonl(sp->expire - time_second);
260 
261 	sp->direction = st->direction;
262 	sp->log = st->log;
263 	sp->timeout = st->timeout;
264 	sp->state_flags = st->state_flags;
265 	if (st->src_node)
266 		sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
267 	if (st->nat_src_node)
268 		sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
269 
270 	bcopy(&st->id, &sp->id, sizeof(sp->id));
271 	sp->creatorid = st->creatorid;
272 	pf_state_peer_hton(&st->src, &sp->src);
273 	pf_state_peer_hton(&st->dst, &sp->dst);
274 
275 	if (st->rule.ptr == NULL)
276 		sp->rule = htonl(-1);
277 	else
278 		sp->rule = htonl(st->rule.ptr->nr);
279 	if (st->anchor.ptr == NULL)
280 		sp->anchor = htonl(-1);
281 	else
282 		sp->anchor = htonl(st->anchor.ptr->nr);
283 	if (st->nat_rule.ptr == NULL)
284 		sp->nat_rule = htonl(-1);
285 	else
286 		sp->nat_rule = htonl(st->nat_rule.ptr->nr);
287 
288 	pf_state_counter_hton(st->packets[0], sp->packets[0]);
289 	pf_state_counter_hton(st->packets[1], sp->packets[1]);
290 	pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
291 	pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
292 
293 }
294 
295 int
296 pfsync_state_import(struct pfsync_state *sp, u_int8_t flags)
297 {
298 	struct pf_state	*st = NULL;
299 	struct pf_state_key *skw = NULL, *sks = NULL;
300 	struct pf_rule *r = NULL;
301 	struct pfi_kif	*kif;
302 	int pool_flags;
303 	int error;
304 
305 	if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
306 		kprintf("pfsync_insert_net_state: invalid creator id:"
307 		    " %08x\n", ntohl(sp->creatorid));
308 		return (EINVAL);
309 	}
310 
311 	if ((kif = pfi_kif_get(sp->ifname)) == NULL) {
312 		if (pf_status.debug >= PF_DEBUG_MISC)
313 			kprintf("pfsync_insert_net_state: "
314 			    "unknown interface: %s\n", sp->ifname);
315 		if (flags & PFSYNC_SI_IOCTL)
316 			return (EINVAL);
317 		return (0);	/* skip this state */
318 	}
319 
320 	/*
321 	 * If the ruleset checksums match or the state is coming from the ioctl,
322 	 * it's safe to associate the state with the rule of that number.
323 	 */
324 	if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) &&
325 	    (flags & (PFSYNC_SI_IOCTL | PFSYNC_SI_CKSUM)) && ntohl(sp->rule) <
326 	    pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount)
327 		r = pf_main_ruleset.rules[
328 		    PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)];
329 	else
330 		r = &pf_default_rule;
331 
332 	if ((r->max_states && r->states_cur >= r->max_states))
333 		goto cleanup;
334 
335 	if (flags & PFSYNC_SI_IOCTL)
336 		pool_flags = M_WAITOK | M_NULLOK | M_ZERO;
337 	else
338 		pool_flags = M_WAITOK | M_ZERO;
339 
340 	if ((st = kmalloc(sizeof(struct pf_state), M_PFSYNC, pool_flags)) == NULL)
341 		goto cleanup;
342 
343 	if ((skw = pf_alloc_state_key(pool_flags)) == NULL)
344 		goto cleanup;
345 
346 	if (PF_ANEQ(&sp->key[PF_SK_WIRE].addr[0],
347 	    &sp->key[PF_SK_STACK].addr[0], sp->af) ||
348 	    PF_ANEQ(&sp->key[PF_SK_WIRE].addr[1],
349 	    &sp->key[PF_SK_STACK].addr[1], sp->af) ||
350 	    sp->key[PF_SK_WIRE].port[0] != sp->key[PF_SK_STACK].port[0] ||
351 	    sp->key[PF_SK_WIRE].port[1] != sp->key[PF_SK_STACK].port[1]) {
352 		if ((sks = pf_alloc_state_key(pool_flags)) == NULL)
353 			goto cleanup;
354 	} else
355 		sks = skw;
356 
357 	/* allocate memory for scrub info */
358 	if (pfsync_alloc_scrub_memory(&sp->src, &st->src) ||
359 	    pfsync_alloc_scrub_memory(&sp->dst, &st->dst))
360 		goto cleanup;
361 
362 	/* copy to state key(s) */
363 	skw->addr[0] = sp->key[PF_SK_WIRE].addr[0];
364 	skw->addr[1] = sp->key[PF_SK_WIRE].addr[1];
365 	skw->port[0] = sp->key[PF_SK_WIRE].port[0];
366 	skw->port[1] = sp->key[PF_SK_WIRE].port[1];
367 	skw->proto = sp->proto;
368 	skw->af = sp->af;
369 	if (sks != skw) {
370 		sks->addr[0] = sp->key[PF_SK_STACK].addr[0];
371 		sks->addr[1] = sp->key[PF_SK_STACK].addr[1];
372 		sks->port[0] = sp->key[PF_SK_STACK].port[0];
373 		sks->port[1] = sp->key[PF_SK_STACK].port[1];
374 		sks->proto = sp->proto;
375 		sks->af = sp->af;
376 	}
377 
378 	/* copy to state */
379 	bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
380 	st->creation = time_second - ntohl(sp->creation);
381 	st->expire = time_second;
382 	if (sp->expire) {
383 		/* XXX No adaptive scaling. */
384 		st->expire -= r->timeout[sp->timeout] - ntohl(sp->expire);
385 	}
386 
387 	st->expire = ntohl(sp->expire) + time_second;
388 	st->direction = sp->direction;
389 	st->log = sp->log;
390 	st->timeout = sp->timeout;
391 	st->state_flags = sp->state_flags;
392 	if (!(flags & PFSYNC_SI_IOCTL))
393 		st->sync_flags = PFSTATE_FROMSYNC;
394 
395 	bcopy(sp->id, &st->id, sizeof(st->id));
396 	st->creatorid = sp->creatorid;
397 	pf_state_peer_ntoh(&sp->src, &st->src);
398 	pf_state_peer_ntoh(&sp->dst, &st->dst);
399 
400 	st->rule.ptr = r;
401 	st->nat_rule.ptr = NULL;
402 	st->anchor.ptr = NULL;
403 	st->rt_kif = NULL;
404 
405 	st->pfsync_time = 0;
406 
407 
408 	/* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
409 	r->states_cur++;
410 	r->states_tot++;
411 
412 	if ((error = pf_state_insert(kif, skw, sks, st)) != 0) {
413 		/* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */
414 		r->states_cur--;
415 		goto cleanup_state;
416 	}
417 
418 	return (0);
419 
420  cleanup:
421 	error = ENOMEM;
422 	if (skw == sks)
423 		sks = NULL;
424 	if (skw != NULL)
425 		kfree(skw, M_PFSYNC);
426 	if (sks != NULL)
427 		kfree(sks, M_PFSYNC);
428 
429  cleanup_state:	/* pf_state_insert frees the state keys */
430 	if (st) {
431 		if (st->dst.scrub)
432 			kfree(st->dst.scrub, M_PFSYNC);
433 		if (st->src.scrub)
434 			kfree(st->src.scrub, M_PFSYNC);
435 		kfree(st, M_PFSYNC);
436 	}
437 	return (error);
438 }
439 
440 void
441 pfsync_input(struct mbuf *m, ...)
442 {
443 	struct ip *ip = mtod(m, struct ip *);
444 	struct pfsync_header *ph;
445 	struct pfsync_softc *sc = pfsyncif;
446 	struct pf_state *st;
447 	struct pf_state_key *sk;
448 	struct pf_state_item *si;
449 	struct pf_state_cmp id_key;
450 	struct pfsync_state *sp;
451 	struct pfsync_state_upd *up;
452 	struct pfsync_state_del *dp;
453 	struct pfsync_state_clr *cp;
454 	struct pfsync_state_upd_req *rup;
455 	struct pfsync_state_bus *bus;
456 #ifdef IPSEC
457 	struct pfsync_tdb *pt;
458 #endif
459 	struct in_addr src;
460 	struct mbuf *mp;
461 	int iplen, action, error, i, count, offp, sfail, stale = 0;
462 	u_int8_t flags = 0;
463 
464 	/* This function is not yet called from anywhere */
465 	/* Still we assume for safety that pf_token must be held */
466 	ASSERT_LWKT_TOKEN_HELD(&pf_token);
467 
468 	pfsyncstats.pfsyncs_ipackets++;
469 
470 	/* verify that we have a sync interface configured */
471 	if (!sc || !sc->sc_sync_ifp || !pf_status.running)
472 		goto done;
473 
474 	/* verify that the packet came in on the right interface */
475 	if (sc->sc_sync_ifp != m->m_pkthdr.rcvif) {
476 		pfsyncstats.pfsyncs_badif++;
477 		goto done;
478 	}
479 
480 	/* verify that the IP TTL is 255.  */
481 	if (ip->ip_ttl != PFSYNC_DFLTTL) {
482 		pfsyncstats.pfsyncs_badttl++;
483 		goto done;
484 	}
485 
486 	iplen = ip->ip_hl << 2;
487 
488 	if (m->m_pkthdr.len < iplen + sizeof(*ph)) {
489 		pfsyncstats.pfsyncs_hdrops++;
490 		goto done;
491 	}
492 
493 	if (iplen + sizeof(*ph) > m->m_len) {
494 		if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) {
495 			pfsyncstats.pfsyncs_hdrops++;
496 			goto done;
497 		}
498 		ip = mtod(m, struct ip *);
499 	}
500 	ph = (struct pfsync_header *)((char *)ip + iplen);
501 
502 	/* verify the version */
503 	if (ph->version != PFSYNC_VERSION) {
504 		pfsyncstats.pfsyncs_badver++;
505 		goto done;
506 	}
507 
508 	action = ph->action;
509 	count = ph->count;
510 
511 	/* make sure it's a valid action code */
512 	if (action >= PFSYNC_ACT_MAX) {
513 		pfsyncstats.pfsyncs_badact++;
514 		goto done;
515 	}
516 
517 	/* Cheaper to grab this now than having to mess with mbufs later */
518 	src = ip->ip_src;
519 
520 	if (!bcmp(&ph->pf_chksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
521 		flags |= PFSYNC_SI_CKSUM;
522 
523 	switch (action) {
524 	case PFSYNC_ACT_CLR: {
525 		struct pf_state *nexts;
526 		struct pf_state_key *nextsk;
527 		struct pfi_kif *kif;
528 		u_int32_t creatorid;
529 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
530 		    sizeof(*cp), &offp)) == NULL) {
531 			pfsyncstats.pfsyncs_badlen++;
532 			return;
533 		}
534 		cp = (struct pfsync_state_clr *)(mp->m_data + offp);
535 		creatorid = cp->creatorid;
536 
537 		crit_enter();
538 		if (cp->ifname[0] == '\0') {
539 			for (st = RB_MIN(pf_state_tree_id, &tree_id);
540 			    st; st = nexts) {
541 				nexts = RB_NEXT(pf_state_tree_id, &tree_id, st);
542 				if (st->creatorid == creatorid) {
543 					st->sync_flags |= PFSTATE_FROMSYNC;
544 					pf_unlink_state(st);
545 				}
546 			}
547 		} else {
548 			if ((kif = pfi_kif_get(cp->ifname)) == NULL) {
549 				crit_exit();
550 				return;
551 			}
552 			/* XXX correct? */
553 			for (sk = RB_MIN(pf_state_tree,
554 			    &pf_statetbl); sk; sk = nextsk) {
555 				nextsk = RB_NEXT(pf_state_tree,
556 				    &pf_statetbl, sk);
557 				TAILQ_FOREACH(si, &sk->states, entry) {
558 					if (si->s->creatorid == creatorid) {
559 						si->s->sync_flags |=
560 						    PFSTATE_FROMSYNC;
561 						pf_unlink_state(si->s);
562 					}
563 				}
564 			}
565 		}
566 		crit_exit();
567 
568 		break;
569 	}
570 	case PFSYNC_ACT_INS:
571 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
572 		    count * sizeof(*sp), &offp)) == NULL) {
573 			pfsyncstats.pfsyncs_badlen++;
574 			return;
575 		}
576 
577 		crit_enter();
578 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
579 		    i < count; i++, sp++) {
580 			/* check for invalid values */
581 			if (sp->timeout >= PFTM_MAX ||
582 			    sp->src.state > PF_TCPS_PROXY_DST ||
583 			    sp->dst.state > PF_TCPS_PROXY_DST ||
584 			    sp->direction > PF_OUT ||
585 			    (sp->af != AF_INET && sp->af != AF_INET6)) {
586 				if (pf_status.debug >= PF_DEBUG_MISC)
587 					kprintf("pfsync_insert: PFSYNC_ACT_INS: "
588 					    "invalid value\n");
589 				pfsyncstats.pfsyncs_badval++;
590 				continue;
591 			}
592 
593 			if ((error = pfsync_state_import(sp, flags))) {
594 				if (error == ENOMEM) {
595 					crit_exit();
596 					goto done;
597 				}
598 				continue;
599 			}
600 		}
601 		crit_exit();
602 		break;
603 	case PFSYNC_ACT_UPD:
604 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
605 		    count * sizeof(*sp), &offp)) == NULL) {
606 			pfsyncstats.pfsyncs_badlen++;
607 			return;
608 		}
609 
610 		crit_enter();
611 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
612 		    i < count; i++, sp++) {
613 			int flags = PFSYNC_FLAG_STALE;
614 
615 			/* check for invalid values */
616 			if (sp->timeout >= PFTM_MAX ||
617 			    sp->src.state > PF_TCPS_PROXY_DST ||
618 			    sp->dst.state > PF_TCPS_PROXY_DST) {
619 				if (pf_status.debug >= PF_DEBUG_MISC)
620 					kprintf("pfsync_insert: PFSYNC_ACT_UPD: "
621 					    "invalid value\n");
622 				pfsyncstats.pfsyncs_badval++;
623 				continue;
624 			}
625 
626 			bcopy(sp->id, &id_key.id, sizeof(id_key.id));
627 			id_key.creatorid = sp->creatorid;
628 
629 			st = pf_find_state_byid(&id_key);
630 			if (st == NULL) {
631 				/* insert the update */
632 				if (pfsync_state_import(sp, flags))
633 					pfsyncstats.pfsyncs_badstate++;
634 				continue;
635 			}
636 			sk = st->key[PF_SK_WIRE];	/* XXX right one? */
637 			sfail = 0;
638 			if (sk->proto == IPPROTO_TCP) {
639 				/*
640 				 * The state should never go backwards except
641 				 * for syn-proxy states.  Neither should the
642 				 * sequence window slide backwards.
643 				 */
644 				if (st->src.state > sp->src.state &&
645 				    (st->src.state < PF_TCPS_PROXY_SRC ||
646 				    sp->src.state >= PF_TCPS_PROXY_SRC))
647 					sfail = 1;
648 				else if (SEQ_GT(st->src.seqlo,
649 				    ntohl(sp->src.seqlo)))
650 					sfail = 3;
651 				else if (st->dst.state > sp->dst.state) {
652 					/* There might still be useful
653 					 * information about the src state here,
654 					 * so import that part of the update,
655 					 * then "fail" so we send the updated
656 					 * state back to the peer who is missing
657 					 * our what we know. */
658 					pf_state_peer_ntoh(&sp->src, &st->src);
659 					/* XXX do anything with timeouts? */
660 					sfail = 7;
661 					flags = 0;
662 				} else if (st->dst.state >= TCPS_SYN_SENT &&
663 				    SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo)))
664 					sfail = 4;
665 			} else {
666 				/*
667 				 * Non-TCP protocol state machine always go
668 				 * forwards
669 				 */
670 				if (st->src.state > sp->src.state)
671 					sfail = 5;
672 				else if (st->dst.state > sp->dst.state)
673 					sfail = 6;
674 			}
675 			if (sfail) {
676 				if (pf_status.debug >= PF_DEBUG_MISC)
677 					kprintf("pfsync: %s stale update "
678 					    "(%d) id: %016jx "
679 					    "creatorid: %08x\n",
680 					    (sfail < 7 ?  "ignoring"
681 					     : "partial"), sfail,
682 					    (uintmax_t)be64toh(st->id),
683 					    ntohl(st->creatorid));
684 				pfsyncstats.pfsyncs_stale++;
685 
686 				if (!(sp->sync_flags & PFSTATE_STALE)) {
687 					/* we have a better state, send it */
688 					if (sc->sc_mbuf != NULL && !stale)
689 						pfsync_sendout(sc);
690 					stale++;
691 					if (!st->sync_flags)
692 						pfsync_pack_state(
693 						    PFSYNC_ACT_UPD, st, flags);
694 				}
695 				continue;
696 			}
697 			pfsync_alloc_scrub_memory(&sp->dst, &st->dst);
698 			pf_state_peer_ntoh(&sp->src, &st->src);
699 			pf_state_peer_ntoh(&sp->dst, &st->dst);
700 			st->expire = ntohl(sp->expire) + time_second;
701 			st->timeout = sp->timeout;
702 		}
703 		if (stale && sc->sc_mbuf != NULL)
704 			pfsync_sendout(sc);
705 		crit_exit();
706 		break;
707 	/*
708 	 * It's not strictly necessary for us to support the "uncompressed"
709 	 * delete action, but it's relatively simple and maintains consistency.
710 	 */
711 	case PFSYNC_ACT_DEL:
712 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
713 		    count * sizeof(*sp), &offp)) == NULL) {
714 			pfsyncstats.pfsyncs_badlen++;
715 			return;
716 		}
717 
718 		crit_enter();
719 		for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp);
720 		    i < count; i++, sp++) {
721 			bcopy(sp->id, &id_key.id, sizeof(id_key.id));
722 			id_key.creatorid = sp->creatorid;
723 
724 			st = pf_find_state_byid(&id_key);
725 			if (st == NULL) {
726 				pfsyncstats.pfsyncs_badstate++;
727 				continue;
728 			}
729 			st->sync_flags |= PFSTATE_FROMSYNC;
730 			pf_unlink_state(st);
731 		}
732 		crit_exit();
733 		break;
734 	case PFSYNC_ACT_UPD_C: {
735 		int update_requested = 0;
736 
737 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
738 		    count * sizeof(*up), &offp)) == NULL) {
739 			pfsyncstats.pfsyncs_badlen++;
740 			return;
741 		}
742 
743 		crit_enter();
744 		for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp);
745 		    i < count; i++, up++) {
746 			/* check for invalid values */
747 			if (up->timeout >= PFTM_MAX ||
748 			    up->src.state > PF_TCPS_PROXY_DST ||
749 			    up->dst.state > PF_TCPS_PROXY_DST) {
750 				if (pf_status.debug >= PF_DEBUG_MISC)
751 					kprintf("pfsync_insert: "
752 					    "PFSYNC_ACT_UPD_C: "
753 					    "invalid value\n");
754 				pfsyncstats.pfsyncs_badval++;
755 				continue;
756 			}
757 
758 			bcopy(up->id, &id_key.id, sizeof(id_key.id));
759 			id_key.creatorid = up->creatorid;
760 
761 			st = pf_find_state_byid(&id_key);
762 			if (st == NULL) {
763 				/* We don't have this state. Ask for it. */
764 				error = pfsync_request_update(up, &src);
765 				if (error == ENOMEM) {
766 					crit_exit();
767 					goto done;
768 				}
769 				update_requested = 1;
770 				pfsyncstats.pfsyncs_badstate++;
771 				continue;
772 			}
773 			sk = st->key[PF_SK_WIRE]; /* XXX right one? */
774 			sfail = 0;
775 			if (sk->proto == IPPROTO_TCP) {
776 				/*
777 				 * The state should never go backwards except
778 				 * for syn-proxy states.  Neither should the
779 				 * sequence window slide backwards.
780 				 */
781 				if (st->src.state > up->src.state &&
782 				    (st->src.state < PF_TCPS_PROXY_SRC ||
783 				    up->src.state >= PF_TCPS_PROXY_SRC))
784 					sfail = 1;
785 				else if (st->dst.state > up->dst.state)
786 					sfail = 2;
787 				else if (SEQ_GT(st->src.seqlo,
788 				    ntohl(up->src.seqlo)))
789 					sfail = 3;
790 				else if (st->dst.state >= TCPS_SYN_SENT &&
791 				    SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo)))
792 					sfail = 4;
793 			} else {
794 				/*
795 				 * Non-TCP protocol state machine always go
796 				 * forwards
797 				 */
798 				if (st->src.state > up->src.state)
799 					sfail = 5;
800 				else if (st->dst.state > up->dst.state)
801 					sfail = 6;
802 			}
803 			if (sfail) {
804 				if (pf_status.debug >= PF_DEBUG_MISC)
805 					kprintf("pfsync: ignoring stale update "
806 					    "(%d) id: %016" PRIx64 " "
807 					    "creatorid: %08x\n", sfail,
808 					    be64toh(st->id),
809 					    ntohl(st->creatorid));
810 				pfsyncstats.pfsyncs_stale++;
811 
812 				/* we have a better state, send it out */
813 				if ((!stale || update_requested) &&
814 				    sc->sc_mbuf != NULL) {
815 					pfsync_sendout(sc);
816 					update_requested = 0;
817 				}
818 				stale++;
819 				if (!st->sync_flags)
820 					pfsync_pack_state(PFSYNC_ACT_UPD, st,
821 					    PFSYNC_FLAG_STALE);
822 				continue;
823 			}
824 			pfsync_alloc_scrub_memory(&up->dst, &st->dst);
825 			pf_state_peer_ntoh(&up->src, &st->src);
826 			pf_state_peer_ntoh(&up->dst, &st->dst);
827 			st->expire = ntohl(up->expire) + time_second;
828 			st->timeout = up->timeout;
829 		}
830 		if ((update_requested || stale) && sc->sc_mbuf)
831 			pfsync_sendout(sc);
832 		crit_exit();
833 		break;
834 	}
835 	case PFSYNC_ACT_DEL_C:
836 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
837 		    count * sizeof(*dp), &offp)) == NULL) {
838 			pfsyncstats.pfsyncs_badlen++;
839 			return;
840 		}
841 
842 		crit_enter();
843 		for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp);
844 		    i < count; i++, dp++) {
845 			bcopy(dp->id, &id_key.id, sizeof(id_key.id));
846 			id_key.creatorid = dp->creatorid;
847 
848 			st = pf_find_state_byid(&id_key);
849 			if (st == NULL) {
850 				pfsyncstats.pfsyncs_badstate++;
851 				continue;
852 			}
853 			st->sync_flags |= PFSTATE_FROMSYNC;
854 			pf_unlink_state(st);
855 		}
856 		crit_exit();
857 		break;
858 	case PFSYNC_ACT_INS_F:
859 	case PFSYNC_ACT_DEL_F:
860 		/* not implemented */
861 		break;
862 	case PFSYNC_ACT_UREQ:
863 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
864 		    count * sizeof(*rup), &offp)) == NULL) {
865 			pfsyncstats.pfsyncs_badlen++;
866 			return;
867 		}
868 
869 		crit_enter();
870 		if (sc->sc_mbuf != NULL)
871 			pfsync_sendout(sc);
872 		for (i = 0,
873 		    rup = (struct pfsync_state_upd_req *)(mp->m_data + offp);
874 		    i < count; i++, rup++) {
875 			bcopy(rup->id, &id_key.id, sizeof(id_key.id));
876 			id_key.creatorid = rup->creatorid;
877 
878 			if (id_key.id == 0 && id_key.creatorid == 0) {
879 				sc->sc_ureq_received = mycpu->gd_time_seconds;
880 				if (sc->sc_bulk_send_next == NULL)
881 					sc->sc_bulk_send_next =
882 					    TAILQ_FIRST(&state_list);
883 				sc->sc_bulk_terminator = sc->sc_bulk_send_next;
884 				if (pf_status.debug >= PF_DEBUG_MISC)
885 					kprintf("pfsync: received "
886 					    "bulk update request\n");
887 				pfsync_send_bus(sc, PFSYNC_BUS_START);
888 				lwkt_reltoken(&pf_token);
889 				callout_init(&sc->sc_bulk_tmo);
890 				lwkt_gettoken(&pf_token);
891 			} else {
892 				st = pf_find_state_byid(&id_key);
893 				if (st == NULL) {
894 					pfsyncstats.pfsyncs_badstate++;
895 					continue;
896 				}
897 				if (!st->sync_flags)
898 					pfsync_pack_state(PFSYNC_ACT_UPD,
899 					    st, 0);
900 			}
901 		}
902 		if (sc->sc_mbuf != NULL)
903 			pfsync_sendout(sc);
904 		crit_exit();
905 		break;
906 	case PFSYNC_ACT_BUS:
907 		/* If we're not waiting for a bulk update, who cares. */
908 		if (sc->sc_ureq_sent == 0)
909 			break;
910 
911 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
912 		    sizeof(*bus), &offp)) == NULL) {
913 			pfsyncstats.pfsyncs_badlen++;
914 			return;
915 		}
916 		bus = (struct pfsync_state_bus *)(mp->m_data + offp);
917 		switch (bus->status) {
918 		case PFSYNC_BUS_START:
919 			lwkt_reltoken(&pf_token);
920 			callout_reset(&sc->sc_bulkfail_tmo,
921 			    pf_pool_limits[PF_LIMIT_STATES].limit /
922 			    (PFSYNC_BULKPACKETS * sc->sc_maxcount),
923 			    pfsync_bulkfail, LIST_FIRST(&pfsync_list));
924 			lwkt_gettoken(&pf_token);
925 			if (pf_status.debug >= PF_DEBUG_MISC)
926 				kprintf("pfsync: received bulk "
927 				    "update start\n");
928 			break;
929 		case PFSYNC_BUS_END:
930 			if (mycpu->gd_time_seconds - ntohl(bus->endtime) >=
931 			    sc->sc_ureq_sent) {
932 				/* that's it, we're happy */
933 				sc->sc_ureq_sent = 0;
934 				sc->sc_bulk_tries = 0;
935 				lwkt_reltoken(&pf_token);
936 				callout_stop(&sc->sc_bulkfail_tmo);
937 				lwkt_gettoken(&pf_token);
938 #if NCARP > 0
939 				if (!pfsync_sync_ok) {
940 					lwkt_reltoken(&pf_token);
941 					carp_group_demote_adj(&sc->sc_if, -1);
942 					lwkt_gettoken(&pf_token);
943 				}
944 #endif
945 				pfsync_sync_ok = 1;
946 				if (pf_status.debug >= PF_DEBUG_MISC)
947 					kprintf("pfsync: received valid "
948 					    "bulk update end\n");
949 			} else {
950 				if (pf_status.debug >= PF_DEBUG_MISC)
951 					kprintf("pfsync: received invalid "
952 					    "bulk update end: bad timestamp\n");
953 			}
954 			break;
955 		}
956 		break;
957 #ifdef IPSEC
958 	case PFSYNC_ACT_TDB_UPD:
959 		if ((mp = m_pulldown(m, iplen + sizeof(*ph),
960 		    count * sizeof(*pt), &offp)) == NULL) {
961 			pfsyncstats.pfsyncs_badlen++;
962 			return;
963 		}
964 		crit_enter();
965 		for (i = 0, pt = (struct pfsync_tdb *)(mp->m_data + offp);
966 		    i < count; i++, pt++)
967 			pfsync_update_net_tdb(pt);
968 		crit_exit();
969 		break;
970 #endif
971 	}
972 
973 done:
974 	if (m)
975 		m_freem(m);
976 }
977 
978 int
979 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
980 	struct rtentry *rt)
981 {
982 	m_freem(m);
983 	return (0);
984 }
985 
986 /* ARGSUSED */
987 int
988 pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
989 {
990 	struct pfsync_softc *sc = ifp->if_softc;
991 	struct ifreq *ifr = (struct ifreq *)data;
992 	struct ip_moptions *imo = &sc->sc_imo;
993 	struct pfsyncreq pfsyncr;
994 	struct ifnet    *sifp;
995 	int error;
996 
997 	lwkt_gettoken(&pf_token);
998 
999 	switch (cmd) {
1000 	case SIOCSIFADDR:
1001 	case SIOCAIFADDR:
1002 	case SIOCSIFDSTADDR:
1003 	case SIOCSIFFLAGS:
1004 		if (ifp->if_flags & IFF_UP)
1005 			ifp->if_flags |= IFF_RUNNING;
1006 		else
1007 			ifp->if_flags &= ~IFF_RUNNING;
1008 		break;
1009 	case SIOCSIFMTU:
1010 		if (ifr->ifr_mtu < PFSYNC_MINMTU) {
1011 			lwkt_reltoken(&pf_token);
1012 			return (EINVAL);
1013 		}
1014 		if (ifr->ifr_mtu > MCLBYTES)
1015 			ifr->ifr_mtu = MCLBYTES;
1016 		crit_enter();
1017 		if (ifr->ifr_mtu < ifp->if_mtu)
1018 			pfsync_sendout(sc);
1019 		pfsync_setmtu(sc, ifr->ifr_mtu);
1020 		crit_exit();
1021 		break;
1022 	case SIOCGETPFSYNC:
1023 		bzero(&pfsyncr, sizeof(pfsyncr));
1024 		if (sc->sc_sync_ifp)
1025 			strlcpy(pfsyncr.pfsyncr_syncdev,
1026 			    sc->sc_sync_ifp->if_xname, IFNAMSIZ);
1027 		pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer;
1028 		pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
1029 		lwkt_reltoken(&pf_token);
1030 		if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr))))
1031 			return (error);
1032 		lwkt_gettoken(&pf_token);
1033 		break;
1034 	case SIOCSETPFSYNC:
1035 		if ((error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY)) != 0) {
1036 			lwkt_reltoken(&pf_token);
1037 			return (error);
1038 		}
1039 		if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr)))) {
1040 			lwkt_reltoken(&pf_token);
1041 			return (error);
1042 		}
1043 
1044 		if (pfsyncr.pfsyncr_syncpeer.s_addr == 0)
1045 			sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
1046 		else
1047 			sc->sc_sync_peer.s_addr =
1048 			    pfsyncr.pfsyncr_syncpeer.s_addr;
1049 
1050 		if (pfsyncr.pfsyncr_maxupdates > 255) {
1051 			lwkt_reltoken(&pf_token);
1052 			return (EINVAL);
1053 		}
1054 		sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
1055 
1056 		if (pfsyncr.pfsyncr_syncdev[0] == 0) {
1057 			sc->sc_sync_ifp = NULL;
1058 			if (sc->sc_mbuf_net != NULL) {
1059 				/* Don't keep stale pfsync packets around. */
1060 				crit_enter();
1061 				m_freem(sc->sc_mbuf_net);
1062 				sc->sc_mbuf_net = NULL;
1063 				sc->sc_statep_net.s = NULL;
1064 				crit_exit();
1065 			}
1066 			if (imo->imo_num_memberships > 0) {
1067 				in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
1068 				imo->imo_multicast_ifp = NULL;
1069 			}
1070 			break;
1071 		}
1072 
1073 		if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL) {
1074 			lwkt_reltoken(&pf_token);
1075 			return (EINVAL);
1076 		}
1077 
1078 		crit_enter();
1079 		if (sifp->if_mtu < sc->sc_if.if_mtu ||
1080 		    (sc->sc_sync_ifp != NULL &&
1081 		    sifp->if_mtu < sc->sc_sync_ifp->if_mtu) ||
1082 		    sifp->if_mtu < MCLBYTES - sizeof(struct ip))
1083 			pfsync_sendout(sc);
1084 		sc->sc_sync_ifp = sifp;
1085 
1086 		pfsync_setmtu(sc, sc->sc_if.if_mtu);
1087 
1088 		if (imo->imo_num_memberships > 0) {
1089 			in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
1090 			imo->imo_multicast_ifp = NULL;
1091 		}
1092 
1093 		if (sc->sc_sync_ifp &&
1094 		    sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
1095 			struct in_addr addr;
1096 
1097 			if (!(sc->sc_sync_ifp->if_flags & IFF_MULTICAST)) {
1098 				sc->sc_sync_ifp = NULL;
1099 				lwkt_reltoken(&pf_token);
1100 				crit_exit();
1101 				return (EADDRNOTAVAIL);
1102 			}
1103 
1104 			addr.s_addr = INADDR_PFSYNC_GROUP;
1105 
1106 			if ((imo->imo_membership[0] =
1107 			    in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) {
1108 				sc->sc_sync_ifp = NULL;
1109 				lwkt_reltoken(&pf_token);
1110 				crit_exit();
1111 				return (ENOBUFS);
1112 			}
1113 			imo->imo_num_memberships++;
1114 			imo->imo_multicast_ifp = sc->sc_sync_ifp;
1115 			imo->imo_multicast_ttl = PFSYNC_DFLTTL;
1116 			imo->imo_multicast_loop = 0;
1117 		}
1118 
1119 		if (sc->sc_sync_ifp ||
1120 		    sc->sc_sendaddr.s_addr != INADDR_PFSYNC_GROUP) {
1121 			/* Request a full state table update. */
1122 			sc->sc_ureq_sent = mycpu->gd_time_seconds;
1123 #if NCARP > 0
1124 			if (pfsync_sync_ok)
1125 				carp_group_demote_adj(&sc->sc_if, 1);
1126 #endif
1127 			pfsync_sync_ok = 0;
1128 			if (pf_status.debug >= PF_DEBUG_MISC)
1129 				kprintf("pfsync: requesting bulk update\n");
1130 			lwkt_reltoken(&pf_token);
1131 			callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
1132 			    pfsync_bulkfail, LIST_FIRST(&pfsync_list));
1133 			lwkt_gettoken(&pf_token);
1134 			error = pfsync_request_update(NULL, NULL);
1135 			if (error == ENOMEM) {
1136 				lwkt_reltoken(&pf_token);
1137 				crit_exit();
1138 				return (ENOMEM);
1139 			}
1140 			pfsync_sendout(sc);
1141 		}
1142 		crit_exit();
1143 
1144 		break;
1145 
1146 	default:
1147 		lwkt_reltoken(&pf_token);
1148 		return (ENOTTY);
1149 	}
1150 
1151 	lwkt_reltoken(&pf_token);
1152 	return (0);
1153 }
1154 
1155 void
1156 pfsync_setmtu(struct pfsync_softc *sc, int mtu_req)
1157 {
1158 	int mtu;
1159 
1160 	if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req)
1161 		mtu = sc->sc_sync_ifp->if_mtu;
1162 	else
1163 		mtu = mtu_req;
1164 
1165 	sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) /
1166 	    sizeof(struct pfsync_state);
1167 	if (sc->sc_maxcount > 254)
1168 	    sc->sc_maxcount = 254;
1169 	sc->sc_if.if_mtu = sizeof(struct pfsync_header) +
1170 	    sc->sc_maxcount * sizeof(struct pfsync_state);
1171 }
1172 
1173 struct mbuf *
1174 pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp)
1175 {
1176 	struct pfsync_header *h;
1177 	struct mbuf *m;
1178 	int len;
1179 
1180 	ASSERT_LWKT_TOKEN_HELD(&pf_token);
1181 
1182 	MGETHDR(m, M_WAITOK, MT_DATA);
1183 	if (m == NULL) {
1184 		sc->sc_if.if_oerrors++;
1185 		return (NULL);
1186 	}
1187 
1188 	switch (action) {
1189 	case PFSYNC_ACT_CLR:
1190 		len = sizeof(struct pfsync_header) +
1191 		    sizeof(struct pfsync_state_clr);
1192 		break;
1193 	case PFSYNC_ACT_UPD_C:
1194 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) +
1195 		    sizeof(struct pfsync_header);
1196 		break;
1197 	case PFSYNC_ACT_DEL_C:
1198 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) +
1199 		    sizeof(struct pfsync_header);
1200 		break;
1201 	case PFSYNC_ACT_UREQ:
1202 		len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) +
1203 		    sizeof(struct pfsync_header);
1204 		break;
1205 	case PFSYNC_ACT_BUS:
1206 		len = sizeof(struct pfsync_header) +
1207 		    sizeof(struct pfsync_state_bus);
1208 		break;
1209 	case PFSYNC_ACT_TDB_UPD:
1210 		len = (sc->sc_maxcount * sizeof(struct pfsync_tdb)) +
1211 		    sizeof(struct pfsync_header);
1212 		break;
1213 	default:
1214 		len = (sc->sc_maxcount * sizeof(struct pfsync_state)) +
1215 		    sizeof(struct pfsync_header);
1216 		break;
1217 	}
1218 
1219 	if (len > MHLEN) {
1220 		MCLGET(m, M_WAITOK);
1221 		if ((m->m_flags & M_EXT) == 0) {
1222 			m_free(m);
1223 			sc->sc_if.if_oerrors++;
1224 			return (NULL);
1225 		}
1226 		m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1);
1227 	} else
1228 		MH_ALIGN(m, len);
1229 
1230 	m->m_pkthdr.rcvif = NULL;
1231 	m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header);
1232 	h = mtod(m, struct pfsync_header *);
1233 	h->version = PFSYNC_VERSION;
1234 	h->af = 0;
1235 	h->count = 0;
1236 	h->action = action;
1237 
1238 	*sp = (void *)((char *)h + PFSYNC_HDRLEN);
1239 	lwkt_reltoken(&pf_token);
1240 	callout_reset(&sc->sc_tmo, hz, pfsync_timeout,
1241 	    LIST_FIRST(&pfsync_list));
1242 	lwkt_gettoken(&pf_token);
1243 	return (m);
1244 }
1245 
1246 int
1247 pfsync_pack_state(u_int8_t action, struct pf_state *st, int flags)
1248 {
1249 	struct ifnet *ifp = NULL;
1250 	struct pfsync_softc *sc = pfsyncif;
1251 	struct pfsync_header *h, *h_net;
1252 	struct pfsync_state *sp = NULL;
1253 	struct pfsync_state_upd *up = NULL;
1254 	struct pfsync_state_del *dp = NULL;
1255 	int ret = 0;
1256 	u_int8_t i = 255, newaction = 0;
1257 
1258 	if (sc == NULL)
1259 		return (0);
1260 	ifp = &sc->sc_if;
1261 
1262 	/*
1263 	 * If a packet falls in the forest and there's nobody around to
1264 	 * hear, does it make a sound?
1265 	 */
1266 	if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL &&
1267 	    sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
1268 		/* Don't leave any stale pfsync packets hanging around. */
1269 		if (sc->sc_mbuf != NULL) {
1270 			m_freem(sc->sc_mbuf);
1271 			sc->sc_mbuf = NULL;
1272 			sc->sc_statep.s = NULL;
1273 		}
1274 		return (0);
1275 	}
1276 
1277 	if (action >= PFSYNC_ACT_MAX)
1278 		return (EINVAL);
1279 
1280 	crit_enter();
1281 	if (sc->sc_mbuf == NULL) {
1282 		if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
1283 		    (void *)&sc->sc_statep.s)) == NULL) {
1284 			crit_exit();
1285 			return (ENOMEM);
1286 		}
1287 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1288 	} else {
1289 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1290 		if (h->action != action) {
1291 			pfsync_sendout(sc);
1292 			if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action,
1293 			    (void *)&sc->sc_statep.s)) == NULL) {
1294 				crit_exit();
1295 				return (ENOMEM);
1296 			}
1297 			h = mtod(sc->sc_mbuf, struct pfsync_header *);
1298 		} else {
1299 			/*
1300 			 * If it's an update, look in the packet to see if
1301 			 * we already have an update for the state.
1302 			 */
1303 			if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) {
1304 				struct pfsync_state *usp =
1305 				    (void *)((char *)h + PFSYNC_HDRLEN);
1306 
1307 				for (i = 0; i < h->count; i++) {
1308 					if (!memcmp(usp->id, &st->id,
1309 					    PFSYNC_ID_LEN) &&
1310 					    usp->creatorid == st->creatorid) {
1311 						sp = usp;
1312 						sp->updates++;
1313 						break;
1314 					}
1315 					usp++;
1316 				}
1317 			}
1318 		}
1319 	}
1320 
1321 	st->pfsync_time = mycpu->gd_time_seconds;;
1322 
1323 	if (sp == NULL) {
1324 		/* not a "duplicate" update */
1325 		i = 255;
1326 		sp = sc->sc_statep.s++;
1327 		sc->sc_mbuf->m_pkthdr.len =
1328 		    sc->sc_mbuf->m_len += sizeof(struct pfsync_state);
1329 		h->count++;
1330 		bzero(sp, sizeof(*sp));
1331 
1332 		pfsync_state_export(sp, st);
1333 
1334 		if (flags & PFSYNC_FLAG_STALE)
1335 			sp->sync_flags |= PFSTATE_STALE;
1336 	} else {
1337 		pf_state_peer_hton(&st->src, &sp->src);
1338 		pf_state_peer_hton(&st->dst, &sp->dst);
1339 
1340 		if (st->expire <= time_second)
1341 			sp->expire = htonl(0);
1342 		else
1343 			sp->expire = htonl(st->expire - time_second);
1344 	}
1345 
1346 	/* do we need to build "compressed" actions for network transfer? */
1347 	if (sc->sc_sync_ifp && flags & PFSYNC_FLAG_COMPRESS) {
1348 		switch (action) {
1349 		case PFSYNC_ACT_UPD:
1350 			newaction = PFSYNC_ACT_UPD_C;
1351 			break;
1352 		case PFSYNC_ACT_DEL:
1353 			newaction = PFSYNC_ACT_DEL_C;
1354 			break;
1355 		default:
1356 			/* by default we just send the uncompressed states */
1357 			break;
1358 		}
1359 	}
1360 
1361 	if (newaction) {
1362 		if (sc->sc_mbuf_net == NULL) {
1363 			if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction,
1364 			    (void *)&sc->sc_statep_net.s)) == NULL) {
1365 				crit_exit();
1366 				return (ENOMEM);
1367 			}
1368 		}
1369 		h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *);
1370 
1371 		switch (newaction) {
1372 		case PFSYNC_ACT_UPD_C:
1373 			if (i != 255) {
1374 				up = (void *)((char *)h_net +
1375 				    PFSYNC_HDRLEN + (i * sizeof(*up)));
1376 				up->updates++;
1377 			} else {
1378 				h_net->count++;
1379 				sc->sc_mbuf_net->m_pkthdr.len =
1380 				    sc->sc_mbuf_net->m_len += sizeof(*up);
1381 				up = sc->sc_statep_net.u++;
1382 
1383 				bzero(up, sizeof(*up));
1384 				bcopy(&st->id, up->id, sizeof(up->id));
1385 				up->creatorid = st->creatorid;
1386 			}
1387 			up->timeout = st->timeout;
1388 			up->expire = sp->expire;
1389 			up->src = sp->src;
1390 			up->dst = sp->dst;
1391 			break;
1392 		case PFSYNC_ACT_DEL_C:
1393 			sc->sc_mbuf_net->m_pkthdr.len =
1394 			    sc->sc_mbuf_net->m_len += sizeof(*dp);
1395 			dp = sc->sc_statep_net.d++;
1396 			h_net->count++;
1397 
1398 			bzero(dp, sizeof(*dp));
1399 			bcopy(&st->id, dp->id, sizeof(dp->id));
1400 			dp->creatorid = st->creatorid;
1401 			break;
1402 		}
1403 	}
1404 
1405 	if (h->count == sc->sc_maxcount ||
1406 	    (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates)))
1407 		ret = pfsync_sendout(sc);
1408 
1409 	crit_exit();
1410 	return (ret);
1411 }
1412 
1413 int
1414 pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src)
1415 {
1416 	struct pfsync_header *h;
1417 	struct pfsync_softc *sc = pfsyncif;
1418 	struct pfsync_state_upd_req *rup;
1419 	int ret = 0;
1420 
1421 	if (sc == NULL)
1422 		return (0);
1423 
1424 	if (sc->sc_mbuf == NULL) {
1425 		if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1426 		    (void *)&sc->sc_statep.s)) == NULL)
1427 			return (ENOMEM);
1428 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1429 	} else {
1430 		h = mtod(sc->sc_mbuf, struct pfsync_header *);
1431 		if (h->action != PFSYNC_ACT_UREQ) {
1432 			pfsync_sendout(sc);
1433 			if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ,
1434 			    (void *)&sc->sc_statep.s)) == NULL)
1435 				return (ENOMEM);
1436 			h = mtod(sc->sc_mbuf, struct pfsync_header *);
1437 		}
1438 	}
1439 
1440 	if (src != NULL)
1441 		sc->sc_sendaddr = *src;
1442 	sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup);
1443 	h->count++;
1444 	rup = sc->sc_statep.r++;
1445 	bzero(rup, sizeof(*rup));
1446 	if (up != NULL) {
1447 		bcopy(up->id, rup->id, sizeof(rup->id));
1448 		rup->creatorid = up->creatorid;
1449 	}
1450 
1451 	if (h->count == sc->sc_maxcount)
1452 		ret = pfsync_sendout(sc);
1453 
1454 	return (ret);
1455 }
1456 
1457 int
1458 pfsync_clear_states(u_int32_t creatorid, char *ifname)
1459 {
1460 	struct pfsync_softc *sc = pfsyncif;
1461 	struct pfsync_state_clr *cp;
1462 	int ret;
1463 
1464 	if (sc == NULL)
1465 		return (0);
1466 
1467 	crit_enter();
1468 	if (sc->sc_mbuf != NULL)
1469 		pfsync_sendout(sc);
1470 	if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR,
1471 	    (void *)&sc->sc_statep.c)) == NULL) {
1472 		crit_exit();
1473 		return (ENOMEM);
1474 	}
1475 	sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp);
1476 	cp = sc->sc_statep.c;
1477 	cp->creatorid = creatorid;
1478 	if (ifname != NULL)
1479 		strlcpy(cp->ifname, ifname, IFNAMSIZ);
1480 
1481 	ret = (pfsync_sendout(sc));
1482 	crit_exit();
1483 	return (ret);
1484 }
1485 
1486 void
1487 pfsync_timeout(void *v)
1488 {
1489 	struct pfsync_softc *sc = v;
1490 
1491 	crit_enter();
1492 	pfsync_sendout(sc);
1493 	crit_exit();
1494 }
1495 
1496 void
1497 pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status)
1498 {
1499 	struct pfsync_state_bus *bus;
1500 
1501 	if (sc->sc_mbuf != NULL)
1502 		pfsync_sendout(sc);
1503 
1504 	if (pfsync_sync_ok &&
1505 	    (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS,
1506 	    (void *)&sc->sc_statep.b)) != NULL) {
1507 		sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus);
1508 		bus = sc->sc_statep.b;
1509 		bus->creatorid = pf_status.hostid;
1510 		bus->status = status;
1511 		bus->endtime = htonl(mycpu->gd_time_seconds - sc->sc_ureq_received);
1512 		pfsync_sendout(sc);
1513 	}
1514 }
1515 
1516 void
1517 pfsync_bulk_update(void *v)
1518 {
1519 	struct pfsync_softc *sc = v;
1520 	int i = 0;
1521 	struct pf_state *state;
1522 
1523 	ASSERT_LWKT_TOKEN_HELD(&pf_token);
1524 
1525 	crit_enter();
1526 	if (sc->sc_mbuf != NULL)
1527 		pfsync_sendout(sc);
1528 
1529 	/*
1530 	 * Grab at most PFSYNC_BULKPACKETS worth of states which have not
1531 	 * been sent since the latest request was made.
1532 	 */
1533 	state = sc->sc_bulk_send_next;
1534 	if (state)
1535 		do {
1536 			/* send state update if syncable and not already sent */
1537 			if (!state->sync_flags
1538 			    && state->timeout < PFTM_MAX
1539 			    && state->pfsync_time <= sc->sc_ureq_received) {
1540 				pfsync_pack_state(PFSYNC_ACT_UPD, state, 0);
1541 				i++;
1542 			}
1543 
1544 			/* figure next state to send */
1545 			state = TAILQ_NEXT(state, entry_list);
1546 
1547 			/* wrap to start of list if we hit the end */
1548 			if (!state)
1549 				state = TAILQ_FIRST(&state_list);
1550 		} while (i < sc->sc_maxcount * PFSYNC_BULKPACKETS &&
1551 		    state != sc->sc_bulk_terminator);
1552 
1553 	if (!state || state == sc->sc_bulk_terminator) {
1554 		/* we're done */
1555 		pfsync_send_bus(sc, PFSYNC_BUS_END);
1556 		sc->sc_ureq_received = 0;
1557 		sc->sc_bulk_send_next = NULL;
1558 		sc->sc_bulk_terminator = NULL;
1559 		lwkt_reltoken(&pf_token);
1560 		callout_stop(&sc->sc_bulk_tmo);
1561 		lwkt_gettoken(&pf_token);
1562 		if (pf_status.debug >= PF_DEBUG_MISC)
1563 			kprintf("pfsync: bulk update complete\n");
1564 	} else {
1565 		/* look again for more in a bit */
1566 		lwkt_reltoken(&pf_token);
1567 		callout_reset(&sc->sc_bulk_tmo, 1, pfsync_timeout,
1568 			    LIST_FIRST(&pfsync_list));
1569 		lwkt_gettoken(&pf_token);
1570 		sc->sc_bulk_send_next = state;
1571 	}
1572 	if (sc->sc_mbuf != NULL)
1573 		pfsync_sendout(sc);
1574 	crit_exit();
1575 }
1576 
1577 void
1578 pfsync_bulkfail(void *v)
1579 {
1580 	struct pfsync_softc *sc = v;
1581 	int error;
1582 
1583 	ASSERT_LWKT_TOKEN_HELD(&pf_token);
1584 
1585 	if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
1586 		/* Try again in a bit */
1587 		lwkt_reltoken(&pf_token);
1588 		callout_reset(&sc->sc_bulkfail_tmo, 5 * hz, pfsync_bulkfail,
1589 		    LIST_FIRST(&pfsync_list));
1590 		lwkt_gettoken(&pf_token);
1591 		crit_enter();
1592 		error = pfsync_request_update(NULL, NULL);
1593 		if (error == ENOMEM) {
1594 			if (pf_status.debug >= PF_DEBUG_MISC)
1595 				kprintf("pfsync: cannot allocate mbufs for "
1596 				    "bulk update\n");
1597 		} else
1598 			pfsync_sendout(sc);
1599 		crit_exit();
1600 	} else {
1601 		/* Pretend like the transfer was ok */
1602 		sc->sc_ureq_sent = 0;
1603 		sc->sc_bulk_tries = 0;
1604 #if NCARP > 0
1605 		if (!pfsync_sync_ok)
1606 			carp_group_demote_adj(&sc->sc_if, -1);
1607 #endif
1608 		pfsync_sync_ok = 1;
1609 		if (pf_status.debug >= PF_DEBUG_MISC)
1610 			kprintf("pfsync: failed to receive "
1611 			    "bulk update status\n");
1612 		lwkt_reltoken(&pf_token);
1613 		callout_stop(&sc->sc_bulkfail_tmo);
1614 		lwkt_gettoken(&pf_token);
1615 	}
1616 }
1617 
1618 /* This must be called in splnet() */
1619 int
1620 pfsync_sendout(struct pfsync_softc *sc)
1621 {
1622 #if NBPFILTER > 0
1623 	struct ifnet *ifp = &sc->sc_if;
1624 #endif
1625 	struct mbuf *m;
1626 
1627 	ASSERT_LWKT_TOKEN_HELD(&pf_token);
1628 
1629 	lwkt_reltoken(&pf_token);
1630 	callout_stop(&sc->sc_tmo);
1631 	lwkt_gettoken(&pf_token);
1632 
1633 	if (sc->sc_mbuf == NULL)
1634 		return (0);
1635 	m = sc->sc_mbuf;
1636 	sc->sc_mbuf = NULL;
1637 	sc->sc_statep.s = NULL;
1638 
1639 #if NBPFILTER > 0
1640 	if (ifp->if_bpf) {
1641 		lwkt_reltoken(&pf_token);
1642 		bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1643 		lwkt_gettoken(&pf_token);
1644 	}
1645 #endif
1646 
1647 	if (sc->sc_mbuf_net) {
1648 		m_freem(m);
1649 		m = sc->sc_mbuf_net;
1650 		sc->sc_mbuf_net = NULL;
1651 		sc->sc_statep_net.s = NULL;
1652 	}
1653 
1654 	return pfsync_sendout_mbuf(sc, m);
1655 }
1656 
1657 int
1658 pfsync_sendout_mbuf(struct pfsync_softc *sc, struct mbuf *m)
1659 {
1660 	struct sockaddr sa;
1661 	struct ip *ip;
1662 
1663 	if (sc->sc_sync_ifp ||
1664 	    sc->sc_sync_peer.s_addr != INADDR_PFSYNC_GROUP) {
1665 		M_PREPEND(m, sizeof(struct ip), M_WAITOK);
1666 		if (m == NULL) {
1667 			pfsyncstats.pfsyncs_onomem++;
1668 			return (0);
1669 		}
1670 		ip = mtod(m, struct ip *);
1671 		ip->ip_v = IPVERSION;
1672 		ip->ip_hl = sizeof(*ip) >> 2;
1673 		ip->ip_tos = IPTOS_LOWDELAY;
1674 		ip->ip_len = htons(m->m_pkthdr.len);
1675 		ip->ip_id = htons(ip_randomid());
1676 		ip->ip_off = htons(IP_DF);
1677 		ip->ip_ttl = PFSYNC_DFLTTL;
1678 		ip->ip_p = IPPROTO_PFSYNC;
1679 		ip->ip_sum = 0;
1680 
1681 		bzero(&sa, sizeof(sa));
1682 		ip->ip_src.s_addr = INADDR_ANY;
1683 
1684 		if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP)
1685 			m->m_flags |= M_MCAST;
1686 		ip->ip_dst = sc->sc_sendaddr;
1687 		sc->sc_sendaddr.s_addr = sc->sc_sync_peer.s_addr;
1688 
1689 		pfsyncstats.pfsyncs_opackets++;
1690 
1691 		if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))
1692 			pfsyncstats.pfsyncs_oerrors++;
1693 	} else
1694 		m_freem(m);
1695 
1696 	return (0);
1697 }
1698 
1699 static int
1700 pfsync_modevent(module_t mod, int type, void *data)
1701 {
1702 	int error = 0;
1703 
1704 	struct pfsync_softc	*pfs_if, *tmp;
1705 
1706 	lwkt_gettoken(&pf_token);
1707 
1708 	switch (type) {
1709 	case MOD_LOAD:
1710 		LIST_INIT(&pfsync_list);
1711 		lwkt_reltoken(&pf_token);
1712 		if_clone_attach(&pfsync_cloner);
1713 		lwkt_gettoken(&pf_token);
1714 		/* Override the function pointer for pf_ioctl.c */
1715 		break;
1716 
1717 	case MOD_UNLOAD:
1718 		lwkt_reltoken(&pf_token);
1719 		if_clone_detach(&pfsync_cloner);
1720 		lwkt_gettoken(&pf_token);
1721 		LIST_FOREACH_MUTABLE(pfs_if, &pfsync_list, sc_next, tmp) {
1722 			pfsync_clone_destroy(&pfs_if->sc_if);
1723 		}
1724 		break;
1725 
1726 	default:
1727 		error = EINVAL;
1728 		break;
1729 	}
1730 
1731 	lwkt_reltoken(&pf_token);
1732 	return error;
1733 }
1734 
1735 static moduledata_t pfsync_mod = {
1736 	"pfsync",
1737 	pfsync_modevent,
1738 	0
1739 };
1740 
1741 #define PFSYNC_MODVER 44
1742 
1743 DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
1744 MODULE_VERSION(pfsync, PFSYNC_MODVER);
1745 
1746 
1747 
1748