1 /* $NetBSD: if_pfsync.c,v 1.23 2024/07/05 04:31:52 rin Exp $ */ 2 /* $OpenBSD: if_pfsync.c,v 1.83 2007/06/26 14:44:12 mcbride Exp $ */ 3 4 /* 5 * Copyright (c) 2002 Michael Shalayeff 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 21 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 23 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 25 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 26 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 27 * THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __KERNEL_RCSID(0, "$NetBSD: if_pfsync.c,v 1.23 2024/07/05 04:31:52 rin Exp $"); 32 33 #ifdef _KERNEL_OPT 34 #include "opt_inet.h" 35 #include "opt_inet6.h" 36 #endif 37 38 #include <sys/param.h> 39 #include <sys/proc.h> 40 #include <sys/systm.h> 41 #include <sys/time.h> 42 #include <sys/mbuf.h> 43 #include <sys/socket.h> 44 #include <sys/ioctl.h> 45 #include <sys/callout.h> 46 #include <sys/kernel.h> 47 48 #include <net/if.h> 49 #include <net/if_types.h> 50 #include <net/route.h> 51 #include <net/bpf.h> 52 #include <netinet/in.h> 53 #ifndef __NetBSD__ 54 #include <netinet/if_ether.h> 55 #else 56 #include <net/if_ether.h> 57 #endif /* __NetBSD__ */ 58 #include <netinet/tcp.h> 59 #include <netinet/tcp_seq.h> 60 61 #ifdef INET 62 #include <netinet/in_systm.h> 63 #include <netinet/in_var.h> 64 #include <netinet/ip.h> 65 #include <netinet/ip_var.h> 66 #endif 67 68 #ifdef INET6 69 #include <netinet6/nd6.h> 70 #endif /* INET6 */ 71 72 #include "carp.h" 73 #if NCARP > 0 74 extern int carp_suppress_preempt; 75 #endif 76 77 #include <net/pfvar.h> 78 #include <net/if_pfsync.h> 79 80 #ifdef __NetBSD__ 81 #include <sys/conf.h> 82 #include <sys/lwp.h> 83 #include <sys/kauth.h> 84 #include <sys/sysctl.h> 85 86 #include <net/net_stats.h> 87 88 #include "ioconf.h" 89 90 percpu_t *pfsyncstat_percpu; 91 92 #define PFSYNC_STATINC(x) _NET_STATINC(pfsyncstat_percpu, x) 93 #endif /* __NetBSD__ */ 94 95 #include "pfsync.h" 96 97 #define PFSYNC_MINMTU \ 98 (sizeof(struct pfsync_header) + sizeof(struct pf_state)) 99 100 #ifdef PFSYNCDEBUG 101 #define DPRINTF(x) do { if (pfsyncdebug) printf x ; } while (0) 102 int pfsyncdebug; 103 #else 104 #define DPRINTF(x) 105 #endif 106 107 extern int ifqmaxlen; /* XXX */ 108 109 struct pfsync_softc *pfsyncif = NULL; 110 111 int pfsync_clone_create(struct if_clone *, int); 112 int pfsync_clone_destroy(struct ifnet *); 113 void pfsync_setmtu(struct pfsync_softc *, int); 114 int pfsync_alloc_scrub_memory(struct pfsync_state_peer *, 115 struct pf_state_peer *); 116 int pfsync_insert_net_state(struct pfsync_state *, u_int8_t); 117 void pfsync_update_net_tdb(struct pfsync_tdb *); 118 int pfsyncoutput(struct ifnet *, struct mbuf *, const struct sockaddr *, 119 const struct rtentry *); 120 int pfsyncioctl(struct ifnet *, u_long, void*); 121 void pfsyncstart(struct ifnet *); 122 123 struct mbuf *pfsync_get_mbuf(struct pfsync_softc *, u_int8_t, void **); 124 int pfsync_request_update(struct pfsync_state_upd *, struct in_addr *); 125 int pfsync_sendout(struct pfsync_softc *); 126 int pfsync_tdb_sendout(struct pfsync_softc *); 127 int pfsync_sendout_mbuf(struct pfsync_softc *, struct mbuf *); 128 void pfsync_timeout(void *); 129 void pfsync_tdb_timeout(void *); 130 void pfsync_send_bus(struct pfsync_softc *, u_int8_t); 131 void pfsync_bulk_update(void *); 132 void pfsync_bulkfail(void *); 133 134 int pfsync_sync_ok; 135 136 struct if_clone pfsync_cloner = 137 IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy); 138 139 void 140 pfsyncattach(int npfsync) 141 { 142 if_clone_attach(&pfsync_cloner); 143 144 pfsyncstat_percpu = percpu_alloc(sizeof(uint64_t) * PFSYNC_NSTATS); 145 } 146 147 int 148 pfsync_clone_create(struct if_clone *ifc, int unit) 149 { 150 struct ifnet *ifp; 151 152 if (unit != 0) 153 return (EINVAL); 154 155 pfsync_sync_ok = 1; 156 if ((pfsyncif = malloc(sizeof(*pfsyncif), M_DEVBUF, M_NOWAIT)) == NULL) 157 return (ENOMEM); 158 memset(pfsyncif, 0, sizeof(*pfsyncif)); 159 pfsyncif->sc_mbuf = NULL; 160 pfsyncif->sc_mbuf_net = NULL; 161 pfsyncif->sc_mbuf_tdb = NULL; 162 pfsyncif->sc_statep.s = NULL; 163 pfsyncif->sc_statep_net.s = NULL; 164 pfsyncif->sc_statep_tdb.t = NULL; 165 pfsyncif->sc_maxupdates = 128; 166 pfsyncif->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP; 167 pfsyncif->sc_sendaddr.s_addr = INADDR_PFSYNC_GROUP; 168 pfsyncif->sc_ureq_received = 0; 169 pfsyncif->sc_ureq_sent = 0; 170 pfsyncif->sc_bulk_send_next = NULL; 171 pfsyncif->sc_bulk_terminator = NULL; 172 ifp = &pfsyncif->sc_if; 173 snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit); 174 ifp->if_softc = pfsyncif; 175 ifp->if_ioctl = pfsyncioctl; 176 ifp->if_output = pfsyncoutput; 177 ifp->if_start = pfsyncstart; 178 ifp->if_type = IFT_PFSYNC; 179 ifp->if_snd.ifq_maxlen = ifqmaxlen; 180 ifp->if_hdrlen = PFSYNC_HDRLEN; 181 pfsync_setmtu(pfsyncif, ETHERMTU); 182 183 callout_init(&pfsyncif->sc_tmo, 0); 184 callout_init(&pfsyncif->sc_tdb_tmo, 0); 185 callout_init(&pfsyncif->sc_bulk_tmo, 0); 186 callout_init(&pfsyncif->sc_bulkfail_tmo, 0); 187 callout_setfunc(&pfsyncif->sc_tmo, pfsync_timeout, pfsyncif); 188 callout_setfunc(&pfsyncif->sc_tdb_tmo, pfsync_tdb_timeout, pfsyncif); 189 callout_setfunc(&pfsyncif->sc_bulk_tmo, pfsync_bulk_update, pfsyncif); 190 callout_setfunc(&pfsyncif->sc_bulkfail_tmo, pfsync_bulkfail, pfsyncif); 191 192 if_attach(ifp); 193 if_alloc_sadl(ifp); 194 195 bpf_attach(&pfsyncif->sc_if, DLT_PFSYNC, PFSYNC_HDRLEN); 196 197 return (0); 198 } 199 200 int 201 pfsync_clone_destroy(struct ifnet *ifp) 202 { 203 bpf_detach(ifp); 204 if_detach(ifp); 205 free(pfsyncif, M_DEVBUF); 206 pfsyncif = NULL; 207 return (0); 208 } 209 210 /* 211 * Start output on the pfsync interface. 212 */ 213 void 214 pfsyncstart(struct ifnet *ifp) 215 { 216 struct mbuf *m; 217 int s; 218 219 for (;;) { 220 s = splnet(); 221 IF_DROP(&ifp->if_snd); 222 IF_DEQUEUE(&ifp->if_snd, m); 223 splx(s); 224 225 if (m == NULL) 226 return; 227 else 228 m_freem(m); 229 } 230 } 231 232 int 233 pfsync_alloc_scrub_memory(struct pfsync_state_peer *s, 234 struct pf_state_peer *d) 235 { 236 if (s->scrub.scrub_flag && d->scrub == NULL) { 237 d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT); 238 if (d->scrub == NULL) 239 return (ENOMEM); 240 memset(d->scrub, 0, sizeof(*d->scrub)); 241 } 242 243 return (0); 244 } 245 246 int 247 pfsync_insert_net_state(struct pfsync_state *sp, u_int8_t chksum_flag) 248 { 249 struct pf_state *st = NULL; 250 struct pf_state_key *sk = NULL; 251 struct pf_rule *r = NULL; 252 struct pfi_kif *kif; 253 254 if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) { 255 printf("pfsync_insert_net_state: invalid creator id:" 256 " %08x\n", ntohl(sp->creatorid)); 257 return (EINVAL); 258 } 259 260 kif = pfi_kif_get(sp->ifname); 261 if (kif == NULL) { 262 if (pf_status.debug >= PF_DEBUG_MISC) 263 printf("pfsync_insert_net_state: " 264 "unknown interface: %s\n", sp->ifname); 265 /* skip this state */ 266 return (0); 267 } 268 269 /* 270 * If the ruleset checksums match, it's safe to associate the state 271 * with the rule of that number. 272 */ 273 if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) && chksum_flag && 274 ntohl(sp->rule) < 275 pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount) 276 r = pf_main_ruleset.rules[ 277 PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)]; 278 else 279 r = &pf_default_rule; 280 281 if (!r->max_states || r->states < r->max_states) 282 st = pool_get(&pf_state_pl, PR_NOWAIT); 283 if (st == NULL) { 284 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 285 return (ENOMEM); 286 } 287 memset(st, 0, sizeof(*st)); 288 289 if ((sk = pf_alloc_state_key(st)) == NULL) { 290 pool_put(&pf_state_pl, st); 291 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 292 return (ENOMEM); 293 } 294 295 /* allocate memory for scrub info */ 296 if (pfsync_alloc_scrub_memory(&sp->src, &st->src) || 297 pfsync_alloc_scrub_memory(&sp->dst, &st->dst)) { 298 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 299 if (st->src.scrub) 300 pool_put(&pf_state_scrub_pl, st->src.scrub); 301 pool_put(&pf_state_pl, st); 302 pool_put(&pf_state_key_pl, sk); 303 return (ENOMEM); 304 } 305 306 st->rule.ptr = r; 307 /* XXX get pointers to nat_rule and anchor */ 308 309 /* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */ 310 r->states++; 311 312 /* fill in the rest of the state entry */ 313 pf_state_host_ntoh(&sp->lan, &sk->lan); 314 pf_state_host_ntoh(&sp->gwy, &sk->gwy); 315 pf_state_host_ntoh(&sp->ext, &sk->ext); 316 317 pf_state_peer_ntoh(&sp->src, &st->src); 318 pf_state_peer_ntoh(&sp->dst, &st->dst); 319 320 memcpy(&st->rt_addr, &sp->rt_addr, sizeof(st->rt_addr)); 321 st->creation = time_second - ntohl(sp->creation); 322 st->expire = ntohl(sp->expire) + time_second; 323 324 sk->af = sp->af; 325 sk->proto = sp->proto; 326 sk->direction = sp->direction; 327 st->log = sp->log; 328 st->timeout = sp->timeout; 329 st->allow_opts = sp->allow_opts; 330 331 memcpy(&st->id, sp->id, sizeof(st->id)); 332 st->creatorid = sp->creatorid; 333 st->sync_flags = PFSTATE_FROMSYNC; 334 335 if (pf_insert_state(kif, st)) { 336 pfi_kif_unref(kif, PFI_KIF_REF_NONE); 337 /* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */ 338 r->states--; 339 if (st->dst.scrub) 340 pool_put(&pf_state_scrub_pl, st->dst.scrub); 341 if (st->src.scrub) 342 pool_put(&pf_state_scrub_pl, st->src.scrub); 343 pool_put(&pf_state_pl, st); 344 return (EINVAL); 345 } 346 347 return (0); 348 } 349 350 void 351 pfsync_input(struct mbuf *m, int off, int proto) 352 { 353 struct ip *ip = mtod(m, struct ip *); 354 struct pfsync_header *ph; 355 struct pfsync_softc *sc = pfsyncif; 356 struct pf_state *st; 357 struct pf_state_key *sk; 358 struct pf_state_cmp id_key; 359 struct pfsync_state *sp; 360 struct pfsync_state_upd *up; 361 struct pfsync_state_del *dp; 362 struct pfsync_state_clr *cp; 363 struct pfsync_state_upd_req *rup; 364 struct pfsync_state_bus *bus; 365 struct in_addr src; 366 struct mbuf *mp; 367 int iplen, action, error, i, s, count, offp, sfail, stale = 0; 368 u_int8_t chksum_flag = 0; 369 370 PFSYNC_STATINC(PFSYNC_STAT_IPACKETS); 371 372 /* verify that we have a sync interface configured */ 373 if (!sc || !sc->sc_sync_ifp || !pf_status.running) 374 goto done; 375 376 /* verify that the packet came in on the right interface */ 377 if (sc->sc_sync_ifp->if_index != m->m_pkthdr.rcvif_index) { 378 PFSYNC_STATINC(PFSYNC_STAT_BADIF); 379 goto done; 380 } 381 382 /* verify that the IP TTL is 255. */ 383 if (ip->ip_ttl != PFSYNC_DFLTTL) { 384 PFSYNC_STATINC(PFSYNC_STAT_BADTTL); 385 goto done; 386 } 387 388 iplen = ip->ip_hl << 2; 389 390 if (m->m_pkthdr.len < iplen + sizeof(*ph)) { 391 PFSYNC_STATINC(PFSYNC_STAT_HDROPS); 392 goto done; 393 } 394 395 if (iplen + sizeof(*ph) > m->m_len) { 396 if ((m = m_pullup(m, iplen + sizeof(*ph))) == NULL) { 397 PFSYNC_STATINC(PFSYNC_STAT_HDROPS); 398 goto done; 399 } 400 ip = mtod(m, struct ip *); 401 } 402 ph = (struct pfsync_header *)((char *)ip + iplen); 403 404 /* verify the version */ 405 if (ph->version != PFSYNC_VERSION) { 406 PFSYNC_STATINC(PFSYNC_STAT_BADVER); 407 goto done; 408 } 409 410 action = ph->action; 411 count = ph->count; 412 413 /* make sure it's a valid action code */ 414 if (action >= PFSYNC_ACT_MAX) { 415 PFSYNC_STATINC(PFSYNC_STAT_BADACT); 416 goto done; 417 } 418 419 /* Cheaper to grab this now than having to mess with mbufs later */ 420 src = ip->ip_src; 421 422 if (!bcmp(&ph->pf_chksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH)) 423 chksum_flag++; 424 425 switch (action) { 426 case PFSYNC_ACT_CLR: { 427 struct pf_state *nexts; 428 struct pf_state_key *nextsk; 429 struct pfi_kif *kif; 430 u_int32_t creatorid; 431 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 432 sizeof(*cp), &offp)) == NULL) { 433 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 434 return; 435 } 436 cp = (struct pfsync_state_clr *)(mp->m_data + offp); 437 creatorid = cp->creatorid; 438 439 s = splsoftnet(); 440 if (cp->ifname[0] == '\0') { 441 for (st = RB_MIN(pf_state_tree_id, &tree_id); 442 st; st = nexts) { 443 nexts = RB_NEXT(pf_state_tree_id, &tree_id, st); 444 if (st->creatorid == creatorid) { 445 st->sync_flags |= PFSTATE_FROMSYNC; 446 pf_unlink_state(st); 447 } 448 } 449 } else { 450 if ((kif = pfi_kif_get(cp->ifname)) == NULL) { 451 splx(s); 452 return; 453 } 454 for (sk = RB_MIN(pf_state_tree_lan_ext, 455 &pf_statetbl_lan_ext); sk; sk = nextsk) { 456 nextsk = RB_NEXT(pf_state_tree_lan_ext, 457 &pf_statetbl_lan_ext, sk); 458 TAILQ_FOREACH(st, &sk->states, next) { 459 if (st->creatorid == creatorid) { 460 st->sync_flags |= 461 PFSTATE_FROMSYNC; 462 pf_unlink_state(st); 463 } 464 } 465 } 466 } 467 splx(s); 468 469 break; 470 } 471 case PFSYNC_ACT_INS: 472 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 473 count * sizeof(*sp), &offp)) == NULL) { 474 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 475 return; 476 } 477 478 s = splsoftnet(); 479 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 480 i < count; i++, sp++) { 481 /* check for invalid values */ 482 if (sp->timeout >= PFTM_MAX || 483 sp->src.state > PF_TCPS_PROXY_DST || 484 sp->dst.state > PF_TCPS_PROXY_DST || 485 sp->direction > PF_OUT || 486 (sp->af != AF_INET && sp->af != AF_INET6)) { 487 if (pf_status.debug >= PF_DEBUG_MISC) 488 printf("pfsync_insert: PFSYNC_ACT_INS: " 489 "invalid value\n"); 490 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 491 continue; 492 } 493 494 if ((error = pfsync_insert_net_state(sp, 495 chksum_flag))) { 496 if (error == ENOMEM) { 497 splx(s); 498 goto done; 499 } 500 continue; 501 } 502 } 503 splx(s); 504 break; 505 case PFSYNC_ACT_UPD: 506 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 507 count * sizeof(*sp), &offp)) == NULL) { 508 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 509 return; 510 } 511 512 s = splsoftnet(); 513 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 514 i < count; i++, sp++) { 515 int flags = PFSYNC_FLAG_STALE; 516 517 /* check for invalid values */ 518 if (sp->timeout >= PFTM_MAX || 519 sp->src.state > PF_TCPS_PROXY_DST || 520 sp->dst.state > PF_TCPS_PROXY_DST) { 521 if (pf_status.debug >= PF_DEBUG_MISC) 522 printf("pfsync_insert: PFSYNC_ACT_UPD: " 523 "invalid value\n"); 524 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 525 continue; 526 } 527 528 memcpy(&id_key.id, sp->id, sizeof(id_key.id)); 529 id_key.creatorid = sp->creatorid; 530 531 st = pf_find_state_byid(&id_key); 532 if (st == NULL) { 533 /* insert the update */ 534 if (pfsync_insert_net_state(sp, chksum_flag)) { 535 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 536 } 537 continue; 538 } 539 sk = st->state_key; 540 sfail = 0; 541 if (sk->proto == IPPROTO_TCP) { 542 /* 543 * The state should never go backwards except 544 * for syn-proxy states. Neither should the 545 * sequence window slide backwards. 546 */ 547 if (st->src.state > sp->src.state && 548 (st->src.state < PF_TCPS_PROXY_SRC || 549 sp->src.state >= PF_TCPS_PROXY_SRC)) 550 sfail = 1; 551 else if (SEQ_GT(st->src.seqlo, 552 ntohl(sp->src.seqlo))) 553 sfail = 3; 554 else if (st->dst.state > sp->dst.state) { 555 /* There might still be useful 556 * information about the src state here, 557 * so import that part of the update, 558 * then "fail" so we send the updated 559 * state back to the peer who is missing 560 * our what we know. */ 561 pf_state_peer_ntoh(&sp->src, &st->src); 562 /* XXX do anything with timeouts? */ 563 sfail = 7; 564 flags = 0; 565 } else if (st->dst.state >= TCPS_SYN_SENT && 566 SEQ_GT(st->dst.seqlo, ntohl(sp->dst.seqlo))) 567 sfail = 4; 568 } else { 569 /* 570 * Non-TCP protocol state machine always go 571 * forwards 572 */ 573 if (st->src.state > sp->src.state) 574 sfail = 5; 575 else if (st->dst.state > sp->dst.state) 576 sfail = 6; 577 } 578 if (sfail) { 579 if (pf_status.debug >= PF_DEBUG_MISC) 580 printf("pfsync: %s stale update " 581 "(%d) id: %016" PRIu64 "" 582 "creatorid: %08x\n", 583 (sfail < 7 ? "ignoring" 584 : "partial"), sfail, 585 be64toh(st->id), 586 ntohl(st->creatorid)); 587 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 588 589 if (!(sp->sync_flags & PFSTATE_STALE)) { 590 /* we have a better state, send it */ 591 if (sc->sc_mbuf != NULL && !stale) 592 pfsync_sendout(sc); 593 stale++; 594 if (!st->sync_flags) 595 pfsync_pack_state( 596 PFSYNC_ACT_UPD, st, flags); 597 } 598 continue; 599 } 600 pfsync_alloc_scrub_memory(&sp->dst, &st->dst); 601 pf_state_peer_ntoh(&sp->src, &st->src); 602 pf_state_peer_ntoh(&sp->dst, &st->dst); 603 st->expire = ntohl(sp->expire) + time_second; 604 st->timeout = sp->timeout; 605 } 606 if (stale && sc->sc_mbuf != NULL) 607 pfsync_sendout(sc); 608 splx(s); 609 break; 610 /* 611 * It's not strictly necessary for us to support the "uncompressed" 612 * delete action, but it's relatively simple and maintains consistency. 613 */ 614 case PFSYNC_ACT_DEL: 615 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 616 count * sizeof(*sp), &offp)) == NULL) { 617 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 618 return; 619 } 620 621 s = splsoftnet(); 622 for (i = 0, sp = (struct pfsync_state *)(mp->m_data + offp); 623 i < count; i++, sp++) { 624 memcpy(&id_key.id, sp->id, sizeof(id_key.id)); 625 id_key.creatorid = sp->creatorid; 626 627 st = pf_find_state_byid(&id_key); 628 if (st == NULL) { 629 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 630 continue; 631 } 632 st->sync_flags |= PFSTATE_FROMSYNC; 633 pf_unlink_state(st); 634 } 635 splx(s); 636 break; 637 case PFSYNC_ACT_UPD_C: { 638 int update_requested = 0; 639 640 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 641 count * sizeof(*up), &offp)) == NULL) { 642 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 643 return; 644 } 645 646 s = splsoftnet(); 647 for (i = 0, up = (struct pfsync_state_upd *)(mp->m_data + offp); 648 i < count; i++, up++) { 649 /* check for invalid values */ 650 if (up->timeout >= PFTM_MAX || 651 up->src.state > PF_TCPS_PROXY_DST || 652 up->dst.state > PF_TCPS_PROXY_DST) { 653 if (pf_status.debug >= PF_DEBUG_MISC) 654 printf("pfsync_insert: " 655 "PFSYNC_ACT_UPD_C: " 656 "invalid value\n"); 657 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 658 continue; 659 } 660 661 memcpy(&id_key.id, up->id, sizeof(id_key.id)); 662 id_key.creatorid = up->creatorid; 663 664 st = pf_find_state_byid(&id_key); 665 if (st == NULL) { 666 /* We don't have this state. Ask for it. */ 667 error = pfsync_request_update(up, &src); 668 if (error == ENOMEM) { 669 splx(s); 670 goto done; 671 } 672 update_requested = 1; 673 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 674 continue; 675 } 676 sk = st->state_key; 677 sfail = 0; 678 if (sk->proto == IPPROTO_TCP) { 679 /* 680 * The state should never go backwards except 681 * for syn-proxy states. Neither should the 682 * sequence window slide backwards. 683 */ 684 if (st->src.state > up->src.state && 685 (st->src.state < PF_TCPS_PROXY_SRC || 686 up->src.state >= PF_TCPS_PROXY_SRC)) 687 sfail = 1; 688 else if (st->dst.state > up->dst.state) 689 sfail = 2; 690 else if (SEQ_GT(st->src.seqlo, 691 ntohl(up->src.seqlo))) 692 sfail = 3; 693 else if (st->dst.state >= TCPS_SYN_SENT && 694 SEQ_GT(st->dst.seqlo, ntohl(up->dst.seqlo))) 695 sfail = 4; 696 } else { 697 /* 698 * Non-TCP protocol state machine always go 699 * forwards 700 */ 701 if (st->src.state > up->src.state) 702 sfail = 5; 703 else if (st->dst.state > up->dst.state) 704 sfail = 6; 705 } 706 if (sfail) { 707 if (pf_status.debug >= PF_DEBUG_MISC) 708 printf("pfsync: ignoring stale update " 709 "(%d) id: %016" PRIu64 "" 710 "creatorid: %08x\n", sfail, 711 be64toh(st->id), 712 ntohl(st->creatorid)); 713 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 714 715 /* we have a better state, send it out */ 716 if ((!stale || update_requested) && 717 sc->sc_mbuf != NULL) { 718 pfsync_sendout(sc); 719 update_requested = 0; 720 } 721 stale++; 722 if (!st->sync_flags) 723 pfsync_pack_state(PFSYNC_ACT_UPD, st, 724 PFSYNC_FLAG_STALE); 725 continue; 726 } 727 pfsync_alloc_scrub_memory(&up->dst, &st->dst); 728 pf_state_peer_ntoh(&up->src, &st->src); 729 pf_state_peer_ntoh(&up->dst, &st->dst); 730 st->expire = ntohl(up->expire) + time_second; 731 st->timeout = up->timeout; 732 } 733 if ((update_requested || stale) && sc->sc_mbuf) 734 pfsync_sendout(sc); 735 splx(s); 736 break; 737 } 738 case PFSYNC_ACT_DEL_C: 739 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 740 count * sizeof(*dp), &offp)) == NULL) { 741 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 742 return; 743 } 744 745 s = splsoftnet(); 746 for (i = 0, dp = (struct pfsync_state_del *)(mp->m_data + offp); 747 i < count; i++, dp++) { 748 memcpy(&id_key.id, dp->id, sizeof(id_key.id)); 749 id_key.creatorid = dp->creatorid; 750 751 st = pf_find_state_byid(&id_key); 752 if (st == NULL) { 753 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 754 continue; 755 } 756 st->sync_flags |= PFSTATE_FROMSYNC; 757 pf_unlink_state(st); 758 } 759 splx(s); 760 break; 761 case PFSYNC_ACT_INS_F: 762 case PFSYNC_ACT_DEL_F: 763 /* not implemented */ 764 break; 765 case PFSYNC_ACT_UREQ: 766 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 767 count * sizeof(*rup), &offp)) == NULL) { 768 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 769 return; 770 } 771 772 s = splsoftnet(); 773 if (sc->sc_mbuf != NULL) 774 pfsync_sendout(sc); 775 for (i = 0, 776 rup = (struct pfsync_state_upd_req *)(mp->m_data + offp); 777 i < count; i++, rup++) { 778 memcpy(&id_key.id, rup->id, sizeof(id_key.id)); 779 id_key.creatorid = rup->creatorid; 780 781 if (id_key.id == 0 && id_key.creatorid == 0) { 782 sc->sc_ureq_received = time_uptime; 783 if (sc->sc_bulk_send_next == NULL) 784 sc->sc_bulk_send_next = 785 TAILQ_FIRST(&state_list); 786 sc->sc_bulk_terminator = sc->sc_bulk_send_next; 787 if (pf_status.debug >= PF_DEBUG_MISC) 788 printf("pfsync: received " 789 "bulk update request\n"); 790 pfsync_send_bus(sc, PFSYNC_BUS_START); 791 callout_schedule(&sc->sc_bulk_tmo, 1 * hz); 792 } else { 793 st = pf_find_state_byid(&id_key); 794 if (st == NULL) { 795 PFSYNC_STATINC(PFSYNC_STAT_BADSTATE); 796 continue; 797 } 798 if (!st->sync_flags) 799 pfsync_pack_state(PFSYNC_ACT_UPD, 800 st, 0); 801 } 802 } 803 if (sc->sc_mbuf != NULL) 804 pfsync_sendout(sc); 805 splx(s); 806 break; 807 case PFSYNC_ACT_BUS: 808 /* If we're not waiting for a bulk update, who cares. */ 809 if (sc->sc_ureq_sent == 0) 810 break; 811 812 if ((mp = m_pulldown(m, iplen + sizeof(*ph), 813 sizeof(*bus), &offp)) == NULL) { 814 PFSYNC_STATINC(PFSYNC_STAT_BADLEN); 815 return; 816 } 817 bus = (struct pfsync_state_bus *)(mp->m_data + offp); 818 switch (bus->status) { 819 case PFSYNC_BUS_START: 820 callout_schedule(&sc->sc_bulkfail_tmo, 821 pf_pool_limits[PF_LIMIT_STATES].limit / 822 (PFSYNC_BULKPACKETS * sc->sc_maxcount)); 823 if (pf_status.debug >= PF_DEBUG_MISC) 824 printf("pfsync: received bulk " 825 "update start\n"); 826 break; 827 case PFSYNC_BUS_END: 828 if (time_uptime - ntohl(bus->endtime) >= 829 sc->sc_ureq_sent) { 830 /* that's it, we're happy */ 831 sc->sc_ureq_sent = 0; 832 sc->sc_bulk_tries = 0; 833 callout_stop(&sc->sc_bulkfail_tmo); 834 #if NCARP > 0 835 if (!pfsync_sync_ok) 836 carp_suppress_preempt--; 837 #endif 838 pfsync_sync_ok = 1; 839 if (pf_status.debug >= PF_DEBUG_MISC) 840 printf("pfsync: received valid " 841 "bulk update end\n"); 842 } else { 843 if (pf_status.debug >= PF_DEBUG_MISC) 844 printf("pfsync: received invalid " 845 "bulk update end: bad timestamp\n"); 846 } 847 break; 848 } 849 break; 850 } 851 852 done: 853 m_freem(m); 854 } 855 856 int 857 pfsyncoutput(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 858 const struct rtentry *rt) 859 { 860 m_freem(m); 861 return (0); 862 } 863 864 /* ARGSUSED */ 865 int 866 pfsyncioctl(struct ifnet *ifp, u_long cmd, void* data) 867 { 868 struct lwp *l = curlwp; 869 struct pfsync_softc *sc = ifp->if_softc; 870 struct ifreq *ifr = (struct ifreq *)data; 871 struct ip_moptions *imo = &sc->sc_imo; 872 struct pfsyncreq pfsyncr; 873 struct ifnet *sifp; 874 int s, error; 875 876 switch (cmd) { 877 case SIOCSIFADDR: 878 case SIOCAIFADDR: 879 case SIOCSIFDSTADDR: 880 case SIOCSIFFLAGS: 881 if (ifp->if_flags & IFF_UP) 882 ifp->if_flags |= IFF_RUNNING; 883 else 884 ifp->if_flags &= ~IFF_RUNNING; 885 break; 886 case SIOCSIFMTU: 887 if (ifr->ifr_mtu < PFSYNC_MINMTU) 888 return (EINVAL); 889 if (ifr->ifr_mtu > MCLBYTES) 890 ifr->ifr_mtu = MCLBYTES; 891 s = splnet(); 892 if (ifr->ifr_mtu < ifp->if_mtu) 893 pfsync_sendout(sc); 894 pfsync_setmtu(sc, ifr->ifr_mtu); 895 splx(s); 896 break; 897 case SIOCGETPFSYNC: 898 if ((error = kauth_authorize_network(l->l_cred, 899 KAUTH_NETWORK_INTERFACE, 900 KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, (void *)cmd, 901 NULL)) != 0) 902 return (error); 903 memset(&pfsyncr, 0, sizeof(pfsyncr)); 904 if (sc->sc_sync_ifp) 905 strlcpy(pfsyncr.pfsyncr_syncdev, 906 sc->sc_sync_ifp->if_xname, IFNAMSIZ); 907 pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer; 908 pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates; 909 if ((error = copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr)))) 910 return (error); 911 break; 912 case SIOCSETPFSYNC: 913 if ((error = kauth_authorize_network(l->l_cred, 914 KAUTH_NETWORK_INTERFACE, 915 KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd, 916 NULL)) != 0) 917 return (error); 918 if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr)))) 919 return (error); 920 921 if (pfsyncr.pfsyncr_syncpeer.s_addr == 0) 922 sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP; 923 else 924 sc->sc_sync_peer.s_addr = 925 pfsyncr.pfsyncr_syncpeer.s_addr; 926 927 if (pfsyncr.pfsyncr_maxupdates > 255) 928 return (EINVAL); 929 sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates; 930 931 if (pfsyncr.pfsyncr_syncdev[0] == 0) { 932 sc->sc_sync_ifp = NULL; 933 if (sc->sc_mbuf_net != NULL) { 934 /* Don't keep stale pfsync packets around. */ 935 s = splnet(); 936 m_freem(sc->sc_mbuf_net); 937 sc->sc_mbuf_net = NULL; 938 sc->sc_statep_net.s = NULL; 939 splx(s); 940 } 941 if (imo->imo_num_memberships > 0) { 942 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]); 943 imo->imo_multicast_if_index = 0; 944 } 945 break; 946 } 947 948 if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL) 949 return (EINVAL); 950 951 s = splnet(); 952 if (sifp->if_mtu < sc->sc_if.if_mtu || 953 (sc->sc_sync_ifp != NULL && 954 sifp->if_mtu < sc->sc_sync_ifp->if_mtu) || 955 sifp->if_mtu < MCLBYTES - sizeof(struct ip)) 956 pfsync_sendout(sc); 957 sc->sc_sync_ifp = sifp; 958 959 pfsync_setmtu(sc, sc->sc_if.if_mtu); 960 961 if (imo->imo_num_memberships > 0) { 962 in_delmulti(imo->imo_membership[--imo->imo_num_memberships]); 963 imo->imo_multicast_if_index = 0; 964 } 965 966 if (sc->sc_sync_ifp && 967 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) { 968 struct in_addr addr; 969 970 if (!(sc->sc_sync_ifp->if_flags & IFF_MULTICAST)) { 971 sc->sc_sync_ifp = NULL; 972 splx(s); 973 return (EADDRNOTAVAIL); 974 } 975 976 addr.s_addr = INADDR_PFSYNC_GROUP; 977 978 if ((imo->imo_membership[0] = 979 in_addmulti(&addr, sc->sc_sync_ifp)) == NULL) { 980 sc->sc_sync_ifp = NULL; 981 splx(s); 982 return (ENOBUFS); 983 } 984 imo->imo_num_memberships++; 985 imo->imo_multicast_if_index = if_get_index(sc->sc_sync_ifp); 986 imo->imo_multicast_ttl = PFSYNC_DFLTTL; 987 imo->imo_multicast_loop = 0; 988 } 989 990 if (sc->sc_sync_ifp || 991 sc->sc_sendaddr.s_addr != INADDR_PFSYNC_GROUP) { 992 /* Request a full state table update. */ 993 sc->sc_ureq_sent = time_uptime; 994 #if NCARP > 0 995 if (pfsync_sync_ok) 996 carp_suppress_preempt ++; 997 #endif 998 pfsync_sync_ok = 0; 999 if (pf_status.debug >= PF_DEBUG_MISC) 1000 printf("pfsync: requesting bulk update\n"); 1001 callout_schedule(&sc->sc_bulkfail_tmo, 5 * hz); 1002 error = pfsync_request_update(NULL, NULL); 1003 if (error == ENOMEM) { 1004 splx(s); 1005 return (ENOMEM); 1006 } 1007 pfsync_sendout(sc); 1008 } 1009 splx(s); 1010 1011 break; 1012 1013 default: 1014 return ifioctl_common(ifp, cmd, data); 1015 } 1016 1017 return (0); 1018 } 1019 1020 void 1021 pfsync_setmtu(struct pfsync_softc *sc, int mtu_req) 1022 { 1023 int mtu; 1024 1025 if (sc->sc_sync_ifp && sc->sc_sync_ifp->if_mtu < mtu_req) 1026 mtu = sc->sc_sync_ifp->if_mtu; 1027 else 1028 mtu = mtu_req; 1029 1030 sc->sc_maxcount = (mtu - sizeof(struct pfsync_header)) / 1031 sizeof(struct pfsync_state); 1032 if (sc->sc_maxcount > 254) 1033 sc->sc_maxcount = 254; 1034 sc->sc_if.if_mtu = sizeof(struct pfsync_header) + 1035 sc->sc_maxcount * sizeof(struct pfsync_state); 1036 } 1037 1038 struct mbuf * 1039 pfsync_get_mbuf(struct pfsync_softc *sc, u_int8_t action, void **sp) 1040 { 1041 struct pfsync_header *h; 1042 struct mbuf *m; 1043 int len; 1044 1045 MGETHDR(m, M_DONTWAIT, MT_DATA); 1046 if (m == NULL) { 1047 #ifdef __NetBSD__ 1048 if_statinc(&sc->sc_if, if_oerrors); 1049 #else 1050 sc->sc_if.if_oerrors++; 1051 #endif /* __NetBSD__ */ 1052 return (NULL); 1053 } 1054 1055 switch (action) { 1056 case PFSYNC_ACT_CLR: 1057 len = sizeof(struct pfsync_header) + 1058 sizeof(struct pfsync_state_clr); 1059 break; 1060 case PFSYNC_ACT_UPD_C: 1061 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd)) + 1062 sizeof(struct pfsync_header); 1063 break; 1064 case PFSYNC_ACT_DEL_C: 1065 len = (sc->sc_maxcount * sizeof(struct pfsync_state_del)) + 1066 sizeof(struct pfsync_header); 1067 break; 1068 case PFSYNC_ACT_UREQ: 1069 len = (sc->sc_maxcount * sizeof(struct pfsync_state_upd_req)) + 1070 sizeof(struct pfsync_header); 1071 break; 1072 case PFSYNC_ACT_BUS: 1073 len = sizeof(struct pfsync_header) + 1074 sizeof(struct pfsync_state_bus); 1075 break; 1076 case PFSYNC_ACT_TDB_UPD: 1077 len = (sc->sc_maxcount * sizeof(struct pfsync_tdb)) + 1078 sizeof(struct pfsync_header); 1079 break; 1080 default: 1081 len = (sc->sc_maxcount * sizeof(struct pfsync_state)) + 1082 sizeof(struct pfsync_header); 1083 break; 1084 } 1085 1086 if (len > MHLEN) { 1087 MCLGET(m, M_DONTWAIT); 1088 if ((m->m_flags & M_EXT) == 0) { 1089 m_free(m); 1090 #ifdef __NetBSD__ 1091 if_statinc(&sc->sc_if, if_oerrors); 1092 #else 1093 sc->sc_if.if_oerrors++; 1094 #endif /* __NetBSD__ */ 1095 return (NULL); 1096 } 1097 m->m_data += (MCLBYTES - len) &~ (sizeof(long) - 1); 1098 } else 1099 m_align(m, len); 1100 1101 m_reset_rcvif(m); 1102 m->m_pkthdr.len = m->m_len = sizeof(struct pfsync_header); 1103 h = mtod(m, struct pfsync_header *); 1104 h->version = PFSYNC_VERSION; 1105 h->af = 0; 1106 h->count = 0; 1107 h->action = action; 1108 if (action != PFSYNC_ACT_TDB_UPD) 1109 memcpy(&h->pf_chksum, &pf_status.pf_chksum, 1110 PF_MD5_DIGEST_LENGTH); 1111 1112 *sp = (void *)((char *)h + PFSYNC_HDRLEN); 1113 if (action == PFSYNC_ACT_TDB_UPD) 1114 callout_schedule(&sc->sc_tdb_tmo, hz); 1115 else 1116 callout_schedule(&sc->sc_tmo, hz); 1117 return (m); 1118 } 1119 1120 int 1121 pfsync_pack_state(u_int8_t action, struct pf_state *st, int flags) 1122 { 1123 struct ifnet *ifp = NULL; 1124 struct pfsync_softc *sc = pfsyncif; 1125 struct pfsync_header *h, *h_net; 1126 struct pfsync_state *sp = NULL; 1127 struct pfsync_state_upd *up = NULL; 1128 struct pfsync_state_del *dp = NULL; 1129 struct pf_state_key *sk = st->state_key; 1130 struct pf_rule *r; 1131 u_long secs; 1132 int s, ret = 0; 1133 u_int8_t i = 255, newaction = 0; 1134 1135 if (sc == NULL) 1136 return (0); 1137 ifp = &sc->sc_if; 1138 1139 /* 1140 * If a packet falls in the forest and there's nobody around to 1141 * hear, does it make a sound? 1142 */ 1143 if (ifp->if_bpf == NULL && sc->sc_sync_ifp == NULL && 1144 sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) { 1145 /* Don't leave any stale pfsync packets hanging around. */ 1146 if (sc->sc_mbuf != NULL) { 1147 m_freem(sc->sc_mbuf); 1148 sc->sc_mbuf = NULL; 1149 sc->sc_statep.s = NULL; 1150 } 1151 return (0); 1152 } 1153 1154 if (action >= PFSYNC_ACT_MAX) 1155 return (EINVAL); 1156 1157 s = splnet(); 1158 if (sc->sc_mbuf == NULL) { 1159 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action, 1160 (void *)&sc->sc_statep.s)) == NULL) { 1161 splx(s); 1162 return (ENOMEM); 1163 } 1164 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1165 } else { 1166 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1167 if (h->action != action) { 1168 pfsync_sendout(sc); 1169 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, action, 1170 (void *)&sc->sc_statep.s)) == NULL) { 1171 splx(s); 1172 return (ENOMEM); 1173 } 1174 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1175 } else { 1176 /* 1177 * If it's an update, look in the packet to see if 1178 * we already have an update for the state. 1179 */ 1180 if (action == PFSYNC_ACT_UPD && sc->sc_maxupdates) { 1181 struct pfsync_state *usp = 1182 (void *)((char *)h + PFSYNC_HDRLEN); 1183 1184 for (i = 0; i < h->count; i++) { 1185 if (!memcmp(usp->id, &st->id, 1186 PFSYNC_ID_LEN) && 1187 usp->creatorid == st->creatorid) { 1188 sp = usp; 1189 sp->updates++; 1190 break; 1191 } 1192 usp++; 1193 } 1194 } 1195 } 1196 } 1197 1198 secs = time_second; 1199 1200 st->pfsync_time = time_uptime; 1201 1202 if (sp == NULL) { 1203 /* not a "duplicate" update */ 1204 i = 255; 1205 sp = sc->sc_statep.s++; 1206 sc->sc_mbuf->m_pkthdr.len = 1207 sc->sc_mbuf->m_len += sizeof(struct pfsync_state); 1208 h->count++; 1209 memset(sp, 0, sizeof(*sp)); 1210 1211 memcpy(sp->id, &st->id, sizeof(sp->id)); 1212 sp->creatorid = st->creatorid; 1213 1214 strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname)); 1215 pf_state_host_hton(&sk->lan, &sp->lan); 1216 pf_state_host_hton(&sk->gwy, &sp->gwy); 1217 pf_state_host_hton(&sk->ext, &sp->ext); 1218 1219 memcpy(&sp->rt_addr, &st->rt_addr, sizeof(sp->rt_addr)); 1220 1221 sp->creation = htonl(secs - st->creation); 1222 pf_state_counter_hton(st->packets[0], sp->packets[0]); 1223 pf_state_counter_hton(st->packets[1], sp->packets[1]); 1224 pf_state_counter_hton(st->bytes[0], sp->bytes[0]); 1225 pf_state_counter_hton(st->bytes[1], sp->bytes[1]); 1226 if ((r = st->rule.ptr) == NULL) 1227 sp->rule = htonl(-1); 1228 else 1229 sp->rule = htonl(r->nr); 1230 if ((r = st->anchor.ptr) == NULL) 1231 sp->anchor = htonl(-1); 1232 else 1233 sp->anchor = htonl(r->nr); 1234 sp->af = sk->af; 1235 sp->proto = sk->proto; 1236 sp->direction = sk->direction; 1237 sp->log = st->log; 1238 sp->allow_opts = st->allow_opts; 1239 sp->timeout = st->timeout; 1240 1241 if (flags & PFSYNC_FLAG_STALE) 1242 sp->sync_flags |= PFSTATE_STALE; 1243 } 1244 1245 pf_state_peer_hton(&st->src, &sp->src); 1246 pf_state_peer_hton(&st->dst, &sp->dst); 1247 1248 if (st->expire <= secs) 1249 sp->expire = htonl(0); 1250 else 1251 sp->expire = htonl(st->expire - secs); 1252 1253 /* do we need to build "compressed" actions for network transfer? */ 1254 if (sc->sc_sync_ifp && flags & PFSYNC_FLAG_COMPRESS) { 1255 switch (action) { 1256 case PFSYNC_ACT_UPD: 1257 newaction = PFSYNC_ACT_UPD_C; 1258 break; 1259 case PFSYNC_ACT_DEL: 1260 newaction = PFSYNC_ACT_DEL_C; 1261 break; 1262 default: 1263 /* by default we just send the uncompressed states */ 1264 break; 1265 } 1266 } 1267 1268 if (newaction) { 1269 if (sc->sc_mbuf_net == NULL) { 1270 if ((sc->sc_mbuf_net = pfsync_get_mbuf(sc, newaction, 1271 (void *)&sc->sc_statep_net.s)) == NULL) { 1272 splx(s); 1273 return (ENOMEM); 1274 } 1275 } 1276 h_net = mtod(sc->sc_mbuf_net, struct pfsync_header *); 1277 1278 switch (newaction) { 1279 case PFSYNC_ACT_UPD_C: 1280 if (i != 255) { 1281 up = (void *)((char *)h_net + 1282 PFSYNC_HDRLEN + (i * sizeof(*up))); 1283 up->updates++; 1284 } else { 1285 h_net->count++; 1286 sc->sc_mbuf_net->m_pkthdr.len = 1287 sc->sc_mbuf_net->m_len += sizeof(*up); 1288 up = sc->sc_statep_net.u++; 1289 1290 memset(up, 0, sizeof(*up)); 1291 memcpy(up->id, &st->id, sizeof(up->id)); 1292 up->creatorid = st->creatorid; 1293 } 1294 up->timeout = st->timeout; 1295 up->expire = sp->expire; 1296 up->src = sp->src; 1297 up->dst = sp->dst; 1298 break; 1299 case PFSYNC_ACT_DEL_C: 1300 sc->sc_mbuf_net->m_pkthdr.len = 1301 sc->sc_mbuf_net->m_len += sizeof(*dp); 1302 dp = sc->sc_statep_net.d++; 1303 h_net->count++; 1304 1305 memset(dp, 0, sizeof(*dp)); 1306 memcpy(dp->id, &st->id, sizeof(dp->id)); 1307 dp->creatorid = st->creatorid; 1308 break; 1309 } 1310 } 1311 1312 if (h->count == sc->sc_maxcount || 1313 (sc->sc_maxupdates && (sp->updates >= sc->sc_maxupdates))) 1314 ret = pfsync_sendout(sc); 1315 1316 splx(s); 1317 return (ret); 1318 } 1319 1320 /* This must be called in splnet() */ 1321 int 1322 pfsync_request_update(struct pfsync_state_upd *up, struct in_addr *src) 1323 { 1324 struct pfsync_header *h; 1325 struct pfsync_softc *sc = pfsyncif; 1326 struct pfsync_state_upd_req *rup; 1327 int ret = 0; 1328 1329 if (sc == NULL) 1330 return (0); 1331 1332 if (sc->sc_mbuf == NULL) { 1333 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ, 1334 (void *)&sc->sc_statep.s)) == NULL) 1335 return (ENOMEM); 1336 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1337 } else { 1338 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1339 if (h->action != PFSYNC_ACT_UREQ) { 1340 pfsync_sendout(sc); 1341 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_UREQ, 1342 (void *)&sc->sc_statep.s)) == NULL) 1343 return (ENOMEM); 1344 h = mtod(sc->sc_mbuf, struct pfsync_header *); 1345 } 1346 } 1347 1348 if (src != NULL) 1349 sc->sc_sendaddr = *src; 1350 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*rup); 1351 h->count++; 1352 rup = sc->sc_statep.r++; 1353 memset(rup, 0, sizeof(*rup)); 1354 if (up != NULL) { 1355 memcpy(rup->id, up->id, sizeof(rup->id)); 1356 rup->creatorid = up->creatorid; 1357 } 1358 1359 if (h->count == sc->sc_maxcount) 1360 ret = pfsync_sendout(sc); 1361 1362 return (ret); 1363 } 1364 1365 int 1366 pfsync_clear_states(u_int32_t creatorid, char *ifname) 1367 { 1368 struct pfsync_softc *sc = pfsyncif; 1369 struct pfsync_state_clr *cp; 1370 int s, ret; 1371 1372 if (sc == NULL) 1373 return (0); 1374 1375 s = splnet(); 1376 if (sc->sc_mbuf != NULL) 1377 pfsync_sendout(sc); 1378 if ((sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_CLR, 1379 (void *)&sc->sc_statep.c)) == NULL) { 1380 splx(s); 1381 return (ENOMEM); 1382 } 1383 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*cp); 1384 cp = sc->sc_statep.c; 1385 cp->creatorid = creatorid; 1386 if (ifname != NULL) 1387 strlcpy(cp->ifname, ifname, IFNAMSIZ); 1388 1389 ret = (pfsync_sendout(sc)); 1390 splx(s); 1391 return (ret); 1392 } 1393 1394 void 1395 pfsync_timeout(void *v) 1396 { 1397 struct pfsync_softc *sc = v; 1398 int s; 1399 1400 s = splnet(); 1401 pfsync_sendout(sc); 1402 splx(s); 1403 } 1404 1405 void 1406 pfsync_tdb_timeout(void *v) 1407 { 1408 struct pfsync_softc *sc = v; 1409 int s; 1410 1411 s = splnet(); 1412 pfsync_tdb_sendout(sc); 1413 splx(s); 1414 } 1415 1416 /* This must be called in splnet() */ 1417 void 1418 pfsync_send_bus(struct pfsync_softc *sc, u_int8_t status) 1419 { 1420 struct pfsync_state_bus *bus; 1421 1422 if (sc->sc_mbuf != NULL) 1423 pfsync_sendout(sc); 1424 1425 if (pfsync_sync_ok && 1426 (sc->sc_mbuf = pfsync_get_mbuf(sc, PFSYNC_ACT_BUS, 1427 (void *)&sc->sc_statep.b)) != NULL) { 1428 sc->sc_mbuf->m_pkthdr.len = sc->sc_mbuf->m_len += sizeof(*bus); 1429 bus = sc->sc_statep.b; 1430 bus->creatorid = pf_status.hostid; 1431 bus->status = status; 1432 bus->endtime = htonl(time_uptime - sc->sc_ureq_received); 1433 pfsync_sendout(sc); 1434 } 1435 } 1436 1437 void 1438 pfsync_bulk_update(void *v) 1439 { 1440 struct pfsync_softc *sc = v; 1441 int s, i = 0; 1442 struct pf_state *state; 1443 1444 s = splnet(); 1445 if (sc->sc_mbuf != NULL) 1446 pfsync_sendout(sc); 1447 1448 /* 1449 * Grab at most PFSYNC_BULKPACKETS worth of states which have not 1450 * been sent since the latest request was made. 1451 */ 1452 state = sc->sc_bulk_send_next; 1453 if (state) 1454 do { 1455 /* send state update if syncable and not already sent */ 1456 if (!state->sync_flags 1457 && state->timeout < PFTM_MAX 1458 && state->pfsync_time <= sc->sc_ureq_received) { 1459 pfsync_pack_state(PFSYNC_ACT_UPD, state, 0); 1460 i++; 1461 } 1462 1463 /* figure next state to send */ 1464 state = TAILQ_NEXT(state, entry_list); 1465 1466 /* wrap to start of list if we hit the end */ 1467 if (!state) 1468 state = TAILQ_FIRST(&state_list); 1469 } while (i < sc->sc_maxcount * PFSYNC_BULKPACKETS && 1470 state != sc->sc_bulk_terminator); 1471 1472 if (!state || state == sc->sc_bulk_terminator) { 1473 /* we're done */ 1474 pfsync_send_bus(sc, PFSYNC_BUS_END); 1475 sc->sc_ureq_received = 0; 1476 sc->sc_bulk_send_next = NULL; 1477 sc->sc_bulk_terminator = NULL; 1478 callout_stop(&sc->sc_bulk_tmo); 1479 if (pf_status.debug >= PF_DEBUG_MISC) 1480 printf("pfsync: bulk update complete\n"); 1481 } else { 1482 /* look again for more in a bit */ 1483 callout_schedule(&sc->sc_bulk_tmo, 1); 1484 sc->sc_bulk_send_next = state; 1485 } 1486 if (sc->sc_mbuf != NULL) 1487 pfsync_sendout(sc); 1488 splx(s); 1489 } 1490 1491 void 1492 pfsync_bulkfail(void *v) 1493 { 1494 struct pfsync_softc *sc = v; 1495 int s, error; 1496 1497 if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) { 1498 /* Try again in a bit */ 1499 callout_schedule(&sc->sc_bulkfail_tmo, 5 * hz); 1500 s = splnet(); 1501 error = pfsync_request_update(NULL, NULL); 1502 if (error == ENOMEM) { 1503 if (pf_status.debug >= PF_DEBUG_MISC) 1504 printf("pfsync: cannot allocate mbufs for " 1505 "bulk update\n"); 1506 } else 1507 pfsync_sendout(sc); 1508 splx(s); 1509 } else { 1510 /* Pretend like the transfer was ok */ 1511 sc->sc_ureq_sent = 0; 1512 sc->sc_bulk_tries = 0; 1513 #if NCARP > 0 1514 if (!pfsync_sync_ok) 1515 carp_suppress_preempt --; 1516 #endif 1517 pfsync_sync_ok = 1; 1518 if (pf_status.debug >= PF_DEBUG_MISC) 1519 printf("pfsync: failed to receive " 1520 "bulk update status\n"); 1521 callout_stop(&sc->sc_bulkfail_tmo); 1522 } 1523 } 1524 1525 /* This must be called in splnet() */ 1526 int 1527 pfsync_sendout(struct pfsync_softc *sc) 1528 { 1529 struct ifnet *ifp = &sc->sc_if; 1530 struct mbuf *m; 1531 1532 callout_stop(&sc->sc_tmo); 1533 1534 if (sc->sc_mbuf == NULL) 1535 return (0); 1536 m = sc->sc_mbuf; 1537 sc->sc_mbuf = NULL; 1538 sc->sc_statep.s = NULL; 1539 1540 bpf_mtap(ifp, m, BPF_D_OUT); 1541 1542 if (sc->sc_mbuf_net) { 1543 m_freem(m); 1544 m = sc->sc_mbuf_net; 1545 sc->sc_mbuf_net = NULL; 1546 sc->sc_statep_net.s = NULL; 1547 } 1548 1549 return pfsync_sendout_mbuf(sc, m); 1550 } 1551 1552 int 1553 pfsync_tdb_sendout(struct pfsync_softc *sc) 1554 { 1555 struct ifnet *ifp = &sc->sc_if; 1556 struct mbuf *m; 1557 1558 callout_stop(&sc->sc_tdb_tmo); 1559 1560 if (sc->sc_mbuf_tdb == NULL) 1561 return (0); 1562 m = sc->sc_mbuf_tdb; 1563 sc->sc_mbuf_tdb = NULL; 1564 sc->sc_statep_tdb.t = NULL; 1565 1566 bpf_mtap(ifp, m, BPF_D_OUT); 1567 1568 return pfsync_sendout_mbuf(sc, m); 1569 } 1570 1571 int 1572 pfsync_sendout_mbuf(struct pfsync_softc *sc, struct mbuf *m) 1573 { 1574 struct sockaddr sa; 1575 struct ip *ip; 1576 1577 if (sc->sc_sync_ifp || 1578 sc->sc_sync_peer.s_addr != INADDR_PFSYNC_GROUP) { 1579 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 1580 if (m == NULL) { 1581 PFSYNC_STATINC(PFSYNC_STAT_ONOMEM); 1582 return (0); 1583 } 1584 ip = mtod(m, struct ip *); 1585 ip->ip_v = IPVERSION; 1586 ip->ip_hl = sizeof(*ip) >> 2; 1587 ip->ip_tos = IPTOS_LOWDELAY; 1588 ip->ip_len = htons(m->m_pkthdr.len); 1589 ip->ip_id = ip_randomid(); 1590 ip->ip_off = htons(IP_DF); 1591 ip->ip_ttl = PFSYNC_DFLTTL; 1592 ip->ip_p = IPPROTO_PFSYNC; 1593 ip->ip_sum = 0; 1594 1595 memset(&sa, 0, sizeof(sa)); 1596 ip->ip_src.s_addr = INADDR_ANY; 1597 1598 if (sc->sc_sendaddr.s_addr == INADDR_PFSYNC_GROUP) 1599 m->m_flags |= M_MCAST; 1600 ip->ip_dst = sc->sc_sendaddr; 1601 sc->sc_sendaddr.s_addr = sc->sc_sync_peer.s_addr; 1602 1603 PFSYNC_STATINC(PFSYNC_STAT_OPACKETS); 1604 1605 if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL)) { 1606 PFSYNC_STATINC(PFSYNC_STAT_OERRORS); 1607 } 1608 } else 1609 m_freem(m); 1610 1611 return (0); 1612 } 1613 1614 static int 1615 sysctl_net_inet_pfsync_stats(SYSCTLFN_ARGS) 1616 { 1617 1618 return (NETSTAT_SYSCTL(pfsyncstat_percpu, PFSYNC_NSTATS)); 1619 } 1620 1621 SYSCTL_SETUP(sysctl_net_inet_pfsync_setup, "sysctl net.inet.pfsync subtree setup") 1622 { 1623 1624 sysctl_createv(clog, 0, NULL, NULL, 1625 CTLFLAG_PERMANENT, 1626 CTLTYPE_NODE, "net", NULL, 1627 NULL, 0, NULL, 0, 1628 CTL_NET, CTL_EOL); 1629 sysctl_createv(clog, 0, NULL, NULL, 1630 CTLFLAG_PERMANENT, 1631 CTLTYPE_NODE, "inet", NULL, 1632 NULL, 0, NULL, 0, 1633 CTL_NET, PF_INET, CTL_EOL); 1634 sysctl_createv(clog, 0, NULL, NULL, 1635 CTLFLAG_PERMANENT, 1636 CTLTYPE_NODE, "pfsync", 1637 SYSCTL_DESCR("pfsync related settings"), 1638 NULL, 0, NULL, 0, 1639 CTL_NET, PF_INET, IPPROTO_PFSYNC, CTL_EOL); 1640 sysctl_createv(clog, 0, NULL, NULL, 1641 CTLFLAG_PERMANENT|CTLFLAG_READONLY, 1642 CTLTYPE_STRUCT, "stats", 1643 SYSCTL_DESCR("pfsync statistics"), 1644 sysctl_net_inet_pfsync_stats, 0, NULL, 0, 1645 CTL_NET, PF_INET, IPPROTO_PFSYNC, 1646 CTL_CREATE, CTL_EOL); 1647 } 1648
Indexes created Sat Sep 20 22:09:52 GMT 2025